turbine-orm 0.3.0 → 0.4.0

package/dist/query.js

@@ -1,5 +1,5 @@
 /**
- * @batadata/turbine — Query builder
+ * turbine-orm — Query builder
  *
  * Each table accessor (db.users, db.posts, etc.) returns a QueryInterface<T>
  * that builds parameterized SQL and executes it through the connection pool.
@@ -11,6 +11,28 @@
  * metadata — nothing is hardcoded.
  */
 import { snakeToCamel, camelToSnake } from './schema.js';
+// ---------------------------------------------------------------------------
+// Identifier quoting — prevents SQL injection via table/column names
+// ---------------------------------------------------------------------------
+/**
+ * Quote a SQL identifier (table name, column name) using Postgres double-quote
+ * rules: wrap in double quotes, escape internal double quotes by doubling them.
+ *
+ * @example
+ *   quoteIdent('users')       → '"users"'
+ *   quoteIdent('my"table')    → '"my""table"'
+ *   quoteIdent('user name')   → '"user name"'
+ */
+export function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+/**
+ * Escape LIKE pattern metacharacters: %, _, and \.
+ * Must be used with `ESCAPE '\'` in the LIKE clause.
+ */
+function escapeLike(value) {
+    return value.replace(/\\/g, '\\\\').replace(/%/g, '\\%').replace(/_/g, '\\_');
+}
 /** Known operator keys — used to detect operator objects vs plain values */
 const OPERATOR_KEYS = new Set([
     'gt', 'gte', 'lt', 'lte', 'not', 'in', 'notIn',
@@ -52,6 +74,9 @@ export class QueryInterface {
     /** SQL template cache: cacheKey → sql string (params are always positional $1,$2,...) */
     sqlCache = new Map();
     middlewares;
+    // Fast path: pre-computed flag — true when this table has zero date/timestamp columns.
+    // When true, parseRow can skip the per-field dateCols.has() check entirely.
+    hasNoDateColumns;
     constructor(pool, table, schema, middlewares) {
         this.pool = pool;
         this.table = table;
@@ -62,6 +87,7 @@ export class QueryInterface {
         }
         this.tableMeta = meta;
         this.middlewares = middlewares ?? [];
+        this.hasNoDateColumns = meta.dateColumns.size === 0;
     }
     /**
      * Execute a query through the middleware chain.
@@ -111,42 +137,53 @@ export class QueryInterface {
         const whereObj = args.where;
         // Check if all where values are simple (plain equality, no operators/null/OR)
         const whereKeys = Object.keys(whereObj).filter((k) => whereObj[k] !== undefined);
-        const isSimpleWhere = !whereObj['OR'] && whereKeys.every((k) => {
+        const isSimpleWhere = !whereObj['OR'] && !whereObj['AND'] && !whereObj['NOT'] && whereKeys.every((k) => {
             const v = whereObj[k];
-            return v !== null && !isWhereOperator(v);
+            return v !== null && !isWhereOperator(v) && !isJsonFilter(v) && !isArrayFilter(v);
         });
-        // For simple queries (no nested with, no operators), use cached SQL template
+        // -----------------------------------------------------------------------
+        // Fast path: no relations, simple equality where — cache SQL template.
+        // Generates: SELECT col1, col2 FROM "table" WHERE "id" = $1 LIMIT 1
+        // No json_build_object, no subqueries, no COALESCE wrappers.
+        // -----------------------------------------------------------------------
         if (!args.with && isSimpleWhere) {
             const colKey = columnsList ? columnsList.join(',') : '*';
             const ck = `fu:${whereKeys.sort().join(',')}:c=${colKey}`;
             let sql = this.sqlCache.get(ck);
             const params = whereKeys.map((k) => whereObj[k]);
             if (!sql) {
-                const whereClauses = whereKeys.map((k, i) => `${this.toColumn(k)} = $${i + 1}`);
+                const qt = quoteIdent(this.table);
+                const whereClauses = whereKeys.map((k, i) => `${this.toSqlColumn(k)} = $${i + 1}`);
                 const whereSql = whereClauses.length > 0 ? ` WHERE ${whereClauses.join(' AND ')}` : '';
                 const selectExpr = columnsList
-                    ? columnsList.map((c) => `${this.table}.${c}`).join(', ')
-                    : `${this.table}.*`;
-                sql = `SELECT ${selectExpr} FROM ${this.table}${whereSql} LIMIT 1`;
+                    ? columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ')
+                    : `${qt}.*`;
+                sql = `SELECT ${selectExpr} FROM ${qt}${whereSql} LIMIT 1`;
                 this.sqlCache.set(ck, sql);
             }
+            // Fast path: skip date coercion when table has no date columns
+            const transformRow = this.hasNoDateColumns
+                ? (row) => this.parseRowFast(row)
+                : (row) => this.parseRow(row, this.table);
             return {
                 sql,
                 params,
                 transform: (result) => {
                     const row = result.rows[0];
-                    return row ? this.parseRow(row, this.table) : null;
+                    return row ? transformRow(row) : null;
                 },
                 tag: `${this.table}.findUnique`,
