bun-query-builder 0.1.26 → 0.1.28

package/dist/src/index.js

@@ -11762,6 +11762,7 @@ var init_config = __esm(() => {
 // src/db.ts
 var {SQL } = globalThis.Bun;
 import { Database } from "bun:sqlite";
+import process19 from "process";
 
 class SQLiteWrapper {
   db;
@@ -11975,6 +11976,16 @@ function createSQLiteSQL(filename) {
   return sqlFunction;
 }
 function createConnectionString(dialect, dbConfig) {
+  if ((dialect === "postgres" || dialect === "mysql") && process19.env.DB_CONNECTION === dialect) {
+    const e = process19.env;
+    const envDb = (e.DB_DATABASE || dbConfig.database || "").replace(/^['"]|['"]$/g, "");
+    const envUser = e.DB_USERNAME || dbConfig.username;
+    const envPass = e.DB_PASSWORD ?? dbConfig.password ?? "";
+    const envHost = e.DB_HOST || dbConfig.host || "localhost";
+    const envPort = e.DB_PORT || dbConfig.port;
+    const scheme = dialect === "postgres" ? "postgres" : "mysql";
+    return `${scheme}://${envUser}:${envPass}@${envHost}${envPort ? `:${envPort}` : ""}/${envDb}`;
+  }
   if (dbConfig.url) {
     return dbConfig.url;
   }
@@ -12392,13 +12403,29 @@ class QueryCache {
       this.cache.delete(key);
       return null;
     }
+    this.cache.delete(key);
+    this.cache.set(key, entry);
     return entry.data;
   }
   set(key, data, ttlMs) {
+    if (this.cache.has(key))
+      this.cache.delete(key);
     if (this.cache.size >= this.maxSize) {
-      const firstKey = this.cache.keys().next().value;
-      if (firstKey)
-        this.cache.delete(firstKey);
+      const now = Date.now();
+      let evicted = false;
+      for (const [k, v] of this.cache) {
+        if (now > v.expiresAt) {
+          this.cache.delete(k);
+          evicted = true;
+          if (this.cache.size < this.maxSize)
+            break;
+        }
+      }
+      if (!evicted) {
+        const lruKey = this.cache.keys().next().value;
+        if (lruKey !== undefined)
+          this.cache.delete(lruKey);
+      }
     }
     this.cache.set(key, {
       data,
@@ -12469,6 +12496,9 @@ function reorderSelectClauses(sql) {
       continue;
     if (i === 0 || !/\s/.test(sql[i - 1]))
       continue;
+    const lead = sql.charCodeAt(i) & ~32;
+    if (lead !== 71 && lead !== 79 && lead !== 72 && lead !== 76 && lead !== 87)
+      continue;
     const rest = sql.slice(i);
     for (const { key, tokens } of KEYWORDS) {
       const m = rest.match(tokens);
@@ -13245,28 +13275,6 @@ function createQueryBuilder(state) {
           if (!rels) {
             return fromTable;
           }
-          const _buildConditionalJoin = (baseJoinCondition, targetTable2) => {
-            let joinCondition = baseJoinCondition;
-            if (config5.softDeletes?.enabled && config5.softDeletes?.defaultFilter) {
-              const softDeleteColumn = config5.softDeletes.column || "deleted_at";
-              joinCondition = `${joinCondition} AND ${targetTable2}.${softDeleteColumn} IS NULL`;
-            }
-            if (!condition)
-              return joinCondition;
-            const conditionBuilder = {
-              where: (col, op, val) => {
-                const valStr = typeof val === "string" ? `'${val}'` : String(val);
-                return `${targetTable2}.${col} ${op} ${valStr}`;
-              }
-            };
-            try {
-              const additionalCondition = condition(conditionBuilder);
-              if (additionalCondition && typeof additionalCondition === "string") {
-                return `${joinCondition} AND ${additionalCondition}`;
-              }
-            } catch {}
-            return joinCondition;
-          };
           const addSoftDeleteCheck = (table2) => {
             if (config5.softDeletes?.enabled && config5.softDeletes?.defaultFilter) {
               const softDeleteColumn = config5.softDeletes.column || "deleted_at";
@@ -13745,6 +13753,8 @@ function createQueryBuilder(state) {
       where(expr, op, value) {
         const getWhereKeyword = () => SQL_PATTERNS.WHERE.test(text) ? "AND" : "WHERE";
         if (typeof expr === "string" && op !== undefined) {
