Port bun-mariadb schema guard, targetId fix, lazy init and tests

- schema: add --dry-run (sync in a rolled-back transaction) and require
  confirmation (or --yes) before dropping tables or columns; unapproved
  destructive changes are refused
- only rebuild tables whose CREATE TABLE statement changed
- always AND targetId with the query, regardless of searchOperator
- empty IN / NOT IN lists become 1 = 0 / 1 = 1
- initialize lazily on first call so importing never throws
- read CLI version from package.json, chmod CLI on compile, pin @types/bun
- add SQL generator, value and schema guard tests

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/sql-generator.test.ts

@@ -0,0 +1,135 @@
+import { describe, expect, test } from "bun:test";
+import sqlGenerator from "../src/utils/sql-generator";
+
+const gen = (genObject: any, extra: Record<string, any> = {}) =>
+    sqlGenerator({ tableName: "users", genObject, ...extra });
+
+describe("identifiers", () => {
+    test("binds values and keeps identifiers", () => {
+        const { string, values } = gen({ query: { email: { value: "[email protected]" } } });
+        expect(string).toBe("SELECT * FROM users WHERE (email = ?)");
+        expect(values).toEqual(["[email protected]"]);
+    });
+
+    test.each([
+        ["field name", { query: { "1=1 OR id": { value: 1 } } }],
+        ["quoted field name", { query: { 'a" OR 1=1 --': { value: 1 } } }],
+        ["select field", { selectFields: ["name; DROP TABLE users"] }],
+    ])("rejects an injected %s", (_name, genObject) => {
+        expect(() => gen(genObject)).toThrow();
+    });
+
+    test("rejects an injected table name", () => {
+        expect(() =>
+            sqlGenerator({ tableName: "users; DROP TABLE users", genObject: {} }),
+        ).toThrow();
+    });
+});
+
+describe("input validation", () => {
+    test.each([
+        ["order strategy", { order: { field: "id", strategy: "DESC; DROP TABLE x" } }],
+        ["limit", { limit: "1; --" }],
+        ["negative offset", { offset: -1 }],
+        ["page", { limit: 10, page: "2 OR 1" }],
+        ["search operator", { query: { a: { value: 1 } }, searchOperator: "OR 1=1" }],
+        ["raw equality", { query: { a: { value: 1, raw_equality: "= 1 OR" } } }],
+        ["join type", { join: [{ tableName: "p", joinType: "CROSS JOIN x;", match: { source: "id", target: "uid" } }] }],
+    ])("rejects invalid %s", (_name, genObject) => {
+        expect(() => gen(genObject)).toThrow();
+    });
+
+    test("rejects non-numeric targetId", () => {
+        expect(() => gen({}, { targetId: "abc" })).toThrow();
+    });
+});
+
+describe("targetId", () => {
+    test("is ANDed with the query, even with searchOperator OR", () => {
+        const { string, values } = gen(
+            { query: { a: { value: 1 }, b: { value: 2 } }, searchOperator: "OR" },
+            { targetId: 5 },
+        );
+        expect(string).toBe(
+            "SELECT * FROM users WHERE (a = ? OR b = ?) AND id = ?",
+        );
+        expect(values).toEqual([1, 2, 5]);
+    });
+
+    test("accepts numeric strings", () => {
+        const { string, values } = gen({}, { targetId: "7" });
+        expect(string).toBe("SELECT * FROM users WHERE id = ?");
+        expect(values).toEqual([7]);
+    });
+
+    test("0 is a real id", () => {
+        expect(gen({}, { targetId: 0 }).values).toEqual([0]);
+    });
+
+    test("is table-qualified with joins", () => {
+        const { string } = gen(
+            {
+                join: [
+                    {
+                        tableName: "posts",
+                        joinType: "LEFT JOIN",
+                        match: { source: "id", target: "user_id" },
+                    },
+                ],
+            },
+            { targetId: 3 },
+        );
+        expect(string).toEndWith("WHERE users.id = ?");
+    });
+
+    test("is part of the where clause used by update / delete", () => {
+        const { where } = gen({ query: { a: { value: 1 } } }, { targetId: 2 });
+        expect(where).toEqual({
+            string: "WHERE (a = ?) AND id = ?",
+            values: [1, 2],
+        });
+    });
+});
+
+describe("values", () => {
+    test("0 is a real value", () => {
+        expect(gen({ query: { age: { value: 0 } } }).values).toEqual([0]);
+    });
+
+    test("IN binds each value", () => {
+        const { string, values } = gen({
+            query: { id: { value: [1, 2], equality: "IN" } },
+        });
+        expect(string).toBe("SELECT * FROM users WHERE (id IN (?, ?))");
+        expect(values).toEqual([1, 2]);
+    });
+
+    test("empty IN matches nothing, empty NOT IN matches everything", () => {
+        expect(gen({ query: { id: { value: [], equality: "IN" } } }).string).toBe(
+            "SELECT * FROM users WHERE (1 = 0)",
+        );
+        expect(
+            gen({ query: { id: { value: [], equality: "NOT IN" } } }).string,
+        ).toBe("SELECT * FROM users WHERE (1 = 1)");
+    });
+
+    test("BETWEEN needs exactly two values", () => {
+        expect(() =>
+            gen({ query: { age: { value: [1], equality: "BETWEEN" } } }),
+        ).toThrow();
+    });
+});
+
+describe("pagination", () => {
+    test("page is converted to an offset", () => {
+        expect(gen({ limit: 10, page: 3 }).string).toBe(
+            "SELECT * FROM users LIMIT 10 OFFSET 20",
+        );
+    });
+
+    test("count queries skip pagination", () => {
+        expect(gen({ limit: 10, page: 3 }, { count: true }).string).not.toContain(
+            "LIMIT",
+        );
+    });
+});