sails-sqlite 0.2.3 → 0.2.5

package/lib/private/machines/avg-records.js

@@ -59,12 +59,12 @@ module.exports = {
 
     try {
       let avgQuery = `SELECT COALESCE(AVG(\`${numericFieldName}\`), 0) as average FROM \`${tableName}\``
-      if (whereClause) {
-        avgQuery += ` WHERE ${whereClause}`
+      if (whereClause.clause) {
+        avgQuery += ` WHERE ${whereClause.clause}`
       }
 
       const stmt = db.prepare(avgQuery)
-      const result = stmt.get()
+      const result = stmt.get(...whereClause.bindings)
 
       return exits.success(result.average)
     } catch (err) {

package/lib/private/machines/count-records.js

@@ -63,12 +63,12 @@ module.exports = {
 
     try {
       let countQuery = `SELECT COUNT(*) as count FROM \`${tableName}\``
-      if (whereClause) {
-        countQuery += ` WHERE ${whereClause}`
+      if (whereClause.clause) {
+        countQuery += ` WHERE ${whereClause.clause}`
       }
 
       const stmt = db.prepare(countQuery)
-      const result = stmt.get()
+      const result = stmt.get(...whereClause.bindings)
 
       return exits.success(result.count)
     } catch (err) {

package/lib/private/machines/create-manager.js

@@ -41,12 +41,19 @@ module.exports = {
       }
 
       // Create database connection with optimized options
+      // Determine verbose logging function:
+      // - verbose: true -> use console.log
+      // - verbose: function -> use custom function
+      // - verbose: false/undefined -> disabled
+      let verboseFn = null
+      if (meta?.verbose === true) {
+        verboseFn = console.log
+      } else if (typeof meta?.verbose === 'function') {
+        verboseFn = meta.verbose
+      }
+
       const dbOptions = {
-        // Enable verbose mode in development
-        verbose:
-          meta?.verbose || process.env.NODE_ENV === 'development'
-            ? console.log
-            : null,
+        verbose: verboseFn,
         // Set timeout for database operations
         timeout: meta?.timeout || 5000,
         // Enable read-only mode if specified

package/lib/private/machines/destroy-records.js

@@ -54,7 +54,7 @@ module.exports = {
     const pkColumnName = WLModel.attributes[WLModel.primaryKey].columnName
     const isFetchEnabled = !!(s3q.meta && s3q.meta.fetch)
 
-    const sqliteWhere = buildSqliteWhereClause(
+    const whereClause = buildSqliteWhereClause(
       s3q.criteria.where,
       WLModel,
       s3q.meta
@@ -68,29 +68,29 @@ module.exports = {
     try {
       // Start a transaction only if we're not already in one
       if (!wasInTransaction) {
-        db.exec('BEGIN TRANSACTION')
+        db.prepare('BEGIN TRANSACTION').run()
       }
 
       let phRecords
       if (isFetchEnabled) {
         // Fetch matching records before deletion
-        const selectSql = sqliteWhere
-          ? `SELECT * FROM \`${tableName}\` WHERE ${sqliteWhere}`
+        const selectSql = whereClause.clause
+          ? `SELECT * FROM \`${tableName}\` WHERE ${whereClause.clause}`
           : `SELECT * FROM \`${tableName}\``
         const selectStmt = db.prepare(selectSql)
-        phRecords = selectStmt.all()
+        phRecords = selectStmt.all(...whereClause.bindings)
       }
 
       // Perform the deletion
-      const deleteSql = sqliteWhere
-        ? `DELETE FROM \`${tableName}\` WHERE ${sqliteWhere}`
+      const deleteSql = whereClause.clause
+        ? `DELETE FROM \`${tableName}\` WHERE ${whereClause.clause}`
         : `DELETE FROM \`${tableName}\``
       const deleteStmt = db.prepare(deleteSql)
-      const deleteInfo = deleteStmt.run()
+      const deleteInfo = deleteStmt.run(...whereClause.bindings)
 