             };
         }
         // General path: supports operators, null, OR, nested with
         const { sql: whereSql, params } = this.buildWhere(args.where);
+        // Fast path: no relations, skip json_agg (but where has operators/null/OR)
         if (!args.with) {
+            const qt = quoteIdent(this.table);
             const selectExpr = columnsList
-                ? columnsList.map((c) => `${this.table}.${c}`).join(', ')
-                : `${this.table}.*`;
-            const sql = `SELECT ${selectExpr} FROM ${this.table}${whereSql} LIMIT 1`;
+                ? columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ')
+                : `${qt}.*`;
+            const sql = `SELECT ${selectExpr} FROM ${qt}${whereSql} LIMIT 1`;
             return {
                 sql,
                 params,
@@ -159,7 +196,7 @@ export class QueryInterface {
         }
         // Nested queries: build fresh each time (with clause affects params)
         const selectClause = this.buildSelectWithRelations(this.table, args.with, params, columnsList);
-        const sql = `SELECT ${selectClause} FROM ${this.table}${whereSql} LIMIT 1`;
+        const sql = `SELECT ${selectClause} FROM ${quoteIdent(this.table)}${whereSql} LIMIT 1`;
         return {
             sql,
             params,
@@ -181,38 +218,106 @@ export class QueryInterface {
         });
     }
     buildFindMany(args) {
+        const columnsList = this.resolveColumns(args?.select, args?.omit);
+        const qt = quoteIdent(this.table);
+        const hasWith = !!(args?.with);
+        // -----------------------------------------------------------------------
+        // Fast path: no relations, no cursor, no distinct — cache SQL template
+        // Skip json_agg subquery machinery entirely for simple table scans.
+        // -----------------------------------------------------------------------
+        if (!hasWith && !args?.cursor && !args?.distinct) {
+            const whereObj = args?.where;
+            const whereKeys = whereObj
+                ? Object.keys(whereObj).filter((k) => whereObj[k] !== undefined)
+                : [];
+            // Check if all where values are simple equality (no operators, null, OR/AND/NOT)
+            const isSimpleWhere = !whereObj || (!whereObj['OR'] && !whereObj['AND'] && !whereObj['NOT'] && whereKeys.every((k) => {
+                const v = whereObj[k];
+                return v !== null && !isWhereOperator(v) && !isJsonFilter(v) && !isArrayFilter(v);
+            }));
+            if (isSimpleWhere) {
+                // Build cache key: operation + where keys + columns + orderBy + hasLimit + hasOffset
+                const colKey = columnsList ? columnsList.join(',') : '*';
+                const orderKey = args?.orderBy ? Object.entries(args.orderBy).map(([k, d]) => `${k}:${d}`).join(',') : '';
+                const hasLimit = args?.limit !== undefined || args?.take !== undefined;
+                const hasOffset = args?.offset !== undefined;
+                const ck = `fm:${whereKeys.sort().join(',')}:c=${colKey}:o=${orderKey}:l=${hasLimit ? '1' : '0'}:off=${hasOffset ? '1' : '0'}`;
+                let sql = this.sqlCache.get(ck);
+                const params = whereKeys.map((k) => whereObj[k]);
+                if (!sql) {
+                    // Build SQL template once and cache it
+                    const selectExpr = columnsList
+                        ? columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ')
+                        : `${qt}.*`;
+                    const whereClauses = whereKeys.map((k, i) => `${this.toSqlColumn(k)} = $${i + 1}`);
+                    const whereSql = whereClauses.length > 0 ? ` WHERE ${whereClauses.join(' AND ')}` : '';
+                    sql = `SELECT ${selectExpr} FROM ${qt}${whereSql}`;
+                    if (args?.orderBy) {
+                        sql += ` ORDER BY ${this.buildOrderBy(args.orderBy)}`;
+                    }
+                    // Placeholders for LIMIT/OFFSET — positions are stable since where params come first
+                    if (hasLimit) {
+                        sql += ` LIMIT $${params.length + 1}`;
+                    }
+                    if (hasOffset) {
+                        sql += ` OFFSET $${params.length + (hasLimit ? 2 : 1)}`;
+                    }
+                    this.sqlCache.set(ck, sql);
+                }
+                // Append runtime param values for LIMIT and OFFSET
+                const effectiveLimit = args?.take ?? args?.limit;
+                if (effectiveLimit !== undefined) {
+                    params.push(Number(effectiveLimit));
+                }
+                if (args?.offset !== undefined) {
+                    params.push(Number(args.offset));
+                }
+                // Fast path: no relations, use parseRow (or parseRowFast when no date columns)
+                const parseRow = this.hasNoDateColumns
+                    ? (row) => this.parseRowFast(row)
+                    : (row) => this.parseRow(row, this.table);
+                return {
