@carbonorm/carbonnode 3.8.4 → 3.9.2

package/dist/index.cjs.js

@@ -61,6 +61,7 @@ var C6Constants = {
     INNER: 'INNER',
     INTERVAL: 'INTERVAL',
     JOIN: 'JOIN',
+    FROM: 'FROM',
     LEFT: 'LEFT',
     LEFT_OUTER: 'LEFT_OUTER',
     LESS_THAN: '<',
@@ -92,6 +93,8 @@ var C6Constants = {
     SECOND: 'SECOND',
     SECOND_MICROSECOND: 'SECOND_MICROSECOND',
     SELECT: 'SELECT',
+    SUBSELECT: 'SUBSELECT',
+    PARAM: 'PARAM',
     // MySQL Spatial Functions
     ST_AREA: 'ST_Area',
     ST_ASBINARY: 'ST_AsBinary',
@@ -1254,14 +1257,34 @@ var AggregateBuilder = /** @class */ (function (_super) {
         _this.selectAliases = new Set();
         return _this;
     }
-    AggregateBuilder.prototype.buildAggregateField = function (field) {
+    // Overridden in ConditionBuilder where alias tracking is available.
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    AggregateBuilder.prototype.assertValidIdentifier = function (_identifier, _context) {
+        // no-op placeholder for subclasses that do not implement alias validation
+    };
+    AggregateBuilder.prototype.buildAggregateField = function (field, params) {
         var _this = this;
+        var _a, _b;
         if (typeof field === 'string') {
+            this.assertValidIdentifier(field, 'SELECT field');
             return field;
         }
         if (!Array.isArray(field) || field.length === 0) {
             throw new Error('Invalid SELECT field entry');
         }
+        // If the array represents a tuple/literal list (e.g., [lng, lat]) rather than a
+        // function call like [FN, ...args], serialize the list as a comma-separated
+        // literal sequence so parent calls (like ORDER BY FN(<here>)) can embed it.
+        var isNumericString = function (s) { return /^-?\d+(?:\.\d+)?$/.test(String(s).trim()); };
+        if (typeof field[0] !== 'string' || isNumericString(field[0])) {
+            return field
+                .map(function (arg) {
+                if (Array.isArray(arg))
+                    return _this.buildAggregateField(arg, params);
+                return String(arg);
+            })
+                .join(', ');
+        }
         var fn = field[0], args = field.slice(1);
         var alias;
         if (args.length >= 2 && String(args[args.length - 2]).toUpperCase() === 'AS') {
@@ -1269,8 +1292,50 @@ var AggregateBuilder = /** @class */ (function (_super) {
             args.pop();
         }
         var F = String(fn).toUpperCase();
+        // Parameter placeholder helper: [C6C.PARAM, value]
+        if (F === C6C.PARAM) {
+            if (!params) {
+                throw new Error('PARAM requires parameter tracking.');
+            }
+            var value = args[0];
+            // Use empty column context; ORDER/SELECT literals have no column typing.
+            // @ts-ignore addParam is provided by ConditionBuilder in our hierarchy.
+            return this.addParam(params, '', value);
+        }
+        if (F === C6C.SUBSELECT) {
+            if (!params) {
+                throw new Error('Scalar subselects in SELECT require parameter tracking.');
+            }
+            var subRequest = args[0];
+            var subSql = (_b = (_a = this).buildScalarSubSelect) === null || _b === void 0 ? void 0 : _b.call(_a, subRequest, params);
+            if (!subSql) {
+                throw new Error('Failed to build scalar subselect.');
+            }
+            var expr_1 = subSql;
+            if (alias) {
+                this.selectAliases.add(alias);
+                expr_1 += " AS ".concat(alias);
+            }
+            this.config.verbose && console.log("[SELECT] ".concat(expr_1));
+            return expr_1;
+        }
+        var identifierPathRegex = /^[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]*$/;
         var argList = args
-            .map(function (arg) { return Array.isArray(arg) ? _this.buildAggregateField(arg) : arg; })
+            .map(function (arg) {
+            if (Array.isArray(arg))
+                return _this.buildAggregateField(arg, params);
+            if (typeof arg === 'string') {
+                if (identifierPathRegex.test(arg)) {
+                    _this.assertValidIdentifier(arg, 'SELECT expression');
+                    return arg;
+                }
+                // Treat numeric-looking strings as literals, not identifier paths
+                if (isNumericString(arg))
+                    return arg;
+                return arg;
+            }
+            return String(arg);
+        })
             .join(', ');
         var expr;
         if (F === 'DISTINCT') {
@@ -1289,11 +1354,91 @@ var AggregateBuilder = /** @class */ (function (_super) {
     return AggregateBuilder;
 }(Executor));
 
