fastify-auto-sqlapi 0.1.6 → 0.1.8

package/BREAKING_CHANGES.md

@@ -0,0 +1,319 @@
+# Breaking Changes — Join API redesign
+
+The join API was rewritten to be explicit, alias-based, and to add a real `LEFT JOIN` mode (`joinLeft`) for N:1 relationships. **No backward compatibility** — old names are rejected with 400. Both backend (table configuration) and frontend (request/response shapes) are affected. This document is the single source of truth for migrating either side.
+
+## Why this changed
+
+- The old API conflated "filter by child", "fetch children", and "aggregate children" under generic names (`joinFilters`, `joins`, `joinGroups`).
+- There was no way to embed a parent record (N:1) inline in the search results, nor to order/filter the main query by a parent field.
+- The same table could not be joined twice with different semantic roles (e.g. `createdBy` and `updatedBy` both pointing to `user`) because lookup keys collided on `joinSchema.tableName`.
+
+The new API addresses all three with a coherent `join*` prefix family and explicit `alias`.
+
+## Naming map
+
+| Old (request body) | New (request body) | Direction | Cardinality | What it does |
+|--------------------|--------------------|-----------|-------------|--------------|
+| `joinFilters` | `joinMustExist` | child → main | 1:N | Filters main rows via `EXISTS` subquery |
+| `joins` | `joinMultiple` | child → main | 1:N | Fetches child rows in a side query |
+| `joinGroups` | `joinGroup` | child → main | 1:N | Aggregations on children (SUM/MIN/…) with optional GROUP BY |
+| — | `joinLeft` | parent → main | N:1 | **NEW** real `LEFT JOIN` for embedding the parent |
+
+| Old (response) | New (response) |
+|----------------|----------------|
+| `result.joins` | `result.joinMultiple` |
+| `result.joinGroups` | `result.joinGroup` |
+| — | `result.joinLeft` (NEW) |
+
+| Old (`buildRelation` last arg) | New (`buildRelation` last arg) |
+|---------------------------------|---------------------------------|
+| `selection?: string` (positional) | `options?: { alias?: string; selection?: string; unique?: boolean }` (all optional; `alias` defaults to `joinSchema.tableName`) |
+
+| Old (lookup key inside the body) | New (lookup key inside the body) |
+|-----------------------------------|-----------------------------------|
+| `joinSchema.tableName` | `alias` (declared in `buildRelation`) |
+
+The `alias` is also the key used in:
+- Response payloads (`result.joinMultiple.<alias>`, `result.joinLeft.<alias>`, `result.joinGroup.<alias>`)
+- `secondaries` and `deletions` payloads in insert/update/bulk-upsert (`secondaries: { <alias>: [...] }`)
+- Dotted notation in `orderBy` and `conditions`
+
+## buildRelation — new signature
+
+```typescript
+// Options object is optional; every field has a sensible default.
+buildRelation(mainSchema, mainField, joinSchema, joinField);
+
+// Or with any subset of options:
+buildRelation(mainSchema, mainField, joinSchema, joinField, {
+  alias: 'creator',         // optional, default = joinSchema.tableName.
+                            // Used as the key in request/response/secondaries payloads
+                            // and in dotted-notation orderBy/conditions.
+  selection: '*',           // optional, default '*'. Comma-separated list, e.g. 'id,name,email'.
+  unique: false,            // optional, default false.
+                            //   true  → relation is N:1 (each main row has at most one join row).
+                            //           Allowed in joinLeft. Forbidden in joinMultiple/joinMustExist/joinGroup.
+                            //   false → relation is 1:N. Allowed in the other three. Forbidden in joinLeft.
+});
+```
+
+You only need to declare an explicit `alias` when:
+- you join the same table more than once (e.g. `createdBy` and `updatedBy` both pointing to `user`); or
+- you want a name different from the join table's name in the API surface (e.g. `'orders'` instead of `'customer_order'`).
+
+If two relations within the same `allowedReadJoins` (or `allowedWriteJoins`) end up resolving to the same alias — explicit or implicit — `defineTable` throws at startup with:
+
+```
+defineTable: duplicate alias '<name>' in allowedReadJoins. When omitted,
+alias defaults to joinSchema.tableName — declare an explicit alias to disambiguate.
+```
+
+If a request hits an alias on the wrong family, the engine returns `400`:
+
+```
+Join alias 'orders' is not declared with unique:true; use joinMultiple/joinMustExist/joinGroup instead
+Join alias 'creator' is declared with unique:true; use joinLeft instead
+Unknown join alias: <name>
+```
+
+## Request body — by family
+
+### `joinMustExist` (was `joinFilters`)
+
+EXISTS-based filter: returns main rows that have at least one matching child.
+
+```json
+{
+  "joinMustExist": {
+    "orders": {
+      "filters": { "status": "completed" },
+      "conditions": [{ "field": "total", "method": "isGreater", "params": [50] }]
+    }
+  }
+}
+```
+
+### `joinMultiple` (was `joins`)
+
+Fetches child rows in a side query; populates `result.joinMultiple.<alias>`.
+
+```json
+{
+  "joinMultiple": {
+    "orders": {
+      "filters": { "status": "completed" },
+      "selection": "id,total,status"
+    }
+  }
+}
+```
+
+`selection` is optional and overrides the default declared in `buildRelation`.
+
+### `joinGroup` (was `joinGroups`)
+
+Aggregations on the child table; populates `result.joinGroup.<alias>`.
+
+```json
+{
+  "joinGroup": {
+    "orders": {
+      "aggregations": {
+        "by": "status",
+        "sum": ["total"],
+        "count": ["id"]
+      },
+      "filters": { "status": "completed" }
+    }
+  }
+}
+```
+
+### `joinLeft` (NEW, requires `unique: true`)
+
+Real `LEFT JOIN` for N:1 (parent) relationships. The parent rows are returned in `result.joinLeft.<alias>` as a deduplicated array (one entry per distinct parent PK).
+
+```json
+{
+  "joinLeft": {
+    "creator": {},
+    "updater": { "filters": { "active": true }, "selection": "id,name" }
+  }
+}
+```
+
+The engine attaches a real `LEFT JOIN <parentTable> AS <alias>` to the main query **only when needed**:
+- when the request includes `filters` or `conditions` on the parent (effectively turns into INNER JOIN behavior on those aliases — main rows whose parent doesn't match are excluded);
+- when `orderBy` uses 2-parti dotted notation referring to a parent field (`alias.field`).
+
+Otherwise only a side query `WHERE pk IN (distinct fk values)` is issued — no LEFT JOIN, no row duplication. Either way, the response shape is the same.
+
+> **Limitation**: `extraFilters` declared via `extendedCondition` on the parent table are **not** applied inside `joinLeft.filters` (only schema fields). The other join families fully support extraFilters.
+
+## orderBy — dotted notations
+
+| Form | Allowed alias source | What it does |
+|------|----------------------|--------------|
+| `<field>` | main schema | regular column ordering |
+| `<alias>.<field>` | `joinLeft` (`unique: true` aliases) | orders main query by a parent field via LEFT JOIN |
+| `<alias>.<fn>.<field>` | `joinGroup` (declared in the same body) | orders main query by an aggregation via correlated scalar subquery |
+
+Ambiguity: 2-parti and 3-parti are disambiguated by counting dots. The 2-parti is rejected unless the alias is in `joinLeft` allowlist; 3-parti is rejected unless the alias is in the request `joinGroup` declaration.
+
+## Response shape
+
+```json
+{
+  "table": "session",
+  "main": [...],
+  "joinLeft":     { "creator": [...], "updater": [...] },
+  "joinMultiple": { "orders": [...] },
+  "joinGroup":    { "orders": { "sum": { "total": 300 }, "count": { "id": 2 } } },
+  "pagination":   { "total": 25, "pages": 3, "paginator": { "page": 1, "itemsPerPage": 20 } }
+}
+```
+
+All four `join*` keys appear only when requested. `pagination` only when `paginator` is provided.
+
+Each value in `result.joinLeft.<alias>` is an array of parent rows (one entry per distinct FK in `main`). The client maps a main row to its parent by FK lookup (`main.userId === joinLeft.creator[i].id`).
+
+## Write side — secondaries / deletions
+
+`secondaries` and `deletions` payloads in insert/update/bulk-upsert now use the **alias** as key (was `joinSchema.tableName`):
+
+```json
+{
+  "main": { "name": "Mario" },
+  "secondaries": { "orders": [{ "total": 50 }] },
+  "deletions":   { "orders": [{ "id": 10 }] }
+}
+```
+
+## Migration recipes (mechanical)
+
+### 1) Find every `buildRelation` call
+
+Old form:
+```
+buildRelation(M, mF, J, jF)
+buildRelation(M, mF, J, jF, '<sel>')        // 5th positional arg = selection
+```
+
+New form (alias is optional, defaults to `J.tableName`):
+```ts
+// Simplest case — no rewrite needed beyond removing the old positional selection:
+buildRelation(M, mF, J, jF)
+
+// Or supply any options you actually need:
+buildRelation(M, mF, J, jF, {
+  // alias: 'orders',          // omit if joinSchema.tableName is fine as alias
+  // selection: 'id, total',   // omit for '*'
+  // unique: true              // ADD if jF is the PK of J (relation is N:1)
+})
+```
+
+**Heuristic for `unique`**: if `joinField` is the PK (or part of the composite PK) of `joinSchema`, the relation is N:1 and you almost certainly want `unique: true` so the alias is usable in `joinLeft`. Mark the call with a `// TODO verify unique:true` and review.
+
+**When to add an explicit `alias`**: only if (a) you join the same table multiple times, or (b) you want a friendlier name than the SQL table name (e.g. `orders` vs `customer_order`).
+
+### 2) Rename request keys (regex-replace inside HTTP/JSON bodies and search params)
+
+```
+joinFilters: → joinMustExist:
+joins:       → joinMultiple:
+joinGroups:  → joinGroup:
+```
+
+### 3) Rename response accessors
+
+```
+result.joins      → result.joinMultiple
+result.joinGroups → result.joinGroup
+body.joins        → body.joinMultiple
+body.joinGroups   → body.joinGroup
+```
+
+(Plus `result.joinLeft` is now available for the new family.)
+
+### 4) Rename secondaries keys
+
+If you used the join table's name as the secondaries key, change it to the new alias:
+
+```diff
+- "secondaries": { "customer_order": [...] }
++ "secondaries": { "orders": [...] }
+```
+
+### 5) Inspect dotted orderBy/conditions
+
+`<table>.<fn>.<field>` still works for joinGroup, but `<table>` must now be the alias declared in `buildRelation`. If the alias differs from the old `tableName`, update the string.
+
+If you need to order by a parent field, **add a `joinLeft`-eligible relation** (with `unique: true`) and use 2-parti notation `alias.field` (NEW capability — not available before).
+
+## Validation summary (400 responses)
+
+The engine rejects, with `statusCode: 400`, any of:
+
+- `joinLeft` referencing an alias declared with `unique: false`
+- `joinMultiple`/`joinMustExist`/`joinGroup` referencing an alias declared with `unique: true`
+- request keys referencing an alias not declared in `allowedReadJoins`
+- `orderBy` 2-parti `<alias>.<field>` whose alias is not in `joinLeft`-eligible (i.e. `unique:true`) declarations
+- `orderBy` 3-parti `<alias>.<fn>.<field>` whose alias or `(fn, field)` pair is not declared in `joinGroup` for the same request
+- `defineTable` with two `allowedReadJoins`/`allowedWriteJoins` entries resolving to the same alias (thrown at startup, not at request time)
+
+---
+
+# Breaking Change — computed field placeholders use `?` markers
+
+`ComputedFieldExpr.expr` must now mark each bound value with `?`. The engine assigns the
+placeholder positions. Writing `$1` (or `db.ph(n)`) inside the expression no longer works and
+is rejected with a descriptive error.
+
+## Why this changed
+
+A computed field cannot know its own placeholder offset: the position depends on how many
+values the rest of the query bound before it. The previous contract asked the *consumer* to
+supply "stable indices", which is not knowable — so any computed that declared `values` and
+was used together with another filter produced a query that referenced the wrong parameter:
+
+```
+WHERE ("name" = $1) AND (CASE WHEN "role" = $1 THEN ... END = $3)
+values: ['Mario', 'admin', 500]
+```
+
+`$2` ('admin') was bound but never referenced, while the expression read `$1` ('Mario'). The
+query did not fail — it silently returned the wrong rows.
+
+## Migration
+
+```typescript
+// Before — placeholder guessed by the caller (silently misbound)
+bonus: ({ db, qiCol }) => ({
+  expr: `CASE WHEN ${qiCol('role')} = ${db.ph(1)} THEN ${qiCol('salary')} ELSE 0 END`,
+  values: ['admin'],
+  type: Type.Number(),
+}),
+
+// After — `?` marker, position assigned by the engine
+bonus: ({ qiCol }) => ({
+  expr: `CASE WHEN ${qiCol('role')} = ? THEN ${qiCol('salary')} ELSE 0 END`,
+  values: ['admin'],
+  type: Type.Number(),
+}),
+```
+
+Computed fields that declare **no** bound values (the majority: JSON extraction, concat,
+`dateTrunc`, arithmetic) are unaffected and need no change. Their SQL is emitted verbatim, so
+a literal `?` — the PostgreSQL jsonb operator — keeps working. In an expression that *does*
+carry values, escape a literal question mark as `\?`.
+
+A mismatch between the number of `?` markers and `values.length` now raises a descriptive
+error instead of producing a wrong query.
+
+## What this unlocks
+
+Bound values now work in every position that lands in the `WHERE` clause or in `ORDER BY`,
+including `joinLeft.filters` / `joinLeft.conditions` and `orderBy`, which previously rejected
+them with 400. They remain rejected in `selectComputed`, `computeMin/Max/Sum/Avg`,
+`joinGroup.aggregations.by` and `defaultOrder`, where the expression precedes the `WHERE`
+values in the parameter order.