+          validateIdentifier(String(expr), "where(column)");
+          assertSafeWhereOperator(op, "where(operator)");
           const operator = String(op).toLowerCase();
           if (operator === "in" || operator === "not in") {
             const values = Array.isArray(value) ? value : [value];
@@ -13766,7 +13776,8 @@ function createQueryBuilder(state) {
         if (Array.isArray(expr)) {
           const [col, op2, val] = expr;
           const colName = String(col);
-          const operator = String(op2);
+          validateIdentifier(colName, "where(column)");
+          const operator = assertSafeWhereOperator(op2, "where(operator)");
           if (operator === "in" || operator === "not in") {
             const values = Array.isArray(val) ? val : [val];
             const placeholders = getPlaceholders(values.length, whereParams.length + 1);
@@ -13788,6 +13799,7 @@ function createQueryBuilder(state) {
           const keys = Object.keys(whereObject);
           const conditions = [];
           for (const key of keys) {
+            validateIdentifier(key, "where(column)");
             const value2 = whereObject[key];
             if (Array.isArray(value2)) {
               const placeholders = getPlaceholders(value2.length, whereParams.length + 1);
@@ -13816,18 +13828,21 @@ function createQueryBuilder(state) {
         return this;
       },
       whereNull(column) {
+        validateIdentifier(String(column), "whereNull(column)");
         const keyword = SQL_PATTERNS.WHERE.test(text) ? "AND" : "WHERE";
         text = `${text} ${keyword} ${String(column)} IS NULL`;
         built = null;
         return this;
       },
       whereNotNull(column) {
+        validateIdentifier(String(column), "whereNotNull(column)");
         const keyword = SQL_PATTERNS.WHERE.test(text) ? "AND" : "WHERE";
         text = `${text} ${keyword} ${String(column)} IS NOT NULL`;
         built = null;
         return this;
       },
       whereBetween(column, start, end) {
+        validateIdentifier(String(column), "whereBetween(column)");
         const keyword = SQL_PATTERNS.WHERE.test(text) ? "AND" : "WHERE";
         const i = whereParams.length + 1;
         text = `${text} ${keyword} ${String(column)} BETWEEN ${getPlaceholder(i)} AND ${getPlaceholder(i + 1)}`;
@@ -13842,6 +13857,7 @@ function createQueryBuilder(state) {
         return this;
       },
       whereJsonContains(column, json) {
+        validateIdentifier(String(column), "whereJsonContains(column)");
         const keyword = SQL_PATTERNS.WHERE.test(text) ? "AND" : "WHERE";
         const dialect = config5.dialect;
         const idx = whereParams.length + 1;
@@ -14011,6 +14027,7 @@ function createQueryBuilder(state) {
         return this;
       },
       whereNotBetween(column, start, end) {
+        validateIdentifier(String(column), "whereNotBetween(column)");
         const keyword = SQL_PATTERNS.WHERE.test(text) ? "AND" : "WHERE";
         const i = whereParams.length + 1;
         text += ` ${keyword} ${column} NOT BETWEEN ${getPlaceholder(i)} AND ${getPlaceholder(i + 1)}`;
@@ -14053,6 +14070,7 @@ function createQueryBuilder(state) {
         return this;
       },
       whereIn(column, values) {
+        validateIdentifier(String(column), "whereIn(column)");
         const keyword = SQL_PATTERNS.WHERE.test(text) ? "AND" : "WHERE";
         if (Array.isArray(values)) {
           const placeholders = getPlaceholders(values.length, whereParams.length + 1);
@@ -14065,6 +14083,7 @@ function createQueryBuilder(state) {
         return this;
       },
       orWhereIn(column, values) {
+        validateIdentifier(String(column), "orWhereIn(column)");
         if (Array.isArray(values)) {
           const placeholders = getPlaceholders(values.length, whereParams.length + 1);
           text += ` OR ${column} IN (${placeholders})`;
@@ -14076,6 +14095,7 @@ function createQueryBuilder(state) {
         return this;
       },
       whereNotIn(column, values) {
+        validateIdentifier(String(column), "whereNotIn(column)");
         const keyword = SQL_PATTERNS.WHERE.test(text) ? "AND" : "WHERE";
