kysely 0.28.15 → 0.28.17

package/README.md

@@ -1,6 +1,7 @@
 [![Stand With Ukraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://stand-with-ukraine.pp.ua)
 
 [![NPM Version](https://img.shields.io/npm/v/kysely?style=flat&label=latest)](https://github.com/kysely-org/kysely/releases/latest)
+[![Socket Badge](https://badge.socket.dev/npm/package/kysely/0.28.17)](https://socket.dev/npm/package/kysely/overview/0.28.17)
 [![Tests](https://github.com/kysely-org/kysely/actions/workflows/test.yml/badge.svg)](https://github.com/kysely-org/kysely)
 [![License](https://img.shields.io/github/license/kysely-org/kysely?style=flat)](https://github.com/kysely-org/kysely/blob/master/LICENSE)
 [![Issues](https://img.shields.io/github/issues-closed/kysely-org/kysely?logo=github)](https://github.com/kysely-org/kysely/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc)

package/dist/cjs/dialect/mysql/mysql-query-compiler.d.ts

@@ -17,5 +17,11 @@ export declare class MysqlQueryCompiler extends DefaultQueryCompiler {
      * @see https://dev.mysql.com/doc/refman/9.6/en/string-literals.html
      */
     protected sanitizeStringLiteral(value: string): string;
+    /**
+     * Member values appear inside `"..."` in the JSON path, which itself sits
+     * inside a SQL string literal. They must therefore be escaped twice — once
+     * for the JSON path grammar, then again for MySQL's string literal parser.
+     */
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected visitCreateIndex(node: CreateIndexNode): void;
 }

package/dist/cjs/dialect/mysql/mysql-query-compiler.js

@@ -2,8 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MysqlQueryCompiler = void 0;
 const default_query_compiler_js_1 = require("../../query-compiler/default-query-compiler.js");
-const LITERAL_ESCAPE_REGEX = /\\|'/g;
+const LITERAL_ESCAPE_REGEX = /[\\']/g;
 const ID_WRAP_REGEX = /`/g;
+const JSON_PATH_MEMBER_ESCAPE_REGEX = /[\\'"]/g;
 class MysqlQueryCompiler extends default_query_compiler_js_1.DefaultQueryCompiler {
     getCurrentParameterPlaceholder() {
         return '?';
@@ -39,6 +40,14 @@ class MysqlQueryCompiler extends default_query_compiler_js_1.DefaultQueryCompile
     sanitizeStringLiteral(value) {
         return value.replace(LITERAL_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\' : "''");
     }
+    /**
+     * Member values appear inside `"..."` in the JSON path, which itself sits
+     * inside a SQL string literal. They must therefore be escaped twice — once
+     * for the JSON path grammar, then again for MySQL's string literal parser.
+     */
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\\\\\' : char === "'" ? "''" : '\\\\"');
+    }
     visitCreateIndex(node) {
         this.append('create ');
         if (node.unique) {

package/dist/cjs/dialect/sqlite/sqlite-query-compiler.d.ts

@@ -10,5 +10,6 @@ export declare class SqliteQueryCompiler extends DefaultQueryCompiler {
     protected getRightIdentifierWrapper(): string;
     protected getAutoIncrement(): string;
     protected sanitizeIdentifier(identifier: string): string;
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected visitDefaultInsertValue(_: DefaultInsertValueNode): void;
 }

package/dist/cjs/dialect/sqlite/sqlite-query-compiler.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SqliteQueryCompiler = void 0;
 const default_query_compiler_js_1 = require("../../query-compiler/default-query-compiler.js");
 const ID_WRAP_REGEX = /"/g;
+const JSON_PATH_MEMBER_ESCAPE_REGEX = /[\\'"]/g;
 class SqliteQueryCompiler extends default_query_compiler_js_1.DefaultQueryCompiler {
     visitOrAction(node) {
         this.append('or ');
@@ -29,6 +30,9 @@ class SqliteQueryCompiler extends default_query_compiler_js_1.DefaultQueryCompil
     sanitizeIdentifier(identifier) {
         return identifier.replace(ID_WRAP_REGEX, '""');
     }
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\' : char === "'" ? "''" : '\\"');
+    }
     visitDefaultInsertValue(_) {
         // sqlite doesn't support the `default` keyword in inserts.
         this.append('null');

