@bunnykit/orm 0.1.21 → 0.1.22

package/dist/src/connection/Connection.js

@@ -111,6 +111,9 @@ export class Connection {
         if (this.driverName !== "postgres") {
             return await this.transaction(callback);
         }
+        if (!/^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(setting)) {
+            throw new Error(`Invalid PostgreSQL setting name: ${setting}`);
+        }
         return await this.transaction(async (connection) => {
             await connection.run(`SET LOCAL ${setting} = ${connection.getGrammar().placeholder(1)}`, [tenantId]);
             return await callback(connection);

package/dist/src/query/Builder.d.ts

@@ -134,7 +134,7 @@ export declare class Builder<T = Record<string, any>> {
     private addBinding;
     private compileWhereClause;
     private compileWheres;
-    private compileNestedWheres;
+    private compileWhereClauses;
     private compileOrders;
     private compileGroups;
     private compileHavings;
@@ -161,6 +161,8 @@ export declare class Builder<T = Record<string, any>> {
     chunk(count: number, callback: (items: T[]) => void | Promise<void>): Promise<void>;
     each(count: number, callback: (item: T) => void | Promise<void>): Promise<void>;
     cursor(chunkSize?: number): AsyncGenerator<T>;
+    private getResultAccessColumn;
+    private compileCursorWheres;
     lazy(count?: number): AsyncGenerator<T>;
     insert(data: ModelAttributeInput<T> | ModelAttributeInput<T>[]): Promise<any>;
     insertGetId(data: ModelAttributeInput<T>, idColumn?: ModelColumn<T>): Promise<any>;