package/CHANGELOG.md

@@ -0,0 +1,116 @@
+# Changelog
+
+All notable changes to this project are documented here. This project follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and adheres to
+[Semantic Versioning](https://semver.org/) — with the caveat that while the version is
+`0.x`, breaking changes may land in a minor release.
+
+Migration instructions for breaking changes live in **[BREAKING_CHANGES.md](./BREAKING_CHANGES.md)**.
+
+## [0.1.7]
+
+### Fixed
+
+- **Ambiguous column references in statements carrying a join.** A filtered `joinLeft` adds a
+  `LEFT JOIN` to the main query, and a tenant scope with `through` adds an `INNER JOIN`. Any
+  column name shared with the joined table (`id`, `name` — the common case) was ambiguous:
+  PostgreSQL rejected the statement, and a reference could otherwise resolve against the wrong
+  table. Every column reference is now table- or alias-qualified: filters, conditions, computed
+  expressions, `orderBy`, join selections, aggregations and tenant conditions.
+- **Correlated subqueries broke on self-referencing relations.** `joinMustExist` emitted
+  `EXISTS (SELECT 1 FROM "t" WHERE "t"."fk" = "t"."id")` when a relation pointed back at its own
+  table; the inner name shadowed the outer one, so the correlation was lost and the filter
+  silently matched the wrong rows. The subquery source is now aliased.
+
+### Changed
+
+- Placeholder offsets are owned by a single accumulator (`QueryParams`) instead of being
+  recomputed at each call site. No behaviour change; it removes the class of mistake where a
+  fragment's placeholders drift out of step with the values array.
+
+### Testing
+
+- Unit tests now assert two invariants on **every** query the engine generates: placeholder
+  integrity (no placeholder referencing an unbound value, no bound value left unreferenced)
+  and column qualification in join-bearing statements. Both are enforced by the shared mock
+  driver, so they apply to the whole suite rather than to hand-written assertions.
+- New integration suite executes ~45 request shapes — all four join families, computed fields
+  with and without bound values, every `orderBy` form, pagination, aggregations — against real
+  PostgreSQL and MySQL, so a syntax error fails a test instead of reaching a consumer.
+
+## [0.1.6]
+
+### Fixed
+
+- **⚠️ Computed fields with bound values silently returned wrong rows.** A computed field
+  declaring `values` could not know its own placeholder offset, so its expression referenced
+  whichever parameter another filter happened to bind. The query did not fail — it filtered or
+  sorted on the wrong value. If you use `computedFields` with a non-empty `values` array,
+  **results produced by 0.1.5 and earlier may be incorrect.**
+
+### Breaking
+
+- `ComputedFieldExpr.expr` now marks each bound value with `?`; the engine assigns placeholder
+  positions. Writing `$1` or `db.ph(n)` inside the expression is rejected with a descriptive
+  error. Computed fields that declare **no** bound values are unaffected — the majority case
+  (JSON extraction, `CONCAT`, `dateTrunc`, arithmetic) needs no change, and a literal `?` such
+  as the PostgreSQL jsonb operator keeps working.
+  See [BREAKING_CHANGES.md](./BREAKING_CHANGES.md#breaking-change--computed-field-placeholders-use--markers).
+
+### Added
+
+- Bound values in computed fields now work in every position that lands in the `WHERE` clause
+  or in `ORDER BY`, including `joinLeft.filters`, `joinLeft.conditions` and `orderBy`, which
+  previously rejected them with 400. They remain rejected in `selectComputed`,
+  `computeMin/Max/Sum/Avg`, `joinGroup.aggregations.by` and `defaultOrder`, where the
+  expression precedes the `WHERE` values in the parameter order.
+- A computed field whose `?` markers do not match `values.length` now fails with a clear error
+  instead of producing a query that binds values nothing references.
+
+## [0.1.5]
+
+### Added
+
+- **`readExclude`** on `defineTable`: hide columns from every read while leaving writes
+  untouched — the case for a password hash or an access token, writable but never readable.
+  Excluded fields are not selected by search/get, are omitted from read response schemas and
+  from the table's default join selection, and cannot be referenced from `filters`,
+  `conditions`, `orderBy`, aggregations or an explicit join `selection` (400). Allowing a
+  hidden field to be filtered would leak its value by bisection. Primary keys cannot be
+  excluded.
+
+### Fixed
+
+- **Granular route plugins did not work standalone.** Registering only `searchRoutes`/`getRoutes`
+  as documented produced a 500, because `fastify.sqlApi` was decorated by the main plugin alone.
+  Each route plugin now creates the decorator in its own scope when no ancestor provides it.
+- **`defaultOrder` required raw column names** while the rest of the API is camelCase, so
+  `defaultOrder: 'squadIndex'` produced `column "squadindex" does not exist`. It is now mapped
+  through the schema like the request `orderBy`, and supports multiple fields and computed
+  fields. Raw SQL fragments still pass through unchanged, so existing configurations keep
+  working. The same mapping applies to the primary-key fallback, which had the same defect.
+- **`sqlapi-generate-tables` with a subset of tables** generated a `dbTables.ts` importing every
+  schema, including tables whose `Table*.ts` was never created — the project did not compile
+  until the file was trimmed by hand. The index now references only the table files present on
+  disk, and the CLI reports which entries to add when `dbTables.ts` already exists.
+- **Generated imports lacked the `.js` extension**, so the emitted files did not compile under
+  `moduleResolution: NodeNext` without editing them by hand.
+
+## [0.1.4]
+
+### Fixed
+
+- Hardened tenant isolation, added request limits (`maxItemsPerPage`, `maxBulkItems`), and
+  fixed placeholder binding in search.
+
+## [0.1.3] and earlier
+
+Released before this changelog was kept. See the git history for details: notable entries are
+the join API redesign (documented in [BREAKING_CHANGES.md](./BREAKING_CHANGES.md)), composite
+primary key support in updates, transactional insert/update with secondaries, the hook matrix,
+and bulk operations.
+
+[0.1.7]: https://github.com/LucaRainone/fastify-auto-sqlapi/releases/tag/v0.1.7
+[0.1.6]: https://github.com/LucaRainone/fastify-auto-sqlapi/releases/tag/v0.1.6
+[0.1.5]: https://github.com/LucaRainone/fastify-auto-sqlapi/releases/tag/v0.1.5
+[0.1.4]: https://github.com/LucaRainone/fastify-auto-sqlapi/releases/tag/v0.1.4

package/README.md

@@ -29,7 +29,9 @@ Point it at your database, and get a full REST API with search, advanced conditi
 - **Swagger UI** — optional, auto-configured from your schemas
 - **Composable** — register all routes or pick only what you need
 
-> ⚠️ **Migrating from a previous version?** The join API was redesigned. See **[BREAKING_CHANGES.md](./BREAKING_CHANGES.md)** for the full migration guide.
+> ⚠️ **Upgrading?** See **[CHANGELOG.md](./CHANGELOG.md)** for what changed in each release, and
+> **[BREAKING_CHANGES.md](./BREAKING_CHANGES.md)** for migration guides. If you use `computedFields`
+> with bound values, read the 0.1.6 entry — earlier versions could return wrong rows.
 
 ## Quick Start
 

package/dist/lib/cli/tables-codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tables-codegen.d.ts","sourceRoot":"","sources":["../../../src/lib/cli/tables-codegen.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAuCpE;AAuCD,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,gBAAgB,EAAE,CAwB3E;AAID,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,CA2HhG;AAID,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAqBrE;AAID,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CA6FlE"}
+{"version":3,"file":"tables-codegen.d.ts","sourceRoot":"","sources":["../../../src/lib/cli/tables-codegen.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAuCpE;AAuCD,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,gBAAgB,EAAE,CAwB3E;AAID,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,CA6HhG;AAID,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAqBrE;AAID,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CA6FlE"}

package/dist/lib/cli/tables-codegen.js

@@ -151,7 +151,9 @@ export function generateSingleTableFile(schema, allSchemas) {
     lines.push(`  //   Schema,`);
     lines.push(`  //   extraFiltersValidation,`);
     lines.push(`  //   (condition, filters) => {`);
-    lines.push(`  //     if (filters.q) condition.isILike(Schema.col('${schema.fields.includes('name') ? 'name' : schema.fields[0]}'), \`%\${filters.q}%\`);`);
+    lines.push(`  //     // Prefix columns with the table name: the query may carry joins, and a`);
+    lines.push(`  //     // bare column shared with a joined table would be ambiguous.`);
+    lines.push(`  //     if (filters.q) condition.isILike(\`\${Schema.tableName}.\${Schema.col('${schema.fields.includes('name') ? 'name' : schema.fields[0]}')}\`, \`%\${filters.q}%\`);`);
     lines.push(`  //   }`);
     lines.push(`  // ),`);
     lines.push(`  defaultOrder: '${pkFirst(pk)}',`);

