Current Status and Limitations

Status: experimental, under active development. APIs and configuration may change before a stable release.

Implemented in the supplied snapshot

• Structured GET, POST, PUT, and DELETE requests.
• Role branches per table operation.
• Allowed/disallowed field resolution.
• Policy and request row-condition composition.
• Nested AND, OR, NOT, and conditional logic.
• Literal, null, membership, range, and existence conditions at runtime.
• INNER and LEFT joins.
• Ordering, grouping, limits, aggregates, and returning fields.
• Single and bulk insert payloads.
• Independent query phases and transactional phases.
• Before and after triggers.
• Multiple Drizzle database type definitions.
• Published npm package as beta (0.9.0)

Not yet a stable public product contract

• No semantic release history or compatibility matrix.
• No declared Node runtime range.
• No evidence that every database in the broad TypeScript union is covered by CI.
• No stable error codes.
• No formal threat model or third-party audit.
• Several public/security-sensitive structures use any.

Important behavioral caveats

• All protected database access must pass through the handler; alternate clients can bypass its policies.
• Separate phases run concurrently at the top level.
• The runtime supports some conditions not represented consistently by exported safe-operator types.
• Driver-specific support for returning, transactions, case-insensitive matching, and other SQL features may differ.
• Generated SQL is not the public compile result; the public result is an executable plan.

Planned, not implemented as a product surface

The management interface, integration tooling, authorization visualization, rule debugging, live policy editing, and SaaS subscription tiers belong to the future direction described in Roadmap.

← From Request to SQL · Learn VoidQL →