neoorm 0.9.6 → 0.9.7

package/dist/runtime/regex-guard.js

@@ -0,0 +1,124 @@
+/**
+ * Guards SQLite `search`/`REGEXP` against catastrophic-backtracking (ReDoS)
+ * patterns.
+ *
+ * On SQLite the pattern runs as an in-process JavaScript `RegExp` inside the
+ * driver's single shared connection, so an exponential-backtracking pattern
+ * (e.g. `(a+)+$`) freezes the whole event loop, not just one query.
+ * PostgreSQL and MySQL execute REGEXP in the database server, where
+ * `statement_timeout` bounds a runaway match, so this guard is SQLite-only.
+ *
+ * The detector flags the classic nested-unbounded-quantifier shape (star
+ * height ≥ 2): an unbounded quantifier (`*`, `+`, `{n,}`) applied to a group
+ * whose body itself contains an unbounded quantifier — `(a+)+`, `(a*)*`,
+ * `(\d+)+`, `((ab)+)+`. It is a heuristic: overlapping-alternation shapes
+ * like `(a|a)*` slip through, and a rare ambiguous-but-practically-linear
+ * pattern like `(a+b)+` is rejected. `SqliteClientOptions.unsafeAllowRegex`
+ * opts out for the latter case.
+ */
+const OPEN_ENDED_REPEAT = /\{\d+,\}\??/y;
+/** Length of the unbounded quantifier (`*`, `+`, `{n,}`, with optional lazy `?`) at `index`, or 0. */
+function unboundedQuantifierLength(pattern, index) {
+    const ch = pattern[index];
+    if (ch === "*" || ch === "+") {
+        return pattern[index + 1] === "?" ? 2 : 1;
+    }
+    if (ch === "{") {
+        OPEN_ENDED_REPEAT.lastIndex = index;
+        return OPEN_ENDED_REPEAT.exec(pattern)?.[0].length ?? 0;
+    }
+    return 0;
+}
+/**
+ * Returns true when `pattern` nests an unbounded quantifier inside another
+ * unbounded quantifier — the shape that backtracks exponentially. Assumes a
+ * syntactically valid pattern (callers compile with `new RegExp` anyway, so
+ * malformed input surfaces as a SyntaxError after this returns false).
+ */
+export function hasCatastrophicBacktracking(pattern) {
+    // One frame per open group; index 0 is the synthetic top level. Each frame
+    // records whether its body contains an unbounded quantifier.
+    const frames = [false];
+    // True when the preceding atom was itself unbounded-quantified, so a
+    // following quantifier wraps it: `a+*` is `(a+)*`.
+    let prevQuantifiedAtom = false;
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === "\\") {
+            i++;
+            prevQuantifiedAtom = false;
+            continue;
+        }
+        if (ch === "[") {
+            // Character-class contents are literals; skip to the closing bracket.
+            i++;
+            if (pattern[i] === "^")
+                i++;
+            if (pattern[i] === "]")
+                i++;
+            while (i < pattern.length && pattern[i] !== "]") {
+                if (pattern[i] === "\\")
+                    i++;
+                i++;
+            }
+            prevQuantifiedAtom = false;
+            continue;
+        }
+        if (ch === "(") {
+            frames.push(false);
+            prevQuantifiedAtom = false;
+            continue;
+        }
+        if (ch === ")") {
+            if (frames.length === 1) {
+                // Unbalanced `)`; RegExp will reject the pattern later.
+                prevQuantifiedAtom = false;
+                continue;
+            }
+            const bodyHasQuantifier = frames.pop() ?? false;
+            const quantifier = unboundedQuantifierLength(pattern, i + 1);
+            // The quantifier wraps the whole group body: nested iff the body
+            // itself contains an unbounded quantifier.
+            if (bodyHasQuantifier && quantifier > 0)
+                return true;
+            if (quantifier > 0) {
+                // The quantifier starts at i+1; skip past its last char so it
+                // is not re-processed as a fresh quantifier below.
+                i += quantifier;
+                prevQuantifiedAtom = true;
+            }
+            else {
+                prevQuantifiedAtom = false;
+            }
+            // The group's contents (and its quantifier, if any) live inside the
+            // parent body: `((a+))+` is star height 2 once the outer group is
+            // quantified.
+            if (bodyHasQuantifier || quantifier > 0) {
+                frames[frames.length - 1] = true;
+            }
+            continue;
+        }
+        const quantifier = unboundedQuantifierLength(pattern, i);
+        if (quantifier > 0) {
+            if (prevQuantifiedAtom)
+                return true;
+            i += quantifier - 1;
+            frames[frames.length - 1] = true;
+            prevQuantifiedAtom = true;
+            continue;
+        }
+        prevQuantifiedAtom = false;
+    }
+    return false;
+}
+const MAX_SHOWN_PATTERN_LENGTH = 100;
+/** Message for a rejected pattern; safe to surface in query errors. */
+export function catastrophicRegexMessage(pattern) {
+    const shown = pattern.length > MAX_SHOWN_PATTERN_LENGTH
+        ? `${pattern.slice(0, MAX_SHOWN_PATTERN_LENGTH)}…`
+        : pattern;
+    return (`SQLite REGEXP pattern ${JSON.stringify(shown)} nests unbounded quantifiers ` +
+        '(e.g. "(a+)+") and can backtrack exponentially, freezing the process. ' +
+        "Simplify the pattern, or pass { unsafeAllowRegex: true } to sqliteClient() to allow it.");
+}
+//# sourceMappingURL=regex-guard.js.map

