uql-orm 0.20.2 → 0.21.0

package/dist/util/sqlLiteral.js

@@ -0,0 +1,108 @@
+/**
+ * SQL string literal escaping for `Dialect.escape`, in two flavors: ANSI single-quote doubling
+ * (Postgres, SQLite) and MySQL backslash escaping (MySQL, MariaDB). Only the quoting step differs.
+ *
+ * **Security.** UQL never calls `Dialect.escape` itself, so this is the hand-written-SQL hatch; prefer
+ * bound parameters. Two limits are inherent to inline MySQL literals (`sqlstring` and `sql-escaper`
+ * share them): escaping breaks under the server's `NO_BACKSLASH_ESCAPES` mode, and under a charset
+ * whose trailing byte can be `0x5C` (GBK, Big5, SJIS). `toSqlString()` values are emitted raw.
+ *
+ * PostgreSQL **array** literals (`{...}` with double-quoted elements and their own escape rules)
+ * are separate from this helper; see {@link PostgresDialect} (array text format when
+ * `nativeArrays` is false) - do not "unify" that path with this function.
+ */
+const SINGLE_QUOTE = /'/g;
+/** Doubles every single quote in `val`, the ANSI escaping shared by string literals and JSON path keys. */
+export function escapeSingleQuotes(val) {
+    return val.replace(SINGLE_QUOTE, "''");
+}
+const ansiStringLiteral = (val) => `'${escapeSingleQuotes(val)}'`;
+// MySQL/MariaDB backslash-escape rather than doubling the quote. Mirrors the `sqlstring` map it replaced.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: MySQL string literals must escape NUL, backspace and SUB
+const MYSQL_SPECIALS = /[\0\b\t\n\r\x1a"'\\]/g;
+const MYSQL_ESCAPES = {
+    '\0': '\\0',
+    '\b': '\\b',
+    '\t': '\\t',
+    '\n': '\\n',
+    '\r': '\\r',
+    '\x1a': '\\Z',
+    '"': '\\"',
+    "'": "\\'",
+    '\\': '\\\\',
+};
+const mysqlStringLiteral = (val) => `'${val.replace(MYSQL_SPECIALS, (char) => MYSQL_ESCAPES[char])}'`;
+const pad = (value, len) => String(value).padStart(len, '0');
+function isByteSource(val) {
+    return (typeof Buffer !== 'undefined' && Buffer.isBuffer(val)) || val instanceof Uint8Array;
+}
+const HEX_BYTES = Array.from({ length: 256 }, (_, byte) => byte.toString(16).padStart(2, '0'));
+/** Native hex encoder where available (~130x faster on 4 KB); lookup table for browsers. */
+function bytesToHexLiteral(bytes) {
+    if (typeof Buffer !== 'undefined') {
+        return `X'${Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString('hex')}'`;
+    }
+    let hex = '';
+    for (let i = 0; i < bytes.length; i++)
+        hex += HEX_BYTES[bytes[i]];
+    return `X'${hex}'`;
+}
+/**
+ * A factory, not a function taking `escapeString` as an argument: threading it through every call
+ * measured 1.1-1.5x slower. Rejects unsupported types rather than stringifying them into SQL.
+ */
+function createEscaper(escapeString) {
+    /** `YYYY-MM-DD HH:mm:ss.mmm` in local time, wrapped as a quoted literal. */
+    const dateLiteral = (date) => escapeString(`${pad(date.getFullYear(), 4)}-${pad(date.getMonth() + 1, 2)}-${pad(date.getDate(), 2)} ${pad(date.getHours(), 2)}:${pad(date.getMinutes(), 2)}:${pad(date.getSeconds(), 2)}.${pad(date.getMilliseconds(), 3)}`);
+    const sqlList = (arr) => {
+        let sql = '';
+        for (let i = 0; i < arr.length; i++) {
+            const val = arr[i];
+            if (i > 0)
+                sql += ', ';
+            sql += Array.isArray(val) ? `(${sqlList(val)})` : escapeValue(val);
+        }
+        return sql;
+    };
+    const escapeValue = (value) => {
+        if (value === undefined || value === null) {
+            return 'NULL';
+        }
+        switch (typeof value) {
+            case 'boolean':
+                return value ? 'true' : 'false';
+            case 'number':
+                return Number.isFinite(value) ? String(value) : 'NULL';
+            case 'bigint':
+                return String(value);
+            case 'string':
+                return escapeString(value);
+            case 'symbol':
+            case 'function':
+                throw new TypeError('escapeSqlLiteral: symbol and function values are not supported; use bound parameters.');
+            case 'object': {
+                if (value instanceof Date) {
+                    return Number.isNaN(value.getTime()) ? 'NULL' : dateLiteral(value);
+                }
+                if (Array.isArray(value)) {
+                    return sqlList(value);
+                }
+                if (isByteSource(value)) {
+                    return bytesToHexLiteral(value);
+                }
+                if ('toSqlString' in value && typeof value.toSqlString === 'function') {
+                    return String(value.toSqlString());
+                }
+                throw new TypeError('escapeSqlLiteral: plain objects are not supported; use bound parameters or JSON.stringify + a string column.');
+            }
+            default:
+                // Unreachable today; throwing keeps a future JS type from silently becoming SQL.
+                throw new TypeError(`escapeSqlLiteral: unsupported value type '${typeof value}'; use bound parameters.`);
+        }
+    };
+    return escapeValue;
+}
+/** Escape `value` for Postgres, SQLite and related dialects (single-quote doubling). */
+export const escapeAnsiSqlLiteral = createEscaper(ansiStringLiteral);
+/** Escape `value` for MySQL and MariaDB (backslash escaping). */
+export const escapeMysqlSqlLiteral = createEscaper(mysqlStringLiteral);