package/dist/cjs/expression/expression-builder.d.ts

@@ -524,7 +524,7 @@ export interface ExpressionBuilder<DB, TB extends keyof DB> {
      * ```
      *
      * In the next example a reference tuple is compared to a subquery. Note that
-     * in this case you need to use the {@link @SelectQueryBuilder.$asTuple | $asTuple}
+     * in this case you need to use the {@link SelectQueryBuilder.$asTuple | $asTuple}
      * function:
      *
      * ```ts

package/dist/cjs/index.d.ts

@@ -1,3 +1,7 @@
+/**
+ * @module
+ * @mergeModuleWith <project>
+ */
 export * from './kysely.js';
 export * from './query-creator.js';
 export * from './expression/expression.js';

package/dist/cjs/index.js

@@ -1,4 +1,8 @@
 "use strict";
+/**
+ * @module
+ * @mergeModuleWith <project>
+ */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);

package/dist/cjs/parser/binary-operation-parser.d.ts

@@ -6,12 +6,14 @@ import { type ValueExpression, type ValueExpressionOrList } from './value-parser
 import type { OperationNode } from '../operation-node/operation-node.js';
 import type { Expression } from '../expression/expression.js';
 import type { SelectType } from '../util/column-type.js';
+import type { IsNever } from '../util/type-utils.js';
+import type { KyselyTypeError } from '../util/type-error.js';
 export type OperandValueExpression<DB, TB extends keyof DB, RE> = ValueExpression<DB, TB, ExtractTypeFromReferenceExpression<DB, TB, RE>>;
 export type OperandValueExpressionOrList<DB, TB extends keyof DB, RE> = ValueExpressionOrList<DB, TB, ExtractTypeFromReferenceExpression<DB, TB, RE> | null>;
 export type OperatorExpression = Operator | Expression<unknown>;
 export type BinaryOperatorExpression = BinaryOperator | Expression<unknown>;
 export type ComparisonOperatorExpression = ComparisonOperator | Expression<unknown>;
-export type FilterObject<DB, TB extends keyof DB> = {
+export type FilterObject<DB, TB extends keyof DB> = IsNever<TB> extends true ? KyselyTypeError<'there are no tables in query context, so a filter object cannot be defined. try passing an array instead.'> : {
     [R in StringReference<DB, TB>]?: ValueExpressionOrList<DB, TB, SelectType<ExtractTypeFromStringReference<DB, TB, R>>>;
 };
 export declare function parseValueBinaryOperationOrExpression(args: any[]): OperationNode;

package/dist/cjs/query-builder/delete-query-builder.d.ts

@@ -653,10 +653,6 @@ export declare class DeleteQueryBuilder<DB, TB extends keyof DB, O> implements W
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples
@@ -976,21 +972,21 @@ export declare class DeleteQueryBuilder<DB, TB extends keyof DB, O> implements W
      */
     clearLimit(): DeleteQueryBuilder<DB, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}>>(expr: OE, modifiers?: OrderByModifiers): DeleteQueryBuilder<DB, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated It does ~2-2.6x more compile-time instantiations compared to multiple chained `orderBy(expr, modifiers?)` calls (in `order by` clauses with reasonable item counts), and has broken autocompletion.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}> | DirectedOrderByStringReference<DB, TB, {}>>(exprs: ReadonlyArray<OE>): DeleteQueryBuilder<DB, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated It does ~2.9x more compile-time instantiations compared to a `orderBy(expr, direction)` call.
      */
     orderBy<OE extends DirectedOrderByStringReference<DB, TB, {}>>(expr: OE): DeleteQueryBuilder<DB, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated Use `orderBy(expr, (ob) => ...)` instead.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}>>(expr: OE, modifiers: Expression<any>): DeleteQueryBuilder<DB, TB, O>;