         if (Array.isArray(values)) {
           const placeholders = getPlaceholders(values.length, whereParams.length + 1);
@@ -14088,6 +14108,7 @@ function createQueryBuilder(state) {
         return this;
       },
       orWhereNotIn(column, values) {
+        validateIdentifier(String(column), "orWhereNotIn(column)");
         if (Array.isArray(values)) {
           const placeholders = getPlaceholders(values.length, whereParams.length + 1);
           text += ` OR ${column} NOT IN (${placeholders})`;
@@ -14113,6 +14134,8 @@ function createQueryBuilder(state) {
       },
       andWhere(expr, op, value) {
         if (typeof expr === "string" && op !== undefined) {
+          validateIdentifier(String(expr), "andWhere(column)");
+          assertSafeWhereOperator(op, "andWhere(operator)");
           const paramIndex = whereParams.length + 1;
           whereConditions.push(`${String(expr)} ${String(op)} ${getPlaceholder(paramIndex)}`);
           whereParams.push(value);
@@ -14123,7 +14146,8 @@ function createQueryBuilder(state) {
         if (Array.isArray(expr)) {
           const [col, op2, val] = expr;
           const colName = String(col);
-          const operator = String(op2);
+          validateIdentifier(colName, "andWhere(column)");
+          const operator = assertSafeWhereOperator(op2, "andWhere(operator)");
           if (operator === "in" || operator === "not in") {
             const values = Array.isArray(val) ? val : [val];
             const placeholders = getPlaceholders(values.length, whereParams.length + 1);
@@ -14173,6 +14197,8 @@ function createQueryBuilder(state) {
       },
       orWhere(expr, op, value) {
         if (typeof expr === "string" && op !== undefined) {
+          validateIdentifier(String(expr), "orWhere(column)");
+          assertSafeWhereOperator(op, "orWhere(operator)");
           const paramIndex = whereParams.length + 1;
           whereConditions.push(`OR ${String(expr)} ${String(op)} ${getPlaceholder(paramIndex)}`);
           whereParams.push(value);
@@ -14183,7 +14209,8 @@ function createQueryBuilder(state) {
         if (Array.isArray(expr)) {
           const [col, op2, val] = expr;
           const colName = String(col);
-          const operator = String(op2);
+          validateIdentifier(colName, "orWhere(column)");
+          const operator = assertSafeWhereOperator(op2, "orWhere(operator)");
           if (operator === "in" || operator === "not in") {
             const values = Array.isArray(val) ? val : [val];
             const placeholders = getPlaceholders(values.length, whereParams.length + 1);
@@ -14281,6 +14308,10 @@ function createQueryBuilder(state) {
         return this;
       },
       join(table2, onLeft, operator, onRight) {
+        validateIdentifier(table2, "join(table)");
+        validateQualifiedIdentifier(onLeft, "join(onLeft)");
+        validateQualifiedIdentifier(onRight, "join(onRight)");
+        assertSafeWhereOperator(operator, "join(operator)");
         insertJoin(`JOIN ${table2} ON ${onLeft} ${operator} ${onRight}`);
         joinedTables.add(table2);
         return this;
@@ -14295,31 +14326,49 @@ function createQueryBuilder(state) {
         return this;
       },
       innerJoin(table2, onLeft, operator, onRight) {
+        validateIdentifier(table2, "innerJoin(table)");
+        validateQualifiedIdentifier(onLeft, "innerJoin(onLeft)");
+        validateQualifiedIdentifier(onRight, "innerJoin(onRight)");
+        assertSafeWhereOperator(operator, "innerJoin(operator)");
         insertJoin(`INNER JOIN ${table2} ON ${onLeft} ${operator} ${onRight}`);
         joinedTables.add(table2);
         return this;
       },
       leftJoin(table2, onLeft, operator, onRight) {
+        validateIdentifier(table2, "leftJoin(table)");
+        validateQualifiedIdentifier(onLeft, "leftJoin(onLeft)");
+        validateQualifiedIdentifier(onRight, "leftJoin(onRight)");
+        assertSafeWhereOperator(operator, "leftJoin(operator)");
         insertJoin(`LEFT JOIN ${table2} ON ${onLeft} ${operator} ${onRight}`);
         joinedTables.add(table2);
         return this;
