@spinajs/orm-sql 2.0.481 → 2.0.484

package/lib/cjs/compilers.js

@@ -13,6 +13,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SqlRawSchemaQueryCompiler = exports.SqlDropEventQueryCompiler = exports.SqlEventQueryCompiler = exports.SqlAlterColumnQueryCompiler = exports.SqlColumnQueryCompiler = exports.SqlTableQueryCompiler = exports.SqlTableHistoryQueryCompiler = exports.SqlTruncateTableQueryCompiler = exports.SqlTableCloneQueryCompiler = exports.SqlAlterTableQueryCompiler = exports.SqlDropViewQueryCompiler = exports.SqlDropTableQueryCompiler = exports.SqlInsertQueryCompiler = exports.SqlIndexQueryCompiler = exports.SqlOnDuplicateQueryCompiler = exports.SqlDeleteQueryCompiler = exports.SqlUpdateQueryCompiler = exports.SqlSelectQueryCompiler = exports.SqlJoinCompiler = exports.SqlHavingCompiler = exports.SqlWhereCompiler = exports.SqlColumnsCompiler = exports.SqlGroupByCompiler = exports.SqlLimitQueryCompiler = exports.SqlForeignKeyQueryCompiler = exports.SqlWithRecursiveCompiler = exports.SqlOrderByQueryCompiler = exports.SqlQueryCompiler = exports.SqlTableAliasCompiler = void 0;
+exports.escapeIdentifier = escapeIdentifier;
+exports.escapeQualifiedIdentifier = escapeQualifiedIdentifier;
+exports.escapeStringLiteral = escapeStringLiteral;
 /* eslint-disable @typescript-eslint/no-unsafe-call */
 /* eslint-disable @typescript-eslint/no-unsafe-member-access */
 /* eslint-disable @typescript-eslint/no-empty-interface */
@@ -22,15 +25,58 @@ const orm_1 = require("@spinajs/orm");
 const typescript_mix_1 = require("typescript-mix");
 const di_1 = require("@spinajs/di");
 const lodash_1 = __importDefault(require("lodash"));
+/**
+ * Central identifier escaping for the MySQL-flavoured dialect.
+ *
+ * Wraps a table/column/alias/schema name in backticks and escapes any embedded
+ * backtick by doubling it (the MySQL rule). For a normal identifier (no special
+ * characters) the output is byte-identical to the previous raw interpolation
+ * (`` `${name}` ``), so existing generated SQL is unchanged; only names that
+ * actually contain a backtick produce different — and now safe — output.
+ *
+ * Dialects that quote differently (e.g. `[name]` with `]`-doubling) override
+ * this by shadowing the relevant compiler/statement, the same way
+ * {@link SqlTableAliasCompiler} is already overridden per driver.
+ */
+function escapeIdentifier(name) {
+    return '`' + String(name).replace(/`/g, '``') + '`';
+}
+/**
+ * Escapes a possibly schema-qualified table name, quoting each dot-separated part
+ * on its own: `schema.table` becomes `` `schema`.`table` ``, not
+ * `` `schema.table` `` — the latter is a single identifier and MySQL rejects it
+ * with "Failed to open the referenced table".
+ *
+ * Needed because {@link TableQueryBuilder.references} takes the parent table as one
+ * string, so cross-schema foreign keys arrive here already qualified. A dot is
+ * therefore read as a qualifier separator; a table whose name genuinely contains a
+ * dot cannot be expressed through that API (it never could).
+ */
+function escapeQualifiedIdentifier(name) {
+    return String(name)
+        .split('.')
+        .map((part) => escapeIdentifier(part))
+        .join('.');
+}
+/**
+ * Escapes a DDL string *literal* (SET/ENUM member, COMMENT, CHARACTER SET,
+ * COLLATE, string DEFAULT). These are single-quoted string literals, NOT
+ * identifiers, so the correct escaping is doubling embedded single quotes.
+ * Returns the value WITHOUT the surrounding quotes so callers keep their exact
+ * quoting; for a value with no quote the output is byte-identical.