package/dist/cjs/query-builder/insert-query-builder.d.ts

@@ -752,10 +752,6 @@ export declare class InsertQueryBuilder<DB, TB extends keyof DB, O> implements R
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples

package/dist/cjs/query-builder/json-path-builder.js

@@ -9,6 +9,7 @@ const json_path_node_js_1 = require("../operation-node/json-path-node.js");
 const json_reference_node_js_1 = require("../operation-node/json-reference-node.js");
 const operation_node_source_js_1 = require("../operation-node/operation-node-source.js");
 const value_node_js_1 = require("../operation-node/value-node.js");
+const HASH_NEGATIVE_INDEX_REGEX = /^#-\d+$/;
 class JSONPathBuilder {
     #node;
     constructor(node) {
@@ -82,6 +83,13 @@ class JSONPathBuilder {
      * ```
      */
     at(index) {
+        if ((typeof index !== 'number' && typeof index !== 'string') ||
+            (typeof index === 'number' && !Number.isInteger(index)) ||
+            (typeof index === 'string' &&
+                index !== 'last' &&
+                !HASH_NEGATIVE_INDEX_REGEX.test(index))) {
+            throw new Error(`Unexpected index value in .at(...): ${index}`);
+        }
         return this.#createBuilderWithPathLeg('ArrayLocation', index);
     }
     /**

package/dist/cjs/query-builder/merge-query-builder.d.ts

@@ -130,10 +130,6 @@ export declare class MergeQueryBuilder<DB, TT extends keyof DB, O> implements Mu
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples
@@ -527,10 +523,6 @@ export declare class WheneableMergeQueryBuilder<DB, TT extends keyof DB, ST exte
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples

package/dist/cjs/query-builder/returning-interface.d.ts

@@ -8,10 +8,6 @@ export interface ReturningInterface<DB, TB extends keyof DB, O> {
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples

package/dist/cjs/query-builder/update-query-builder.d.ts

@@ -602,21 +602,21 @@ export declare class UpdateQueryBuilder<DB, UT extends keyof DB, TB extends keyo
     fullJoin<TE extends TableExpression<DB, TB>, K1 extends JoinReferenceExpression<DB, TB, TE>, K2 extends JoinReferenceExpression<DB, TB, TE>>(table: TE, k1: K1, k2: K2): UpdateQueryBuilderWithFullJoin<DB, UT, TB, O, TE>;
     fullJoin<TE extends TableExpression<DB, TB>, FN extends JoinCallbackExpression<DB, TB, TE>>(table: TE, callback: FN): UpdateQueryBuilderWithFullJoin<DB, UT, TB, O, TE>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}>>(expr: OE, modifiers?: OrderByModifiers): UpdateQueryBuilder<DB, UT, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated It does ~2-2.6x more compile-time instantiations compared to multiple chained `orderBy(expr, modifiers?)` calls (in `order by` clauses with reasonable item counts), and has broken autocompletion.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}> | DirectedOrderByStringReference<DB, TB, {}>>(exprs: ReadonlyArray<OE>): UpdateQueryBuilder<DB, UT, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated It does ~2.9x more compile-time instantiations compared to a `orderBy(expr, direction)` call.
      */
     orderBy<OE extends DirectedOrderByStringReference<DB, TB, {}>>(expr: OE): UpdateQueryBuilder<DB, UT, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated Use `orderBy(expr, (ob) => ...)` instead.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}>>(expr: OE, modifiers: Expression<any>): UpdateQueryBuilder<DB, UT, TB, O>;
@@ -850,10 +850,6 @@ export declare class UpdateQueryBuilder<DB, UT extends keyof DB, TB extends keyo
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples

package/dist/cjs/query-compiler/default-query-compiler.d.ts

@@ -222,6 +222,7 @@ export declare class DefaultQueryCompiler extends OperationNodeVisitor implement
     protected getRightExplainOptionsWrapper(): string;
     protected sanitizeIdentifier(identifier: string): string;
     protected sanitizeStringLiteral(value: string): string;
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected addParameter(parameter: unknown): void;
     protected appendImmediateValue(value: unknown): void;
     protected appendStringLiteral(value: string): void;

package/dist/cjs/query-compiler/default-query-compiler.js

@@ -13,6 +13,7 @@ const set_operation_node_js_1 = require("../operation-node/set-operation-node.js
 const when_node_js_1 = require("../operation-node/when-node.js");
 const log_once_js_1 = require("../util/log-once.js");
 const LIT_WRAP_REGEX = /'/g;
+const JSON_PATH_MEMBER_WRAP_REGEX = /['"]/g;
 class DefaultQueryCompiler extends operation_node_visitor_js_1.OperationNodeVisitor {
     #sql = '';
     #parameters = [];
@@ -1168,13 +1169,17 @@ class DefaultQueryCompiler extends operation_node_visitor_js_1.OperationNodeVisi
     }
     visitJSONPathLeg(node) {
         const isArrayLocation = node.type === 'ArrayLocation';
-        this.append(isArrayLocation ? '[' : '.');
-        this.append(typeof node.value === 'string'
-            ? this.sanitizeStringLiteral(node.value)
-            : String(node.value));
+        const value = String(node.value);
         if (isArrayLocation) {
+            this.append('[');
+            this.append(this.sanitizeStringLiteral(value));
             this.append(']');
         }
+        else {
+            this.append('."');
+            this.append(this.sanitizeJSONPathMemberValue(value));
+            this.append('"');
+        }
     }
     visitJSONOperatorChain(node) {
         for (let i = 0, len = node.values.length; i < len; i++) {
@@ -1321,6 +1326,9 @@ class DefaultQueryCompiler extends operation_node_visitor_js_1.OperationNodeVisi
     sanitizeStringLiteral(value) {
         return value.replace(LIT_WRAP_REGEX, "''");
     }
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_WRAP_REGEX, (char) => char === "'" ? "''" : '\\"');
+    }
     addParameter(parameter) {
         this.#parameters.push(parameter);
     }

package/dist/esm/dialect/mysql/mysql-query-compiler.d.ts

@@ -17,5 +17,11 @@ export declare class MysqlQueryCompiler extends DefaultQueryCompiler {
      * @see https://dev.mysql.com/doc/refman/9.6/en/string-literals.html
      */
     protected sanitizeStringLiteral(value: string): string;
+    /**
+     * Member values appear inside `"..."` in the JSON path, which itself sits
+     * inside a SQL string literal. They must therefore be escaped twice — once
+     * for the JSON path grammar, then again for MySQL's string literal parser.
+     */
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected visitCreateIndex(node: CreateIndexNode): void;
 }

package/dist/esm/dialect/mysql/mysql-query-compiler.js

@@ -1,7 +1,8 @@
 /// <reference types="./mysql-query-compiler.d.ts" />
 import { DefaultQueryCompiler } from '../../query-compiler/default-query-compiler.js';
-const LITERAL_ESCAPE_REGEX = /\\|'/g;
+const LITERAL_ESCAPE_REGEX = /[\\']/g;
 const ID_WRAP_REGEX = /`/g;
+const JSON_PATH_MEMBER_ESCAPE_REGEX = /[\\'"]/g;
 export class MysqlQueryCompiler extends DefaultQueryCompiler {
     getCurrentParameterPlaceholder() {
         return '?';
@@ -37,6 +38,14 @@ export class MysqlQueryCompiler extends DefaultQueryCompiler {
     sanitizeStringLiteral(value) {
         return value.replace(LITERAL_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\' : "''");
     }
+    /**
+     * Member values appear inside `"..."` in the JSON path, which itself sits
+     * inside a SQL string literal. They must therefore be escaped twice — once
+     * for the JSON path grammar, then again for MySQL's string literal parser.
+     */
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\\\\\' : char === "'" ? "''" : '\\\\"');
+    }
     visitCreateIndex(node) {
         this.append('create ');
         if (node.unique) {

