@vibeorm/sql 2.3.0 → 2.3.1

package/dist/dialects/mysql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mysql.d.ts","sourceRoot":"","sources":["../../src/dialects/mysql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,eAAO,MAAM,YAAY,EAAE,UA4F1B,CAAC"}
+{"version":3,"file":"mysql.d.ts","sourceRoot":"","sources":["../../src/dialects/mysql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIhD,eAAO,MAAM,YAAY,EAAE,UA4F1B,CAAC"}

package/dist/dialects/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../src/dialects/postgres.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,eAAO,MAAM,eAAe,EAAE,UA0F7B,CAAC"}
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../src/dialects/postgres.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIhD,eAAO,MAAM,eAAe,EAAE,UA0F7B,CAAC"}

package/dist/dialects/sqlite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/dialects/sqlite.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,eAAO,MAAM,aAAa,EAAE,UAuF3B,CAAC"}
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/dialects/sqlite.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIhD,eAAO,MAAM,aAAa,EAAE,UAuF3B,CAAC"}

package/dist/identifiers.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Identifier hygiene shared by every dialect's `quoteIdent`.
+ *
+ * Quoting doubles the quote character, which is the whole grammar for every
+ * other byte — except NUL: C-string servers stop reading an identifier at the
+ * first NUL, so `"users\0x"` would address `users`, and a quoted identifier
+ * containing one is not an identifier at all. Refused at render time, the
+ * earliest point every path (IR, raw `sql.ident`, extension DDL) shares.
+ */
+/** Return `name` unchanged, or throw `VIBE_VALIDATION` when it contains a NUL. */
+export declare function assertNoNul(params: {
+    name: string;
+}): string;
+//# sourceMappingURL=identifiers.d.ts.map

package/dist/identifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifiers.d.ts","sourceRoot":"","sources":["../src/identifiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAS5D"}

package/dist/index.js

@@ -1188,6 +1188,19 @@ import {
   MYSQL_CAPABILITIES
 } from "@vibeorm/schema";
 
+// packages/sql/src/identifiers.ts
+import { VibeError as VibeError6 } from "@vibeorm/schema";
+function assertNoNul(params) {
+  if (params.name.includes("\x00")) {
+    throw new VibeError6({
+      code: "VIBE_VALIDATION",
+      message: "an SQL identifier cannot contain a NUL character \u2014 the server would stop reading it there and address a different object",
+      meta: { name: params.name.replaceAll("\x00", "\\0") }
+    });
+  }
+  return params.name;
+}
+
 // packages/sql/src/dialects/postgres.ts
 var postgresDialect = {
   name: "postgres",
@@ -1243,7 +1256,7 @@ var postgresDialect = {
   paramBudget: 30000,
   booleanLiteral: { true: "true", false: "false" },
   quoteIdent({ name }) {
-    return `"${name.replaceAll('"', '""')}"`;
+    return `"${assertNoNul({ name }).replaceAll('"', '""')}"`;
   },
   quoteStringLiteral({ value }) {
     return `'${value.replaceAll("'", "''")}'`;
@@ -1294,7 +1307,7 @@ var sqliteDialect = {
   paramBudget: 900,
   booleanLiteral: { true: "1", false: "0" },
   quoteIdent({ name }) {
-    return `"${name.replaceAll('"', '""')}"`;
+    return `"${assertNoNul({ name }).replaceAll('"', '""')}"`;
   },
   quoteStringLiteral({ value }) {
     return `'${value.replaceAll("'", "''")}'`;
@@ -1349,7 +1362,7 @@ var mysqlDialect = {
   paramBudget: 1e4,
   booleanLiteral: { true: "1", false: "0" },
   quoteIdent({ name }) {
-    return `\`${name.replaceAll("`", "``")}\``;
+    return `\`${assertNoNul({ name }).replaceAll("`", "``")}\``;
   },
   quoteStringLiteral({ value }) {
     return `'${value.replaceAll("\\", "\\\\").replaceAll("'", "''")}'`;
@@ -1390,7 +1403,7 @@ function isFixedDiagnostic(params) {
 }
 