+// Alias a table name with a given alias
+var DERIVED_TABLE_PREFIX = '__c6DerivedTable__';
+var DERIVED_ID_SYMBOL = Symbol('c6DerivedTableId');
+var derivedTableLookup = new Map();
+var derivedTableReverseLookup = new WeakMap();
+var derivedTableCounter = 0;
+var isDerivedTableKey = function (key) {
+    return typeof key === 'string' && key.startsWith(DERIVED_TABLE_PREFIX);
+};
+var resolveDerivedTable = function (key) {
+    return derivedTableLookup.get(key);
+};
+var derivedTable = function (spec) {
+    if (!spec || typeof spec !== 'object') {
+        throw new Error('Derived table definition must be an object.');
+    }
+    var aliasRaw = spec[C6C.AS];
+    if (typeof aliasRaw !== 'string' || aliasRaw.trim() === '') {
+        throw new Error('Derived tables require a non-empty alias via C6C.AS.');
+    }
+    if (!spec[C6C.SUBSELECT] || typeof spec[C6C.SUBSELECT] !== 'object') {
+        throw new Error('Derived tables require a nested SELECT payload under C6C.SUBSELECT.');
+    }
+    var id = derivedTableReverseLookup.get(spec);
+    if (!id) {
+        id = "".concat(DERIVED_TABLE_PREFIX).concat(++derivedTableCounter);
+        derivedTableReverseLookup.set(spec, id);
+        derivedTableLookup.set(id, spec);
+        Object.defineProperty(spec, DERIVED_ID_SYMBOL, {
+            value: id,
+            configurable: false,
+            enumerable: false,
+            writable: false
+        });
+    }
+    var alias = aliasRaw.trim();
+    derivedTableLookup.set(id, spec);
+    Object.defineProperty(spec, 'toString', {
+        value: function () { return "".concat(id, " ").concat(alias); },
+        configurable: true,
+        enumerable: false,
+        writable: true
+    });
+    return spec;
+};
+var A = function (tableName, alias) {
+    return "".concat(tableName, " ").concat(alias);
+};
+// Qualify a column constant (e.g. 'property_units.parcel_id') to an alias
+var F = function (qualifiedCol, alias) {
+    return "".concat(alias, ".").concat(qualifiedCol.split('.').pop());
+};
+// Equal join condition using full-qualified column constants
+var fieldEq = function (leftCol, rightCol, leftAlias, rightAlias) {
+    var _a;
+    return (_a = {},
+        _a[F(leftCol, leftAlias)] = F(rightCol, rightAlias),
+        _a);
+};
+// ST_Distance_Sphere for aliased fields
+var distSphere = function (fromCol, toCol, fromAlias, toAlias) {
+    return [C6C.ST_DISTANCE_SPHERE, F(fromCol, fromAlias), F(toCol, toAlias)];
+};
+// Build a bounding-box expression.
+//
+// Arguments must be provided in `(minLng, minLat, maxLng, maxLat)` order. The
+// helper does not attempt to swap or validate coordinates; if a minimum value
+// is greater than its corresponding maximum value, MySQL's `ST_MakeEnvelope`
+// returns `NULL`.
+var bbox = function (minLng, minLat, maxLng, maxLat) {
+    return [C6C.ST_SRID, [C6C.ST_MAKEENVELOPE,
+            [C6C.ST_POINT, minLng, minLat],
+            [C6C.ST_POINT, maxLng, maxLat]], 4326];
+};
+// ST_Contains for map envelope/shape queries
+var stContains = function (envelope, shape) {
+    return [C6C.ST_CONTAINS, envelope, shape];
+};
+
 var ConditionBuilder = /** @class */ (function (_super) {
     tslib.__extends(ConditionBuilder, _super);
     function ConditionBuilder() {
         var _this = _super !== null && _super.apply(this, arguments) || this;
         _this.aliasMap = {};
+        _this.derivedAliases = new Set();
         _this.OPERATORS = new Set([
             C6C.EQUAL, C6C.NOT_EQUAL, C6C.LESS_THAN, C6C.LESS_THAN_OR_EQUAL_TO,
             C6C.GREATER_THAN, C6C.GREATER_THAN_OR_EQUAL_TO,
@@ -1318,21 +1463,43 @@ var ConditionBuilder = /** @class */ (function (_super) {
     ConditionBuilder.prototype.initAlias = function (baseTable, joins) {
         var _a;
         this.aliasMap = (_a = {}, _a[baseTable] = baseTable, _a);
+        this.derivedAliases = new Set();
         if (!joins)
             return;
         for (var joinType in joins) {
             for (var raw in joins[joinType]) {
-                var _b = raw.split(' '), table = _b[0], alias = _b[1];
-                this.aliasMap[alias || table] = table;
+                var _b = raw.trim().split(/\s+/, 2), table = _b[0], alias = _b[1];
+                if (!table)
+                    continue;
+                this.registerAlias(alias || table, table);
             }
         }
     };
+    ConditionBuilder.prototype.registerAlias = function (alias, table) {
+        this.aliasMap[alias] = table;
+        if (isDerivedTableKey(table)) {
+            this.derivedAliases.add(alias);
+        }
+    };
+    ConditionBuilder.prototype.assertValidIdentifier = function (identifier, context) {
+        if (typeof identifier !== 'string')
+            return;
+        if (!identifier.includes('.'))
