@bunnykit/orm 0.1.15 → 0.1.16

package/dist/src/connection/Connection.d.ts

@@ -20,8 +20,8 @@ export declare class Connection {
     withoutSchema(): Connection;
     qualifyTable(table: string): string;
     private quoteIdentifier;
-    query(sqlString: string): Promise<any[]>;
-    run(sqlString: string): Promise<any>;
+    query(sqlString: string, bindings?: any[]): Promise<any[]>;
+    run(sqlString: string, bindings?: any[]): Promise<any>;
     beginTransaction(): Promise<void>;
     commit(): Promise<void>;
     rollback(): Promise<void>;

package/dist/src/connection/Connection.js

@@ -75,11 +75,11 @@ export class Connection {
     quoteIdentifier(value) {
         return `"${value.replace(/"/g, '""')}"`;
     }
-    async query(sqlString) {
-        return (await this.driver.unsafe(sqlString));
+    async query(sqlString, bindings) {
+        return (await this.driver.unsafe(sqlString, bindings));
     }
-    async run(sqlString) {
-        return await this.driver.unsafe(sqlString);
+    async run(sqlString, bindings) {
+        return await this.driver.unsafe(sqlString, bindings);
     }
     async beginTransaction() {
         await this.driver.unsafe("BEGIN");
@@ -105,7 +105,7 @@ export class Connection {
             return await this.transaction(callback);
         }
         return await this.transaction(async (connection) => {
-            await connection.run(`SET LOCAL ${setting} = ${connection.getGrammar().escape(tenantId)}`);
+            await connection.run(`SET LOCAL ${setting} = ${connection.getGrammar().placeholder(1)}`, [tenantId]);
             return await callback(connection);
         });
     }

package/dist/src/query/Builder.d.ts

@@ -31,6 +31,7 @@ export declare class Builder<T = Record<string, any>> {
     fromRaw?: string;
     updateJoins: string[];
     bindings: any[];
+    private parameterize;
     constructor(connection: Connection, table: string);
     private get grammar();
     setModel(model: ModelConstructor): this;
@@ -130,6 +131,7 @@ export declare class Builder<T = Record<string, any>> {
     clone(): Builder<T>;
     wrapColumn(value: string): string;
     escapeValue(value: any): string;
+    private addBinding;
     private compileWhereClause;
     private compileWheres;
     private compileNestedWheres;

