@c9up/atlas 0.1.9 → 0.1.10

package/dist/schema/Seeder.d.ts

@@ -1,15 +1,20 @@
 /**
  * Seeder — populate the database with default / reference / test data.
  *
- * The canonical pattern:
+ * The canonical pattern (idempotent via `upsert`, keyed on a unique column):
  *
  *     export default class CountrySeeder extends BaseSeeder {
  *       async run() {
- *         // Idempotent via updateOrCreateMany — safe to re-run.
- *         await Country.updateOrCreateMany('isoCode', [
- *           { isoCode: 'FR', name: 'France' },
- *           { isoCode: 'IN', name: 'India' },
- *         ])
+ *         const countries = new BaseRepository(Country, this.db)
+ *         // Conflict on isoCode → update name. Safe to re-run.
+ *         await countries.upsert(
+ *           [
+ *             { isoCode: 'FR', name: 'France' },
+ *             { isoCode: 'IN', name: 'India' },
+ *           ],
+ *           ['isoCode'],
+ *           ['name'],
+ *         )
  *       }
  *     }
  *
@@ -25,7 +30,7 @@ import type { DatabaseConnection } from "../BaseRepository.js";
 export declare abstract class BaseSeeder {
     protected db: DatabaseConnection;
     constructor(db: DatabaseConnection);
-    /** The seeder body. Should be idempotent — `updateOrCreateMany` is the recommended pattern. */
+    /** The seeder body. Should be idempotent — `repo.upsert(...)` is the recommended pattern. */
     abstract run(): Promise<void> | void;
 }
 /** Legacy alias kept for code using the previous API. */
@@ -35,7 +40,7 @@ export declare const Seeder: typeof BaseSeeder;
  * sequentially so ordering is deterministic and side effects are visible to
  * subsequent seeders.
  */
-export declare function runSeeders(seeders: BaseSeeder[], _db?: DatabaseConnection): Promise<void>;
+export declare function runSeeders(seeders: BaseSeeder[]): Promise<void>;
 /**
  * Discover seeder files under `dir`, import them in alphabetical order, build
  * instances with the given DB connection, and run them sequentially.

package/dist/schema/Seeder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Seeder.d.ts","sourceRoot":"","sources":["../../src/schema/Seeder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAQ/D;;;;;GAKG;AACH,8BAAsB,UAAU;IAC/B,SAAS,CAAC,EAAE,EAAE,kBAAkB,CAAC;gBAErB,EAAE,EAAE,kBAAkB;IAIlC,+FAA+F;IAC/F,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;CACpC;AAED,yDAAyD;AACzD,eAAO,MAAM,MAAM,mBAAa,CAAC;AAEjC;;;;GAIG;AACH,wBAAsB,UAAU,CAC/B,OAAO,EAAE,UAAU,EAAE,EACrB,GAAG,CAAC,EAAE,kBAAkB,GACtB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACvC,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,kBAAkB,EACtB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrC,OAAO,CAAC,MAAM,EAAE,CAAC,CAqDnB"}
+{"version":3,"file":"Seeder.d.ts","sourceRoot":"","sources":["../../src/schema/Seeder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAQ/D;;;;;GAKG;AACH,8BAAsB,UAAU;IAC/B,SAAS,CAAC,EAAE,EAAE,kBAAkB,CAAC;gBAErB,EAAE,EAAE,kBAAkB;IAIlC,6FAA6F;IAC7F,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;CACpC;AAED,yDAAyD;AACzD,eAAO,MAAM,MAAM,mBAAa,CAAC;AAEjC;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACvC,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,kBAAkB,EACtB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrC,OAAO,CAAC,MAAM,EAAE,CAAC,CAqDnB"}