package/dist/lib/engine/query-params.d.ts

@@ -0,0 +1,40 @@
+import type { ConditionBuilder } from 'node-condition-builder';
+import type { QueryClient } from '../db.js';
+/**
+ * Owns the bound values of a statement while it is being assembled.
+ *
+ * A statement is built from several fragments (WHERE condition, EXISTS subqueries,
+ * aggregation clauses, LEFT JOIN filters, ORDER BY), each of which must number its
+ * placeholders from wherever the preceding fragments left off. Computing that offset at the
+ * call site is how placeholders drift out of step with values — a query that binds a value
+ * nobody references does not fail, it silently reads the wrong parameter.
+ *
+ * Here the offset is derived in exactly one place. `emit` hands a producer the index its
+ * first placeholder must take and absorbs the values it returned in the same step, so SQL
+ * and values cannot be appended independently.
+ *
+ * Fragments must be emitted in the order their placeholders appear in the final SQL: MySQL
+ * binds `?` positionally, so a fragment numbered out of textual order would break there while
+ * working on PostgreSQL.
+ */
+export declare class QueryParams {
+    private values;
+    /** Values bound so far. */
+    get length(): number;
+    /**
+     * Render a fragment at the current offset and record the values it bound.
+     * Returns whatever the producer returned, so callers can read its SQL and any extras.
+     */
+    emit<T extends {
+        values: unknown[];
+    }>(produce: (startIndex: number) => T): T;
+    /** Render a ConditionBuilder at the current offset and return its SQL. */
+    emitCondition(condition: ConditionBuilder, db: QueryClient): string;
+    /**
+     * Copy of the values bound so far. Take a snapshot before emitting a fragment that only
+     * the main query carries (ORDER BY), so the COUNT/aggregate queries can bind the subset
+     * they actually reference.
+     */
+    snapshot(): unknown[];
+}
+//# sourceMappingURL=query-params.d.ts.map

package/dist/lib/engine/query-params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-params.d.ts","sourceRoot":"","sources":["../../../src/lib/engine/query-params.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAiB;IAE/B,2BAA2B;IAC3B,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED;;;OAGG;IACH,IAAI,CAAC,CAAC,SAAS;QAAE,MAAM,EAAE,OAAO,EAAE,CAAA;KAAE,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC;IAM5E,0EAA0E;IAC1E,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE,WAAW,GAAG,MAAM;IAOnE;;;;OAIG;IACH,QAAQ,IAAI,OAAO,EAAE;CAGtB"}

package/dist/lib/engine/query-params.js

@@ -0,0 +1,48 @@
+/**
+ * Owns the bound values of a statement while it is being assembled.
+ *
+ * A statement is built from several fragments (WHERE condition, EXISTS subqueries,
+ * aggregation clauses, LEFT JOIN filters, ORDER BY), each of which must number its
+ * placeholders from wherever the preceding fragments left off. Computing that offset at the
+ * call site is how placeholders drift out of step with values — a query that binds a value
+ * nobody references does not fail, it silently reads the wrong parameter.
+ *
+ * Here the offset is derived in exactly one place. `emit` hands a producer the index its
+ * first placeholder must take and absorbs the values it returned in the same step, so SQL
+ * and values cannot be appended independently.
+ *
+ * Fragments must be emitted in the order their placeholders appear in the final SQL: MySQL
+ * binds `?` positionally, so a fragment numbered out of textual order would break there while
+ * working on PostgreSQL.
+ */
+export class QueryParams {
+    values = [];
+    /** Values bound so far. */
+    get length() {
+        return this.values.length;
+    }
+    /**
+     * Render a fragment at the current offset and record the values it bound.
+     * Returns whatever the producer returned, so callers can read its SQL and any extras.
+     */
+    emit(produce) {
+        const out = produce(this.values.length + 1);
+        this.values.push(...out.values);
+        return out;
+    }
+    /** Render a ConditionBuilder at the current offset and return its SQL. */
+    emitCondition(condition, db) {
+        return this.emit((startIndex) => ({
+            sql: condition.build(startIndex, db.ph),
+            values: condition.getValues(),
+        })).sql;
+    }
+    /**
+     * Copy of the values bound so far. Take a snapshot before emitting a fragment that only
+     * the main query carries (ORDER BY), so the COUNT/aggregate queries can bind the subset
+     * they actually reference.
+     */
+    snapshot() {
+        return [...this.values];
+    }
+}

package/dist/lib/engine/rest/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/get.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAuB,MAAM,mBAAmB,CAAC;AAEnF,wBAAsB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CA8BrE"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/get.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAuB,MAAM,mBAAmB,CAAC;AAEnF,wBAAsB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAgCrE"}

package/dist/lib/engine/rest/get.js

@@ -8,10 +8,12 @@ export async function getEngine(params) {
     const { db, tableConf, id, tenant } = params;
     const pkCol = tableConf.Schema.col(primaryAsString(tableConf.primary));
     const cb = new ConditionBuilder('AND', db.cbDialect);
-    cb.isEqual(db.qi(pkCol), id);
+    // Table-qualified: the tenant scope may add a through-join, and a bare PK column
+    // shared with the through table would be ambiguous.
+    cb.isEqual(`${db.qi(tableConf.Schema.tableName)}.${db.qi(pkCol)}`, id);
     const joins = [];
     if (tenant) {
-        cb.append(buildTenantCondition(db, tenant.scope, tenant.ids));
+        cb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableConf.Schema.tableName));
         if ('through' in tenant.scope) {
             joins.push(buildTenantJoin(db, tenant.scope, tableConf.Schema.tableName));
         }

package/dist/lib/engine/search/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EAcb,MAAM,mBAAmB,CAAC;AAmkC3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CAkIvB"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EAcb,MAAM,mBAAmB,CAAC;AAwlC3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CA4HvB"}