       },
       leftJoinSub(sub, alias, onLeft, operator, onRight) {
+        validateIdentifier(alias, "leftJoinSub(alias)");
+        validateQualifiedIdentifier(onLeft, "leftJoinSub(onLeft)");
+        validateQualifiedIdentifier(onRight, "leftJoinSub(onRight)");
+        assertSafeWhereOperator(operator, "leftJoinSub(operator)");
         insertJoin(`LEFT JOIN (${String(sub.toSQL())}) AS ${alias} ON ${onLeft} ${operator} ${onRight}`);
         joinedTables.add(alias);
         return this;
       },
       rightJoin(table2, onLeft, operator, onRight) {
+        validateIdentifier(table2, "rightJoin(table)");
+        validateQualifiedIdentifier(onLeft, "rightJoin(onLeft)");
+        validateQualifiedIdentifier(onRight, "rightJoin(onRight)");
+        assertSafeWhereOperator(operator, "rightJoin(operator)");
         insertJoin(`RIGHT JOIN ${table2} ON ${onLeft} ${operator} ${onRight}`);
         joinedTables.add(table2);
         return this;
       },
       crossJoin(table2) {
+        validateIdentifier(table2, "crossJoin(table)");
         insertJoin(`CROSS JOIN ${table2}`);
         joinedTables.add(table2);
         return this;
       },
       crossJoinSub(sub, alias) {
+        validateIdentifier(alias, "crossJoinSub(alias)");
         insertJoin(`CROSS JOIN (${String(sub.toSQL())}) AS ${alias}`);
         joinedTables.add(alias);
         return this;
@@ -14679,17 +14728,15 @@ function createQueryBuilder(state) {
             addWhereText("WHERE", `${String(col)} IS ${onlyTrashed ? "NOT " : ""}NULL`);
           }
         }
+        const cacheKey = useCache ? `${String(finalQuery)}\x00${JSON.stringify(whereParams)}` : "";
         if (useCache) {
-          const cacheKey = String(finalQuery);
           const cached = queryCache.get(cacheKey);
           if (cached)
             return cached;
         }
         const result = await runWithHooks(finalQuery, "select", { signal: abortSignal, timeoutMs });
-        if (useCache) {
-          const cacheKey = String(finalQuery);
+        if (useCache)
           queryCache.set(cacheKey, result, cacheTtl);
-        }
         return hydratePivotRows(result);
       },
       async executeTakeFirst() {
@@ -16251,7 +16298,7 @@ var init_cache = __esm(() => {
 });
 
 // src/actions/console.ts
-import process19 from "process";
+import process21 from "process";
 import { createInterface } from "readline";
 async function startConsole() {
   console.log("-- Query Builder Interactive Console");
@@ -16260,8 +16307,8 @@ async function startConsole() {
   console.log();
   const qb = createQueryBuilder();
   const rl = createInterface({
-    input: process19.stdin,
-    output: process19.stdout,
+    input: process21.stdin,
+    output: process21.stdout,
     prompt: "qb> "
   });
   let multilineBuffer = "";
@@ -16312,7 +16359,7 @@ Tips:
       if (cmd === ".exit" || cmd === ".quit") {
         console.log("Goodbye!");
         rl.close();
-        process19.exit(0);
+        process21.exit(0);
       } else if (cmd === ".help") {
         console.log(helpText);
       } else if (cmd === ".clear") {
@@ -16383,7 +16430,7 @@ Tips:
   rl.on("close", () => {
     console.log(`
 Goodbye!`);
-    process19.exit(0);
+    process21.exit(0);
   });
   rl.prompt();
 }
@@ -16761,9 +16808,9 @@ var init_db_info = __esm(() => {
 });
 
 // src/actions/db-optimize.ts
-import process21 from "process";
+import process22 from "process";
 async function dbOptimize(options = {}) {
-  const dialect = options.dialect || process21.env.DB_DIALECT || "postgres";
+  const dialect = options.dialect || process22.env.DB_DIALECT || "postgres";
   const aggressive = options.aggressive || false;
   if (options.verbose) {
     console.log(`Optimizing ${dialect} database${aggressive ? " (aggressive mode)" : ""}...`);
@@ -16803,7 +16850,7 @@ async function dbOptimize(options = {}) {
           await bunSql`ANALYZE TABLE ${bunSql(table)}`;
         }
       } else {
-        const dbName = process21.env.DB_NAME || "test";
+        const dbName = process22.env.DB_NAME || "test";
         const tables = await bunSql`
