typeorm-extensions 2.2.0-rc.1 → 2.2.0-rc.11

package/dist/utils/reserved-qualifier-guard.utils.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.disableReservedQualifierGuard = exports.enableReservedQualifierGuard = exports.ReservedQualifierError = void 0;
+const typeorm_1 = require("typeorm");
+const reserved_qualifier_utils_1 = require("./reserved-qualifier.utils");
+const sql_utils_1 = require("./sql.utils");
+const NAME_AFTER_DOT = /^\s*\.\s*("(?:[^"]|"")*"|[A-Za-z_][\w$]*|\*)/;
+/** `"order"."userId"` for `order."userId"` / `order.userId`, `"order".*` for `order.*`. */
+function toQuotedReference(sql, { word, index }) {
+    var _a, _b;
+    const name = (_b = (_a = NAME_AFTER_DOT.exec(sql.slice(index + word.length))) === null || _a === void 0 ? void 0 : _a[1]) !== null && _b !== void 0 ? _b : 'column';
+    const quotedName = name.startsWith('"') || name === '*' ? name : `"${name}"`;
+    return `"${word}".${quotedName}`;
+}
+/** The SQL of a query names a reserved word as a qualifier without quotes; see `enableReservedQualifierGuard`. */
+class ReservedQualifierError extends Error {
+    constructor(sql, qualifiers) {
+        const [first] = qualifiers;
+        const found = qualifiers.map(({ word, snippet }) => `"${word}" in ${snippet}`).join('; ');
+        super(`Reserved word used as a qualifier without quotes: ${found}. ` +
+            `PostgreSQL reads it as the key word, not as an alias, and rejects the query. ` +
+            (first
+                ? `Quote both halves, ${toQuotedReference(sql, first)}, or build the reference with tableHelper or the typed methods`
+                : ''));
+        this.name = 'ReservedQualifierError';
+        this.sql = sql;
+        this.qualifiers = qualifiers;
+    }
+}
+exports.ReservedQualifierError = ReservedQualifierError;
+let guard;
+let installed = false;
+let lastScan;
+const reportViolation = (violation) => console.warn(violation);
+function checkQuery(queryBuilder, sql, state) {
+    var _a;
+    const driver = (0, sql_utils_1.getDriverType)(queryBuilder);
+    if (typeof sql !== 'string' || !(0, sql_utils_1.isPostgresLikeDriver)(driver)) {
+        return;
+    }
+    const words = (_a = state.words) !== null && _a !== void 0 ? _a : (0, reserved_qualifier_utils_1.toReservedWordSet)(driver === 'cockroachdb' ? reserved_qualifier_utils_1.COCKROACHDB_RESERVED_KEY_WORDS : reserved_qualifier_utils_1.POSTGRES_RESERVED_KEY_WORDS);
+    // the same SQL again, as a query run in a loop: one scan
+    const qualifiers = lastScan && lastScan.sql === sql && lastScan.words === words
+        ? lastScan.qualifiers
+        : (0, reserved_qualifier_utils_1.scanReservedQualifiers)(sql, words);
+    lastScan = { sql, words, qualifiers };
+    if (qualifiers.length === 0) {
+        return;
+    }
+    const violation = new ReservedQualifierError(sql, qualifiers);
+    if (state.mode === 'throw') {
+        throw violation;
+    }
+    state.onViolation(violation);
+}
+// every query of every builder gets its SQL here before it runs: getMany, getRawMany, getOne, getCount, stream,
+// execute; getSql() too. getQuery() isn't checked: a subquery's SQL is checked as part of the query it is in
+function installGuard() {
+    if (installed) {
+        return;
+    }
+    installed = true;
+    const getQueryAndParameters = typeorm_1.QueryBuilder.prototype.getQueryAndParameters;
+    typeorm_1.QueryBuilder.prototype.getQueryAndParameters = function () {
+        const queryAndParameters = getQueryAndParameters.call(this);
+        if (guard) {
+            checkQuery(this, queryAndParameters[0], guard);
+        }
+        return queryAndParameters;
+    };
+}
+/**
+ * Checks the SQL of every query builder on PostgreSQL and CockroachDB for a reserved word used as a qualifier
+ * without quotes, such as `order."userId"` or `user.id` (`findBareReservedQualifiers`), before the query runs.
+ * TypeORM quotes the aliases it writes, so such a word comes from SQL written by hand, which PostgreSQL rejects.
+ *
+ * Off by default. A second call replaces the options. Other databases aren't checked.
+ */
+function enableReservedQualifierGuard(options = {}) {
+    var _a;
+    const mode = (_a = options.mode) !== null && _a !== void 0 ? _a : 'throw';
+    if (mode !== 'throw' && mode !== 'warn') {
+        throw new TypeError(`Invalid mode ${JSON.stringify(mode)} of the reserved qualifier guard: 'throw' or 'warn'`);
+    }
+    guard = {
+        mode,
+        words: options.words === undefined ? undefined : (0, reserved_qualifier_utils_1.toReservedWordSet)(options.words),
+        onViolation: (options.mode === 'warn' && options.onViolation) || reportViolation,
+    };
+    installGuard();
+}
+exports.enableReservedQualifierGuard = enableReservedQualifierGuard;
+/** Turns the check of `enableReservedQualifierGuard` off. */
+function disableReservedQualifierGuard() {
+    guard = undefined;
+    lastScan = undefined;
+}
+exports.disableReservedQualifierGuard = disableReservedQualifierGuard;

