@bunnykit/orm 0.1.20 → 0.1.22

package/dist/src/connection/Connection.js

@@ -111,6 +111,9 @@ export class Connection {
         if (this.driverName !== "postgres") {
             return await this.transaction(callback);
         }
+        if (!/^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(setting)) {
+            throw new Error(`Invalid PostgreSQL setting name: ${setting}`);
+        }
         return await this.transaction(async (connection) => {
             await connection.run(`SET LOCAL ${setting} = ${connection.getGrammar().placeholder(1)}`, [tenantId]);
             return await callback(connection);

package/dist/src/connection/ConnectionManager.js

@@ -28,12 +28,12 @@ export class ConnectionManager {
         }
         const now = Date.now();
         const idleTimeout = poolConfig.idleTimeout || 30000;
+        // Reuse a healthy idle connection
         while (pool.length > 0) {
             const idx = pool.findIndex((c) => !c.inUse && (now - c.lastUsed) < idleTimeout);
             if (idx === -1)
                 break;
             const pooled = pool[idx];
-            pool.splice(idx, 1);
             try {
                 await pooled.connection.query("SELECT 1");
                 pooled.inUse = true;
@@ -41,6 +41,14 @@ export class ConnectionManager {
             }
             catch {
                 await pooled.connection.close().catch(() => null);
+                pool.splice(idx, 1);
+            }
+        }
+        // Clean up expired idle connections
+        for (let i = pool.length - 1; i >= 0; i--) {
+            if (!pool[i].inUse && (now - pool[i].lastUsed) >= idleTimeout) {
+                await pool[i].connection.close().catch(() => null);
+                pool.splice(i, 1);
             }
         }
         if (pool.length < (poolConfig.maxConnections || 10)) {
@@ -203,6 +211,14 @@ export class ConnectionManager {
         this.connections.clear();
         this.pools.clear();
         this.tenantCache.clear();
+        // Reject all pending waiters
+        for (const [name, poolWaiters] of this.waiters) {
+            for (const waiter of poolWaiters) {
+                clearTimeout(waiter.timer);
+                waiter.reject(new Error(`Connection pool "${name}" is closing`));
+            }
+        }
+        this.waiters.clear();
         for (const connection of connections) {
             await connection.close();
         }

package/dist/src/model/BelongsToMany.js

@@ -23,6 +23,15 @@ export class BelongsToMany {
         this.relatedPivotKey = relatedPivotKey || `${snakeCase(related.name)}_id`;
         this.builder = related.on(parent.getConnection());
         this.addConstraints();
+        // Wrap getResults with lazy-loading guard
+        const originalGetResults = this.getResults.bind(this);
+        this.getResults = async () => {
+            if (this.parent.constructor.preventLazyLoading) {
+                throw new Error(`Lazy loading is prevented on ${this.parent.constructor.name}. ` +
+                    `Eager load the relation using with().`);
+            }
+            return await originalGetResults();
+        };
     }
     addConstraints() {
         const relatedTable = this.related.getTable();

package/dist/src/model/IdentityMap.d.ts

@@ -5,4 +5,5 @@ export declare class IdentityMap {
     static get(table: string, key: string | number): Model | undefined;
     static set(table: string, key: string | number, model: Model): void;
     static clear(): void;
+    static delete(table: string, key: string | number): void;
 }

package/dist/src/model/IdentityMap.js

@@ -25,4 +25,10 @@ export class IdentityMap {
             return;
         map.clear();
     }
+    static delete(table, key) {
+        const map = this.current();
+        if (!map)
+            return;
+        map.delete(`${table}:${String(key)}`);
+    }
 }

package/dist/src/model/Model.js

@@ -332,6 +332,29 @@ export class Model {
                 }
                 return Reflect.set(target, prop, value, receiver);
             },
+            has(target, prop) {
+                if (typeof prop === "string" && prop in target.$attributes)
+                    return true;
+                return Reflect.has(target, prop);
+            },
+            getOwnPropertyDescriptor(target, prop) {
+                if (typeof prop === "string" && prop in target.$attributes) {
+                    return {
+                        enumerable: true,
+                        configurable: true,
+                        value: target.getAttribute(prop),
+                    };
+                }
+                return Reflect.getOwnPropertyDescriptor(target, prop);
+            },
+            ownKeys(target) {
+                const keys = new Set(Reflect.ownKeys(target));
+                for (const key of Object.keys(target.$attributes)) {
+                    if (!key.startsWith("$"))
+                        keys.add(key);
+                }
+                return Array.from(keys);
+            },
         });
     }
     defineAttributeProperty(key) {
@@ -345,7 +368,17 @@ export class Model {
         });
     }
     syncAttributeProperties() {
-        for (const key of Object.keys(this.$attributes)) {
+        const currentKeys = new Set(Object.keys(this.$attributes));
+        // Remove stale attribute properties
+        for (const key of Reflect.ownKeys(this)) {
+            if (key.startsWith("$") || typeof key !== "string")
+                continue;
+            const desc = Object.getOwnPropertyDescriptor(this, key);
+            if (desc && desc.get && desc.configurable && !currentKeys.has(key)) {
+                delete this[key];
+            }
+        }
+        for (const key of currentKeys) {
             this.defineAttributeProperty(key);
         }
     }
@@ -918,6 +951,10 @@ export class Model {
                 .delete();
             this.$exists = false;
         }
+        const identityMap = IdentityMap.current();
+        if (identityMap) {
+            IdentityMap.delete(constructor.getTable(), pk);
+        }
         await ObserverRegistry.dispatch("deleted", this);
         return true;
     }
@@ -948,6 +985,10 @@ export class Model {
             .where(constructor.primaryKey, pk)
             .delete();
         this.$exists = false;
+        const identityMap = IdentityMap.current();
+        if (identityMap) {
+            IdentityMap.delete(constructor.getTable(), pk);
+        }
         return true;
     }
     async refresh() {
@@ -955,11 +996,20 @@ export class Model {
         const pk = this.getAttribute(constructor.primaryKey);
         if (!pk)
             return this;
+        // Bypass identity map to fetch fresh data
+        const identityMap = IdentityMap.current();
+        if (identityMap) {
+            IdentityMap.delete(constructor.getTable(), pk);
+        }
         const result = await constructor.find(pk);
         if (result) {
             this.$attributes = result.$attributes;
             this.$original = { ...result.$attributes };
             this.syncAttributeProperties();
+            // Ensure this instance is the canonical one in the identity map
+            if (identityMap) {
+                IdentityMap.set(constructor.getTable(), pk, this);
+            }
         }
         return this;
     }