package/dist/esm/dialect/sqlite/sqlite-query-compiler.d.ts

@@ -10,5 +10,6 @@ export declare class SqliteQueryCompiler extends DefaultQueryCompiler {
     protected getRightIdentifierWrapper(): string;
     protected getAutoIncrement(): string;
     protected sanitizeIdentifier(identifier: string): string;
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected visitDefaultInsertValue(_: DefaultInsertValueNode): void;
 }

package/dist/esm/dialect/sqlite/sqlite-query-compiler.js

@@ -1,6 +1,7 @@
 /// <reference types="./sqlite-query-compiler.d.ts" />
 import { DefaultQueryCompiler } from '../../query-compiler/default-query-compiler.js';
 const ID_WRAP_REGEX = /"/g;
+const JSON_PATH_MEMBER_ESCAPE_REGEX = /[\\'"]/g;
 export class SqliteQueryCompiler extends DefaultQueryCompiler {
     visitOrAction(node) {
         this.append('or ');
@@ -27,6 +28,9 @@ export class SqliteQueryCompiler extends DefaultQueryCompiler {
     sanitizeIdentifier(identifier) {
         return identifier.replace(ID_WRAP_REGEX, '""');
     }
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\' : char === "'" ? "''" : '\\"');
+    }
     visitDefaultInsertValue(_) {
         // sqlite doesn't support the `default` keyword in inserts.
         this.append('null');

package/dist/esm/expression/expression-builder.d.ts

@@ -524,7 +524,7 @@ export interface ExpressionBuilder<DB, TB extends keyof DB> {
      * ```
      *
      * In the next example a reference tuple is compared to a subquery. Note that
-     * in this case you need to use the {@link @SelectQueryBuilder.$asTuple | $asTuple}
+     * in this case you need to use the {@link SelectQueryBuilder.$asTuple | $asTuple}
      * function:
      *
      * ```ts

package/dist/esm/index.d.ts

@@ -1,3 +1,7 @@
+/**
+ * @module
+ * @mergeModuleWith <project>
+ */
 export * from './kysely.js';
 export * from './query-creator.js';
 export * from './expression/expression.js';

package/dist/esm/index.js

@@ -1,4 +1,8 @@
 /// <reference types="./index.d.ts" />
+/**
+ * @module
+ * @mergeModuleWith <project>
+ */
 export * from './kysely.js';
 export * from './query-creator.js';
 export * from './expression/expression.js';

package/dist/esm/parser/binary-operation-parser.d.ts

@@ -6,12 +6,14 @@ import { type ValueExpression, type ValueExpressionOrList } from './value-parser
 import type { OperationNode } from '../operation-node/operation-node.js';
 import type { Expression } from '../expression/expression.js';
 import type { SelectType } from '../util/column-type.js';
+import type { IsNever } from '../util/type-utils.js';
+import type { KyselyTypeError } from '../util/type-error.js';
 export type OperandValueExpression<DB, TB extends keyof DB, RE> = ValueExpression<DB, TB, ExtractTypeFromReferenceExpression<DB, TB, RE>>;
 export type OperandValueExpressionOrList<DB, TB extends keyof DB, RE> = ValueExpressionOrList<DB, TB, ExtractTypeFromReferenceExpression<DB, TB, RE> | null>;
 export type OperatorExpression = Operator | Expression<unknown>;
 export type BinaryOperatorExpression = BinaryOperator | Expression<unknown>;
 export type ComparisonOperatorExpression = ComparisonOperator | Expression<unknown>;
-export type FilterObject<DB, TB extends keyof DB> = {
+export type FilterObject<DB, TB extends keyof DB> = IsNever<TB> extends true ? KyselyTypeError<'there are no tables in query context, so a filter object cannot be defined. try passing an array instead.'> : {
     [R in StringReference<DB, TB>]?: ValueExpressionOrList<DB, TB, SelectType<ExtractTypeFromStringReference<DB, TB, R>>>;
 };
 export declare function parseValueBinaryOperationOrExpression(args: any[]): OperationNode;