+            return;
+        var alias = identifier.split('.', 2)[0];
+        if (!(alias in this.aliasMap)) {
+            throw new Error("Unknown table or alias '".concat(alias, "' referenced in ").concat(context, ": '").concat(identifier, "'."));
+        }
+    };
     ConditionBuilder.prototype.isColumnRef = function (ref) {
         var _a, _b;
         if (typeof ref !== 'string' || !ref.includes('.'))
             return false;
         var _c = ref.split('.', 2), prefix = _c[0], column = _c[1];
         var tableName = this.aliasMap[prefix] || prefix;
+        if (isDerivedTableKey(tableName) || this.derivedAliases.has(prefix)) {
+            return true;
+        }
         var table = (_b = (_a = this.config.C6) === null || _a === void 0 ? void 0 : _a.TABLES) === null || _b === void 0 ? void 0 : _b[tableName];
         if (!table)
             return false;
@@ -1361,6 +1528,9 @@ var ConditionBuilder = /** @class */ (function (_super) {
         }
         var _e = val.split('.'), prefix = _e[0], column = _e[1];
         var tableName = (_b = this.aliasMap[prefix]) !== null && _b !== void 0 ? _b : prefix;
+        if (isDerivedTableKey(tableName) || this.derivedAliases.has(prefix)) {
+            return true;
+        }
         var table = (_d = (_c = this.config.C6) === null || _c === void 0 ? void 0 : _c.TABLES) === null || _d === void 0 ? void 0 : _d[tableName];
         if (!table || !table.COLUMNS)
             return false;
@@ -1403,6 +1573,26 @@ var ConditionBuilder = /** @class */ (function (_super) {
             // Normalize common variants
             var valueNorm = (value === C6C.NULL) ? null : value;
             var displayOp = typeof op === 'string' ? op.replace('_', ' ') : op;
+            var extractSubSelect = function (input) {
+                if (Array.isArray(input) && input.length >= 2 && input[0] === C6C.SUBSELECT) {
+                    return input[1];
+                }
+                if (input && typeof input === 'object' && C6C.SUBSELECT in input) {
+                    return input[C6C.SUBSELECT];
+                }
+                return undefined;
+            };
+            var rightSubSelectPayload = extractSubSelect(valueNorm);
+            var buildSubSelect = function (payload) {
+                if (!payload)
+                    return undefined;
+                var builder = _this.buildScalarSubSelect;
+                if (typeof builder !== 'function') {
+                    throw new Error('Scalar subselect handling requires JoinBuilder context.');
+                }
+                return builder.call(_this, payload, params);
+            };
+            var rightSubSelectSql = buildSubSelect(rightSubSelectPayload);
             // Support function-based expressions like [C6C.ST_DISTANCE_SPHERE, col1, col2]
             if (typeof column === 'string' &&
                 _this.OPERATORS.has(column) &&
@@ -1429,7 +1619,7 @@ var ConditionBuilder = /** @class */ (function (_super) {
             var leftIsCol = _this.isColumnRef(column);
             var leftIsRef = _this.isTableReference(column);
             var rightIsCol = typeof value === 'string' && _this.isColumnRef(value);
-            if (!leftIsCol && !leftIsRef && !rightIsCol) {
+            if (!leftIsCol && !leftIsRef && !rightIsCol && !rightSubSelectSql) {
                 throw new Error("Potential SQL injection detected: '".concat(column, " ").concat(op, " ").concat(value, "'"));
             }
             _this.validateOperator(op);
@@ -1462,6 +1652,13 @@ var ConditionBuilder = /** @class */ (function (_super) {
                 return matchClause;
             }
             if ((op === C6C.IN || op === C6C.NOT_IN) && Array.isArray(value)) {
+                if (rightSubSelectSql) {
+                    if (!leftIsRef) {
+                        throw new Error("IN operator requires a table reference as the left operand. Column '".concat(column, "' is not a valid table reference."));
+                    }
+                    var normalized_1 = op.replace('_', ' ');
+                    return "( ".concat(column, " ").concat(normalized_1, " ").concat(rightSubSelectSql, " )");
+                }
                 var placeholders = value.map(function (v) {
                     return _this.isColumnRef(v) ? v : _this.addParam(params, column, v);
                 }).join(', ');
@@ -1481,10 +1678,13 @@ var ConditionBuilder = /** @class */ (function (_super) {
                 }
                 return "(".concat(column, ") ").concat(op.replace('_', ' '), " ").concat(_this.addParam(params, column, start), " AND ").concat(_this.addParam(params, column, end));
             }
-            var rightIsRef = _this.isTableReference(value);
+            var rightIsRef = rightSubSelectSql ? false : _this.isTableReference(value);
             if (leftIsRef && rightIsRef) {
                 return "(".concat(column, ") ").concat(displayOp, " ").concat(value);
             }
+            if (leftIsRef && rightSubSelectSql) {
+                return "(".concat(column, ") ").concat(displayOp, " ").concat(rightSubSelectSql);
+            }
             if (leftIsRef && !rightIsRef) {
                 return "(".concat(column, ") ").concat(displayOp, " ").concat(_this.addParam(params, column, valueNorm));
             }
@@ -1580,85 +1780,117 @@ var JoinBuilder = /** @class */ (function (_super) {
     function JoinBuilder() {
         return _super !== null && _super.apply(this, arguments) || this;
     }
+    JoinBuilder.prototype.createSelectBuilder = function (_request) {
+        throw new Error('Subclasses must implement createSelectBuilder to support derived table serialization.');
+    };
     JoinBuilder.prototype.buildJoinClauses = function (joinArgs, params) {
         var sql = '';
-        for (var joinType in joinArgs) {
+        var _loop_1 = function (joinType) {
             var joinKind = joinType.replace('_', ' ').toUpperCase();
-            for (var raw in joinArgs[joinType]) {
-                var _a = raw.split(' '), table = _a[0], alias = _a[1];
-                this.aliasMap[alias || table] = table;
-                var onClause = this.buildBooleanJoinedConditions(joinArgs[joinType][raw], true, params);
-                var joinSql = alias ? "`".concat(table, "` AS `").concat(alias, "`") : "`".concat(table, "`");
-                sql += " ".concat(joinKind, " JOIN ").concat(joinSql, " ON ").concat(onClause);
+            var entries = [];
+            var joinSection = joinArgs[joinType];
+            if (joinSection instanceof Map) {
+                joinSection.forEach(function (value, key) {
+                    entries.push([key, value]);
+                });
             }
+            else {
+                for (var raw in joinSection) {
+                    entries.push([raw, joinSection[raw]]);
+                }
+            }
+            for (var _i = 0, entries_1 = entries; _i < entries_1.length; _i++) {
+                var _a = entries_1[_i], rawKey = _a[0], conditions = _a[1];
+                var raw = typeof rawKey === 'string' ? rawKey : String(rawKey);
+                var _b = raw.trim().split(/\s+/, 2), table = _b[0], aliasCandidate = _b[1];
+                if (!table)
+                    continue;
+                if (isDerivedTableKey(table)) {
+                    var derived = resolveDerivedTable(table);
+                    if (!derived) {
+                        throw new Error("Derived table '".concat(table, "' was not registered. Wrap the object with derivedTable(...) before using it in JOIN."));
+                    }
+                    var configuredAliasRaw = derived[C6C.AS];
+                    var configuredAlias = typeof configuredAliasRaw === 'string' ? configuredAliasRaw.trim() : '';
+                    var alias = (aliasCandidate !== null && aliasCandidate !== void 0 ? aliasCandidate : configuredAlias).trim();
+                    if (!alias) {
+                        throw new Error('Derived tables require an alias via C6C.AS.');
+                    }
+                    this_1.registerAlias(alias, table);
+                    var subRequest = derived[C6C.SUBSELECT];
+                    if (!subRequest || typeof subRequest !== 'object') {
+                        throw new Error('Derived tables must include a C6C.SUBSELECT payload.');
+                    }
+                    var fromTable = subRequest[C6C.FROM];
+                    if (typeof fromTable !== 'string' || fromTable.trim() === '') {
+                        throw new Error('Derived table subselects require a base table defined with C6C.FROM.');
+                    }
+                    var subBuilder = this_1.createSelectBuilder(subRequest);
+                    var _c = subBuilder.build(fromTable, true), subSql = _c.sql, subParams = _c.params;
+                    var normalizedSql = this_1.integrateSubSelectParams(subSql, subParams, params);
+                    var formatted = normalizedSql.trim().split('\n').map(function (line) { return "  ".concat(line); }).join('\n');
+                    var joinSql = "(\n".concat(formatted, "\n) AS `").concat(alias, "`");
+                    var onClause = this_1.buildBooleanJoinedConditions(conditions, true, params);
+                    sql += " ".concat(joinKind, " JOIN ").concat(joinSql);
+                    if (onClause) {
+                        sql += " ON ".concat(onClause);
+                    }
+                }
+                else {
+                    var alias = aliasCandidate;
+                    if (alias) {
+                        this_1.registerAlias(alias, table);
+                    }
+                    var joinSql = alias ? "`".concat(table, "` AS `").concat(alias, "`") : "`".concat(table, "`");
+                    var onClause = this_1.buildBooleanJoinedConditions(conditions, true, params);
+                    sql += " ".concat(joinKind, " JOIN ").concat(joinSql);
+                    if (onClause) {
+                        sql += " ON ".concat(onClause);
+                    }
+                }
+            }
+        };
+        var this_1 = this;
+        for (var joinType in joinArgs) {
+            _loop_1(joinType);
         }
         this.config.verbose && console.log("[JOIN] ".concat(sql.trim()));
         return sql;
     };
-    return JoinBuilder;
-}(ConditionBuilder));
-
-var DeleteQueryBuilder = /** @class */ (function (_super) {
-    tslib.__extends(DeleteQueryBuilder, _super);
-    function DeleteQueryBuilder() {
-        return _super !== null && _super.apply(this, arguments) || this;
-    }
-    DeleteQueryBuilder.prototype.build = function (table) {
-        this.aliasMap = {};
-        var params = this.useNamedParams ? {} : [];
-        this.initAlias(table, this.request.JOIN);
-        var sql = "DELETE `".concat(table, "` FROM `").concat(table, "`");
-        if (this.request.JOIN) {
-            sql += this.buildJoinClauses(this.request.JOIN, params);
-        }
-        if (this.request.WHERE) {
-            sql += this.buildWhereClause(this.request.WHERE, params);
-        }
-        return { sql: sql, params: params };
-    };
-    return DeleteQueryBuilder;
-}(JoinBuilder));
-
-var PostQueryBuilder = /** @class */ (function (_super) {
-    tslib.__extends(PostQueryBuilder, _super);
-    function PostQueryBuilder() {
-        return _super !== null && _super.apply(this, arguments) || this;
-    }
-    PostQueryBuilder.prototype.trimTablePrefix = function (table, column) {
-        if (!column.includes('.'))
