turbine-orm 0.3.0 → 0.3.1

package/dist/query.js

@@ -11,6 +11,28 @@
  * metadata — nothing is hardcoded.
  */
 import { snakeToCamel, camelToSnake } from './schema.js';
+// ---------------------------------------------------------------------------
+// Identifier quoting — prevents SQL injection via table/column names
+// ---------------------------------------------------------------------------
+/**
+ * Quote a SQL identifier (table name, column name) using Postgres double-quote
+ * rules: wrap in double quotes, escape internal double quotes by doubling them.
+ *
+ * @example
+ *   quoteIdent('users')       → '"users"'
+ *   quoteIdent('my"table')    → '"my""table"'
+ *   quoteIdent('user name')   → '"user name"'
+ */
+export function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+/**
+ * Escape LIKE pattern metacharacters: %, _, and \.
+ * Must be used with `ESCAPE '\'` in the LIKE clause.
+ */
+function escapeLike(value) {
+    return value.replace(/\\/g, '\\\\').replace(/%/g, '\\%').replace(/_/g, '\\_');
+}
 /** Known operator keys — used to detect operator objects vs plain values */
 const OPERATOR_KEYS = new Set([
     'gt', 'gte', 'lt', 'lte', 'not', 'in', 'notIn',
@@ -122,12 +144,13 @@ export class QueryInterface {
             let sql = this.sqlCache.get(ck);
             const params = whereKeys.map((k) => whereObj[k]);
             if (!sql) {
-                const whereClauses = whereKeys.map((k, i) => `${this.toColumn(k)} = $${i + 1}`);
+                const qt = quoteIdent(this.table);
+                const whereClauses = whereKeys.map((k, i) => `${this.toSqlColumn(k)} = $${i + 1}`);
                 const whereSql = whereClauses.length > 0 ? ` WHERE ${whereClauses.join(' AND ')}` : '';
                 const selectExpr = columnsList
-                    ? columnsList.map((c) => `${this.table}.${c}`).join(', ')
-                    : `${this.table}.*`;
-                sql = `SELECT ${selectExpr} FROM ${this.table}${whereSql} LIMIT 1`;
+                    ? columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ')
+                    : `${qt}.*`;
+                sql = `SELECT ${selectExpr} FROM ${qt}${whereSql} LIMIT 1`;
                 this.sqlCache.set(ck, sql);
             }
             return {
@@ -143,10 +166,11 @@ export class QueryInterface {
         // General path: supports operators, null, OR, nested with
         const { sql: whereSql, params } = this.buildWhere(args.where);
         if (!args.with) {
+            const qt = quoteIdent(this.table);
             const selectExpr = columnsList
-                ? columnsList.map((c) => `${this.table}.${c}`).join(', ')
-                : `${this.table}.*`;
-            const sql = `SELECT ${selectExpr} FROM ${this.table}${whereSql} LIMIT 1`;
+                ? columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ')
+                : `${qt}.*`;
+            const sql = `SELECT ${selectExpr} FROM ${qt}${whereSql} LIMIT 1`;
             return {
                 sql,
                 params,
@@ -159,7 +183,7 @@ export class QueryInterface {
         }
         // Nested queries: build fresh each time (with clause affects params)
         const selectClause = this.buildSelectWithRelations(this.table, args.with, params, columnsList);
-        const sql = `SELECT ${selectClause} FROM ${this.table}${whereSql} LIMIT 1`;
+        const sql = `SELECT ${selectClause} FROM ${quoteIdent(this.table)}${whereSql} LIMIT 1`;
         return {
             sql,
             params,
@@ -185,10 +209,11 @@ export class QueryInterface {
             ? this.buildWhere(args.where)
             : { sql: '', params: [] };
         const columnsList = this.resolveColumns(args?.select, args?.omit);
+        const qt = quoteIdent(this.table);
         // Distinct support
         let distinctPrefix = '';
         if (args?.distinct && args.distinct.length > 0) {
-            const distinctCols = args.distinct.map((k) => this.toColumn(k));
+            const distinctCols = args.distinct.map((k) => this.toSqlColumn(k));
             distinctPrefix = `DISTINCT ON (${distinctCols.join(', ')}) `;
         }
         let selectClause;
@@ -196,23 +221,23 @@ export class QueryInterface {
             selectClause = this.buildSelectWithRelations(this.table, args.with, params, columnsList);
         }
         else if (columnsList) {
-            selectClause = columnsList.map((c) => `${this.table}.${c}`).join(', ');
+            selectClause = columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ');
         }
         else {
