bun-query-builder 0.1.20 → 0.1.23

package/dist/actions/data.d.ts

@@ -3,6 +3,14 @@
  */
 // eslint-disable-next-line pickier/no-unused-vars
 export declare function exportData(tableName: string, options?: ExportOptions): Promise<void>;
+/**
+ * Import data into a table
+ */
+export declare function importData(tableName: string, filePath: string, options?: ImportOptions): Promise<void>;
+/**
+ * Dump database or specific tables to SQL
+ */
+export declare function dumpDatabase(options?: DumpOptions): Promise<void>;
 export declare interface ExportOptions {
   format?: 'json' | 'csv' | 'sql'
   output?: string

package/dist/bin/cli.js

@@ -11663,9 +11663,6 @@ async function getConfig() {
   return _config;
 }
 function setConfig(userConfig) {
-  if (config5 === undefined || config5.dialect === undefined) {
-    config5 = { ...defaultConfig4 };
-  }
   Object.assign(config5, userConfig);
   if (userConfig.database) {
     config5.database = { ...config5.database, ...userConfig.database };
@@ -12380,6 +12377,7 @@ function createQueryBuilder(state) {
   function applyCondition(expr) {
     if (Array.isArray(expr)) {
       const [col, op, val] = expr;
+      validateIdentifier(col, "where(column)");
       const colName = String(col);
       switch (op) {
         case "in":
@@ -12397,9 +12395,12 @@ function createQueryBuilder(state) {
         case "like":
           return _sql.unsafe(`${colName} LIKE ${getPlaceholder(1)}`, [val]);
         case "is":
-          return _sql.unsafe(`${colName} IS ${val}`);
-        case "is not":
-          return _sql.unsafe(`${colName} IS NOT ${val}`);
+        case "is not": {
+          if (val !== null && val !== undefined) {
+            throw new TypeError(`[query-builder] where(..., '${op}', ?): operator '${op}' only accepts NULL/undefined as value, got ${typeof val} (${String(val)})`);
+          }
+          return _sql.unsafe(`${colName} IS ${op === "is not" ? "NOT " : ""}NULL`);
+        }
         case "!=":
           return _sql.unsafe(`${colName} <> ${getPlaceholder(1)}`, [val]);
         case "<":
@@ -12407,8 +12408,9 @@ function createQueryBuilder(state) {
         case "<=":
         case ">=":
         case "=":
-        default:
           return _sql.unsafe(`${colName} ${op} ${getPlaceholder(1)}`, [val]);
+        default:
+          throw new TypeError(`[query-builder] where(..., '${String(op)}', ?): unsupported operator. Allowed: =, !=, <>, <, <=, >, >=, like, in, not in, is, is not`);
       }
     }
     if ("raw" in expr) {
@@ -12421,6 +12423,7 @@ function createQueryBuilder(state) {
     const allParams = [];
     let paramIndex = 1;
     for (const key of keys) {
+      validateIdentifier(key, "where(object key)");
       const value = expr[key];
       if (Array.isArray(value)) {
         const placeholders = getPlaceholders(value.length, paramIndex);
@@ -12609,17 +12612,17 @@ function createQueryBuilder(state) {
         return;
       const parentTable = String(table);
       const parentPk = meta.primaryKeys[parentTable] ?? "id";
-      validateIdentifier(resolved.pivotTable, "wherePivot auto-join (pivot table)");
-      validateIdentifier(resolved.fkParent, "wherePivot auto-join (parent FK)");
-      validateIdentifier(parentTable, "wherePivot auto-join (parent table)");
-      validateIdentifier(parentPk, "wherePivot auto-join (parent PK)");
+      validateIdentifier2(resolved.pivotTable, "wherePivot auto-join (pivot table)");
+      validateIdentifier2(resolved.fkParent, "wherePivot auto-join (parent FK)");
+      validateIdentifier2(parentTable, "wherePivot auto-join (parent table)");
+      validateIdentifier2(parentPk, "wherePivot auto-join (parent PK)");
       built = sql`${ensureBuilt()} LEFT JOIN ${sql(resolved.pivotTable)} ON ${sql(`${resolved.pivotTable}.${resolved.fkParent}`)} = ${sql(`${parentTable}.${parentPk}`)}`;
       text = `${text} LEFT JOIN ${resolved.pivotTable} ON ${resolved.pivotTable}.${resolved.fkParent} = ${parentTable}.${parentPk}`;