package/dist/lib/engine/search/search.js

@@ -1,5 +1,6 @@
 import { ConditionBuilder, Expression } from 'node-condition-builder';
 import { camelcaseObject } from '../../naming.js';
+import { QueryParams } from '../query-params.js';
 import { buildTenantCondition, buildTenantJoin } from '../../tenant.js';
 import { assertReadable, assertFiltersReadable, readableSelectColumns } from '../../read-access.js';
 import { primaryAsString } from '../../../types.js';
@@ -32,7 +33,9 @@ function buildComputedContext(db, schema, alias) {
                 err400(`Unknown field referenced by computed expression: ${field}`);
             }
             const col = db.qi(schema.col(field));
-            const qualifier = opts?.qualifier ?? alias;
+            // Default to the owning table: the statement may carry joins, and a bare
+            // column shared with a joined table would be ambiguous.
+            const qualifier = opts?.qualifier ?? alias ?? schema.tableName;
             return qualifier ? `${db.qi(qualifier)}.${col}` : col;
         },
     };
@@ -41,7 +44,9 @@ function resolveFieldRef(field, schema, tableConf, db, alias) {
     if (field in schema.fields) {
         assertReadable(tableConf, field);
         const col = db.qi(schema.col(field));
-        const expr = alias ? `${db.qi(alias)}.${col}` : col;
+        // Qualified with the alias or the owning table — never bare, so the reference
+        // stays unambiguous when the statement carries joins.
+        const expr = `${db.qi(alias ?? schema.tableName)}.${col}`;
         return { expr, computed: false };
     }
     const fn = tableConf?.computedFields?.[field];
@@ -57,16 +62,28 @@ function resolveFieldRef(field, schema, tableConf, db, alias) {
  * appends the tenant condition to `cb` (direct: `col IN ids`; indirect: condition on the
  * through table) and, for indirect scopes, pushes the INNER JOIN clause into `joins`.
  * No-op without a tenant context (admin) or when the join table is not tenant-scoped.
+ *
+ * `joinTableRef` is the raw name the join table goes by in the statement: its table name
+ * in plain side-queries, or the subquery alias inside an aliased, correlated EXISTS.
  */
-function appendJoinTenantScope(db, joinTableConf, tenant, joinTableName, cb, joins) {
+function appendJoinTenantScope(db, joinTableConf, tenant, joinTableRef, cb, joins) {
     const scope = joinTableConf?.tenantScope;
     if (!tenant || !scope)
         return;
-    cb.append(buildTenantCondition(db, scope, tenant.ids));
+    cb.append(buildTenantCondition(db, scope, tenant.ids, joinTableRef));
     if ('through' in scope) {
-        joins?.push(buildTenantJoin(db, scope, joinTableName));
+        joins?.push(buildTenantJoin(db, scope, joinTableRef));
     }
 }
+/**
+ * Alias for the FROM of a correlated subquery (EXISTS, aggregate). The subquery must not
+ * say `FROM <table>` bare: on a self-referencing relation the inner table would shadow the
+ * outer one and the correlation would silently compare each row with itself. The request
+ * alias is used, suffixed when it would itself collide with the outer table's name.
+ */
+function subqueryAlias(alias, tableConf) {
+    return alias === tableConf.Schema.tableName ? `${alias}_sub` : alias;
+}
 function findJoinByAlias(tableConf, alias) {
     return tableConf.allowedReadJoins?.find((j) => j.alias === alias);
 }
@@ -164,9 +181,10 @@ function buildSelectionColumns(selection, joinSchema, db, joinTableConf) {
     if (selection === '*') {
         return readableSelectColumns(joinTableConf, joinSchema, db) ?? '*';
     }
+    const table = db.qi(joinSchema.tableName);
     return selection
         .split(',')
-        .map((c) => db.qi(validateSchemaField(c.trim(), joinSchema, joinTableConf)))
+        .map((c) => `${table}.${db.qi(validateSchemaField(c.trim(), joinSchema, joinTableConf))}`)
         .join(', ');
 }
 const AGG_FN = {
@@ -180,7 +198,12 @@ const AGG_FN = {
 function aggExpr(fn, qualifiedCol) {
     return fn.distinct ? `COUNT(DISTINCT ${qualifiedCol})` : `${fn.sql}(${qualifiedCol})`;
 }
-function buildAggOrderExpr(db, dbTables, tableConf, alias, fn, field, joinGroup, startIdx) {
+/**
+ * Correlated aggregate subquery for `<alias>.<fn>.<field>`, as an Expression carrying the
+ * values of its optional filter. Markers are `?`, so whoever embeds it — a ConditionBuilder
+ * or an ORDER BY list — decides the placeholder positions.
+ */
+function buildAggOrderExpr(db, dbTables, tableConf, alias, fn, field, joinGroup) {
     const aggFn = AGG_FN[fn];
     if (!aggFn)
         err400(`Invalid aggregation function: ${fn}`);
@@ -198,20 +221,24 @@ function buildAggOrderExpr(db, dbTables, tableConf, alias, fn, field, joinGroup,
     }
     const fieldCol = validateSchemaField(field, joinSchema);
     const refs = extractJoinRefs(db, tableConf, joinDef);
+    // The subquery FROM is aliased so the correlation to the outer table survives a
+    // self-referencing relation; everything inside references the alias.
+    const subAlias = subqueryAlias(alias, tableConf);
+    const subRef = db.qi(subAlias);
     let filterWhere = '';
     let filterVals = [];
     const joinTableConf = dbTables[joinSchema.tableName];
     if (groupReq.filters || groupReq.conditions?.length) {
-        const cb = buildJoinRefCondition(joinTableConf, joinSchema, { filters: groupReq.filters, conditions: groupReq.conditions }, db);
-        const built = cb.build(startIdx, db.ph);
-        if (built) {
-            filterWhere = ` AND ${built}`;
-            filterVals = cb.getValues();
+        const cb = buildJoinRefCondition(joinTableConf, joinSchema, { filters: groupReq.filters, conditions: groupReq.conditions }, db, subAlias);
+        const fragment = cb.toExpression();
+        if (fragment.value) {
+            filterWhere = ` AND ${fragment.value}`;
+            filterVals = [...fragment.values];
         }
     }
-    const qualifiedCol = `${refs.joinTable}.${db.qi(fieldCol)}`;
-    const expr = `COALESCE((SELECT ${aggExpr(aggFn, qualifiedCol)} FROM ${refs.joinTable} WHERE ${refs.joinTable}.${refs.fkCol} = ${refs.mainTable}.${refs.mainCol}${filterWhere}), 0)`;
-    return { expr, values: filterVals };
+    const qualifiedCol = `${subRef}.${db.qi(fieldCol)}`;
+    const expr = `COALESCE((SELECT ${aggExpr(aggFn, qualifiedCol)} FROM ${refs.joinTable} AS ${subRef} WHERE ${subRef}.${refs.fkCol} = ${refs.mainTable}.${refs.mainCol}${filterWhere}), 0)`;
+    return new Expression(expr, filterVals);
 }
 /**
  * Pre-scan `orderBy` for the joinLeft aliases referenced in 2-parti notation (`<alias>.<field>`).
@@ -250,10 +277,11 @@ function validateOrderBy(orderBy, tableConf, db, dbTables, joinGroup, startIdx)
                 err400('Cannot combine distinctResults with aggregation orderBy');
             }
             const [, alias, fn, field, dir] = dotted3;
-            const { expr, values } = buildAggOrderExpr(db, dbTables, tableConf, alias, fn, field, joinGroup, currentIdx);
-            outParts.push(`${expr} ${(dir || 'ASC').toUpperCase()}`);
-            outValues.push(...values);
-            currentIdx += values.length;
+            const expr = buildAggOrderExpr(db, dbTables, tableConf, alias, fn, field, joinGroup);
+            const aggVals = [...expr.values];
+            outParts.push(`${renderRef(expr, currentIdx, db)} ${(dir || 'ASC').toUpperCase()}`);
