libsql-search 0.1.5 → 0.1.6

package/dist/index.cjs

@@ -114,6 +114,34 @@ function prepareTextForEmbedding(fields) {
   return parts.filter(Boolean).join("\n\n");
 }
 
+const SQL_IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const DEFAULT_SEARCH_LIMIT = 10;
+const MAX_SEARCH_LIMIT = 100;
+function validateSqlIdentifier(identifier, name = "identifier") {
+  if (typeof identifier !== "string" || !SQL_IDENTIFIER_PATTERN.test(identifier)) {
+    throw new Error(
+      `Invalid SQL ${name}: expected an ASCII identifier matching ${SQL_IDENTIFIER_PATTERN.toString()}`
+    );
+  }
+  return identifier;
+}
+function quoteSqlIdentifier(identifier, name) {
+  const validated = validateSqlIdentifier(identifier, name);
+  return `"${validated.replace(/"/g, '""')}"`;
+}
+function normalizeSearchLimit(limit = DEFAULT_SEARCH_LIMIT) {
+  if (typeof limit !== "number" || !Number.isFinite(limit) || !Number.isInteger(limit) || limit < 1 || limit > MAX_SEARCH_LIMIT) {
+    throw new Error(`Invalid search limit: expected an integer from 1 to ${MAX_SEARCH_LIMIT}`);
+  }
+  return limit;
+}
+function normalizeVectorDimensions(dimensions) {
+  if (typeof dimensions !== "number" || !Number.isFinite(dimensions) || !Number.isInteger(dimensions) || dimensions < 1) {
+    throw new Error("Invalid vector dimensions: expected a positive integer");
+  }
+  return dimensions;
+}
+
 async function indexContent(options) {
   const {
     client,
@@ -124,12 +152,13 @@ async function indexContent(options) {
     tableName = "articles",
     onProgress
   } = options;
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
   const files = await findFiles(contentPath, contentPath, fileExtensions, exclude);
   if (files.length === 0) {
     console.warn(`No files found in ${contentPath}`);
     return { success: 0, failed: 0, total: 0 };
   }
-  await client.execute(`DELETE FROM ${tableName}`);
+  await client.execute(`DELETE FROM ${quotedTableName}`);
   let success = 0;
   let failed = 0;
   for (let i = 0; i < files.length; i++) {
@@ -139,7 +168,7 @@ async function indexContent(options) {
     }
     try {
       const document = await processFile(file, embeddingOptions);
-      await insertDocument(client, document, tableName);
+      await insertDocument(client, document, quotedTableName);
       success++;
     } catch (error) {
       console.error(`Failed to index ${file.relativePath}:`, error);
@@ -193,9 +222,9 @@ async function processFile(file, embeddingOptions) {
     metadata: frontMatter
   };
 }
-async function insertDocument(client, document, tableName) {
+async function insertDocument(client, document, quotedTableName) {
   await client.execute({
-    sql: `INSERT INTO ${tableName}
+    sql: `INSERT INTO ${quotedTableName}
           (slug, title, content, folder, tags, embedding, created_at, updated_at)
           VALUES (?, ?, ?, ?, ?, vector(?), datetime('now'), datetime('now'))`,
     args: [
@@ -209,30 +238,35 @@ async function insertDocument(client, document, tableName) {
   });
 }
 async function createTable(client, tableName = "articles", dimensions = 768) {
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
+  const vectorDimensions = normalizeVectorDimensions(dimensions);
+  const quotedEmbeddingIndexName = quoteSqlIdentifier(`${tableName}_embedding_idx`, "embedding index name");
+  const quotedFolderIndexName = quoteSqlIdentifier(`${tableName}_folder_idx`, "folder index name");
+  const quotedSlugIndexName = quoteSqlIdentifier(`${tableName}_slug_idx`, "slug index name");
   await client.execute(`
-    CREATE TABLE IF NOT EXISTS ${tableName} (
+    CREATE TABLE IF NOT EXISTS ${quotedTableName} (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
       slug TEXT UNIQUE NOT NULL,
       title TEXT NOT NULL,
       content TEXT NOT NULL,
       folder TEXT NOT NULL DEFAULT 'root',
       tags TEXT DEFAULT '[]',
-      embedding F32_BLOB(${dimensions}),
+      embedding F32_BLOB(${vectorDimensions}),
       created_at TEXT NOT NULL,
       updated_at TEXT NOT NULL
     )
   `);
   await client.execute(`
-    CREATE INDEX IF NOT EXISTS ${tableName}_embedding_idx
-    ON ${tableName}(libsql_vector_idx(embedding))
+    CREATE INDEX IF NOT EXISTS ${quotedEmbeddingIndexName}
+    ON ${quotedTableName}(libsql_vector_idx(embedding))
   `);
   await client.execute(`
-    CREATE INDEX IF NOT EXISTS ${tableName}_folder_idx
-    ON ${tableName}(folder)
+    CREATE INDEX IF NOT EXISTS ${quotedFolderIndexName}
+    ON ${quotedTableName}(folder)
   `);
   await client.execute(`
-    CREATE INDEX IF NOT EXISTS ${tableName}_slug_idx
-    ON ${tableName}(slug)
+    CREATE INDEX IF NOT EXISTS ${quotedSlugIndexName}
+    ON ${quotedTableName}(slug)
   `);
 }
 
