@graphoria/server 0.1.5 → 0.2.0

package/src/databases/common.ts

@@ -4,6 +4,7 @@ import type { SelectionAnalysis, VariableDefinition } from "../analyzeQuery/type
 import type { MergedEntities } from "../configuration/getSchemas/mergeEntities";
 import type { DatabaseType, RelationshipCondition, VirtualColumn } from "../types/configuration";
 
+import { FILTER_OPERATORS } from "../config/types/auth";
 import { applyDirectives } from "./directives";
 
 // Common aggregation types
@@ -25,10 +26,36 @@ export interface GroupByInfo {
   cteAlias: string;
 }
 
+// isOperatorObject decides whether a filter object is a column filter or a nested
+// relation, so an operator missing from this set is not merely unhandled — the
+// whole filter is routed to the relation branch and dropped. Shared with the
+// config schema so the two cannot drift.
+const OPERATORS = new Set<string>(FILTER_OPERATORS);
+
 const isOperatorObject = (obj: object): boolean =>
-  Object.keys(obj).some((key) =>
-    ["eq", "neq", "gt", "gte", "lt", "lte", "like", "in", "is_null", "is_not_null"].includes(key),
-  );
+  Object.keys(obj).some((key) => OPERATORS.has(key));
+
+// These operators branch on the operand instead of binding it. Every literal in a
+// query document is hoisted into a generated variable (analyzeQuery/valueExtractors),
+// so the operand arrives as "$name" — testing that string for truthiness would make
+// `is_null: false` behave exactly like `is_null: true`. Resolve the real boolean.
+const NULL_CHECK_OPERATORS = new Set(["is_null", "is_not_null", "not_null"]);
+
+const resolveBooleanOperand = (
+  operand: unknown,
+  variables: Record<string, unknown>,
+  variablesDefinition: VariableDefinition[],
+): boolean => {
+  if (!isString(operand) || !operand.startsWith("$")) return Boolean(operand);
+
+  const name = operand.substring(1);
+
+  // The hash-key path passes the request variables without the generated defaults,
+  // so fall back to the definition's defaultValue for hoisted literals.
+  return name in variables
+    ? Boolean(variables[name])
+    : Boolean(variablesDefinition.find((v) => v.name === name)?.defaultValue);
+};
 
 export const generateTableAlias = (level: number): string => `t${level}`;
 
@@ -47,6 +74,8 @@ export const buildConditions = (
   tableAlias: string,
   level: number,
   aliasMap: { [alias: string]: string },
+  /** Query name of the table being filtered — resolves its virtual columns. */
+  tableName?: string,
 ): string => {
   if (!whereArgs) return "";
 
@@ -58,25 +87,50 @@ export const buildConditions = (
     if (isOperatorObject(value)) {
       for (const [operator, operand] of Object.entries(value)) {
         // All values are now variable references (e.g., "$varName" or ["$var1", "$var2"])
-        const resolvedValue = Array.isArray(operand)
-          ? operand.map((op) => {
-              if (isString(op) && op.startsWith("$")) {
-                const index = variablesDefinition.findIndex((v) => v.name === op.substring(1));
-                return `${mappingDbTypeCharVar[dbType]}${index + 1}`;
-              }
-              return op;
-            })
-          : isString(operand) && operand.startsWith("$")
-            ? `${mappingDbTypeCharVar[dbType]}${variablesDefinition.findIndex((v) => v.name === operand.substring(1)) + 1}`
-            : operand;
-
-        const condition = buildCondition(tableAlias, fieldName, operator, resolvedValue, dbType);
+        const resolvedValue = NULL_CHECK_OPERATORS.has(operator)
+          ? resolveBooleanOperand(operand, variables, variablesDefinition)
+          : Array.isArray(operand)
+            ? operand.map((op) => {
+                if (isString(op) && op.startsWith("$")) {
+                  const index = variablesDefinition.findIndex((v) => v.name === op.substring(1));
+                  return `${mappingDbTypeCharVar[dbType]}${index + 1}`;
+                }
+                return op;
+              })
+            : isString(operand) && operand.startsWith("$")
+              ? `${mappingDbTypeCharVar[dbType]}${variablesDefinition.findIndex((v) => v.name === operand.substring(1)) + 1}`
+              : operand;
+
+        const condition = buildCondition(
+          columnTargetFp(dbType)(entities, tableName, fieldName, tableAlias),
+          fieldName,
+          operator,
+          resolvedValue,
+          dbType,
+        );
 