package/dist/utils/reserved-qualifier.utils.d.ts

@@ -0,0 +1,33 @@
+/** A reserved word that qualifies a name without quotes, as in `order."userId"`. */
+export interface ReservedQualifier {
+    /** The word as the SQL has it: `order`, `ORDER`. */
+    word: string;
+    /** Offset of the word in the SQL. */
+    index: number;
+    /** The SQL around the word, on one line. */
+    snippet: string;
+}
+/**
+ * The reserved key words of PostgreSQL, "reserved" in Appendix C of its documentation (`SYSTEM_USER` since
+ * PostgreSQL 16). None can be a table, an alias or a schema without quotes, so none is followed by a `.` in valid
+ * SQL. The words "reserved (can be function or type)" (`LEFT`, `JOIN`, `BINARY`, …) aren't on the list: one may
+ * name the schema of a type, as in `CAST(x AS binary.my_type)`.
+ */
+export declare const POSTGRES_RESERVED_KEY_WORDS: readonly string[];
+/** The reserved key words of CockroachDB: PostgreSQL's without `SYSTEM_USER`, with `CONCURRENTLY` and `CURRENT_SCHEMA`. */
+export declare const COCKROACHDB_RESERVED_KEY_WORDS: readonly string[];
+/** The words in lower case; cached for a frozen list, such as the defaults, which can't change afterwards. */
+export declare function toReservedWordSet(words: readonly string[]): ReadonlySet<string>;
+/** `findBareReservedQualifiers` with the words as a set of lower-case words (`toReservedWordSet`). */
+export declare function scanReservedQualifiers(sql: string, words: ReadonlySet<string>): ReservedQualifier[];
+/**
+ * Reserved words that qualify a name without quotes, as in `order."userId"` or `user.id`: PostgreSQL reads such a
+ * word as the key word, not as an alias, and rejects the statement (`syntax error at or near "order"`).
+ *
+ * Words in string literals (`E'…'` and dollar-quoted ones too), quoted identifiers, comments and parameters are
+ * skipped, and so are words after a dot (`public.order`) and a number after one (`THEN .5`). Case-insensitive;
+ * whitespace may come before the dot (`group . name`).
+ *
+ * @param words the words to look for, `POSTGRES_RESERVED_KEY_WORDS` by default
+ */
+export declare function findBareReservedQualifiers(sql: string, words?: readonly string[]): ReservedQualifier[];