-            selectClause = `${this.table}.*`;
+            selectClause = `${qt}.*`;
         }
-        let sql = `SELECT ${distinctPrefix}${selectClause} FROM ${this.table}${whereSql}`;
+        let sql = `SELECT ${distinctPrefix}${selectClause} FROM ${qt}${whereSql}`;
         // Cursor-based pagination: add WHERE condition for cursor
         if (args?.cursor) {
             const cursorEntries = Object.entries(args.cursor).filter(([, v]) => v !== undefined);
             if (cursorEntries.length > 0) {
                 // Determine direction from orderBy (default 'asc')
                 const cursorConditions = cursorEntries.map(([k, v]) => {
-                    const col = this.toColumn(k);
+                    const col = this.toSqlColumn(k);
                     const dir = args.orderBy?.[k] ?? 'asc';
                     const op = dir === 'desc' ? '<' : '>';
                     params.push(v);
-                    return `${this.table}.${col} ${op} $${params.length}`;
+                    return `${qt}.${col} ${op} $${params.length}`;
                 });
                 // Append to existing WHERE or create new one
                 if (whereSql) {
@@ -229,10 +254,12 @@ export class QueryInterface {
         // take overrides limit when cursor pagination is used
         const effectiveLimit = args?.take ?? args?.limit;
         if (effectiveLimit !== undefined) {
-            sql += ` LIMIT ${Number(effectiveLimit)}`;
+            params.push(Number(effectiveLimit));
+            sql += ` LIMIT $${params.length}`;
         }
         if (args?.offset !== undefined) {
-            sql += ` OFFSET ${Number(args.offset)}`;
+            params.push(Number(args.offset));
+            sql += ` OFFSET $${params.length}`;
         }
         return {
             sql,
@@ -329,14 +356,19 @@ export class QueryInterface {
     }
     buildCreate(args) {
         const entries = Object.entries(args.data).filter(([, v]) => v !== undefined);
-        const columns = entries.map(([k]) => this.toColumn(k));
+        const columns = entries.map(([k]) => this.toSqlColumn(k));
         const params = entries.map(([, v]) => v);
         const placeholders = entries.map((_, i) => `$${i + 1}`);
-        const sql = `INSERT INTO ${this.table} (${columns.join(', ')}) VALUES (${placeholders.join(', ')}) RETURNING *`;
+        const sql = `INSERT INTO ${quoteIdent(this.table)} (${columns.join(', ')}) VALUES (${placeholders.join(', ')}) RETURNING *`;
         return {
             sql,
             params,
-            transform: (result) => this.parseRow(result.rows[0], this.table),
+            transform: (result) => {
+                const row = result.rows[0];
+                if (!row)
+                    throw new Error('[turbine] Expected a row but query returned none');
+                return this.parseRow(row, this.table);
+            },
             tag: `${this.table}.create`,
         };
     }
@@ -351,9 +383,10 @@ export class QueryInterface {
         });
     }
     buildCreateMany(args) {
+        const qt = quoteIdent(this.table);
         if (args.data.length === 0) {
             return {
-                sql: `SELECT * FROM ${this.table} WHERE false`,
+                sql: `SELECT * FROM ${qt} WHERE false`,
                 params: [],
                 transform: () => [],
                 tag: `${this.table}.createMany`,
@@ -372,7 +405,8 @@ export class QueryInterface {
         // Use actual Postgres types for array casts
         const typeCasts = columns.map((col) => this.getColumnArrayType(col));
         const unnestArgs = columnArrays.map((_, i) => `$${i + 1}::${typeCasts[i]}`);
-        let sql = `INSERT INTO ${this.table} (${columns.join(', ')}) SELECT * FROM UNNEST(${unnestArgs.join(', ')})`;
+        const quotedColumns = columns.map((c) => quoteIdent(c));
+        let sql = `INSERT INTO ${qt} (${quotedColumns.join(', ')}) SELECT * FROM UNNEST(${unnestArgs.join(', ')})`;
         // skipDuplicates: add ON CONFLICT DO NOTHING
         if (args.skipDuplicates) {
             sql += ` ON CONFLICT DO NOTHING`;
@@ -401,16 +435,21 @@ export class QueryInterface {
         const params = [];
         const setClauses = setEntries.map(([k, v]) => {
             params.push(v);
-            return `${this.toColumn(k)} = $${params.length}`;
+            return `${this.toSqlColumn(k)} = $${params.length}`;
         });
         // Build WHERE using the shared params array (continues numbering after SET params)
         const whereClause = this.buildWhereClause(args.where, params);