+            outValues.push(...aggVals);
+            currentIdx += aggVals.length;
             continue;
         }
         // 2-parti: <alias>.<field> [ASC|DESC] (joinLeft inline ordering)
@@ -368,7 +396,7 @@ function convertConfiguredOrder(order, tableConf, db) {
             const [, field, dir] = match;
             const suffix = dir ? ` ${dir.toUpperCase()}` : '';
             if (field in tableConf.Schema.fields) {
-                return `${db.qi(tableConf.Schema.col(field))}${suffix}`;
+                return `${db.qi(tableConf.Schema.tableName)}.${db.qi(tableConf.Schema.col(field))}${suffix}`;
             }
             const computed = tableConf.computedFields?.[field];
             if (computed) {
@@ -463,7 +491,7 @@ async function executeJoinMultiple(db, dbTables, tableConf, mainResults, joinMul
         }
         const cb = buildJoinRefCondition(joinTableConf, joinSchema, ref || {}, db);
         const fkCol = joinSchema.col(joinField);
-        cb.isIn(db.qi(fkCol), ids);
+        cb.isIn(`${db.qi(joinSchema.tableName)}.${db.qi(fkCol)}`, ids);
         const tenantJoins = [];
         appendJoinTenantScope(db, joinTableConf, tenant, joinSchema.tableName, cb, tenantJoins);
         const where = cb.build(1, db.ph);
@@ -497,7 +525,7 @@ async function executeJoinLeft(db, dbTables, tableConf, mainResults, joinLeft, t
         }
         const fkCol = joinSchema.col(joinField);
         const cb = new ConditionBuilder('AND', db.cbDialect);
-        cb.isIn(db.qi(fkCol), ids);
+        cb.isIn(`${db.qi(joinSchema.tableName)}.${db.qi(fkCol)}`, ids);
         const tenantJoins = [];
         appendJoinTenantScope(db, joinTableConf, tenant, joinSchema.tableName, cb, tenantJoins);
         const where = cb.build(1, db.ph);
@@ -527,7 +555,7 @@ function buildByExpression(by, joinSchema, joinTableConf, db) {
         err400(`Invalid 'by' specification: expected a field or computed name`);
     }
     if (by in joinSchema.fields) {
-        return db.qi(joinSchema.col(by));
+        return `${db.qi(joinSchema.tableName)}.${db.qi(joinSchema.col(by))}`;
     }
     const fn = joinTableConf?.computedFields?.[by];
     if (fn) {
@@ -561,7 +589,7 @@ async function executeJoinGroup(db, dbTables, tableConf, mainResults, joinGroup,
             const fn = AGG_FN[kind];
             for (const f of fields) {
                 const col = validateSchemaField(f, joinSchema, joinTableConf);
-                selectParts.push(`${aggExpr(fn, db.qi(col))} as "${kind}_${f}"`);
+                selectParts.push(`${aggExpr(fn, `${db.qi(joinSchema.tableName)}.${db.qi(col)}`)} as "${kind}_${f}"`);
             }
         };
         addAgg('distinctCount', aggregations.distinctCount);
@@ -577,7 +605,7 @@ async function executeJoinGroup(db, dbTables, tableConf, mainResults, joinGroup,
         const groupRef = { filters: groupFilters, conditions: groupConditions };
         const cb = buildJoinRefCondition(joinTableConf, joinSchema, groupRef, db);
         const fkCol = joinSchema.col(joinField);
-        cb.isIn(db.qi(fkCol), ids);
+        cb.isIn(`${db.qi(joinSchema.tableName)}.${db.qi(fkCol)}`, ids);
         const tenantJoins = [];
         appendJoinTenantScope(db, joinTableConf, tenant, joinSchema.tableName, cb, tenantJoins);
         const where = cb.build(1, db.ph);
@@ -640,10 +668,13 @@ function dispatchConditionMethod(cb, method, colOrExpr, params) {
         cb[method](colOrExpr, true);
     }
 }
-function buildJoinRefCondition(joinTableConf, joinSchema, ref, db) {
+function buildJoinRefCondition(joinTableConf, joinSchema, ref, db, qualifier) {
     assertFiltersReadable(ref.filters, joinTableConf);
+    // Bare table name for plain side-queries; the subquery alias when the condition lands
+    // inside an aliased, correlated FROM (there the table name would resolve to the outer query).
+    const colQualifier = qualifier ?? joinSchema.tableName;
     const cb = (ref.filters && joinTableConf)
-        ? joinTableConf.filters(ref.filters, db.cbDialect)
+        ? joinTableConf.filters(ref.filters, db.cbDialect, colQualifier)
         : new ConditionBuilder('AND', db.cbDialect);
     // Equality filters targeting the join table's computed fields
     const computed = joinTableConf?.computedFields;
@@ -653,7 +684,7 @@ function buildJoinRefCondition(joinTableConf, joinSchema, ref, db) {
                 continue;
             if (!computed[name])
                 continue;
-            const expr = evaluateComputedField(name, computed[name], joinTableConf.Schema, db, undefined, '', true);
+            const expr = evaluateComputedField(name, computed[name], joinTableConf.Schema, db, colQualifier, '', true);
             cb.isEqual(expr, value);
         }
     }
@@ -665,8 +696,8 @@ function buildJoinRefCondition(joinTableConf, joinSchema, ref, db) {
             // Computed fields resolve to an Expression carrying their own bound values, which
             // the ConditionBuilder places together with the compared value.
             const operand = computed?.[c.field]
-                ? evaluateComputedField(c.field, computed[c.field], joinTableConf.Schema, db, undefined, '', true)
-                : db.qi(validateSchemaField(c.field, joinSchema, joinTableConf));
+                ? evaluateComputedField(c.field, computed[c.field], joinTableConf.Schema, db, colQualifier, '', true)
+                : `${db.qi(colQualifier)}.${db.qi(validateSchemaField(c.field, joinSchema, joinTableConf))}`;
             dispatchConditionMethod(cb, c.method, operand, c.params ?? []);
         }
     }
@@ -710,9 +741,8 @@ function applyComputedFilters(condition, filters, tableConf, db) {
         condition.isEqual(expr, value);
     }
 }
-function appendAggConditions(currentWhere, currentValues, conditions, db, dbTables, tableConf, joinGroup) {
-    let where = currentWhere;
-    let values = [...currentValues];
+function appendAggConditions(params, conditions, db, dbTables, tableConf, joinGroup) {
+    let where = '';
     for (const c of conditions) {
         if (!c.field.includes('.'))
             continue;
@@ -724,44 +754,38 @@ function appendAggConditions(currentWhere, currentValues, conditions, db, dbTabl
             err400(`Invalid dotted field in condition: ${c.field} (expected <alias>.<fn>.<field>)`);
         }
         const [alias, fn, field] = parts;
-        const { expr, values: exprValues } = buildAggOrderExpr(db, dbTables, tableConf, alias, fn, field, joinGroup, values.length + 1);
-        values = [...values, ...exprValues];
+        // The aggregate carries the values of its own filter; passing it as the left-hand side
+        // lets the ConditionBuilder place those and the compared value in one step.
+        const expr = buildAggOrderExpr(db, dbTables, tableConf, alias, fn, field, joinGroup);
         const tmpCb = new ConditionBuilder('AND', db.cbDialect);
         dispatchConditionMethod(tmpCb, c.method, expr, c.params);
-        const startIdx = values.length + 1;
-        const clause = tmpCb.build(startIdx, db.ph);
-        where += ` AND ${clause}`;
-        values.push(...tmpCb.getValues());
+        where += ` AND ${params.emitCondition(tmpCb, db)}`;
     }
-    return { where, values };
+    return where;
 }
 // ─── joinMustExist (EXISTS subquery filter on main) ─────────