+                    sql,
+                    params,
+                    transform: (result) => result.rows.map(parseRow),
+                    tag: `${this.table}.findMany`,
+                };
+            }
+        }
+        // -----------------------------------------------------------------------
+        // General path: supports operators, null, OR, cursor, distinct, nested with
+        // -----------------------------------------------------------------------
         const { sql: whereSql, params } = args?.where
             ? this.buildWhere(args.where)
             : { sql: '', params: [] };
-        const columnsList = this.resolveColumns(args?.select, args?.omit);
         // Distinct support
         let distinctPrefix = '';
         if (args?.distinct && args.distinct.length > 0) {
-            const distinctCols = args.distinct.map((k) => this.toColumn(k));
+            const distinctCols = args.distinct.map((k) => this.toSqlColumn(k));
             distinctPrefix = `DISTINCT ON (${distinctCols.join(', ')}) `;
         }
         let selectClause;
-        if (args?.with) {
+        if (hasWith) {
             selectClause = this.buildSelectWithRelations(this.table, args.with, params, columnsList);
         }
         else if (columnsList) {
-            selectClause = columnsList.map((c) => `${this.table}.${c}`).join(', ');
+            selectClause = columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ');
         }
         else {
-            selectClause = `${this.table}.*`;
+            selectClause = `${qt}.*`;
         }
-        let sql = `SELECT ${distinctPrefix}${selectClause} FROM ${this.table}${whereSql}`;
+        let sql = `SELECT ${distinctPrefix}${selectClause} FROM ${qt}${whereSql}`;
         // Cursor-based pagination: add WHERE condition for cursor
         if (args?.cursor) {
             const cursorEntries = Object.entries(args.cursor).filter(([, v]) => v !== undefined);
             if (cursorEntries.length > 0) {
                 // Determine direction from orderBy (default 'asc')
                 const cursorConditions = cursorEntries.map(([k, v]) => {
-                    const col = this.toColumn(k);
+                    const col = this.toSqlColumn(k);
                     const dir = args.orderBy?.[k] ?? 'asc';
                     const op = dir === 'desc' ? '<' : '>';
                     params.push(v);
-                    return `${this.table}.${col} ${op} $${params.length}`;
+                    return `${qt}.${col} ${op} $${params.length}`;
                 });
                 // Append to existing WHERE or create new one
                 if (whereSql) {
@@ -229,15 +334,17 @@ export class QueryInterface {
         // take overrides limit when cursor pagination is used
         const effectiveLimit = args?.take ?? args?.limit;
         if (effectiveLimit !== undefined) {
-            sql += ` LIMIT ${Number(effectiveLimit)}`;
+            params.push(Number(effectiveLimit));
+            sql += ` LIMIT $${params.length}`;
         }
         if (args?.offset !== undefined) {
-            sql += ` OFFSET ${Number(args.offset)}`;
+            params.push(Number(args.offset));
+            sql += ` OFFSET $${params.length}`;
         }
         return {
             sql,
             params,
-            transform: (result) => result.rows.map((row) => args?.with
+            transform: (result) => result.rows.map((row) => hasWith
                 ? this.parseNestedRow(row, this.table)
                 : this.parseRow(row, this.table)),
             tag: `${this.table}.findMany`,
@@ -329,14 +436,19 @@ export class QueryInterface {
     }
     buildCreate(args) {
         const entries = Object.entries(args.data).filter(([, v]) => v !== undefined);
-        const columns = entries.map(([k]) => this.toColumn(k));
+        const columns = entries.map(([k]) => this.toSqlColumn(k));
         const params = entries.map(([, v]) => v);
         const placeholders = entries.map((_, i) => `$${i + 1}`);
-        const sql = `INSERT INTO ${this.table} (${columns.join(', ')}) VALUES (${placeholders.join(', ')}) RETURNING *`;
+        const sql = `INSERT INTO ${quoteIdent(this.table)} (${columns.join(', ')}) VALUES (${placeholders.join(', ')}) RETURNING *`;
         return {
             sql,
             params,
-            transform: (result) => this.parseRow(result.rows[0], this.table),
+            transform: (result) => {
+                const row = result.rows[0];
+                if (!row)
+                    throw new Error('[turbine] Expected a row but query returned none');
+                return this.parseRow(row, this.table);
+            },
             tag: `${this.table}.create`,
         };
     }
@@ -351,9 +463,10 @@ export class QueryInterface {
         });
     }
     buildCreateMany(args) {
+        const qt = quoteIdent(this.table);
         if (args.data.length === 0) {
             return {
-                sql: `SELECT * FROM ${this.table} WHERE false`,
+                sql: `SELECT * FROM ${qt} WHERE false`,
                 params: [],