           SELECT table_name
           FROM information_schema.tables
@@ -16855,9 +16902,9 @@ var init_db_optimize = __esm(() => {
 });
 
 // src/actions/db-wipe.ts
-import process22 from "process";
+import process23 from "process";
 async function dbWipe(options = {}) {
-  const dialect = options.dialect || process22.env.DB_DIALECT || "postgres";
+  const dialect = options.dialect || process23.env.DB_DIALECT || "postgres";
   if (options.verbose) {
     console.log(`Wiping all tables from ${dialect} database...`);
   }
@@ -16871,7 +16918,7 @@ async function dbWipe(options = {}) {
       `;
       tables = result.map((row) => row.tablename);
     } else if (dialect === "mysql") {
-      const dbName = process22.env.DB_NAME || "test";
+      const dbName = process23.env.DB_NAME || "test";
       const result = await bunSql`
         SELECT table_name
         FROM information_schema.tables
@@ -17287,7 +17334,7 @@ var init_introspect_db = __esm(() => {
 // src/actions/make-model.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync5, writeFileSync as writeFileSync10 } from "fs";
 import { dirname as dirname5, join as join7 } from "path";
-import process23 from "process";
+import process24 from "process";
 function findWorkspaceRoot(startPath) {
   let currentPath = startPath;
   while (currentPath !== dirname5(currentPath)) {
@@ -17296,10 +17343,10 @@ function findWorkspaceRoot(startPath) {
     }
     currentPath = dirname5(currentPath);
   }
-  return process23.cwd();
+  return process24.cwd();
 }
 async function makeModel(name, options = {}) {
-  const workspaceRoot = findWorkspaceRoot(process23.cwd());
+  const workspaceRoot = findWorkspaceRoot(process24.cwd());
   const modelsDir = options.dir || join7(workspaceRoot, "app/Models");
   if (!existsSync14(modelsDir)) {
     mkdirSync5(modelsDir, { recursive: true });
@@ -17856,7 +17903,7 @@ __export(exports_migrate, {
 import { existsSync as existsSync16, mkdirSync as mkdirSync7, mkdtempSync, readdirSync as readdirSync6, readFileSync as readFileSync3, rmSync, unlinkSync, writeFileSync as writeFileSync11 } from "fs";
 import { tmpdir } from "os";
 import { join as join9 } from "path";
-import process24 from "process";
+import process25 from "process";
 function info(message) {
   if (config5.verbose)
     console.log(message);
@@ -17903,7 +17950,7 @@ function savePlanSnapshot(workspaceRoot, dialect, plan) {
   info(`-- Model snapshot saved to ${snapshotPath}`);
 }
 function getWorkspaceRoot() {
-  return process24.cwd();
+  return process25.cwd();
 }
 function ensureSqlDirectory(workspaceRoot) {
   const sqlDir = getSqlDirectory(workspaceRoot);
@@ -17915,7 +17962,7 @@ function ensureSqlDirectory(workspaceRoot) {
 }
 async function generateMigration(dir, opts = {}) {
   if (!dir) {
-    dir = join9(process24.cwd(), "app/Models");
+    dir = join9(process25.cwd(), "app/Models");
   }
   const dialect = opts.dialect || config5.dialect || "postgres";
   const workspaceRoot = getWorkspaceRoot();
@@ -17970,7 +18017,7 @@ async function generateMigration(dir, opts = {}) {
 }
 async function executeMigration(dir) {
   if (!dir) {
-    dir = join9(process24.cwd(), "app/Models");
+    dir = join9(process25.cwd(), "app/Models");
   }
   const workspaceRoot = getWorkspaceRoot();
   const sqlDir = ensureSqlDirectory(workspaceRoot);
@@ -18035,7 +18082,7 @@ async function executeMigration(dir) {
 }
 async function resetDatabase(dir, opts = {}) {
   if (!dir) {
-    dir = join9(process24.cwd(), "app/Models");
+    dir = join9(process25.cwd(), "app/Models");
   }
   const dialect = opts.dialect || "postgres";
   const driver = getDialectDriver(dialect);
@@ -18128,7 +18175,7 @@ async function resetDatabase(dir, opts = {}) {
 }
 async function deleteMigrationFiles(dir, workspaceRoot, opts = {}) {
   if (!dir) {
-    dir = join9(process24.cwd(), "app/Models");
+    dir = join9(process25.cwd(), "app/Models");
   }
   if (!workspaceRoot) {
     workspaceRoot = getWorkspaceRoot();
@@ -18228,7 +18275,7 @@ var init_migrate_generate = __esm(() => {
 // src/actions/migrate-rollback.ts