+ */
+function escapeStringLiteral(value) {
+    return String(value).replace(/'/g, "''");
+}
 let SqlTableAliasCompiler = class SqlTableAliasCompiler {
     compile(builder, tbl) {
         let table = '';
         if (builder.Database) {
-            table += `\`${builder.Database}\`.`;
+            table += `${escapeIdentifier(builder.Database)}.`;
         }
-        table += `\`${tbl ? tbl : builder.Table}\``;
+        table += escapeIdentifier(tbl ? tbl : builder.Table);
         if (builder.TableAlias) {
-            table += ` as \`${builder.TableAlias}\``;
+            table += ` as ${escapeIdentifier(builder.TableAlias)}`;
         }
         return table;
     }
@@ -44,7 +90,7 @@ let SqlQueryCompiler = class SqlQueryCompiler extends orm_1.SelectQueryCompiler
         super();
         this._builder = _builder;
         this._container = _container;
-        if (_builder === null && _builder === undefined) {
+        if (_builder === null || _builder === undefined) {
             throw new exceptions_1.InvalidArgument('builder cannot be null or undefined');
         }
     }
@@ -72,11 +118,11 @@ let SqlOrderByQueryCompiler = class SqlOrderByQueryCompiler extends orm_1.OrderB
         this._builder = builder;
     }
     compile() {
-        const sort = this._builder.getSort();
+        const sorts = this._builder.getSorts();
         let stmt = '';
         const bindings = [];
-        if (sort) {
-            stmt = ` ORDER BY \`${sort.column}\` ${sort.order}`;
+        if (sorts.length > 0) {
+            stmt = ` ORDER BY ${sorts.map((s) => `${escapeIdentifier(s.column)} ${s.order}`).join(', ')}`;
         }
         return {
             bindings,
@@ -117,7 +163,7 @@ let SqlForeignKeyQueryCompiler = class SqlForeignKeyQueryCompiler {
         }
     }
     compile() {
-        const exprr = `FOREIGN KEY (${this._builder.ForeignKeyField}) REFERENCES ${this._builder.Table}(${this._builder.PrimaryKey}) ON DELETE ${this._builder.OnDeleteAction} ON UPDATE ${this._builder.OnUpdateAction}`;
+        const exprr = `FOREIGN KEY (${escapeIdentifier(this._builder.ForeignKeyField)}) REFERENCES ${escapeQualifiedIdentifier(this._builder.Table)}(${escapeIdentifier(this._builder.PrimaryKey)}) ON DELETE ${this._builder.OnDeleteAction} ON UPDATE ${this._builder.OnUpdateAction}`;
         return {
             bindings: [],
             expression: exprr,
@@ -200,23 +246,24 @@ exports.SqlColumnsCompiler = SqlColumnsCompiler = __decorate([
 ], SqlColumnsCompiler);
 let SqlWhereCompiler = class SqlWhereCompiler {
     where(builder) {
-        const where = [];
         const bindings = [];
-        const lazyBindings = builder.Statements.filter((x) => x instanceof orm_1.LazyQueryStatement).map((x) => x.build());
-        builder.Statements.filter((x) => !x.IsAggregate).filter(x => !(x instanceof orm_1.LazyQueryStatement))
-            .map((x) => {
-            return x.build();
-        })
-            .concat(lazyBindings)
-            .forEach((r) => {
-            where.push(...r.Statements);
-            if (Array.isArray(r.Bindings)) {
-                bindings.push(...r.Bindings);
-            }
-        });
+        // Lazy statements must be built FIRST: their build() may have side effects
+        // that append further statements to the builder (e.g. a correlated EXISTS
+        // sub-query registers its correlation predicate lazily). Building them now and
+        // reusing the result guarantees the side effect runs exactly once, and lets the
+        // non-lazy pass below pick up any statements the lazy build appended. The lazy
+        // results are then emitted after the non-lazy ones (preserving legacy ordering).