 // packages/sql/src/dialects/postgres-diagnostics.ts
-import { VibeError as VibeError6, unsupportedCapability as unsupportedCapability6 } from "@vibeorm/schema";
+import { VibeError as VibeError7, unsupportedCapability as unsupportedCapability6 } from "@vibeorm/schema";
 function renderPostgresExplain(params) {
   const { dialect, query, options } = params;
   requirePostgres({ dialect, feature: "query plan inspection (EXPLAIN)" });
@@ -1443,7 +1456,7 @@ function renderPostgresWorkload(params) {
   if (query === "statementSnapshot") {
     const bounded = limit ?? 20;
     if (!Number.isInteger(bounded) || bounded < POSTGRES_WORKLOAD_LIMITS.minLimit || bounded > POSTGRES_WORKLOAD_LIMITS.maxLimit) {
-      throw new VibeError6({
+      throw new VibeError7({
         code: "VIBE_CONFIG",
         message: `workload snapshot limit must be an integer between ${POSTGRES_WORKLOAD_LIMITS.minLimit} and ${POSTGRES_WORKLOAD_LIMITS.maxLimit}, got ${String(limit)}`,
         meta: { limit }
@@ -1462,7 +1475,7 @@ function renderPostgresWorkload(params) {
 function requireArg(params) {
   const { value, name, query } = params;
   if (value === undefined || value.length === 0) {
-    throw new VibeError6({
+    throw new VibeError7({
       code: "VIBE_CONFIG",
       message: `the "${query}" diagnostic read requires a ${name}`,
       meta: { query, argument: name }
@@ -1475,7 +1488,7 @@ function requireArg(params) {
 import { unsupportedCapability as unsupportedCapability8 } from "@vibeorm/schema";
 