package/dist/runtime/regex-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex-guard.js","sourceRoot":"","sources":["../../src/runtime/regex-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC,sGAAsG;AACtG,SAAS,yBAAyB,CAAC,OAAe,EAAE,KAAa;IAChE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QAChB,iBAAiB,CAAC,SAAS,GAAG,KAAK,CAAC;QACpC,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe;IAC1D,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,MAAM,GAAc,CAAC,KAAK,CAAC,CAAC;IAClC,qEAAqE;IACrE,mDAAmD;IACnD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACjB,CAAC,EAAE,CAAC;YACJ,kBAAkB,GAAG,KAAK,CAAC;YAC3B,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,sEAAsE;YACtE,CAAC,EAAE,CAAC;YACJ,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACjD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;gBAC7B,CAAC,EAAE,CAAC;YACL,CAAC;YACD,kBAAkB,GAAG,KAAK,CAAC;YAC3B,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,kBAAkB,GAAG,KAAK,CAAC;YAC3B,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,wDAAwD;gBACxD,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,SAAS;YACV,CAAC;YACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;YAChD,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,iEAAiE;YACjE,2CAA2C;YAC3C,IAAI,iBAAiB,IAAI,UAAU,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACpB,8DAA8D;gBAC9D,mDAAmD;gBACnD,CAAC,IAAI,UAAU,CAAC;gBAChB,kBAAkB,GAAG,IAAI,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACP,kBAAkB,GAAG,KAAK,CAAC;YAC5B,CAAC;YACD,oEAAoE;YACpE,kEAAkE;YAClE,cAAc;YACd,IAAI,iBAAiB,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;YAClC,CAAC;YACD,SAAS;QACV,CAAC;QACD,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,kBAAkB;gBAAE,OAAO,IAAI,CAAC;YACpC,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;YACjC,kBAAkB,GAAG,IAAI,CAAC;YAC1B,SAAS;QACV,CAAC;QACD,kBAAkB,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,uEAAuE;AACvE,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACvD,MAAM,KAAK,GACV,OAAO,CAAC,MAAM,GAAG,wBAAwB;QACxC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,GAAG;QAClD,CAAC,CAAC,OAAO,CAAC;IACZ,OAAO,CACN,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,+BAA+B;QAC7E,wEAAwE;QACxE,yFAAyF,CACzF,CAAC;AACH,CAAC"}

package/dist/runtime/regex-guard.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=regex-guard.test.d.ts.map

package/dist/runtime/regex-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex-guard.test.d.ts","sourceRoot":"","sources":["../../src/runtime/regex-guard.test.ts"],"names":[],"mappings":""}

package/dist/runtime/regex-guard.test.js

@@ -0,0 +1,63 @@
+import { describe, expect, it } from "vitest";
+import { catastrophicRegexMessage, hasCatastrophicBacktracking, } from "./regex-guard.js";
+describe("hasCatastrophicBacktracking", () => {
+    it.each([
+        "(a+)+",
+        "(a*)*",
+        "(a+)*",
+        "(a*)+",
+        "(a+)+$",
+        "^(a+)+$",
+        "(\\d+)+",
+        "((ab)+)+",
+        "(?:x+){2,}",
+        "(\\w+\\s*)+",
+        "(a{2,})+",
+        "a+*",
+        "(a+){3,}",
+    ])("flags nested unbounded quantifiers: %s", (pattern) => {
+        expect(hasCatastrophicBacktracking(pattern)).toBe(true);
+    });
+    it.each([
+        "(a)+",
+        "a+",
+        "^foo$",
+        "[a+]+",
+        "([a+])+",
+        "https?://",
+        "a+b+",
+        "foo{2,3}",
+        "(?:ab)+",
+        "(foo|bar)+",
+        "(\\+\\+)+",
+        "\\+",
+        "(a+)?",
+        "(a+){2,3}",
+        "[0-9]+\\.[0-9]+",
+    ])("allows benign patterns: %s", (pattern) => {
+        expect(hasCatastrophicBacktracking(pattern)).toBe(false);
+    });
+    it.each([
+        ")",
+        "(a+",
+        "[a+",
+        "{2,}",
+        "(?",
+        "[]",
+    ])("does not throw on malformed input: %s", (pattern) => {
+        expect(() => hasCatastrophicBacktracking(pattern)).not.toThrow();
+    });
+});
+describe("catastrophicRegexMessage", () => {
+    it("names the pattern and the opt-out", () => {
+        const message = catastrophicRegexMessage("(a+)+$");
+        expect(message).toContain("(a+)+$");
+        expect(message).toContain("unsafeAllowRegex");
+    });
+    it("truncates very long patterns", () => {
+        const message = catastrophicRegexMessage("a".repeat(500));
+        expect(message).toContain(`${"a".repeat(100)}…`);
+        expect(message).not.toContain("a".repeat(101));
+    });
+});
+//# sourceMappingURL=regex-guard.test.js.map

