tina4-nodejs 3.13.138 → 3.13.140

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. package/CLAUDE.md +2 -2
  2. package/package.json +1 -1
  3. package/packages/cli/dist/bin.js +683 -329
  4. package/packages/cli/src/commands/generate.ts +7 -13
  5. package/packages/core/dist/index.js +688 -329
  6. package/packages/core/src/api.ts +33 -4
  7. package/packages/core/src/auth.ts +73 -6
  8. package/packages/core/src/authGate.ts +27 -20
  9. package/packages/core/src/graphql.ts +92 -0
  10. package/packages/core/src/index.ts +1 -0
  11. package/packages/core/src/job.ts +8 -1
  12. package/packages/core/src/mcp.ts +3 -1
  13. package/packages/core/src/middleware.ts +4 -2
  14. package/packages/core/src/push.ts +16 -0
  15. package/packages/core/src/queue.ts +15 -2
  16. package/packages/core/src/queueBackends/liteBackend.ts +15 -0
  17. package/packages/core/src/queueBackends/mongoBackend.ts +40 -6
  18. package/packages/core/src/server.ts +6 -1
  19. package/packages/core/src/sessionHandlers/databaseHandler.ts +60 -3
  20. package/packages/core/src/sso.ts +12 -4
  21. package/packages/core/src/ssoIdentity.ts +19 -0
  22. package/packages/core/src/ssrf.ts +221 -0
  23. package/packages/core/src/testClient.ts +3 -0
  24. package/packages/core/src/websocket.ts +4 -2
  25. package/packages/frond/dist/index.js +6 -0
  26. package/packages/frond/src/engine.ts +9 -0
  27. package/packages/orm/dist/index.js +675 -320
  28. package/packages/orm/src/adapters/firebird.ts +14 -45
  29. package/packages/orm/src/adapters/mssql.ts +21 -58
  30. package/packages/orm/src/adapters/mysql.ts +10 -49
  31. package/packages/orm/src/adapters/odbc.ts +11 -42
  32. package/packages/orm/src/adapters/postgres.ts +20 -60
  33. package/packages/orm/src/adapters/sqlCrud.ts +178 -0
  34. package/packages/orm/src/adapters/sqlite.ts +46 -66
  35. package/packages/orm/src/index.ts +1 -1
  36. package/types/core/src/api.d.ts +6 -0
  37. package/types/core/src/auth.d.ts +30 -0
  38. package/types/core/src/graphql.d.ts +25 -0
  39. package/types/core/src/index.d.ts +1 -0
  40. package/types/core/src/job.d.ts +1 -0
  41. package/types/core/src/push.d.ts +5 -0
  42. package/types/core/src/queue.d.ts +7 -1
  43. package/types/core/src/queueBackends/liteBackend.d.ts +9 -0
  44. package/types/core/src/queueBackends/mongoBackend.d.ts +8 -1
  45. package/types/core/src/sessionHandlers/databaseHandler.d.ts +25 -1
  46. package/types/core/src/sso.d.ts +1 -0
  47. package/types/core/src/ssoIdentity.d.ts +10 -0
  48. package/types/core/src/ssrf.d.ts +19 -0
  49. package/types/orm/src/adapters/sqlCrud.d.ts +90 -0
  50. package/types/orm/src/adapters/sqlite.d.ts +17 -0
  51. package/types/orm/src/index.d.ts +1 -1
@@ -0,0 +1,90 @@
1
+ /**
2
+ * One CRUD write composer for every SQL engine, instead of one per adapter.
3
+ *
4
+ * `sqlDialect.ts` already collapsed the SQL *fragment* builders (columns, the
5
+ * SET list, the WHERE list). What it did NOT collapse was the METHOD BODIES:
6
+ * every SQL adapter's `insert`/`update`/`delete` re-implemented the SAME
7
+ * envelope around those fragments — the string-filter branch vs the hash-filter
8
+ * branch, the `[...Object.values(data), ...(params ?? [])]` value assembly, the
9
+ * batch fan-out — differing only in the two things a `Dialect` already captures
10
+ * (identifier quoting, parameter marker) plus three per-engine knobs:
11
+ *
12
+ * INSERT SUFFIX "" | " RETURNING *" | "; SELECT SCOPE_IDENTITY() AS id"
13
+ * MARKER START 1 (PostgreSQL $N) | 0 (MSSQL @pN) | ignored (`?` engines)
14
+ * FRAGMENT REWRITE a raw "id = ?" WHERE string: identity on a `?` engine,
15
+ * convertPlaceholders/bindable on a positional one
16
+ *
17
+ * This is the Node port of the Python master's `SqlCrudMixin`
18
+ * (tina4_python/database/adapter.py): build the SQL and the ordered parameter
19
+ * list engine-neutrally from a dialect + those knobs, and hand the pair back to
20
+ * the adapter to EXECUTE.
21
+ *
22
+ * Like `sqlDialect.ts`, these functions build STRINGS and parameter arrays and
23
+ * NOTHING else. Execution and result extraction stay in the adapters on purpose:
24
+ * `this.db.prepare().run()` vs `await this.client!.query()` vs tedious vs a
25
+ * Firebird transaction handle, and RETURNING / SCOPE_IDENTITY() / lastId /
26
+ * affectedRows normalisation, are genuinely per-driver — folding them in here
27
+ * would trade a real duplication for a fake abstraction.
28
+ *
29
+ * MongoDB has no entry: it does not build SQL at all.
30
+ */
31
+ import { type Dialect } from "./sqlDialect.js";
32
+ /** A composed statement: the SQL text and its ordered parameter list. */
33
+ export interface CrudSql {
34
+ sql: string;
35
+ values: unknown[];
36
+ }
37
+ /**
38
+ * A composed batch INSERT: one SQL statement plus one parameter row per input
39
+ * record, ready for the adapter's own `executeMany`.
