uql-orm 0.65.1 → 0.67.0

package/dist/util/sqlLiteral.d.ts

@@ -1,18 +1,7 @@
-/**
- * SQL string literal escaping for `Dialect.escape`, in two flavors: ANSI single-quote doubling
- * (Postgres, SQLite) and MySQL backslash escaping (MySQL, MariaDB). Only the quoting step differs.
- *
- * **Security.** UQL never calls `Dialect.escape` itself, so this is the hand-written-SQL hatch; prefer
- * bound parameters. Two limits are inherent to inline MySQL literals (`sqlstring` and `sql-escaper`
- * share them): escaping breaks under the server's `NO_BACKSLASH_ESCAPES` mode, and under a charset
- * whose trailing byte can be `0x5C` (GBK, Big5, SJIS). `toSqlString()` values are emitted raw.
- *
- * PostgreSQL **array** literals (`{...}` with double-quoted elements and their own escape rules)
- * are separate from this helper; see {@link PostgresDialect} (array text format when
- * `nativeArrays` is false) - do not "unify" that path with this function.
- */
 /** Doubles every single quote in `val`, the ANSI escaping shared by string literals and JSON path keys. */
 export declare function escapeSingleQuotes(val: string): string;
+/** The text a MySQL string literal's body stands for: its backslash escapes and doubled quotes undone. */
+export declare function unescapeMysqlString(body: string): string;
 /** Escape `value` for Postgres, SQLite and related dialects (single-quote doubling). */
 export declare const escapeAnsiSqlLiteral: (value: unknown) => string;
 /** Escape `value` for MySQL and MariaDB (backslash escaping). */

package/dist/util/sqlLiteral.js

@@ -1,16 +1,6 @@
-/**
- * SQL string literal escaping for `Dialect.escape`, in two flavors: ANSI single-quote doubling
- * (Postgres, SQLite) and MySQL backslash escaping (MySQL, MariaDB). Only the quoting step differs.
- *
- * **Security.** UQL never calls `Dialect.escape` itself, so this is the hand-written-SQL hatch; prefer
- * bound parameters. Two limits are inherent to inline MySQL literals (`sqlstring` and `sql-escaper`
- * share them): escaping breaks under the server's `NO_BACKSLASH_ESCAPES` mode, and under a charset
- * whose trailing byte can be `0x5C` (GBK, Big5, SJIS). `toSqlString()` values are emitted raw.
- *
- * PostgreSQL **array** literals (`{...}` with double-quoted elements and their own escape rules)
- * are separate from this helper; see {@link PostgresDialect} (array text format when
- * `nativeArrays` is false) - do not "unify" that path with this function.
- */
+// SQL literal escaping for `Dialect.escape`: ANSI quote doubling, or MySQL's backslashes. UQL binds
+// values instead, so this is the hand-written-SQL hatch, and inline MySQL literals break under
+// `NO_BACKSLASH_ESCAPES` or a GBK-like charset: prefer bound parameters. Postgres arrays are separate.
 const SINGLE_QUOTE = /'/g;
 /** Doubles every single quote in `val`, the ANSI escaping shared by string literals and JSON path keys. */
 export function escapeSingleQuotes(val) {
@@ -31,6 +21,11 @@ const MYSQL_ESCAPES = {
     "'": "\\'",
     '\\': '\\\\',
 };
+const MYSQL_UNESCAPES = Object.fromEntries(Object.entries(MYSQL_ESCAPES).map(([char, escaped]) => [escaped[1], char]));
+/** The text a MySQL string literal's body stands for: its backslash escapes and doubled quotes undone. */
+export function unescapeMysqlString(body) {
+    return body.replace(/\\(.)|''/gs, (_, char) => char === undefined ? "'" : (MYSQL_UNESCAPES[char] ?? char));
+}
 const mysqlStringLiteral = (val) => `'${val.replace(MYSQL_SPECIALS, (char) => MYSQL_ESCAPES[char])}'`;
 const HEX_BYTES = Array.from({ length: 256 }, (_, byte) => byte.toString(16).padStart(2, '0'));
 /** Native hex encoder where available (~130x faster on 4 KB); lookup table for browsers. */

package/dist/util/string.util.js

@@ -12,8 +12,6 @@ export function lowerFirst(text) {
     return text.charAt(0).toLowerCase() + text.slice(1);
 }
 export function snakeCase(val) {
-    if (val === null || val === undefined)
-        return val;
     if (!val)
         return '';
     let resp = val.charAt(0).toLowerCase();

package/package.json

@@ -3,7 +3,7 @@
   "homepage": "https://uql-orm.dev",
   "description": "The JSON-native TypeScript ORM for Bun, Browsers, Edge, Deno, Node, Workers. Supports PostgreSQL, PGlite, MySQL, MariaDB, SQLite, CockroachDB, SQL Server, Turso, Neon, Cloudflare D1 and MongoDB. Queries are plain JSON, typed to the leaf.",
   "license": "MIT",
-  "version": "0.65.1",
+  "version": "0.67.0",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -135,9 +135,9 @@
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@libsql/client": "^0.18.0",
     "@neondatabase/serverless": "^1.1.0",
-    "@nestjs/common": "^12.0.1",
-    "@nestjs/core": "^12.0.1",
-    "@nestjs/testing": "^12.0.1",
+    "@nestjs/common": "^12.0.3",
+    "@nestjs/core": "^12.0.3",
+    "@nestjs/testing": "^12.0.3",
     "@tursodatabase/database": "^0.7.2",
     "@tursodatabase/serverless": "^1.4.0",
     "@types/better-sqlite3": "^9.6.0",