-function buildJoinMustExistClauses(db, dbTables, tableConf, joinMustExist, currentWhere, currentValues, tenant) {
-    let where = currentWhere;
-    const values = [...currentValues];
+function buildJoinMustExistClauses(params, db, dbTables, tableConf, joinMustExist, tenant) {
+    let where = '';
     for (const [alias, ref] of Object.entries(joinMustExist)) {
         const joinDef = requireJoin(tableConf, alias, false);
         const { joinSchema } = joinDef;
         const joinTableConf = dbTables[joinSchema.tableName];
         const refs = extractJoinRefs(db, tableConf, joinDef);
-        const filterCondition = buildJoinRefCondition(joinTableConf, joinSchema, ref, db);
+        // The EXISTS FROM is aliased so the correlation to the outer table survives a
+        // self-referencing relation; everything inside references the alias.
+        const subAlias = subqueryAlias(alias, tableConf);
+        const subRef = db.qi(subAlias);
+        const filterCondition = buildJoinRefCondition(joinTableConf, joinSchema, ref, db, subAlias);
         const tenantJoins = [];
-        appendJoinTenantScope(db, joinTableConf, tenant, joinSchema.tableName, filterCondition, tenantJoins);
-        // The sub-condition (computed fields included) is built by the ConditionBuilder, which
-        // numbers its placeholders from where the outer values end.
-        const startIdx = values.length + 1;
-        const filterWhere = filterCondition.build(startIdx, db.ph);
-        const filterVals = [...filterCondition.getValues()];
-        // Qualify the FK with the join table: the EXISTS FROM may include the tenant
-        // through-join, so a bare column could become ambiguous.
+        appendJoinTenantScope(db, joinTableConf, tenant, subAlias, filterCondition, tenantJoins);
+        const filterWhere = params.emitCondition(filterCondition, db);
         const innerWhere = filterWhere
-            ? `${refs.joinTable}.${refs.fkCol} = ${refs.mainTable}.${refs.mainCol} AND ${filterWhere}`
-            : `${refs.joinTable}.${refs.fkCol} = ${refs.mainTable}.${refs.mainCol}`;
+            ? `${subRef}.${refs.fkCol} = ${refs.mainTable}.${refs.mainCol} AND ${filterWhere}`
+            : `${subRef}.${refs.fkCol} = ${refs.mainTable}.${refs.mainCol}`;
         const existsJoins = tenantJoins.length > 0 ? ` ${tenantJoins.join(' ')}` : '';
-        where += ` AND EXISTS (SELECT 1 FROM ${refs.joinTable}${existsJoins} WHERE ${innerWhere})`;
-        values.push(...filterVals);
+        where += ` AND EXISTS (SELECT 1 FROM ${refs.joinTable} AS ${subRef}${existsJoins} WHERE ${innerWhere})`;
     }
-    return { where, values };
+    return where;
 }
 // ─── searchEngine entrypoint ────────────────────────────────
 export async function searchEngine(dbTables, params) {
@@ -794,23 +818,24 @@ export async function searchEngine(dbTables, params) {
     // Tenant
     const tenantJoins = [];
     if (tenant) {
-        condition.append(buildTenantCondition(db, tenant.scope, tenant.ids));
+        condition.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableConf.Schema.tableName));
         if ('through' in tenant.scope) {
             tenantJoins.push(buildTenantJoin(db, tenant.scope, tableConf.Schema.tableName));
         }
     }
-    let where = condition.build(1, db.ph);
-    let values = [...condition.getValues()];
+    // From here the statement is assembled fragment by fragment. `bound` owns the values and
+    // hands each fragment the placeholder index it must start from, so no offset is computed
+    // at any call site. Fragments must be emitted in the order their placeholders appear in
+    // the final SQL — MySQL binds `?` positionally.
+    const bound = new QueryParams();
+    let where = bound.emitCondition(condition, db);
     // joinMustExist (EXISTS)
     if (joinMustExist && Object.keys(joinMustExist).length > 0) {
-        ({ where, values } = buildJoinMustExistClauses(db, dbTables, tableConf, joinMustExist, where, values, tenant));
+        where += buildJoinMustExistClauses(bound, db, dbTables, tableConf, joinMustExist, tenant);
     }
     // Aggregation conditions (HAVING-style)
-    if (conditions?.length) {
-        const hasAggConditions = conditions.some((c) => c.field.includes('.'));
-        if (hasAggConditions) {
-            ({ where, values } = appendAggConditions(where, values, conditions, db, dbTables, tableConf, joinGroup));
-        }
+    if (conditions?.length && conditions.some((c) => c.field.includes('.'))) {
+        where += appendAggConditions(bound, conditions, db, dbTables, tableConf, joinGroup);
     }
     // Determine which joinLeft aliases need a LEFT JOIN on the main query:
     // - any alias used in 2-parti orderBy
@@ -826,32 +851,24 @@ export async function searchEngine(dbTables, params) {
                 aliasesNeedingLeftJoin.add(alias);
         }
     }
-    // Build LEFT JOIN clauses + extra WHERE for filtered parents. Their placeholders start right
-    // after the WHERE values; the same clause SQL is reused by the pagination COUNT/compute queries,
-    // whose value array is [...WHERE, ...leftJoin] — so this base MUST stay `values.length + 1`.
+    // LEFT JOIN clauses + extra WHERE for filtered parents.
     const extraJoinClauses = [...tenantJoins];
-    let leftJoinValues = [];
     if (aliasesNeedingLeftJoin.size > 0) {
-        const lj = buildLeftJoinClauses(db, dbTables, tableConf, aliasesNeedingLeftJoin, joinLeft, values.length + 1);
+        const lj = bound.emit((startIndex) => buildLeftJoinClauses(db, dbTables, tableConf, aliasesNeedingLeftJoin, joinLeft, startIndex));
         extraJoinClauses.push(...lj.joinClauses);
-        leftJoinValues = lj.values;
         for (const w of lj.whereExtras)
             where += ` AND ${w}`;
     }
-    // orderBy is parsed AFTER the LEFT JOIN values so aggregation-orderBy placeholders start past
-    // them (main query binds [...WHERE, ...leftJoin, ...orderBy]). Parsing it earlier with base
-    // `values.length + 1` misbinds when BOTH an aggregation orderBy and a filtered joinLeft exist.
+    // The pagination COUNT and the compute* queries reuse the WHERE and its joins but drop the
+    // ORDER BY, so they bind everything up to this point and nothing after it.
+    const whereAndJoinValues = bound.snapshot();
+    // ORDER BY is emitted last, so an aggregation-orderBy numbers its placeholders past the
+    // WHERE and LEFT JOIN values.
     let safeOrderBy;
-    let orderByValues = [];
     if (orderBy) {
-        const obResult = validateOrderBy(orderBy, tableConf, db, dbTables, joinGroup, values.length + leftJoinValues.length + 1);
-        safeOrderBy = obResult.sql;
-        orderByValues = obResult.values;
-    }
-    // Bind WHERE values + LEFT JOIN values + orderBy aggregation values for main query.
-    // Pagination COUNT/compute include WHERE + LEFT JOIN values (no orderBy).
-    const whereAndJoinValues = [...values, ...leftJoinValues];
-    const mainValues = [...whereAndJoinValues, ...orderByValues];
+        safeOrderBy = bound.emit((startIndex) => validateOrderBy(orderBy, tableConf, db, dbTables, joinGroup, startIndex)).sql;
+    }
+    const mainValues = bound.snapshot();
     const main = await executeMainQuery(db, tableConf, where, mainValues, safeOrderBy, paginator, extraJoinClauses, params.selectComputed, params.maxRows);
     let pagination;
     if (paginator) {