 // packages/sql/src/dialects/postgres-rls.ts
-import { RlsContextError, VibeError as VibeError7, assertValidSchemaIR, unsupportedCapability as unsupportedCapability7, validateRlsContextIR } from "@vibeorm/schema";
+import { RlsContextError, VibeError as VibeError8, assertValidSchemaIR, unsupportedCapability as unsupportedCapability7, validateRlsContextIR } from "@vibeorm/schema";
 var NATIVE_RLS = Object.freeze({ policyName: "vibeorm_managed", tableSchema: "public", settingPrefix: "vibeorm.", parentAlias: "parent" });
 var COLUMN_TYPES = {
   String: { default: "text", native: { text: "text", varchar: "varchar", charactervarying: "varchar", uuid: "uuid" } },
@@ -1493,7 +1506,7 @@ function requireRls(params) {
 }
 function identifier2(params) {
   if (typeof params.name !== "string" || params.name.length === 0 || params.name.includes("\x00") || new TextEncoder().encode(params.name).length > 63) {
-    throw new VibeError7({ code: "VIBE_SCHEMA_INVALID", message: "Native RLS identifiers must be nonempty PostgreSQL identifiers of at most 63 bytes" });
+    throw new VibeError8({ code: "VIBE_SCHEMA_INVALID", message: "Native RLS identifiers must be nonempty PostgreSQL identifiers of at most 63 bytes" });
   }
   return params.dialect.quoteIdent({ name: params.name });
 }
@@ -1547,7 +1560,7 @@ function protectedModel(params) {
   assertValidSchemaIR({ schema: params.schema });
   const model = params.schema.models.find((entry) => entry.name === params.model);
   if (model === undefined || model.rls === undefined || model.rls === "unprotected") {
-    throw new VibeError7({ code: "VIBE_SCHEMA_INVALID", message: "Native RLS policy rendering requires a protected model", meta: { model: params.model } });
+    throw new VibeError8({ code: "VIBE_SCHEMA_INVALID", message: "Native RLS policy rendering requires a protected model", meta: { model: params.model } });
   }
   return model;
 }
@@ -1580,7 +1593,7 @@ function predicate(params) {
     }).join(" AND ");
     return `EXISTS (SELECT 1 FROM ${tableRef({ dialect, table: parent.dbName ?? parent.name })} AS ${alias} WHERE ${join})`;
   }
-  throw new VibeError7({ code: "VIBE_SCHEMA_INVALID", message: "Native RLS requires a protected policy rule" });
+  throw new VibeError8({ code: "VIBE_SCHEMA_INVALID", message: "Native RLS requires a protected policy rule" });
 }
 function renderRlsPolicy(params) {
   const model = protectedModel(params);
@@ -1614,7 +1627,7 @@ function renderRlsContext(params) {
 function renderRlsRole(params) {
   requireRls(params);
   if (typeof params.role !== "string" || params.role.trim().length === 0 || params.role.includes("\x00")) {
-    throw new VibeError7({ code: "VIBE_CONFIG", message: "PGlite native RLS requires a trusted nonempty runtime role name" });
+    throw new VibeError8({ code: "VIBE_CONFIG", message: "PGlite native RLS requires a trusted nonempty runtime role name" });
   }
   const collector = new ParamCollector(params.dialect);
   return query({ text: `SELECT set_config('role', ${collector.add(params.role)}, true)`, values: collector.values });
@@ -2121,7 +2134,7 @@ function jsonPathString(path) {
     } else if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(segment)) {
       out += `.${segment}`;
     } else {
-      out += `."${segment.replaceAll('"', "\\\"")}"`;
+      out += `."${segment.replaceAll("\\", "\\\\").replaceAll('"', "\\\"")}"`;
     }
   }
   return out;
@@ -2623,7 +2636,7 @@ function renderDelete(params) {
   return { text: text + returning.suffix, values: collector.values, returning: returning.status };
 }
 // packages/sql/src/dialects/sqlite-table-definition.ts
-import { VibeError as VibeError8 } from "@vibeorm/schema";
+import { VibeError as VibeError9 } from "@vibeorm/schema";
 function tableDefinitionParts(params) {
   const sql = params.sql;
   if (!/^\s*CREATE\s+(?:TEMP(?:ORARY)?\s+)?TABLE\b/i.test(sql))
@@ -2684,7 +2697,7 @@ function tableDefinitionParts(params) {
   throw unavailable();
 }
 function unavailable() {
-  return new VibeError8({ code: "VIBE_MIGRATION", message: "Cannot preserve table definition", meta: { reason: "table-definition-unavailable" } });
+  return new VibeError9({ code: "VIBE_MIGRATION", message: "Cannot preserve table definition", meta: { reason: "table-definition-unavailable" } });
 }
 function sqliteColumnClauses(params) {
   const columns = [];
@@ -3108,7 +3121,7 @@ function renderCheckProbe(params) {
   return { text: `ALTER TABLE ${q(params.table.namespace)}.${q(params.table.name)} ADD CONSTRAINT ${q(params.name)} CHECK (${params.expression}) NOT VALID`, values: [], returning: "none" };
 }
 // packages/sql/src/dialects/postgres-migration.ts
-import { VibeError as VibeError9, unsupportedCapability as unsupportedCapability17 } from "@vibeorm/schema";
+import { VibeError as VibeError10, unsupportedCapability as unsupportedCapability17 } from "@vibeorm/schema";
 var SETTING_VALUE = /^[0-9]+(?:\.[0-9]+)?\s*(?:us|ms|s|min|h|d)?$/;
 function requirePostgres2(params) {
   if (params.dialect.name !== "postgres") {
@@ -3127,7 +3140,7 @@ function renderMigrationSessionSet(params) {
   requirePostgres2({ dialect: params.dialect, feature: "migrationSessionSettings" });
   const { milliseconds, setting } = params;
   if (!Number.isSafeInteger(milliseconds) || milliseconds < 0) {
-    throw new VibeError9({
+    throw new VibeError10({
       code: "VIBE_MIGRATION",
       message: `${setting} must be a non-negative integer number of milliseconds (got ${String(milliseconds)})`,
       meta: { reason: "execution-metadata-invalid", setting, value: milliseconds }
@@ -3333,4 +3346,4 @@ export {
   toPgArrayLiteral
 };
 
-//# debugId=E08264A778510D8664756E2164756E21
+//# debugId=C1F0ADA45113049064756E2164756E21