package/dist/src/model/MorphRelations.js

@@ -13,6 +13,15 @@ export class MorphTo {
         this.typeColumn = `${name}_type`;
         this.idColumn = `${name}_id`;
         this.typeMap = typeMap;
+        // Wrap getResults with lazy-loading guard
+        const originalGetResults = this.getResults.bind(this);
+        this.getResults = async () => {
+            if (this.parent.constructor.preventLazyLoading) {
+                throw new Error(`Lazy loading is prevented on ${this.parent.constructor.name}. ` +
+                    `Eager load the relation using with().`);
+            }
+            return await originalGetResults();
+        };
     }
     async getResults() {
         const type = this.parent.getAttribute(this.typeColumn);
@@ -99,6 +108,15 @@ export class MorphOne {
         this.builder = related.on(parent.getConnection());
         this.builder.where(this.typeColumn, this.getMorphType());
         this.builder.where(this.idColumn, this.parent.getAttribute(this.localKey));
+        // Wrap getResults with lazy-loading guard
+        const originalGetResults = this.getResults.bind(this);
+        this.getResults = async () => {
+            if (this.parent.constructor.preventLazyLoading) {
+                throw new Error(`Lazy loading is prevented on ${this.parent.constructor.name}. ` +
+                    `Eager load the relation using with().`);
+            }
+            return await originalGetResults();
+        };
     }
     getMorphType() {
         return this.parent.constructor.morphName || this.parent.constructor.name;
@@ -168,6 +186,15 @@ export class MorphMany {
         this.builder = related.on(parent.getConnection());
         this.builder.where(this.typeColumn, this.getMorphType());
         this.builder.where(this.idColumn, this.parent.getAttribute(this.localKey));
+        // Wrap getResults with lazy-loading guard
+        const originalGetResults = this.getResults.bind(this);
+        this.getResults = async () => {
+            if (this.parent.constructor.preventLazyLoading) {
+                throw new Error(`Lazy loading is prevented on ${this.parent.constructor.name}. ` +
+                    `Eager load the relation using with().`);
+            }
+            return await originalGetResults();
+        };
     }
     getMorphType() {
         return this.parent.constructor.morphName || this.parent.constructor.name;
@@ -244,6 +271,15 @@ export class MorphToMany {
         this.relatedPivotKey = relatedPivotKey || `${snakeCase(related.name)}_id`;
         this.builder = related.on(parent.getConnection());
         this.addConstraints();
+        // Wrap getResults with lazy-loading guard
+        const originalGetResults = this.getResults.bind(this);
+        this.getResults = async () => {
+            if (this.parent.constructor.preventLazyLoading) {
+                throw new Error(`Lazy loading is prevented on ${this.parent.constructor.name}. ` +
+                    `Eager load the relation using with().`);
+            }
+            return await originalGetResults();
+        };
     }
     addConstraints() {
         const relatedTable = this.related.getTable();

package/dist/src/query/Builder.d.ts

@@ -134,7 +134,7 @@ export declare class Builder<T = Record<string, any>> {
     private addBinding;
     private compileWhereClause;
     private compileWheres;
-    private compileNestedWheres;
+    private compileWhereClauses;
     private compileOrders;
     private compileGroups;
     private compileHavings;
@@ -161,6 +161,8 @@ export declare class Builder<T = Record<string, any>> {
     chunk(count: number, callback: (items: T[]) => void | Promise<void>): Promise<void>;
     each(count: number, callback: (item: T) => void | Promise<void>): Promise<void>;
     cursor(chunkSize?: number): AsyncGenerator<T>;
+    private getResultAccessColumn;
+    private compileCursorWheres;
     lazy(count?: number): AsyncGenerator<T>;
     insert(data: ModelAttributeInput<T> | ModelAttributeInput<T>[]): Promise<any>;
     insertGetId(data: ModelAttributeInput<T>, idColumn?: ModelColumn<T>): Promise<any>;