-            return column;
-        var _a = column.split('.', 2), prefix = _a[0], col = _a[1];
-        if (prefix !== table) {
-            throw new Error("Invalid prefixed column: '".concat(column, "'. Expected prefix '").concat(table, ".'"));
+    JoinBuilder.prototype.integrateSubSelectParams = function (subSql, subParams, target) {
+        var _a;
+        if (!subParams)
+            return subSql;
+        if (this.useNamedParams) {
+            var normalized = subSql;
+            var extras = subParams;
+            for (var _i = 0, _b = Object.keys(extras); _i < _b.length; _i++) {
+                var key = _b[_i];
+                var placeholder = this.addParam(target, '', extras[key]);
+                var original = ":".concat(key);
+                if (original !== placeholder) {
+                    normalized = normalized.split(original).join(placeholder);
+                }
+            }
+            return normalized;
         }
-        return col;
+        (_a = target).push.apply(_a, subParams);
+        return subSql;
     };
-    PostQueryBuilder.prototype.build = function (table) {
-        var _this = this;
-        this.aliasMap = {};
-        var verb = C6C.REPLACE in this.request ? C6C.REPLACE : C6C.INSERT;
-        var body = verb in this.request ? this.request[verb] : this.request;
-        var keys = Object.keys(body);
-        var params = [];
-        var placeholders = [];
-        for (var _i = 0, keys_1 = keys; _i < keys_1.length; _i++) {
-            var key = keys_1[_i];
-            var value = body[key];
-            var placeholder = this.addParam(params, key, value);
-            placeholders.push(placeholder);
+    JoinBuilder.prototype.buildScalarSubSelect = function (subRequest, params) {
+        if (!subRequest || typeof subRequest !== 'object') {
+            throw new Error('Scalar subselect requires a C6C.SUBSELECT object payload.');
         }
-        var sql = "".concat(verb, " INTO `").concat(table, "` (\n            ").concat(keys.map(function (k) { return "`".concat(_this.trimTablePrefix(table, k), "`"); }).join(', '), "\n         ) VALUES (\n            ").concat(placeholders.join(', '), "\n        )");
-        if (C6C.UPDATE in this.request) {
-            var updateData = this.request[C6C.UPDATE];
-            if (!Array.isArray(updateData)) {
-                throw new Error("Update data must be an array of keys to update, got: ".concat(JSON.stringify(updateData)));
-            }
-            var updateClause = updateData.map(function (k) { return "`".concat(k, "` = VALUES(`").concat(k, "`)"); }).join(', ');
-            sql += " ON DUPLICATE KEY UPDATE ".concat(updateClause);
+        var fromTable = subRequest[C6C.FROM];
+        if (typeof fromTable !== 'string' || fromTable.trim() === '') {
+            throw new Error('Scalar subselects require a base table specified with C6C.FROM.');
         }
-        return { sql: sql, params: params };
+        var subBuilder = this.createSelectBuilder(subRequest);
+        var _a = subBuilder.build(fromTable, true), subSql = _a.sql, subParams = _a.params;
+        var normalized = this.integrateSubSelectParams(subSql, subParams, params).trim();
+        return "(".concat(normalized, ")");
     };
-    return PostQueryBuilder;
+    return JoinBuilder;
 }(ConditionBuilder));
 
 var PaginationBuilder = /** @class */ (function (_super) {
@@ -1679,18 +1911,36 @@ var PaginationBuilder = /** @class */ (function (_super) {
      * }
      * ```
      */
-    PaginationBuilder.prototype.buildPaginationClause = function (pagination) {
+    PaginationBuilder.prototype.buildPaginationClause = function (pagination, params) {
         var _this = this;
         var sql = "";
         /* -------- ORDER BY -------- */