+        const lazyEntries = builder.Statements.filter((x) => x instanceof orm_1.LazyQueryStatement).map((stmt) => ({
+            boolean: stmt.Boolean,
+            result: stmt.build(),
+        }));
+        const nonLazyEntries = builder.Statements
+            .filter((x) => !x.IsAggregate)
+            .filter((x) => !(x instanceof orm_1.LazyQueryStatement))
+            .map((stmt) => ({ boolean: stmt.Boolean, result: stmt.build() }));
         return {
             bindings,
-            expression: where.join(` ${builder.Op.toUpperCase()} `),
+            expression: joinBuiltStatements(nonLazyEntries.concat(lazyEntries), bindings),
         };
     }
 };
@@ -224,23 +271,41 @@ exports.SqlWhereCompiler = SqlWhereCompiler;
 exports.SqlWhereCompiler = SqlWhereCompiler = __decorate([
     (0, di_1.NewInstance)()
 ], SqlWhereCompiler);
+/**
+ * Joins a list of already-built where/having statements into a single SQL
+ * expression, prefixing every statement after the first with its OWN boolean
+ * connector. This yields correct mixed grouping such as
+ * `a AND b OR c` for `where(a).where(b).orWhere(c)`, instead of applying a single
+ * builder-level connector uniformly. Bindings are collected in statement order.
+ */
+function joinBuiltStatements(statements, bindings) {
+    const parts = [];
+    statements.forEach(({ boolean, result }) => {
+        if (Array.isArray(result.Bindings)) {
+            bindings.push(...result.Bindings);
+        }
+        // A single statement always builds to one fragment; guard multi-fragment
+        // statements by joining them with AND (they carry no per-fragment connector).
+        const fragment = result.Statements.join(' AND ');
+        if (fragment === '') {
+            return;
+        }
+        if (parts.length === 0) {
+            parts.push(fragment);
+        }
+        else {
+            parts.push(`${(boolean ?? orm_1.WhereBoolean.AND).toUpperCase()} ${fragment}`);
+        }
+    });
+    return parts.join(' ');
+}
 let SqlHavingCompiler = class SqlHavingCompiler {
     having(builder) {
-        const where = [];
         const bindings = [];
-        builder.Statements.filter((x) => x.IsAggregate)
-            .map((x) => {
-            return x.build();
-        })
-            .forEach((r) => {
-            where.push(...r.Statements);
-            if (Array.isArray(r.Bindings)) {
-                bindings.push(...r.Bindings);
-            }
-        });
+        const aggregates = builder.Statements.filter((x) => x.IsAggregate).map((stmt) => ({ boolean: stmt.Boolean, result: stmt.build() }));
         return {
             bindings,
-            expression: where.join(` ${builder.Op.toUpperCase()} `),
+            expression: joinBuiltStatements(aggregates, bindings),
         };
     }
 };
@@ -348,7 +413,7 @@ let SqlUpdateQueryCompiler = class SqlUpdateQueryCompiler extends SqlQueryCompil
         const exprr = [];
         for (const prop of Object.keys(this._builder.Value)) {
             const v = this._builder.Value[`${prop}`];
-            exprr.push(`\`${prop}\` = ?`);
+            exprr.push(`${escapeIdentifier(prop)} = ?`);
             bindings = bindings.concat(this.tryConvertValue(v));
         }
         return {
@@ -415,22 +480,22 @@ let SqlOnDuplicateQueryCompiler = class SqlOnDuplicateQueryCompiler {
             .getColumnsToUpdate()
             .map((c) => {
             if (lodash_1.default.isString(c)) {
-                return `\`${c}\` = ?`;
+                // Reference the row being inserted via VALUES(col) instead of
+                // re-binding one specific row's value. Binding `parent.Values[0]`
+                // applied the FIRST row's values to every conflicting row in a
+                // multi row upsert.
+                return `${escapeIdentifier(c)} = VALUES(${escapeIdentifier(c)})`;
             }
             else {
                 return c.Query;
             }
         })
             .join(',');
-        const parent = this._builder.getParent();
-        const valueMap = parent.getColumns().map((c) => c.Column);
-        const bindings = this._builder.getColumnsToUpdate().map((c) => {
-            if (lodash_1.default.isString(c)) {
-                return parent.Values[0][valueMap.indexOf(c)];
-            }
-            else {
-                return c.Bindings;
-            }
+        // Only RawQuery update columns contribute bindings - VALUES(col) needs
+        // none. flatMap keeps raw bindings flat; returning the array itself
+        // nested them and shifted every following placeholder.