package/dist/src/query/Builder.js

@@ -65,8 +65,7 @@ export class Builder {
         const nested = new Builder(this.connection, this.tableName);
         callback(nested);
         if (nested.wheres.length > 0) {
-            const sql = this.compileNestedWheres(nested);
-            this.wheres.push({ type: "raw", column: `(${sql})`, boolean, scope: undefined });
+            this.wheres.push({ type: "nested", column: "", query: nested.wheres, boolean, scope: undefined });
         }
         return this;
     }
@@ -182,10 +181,7 @@ export class Builder {
         return this.whereRaw(sql, "or", scope);
     }
     whereJsonContains(column, value, boolean = "and", not = false) {
-        let sql = this.grammar.compileJsonContains(this.grammar.wrap(column), value);
-        if (not)
-            sql = `NOT (${sql})`;
-        this.wheres.push({ type: "raw", column: sql, boolean, scope: undefined });
+        this.wheres.push({ type: "json_contains", column, value, boolean, scope: undefined, not });
         return this;
     }
     whereJsonLength(column, operator = "=", value, boolean = "and", not = false) {
@@ -193,41 +189,31 @@ export class Builder {
             value = operator;
             operator = "=";
         }
-        let sql = this.grammar.compileJsonLength(this.grammar.wrap(column), String(operator), value);
-        if (not)
-            sql = `NOT (${sql})`;
-        this.wheres.push({ type: "raw", column: sql, boolean, scope: undefined });
+        this.wheres.push({ type: "json_length", column, operator: String(operator), value, boolean, scope: undefined, not });
         return this;
     }
     whereLike(column, value, boolean = "and", not = false) {
-        const sql = this.grammar.compileLike(this.grammar.wrap(column), value, not);
-        this.wheres.push({ type: "raw", column: sql, boolean, scope: undefined });
+        this.wheres.push({ type: "like", column, value, boolean, scope: undefined, not });
         return this;
     }
     whereNotLike(column, value) {
         return this.whereLike(column, value, "and", true);
     }
     whereRegexp(column, value, boolean = "and", not = false) {
-        const sql = this.grammar.compileRegexp(this.grammar.wrap(column), value, not);
-        this.wheres.push({ type: "raw", column: sql, boolean, scope: undefined });
+        this.wheres.push({ type: "regexp", column, value, boolean, scope: undefined, not });
         return this;
     }
     whereFullText(columns, value, boolean = "and", not = false) {
         const cols = Array.isArray(columns) ? columns : [columns];
-        let sql = this.grammar.compileFullText(cols.map((c) => this.grammar.wrap(c)), value);
-        if (not)
-            sql = `NOT (${sql})`;
-        this.wheres.push({ type: "raw", column: sql, boolean, scope: undefined });
+        this.wheres.push({ type: "fulltext", column: "", columns: cols, value, boolean, scope: undefined, not });
         return this;
     }
     whereAll(columns, operator, value, boolean = "and") {
-        const sql = columns.map((c) => `${this.grammar.wrap(c)} ${operator} ${this.grammar.escape(value)}`).join(" AND ");
-        this.wheres.push({ type: "raw", column: `(${sql})`, boolean, scope: undefined });
+        this.wheres.push({ type: "all", column: "", columns: columns, operator, value, boolean, scope: undefined });
         return this;
     }
     whereAny(columns, operator, value, boolean = "and") {
-        const sql = columns.map((c) => `${this.grammar.wrap(c)} ${operator} ${this.grammar.escape(value)}`).join(" OR ");
-        this.wheres.push({ type: "raw", column: `(${sql})`, boolean, scope: undefined });
+        this.wheres.push({ type: "any", column: "", columns: columns, operator, value, boolean, scope: undefined });
         return this;
     }
     orderBy(column, direction = "asc") {
@@ -459,6 +445,7 @@ export class Builder {
         cloned.fromRaw = this.fromRaw;
         cloned.updateJoins = [...this.updateJoins];
         cloned.bindings = [...this.bindings];
+        cloned.parameterize = this.parameterize;
         return cloned;
     }
     wrapColumn(value) {
@@ -496,6 +483,57 @@ export class Builder {
         else if (where.type === "raw") {
             return `${prefix} ${where.column}`;
         }
+        else if (where.type === "nested") {
+            const sql = this.compileWhereClauses(where.query || [], "");
+            return `${prefix} (${sql})`;
+        }
+        else if (where.type === "like") {
+            const sql = this.grammar.compileLike(this.grammar.wrap(where.column), where.value, !!where.not, this.parameterize ? (v) => this.addBinding(v) : undefined);
+            return `${prefix} ${sql}`;
+        }
+        else if (where.type === "regexp") {
+            const sql = this.grammar.compileRegexp(this.grammar.wrap(where.column), where.value, !!where.not, this.parameterize ? (v) => this.addBinding(v) : undefined);
+            return `${prefix} ${sql}`;
+        }
+        else if (where.type === "fulltext") {
+            const cols = (where.columns || []).map((c) => this.grammar.wrap(c));
+            let sql = this.grammar.compileFullText(cols, where.value, this.parameterize ? (v) => this.addBinding(v) : undefined);
+            if (where.not)
+                sql = `NOT (${sql})`;
+            return `${prefix} ${sql}`;
+        }
+        else if (where.type === "json_contains") {
+            let sql = this.grammar.compileJsonContains(this.grammar.wrap(where.column), where.value, this.parameterize ? (v) => this.addBinding(v) : undefined);
+            if (where.not)
+                sql = `NOT (${sql})`;
+            return `${prefix} ${sql}`;
+        }
+        else if (where.type === "json_length") {
+            let sql = this.grammar.compileJsonLength(this.grammar.wrap(where.column), where.operator || "=", where.value, this.parameterize ? (v) => this.addBinding(v) : undefined);
+            if (where.not)
+                sql = `NOT (${sql})`;
+            return `${prefix} ${sql}`;
+        }
+        else if (where.type === "date") {
+            const sql = this.grammar.compileDateWhere(where.dateType || "date", this.grammar.wrap(where.column), where.operator || "=", where.value, this.parameterize ? (v) => this.addBinding(v) : undefined);
+            return `${prefix} ${sql}`;
+        }
+        else if (where.type === "all") {
+            const cols = (where.columns || []).map((c) => this.grammar.wrap(c));
+            const inner = cols.map((c) => {
+                const val = this.parameterize ? this.addBinding(where.value) : this.grammar.escape(where.value);