package/dist/runtime/regex-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex-guard.test.js","sourceRoot":"","sources":["../../src/runtime/regex-guard.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACN,wBAAwB,EACxB,2BAA2B,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,IAAI,CAAC;QACP,OAAO;QACP,OAAO;QACP,OAAO;QACP,OAAO;QACP,QAAQ;QACR,SAAS;QACT,SAAS;QACT,UAAU;QACV,YAAY;QACZ,aAAa;QACb,UAAU;QACV,KAAK;QACL,UAAU;KACV,CAAC,CAAC,wCAAwC,EAAE,CAAC,OAAO,EAAE,EAAE;QACxD,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACP,MAAM;QACN,IAAI;QACJ,OAAO;QACP,OAAO;QACP,SAAS;QACT,WAAW;QACX,MAAM;QACN,UAAU;QACV,SAAS;QACT,YAAY;QACZ,WAAW;QACX,KAAK;QACL,OAAO;QACP,WAAW;QACX,iBAAiB;KACjB,CAAC,CAAC,4BAA4B,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACP,GAAG;QACH,KAAK;QACL,KAAK;QACL,MAAM;QACN,IAAI;QACJ,IAAI;KACJ,CAAC,CAAC,uCAAuC,EAAE,CAAC,OAAO,EAAE,EAAE;QACvD,MAAM,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC5C,MAAM,OAAO,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACvC,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/runtime/sqlite-open.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-open.d.ts","sourceRoot":"","sources":["../../src/runtime/sqlite-open.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AActD,oFAAoF;AACpF,wBAAgB,yBAAyB,CACxC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,CAOR;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAyB3E"}
+{"version":3,"file":"sqlite-open.d.ts","sourceRoot":"","sources":["../../src/runtime/sqlite-open.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAqBtD,oFAAoF;AACpF,wBAAgB,yBAAyB,CACxC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,CAOR;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAsC3E"}

package/dist/runtime/sqlite-open.js

@@ -2,12 +2,18 @@ import { createRequire } from "node:module";
 import { schemaError } from "./error-builders.js";
 import { SchemaErrorCode } from "./error-codes.js";
 const require = createRequire(import.meta.url);
-const POSTGRES_URL = /^(postgres(ql)?:)/i;
+// A `scheme://` prefix marks a connection URL. Only `file:`/`sqlite:` are
+// valid SQLite URIs; every other scheme (postgres://, mysql://, mariadb://, …)
+// is another engine's connection URL and must never become a literal file path.
+const URL_SCHEME = /^([a-z][a-z0-9+.-]*):\/\//i;
+const SQLITE_URI_SCHEMES = new Set(["file", "sqlite"]);
 function usableSqlitePath(path) {
     if (!path)
         return undefined;
-    if (POSTGRES_URL.test(path))
+    const scheme = URL_SCHEME.exec(path)?.[1]?.toLowerCase();
+    if (scheme !== undefined && !SQLITE_URI_SCHEMES.has(scheme)) {
         return undefined;
+    }
     return path;
 }
 /** File path or `:memory:` for SQLite. Ignores PostgreSQL `DATABASE_URL` values. */
@@ -20,20 +26,29 @@ export function resolveSqliteDatabasePath(databasePath, manifestUrl) {
 export function openSqliteDatabase(databasePath) {
     const bunRuntime = typeof globalThis.Bun !== "undefined";
     if (bunRuntime) {
+        let Database;
         try {
-            const { Database } = require("bun:sqlite");
-            return new Database(databasePath);
+            Database = require("bun:sqlite").Database;
         }
         catch {
-            // fall through to node:sqlite
+            // bun:sqlite unavailable — fall through to node:sqlite
+        }
+        if (Database) {
+            // Open outside the require try: a real open failure (bad path,
+            // permissions, is-a-directory) must surface as itself, not be
+            // conflated with a missing driver.
+            return new Database(databasePath);
         }
     }
+    let DatabaseSync;
     try {
-        const { DatabaseSync } = require("node:sqlite");
-        return new DatabaseSync(databasePath);
+        DatabaseSync = require("node:sqlite").DatabaseSync;
     }
     catch {
         throw schemaError(SchemaErrorCode.invalid_config, "No SQLite driver available. Provide a `db` instance, or run on Bun or Node.js 22.5+ so `databasePath` can be opened automatically.");
     }
+    // Open outside the require try: a real open failure must surface as itself,
+    // not be reported as "No SQLite driver available".
+    return new DatabaseSync(databasePath);
 }
 //# sourceMappingURL=sqlite-open.js.map