       joinedTables.add(resolved.pivotTable);
     };
     const whereConditions = [];
     const whereParams = [];
-    const validateIdentifier = (name, context) => {
+    const validateIdentifier2 = (name, context) => {
       if (!SQL_PATTERNS.IDENTIFIER.test(name)) {
         const contextMsg = context ? ` in ${context}` : "";
         throw new Error(`[query-builder] Invalid identifier${contextMsg}: '${name}'. Identifiers must start with a letter or underscore and contain only alphanumeric characters, underscores, and dots.`);
@@ -12643,18 +12646,56 @@ function createQueryBuilder(state) {
         }
       }
     };
+    const SAFE_WHERE_OPERATORS = new Set([
+      "=",
+      "!=",
+      "<>",
+      "<",
+      "<=",
+      ">",
+      ">=",
+      "like",
+      "not like",
+      "ilike",
+      "not ilike",
+      "in",
+      "not in",
+      "is",
+      "is not",
+      "between",
+      "not between"
+    ]);
+    function assertSafeWhereOperator(op, context) {
+      if (typeof op !== "string")
+        throw new TypeError(`[query-builder] ${context}: operator must be a string, got ${typeof op}`);
+      const lower = op.toLowerCase();
+      if (!SAFE_WHERE_OPERATORS.has(lower))
+        throw new TypeError(`[query-builder] ${context}: refusing to use '${op}' as a SQL operator \u2014 not in the allowed set (${[...SAFE_WHERE_OPERATORS].join(", ")})`);
+      return op;
+    }
+    function formatSubqueryValue(val) {
+      if (val === null)
+        return "NULL";
+      if (typeof val === "number" && Number.isFinite(val))
+        return String(val);
+      if (typeof val === "boolean")
+        return val ? "1" : "0";
+      if (typeof val === "string")
+        return `'${val.replace(/'/g, "''")}'`;
+      throw new TypeError(`[query-builder] subquery condition: refusing to interpolate value of type ${typeof val}`);
+    }
     const buildHasSubquery = (parentTable, targetTable, pk, callback) => {
-      validateIdentifier(parentTable, "relationship subquery (parent table)");
-      validateIdentifier(targetTable, "relationship subquery (target table)");
-      validateIdentifier(pk, "relationship subquery (primary key)");
+      validateIdentifier2(parentTable, "relationship subquery (parent table)");
+      validateIdentifier2(targetTable, "relationship subquery (target table)");
+      validateIdentifier2(pk, "relationship subquery (primary key)");
       const fk = `${parentTable.endsWith("s") ? parentTable.slice(0, -1) : parentTable}_id`;
-      validateIdentifier(fk, "relationship subquery (foreign key)");
+      validateIdentifier2(fk, "relationship subquery (foreign key)");
       let subquerySQL = `SELECT 1 FROM ${targetTable} WHERE ${targetTable}.${fk} = ${parentTable}.${pk}`;
       if (callback) {
         const subQb = {
           where: (col, op, val) => {
-            validateIdentifier(col, "relationship subquery condition");
-            return `${targetTable}.${col} ${op} ${typeof val === "string" ? `'${val}'` : val}`;
+            validateIdentifier2(col, "relationship subquery condition");
+            return `${targetTable}.${col} ${assertSafeWhereOperator(op, "whereHas callback")} ${formatSubqueryValue(val)}`;
           }
         };
         const condition = callback(subQb);
@@ -12665,16 +12706,16 @@ function createQueryBuilder(state) {
       return subquerySQL;
     };
     const buildBelongsToSubquery = (parentTable, targetTable, pk, callback) => {
-      validateIdentifier(parentTable, "relationship subquery (parent table)");
-      validateIdentifier(targetTable, "relationship subquery (target table)");
-      validateIdentifier(pk, "relationship subquery (primary key)");
+      validateIdentifier2(parentTable, "relationship subquery (parent table)");
+      validateIdentifier2(targetTable, "relationship subquery (target table)");
+      validateIdentifier2(pk, "relationship subquery (primary key)");