+                return `${c} ${where.operator} ${val}`;
+            }).join(" AND ");
+            return `${prefix} (${inner})`;
+        }
+        else if (where.type === "any") {
+            const cols = (where.columns || []).map((c) => this.grammar.wrap(c));
+            const inner = cols.map((c) => {
+                const val = this.parameterize ? this.addBinding(where.value) : this.grammar.escape(where.value);
+                return `${c} ${where.operator} ${val}`;
+            }).join(" OR ");
+            return `${prefix} (${inner})`;
+        }
         else if (where.type === "column") {
             return `${prefix} ${this.grammar.wrap(where.column)} ${where.operator} ${this.grammar.wrap(where.value)}`;
         }
@@ -505,20 +543,15 @@ export class Builder {
         return "";
     }
     compileWheres() {
-        if (this.wheres.length === 0)
-            return "";
-        const clauses = this.wheres.map((where, index) => {
-            const prefix = index === 0 ? "WHERE" : where.boolean.toUpperCase();
-            return this.compileWhereClause(where, prefix);
-        });
-        return clauses.join(" ");
+        return this.compileWhereClauses(this.wheres, "WHERE");
     }
-    compileNestedWheres(builder) {
-        if (builder.wheres.length === 0)
+    compileWhereClauses(wheres, firstPrefix) {
+        if (wheres.length === 0)
             return "";
-        const clauses = builder.wheres.map((where, index) => {
-            const prefix = index === 0 ? "" : where.boolean.toUpperCase();
-            return this.compileWhereClause(where, prefix);
+        const clauses = wheres.map((where, index) => {
+            const prefix = index === 0 ? "WHERE" : where.boolean.toUpperCase();
+            const adjustedPrefix = index === 0 ? firstPrefix : prefix;
+            return this.compileWhereClause(where, adjustedPrefix);
         });
         return clauses.join(" ").trim();
     }
@@ -740,24 +773,32 @@ export class Builder {
     async *cursor(chunkSize = 1000) {
         const model = this.model;
         const primaryKey = model ? model.primaryKey || "id" : "id";
+        // Cursor pagination is incompatible with random ordering
+        if (this.randomOrderFlag) {
+            throw new Error("cursor() does not support inRandomOrder(). Use lazy() instead.");
+        }
         const orderColumn = this.orders[0]?.column || primaryKey;
         const orderDirection = this.orders[0]?.direction || "asc";
-        let lastValue = undefined;
+        let lastValues = undefined;
         while (true) {
             const builder = this.clone();
-            builder.orders = [{ column: orderColumn, direction: orderDirection }];
+            // Preserve multi-column ORDER BY, appending PK tie-breaker if not present
+            builder.orders = this.orders.length > 0 ? [...this.orders] : [{ column: orderColumn, direction: orderDirection }];
+            const hasPkOrder = builder.orders.some((o) => o.column === primaryKey);
+            if (!hasPkOrder) {
+                builder.orders.push({ column: primaryKey, direction: orderDirection });
+            }
             builder.offsetValue = undefined;
             builder.limitValue = chunkSize;
-            if (lastValue !== undefined) {
-                const op = orderDirection === "asc" ? ">" : "<";
-                builder.wheres.push({
-                    type: "basic",
-                    column: orderColumn,
-                    operator: op,
-                    value: lastValue,
-                    boolean: "and",
-                    scope: undefined,
-                });
+            if (lastValues !== undefined) {
+                // Parenthesize existing wheres when appending cursor condition to preserve OR precedence
+                if (builder.wheres.length > 0) {
+                    const hasOr = builder.wheres.some((w) => w.boolean === "or");
+                    if (hasOr) {
+                        builder.wheres = [{ type: "nested", column: "", query: builder.wheres, boolean: "and", scope: undefined }];
+                    }
+                }
+                builder.wheres.push({ type: "nested", column: "", query: this.compileCursorWheres(builder.orders, lastValues), boolean: "and", scope: undefined });
             }
             const items = await builder.get();
             if (items.length === 0)
@@ -768,11 +809,46 @@ export class Builder {
             if (items.length < chunkSize)
                 break;
             const lastItem = items[items.length - 1];
-            lastValue = lastItem && typeof lastItem === "object"
-                ? lastItem[orderColumn]
+            lastValues = lastItem && typeof lastItem === "object"
+                ? builder.orders.map((order) => lastItem[this.getResultAccessColumn(order.column)])
                 : undefined;
         }
     }
+    getResultAccessColumn(column) {
+        return column.includes(".") ? column.split(".").at(-1) : column;
+    }
+    compileCursorWheres(orders, values, index = 0) {
+        const order = orders[index];
+        const op = order.direction === "asc" ? ">" : "<";
+        const clauses = [{
+                type: "basic",
+                column: order.column,
+                operator: op,
+                value: values[index],
+                boolean: "and",
+                scope: undefined,
+            }];
+        if (index < orders.length - 1) {
+            clauses.push({
+                type: "nested",
+                column: "",
+                query: [
+                    {
+                        type: "basic",
+                        column: order.column,
+                        operator: "=",
+                        value: values[index],
+                        boolean: "and",
+                        scope: undefined,
+                    },
+                    ...this.compileCursorWheres(orders, values, index + 1),
+                ],
+                boolean: "or",
+                scope: undefined,
+            });
+        }
+        return clauses;
+    }
     async *lazy(count = 1000) {
         let page = 1;
         while (true) {
@@ -958,8 +1034,7 @@ export class Builder {
             value = operator;
             operator = "=";
         }
-        const sql = this.grammar.compileDateWhere(type, this.grammar.wrap(column), operator, value);
-        this.wheres.push({ type: "raw", column: sql, boolean, scope: undefined });
+        this.wheres.push({ type: "date", column: column, operator, value, boolean, scope: undefined, dateType: type });
         return this;
     }
     getModelRelation(relationName) {