                 transform: () => [],
                 tag: `${this.table}.createMany`,
@@ -372,7 +485,8 @@ export class QueryInterface {
         // Use actual Postgres types for array casts
         const typeCasts = columns.map((col) => this.getColumnArrayType(col));
         const unnestArgs = columnArrays.map((_, i) => `$${i + 1}::${typeCasts[i]}`);
-        let sql = `INSERT INTO ${this.table} (${columns.join(', ')}) SELECT * FROM UNNEST(${unnestArgs.join(', ')})`;
+        const quotedColumns = columns.map((c) => quoteIdent(c));
+        let sql = `INSERT INTO ${qt} (${quotedColumns.join(', ')}) SELECT * FROM UNNEST(${unnestArgs.join(', ')})`;
         // skipDuplicates: add ON CONFLICT DO NOTHING
         if (args.skipDuplicates) {
             sql += ` ON CONFLICT DO NOTHING`;
@@ -401,16 +515,21 @@ export class QueryInterface {
         const params = [];
         const setClauses = setEntries.map(([k, v]) => {
             params.push(v);
-            return `${this.toColumn(k)} = $${params.length}`;
+            return `${this.toSqlColumn(k)} = $${params.length}`;
         });
         // Build WHERE using the shared params array (continues numbering after SET params)
         const whereClause = this.buildWhereClause(args.where, params);
         const whereSql = whereClause ? ` WHERE ${whereClause}` : '';
-        const sql = `UPDATE ${this.table} SET ${setClauses.join(', ')}${whereSql} RETURNING *`;
+        const sql = `UPDATE ${quoteIdent(this.table)} SET ${setClauses.join(', ')}${whereSql} RETURNING *`;
         return {
             sql,
             params,
-            transform: (result) => this.parseRow(result.rows[0], this.table),
+            transform: (result) => {
+                const row = result.rows[0];
+                if (!row)
+                    throw new Error('[turbine] Expected a row but query returned none');
+                return this.parseRow(row, this.table);
+            },
             tag: `${this.table}.update`,
         };
     }
@@ -426,11 +545,16 @@ export class QueryInterface {
     }
     buildDelete(args) {
         const { sql: whereSql, params } = this.buildWhere(args.where);
-        const sql = `DELETE FROM ${this.table}${whereSql} RETURNING *`;
+        const sql = `DELETE FROM ${quoteIdent(this.table)}${whereSql} RETURNING *`;
         return {
             sql,
             params,
-            transform: (result) => this.parseRow(result.rows[0], this.table),
+            transform: (result) => {
+                const row = result.rows[0];
+                if (!row)
+                    throw new Error('[turbine] Expected a row but query returned none');
+                return this.parseRow(row, this.table);
+            },
             tag: `${this.table}.delete`,
         };
     }
@@ -447,29 +571,34 @@ export class QueryInterface {
     buildUpsert(args) {
         // Build the INSERT part from create data
         const createEntries = Object.entries(args.create).filter(([, v]) => v !== undefined);
-        const columns = createEntries.map(([k]) => this.toColumn(k));
+        const columns = createEntries.map(([k]) => this.toSqlColumn(k));
         const createParams = createEntries.map(([, v]) => v);
         const placeholders = createEntries.map((_, i) => `$${i + 1}`);
         // The conflict target comes from `where` keys — must be unique/PK columns
         const conflictKeys = Object.keys(args.where).filter((k) => args.where[k] !== undefined);
-        const conflictColumns = conflictKeys.map((k) => this.toColumn(k));
+        const conflictColumns = conflictKeys.map((k) => this.toSqlColumn(k));
         // Build the UPDATE SET part
         const updateEntries = Object.entries(args.update).filter(([, v]) => v !== undefined);
         let paramIdx = createParams.length + 1;
         const setClauses = updateEntries.map(([k]) => {
-            const clause = `${this.toColumn(k)} = $${paramIdx}`;
+            const clause = `${this.toSqlColumn(k)} = $${paramIdx}`;
             paramIdx++;
             return clause;
         });
         const updateParams = updateEntries.map(([, v]) => v);
         const params = [...createParams, ...updateParams];
-        const sql = `INSERT INTO ${this.table} (${columns.join(', ')}) VALUES (${placeholders.join(', ')})` +
+        const sql = `INSERT INTO ${quoteIdent(this.table)} (${columns.join(', ')}) VALUES (${placeholders.join(', ')})` +
             ` ON CONFLICT (${conflictColumns.join(', ')}) DO UPDATE SET ${setClauses.join(', ')}` +
             ` RETURNING *`;
         return {
             sql,
             params,
-            transform: (result) => this.parseRow(result.rows[0], this.table),
+            transform: (result) => {
+                const row = result.rows[0];
+                if (!row)
+                    throw new Error('[turbine] Expected a row but query returned none');
+                return this.parseRow(row, this.table);
+            },
             tag: `${this.table}.upsert`,
         };
     }
@@ -489,12 +618,12 @@ export class QueryInterface {
         const params = [];
         const setClauses = setEntries.map(([k, v]) => {