       const fk = `${targetTable.endsWith("s") ? targetTable.slice(0, -1) : targetTable}_id`;
-      validateIdentifier(fk, "relationship subquery (foreign key)");
+      validateIdentifier2(fk, "relationship subquery (foreign key)");
       let subquerySQL = `SELECT 1 FROM ${targetTable} WHERE ${targetTable}.${pk} = ${parentTable}.${fk}`;
       if (callback) {
         const subQb = {
           where: (col, op, val) => {
-            validateIdentifier(col, "relationship subquery condition");
+            validateIdentifier2(col, "relationship subquery condition");
             return `${targetTable}.${col} ${op} ${typeof val === "string" ? `'${val}'` : val}`;
           }
         };
@@ -12686,24 +12727,24 @@ function createQueryBuilder(state) {
       return subquerySQL;
     };
     const buildBelongsToManySubquery = (parentTable, targetTable, pk, targetPk, callback, relationKey) => {
-      validateIdentifier(parentTable, "relationship subquery (parent table)");
-      validateIdentifier(targetTable, "relationship subquery (target table)");
-      validateIdentifier(pk, "relationship subquery (primary key)");
-      validateIdentifier(targetPk, "relationship subquery (target primary key)");
+      validateIdentifier2(parentTable, "relationship subquery (parent table)");
+      validateIdentifier2(targetTable, "relationship subquery (target table)");
+      validateIdentifier2(pk, "relationship subquery (primary key)");
+      validateIdentifier2(targetPk, "relationship subquery (target primary key)");
       const resolved = relationKey && meta ? resolvePivot(meta, parentTable, relationKey, { singularize, models: meta.models }) : null;
       const a = singularize(parentTable);
       const b = singularize(targetTable);
       const pivot = resolved?.pivotTable ?? [a, b].sort().join("_");
       const fkA = resolved?.fkParent ?? `${a}_id`;
       const fkB = resolved?.fkRelated ?? `${b}_id`;
-      validateIdentifier(pivot, "relationship subquery (pivot table)");
-      validateIdentifier(fkA, "relationship subquery (foreign key A)");
-      validateIdentifier(fkB, "relationship subquery (foreign key B)");
+      validateIdentifier2(pivot, "relationship subquery (pivot table)");
+      validateIdentifier2(fkA, "relationship subquery (foreign key A)");
+      validateIdentifier2(fkB, "relationship subquery (foreign key B)");
       let subquerySQL = `SELECT 1 FROM ${pivot} JOIN ${targetTable} ON ${targetTable}.${targetPk} = ${pivot}.${fkB} WHERE ${pivot}.${fkA} = ${parentTable}.${pk}`;
       if (callback) {
         const subQb = {
           where: (col, op, val) => {
-            validateIdentifier(col, "relationship subquery condition");
+            validateIdentifier2(col, "relationship subquery condition");
             return `${targetTable}.${col} ${op} ${typeof val === "string" ? `'${val}'` : val}`;
           }
         };
@@ -12715,24 +12756,24 @@ function createQueryBuilder(state) {
       return subquerySQL;
     };
     const buildHasCountSubquery = (parentTable, targetTable, pk) => {
-      validateIdentifier(parentTable, "withCount (parent table)");
-      validateIdentifier(targetTable, "withCount (target table)");
-      validateIdentifier(pk, "withCount (primary key)");
+      validateIdentifier2(parentTable, "withCount (parent table)");
+      validateIdentifier2(targetTable, "withCount (target table)");
+      validateIdentifier2(pk, "withCount (primary key)");
       const fk = `${parentTable.endsWith("s") ? parentTable.slice(0, -1) : parentTable}_id`;
-      validateIdentifier(fk, "withCount (foreign key)");
+      validateIdentifier2(fk, "withCount (foreign key)");
       return `(SELECT COUNT(*) FROM ${targetTable} WHERE ${targetTable}.${fk} = ${parentTable}.${pk})`;
     };
     const buildBelongsToManyCountSubquery = (parentTable, targetTable, pk, relationKey) => {
-      validateIdentifier(parentTable, "withCount (parent table)");