@@ -244,6 +278,8 @@ async function search(options) {
     tableName = "articles",
     embeddingOptions = {}
   } = options;
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
+  const resultLimit = normalizeSearchLimit(limit);
   const queryEmbedding = await generateEmbedding(query, embeddingOptions);
   const results = await client.execute({
     sql: `
@@ -256,12 +292,12 @@ async function search(options) {
         tags,
         created_at,
         vector_distance_cos(embedding, vector(?)) as distance
-      FROM ${tableName}
+      FROM ${quotedTableName}
       WHERE embedding IS NOT NULL
       ORDER BY distance
       LIMIT ?
     `,
-    args: [JSON.stringify(queryEmbedding), limit]
+    args: [JSON.stringify(queryEmbedding), resultLimit]
   });
   return results.rows.map((row) => ({
     id: row.id,
@@ -275,9 +311,10 @@ async function search(options) {
   }));
 }
 async function getAllArticles(client, tableName = "articles") {
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
   const results = await client.execute(`
     SELECT id, slug, title, folder, tags, created_at, updated_at
-    FROM ${tableName}
+    FROM ${quotedTableName}
     ORDER BY title
   `);
   return results.rows.map((row) => ({
@@ -291,10 +328,11 @@ async function getAllArticles(client, tableName = "articles") {
   }));
 }
 async function getArticleBySlug(client, slug, tableName = "articles") {
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
   const results = await client.execute({
     sql: `
       SELECT id, slug, title, content, folder, tags, created_at, updated_at
-      FROM ${tableName}
+      FROM ${quotedTableName}
       WHERE slug = ?
       LIMIT 1
     `,
@@ -316,10 +354,11 @@ async function getArticleBySlug(client, slug, tableName = "articles") {
   };
 }
 async function getArticlesByFolder(client, folder, tableName = "articles") {
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
   const results = await client.execute({
     sql: `
       SELECT id, slug, title, folder, tags
-      FROM ${tableName}
+      FROM ${quotedTableName}
       WHERE folder = ?
       ORDER BY title
     `,
@@ -334,9 +373,10 @@ async function getArticlesByFolder(client, folder, tableName = "articles") {
   }));
 }
 async function getFolders(client, tableName = "articles") {
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
   const results = await client.execute(`
     SELECT DISTINCT folder
-    FROM ${tableName}
+    FROM ${quotedTableName}
     ORDER BY folder
   `);
   return results.rows.map((row) => row.folder);

package/dist/index.esm.js

@@ -112,6 +112,34 @@ function prepareTextForEmbedding(fields) {
   return parts.filter(Boolean).join("\n\n");
 }
 
