@truto/sqlite-builder 2.0.2-canary.24 → 2.0.2-canary.26

package/README.md

@@ -1,28 +1,28 @@
-To use the `regex` operator, you need to load a REGEXP extension in SQLite:
-
-```typescript
-// With better-sqlite3
-import sqlite3 from 'better-sqlite3'
+// ❌ Unsafe types (will throw TypeError)
+sql`SELECT * FROM users WHERE data = ${Buffer.from('test')}` // Use sql.raw() for buffers
+sql`SELECT * FROM users WHERE id = ${Symbol('test')}` // Unsupported type
+```
 
-const db = new sqlite3('database.db')
+## 📋 Examples
 
-// Load REGEXP extension (varies by implementation)
-// This is implementation-specific - check your SQLite setup
-db.loadExtension('regexp') // Example - actual method may vary
+### Basic CRUD Operations
 
-// Now regex filters work
-const filter = {
-  email: { regex: '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$' },
-}
-```
+```typescript
+import { sql } from '@truto/sqlite-builder'
 
-## 🛡️ Security Model
+// CREATE with array identifiers
+const insertColumns = ['name', 'email', 'age']
+const insertUser = sql`
+  INSERT INTO users (${sql.ident(insertColumns)})
+  VALUES (${name}, ${email}, ${age})
+`
 
-### What's Protected
+// READ with specific columns
+const selectColumns = ['id', 'name', 'email', 'created_at']
+const getUser = sql`
+  SELECT ${sql.ident(selectColumns)} FROM users 
+  WHERE id = ${userId}
+`
 
-- **SQL Injection**: All interpolated values are parameterized
-- **Unforgeable fragments**: Only fragments created by this library can contribute raw SQL text. A plain `{ text, values }` object (e.g. from `JSON.parse` or a request body) is treated as a value, never as SQL, closing the structural duck-typing bypass
-- **Placeholder integrity**: The `sql` tag rejects any query whose `?` count does not match its bound-value count, catching raw fragments that smuggle or drop placeholders
-- **Safe `sql.join()` separators**: String separators are validated so they cannot introduce string literals, comments, statement terminators, or unbalanced parentheses; use a `SqlFragment` separator to parameterize the connector itself
-- **Stacked Queries**: Queries containing `;` followed by additional SQL are rejected (detection ignores semicolons inside string literals and comments)
-- **Identifier Safety**: `sql.ident()` validates against ANSI identifier rules and caps each part at 255 characters
+// UPDATE
+const updateUser = sql`

package/package.json

@@ -1 +1 @@
-{"name":"@truto/sqlite-builder","version":"2.0.2-canary.24","description":"debug canary","license":"MIT","main":"index.js"}
+{"name":"@truto/sqlite-builder","version":"2.0.2-canary.26","description":"debug canary","license":"MIT","main":"index.js"}