package/dist/utils/reserved-qualifier.utils.js

@@ -0,0 +1,252 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findBareReservedQualifiers = exports.scanReservedQualifiers = exports.toReservedWordSet = exports.COCKROACHDB_RESERVED_KEY_WORDS = exports.POSTGRES_RESERVED_KEY_WORDS = void 0;
+/**
+ * The reserved key words of PostgreSQL, "reserved" in Appendix C of its documentation (`SYSTEM_USER` since
+ * PostgreSQL 16). None can be a table, an alias or a schema without quotes, so none is followed by a `.` in valid
+ * SQL. The words "reserved (can be function or type)" (`LEFT`, `JOIN`, `BINARY`, …) aren't on the list: one may
+ * name the schema of a type, as in `CAST(x AS binary.my_type)`.
+ */
+exports.POSTGRES_RESERVED_KEY_WORDS = Object.freeze([
+    'ALL', 'ANALYSE', 'ANALYZE', 'AND', 'ANY', 'ARRAY', 'AS', 'ASC', 'ASYMMETRIC', 'BOTH', 'CASE', 'CAST', 'CHECK',
+    'COLLATE', 'COLUMN', 'CONSTRAINT', 'CREATE', 'CURRENT_CATALOG', 'CURRENT_DATE', 'CURRENT_ROLE', 'CURRENT_TIME',
+    'CURRENT_TIMESTAMP', 'CURRENT_USER', 'DEFAULT', 'DEFERRABLE', 'DESC', 'DISTINCT', 'DO', 'ELSE', 'END', 'EXCEPT',
+    'FALSE', 'FETCH', 'FOR', 'FOREIGN', 'FROM', 'GRANT', 'GROUP', 'HAVING', 'IN', 'INITIALLY', 'INTERSECT', 'INTO',
+    'LATERAL', 'LEADING', 'LIMIT', 'LOCALTIME', 'LOCALTIMESTAMP', 'NOT', 'NULL', 'OFFSET', 'ON', 'ONLY', 'OR', 'ORDER',
+    'PLACING', 'PRIMARY', 'REFERENCES', 'RETURNING', 'SELECT', 'SESSION_USER', 'SOME', 'SYMMETRIC', 'SYSTEM_USER',
+    'TABLE', 'THEN', 'TO', 'TRAILING', 'TRUE', 'UNION', 'UNIQUE', 'USER', 'USING', 'VARIADIC', 'WHEN', 'WHERE',
+    'WINDOW', 'WITH',
+]);
+/** The reserved key words of CockroachDB: PostgreSQL's without `SYSTEM_USER`, with `CONCURRENTLY` and `CURRENT_SCHEMA`. */
+exports.COCKROACHDB_RESERVED_KEY_WORDS = Object.freeze([
+    ...exports.POSTGRES_RESERVED_KEY_WORDS.filter((word) => word !== 'SYSTEM_USER'),
+    'CONCURRENTLY',
+    'CURRENT_SCHEMA',
+]);
+const KEY_WORD = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+const wordSets = new WeakMap();
+/** The words in lower case; cached for a frozen list, such as the defaults, which can't change afterwards. */
+function toReservedWordSet(words) {
+    const cached = wordSets.get(words);
+    if (cached) {
+        return cached;
+    }
+    if (!Array.isArray(words)) {
+        throw new TypeError(`Reserved words must be an array of key words, got ${typeof words}`);
+    }
+    for (const word of words) {
+        if (typeof word !== 'string' || !KEY_WORD.test(word)) {
+            throw new TypeError(`Invalid reserved word ${JSON.stringify(word)}: expected a key word, such as "order"`);
+        }
+    }
+    const set = new Set(words.map((word) => word.toLowerCase()));
+    if (Object.isFrozen(words)) {
+        wordSets.set(words, set);
+    }
+    return set;
+}
+exports.toReservedWordSet = toReservedWordSet;
+const TAB = 9;
+const CARRIAGE_RETURN = 13;
+const LINE_FEED = 10;
+const SPACE = 32;
+const DOUBLE_QUOTE = 34;
+const DOLLAR = 36;
+const QUOTE = 39;
+const STAR = 42;
+const DASH = 45;
+const DOT = 46;
+const SLASH = 47;
+const COLON = 58;
+const BACKSLASH = 92;
+const isSpace = (code) => code === SPACE || (code >= TAB && code <= CARRIAGE_RETURN);
+const isDigit = (code) => code >= 48 && code <= 57;
+// as PostgreSQL reads identifiers: letters, `_` and every non-ASCII character; then digits and `$` too
+const isIdentifierStart = (code) => (code >= 97 && code <= 122) || (code >= 65 && code <= 90) || code === 95 || code >= 128;
+const isIdentifierPart = (code) => isIdentifierStart(code) || isDigit(code) || code === DOLLAR;
+/** Index after the string literal whose opening quote is at `start`; `E'…'` strings take backslash escapes. */
+function skipString(sql, start, backslashEscapes) {
+    for (let i = start + 1; i < sql.length; i++) {
+        const code = sql.charCodeAt(i);
+        if (backslashEscapes && code === BACKSLASH) {
+            i++;
+        }
+        else if (code === QUOTE) {
+            if (sql.charCodeAt(i + 1) !== QUOTE) {
+                return i + 1;
+            }
+            i++;
+        }
+    }
+    return sql.length;
+}
+function skipQuotedIdentifier(sql, start) {
+    for (let i = start + 1; i < sql.length; i++) {
+        if (sql.charCodeAt(i) === DOUBLE_QUOTE) {
+            if (sql.charCodeAt(i + 1) !== DOUBLE_QUOTE) {
+                return i + 1;
+            }
+            i++;
+        }
+    }
+    return sql.length;
+}
+function skipLineComment(sql, start) {
+    for (let i = start + 2; i < sql.length; i++) {
+        const code = sql.charCodeAt(i);
+        if (code === LINE_FEED || code === CARRIAGE_RETURN) {
+            return i;
+        }
+    }
+    return sql.length;
+}
+// PostgreSQL nests block comments: `/* a /* b */ c */` is one comment
+function skipBlockComment(sql, start) {
+    let depth = 0;
+    let i = start;
+    while (i < sql.length) {
+        const code = sql.charCodeAt(i);
+        const next = sql.charCodeAt(i + 1);
+        if (code === SLASH && next === STAR) {
+            depth++;
+            i += 2;
+        }
+        else if (code === STAR && next === SLASH) {
+            depth--;
+            i += 2;
+            if (depth === 0) {
