bun-query-builder 0.2.29 → 0.2.30

package/dist/bin/cli.js

@@ -11862,6 +11862,68 @@ import { Database } from "bun:sqlite";
 import { mkdirSync as mkdirSync5 } from "fs";
 import { dirname as dirname5 } from "path";
 import process21 from "process";
+function bindNumberedPlaceholders(sql, params) {
+  if (params.length === 0 || !/\$\d/.test(sql))
+    return { sql, params };
+  const out = [];
+  let rewritten = "";
+  let highest = 0;
+  for (let i = 0;i < sql.length; i++) {
+    const char = sql[i];
+    if (char === "'" || char === '"' || char === "`") {
+      const end = skipQuoted(sql, i, char);
+      rewritten += sql.slice(i, end);
+      i = end - 1;
+      continue;
+    }
+    if (char === "-" && sql[i + 1] === "-") {
+      const end = sql.indexOf(`
+`, i);
+      const stop = end === -1 ? sql.length : end;
+      rewritten += sql.slice(i, stop);
+      i = stop - 1;
+      continue;
+    }
+    if (char === "/" && sql[i + 1] === "*") {
+      const end = sql.indexOf("*/", i + 2);
+      const stop = end === -1 ? sql.length : end + 2;
+      rewritten += sql.slice(i, stop);
+      i = stop - 1;
+      continue;
+    }
+    if (char === "$") {
+      const digits = /^\d+/.exec(sql.slice(i + 1))?.[0];
+      if (digits) {
+        const index = Number(digits);
+        highest = Math.max(highest, index);
+        if (index >= 1 && index <= params.length) {
+          out.push(params[index - 1]);
+          rewritten += "?";
+          i += digits.length;
+          continue;
+        }
+      }
+    }
+    rewritten += char;
+  }
+  if (highest > params.length)
+    throw new Error(`SQL references $${highest} but only ${params.length} value${params.length === 1 ? " was" : "s were"} provided`);
+  if (out.length === 0)
+    return { sql, params };
+  return { sql: rewritten, params: out };
+}
+function skipQuoted(sql, start, quote) {
+  for (let i = start + 1;i < sql.length; i++) {
+    if (sql[i] !== quote)
+      continue;
+    if (sql[i + 1] === quote) {
+      i++;
+      continue;
+    }
+    return i + 1;
+  }
+  return sql.length;
+}
 