package/dist/util/string.util.d.ts

@@ -26,4 +26,3 @@ export declare function singularize(name: string): string;
  * @example 'category' -> 'categories'
  */
 export declare function pluralize(name: string): string;
-//# sourceMappingURL=string.util.d.ts.map

package/dist/util/string.util.js

@@ -90,4 +90,3 @@ export function pluralize(name) {
     }
     return name + 's';
 }
-//# sourceMappingURL=string.util.js.map

package/package.json

@@ -1,10 +1,14 @@
 {
   "name": "uql-orm",
   "homepage": "https://uql-orm.dev",
-  "description": "Fast, type-safe TypeScript ORM - one API for every database",
+  "description": "Extremely fast, type-safe TypeScript ORM - one API for every database",
   "license": "MIT",
-  "version": "0.20.2",
+  "version": "0.21.0",
   "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "sideEffects": false,
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "browser": {
@@ -42,28 +46,21 @@
     "./libsql": "./dist/libsql/index.js",
     "./neon": "./dist/neon/index.js",
     "./d1": "./dist/d1/index.js",
-    "./bunSql": "./dist/bunSql/index.js"
+    "./bunSql": "./dist/bunSql/index.js",
+    "./package.json": "./package.json"
   },
   "files": [
     "dist",
-    "README.md",
-    "CHANGELOG.md"
+    "README.md"
   ],
   "scripts": {
-    "prepack": "bun run verify-dist.ts && cp ../../README.md . && cp ../../CHANGELOG.md .",
-    "postpack": "rm README.md CHANGELOG.md",
-    "verify.package": "bun run build && bun run verify-dist.ts",
+    "prepack": "bun run verify-dist.ts && cp ../../README.md .",
+    "postpack": "rm README.md",
     "compile.browser": "bun build src/browser/index.ts --minify --sourcemap=linked --format=esm --target=browser --outdir=dist/browser --entry-naming 'uql-browser.min.[ext]'",
-    "build": "bun run clean && tsc -b tsconfig.build.json && bun run compile.browser",
+    "build": "bun run clean && tsc -b tsconfig.build.json && bun run compile.browser && bun run verify-dist.ts",
     "start": "tsc --watch",
     "clean": "rimraf dist .tsconfig.tsbuildinfo"
   },
-  "dependencies": {
-    "jiti": "^2.7.0",
-    "reflect-metadata": "^0.2.2",
-    "sqlstring": "^2.3.3",
-    "tslib": "^2.8.1"
-  },
   "peerDependencies": {
     "@libsql/client": ">=0.6.0",
     "@neondatabase/serverless": ">=0.9.0",
@@ -71,26 +68,37 @@
     "@nestjs/core": ">=10.0.0",
     "better-sqlite3": ">=9.0.0",
     "express": ">=5.0.0",
+    "jiti": ">=2.0.0",
     "mariadb": ">=3.0.0",
     "mongodb": ">=6.0.0",
     "mysql2": ">=3.0.0",
     "pg": ">=8.0.0",
     "pg-query-stream": ">=4.0.0",
+    "reflect-metadata": ">=0.2.0",
     "rxjs": ">=7.0.0"
   },
   "peerDependenciesMeta": {
+    "@libsql/client": {
+      "optional": true
+    },
+    "@neondatabase/serverless": {
+      "optional": true
+    },
     "@nestjs/common": {
       "optional": true
     },
     "@nestjs/core": {
       "optional": true
     },
-    "rxjs": {
+    "better-sqlite3": {
       "optional": true
     },
     "express": {
       "optional": true
     },
+    "jiti": {
+      "optional": true
+    },
     "mariadb": {
       "optional": true
     },
@@ -106,13 +114,10 @@
     "pg-query-stream": {
       "optional": true
     },
-    "better-sqlite3": {
+    "reflect-metadata": {
       "optional": true
     },
-    "@libsql/client": {
-      "optional": true
-    },
-    "@neondatabase/serverless": {
+    "rxjs": {
       "optional": true
     }
   },
@@ -125,22 +130,24 @@
     "@types/better-sqlite3": "^7.6.13",
     "@types/express": "^5.0.6",
     "@types/pg": "^8.20.0",
-    "@types/sqlstring": "^2.3.2",
     "@types/ws": "^8.18.1",
-    "better-sqlite3": "^13.0.1",
+    "better-sqlite3": "^13.0.2",
     "express": "^5.2.1",
+    "jiti": "^2.7.0",
     "mariadb": "^3.5.3",
     "mongodb": "^7.5.0",
     "mysql2": "^3.23.2",
     "pg": "^8.22.0",
     "pg-query-stream": "^4.16.0",
+    "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
     "ws": "^8.21.1"
   },
   "author": "Roger Padilla",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/rogerpadilla/uql.git"
+    "url": "git+https://github.com/rogerpadilla/uql.git",
+    "directory": "packages/uql-orm"
   },
   "bugs": {
     "url": "https://github.com/rogerpadilla/uql/issues"
@@ -167,15 +174,25 @@
     "cockroachdb-orm",
     "mongodb",
     "mongodb-orm",
+    "libsql",
+    "turso",
+    "neon",
+    "d1",
+    "cloudflare",
+    "bun",
+    "edge",
     "entity",
     "dao",
     "transaction",
     "repository",
     "service",
-    "migrations"
+    "migrations",
+    "vector-search",
+    "nestjs",
+    "express"
   ],
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "a544bc7addddc9728b348fe564b94805a61d3c3e"
+  "gitHead": "1d056e8d5030fe70e3dc21a151db282e9e553dd9"
 }