+                return i;
+            }
+        }
+        else {
+            i++;
+        }
+    }
+    return sql.length;
+}
+/** Index after the opening tag of a dollar-quoted string at `start` (`$$`, `$tag$`); -1 for a parameter (`$1`). */
+function dollarTagEnd(sql, start) {
+    let i = start + 1;
+    if (isIdentifierStart(sql.charCodeAt(i))) {
+        do {
+            i++;
+        } while (isIdentifierStart(sql.charCodeAt(i)) || isDigit(sql.charCodeAt(i)));
+    }
+    return sql.charCodeAt(i) === DOLLAR ? i + 1 : -1;
+}
+/**
+ * Whether the word from `start` to `end` qualifies a name: a dot follows it, after optional whitespace, and not a
+ * number (`THEN .5`); and it isn't itself a name after a dot (`public.order.id`), next to a quoted name or an
+ * identifier character, or a named parameter (`:order`, but `::` is a cast).
+ */
+function isQualifier(sql, start, end, previous) {
+    let next = end;
+    while (isSpace(sql.charCodeAt(next))) {
+        next++;
+    }
+    if (sql.charCodeAt(next) !== DOT || isDigit(sql.charCodeAt(next + 1)) || previous === DOT) {
+        return false;
+    }
+    const before = sql.charCodeAt(start - 1);
+    return (before !== DOUBLE_QUOTE &&
+        !isIdentifierPart(before) &&
+        !(before === COLON && sql.charCodeAt(start - 2) !== COLON));
+}
+const SNIPPET_CONTEXT = 30;
+// cut at whitespace, not inside a word, when the context has some
+function snippetAt(sql, start, end) {
+    let from = Math.max(0, start - SNIPPET_CONTEXT);
+    let to = Math.min(sql.length, end + SNIPPET_CONTEXT);
+    if (from > 0) {
+        const space = sql.slice(from, start).search(/\s/);
+        if (space !== -1) {
+            from += space + 1;
+        }
+    }
+    if (to < sql.length) {
+        const space = sql.slice(end, to).search(/\s\S*$/);
+        if (space !== -1) {
+            to = end + space;
+        }
+    }
+    return `${from > 0 ? '…' : ''}${sql.slice(from, to).replace(/\s+/g, ' ')}${to < sql.length ? '…' : ''}`;
+}
+/** `findBareReservedQualifiers` with the words as a set of lower-case words (`toReservedWordSet`). */
+function scanReservedQualifiers(sql, words) {
+    const found = [];
+    const length = sql.length;
+    // the last character outside whitespace and comments
+    let previous = -1;
+    let i = 0;
+    while (i < length) {
+        const code = sql.charCodeAt(i);
+        if (isSpace(code)) {
+            i++;
+        }
+        else if (code === DASH && sql.charCodeAt(i + 1) === DASH) {
+            i = skipLineComment(sql, i);
+        }
+        else if (code === SLASH && sql.charCodeAt(i + 1) === STAR) {
+            i = skipBlockComment(sql, i);
+        }
+        else if (code === QUOTE) {
+            i = skipString(sql, i, false);
+            previous = code;
+        }
+        else if (code === DOUBLE_QUOTE) {
+            i = skipQuotedIdentifier(sql, i);
+            previous = code;
+        }
+        else if (code === DOLLAR) {
+            const tagEnd = dollarTagEnd(sql, i);
+            if (tagEnd === -1) {
+                do {
+                    i++;
+                } while (isDigit(sql.charCodeAt(i)));
+            }
+            else {
+                const close = sql.indexOf(sql.slice(i, tagEnd), tagEnd);
+                i = close === -1 ? length : close + (tagEnd - i);
+            }
+            previous = code;
+        }
+        else if (isIdentifierPart(code)) {
+            const start = i;
+            do {
+                i++;
+            } while (isIdentifierPart(sql.charCodeAt(i)));
+            // E'…', the string literal with backslash escapes
+            if (i - start === 1 && (code === 69 || code === 101) && sql.charCodeAt(i) === QUOTE) {
+                i = skipString(sql, i, true);
+                previous = QUOTE;
+                continue;
+            }
+            if (isIdentifierStart(code) &&
+                isQualifier(sql, start, i, previous) &&
+                words.has(sql.slice(start, i).toLowerCase())) {
+                found.push({ word: sql.slice(start, i), index: start, snippet: snippetAt(sql, start, i) });
+            }
+            previous = code;
+        }
+        else {
+            previous = code;
+            i++;
+        }
+    }
+    return found;
+}
+exports.scanReservedQualifiers = scanReservedQualifiers;
+/**
+ * Reserved words that qualify a name without quotes, as in `order."userId"` or `user.id`: PostgreSQL reads such a
+ * word as the key word, not as an alias, and rejects the statement (`syntax error at or near "order"`).
+ *
+ * Words in string literals (`E'…'` and dollar-quoted ones too), quoted identifiers, comments and parameters are
+ * skipped, and so are words after a dot (`public.order`) and a number after one (`THEN .5`). Case-insensitive;
+ * whitespace may come before the dot (`group . name`).
+ *
+ * @param words the words to look for, `POSTGRES_RESERVED_KEY_WORDS` by default
+ */
+function findBareReservedQualifiers(sql, words = exports.POSTGRES_RESERVED_KEY_WORDS) {
+    return scanReservedQualifiers(sql, toReservedWordSet(words));
+}
+exports.findBareReservedQualifiers = findBareReservedQualifiers;