 class SQLiteWrapper {
   db;
@@ -11876,12 +11938,14 @@ class SQLiteWrapper {
     applySqliteBootstrapPragmas(this.db);
   }
   query(sql, params = []) {
-    const stmt = this.db.prepare(sql);
-    return stmt.all(...params);
+    const bound = bindNumberedPlaceholders(sql, params);
+    const stmt = this.db.prepare(bound.sql);
+    return stmt.all(...bound.params);
   }
   run(sql, params = []) {
-    const stmt = this.db.prepare(sql);
-    return stmt.run(...params);
+    const bound = bindNumberedPlaceholders(sql, params);
+    const stmt = this.db.prepare(bound.sql);
+    return stmt.run(...bound.params);
   }
   close() {
     this.db.close();
@@ -12650,6 +12714,21 @@ function renderSelectColumn(col) {
   }
   throw new TypeError(`[query-builder] select(): unsupported column ${String(col)} \u2014 pass a column name, a string[], or a SQL fragment (e.g. sql\`count(*) as c\`)`);
 }
+function hasTopLevelOrderBy(s) {
+  const re = /\(|\)|\bORDER\s+BY\b/gi;
+  let depth = 0;
+  let m;
+  while (m = re.exec(s)) {
+    if (m[0] === "(") {
+      depth++;
+    } else if (m[0] === ")") {
+      depth = Math.max(0, depth - 1);
+    } else if (depth === 0) {
+      return true;
+    }
+  }
+  return false;
+}
 function validateIdentifier(name, context) {
   if (!SQL_PATTERNS.IDENTIFIER.test(name)) {
     const contextMsg = context ? ` in ${context}` : "";
@@ -13160,8 +13239,8 @@ function createQueryBuilder(state) {
       }
       return -1;
     };
-    const currentSql = () => {
-      const body = renderWhereTerms(whereTerms);
+    const currentSql = (extra) => {
+      const body = renderWhereTerms(extra ? [...whereTerms, extra] : whereTerms);
       if (!body)
         return text;
       if (whereTail) {
@@ -14888,25 +14967,33 @@ function createQueryBuilder(state) {
         return { data: hasMore ? data.slice(0, perPage) : data, meta: { perPage, page: p, hasMore } };
       },
       async cursorPaginate(perPage, cursor, column = "id", direction = "asc") {
-        let q = ensureBuilt();
+        if (!Number.isInteger(perPage) || perPage <= 0)
+          throw new TypeError(`[query-builder] cursorPaginate(perPage): expected positive integer, got ${perPage}`);
+        const cols = (Array.isArray(column) ? column : [column]).map(String);
+        for (const c of cols)
+          validateIdentifier(c, "cursorPaginate(column)");
+        const cmp = direction === "asc" ? ">" : "<";
+        const dir = direction === "asc" ? "ASC" : "DESC";
+        const params = [...whereParams];
+        let predicate = "";
         if (cursor !== undefined && cursor !== null) {
           if (Array.isArray(column)) {
-            const cols = column.map((c) => sql(String(c)));
-            const comp = direction === "asc" ? sql`>` : sql`<`;
-            const tupleCols = sql`(${sql(cols)})`;
-            const tupleVals = sql`(${sql(cursor)})`;
-            q = sql`${q} WHERE ${tupleCols} ${comp} ${tupleVals}`;
+            const phs = cursor.map((v) => {
+              params.push(v);
+              return getPlaceholder(params.length);
+            });
+            predicate = `(${cols.join(", ")}) ${cmp} (${phs.join(", ")})`;
           } else {
-            q = direction === "asc" ? sql`${q} WHERE ${sql(String(column))} > ${cursor}` : sql`${q} WHERE ${sql(String(column))} < ${cursor}`;
+            params.push(cursor);
+            predicate = `${cols[0]} ${cmp} ${getPlaceholder(params.length)}`;
           }
         }
-        if (Array.isArray(column)) {
-          const orderParts = column.map((c) => sql`${sql(String(c))} ${direction === "asc" ? sql`ASC` : sql`DESC`}`);
-          const orderExpr = orderParts.reduce((acc, p, i) => i === 0 ? p : sql`${acc}, ${p}`);
-          q = sql`${q} ORDER BY ${orderExpr} LIMIT ${perPage + 1}`;
-        } else {
-          q = sql`${q} ORDER BY ${sql(String(column))} ${direction === "asc" ? sql`ASC` : sql`DESC`} LIMIT ${perPage + 1}`;
+        const base2 = reorderSelectClauses(predicate ? currentSql({ conn: "AND", sql: predicate }) : currentSql());
+        const order = cols.map((c) => `${c} ${dir}`).join(", ");
+        if (hasTopLevelOrderBy(base2)) {
+          throw new TypeError(`[query-builder] cursorPaginate() cannot be combined with orderBy() \u2014 it orders by ` + `${order} itself, and a cursor is only meaningful in that order. ` + `Remove the orderBy(), or pass the column and direction to cursorPaginate().`);
         }
+        const q = params.length > 0 ? _sql.unsafe(`${base2} ORDER BY ${order} LIMIT ${perPage + 1}`, params) : _sql.unsafe(`${base2} ORDER BY ${order} LIMIT ${perPage + 1}`);
         const rows = await runWithHooks(q, "select", { signal: abortSignal, timeoutMs });
         const hasMore = rows.length > perPage;
         const data = rows.slice(0, perPage);
@@ -31980,7 +32067,7 @@ function getPrefix() {
 }
 var prefix = getPrefix();
 // package.json
-var version2 = "0.2.29";
+var version2 = "0.2.30";
 
 // bin/cli.ts
 init_actions();