package/dist/src/query/grammars/Grammar.d.ts

@@ -6,15 +6,15 @@ export declare abstract class Grammar {
     abstract compileRandomOrder(): string;
     compileOffset(offset: number, _limit?: number): string;
     compileLock(lockMode?: string): string;
-    abstract compileDateWhere(type: string, column: string, operator: string, value: any): string;
+    abstract compileDateWhere(type: string, column: string, operator: string, value: any, binding?: (value: any) => string): string;
     abstract compileInsertOrIgnore(table: string, columns: string[], values: string[]): string;
     abstract compileUpsert(table: string, columns: string[], values: string[], uniqueBy: string[], updateColumns: string[]): string;
     compileUpdate(table: string, sets: string[], wheres: string, joins?: string[]): string;
     compileDelete(table: string, wheres: string, joins?: string[], limit?: number): string;
-    abstract compileJsonContains(column: string, value: any): string;
-    abstract compileJsonLength(column: string, operator: string, value: any): string;
-    compileLike(column: string, value: string, not: boolean): string;
-    abstract compileRegexp(column: string, value: string, not: boolean): string;
-    abstract compileFullText(columns: string[], value: string): string;
+    abstract compileJsonContains(column: string, value: any, binding?: (value: any) => string): string;
+    abstract compileJsonLength(column: string, operator: string, value: any, binding?: (value: any) => string): string;
+    compileLike(column: string, value: string, not: boolean, binding?: (value: any) => string): string;
+    abstract compileRegexp(column: string, value: string, not: boolean, binding?: (value: any) => string): string;
+    abstract compileFullText(columns: string[], value: string, binding?: (value: any) => string): string;
     abstract compileExplain(sql: string): string;
 }

package/dist/src/query/grammars/Grammar.js

@@ -40,8 +40,8 @@ export class Grammar {
             sql += ` LIMIT ${limit}`;
         return sql.trim();
     }
-    compileLike(column, value, not) {
+    compileLike(column, value, not, binding) {
         const op = not ? "NOT LIKE" : "LIKE";
-        return `${column} ${op} ${this.escape(value)}`;
+        return `${column} ${op} ${binding ? binding(value) : this.escape(value)}`;
     }
 }

package/dist/src/query/grammars/MySqlGrammar.d.ts

@@ -3,12 +3,12 @@ export declare class MySqlGrammar extends Grammar {
     wrap(value: string): string;
     placeholder(_index: number): string;
     compileRandomOrder(): string;
-    compileDateWhere(type: string, column: string, operator: string, value: any): string;
+    compileDateWhere(type: string, column: string, operator: string, value: any, binding?: (value: any) => string): string;
     compileInsertOrIgnore(table: string, columns: string[], values: string[]): string;
     compileUpsert(table: string, columns: string[], values: string[], _uniqueBy: string[], updateColumns: string[]): string;
-    compileJsonContains(column: string, value: any): string;
-    compileJsonLength(column: string, operator: string, value: any): string;
-    compileRegexp(column: string, value: string, not: boolean): string;
-    compileFullText(columns: string[], value: string): string;
+    compileJsonContains(column: string, value: any, binding?: (value: any) => string): string;
+    compileJsonLength(column: string, operator: string, value: any, binding?: (value: any) => string): string;
+    compileRegexp(column: string, value: string, not: boolean, binding?: (value: any) => string): string;
+    compileFullText(columns: string[], value: string, binding?: (value: any) => string): string;
     compileExplain(sql: string): string;
 }