package/dist/utils/table.utils.d.ts

@@ -74,17 +74,7 @@ export type TableHelperTimeZone<T> = string | {
 /** The units of PostgreSQL's `date_trunc`. */
 export type DateTruncUnit = 'microseconds' | 'milliseconds' | 'second' | 'minute' | 'hour' | 'day' | 'week' | 'month' | 'quarter' | 'year' | 'decade' | 'century' | 'millennium';
 export type JsonFieldRest<V> = [NonNullable<V>] extends [Record<string, unknown>] ? JsonFieldTuple<NonNullable<V>> : string[];
-/**
- * Creates a type-safe SQL helper for building column references, WHERE expressions,
- * JOIN clauses, and JSONB accessors for a given entity type.
- *
- * @example
- * const t = tableHelper<UserEntity>('user');
- * t.column('email')              // → "user"."email"
- * t.where('id', '= :id')        // → "user"."id" = :id
- * t.jsonColumn('metadata', '->>', 'role')  // → "user"."metadata" ->> 'role'
- */
-export declare const tableHelper: <T extends ObjectLiteral>(alias?: string, options?: TableHelperOptions) => {
+declare const createTableHelper: <T extends ObjectLiteral>(alias?: string, options?: TableHelperOptions, databaseNames?: ReadonlyMap<string, string>) => {
     alias: string | undefined;
     /**
      * Returns a quoted SQL column identifier, e.g. `"alias"."column"`. The column is always quoted as one
@@ -193,4 +183,30 @@ export declare const tableHelper: <T extends ObjectLiteral>(alias?: string, opti
      */
     dateTrunc(unit: DateTruncUnit, value: TableHelperExpression<T>, timeZone?: TableHelperTimeZone<T> | undefined): string;
 };
+type TableHelperMemberName = keyof ReturnType<typeof createTableHelper>;
+/**
+ * The helper `tableHelper` returns: its methods, and each column of the table as a read-only property,
+ * `t.email` for `t.column('email')`. A column named like a member (`alias`, `count`, …) is the member there.
+ */
+export type TableHelper<T extends ObjectLiteral> = ReturnType<typeof createTableHelper<T>> & {
+    readonly [K in Exclude<ColumnName<T>, TableHelperMemberName>]: string;
+};
+/** An entity class, abstract ones included. */
+export type EntityClass<T> = abstract new (...args: never[]) => T;
+/**
+ * Creates a type-safe SQL helper for building column references, WHERE expressions,
+ * JOIN clauses, and JSONB accessors for a given entity type.
+ *
+ * Given the entity class, it takes property names and writes the column names the entity maps them to:
+ * `tableHelper(UserEntity, 'user').adminEmail` is `"user"."email"` for `@Column({ name: 'email' }) adminEmail`.
+ *
+ * @example
+ * const t = tableHelper<UserEntity>('user');
+ * t.column('email')              // → "user"."email"
+ * t.email                        // → "user"."email", the same
+ * t.where('id', '= :id')        // → "user"."id" = :id
+ * t.jsonColumn('metadata', '->>', 'role')  // → "user"."metadata" ->> 'role'
+ */
+export declare function tableHelper<T extends ObjectLiteral>(entity: EntityClass<T>, alias?: string, options?: TableHelperOptions): TableHelper<T>;
+export declare function tableHelper<T extends ObjectLiteral>(alias?: string, options?: TableHelperOptions): TableHelper<T>;
 export {};