-      validateIdentifier(targetTable, "withCount (target table)");
-      validateIdentifier(pk, "withCount (primary key)");
+      validateIdentifier2(parentTable, "withCount (parent table)");
+      validateIdentifier2(targetTable, "withCount (target table)");
+      validateIdentifier2(pk, "withCount (primary key)");
       const resolved = relationKey && meta ? resolvePivot(meta, parentTable, relationKey, { singularize, models: meta.models }) : null;
       const a = singularize(parentTable);
       const b = singularize(targetTable);
       const pivot = resolved?.pivotTable ?? [a, b].sort().join("_");
       const fkA = resolved?.fkParent ?? `${a}_id`;
-      validateIdentifier(pivot, "withCount (pivot table)");
-      validateIdentifier(fkA, "withCount (foreign key)");
+      validateIdentifier2(pivot, "withCount (pivot table)");
+      validateIdentifier2(fkA, "withCount (foreign key)");
       return `(SELECT COUNT(*) FROM ${pivot} WHERE ${pivot}.${fkA} = ${parentTable}.${pk})`;
     };
     const applyPivotColumnsToQuery = () => {
@@ -12744,7 +12785,7 @@ function createQueryBuilder(state) {
         if (!resolved)
           continue;
         for (const col of columns2) {
-          validateIdentifier(col, "withPivot");
+          validateIdentifier2(col, "withPivot");
         }
         const pivotColumnsStr = columns2.map((col) => `${resolved.pivotTable}.${col} AS pivot_${col}`);
         allPivotColumns.push(...pivotColumnsStr);
@@ -13294,8 +13335,8 @@ function createQueryBuilder(state) {
         if (!resolved) {
           throw new Error(`[query-builder] Relationship '${relation}' is not a belongsToMany relationship on table '${String(table)}'`);
         }
-        validateIdentifier(resolved.pivotTable, "wherePivot (pivot table)");
-        validateIdentifier(column, "wherePivot (column)");
+        validateIdentifier2(resolved.pivotTable, "wherePivot (pivot table)");
+        validateIdentifier2(column, "wherePivot (column)");
         ensurePivotJoined(resolved);
         const op = value === undefined ? "=" : String(opOrValue);
         const val = value === undefined ? opOrValue : value;
@@ -13317,8 +13358,8 @@ function createQueryBuilder(state) {
         if (!resolved) {
           throw new Error(`[query-builder] Relationship '${relation}' is not a belongsToMany relationship on table '${String(table)}'`);
         }
-        validateIdentifier(resolved.pivotTable, "wherePivotIn (pivot table)");
-        validateIdentifier(column, "wherePivotIn (column)");
+        validateIdentifier2(resolved.pivotTable, "wherePivotIn (pivot table)");
+        validateIdentifier2(column, "wherePivotIn (column)");
         ensurePivotJoined(resolved);
         const placeholders = getPlaceholders(values.length, whereParams.length + 1);
         const clause = `${resolved.pivotTable}.${column} IN (${placeholders})`;
@@ -13338,8 +13379,8 @@ function createQueryBuilder(state) {
         if (!resolved) {
           throw new Error(`[query-builder] Relationship '${relation}' is not a belongsToMany relationship on table '${String(table)}'`);
         }
-        validateIdentifier(resolved.pivotTable, "wherePivotNotIn (pivot table)");
-        validateIdentifier(column, "wherePivotNotIn (column)");
+        validateIdentifier2(resolved.pivotTable, "wherePivotNotIn (pivot table)");
+        validateIdentifier2(column, "wherePivotNotIn (column)");
         ensurePivotJoined(resolved);
         const placeholders = getPlaceholders(values.length, whereParams.length + 1);
         const clause = `${resolved.pivotTable}.${column} NOT IN (${placeholders})`;
@@ -13359,8 +13400,8 @@ function createQueryBuilder(state) {
         if (!resolved) {
           throw new Error(`[query-builder] Relationship '${relation}' is not a belongsToMany relationship on table '${String(table)}'`);
         }
-        validateIdentifier(resolved.pivotTable, "wherePivotNull (pivot table)");