       // Commit the transaction only if we started it
       if (!wasInTransaction) {
-        db.exec('COMMIT')
+        db.prepare('COMMIT').run()
       }
 
       if (!isFetchEnabled) {
@@ -106,7 +106,7 @@ module.exports = {
     } catch (err) {
       // Rollback the transaction in case of error (only if we started it)
       if (!wasInTransaction) {
-        db.exec('ROLLBACK')
+        db.prepare('ROLLBACK').run()
       }
       return exits.error(err)
     }

package/lib/private/machines/find-records.js

@@ -70,8 +70,8 @@ module.exports = {
         WLModel,
         s3q.meta
       )
-      if (whereClause) {
-        sqlQuery += ` WHERE ${whereClause}`
+      if (whereClause.clause) {
+        sqlQuery += ` WHERE ${whereClause.clause}`
       }
 
       // Handle SORT clause
@@ -99,12 +99,9 @@ module.exports = {
         sqlQuery += ` OFFSET ${s3q.criteria.skip}`
       }
 
-      // Use prepared statement caching for better performance
-      const stmt = db.getPreparedStatement
-        ? db.getPreparedStatement(sqlQuery)
-        : db.prepare(sqlQuery)
-
-      const nativeResult = stmt.all()
+      // Use prepared statement with bindings for security
+      const stmt = db.prepare(sqlQuery)
+      const nativeResult = stmt.all(...whereClause.bindings)
 
       // Process records
       const phRecords = nativeResult.map((record) => {

package/lib/private/machines/private/build-sqlite-where-clause.js

@@ -2,90 +2,147 @@
  * buildSqliteWhereClause()
  *
  * Build a SQLite WHERE clause from the specified S3Q `where` clause.
+ * Uses parameterized queries for security.
  * > Note: The provided `where` clause is NOT mutated.
  *
  * @param  {Object} whereClause [`where` clause from the criteria of a S3Q]
  * @param  {Object} WLModel
  * @param  {Object?} meta       [`meta` query key from the s3q]
  *
- * @returns {String}            [SQLite WHERE clause]
+ * @returns {Object}            [{ clause: String, bindings: Array }]
  */
 module.exports = function buildSqliteWhereClause(whereClause, WLModel, meta) {
   // Handle null, undefined, or empty `where` clause.
   if (!whereClause || Object.keys(whereClause).length === 0) {
-    return ''
+    return { clause: '', bindings: [] }
   }
 
-  // Recursively build and return a transformed `where` clause for use with SQLite.
-  function recurse(branch, isRoot = true) {
-    const clauses = []
-    for (const [key, value] of Object.entries(branch)) {
-      if (key === 'and' || key === 'or') {
-        const subClauses = value.map((subBranch) => recurse(subBranch, false))
-        clauses.push(`(${subClauses.join(` ${key.toUpperCase()} `)})`)
-      } else {
-        clauses.push(buildConstraint(key, value, WLModel, meta))
+  const bindings = []
+
+  // Recursively build WHERE clause
+  function recurse(branch) {
+    const conditions = []
+
+    // Handle AND conditions
+    if (branch.and && Array.isArray(branch.and)) {
+      const andConditions = branch.and.map((condition) => recurse(condition))
+      const andClauses = andConditions
+        .filter((c) => c.clause)
+        .map((c) => c.clause)
+      if (andClauses.length > 0) {
+        conditions.push(`(${andClauses.join(' AND ')})`)
       }
     }
-    return isRoot ? clauses.join(' AND ') : clauses.join(' AND ')
-  }
 
-  return recurse(whereClause)
-}
+    // Handle OR conditions
+    if (branch.or && Array.isArray(branch.or)) {
+      const orConditions = branch.or.map((condition) => recurse(condition))
+      const orClauses = orConditions
+        .filter((c) => c.clause)
+        .map((c) => c.clause)
+      if (orClauses.length > 0) {
+        conditions.push(`(${orClauses.join(' OR ')})`)
+      }
+    }
 
-function buildConstraint(columnName, constraint, WLModel, meta) {
-  if (typeof constraint !== 'object' || constraint === null) {
-    return `${columnName} = ${sqliteEscape(constraint)}`
-  }
+    // Handle field conditions
+    Object.keys(branch).forEach((key) => {
+      if (key === 'and' || key === 'or') {
+        return // Already handled above
+      }
 
-  const modifierKind = Object.keys(constraint)[0]
-  const modifier = constraint[modifierKind]
+      const value = branch[key]
+      let columnName
 