package/dist/src/query/grammars/MySqlGrammar.js

@@ -18,20 +18,21 @@ export class MySqlGrammar extends Grammar {
     compileRandomOrder() {
         return "ORDER BY RAND()";
     }
-    compileDateWhere(type, column, operator, value) {
+    compileDateWhere(type, column, operator, value, binding) {
+        const val = binding ? binding(value) : this.escape(value);
         switch (type) {
             case "date":
-                return `DATE(${column}) ${operator} ${this.escape(value)}`;
+                return `DATE(${column}) ${operator} ${val}`;
             case "day":
-                return `DAY(${column}) ${operator} ${this.escape(value)}`;
+                return `DAY(${column}) ${operator} ${val}`;
             case "month":
-                return `MONTH(${column}) ${operator} ${this.escape(value)}`;
+                return `MONTH(${column}) ${operator} ${val}`;
             case "year":
-                return `YEAR(${column}) ${operator} ${this.escape(value)}`;
+                return `YEAR(${column}) ${operator} ${val}`;
             case "time":
-                return `TIME(${column}) ${operator} ${this.escape(value)}`;
+                return `TIME(${column}) ${operator} ${val}`;
             default:
-                return `${column} ${operator} ${this.escape(value)}`;
+                return `${column} ${operator} ${val}`;
         }
     }
     compileInsertOrIgnore(table, columns, values) {
@@ -43,18 +44,18 @@ export class MySqlGrammar extends Grammar {
             .join(", ");
         return `INSERT INTO ${table} (${columns.map((c) => this.wrap(c)).join(", ")}) VALUES ${values.join(", ")} ON DUPLICATE KEY UPDATE ${updateCols}`;
     }
-    compileJsonContains(column, value) {
-        return `JSON_CONTAINS(${column}, ${this.escape(JSON.stringify(value))})`;
+    compileJsonContains(column, value, binding) {
+        return `JSON_CONTAINS(${column}, ${binding ? binding(JSON.stringify(value)) : this.escape(JSON.stringify(value))})`;
     }
-    compileJsonLength(column, operator, value) {
-        return `JSON_LENGTH(${column}) ${operator} ${this.escape(value)}`;
+    compileJsonLength(column, operator, value, binding) {
+        return `JSON_LENGTH(${column}) ${operator} ${binding ? binding(value) : this.escape(value)}`;
     }
-    compileRegexp(column, value, not) {
+    compileRegexp(column, value, not, binding) {
         const op = not ? "NOT REGEXP" : "REGEXP";
-        return `${column} ${op} ${this.escape(value)}`;
+        return `${column} ${op} ${binding ? binding(value) : this.escape(value)}`;
     }
-    compileFullText(columns, value) {
-        return `MATCH (${columns.join(", ")}) AGAINST (${this.escape(value)})`;
+    compileFullText(columns, value, binding) {
+        return `MATCH (${columns.join(", ")}) AGAINST (${binding ? binding(value) : this.escape(value)})`;
     }
     compileExplain(sql) {
         return `EXPLAIN ${sql}`;

package/dist/src/query/grammars/PostgresGrammar.d.ts

@@ -3,12 +3,12 @@ export declare class PostgresGrammar extends Grammar {
     wrap(value: string): string;
     placeholder(index: number): string;
     compileRandomOrder(): string;
-    compileDateWhere(type: string, column: string, operator: string, value: any): string;
+    compileDateWhere(type: string, column: string, operator: string, value: any, binding?: (value: any) => string): string;
     compileInsertOrIgnore(table: string, columns: string[], values: string[]): string;
     compileUpsert(table: string, columns: string[], values: string[], uniqueBy: string[], updateColumns: string[]): string;
-    compileJsonContains(column: string, value: any): string;
-    compileJsonLength(column: string, operator: string, value: any): string;
-    compileRegexp(column: string, value: string, not: boolean): string;
-    compileFullText(columns: string[], value: string): string;
+    compileJsonContains(column: string, value: any, binding?: (value: any) => string): string;
+    compileJsonLength(column: string, operator: string, value: any, binding?: (value: any) => string): string;
+    compileRegexp(column: string, value: string, not: boolean, binding?: (value: any) => string): string;
+    compileFullText(columns: string[], value: string, binding?: (value: any) => string): string;
     compileExplain(sql: string): string;
 }

package/dist/src/query/grammars/PostgresGrammar.js

@@ -18,20 +18,21 @@ export class PostgresGrammar extends Grammar {
     compileRandomOrder() {
         return "ORDER BY RANDOM()";
     }
-    compileDateWhere(type, column, operator, value) {
+    compileDateWhere(type, column, operator, value, binding) {
+        const val = binding ? binding(value) : this.escape(value);
         switch (type) {
             case "date":
-                return `(${column})::date ${operator} ${this.escape(value)}`;
+                return `(${column})::date ${operator} ${val}`;
             case "day":
-                return `EXTRACT(DAY FROM ${column}) ${operator} ${this.escape(value)}`;
+                return `EXTRACT(DAY FROM ${column}) ${operator} ${val}`;
             case "month":
-                return `EXTRACT(MONTH FROM ${column}) ${operator} ${this.escape(value)}`;
+                return `EXTRACT(MONTH FROM ${column}) ${operator} ${val}`;
             case "year":
-                return `EXTRACT(YEAR FROM ${column}) ${operator} ${this.escape(value)}`;
+                return `EXTRACT(YEAR FROM ${column}) ${operator} ${val}`;
             case "time":
-                return `(${column})::time ${operator} ${this.escape(value)}`;
+                return `(${column})::time ${operator} ${val}`;
             default:
-                return `${column} ${operator} ${this.escape(value)}`;
+                return `${column} ${operator} ${val}`;
         }
     }
     compileInsertOrIgnore(table, columns, values) {
@@ -43,21 +44,21 @@ export class PostgresGrammar extends Grammar {
             .join(", ");
         return `INSERT INTO ${table} (${columns.map((c) => this.wrap(c)).join(", ")}) VALUES ${values.join(", ")} ON CONFLICT (${uniqueBy.map((c) => this.wrap(c)).join(", ")}) DO UPDATE SET ${updateCols}`;
     }
-    compileJsonContains(column, value) {
-        return `${column} @> ${this.escape(JSON.stringify([value]))}`;
+    compileJsonContains(column, value, binding) {
+        return `${column} @> ${binding ? binding(JSON.stringify([value])) : this.escape(JSON.stringify([value]))}`;
     }
-    compileJsonLength(column, operator, value) {
-        return `jsonb_array_length(${column}) ${operator} ${this.escape(value)}`;
+    compileJsonLength(column, operator, value, binding) {
+        return `jsonb_array_length(${column}) ${operator} ${binding ? binding(value) : this.escape(value)}`;
     }
-    compileRegexp(column, value, not) {
+    compileRegexp(column, value, not, binding) {
         const op = not ? "!~" : "~";
-        return `${column} ${op} ${this.escape(value)}`;
+        return `${column} ${op} ${binding ? binding(value) : this.escape(value)}`;
     }
-    compileFullText(columns, value) {
+    compileFullText(columns, value, binding) {
         const cols = columns.length > 1
             ? `concat_ws(' ', ${columns.join(", ")})`
             : columns[0];
-        return `to_tsvector('english', ${cols}) @@ plainto_tsquery('english', ${this.escape(value)})`;
+        return `to_tsvector('english', ${cols}) @@ plainto_tsquery('english', ${binding ? binding(value) : this.escape(value)})`;
     }
     compileExplain(sql) {
         return `EXPLAIN (FORMAT JSON) ${sql}`;