-        validateIdentifier(column, "wherePivotNull (column)");
+        validateIdentifier2(resolved.pivotTable, "wherePivotNull (pivot table)");
+        validateIdentifier2(column, "wherePivotNull (column)");
         ensurePivotJoined(resolved);
         const clause = `${resolved.pivotTable}.${column} IS NULL`;
         whereConditions.push(clause);
@@ -13378,8 +13419,8 @@ function createQueryBuilder(state) {
         if (!resolved) {
           throw new Error(`[query-builder] Relationship '${relation}' is not a belongsToMany relationship on table '${String(table)}'`);
         }
-        validateIdentifier(resolved.pivotTable, "wherePivotNotNull (pivot table)");
-        validateIdentifier(column, "wherePivotNotNull (column)");
+        validateIdentifier2(resolved.pivotTable, "wherePivotNotNull (pivot table)");
+        validateIdentifier2(column, "wherePivotNotNull (column)");
         ensurePivotJoined(resolved);
         const clause = `${resolved.pivotTable}.${column} IS NOT NULL`;
         whereConditions.push(clause);
@@ -13612,10 +13653,14 @@ function createQueryBuilder(state) {
         return this;
       },
       whereDate(column, op, date) {
+        validateIdentifier2(column, "whereDate(column)");
+        const dateString = date instanceof Date ? date.toISOString() : typeof date === "string" ? date : (() => {
+          throw new TypeError(`[query-builder] whereDate(date): expected string or Date, got ${typeof date}`);
+        })();
         const keyword = SQL_PATTERNS.WHERE.test(text) ? "AND" : "WHERE";
         const idx = whereParams.length + 1;
         text += ` ${keyword} ${column} ${op} ${getPlaceholder(idx)}`;
-        whereParams.push(String(date));
+        whereParams.push(dateString);
         built = null;
         return this;
       },
@@ -13626,12 +13671,16 @@ function createQueryBuilder(state) {
         return this;
       },
       whereColumn(left, op, right) {
+        validateIdentifier2(left, "whereColumn(left)");
+        validateIdentifier2(right, "whereColumn(right)");
         const keyword = SQL_PATTERNS.WHERE.test(text) ? "AND" : "WHERE";
         text += ` ${keyword} ${left} ${op} ${right}`;
         built = null;
         return this;
       },
       orWhereColumn(left, op, right) {
+        validateIdentifier2(left, "orWhereColumn(left)");
+        validateIdentifier2(right, "orWhereColumn(right)");
         text += ` OR ${left} ${op} ${right}`;
         built = null;
         return this;
@@ -13851,11 +13900,15 @@ function createQueryBuilder(state) {
         return this;
       },
       limit(n) {
+        if (!Number.isFinite(n) || n < 0 || !Number.isInteger(n))
+          throw new TypeError(`[bun-query-builder] limit(n): expected non-negative integer, got ${n}`);
         text = SQL_PATTERNS.LIMIT.test(text) ? text.replace(SQL_PATTERNS.LIMIT, ` LIMIT ${n}`) : `${text} LIMIT ${n}`;
         built = null;
         return this;
       },
       offset(n) {
+        if (!Number.isFinite(n) || n < 0 || !Number.isInteger(n))
+          throw new TypeError(`[bun-query-builder] offset(n): expected non-negative integer, got ${n}`);
         text = SQL_PATTERNS.OFFSET.test(text) ? text.replace(SQL_PATTERNS.OFFSET, ` OFFSET ${n}`) : `${text} OFFSET ${n}`;
         built = null;
         return this;
@@ -14128,19 +14181,25 @@ function createQueryBuilder(state) {
         includeTrashed = true;
         onlyTrashed = true;
         const softDeleteColumn = config5.softDeletes?.column || "deleted_at";
-        if (text.includes("WHERE")) {
-          text = text.replace(/WHERE/, `WHERE ${table}.${softDeleteColumn} IS NOT NULL AND`);
-        } else {
-          text = `${text} WHERE ${table}.${softDeleteColumn} IS NOT NULL`;
-        }
+        const splice = (raw, predicate2) => {
+          const upper = raw.toUpperCase();
+          let depth = 0;
+          for (let i = 0;i < raw.length; i++) {
+            const c = raw[i];
+            if (c === "(")