-  switch (modifierKind) {
-    case '<':
-      return `${columnName} < ${sqliteEscape(modifier)}`
-    case '<=':
-      return `${columnName} <= ${sqliteEscape(modifier)}`
-    case '>':
-      return `${columnName} > ${sqliteEscape(modifier)}`
-    case '>=':
-      return `${columnName} >= ${sqliteEscape(modifier)}`
-    case '!=':
-      return `${columnName} != ${sqliteEscape(modifier)}`
-    case 'nin':
-      return `${columnName} NOT IN (${modifier.map(sqliteEscape).join(', ')})`
-    case 'in':
-      return `${columnName} IN (${modifier.map(sqliteEscape).join(', ')})`
-    case 'like':
-      // SQLite uses LIKE with % and _ wildcards (not REGEXP)
-      let likePattern = modifier
-      // Convert JavaScript-style wildcards to SQL LIKE wildcards if needed
-      if (!likePattern.includes('%') && !likePattern.includes('_')) {
-        // If no wildcards, assume they want contains behavior
-        likePattern = `%${likePattern}%`
+      // Handle table.column format
+      if (key.includes('.')) {
+        const parts = key.split('.')
+        if (parts.length === 2) {
+          const [tableName, colName] = parts
+          columnName = `\`${tableName}\`.\`${colName}\``
+        } else {
+          columnName = key
+        }
+      } else {
+        columnName = `\`${key}\``
       }
-      let clause = `${columnName} LIKE '${likePattern.replace(/'/g, "''")}'`
-      if (meta && meta.makeLikeModifierCaseInsensitive === true) {
-        clause = `LOWER(${columnName}) LIKE LOWER('${likePattern.replace(/'/g, "''")}')`
+
+      if (typeof value === 'object' && value !== null) {
+        // Handle operators
+        Object.keys(value).forEach((operator) => {
+          const operatorValue = value[operator]
+
+          switch (operator) {
+            case 'in':
+              if (Array.isArray(operatorValue) && operatorValue.length > 0) {
+                const placeholders = operatorValue.map(() => '?').join(', ')
+                conditions.push(`${columnName} IN (${placeholders})`)
+                bindings.push(...operatorValue)
+              }
+              break
+            case 'nin':
+              if (Array.isArray(operatorValue) && operatorValue.length > 0) {
+                const placeholders = operatorValue.map(() => '?').join(', ')
+                conditions.push(`${columnName} NOT IN (${placeholders})`)
+                bindings.push(...operatorValue)
+              }
+              break
+            case '>':
+              conditions.push(`${columnName} > ?`)
+              bindings.push(operatorValue)
+              break
+            case '>=':
+              conditions.push(`${columnName} >= ?`)
+              bindings.push(operatorValue)
+              break
+            case '<':
+              conditions.push(`${columnName} < ?`)
+              bindings.push(operatorValue)
+              break
+            case '<=':
+              conditions.push(`${columnName} <= ?`)
+              bindings.push(operatorValue)
+              break
+            case '!=':
+            case 'ne':
+              conditions.push(`${columnName} != ?`)
+              bindings.push(operatorValue)
+              break
+            case 'like':
+              if (meta && meta.makeLikeModifierCaseInsensitive === true) {
+                conditions.push(`LOWER(${columnName}) LIKE LOWER(?)`)
+              } else {
+                conditions.push(`${columnName} LIKE ?`)
+              }
+              bindings.push(operatorValue)
+              break
+            case 'contains':
+              conditions.push(`${columnName} LIKE ?`)
+              bindings.push(`%${operatorValue}%`)
+              break
+            case 'startsWith':
+              conditions.push(`${columnName} LIKE ?`)
+              bindings.push(`${operatorValue}%`)
+              break
+            case 'endsWith':
+              conditions.push(`${columnName} LIKE ?`)
+              bindings.push(`%${operatorValue}`)
+              break
+            default:
+              conditions.push(`${columnName} = ?`)
+              bindings.push(operatorValue)
+          }
+        })
+      } else {
+        // Simple equality
+        conditions.push(`${columnName} = ?`)
+        bindings.push(value)
       }
-      return clause
-    default:
-      throw new Error(
-        `Consistency violation: \`where\` clause modifier \`${modifierKind}\` is not valid! This should never happen-- a stage 3 query should have already been normalized in Waterline core.`
-      )
-  }
-}
+    })
 