         const whereSql = whereClause ? ` WHERE ${whereClause}` : '';
-        const sql = `UPDATE ${this.table} SET ${setClauses.join(', ')}${whereSql} RETURNING *`;
+        const sql = `UPDATE ${quoteIdent(this.table)} SET ${setClauses.join(', ')}${whereSql} RETURNING *`;
         return {
             sql,
             params,
-            transform: (result) => this.parseRow(result.rows[0], this.table),
+            transform: (result) => {
+                const row = result.rows[0];
+                if (!row)
+                    throw new Error('[turbine] Expected a row but query returned none');
+                return this.parseRow(row, this.table);
+            },
             tag: `${this.table}.update`,
         };
     }
@@ -426,11 +465,16 @@ export class QueryInterface {
     }
     buildDelete(args) {
         const { sql: whereSql, params } = this.buildWhere(args.where);
-        const sql = `DELETE FROM ${this.table}${whereSql} RETURNING *`;
+        const sql = `DELETE FROM ${quoteIdent(this.table)}${whereSql} RETURNING *`;
         return {
             sql,
             params,
-            transform: (result) => this.parseRow(result.rows[0], this.table),
+            transform: (result) => {
+                const row = result.rows[0];
+                if (!row)
+                    throw new Error('[turbine] Expected a row but query returned none');
+                return this.parseRow(row, this.table);
+            },
             tag: `${this.table}.delete`,
         };
     }
@@ -447,29 +491,34 @@ export class QueryInterface {
     buildUpsert(args) {
         // Build the INSERT part from create data
         const createEntries = Object.entries(args.create).filter(([, v]) => v !== undefined);
-        const columns = createEntries.map(([k]) => this.toColumn(k));
+        const columns = createEntries.map(([k]) => this.toSqlColumn(k));
         const createParams = createEntries.map(([, v]) => v);
         const placeholders = createEntries.map((_, i) => `$${i + 1}`);
         // The conflict target comes from `where` keys — must be unique/PK columns
         const conflictKeys = Object.keys(args.where).filter((k) => args.where[k] !== undefined);
-        const conflictColumns = conflictKeys.map((k) => this.toColumn(k));
+        const conflictColumns = conflictKeys.map((k) => this.toSqlColumn(k));
         // Build the UPDATE SET part
         const updateEntries = Object.entries(args.update).filter(([, v]) => v !== undefined);
         let paramIdx = createParams.length + 1;
         const setClauses = updateEntries.map(([k]) => {
-            const clause = `${this.toColumn(k)} = $${paramIdx}`;
+            const clause = `${this.toSqlColumn(k)} = $${paramIdx}`;
             paramIdx++;
             return clause;
         });
         const updateParams = updateEntries.map(([, v]) => v);
         const params = [...createParams, ...updateParams];
-        const sql = `INSERT INTO ${this.table} (${columns.join(', ')}) VALUES (${placeholders.join(', ')})` +
+        const sql = `INSERT INTO ${quoteIdent(this.table)} (${columns.join(', ')}) VALUES (${placeholders.join(', ')})` +
             ` ON CONFLICT (${conflictColumns.join(', ')}) DO UPDATE SET ${setClauses.join(', ')}` +
             ` RETURNING *`;
         return {
             sql,
             params,
-            transform: (result) => this.parseRow(result.rows[0], this.table),
+            transform: (result) => {
+                const row = result.rows[0];
+                if (!row)
+                    throw new Error('[turbine] Expected a row but query returned none');
+                return this.parseRow(row, this.table);
+            },
             tag: `${this.table}.upsert`,
         };
     }
@@ -489,12 +538,12 @@ export class QueryInterface {
         const params = [];
         const setClauses = setEntries.map(([k, v]) => {
             params.push(v);
-            return `${this.toColumn(k)} = $${params.length}`;
+            return `${this.toSqlColumn(k)} = $${params.length}`;
         });
         // Build WHERE using the shared params array (continues numbering after SET params)
         const whereClause = this.buildWhereClause(args.where, params);
         const whereSql = whereClause ? ` WHERE ${whereClause}` : '';
-        const sql = `UPDATE ${this.table} SET ${setClauses.join(', ')}${whereSql}`;
+        const sql = `UPDATE ${quoteIdent(this.table)} SET ${setClauses.join(', ')}${whereSql}`;
         return {
             sql,
             params,
@@ -514,7 +563,7 @@ export class QueryInterface {
     }