package/dist/esm/query-builder/delete-query-builder.d.ts

@@ -653,10 +653,6 @@ export declare class DeleteQueryBuilder<DB, TB extends keyof DB, O> implements W
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples
@@ -976,21 +972,21 @@ export declare class DeleteQueryBuilder<DB, TB extends keyof DB, O> implements W
      */
     clearLimit(): DeleteQueryBuilder<DB, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}>>(expr: OE, modifiers?: OrderByModifiers): DeleteQueryBuilder<DB, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated It does ~2-2.6x more compile-time instantiations compared to multiple chained `orderBy(expr, modifiers?)` calls (in `order by` clauses with reasonable item counts), and has broken autocompletion.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}> | DirectedOrderByStringReference<DB, TB, {}>>(exprs: ReadonlyArray<OE>): DeleteQueryBuilder<DB, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated It does ~2.9x more compile-time instantiations compared to a `orderBy(expr, direction)` call.
      */
     orderBy<OE extends DirectedOrderByStringReference<DB, TB, {}>>(expr: OE): DeleteQueryBuilder<DB, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated Use `orderBy(expr, (ob) => ...)` instead.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}>>(expr: OE, modifiers: Expression<any>): DeleteQueryBuilder<DB, TB, O>;

package/dist/esm/query-builder/insert-query-builder.d.ts

@@ -752,10 +752,6 @@ export declare class InsertQueryBuilder<DB, TB extends keyof DB, O> implements R
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples

package/dist/esm/query-builder/json-path-builder.js

@@ -7,6 +7,7 @@ import { JSONPathNode } from '../operation-node/json-path-node.js';
 import { JSONReferenceNode } from '../operation-node/json-reference-node.js';
 import { isOperationNodeSource } from '../operation-node/operation-node-source.js';
 import { ValueNode } from '../operation-node/value-node.js';
+const HASH_NEGATIVE_INDEX_REGEX = /^#-\d+$/;
 export class JSONPathBuilder {
     #node;
     constructor(node) {
@@ -80,6 +81,13 @@ export class JSONPathBuilder {
      * ```
      */
     at(index) {
+        if ((typeof index !== 'number' && typeof index !== 'string') ||
+            (typeof index === 'number' && !Number.isInteger(index)) ||
+            (typeof index === 'string' &&
+                index !== 'last' &&
+                !HASH_NEGATIVE_INDEX_REGEX.test(index))) {
+            throw new Error(`Unexpected index value in .at(...): ${index}`);
+        }
         return this.#createBuilderWithPathLeg('ArrayLocation', index);
     }
     /**

package/dist/esm/query-builder/merge-query-builder.d.ts

@@ -130,10 +130,6 @@ export declare class MergeQueryBuilder<DB, TT extends keyof DB, O> implements Mu
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples
@@ -527,10 +523,6 @@ export declare class WheneableMergeQueryBuilder<DB, TT extends keyof DB, ST exte
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples

package/dist/esm/query-builder/returning-interface.d.ts

@@ -8,10 +8,6 @@ export interface ReturningInterface<DB, TB extends keyof DB, O> {
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples

package/dist/esm/query-builder/update-query-builder.d.ts

@@ -602,21 +602,21 @@ export declare class UpdateQueryBuilder<DB, UT extends keyof DB, TB extends keyo
     fullJoin<TE extends TableExpression<DB, TB>, K1 extends JoinReferenceExpression<DB, TB, TE>, K2 extends JoinReferenceExpression<DB, TB, TE>>(table: TE, k1: K1, k2: K2): UpdateQueryBuilderWithFullJoin<DB, UT, TB, O, TE>;
     fullJoin<TE extends TableExpression<DB, TB>, FN extends JoinCallbackExpression<DB, TB, TE>>(table: TE, callback: FN): UpdateQueryBuilderWithFullJoin<DB, UT, TB, O, TE>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}>>(expr: OE, modifiers?: OrderByModifiers): UpdateQueryBuilder<DB, UT, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated It does ~2-2.6x more compile-time instantiations compared to multiple chained `orderBy(expr, modifiers?)` calls (in `order by` clauses with reasonable item counts), and has broken autocompletion.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}> | DirectedOrderByStringReference<DB, TB, {}>>(exprs: ReadonlyArray<OE>): UpdateQueryBuilder<DB, UT, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated It does ~2.9x more compile-time instantiations compared to a `orderBy(expr, direction)` call.
      */
     orderBy<OE extends DirectedOrderByStringReference<DB, TB, {}>>(expr: OE): UpdateQueryBuilder<DB, UT, TB, O>;
     /**
-     * @description This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
+     * @remarks This is only supported by some dialects like MySQL or SQLite with `SQLITE_ENABLE_UPDATE_DELETE_LIMIT`.
      * @deprecated Use `orderBy(expr, (ob) => ...)` instead.
      */
     orderBy<OE extends OrderByExpression<DB, TB, {}>>(expr: OE, modifiers: Expression<any>): UpdateQueryBuilder<DB, UT, TB, O>;
@@ -850,10 +850,6 @@ export declare class UpdateQueryBuilder<DB, UT extends keyof DB, TB extends keyo
      * On supported databases like PostgreSQL, this method can be chained to
      * `insert`, `update`, `delete` and `merge` queries to return data.
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
      *
      * ### Examples

package/dist/esm/query-compiler/default-query-compiler.d.ts

@@ -222,6 +222,7 @@ export declare class DefaultQueryCompiler extends OperationNodeVisitor implement
     protected getRightExplainOptionsWrapper(): string;
     protected sanitizeIdentifier(identifier: string): string;
     protected sanitizeStringLiteral(value: string): string;
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected addParameter(parameter: unknown): void;
     protected appendImmediateValue(value: unknown): void;
     protected appendStringLiteral(value: string): void;