-function sqliteEscape(value) {
-  if (typeof value === 'string') {
-    return `'${value.replace(/'/g, "''")}'`
-  }
-  if (typeof value === 'boolean') {
-    // Match the decimal format that SQLite stores (1.0, 0.0)
-    return value ? '1.0' : '0.0'
+    return { clause: conditions.join(' AND ') }
   }
-  if (value === null) {
-    return 'NULL'
-  }
-  return value
+
+  const result = recurse(whereClause)
+  return { clause: result.clause, bindings }
 }

package/lib/private/machines/private/compile-statement.js

@@ -75,18 +75,27 @@ module.exports = function compileStatement(statement) {
 
   // Handle regular SELECT statements
   if (statement.select) {
-    // Determine parent table for ORDER BY disambiguation
-    let parentTable = null
-    if (statement.from) {
-      if (statement.from.includes(' as ')) {
-        parentTable = statement.from.split(' as ')[0].trim()
-      } else {
-        parentTable = statement.from
-      }
-    }
     const hasJoins =
       statement.leftOuterJoin && statement.leftOuterJoin.length > 0
 
+    // Build a map of column names to their qualified table.column references
+    // This helps resolve unqualified ORDER BY columns
+    const columnToTable = {}
+    if (Array.isArray(statement.select)) {
+      statement.select.forEach((col) => {
+        if (col.includes('.')) {
+          const colWithoutAlias = col.includes(' as ')
+            ? col.split(' as ')[0].trim()
+            : col
+          const parts = colWithoutAlias.split('.')
+          if (parts.length === 2) {
+            const [tableName, columnName] = parts
+            columnToTable[columnName] = tableName
+          }
+        }
+      })
+    }
+
     // SELECT clause
     if (Array.isArray(statement.select) && statement.select.length > 0) {
       const selectColumns = statement.select.map((col) => {
@@ -179,10 +188,10 @@ module.exports = function compileStatement(statement) {
 
     // WHERE clause
     if (statement.where) {
-      const whereResult = buildWhereClause(statement.where)
-      if (whereResult.clause) {
-        sql += ` WHERE ${whereResult.clause}`
-        bindings = bindings.concat(whereResult.bindings || [])
+      const whereClause = buildSqliteWhereClause(statement.where)
+      if (whereClause.clause) {
+        sql += ` WHERE ${whereClause.clause}`
+        bindings = bindings.concat(whereClause.bindings || [])
       }
     }
 
@@ -201,9 +210,9 @@ module.exports = function compileStatement(statement) {
               return `\`${tableName}\`.\`${columnName}\` ASC`
             }
           }
-          // If there are JOINs and column is unqualified, prefix with parent table
-          if (hasJoins && parentTable) {
-            return `\`${parentTable}\`.\`${orderItem}\` ASC`
+          // If column is unqualified, look up which table it belongs to from SELECT
+          if (hasJoins && columnToTable[orderItem]) {
+            return `\`${columnToTable[orderItem]}\`.\`${orderItem}\` ASC`
           }
           return `\`${orderItem}\` ASC`
         }
@@ -218,9 +227,9 @@ module.exports = function compileStatement(statement) {
               return `\`${tableName}\`.\`${columnName}\` ${direction}`
             }
           }
-          // If there are JOINs and column is unqualified, prefix with parent table
-          if (hasJoins && parentTable) {
-            return `\`${parentTable}\`.\`${key}\` ${direction}`
+          // If column is unqualified, look up which table it belongs to from SELECT
+          if (hasJoins && columnToTable[key]) {
+            return `\`${columnToTable[key]}\`.\`${key}\` ${direction}`
           }
           return `\`${key}\` ${direction}`
         }
@@ -242,141 +251,3 @@ module.exports = function compileStatement(statement) {
 
