@truto/sqlite-builder 2.0.2-canary.21 → 2.0.2-canary.24

package/README.md

@@ -1,28 +1,28 @@
-const results = db.prepare(complexQuery.text).all(...complexQuery.values)
-```
+To use the `regex` operator, you need to load a REGEXP extension in SQLite:
+
+```typescript
+// With better-sqlite3
+import sqlite3 from 'better-sqlite3'
 
-#### Kitchen Sink Examples
+const db = new sqlite3('database.db')
 
-Real-world complex filters:
+// Load REGEXP extension (varies by implementation)
+// This is implementation-specific - check your SQLite setup
+db.loadExtension('regexp') // Example - actual method may vary
 
-```typescript
-// Active users in specific regions, either minors/seniors or VIP
-const complexFilter = {
-  and: [
-    { status: 'ACTIVE' },
-    { or: [{ age: { lt: 18 } }, { age: { gte: 65 } }, { membership: 'VIP' }] },
-    { country: { in: ['US', 'CA', 'GB'] } },
-    { email: { exists: true } },
-    { 'profile.verified': true },
-  ],
+// Now regex filters work
+const filter = {
+  email: { regex: '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$' },
 }
+```
+
+## 🛡️ Security Model
+
+### What's Protected
 
-// Content filtering with multiple criteria
-const contentFilter = {
-  name: { like: 'Project%' },
-  category: { nin: ['ARCHIVED', 'DELETED', 'SPAM'] },
-  created_at: { exists: true },
-  or: [
-    { tags: { ilike: '%important%' } },
-    { priority: { gte: 8 } },
-    { 'metadata.featured': true },
+- **SQL Injection**: All interpolated values are parameterized
+- **Unforgeable fragments**: Only fragments created by this library can contribute raw SQL text. A plain `{ text, values }` object (e.g. from `JSON.parse` or a request body) is treated as a value, never as SQL, closing the structural duck-typing bypass
+- **Placeholder integrity**: The `sql` tag rejects any query whose `?` count does not match its bound-value count, catching raw fragments that smuggle or drop placeholders
+- **Safe `sql.join()` separators**: String separators are validated so they cannot introduce string literals, comments, statement terminators, or unbalanced parentheses; use a `SqlFragment` separator to parameterize the connector itself
+- **Stacked Queries**: Queries containing `;` followed by additional SQL are rejected (detection ignores semicolons inside string literals and comments)
+- **Identifier Safety**: `sql.ident()` validates against ANSI identifier rules and caps each part at 255 characters

package/package.json

@@ -1 +1 @@
-{"name":"@truto/sqlite-builder","version":"2.0.2-canary.21","description":"debug canary","license":"MIT","main":"index.js"}
+{"name":"@truto/sqlite-builder","version":"2.0.2-canary.24","description":"debug canary","license":"MIT","main":"index.js"}