package/dist/lib/table-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table-helpers.d.ts","sourceRoot":"","sources":["../../src/lib/table-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,yBAAyB,EAAiC,MAAM,wBAAwB,CAAC;AACzH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,MAAM,EACP,MAAM,aAAa,CAAC;AAarB,KAAK,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAExH,wBAAgB,eAAe,CAC7B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,EAAE,SAAS,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAErE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC3B,YAAY,GAAE,EAAa,EAC3B,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,yBAAyB;CAAE,KAC3E,IAAI,GACR;IAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CA0BhG;AAED,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAChB,MAAM,CAAC,CAAC,CAAC,CAMX;AAkED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,aAAa,CAC3B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC/B,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,EAClD,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC/B,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,EAC3B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,cAAc,CAShB;AAED,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC3B,OAAO,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,GAC5B,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAE9B;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,GACvC,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAEjC"}
+{"version":3,"file":"table-helpers.d.ts","sourceRoot":"","sources":["../../src/lib/table-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,yBAAyB,EAAiC,MAAM,wBAAwB,CAAC;AACzH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,MAAM,EACP,MAAM,aAAa,CAAC;AAarB,KAAK,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAExH,wBAAgB,eAAe,CAC7B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,EAAE,SAAS,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAErE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC3B,YAAY,GAAE,EAAa,EAC3B,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,yBAAyB;CAAE,KAC3E,IAAI,GACR;IAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CA8BhG;AAED,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAChB,MAAM,CAAC,CAAC,CAAC,CAMX;AAkED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,aAAa,CAC3B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC/B,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,EAClD,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC/B,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,EAC3B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,cAAc,CAShB;AAED,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC3B,OAAO,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,GAC5B,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAE9B;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,GACvC,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAEjC"}

package/dist/lib/table-helpers.js

@@ -9,12 +9,16 @@ function qi(field, dialect) {
     return getDialect(dialect ?? ConditionBuilder.DIALECT).qi(field);
 }
 export function exportTableInfo(Schema, extraFilters = {}, extendedCondition) {
-    const filters = (filterValues, dialect) => {
+    const filters = (filterValues, dialect, qualifier) => {
         const condition = new ConditionBuilder('AND', dialect);
-        // Only auto-match real schema fields (DB columns)
+        // Only auto-match real schema fields (DB columns). Columns are table-qualified:
+        // the statement may carry joins (LEFT JOIN parents, tenant through-joins), and a
+        // bare column shared with a joined table would be ambiguous. A caller-provided
+        // qualifier (a subquery alias) takes precedence over the table name.
+        const table = qi(qualifier ?? Schema.tableName, dialect);
         for (const field of Object.keys(Schema.fields)) {
             if (field in filterValues && filterValues[field] !== null && filterValues[field] !== undefined) {
-                condition.isEqual(qi(Schema.col(field), dialect), filterValues[field]);
+                condition.isEqual(`${table}.${qi(Schema.col(field), dialect)}`, filterValues[field]);
             }
         }
         // extraFilters are handled exclusively by extendedCondition