package/dist/schema/Seeder.js

@@ -1,15 +1,20 @@
 /**
  * Seeder — populate the database with default / reference / test data.
  *
- * The canonical pattern:
+ * The canonical pattern (idempotent via `upsert`, keyed on a unique column):
  *
  *     export default class CountrySeeder extends BaseSeeder {
  *       async run() {
- *         // Idempotent via updateOrCreateMany — safe to re-run.
- *         await Country.updateOrCreateMany('isoCode', [
- *           { isoCode: 'FR', name: 'France' },
- *           { isoCode: 'IN', name: 'India' },
- *         ])
+ *         const countries = new BaseRepository(Country, this.db)
+ *         // Conflict on isoCode → update name. Safe to re-run.
+ *         await countries.upsert(
+ *           [
+ *             { isoCode: 'FR', name: 'France' },
+ *             { isoCode: 'IN', name: 'India' },
+ *           ],
+ *           ['isoCode'],
+ *           ['name'],
+ *         )
  *       }
  *     }
  *
@@ -38,7 +43,7 @@ export const Seeder = BaseSeeder;
  * sequentially so ordering is deterministic and side effects are visible to
  * subsequent seeders.
  */
-export async function runSeeders(seeders, _db) {
+export async function runSeeders(seeders) {
     for (const seeder of seeders) {
         await seeder.run();
     }
@@ -70,7 +75,7 @@ export async function runSeederDirectory(dir, db, options) {
     const executed = [];
     for (const file of selected) {
         assertSafeName(file, "E_SEEDER_INVALID", "seeder");
-        const resolved = assertPathInsideBase(dir, file, "E_SEEDER_INVALID_PATH", "Seeder");
+        const resolved = await assertPathInsideBase(dir, file, "E_SEEDER_INVALID_PATH", "Seeder");
         // `pathToFileURL` is required on Windows where bare `C:\…` paths
         // trip ESM's ERR_UNSUPPORTED_ESM_URL_SCHEME on dynamic import.
         const mod = await import(pathToFileURL(resolved).href);

package/dist/schema/Seeder.js.map

@@ -1 +1 @@
-{"version":3,"file":"Seeder.js","sourceRoot":"","sources":["../../src/schema/Seeder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACN,oBAAoB,EACpB,cAAc,EACd,UAAU,GACV,MAAM,sBAAsB,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,OAAgB,UAAU;IACrB,EAAE,CAAqB;IAEjC,YAAY,EAAsB;QACjC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACd,CAAC;CAID;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,MAAM,GAAG,UAAU,CAAC;AAEjC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,OAAqB,EACrB,GAAwB;IAExB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,GAAW,EACX,EAAsB,EACtB,OAAuC;IAEvC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CACnB,wBAAwB,EACxB,+BAA+B,GAAG,EAAE,EACpC;YACC,IAAI,EAAE,uEAAuE;SAC7E,CACD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SACvC,MAAM,CACN,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACvE;SACA,IAAI,EAAE,CAAC;IAET,MAAM,QAAQ,GAAG,OAAO,EAAE,KAAK;QAC9B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CACpD;QACF,CAAC,CAAC,QAAQ,CAAC;IAEZ,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC7B,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,oBAAoB,CACpC,GAAG,EACH,IAAI,EACJ,uBAAuB,EACvB,QAAQ,CACR,CAAC;QAEF,iEAAiE;QACjE,+DAA+D;QAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CACnB,kBAAkB,EAClB,UAAU,IAAI,mDAAmD,EACjE;gBACC,IAAI,EAAE,uFAAuF;aAC7F,CACD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAe,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}
+{"version":3,"file":"Seeder.js","sourceRoot":"","sources":["../../src/schema/Seeder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACN,oBAAoB,EACpB,cAAc,EACd,UAAU,GACV,MAAM,sBAAsB,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,OAAgB,UAAU;IACrB,EAAE,CAAqB;IAEjC,YAAY,EAAsB;QACjC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACd,CAAC;CAID;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,MAAM,GAAG,UAAU,CAAC;AAEjC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAqB;IACrD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,GAAW,EACX,EAAsB,EACtB,OAAuC;IAEvC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CACnB,wBAAwB,EACxB,+BAA+B,GAAG,EAAE,EACpC;YACC,IAAI,EAAE,uEAAuE;SAC7E,CACD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SACvC,MAAM,CACN,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACvE;SACA,IAAI,EAAE,CAAC;IAET,MAAM,QAAQ,GAAG,OAAO,EAAE,KAAK;QAC9B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CACpD;QACF,CAAC,CAAC,QAAQ,CAAC;IAEZ,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC7B,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAC1C,GAAG,EACH,IAAI,EACJ,uBAAuB,EACvB,QAAQ,CACR,CAAC;QAEF,iEAAiE;QACjE,+DAA+D;QAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CACnB,kBAAkB,EAClB,UAAU,IAAI,mDAAmD,EACjE;gBACC,IAAI,EAAE,uFAAuF;aAC7F,CACD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAe,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/services/db.d.ts