+              depth++;
+            else if (c === ")")
+              depth--;
+            else if (depth === 0 && upper.substring(i, i + 5) === "WHERE" && (i === 0 || /\s/.test(raw[i - 1] ?? "")) && /\s/.test(raw[i + 5] ?? "")) {
+              return `${raw.substring(0, i)}WHERE ${predicate2} AND ${raw.substring(i + 6)}`;
+            }
+          }
+          return `${raw} WHERE ${predicate2}`;
+        };
+        const predicate = `${table}.${softDeleteColumn} IS NOT NULL`;
+        text = splice(text, predicate);
         const currentSql = String(ensureBuilt());
-        if (currentSql.includes("WHERE")) {
-          const newSql = currentSql.replace(/WHERE/, `WHERE ${table}.${softDeleteColumn} IS NOT NULL AND`);
-          built = sql([newSql]);
-        } else {
-          const newSql = `${currentSql} WHERE ${table}.${softDeleteColumn} IS NOT NULL`;
-          built = sql([newSql]);
-        }
+        built = sql([splice(currentSql, predicate)]);
         return this;
       },
       scope(name, value) {
@@ -14314,7 +14373,15 @@ function createQueryBuilder(state) {
       },
       async count() {
         const fromIdx = text.indexOf(" FROM ");
-        const countText = fromIdx !== -1 ? `SELECT COUNT(*) as c${text.substring(fromIdx)}` : `SELECT COUNT(*) as c FROM ${table}`;
+        const hasGroupBy = / GROUP BY /i.test(text);
+        let countText;
+        if (hasGroupBy) {
+          countText = `SELECT COUNT(*) as c FROM (${text}) AS _bqb_count_sub`;
+        } else if (fromIdx !== -1) {
+          countText = `SELECT COUNT(*) as c${text.substring(fromIdx)}`;
+        } else {
+          countText = `SELECT COUNT(*) as c FROM ${table}`;
+        }
         const cHooks = config5.hooks;
         const cHasHooks = cHooks && (cHooks.onQueryStart || cHooks.onQueryEnd || cHooks.onQueryError || cHooks.startSpan);
         if (!config5.softDeletes?.enabled && !useCache && !timeoutMs && !abortSignal && !cHasHooks) {
@@ -14738,7 +14805,7 @@ function createQueryBuilder(state) {
       let sqlText = "";
       const params = [];
       const isPostgres = config5.dialect === "postgres";
-      const quoteId = isPostgres ? (id) => `"${id}"` : config5.dialect === "mysql" ? (id) => `\`${id}\`` : (id) => id;
+      const quoteId = isPostgres ? (id) => `"${String(id).replace(/"/g, '""')}"` : config5.dialect === "mysql" ? (id) => `\`${String(id).replace(/`/g, "``")}\`` : (id) => `"${String(id).replace(/"/g, '""')}"`;
       const getPlaceholder2 = isPostgres ? (index) => `$${index + 1}` : (_index) => "?";
       return {
         values(data) {
@@ -14871,11 +14938,11 @@ function createQueryBuilder(state) {
     updateTable(table) {
       let built;
       const params = [];
-      const quoteId = (id) => {
-        if (config5.dialect === "mysql") {
-          return `\`${id}\``;
-        }
-        return `"${id}"`;
+      const quoteId = (identifier) => {
+        const s = String(identifier);
+        if (config5.dialect === "mysql")
+          return `\`${s.replace(/`/g, "``")}\``;
+        return `"${s.replace(/"/g, '""')}"`;
       };
       let sqlText = `UPDATE ${quoteId(String(table))}`;
       return {
@@ -14979,11 +15046,11 @@ function createQueryBuilder(state) {
       };
     },
     deleteFrom(table) {
-      const quoteId = (id) => {
-        if (config5.dialect === "mysql") {
-          return `\`${id}\``;
-        }
-        return `"${id}"`;
+      const quoteId = (identifier) => {
+        const s = String(identifier);
+        if (config5.dialect === "mysql")
+          return `\`${s.replace(/`/g, "``")}\``;
+        return `"${s.replace(/"/g, '""')}"`;
       };
       const quotedTable = quoteId(String(table));
       let sqlText = `DELETE FROM ${quotedTable}`;
@@ -15267,6 +15334,10 @@ function createQueryBuilder(state) {
       };
     },
     async insertOrIgnore(table, values) {
+      if (config5.dialect === "mysql") {