     buildDeleteMany(args) {
         const { sql: whereSql, params } = this.buildWhere(args.where);
-        const sql = `DELETE FROM ${this.table}${whereSql}`;
+        const sql = `DELETE FROM ${quoteIdent(this.table)}${whereSql}`;
         return {
             sql,
             params,
@@ -536,7 +585,7 @@ export class QueryInterface {
         const { sql: whereSql, params } = args?.where
             ? this.buildWhere(args.where)
             : { sql: '', params: [] };
-        const sql = `SELECT COUNT(*)::int AS count FROM ${this.table}${whereSql}`;
+        const sql = `SELECT COUNT(*)::int AS count FROM ${quoteIdent(this.table)}${whereSql}`;
         return {
             sql,
             params,
@@ -555,7 +604,8 @@ export class QueryInterface {
         });
     }
     buildGroupBy(args) {
-        const groupCols = args.by.map((k) => this.toColumn(k));
+        const groupColsRaw = args.by.map((k) => this.toColumn(k));
+        const groupCols = groupColsRaw.map((c) => quoteIdent(c));
         const { sql: whereSql, params } = args.where
             ? this.buildWhere(args.where)
             : { sql: '', params: [] };
@@ -571,7 +621,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._sum)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`SUM(${col}) AS _sum_${col}`);
+                    selectExprs.push(`SUM(${quoteIdent(col)}) AS _sum_${col}`);
                 }
             }
         }
@@ -580,7 +630,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._avg)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`AVG(${col})::float AS _avg_${col}`);
+                    selectExprs.push(`AVG(${quoteIdent(col)})::float AS _avg_${col}`);
                 }
             }
         }
@@ -589,7 +639,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._min)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MIN(${col}) AS _min_${col}`);
+                    selectExprs.push(`MIN(${quoteIdent(col)}) AS _min_${col}`);
                 }
             }
         }
@@ -598,11 +648,11 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._max)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MAX(${col}) AS _max_${col}`);
+                    selectExprs.push(`MAX(${quoteIdent(col)}) AS _max_${col}`);
                 }
             }
         }
-        let sql = `SELECT ${selectExprs.join(', ')} FROM ${this.table}${whereSql} GROUP BY ${groupCols.join(', ')}`;
+        let sql = `SELECT ${selectExprs.join(', ')} FROM ${quoteIdent(this.table)}${whereSql} GROUP BY ${groupCols.join(', ')}`;
         // ORDER BY
         if (args.orderBy) {
             sql += ` ORDER BY ${this.buildOrderBy(args.orderBy)}`;
@@ -693,7 +743,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._count)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`COUNT(${col})::int AS _count_${col}`);
+                    selectExprs.push(`COUNT(${quoteIdent(col)})::int AS _count_${col}`);
                 }
             }
         }
@@ -702,7 +752,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._sum)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`SUM(${col}) AS _sum_${col}`);
+                    selectExprs.push(`SUM(${quoteIdent(col)}) AS _sum_${col}`);
                 }
             }
         }
@@ -711,7 +761,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._avg)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`AVG(${col})::float AS _avg_${col}`);
+                    selectExprs.push(`AVG(${quoteIdent(col)})::float AS _avg_${col}`);
                 }
             }
         }
@@ -720,7 +770,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._min)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MIN(${col}) AS _min_${col}`);
+                    selectExprs.push(`MIN(${quoteIdent(col)}) AS _min_${col}`);
                 }
             }
         }
@@ -729,14 +779,14 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._max)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MAX(${col}) AS _max_${col}`);
+                    selectExprs.push(`MAX(${quoteIdent(col)}) AS _max_${col}`);
                 }
             }
         }
         if (selectExprs.length === 0) {
             selectExprs.push('COUNT(*)::int AS _count');
         }
-        const sql = `SELECT ${selectExprs.join(', ')} FROM ${this.table}${whereSql}`;
+        const sql = `SELECT ${selectExprs.join(', ')} FROM ${quoteIdent(this.table)}${whereSql}`;
         return {
             sql,
             params,
@@ -830,13 +880,17 @@ export class QueryInterface {
         }
         return null;
     }
