@dbsp/core 1.0.1 → 1.0.3

package/dist/index.d.ts

@@ -2213,7 +2213,10 @@ declare class WindowBuilder {
      */
     as(alias: string): ExpressionSpec;
     /**
-     * Convert builder state to WindowIntent
+     * Convert builder state to WindowIntent — produces the correct discriminated branch.
+     * - ranking → RankingWindowIntent (no field)
+     * - aggregate → AggregateWindowIntent (field required; COUNT uses '*' when omitted)
+     * - offset → OffsetWindowIntent (field required)
      */
     private toWindowIntent;
 }
@@ -4872,6 +4875,12 @@ declare class UpsertBuilder<T = void> extends MutationBuilderBase<T, UpsertInten
  * const users = await orm.nql<{ name: string; email: string }>`users | select name, email`.all();
  * ```
  *
+ * Each `${value}` interpolation is escaped into a safe NQL literal (string/number/boolean/null).
+ * Untrusted string input cannot inject NQL structure because it is always quoted and
+ * single-quotes inside are doubled (`''`). For dynamic structural fragments (table names,
+ * column names, ORDER BY direction) use the builder API (`orm.select()`). See #134 for
+ * upcoming `:param` binding and a `nqlRaw()` escape hatch.
+ *
  * @module nql
  * @since DX-040
  */
@@ -4905,6 +4914,13 @@ type NqlTag = <T>(strings: TemplateStringsArray, ...values: unknown[]) => NqlBui
 /**
  * Create an NQL template tag function.
  *
+ * Each `${value}` in the template is escaped into a safe NQL literal before parsing.
+ * Supported interpolation types: `string`, `number`, `boolean`, `null`.
+ * Untrusted string input is therefore safe from NQL-syntax injection — it is always
+ * wrapped in single-quotes with embedded quotes doubled (`''`).
+ * For dynamic structural fragments (table names, column names, ORDER BY direction)
+ * use the builder API (`orm.select()`). See issue #134 for upcoming `:param` binding.
+ *
  * @param schemaDefinition - Schema definition for validation
  * @param model - ModelIR for plan execution
  * @param adapter - Optional adapter for query execution
@@ -6957,7 +6973,7 @@ interface FeatureUsage {
     readonly detail: string;
 }
 /**
- * Default feature checkers -- mirrors the 15 supportsDDL* flags that
+ * Default feature checkers -- mirrors the 16 supportsDDL* flags that
  * negotiateFeatures() previously checked inline.
  *
  * Each checker preserves exactly the same detection logic (same guards,
@@ -7401,6 +7417,14 @@ declare function getLogger(): Logger;
  */
 declare function resetLogger(): void;
 
+/** Error thrown when behavior = 'error' and unsupported feature detected */
+declare class UnsupportedFeatureError extends Error {
+    readonly feature: string;
+    readonly adapter: string;
+    readonly element: string;
+    constructor(feature: string, adapter: string, element: string);
+}
+
 interface NegotiationResult {
     readonly warnings: readonly FeatureWarning[];
 }
@@ -8120,4 +8144,4 @@ declare const assertIntentHasOrderBy: (result: AssertionQueryResult, expected: b
  */
 declare function runAssertions(blocks: AssertionBlock[], results: AssertionQueryResult[], queries: string[], hasDb?: boolean): AssertionSummary;
 
-export { ASSERTION_TYPES, AdapterRequiredError, type AdjacencyOptions, type AfterMutationHook, type AfterQueryHook, type AggregateOptions, type AliasedColumn, type AliasedExprColumn, type AllColumns, AmbiguousPlanError, AmbiguousRelationError, type Assertion, type AssertionBlock, type AssertionOutcome, type AssertionQueryResult, type AssertionSummary, type AssertionType, BRAND, type BatchValuesOptions, type BatchValuesRef, type BeforeMutationHook, type BeforeQueryHook, type BrandKey, COLUMN_META, type CardinalityShorthand, CaseBuilder, type CaseValue, type ColumnDef, type ColumnMetaKey, ColumnNotFoundError, type ColumnRef, type ColumnSpec, type ColumnTypeToTS, CteBuilder, type CteDump, CteQueryBuilder, type CursorPaginateOptions, type CursorPaginatedResult, DEFAULT_CONVENTIONS, DEFAULT_FEATURE_CHECKERS, DUCKDB_CAPABILITIES, type DefaultFilters, type DefineModelOptions, DeleteBuilder, type DistinctField, type DumpMetaInput, type EdgeTableOptions, ErrorCode, type ErrorHookContext, Errors, ExecutionError, type ExprInput, ExpressionRef, type ExpressionSpec, type FeatureChecker, type FeatureUsage, type FilterOperators, type FilterValue, type FullTextSearchField, type FullTextSearchOptions, type GeneratedBelongsTo, type GeneratedColumn, type GeneratedColumnType, type GeneratedConventions, type GeneratedHasMany, type GeneratedHint, type GeneratedManyToMany, type GeneratedRelation, type GeneratedRelationKind, type GeneratedSchema, type GeneratedTable, type GetSchemaFromDbOptions, type HierarchyOptions, type HookErrorHandler, type HookManager, type HookPriority, type HydrateOptions, IRREGULAR_PLURALS, type IncludeOptions, type IncludeOptionsWithRecursive, type InferColumn, type InferColumnType, type InferColumnTypes, type InferDB, type InferDBFromSchema, type InferRefColumn, type InferRow, type InferRowType, type InferSchemaDB, type InferTableRow, type InferTables, type InferredRangeValue, InsertBuilder, IntentBuilder, type IntentBuilderState, type IntentSummary, InvalidOperationError, InvalidRelationDefinitionError, type JoinOptions, type JsonValue, type LightweightRelationsDef, type ListHierarchyOptions, type ListIndexOptions, type Logger, MSSQL_CAPABILITIES, MYSQL_CAPABILITIES, ModelIRImpl, type MutationDump, type MutationHookContext, type MutationOperation, NamingConventionMismatchError, type NegotiationResult, type NestedInclude, type SchemaColumnType$1 as NewSchemaColumnType, NotFoundError, type NqlBuilder, type NqlTag, type OnErrorHook, type OrderByInput, type OrderByRecord, type OrderBySpec, type OrmInstance, type OrmOf, type OrmOptions, type OrmOptionsWithAdapter, type OrmOptionsWithModel, type OrmOptionsWithSchema, POSTGRESQL_CAPABILITIES, type PaginateOptions, type PaginatedResult, type ParseError, type ParseResult, type ParsedRelationDef, type ParsedRelationKey, type PathOptions, type PrioritizedHook, type QueryAssertionResult, type QueryBuilder, type QueryHookContext, type QueryResultType, RELATION_META, type RangeType, RawCteQueryBuilder, type RecursiveDump, type RecursiveIncludeConfig, type RecursiveOptions, RecursiveShapeMismatchError, type RefDefinition, type RefOptions, type RelationHints, type RelationKey, type RelationMetaKey, RelationNotFoundError, type RelationObjectDef, type RelationRef, type RelationShorthand, type RelationTupleDef, type ResolvedSchema, ResolvedSchemaValidation, ResultHydrator, SQLITE_CAPABILITIES, SQL_RAW_MARKER, type Schema, type SchemaBelongsToRelation, type SchemaCardinality, type SchemaColumnDefinition, type SchemaColumnType, type SchemaConfigInput, type SchemaConstraints, type SchemaConventionsDefinition, type SchemaConversionResult, type SchemaDefinition, type SchemaDefinitionInput, SchemaValidationError$1 as SchemaError, type SchemaExtras, type SchemaFilterStrategy, type SchemaForeignKeyReference, type SchemaHasManyRelation, type SchemaHintDefinition, type SchemaHintsDefinition, type SchemaIndexDefinition, type SchemaIndexOptions, type SchemaIndexesDefinition, type SchemaManyToManyRelation, type SchemaOnDeleteAction, type SchemaOptions, type SchemaRelationDefinition, type SchemaRelationKind, type SchemaRelationsDefinition, type SchemaTableDefinition, type SchemaTableOptions, type SchemaTablesDefinition, SchemaValidationError, type SelectField, type SelfRefRoles, type SetOperationBuilder, type SimplifiedOrmOptions, type SqlRawExpression, type StreamOptions, SubqueryBuilder, SubqueryExpression, TABLE_META, type TableAssertionData, type TableDDL, type TableDef, type TableIndexes, type TableMetaKey, TableNotFoundError, type TableRef, type TraversalDirection, UnhandledTypeInDialect, UnknownDialectError, UnsafeOperationError, UnsupportedCapabilityError, UnsupportedStrategyError, UpdateBuilder, UpsertBuilder, type ValidatedResolvedSchema, type WhereFilter, WindowBuilder, aggOrderBy, and, any, array, arrayAgg, assertCapability, assertContains, assertDbColumnExists, assertDbOutput, assertDbRowsEquals, assertDbRowsMax, assertDbRowsMin, assertDbValueEquals, assertEquals, assertIntentHasGroupBy, assertIntentHasOrderBy, assertIntentHasWhere, assertIntentTable, assertIntentType, assertIntentWith, assertMatches, assertParamsEquals, assertParamsLength, assertParamsType, assertParamsValue, assertResolvedSchemaToGeneratedSchema, assertSQLColumn, assertSQLEquals, assertSQLJoin, assertSQLTable, assertSuccess, assertTypeSupported, batchValues, buildModelFromResolvedSchema, buildModelFromSchema, capitalize, caseWhen, cast, coalesce, col, composeAfterMutationHooks, composeAfterQueryHooks, composeBeforeMutationHooks, composeBeforeQueryHooks, composeOnErrorHooks, createDialectCapabilities, createHookManager, createNqlTag, createOrm, createPseudoColumnMetadata, createRawCteBuilder, createRecursiveMetadata, decapitalize, defaultLogger, defineModel, defineSchema, denseRank, detectForeignKeys, detectManyToMany, distinct, eq, every, exists, ref as exprRef, extendDialect, extractPseudoColumnKeywords, findClosestMatch, fn, fullTextSearch, getAvailableDialects, getDialectCapabilities, getLogger, getRelationKind, getSchemaFromDb, gt, gte, inArray, inSubquery, inferForeignKey, inferRelationsFromSchema, isAliasedColumn, isAllColumns, isBatchValuesRef, isBelongsTo, isCardinalityShorthand, isColumnRef, isDistinctField, isDistinctFrom, isExpressionSpec, isGeneratedSchema, isHasMany, isKnownDialect, isManyToMany, isNotNull, isNull, isOverallSuccess, isRecursiveIncludeOptions, isRecursiveRelation, isRef, isRelationObjectDef, isRelationRef, isRelationTupleDef, isResolvedSchema, isSelfReferential, isSqlRaw, isSubqueryExpression, isTableRef, isWhereIntent, lag, lead, like, literal, lt, lte, namedArg, negotiateFeatures, neq, none, normalizeSQL, normalizeSchema, not, notExists, objectToWhereIntent, op, or, outerRef, param, parseAssertionFile, parseRelationDef, parseRelationKey, pipeAfterMutationHooks, pipeAfterQueryHooks, pipeBeforeMutationHooks, pipeBeforeQueryHooks, pipeOnErrorHooks, plan, planRecursive, pluralize, rangeContainedBy, rangeContains, rangeOverlaps, rank, raw, rawExists, rawNotExists, ref$1 as ref, registerDialect, relationColumn, requiresDatabase, resetLogger, resolveQueryIndex, resolvedSchemaToGeneratedSchema, rowNumber, runAssertions, schema, schemaToModelIR, setLogger, silentLogger, singularize, some, sortByPriority, sql, star, stringAgg, subquery, supportsDDLGeneration, supportsExecution, supportsIntrospection, supportsRawSql, supportsStreaming, supportsTransactions, textScore, unary, validateAssertionBlocks, validateRecursiveInclude, validateRecursiveShape, wAvg, wCount, wMax, wMin, wSum, withPriority };
+export { ASSERTION_TYPES, AdapterRequiredError, type AdjacencyOptions, type AfterMutationHook, type AfterQueryHook, type AggregateOptions, type AliasedColumn, type AliasedExprColumn, type AllColumns, AmbiguousPlanError, AmbiguousRelationError, type Assertion, type AssertionBlock, type AssertionOutcome, type AssertionQueryResult, type AssertionSummary, type AssertionType, BRAND, type BatchValuesOptions, type BatchValuesRef, type BeforeMutationHook, type BeforeQueryHook, type BrandKey, COLUMN_META, type CardinalityShorthand, CaseBuilder, type CaseValue, type ColumnDef, type ColumnMetaKey, ColumnNotFoundError, type ColumnRef, type ColumnSpec, type ColumnTypeToTS, CteBuilder, type CteDump, CteQueryBuilder, type CursorPaginateOptions, type CursorPaginatedResult, DEFAULT_CONVENTIONS, DEFAULT_FEATURE_CHECKERS, DUCKDB_CAPABILITIES, type DefaultFilters, type DefineModelOptions, DeleteBuilder, type DistinctField, type DumpMetaInput, type EdgeTableOptions, ErrorCode, type ErrorHookContext, Errors, ExecutionError, type ExprInput, ExpressionRef, type ExpressionSpec, type FeatureChecker, type FeatureUsage, type FilterOperators, type FilterValue, type FullTextSearchField, type FullTextSearchOptions, type GeneratedBelongsTo, type GeneratedColumn, type GeneratedColumnType, type GeneratedConventions, type GeneratedHasMany, type GeneratedHint, type GeneratedManyToMany, type GeneratedRelation, type GeneratedRelationKind, type GeneratedSchema, type GeneratedTable, type GetSchemaFromDbOptions, type HierarchyOptions, type HookErrorHandler, type HookManager, type HookPriority, type HydrateOptions, IRREGULAR_PLURALS, type IncludeOptions, type IncludeOptionsWithRecursive, type InferColumn, type InferColumnType, type InferColumnTypes, type InferDB, type InferDBFromSchema, type InferRefColumn, type InferRow, type InferRowType, type InferSchemaDB, type InferTableRow, type InferTables, type InferredRangeValue, InsertBuilder, IntentBuilder, type IntentBuilderState, type IntentSummary, InvalidOperationError, InvalidRelationDefinitionError, type JoinOptions, type JsonValue, type LightweightRelationsDef, type ListHierarchyOptions, type ListIndexOptions, type Logger, MSSQL_CAPABILITIES, MYSQL_CAPABILITIES, ModelIRImpl, type MutationDump, type MutationHookContext, type MutationOperation, NamingConventionMismatchError, type NegotiationResult, type NestedInclude, type SchemaColumnType$1 as NewSchemaColumnType, NotFoundError, type NqlBuilder, type NqlTag, type OnErrorHook, type OrderByInput, type OrderByRecord, type OrderBySpec, type OrmInstance, type OrmOf, type OrmOptions, type OrmOptionsWithAdapter, type OrmOptionsWithModel, type OrmOptionsWithSchema, POSTGRESQL_CAPABILITIES, type PaginateOptions, type PaginatedResult, type ParseError, type ParseResult, type ParsedRelationDef, type ParsedRelationKey, type PathOptions, type PrioritizedHook, type QueryAssertionResult, type QueryBuilder, type QueryHookContext, type QueryResultType, RELATION_META, type RangeType, RawCteQueryBuilder, type RecursiveDump, type RecursiveIncludeConfig, type RecursiveOptions, RecursiveShapeMismatchError, type RefDefinition, type RefOptions, type RelationHints, type RelationKey, type RelationMetaKey, RelationNotFoundError, type