package/dist/utils/table.utils.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.tableHelper = void 0;
+const typeorm_1 = require("typeorm");
 const sql_utils_1 = require("./sql.utils");
 const json_path_utils_1 = require("./json-path.utils");
+const time_zone_utils_1 = require("./time-zone.utils");
 /**
  * The argument of an aggregate and the clause after it for a `filter` written with `syntax`:
  * `CASE WHEN filter THEN argument END`, or `argument` and ` FILTER (WHERE filter)`.
@@ -44,9 +46,9 @@ const DATE_TRUNC_UNITS = [
     'century',
     'millennium',
 ];
-function assertPostgres(method, driver) {
+function assertPostgres(method, driver, hint) {
     if (driver !== undefined && !(0, sql_utils_1.isPostgresLikeDriver)(driver)) {
-        throw new TypeError(`tableHelper.${method}(): PostgreSQL only, the driver is "${driver}"`);
+        throw new TypeError(`tableHelper.${method}(): PostgreSQL only, the driver is "${driver}"${hint ? `: ${hint}` : ''}`);
     }
 }
 function toExpression(value, toColumn) {
@@ -57,7 +59,7 @@ function toTimeZone(method, timeZone, toColumn) {
         if (!timeZone.trim()) {
             throw new TypeError(`tableHelper.${method}(): the time zone is empty`);
         }
-        return sqlString(toPostgresZone(timeZone));
+        return sqlString(toPostgresZone(method, timeZone));
     }
     if ('sql' in timeZone) {
         return timeZone.sql;
@@ -65,19 +67,18 @@ function toTimeZone(method, timeZone, toColumn) {
     const column = toColumn(timeZone.column);
     return timeZone.fallback === undefined
         ? column
-        : `COALESCE(${column}, ${sqlString(toPostgresZone(timeZone.fallback))})`;
+        : `COALESCE(${column}, ${sqlString(toPostgresZone(method, timeZone.fallback))})`;
 }
-const ISO_OFFSET = /^([+-])(\d{2}):?(\d{2})?$/;
 /**
  * PostgreSQL reads `'+02:00'` as a POSIX zone, whose offsets count west: UTC−2. An ISO 8601 offset is
  * written as the POSIX zone of the same offset, `'<+0200>-02:00'`, so `'+02:00'` is UTC+2 as everywhere else.
  */
-function toPostgresZone(timeZone) {
-    const offset = ISO_OFFSET.exec(timeZone.trim());
+function toPostgresZone(method, timeZone) {
+    const offset = (0, time_zone_utils_1.parseUtcOffset)(timeZone.trim(), `tableHelper.${method}(): "${timeZone}" is not a UTC offset`);
     if (offset === null) {
         return timeZone;
     }
-    const [, sign, hours, minutes = '00'] = offset;
+    const { sign, hours, minutes } = offset;
     return `<${sign}${hours}${minutes}>${sign === '+' ? '-' : '+'}${hours}:${minutes}`;
 }
 /** The JSON functions of a database: PostgreSQL's unless the driver is MySQL / MariaDB or SQLite. */
@@ -102,26 +103,17 @@ function jsonFunctions(driver, jsonb) {
 }
 // MySQL reads a backslash in a string as an escape (unless NO_BACKSLASH_ESCAPES): `\'` would end the literal
 const sqlString = (value, driver) => `'${((0, sql_utils_1.isMysqlLikeDriver)(driver) ? value.replace(/\\/g, '\\\\') : value).replace(/'/g, "''")}'`;
-/**
- * Creates a type-safe SQL helper for building column references, WHERE expressions,
- * JOIN clauses, and JSONB accessors for a given entity type.
- *
- * @example
- * const t = tableHelper<UserEntity>('user');
- * t.column('email')              // → "user"."email"
- * t.where('id', '= :id')        // → "user"."id" = :id
- * t.jsonColumn('metadata', '->>', 'role')  // → "user"."metadata" ->> 'role'
- */
-const tableHelper = (alias, options = {}) => ({
+const createTableHelper = (alias, options = {}, databaseNames) => ({
     alias,
     /**
      * Returns a quoted SQL column identifier, e.g. `"alias"."column"`. The column is always quoted as one
      * identifier, so names with other characters work too: `"user"."first-name"`.
      */
     column(columnName, alias) {
+        var _a;