package/dist/src/query/grammars/SQLiteGrammar.d.ts

@@ -4,12 +4,12 @@ export declare class SQLiteGrammar extends Grammar {
     placeholder(_index: number): string;
     compileRandomOrder(): string;
     compileOffset(offset: number, limit?: number): string;
-    compileDateWhere(type: string, column: string, operator: string, value: any): string;
+    compileDateWhere(type: string, column: string, operator: string, value: any, binding?: (value: any) => string): string;
     compileInsertOrIgnore(table: string, columns: string[], values: string[]): string;
     compileUpsert(table: string, columns: string[], values: string[], uniqueBy: string[], updateColumns: string[]): string;
-    compileJsonContains(column: string, value: any): string;
-    compileJsonLength(column: string, operator: string, value: any): string;
-    compileRegexp(column: string, value: string, not: boolean): string;
-    compileFullText(columns: string[], value: string): string;
+    compileJsonContains(column: string, value: any, binding?: (value: any) => string): string;
+    compileJsonLength(column: string, operator: string, value: any, binding?: (value: any) => string): string;
+    compileRegexp(column: string, value: string, not: boolean, binding?: (value: any) => string): string;
+    compileFullText(columns: string[], value: string, binding?: (value: any) => string): string;
     compileExplain(sql: string): string;
 }

package/dist/src/query/grammars/SQLiteGrammar.js

@@ -22,20 +22,21 @@ export class SQLiteGrammar extends Grammar {
         const limitSql = limit === undefined ? "LIMIT -1 " : "";
         return `${limitSql}OFFSET ${offset}`;
     }
-    compileDateWhere(type, column, operator, value) {
+    compileDateWhere(type, column, operator, value, binding) {
+        const val = binding ? binding(value) : this.escape(value);
         switch (type) {
             case "date":
-                return `date(${column}) ${operator} ${this.escape(value)}`;
+                return `date(${column}) ${operator} ${val}`;
             case "day":
-                return `CAST(strftime('%d', ${column}) AS INTEGER) ${operator} ${this.escape(value)}`;
+                return `CAST(strftime('%d', ${column}) AS INTEGER) ${operator} ${val}`;
             case "month":
-                return `CAST(strftime('%m', ${column}) AS INTEGER) ${operator} ${this.escape(value)}`;
+                return `CAST(strftime('%m', ${column}) AS INTEGER) ${operator} ${val}`;
             case "year":
-                return `CAST(strftime('%Y', ${column}) AS INTEGER) ${operator} ${this.escape(value)}`;
+                return `CAST(strftime('%Y', ${column}) AS INTEGER) ${operator} ${val}`;
             case "time":
-                return `time(${column}) ${operator} ${this.escape(value)}`;
+                return `time(${column}) ${operator} ${val}`;
             default:
-                return `${column} ${operator} ${this.escape(value)}`;
+                return `${column} ${operator} ${val}`;
         }
     }
     compileInsertOrIgnore(table, columns, values) {
@@ -47,18 +48,18 @@ export class SQLiteGrammar extends Grammar {
             .join(", ");
         return `INSERT INTO ${table} (${columns.map((c) => this.wrap(c)).join(", ")}) VALUES ${values.join(", ")} ON CONFLICT(${uniqueBy.map((c) => this.wrap(c)).join(", ")}) DO UPDATE SET ${updateCols}`;
     }
-    compileJsonContains(column, value) {
-        return `${column} IN (SELECT value FROM json_each(${column})) AND ${this.escape(value)} IN (SELECT value FROM json_each(${column}))`;
+    compileJsonContains(column, value, binding) {
+        return `${column} IN (SELECT value FROM json_each(${column})) AND ${binding ? binding(value) : this.escape(value)} IN (SELECT value FROM json_each(${column}))`;
     }
-    compileJsonLength(column, operator, value) {
-        return `(SELECT COUNT(*) FROM json_each(${column})) ${operator} ${this.escape(value)}`;
+    compileJsonLength(column, operator, value, binding) {
+        return `(SELECT COUNT(*) FROM json_each(${column})) ${operator} ${binding ? binding(value) : this.escape(value)}`;
     }
-    compileRegexp(column, value, not) {
+    compileRegexp(column, value, not, binding) {
         const op = not ? "NOT REGEXP" : "REGEXP";
-        return `${column} ${op} ${this.escape(value)}`;
+        return `${column} ${op} ${binding ? binding(value) : this.escape(value)}`;
     }
-    compileFullText(columns, value) {
-        return columns.map((c) => `${this.wrap(c)} LIKE ${this.escape(`%${value}%`)}`).join(" OR ");
+    compileFullText(columns, value, binding) {
+        return columns.map((c) => `${this.wrap(c)} LIKE ${binding ? binding(`%${value}%`) : this.escape(`%${value}%`)}`).join(" OR ");
     }
     compileExplain(sql) {
         return `EXPLAIN QUERY PLAN ${sql}`;

