@ultimat3/entity 22.8.2 → 22.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/entity",
-  "version": "22.8.2",
+  "version": "22.9.1",
   "description": "A table + its domain type + invariants the database also enforces",
   "license": "MIT",
   "type": "module",
@@ -32,9 +32,9 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "22.8.2",
-    "@ultimat3/db": "22.8.2",
-    "@ultimat3/schema": "22.8.2",
-    "@ultimat3/time": "22.8.2"
+    "@ultimat3/core": "22.9.1",
+    "@ultimat3/db": "22.9.1",
+    "@ultimat3/schema": "22.9.1",
+    "@ultimat3/time": "22.9.1"
   }
 }

package/src/column-values.ts

@@ -4,6 +4,7 @@
 
 import { literal } from '@ultimat3/db';
 import { describeValue } from '@ultimat3/schema';
+import { refuseColumn } from './refuse';
 
 /**
  * The rejected value, rendered as its SHAPE and never its content — `@ultimat3/schema`'s
@@ -35,3 +36,18 @@ export const oneOf =
   (values: readonly string[]) =>
   (name: string): string =>
     `${name} in (${values.map((value) => literal(value).text).join(', ')})`;
+
+/**
+ * U+0000 is the one character a Postgres `text` value cannot hold (SQLSTATE 22021). Refused in the
+ * column parser for the reason every rule in this package is: the memory driver would store what
+ * production answers `X_DB_STATEMENT_FAILED` for. `t.string` refuses it at the wire first; this is
+ * the same rule for a value that reached the row by any other path — a job, a seed, an import.
+ */
+export const refuseNul = (value: string): string =>
+  value.includes('\u0000')
+    ? refuseColumn(
+        'format',
+        `expected text without a NUL character (U+0000), ${got(value)} that contains one`,
+        "strip it at the call site — value.replaceAll('\\u0000', '') — Postgres text cannot store U+0000; binary content is bytea()",
+      )
+    : value;

package/src/columns-scalar.ts

@@ -1,10 +1,10 @@
 // Single responsibility: the three plain scalar columns — `text`, `integer`, `boolean` — each
 // refusing in `$parse` exactly what Postgres refuses at the column, so the memory driver cannot
-// store a value production answers 23514 or 22003 for. Split from `columns.ts` at its ceiling.
+// store a value production answers 23514, 22003 or 22021 (a NUL in text) for. Split from `columns.ts` at its ceiling.
 
 import { charCount } from '@ultimat3/schema';
 import { column } from './column';
-import { got } from './column-values';
+import { got, refuseNul } from './column-values';
 import { refuseColumn } from './refuse';
 import type { Column } from './types';
 
@@ -43,7 +43,7 @@ export const text = (options: TextOptions = {}): Column<string> => {
           `truncate at the call site, or widen the column — text({ max: ${charCount(value)} }) — and run x db gen "widen the text"`,
         );
       }
-      return value;
+      return refuseNul(value);
     },
     max === undefined ? {} : { length: max, check: (name) => `char_length(${name}) <= ${max}` },
   );

package/src/columns.ts

@@ -19,7 +19,7 @@ import {
   makeColumn,
   makeTimestamp,
 } from './column';
-import { got, oneOf } from './column-values';
+import { got, oneOf, refuseNul } from './column-values';
 import { refuseColumn } from './refuse';
 import type {
   Column,
@@ -118,6 +118,9 @@ export const url = (): Column<string> =>
     'text',
     (value) => {
       if (typeof value === 'string') {
+        // Before the parse, outside its `catch`: WHATWG percent-encodes a NUL in a path, so
+        // `new URL` accepts it, and the value stored is the caller's — NUL included.
+        refuseNul(value);
         try {
           const parsed = new URL(value);
           // The scheme is stored in its canonical LOWER case: the CHECK is `~ '^https?://'`, so