+        const built2 = bunSql`INSERT IGNORE INTO ${bunSql(String(table))} ${bunSql(values)}`;
+        return built2.execute();
+      }
       const built = bunSql`INSERT INTO ${bunSql(String(table))} ${bunSql(values)} ON CONFLICT DO NOTHING`;
       return built.execute();
     },
@@ -15302,7 +15373,15 @@ function createQueryBuilder(state) {
     async upsert(table, rows, conflictColumns, mergeColumns) {
       const targetCols = conflictColumns.map((c) => String(c));
       const setCols = (mergeColumns ?? []).map((c) => String(c));
-      const built = bunSql`INSERT INTO ${bunSql(String(table))} ${bunSql(rows)} ON CONFLICT (${bunSql(targetCols)}) DO UPDATE SET ${bunSql(setCols.reduce((acc, c) => ({ ...acc, [c]: bunSql(`EXCLUDED.${c}`) }), {}))}`;
+      if (config5.dialect === "mysql") {
+        const updateList2 = setCols.map((c) => `\`${c.replace(/`/g, "``")}\` = VALUES(\`${c.replace(/`/g, "``")}\`)`).join(", ");
+        const built2 = bunSql`INSERT INTO ${bunSql(String(table))} ${bunSql(rows)} ON DUPLICATE KEY UPDATE ${bunSql.unsafe(updateList2)}`;
+        return built2.execute();
+      }
+      const isPostgres = config5.dialect === "postgres";
+      const quoteCol = (column) => isPostgres ? `"${column.replace(/"/g, '""')}"` : `"${column.replace(/"/g, '""')}"`;
+      const updateList = setCols.map((column) => `${quoteCol(column)} = EXCLUDED.${quoteCol(column)}`).join(", ");
+      const built = bunSql`INSERT INTO ${bunSql(String(table))} ${bunSql(rows)} ON CONFLICT (${bunSql(targetCols)}) DO UPDATE SET ${bunSql.unsafe(updateList)}`;
       return built.execute();
     },
     async save(table, values) {
@@ -24067,6 +24146,14 @@ var init_src = __esm(async () => {
 
 // src/orm.ts
 import { Database as Database2 } from "bun:sqlite";
+function assertValidIdentifier(name, context) {
+  if (typeof name !== "string" || name.length === 0)
+    throw new TypeError(`[bun-query-builder] ${context}: identifier must be a non-empty string, got ${typeof name}`);
+  if (name.length > 64)
+    throw new TypeError(`[bun-query-builder] ${context}: identifier '${name}' exceeds 64 chars`);
+  if (!SAFE_SQL_IDENTIFIER.test(name))
+    throw new TypeError(`[bun-query-builder] ${context}: identifier '${name}' contains characters outside [A-Za-z0-9_] \u2014 refusing to interpolate into SQL`);
+}
 function getModelFromRegistry(name) {
   if (!_getModel) {
     try {
@@ -24617,14 +24704,21 @@ class BelongsToManyRelationBuilder {
     return this;
   }
   orderBy(column, direction = "asc") {
+    assertValidIdentifier(column, "orderBy(column)");
+    if (direction !== "asc" && direction !== "desc")
+      throw new TypeError(`[bun-query-builder] orderBy(direction): expected 'asc' or 'desc', got '${direction}'`);
     this._orderBy.push(`${column} ${direction.toUpperCase()}`);
     return this;
   }
   limit(n2) {
+    if (!Number.isFinite(n2) || n2 < 0 || !Number.isInteger(n2))
+      throw new TypeError(`[bun-query-builder] limit(n): expected non-negative integer, got ${n2}`);
     this._limit = n2;
     return this;
   }
   offset(n2) {
+    if (!Number.isFinite(n2) || n2 < 0 || !Number.isInteger(n2))
+      throw new TypeError(`[bun-query-builder] offset(n): expected non-negative integer, got ${n2}`);
     this._offset = n2;
     return this;
   }
@@ -24851,18 +24945,22 @@ class ModelQueryBuilder {
     return this;
   }
   whereNull(column) {
+    assertValidIdentifier(column, "whereNull(column)");
     this._wheres.push({ column, operator: "=", value: null, boolean: "and" });
     return this;
   }
   orWhereNull(column) {
+    assertValidIdentifier(column, "orWhereNull(column)");
     this._wheres.push({ column, operator: "=", value: null, boolean: "or" });
     return this;
   }
   whereNotNull(column) {
+    assertValidIdentifier(column, "whereNotNull(column)");
     this._wheres.push({ column, operator: "!=", value: null, boolean: "and" });
     return this;
   }
   orWhereNotNull(column) {