             params.push(v);
-            return `${this.toColumn(k)} = $${params.length}`;
+            return `${this.toSqlColumn(k)} = $${params.length}`;
         });
         // Build WHERE using the shared params array (continues numbering after SET params)
         const whereClause = this.buildWhereClause(args.where, params);
         const whereSql = whereClause ? ` WHERE ${whereClause}` : '';
-        const sql = `UPDATE ${this.table} SET ${setClauses.join(', ')}${whereSql}`;
+        const sql = `UPDATE ${quoteIdent(this.table)} SET ${setClauses.join(', ')}${whereSql}`;
         return {
             sql,
             params,
@@ -514,7 +643,7 @@ export class QueryInterface {
     }
     buildDeleteMany(args) {
         const { sql: whereSql, params } = this.buildWhere(args.where);
-        const sql = `DELETE FROM ${this.table}${whereSql}`;
+        const sql = `DELETE FROM ${quoteIdent(this.table)}${whereSql}`;
         return {
             sql,
             params,
@@ -536,7 +665,7 @@ export class QueryInterface {
         const { sql: whereSql, params } = args?.where
             ? this.buildWhere(args.where)
             : { sql: '', params: [] };
-        const sql = `SELECT COUNT(*)::int AS count FROM ${this.table}${whereSql}`;
+        const sql = `SELECT COUNT(*)::int AS count FROM ${quoteIdent(this.table)}${whereSql}`;
         return {
             sql,
             params,
@@ -555,7 +684,8 @@ export class QueryInterface {
         });
     }
     buildGroupBy(args) {
-        const groupCols = args.by.map((k) => this.toColumn(k));
+        const groupColsRaw = args.by.map((k) => this.toColumn(k));
+        const groupCols = groupColsRaw.map((c) => quoteIdent(c));
         const { sql: whereSql, params } = args.where
             ? this.buildWhere(args.where)
             : { sql: '', params: [] };
@@ -571,7 +701,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._sum)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`SUM(${col}) AS _sum_${col}`);
+                    selectExprs.push(`SUM(${quoteIdent(col)}) AS _sum_${col}`);
                 }
             }
         }
@@ -580,7 +710,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._avg)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`AVG(${col})::float AS _avg_${col}`);
+                    selectExprs.push(`AVG(${quoteIdent(col)})::float AS _avg_${col}`);
                 }
             }
         }
@@ -589,7 +719,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._min)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MIN(${col}) AS _min_${col}`);
+                    selectExprs.push(`MIN(${quoteIdent(col)}) AS _min_${col}`);
                 }
             }
         }
@@ -598,11 +728,11 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._max)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MAX(${col}) AS _max_${col}`);
+                    selectExprs.push(`MAX(${quoteIdent(col)}) AS _max_${col}`);
                 }
             }
         }
-        let sql = `SELECT ${selectExprs.join(', ')} FROM ${this.table}${whereSql} GROUP BY ${groupCols.join(', ')}`;
+        let sql = `SELECT ${selectExprs.join(', ')} FROM ${quoteIdent(this.table)}${whereSql} GROUP BY ${groupCols.join(', ')}`;
         // ORDER BY
         if (args.orderBy) {
             sql += ` ORDER BY ${this.buildOrderBy(args.orderBy)}`;
@@ -693,7 +823,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._count)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`COUNT(${col})::int AS _count_${col}`);
+                    selectExprs.push(`COUNT(${quoteIdent(col)})::int AS _count_${col}`);
                 }
             }
         }
@@ -702,7 +832,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._sum)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`SUM(${col}) AS _sum_${col}`);
+                    selectExprs.push(`SUM(${quoteIdent(col)}) AS _sum_${col}`);
                 }
             }
         }
@@ -711,7 +841,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._avg)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`AVG(${col})::float AS _avg_${col}`);
+                    selectExprs.push(`AVG(${quoteIdent(col)})::float AS _avg_${col}`);
                 }
             }
         }
@@ -720,7 +850,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._min)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MIN(${col}) AS _min_${col}`);
+                    selectExprs.push(`MIN(${quoteIdent(col)}) AS _min_${col}`);
                 }
             }
         }
@@ -729,14 +859,14 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._max)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MAX(${col}) AS _max_${col}`);
+                    selectExprs.push(`MAX(${quoteIdent(col)}) AS _max_${col}`);
                 }
             }
         }
         if (selectExprs.length === 0) {
             selectExprs.push('COUNT(*)::int AS _count');
         }
-        const sql = `SELECT ${selectExprs.join(', ')} FROM ${this.table}${whereSql}`;
+        const sql = `SELECT ${selectExprs.join(', ')} FROM ${quoteIdent(this.table)}${whereSql}`;
