@starbemtech/star-db-query-builder 1.4.0 → 1.4.1

package/CHANGELOG.md

@@ -9,6 +9,21 @@ Entries below are generated from the real commit history for each tagged release
 
 ## [Unreleased]
 
+## [1.4.1] - 2026-10-08
+
+- `fix`: `Conditions<T>`'s `JOINS`/`AND`/`OR` now accept a table-qualified column key (e.g. `'orders.total'`) alongside `T`'s own keys, instead of rejecting it at compile time — `JOINS` in particular was typed `Conditions<object>` regardless of `T`, which (since `keyof object` is `never`) could never actually hold a qualified-column condition. A plain (unqualified) typo of one of `T`'s own keys is still a compile-time error in all three. Fixes #25.
+- `fix`: `joins<T>()` gains a second, independent generic `W` (`joins<T, W = T>`) decoupling the result row type from the `where` shape, for the case where `T` is passed explicitly and `where` needs a joined table's column at its top level (not inside `AND`/`OR`/`JOINS`).
+- `fix`: an `AND`/`OR`/`JOINS` group element with more than one key (e.g. `{ status: ..., tenant_id: ... }`) no longer silently drops every key past the first — all of a group element's sibling keys are now ANDed together, matching how sibling keys behave at the top level of `where`. Previously a scoping condition placed alongside another key in the same group element (e.g. a `tenant_id` guard) could vanish from the generated SQL with no error.
+- `fix`: a transaction client (the `tx` passed to `withTransaction`'s callback, or returned by `beginTransaction`) can now itself be passed as `dbClient` to `findFirst`/`insert`/`update`/etc, matching the pattern documented in `docs/methods/transactions.md` and the README — it previously failed to type-check because `ITransactionClient` had no `clientType`, and these functions required the full `IDatabaseClient` shape (including `beginTransaction`) even though they never call it. `ITransactionClient` now has `clientType`, and the query-executing functions accept the narrower `IQueryClient` (`clientType` + `query`) instead.
+- `fix`: `rawQuery` now throws a `RawQueryError` that preserves the original driver error as `.cause` plus the cross-driver fields callers actually branch on (pg's `code`/`detail`/`constraint`, mysql2's `errno`/`sqlState`), instead of a plain `Error` built from just `error.message` that discarded all of it — callers could not distinguish e.g. a unique-constraint violation from a syntax error.
+- `fix`: `updateMany` on MySQL now returns the rows it actually updated even when the `where` condition targets a column the update itself changes (e.g. `where: { status: 'pending' }, data: { status: 'done' }`) — it used to re-run the *original* `where` in a post-update `SELECT`, which matched zero (or the wrong) rows once the update had already changed every matched row's `status`. The matching rows' `id`s are now captured before the `UPDATE` runs and used to scope the final `SELECT`.
+- `fix`: `update`/`updateMany` now ignore a `data` key whose value is `undefined` instead of passing it through as a real column assignment — node-postgres silently coerces an `undefined` bind value to SQL `NULL` (so a partial DTO built by spreading an object with an unset optional field could overwrite a column with `NULL`), while mysql2 rejects it outright. A `data` object left with no defined keys after filtering throws the same "must have at least one field to update" error as an empty `data` object.
+- `fix`: `assertSafeSqlFragment` now also rejects `#`, MySQL's single-line comment marker, which previously passed through untouched in a `select`/`groupBy`/`orderBy.field`/`join.on` fragment.
+- `fix`: an `IN`/`NOT IN` condition with an empty array, and an empty `AND`/`OR`/`JOINS` array, now throw a descriptive error instead of silently building invalid SQL (`key IN ()`, or a bare `()` fragment) that only surfaced as an opaque syntax error from the database.
+- `fix`: `tsc --noEmit` (the `type:check` script, run by the pre-commit hook and CI) now also type-checks everything under `__tests__/` via `tsconfig.test.json` — previously excluded, which is how a type-level regression introduced earlier in this same change set reached `main` undetected.
+- `fix`: `lint`/`format`/`format:check` now target the `src` directory instead of the unquoted glob `src/**/*.ts`, which the shell expanded to `src/*/*.ts` before npm/eslint/prettier ever saw it — silently skipping every file directly under `src` (`setupTests.ts`) and every file two or more directories deep. Several previously-unlinted/-unformatted files were reformatted as a result.
+- `docs`: documented that `monitor`'s `QUERY_START`/`QUERY_END`/`QUERY_ERROR` events carry the raw, unredacted query `params`, and that `retryOptions` retries any query (including non-idempotent statements) without regard to idempotency — both in the README's new "Security & Operational Notes" section.
+
 ## [1.4.0] - 2026-09-04
 
 - `fix`: `createWhereClause` no longer throws `RangeError: Maximum call stack size exceeded` on a large `IN`/`NOT IN`/`BETWEEN` condition — `values.push(...value)` (spreading the array into a function call) replaced with a plain loop. Fixes #21 (item 1) / #22.