RelationObjectDef, type RelationRef, type RelationShorthand, type RelationTupleDef, type ResolvedSchema, ResolvedSchemaValidation, ResultHydrator, SQLITE_CAPABILITIES, SQL_RAW_MARKER, type Schema, type SchemaBelongsToRelation, type SchemaCardinality, type SchemaColumnDefinition, type SchemaColumnType, type SchemaConfigInput, type SchemaConstraints, type SchemaConventionsDefinition, type SchemaConversionResult, type SchemaDefinition, type SchemaDefinitionInput, SchemaValidationError$1 as SchemaError, type SchemaExtras, type SchemaFilterStrategy, type SchemaForeignKeyReference, type SchemaHasManyRelation, type SchemaHintDefinition, type SchemaHintsDefinition, type SchemaIndexDefinition, type SchemaIndexOptions, type SchemaIndexesDefinition, type SchemaManyToManyRelation, type SchemaOnDeleteAction, type SchemaOptions, type SchemaRelationDefinition, type SchemaRelationKind, type SchemaRelationsDefinition, type SchemaTableDefinition, type SchemaTableOptions, type SchemaTablesDefinition, SchemaValidationError, type SelectField, type SelfRefRoles, type SetOperationBuilder, type SimplifiedOrmOptions, type SqlRawExpression, type StreamOptions, SubqueryBuilder, SubqueryExpression, TABLE_META, type TableAssertionData, type TableDDL, type TableDef, type TableIndexes, type TableMetaKey, TableNotFoundError, type TableRef, type TraversalDirection, UnhandledTypeInDialect, UnknownDialectError, UnsafeOperationError, UnsupportedCapabilityError, UnsupportedFeatureError, UnsupportedStrategyError, UpdateBuilder, UpsertBuilder, type ValidatedResolvedSchema, type WhereFilter, WindowBuilder, aggOrderBy, and, any, array, arrayAgg, assertCapability, assertContains, assertDbColumnExists, assertDbOutput, assertDbRowsEquals, assertDbRowsMax, assertDbRowsMin, assertDbValueEquals, assertEquals, assertIntentHasGroupBy, assertIntentHasOrderBy, assertIntentHasWhere, assertIntentTable, assertIntentType, assertIntentWith, assertMatches, assertParamsEquals, assertParamsLength, assertParamsType, assertParamsValue, assertResolvedSchemaToGeneratedSchema, assertSQLColumn, assertSQLEquals, assertSQLJoin, assertSQLTable, assertSuccess, assertTypeSupported, batchValues, buildModelFromResolvedSchema, buildModelFromSchema, capitalize, caseWhen, cast, coalesce, col, composeAfterMutationHooks, composeAfterQueryHooks, composeBeforeMutationHooks, composeBeforeQueryHooks, composeOnErrorHooks, createDialectCapabilities, createHookManager, createNqlTag, createOrm, createPseudoColumnMetadata, createRawCteBuilder, createRecursiveMetadata, decapitalize, defaultLogger, defineModel, defineSchema, denseRank, detectForeignKeys, detectManyToMany, distinct, eq, every, exists, ref as exprRef, extendDialect, extractPseudoColumnKeywords, findClosestMatch, fn, fullTextSearch, getAvailableDialects, getDialectCapabilities, getLogger, getRelationKind, getSchemaFromDb, gt, gte, inArray, inSubquery, inferForeignKey, inferRelationsFromSchema, isAliasedColumn, isAllColumns, isBatchValuesRef, isBelongsTo, isCardinalityShorthand, isColumnRef, isDistinctField, isDistinctFrom, isExpressionSpec, isGeneratedSchema, isHasMany, isKnownDialect, isManyToMany, isNotNull, isNull, isOverallSuccess, isRecursiveIncludeOptions, isRecursiveRelation, isRef, isRelationObjectDef, isRelationRef, isRelationTupleDef, isResolvedSchema, isSelfReferential, isSqlRaw, isSubqueryExpression, isTableRef, isWhereIntent, lag, lead, like, literal, lt, lte, namedArg, negotiateFeatures, neq, none, normalizeSQL, normalizeSchema, not, notExists, objectToWhereIntent, op, or, outerRef, param, parseAssertionFile, parseRelationDef, parseRelationKey, pipeAfterMutationHooks, pipeAfterQueryHooks, pipeBeforeMutationHooks, pipeBeforeQueryHooks, pipeOnErrorHooks, plan, planRecursive, pluralize, rangeContainedBy, rangeContains, rangeOverlaps, rank, raw, rawExists, rawNotExists, ref$1 as ref, registerDialect, relationColumn, requiresDatabase, resetLogger, resolveQueryIndex, resolvedSchemaToGeneratedSchema, rowNumber, runAssertions, schema, schemaToModelIR, setLogger, silentLogger, singularize, some, sortByPriority, sql, star, stringAgg, subquery, supportsDDLGeneration, supportsExecution, supportsIntrospection, supportsRawSql, supportsStreaming, supportsTransactions, textScore, unary, validateAssertionBlocks, validateRecursiveInclude, validateRecursiveShape, wAvg, wCount, wMax, wMin, wSum, withPriority };

package/dist/index.js

@@ -3662,6 +3662,23 @@ var DEFAULT_FEATURE_CHECKERS = Object.freeze([
       }
       return usages;
     }
+  },
+  // -----------------------------------------------------------------------
+  // Row-Level Security
+  // -----------------------------------------------------------------------
+  {
+    capability: "supportsDDLRowLevelSecurity",
+    feature: "rowLevelSecurity",
+    detectUsage(model) {
+      if (!model.tables) return [];
+      const usages = [];
+      for (const [tableName, table] of model.tables) {
+        if (table.rlsEnabled || table.policies?.length) {
+          usages.push({ table: tableName, detail: tableName });
+        }
+      }
+      return usages;
+    }
   }
 ]);
 
@@ -3772,11 +3789,12 @@ var WindowBuilder = class _WindowBuilder {
     };
   }
   /**
-   * Convert builder state to WindowIntent
+   * Convert builder state to WindowIntent — produces the correct discriminated branch.
+   * - ranking → RankingWindowIntent (no field)
+   * - aggregate → AggregateWindowIntent (field required; COUNT uses '*' when omitted)
+   * - offset → OffsetWindowIntent (field required)
    */
   toWindowIntent(alias) {
-    const fn2 = this.fnKind.fn;
-    const field = this.fnKind.type === "aggregate" || this.fnKind.type === "offset" ? this.fnKind.field : void 0;
     const over = {};
     if (this.partitions.length > 0) {
       over.partitionBy = this.partitions;
@@ -3784,16 +3802,31 @@ var WindowBuilder = class _WindowBuilder {
     if (this.orders.length > 0) {
       over.orderBy = this.orders;
     }
-    const intent = {
+    if (this.fnKind.type === "ranking") {
+      return {
+        kind: "window",
+        function: this.fnKind.fn,
+        alias,
+        over
+      };
+    }
+    if (this.fnKind.type === "offset") {
+      return {
+        kind: "window",
+        function: this.fnKind.fn,
+        field: this.fnKind.field,
+        alias,
+        over
+      };
+    }
+    const { field } = this.fnKind;
+    return {
       kind: "window",
-      function: fn2,
+      function: this.fnKind.fn,
+      ...field !== void 0 && { field },
       alias,
       over
     };
-    if (field !== void 0) {
-      return { ...intent, field };
-    }
-    return intent;
   }
 };
 function rowNumber() {
@@ -3871,7 +3904,6 @@ function inSubquery(field, query) {
   return {
     kind: "in",
     field: getColumnName(field),
-    values: [],
     subquery: expr.toIntent()
   };
 }
@@ -4901,17 +4933,24 @@ var IntentBuilder = class _IntentBuilder {
    * DX-034: Now supports distinct flag for COUNT(DISTINCT field), etc.
    */
   addAggregate(func, field, options) {
-    const agg = { function: func };
-    if (field !== void 0) {
-      agg.field = field;
-    } else if (options?.field !== void 0) {
-      agg.field = options.field;
-    }
-    if (options?.as !== void 0) {
-      agg.as = options.as;
-    }
-    if (options?.distinct) {
-      agg.distinct = true;
+    const resolvedField = field ?? options?.field;
+    const as = options?.as;
+    const distinct2 = options?.distinct ? true : void 0;
+    let agg;
+    if (func === "count") {
+      agg = {
+        function: "count",
+        ...resolvedField !== void 0 && { field: resolvedField },
+        ...as !== void 0 && { as },
+        ...distinct2 !== void 0 && { distinct: distinct2 }
+      };
+    } else {
+      agg = {
+        function: func,
+        field: resolvedField ?? "",
+        ...as !== void 0 && { as },
+        ...distinct2 !== void 0 && { distinct: distinct2 }
+      };
     }
     this.state.aggregates.push(agg);
   }
@@ -5956,7 +5995,20 @@ var UpsertBuilder = class _UpsertBuilder extends MutationBuilderBase {
 };
 
 // src/dx/negotiate-features.ts
-import { UnsupportedFeatureError } from "@dbsp/types";
+var UnsupportedFeatureError = class extends Error {
+  constructor(feature, adapter, element) {
+    super(
+      `Unsupported feature "${feature}" on adapter "${adapter}" for "${element}"`
+    );
+    this.feature = feature;
+    this.adapter = adapter;
+    this.element = element;
+    this.name = "UnsupportedFeatureError";
+  }
+  feature;
+  adapter;
+  element;
+};
 function resolveBehavior(feature, config) {
   if (typeof config === "string") return config;
   return config.overrides?.[feature] ?? config.default;
@@ -5992,11 +6044,49 @@ function negotiateFeatures(model, capabilities, behavior = "warning", checkers =
 
 // src/dx/nql.ts
 import { compile as nqlCompile } from "@dbsp/nql";
+function toNqlLiteral(value, index) {
+  if (value === null) {
+    return "null";
+  }
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "number": {
+      if (!Number.isFinite(value)) {
+        throw new Error(
+          `nql\`...\`: cannot interpolate non-finite number (${value}) at position ${index}. Only finite numbers are supported. For dynamic NQL structure use the builder API (orm.select()). See issue #134.`
+        );
+      }
+      const s = value < 0 ? `-${Math.abs(value)}` : String(value);
+      if (/[eE]/.test(s)) {
+        throw new Error(
+          `nql\`...\`: number ${value} at position ${index} has no exact NQL numeric literal form (exponential notation). Convert it yourself or use the builder API (orm.select()). See issue #134.`
+        );
+      }
+      return s;
+    }
+    case "string": {
+      if (value.includes("\n") || value.includes("\r")) {
+        throw new Error(
+          `nql\`...\`: cannot interpolate a string containing a newline at position ${index}. NQL string literals do not support raw newline characters. For dynamic NQL structure use the builder API (orm.select()). See issue #134.`
+        );
+      }
+      const escaped = value.replaceAll("'", "''");
+      return `'${escaped}'`;
+    }
+    default: {
+      const typeName = value === void 0 ? "undefined" : typeof value;
+      throw new Error(
+        `nql\`...\`: cannot interpolate value of type "${typeName}" at position ${index}. Only string, number, boolean, and null are supported; for dynamic NQL fragments use the builder API (orm.select()). See issue #134.`
+      );
+    }
+  }
+}
 function createNqlTag(schemaDefinition, model, adapter, schemaName) {
   return function nql(strings, ...values) {
     let query = strings[0] ?? "";
     for (let i = 0; i < values.length; i++) {
-      query += String(values[i]) + (strings[i + 1] ?? "");
+      query += toNqlLiteral(values[i], i) + (strings[i + 1] ?? "");
     }
     return new NqlBuilderImpl(
       query,
@@ -7172,27 +7262,25 @@ var QueryBuilderImpl = class _QueryBuilderImpl {
   }
   count(fieldOrOptions, as) {
     const builder = this.clone();
-    const agg = { function: "count" };
+    let field;
+    let alias = as;
+    let distinct2;
     if (fieldOrOptions === void 0) {
     } else if (typeof fieldOrOptions === "string") {
-      agg.field = fieldOrOptions;
-      if (as !== void 0) {
-        agg.as = as;
-      }
+      field = fieldOrOptions;
     } else if (isDistinctField(fieldOrOptions)) {
-      agg.field = fieldOrOptions.field;
-      agg.distinct = true;
-      if (as !== void 0) {
-        agg.as = as;
-      }
+      field = fieldOrOptions.field;
+      distinct2 = true;
     } else {
-      if (fieldOrOptions.field !== void 0) {
-        agg.field = fieldOrOptions.field;
-      }
-      if (fieldOrOptions.as !== void 0) {
-        agg.as = fieldOrOptions.as;
-      }
-    }
+      field = fieldOrOptions.field;
+      alias = fieldOrOptions.as ?? as;
+    }
+    const agg = {
+      function: "count",
+      ...field !== void 0 && { field },
+      ...alias !== void 0 && { as: alias },
+      ...distinct2 !== void 0 && { distinct: distinct2 }
+    };
     builder.aggregates.push(agg);
     return builder;
   }
@@ -7200,13 +7288,12 @@ var QueryBuilderImpl = class _QueryBuilderImpl {
     const builder = this.clone();
     const isDistinct = isDistinctField(field);
     const fieldName = isDistinct ? field.field : field;
-    const agg = { function: "sum", field: fieldName };
-    if (isDistinct) {
-      agg.distinct = true;
-    }
-    if (as !== void 0) {
-      agg.as = as;
-    }
+    const agg = {
+      function: "sum",
+      field: fieldName,
+      ...isDistinct && { distinct: true },
+      ...as !== void 0 && { as }
+    };
     builder.aggregates.push(agg);
     return builder;
   }
@@ -7214,31 +7301,32 @@ var QueryBuilderImpl = class _QueryBuilderImpl {
     const builder = this.clone();
     const isDistinct = isDistinctField(field);
     const fieldName = isDistinct ? field.field : field;
-    const agg = { function: "avg", field: fieldName };
-    if (isDistinct) {
-      agg.distinct = true;
-    }
-    if (as !== void 0) {
-      agg.as = as;
-    }
+    const agg = {
+      function: "avg",
+      field: fieldName,
+      ...isDistinct && { distinct: true },
+      ...as !== void 0 && { as }
+    };
     builder.aggregates.push(agg);
     return builder;
   }
   min(field, as) {
     const builder = this.clone();
-    const agg = { function: "min", field };
-    if (as !== void 0) {
-      agg.as = as;
-    }
+    const agg = {
+      function: "min",
+      field,
+      ...as !== void 0 && { as }
+    };
     builder.aggregates.push(agg);
     return builder;
   }
   max(field, as) {
     const builder = this.clone();
-    const agg = { function: "max", field };
-    if (as !== void 0) {
-      agg.as = as;
-    }
+    const agg = {
+      function: "max",
+      field,
+      ...as !== void 0 && { as }
+    };
     builder.aggregates.push(agg);
     return builder;
   }
@@ -8243,7 +8331,9 @@ var QueryBuilderImpl = class _QueryBuilderImpl {
     const builder = new _QueryBuilderImpl(
       { ...this.ctx, ...ctxOverride },
       this.from,
-      { ...this.relationHints }
+      {
+        ...this.relationHints
+      }
     );
     builder.includes.push(...this.includes);
     builder.recursiveIncludes.push(...this.recursiveIncludes);
@@ -9217,6 +9307,7 @@ function rangeOverlaps(fieldOrColumn, valueOrRange, rangeType = "daterange") {
     kind: "range",
     field: fieldOrColumn,
     operator: "overlaps",
+    // Cast: non-array branch is RangeOperand (tuple path already returned above)
     value: valueOrRange
   };
 }
@@ -10026,7 +10117,8 @@ var FEATURE_TO_FLAG = {
   indexOpclass: "supportsDDLIndexOpclass",
   indexInclude: "supportsDDLIndexInclude",
   partialIndex: "supportsDDLPartialIndexes",
-  expressionIndex: "supportsDDLExpressionIndexes"
+  expressionIndex: "supportsDDLExpressionIndexes",
+  rowLevelSecurity: "supportsDDLRowLevelSecurity"
 };
 function createDialectCapabilities(overrides, options) {
   const result = {
@@ -11240,6 +11332,7 @@ export {
   UnknownDialectError,
   UnsafeOperationError,
   UnsupportedCapabilityError,
+  UnsupportedFeatureError,
   UnsupportedStrategyError,
   UpdateBuilder,
   UpsertBuilder,