         if (pagination === null || pagination === void 0 ? void 0 : pagination[C6Constants.ORDER]) {
             var orderParts = [];
-            for (var _i = 0, _a = Object.entries(pagination[C6Constants.ORDER]); _i < _a.length; _i++) {
-                var _b = _a[_i], key = _b[0], val = _b[1];
+            var _loop_1 = function (key, val) {
+                if (typeof key === 'string' && key.includes('.')) {
+                    this_1.assertValidIdentifier(key, 'ORDER BY');
+                }
                 // FUNCTION CALL: val is an array of args
                 if (Array.isArray(val)) {
+                    var identifierPathRegex_1 = /^[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]*$/;
+                    var isNumericString_1 = function (s) { return /^-?\d+(?:\.\d+)?$/.test(s.trim()); };
                     var args = val
-                        .map(function (arg) { return Array.isArray(arg) ? _this.buildAggregateField(arg) : String(arg); })
+                        .map(function (arg) {
+                        if (Array.isArray(arg))
+                            return _this.buildAggregateField(arg, params);
+                        if (typeof arg === 'string') {
+                            if (identifierPathRegex_1.test(arg)) {
+                                _this.assertValidIdentifier(arg, 'ORDER BY argument');
+                                return arg;
+                            }
+                            // numeric-looking strings should be treated as literals
+                            if (isNumericString_1(arg))
+                                return arg;
+                            return arg;
+                        }
+                        return String(arg);
+                    })
                         .join(", ");
                     orderParts.push("".concat(key, "(").concat(args, ")"));
                 }
@@ -1698,6 +1948,11 @@ var PaginationBuilder = /** @class */ (function (_super) {
                 else {
                     orderParts.push("".concat(key, " ").concat(String(val).toUpperCase()));
                 }
+            };
+            var this_1 = this;
+            for (var _i = 0, _a = Object.entries(pagination[C6Constants.ORDER]); _i < _a.length; _i++) {
+                var _b = _a[_i], key = _b[0], val = _b[1];
+                _loop_1(key, val);
             }
             if (orderParts.length)
                 sql += " ORDER BY ".concat(orderParts.join(", "));
@@ -1727,6 +1982,9 @@ var SelectQueryBuilder = /** @class */ (function (_super) {
     function SelectQueryBuilder() {
         return _super !== null && _super.apply(this, arguments) || this;
     }
+    SelectQueryBuilder.prototype.createSelectBuilder = function (request) {
+        return new SelectQueryBuilder(this.config, request, this.useNamedParams);
+    };
     SelectQueryBuilder.prototype.build = function (table, isSubSelect) {
         var _this = this;
         var _a;
@@ -1741,7 +1999,7 @@ var SelectQueryBuilder = /** @class */ (function (_super) {
         var params = this.useNamedParams ? {} : [];
         var selectList = (_a = args.SELECT) !== null && _a !== void 0 ? _a : ['*'];
         var selectFields = selectList
-            .map(function (f) { return _this.buildAggregateField(f); })
+            .map(function (f) { return _this.buildAggregateField(f, params); })
             .join(', ');
         var sql = "SELECT ".concat(selectFields, " FROM `").concat(table, "`");
         if (args.JOIN) {
@@ -1760,7 +2018,7 @@ var SelectQueryBuilder = /** @class */ (function (_super) {
             sql += " HAVING ".concat(this.buildBooleanJoinedConditions(args.HAVING, true, params));
         }
         if (args.PAGINATION) {
-            sql += this.buildPaginationClause(args.PAGINATION);
+            sql += this.buildPaginationClause(args.PAGINATION, params);