+        const bindings = lodash_1.default.flatMap(this._builder.getColumnsToUpdate(), (c) => {
+            return lodash_1.default.isString(c) ? [] : c.Bindings ?? [];
         });
         return {
             bindings,
@@ -451,7 +516,7 @@ let SqlIndexQueryCompiler = class SqlIndexQueryCompiler extends orm_1.IndexQuery
     compile() {
         return {
             bindings: [],
-            expression: `CREATE ${this._builder.Unique ? 'UNIQUE ' : ''}INDEX \`${this._builder.Name}\` ON \`${this._builder.Table}\` (${this._builder.Columns.map((c) => `\`${c}\``).join(',')});`,
+            expression: `CREATE ${this._builder.Unique ? 'UNIQUE ' : ''}INDEX ${escapeIdentifier(this._builder.Name)} ON ${escapeIdentifier(this._builder.Table)} (${this._builder.Columns.map((c) => escapeIdentifier(c)).join(',')});`,
         };
     }
 };
@@ -483,31 +548,54 @@ let SqlInsertQueryCompiler = class SqlInsertQueryCompiler extends SqlQueryCompil
             expression: '',
         };
     }
+    /**
+     * Indices of the columns that take part in this INSERT.
+     *
+     * An auto increment primary key is omitted only when NO row supplies a value
+     * for it. If at least one row supplies one the column stays, and the rows
+     * that don't emit NULL so the engine assigns the value.
+     *
+     * Both {@link columns} and {@link values} MUST derive their shape from this
+     * single decision - deciding per-row in one place and per-batch in the other
+     * produced value tuples whose arity did not match the column list.
+     */
+    keptColumnIndices() {
+        return this._builder
+            .getColumns()
+            .map((c, i) => ({ c, i }))
+            .filter(({ c, i }) => {
+            const descriptor = c.Descriptor;
+            if (descriptor && descriptor.AutoIncrement && descriptor.PrimaryKey) {
+                return this._builder.Values.some((x) => x[i] !== undefined && x[i] !== null);
+            }
+            return true;
+        })
+            .map(({ i }) => i);
+    }
     values() {
         if (this._builder.Values.length === 0) {
             throw new exceptions_1.InvalidArgument('values count invalid');
         }
+        const kept = this.keptColumnIndices();
         const bindings = [];
         let data = 'VALUES ';
         data += this._builder.Values.map((val) => {
-            const toInsert = val
-                .filter((v, i) => {
+            const toInsert = kept.map((i) => {
+                // eslint-disable-next-line security/detect-object-injection
+                const v = val[i];
                 // eslint-disable-next-line security/detect-object-injection
                 const descriptor = this._builder.getColumns()[i].Descriptor;
                 if (descriptor) {
                     if (!descriptor.Nullable && (v === null || v === undefined) && !descriptor.AutoIncrement) {
                         throw new exceptions_1.InvalidArgument(`value column ${descriptor.Name} cannot be null`);
                     }
-                    if (descriptor.AutoIncrement && descriptor.PrimaryKey) {
-                        if (v !== undefined && v !== null) {
-                            return true;
-                        }
-                        return false;
+                    // Auto increment PK this row does not supply. NULL (not DEFAULT) lets
+                    // the engine assign it and is portable - sqlite does not accept the
+                    // DEFAULT keyword inside a VALUES tuple.