package/dist/runtime/sqlite-open.js.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-open.js","sourceRoot":"","sources":["../../src/runtime/sqlite-open.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAE1C,SAAS,gBAAgB,CAAC,IAAwB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,yBAAyB,CACxC,YAAgC,EAChC,WAA+B;IAE/B,OAAO,CACN,gBAAgB,CAAC,YAAY,CAAC;QAC9B,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC1C,gBAAgB,CAAC,WAAW,CAAC;QAC7B,UAAU,CACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,YAAoB;IACtD,MAAM,UAAU,GACf,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW,CAAC;IAC9D,IAAI,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC;YACJ,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,CAExC,CAAC;YACF,OAAO,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACR,8BAA8B;QAC/B,CAAC;IACF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,aAAa,CAE7C,CAAC;QACF,OAAO,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,WAAW,CAChB,eAAe,CAAC,cAAc,EAC9B,oIAAoI,CACpI,CAAC;IACH,CAAC;AACF,CAAC"}
+{"version":3,"file":"sqlite-open.js","sourceRoot":"","sources":["../../src/runtime/sqlite-open.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,0EAA0E;AAC1E,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAChD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEvD,SAAS,gBAAgB,CAAC,IAAwB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,yBAAyB,CACxC,YAAgC,EAChC,WAA+B;IAE/B,OAAO,CACN,gBAAgB,CAAC,YAAY,CAAC;QAC9B,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC1C,gBAAgB,CAAC,WAAW,CAAC;QAC7B,UAAU,CACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,YAAoB;IACtD,MAAM,UAAU,GACf,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW,CAAC;IAC9D,IAAI,UAAU,EAAE,CAAC;QAChB,IAAI,QAAgE,CAAC;QACrE,IAAI,CAAC;YACJ,QAAQ,GACP,OAAO,CAAC,YAAY,CAGpB,CAAC,QAAQ,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACR,uDAAuD;QACxD,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,+DAA+D;YAC/D,8DAA8D;YAC9D,mCAAmC;YACnC,OAAO,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;IACF,CAAC;IAED,IAAI,YAAoE,CAAC;IACzE,IAAI,CAAC;QACJ,YAAY,GACX,OAAO,CAAC,aAAa,CAGrB,CAAC,YAAY,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,WAAW,CAChB,eAAe,CAAC,cAAc,EAC9B,oIAAoI,CACpI,CAAC;IACH,CAAC;IACD,4EAA4E;IAC5E,mDAAmD;IACnD,OAAO,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC"}

package/dist/runtime/sqlite-open.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sqlite-open.test.d.ts.map

package/dist/runtime/sqlite-open.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-open.test.d.ts","sourceRoot":"","sources":["../../src/runtime/sqlite-open.test.ts"],"names":[],"mappings":""}