@@ -15,6 +15,13 @@
 import type { AsyncDatabaseConnection } from "../adapters/NapiDbAdapter.js";
 /** @internal Bind the singleton (called by AtlasProvider). */
 export declare function setDb(connection: AsyncDatabaseConnection): void;
+/**
+ * @internal Unbind the singleton IF it still points at `connection` (called by
+ * `AtlasProvider.shutdown()`). Ownership-guarded: when a second provider rebound
+ * the singleton, the older provider's shutdown must not clear the newer binding.
+ * Without this, `db.*` after shutdown would dereference a closed connection.
+ */
+export declare function clearDb(connection: AsyncDatabaseConnection): void;
 /** @internal Read the singleton (or `undefined` pre-boot). */
 export declare function getDb(): AsyncDatabaseConnection | undefined;
 declare const db: AsyncDatabaseConnection;

package/dist/services/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/services/db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAI5E,8DAA8D;AAC9D,wBAAgB,KAAK,CAAC,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAE/D;AAED,8DAA8D;AAC9D,wBAAgB,KAAK,IAAI,uBAAuB,GAAG,SAAS,CAE3D;AAED,QAAA,MAAM,EAAE,EAAE,uBAaR,CAAC;AAEH,eAAe,EAAE,CAAC"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/services/db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAI5E,8DAA8D;AAC9D,wBAAgB,KAAK,CAAC,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAEjE;AAED,8DAA8D;AAC9D,wBAAgB,KAAK,IAAI,uBAAuB,GAAG,SAAS,CAE3D;AAED,QAAA,MAAM,EAAE,EAAE,uBAaR,CAAC;AAEH,eAAe,EAAE,CAAC"}

package/dist/services/db.js

@@ -17,6 +17,16 @@ let instance;
 export function setDb(connection) {
     instance = connection;
 }
+/**
+ * @internal Unbind the singleton IF it still points at `connection` (called by
+ * `AtlasProvider.shutdown()`). Ownership-guarded: when a second provider rebound
+ * the singleton, the older provider's shutdown must not clear the newer binding.
+ * Without this, `db.*` after shutdown would dereference a closed connection.
+ */
+export function clearDb(connection) {
+    if (instance === connection)
+        instance = undefined;
+}
 /** @internal Read the singleton (or `undefined` pre-boot). */
 export function getDb() {
     return instance;

package/dist/services/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/services/db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,IAAI,QAA6C,CAAC;AAElD,8DAA8D;AAC9D,MAAM,UAAU,KAAK,CAAC,UAAmC;IACxD,QAAQ,GAAG,UAAU,CAAC;AACvB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,KAAK;IACpB,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,EAAE,GAA4B,IAAI,KAAK,CAAC,EAA6B,EAAE;IAC5E,GAAG,CAAC,OAAO,EAAE,IAAI;QAChB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACd,iEAAiE;gBAChE,gEAAgE;gBAChE,+DAA+D;gBAC/D,aAAa,CACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnE,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,EAAE,CAAC"}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/services/db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,IAAI,QAA6C,CAAC;AAElD,8DAA8D;AAC9D,MAAM,UAAU,KAAK,CAAC,UAAmC;IACxD,QAAQ,GAAG,UAAU,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,UAAmC;IAC1D,IAAI,QAAQ,KAAK,UAAU;QAAE,QAAQ,GAAG,SAAS,CAAC;AACnD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,KAAK;IACpB,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,EAAE,GAA4B,IAAI,KAAK,CAAC,EAA6B,EAAE;IAC5E,GAAG,CAAC,OAAO,EAAE,IAAI;QAChB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACd,iEAAiE;gBAChE,gEAAgE;gBAChE,+DAA+D;gBAC/D,aAAa,CACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnE,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,EAAE,CAAC"}