package/dist/src/query/Builder.js

@@ -19,6 +19,7 @@ export class Builder {
     fromRaw;
     updateJoins = [];
     bindings = [];
+    parameterize = false;
     constructor(connection, table) {
         this.connection = connection;
         this.tableName = table;
@@ -258,11 +259,11 @@ export class Builder {
         return this;
     }
     having(column, operator, value) {
-        this.havings.push({ sql: `${this.grammar.wrap(column)} ${operator} ${this.grammar.escape(value)}`, boolean: "and" });
+        this.havings.push({ column, operator, value, boolean: "and" });
         return this;
     }
     orHaving(column, operator, value) {
-        this.havings.push({ sql: `${this.grammar.wrap(column)} ${operator} ${this.grammar.escape(value)}`, boolean: "or" });
+        this.havings.push({ column, operator, value, boolean: "or" });
         return this;
     }
     havingRaw(sql, boolean = "and") {
@@ -465,13 +466,21 @@ export class Builder {
     escapeValue(value) {
         return this.grammar.escape(value);
     }
+    addBinding(value) {
+        this.bindings.push(value);
+        return this.grammar.placeholder(this.bindings.length);
+    }
     compileWhereClause(where, prefix) {
         if (where.type === "basic") {
-            return `${prefix} ${this.grammar.wrap(where.column)} ${where.operator} ${this.grammar.escape(where.value)}`;
+            const value = this.parameterize ? this.addBinding(where.value) : this.grammar.escape(where.value);
+            return `${prefix} ${this.grammar.wrap(where.column)} ${where.operator} ${value}`;
         }
         else if (where.type === "in") {
             const op = where.operator === "NOT IN" ? "NOT IN" : "IN";
-            return `${prefix} ${this.grammar.wrap(where.column)} ${op} (${where.value.map((v) => this.grammar.escape(v)).join(", ")})`;
+            const values = this.parameterize
+                ? where.value.map((v) => this.addBinding(v)).join(", ")
+                : where.value.map((v) => this.grammar.escape(v)).join(", ");
+            return `${prefix} ${this.grammar.wrap(where.column)} ${op} (${values})`;
         }
         else if (where.type === "null") {
             const op = where.operator === "NOT NULL" ? "IS NOT NULL" : "IS NULL";
@@ -479,7 +488,9 @@ export class Builder {
         }
         else if (where.type === "between") {
             const op = where.operator === "NOT BETWEEN" ? "NOT BETWEEN" : "BETWEEN";
-            return `${prefix} ${this.grammar.wrap(where.column)} ${op} ${this.grammar.escape(where.value[0])} AND ${this.grammar.escape(where.value[1])}`;
+            const low = this.parameterize ? this.addBinding(where.value[0]) : this.grammar.escape(where.value[0]);
+            const high = this.parameterize ? this.addBinding(where.value[1]) : this.grammar.escape(where.value[1]);
+            return `${prefix} ${this.grammar.wrap(where.column)} ${op} ${low} AND ${high}`;
         }
         else if (where.type === "raw") {
             return `${prefix} ${where.column}`;
@@ -528,7 +539,11 @@ export class Builder {
             return "";
         const clauses = this.havings.map((h, index) => {
             const prefix = index === 0 ? "" : h.boolean.toUpperCase() + " ";
-            return prefix + h.sql;
+            if (h.sql) {
+                return prefix + h.sql;
+            }
+            const value = this.parameterize ? this.addBinding(h.value) : this.grammar.escape(h.value);
+            return prefix + `${this.grammar.wrap(h.column)} ${h.operator} ${value}`;
         });
         return `HAVING ${clauses.join(" ")}`;
     }
@@ -567,7 +582,11 @@ export class Builder {
         return sql.replace(/\s+/g, " ").trim();
     }
     async get() {
-        const results = await this.connection.query(this.toSql());
+        this.bindings = [];
+        this.parameterize = true;
+        const sql = this.toSql();
+        this.parameterize = false;
+        const results = await this.connection.query(sql, this.bindings);
         const rows = Array.from(results);
         if (this.model) {
             const models = rows.map((row) => {
@@ -748,11 +767,15 @@ export class Builder {
         if (records.length === 0)
             return;
         const columns = Object.keys(records[0]);
+        const bindings = [];
         const values = records.map((record) => {
-            return `(${columns.map((col) => this.grammar.escape(record[col])).join(", ")})`;
+            return `(${columns.map((col) => {
+                bindings.push(record[col]);
+                return this.grammar.placeholder(bindings.length);
+            }).join(", ")})`;
         });
         const sql = `INSERT INTO ${this.grammar.wrap(this.tableName)} (${columns.map((c) => this.grammar.wrap(c)).join(", ")}) VALUES ${values.join(", ")}`;
-        return await this.connection.run(sql);
+        return await this.connection.run(sql, bindings);
     }
     async insertGetId(data, idColumn = "id") {
         const result = await this.insert(data);
@@ -763,43 +786,65 @@ export class Builder {
         if (records.length === 0)
             return;
         const columns = Object.keys(records[0]);
+        const bindings = [];
         const values = records.map((record) => {
-            return `(${columns.map((col) => this.grammar.escape(record[col])).join(", ")})`;
+            return `(${columns.map((col) => {
+                bindings.push(record[col]);
+                return this.grammar.placeholder(bindings.length);
+            }).join(", ")})`;
         });
         const sql = this.grammar.compileInsertOrIgnore(this.grammar.wrap(this.tableName), columns, values);
-        return await this.connection.run(sql);
+        return await this.connection.run(sql, bindings);
     }
     async upsert(data, uniqueBy, updateColumns) {
         const records = Array.isArray(data) ? data : [data];
         if (records.length === 0)
             return;
         const columns = Object.keys(records[0]);
+        const bindings = [];
         const values = records.map((record) => {
-            return `(${columns.map((col) => this.grammar.escape(record[col])).join(", ")})`;
+            return `(${columns.map((col) => {
+                bindings.push(record[col]);
+                return this.grammar.placeholder(bindings.length);
+            }).join(", ")})`;
         });
         const uniqueCols = Array.isArray(uniqueBy) ? uniqueBy : [uniqueBy];
         const updateCols = updateColumns ?? columns.filter((c) => !uniqueCols.includes(c));
         const sql = this.grammar.compileUpsert(this.grammar.wrap(this.tableName), columns, values, uniqueCols, updateCols);
-        return await this.connection.run(sql);
+        return await this.connection.run(sql, bindings);
     }
     async update(data) {
-        const sets = Object.entries(data)
-            .map(([key, value]) => `${this.grammar.wrap(key)} = ${this.grammar.escape(value)}`)
-            .join(", ");
-        const sql = this.grammar.compileUpdate(this.grammar.wrap(this.tableName), sets.split(", "), this.compileWheres(), this.updateJoins);
-        return await this.connection.run(sql);
+        this.bindings = [];
+        this.parameterize = true;
+        const sets = Object.entries(data).map(([key, value]) => {
+            this.bindings.push(value);
+            return `${this.grammar.wrap(key)} = ${this.grammar.placeholder(this.bindings.length)}`;
+        });
+        const whereSql = this.compileWheres();
+        this.parameterize = false;
+        const sql = this.grammar.compileUpdate(this.grammar.wrap(this.tableName), sets, whereSql, this.updateJoins);
+        return await this.connection.run(sql, this.bindings);
     }
     async delete() {
-        const sql = this.grammar.compileDelete(this.grammar.wrap(this.tableName), this.compileWheres(), this.updateJoins, this.limitValue);
-        return await this.connection.run(sql);
+        this.bindings = [];
+        this.parameterize = true;
+        const whereSql = this.compileWheres();
+        this.parameterize = false;
+        const sql = this.grammar.compileDelete(this.grammar.wrap(this.tableName), whereSql, this.updateJoins, this.limitValue);
+        return await this.connection.run(sql, this.bindings);
     }
     async increment(column, amount = 1, extra = {}) {
+        this.bindings = [];
+        this.parameterize = true;
         const sets = [`${this.grammar.wrap(column)} = ${this.grammar.wrap(column)} + ${amount}`];
         for (const [key, value] of Object.entries(extra)) {
-            sets.push(`${this.grammar.wrap(key)} = ${this.grammar.escape(value)}`);
+            this.bindings.push(value);
+            sets.push(`${this.grammar.wrap(key)} = ${this.grammar.placeholder(this.bindings.length)}`);
         }
-        const sql = `UPDATE ${this.grammar.wrap(this.tableName)} SET ${sets.join(", ")} ${this.compileWheres()}`;
-        return await this.connection.run(sql.trim());
+        const whereSql = this.compileWheres();
+        this.parameterize = false;
+        const sql = `UPDATE ${this.grammar.wrap(this.tableName)} SET ${sets.join(", ")} ${whereSql}`;
+        return await this.connection.run(sql.trim(), this.bindings);
     }
     async decrement(column, amount = 1, extra = {}) {
         return this.increment(column, -amount, extra);
@@ -841,8 +886,11 @@ export class Builder {
         throw new Error("dd() called — execution halted.");
     }
     async explain() {
+        this.bindings = [];
+        this.parameterize = true;
         const sql = this.grammar.compileExplain(this.toSql());
-        const results = await this.connection.query(sql);
+        this.parameterize = false;
+        const results = await this.connection.query(sql, this.bindings);
         return Array.from(results);
     }
     take(count) {