-    /** Convert camelCase field name to snake_case column name */
+    /** Convert camelCase field name to snake_case column name (unquoted, for non-SQL uses) */
     toColumn(field) {
         const mapped = this.tableMeta.columnMap[field];
         if (mapped)
             return mapped;
         return camelToSnake(field);
     }
+    /** Convert camelCase field name to a double-quoted SQL identifier */
+    toSqlColumn(field) {
+        return quoteIdent(this.toColumn(field));
+    }
     /** Build WHERE clause from a where object (supports operators, NULL, OR) */
     buildWhere(where) {
         const params = [];
@@ -907,7 +961,8 @@ export class QueryInterface {
                     continue;
                 }
             }
-            const column = this.toColumn(key);
+            const rawColumn = this.toColumn(key);
+            const column = quoteIdent(rawColumn);
             // Handle null → IS NULL
             if (value === null) {
                 andClauses.push(`${column} IS NULL`);
@@ -915,7 +970,7 @@ export class QueryInterface {
             }
             // Handle JSONB filter operators (for json/jsonb columns)
             if (typeof value === 'object' && !Array.isArray(value) && isJsonFilter(value)) {
-                const colType = this.getColumnPgType(column);
+                const colType = this.getColumnPgType(rawColumn);
                 if (colType === 'json' || colType === 'jsonb') {
                     const jsonClauses = this.buildJsonFilterClauses(column, value, params);
                     andClauses.push(...jsonClauses);
@@ -924,7 +979,7 @@ export class QueryInterface {
             }
             // Handle Array filter operators (for array columns)
             if (typeof value === 'object' && !Array.isArray(value) && isArrayFilter(value)) {
-                const colType = this.getColumnPgType(column);
+                const colType = this.getColumnPgType(rawColumn);
                 if (colType.startsWith('_')) {
                     const arrayClauses = this.buildArrayFilterClauses(column, value, params, colType);
                     andClauses.push(...arrayClauses);
@@ -954,37 +1009,39 @@ export class QueryInterface {
         const targetMeta = this.schema.tables[targetTable];
         if (!targetMeta)
             return null;
+        const qt = quoteIdent(targetTable);
+        const qSelf = quoteIdent(this.table);
         const clauses = [];
         // Correlation: link child table to parent table
         let correlation;
         if (relDef.type === 'hasMany' || relDef.type === 'hasOne') {
             // parent.pk = child.fk
-            correlation = `${targetTable}.${relDef.foreignKey} = ${this.table}.${relDef.referenceKey}`;
+            correlation = `${qt}.${quoteIdent(relDef.foreignKey)} = ${qSelf}.${quoteIdent(relDef.referenceKey)}`;
         }
         else {
             // belongsTo: parent.fk = child.pk
-            correlation = `${targetTable}.${relDef.referenceKey} = ${this.table}.${relDef.foreignKey}`;
+            correlation = `${qt}.${quoteIdent(relDef.referenceKey)} = ${qSelf}.${quoteIdent(relDef.foreignKey)}`;
         }
         // "some": EXISTS (SELECT 1 FROM target WHERE correlation AND filter)
         if (filterObj.some !== undefined) {
             const subWhere = filterObj.some;
             const filterClause = this.buildSubWhereForRelation(targetTable, subWhere, params);
             const fullWhere = filterClause ? `${correlation} AND ${filterClause}` : correlation;
-            clauses.push(`EXISTS (SELECT 1 FROM ${targetTable} WHERE ${fullWhere})`);
+            clauses.push(`EXISTS (SELECT 1 FROM ${qt} WHERE ${fullWhere})`);
         }
         // "none": NOT EXISTS (SELECT 1 FROM target WHERE correlation AND filter)
         if (filterObj.none !== undefined) {
             const subWhere = filterObj.none;
             const filterClause = this.buildSubWhereForRelation(targetTable, subWhere, params);
             const fullWhere = filterClause ? `${correlation} AND ${filterClause}` : correlation;
-            clauses.push(`NOT EXISTS (SELECT 1 FROM ${targetTable} WHERE ${fullWhere})`);
+            clauses.push(`NOT EXISTS (SELECT 1 FROM ${qt} WHERE ${fullWhere})`);
         }
         // "every": NOT EXISTS (SELECT 1 FROM target WHERE correlation AND NOT (filter))
         if (filterObj.every !== undefined) {
             const subWhere = filterObj.every;
             const filterClause = this.buildSubWhereForRelation(targetTable, subWhere, params);
             if (filterClause) {