         const { useQuotes = true, driver } = options;
         const tableAlias = alias !== null && alias !== void 0 ? alias : this.alias;
-        const column = String(columnName);
+        const column = (_a = databaseNames === null || databaseNames === void 0 ? void 0 : databaseNames.get(String(columnName))) !== null && _a !== void 0 ? _a : String(columnName);
         if (!useQuotes) {
             return [tableAlias, column].filter(Boolean).join('.');
         }
@@ -208,9 +200,7 @@ const tableHelper = (alias, options = {}) => ({
     arrayAgg(columnName, aggOptions = {}) {
         var _a;
         const { distinct = false, orderBy, filter } = aggOptions;
-        if (options.driver !== undefined && !(0, sql_utils_1.isPostgresLikeDriver)(options.driver)) {
-            throw new TypeError(`tableHelper.arrayAgg(): arrays are PostgreSQL's, the driver is "${options.driver}": use jsonAgg`);
-        }
+        assertPostgres('arrayAgg', options.driver, 'use jsonAgg');
         const order = orderBy ? aggregateOrder('arrayAgg', orderBy, (column) => this.column(column)) : undefined;
         // PostgreSQL: "in an aggregate with DISTINCT, ORDER BY expressions must appear in argument list"
         if (distinct && order && order.column !== columnName) {
@@ -316,4 +306,49 @@ const tableHelper = (alias, options = {}) => ({
         return `date_trunc('${unit}', ${toExpression(value, toColumn)}${zone})`;
     }
 });
+// keys that JavaScript, Node and test tools read on any object (await, JSON.stringify, util.inspect, Jest): they
+// must stay undefined, as must symbols. The members of Object.prototype are in the target already
+const PROTOCOL_KEYS = new Set(['then', 'toJSON', 'inspect', 'asymmetricMatch', '$$typeof', 'nodeType']);
+const columnAccess = {
+    get(target, key, receiver) {
+        if (typeof key === 'symbol' || key in target || PROTOCOL_KEYS.has(key)) {
+            return Reflect.get(target, key, receiver);
+        }
+        return target.column(key);
+    },
+};
+const databaseNamesByEntity = new WeakMap();
+// The names set with `@Column({ name })` on the class or a parent, the nearest declaration winning. Every other
+// column keeps its property name, as under TypeORM's default naming strategy. Columns of embedded entities are not read
+const databaseColumnNames = (entity) => {
+    var _a;
+    const cached = databaseNamesByEntity.get(entity);
+    if (cached) {
+        return cached;
+    }
+    const lineage = [];
+    for (let target = entity; typeof target === 'function' && target !== Function.prototype; target = Object.getPrototypeOf(target)) {
+        lineage.push(target);
+    }
+    const names = new Map();
+    const depths = new Map();
+    for (const { target, propertyName, options } of (0, typeorm_1.getMetadataArgsStorage)().columns) {
+        const depth = lineage.indexOf(target);
+        if (depth !== -1 && options.name && depth < ((_a = depths.get(propertyName)) !== null && _a !== void 0 ? _a : Infinity)) {
+            names.set(propertyName, options.name);
+            depths.set(propertyName, depth);
+        }
+    }
+    databaseNamesByEntity.set(entity, names);
+    return names;
+};
+function tableHelper(entityOrAlias, aliasOrOptions, entityOptions) {
+    if (entityOrAlias === undefined && typeof aliasOrOptions === 'string') {
+        throw new TypeError(`tableHelper(entity, '${aliasOrOptions}'): the entity class is undefined, as a circular import leaves it at module load. Create the helper where it is used`);
+    }
+    const helper = typeof entityOrAlias === 'function'
+        ? createTableHelper(aliasOrOptions, entityOptions, databaseColumnNames(entityOrAlias))
+        : createTableHelper(entityOrAlias, aliasOrOptions);
+    return new Proxy(helper, columnAccess);
+}
 exports.tableHelper = tableHelper;