+                    if (descriptor.AutoIncrement && descriptor.PrimaryKey && (v === undefined || v === null)) {
+                        return 'NULL';
                     }
                 }
-                return true;
-            })
-                .map((v) => {
                 if (v === undefined) {
                     return 'DEFAULT';
                 }
@@ -525,23 +613,15 @@ let SqlInsertQueryCompiler = class SqlInsertQueryCompiler extends SqlQueryCompil
         };
     }
     columns() {
-        const columns = this._builder
-            .getColumns()
-            .filter((c, i) => {
-            const descriptor = c.Descriptor;
-            if (descriptor && descriptor.AutoIncrement && descriptor.PrimaryKey) {
-                if (this._builder.Values.every((x) => x[i] !== undefined && x[i] !== null)) {
-                    return true;
-                }
-                return false;
-            }
-            return true;
-        })
-            .map((c) => {
-            return c.Column;
+        const columns = this.keptColumnIndices()
+            .map((i) => {
+            // eslint-disable-next-line security/detect-object-injection
+            return this._builder.getColumns()[i].Column;
         })
             .map((c) => {
-            return `\`${c instanceof orm_1.RawQuery ? c.Query : c}\``;
+            // RawQuery columns carry raw SQL - preserve the existing (unescaped)
+            // backtick wrapping. String columns go through the identifier escaper.
+            return c instanceof orm_1.RawQuery ? `\`${c.Query}\`` : escapeIdentifier(c);
         });
         if (columns.length === 0) {
             throw new exceptions_1.InvalidArgument('invalid column count');
@@ -629,10 +709,22 @@ let SqlAlterTableQueryCompiler = class SqlAlterTableQueryCompiler extends orm_1.
         }
         if (this.builder.Columns.length !== 0) {
             _outputs = _outputs.concat(this.builder.Columns.map((c) => {
-                const compiler = this.container.resolve(orm_1.AlterColumnQueryCompiler, [c]).compile();
+                // keep the compiler instance around - it carries the dialect's answer to
+                // "is my expression already a complete statement ?" (see IsStandaloneStatement)
+                const compiler = this.container.resolve(orm_1.AlterColumnQueryCompiler, [c]);
+                return { compiler, output: compiler.compile() };
+            })
+                // a driver may legitimately skip an alteration by compiling it to nothing.
+                // emitting it anyway would yield a dangling `ALTER TABLE \`x\`` - invalid SQL.
+                .filter(({ output }) => (output.expression ?? '').trim().length !== 0)
+                .map(({ compiler, output }) => {
+                // some dialects cannot express an alteration as a suffix of `ALTER TABLE x`
+                // eg. MSSQL renames a column with `EXEC sp_rename '[t].[old]', 'new', 'COLUMN'`,
+                // which is a complete statement and must be emitted verbatim.
+                const standalone = compiler.IsStandaloneStatement === true;
                 return {
-                    bindings: compiler.bindings,
-                    expression: `${_table} ${compiler.expression}`,
+                    bindings: output.bindings,
+                    expression: standalone ? output.expression : `${_table} ${output.expression}`,
                 };
             }));
         }
@@ -669,7 +761,7 @@ let SqlTableCloneQueryCompiler = class SqlTableCloneQueryCompiler extends orm_1.
                     // if no filter is provided, copy all the data
                     expression: `SELECT * FROM ${_tblName}`,
                 };
-            const fExprr = `INSERT INTO \`${this.builder.Table}\` ${fOut.expression}`;
+            const fExprr = `INSERT INTO ${escapeIdentifier(this.builder.Table)} ${fOut.expression}`;
             return [
                 out1,
                 {
@@ -851,7 +943,7 @@ let SqlTableQueryCompiler = class SqlTableQueryCompiler extends orm_1.TableQuery
     }
     _primaryKeys() {
         const _keys = this.builder.Columns.filter((x) => x.PrimaryKey)
-            .map((c) => `\`${c.Name}\``)
+            .map((c) => escapeIdentifier(c.Name))
             .join(',');