40
+ */
41
+ export interface CrudBatchSql {
42
+ sql: string;
43
+ paramsList: unknown[][];
44
+ }
45
+ /** The only per-engine differences in a composed write's SQL + parameter list. */
46
+ export interface WriteOptions {
47
+ /**
48
+ * 1-based position of the FIRST parameter marker. PostgreSQL numbers `$N`
49
+ * from 1; MSSQL names `@pN` from 0 and BINDS by that name, so the start must
50
+ * match its binding loop. Engines whose marker is `?` ignore it. Default 1.
51
+ */
52
+ startAt?: number;
53
+ /**
54
+ * Rewrite a raw string WHERE fragment's `?` markers for this engine, given the
55
+ * 1-based position of the fragment's first marker. `?` engines leave it
56
+ * untouched (the default); a positional engine passes its `convertPlaceholders`
57
+ * / `bindable`. Only ever applied to the developer-supplied string filter,
58
+ * never to the framework-built hash WHERE.
59
+ */
60
+ convertFragment?: (fragment: string, startAt: number) => string;
61
+ }
62
+ /**
63
+ * A single-row INSERT: `INSERT INTO t (a, b) VALUES (?, ?)<suffix>` and the row's
64
+ * values in column order. `suffix` carries the genuinely engine-specific tail
65
+ * (PostgreSQL's ` RETURNING *`, MSSQL's SCOPE_IDENTITY() probe).
66
+ */
67
+ export declare function buildInsertRow(dialect: Dialect, table: string, data: Record<string, unknown>, suffix?: string, options?: WriteOptions): CrudSql;
68
+ /**
69
+ * A batch INSERT from a list of rows — one parameterised statement the adapter
70
+ * runs once per row via its own `executeMany`. Returns `null` for an empty list
71
+ * (the adapters treat that as a no-op affecting zero rows). The keys come from
72
+ * the first row, exactly as every adapter already assumed.
73
+ */
74
+ export declare function buildInsertRows(dialect: Dialect, table: string, rows: Record<string, unknown>[]): CrudBatchSql | null;
75
+ /**
76
+ * An UPDATE from a data object and either a hash filter (`{id: 5}` →
77
+ * `WHERE "id" = ?`) or a raw string filter (`"id = ?"` + `params`). The SET
78
+ * values always lead the parameter list; the WHERE values follow.
79
+ */
80
+ export declare function buildUpdate(dialect: Dialect, table: string, data: Record<string, unknown>, filter: Record<string, unknown> | string, params?: unknown[], options?: WriteOptions): CrudSql;
81
+ /**
82
+ * A DELETE from either a hash filter (`{id: 5}` → `WHERE "id" = ?`) or a raw
83
+ * string filter (`"age < ?"` + `params`). An empty string filter deletes the
84
+ * whole table (the explicit `truncate()` spelling routes through here).
85
+ *
86
+ * The array-of-dicts filter form is NOT handled here: only SQLite and ODBC
87
+ * accept it, and both loop it into per-row `delete` calls that land back in one
88
+ * of the two branches above — that fan-out stays in those two adapters.
89
+ */
90
+ export declare function buildDelete(dialect: Dialect, table: string, filter: Record<string, unknown> | string, params?: unknown[], options?: WriteOptions): CrudSql;
@@ -1,4 +1,21 @@
1
1
  import type { DatabaseAdapter, DatabaseResult, ColumnInfo, FieldDefinition } from "../types.js";
2
+ /**
3
+ * Resolve a SQLite path argument against the project root (cwd).
4
+ *
5
+ * Matches the tina4-python + tina4-php convention:
6
+ * ":memory:" → passthrough
7
+ * "data/app.db" → {cwd}/data/app.db (parent auto-created, mode 0775)
8
+ * "/abs/app.db" → /abs/app.db (NO auto-mkdir; user's responsibility)
9
+ * "C:/Users/app.db" → C:/Users/app.db (recognised as absolute on EVERY OS)
10
+ * "../../etc/foo.db" → REFUSED loudly (its parent escapes cwd)
11
+ *
12
+ * The canonical contract is ADR-0086. Two things this pins that node:path alone
13
+ * gets wrong: a drive-letter path is absolute on POSIX too (isAbsolute does not
14
+ * recognise it, so it would be re-rooted under cwd), and a relative path whose
15
+ * parent escapes cwd must be REFUSED — never the silent mkdir outside the
16
+ * project that was the root cause of the `EROFS: mkdir '/data'` crash.
17
+ */
18
+ export declare function resolveSqlitePath(dbPath: string): string;
2
19
  export declare class SQLiteAdapter implements DatabaseAdapter {
3
20
  private db;
4
21
  private _lastInsertId;
@@ -31,7 +31,7 @@ export { seedTable, seedOrm, seedModels, autoFieldMap } from "./seeder.js";
31
31
  export type { SeedSummary, SeedOptions } from "./seeder.js";
32
32
  export { ObjectId, InvalidId, DocStoreDriverMissing, SqliteDatabase, SqliteCollection, Cursor, getCollection, isServerless, resetDefaultStore, closeDocStore, encodeValue, decodeValue, compileFilter, } from "./docstore.js";
33
33
  export type { InsertOneResult, InsertManyResult, UpdateResult, DeleteResult, } from "./docstore.js";
34
- export { SQLiteAdapter } from "./adapters/sqlite.js";
34
+ export { SQLiteAdapter, resolveSqlitePath } from "./adapters/sqlite.js";
35
35
  export { PostgresAdapter } from "./adapters/postgres.js";
36
36
  export type { PostgresConfig } from "./adapters/postgres.js";
37
37
  export { MysqlAdapter } from "./adapters/mysql.js";