         if (condition) {
           conditions.push(condition);
         }
       }
     } else if (typeof value === "object" && !Array.isArray(value)) {
+      // Only entities (tables/views) appear in queriesMap. An operator-less filter object on a
+      // column (e.g. `{ col: {} }`) has no operator keys, so it lands here despite not being a
+      // relation; skip it as a no-op instead of dereferencing a missing queriesMap entry.
+      const nestedEntity = entities.queriesMap[fieldName];
+      if (!nestedEntity) {
+        const [unknownOperator] = Object.keys(value as object);
+        // A non-empty filter object on something that is not a relation can only
+        // be a column filter whose operator we do not implement. Dropping it here
+        // would return every row.
+        if (unknownOperator) {
+          throw new Error(
+            `Unsupported filter operator "${unknownOperator}" on column "${fieldName}"`,
+          );
+        }
+        continue;
+      }
+
       const nestedTableAlias = `t${level}`;
 
       const parentTableName = aliasMap[tableAlias];
@@ -90,6 +144,11 @@ export const buildConditions = (
         dbType,
       );
 
+      // Record this relation's alias→table so a deeper nested where (3+ levels) can resolve
+      // its own parent via aliasMap[tableAlias]; without it the next recursion sees undefined
+      // and emits a join-less "WHERE  AND (...)".
+      aliasMap[nestedTableAlias] = fieldName;
+
       const nestedConditions = buildConditions(
         entities,
         dbType,
@@ -99,11 +158,12 @@ export const buildConditions = (
         nestedTableAlias,
         level + 1,
         aliasMap,
+        fieldName,
       );
 
       const existsClause = `EXISTS (
       SELECT 1
-      FROM ${entities.queriesMap[fieldName]!.dottedQuotedName} ${nestedTableAlias}
+      FROM ${nestedEntity.dottedQuotedName} ${nestedTableAlias}
       WHERE ${joinCondition}${nestedConditions ? ` AND (${nestedConditions})` : ""}
     )`;
 
@@ -142,6 +202,31 @@ export const qualifiedNameFp =
     return `${wrap(schema)}.${wrap(name)}`;
   };
 
+const renderVirtualColumn = (vc: VirtualColumn): string =>
+  vc.function ? `(${vc.function}(${vc.params?.join(", ")}))` : `(${vc.expression})`;
+
+/**
+ * What a column name compiles to on the left of a comparison or in ORDER BY.
+ *
+ * A virtual column has no physical counterpart, so emitting `alias."name"` for
+ * one produces `column t1.name does not exist`. WHERE and ORDER BY both go
+ * through here so they cannot disagree about what a column is.
+ */
+const columnTargetFp =
+  (dbType: DatabaseType) =>
+  (
+    entities: MergedEntities,
+    tableName: string | undefined,
+    colName: string,
+    tableAlias: string,
+  ): string => {
+    const virtualColumn = tableName ? entities.isVirtualColumn(tableName, colName) : undefined;
+
+    return virtualColumn
+      ? renderVirtualColumn(virtualColumn as VirtualColumn)
+      : `${tableAlias}.${wrapIdentifierFp(dbType)(colName)}`;
+  };
+
 // Helper to resolve variable values
 const resolveVariable = <T>(value: unknown, variables: Record<string, unknown>): T => {
   if (isString(value) && value.startsWith("$")) {
@@ -151,43 +236,51 @@ const resolveVariable = <T>(value: unknown, variables: Record<string, unknown>):
 };
 