package/dist/esm/query-compiler/default-query-compiler.js

@@ -11,6 +11,7 @@ import { SetOperationNode } from '../operation-node/set-operation-node.js';
 import { WhenNode } from '../operation-node/when-node.js';
 import { logOnce } from '../util/log-once.js';
 const LIT_WRAP_REGEX = /'/g;
+const JSON_PATH_MEMBER_WRAP_REGEX = /['"]/g;
 export class DefaultQueryCompiler extends OperationNodeVisitor {
     #sql = '';
     #parameters = [];
@@ -1166,13 +1167,17 @@ export class DefaultQueryCompiler extends OperationNodeVisitor {
     }
     visitJSONPathLeg(node) {
         const isArrayLocation = node.type === 'ArrayLocation';
-        this.append(isArrayLocation ? '[' : '.');
-        this.append(typeof node.value === 'string'
-            ? this.sanitizeStringLiteral(node.value)
-            : String(node.value));
+        const value = String(node.value);
         if (isArrayLocation) {
+            this.append('[');
+            this.append(this.sanitizeStringLiteral(value));
             this.append(']');
         }
+        else {
+            this.append('."');
+            this.append(this.sanitizeJSONPathMemberValue(value));
+            this.append('"');
+        }
     }
     visitJSONOperatorChain(node) {
         for (let i = 0, len = node.values.length; i < len; i++) {
@@ -1319,6 +1324,9 @@ export class DefaultQueryCompiler extends OperationNodeVisitor {
     sanitizeStringLiteral(value) {
         return value.replace(LIT_WRAP_REGEX, "''");
     }
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_WRAP_REGEX, (char) => char === "'" ? "''" : '\\"');
+    }
     addParameter(parameter) {
         this.#parameters.push(parameter);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kysely",
-  "version": "0.28.15",
+  "version": "0.28.17",
   "description": "Type safe SQL query builder",
   "repository": {
     "type": "git",
@@ -77,38 +77,38 @@
     "Igal Klebanov <igalklebanov@gmail.com>"
   ],
   "devDependencies": {
-    "@arethetypeswrong/cli": "^0.18.2",
-    "@ark/attest": "^0.56.0",
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/chai": "^5.2.3",
-    "@types/chai-as-promised": "^8.0.2",
-    "@types/mocha": "^10.0.10",
-    "@types/node": "^25.5.0",
-    "@types/pg": "^8.20.0",
-    "@types/pg-cursor": "^2.7.2",
-    "@types/semver": "^7.7.1",
-    "@types/sinon": "^21.0.0",
-    "better-sqlite3": "^12.8.0",
-    "chai": "^6.2.2",
-    "chai-as-promised": "^8.0.2",
-    "esbuild": "^0.27.4",
-    "jsr": "^0.14.3",
-    "lodash": "^4.17.23",
-    "mocha": "^11.7.5",
-    "mysql2": "^3.20.0",
-    "pathe": "^2.0.3",
-    "pg": "^8.20.0",
-    "pg-cursor": "^2.19.0",
-    "pkg-types": "^2.3.0",
-    "playwright": "^1.58.2",
-    "prettier": "^3.8.1",
-    "semver": "^7.7.4",
-    "sinon": "^21.0.3",
-    "std-env": "^4.0.0",
-    "tarn": "^3.0.2",
-    "tedious": "^19.2.1",
-    "tsd": "^0.33.0",
-    "typescript": "~6.0.2"
+    "@arethetypeswrong/cli": "0.18.2",
+    "@ark/attest": "0.56.0",
+    "@types/better-sqlite3": "7.6.13",
+    "@types/chai": "5.2.3",
+    "@types/chai-as-promised": "8.0.2",
+    "@types/mocha": "10.0.10",
+    "@types/node": "25.5.2",
+    "@types/pg": "8.20.0",
+    "@types/pg-cursor": "2.7.2",
+    "@types/semver": "7.7.1",
+    "@types/sinon": "21.0.1",
+    "better-sqlite3": "12.8.0",
+    "chai": "6.2.2",
+    "chai-as-promised": "8.0.2",
+    "esbuild": "0.28.0",
+    "jsr": "0.14.3",
+    "lodash": "4.18.1",
+    "mocha": "11.7.5",
+    "mysql2": "3.21.0",
+    "pathe": "2.0.3",
+    "pg": "8.20.0",
+    "pg-cursor": "2.19.0",
+    "pkg-types": "2.3.0",
+    "playwright": "1.59.1",
+    "prettier": "3.8.1",
+    "semver": "7.7.4",
+    "sinon": "21.0.3",
+    "std-env": "4.0.0",
+    "tarn": "3.0.2",
+    "tedious": "19.2.1",
+    "tsd": "0.33.0",
+    "typescript": "6.0.2"
   },
   "scripts": {
     "clean": "rm -rf dist & rm -rf test/node/dist & rm -rf test/browser/bundle.js & rm -rf helpers",
@@ -121,7 +121,7 @@
     "test:browser": "pnpm build && pnpm test:browser:build && node test/browser/test.js",
     "test:bun": "pnpm build && bun link && cd test/bun && bun install && bun run test",
     "test:cloudflare-workers": "pnpm build && pnpm -r test --filter kysely-cloudflare-workers-test",
-    "test:deno": "deno run --allow-env --allow-read --allow-net --no-lock test/deno/local.test.ts && deno run --allow-env --allow-read --allow-net --no-lock test/deno/cdn.test.ts",
+    "test:deno": "deno run --allow-env --allow-read --allow-net --no-lock test/deno/test.ts",
     "test:typings": "tsd test/typings",
     "test:esmimports": "node scripts/check-esm-imports.cjs",
     "test:esbuild": "esbuild --bundle --platform=node --external:pg-native dist/esm/index.js --outfile=/dev/null",