@vertz/db 0.2.1 → 0.2.3

package/dist/d1/index.js

@@ -1,7 +1,7 @@
 import {
   createD1Adapter,
   createD1Driver
-} from "../shared/chunk-ktbebkz5.js";
+} from "../shared/chunk-pnk6yzjv.js";
 export {
   createD1Driver,
   createD1Adapter

package/dist/index.js

@@ -43,10 +43,10 @@ import {
 import {
   createD1Adapter,
   createD1Driver
-} from "./shared/chunk-ktbebkz5.js";
+} from "./shared/chunk-pnk6yzjv.js";
 import {
   generateId
-} from "./shared/chunk-fwk49jvg.js";
+} from "./shared/chunk-sfmyxz6r.js";
 // src/adapters/database-bridge-adapter.ts
 function createDatabaseBridgeAdapter(db, tableName) {
   const delegate = db[tableName];
@@ -645,6 +645,12 @@ function nextMigrationNumber(existingFiles) {
 }
 // src/migration/introspect.ts
 var SQLITE_EXCLUDED_TABLES = new Set(["sqlite_sequence", "_vertz_migrations"]);
+function validateIdentifier(name) {
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+    throw new Error(`Invalid SQL identifier: "${name}"`);
+  }
+  return name;
+}
 function mapSqliteType(rawType) {
   const upper = rawType.toUpperCase();
   if (upper === "TEXT")
@@ -669,7 +675,7 @@ async function introspectSqlite(queryFn) {
     if (SQLITE_EXCLUDED_TABLES.has(tableName))
       continue;
     const columns = {};
-    const { rows: colRows } = await queryFn(`PRAGMA table_info("${tableName}")`, []);
+    const { rows: colRows } = await queryFn(`PRAGMA table_info("${validateIdentifier(tableName)}")`, []);
     for (const col of colRows) {
       const colName = col.name;
       const colSnap = {
@@ -684,12 +690,12 @@ async function introspectSqlite(queryFn) {
       columns[colName] = colSnap;
     }
     const indexes = [];
-    const { rows: indexRows } = await queryFn(`PRAGMA index_list("${tableName}")`, []);
+    const { rows: indexRows } = await queryFn(`PRAGMA index_list("${validateIdentifier(tableName)}")`, []);
     for (const idx of indexRows) {
       const idxName = idx.name;
       const isUnique = idx.unique === 1;
       const origin = idx.origin;
-      const { rows: idxInfoRows } = await queryFn(`PRAGMA index_info("${idxName}")`, []);
+      const { rows: idxInfoRows } = await queryFn(`PRAGMA index_info("${validateIdentifier(idxName)}")`, []);
       const idxColumns = idxInfoRows.map((r) => r.name);
       if (isUnique && idxColumns.length === 1 && origin === "u") {
         const colName = idxColumns[0];
@@ -706,7 +712,7 @@ async function introspectSqlite(queryFn) {
       }
     }
     const foreignKeys = [];
-    const { rows: fkRows } = await queryFn(`PRAGMA foreign_key_list("${tableName}")`, []);
+    const { rows: fkRows } = await queryFn(`PRAGMA foreign_key_list("${validateIdentifier(tableName)}")`, []);
     for (const fk of fkRows) {
       foreignKeys.push({
         column: fk.from,

package/dist/shared/{chunk-ktbebkz5.js → chunk-pnk6yzjv.js}

@@ -2,7 +2,7 @@ import {
   BaseSqlAdapter,
   generateCreateTableSql,
   generateIndexSql
-} from "./chunk-fwk49jvg.js";
+} from "./chunk-sfmyxz6r.js";
 
 // src/adapters/d1-adapter.ts
 function createD1Driver(d1) {

package/dist/shared/{chunk-fwk49jvg.js → chunk-sfmyxz6r.js}

@@ -72,7 +72,7 @@ function generateCreateTableSql(schema) {
       if (meta.defaultValue === "now") {
         colDef += " DEFAULT (datetime('now'))";
       } else if (typeof meta.defaultValue === "string") {
-        colDef += ` DEFAULT '${meta.defaultValue}'`;
+        colDef += ` DEFAULT '${meta.defaultValue.replace(/'/g, "''")}'`;
       } else if (typeof meta.defaultValue === "number") {
         colDef += ` DEFAULT ${meta.defaultValue}`;
       } else if (typeof meta.defaultValue === "boolean") {
@@ -80,6 +80,10 @@ function generateCreateTableSql(schema) {
       }
     }
     if (meta.check) {
+      const DANGEROUS_PATTERN = /;|--|\b(DROP|DELETE|INSERT|UPDATE|ALTER|CREATE|EXEC)\b/i;
+      if (DANGEROUS_PATTERN.test(meta.check)) {
+        throw new Error(`Unsafe CHECK constraint expression: "${meta.check}"`);
+      }
       colDef += ` CHECK (${meta.check})`;
     }
     columns.push(colDef);

package/dist/sqlite/index.js

@@ -2,7 +2,7 @@ import {
   BaseSqlAdapter,
   generateCreateTableSql,
   generateIndexSql
-} from "../shared/chunk-fwk49jvg.js";
+} from "../shared/chunk-sfmyxz6r.js";
 import {
   __commonJS,
   __require
@@ -73,7 +73,7 @@ var require_file_uri_to_path = __commonJS((exports, module) => {
 
 // ../../node_modules/.bun/bindings@1.5.0/node_modules/bindings/bindings.js
 var require_bindings = __commonJS((exports, module) => {
-  var __filename = "/Users/viniciusdacal/vertz-dev/vertz/.claude/worktrees/poc-ssr-hmr/node_modules/.bun/bindings@1.5.0/node_modules/bindings/bindings.js";
+  var __filename = "/home/runner/work/vertz/vertz/node_modules/.bun/bindings@1.5.0/node_modules/bindings/bindings.js";
   var fs = __require("fs");
   var path = __require("path");
   var fileURLToPath = require_file_uri_to_path();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vertz/db",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "type": "module",
   "license": "MIT",
   "description": "Database layer for Vertz — typed queries, migrations, codegen",
@@ -73,7 +73,7 @@
     "@types/node": "^25.3.1",
     "@vitest/coverage-v8": "^4.0.18",
     "better-sqlite3": "^12.6.2",
-    "bunup": "latest",
+    "bunup": "^0.16.31",
     "postgres": "^3.4.8",
     "typescript": "^5.7.0",
     "vitest": "^4.0.18"
@@ -83,7 +83,7 @@
   },
   "dependencies": {
     "@vertz/errors": "0.2.1",
-    "@vertz/schema": "0.2.1",
+    "@vertz/schema": "0.2.2",
     "@paralleldrive/cuid2": "^3.3.0",
     "nanoid": "^5.1.5",
     "uuid": "^13.0.0"