bun-query-builder 0.1.23 → 0.1.24

package/dist/browser.d.ts

@@ -1,5 +1,5 @@
 import type { BrowserConfig } from './types';
-import type { Faker } from 'ts-mocker';
+import type { Faker } from '@stacksjs/ts-faker';
 // Export types for external use
 export type { BrowserModelInstance, BrowserModelQueryBuilder };
 /**

package/dist/client.d.ts

@@ -32,9 +32,9 @@ export declare interface WhereRaw {
 export declare interface BaseSelectQueryBuilder<DB extends DatabaseSchema<any>, TTable extends keyof DB & string, TSelected, TJoined extends string = TTable,> {
   distinct: () => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   distinctOn: (...columns: (keyof DB[TTable]['columns'] & string | string)[]) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
-  selectRaw: (fragment: any) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
+  selectRaw: (fragment: SqlFragment) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   where: (expr: WhereExpression<DB[TTable]['columns']> | string, op?: WhereOperator, value?: any) => SelectQueryBuilder<DB, TTable, TSelected>
-  whereRaw: (fragment: any) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
+  whereRaw: (fragment: SqlFragment) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   whereColumn: (left: string, op: WhereOperator, right: string) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   orWhereColumn: (left: string, op: WhereOperator, right: string) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   whereIn: (column: keyof DB[TTable]['columns'] & string, values: any[] | { toSQL: () => any }) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
@@ -100,13 +100,13 @@ export declare interface BaseSelectQueryBuilder<DB extends DatabaseSchema<any>,
   crossJoin: <T2 extends keyof DB & string>(table: T2) => SelectQueryBuilder<DB, TTable, TSelected, TJoined | T2>
   crossJoinSub: (sub: { toSQL: () => any }, alias: string) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   groupBy: (...columns: (keyof DB[TTable]['columns'] & string | string)[]) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
-  groupByRaw: (fragment: any) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
+  groupByRaw: (fragment: SqlFragment) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   having: (expr: WhereExpression<any>) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
-  havingRaw: (fragment: any) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
+  havingRaw: (fragment: SqlFragment) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   addSelect: (...columns: (keyof DB[TTable]['columns'] & string | string)[]) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   select?: (columns: (keyof DB[TTable]['columns'] & string | string)[]) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   selectAll?: () => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
-  orderByRaw: (fragment: any) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
+  orderByRaw: (fragment: SqlFragment) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   union: (other: { toSQL: () => any }) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   unionAll: (other: { toSQL: () => any }) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
   forPage: (page: number, perPage: number) => SelectQueryBuilder<DB, TTable, TSelected, TJoined>
@@ -356,6 +356,28 @@ export declare interface TransactionOptions {
 declare type Primitive = string | number | boolean | bigint | Date | null | undefined;
 declare type ValueOrRef = Primitive;
 export type WhereOperator = '=' | '!=' | '<' | '>' | '<=' | '>=' | 'like' | 'in' | 'not in' | 'is' | 'is not';
+/**
+ * Brand for SQL fragments produced by Bun's `sql\`...\`` tagged-template
+ * (or any equivalent helper). Typed as `object` so the *Raw methods
+ * (`whereRaw`, `selectRaw`, `groupByRaw`, `havingRaw`, `orderByRaw`)
+ * refuse to compile when passed a bare string — concatenated user
+ * input (`whereRaw(\`status = '${req.body.s}'\`)`) was the canonical
+ * SQL-injection vector flagged by the audit as Q-3.
+ *
+ * Callers who legitimately need raw SQL use `sql\`...\`` which
+ * separates the SQL fragment from parameter values:
+ *
+ * ```ts
+ * import { sql } from 'bun'
+ * db.selectFrom('users').whereRaw(sql\`lower(name) = lower(${input})\`)
+ * ```
+ *
+ * The runtime guard in each *Raw method also rejects bare strings as
+ * a defense-in-depth backstop for `as any` casts.
+ *
+ * See stacksjs/stacks#1858 Q-3.
+ */
+export type SqlFragment = object;
 export type WhereExpression<TableColumns> = | Partial<{ [K in keyof TableColumns & string]: ValueOrRef | ValueOrRef[] }>
   | [key: keyof TableColumns & string, op: WhereOperator, value: ValueOrRef | ValueOrRef[]]
   | WhereRaw;

package/dist/config.d.ts

@@ -11,11 +11,6 @@ export declare function getPlaceholder(index: number): string;
  */
 export declare function getPlaceholders(count: number, startIndex?: number): string;
 export declare function getConfig(): Promise<QueryBuilderConfig>;
-/**
- * Programmatically set/override the query builder configuration.
- * This is useful when you want to configure bun-query-builder from
- * your application code rather than using a config file.
- */
 export declare function setConfig(userConfig: Partial<QueryBuilderConfig>): void;
 export declare const defaultConfig: QueryBuilderConfig;
 // For backwards compatibility — synchronous access with default fallback.

package/dist/drivers/sqlite.d.ts

@@ -18,7 +18,7 @@ export declare class SQLiteDriver implements DialectDriver {
   createEnumType(_enumTypeName: string, _values: string[]): string;
   createTable(table: TablePlan): string;
   createIndex(tableName: string, index: IndexPlan): string;
-  addForeignKey(tableName: string, columnName: string, refTable: string, refColumn: string, onDelete?: string, onUpdate?: string): string;
+  addForeignKey(_tableName: string, _columnName: string, _refTable: string, _refColumn: string, _onDelete?: string, _onUpdate?: string): string;
   addColumn(tableName: string, column: ColumnPlan): string;
   modifyColumn(tableName: string, column: ColumnPlan): string;
   dropTable(tableName: string): string;

package/dist/orm.d.ts

@@ -1,5 +1,5 @@
 import { Database, type SQLQueryBindings } from 'bun:sqlite';
-import type { Faker } from 'ts-mocker';
+import type { Faker } from '@stacksjs/ts-faker';
 export type {
   ModelInstance,
   ModelQueryBuilder,

package/dist/schema.d.ts

@@ -1,4 +1,4 @@
-import type { Faker } from 'ts-mocker';
+import type { Faker } from '@stacksjs/ts-faker';
 /**
  * # `defineModel(model)`
  *