package/dist/runtime/sqlite-open.test.js

@@ -0,0 +1,66 @@
+import { mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, afterEach, describe, expect, it } from "vitest";
+import { openSqliteDatabase, resolveSqliteDatabasePath, } from "./sqlite-open.js";
+const workDir = join(tmpdir(), "neoorm-sqlite-open-test");
+afterAll(() => {
+    rmSync(workDir, { recursive: true, force: true });
+});
+describe("openSqliteDatabase error reporting", () => {
+    it("surfaces a real open failure instead of 'no driver available'", () => {
+        // node:sqlite is present here (its require succeeds). Only the open
+        // fails because the parent directory does not exist. That real error
+        // must not be swallowed and re-reported as a missing driver.
+        mkdirSync(workDir, { recursive: true });
+        expect(() => openSqliteDatabase(join(workDir, "no", "such", "dir", "db.sqlite"))).toThrowError(/unable to open database file/);
+        expect(() => openSqliteDatabase(join(workDir, "no", "such", "dir", "db.sqlite"))).not.toThrowError(/No SQLite driver available/);
+    });
+    it("surfaces a real open failure when the path is a directory", () => {
+        mkdirSync(workDir, { recursive: true });
+        expect(() => openSqliteDatabase(workDir)).toThrowError(/unable to open database file/);
+        expect(() => openSqliteDatabase(workDir)).not.toThrowError(/No SQLite driver available/);
+    });
+});
+describe("resolveSqliteDatabasePath URL handling", () => {
+    const envSave = process.env.DATABASE_URL;
+    afterEach(() => {
+        delete process.env.DATABASE_URL;
+        if (envSave !== undefined)
+            process.env.DATABASE_URL = envSave;
+    });
+    it("ignores non-SQLite connection URLs (mysql, mariadb, …), like postgres", () => {
+        delete process.env.DATABASE_URL;
+        // These are other engines' connection URLs, never literal file paths.
+        expect(resolveSqliteDatabasePath(undefined, "mysql://h/db")).toBe(":memory:");
+        expect(resolveSqliteDatabasePath(undefined, "mariadb://h/db")).toBe(":memory:");
+        expect(resolveSqliteDatabasePath(undefined, "postgres://h/db")).toBe(":memory:");
+        expect(resolveSqliteDatabasePath(undefined, "postgresql://h/db")).toBe(":memory:");
+        expect(resolveSqliteDatabasePath(undefined, "mongodb://h/db")).toBe(":memory:");
+    });
+    it("passes SQLite file URIs and plain paths through unchanged", () => {
+        delete process.env.DATABASE_URL;
+        expect(resolveSqliteDatabasePath(undefined, "file:/tmp/x.db")).toBe("file:/tmp/x.db");
+        expect(resolveSqliteDatabasePath(undefined, "file:///tmp/x.db")).toBe("file:///tmp/x.db");
+        expect(resolveSqliteDatabasePath(undefined, "sqlite:/tmp/x.db")).toBe("sqlite:/tmp/x.db");
+        expect(resolveSqliteDatabasePath(undefined, ":memory:")).toBe(":memory:");
+        expect(resolveSqliteDatabasePath("./rel.db", undefined)).toBe("./rel.db");
+        // A Windows path has a drive letter but no `//`, so it is not a URL.
+        expect(resolveSqliteDatabasePath(undefined, "C:\\data\\x.db")).toBe("C:\\data\\x.db");
+    });
+    it("falls through a bad explicit URL to the next usable source", () => {
+        delete process.env.DATABASE_URL;
+        // explicit databasePath is a mysql URL → not usable → manifest path wins
+        expect(resolveSqliteDatabasePath("mysql://h/db", "/tmp/ok.db")).toBe("/tmp/ok.db");
+    });
+    it("prefers an explicit path and falls back to :memory:", () => {
+        delete process.env.DATABASE_URL;
+        expect(resolveSqliteDatabasePath("/abs/x.db", "mysql://h/db")).toBe("/abs/x.db");
+        expect(resolveSqliteDatabasePath(undefined, undefined)).toBe(":memory:");
+    });
+    it("ignores a non-SQLite DATABASE_URL and uses the manifest url", () => {
+        process.env.DATABASE_URL = "postgres://env/db";
+        expect(resolveSqliteDatabasePath(undefined, "/tmp/m.db")).toBe("/tmp/m.db");
+    });
+});
+//# sourceMappingURL=sqlite-open.test.js.map

package/dist/runtime/sqlite-open.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-open.test.js","sourceRoot":"","sources":["../../src/runtime/sqlite-open.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EACN,kBAAkB,EAClB,yBAAyB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC;AAE1D,QAAQ,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,6DAA6D;QAC7D,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,EAAE,CACX,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CACnE,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,EAAE,CACX,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CACnE,CAAC,GAAG,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACpE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CACrD,8BAA8B,CAC9B,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CACzD,4BAA4B,CAC5B,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACzC,SAAS,CAAC,GAAG,EAAE;QACd,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAChF,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,sEAAsE;QACtE,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAChE,UAAU,CACV,CAAC;QACF,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAClE,UAAU,CACV,CAAC;QACF,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CACnE,UAAU,CACV,CAAC;QACF,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,CACrE,UAAU,CACV,CAAC;QACF,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAClE,UAAU,CACV,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACpE,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAClE,gBAAgB,CAChB,CAAC;QACF,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,IAAI,CACpE,kBAAkB,CAClB,CAAC;QACF,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,IAAI,CACpE,kBAAkB,CAClB,CAAC;QACF,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAC5D,UAAU,CACV,CAAC;QACF,MAAM,CAAC,yBAAyB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAC5D,UAAU,CACV,CAAC;QACF,qEAAqE;QACrE,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAClE,gBAAgB,CAChB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,yEAAyE;QACzE,MAAM,CAAC,yBAAyB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CACnE,YAAY,CACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC9D,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,MAAM,CAAC,yBAAyB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAClE,WAAW,CACX,CAAC;QACF,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAC3D,UAAU,CACV,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACtE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,mBAAmB,CAAC;QAC/C,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAC7D,WAAW,CACX,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/sql/split-statements.d.ts