   return { sql, bindings }
 }
-
-/**
- * Build WHERE clause from Waterline criteria
- */
-function buildWhereClause(whereObj) {
-  if (!whereObj || typeof whereObj !== 'object') {
-    return { clause: '', bindings: [] }
-  }
-
-  const conditions = []
-  const bindings = []
-
-  // Handle AND conditions
-  if (whereObj.and && Array.isArray(whereObj.and)) {
-    const andConditions = []
-    whereObj.and.forEach((condition) => {
-      const result = buildWhereClause(condition)
-      if (result.clause) {
-        andConditions.push(result.clause)
-        bindings.push(...result.bindings)
-      }
-    })
-    if (andConditions.length > 0) {
-      conditions.push(`(${andConditions.join(' AND ')})`)
-    }
-  }
-
-  // Handle OR conditions
-  if (whereObj.or && Array.isArray(whereObj.or)) {
-    const orConditions = []
-    whereObj.or.forEach((condition) => {
-      const result = buildWhereClause(condition)
-      if (result.clause) {
-        orConditions.push(result.clause)
-        bindings.push(...result.bindings)
-      }
-    })
-    if (orConditions.length > 0) {
-      conditions.push(`(${orConditions.join(' OR ')})`)
-    }
-  }
-
-  // Handle field conditions
-  Object.keys(whereObj).forEach((key) => {
-    if (key === 'and' || key === 'or') {
-      return // Already handled above
-    }
-
-    const value = whereObj[key]
-    let columnName
-
-    // Handle table.column format
-    if (key.includes('.')) {
-      const parts = key.split('.')
-      if (parts.length === 2) {
-        const [tableName, colName] = parts
-        columnName = `\`${tableName}\`.\`${colName}\``
-      } else {
-        columnName = key // fallback for complex expressions
-      }
-    } else {
-      columnName = `\`${key}\``
-    }
-
-    if (typeof value === 'object' && value !== null) {
-      // Handle operators
-      Object.keys(value).forEach((operator) => {
-        const operatorValue = value[operator]
-
-        switch (operator) {
-          case 'in':
-            if (Array.isArray(operatorValue) && operatorValue.length > 0) {
-              const placeholders = operatorValue.map(() => '?').join(', ')
-              conditions.push(`${columnName} IN (${placeholders})`)
-              bindings.push(...operatorValue)
-            }
-            break
-          case 'nin':
-            if (Array.isArray(operatorValue) && operatorValue.length > 0) {
-              const placeholders = operatorValue.map(() => '?').join(', ')
-              conditions.push(`${columnName} NOT IN (${placeholders})`)
-              bindings.push(...operatorValue)
-            }
-            break
-          case '>':
-            conditions.push(`${columnName} > ?`)
-            bindings.push(operatorValue)
-            break
-          case '>=':
-            conditions.push(`${columnName} >= ?`)
-            bindings.push(operatorValue)
-            break
-          case '<':
-            conditions.push(`${columnName} < ?`)
-            bindings.push(operatorValue)
-            break
-          case '<=':
-            conditions.push(`${columnName} <= ?`)
-            bindings.push(operatorValue)
-            break
-          case '!=':
-          case 'ne':
-            conditions.push(`${columnName} != ?`)
-            bindings.push(operatorValue)
-            break
-          case 'like':
-            conditions.push(`${columnName} LIKE ?`)
-            bindings.push(operatorValue)
-            break
-          case 'contains':
-            conditions.push(`${columnName} LIKE ?`)
-            bindings.push(`%${operatorValue}%`)
-            break
-          case 'startsWith':
-            conditions.push(`${columnName} LIKE ?`)
-            bindings.push(`${operatorValue}%`)
-            break
-          case 'endsWith':
-            conditions.push(`${columnName} LIKE ?`)
-            bindings.push(`%${operatorValue}`)
-            break
-          default:
-            conditions.push(`${columnName} = ?`)
-            bindings.push(operatorValue)
-        }
-      })
-    } else {
-      // Simple equality
-      conditions.push(`${columnName} = ?`)
-      bindings.push(value)
-    }
-  })
-
-  return {
-    clause: conditions.join(' AND '),
-    bindings: bindings
-  }
-}

package/lib/private/machines/private/process-each-record.js

@@ -42,7 +42,8 @@ module.exports = function processEachRecord(options) {
   // Update the orm object with the keyed collections
   orm.collections = collections
 
-  // Process each record
+  // Process each record using waterline-utils' eachRecordDeep
+  // which handles recursively processing populated associations
   eachRecordDeep(
     records,
     (record, WLModel) => {
@@ -63,9 +64,17 @@ module.exports = function processEachRecord(options) {
         if (columnName in record) {
           switch (attrDef.type) {
             case 'boolean':
-              // SQLite stores booleans as integers, so we need to convert them
+              // SQLite stores booleans as integers (0 = false, 1 = true)
+              // Values may come back as numbers (1, 1.0) or strings ('1', '1.0')
               if (typeof record[columnName] !== 'boolean') {
-                record[columnName] = record[columnName] === 1
+                const rawValue = record[columnName]
+                if (rawValue !== undefined && rawValue !== null) {
+                  const numericValue =
+                    typeof rawValue === 'string'
+                      ? parseFloat(rawValue)
+                      : rawValue
+                  record[columnName] = numericValue !== 0
+                }
               }
               break
 

package/lib/private/machines/private/process-native-record.js

@@ -25,21 +25,24 @@ module.exports = function processNativeRecord(nativeRecord, WLModel, meta) {
     '2nd argument must be a WLModel, and it has to have a `definition` property for this utility to work.'
   )
 