 import { existsSync as existsSync17, readFileSync as readFileSync4, unlinkSync as unlinkSync2 } from "fs";
 import { dirname as dirname7, join as join10 } from "path";
-import process25 from "process";
+import process26 from "process";
 function splitSqlStatements2(sql) {
   const out = [];
   let buf = "";
@@ -18279,11 +18326,11 @@ function findWorkspaceRoot2(startPath) {
     }
     currentPath = dirname7(currentPath);
   }
-  return process25.cwd();
+  return process26.cwd();
 }
 function getSqlDirectory2(workspaceRoot) {
   if (!workspaceRoot) {
-    workspaceRoot = findWorkspaceRoot2(process25.cwd());
+    workspaceRoot = findWorkspaceRoot2(process26.cwd());
   }
   return join10(workspaceRoot, "database", "migrations");
 }
@@ -18366,7 +18413,7 @@ var init_migrate_rollback = __esm(() => {
 // src/actions/migrate-status.ts
 import { existsSync as existsSync18, readdirSync as readdirSync8 } from "fs";
 import { dirname as dirname8, join as join11 } from "path";
-import process26 from "process";
+import process27 from "process";
 function findWorkspaceRoot3(startPath) {
   let currentPath = startPath;
   while (currentPath !== dirname8(currentPath)) {
@@ -18375,11 +18422,11 @@ function findWorkspaceRoot3(startPath) {
     }
     currentPath = dirname8(currentPath);
   }
-  return process26.cwd();
+  return process27.cwd();
 }
 function getSqlDirectory3(workspaceRoot) {
   if (!workspaceRoot) {
-    workspaceRoot = findWorkspaceRoot3(process26.cwd());
+    workspaceRoot = findWorkspaceRoot3(process27.cwd());
   }
   return join11(workspaceRoot, "database", "migrations");
 }
@@ -18473,9 +18520,9 @@ var init_migrate_status = __esm(() => {
 // src/actions/model-show.ts
 import { readdirSync as readdirSync9 } from "fs";
 import { extname as extname2, join as join12 } from "path";
-import process27 from "process";
+import process28 from "process";
 async function modelShow(modelName, options = {}) {
-  const dir = options.dir || join12(process27.cwd(), "app/Models");
+  const dir = options.dir || join12(process28.cwd(), "app/Models");
   try {
     const files = readdirSync9(dir);
     const modelFile = files.find((f) => {
@@ -18689,9 +18736,9 @@ var init_query_explain_all = __esm(() => {
 // src/actions/relation-diagram.ts
 import { writeFileSync as writeFileSync12 } from "fs";
 import { join as join14 } from "path";
-import process28 from "process";
+import process29 from "process";
 async function relationDiagram(options = {}) {
-  const dir = options.dir || join14(process28.cwd(), "app/Models");
+  const dir = options.dir || join14(process29.cwd(), "app/Models");
   const format = options.format || "mermaid";
   try {
     const models = await loadModels({ modelsDir: dir });
@@ -18813,7 +18860,7 @@ var init_relation_diagram = __esm(() => {
 // src/actions/seed.ts
 import { existsSync as existsSync19, mkdirSync as mkdirSync8, readdirSync as readdirSync11, writeFileSync as writeFileSync13 } from "fs";
 import { dirname as dirname9, join as join15 } from "path";
-import process29 from "process";
+import process30 from "process";
 function findWorkspaceRoot4(startPath) {
   let currentPath = startPath;
   while (currentPath !== dirname9(currentPath)) {
@@ -18822,7 +18869,7 @@ function findWorkspaceRoot4(startPath) {
     }
     currentPath = dirname9(currentPath);
   }
-  return process29.cwd();
+  return process30.cwd();
 }
 async function loadSeeders(seedersDir) {
   if (!existsSync19(seedersDir)) {
@@ -18854,7 +18901,7 @@ async function loadSeeders(seedersDir) {
   return seeders;
 }
 async function runSeeders(config6 = {}) {
-  const workspaceRoot = findWorkspaceRoot4(process29.cwd());
+  const workspaceRoot = findWorkspaceRoot4(process30.cwd());
   const seedersDir = config6.seedersDir || join15(workspaceRoot, "database/seeders");
   const verbose = config6.verbose ?? true;
   if (verbose) {
@@ -18889,7 +18936,7 @@ async function runSeeders(config6 = {}) {
   }
 }
 async function runSeeder(className, options = {}) {
-  const workspaceRoot = findWorkspaceRoot4(process29.cwd());
+  const workspaceRoot = findWorkspaceRoot4(process30.cwd());
   const seedersDir = join15(workspaceRoot, "database/seeders");