package/dist/testing/Factory.d.ts

@@ -21,15 +21,14 @@ type StateFn<D> = (data: D) => void;
 export interface FactoryBuilder<T extends BaseEntity> {
     /** Override specific fields for the next call (reset after consumption). */
     merge(overrides: Partial<Record<string, unknown>>): FactoryBuilder<T>;
-    /**
-     * Declare a named variation of this factory. States are stored on the
-     * factory itself and don't mutate the caller — `apply()` returns a child
-     * builder with the state active.
-     */
+    /** Declare a named variation of this factory, stored on the factory's state map. */
     state(name: string, fn: StateFn<Record<string, unknown>>): FactoryBuilder<T>;
     /**
-     * Activate one or more declared states for the next call. Multiple applies
-     * compose (all applied states fire, in order).
+     * Activate one or more declared states for the NEXT build. Multiple applies
+     * compose (all fire, in order). NOTE: this mutates the builder's shared
+     * pending state and returns the SAME builder for chaining — there is no
+     * isolated child builder. The pending set is reset after each make/create
+     * (audit 2026-06-13). `merge()` behaves the same way.
      */
     apply(...stateNames: string[]): FactoryBuilder<T>;
     /** Create and persist a single entity (fires lifecycle hooks via `repo.create`). */

package/dist/testing/Factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Factory.d.ts","sourceRoot":"","sources":["../../src/testing/Factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/E,KAAK,iBAAiB,CAAC,CAAC,SAAS,UAAU,IAAI,UAAU,CAAC,CAAC;AAE3D,mEAAmE;AACnE,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;AAEpC,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,UAAU;IACnD,4EAA4E;IAC5E,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAEtE;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAE7E;;;OAGG;IACH,KAAK,CAAC,GAAG,UAAU,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAElD,oFAAoF;IACpF,MAAM,CAAC,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3C,kEAAkE;IAClE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAEhE,oFAAoF;IACpF,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEhC,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAEnD;;;OAGG;IACH,WAAW,IAAI,CAAC,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,UAAU,EAC3C,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACjC,QAAQ,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,cAAc,CAAC,CAAC,CAAC,CA4FnB"}
+{"version":3,"file":"Factory.d.ts","sourceRoot":"","sources":["../../src/testing/Factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/E,KAAK,iBAAiB,CAAC,CAAC,SAAS,UAAU,IAAI,UAAU,CAAC,CAAC;AAE3D,mEAAmE;AACnE,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;AAEpC,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,UAAU;IACnD,4EAA4E;IAC5E,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAEtE,oFAAoF;IACpF,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAE7E;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,UAAU,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAElD,oFAAoF;IACpF,MAAM,CAAC,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3C,kEAAkE;IAClE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAEhE,oFAAoF;IACpF,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEhC,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAEnD;;;OAGG;IACH,WAAW,IAAI,CAAC,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,UAAU,EAC3C,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACjC,QAAQ,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,cAAc,CAAC,CAAC,CAAC,CA0FnB"}

package/dist/testing/Factory.js

@@ -64,13 +64,11 @@ export function factory(entityClass, defaults) {
             return data;
         },
         makeMany(count) {
-            // Re-evaluate defaults for each row so `Date.now()` / faker generate distinct values.
+            // Re-evaluate defaults for each row so `Date.now()` / faker generate
+            // distinct values. `buildData()` reads (never mutates) the pending
+            // overrides/states, so they stay stable across iterations on their own.
             const rows = [];
-            const capturedOverrides = pendingOverrides;
-            const capturedStates = pendingStates;
             for (let i = 0; i < count; i++) {
-                pendingOverrides = capturedOverrides;
-                pendingStates = capturedStates;
                 rows.push(buildData());
             }
             resetPending();