         }
         else if (!isSubSelect) {
             sql += " LIMIT 100";
@@ -1771,11 +2029,80 @@ var SelectQueryBuilder = /** @class */ (function (_super) {
     return SelectQueryBuilder;
 }(PaginationBuilder));
 
+var DeleteQueryBuilder = /** @class */ (function (_super) {
+    tslib.__extends(DeleteQueryBuilder, _super);
+    function DeleteQueryBuilder() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    DeleteQueryBuilder.prototype.createSelectBuilder = function (request) {
+        return new SelectQueryBuilder(this.config, request, this.useNamedParams);
+    };
+    DeleteQueryBuilder.prototype.build = function (table) {
+        this.aliasMap = {};
+        var params = this.useNamedParams ? {} : [];
+        this.initAlias(table, this.request.JOIN);
+        var sql = "DELETE `".concat(table, "` FROM `").concat(table, "`");
+        if (this.request.JOIN) {
+            sql += this.buildJoinClauses(this.request.JOIN, params);
+        }
+        if (this.request.WHERE) {
+            sql += this.buildWhereClause(this.request.WHERE, params);
+        }
+        return { sql: sql, params: params };
+    };
+    return DeleteQueryBuilder;
+}(JoinBuilder));
+
+var PostQueryBuilder = /** @class */ (function (_super) {
+    tslib.__extends(PostQueryBuilder, _super);
+    function PostQueryBuilder() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    PostQueryBuilder.prototype.trimTablePrefix = function (table, column) {
+        if (!column.includes('.'))
+            return column;
+        var _a = column.split('.', 2), prefix = _a[0], col = _a[1];
+        if (prefix !== table) {
+            throw new Error("Invalid prefixed column: '".concat(column, "'. Expected prefix '").concat(table, ".'"));
+        }
+        return col;
+    };
+    PostQueryBuilder.prototype.build = function (table) {
+        var _this = this;
+        this.aliasMap = {};
+        var verb = C6C.REPLACE in this.request ? C6C.REPLACE : C6C.INSERT;
+        var body = verb in this.request ? this.request[verb] : this.request;
+        var keys = Object.keys(body);
+        var params = [];
+        var placeholders = [];
+        for (var _i = 0, keys_1 = keys; _i < keys_1.length; _i++) {
+            var key = keys_1[_i];
+            var value = body[key];
+            var placeholder = this.addParam(params, key, value);
+            placeholders.push(placeholder);
+        }
+        var sql = "".concat(verb, " INTO `").concat(table, "` (\n            ").concat(keys.map(function (k) { return "`".concat(_this.trimTablePrefix(table, k), "`"); }).join(', '), "\n         ) VALUES (\n            ").concat(placeholders.join(', '), "\n        )");
+        if (C6C.UPDATE in this.request) {
+            var updateData = this.request[C6C.UPDATE];
+            if (!Array.isArray(updateData)) {
+                throw new Error("Update data must be an array of keys to update, got: ".concat(JSON.stringify(updateData)));
+            }
+            var updateClause = updateData.map(function (k) { return "`".concat(k, "` = VALUES(`").concat(k, "`)"); }).join(', ');
+            sql += " ON DUPLICATE KEY UPDATE ".concat(updateClause);
+        }
+        return { sql: sql, params: params };
+    };
+    return PostQueryBuilder;
+}(ConditionBuilder));
+
 var UpdateQueryBuilder = /** @class */ (function (_super) {
     tslib.__extends(UpdateQueryBuilder, _super);
     function UpdateQueryBuilder() {
         return _super !== null && _super.apply(this, arguments) || this;
     }
+    UpdateQueryBuilder.prototype.createSelectBuilder = function (request) {
+        return new SelectQueryBuilder(this.config, request, this.useNamedParams);
+    };
     UpdateQueryBuilder.prototype.trimTablePrefix = function (table, column) {
         if (!column.includes('.'))