package/dist/db.d.ts

@@ -1,6 +1,35 @@
 import { Database } from 'bun:sqlite';
 import { SQL } from 'bun';
 import type { DatabaseConfig, PoolConfig, SupportedDialect } from './types';
+/**
+ * SQLite wrapper that provides a SQL-like tagged template literal interface
+ * using bun:sqlite's Database class for better compiled binary support.
+ */
+/**
+ * Give `$1`-style placeholders their Postgres meaning on SQLite: `$n` is the
+ * n-th value, wherever it appears and however often.
+ *
+ * bun:sqlite treats `$1` as a NAME, not an index. Handed an array it binds the
+ * values to those names in ORDER OF FIRST APPEARANCE and ignores the numbers
+ * entirely, so a query whose placeholders are not already in ascending order
+ * binds the wrong values and says nothing:
+ *
+ *   sql.unsafe('SELECT $2 AS a, $1 AS b', ['ONE', 'TWO'])
+ *   -> { a: 'ONE', b: 'TWO' }        // both backwards, no error
+ *
+ * Every caller writing `$n` means the Postgres semantics, because the same
+ * query text is expected to run on both drivers. The failure is silent, and it
+ * lands hardest in exactly the queries that repeat a parameter - authorisation
+ * checks of the shape "owner_id = $2 OR EXISTS (... user_id = $2)" - where the
+ * result is a permission answer computed from the wrong values.
+ *
+ * Rewritten to ordinal `?` here, once, at the only place both `query` and `run`
+ * pass through. Placeholders inside string literals, quoted identifiers and
+ * comments are left alone: `'$1'` is data, not a parameter. SQL with no
+ * numbered placeholders is returned untouched, so `?` queries and Bun's own
+ * tagged-template output are unaffected.
+ */
+export declare function bindNumberedPlaceholders(sql: string, params: any[]): { sql: string, params: any[] };
 export declare function splitSqlStatements(sql: string): string[];
 /**
  * Creates a database connection string based on the configured dialect and database settings.
@@ -98,10 +127,6 @@ export declare interface DriverConnection {
 }
 /** An `unsafe(...)` result: a query object that is ALSO directly awaitable. */
 export type AwaitableDriverQuery = DriverQuery & PromiseLike<any>;
-/**
- * SQLite wrapper that provides a SQL-like tagged template literal interface
- * using bun:sqlite's Database class for better compiled binary support.
- */
 declare class SQLiteWrapper {
   constructor(filename: string);
   query(sql: string, params?: any[]): any[];

package/dist/src/index.js

@@ -11861,6 +11861,68 @@ import { Database } from "bun:sqlite";
 import { mkdirSync as mkdirSync5 } from "fs";
 import { dirname as dirname5 } from "path";
 import process21 from "process";
+function bindNumberedPlaceholders(sql, params) {
+  if (params.length === 0 || !/\$\d/.test(sql))
+    return { sql, params };
+  const out = [];
+  let rewritten = "";
+  let highest = 0;
+  for (let i = 0;i < sql.length; i++) {
+    const char = sql[i];
+    if (char === "'" || char === '"' || char === "`") {
+      const end = skipQuoted(sql, i, char);
+      rewritten += sql.slice(i, end);
+      i = end - 1;
+      continue;
+    }
+    if (char === "-" && sql[i + 1] === "-") {
+      const end = sql.indexOf(`
+`, i);
+      const stop = end === -1 ? sql.length : end;
+      rewritten += sql.slice(i, stop);
+      i = stop - 1;
+      continue;
+    }
+    if (char === "/" && sql[i + 1] === "*") {
+      const end = sql.indexOf("*/", i + 2);
+      const stop = end === -1 ? sql.length : end + 2;
+      rewritten += sql.slice(i, stop);
+      i = stop - 1;
+      continue;
+    }
+    if (char === "$") {
+      const digits = /^\d+/.exec(sql.slice(i + 1))?.[0];
+      if (digits) {
+        const index = Number(digits);
+        highest = Math.max(highest, index);
+        if (index >= 1 && index <= params.length) {
+          out.push(params[index - 1]);
+          rewritten += "?";
+          i += digits.length;
+          continue;
+        }
+      }
+    }
+    rewritten += char;
+  }
+  if (highest > params.length)
+    throw new Error(`SQL references $${highest} but only ${params.length} value${params.length === 1 ? " was" : "s were"} provided`);
+  if (out.length === 0)
+    return { sql, params };
+  return { sql: rewritten, params: out };
+}
+function skipQuoted(sql, start, quote) {
+  for (let i = start + 1;i < sql.length; i++) {
+    if (sql[i] !== quote)
+      continue;
+    if (sql[i + 1] === quote) {
+      i++;
+      continue;
+    }
+    return i + 1;
+  }
+  return sql.length;
+}
 