package/dist/src/query/Builder.js

@@ -65,8 +65,7 @@ export class Builder {
         const nested = new Builder(this.connection, this.tableName);
         callback(nested);
         if (nested.wheres.length > 0) {
-            const sql = this.compileNestedWheres(nested);
-            this.wheres.push({ type: "raw", column: `(${sql})`, boolean, scope: undefined });
+            this.wheres.push({ type: "nested", column: "", query: nested.wheres, boolean, scope: undefined });
         }
         return this;
     }
@@ -484,6 +483,10 @@ export class Builder {
         else if (where.type === "raw") {
             return `${prefix} ${where.column}`;
         }
+        else if (where.type === "nested") {
+            const sql = this.compileWhereClauses(where.query || [], "");
+            return `${prefix} (${sql})`;
+        }
         else if (where.type === "like") {
             const sql = this.grammar.compileLike(this.grammar.wrap(where.column), where.value, !!where.not, this.parameterize ? (v) => this.addBinding(v) : undefined);
             return `${prefix} ${sql}`;
@@ -540,20 +543,15 @@ export class Builder {
         return "";
     }
     compileWheres() {
-        if (this.wheres.length === 0)
-            return "";
-        const clauses = this.wheres.map((where, index) => {
-            const prefix = index === 0 ? "WHERE" : where.boolean.toUpperCase();
-            return this.compileWhereClause(where, prefix);
-        });
-        return clauses.join(" ");
+        return this.compileWhereClauses(this.wheres, "WHERE");
     }
-    compileNestedWheres(builder) {
-        if (builder.wheres.length === 0)
+    compileWhereClauses(wheres, firstPrefix) {
+        if (wheres.length === 0)
             return "";
-        const clauses = builder.wheres.map((where, index) => {
-            const prefix = index === 0 ? "" : where.boolean.toUpperCase();
-            return this.compileWhereClause(where, prefix);
+        const clauses = wheres.map((where, index) => {
+            const prefix = index === 0 ? "WHERE" : where.boolean.toUpperCase();
+            const adjustedPrefix = index === 0 ? firstPrefix : prefix;
+            return this.compileWhereClause(where, adjustedPrefix);
         });
         return clauses.join(" ").trim();
     }
@@ -781,9 +779,7 @@ export class Builder {
         }
         const orderColumn = this.orders[0]?.column || primaryKey;
         const orderDirection = this.orders[0]?.direction || "asc";
-        // Use unqualified column name for property access on model instances
-        const accessColumn = orderColumn.includes(".") ? orderColumn.split(".")[1] : orderColumn;
-        let lastValue = undefined;
+        let lastValues = undefined;
         while (true) {
             const builder = this.clone();
             // Preserve multi-column ORDER BY, appending PK tie-breaker if not present
@@ -794,23 +790,15 @@ export class Builder {
             }
             builder.offsetValue = undefined;
             builder.limitValue = chunkSize;
-            if (lastValue !== undefined) {
-                const op = orderDirection === "asc" ? ">" : "<";
+            if (lastValues !== undefined) {
                 // Parenthesize existing wheres when appending cursor condition to preserve OR precedence
                 if (builder.wheres.length > 0) {
                     const hasOr = builder.wheres.some((w) => w.boolean === "or");
                     if (hasOr) {
-                        builder.wheres = [{ type: "raw", column: `(${builder.compileWheres().replace(/^WHERE /, "")})`, boolean: "and", scope: undefined }];
+                        builder.wheres = [{ type: "nested", column: "", query: builder.wheres, boolean: "and", scope: undefined }];
                     }
                 }
-                builder.wheres.push({
-                    type: "basic",
-                    column: orderColumn,
-                    operator: op,
-                    value: lastValue,
-                    boolean: "and",
-                    scope: undefined,
-                });
+                builder.wheres.push({ type: "nested", column: "", query: this.compileCursorWheres(builder.orders, lastValues), boolean: "and", scope: undefined });
             }
             const items = await builder.get();
             if (items.length === 0)
@@ -821,11 +809,46 @@ export class Builder {
             if (items.length < chunkSize)
                 break;
             const lastItem = items[items.length - 1];
-            lastValue = lastItem && typeof lastItem === "object"
-                ? lastItem[accessColumn]
+            lastValues = lastItem && typeof lastItem === "object"
+                ? builder.orders.map((order) => lastItem[this.getResultAccessColumn(order.column)])
                 : undefined;
         }
     }
+    getResultAccessColumn(column) {
+        return column.includes(".") ? column.split(".").at(-1) : column;
+    }
+    compileCursorWheres(orders, values, index = 0) {
+        const order = orders[index];
+        const op = order.direction === "asc" ? ">" : "<";
+        const clauses = [{
+                type: "basic",
+                column: order.column,
+                operator: op,
+                value: values[index],
+                boolean: "and",
+                scope: undefined,
+            }];
+        if (index < orders.length - 1) {
+            clauses.push({
+                type: "nested",
+                column: "",
+                query: [
+                    {
+                        type: "basic",
+                        column: order.column,
+                        operator: "=",
+                        value: values[index],
+                        boolean: "and",
+                        scope: undefined,
+                    },
+                    ...this.compileCursorWheres(orders, values, index + 1),
+                ],
+                boolean: "or",
+                scope: undefined,
+            });
+        }
+        return clauses;
+    }
     async *lazy(count = 1000) {
         let page = 1;
         while (true) {