             return column;
@@ -1810,7 +2137,7 @@ var UpdateQueryBuilder = /** @class */ (function (_super) {
             sql += this.buildWhereClause(args.WHERE, params);
         }
         if (args.PAGINATION) {
-            sql += this.buildPaginationClause(args.PAGINATION);
+            sql += this.buildPaginationClause(args.PAGINATION, params);
         }
         return { sql: sql, params: params };
     };
@@ -2206,41 +2533,6 @@ function ExpressHandler(_a) {
     }); };
 }
 
-// Alias a table name with a given alias
-var A = function (tableName, alias) {
-    return "".concat(tableName, " ").concat(alias);
-};
-// Qualify a column constant (e.g. 'property_units.parcel_id') to an alias
-var F = function (qualifiedCol, alias) {
-    return "".concat(alias, ".").concat(qualifiedCol.split('.').pop());
-};
-// Equal join condition using full-qualified column constants
-var fieldEq = function (leftCol, rightCol, leftAlias, rightAlias) {
-    var _a;
-    return (_a = {},
-        _a[F(leftCol, leftAlias)] = F(rightCol, rightAlias),
-        _a);
-};
-// ST_Distance_Sphere for aliased fields
-var distSphere = function (fromCol, toCol, fromAlias, toAlias) {
-    return [C6C.ST_DISTANCE_SPHERE, F(fromCol, fromAlias), F(toCol, toAlias)];
-};
-// Build a bounding-box expression.
-//
-// Arguments must be provided in `(minLng, minLat, maxLng, maxLat)` order. The
-// helper does not attempt to swap or validate coordinates; if a minimum value
-// is greater than its corresponding maximum value, MySQL's `ST_MakeEnvelope`
-// returns `NULL`.
-var bbox = function (minLng, minLat, maxLng, maxLat) {
-    return [C6C.ST_SRID, [C6C.ST_MAKEENVELOPE,
-            [C6C.ST_POINT, minLng, minLat],
-            [C6C.ST_POINT, maxLng, maxLat]], 4326];
-};
-// ST_Contains for map envelope/shape queries
-var stContains = function (envelope, shape) {
-    return [C6C.ST_CONTAINS, envelope, shape];
-};
-
 function determineRuntimeJsType(mysqlType) {
     var base = mysqlType.toLowerCase().split('(')[0];
     if ([
@@ -2369,6 +2661,7 @@ exports.checkCache = checkCache;
 exports.clearCache = clearCache;
 exports.convertForRequestBody = convertForRequestBody;
 exports.convertHexIfBinary = convertHexIfBinary;
+exports.derivedTable = derivedTable;
 exports.determineRuntimeJsType = determineRuntimeJsType;
 exports.distSphere = distSphere;
 exports.error = error;
@@ -2377,6 +2670,7 @@ exports.getEnvVar = getEnvVar;
 exports.getPrimaryKeyTypes = getPrimaryKeyTypes;
 exports.group = group;
 exports.info = info;
+exports.isDerivedTableKey = isDerivedTableKey;
 exports.isLocal = isLocal;
 exports.isNode = isNode;
 exports.isTest = isTest;
@@ -2386,6 +2680,7 @@ exports.onError = onError;
 exports.onSuccess = onSuccess;
 exports.removeInvalidKeys = removeInvalidKeys;
 exports.removePrefixIfExists = removePrefixIfExists;
+exports.resolveDerivedTable = resolveDerivedTable;
 exports.restOrm = restOrm;
 exports.restRequest = restRequest;
 exports.sortAndSerializeQueryObject = sortAndSerializeQueryObject;