package/dist/lib/tenant.d.ts

@@ -3,7 +3,7 @@ import type { QueryClient } from './db.js';
 import { ConditionBuilder, type ConditionValue, type ConditionValueOrUndefined } from 'node-condition-builder';
 import type { ITable, SqlApiPluginOptions, TenantId, TenantScope, TenantScopeIndirect, TenantContext } from '../types.js';
 export declare function resolveTenant(options: SqlApiPluginOptions, tableConf: ITable, request: FastifyRequest): Promise<TenantContext | undefined>;
-export declare function buildTenantCondition(db: QueryClient, scope: TenantScope, tenantIds: TenantId[]): ConditionBuilder;
+export declare function buildTenantCondition(db: QueryClient, scope: TenantScope, tenantIds: TenantId[], ownTable: string): ConditionBuilder;
 export declare function buildTenantJoin(db: QueryClient, scope: TenantScopeIndirect, mainTableName: string): string;
 export declare function injectTenantValue(record: Record<string, unknown>, scope: TenantScope, tenantIds: TenantId[]): void;
 export declare function validateTenantFK(db: QueryClient, scope: TenantScopeIndirect, tenantIds: TenantId[], fkValues: unknown[]): Promise<void>;

package/dist/lib/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/lib/tenant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAE/G,OAAO,KAAK,EACV,MAAM,EACN,mBAAmB,EACnB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,aAAa,EACd,MAAM,aAAa,CAAC;AAMrB,wBAAsB,aAAa,CACjC,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CASpC;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EAAE,GACpB,gBAAgB,CAclB;AAED,wBAAgB,eAAe,CAC7B,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,aAAa,EAAE,MAAM,GACpB,MAAM,CAMR;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EAAE,GACpB,IAAI,CAiBN;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,SAAS,EAAE,QAAQ,EAAE,EACrB,QAAQ,EAAE,OAAO,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GAAG,cAAc,EAAE,EACrD,MAAM,EAAE,aAAa,GACpB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAsBtC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CA2Df;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,WAAW,GACjB,IAAI,CAGN;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,GAChC,gBAAgB,GAAG,SAAS,CAM9B;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,cAAc,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CAgBf"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/lib/tenant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAE/G,OAAO,KAAK,EACV,MAAM,EACN,mBAAmB,EACnB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,aAAa,EACd,MAAM,aAAa,CAAC;AAMrB,wBAAsB,aAAa,CACjC,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CASpC;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,gBAAgB,CAgBlB;AAED,wBAAgB,eAAe,CAC7B,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,aAAa,EAAE,MAAM,GACpB,MAAM,CAMR;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EAAE,GACpB,IAAI,CAiBN;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,SAAS,EAAE,QAAQ,EAAE,EACrB,QAAQ,EAAE,OAAO,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GAAG,cAAc,EAAE,EACrD,MAAM,EAAE,aAAa,GACpB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAsBtC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CA2Df;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,WAAW,GACjB,IAAI,CAGN;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,GAChC,gBAAgB,GAAG,SAAS,CAM9B;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,cAAc,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/types/table.d.ts

@@ -16,8 +16,13 @@ export type ExtendedConditionFn = (condition: ConditionBuilder, filters: FilterR
  * `dialect` selects identifier quoting and builder behavior per call (the engines pass
  * the dialect of the QueryClient that runs the query); when omitted, the global
  * `ConditionBuilder.DIALECT` is used.
+ *
+ * `qualifier` is the raw (unquoted) table name or alias to prefix columns with; it
+ * defaults to the table's own name. The engines pass an alias when the condition lands
+ * inside a correlated subquery whose FROM is aliased — there the bare table name would
+ * resolve against the OUTER query.
  */
-export type TableFilterFn = (filters: FilterRecord, dialect?: CbDialect) => ConditionBuilder;
+export type TableFilterFn = (filters: FilterRecord, dialect?: CbDialect, qualifier?: string) => ConditionBuilder;
 export interface ITable<F extends Record<string, TSchema> = Record<string, TSchema>> {
     primary: (string & keyof F) | (string & keyof F)[];
     Schema: SchemaDefinition<F>;

package/dist/types/table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../src/types/table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,WAAW,IAAI,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAChI,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEpE,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,YAAY,GACZ,YAAY,CAAC;AAEjB,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;AAC/F;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,SAAS,KAAK,gBAAgB,CAAC;AAE7F,MAAM,WAAW,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjF,OAAO,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACjD,gBAAgB,CAAC,EAAE,cAAc,EAAE,CAAC;IACpC,iBAAiB,CAAC,EAAE,cAAc,EAAE,CAAC;IACrC,SAAS,CAAC,EAAE,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,YAAY,CAAC,EAAE,CACb,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;SAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,IAAI;KAAE,KAC1D,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,YAAY,CAAC,EAAE,CACb,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;SAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,IAAI;KAAE,EAC7D,sBAAsB,CAAC,EAAE,OAAO,KAC7B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,CAAC,EAAE,CACZ,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;SAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAAE,EACzC,gBAAgB,CAAC,EAAE,OAAO,KACvB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CACZ,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;SAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,IAAI;KAAE,EAC7D,gBAAgB,CAAC,EAAE,OAAO,EAC1B,eAAe,CAAC,EAAE,OAAO,KACtB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,CACb,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,GAAG,MAAM,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,CACZ,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,GAAG,MAAM,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,CACjB,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,KACrB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAChB,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,KAC5B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;IAC3C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC;IAChG,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAGD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAGnD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,CAE7D;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAEpG"}
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../src/types/table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,WAAW,IAAI,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAChI,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEpE,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,YAAY,GACZ,YAAY,CAAC;AAEjB,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;AAC/F;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,gBAAgB,CAAC;AAEjH,MAAM,WAAW,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjF,OAAO,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACjD,gBAAgB,CAAC,EAAE,cAAc,EAAE,CAAC;IACpC,iBAAiB,CAAC,EAAE,cAAc,EAAE,CAAC;IACrC,SAAS,CAAC,EAAE,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,YAAY,CAAC,EAAE,CACb,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;SAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,IAAI;KAAE,KAC1D,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,YAAY,CAAC,EAAE,CACb,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;SAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,IAAI;KAAE,EAC7D,sBAAsB,CAAC,EAAE,OAAO,KAC7B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,CAAC,EAAE,CACZ,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;SAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAAE,EACzC,gBAAgB,CAAC,EAAE,OAAO,KACvB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CACZ,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;SAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,IAAI;KAAE,EAC7D,gBAAgB,CAAC,EAAE,OAAO,EAC1B,eAAe,CAAC,EAAE,OAAO,KACtB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,CACb,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,GAAG,MAAM,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,CACZ,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,GAAG,MAAM,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,CACjB,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,KACrB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAChB,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,KAC5B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;IAC3C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC;IAChG,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAGD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAGnD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,CAE7D;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAEpG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify-auto-sqlapi",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Fastify plugin for automatic CRUD API generation from PostgreSQL, MySQL and MariaDB tables",
   "type": "module",
   "main": "./dist/index.js",
@@ -20,7 +20,9 @@
     "dist",
     "AGENTS.md",
     "AGENTS_BACKEND.md",
-    "AGENTS_FRONTEND.md"
+    "AGENTS_FRONTEND.md",
+    "CHANGELOG.md",
+    "BREAKING_CHANGES.md"
   ],
   "scripts": {
     "clean": "rm -rf dist",