@truto/sqlite-builder 2.0.2-canary.22 → 2.0.2-canary.24

package/README.md

@@ -1,28 +1,28 @@
-  ],
-}
-```
-
-### Integration with SQL Template
+To use the `regex` operator, you need to load a REGEXP extension in SQLite:
 
 ```typescript
-import { sql, compileFilter } from '@truto/sqlite-builder'
+// With better-sqlite3
+import sqlite3 from 'better-sqlite3'
+
+const db = new sqlite3('database.db')
 
-// Build the WHERE clause
+// Load REGEXP extension (varies by implementation)
+// This is implementation-specific - check your SQLite setup
+db.loadExtension('regexp') // Example - actual method may vary
+
+// Now regex filters work
 const filter = {
-  status: 'ACTIVE',
-  age: { gte: 18 },
-  role: { in: ['USER', 'ADMIN'] },
+  email: { regex: '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$' },
 }
+```
+
+## 🛡️ Security Model
 
-// Use in complete query — the filter fragment and the LIMIT value are
-// collected in order, so query.values lines up with the placeholders.
-const query = sql`
-  SELECT id, name, email, created_at
-  FROM users
-  WHERE ${compileFilter(filter)}
-  ORDER BY created_at DESC
-  LIMIT ${limit}
-`
+### What's Protected
 
-// Execute with driver
-const results = db.prepare(query.text).all(...query.values)
+- **SQL Injection**: All interpolated values are parameterized
+- **Unforgeable fragments**: Only fragments created by this library can contribute raw SQL text. A plain `{ text, values }` object (e.g. from `JSON.parse` or a request body) is treated as a value, never as SQL, closing the structural duck-typing bypass
+- **Placeholder integrity**: The `sql` tag rejects any query whose `?` count does not match its bound-value count, catching raw fragments that smuggle or drop placeholders
+- **Safe `sql.join()` separators**: String separators are validated so they cannot introduce string literals, comments, statement terminators, or unbalanced parentheses; use a `SqlFragment` separator to parameterize the connector itself
+- **Stacked Queries**: Queries containing `;` followed by additional SQL are rejected (detection ignores semicolons inside string literals and comments)
+- **Identifier Safety**: `sql.ident()` validates against ANSI identifier rules and caps each part at 255 characters

package/package.json

@@ -1 +1 @@
-{"name":"@truto/sqlite-builder","version":"2.0.2-canary.22","description":"debug canary","license":"MIT","main":"index.js"}
+{"name":"@truto/sqlite-builder","version":"2.0.2-canary.24","description":"debug canary","license":"MIT","main":"index.js"}