 const buildCondition = (
-  tableAlias: string,
+  target: string,
   field: string,
   operator: string,
   value: unknown,
   dbType: DatabaseType,
 ): string | null => {
-  const wrappedField = wrapIdentifierFp(dbType)(field);
-
   switch (operator) {
     case "eq":
-      return `${tableAlias}.${wrappedField} = ${value}`;
+      return `${target} = ${value}`;
     case "neq":
-      return `${tableAlias}.${wrappedField} <> ${value}`;
+      return `${target} <> ${value}`;
     case "gt":
-      return `${tableAlias}.${wrappedField} > ${value}`;
+      return `${target} > ${value}`;
     case "gte":
-      return `${tableAlias}.${wrappedField} >= ${value}`;
+      return `${target} >= ${value}`;
     case "lt":
-      return `${tableAlias}.${wrappedField} < ${value}`;
+      return `${target} < ${value}`;
     case "lte":
-      return `${tableAlias}.${wrappedField} <= ${value}`;
+      return `${target} <= ${value}`;
+    // PostgreSQL and MySQL treat a backslash as the LIKE escape by default;
+    // T-SQL has no default escape character at all, so `100\%` matched a literal
+    // backslash and found nothing. Declare the escape to make the three agree.
     case "like":
-      return `${tableAlias}.${wrappedField} LIKE ${value}`;
+      return dbType === "mssql" ? `${target} LIKE ${value} ESCAPE '\\'` : `${target} LIKE ${value}`;
     case "in":
-      return `${tableAlias}.${wrappedField} IN (${
-        Array.isArray(value) ? value.join(", ") : value
-      })`;
+      return `${target} IN (${Array.isArray(value) ? value.join(", ") : value})`;
     case "is_null":
-      return value
-        ? `${tableAlias}.${wrappedField} IS NULL`
-        : `${tableAlias}.${wrappedField} IS NOT NULL`;
+      return value ? `${target} IS NULL` : `${target} IS NOT NULL`;
     case "is_not_null":
-      return value
-        ? `${tableAlias}.${wrappedField} IS NOT NULL`
-        : `${tableAlias}.${wrappedField} IS NULL`;
+    case "not_null":
+      return value ? `${target} IS NOT NULL` : `${target} IS NULL`;
+    case "between": {
+      const bounds = Array.isArray(value) ? value : [];
+      if (bounds.length !== 2) {
+        throw new Error(
+          `Filter operator "between" on column "${field}" expects exactly two values, received ${bounds.length}`,
+        );
+      }
+      return `${target} BETWEEN ${bounds[0]} AND ${bounds[1]}`;
+    }
+    // Returning null here would drop the condition, so a filter Graphoria cannot
+    // honour would widen the result set instead of failing — a role filter naming
+    // an unimplemented operator would return the whole table.
     default:
-      return null;
+      throw new Error(`Unsupported filter operator "${operator}" on column "${field}"`);
   }
 };
 
@@ -377,6 +470,7 @@ export const buildWhereClauseFp =
         tableAlias,
         level + 1,
         aliasMap,
+        field.name ?? aliasMap[tableAlias],
       ),
       parentTableName && parentTableAlias
         ? findJoinCondition(
@@ -413,7 +507,6 @@ const parseOrderDirection = (direction: string): { sort: string; nulls?: string
 export const buildOrderByClauseFp =
   (dbType: DatabaseType = "pg") =>
   (entities: MergedEntities, field: SelectionAnalysis, tableAlias: string): string => {
-    const wrap = wrapIdentifierFp(dbType);
     if (field.arguments?.["orderBy"]) {
       const orderBy = field.arguments?.["orderBy"];
       // orderBy is an array or object of { column: direction } - no variable resolution needed
@@ -433,16 +526,18 @@ export const buildOrderByClauseFp =
           const [colName, direction] = Object.entries(ob)[0];
           const { sort, nulls } = parseOrderDirection(direction as string);
 
-          const virtualColumn = entities.isVirtualColumn(field.name, colName);
+          // Resolved once, above the NULLS branch: a virtual column has to expand
+          // to its expression in every emission below, not only the default one.
+          const target = columnTargetFp(dbType)(entities, field.name, colName, tableAlias);
 
           if (nulls) {
             if (dbType === "pg") {
               // PostgreSQL supports NULLS FIRST/LAST natively
-              return `${tableAlias}.${wrap(colName)} ${sort} NULLS ${nulls}`;
+              return `${target} ${sort} NULLS ${nulls}`;
             } else if (dbType === "mysql") {
               // MySQL: Use CASE statement for NULL handling
               const nullFirst = nulls === "FIRST";
-              return `CASE WHEN ${tableAlias}.${wrap(colName)} IS NULL THEN ${nullFirst ? 0 : 1} ELSE ${nullFirst ? 1 : 0} END, ${tableAlias}.${wrap(colName)} ${sort}`;
+              return `CASE WHEN ${target} IS NULL THEN ${nullFirst ? 0 : 1} ELSE ${nullFirst ? 1 : 0} END, ${target} ${sort}`;
             } else {
               // MSSQL requires CASE statements for NULL handling
               const nullFirst = nulls === "FIRST";
@@ -450,23 +545,16 @@ export const buildOrderByClauseFp =
 
               if ((nullFirst && isAsc) || (!nullFirst && !isAsc)) {
                 // NULLs naturally come first in this combination
-                return `${tableAlias}.${wrap(colName)} ${sort}`;
+                return `${target} ${sort}`;
               } else {
                 // Need to force NULL positioning with CASE
-                return `CASE WHEN ${tableAlias}.${wrap(colName)} IS NULL THEN ${nullFirst ? 0 : 1} ELSE ${nullFirst ? 1 : 0} END, ${tableAlias}.${wrap(colName)} ${sort}`;
+                return `CASE WHEN ${target} IS NULL THEN ${nullFirst ? 0 : 1} ELSE ${nullFirst ? 1 : 0} END, ${target} ${sort}`;
               }
             }
-          } else {
-            // No explicit NULL handling - use database defaults
-            if (virtualColumn) {
-              const vc = virtualColumn as VirtualColumn;
-              return `(
-                ${vc.function ? `${vc.function}(${vc.params?.join(", ")})` : `${vc.expression}`}
-              ) ${sort}`;
-            }
-
-            return `${tableAlias}.${wrap(colName)} ${sort}`;
           }
+
+          // No explicit NULL handling - use database defaults
+          return `${target} ${sort}`;
         })
         .join(", ");
 
@@ -733,14 +821,6 @@ export const buildPaginationClauseFp =
   (field: SelectionAnalysis, variablesDefinition: VariableDefinition[] = []): string => {
     const args = field.arguments;
 
-    // MSSQL requires ORDER BY for pagination
-    if (
-      dbType === "mssql" &&
-      (!args || args["limit"] === undefined || args["orderBy"] === undefined)
-    ) {
-      return "";
-    }
-
     if (!args || args["limit"] === undefined) {
       return "";
     }
@@ -756,10 +836,16 @@ export const buildPaginationClauseFp =
       ? toPositionalPlaceholder(args["offset"], variablesDefinition, dbType)
       : "0";
 
-    // Return database-specific syntax
-    return dbType === "mssql"
-      ? `OFFSET ${offsetPlaceholder} ROWS FETCH NEXT ${limitPlaceholder} ROWS ONLY`
-      : `LIMIT ${limitPlaceholder} OFFSET ${offsetPlaceholder}`;
+    if (dbType !== "mssql") {
+      return `LIMIT ${limitPlaceholder} OFFSET ${offsetPlaceholder}`;
+    }
+
+    // T-SQL only accepts OFFSET/FETCH after an ORDER BY. Dropping the limit when
+    // the query has none returned the whole table instead, so supply the
+    // order-agnostic ORDER BY that T-SQL accepts for exactly this case.
+    const orderByFallback = args["orderBy"] === undefined ? "ORDER BY (SELECT NULL) " : "";
+
+    return `${orderByFallback}OFFSET ${offsetPlaceholder} ROWS FETCH NEXT ${limitPlaceholder} ROWS ONLY`;
   };
 
 export const buildPaginationClausePG = buildPaginationClauseFp("pg");

package/src/databases/directives.ts

@@ -10,10 +10,12 @@ export type DirectiveHandler = (
   dbType: DatabaseType,
 ) => string;
 
+const PLACEHOLDER_RE = /^[$@]\d+$/;
+
 // Wrap a value in SQL string quotes unless it's a positional placeholder ($1, @1, etc.)
 const sqlString = (value: unknown): string => {
   const s = String(value);
-  if (/^[$@]\d+$/.test(s)) return s;
+  if (PLACEHOLDER_RE.test(s)) return s;
   return `'${s}'`;
 };
 
@@ -32,12 +34,18 @@ export const DIRECTIVE_HANDLERS: Record<string, DirectiveHandler> = {
     `SUBSTRING(${querySelector}, ${directive.arguments!["start"]}, ${directive.arguments!["length"]})`,
   replace: (querySelector, directive) =>
     `REPLACE(${querySelector}, ${sqlString(directive.arguments!["find"])}, ${sqlString(directive.arguments!["replaceWith"])})`,
-  concat: (querySelector, directive) => {
-    const withValue = directive.arguments!["with"] as string;
+  concat: (querySelector, directive, dbType) => {
+    const rendered = sqlString(directive.arguments!["with"]);
+    // CONCAT is variadic "any" in PostgreSQL, so it gives the planner nothing to
+    // infer a bare placeholder from and the statement dies with
+    // "could not determine data type of parameter $n". The cast annotates the
+    // parameter type without unbinding the value.
+    const withValue =
+      dbType === "pg" && PLACEHOLDER_RE.test(rendered) ? `${rendered}::TEXT` : rendered;
     const position = (directive.arguments?.["position"] as string) ?? "after";
     return position === "before"
-      ? `CONCAT(${sqlString(withValue)}, ${querySelector})`
-      : `CONCAT(${querySelector}, ${sqlString(withValue)})`;
+      ? `CONCAT(${withValue}, ${querySelector})`
+      : `CONCAT(${querySelector}, ${withValue})`;
   },
   pad: (querySelector, directive, dbType) => {
     const length = directive.arguments!["length"] as number;
@@ -47,13 +55,23 @@ export const DIRECTIVE_HANDLERS: Record<string, DirectiveHandler> = {
       return side === "left"
         ? `LPAD(${querySelector}::TEXT, ${length}, ${char})`
         : `RPAD(${querySelector}::TEXT, ${length}, ${char})`;
-    } else {
+    }
+    // MySQL has LPAD/RPAD too, and needs no cast. It used to fall through to the
+    // SQL Server branch, where REPLICATE and VARCHAR(MAX) are syntax errors.
+    if (dbType === "mysql") {
       return side === "left"
-        ? `RIGHT(REPLICATE(${char}, ${length}) + CAST(${querySelector} AS VARCHAR(MAX)), ${length})`
-        : `LEFT(CAST(${querySelector} AS VARCHAR(MAX)) + REPLICATE(${char}, ${length}), ${length})`;
+        ? `LPAD(${querySelector}, ${length}, ${char})`
+        : `RPAD(${querySelector}, ${length}, ${char})`;
     }
+    // SQL Server: LPAD/RPAD only exist from 2022.
+    return side === "left"
+      ? `RIGHT(REPLICATE(${char}, ${length}) + CAST(${querySelector} AS VARCHAR(MAX)), ${length})`
+      : `LEFT(CAST(${querySelector} AS VARCHAR(MAX)) + REPLICATE(${char}, ${length}), ${length})`;
   },
   dateFormat: (querySelector, directive, dbType) => {
+    if (dbType === "mysql") {
+      throw new Error("@dateFormat is not supported on MySQL. Expose a virtual column instead.");
+    }
     const format = directive.arguments!["format"] as string;
     return dbType === "pg"
       ? `TO_CHAR(${querySelector}, ${sqlString(format)})`

package/src/databases/engines/mssql/connection.ts

@@ -145,7 +145,7 @@ export const callStoredProcedure = async (
     // never as SQL text, so reserved words need no delimiting here.
     const data = await request.execute(sp.dottedName);
 
-    return data?.recordset ?? false;
+    return !data?.returnValue;
   } catch (e: unknown) {
     logger("mssql").error({ err: e }, "stored procedure execution failed");
     return false;

package/src/databases/engines/mssql/query/index.ts

@@ -19,6 +19,8 @@ import {
   wrapIdentifierMSSQL,
 } from "../../../common";
 
+import { applyDirectives } from "../../../directives";
+
 // FOR JSON PATH uses the unbracketed alias as the JSON key, so bracket-quoting
 // (required for reserved words like PRINT) never leaks into results.
 
@@ -44,9 +46,13 @@ const buildAggregationCTE = (
       selectClauses.push(`COUNT(*) AS ${agg.alias}`);
     } else {
       const func = agg.name.toUpperCase();
-      selectClauses.push(
-        `${func}(${tableAlias}.${wrapIdentifierMSSQL(agg.fieldName)}) AS ${agg.alias}`,
-      );
+      // SQL Server's AVG over an integer column is integer division — AVG of
+      // 1, 5, 5, 2 is 3, not 3.25 — so the average has to be taken on a float.
+      const operand =
+        agg.name === "avg"
+          ? `CAST(${tableAlias}.${wrapIdentifierMSSQL(agg.fieldName)} AS FLOAT)`
+          : `${tableAlias}.${wrapIdentifierMSSQL(agg.fieldName)}`;
+      selectClauses.push(`${func}(${operand}) AS ${agg.alias}`);
     }
   });
 
@@ -64,6 +70,7 @@ const buildAggregationCTE = (
 // Build the main query for grouped results
 const buildGroupedQuery = (
   entities: MergedEntities,
+  variablesDefinition: VariableDefinition[],
   field: SelectionAnalysis,
   groupByInfo: GroupByInfo,
   dottedQuotedName: string,
@@ -78,10 +85,15 @@ const buildGroupedQuery = (
   if (hasKey) {
     // Add key object with group by fields
     const keyFields = keys
-      .map(
-        (field) =>
-          `${cteAlias}.${wrapIdentifierMSSQL(field.name)} AS ${wrapIdentifierMSSQL(field.alias || field.name)}`,
-      )
+      .map((field) => {
+        const selector = applyDirectives(
+          `${cteAlias}.${wrapIdentifierMSSQL(field.name)}`,
+          field.directives,
+          "mssql",
+          variablesDefinition,
+        );
+        return `${selector} AS ${wrapIdentifierMSSQL(field.alias || field.name)}`;
+      })
       .join(", ");
 
     selectClauses.push(
@@ -107,10 +119,15 @@ const buildGroupedQuery = (
     if (itemsSelection?.selections) {
       const itemFields = itemsSelection.selections
         .filter((sel) => !isAggregationField(sel.name) && sel.name !== "items")
-        .map(
-          (sel) =>
-            `${tableAlias}.${wrapIdentifierMSSQL(sel.name)} AS ${wrapIdentifierMSSQL(sel.alias || sel.name)}`,
-        )
+        .map((sel) => {
+          const selector = applyDirectives(
+            `${tableAlias}.${wrapIdentifierMSSQL(sel.name)}`,
+            sel.directives,
+            "mssql",
+            variablesDefinition,
+          );
+          return `${selector} AS ${wrapIdentifierMSSQL(sel.alias || sel.name)}`;
+        })
         .join(", ");
 
       if (itemFields) {
@@ -265,6 +282,7 @@ export const buildSQLForField = (
     // Handle GROUP BY aggregation query
     const mainQuery = buildGroupedQuery(
       entities,
+      variablesDefinition,
       field,
       groupByInfo,
       dottedQuotedName,

package/src/databases/engines/mysql/auth.ts

@@ -41,7 +41,7 @@ export const checkUserCredentials = async (
   const schema = assertSafeIdentifier(auth.schema!, "schema");
 
   const result = await pool.unsafe<UserRecord[]>(
-    `SELECT * FROM \`${schema}\`.\`user\` WHERE username = $1 AND is_active = TRUE`,
+    `SELECT * FROM \`${schema}\`.\`user\` WHERE username = ? AND is_active = TRUE`,
     [username],
   );
 
@@ -94,7 +94,7 @@ export const insertAuthUser = async (
 
   await pool.unsafe(
     `INSERT INTO \`${schema}\`.\`user\` (username, password, role, is_active, claims)
-       VALUES ($1, $2, $3, TRUE, $4)`,
+       VALUES (?, ?, ?, TRUE, ?)`,
     [input.username, hashed, input.role, JSON.stringify(input.claims ?? {})],
   );
 };

package/src/databases/engines/mysql/connection.ts

@@ -6,6 +6,7 @@ import type { Database } from "../../../types/configuration";
 import type { ProcedureResolver } from "../../../types/db";
 
 import { databasesConnections } from "../../../singletons/databases";
+import { toMySQLPlaceholders } from "./placeholders";
 
 export const getPool = async (db: Database) => {
   const opts = db.connectionOptions as BunSQLConnectionOptions | undefined;
@@ -42,10 +43,10 @@ export const executeQueryFactory =
   ) => {
     const pool = singleQuery ? await getPool(db) : await getPoolSingleton(db);
 
-    const result = await pool.unsafe<T>(
-      query,
-      variablesDefinition.map((v) => values[v.name]),
-    );
+    // Bun's MySQL adapter binds `?` positionally; the builders emit `$n`.
+    const bound = toMySQLPlaceholders(query, variablesDefinition, values);
+
+    const result = await pool.unsafe<T>(bound.query, bound.params);
 
     if (singleQuery) {
       await pool.close();