@@ -0,0 +1,15 @@
+export type SplitStatementsOptions = {
+    /**
+     * Treat `\` as an escape character inside quoted strings and quoted
+     * identifiers (MySQL/MariaDB string syntax). Off by default: SQLite and
+     * PostgreSQL treat a backslash as a literal character in strings.
+     */
+    backslashEscapes?: boolean;
+};
+/**
+ * Split a SQL script into individual statements on `;` boundaries, honoring
+ * quoted strings, quoted identifiers (backticks/double quotes), and
+ * line/block comments — so `;` inside any of them never splits.
+ */
+export declare function splitStatements(sql: string, options?: SplitStatementsOptions): string[];
+//# sourceMappingURL=split-statements.d.ts.map

package/dist/sql/split-statements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"split-statements.d.ts","sourceRoot":"","sources":["../../src/sql/split-statements.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sBAAsB,GAAG;IACpC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,sBAAsB,GAC9B,MAAM,EAAE,CA6HV"}

package/dist/sql/split-statements.js

@@ -0,0 +1,132 @@
+/**
+ * Split a SQL script into individual statements on `;` boundaries, honoring
+ * quoted strings, quoted identifiers (backticks/double quotes), and
+ * line/block comments — so `;` inside any of them never splits.
+ */
+export function splitStatements(sql, options) {
+    const backslash = options?.backslashEscapes === true;
+    const statements = [];
+    let current = "";
+    let inSingle = false;
+    let inDouble = false;
+    let inBacktick = false;
+    let inLineComment = false;
+    let inBlockComment = false;
+    for (let i = 0; i < sql.length; i++) {
+        const ch = sql[i];
+        const next = sql[i + 1];
+        if (inLineComment) {
+            current += ch;
+            if (ch === "\n")
+                inLineComment = false;
+            continue;
+        }
+        if (inBlockComment) {
+            current += ch;
+            if (ch === "*" && next === "/") {
+                current += next;
+                i++;
+                inBlockComment = false;
+            }
+            continue;
+        }
+        if (inSingle) {
+            current += ch;
+            if (backslash && ch === "\\") {
+                if (next !== undefined) {
+                    current += next;
+                    i++;
+                }
+                continue;
+            }
+            if (ch === "'") {
+                if (next === "'") {
+                    current += next;
+                    i++;
+                }
+                else {
+                    inSingle = false;
+                }
+            }
+            continue;
+        }
+        if (inDouble) {
+            current += ch;
+            if (backslash && ch === "\\") {
+                if (next !== undefined) {
+                    current += next;
+                    i++;
+                }
+                continue;
+            }
+            if (ch === '"') {
+                if (next === '"') {
+                    current += next;
+                    i++;
+                }
+                else {
+                    inDouble = false;
+                }
+            }
+            continue;
+        }
+        if (inBacktick) {
+            current += ch;
+            if (backslash && ch === "\\") {
+                if (next !== undefined) {
+                    current += next;
+                    i++;
+                }
+                continue;
+            }
+            if (ch === "`") {
+                if (next === "`") {
+                    current += next;
+                    i++;
+                }
+                else {
+                    inBacktick = false;
+                }
+            }
+            continue;
+        }
+        if (ch === "-" && next === "-") {
+            inLineComment = true;
+            current += ch;
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            inBlockComment = true;
+            current += ch;
+            continue;
+        }
+        if (ch === "'") {
+            inSingle = true;
+            current += ch;
+            continue;
+        }
+        if (ch === '"') {
+            inDouble = true;
+            current += ch;
+            continue;
+        }
+        if (ch === "`") {
+            inBacktick = true;
+            current += ch;
+            continue;
+        }
+        if (ch === ";") {
+            if (current.trim().length > 0) {
+                statements.push(current.trim());
+            }
+            current = "";
+            continue;
+        }
+        current += ch;
+    }
+    if (current.trim().length > 0) {
+        statements.push(current.trim());
+    }
+    return statements.length > 0 ? statements : [sql];
+}
+//# sourceMappingURL=split-statements.js.map