         if (!lodash_1.default.isEmpty(_keys)) {
             return `PRIMARY KEY (${_keys})`;
@@ -872,7 +964,7 @@ let SqlColumnQueryCompiler = class SqlColumnQueryCompiler {
     constructor(builder) {
         this.builder = builder;
         this._statementsMappings = {
-            set: (builder) => `SET(${builder.Args[0].map((a) => `'${a}\'`).join(',')})`,
+            set: (builder) => `SET(${builder.Args[0].map((a) => `'${escapeStringLiteral(a)}'`).join(',')})`,
             string: (builder) => `VARCHAR(${builder.Args[0] ? builder.Args[0] : 255})`,
             boolean: () => `BOOLEAN`,
             float: (builder) => {
@@ -882,8 +974,8 @@ let SqlColumnQueryCompiler = class SqlColumnQueryCompiler {
             },
             double: (builder) => this._statementsMappings.float(builder),
             decimal: (builder) => this._statementsMappings.float(builder),
-            enum: (builder) => `${builder.Type.toUpperCase()}(${builder.Args[0].map((a) => `'${a}'`).join(',')})`,
-            binary: (builder) => `BINARY(${builder.Args[0] ?? 255}`,
+            enum: (builder) => `${builder.Type.toUpperCase()}(${builder.Args[0].map((a) => `'${escapeStringLiteral(a)}'`).join(',')})`,
+            binary: (builder) => `BINARY(${builder.Args[0] ?? 255})`,
             smallint: (builder) => builder.Type.toUpperCase(),
             tinyint: (builder) => builder.Type.toUpperCase(),
             mediumint: (builder) => builder.Type.toUpperCase(),
@@ -904,12 +996,12 @@ let SqlColumnQueryCompiler = class SqlColumnQueryCompiler {
             longblob: (builder) => builder.Type.toUpperCase(),
             // COLUMN ADDITIONA PROPS
             unsigned: () => 'UNSIGNED',
-            charset: (builder) => `CHARACTER SET '${builder.Charset}'`,
-            collation: (builder) => `COLLATE '${builder.Collation}'`,
+            charset: (builder) => `CHARACTER SET '${escapeStringLiteral(builder.Charset)}'`,
+            collation: (builder) => `COLLATE '${escapeStringLiteral(builder.Collation)}'`,
             notnull: () => `NOT NULL`,
             default: () => this._defaultCompiler(),
             autoincrement: () => `AUTO_INCREMENT`,
-            comment: (builder) => `COMMENT '${builder.Comment}'`,
+            comment: (builder) => `COMMENT '${escapeStringLiteral(builder.Comment)}'`,
         };
         if (!builder) {
             throw new Error('column query builder cannot be null');
@@ -917,7 +1009,7 @@ let SqlColumnQueryCompiler = class SqlColumnQueryCompiler {
     }
     compile() {
         const _stmt = [];
-        _stmt.push(`\`${this.builder.Name}\``);
+        _stmt.push(escapeIdentifier(this.builder.Name));
         _stmt.push(this._statementsMappings[this.builder.Type](this.builder));
         if (this.builder.Unsigned) {
             _stmt.push(this._statementsMappings.unsigned());
@@ -954,7 +1046,7 @@ let SqlColumnQueryCompiler = class SqlColumnQueryCompiler {
             return _stmt;
         }
         if (lodash_1.default.isString(this.builder.Default.Value)) {
-            _stmt = `DEFAULT '${this.builder.Default.Value.trim()}'`;
+            _stmt = `DEFAULT '${escapeStringLiteral(this.builder.Default.Value.trim())}'`;
         }
         else if (lodash_1.default.isNumber(this.builder.Default.Value)) {
             _stmt = `DEFAULT ${this.builder.Default.Value}`;
@@ -970,39 +1062,85 @@ exports.SqlColumnQueryCompiler = SqlColumnQueryCompiler = __decorate([
     (0, di_1.NewInstance)(),
     __metadata("design:paramtypes", [orm_1.ColumnQueryBuilder])
 ], SqlColumnQueryCompiler);
-let SqlAlterColumnQueryCompiler = class SqlAlterColumnQueryCompiler extends SqlColumnQueryCompiler {
-    constructor(builder) {
-        super(builder);
+let SqlAlterColumnQueryCompiler = class SqlAlterColumnQueryCompiler extends orm_1.AlterColumnQueryCompiler {
+    constructor(container, builder) {
+        super();
+        this.container = container;
+        this.builder = builder;
+        if (!builder) {
+            throw new exceptions_1.InvalidArgument('builder cannot be null or undefined');
+        }
+    }
+    /**
+     * Renders the column body using the DRIVER's own column compiler, resolved
+     * from the container (late binding) - exactly like the CREATE TABLE path does.