   const verbose = options.verbose ?? true;
   if (verbose) {
@@ -18913,7 +18960,7 @@ async function runSeeder(className, options = {}) {
   }
 }
 async function makeSeeder(name) {
-  const workspaceRoot = findWorkspaceRoot4(process29.cwd());
+  const workspaceRoot = findWorkspaceRoot4(process30.cwd());
   const seedersDir = join15(workspaceRoot, "database/seeders");
   if (!existsSync19(seedersDir)) {
     mkdirSync8(seedersDir, { recursive: true });
@@ -18977,7 +19024,7 @@ export default class ${className} extends Seeder {
   console.log(`-- \u2713 Created seeder: ${filePath}`);
 }
 async function freshDatabase(options = {}) {
-  const workspaceRoot = findWorkspaceRoot4(process29.cwd());
+  const workspaceRoot = findWorkspaceRoot4(process30.cwd());
   const modelsDir = options.modelsDir || join15(workspaceRoot, "app/Models");
   const seedersDir = options.seedersDir || join15(workspaceRoot, "database/seeders");
   const verbose = options.verbose ?? true;
@@ -19039,7 +19086,7 @@ var init_unsafe = __esm(() => {
 // src/actions/validate.ts
 import { existsSync as existsSync20 } from "fs";
 import { dirname as dirname10, join as join16 } from "path";
-import process30 from "process";
+import process31 from "process";
 function findWorkspaceRoot5(startPath) {
   let currentPath = startPath;
   while (currentPath !== dirname10(currentPath)) {
@@ -19048,11 +19095,11 @@ function findWorkspaceRoot5(startPath) {
     }
     currentPath = dirname10(currentPath);
   }
-  return process30.cwd();
+  return process31.cwd();
 }
 async function validateSchema(dir) {
   if (!dir) {
-    dir = join16(findWorkspaceRoot5(process30.cwd()), "app/Models");
+    dir = join16(findWorkspaceRoot5(process31.cwd()), "app/Models");
   }
   const dialect = config5.dialect || "postgres";
   console.log("-- Validating Schema");
@@ -23754,6 +23801,13 @@ function assertValidIdentifier(name, context) {
   if (!SAFE_SQL_IDENTIFIER.test(name))
     throw new TypeError(`[bun-query-builder] ${context}: identifier '${name}' contains characters outside [A-Za-z0-9_] \u2014 refusing to interpolate into SQL`);
 }
+function assertValidOrderByColumn(name, context) {
+  if (typeof name !== "string" || name.length === 0)
+    throw new TypeError(`[bun-query-builder] ${context}: identifier must be a non-empty string, got ${typeof name}`);
+  const parts = name.split(".");
+  if (parts.length > 2 || parts.some((p2) => p2.length === 0 || p2.length > 64 || !SAFE_SQL_IDENTIFIER.test(p2)))
+    throw new TypeError(`[bun-query-builder] ${context}: invalid ORDER BY column '${name}' \u2014 expected 'column' or 'table.column' of [A-Za-z0-9_] \u2014 refusing to interpolate into SQL`);
+}
 function getModelFromRegistry(name) {
   if (!_getModel) {
     try {
@@ -24042,12 +24096,16 @@ class ModelInstance {
     for (const [key, value] of Object.entries(data)) {
       const attr = attrs[key];
       if (attr?.fillable && !attr?.guarded) {
+        if (this._original === null)
+          this._original = { ...this._attributes };
         this._attributes[key] = value;
       }
     }
     return this;
   }
   forceFill(data) {
+    if (this._original === null)
+      this._original = { ...this._attributes };
     Object.assign(this._attributes, data);
     return this;
   }
@@ -24443,7 +24501,7 @@ class BelongsToManyRelationBuilder {
     return this;
   }
   orderBy(column, direction = "asc") {
-    assertValidIdentifier(column, "orderBy(column)");
+    assertValidOrderByColumn(column, "orderBy(column)");
     if (direction !== "asc" && direction !== "desc")
       throw new TypeError(`[bun-query-builder] orderBy(direction): expected 'asc' or 'desc', got '${direction}'`);
     this._orderBy.push(`${column} ${direction.toUpperCase()}`);
@@ -24784,7 +24842,7 @@ class ModelQueryBuilder {
     return this;
   }
   orderBy(column, direction = "asc") {
-    assertValidIdentifier(column, "orderBy(column)");
+    assertValidOrderByColumn(column, "orderBy(column)");
     if (direction !== "asc" && direction !== "desc")
       throw new TypeError(`[bun-query-builder] orderBy(direction): expected 'asc' or 'desc', got '${direction}'`);