-  // Check out each known attribute...
+  // Check out each known attribute and process by column name
+  // NOTE: We do NOT rename columnName to attrName here - that's Waterline's job.
+  // The adapter must return records with column names, not attribute names.
   Object.entries(WLModel.attributes).forEach(([attrName, attrDef]) => {
-    const phRecordKey = attrDef.columnName
+    // Use columnName if defined, otherwise fall back to attribute name
+    const columnName = attrDef.columnName || attrName
 
     // Handle JSON type
     if (
       attrDef.type === 'json' &&
-      typeof nativeRecord[phRecordKey] === 'string'
+      typeof nativeRecord[columnName] === 'string'
     ) {
       try {
-        nativeRecord[phRecordKey] = JSON.parse(nativeRecord[phRecordKey])
+        nativeRecord[columnName] = JSON.parse(nativeRecord[columnName])
       } catch (e) {
         // If parsing fails, leave the value as-is
         console.warn(
-          `Failed to parse JSON for attribute ${attrName}: ${e.message}`
+          `Failed to parse JSON for column ${columnName}: ${e.message}`
         )
       }
     }
@@ -47,57 +50,45 @@ module.exports = function processNativeRecord(nativeRecord, WLModel, meta) {
     // Handle Date type
     if (
       attrDef.type === 'ref' &&
-      typeof nativeRecord[phRecordKey] === 'string'
+      typeof nativeRecord[columnName] === 'string'
     ) {
-      const timestamp = Date.parse(nativeRecord[phRecordKey])
+      const timestamp = Date.parse(nativeRecord[columnName])
       if (!isNaN(timestamp)) {
-        nativeRecord[phRecordKey] = new Date(timestamp)
+        nativeRecord[columnName] = new Date(timestamp)
       }
     }
 
     // Handle Number type - SQLite returns numbers as strings with decimals
-    if (
-      attrDef.type === 'number' &&
-      typeof nativeRecord[phRecordKey] === 'string'
-    ) {
-      const numericValue = parseFloat(nativeRecord[phRecordKey])
-      if (!isNaN(numericValue)) {
-        nativeRecord[phRecordKey] = numericValue
+    // Also ensure auto timestamps are numbers
+    if (attrDef.type === 'number') {
+      if (typeof nativeRecord[columnName] === 'string') {
+        const numericValue = parseFloat(nativeRecord[columnName])
+        if (!isNaN(numericValue)) {
+          nativeRecord[columnName] = numericValue
+        }
+      }
+      // Ensure auto timestamps are numbers (like sails-postgresql does)
+      if (
+        (attrDef.autoUpdatedAt || attrDef.autoCreatedAt) &&
+        nativeRecord[columnName] !== undefined
+      ) {
+        nativeRecord[columnName] = Number(nativeRecord[columnName])
       }
     }
 
     // Handle Boolean type
     if (attrDef.type === 'boolean') {
       // SQLite stores booleans as integers (0 = false, 1 = true)
-      // But they come back as strings, so we need to parse them first
-      const rawValue = nativeRecord[phRecordKey]
+      // Values may come back as numbers (1, 1.0) or strings ('1', '1.0')
+      const rawValue = nativeRecord[columnName]
       if (rawValue !== undefined && rawValue !== null) {
-        const numericValue =
-          typeof rawValue === 'string' ? parseFloat(rawValue) : rawValue
-        nativeRecord[phRecordKey] = numericValue === 0 ? false : true
+        if (typeof rawValue !== 'boolean') {
+          const numericValue =
+            typeof rawValue === 'string' ? parseFloat(rawValue) : rawValue
+          nativeRecord[columnName] = numericValue !== 0
+        }
       }
     }
-
-    const isForeignKey = !!attrDef.model
-    // Sanity checks:
-    if (isForeignKey) {
-      assert(
-        attrDef.foreignKey,
-        'attribute has a `model` property, but wl-schema did not give it `foreignKey: true`!'
-      )
-    } else {
-      assert(
-        !attrDef.foreignKey,
-        'wl-schema gave this attribute `foreignKey: true`, but it has no `model` property!'
-      )
-    }
-
-    if (!isForeignKey) return
-    if (nativeRecord[phRecordKey] === undefined) return // This is weird, but WL core deals with warning about it.
-    if (nativeRecord[phRecordKey] === null) return
-
-    // For SQLite, we don't need to do any special processing for foreign keys
-    // as they are typically just stored as integers or strings.
   })
 