         return {
             sql,
             params,
@@ -830,13 +960,17 @@ export class QueryInterface {
         }
         return null;
     }
-    /** Convert camelCase field name to snake_case column name */
+    /** Convert camelCase field name to snake_case column name (unquoted, for non-SQL uses) */
     toColumn(field) {
         const mapped = this.tableMeta.columnMap[field];
         if (mapped)
             return mapped;
         return camelToSnake(field);
     }
+    /** Convert camelCase field name to a double-quoted SQL identifier */
+    toSqlColumn(field) {
+        return quoteIdent(this.toColumn(field));
+    }
     /** Build WHERE clause from a where object (supports operators, NULL, OR) */
     buildWhere(where) {
         const params = [];
@@ -907,7 +1041,8 @@ export class QueryInterface {
                     continue;
                 }
             }
-            const column = this.toColumn(key);
+            const rawColumn = this.toColumn(key);
+            const column = quoteIdent(rawColumn);
             // Handle null → IS NULL
             if (value === null) {
                 andClauses.push(`${column} IS NULL`);
@@ -915,7 +1050,7 @@ export class QueryInterface {
             }
             // Handle JSONB filter operators (for json/jsonb columns)
             if (typeof value === 'object' && !Array.isArray(value) && isJsonFilter(value)) {
-                const colType = this.getColumnPgType(column);
+                const colType = this.getColumnPgType(rawColumn);
                 if (colType === 'json' || colType === 'jsonb') {
                     const jsonClauses = this.buildJsonFilterClauses(column, value, params);
                     andClauses.push(...jsonClauses);
@@ -924,7 +1059,7 @@ export class QueryInterface {
             }
             // Handle Array filter operators (for array columns)
             if (typeof value === 'object' && !Array.isArray(value) && isArrayFilter(value)) {
-                const colType = this.getColumnPgType(column);
+                const colType = this.getColumnPgType(rawColumn);
                 if (colType.startsWith('_')) {
                     const arrayClauses = this.buildArrayFilterClauses(column, value, params, colType);
                     andClauses.push(...arrayClauses);
@@ -954,37 +1089,39 @@ export class QueryInterface {
         const targetMeta = this.schema.tables[targetTable];
         if (!targetMeta)
             return null;
+        const qt = quoteIdent(targetTable);
+        const qSelf = quoteIdent(this.table);
         const clauses = [];
         // Correlation: link child table to parent table
         let correlation;
         if (relDef.type === 'hasMany' || relDef.type === 'hasOne') {
             // parent.pk = child.fk
-            correlation = `${targetTable}.${relDef.foreignKey} = ${this.table}.${relDef.referenceKey}`;
+            correlation = `${qt}.${quoteIdent(relDef.foreignKey)} = ${qSelf}.${quoteIdent(relDef.referenceKey)}`;
         }
         else {
             // belongsTo: parent.fk = child.pk
-            correlation = `${targetTable}.${relDef.referenceKey} = ${this.table}.${relDef.foreignKey}`;
+            correlation = `${qt}.${quoteIdent(relDef.referenceKey)} = ${qSelf}.${quoteIdent(relDef.foreignKey)}`;
         }
         // "some": EXISTS (SELECT 1 FROM target WHERE correlation AND filter)
         if (filterObj.some !== undefined) {
             const subWhere = filterObj.some;
             const filterClause = this.buildSubWhereForRelation(targetTable, subWhere, params);
             const fullWhere = filterClause ? `${correlation} AND ${filterClause}` : correlation;
-            clauses.push(`EXISTS (SELECT 1 FROM ${targetTable} WHERE ${fullWhere})`);
+            clauses.push(`EXISTS (SELECT 1 FROM ${qt} WHERE ${fullWhere})`);
         }
         // "none": NOT EXISTS (SELECT 1 FROM target WHERE correlation AND filter)
         if (filterObj.none !== undefined) {
             const subWhere = filterObj.none;
             const filterClause = this.buildSubWhereForRelation(targetTable, subWhere, params);
             const fullWhere = filterClause ? `${correlation} AND ${filterClause}` : correlation;
-            clauses.push(`NOT EXISTS (SELECT 1 FROM ${targetTable} WHERE ${fullWhere})`);
+            clauses.push(`NOT EXISTS (SELECT 1 FROM ${qt} WHERE ${fullWhere})`);
         }
         // "every": NOT EXISTS (SELECT 1 FROM target WHERE correlation AND NOT (filter))
         if (filterObj.every !== undefined) {
             const subWhere = filterObj.every;
             const filterClause = this.buildSubWhereForRelation(targetTable, subWhere, params);
             if (filterClause) {
-                clauses.push(`NOT EXISTS (SELECT 1 FROM ${targetTable} WHERE ${correlation} AND NOT (${filterClause}))`);
+                clauses.push(`NOT EXISTS (SELECT 1 FROM ${qt} WHERE ${correlation} AND NOT (${filterClause}))`);
             }
             else {
                 // "every" with empty filter = true (all match trivially)
@@ -1000,22 +1137,24 @@ export class QueryInterface {