package/dist/src/schema/Schema.js

@@ -135,48 +135,57 @@ export class Schema {
         const driver = connection.getDriverName();
         const schema = connection.getSchema() || "public";
         let sql;
+        let bindings = [];
         if (driver === "sqlite") {
-            sql = `SELECT name FROM sqlite_master WHERE type='table' AND name='${table}'`;
+            sql = "SELECT name FROM sqlite_master WHERE type='table' AND name = ?";
+            bindings = [table];
         }
         else if (driver === "mysql") {
-            sql = `SHOW TABLES LIKE '${table}'`;
+            sql = "SELECT table_name FROM information_schema.tables WHERE table_schema = DATABASE() AND table_name = ?";
+            bindings = [table];
         }
         else {
-            sql = `SELECT * FROM information_schema.tables WHERE table_schema = '${schema}' AND table_name = '${table}'`;
+            sql = "SELECT table_name FROM information_schema.tables WHERE table_schema = $1 AND table_name = $2";
+            bindings = [schema, table];
         }
-        const result = await connection.query(sql);
+        const result = await connection.query(sql, bindings);
         return result.length > 0;
     }
     static async hasColumn(table, column) {
         const connection = this.getConnection();
         const driver = connection.getDriverName();
         const schema = connection.getSchema() || "public";
+        const grammar = this.getGrammar();
         let sql;
+        let bindings = [];
         if (driver === "sqlite") {
-            sql = `PRAGMA table_info(${table})`;
+            sql = `PRAGMA table_info(${grammar.wrap(table)})`;
             const result = await connection.query(sql);
             return result.some((row) => row.name === column);
         }
         else if (driver === "mysql") {
-            sql = `SHOW COLUMNS FROM ${table} LIKE '${column}'`;
+            sql = "SELECT column_name FROM information_schema.columns WHERE table_schema = DATABASE() AND table_name = ? AND column_name = ?";
+            bindings = [table, column];
         }
         else {
-            sql = `SELECT column_name FROM information_schema.columns WHERE table_schema = '${schema}' AND table_name = '${table}' AND column_name = '${column}'`;
+            sql = "SELECT column_name FROM information_schema.columns WHERE table_schema = $1 AND table_name = $2 AND column_name = $3";
+            bindings = [schema, table, column];
         }
-        const result = await connection.query(sql);
+        const result = await connection.query(sql, bindings);
         return result.length > 0;
     }
     static async getColumn(table, column) {
         const connection = this.getConnection();
         const driver = connection.getDriverName();
         const schema = connection.getSchema() || "public";
+        const grammar = this.getGrammar();
         if (driver === "sqlite") {
-            const rows = await connection.query(`PRAGMA table_info(${table})`);
+            const rows = await connection.query(`PRAGMA table_info(${grammar.wrap(table)})`);
             const row = rows.find((item) => item.name === column);
             return row ? { name: row.name, type: row.type, primary: row.pk > 0, autoIncrement: false } : null;
         }
         if (driver === "mysql") {
-            const rows = await connection.query(`SHOW COLUMNS FROM ${table} LIKE '${column}'`);
+            const rows = await connection.query("SELECT column_name AS Field, column_type AS Type, column_key AS `Key`, extra AS Extra FROM information_schema.columns WHERE table_schema = DATABASE() AND table_name = ? AND column_name = ?", [table, column]);
             const row = rows[0];
             return row ? { name: row.Field, type: row.Type, primary: row.Key === "PRI", autoIncrement: String(row.Extra || "").toLowerCase().includes("auto_increment") } : null;
         }
@@ -189,9 +198,9 @@ export class Schema {
        LEFT JOIN information_schema.table_constraints tc
          ON kcu.table_schema = tc.table_schema
         AND kcu.constraint_name = tc.constraint_name
-       WHERE c.table_schema = '${schema}'
-         AND c.table_name = '${table}'
-         AND c.column_name = '${column}'`);
+       WHERE c.table_schema = $1
+         AND c.table_name = $2
+         AND c.column_name = $3`, [schema, table, column]);
         const row = rows[0];
         return row ? { name: row.column_name, type: row.data_type, primary: !!row.primary_key, autoIncrement: false } : null;
     }

package/dist/src/schema/grammars/Grammar.js

@@ -5,7 +5,7 @@ export class Grammar {
             return value.split(".").map((v) => this.wrap(v)).join(".");
         }
         const { prefix, suffix } = this.wrappers;
-        return `${prefix}${value}${suffix}`;
+        return `${prefix}${value.replaceAll(suffix, `${suffix}${suffix}`)}${suffix}`;
     }
     wrapArray(values) {
         return values.map((v) => this.wrap(v));

package/dist/src/types/index.d.ts

@@ -29,7 +29,7 @@ export interface ForeignKeyDefinition {
     onUpdate?: string;
 }
 export interface WhereClause {
-    type: "basic" | "in" | "null" | "raw" | "between" | "column" | "exists" | "like" | "regexp" | "fulltext" | "json_contains" | "json_length" | "date" | "all" | "any";
+    type: "basic" | "in" | "null" | "raw" | "nested" | "between" | "column" | "exists" | "like" | "regexp" | "fulltext" | "json_contains" | "json_length" | "date" | "all" | "any";
     column: string;
     columns?: string[];
     operator?: string;
@@ -38,6 +38,7 @@ export interface WhereClause {
     scope?: string;
     not?: boolean;
     dateType?: string;
+    query?: WhereClause[];
 }
 export interface OrderClause {
     column: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunnykit/orm",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "An Eloquent-inspired ORM for Bun's native SQL client supporting SQLite, MySQL, and PostgreSQL.",
   "license": "MIT",
   "packageManager": "bun@1.3.12",