package/dist/src/query/grammars/Grammar.d.ts

@@ -1,6 +1,7 @@
 export declare abstract class Grammar {
     abstract wrap(value: string): string;
     wrapArray(values: string[]): string[];
+    abstract placeholder(index: number): string;
     escape(value: any): string;
     abstract compileRandomOrder(): string;
     compileOffset(offset: number, _limit?: number): string;

package/dist/src/query/grammars/MySqlGrammar.d.ts

@@ -1,6 +1,7 @@
 import { Grammar } from "./Grammar.js";
 export declare class MySqlGrammar extends Grammar {
     wrap(value: string): string;
+    placeholder(_index: number): string;
     compileRandomOrder(): string;
     compileDateWhere(type: string, column: string, operator: string, value: any): string;
     compileInsertOrIgnore(table: string, columns: string[], values: string[]): string;

package/dist/src/query/grammars/MySqlGrammar.js

@@ -12,6 +12,9 @@ export class MySqlGrammar extends Grammar {
             return value;
         return `\`${value}\``;
     }
+    placeholder(_index) {
+        return "?";
+    }
     compileRandomOrder() {
         return "ORDER BY RAND()";
     }

package/dist/src/query/grammars/PostgresGrammar.d.ts

@@ -1,6 +1,7 @@
 import { Grammar } from "./Grammar.js";
 export declare class PostgresGrammar extends Grammar {
     wrap(value: string): string;
+    placeholder(index: number): string;
     compileRandomOrder(): string;
     compileDateWhere(type: string, column: string, operator: string, value: any): string;
     compileInsertOrIgnore(table: string, columns: string[], values: string[]): string;

package/dist/src/query/grammars/PostgresGrammar.js

@@ -12,6 +12,9 @@ export class PostgresGrammar extends Grammar {
             return value;
         return `"${value}"`;
     }
+    placeholder(index) {
+        return `$${index}`;
+    }
     compileRandomOrder() {
         return "ORDER BY RANDOM()";
     }

package/dist/src/query/grammars/SQLiteGrammar.d.ts

@@ -1,6 +1,7 @@
 import { Grammar } from "./Grammar.js";
 export declare class SQLiteGrammar extends Grammar {
     wrap(value: string): string;
+    placeholder(_index: number): string;
     compileRandomOrder(): string;
     compileOffset(offset: number, limit?: number): string;
     compileDateWhere(type: string, column: string, operator: string, value: any): string;

package/dist/src/query/grammars/SQLiteGrammar.js

@@ -12,6 +12,9 @@ export class SQLiteGrammar extends Grammar {
             return value;
         return `"${value}"`;
     }
+    placeholder(_index) {
+        return "?";
+    }
     compileRandomOrder() {
         return "ORDER BY RANDOM()";
     }

package/dist/src/types/index.d.ts

@@ -41,7 +41,10 @@ export interface OrderClause {
     direction: "asc" | "desc";
 }
 export interface HavingClause {
-    sql: string;
+    column?: string;
+    operator?: string;
+    value?: any;
+    sql?: string;
     boolean: "and" | "or";
 }
 export interface UnionClause {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunnykit/orm",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "An Eloquent-inspired ORM for Bun's native SQL client supporting SQLite, MySQL, and PostgreSQL.",
   "license": "MIT",
   "packageManager": "bun@1.3.12",