Skip to content

Release: add files after the first, merge hardening, release workflow fix - #5

Merged
HideBa merged 3 commits into
mainfrom
develop
Oct 11, 2026
Merged

HideBa merged 3 commits into
mainfrom
develop

Conversation

@HideBa

@HideBa HideBa commented Oct 11, 2026

Copy link
Copy Markdown
Member
  • Website: add or remove input files / URLs after the first; they are combined into one output
  • Merges reconcile types the reader inferred differently between tiles; casts only to allow-listed scalar types (fixes an SQL injection path through crafted nested types)
  • release workflow: releases the newest vX.Y.Z tag once npm serves it (the v0.0.1 run failed on npm's transient 0.0.0-stage)

Once a file is loaded, the source card lists every input with a remove button, and
offers Add files, add-by-URL and dropping onto the card. Two or more inputs are
combined into one output; each change re-inspects the combination, and a file that
cannot join is not added, with the reason shown under the source step. Every input
is registered in a directory of its own, so adding never overwrites. Errors name the
user's files rather than virtual-FS paths.

Merging no longer refuses types the reader merely inferred differently between tiles
(it infers from a sample of lines): numbers take the widest type, and text whose
every value casts to the other input's type takes that type; a column empty in one
input takes the other's. Values of a different kind are still refused.
Column types come from DESCRIBE, and a nested type's field names come from the file
being read, so pasting a resolved type into CAST(... AS <type>) / ALTER ... SET DATA
TYPE let a crafted input inject SQL. A merge now resolves a type difference only to a
fixed set of scalar types (numbers, VARCHAR, BOOLEAN, DATE, TIME, TIMESTAMP[ TZ]) and
refuses anything else as a schema conflict, so no type string from a file reaches SQL.
npm's 'latest' lags a fresh publish (a first publish briefly showed 0.0.0-stage), so
the run after v0.0.1 tried to release 0.0.0-stage and failed. The version now comes
from the newest vX.Y.Z tag, which Publish to npm pushes, and the release waits up to
two minutes for npm to serve that exact version of both packages.
@HideBa
HideBa merged commit 9af2a67 into main Oct 11, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant