feat(sqlite): Table + QueryBuilder work end-to-end over SQLite

Widens the query/mutation builders from PG-only (`instanceof Any`) to
dialect-agnostic (`instanceof SqlValue`) across ~15 runtime dispatch
points + ~20 type refs. PG callers unchanged — Any still is-a SqlValue.

Changes by file:

- src/table.ts, src/util.ts, src/builder/{values,insert,update,query}.ts:
  Any → SqlValue at instanceof checks + type positions. `isColumn` /
  `getColumn` imports moved from postgres/overrides/any (re-export)
  to src/types/any (source).

- src/types/runtime.ts: `NullOf`, `TsTypeOf`, `Aggregate`, `AggregateRow`
  widened from `T extends Any<...>` to `T extends SqlValue<...>` so the
  utilities work uniformly over PG's Any and SQLite's SqliteValue.

- src/types/bool.ts: the shared `Bool<N>` interface loses `and`/`or`/`not`
  and becomes a nominal marker. Concrete Bool classes' `.and(other: X
  <any> | boolean)` are contravariantly incompatible with a shared
  method signature — trying to require the ops here breaks assignment
  from concrete to shared. Chaining callers cast through `any` (see
  `combinePredicates`); runtime validation still uses the `isBool`
  identity predicate.

- src/types/meta.ts (new): extracted the `meta` symbol into its own
  tiny module. `types/any.ts` used to import `meta` from `runtime.ts`,
  but `runtime.ts` also does `import * as types from "./index"` which
  triggers the PG barrel chain — extending SqlValue via PG's generated
  any before any.ts had defined it. Splitting `meta` out breaks the
  cycle.

- src/driver.ts (SqliteDriver): unwraps a single matched outer paren
  pair from compiled SQL. `QueryBuilder.FinalizedQuery.bind()` wraps
  its output in `(...)` for subquery-splicing; PG tolerates a
  parenthesized top-level, SQLite does not.

- src/builder/{delete,update,query}.ts: `@expose` validators swapped
  from `z.instanceof(Bool)` (PG-only) to `z.custom<SharedBool<any>>
  (isBool)` (dialect-agnostic via the identity predicate). Note: the
  broader "same-database provenance" concern is filed as ISSUES.md #16;
  this changes the check from PG-nominal to dialect-nominal (catches
  cross-dialect but not cross-tenant).

- src/types/sqlite/table.test.ts (new): 7 end-to-end tests through the
  full Table → QueryBuilder → SqliteDriver stack — INSERT, SELECT with
  method composition (.upper()), .where predicates, INSERT/UPDATE/
  DELETE ... RETURNING.

Deferred (documented as comments in place, not blocking Phase 1):

- QueryBuilder.scalar() stays PG-only — emits ROW() + array_agg +
  COALESCE(..., '{}'). Phase 2.1 Scalar AST node lands the SQLite
  dispatch (json_object + json_group_array).
- `.where(true)` shorthand in delete/update still constructs a PG
  `Bool` — sqlite-only apps that need this will hit a nominal mismatch
  until the shorthand becomes dialect-aware.

Test totals: 28 files, 550 passed, 1 skipped (was 27/544). PG suite
green throughout.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ryanrasti

docs/ISSUES.md

@@ -95,3 +95,51 @@
 
 14. ~~**`.live()` subscriptions**~~ — done (PR #72). Predicate extraction,
     reverse-index bus, MVCC-snapshot-aware re-iteration.
+
+16. **Cross-database provenance for typed values (RPC security).** Runtime
+    validators today check `v instanceof SqlValue` — "is this a typegres
+    value?" but not "*whose* typegres value?" Over RPC (exoeval), a client
+    can construct a `Bool` (or any typed expression) and hand it to
+    `db.execute(qb.where(theirBool))`. The check passes if the object is
+    a proper SqlValue instance; nothing verifies it was built *for the
+    Database the RPC handler is bound to*.
+
+    Threats:
+
+    - **Cross-dialect smuggling:** attacker on a SQLite-backed session
+      injects a Bool constructed against a Postgres schema. SQL emission
+      collides (`?` vs `$N` placeholders, wrong typenames). Coarsely
+      addressed by the dialect check that comes with the `Any` → `SqlValue`
+      sweep (Table+QB dialect-agnostic work), because `v.constructor.dialect.name`
+      is authoritative per class.
+    - **Cross-tenant smuggling** (same dialect, different DB instances):
+      values from tenant B's schema get spliced into tenant A's query.
+      Column names / OIDs matching by coincidence → info leak. Dialect
+      check does *not* catch this.
+    - **Cross-session smuggling** within one Database: some values carry
+      session-scoped state via `db.scope(principal)`. Bypassing the tag =
+      privilege escalation.
+
+    Design options:
+
+    - **Instance-scoped tagging.** Each `Database` mints a `Symbol()`;
+      values built through a db-scoped factory (`db.Int4.from(5)` instead
+      of `Int4.from(5)`) carry that tag. Runtime checks `v[dbIdKey] === this.dbId`.
+      Catches all three. Cost: breaking API change for existing PG callers;
+      RPC serialization needs to preserve the tag across the wire.
+    - **Scope-only.** Don't tag values; validate the compiled Sql tree at
+      `db.execute()` time — walk it and reject any SqlValue whose dialect
+      doesn't match ctx. Cheap, addresses cross-dialect only.
+    - **Opt-in session tagging.** Untagged values keep working (interop).
+      `db.scope(session).typedValue(x)` explicitly binds. Session-sensitive
+      methods (mutation, sensitive-table `.where`) refuse untagged values.
+      Backwards-compatible; enforcement lives where the security matters.
+
+    Operator/method checks have the same story — `int.plus(other)` today
+    accepts any Int4-ish arg; under instance-tagging, `runtime.match()`
+    would enforce the tag matches `this`. Single code path to protect.
+
+    Not blocking Phase 1 (SQLite dialect work), but *is* blocking any RPC
+    production deployment with multi-tenant or cross-dialect setups. Fold
+    into the exoeval hardening pass (relates to #13 gas accounting — both
+    are RPC-boundary threats).

src/builder/delete.ts

@@ -1,6 +1,7 @@
 import { Sql, sql, Alias, compile, pgCtx, type CompileContext } from "./sql";
 import type { BoundSql } from "./sql";
 import { Bool } from "../types";
+import { isBool, type Bool as SharedBool } from "../types/bool";
 import type { RowType, RowTypeToTsType } from "./query";
 import { combinePredicates, compileSelectList, isRowType, mergeReturning, reAlias } from "./query";
 import type { TableBase } from "../table";
@@ -12,7 +13,7 @@ type Namespace<Name extends string, T> = { [K in Name]: T };
 
 type DeleteOpts<Name extends string, T extends TableBase, R extends RowType> = {
   instance: T;
-  where?: (ns: Namespace<Name, T>) => Bool<any>;
+  where?: (ns: Namespace<Name, T>) => SharedBool<any>;
   returning?: (ns: Namespace<Name, T>) => R;
 };
 
@@ -23,7 +24,7 @@ type FinalizedDeleteOpts<Name extends string, T extends TableBase, R extends Row
   tableName: Name;
   alias: Alias;
   instance: T;
-  where: Bool<any>;
+  where: SharedBool<any>;
   returning?: R;
 };
 
@@ -59,10 +60,10 @@ export class DeleteBuilder<Name extends string, T extends TableBase, R extends R
   }
 
   // Multiple where() calls are combined with AND. .where(true) matches all rows.
-  @expose(z.union([z.literal(true), fn.returns(z.lazy(() => z.instanceof(Bool)))]))
-  where(fn: ((ns: Namespace<Name, T>) => Bool<any>) | true): DeleteBuilder<Name, T, R> {
-    const wrapped: (ns: Namespace<Name, T>) => Bool<any> =
-      fn === true ? () => Bool.from(sql`TRUE`) as Bool<any> : fn;
+  @expose(z.union([z.literal(true), fn.returns(z.custom<SharedBool<any>>(isBool))]))
+  where(fn: ((ns: Namespace<Name, T>) => SharedBool<any>) | true): DeleteBuilder<Name, T, R> {
+    const wrapped: (ns: Namespace<Name, T>) => SharedBool<any> =
+      fn === true ? () => Bool.from(sql`TRUE`) as SharedBool<any> : fn;
     return new DeleteBuilder({
       ...this.#opts,
       where: combinePredicates(this.#opts.where, wrapped),

src/builder/insert.ts

@@ -4,7 +4,7 @@ import type { RowType, RowTypeToTsType } from "./query";
 import { compileSelectList, isRowType, mergeReturning, reAlias } from "./query";
 import type { TableBase } from "../table";
 import { Database } from "../database";
-import { getColumn } from "../types/postgres/overrides/any";
+import { getColumn } from "../types/any";
 import { meta } from "../types/runtime";
 import { fn, expose } from "../exoeval/tool";
 import z from "zod";

src/builder/query.test.ts

@@ -834,7 +834,11 @@ test("where defers callback validation — bad return only throws at compile", (
     .values({ a: Int4.from(1) })
     // @ts-expect-error — callback must return Bool
     .where(() => 42);
-  expectReturnValidationError(() => compile(q, pgCtx), /expected Bool, received number/);
+  // With the shared `isBool` predicate (`z.custom(isBool)`), Zod emits a
+  // generic `Invalid input` message. The typed `expected Bool, received
+  // number` output was specific to `z.instanceof(Bool)`; there's no way
+  // to recover the same message via z.custom without a message override.
+  expectReturnValidationError(() => compile(q, pgCtx), /Invalid input/);
 });
 
 test("orderBy defers — empty array fails .min(1) at compile", () => {