         const meta = this.schema.tables[targetTable];
         if (!meta)
             return null;
+        const qt = quoteIdent(targetTable);
         const conditions = [];
         for (const [field, value] of Object.entries(subWhere)) {
             if (value === undefined)
                 continue;
             const col = meta.columnMap[field] ?? camelToSnake(field);
+            const qCol = `${qt}.${quoteIdent(col)}`;
             if (value === null) {
-                conditions.push(`${targetTable}.${col} IS NULL`);
+                conditions.push(`${qCol} IS NULL`);
                 continue;
             }
             if (isWhereOperator(value)) {
-                const opClauses = this.buildOperatorClauses(`${targetTable}.${col}`, value, params);
+                const opClauses = this.buildOperatorClauses(qCol, value, params);
                 conditions.push(...opClauses);
                 continue;
             }
             params.push(value);
-            conditions.push(`${targetTable}.${col} = $${params.length}`);
+            conditions.push(`${qCol} = $${params.length}`);
         }
         return conditions.length > 0 ? conditions.join(' AND ') : null;
     }
@@ -1059,23 +1198,26 @@ export class QueryInterface {
             clauses.push(`${column} != ALL($${params.length})`);
         }
         if (op.contains !== undefined) {
-            params.push(`%${op.contains}%`);
-            clauses.push(`${column} LIKE $${params.length}`);
+            params.push(`%${escapeLike(op.contains)}%`);
+            clauses.push(`${column} LIKE $${params.length} ESCAPE '\\'`);
         }
         if (op.startsWith !== undefined) {
-            params.push(`${op.startsWith}%`);
-            clauses.push(`${column} LIKE $${params.length}`);
+            params.push(`${escapeLike(op.startsWith)}%`);
+            clauses.push(`${column} LIKE $${params.length} ESCAPE '\\'`);
         }
         if (op.endsWith !== undefined) {
-            params.push(`%${op.endsWith}`);
-            clauses.push(`${column} LIKE $${params.length}`);
+            params.push(`%${escapeLike(op.endsWith)}`);
+            clauses.push(`${column} LIKE $${params.length} ESCAPE '\\'`);
         }
         return clauses;
     }
     /** Build ORDER BY clause from an object */
     buildOrderBy(orderBy) {
         return Object.entries(orderBy)
-            .map(([key, dir]) => `${this.toColumn(key)} ${dir.toUpperCase()}`)
+            .map(([key, dir]) => {
+            const safeDir = dir.toLowerCase() === 'desc' ? 'DESC' : 'ASC';
+            return `${this.toSqlColumn(key)} ${safeDir}`;
+        })
             .join(', ');
     }
     /** Parse a flat row: convert snake_case to camelCase + Date coercion */
@@ -1107,6 +1249,22 @@ export class QueryInterface {
         }
         return parsed;
     }
+    /**
+     * Fast path: parse a flat row when the table has NO date columns.
+     * Only renames snake_case -> camelCase via the pre-computed reverseMap.
+     * Skips all date coercion checks — avoids Set.has() per field per row.
+     * Used by findUnique/findMany fast paths when hasNoDateColumns is true.
+     */
+    parseRowFast(row) {
+        const parsed = {};
+        const reverseMap = this.tableMeta.reverseColumnMap;
+        const keys = Object.keys(row);
+        for (let i = 0; i < keys.length; i++) {
+            const col = keys[i];
+            parsed[reverseMap[col] ?? col] = row[col];
+        }
+        return parsed;
+    }
     /** Parse a row that may contain JSON nested relation columns */
     parseNestedRow(row, table) {
         const parsed = this.parseRow(row, table);
@@ -1153,8 +1311,9 @@ export class QueryInterface {
         if (!meta)
             throw new Error(`[turbine] Unknown table "${table}"`);
         const cols = columnsList ?? meta.allColumns;
+        const qtbl = quoteIdent(table);
         const baseCols = cols
-            .map((col) => `${table}.${col}`)
+            .map((col) => `${qtbl}.${quoteIdent(col)}`)
             .join(', ');
         const relationSelects = [];
         const aliasCounter = { n: 0 };
@@ -1166,7 +1325,7 @@ export class QueryInterface {
             }
             // The main table is not aliased, so pass table name as parentRef
             const subquery = this.buildRelationSubquery(relDef, relSpec, params, table, aliasCounter);
-            relationSelects.push(`(${subquery}) AS ${relName}`);
+            relationSelects.push(`(${subquery}) AS ${quoteIdent(relName)}`);
         }
         return [baseCols, ...relationSelects].join(', ');
     }
@@ -1202,7 +1361,7 @@ export class QueryInterface {
             targetColumns = targetMeta.allColumns.filter((col) => !omittedFields.has(col));
         }
         // Build json_build_object pairs for resolved columns
-        const jsonPairs = targetColumns.map((col) => `'${targetMeta.reverseColumnMap[col] ?? snakeToCamel(col)}', ${alias}.${col}`);
+        const jsonPairs = targetColumns.map((col) => `'${targetMeta.reverseColumnMap[col] ?? snakeToCamel(col)}', ${alias}.${quoteIdent(col)}`);
         // Nested relations?