package/dist/utils/time-zone.utils.d.ts

@@ -1,3 +1,10 @@
+type UtcOffset = {
+    sign: '+' | '-';
+    hours: string;
+    minutes: string;
+};
+/** The parts of an ISO 8601 UTC offset (`+02:00`, `-0530`, `+02`); `null` for other text, a `TypeError` past 23:59. */
+export declare function parseUtcOffset(text: string, errorMessage: string): UtcOffset | null;
 /** Throws a `TypeError` for a time zone the runtime doesn't know. */
 export declare function assertTimeZone(timeZone: string): void;
 /**
@@ -6,3 +13,4 @@ export declare function assertTimeZone(timeZone: string): void;
  * instant already: it is returned as that `Date`. Any other string throws a `TypeError` naming `name`.
  */
 export declare function readInTimeZone(value: string, timeZone: string, name: string): Date;
+export {};

package/dist/utils/time-zone.utils.js

@@ -1,10 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readInTimeZone = exports.assertTimeZone = void 0;
+exports.readInTimeZone = exports.assertTimeZone = exports.parseUtcOffset = void 0;
 const DAY_MS = 24 * 60 * 60 * 1000;
 const MAX_CACHED_FORMATTERS = 500;
 const DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(Z|[+-]\d{2}(?::?\d{2})?)?)?$/i;
 const OFFSET = /^([+-])(\d{2}):?(\d{2})?$/;
+/** The parts of an ISO 8601 UTC offset (`+02:00`, `-0530`, `+02`); `null` for other text, a `TypeError` past 23:59. */
+function parseUtcOffset(text, errorMessage) {
+    const offset = OFFSET.exec(text);
+    if (offset === null) {
+        return null;
+    }
+    const [, sign, hours, minutes = '00'] = offset;
+    if (Number(hours) > 23 || Number(minutes) > 59) {
+        throw new TypeError(errorMessage);
+    }
+    return { sign: sign, hours, minutes };
+}
+exports.parseUtcOffset = parseUtcOffset;
 const formatters = new Map();
 function getFormatter(timeZone) {
     let formatter = formatters.get(timeZone);
@@ -94,9 +107,6 @@ function getOffsetMinutes(offset, value, name) {
     if (offset.toUpperCase() === 'Z') {
         return 0;
     }
-    const [, sign, hours, minutes = '00'] = OFFSET.exec(offset);
-    if (Number(hours) > 23 || Number(minutes) > 59) {
-        throw new TypeError(`Invalid ${name} "${value}": not a UTC offset`);
-    }
+    const { sign, hours, minutes } = parseUtcOffset(offset, `Invalid ${name} "${value}": not a UTC offset`);
     return (sign === '-' ? -1 : 1) * (Number(hours) * 60 + Number(minutes));
 }

package/dist/utils/typed-where.utils.d.ts

@@ -0,0 +1,9 @@
+import { ObjectLiteral, WhereExpressionBuilder } from 'typeorm';
+import type { KeyProxyCallback } from '../types/modules/proxy-callback.types';
+import type { JsonPathSqlOptions } from './json-path.utils';
+/**
+ * Calls the untyped where `method` with the single column a typed callback picks, followed by `args`, as the typed
+ * where methods that only add the column to their untyped counterpart do. A callback that isn't a function, from
+ * untyped code, leaves the builder as it is.
+ */
+export declare function attachTypedColumnWhere<Type extends ObjectLiteral, QB extends WhereExpressionBuilder, Args extends unknown[] = unknown[]>(builder: QB, method: string, where: KeyProxyCallback<Type>, jsonOptions: JsonPathSqlOptions | undefined, ...args: Args): QB;

package/dist/utils/typed-where.utils.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attachTypedColumnWhere = void 0;
+const query_builder_utils_1 = require("./query-builder.utils");
+/**
+ * Calls the untyped where `method` with the single column a typed callback picks, followed by `args`, as the typed
+ * where methods that only add the column to their untyped counterpart do. A callback that isn't a function, from
+ * untyped code, leaves the builder as it is.
+ */
+function attachTypedColumnWhere(builder, method, where, jsonOptions, ...args) {
+    if (typeof where !== 'function') {
+        return builder;
+    }
+    const key = (0, query_builder_utils_1.getTypedSingleColumnKey)(builder, where, `${method}Typed`, jsonOptions);
+    return builder[method](key, ...args);
+}
+exports.attachTypedColumnWhere = attachTypedColumnWhere;