v0.4.1

Note — the package name changed. The unscoped name zodstore was refused by the npm registry as too similar to an existing zod-store, so no version was ever published under it and the install command below does not work. Use v0.4.2 and bun add @binaryplease/zodstore zod.

zodstore is a native SQLite + Zod document store for Bun. Zod is the
gatekeeper; bun:sqlite is the synchronous, in-process engine. No migrations,
no ORM — the shape lives in Zod, the rows live in SQLite.

This is the first public release. See README.md for the API and
the design rationale, and CHANGELOG.md for the full history.

Install

bun add zodstore zod

Zod is a peer dependency (^3.24.0 || ^4.3) — the consumer owns the Zod
version, so two copies of Zod never end up in one process.

Changed in 0.4.1

The published tarball is now an allowlist. package.json declares
files: ["src", "README.md", "CHANGELOG.md", "LICENSE"], so an install brings
the library, its documentation and its licence and nothing else. The test suite,
the CI workflow, the flake and the ignore files no longer ship. Nothing exported
changes and no consumer loses anything it could import.

The reason is the direction the control fails in. npm packs the working
directory rather than git, so a denylist fails open on whatever nobody thought
to name. An allowlist fails closed instead, and a registry version is never
taken back.

Fixed in 0.4.1

A stored row that fails the schema no longer reports its own content. The
read path forwarded a ZodError's message verbatim, on the premise that a
ZodError names paths and types and carries no values. It does not: its
message is the serialised issue list, an issue's path runs through a
z.record()'s keys, and under Zod 3 the issue carries the rejected value as
received. Ordinary schema drift therefore put document content into the
exception thrown by get(), find(), findByIds() and findOne(), and from
there into a log.

The issue list is now rendered rather than forwarded: each issue reads
"consents.<key>" (invalid_type, expected boolean) — the path, the code, and
expected where it is a string. A path segment is printed when the schema
declares it and elided as <key> when it does not; an array index is printed,
because a position is not content. The ZodError remains the cause, so a
caller that deliberately inspects it loses nothing.

The write gate carried the same defect and takes the same remedy.
serializeDocument interpolated a ZodError's message into the refusal it
raises for a document whose stored form its own schema rejects. It renders the
issue list through the same renderer now.

Message text only: what is thrown, when it is thrown, and what validate()
returns are all unchanged.

Requirements

Bun. The library imports bun:sqlite and has no Node compatibility path.

License

MIT — see LICENSE.