         if (spec !== true && spec.with) {
             for (const [nestedRelName, nestedSpec] of Object.entries(spec.with)) {
@@ -1217,6 +1376,9 @@ export class QueryInterface {
             }
         }
         const jsonObj = `json_build_object(${jsonPairs.join(', ')})`;
+        // Quote parent ref — can be a table name or auto-generated alias
+        const qParent = quoteIdent(parentRef);
+        const qTarget = quoteIdent(targetTable);
         // Build ORDER BY for json_agg
         let orderClause = '';
         if (spec !== true && spec.orderBy) {
@@ -1227,7 +1389,7 @@ export class QueryInterface {
                     throw new Error(`[turbine] Unknown column "${k}" in orderBy for table "${targetTable}"`);
                 }
                 const safeDir = dir.toLowerCase() === 'desc' ? 'DESC' : 'ASC';
-                return `${alias}.${col} ${safeDir}`;
+                return `${alias}.${quoteIdent(col)} ${safeDir}`;
             })
                 .join(', ');
             orderClause = ` ORDER BY ${orders}`;
@@ -1237,10 +1399,10 @@ export class QueryInterface {
         // For belongsTo: source has FK, so alias.pk = parentRef.fk (reversed)
         let whereClause;
         if (relDef.type === 'belongsTo' || relDef.type === 'hasOne') {
-            whereClause = `${alias}.${relDef.referenceKey} = ${parentRef}.${relDef.foreignKey}`;
+            whereClause = `${alias}.${quoteIdent(relDef.referenceKey)} = ${qParent}.${quoteIdent(relDef.foreignKey)}`;
         }
         else {
-            whereClause = `${alias}.${relDef.foreignKey} = ${parentRef}.${relDef.referenceKey}`;
+            whereClause = `${alias}.${quoteIdent(relDef.foreignKey)} = ${qParent}.${quoteIdent(relDef.referenceKey)}`;
         }
         // Additional filters — properly parameterized
         if (spec !== true && spec.where) {
@@ -1250,13 +1412,14 @@ export class QueryInterface {
                     throw new Error(`[turbine] Unknown column "${k}" in where for table "${targetTable}"`);
                 }
                 params.push(v);
-                whereClause += ` AND ${alias}.${col} = $${params.length}`;
+                whereClause += ` AND ${alias}.${quoteIdent(col)} = $${params.length}`;
             }
         }
         // LIMIT
         let limitClause = '';
         if (spec !== true && spec.limit) {
-            limitClause = ` LIMIT ${Number(spec.limit)}`;
+            params.push(Number(spec.limit));
+            limitClause = ` LIMIT $${params.length}`;
         }
         if (relDef.type === 'hasMany') {
             // When LIMIT or ORDER BY is used, wrap in a subquery so LIMIT applies to rows
@@ -1265,9 +1428,9 @@ export class QueryInterface {
                 const innerAlias = `${alias}i`;
                 // Rewrite: SELECT json_agg(json_build_object(...)) FROM (SELECT * FROM table WHERE ... ORDER BY ... LIMIT N) AS alias
                 // Inner SELECT always needs all columns for WHERE/ORDER to work; json_build_object filters later
-                const innerSql = `SELECT ${targetMeta.allColumns.map((c) => `${alias}.${c}`).join(', ')} FROM ${targetTable} ${alias} WHERE ${whereClause}${orderClause}${limitClause}`;
+                const innerSql = `SELECT ${targetMeta.allColumns.map((c) => `${alias}.${quoteIdent(c)}`).join(', ')} FROM ${qTarget} ${alias} WHERE ${whereClause}${orderClause}${limitClause}`;
                 // For the json_build_object, reference the inner alias — only include resolved columns
-                const innerJsonPairs = targetColumns.map((col) => `'${targetMeta.reverseColumnMap[col] ?? snakeToCamel(col)}', ${innerAlias}.${col}`);
+                const innerJsonPairs = targetColumns.map((col) => `'${targetMeta.reverseColumnMap[col] ?? snakeToCamel(col)}', ${innerAlias}.${quoteIdent(col)}`);
                 // Re-add nested relation subqueries referencing innerAlias
                 if (spec !== true && spec.with) {
                     for (const [nestedRelName] of Object.entries(spec.with)) {
@@ -1281,10 +1444,10 @@ export class QueryInterface {
                 const innerJsonObj = `json_build_object(${innerJsonPairs.join(', ')})`;
                 return `SELECT COALESCE(json_agg(${innerJsonObj}), '[]'::json) FROM (${innerSql}) ${innerAlias}`;
             }
-            return `SELECT COALESCE(json_agg(${jsonObj}${orderClause}), '[]'::json) FROM ${targetTable} ${alias} WHERE ${whereClause}`;
+            return `SELECT COALESCE(json_agg(${jsonObj}${orderClause}), '[]'::json) FROM ${qTarget} ${alias} WHERE ${whereClause}`;
         }
         // belongsTo / hasOne — return single object
-        return `SELECT ${jsonObj} FROM ${targetTable} ${alias} WHERE ${whereClause} LIMIT 1`;
+        return `SELECT ${jsonObj} FROM ${qTarget} ${alias} WHERE ${whereClause} LIMIT 1`;
     }
     /**
      * Get the Postgres type for a column (e.g. 'jsonb', 'text', '_int4').