-                clauses.push(`NOT EXISTS (SELECT 1 FROM ${targetTable} WHERE ${correlation} AND NOT (${filterClause}))`);
+                clauses.push(`NOT EXISTS (SELECT 1 FROM ${qt} WHERE ${correlation} AND NOT (${filterClause}))`);
             }
             else {
                 // "every" with empty filter = true (all match trivially)
@@ -1000,22 +1057,24 @@ export class QueryInterface {
         const meta = this.schema.tables[targetTable];
         if (!meta)
             return null;
+        const qt = quoteIdent(targetTable);
         const conditions = [];
         for (const [field, value] of Object.entries(subWhere)) {
             if (value === undefined)
                 continue;
             const col = meta.columnMap[field] ?? camelToSnake(field);
+            const qCol = `${qt}.${quoteIdent(col)}`;
             if (value === null) {
-                conditions.push(`${targetTable}.${col} IS NULL`);
+                conditions.push(`${qCol} IS NULL`);
                 continue;
             }
             if (isWhereOperator(value)) {
-                const opClauses = this.buildOperatorClauses(`${targetTable}.${col}`, value, params);
+                const opClauses = this.buildOperatorClauses(qCol, value, params);
                 conditions.push(...opClauses);
                 continue;
             }
             params.push(value);
-            conditions.push(`${targetTable}.${col} = $${params.length}`);
+            conditions.push(`${qCol} = $${params.length}`);
         }
         return conditions.length > 0 ? conditions.join(' AND ') : null;
     }
@@ -1059,23 +1118,26 @@ export class QueryInterface {
             clauses.push(`${column} != ALL($${params.length})`);
         }
         if (op.contains !== undefined) {
-            params.push(`%${op.contains}%`);
-            clauses.push(`${column} LIKE $${params.length}`);
+            params.push(`%${escapeLike(op.contains)}%`);
+            clauses.push(`${column} LIKE $${params.length} ESCAPE '\\'`);
         }
         if (op.startsWith !== undefined) {
-            params.push(`${op.startsWith}%`);
-            clauses.push(`${column} LIKE $${params.length}`);
+            params.push(`${escapeLike(op.startsWith)}%`);
+            clauses.push(`${column} LIKE $${params.length} ESCAPE '\\'`);
         }
         if (op.endsWith !== undefined) {
-            params.push(`%${op.endsWith}`);
-            clauses.push(`${column} LIKE $${params.length}`);
+            params.push(`%${escapeLike(op.endsWith)}`);
+            clauses.push(`${column} LIKE $${params.length} ESCAPE '\\'`);
         }
         return clauses;
     }
     /** Build ORDER BY clause from an object */
     buildOrderBy(orderBy) {
         return Object.entries(orderBy)
-            .map(([key, dir]) => `${this.toColumn(key)} ${dir.toUpperCase()}`)
+            .map(([key, dir]) => {
+            const safeDir = dir.toLowerCase() === 'desc' ? 'DESC' : 'ASC';
+            return `${this.toSqlColumn(key)} ${safeDir}`;
+        })
             .join(', ');
     }
     /** Parse a flat row: convert snake_case to camelCase + Date coercion */
@@ -1153,8 +1215,9 @@ export class QueryInterface {
         if (!meta)
             throw new Error(`[turbine] Unknown table "${table}"`);
         const cols = columnsList ?? meta.allColumns;
+        const qtbl = quoteIdent(table);
         const baseCols = cols
-            .map((col) => `${table}.${col}`)
+            .map((col) => `${qtbl}.${quoteIdent(col)}`)
             .join(', ');
         const relationSelects = [];
         const aliasCounter = { n: 0 };
@@ -1166,7 +1229,7 @@ export class QueryInterface {
             }
             // The main table is not aliased, so pass table name as parentRef
             const subquery = this.buildRelationSubquery(relDef, relSpec, params, table, aliasCounter);
-            relationSelects.push(`(${subquery}) AS ${relName}`);
+            relationSelects.push(`(${subquery}) AS ${quoteIdent(relName)}`);
         }
         return [baseCols, ...relationSelects].join(', ');
     }
@@ -1202,7 +1265,7 @@ export class QueryInterface {
             targetColumns = targetMeta.allColumns.filter((col) => !omittedFields.has(col));
         }
         // Build json_build_object pairs for resolved columns
-        const jsonPairs = targetColumns.map((col) => `'${targetMeta.reverseColumnMap[col] ?? snakeToCamel(col)}', ${alias}.${col}`);
+        const jsonPairs = targetColumns.map((col) => `'${targetMeta.reverseColumnMap[col] ?? snakeToCamel(col)}', ${alias}.${quoteIdent(col)}`);
         // Nested relations?