+const SQL_IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const DEFAULT_SEARCH_LIMIT = 10;
+const MAX_SEARCH_LIMIT = 100;
+function validateSqlIdentifier(identifier, name = "identifier") {
+  if (typeof identifier !== "string" || !SQL_IDENTIFIER_PATTERN.test(identifier)) {
+    throw new Error(
+      `Invalid SQL ${name}: expected an ASCII identifier matching ${SQL_IDENTIFIER_PATTERN.toString()}`
+    );
+  }
+  return identifier;
+}
+function quoteSqlIdentifier(identifier, name) {
+  const validated = validateSqlIdentifier(identifier, name);
+  return `"${validated.replace(/"/g, '""')}"`;
+}
+function normalizeSearchLimit(limit = DEFAULT_SEARCH_LIMIT) {
+  if (typeof limit !== "number" || !Number.isFinite(limit) || !Number.isInteger(limit) || limit < 1 || limit > MAX_SEARCH_LIMIT) {
+    throw new Error(`Invalid search limit: expected an integer from 1 to ${MAX_SEARCH_LIMIT}`);
+  }
+  return limit;
+}
+function normalizeVectorDimensions(dimensions) {
+  if (typeof dimensions !== "number" || !Number.isFinite(dimensions) || !Number.isInteger(dimensions) || dimensions < 1) {
+    throw new Error("Invalid vector dimensions: expected a positive integer");
+  }
+  return dimensions;
+}
+
 async function indexContent(options) {
   const {
     client,
@@ -122,12 +150,13 @@ async function indexContent(options) {
     tableName = "articles",
     onProgress
   } = options;
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
   const files = await findFiles(contentPath, contentPath, fileExtensions, exclude);
   if (files.length === 0) {
     console.warn(`No files found in ${contentPath}`);
     return { success: 0, failed: 0, total: 0 };
   }
-  await client.execute(`DELETE FROM ${tableName}`);
+  await client.execute(`DELETE FROM ${quotedTableName}`);
   let success = 0;
   let failed = 0;
   for (let i = 0; i < files.length; i++) {
@@ -137,7 +166,7 @@ async function indexContent(options) {
     }
     try {
       const document = await processFile(file, embeddingOptions);
-      await insertDocument(client, document, tableName);
+      await insertDocument(client, document, quotedTableName);
       success++;
     } catch (error) {
       console.error(`Failed to index ${file.relativePath}:`, error);
@@ -191,9 +220,9 @@ async function processFile(file, embeddingOptions) {
     metadata: frontMatter
   };
 }
-async function insertDocument(client, document, tableName) {
+async function insertDocument(client, document, quotedTableName) {
   await client.execute({
-    sql: `INSERT INTO ${tableName}
+    sql: `INSERT INTO ${quotedTableName}
           (slug, title, content, folder, tags, embedding, created_at, updated_at)
           VALUES (?, ?, ?, ?, ?, vector(?), datetime('now'), datetime('now'))`,
     args: [
@@ -207,30 +236,35 @@ async function insertDocument(client, document, tableName) {
   });
 }
 async function createTable(client, tableName = "articles", dimensions = 768) {
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
+  const vectorDimensions = normalizeVectorDimensions(dimensions);
+  const quotedEmbeddingIndexName = quoteSqlIdentifier(`${tableName}_embedding_idx`, "embedding index name");
+  const quotedFolderIndexName = quoteSqlIdentifier(`${tableName}_folder_idx`, "folder index name");
+  const quotedSlugIndexName = quoteSqlIdentifier(`${tableName}_slug_idx`, "slug index name");
   await client.execute(`
-    CREATE TABLE IF NOT EXISTS ${tableName} (
+    CREATE TABLE IF NOT EXISTS ${quotedTableName} (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
       slug TEXT UNIQUE NOT NULL,
       title TEXT NOT NULL,
       content TEXT NOT NULL,
       folder TEXT NOT NULL DEFAULT 'root',
       tags TEXT DEFAULT '[]',
-      embedding F32_BLOB(${dimensions}),
+      embedding F32_BLOB(${vectorDimensions}),
       created_at TEXT NOT NULL,
       updated_at TEXT NOT NULL
     )
   `);
   await client.execute(`
-    CREATE INDEX IF NOT EXISTS ${tableName}_embedding_idx
-    ON ${tableName}(libsql_vector_idx(embedding))
+    CREATE INDEX IF NOT EXISTS ${quotedEmbeddingIndexName}
+    ON ${quotedTableName}(libsql_vector_idx(embedding))
   `);
   await client.execute(`
-    CREATE INDEX IF NOT EXISTS ${tableName}_folder_idx
-    ON ${tableName}(folder)
+    CREATE INDEX IF NOT EXISTS ${quotedFolderIndexName}
+    ON ${quotedTableName}(folder)
   `);
   await client.execute(`
-    CREATE INDEX IF NOT EXISTS ${tableName}_slug_idx
-    ON ${tableName}(slug)
+    CREATE INDEX IF NOT EXISTS ${quotedSlugIndexName}
+    ON ${quotedTableName}(slug)
   `);
 }
 