package/dist/sql/split-statements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"split-statements.js","sourceRoot":"","sources":["../../src/sql/split-statements.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC9B,GAAW,EACX,OAAgC;IAEhC,MAAM,SAAS,GAAG,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACrD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAExB,IAAI,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,EAAE,CAAC;YACd,IAAI,EAAE,KAAK,IAAI;gBAAE,aAAa,GAAG,KAAK,CAAC;YACvC,SAAS;QACV,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACpB,OAAO,IAAI,EAAE,CAAC;YACd,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAChC,OAAO,IAAI,IAAI,CAAC;gBAChB,CAAC,EAAE,CAAC;gBACJ,cAAc,GAAG,KAAK,CAAC;YACxB,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,EAAE,CAAC;YACd,IAAI,SAAS,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,IAAI,IAAI,CAAC;oBAChB,CAAC,EAAE,CAAC;gBACL,CAAC;gBACD,SAAS;YACV,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAChB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBAClB,OAAO,IAAI,IAAI,CAAC;oBAChB,CAAC,EAAE,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACP,QAAQ,GAAG,KAAK,CAAC;gBAClB,CAAC;YACF,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,EAAE,CAAC;YACd,IAAI,SAAS,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,IAAI,IAAI,CAAC;oBAChB,CAAC,EAAE,CAAC;gBACL,CAAC;gBACD,SAAS;YACV,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAChB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBAClB,OAAO,IAAI,IAAI,CAAC;oBAChB,CAAC,EAAE,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACP,QAAQ,GAAG,KAAK,CAAC;gBAClB,CAAC;YACF,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,EAAE,CAAC;YACd,IAAI,SAAS,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,IAAI,IAAI,CAAC;oBAChB,CAAC,EAAE,CAAC;gBACL,CAAC;gBACD,SAAS;YACV,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAChB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBAClB,OAAO,IAAI,IAAI,CAAC;oBAChB,CAAC,EAAE,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACP,UAAU,GAAG,KAAK,CAAC;gBACpB,CAAC;YACF,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,aAAa,GAAG,IAAI,CAAC;YACrB,OAAO,IAAI,EAAE,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,cAAc,GAAG,IAAI,CAAC;YACtB,OAAO,IAAI,EAAE,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,IAAI,EAAE,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,IAAI,EAAE,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,IAAI,EAAE,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACjC,CAAC;YACD,OAAO,GAAG,EAAE,CAAC;YACb,SAAS;QACV,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC"}