         if (spec !== true && spec.with) {
             for (const [nestedRelName, nestedSpec] of Object.entries(spec.with)) {
@@ -1217,6 +1280,9 @@ export class QueryInterface {
             }
         }
         const jsonObj = `json_build_object(${jsonPairs.join(', ')})`;
+        // Quote parent ref — can be a table name or auto-generated alias
+        const qParent = quoteIdent(parentRef);
+        const qTarget = quoteIdent(targetTable);
         // Build ORDER BY for json_agg
         let orderClause = '';
         if (spec !== true && spec.orderBy) {
@@ -1227,7 +1293,7 @@ export class QueryInterface {
                     throw new Error(`[turbine] Unknown column "${k}" in orderBy for table "${targetTable}"`);
                 }
                 const safeDir = dir.toLowerCase() === 'desc' ? 'DESC' : 'ASC';
-                return `${alias}.${col} ${safeDir}`;
+                return `${alias}.${quoteIdent(col)} ${safeDir}`;
             })
                 .join(', ');
             orderClause = ` ORDER BY ${orders}`;
@@ -1237,10 +1303,10 @@ export class QueryInterface {
         // For belongsTo: source has FK, so alias.pk = parentRef.fk (reversed)
         let whereClause;
         if (relDef.type === 'belongsTo' || relDef.type === 'hasOne') {
-            whereClause = `${alias}.${relDef.referenceKey} = ${parentRef}.${relDef.foreignKey}`;
+            whereClause = `${alias}.${quoteIdent(relDef.referenceKey)} = ${qParent}.${quoteIdent(relDef.foreignKey)}`;
         }
         else {
-            whereClause = `${alias}.${relDef.foreignKey} = ${parentRef}.${relDef.referenceKey}`;
+            whereClause = `${alias}.${quoteIdent(relDef.foreignKey)} = ${qParent}.${quoteIdent(relDef.referenceKey)}`;
         }
         // Additional filters — properly parameterized
         if (spec !== true && spec.where) {
@@ -1250,13 +1316,14 @@ export class QueryInterface {
                     throw new Error(`[turbine] Unknown column "${k}" in where for table "${targetTable}"`);
                 }
                 params.push(v);
-                whereClause += ` AND ${alias}.${col} = $${params.length}`;
+                whereClause += ` AND ${alias}.${quoteIdent(col)} = $${params.length}`;
             }
         }
         // LIMIT
         let limitClause = '';
         if (spec !== true && spec.limit) {
-            limitClause = ` LIMIT ${Number(spec.limit)}`;
+            params.push(Number(spec.limit));
+            limitClause = ` LIMIT $${params.length}`;
         }
         if (relDef.type === 'hasMany') {
             // When LIMIT or ORDER BY is used, wrap in a subquery so LIMIT applies to rows
@@ -1265,9 +1332,9 @@ export class QueryInterface {
                 const innerAlias = `${alias}i`;
                 // Rewrite: SELECT json_agg(json_build_object(...)) FROM (SELECT * FROM table WHERE ... ORDER BY ... LIMIT N) AS alias
                 // Inner SELECT always needs all columns for WHERE/ORDER to work; json_build_object filters later
-                const innerSql = `SELECT ${targetMeta.allColumns.map((c) => `${alias}.${c}`).join(', ')} FROM ${targetTable} ${alias} WHERE ${whereClause}${orderClause}${limitClause}`;
+                const innerSql = `SELECT ${targetMeta.allColumns.map((c) => `${alias}.${quoteIdent(c)}`).join(', ')} FROM ${qTarget} ${alias} WHERE ${whereClause}${orderClause}${limitClause}`;
                 // For the json_build_object, reference the inner alias — only include resolved columns