 class SQLiteWrapper {
   db;
@@ -11875,12 +11937,14 @@ class SQLiteWrapper {
     applySqliteBootstrapPragmas(this.db);
   }
   query(sql, params = []) {
-    const stmt = this.db.prepare(sql);
-    return stmt.all(...params);
+    const bound = bindNumberedPlaceholders(sql, params);
+    const stmt = this.db.prepare(bound.sql);
+    return stmt.all(...bound.params);
   }
   run(sql, params = []) {
-    const stmt = this.db.prepare(sql);
-    return stmt.run(...params);
+    const bound = bindNumberedPlaceholders(sql, params);
+    const stmt = this.db.prepare(bound.sql);
+    return stmt.run(...bound.params);
   }
   close() {
     this.db.close();
@@ -12649,6 +12713,21 @@ function renderSelectColumn(col) {
   }
   throw new TypeError(`[query-builder] select(): unsupported column ${String(col)} \u2014 pass a column name, a string[], or a SQL fragment (e.g. sql\`count(*) as c\`)`);
 }
+function hasTopLevelOrderBy(s) {
+  const re = /\(|\)|\bORDER\s+BY\b/gi;
+  let depth = 0;
+  let m;
+  while (m = re.exec(s)) {
+    if (m[0] === "(") {
+      depth++;
+    } else if (m[0] === ")") {
+      depth = Math.max(0, depth - 1);
+    } else if (depth === 0) {
+      return true;
+    }
+  }
+  return false;
+}
 function validateIdentifier(name, context) {
   if (!SQL_PATTERNS.IDENTIFIER.test(name)) {
     const contextMsg = context ? ` in ${context}` : "";
@@ -13159,8 +13238,8 @@ function createQueryBuilder(state) {
       }
       return -1;
     };
-    const currentSql = () => {
-      const body = renderWhereTerms(whereTerms);
+    const currentSql = (extra) => {
+      const body = renderWhereTerms(extra ? [...whereTerms, extra] : whereTerms);
       if (!body)
         return text;
       if (whereTail) {
@@ -14887,25 +14966,33 @@ function createQueryBuilder(state) {
         return { data: hasMore ? data.slice(0, perPage) : data, meta: { perPage, page: p, hasMore } };
       },
       async cursorPaginate(perPage, cursor, column = "id", direction = "asc") {
-        let q = ensureBuilt();
+        if (!Number.isInteger(perPage) || perPage <= 0)
+          throw new TypeError(`[query-builder] cursorPaginate(perPage): expected positive integer, got ${perPage}`);
+        const cols = (Array.isArray(column) ? column : [column]).map(String);
+        for (const c of cols)
+          validateIdentifier(c, "cursorPaginate(column)");
+        const cmp = direction === "asc" ? ">" : "<";
+        const dir = direction === "asc" ? "ASC" : "DESC";
+        const params = [...whereParams];
+        let predicate = "";
         if (cursor !== undefined && cursor !== null) {
           if (Array.isArray(column)) {
-            const cols = column.map((c) => sql(String(c)));
-            const comp = direction === "asc" ? sql`>` : sql`<`;
-            const tupleCols = sql`(${sql(cols)})`;
-            const tupleVals = sql`(${sql(cursor)})`;
-            q = sql`${q} WHERE ${tupleCols} ${comp} ${tupleVals}`;
+            const phs = cursor.map((v) => {
+              params.push(v);
+              return getPlaceholder(params.length);
+            });
+            predicate = `(${cols.join(", ")}) ${cmp} (${phs.join(", ")})`;
           } else {
-            q = direction === "asc" ? sql`${q} WHERE ${sql(String(column))} > ${cursor}` : sql`${q} WHERE ${sql(String(column))} < ${cursor}`;
+            params.push(cursor);
+            predicate = `${cols[0]} ${cmp} ${getPlaceholder(params.length)}`;
           }
         }
-        if (Array.isArray(column)) {
-          const orderParts = column.map((c) => sql`${sql(String(c))} ${direction === "asc" ? sql`ASC` : sql`DESC`}`);
-          const orderExpr = orderParts.reduce((acc, p, i) => i === 0 ? p : sql`${acc}, ${p}`);
-          q = sql`${q} ORDER BY ${orderExpr} LIMIT ${perPage + 1}`;
-        } else {
-          q = sql`${q} ORDER BY ${sql(String(column))} ${direction === "asc" ? sql`ASC` : sql`DESC`} LIMIT ${perPage + 1}`;
+        const base2 = reorderSelectClauses(predicate ? currentSql({ conn: "AND", sql: predicate }) : currentSql());
+        const order = cols.map((c) => `${c} ${dir}`).join(", ");
+        if (hasTopLevelOrderBy(base2)) {
+          throw new TypeError(`[query-builder] cursorPaginate() cannot be combined with orderBy() \u2014 it orders by ` + `${order} itself, and a cursor is only meaningful in that order. ` + `Remove the orderBy(), or pass the column and direction to cursorPaginate().`);
         }
+        const q = params.length > 0 ? _sql.unsafe(`${base2} ORDER BY ${order} LIMIT ${perPage + 1}`, params) : _sql.unsafe(`${base2} ORDER BY ${order} LIMIT ${perPage + 1}`);
         const rows = await runWithHooks(q, "select", { signal: abortSignal, timeoutMs });
         const hasMore = rows.length > perPage;
         const data = rows.slice(0, perPage);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bun-query-builder",
   "type": "module",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "description": "A simple yet performant query builder for TypeScript. Built with Bun.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",