+    assertValidIdentifier(column, "orWhereNotNull(column)");
     this._wheres.push({ column, operator: "!=", value: null, boolean: "or" });
     return this;
   }
@@ -24909,13 +25007,19 @@ class ModelQueryBuilder {
     return this;
   }
   whereBetween(column, range) {
+    assertValidIdentifier(column, "whereBetween(column)");
     this._wheres.push({ column, operator: ">=", value: range[0], boolean: "and" });
     this._wheres.push({ column, operator: "<=", value: range[1], boolean: "and" });
     return this;
   }
   whereNotBetween(column, range) {
-    this._wheres.push({ column, operator: "<", value: range[0], boolean: "and" });
-    this._wheres.push({ column, operator: ">", value: range[1], boolean: "or" });
+    assertValidIdentifier(column, "whereNotBetween(column)");
+    const col = column;
+    this._wheres.push({
+      raw: `(${col} < ? OR ${col} > ?)`,
+      rawParams: [range[0], range[1]],
+      boolean: "and"
+    });
     return this;
   }
   when(condition, callback) {
@@ -24925,6 +25029,9 @@ class ModelQueryBuilder {
     return this;
   }
   orderBy(column, direction = "asc") {
+    assertValidIdentifier(column, "orderBy(column)");
+    if (direction !== "asc" && direction !== "desc")
+      throw new TypeError(`[bun-query-builder] orderBy(direction): expected 'asc' or 'desc', got '${direction}'`);
     this._orderBy.push({ column, direction });
     return this;
   }
@@ -25169,6 +25276,7 @@ class ModelQueryBuilder {
     return results[0];
   }
   increment(column, amount = 1) {
+    assertValidIdentifier(column, "increment(column)");
     const db = getDatabase();
     const params = [amount];
     let sql2 = `UPDATE ${this._definition.table} SET ${column} = ${column} + ?`;
@@ -25225,6 +25333,7 @@ class ModelQueryBuilder {
     };
   }
   pluck(column) {
+    assertValidIdentifier(column, "pluck(column)");
     const db = getDatabase();
     const params = [];
     let sql2 = `SELECT ${column} FROM ${this._definition.table}`;
@@ -25242,6 +25351,7 @@ class ModelQueryBuilder {
     return rows.map((r2) => r2[column]);
   }
   aggregate(fn, column) {
+    assertValidIdentifier(column, `${fn}(column)`);
     const db = getDatabase();
     const params = [];
     let sql2 = `SELECT ${fn}(${column}) as v FROM ${this._definition.table}`;
@@ -25518,8 +25628,9 @@ async function seedModel(definition, count, faker) {
     db.run(`INSERT INTO ${definition.table} (${columns.join(", ")}) VALUES (${columns.map(() => "?").join(", ")})`, Object.values(data));
   }
 }
-var _getModel = null, globalDb = null, snakeCaseCache, tableNameCache, relationCache, preparedStatementCache;
+var SAFE_SQL_IDENTIFIER, _getModel = null, globalDb = null, snakeCaseCache, tableNameCache, relationCache, preparedStatementCache;
 var init_orm = __esm(() => {
+  SAFE_SQL_IDENTIFIER = /^[A-Z_][A-Z0-9_]*$/i;
   snakeCaseCache = new Map;
   tableNameCache = new Map;
   relationCache = new Map;
@@ -25529,6 +25640,7 @@ var init_orm = __esm(() => {
 // src/model.ts
 var exports_model = {};
 __export(exports_model, {
+  registerModel: () => registerModel,
   registerBrowserModels: () => registerBrowserModels,
   hasModel: () => hasModel,
   getModelRegistry: () => getModelRegistry,
@@ -25552,6 +25664,10 @@ function hasModel(name) {
 function clearModelRegistry() {
   modelRegistry.clear();
 }
+function registerModel(name, model) {
+  modelRegistry.set(name, model);
+  return model;
+}
 function isClientSide() {
   return typeof window !== "undefined" && typeof document !== "undefined";
 }
@@ -25568,7 +25684,7 @@ function defineModel(definition) {
       getName: () => definition.name
     });
   }
-  modelRegistry.set(definition.name, model);
+  registerModel(definition.name, model);
   return model;
 }
 function registerBrowserModels(models) {
@@ -29921,7 +30037,7 @@ function getPrefix() {
 }
 var prefix = getPrefix();
 // package.json
-var version2 = "0.1.20";
+var version2 = "0.1.23";
 
 // bin/cli.ts
 init_actions();