+     * Previously this was `super.compile()`, which statically bound every driver
+     * to orm-sql's MySQL dialect.
+     */
+    _columnDefinition() {
+        return this.container.resolve(orm_1.ColumnQueryCompiler, [this.builder]).compile();
+    }
+    /**
+     * Whether the expression produced by `compile()` is already a complete, standalone
+     * statement. When true, SqlAlterTableQueryCompiler emits it verbatim instead of
+     * prefixing it with `ALTER TABLE <table> `.
+     *
+     * Needed by dialects whose alteration is not expressible as a suffix of ALTER TABLE,
+     * eg. MSSQL's `EXEC sp_rename '[t].[old]', 'new', 'COLUMN'`.
+     *
+     * It is read AFTER `compile()`, so a subclass may decide per `builder.AlterType`.
+     * Defaults to false - MySQL (this class) always emits a suffix.
+     */
+    get IsStandaloneStatement() {
+        return false;
+    }
+    /**
+     * Dialect hooks. Returning `null` means "emit no statement at all" - the
+     * parent AlterTableQueryCompiler filters such columns out.
+     */
+    _add(definition) {
+        // escapeIdentifier, not raw backticks: an identifier containing a backtick would
+        // otherwise terminate the quote and splice arbitrary SQL into the DDL ( A3 ).
+        return `ADD ${definition} ${this.builder.AfterColumn ? `AFTER ${escapeIdentifier(this.builder.AfterColumn)}` : ''}`;
+    }
+    _modify(definition) {
+        return `MODIFY ${definition}`;
+    }
+    _rename() {
+        return `RENAME COLUMN ${escapeIdentifier(this.builder.OldName)} TO ${escapeIdentifier(this.builder.Name)}`;
     }
     compile() {
-        const builder = this.builder;
-        if (builder.AlterType === orm_1.ColumnAlterationType.Rename) {
-            const bld = this.builder;
+        // rename never renders a column body, so it must not resolve one
+        if (this.builder.AlterType === orm_1.ColumnAlterationType.Rename) {
             return {
                 bindings: [],
-                expression: `RENAME COLUMN \`${bld.OldName}\` TO \`${bld.Name}\``,
+                expression: this._rename() ?? '',
             };
         }
-        const cDefinition = super.compile();
-        if (builder.AlterType === orm_1.ColumnAlterationType.Add) {
-            return {
-                bindings: cDefinition.bindings,
-                expression: `ADD ${cDefinition.expression} ${builder.AfterColumn ? `AFTER \`${builder.AfterColumn}\`` : ''}`,
-            };
-        }
-        if (builder.AlterType === orm_1.ColumnAlterationType.Modify) {
-            return {
-                bindings: cDefinition.bindings,
-                expression: `MODIFY ${cDefinition.expression}`,
-            };
+        const cDefinition = this._columnDefinition();
+        let expression;
+        switch (this.builder.AlterType) {
+            case orm_1.ColumnAlterationType.Add:
+                expression = this._add(cDefinition.expression);
+                break;
+            case orm_1.ColumnAlterationType.Modify:
+                expression = this._modify(cDefinition.expression);
+                break;
+            default:
+                expression = cDefinition.expression;
+                break;
         }
-        return cDefinition;
+        return {
+            bindings: cDefinition.bindings,
+            expression: expression ?? '',
+        };
     }
 };
 exports.SqlAlterColumnQueryCompiler = SqlAlterColumnQueryCompiler;
 exports.SqlAlterColumnQueryCompiler = SqlAlterColumnQueryCompiler = __decorate([
     (0, di_1.NewInstance)(),
-    __metadata("design:paramtypes", [orm_1.AlterColumnQueryBuilder])
+    (0, di_1.Inject)(di_1.Container),
+    __metadata("design:paramtypes", [di_1.Container, orm_1.AlterColumnQueryBuilder])
 ], SqlAlterColumnQueryCompiler);
 let SqlEventQueryCompiler = class SqlEventQueryCompiler extends SqlQueryCompiler {
     constructor(container, builder) {