-                const innerJsonPairs = targetColumns.map((col) => `'${targetMeta.reverseColumnMap[col] ?? snakeToCamel(col)}', ${innerAlias}.${col}`);
+                const innerJsonPairs = targetColumns.map((col) => `'${targetMeta.reverseColumnMap[col] ?? snakeToCamel(col)}', ${innerAlias}.${quoteIdent(col)}`);
                 // Re-add nested relation subqueries referencing innerAlias
                 if (spec !== true && spec.with) {
                     for (const [nestedRelName] of Object.entries(spec.with)) {
@@ -1281,10 +1348,10 @@ export class QueryInterface {
                 const innerJsonObj = `json_build_object(${innerJsonPairs.join(', ')})`;
                 return `SELECT COALESCE(json_agg(${innerJsonObj}), '[]'::json) FROM (${innerSql}) ${innerAlias}`;
             }
-            return `SELECT COALESCE(json_agg(${jsonObj}${orderClause}), '[]'::json) FROM ${targetTable} ${alias} WHERE ${whereClause}`;
+            return `SELECT COALESCE(json_agg(${jsonObj}${orderClause}), '[]'::json) FROM ${qTarget} ${alias} WHERE ${whereClause}`;
         }
         // belongsTo / hasOne — return single object
-        return `SELECT ${jsonObj} FROM ${targetTable} ${alias} WHERE ${whereClause} LIMIT 1`;
+        return `SELECT ${jsonObj} FROM ${qTarget} ${alias} WHERE ${whereClause} LIMIT 1`;
     }
     /**
      * Get the Postgres type for a column (e.g. 'jsonb', 'text', '_int4').

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turbine-orm",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "TypeScript ORM with json_agg nested queries — 2-3x faster than Prisma, 1.5x faster than Drizzle",
   "type": "module",
   "exports": {
@@ -25,6 +25,8 @@
   "files": [
     "dist",
     "!dist/test",
+    "!dist/**/*.js.map",
+    "!dist/examples.*",
     "LICENSE",
     "README.md"
   ],

package/dist/cli/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAyBzC,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E,MAAM,YAAY,GAAG;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;CACZ,CAAC;AAEX,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY;IAC3C,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEjC,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;YAE5C,sEAAsE;YACtE,+DAA+D;YAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,MAAM,GAAqB,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;YAEpD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kDAAkD;YAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACjC,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAyBD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,UAA4B,EAC5B,SAAuB;IAEvB,OAAO;QACL,GAAG,EACD,SAAS,CAAC,GAAG;YACb,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAC3B,UAAU,CAAC,GAAG;YACd,EAAE;QACJ,GAAG,EAAE,SAAS,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,IAAI,qBAAqB;QAC7D,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ;QACzD,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,IAAI,EAAE;QACtD,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,IAAI,EAAE;QACtD,aAAa,EAAE,UAAU,CAAC,aAAa,IAAI,sBAAsB;QACjE,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,mBAAmB;QACpD,UAAU,EAAE,UAAU,CAAC,UAAU,IAAI,qBAAqB;KAC3D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E,MAAM,UAAU,cAAc,CAAC,gBAAyB;IACtD,MAAM,GAAG,GAAG,gBAAgB,IAAI,0BAA0B,CAAC;IAC3D,MAAM,OAAO,GAAG,gBAAgB;QAC9B,CAAC,CAAC,WAAW,gBAAgB,IAAI;QACjC,CAAC,CAAC,kCAAkC,CAAC;IAEvC,OAAO;;;;;;;;EAQP,OAAO;;;;;;;;;;;;;;;;;;;;;;CAsBR,CAAC;AACF,CAAC"}