package/docs/migrate-dev-workflow.md

@@ -0,0 +1,84 @@
+# `migrate dev` Workflow
+
+This guide records the workflow contract and the implementation changes behind `neoorm migrate dev`. The refactor preserves the command's migration order and user-visible output timing.
+
+## Runtime contract
+
+`runMigrateDev` derives `migrationsDir` from `outDir` and runs the complete sequence inside `withMigrateDevLock`:
+
+1. Read the snapshot, compile the target schema, reconcile pending `CREATE TABLE` migrations against the live database, then apply remaining pending migrations.
+2. Generate from the current schema. If generation fails with the existing missing-migration-name error, no explicit name was supplied, and the CLI provided an interactive prompt callback, ask once and retry once. Other errors propagate unchanged. If generation needs no migration, it does not prompt.
+3. Emit the generation summary and warnings, then reconcile a newly written migration against existing tables or apply it when reconciliation did not record it.
+4. Return whether destructive changes were blocked; the CLI sets `process.exitCode` after the workflow completes.
+
+The lock covers snapshot reading, both reconciliation/deployment phases, generation, and the optional prompt. Progress events keep the CLI output at the same stage as before: pending-migration output precedes a possible prompt, while generation output precedes post-generation reconciliation/application.
+
+## File-by-file changes
+
+### `src/migrate/dev-workflow.ts`
+
+- **Before:** The ordered `migrate dev` sequence had no dedicated workflow module; the CLI path coordinated it.
+- **After:** `runMigrateDev` owns snapshot reading, initial reconciliation/deployment, generation, the optional one-shot prompt/retry, and post-generation reconciliation/deployment. A typed progress-event union reports completed stages, while existing migration and code-generation helpers remain responsible for their work. The migration directory is derived from `outDir`.
+- **Why it is useful:** The lock scope and ordering have one owner, and the workflow can be tested through a small interface without a CLI/TTY harness.
+
+### `src/bin/neoorm.ts`
+
+- **Before:** The CLI command path contained the `migrate dev` orchestration alongside the separate `migrate deploy` path.
+- **After:** `migrate dev` calls `runMigrateDev`, adapts its progress events to the existing console output, supplies the prompt callback only for interactive runs, and handles the returned destructive-blocked status. `migrate deploy` remains on its separate path.
+- **Why it is useful:** Terminal interaction and presentation stay in the CLI, while moving orchestration does not delay or reorder output around the prompt.
+
+### `src/codegen/generate.ts`
+
+- **Before:** The missing-migration-name predicate lived in the CLI even though both regular `generate` and `migrate dev` use it.
+- **After:** The same predicate lives beside `missingMigrationNameError` in the code-generation module and is shared by both callers.
+- **Why it is useful:** There is one definition of the narrow prompt-eligibility check; its error conditions are unchanged, not broadened into general error handling.
+
+### `test/migrate-dev-workflow.test.ts`
+
+- **Before:** Existing tests covered migration, generation, and lock helpers separately, but not their ordering at the workflow boundary.
+- **After:** Real in-memory SQLite tests verify that a pending migration is applied and the lock remains held when the controlled name prompt runs, and that an unchanged schema completes without prompting or creating another migration.
+- **Why it is useful:** The regression coverage checks observable database state and timing rather than mocked helper forwarding or CLI wiring.
+
+### `docs/migrations.md`
+
+- **Before:** The migration guide described command behavior but did not state the full `migrate dev` lock interval.
+- **After:** It documents that the lock starts before pending reconciliation and remains held through the optional name prompt, generation, and post-generation reconciliation/application; it links to this implementation guide.
+- **Why it is useful:** Readers can reason about concurrency and prompt timing from the documented contract.
+
+### `llms-full.txt`
+
+- **Before:** The generated documentation aggregate did not include the updated lock-lifetime note or this guide.
+- **After:** Regeneration mirrors the migration-guide update and includes the new workflow page.
+- **Why it is useful:** The aggregate stays aligned with the source documentation instead of presenting stale workflow details.
+
+### `examples/blog/seed.ts`
+
+- **Before:** The schema was imported as a runtime value even though it was used only for a type.
+- **After:** The import is type-only.
+- **Why it is useful:** TypeScript erases the import from emitted JavaScript, and lint no longer reports the type-only usage.
+
+### `docs/migrate-dev-workflow.md`
+
+- **Before:** There was no durable, file-by-file record of the workflow ownership, preserved behavior, and verification.
+- **After:** This page records the execution contract, concrete before/after changes, and their rationale.
+- **Why it is useful:** Future maintenance can distinguish an ownership refactor from an intended behavior change.
+
+## Preserved behavior and scope
+
+- Pending migrations are reconciled and applied before a missing name can be requested.
+- The prompt is limited to the existing missing-name condition and is attempted at most once; unchanged schemas do not prompt.
+- The migrate-dev lock remains held during the prompt and until post-generation reconciliation/application finishes.
+- The existing second schema compilation remains; this change does not optimize it.
+- `migrate deploy` keeps its separate execution path.
+
+## Verification
+
+The implementation verification below was recorded before this documentation continuation; it was not rerun as part of the documentation-only changes:
+
+- `bun run build` — passed.
+- `bun run test` — 128 files passed, 4 skipped; 1,215 tests passed, 42 skipped.
+- `bun run typecheck` and `bun run lint` — passed; lint was clean.
+- Focused migration suites — 4 files and 34 tests passed.
+- CLI fixture smoke — `migrate dev --name initial`, a no-name no-op `migrate dev`, and a no-op `migrate deploy` each exited 0; the SQLite database had the expected table and one applied ledger entry.
+
+The generated documentation is refreshed with `bun run docs:llms` after editing this page.

package/docs/migrations.md

@@ -28,6 +28,9 @@
 
 Migration names are slugified (`Add Users` → `add_users`, capped at 50 chars) and prefixed with a timestamp so folders sort in apply order. `--name` is only needed when a migration is created: the CLI prompts on a TTY at that point (after pending migrations are applied in `dev`) and errors in non-interactive runs. Runs with no schema changes (client regeneration only) and pending-apply-only `dev` runs succeed without `--name` and never prompt. Older `*_migration` folders still apply in order.
 
+`migrate dev` holds its lock from before pending reconciliation through the optional name prompt, generation, and post-generation reconciliation/application.
+For the implementation ordering and regression coverage, see [the workflow guide](migrate-dev-workflow.md).
+
 When migration is blocked, the CLI explains why — for example unsupported type casts (`alter_column_type_manual`), enum value changes, or destructive drops. Re-run with `--accept-data-loss` to include destructive DDL:
 
 ```bash

package/docs/sqlite.md

@@ -60,6 +60,8 @@ const db = createNeoOrmClient(manifest, {
 
 `busyTimeout` can also be a millisecond wait (`sqlite: { busyTimeout: 10_000 }`).
 
+SQLite runs `search`/`REGEXP` patterns in-process as JavaScript `RegExp`, so a catastrophic-backtracking pattern (e.g. `(a+)+$`) could freeze the whole process. neoorm rejects patterns that nest unbounded quantifiers; pass `sqlite: { unsafeAllowRegex: true }` to allow them anyway.
+
 ### Custom driver
 
 Pass any object implementing `prepare(sql)`, `exec(sql)`, and `close()` — the `node:sqlite` and `bun:sqlite` APIs both match. Useful for sandboxed runtimes or existing database handles: