@happyvertical/sql 0.74.8 → 0.74.10

package/dist/chunks/{index-DL-5nB7l.js → index-DrPgGVZz.js}

@@ -22,18 +22,43 @@ const VALID_OPERATORS = {
   "<=": "<=",
   "!=": "!=",
   like: "LIKE",
-  in: "IN"
+  in: "IN",
+  "not in": "NOT IN"
 };
+function isSimpleSqlIdentifier(field) {
+  return /^[a-zA-Z0-9_.]+$/.test(field);
+}
+function parseConditionKey(fullKey) {
+  const trimmed = fullKey.trim();
+  const lower = trimmed.toLowerCase();
+  const operators = ["not in", "like", "in", "!=", ">=", "<=", ">", "<", "="];
+  for (const operator of operators) {
+    if (lower.endsWith(` ${operator}`)) {
+      return {
+        field: trimmed.slice(0, -(operator.length + 1)).trim(),
+        operator,
+        explicitOperator: true
+      };
+    }
+  }
+  return { field: trimmed, operator: "=", explicitOperator: false };
+}
 const buildCondition = (fullKey, value, currIndex, adapterType) => {
-  const [field, operator = "="] = fullKey.split(" ");
+  const { field, operator, explicitOperator } = parseConditionKey(fullKey);
+  if (!explicitOperator && !isSimpleSqlIdentifier(field)) {
+    throw new Error(`Invalid SQL identifier: ${field}`);
+  }
   const sqlOperator = VALID_OPERATORS[operator] || "=";
   const values = [];
   let sql;
   if (value === null) {
     sql = `${field} IS ${sqlOperator === "=" ? "NULL" : "NOT NULL"}`;
-  } else if (sqlOperator === "IN" && Array.isArray(value)) {
+  } else if ((sqlOperator === "IN" || sqlOperator === "NOT IN") && Array.isArray(value)) {
+    if (value.length === 0) {
+      throw new Error(`${sqlOperator} requires at least one value`);
+    }
     const placeholders = value.map(() => `$${currIndex.value++}`).join(", ");
-    sql = `${field} IN (${placeholders})`;
+    sql = `${field} ${sqlOperator} (${placeholders})`;
     values.push(...value);
   } else if (value instanceof Date) {
     const needsCast = adapterType === "duckdb" || adapterType === "json";
@@ -92,6 +117,203 @@ const buildWhere = (where, startIndex = 1, adapterType) => {
   }
   return { sql, values };
 };
+const VALID_DIRECTIONS = /* @__PURE__ */ new Set(["ASC", "DESC"]);
+const VALID_BUCKET_UNITS = /* @__PURE__ */ new Set([
+  "minute",
+  "hour",
+  "day",
+  "week",
+  "month",
+  "quarter",
+  "year"
+]);
+function validateSqlIdentifier(identifier) {
+  if (!/^[a-zA-Z0-9_.]+$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return identifier;
+}
+function normalizeAdapter(adapterType) {
+  return adapterType ?? "sqlite";
+}
+function placeholder(index2) {
+  return `$${index2}`;
+}
+function bucketExpr(adapterType, unit, column) {
+  if (!VALID_BUCKET_UNITS.has(unit)) {
+    throw new Error(`Invalid aggregate bucket unit: ${unit}`);
+  }
+  const col = validateSqlIdentifier(column);
+  const adapter = normalizeAdapter(adapterType);
+  if (adapter === "postgres" || adapter === "duckdb" || adapter === "json") {
+    return `date_trunc('${unit}', ${col})`;
+  }
+  switch (unit) {
+    case "minute":
+      return `strftime('%Y-%m-%d %H:%M:00', ${col})`;
+    case "hour":
+      return `strftime('%Y-%m-%d %H:00:00', ${col})`;
+    case "day":
+      return `strftime('%Y-%m-%d 00:00:00', ${col})`;
+    case "week":
+      return `strftime('%Y-%m-%d 00:00:00', date(${col}, printf('-%d days', (CAST(strftime('%w', ${col}) AS INTEGER) + 6) % 7)))`;
+    case "month":
+      return `strftime('%Y-%m-01 00:00:00', ${col})`;
+    case "quarter":
+      return `strftime('%Y-%m-%d 00:00:00', date(strftime('%Y-', ${col}) || printf('%02d', ((CAST(strftime('%m', ${col}) AS INTEGER) - 1) / 3) * 3 + 1) || '-01'))`;
+    case "year":
+      return `strftime('%Y-01-01 00:00:00', ${col})`;
+  }
+}
+function aggregateExpression(expr) {
+  const normalizedFn = String(expr.fn).toLowerCase();
+  const fn = validateSqlIdentifier(String(expr.fn)).toUpperCase();
+  if (normalizedFn === "count" && !expr.column) {
+    if (expr.distinct) {
+      throw new Error(`Aggregate ${expr.fn} with distinct requires a column`);
+    }
+    return "COUNT(*)";
+  }
+  if (!expr.column) {
+    throw new Error(`Aggregate ${expr.fn} requires a column`);
+  }
+  const col = validateSqlIdentifier(expr.column);
+  const distinct = expr.distinct ? "DISTINCT " : "";
+  return `${fn}(${distinct}${col})`;
+}
+function selectExpression(expr, adapterType) {
+  if ("column" in expr && !("fn" in expr) && !("bucket" in expr)) {
+    const column = validateSqlIdentifier(expr.column);
+    const alias2 = validateSqlIdentifier(expr.as ?? expr.column);
+    return { expression: column, alias: alias2, groupingCandidate: true };
+  }
+  if ("bucket" in expr) {
+    const expression2 = bucketExpr(adapterType, expr.bucket, expr.column);
+    const alias2 = validateSqlIdentifier(expr.as);
+    return { expression: expression2, alias: alias2, groupingCandidate: true };
+  }
+  const expression = aggregateExpression(expr);
+  const alias = validateSqlIdentifier(expr.as);
+  return { expression, alias, groupingCandidate: false };
+}
+function validateWhereShape(where) {
+  if (!where) return;
+  const validateKey = (key) => {
+    const { field } = parseConditionKey(key);
+    if (field) validateSqlIdentifier(field);
+  };
+  if (Array.isArray(where)) {
+    for (const andGroup of where) {
+      for (const condition of andGroup) {
+        for (const key of Object.keys(condition)) validateKey(key);
+      }
+    }
+    return;
+  }
+  for (const key of Object.keys(where)) validateKey(key);
+}
+function expandHavingKey(key, expressionByAlias) {
+  const parsed = parseConditionKey(key);
+  const expression = expressionByAlias.get(parsed.field) ?? validateSqlIdentifier(parsed.field);
+  return `${expression} ${parsed.operator}`;
+}
+function expandHaving(having, expressionByAlias) {
+  const expandCondition = (condition) => Object.fromEntries(
+    Object.entries(condition).map(([key, value]) => [
+      expandHavingKey(key, expressionByAlias),
+      value
+    ])
+  );
+  if (Array.isArray(having)) {
+    return having.map(
+      (andGroup) => andGroup.map(
+        (condition) => expandCondition(condition)
+      )
+    );
+  }
+  return expandCondition(having);
+}
+function buildHaving(having, expressionByAlias, startIndex, adapterType) {
+  if (!having) return { sql: "", values: [] };
+  const expanded = expandHaving(having, expressionByAlias);
+  const built = buildWhere(expanded, startIndex, adapterType);
+  return {
+    sql: built.sql ? built.sql.replace(/^WHERE/, "HAVING") : "",
+    values: built.values
+  };
+}
+function buildOrderBy(orderBy) {
+  if (!orderBy) return "";
+  const items = Array.isArray(orderBy) ? orderBy : [orderBy];
+  const parts = items.map((item) => {
+    const [field, direction = "ASC"] = item.trim().split(/\s+/);
+    const normalizedDirection = direction.toUpperCase();
+    if (!VALID_DIRECTIONS.has(normalizedDirection)) {
+      throw new Error(`Invalid aggregate order direction: ${direction}`);
+    }
+    const orderExpr = validateSqlIdentifier(field);
+    return `${orderExpr} ${normalizedDirection}`;
+  });
+  return `ORDER BY ${parts.join(", ")}`;
+}
+function buildAggregate(spec, startIndex = 1, adapterType) {
+  const from = validateSqlIdentifier(spec.from);
+  if (spec.select.length === 0) {
+    throw new Error(
+      "AggregateSpec.select must contain at least one expression"
+    );
+  }
+  validateWhereShape(spec.where);
+  const expressionByAlias = /* @__PURE__ */ new Map();
+  const groupingAliases = [];
+  const selectSql = spec.select.map((expr) => {
+    const selected = selectExpression(expr, adapterType);
+    expressionByAlias.set(selected.alias, selected.expression);
+    if (selected.groupingCandidate) {
+      groupingAliases.push(selected.alias);
+    }
+    return `${selected.expression} AS ${selected.alias}`;
+  });
+  const where = spec.where ? buildWhere(spec.where, startIndex, adapterType) : { sql: "", values: [] };
+  let nextParamIndex = startIndex + where.values.length;
+  const groupByItems = spec.groupBy ?? groupingAliases;
+  const groupBySql = groupByItems.length > 0 ? `GROUP BY ${groupByItems.map(
+    (item) => expressionByAlias.has(item) ? expressionByAlias.get(item) : validateSqlIdentifier(item)
+  ).join(", ")}` : "";
+  const having = buildHaving(
+    spec.having,
+    expressionByAlias,
+    nextParamIndex,
+    adapterType
+  );
+  nextParamIndex += having.values.length;
+  const orderBySql = buildOrderBy(spec.orderBy);
+  const pagingValues = [];
+  const pagingSql = [];
+  if (spec.limit !== void 0) {
+    pagingSql.push(`LIMIT ${placeholder(nextParamIndex++)}`);
+    pagingValues.push(spec.limit);
+  } else if (spec.offset !== void 0 && normalizeAdapter(adapterType) === "sqlite") {
+    pagingSql.push("LIMIT -1");
+  }
+  if (spec.offset !== void 0) {
+    pagingSql.push(`OFFSET ${placeholder(nextParamIndex++)}`);
+    pagingValues.push(spec.offset);
+  }
+  const sql = [
+    `SELECT ${selectSql.join(", ")}`,
+    `FROM ${from}`,
+    where.sql,
+    groupBySql,
+    having.sql,
+    orderBySql,
+    pagingSql.join(" ")
+  ].filter(Boolean).join(" ");
+  return {
+    sql,
+    values: [...where.values, ...having.values, ...pagingValues]
+  };
+}
 function parseIndexStatement(indexSQL) {
   const trimmed = indexSQL.trim();
   const match = trimmed.match(
@@ -3385,11 +3607,11 @@ async function getDatabase(options = {}) {
     return postgres$1.getDatabase(options);
   }
   if (options.type === "sqlite") {
-    const sqlite = await import("./sqlite-DkCGjXmu.js");
+    const sqlite = await import("./sqlite-Cxjsirpn.js");
     return sqlite.getDatabase(options);
   }
   if (options.type === "duckdb") {
-    const duckdb = await import("./duckdb-Djx8WKZE.js");
+    const duckdb = await import("./duckdb-CIywTPV3.js");
     return duckdb.getDatabase(options);
   }
   if (options.type === "json") {
@@ -3450,19 +3672,21 @@ export {
   convertUniqueIndexesToInlineConstraints as e,
   formatDbError as f,
   generateCreateIndexStatement as g,
-  checkExpectedTables as h,
-  checkRelationship as i,
-  checkUniqueColumn as j,
-  clearConnectionCache as k,
-  clearPostgresConnectionCache as l,
-  index as m,
-  escapeSqlValue as n,
-  getDatabase as o,
-  runDoctor as p,
-  validateColumnName as q,
+  bucketExpr as h,
+  buildAggregate as i,
+  checkExpectedTables as j,
+  checkRelationship as k,
+  checkUniqueColumn as l,
+  clearConnectionCache as m,
+  clearPostgresConnectionCache as n,
+  index as o,
+  escapeSqlValue as p,
+  getDatabase as q,
   resolveSchemas as r,
-  syncSchema as s,
-  tableExists as t,
-  validateTableName as v
+  runDoctor as s,
+  syncSchema as t,
+  tableExists as u,
+  validateTableName as v,
+  validateColumnName as w
 };
-//# sourceMappingURL=index-DL-5nB7l.js.map
+//# sourceMappingURL=index-DrPgGVZz.js.map