@truto/sqlite-builder 2.0.2-canary.24 → 2.0.2-canary.25

package/README.md

@@ -1,28 +1,28 @@
-To use the `regex` operator, you need to load a REGEXP extension in SQLite:
+- **Length Limits**: Queries exceeding 100KB are rejected; `compileFilter()` enforces the same cap on its output
+- **Pattern Limits**: `like`/`ilike`/`regex` patterns are capped at 1024 characters to bound matching cost at the SQLite layer
+- **Filter Security**: JSON filters validate operators, identifiers, and enforce limits
 
-```typescript
-// With better-sqlite3
-import sqlite3 from 'better-sqlite3'
-
-const db = new sqlite3('database.db')
+### What's Your Responsibility
 
-// Load REGEXP extension (varies by implementation)
-// This is implementation-specific - check your SQLite setup
-db.loadExtension('regexp') // Example - actual method may vary
+- **Never use `sql.raw()` with user input**
+- **Validate identifiers before using `sql.ident()`** (though it has built-in validation)
+- **Use `sql.in()` instead of string concatenation** for arrays
+- **Keep your SQLite driver updated**
+- **Load REGEXP extension safely** if using regex filters
 
-// Now regex filters work
-const filter = {
-  email: { regex: '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$' },
-}
-```
+### Supported Value Types
 
-## 🛡️ Security Model
-
-### What's Protected
+```typescript
+// ✅ Safe types (automatically parameterized)
+const query = sql`
+  INSERT INTO users (name, age, active, created_at, data, deleted_at)
+  VALUES (
+    ${'John'},           // string
+    ${30},               // number  
+    ${true},             // boolean
+    ${new Date()},       // Date → 'YYYY-MM-DD HH:MM:SS'
+    ${null},             // null
+    ${undefined}         // undefined → null
+  )
+`
 
-- **SQL Injection**: All interpolated values are parameterized
-- **Unforgeable fragments**: Only fragments created by this library can contribute raw SQL text. A plain `{ text, values }` object (e.g. from `JSON.parse` or a request body) is treated as a value, never as SQL, closing the structural duck-typing bypass
-- **Placeholder integrity**: The `sql` tag rejects any query whose `?` count does not match its bound-value count, catching raw fragments that smuggle or drop placeholders
-- **Safe `sql.join()` separators**: String separators are validated so they cannot introduce string literals, comments, statement terminators, or unbalanced parentheses; use a `SqlFragment` separator to parameterize the connector itself
-- **Stacked Queries**: Queries containing `;` followed by additional SQL are rejected (detection ignores semicolons inside string literals and comments)
-- **Identifier Safety**: `sql.ident()` validates against ANSI identifier rules and caps each part at 255 characters

package/package.json

@@ -1 +1 @@
-{"name":"@truto/sqlite-builder","version":"2.0.2-canary.24","description":"debug canary","license":"MIT","main":"index.js"}
+{"name":"@truto/sqlite-builder","version":"2.0.2-canary.25","description":"debug canary","license":"MIT","main":"index.js"}