@@ -242,6 +276,8 @@ async function search(options) {
     tableName = "articles",
     embeddingOptions = {}
   } = options;
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
+  const resultLimit = normalizeSearchLimit(limit);
   const queryEmbedding = await generateEmbedding(query, embeddingOptions);
   const results = await client.execute({
     sql: `
@@ -254,12 +290,12 @@ async function search(options) {
         tags,
         created_at,
         vector_distance_cos(embedding, vector(?)) as distance
-      FROM ${tableName}
+      FROM ${quotedTableName}
       WHERE embedding IS NOT NULL
       ORDER BY distance
       LIMIT ?
     `,
-    args: [JSON.stringify(queryEmbedding), limit]
+    args: [JSON.stringify(queryEmbedding), resultLimit]
   });
   return results.rows.map((row) => ({
     id: row.id,
@@ -273,9 +309,10 @@ async function search(options) {
   }));
 }
 async function getAllArticles(client, tableName = "articles") {
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
   const results = await client.execute(`
     SELECT id, slug, title, folder, tags, created_at, updated_at
-    FROM ${tableName}
+    FROM ${quotedTableName}
     ORDER BY title
   `);
   return results.rows.map((row) => ({
@@ -289,10 +326,11 @@ async function getAllArticles(client, tableName = "articles") {
   }));
 }
 async function getArticleBySlug(client, slug, tableName = "articles") {
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
   const results = await client.execute({
     sql: `
       SELECT id, slug, title, content, folder, tags, created_at, updated_at
-      FROM ${tableName}
+      FROM ${quotedTableName}
       WHERE slug = ?
       LIMIT 1
     `,
@@ -314,10 +352,11 @@ async function getArticleBySlug(client, slug, tableName = "articles") {
   };
 }
 async function getArticlesByFolder(client, folder, tableName = "articles") {
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
   const results = await client.execute({
     sql: `
       SELECT id, slug, title, folder, tags
-      FROM ${tableName}
+      FROM ${quotedTableName}
       WHERE folder = ?
       ORDER BY title
     `,
@@ -332,9 +371,10 @@ async function getArticlesByFolder(client, folder, tableName = "articles") {
   }));
 }
 async function getFolders(client, tableName = "articles") {
+  const quotedTableName = quoteSqlIdentifier(tableName, "tableName");
   const results = await client.execute(`
     SELECT DISTINCT folder
-    FROM ${tableName}
+    FROM ${quotedTableName}
     ORDER BY folder
   `);
   return results.rows.map((row) => row.folder);

package/docs/API.md

@@ -37,6 +37,11 @@ Defaults:
 - `tableName`: `"articles"`
 - `dimensions`: `768`
 
+`tableName` must be an ASCII SQLite identifier matching
+`[A-Za-z_][A-Za-z0-9_]*`. Valid identifiers are quoted internally, so reserved
+words such as `"select"` are safe to use. `dimensions` must be a positive
+integer.
+
 The created schema includes:
 
 - `id` primary key
@@ -71,6 +76,8 @@ Defaults:
 - `exclude`: ["node_modules", ".git", "dist", "build"]
 - `tableName`: `"articles"`
 
+`tableName` follows the same identifier policy as `createTable()`.
+
 Return shape:
 
 ```ts
@@ -107,6 +114,10 @@ Defaults:
 - `limit`: `10`
 - `tableName`: `"articles"`
 
+`limit` must be an integer from `1` through `100`; invalid values are rejected
+before query embedding generation. `tableName` follows the same identifier
+policy as `createTable()`.
+
 Result shape:
 
 ```ts
@@ -142,6 +153,8 @@ Returns articles in a specific folder.
 
 Returns distinct folder names from the index.
 
+All article retrieval helpers validate `tableName` before executing SQL.
+
 ## Embedding Helpers
 
 ### `generateEmbedding(text, options?)`

package/docs/INDEXING.md

@@ -57,8 +57,10 @@ site build:
 
 ## Table Names
 
-`tableName` is interpolated into SQL. Treat it as a trusted identifier coming
-from your own configuration, not from user input.
+`tableName` must be an ASCII SQLite identifier matching
+`[A-Za-z_][A-Za-z0-9_]*`. Valid names are quoted internally for table and index
+SQL, so reserved words such as `"select"` work safely. Invalid names fail before
+database calls or embedding generation.
 
 ## Runtime Notes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libsql-search",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Semantic search for static sites using libSQL/Turso with multi-provider embeddings",
   "type": "module",
   "packageManager": "pnpm@10.34.5",