package/dist/src/schema/Schema.js

@@ -135,48 +135,57 @@ export class Schema {
         const driver = connection.getDriverName();
         const schema = connection.getSchema() || "public";
         let sql;
+        let bindings = [];
         if (driver === "sqlite") {
-            sql = `SELECT name FROM sqlite_master WHERE type='table' AND name='${table}'`;
+            sql = "SELECT name FROM sqlite_master WHERE type='table' AND name = ?";
+            bindings = [table];
         }
         else if (driver === "mysql") {
-            sql = `SHOW TABLES LIKE '${table}'`;
+            sql = "SELECT table_name FROM information_schema.tables WHERE table_schema = DATABASE() AND table_name = ?";
+            bindings = [table];
         }
         else {
-            sql = `SELECT * FROM information_schema.tables WHERE table_schema = '${schema}' AND table_name = '${table}'`;
+            sql = "SELECT table_name FROM information_schema.tables WHERE table_schema = $1 AND table_name = $2";
+            bindings = [schema, table];
         }
-        const result = await connection.query(sql);
+        const result = await connection.query(sql, bindings);
         return result.length > 0;
     }
     static async hasColumn(table, column) {
         const connection = this.getConnection();
         const driver = connection.getDriverName();
         const schema = connection.getSchema() || "public";
+        const grammar = this.getGrammar();
         let sql;
+        let bindings = [];
         if (driver === "sqlite") {
-            sql = `PRAGMA table_info(${table})`;
+            sql = `PRAGMA table_info(${grammar.wrap(table)})`;
             const result = await connection.query(sql);
             return result.some((row) => row.name === column);
         }
         else if (driver === "mysql") {
-            sql = `SHOW COLUMNS FROM ${table} LIKE '${column}'`;
+            sql = "SELECT column_name FROM information_schema.columns WHERE table_schema = DATABASE() AND table_name = ? AND column_name = ?";
+            bindings = [table, column];
         }
         else {
-            sql = `SELECT column_name FROM information_schema.columns WHERE table_schema = '${schema}' AND table_name = '${table}' AND column_name = '${column}'`;
+            sql = "SELECT column_name FROM information_schema.columns WHERE table_schema = $1 AND table_name = $2 AND column_name = $3";
+            bindings = [schema, table, column];
         }
-        const result = await connection.query(sql);
+        const result = await connection.query(sql, bindings);
         return result.length > 0;
     }
     static async getColumn(table, column) {
         const connection = this.getConnection();
         const driver = connection.getDriverName();
         const schema = connection.getSchema() || "public";
+        const grammar = this.getGrammar();
         if (driver === "sqlite") {
-            const rows = await connection.query(`PRAGMA table_info(${table})`);
+            const rows = await connection.query(`PRAGMA table_info(${grammar.wrap(table)})`);
             const row = rows.find((item) => item.name === column);
             return row ? { name: row.name, type: row.type, primary: row.pk > 0, autoIncrement: false } : null;
         }
         if (driver === "mysql") {
-            const rows = await connection.query(`SHOW COLUMNS FROM ${table} LIKE '${column}'`);
+            const rows = await connection.query("SELECT column_name AS Field, column_type AS Type, column_key AS `Key`, extra AS Extra FROM information_schema.columns WHERE table_schema = DATABASE() AND table_name = ? AND column_name = ?", [table, column]);
             const row = rows[0];
             return row ? { name: row.Field, type: row.Type, primary: row.Key === "PRI", autoIncrement: String(row.Extra || "").toLowerCase().includes("auto_increment") } : null;
         }
@@ -189,9 +198,9 @@ export class Schema {
        LEFT JOIN information_schema.table_constraints tc
          ON kcu.table_schema = tc.table_schema
         AND kcu.constraint_name = tc.constraint_name
-       WHERE c.table_schema = '${schema}'
-         AND c.table_name = '${table}'
-         AND c.column_name = '${column}'`);
+       WHERE c.table_schema = $1
+         AND c.table_name = $2
+         AND c.column_name = $3`, [schema, table, column]);
         const row = rows[0];
         return row ? { name: row.column_name, type: row.data_type, primary: !!row.primary_key, autoIncrement: false } : null;
     }

package/dist/src/schema/grammars/Grammar.js

@@ -5,7 +5,7 @@ export class Grammar {
             return value.split(".").map((v) => this.wrap(v)).join(".");
         }
         const { prefix, suffix } = this.wrappers;
-        return `${prefix}${value}${suffix}`;
+        return `${prefix}${value.replaceAll(suffix, `${suffix}${suffix}`)}${suffix}`;
     }
     wrapArray(values) {
         return values.map((v) => this.wrap(v));

package/dist/src/types/index.d.ts

@@ -29,12 +29,16 @@ export interface ForeignKeyDefinition {
     onUpdate?: string;
 }
 export interface WhereClause {
-    type: "basic" | "in" | "null" | "raw" | "between" | "column" | "exists";
+    type: "basic" | "in" | "null" | "raw" | "nested" | "between" | "column" | "exists" | "like" | "regexp" | "fulltext" | "json_contains" | "json_length" | "date" | "all" | "any";
     column: string;
+    columns?: string[];
     operator?: string;
     value?: any;
     boolean: "and" | "or";
     scope?: string;
+    not?: boolean;
+    dateType?: string;
+    query?: WhereClause[];
 }
 export interface OrderClause {
     column: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunnykit/orm",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "An Eloquent-inspired ORM for Bun's native SQL client supporting SQLite, MySQL, and PostgreSQL.",
   "license": "MIT",
   "packageManager": "bun@1.3.12",