   return nativeRecord

package/lib/private/machines/set-physical-sequence.js

@@ -22,53 +22,66 @@ module.exports = {
   },
 
   fn: function (inputs, exits) {
-    const db = inputs.connection
-    const sequenceName = inputs.sequenceName
-    const newSequenceValue = inputs.sequenceValue
+    const { connection: db, sequenceName, sequenceValue } = inputs
 
-    // Parse the sequence name to get the actual table name
-    // PostgreSQL-style sequences are often named like 'user_id_seq', 'users_id_seq', etc.
-    // The table name should be the first string before the first underscore
-    let tableName = sequenceName
-
-    // Handle PostgreSQL-style sequence names
-    if (sequenceName.includes('_')) {
-      // Extract the table name as the first part before the first underscore
-      tableName = sequenceName.split('_')[0]
-    }
-
-    try {
-      // First, check if the table exists
-      const tableExists = db
-        .prepare(
-          "SELECT name FROM sqlite_master WHERE type='table' AND name = ?"
-        )
-        .get(tableName)
-
-      if (!tableExists) {
-        return exits.notFound(new Error(`Table '${tableName}' not found.`))
+    // Parse table name from PostgreSQL-style sequence name
+    // Format is: tablename_columnname_seq
+    // e.g., 'invoice_items_id_seq' -> table 'invoice_items', column 'id'
+    // e.g., 'alter__id_seq' -> table 'alter', column '_id'
+    // e.g., 'users_user_id_seq' -> table 'users', column 'user_id'
+    //
+    // Since we can't reliably split table/column when both contain underscores,
+    // we try progressively shorter prefixes until we find an existing table.
+    let tableName = null
+    if (sequenceName.endsWith('_seq')) {
+      const withoutSeq = sequenceName.slice(0, -4) // Remove '_seq'
+      // Try progressively shorter prefixes to find the table name
+      // Start from the longest possible table name and work backwards
+      let candidate = withoutSeq
+      while (candidate.includes('_')) {
+        const lastUnderscoreIdx = candidate.lastIndexOf('_')
+        candidate = candidate.slice(0, lastUnderscoreIdx)
+        // Check if this table exists
+        const exists = db
+          .prepare(
+            "SELECT name FROM sqlite_master WHERE type='table' AND name = ?"
+          )
+          .get(candidate)
+        if (exists) {
+          tableName = candidate
+          break
+        }
       }
+      // If no table found with underscores, try the full name without _seq
+      if (!tableName) {
+        const exists = db
+          .prepare(
+            "SELECT name FROM sqlite_master WHERE type='table' AND name = ?"
+          )
+          .get(withoutSeq)
+        if (exists) {
+          tableName = withoutSeq
+        }
+      }
+    }
 
-      // If the table exists, update the sequence
-      const updateStmt = db.prepare(
-        'UPDATE sqlite_sequence SET seq = ? WHERE name = ?'
+    // If still no table found, exit with notFound
+    if (!tableName) {
+      return exits.notFound(
+        new Error(`Could not find table for sequence '${sequenceName}'.`)
       )
-      const updateResult = updateStmt.run(newSequenceValue - 1, tableName)
+    }
 
-      if (updateResult.changes === 0) {
-        // If no rows were updated, it means the table doesn't have an autoincrement column
-        // We'll insert a new row in this case
-        const insertStmt = db.prepare(
-          'INSERT INTO sqlite_sequence (name, seq) VALUES (?, ?)'
-        )
-        insertStmt.run(tableName, newSequenceValue - 1)
-      }
+    try {
+      // Use INSERT OR REPLACE to handle both insert and update in one statement
+      db.prepare(
+        'INSERT OR REPLACE INTO sqlite_sequence (name, seq) VALUES (?, ?)'
+      ).run(tableName, sequenceValue - 1)
 