package/dist/testing/Factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"Factory.js","sourceRoot":"","sources":["../../src/testing/Factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,cAAc,EAA2B,MAAM,sBAAsB,CAAC;AA2C/E;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CACtB,WAAiC,EACjC,QAAuC;IAEvC,yCAAyC;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4C,CAAC;IACnE,wDAAwD;IACxD,IAAI,gBAAgB,GAAqC,EAAE,CAAC;IAC5D,IAAI,aAAa,GAAa,EAAE,CAAC;IAEjC,MAAM,SAAS,GAAG,GAA4B,EAAE;QAC/C,MAAM,IAAI,GAA4B;YACrC,GAAG,QAAQ,EAAE;YACb,GAAG,gBAAgB;SACnB,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,EAAE;gBACN,MAAM,IAAI,KAAK,CACd,kBAAkB,IAAI,uBAAuB,WAAW,CAAC,IAAI,SAAS,CACtE,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,CAAC;QACV,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,GAAS,EAAE;QAC/B,gBAAgB,GAAG,EAAE,CAAC;QACtB,aAAa,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAsB;QAClC,KAAK,CAAC,SAAS;YACd,gBAAgB,GAAG,EAAE,GAAG,gBAAgB,EAAE,GAAG,SAAS,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,IAAI,EAAE,EAAE;YACb,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACrB,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,GAAG,KAAK;YACb,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,IAAI;YACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;YACzB,YAAY,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACb,CAAC;QAED,QAAQ,CAAC,KAAK;YACb,sFAAsF;YACtF,MAAM,IAAI,GAA8B,EAAE,CAAC;YAC3C,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;YAC3C,MAAM,cAAc,GAAG,aAAa,CAAC;YACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChC,gBAAgB,GAAG,iBAAiB,CAAC;gBACrC,aAAa,GAAG,cAAc,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACxB,CAAC;YACD,YAAY,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACb,CAAC;QAED,WAAW;YACV,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;YACzB,YAAY,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACd,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE;YACzB,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACjD,MAAM,OAAO,GAAQ,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,OAAO,CAAC;QAChB,CAAC;KACD,CAAC;IAEF,OAAO,OAAO,CAAC;AAChB,CAAC"}
+{"version":3,"file":"Factory.js","sourceRoot":"","sources":["../../src/testing/Factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,cAAc,EAA2B,MAAM,sBAAsB,CAAC;AA0C/E;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CACtB,WAAiC,EACjC,QAAuC;IAEvC,yCAAyC;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4C,CAAC;IACnE,wDAAwD;IACxD,IAAI,gBAAgB,GAAqC,EAAE,CAAC;IAC5D,IAAI,aAAa,GAAa,EAAE,CAAC;IAEjC,MAAM,SAAS,GAAG,GAA4B,EAAE;QAC/C,MAAM,IAAI,GAA4B;YACrC,GAAG,QAAQ,EAAE;YACb,GAAG,gBAAgB;SACnB,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,EAAE;gBACN,MAAM,IAAI,KAAK,CACd,kBAAkB,IAAI,uBAAuB,WAAW,CAAC,IAAI,SAAS,CACtE,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,CAAC;QACV,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,GAAS,EAAE;QAC/B,gBAAgB,GAAG,EAAE,CAAC;QACtB,aAAa,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAsB;QAClC,KAAK,CAAC,SAAS;YACd,gBAAgB,GAAG,EAAE,GAAG,gBAAgB,EAAE,GAAG,SAAS,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,IAAI,EAAE,EAAE;YACb,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACrB,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,GAAG,KAAK;YACb,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,IAAI;YACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;YACzB,YAAY,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACb,CAAC;QAED,QAAQ,CAAC,KAAK;YACb,qEAAqE;YACrE,mEAAmE;YACnE,wEAAwE;YACxE,MAAM,IAAI,GAA8B,EAAE,CAAC;YAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACxB,CAAC;YACD,YAAY,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACb,CAAC;QAED,WAAW;YACV,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;YACzB,YAAY,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACd,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE;YACzB,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACjD,MAAM,OAAO,GAAQ,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,OAAO,CAAC;QAChB,CAAC;KACD,CAAC;IAEF,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/utils/safePath.d.ts