     this._orderBy.push({ column, direction });
@@ -24885,6 +24943,8 @@ class ModelQueryBuilder {
       let rel = relationCache.get(cacheKey);
       if (rel === undefined) {
         rel = resolveRelation(this._definition, relationName);
+        if (relationCache.size >= RELATION_CACHE_MAX)
+          relationCache.clear();
         relationCache.set(cacheKey, rel);
       }
       if (!rel)
@@ -24921,8 +24981,13 @@ class ModelQueryBuilder {
         }
       }
       if (rel.type === "belongsTo") {
-        const fkValues = instances.map((i2) => i2._attributes[rel.foreignKey]).filter((v2) => v2 != null);
-        const uniqueFkValues = [...new Set(fkValues)];
+        const fkSet = new Set;
+        for (const i2 of instances) {
+          const v2 = i2._attributes[rel.foreignKey];
+          if (v2 != null)
+            fkSet.add(v2);
+        }
+        const uniqueFkValues = [...fkSet];
         if (uniqueFkValues.length === 0)
           continue;
         const placeholders = uniqueFkValues.map(() => "?").join(", ");
@@ -24952,7 +25017,13 @@ class ModelQueryBuilder {
             instance.setRelation(relationName, []);
           continue;
         }
-        const relatedIds = [...new Set(pivotRows.map((p2) => p2[rel.pivotFkRelated]))].filter((v2) => v2 != null);
+        const relatedIdSet = new Set;
+        for (const p2 of pivotRows) {
+          const v2 = p2[rel.pivotFkRelated];
+          if (v2 != null)
+            relatedIdSet.add(v2);
+        }
+        const relatedIds = [...relatedIdSet];
         const relatedModelDef = getModelFromRegistry(rel.relatedModelName);
         const relDef = relatedModelDef?.getDefinition?.() || relatedModelDef?.definition || this._definition;
         const relatedPk = relDef?.primaryKey || "id";
@@ -25402,7 +25473,7 @@ async function seedModel(definition, count, faker) {
     await exec.run(`INSERT INTO ${definition.table} (${columns.join(", ")}) VALUES (${columns.map(() => "?").join(", ")})`, Object.values(data));
   }
 }
-var SAFE_SQL_IDENTIFIER, _getModel = null, globalDb = null, _executor = null, _executorForDb = null, _executorDialect = null, _executorDatabase = null, SOFT_DELETE_COLUMN = "deleted_at", BTM_RELATED_ALIAS = "__btm_rel__", snakeCaseCache, tableNameCache, relationCache;
+var SAFE_SQL_IDENTIFIER, _getModel = null, globalDb = null, _executor = null, _executorForDb = null, _executorDialect = null, _executorDatabase = null, SOFT_DELETE_COLUMN = "deleted_at", BTM_RELATED_ALIAS = "__btm_rel__", snakeCaseCache, tableNameCache, relationCache, RELATION_CACHE_MAX = 1000;
 var init_orm = __esm(() => {
   init_config();
   init_db();
@@ -26858,9 +26929,9 @@ function buildDatabaseSchema(models) {
 // src/loader.ts
 import { readdirSync as readdirSync12, statSync as statSync5 } from "fs";
 import { basename, extname as extname4 } from "path";
-import process31 from "process";
+import process33 from "process";
 async function loadModels(options) {
-  const cwd = options.cwd ?? process31.cwd();
+  const cwd = options.cwd ?? process33.cwd();
   const dir = options.modelsDir.startsWith("/") ? options.modelsDir : `${cwd}/${options.modelsDir}`;
   const result = {};
   const entries = readdirSync12(dir);
@@ -26990,7 +27061,7 @@ var init_meta = () => {};
 // src/migrations.ts
 import { existsSync as existsSync21, mkdirSync as mkdirSync9, writeFileSync as writeFileSync14 } from "fs";
 import { dirname as dirname11, join as join17 } from "path";
-import process33 from "process";
+import process35 from "process";
 function info2(message) {
   if (config5.verbose)
     console.log(message);
@@ -27006,10 +27077,10 @@ function findWorkspaceRoot6(startPath) {
     }
     currentPath = dirname11(currentPath);
   }
-  return process33.cwd();
+  return process35.cwd();
 }
 function ensureSqlDirectory2() {
-  const workspaceRoot = findWorkspaceRoot6(process33.cwd());
+  const workspaceRoot = findWorkspaceRoot6(process35.cwd());
   const sqlDir = join17(workspaceRoot, "database", "migrations");
   if (!existsSync21(sqlDir)) {
     mkdirSync9(sqlDir, { recursive: true });