       return exits.success()
     } catch (error) {
-      // Handle the case where sqlite_sequence doesn't exist
+      // sqlite_sequence doesn't exist = no AUTOINCREMENT tables yet, which is fine
       if (error.message.includes('no such table: sqlite_sequence')) {
-        // This is not an error condition - it just means no tables with AUTOINCREMENT have been created yet
         return exits.success()
       }
       return exits.error(error)

package/lib/private/machines/sum-records.js

@@ -60,12 +60,12 @@ module.exports = {
 
     try {
       let sumQuery = `SELECT COALESCE(SUM(\`${numericFieldName}\`), 0) as total FROM \`${tableName}\``
-      if (whereClause) {
-        sumQuery += ` WHERE ${whereClause}`
+      if (whereClause.clause) {
+        sumQuery += ` WHERE ${whereClause.clause}`
       }
 
       const stmt = db.prepare(sumQuery)
-      const result = stmt.get()
+      const result = stmt.get(...whereClause.bindings)
 
       return exits.success(result.total)
     } catch (err) {

package/lib/private/machines/update-records.js

@@ -64,7 +64,7 @@ module.exports = {
       return exits.error(e)
     }
 
-    const sqliteWhere = buildSqliteWhereClause(
+    const whereClause = buildSqliteWhereClause(
       s3q.criteria.where,
       WLModel,
       s3q.meta
@@ -78,31 +78,37 @@ module.exports = {
     try {
       // Start a transaction only if we're not already in one
       if (!wasInTransaction) {
-        db.exec('BEGIN TRANSACTION')
+        db.prepare('BEGIN TRANSACTION').run()
       }
 
       let affectedIds = []
 
       if (isFetchEnabled) {
         // Get the IDs of records which match this criteria
-        const selectSql = sqliteWhere
-          ? `SELECT \`${pkColumnName}\` FROM \`${tableName}\` WHERE ${sqliteWhere}`
+        const selectSql = whereClause.clause
+          ? `SELECT \`${pkColumnName}\` FROM \`${tableName}\` WHERE ${whereClause.clause}`
           : `SELECT \`${pkColumnName}\` FROM \`${tableName}\``
         const selectStmt = db.prepare(selectSql)
-        affectedIds = selectStmt.all().map((row) => row[pkColumnName])
+        affectedIds = selectStmt
+          .all(...whereClause.bindings)
+          .map((row) => row[pkColumnName])
       }
 
       // Prepare the UPDATE statement
       const setClauses = Object.entries(s3q.valuesToSet)
         .map(([column, value]) => `\`${column}\` = ?`)
         .join(', ')
-      const updateSql = sqliteWhere
-        ? `UPDATE \`${tableName}\` SET ${setClauses} WHERE ${sqliteWhere}`
+      const updateSql = whereClause.clause
+        ? `UPDATE \`${tableName}\` SET ${setClauses} WHERE ${whereClause.clause}`
         : `UPDATE \`${tableName}\` SET ${setClauses}`
       const updateStmt = db.prepare(updateSql)
 
-      // Execute the UPDATE
-      const updateInfo = updateStmt.run(...Object.values(s3q.valuesToSet))
+      // Execute the UPDATE with values and where bindings
+      const updateBindings = [
+        ...Object.values(s3q.valuesToSet),
+        ...whereClause.bindings
+      ]
+      const updateInfo = updateStmt.run(...updateBindings)
 
       // Handle case where pk value was changed
       if (
@@ -117,7 +123,7 @@ module.exports = {
         affectedIds.length > 1
       ) {
         if (!wasInTransaction) {
-          db.exec('ROLLBACK')
+          db.prepare('ROLLBACK').run()
         }
         return exits.error(
           new Error(
@@ -129,7 +135,7 @@ module.exports = {
       // If fetch is not enabled, we're done
       if (!isFetchEnabled) {
         if (!wasInTransaction) {
-          db.exec('COMMIT')
+          db.prepare('COMMIT').run()
         }
         return exits.success()
       }
@@ -145,12 +151,12 @@ module.exports = {
       })
 
       if (!wasInTransaction) {
-        db.exec('COMMIT')
+        db.prepare('COMMIT').run()
       }
       return exits.success(phRecords)
     } catch (err) {
       if (!wasInTransaction) {
-        db.exec('ROLLBACK')
+        db.prepare('ROLLBACK').run()
       }
       err = processNativeError(err)
       if (err.footprint && err.footprint.identity === 'notUnique') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sails-sqlite",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "SQLite adapter for Sails/Waterline",
   "main": "lib",
   "directories": {