@@ -17,6 +17,12 @@ export declare function assertSafeName(name: string, errorCode: string, kind: st
  * Resolve `fileName` inside `baseDir` and throw if the resulting path escapes
  * the base — guards against symlink / `../` traversal attacks when loading
  * migration or seeder files dynamically.
+ *
+ * Two layers: (1) a logical `path.resolve` check that catches `../` walks, and
+ * (2) a `realpath` check that follows symlinks — a symlink FILE sitting inside
+ * the base but pointing at `/etc/passwd` passes the logical check yet is caught
+ * here. When the file doesn't exist yet (ENOENT), only the logical check
+ * applies and the caller's own existence check produces the not-found error.
  */
-export declare function assertPathInsideBase(baseDir: string, fileName: string, errorCode: string, kind: string): string;
+export declare function assertPathInsideBase(baseDir: string, fileName: string, errorCode: string, kind: string): Promise<string>;
 //# sourceMappingURL=safePath.d.ts.map

package/dist/utils/safePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safePath.d.ts","sourceRoot":"","sources":["../../src/utils/safePath.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,uGAAuG;AACvG,wBAAsB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ5D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC7B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACV,IAAI,CAIN;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACV,MAAM,CAUR"}
+{"version":3,"file":"safePath.d.ts","sourceRoot":"","sources":["../../src/utils/safePath.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,uGAAuG;AACvG,wBAAsB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ5D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC7B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACV,IAAI,CAIN;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CA6BjB"}

package/dist/utils/safePath.js

@@ -34,13 +34,36 @@ export function assertSafeName(name, errorCode, kind) {
  * Resolve `fileName` inside `baseDir` and throw if the resulting path escapes
  * the base — guards against symlink / `../` traversal attacks when loading
  * migration or seeder files dynamically.
+ *
+ * Two layers: (1) a logical `path.resolve` check that catches `../` walks, and
+ * (2) a `realpath` check that follows symlinks — a symlink FILE sitting inside
+ * the base but pointing at `/etc/passwd` passes the logical check yet is caught
+ * here. When the file doesn't exist yet (ENOENT), only the logical check
+ * applies and the caller's own existence check produces the not-found error.
  */
-export function assertPathInsideBase(baseDir, fileName, errorCode, kind) {
+export async function assertPathInsideBase(baseDir, fileName, errorCode, kind) {
     const resolved = path.resolve(baseDir, fileName);
     const base = path.resolve(baseDir);
     if (!resolved.startsWith(base + path.sep) && resolved !== base) {
         throw new AtlasError(errorCode, `${kind} path escapes directory: ${fileName}`);
     }
+    // Symlink-aware check: resolve real targets and re-verify containment.
+    try {
+        const realBase = await fsp.realpath(base);
+        const realResolved = await fsp.realpath(resolved);
+        if (!realResolved.startsWith(realBase + path.sep) &&
+            realResolved !== realBase) {
+            throw new AtlasError(errorCode, `${kind} path escapes directory via symlink: ${fileName}`);
+        }
+    }
+    catch (err) {
+        // File not yet created — the logical check above stands; let the caller's
+        // existence check report the missing file. Re-throw real traversal errors.
+        if (err instanceof AtlasError)
+            throw err;
+        if (err.code !== "ENOENT")
+            throw err;
+    }
     return resolved;
 }
 //# sourceMappingURL=safePath.js.map

package/dist/utils/safePath.js.map

@@ -1 +1 @@
-{"version":3,"file":"safePath.js","sourceRoot":"","sources":["../../src/utils/safePath.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAS;IACzC,IAAI,CAAC;QACJ,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC7B,IAAY,EACZ,SAAiB,EACjB,IAAY;IAEZ,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,IAAI,UAAU,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAe,EACf,QAAgB,EAChB,SAAiB,EACjB,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CACnB,SAAS,EACT,GAAG,IAAI,4BAA4B,QAAQ,EAAE,CAC7C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}
+{"version":3,"file":"safePath.js","sourceRoot":"","sources":["../../src/utils/safePath.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAS;IACzC,IAAI,CAAC;QACJ,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC7B,IAAY,EACZ,SAAiB,EACjB,IAAY;IAEZ,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,IAAI,UAAU,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAe,EACf,QAAgB,EAChB,SAAiB,EACjB,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CACnB,SAAS,EACT,GAAG,IAAI,4BAA4B,QAAQ,EAAE,CAC7C,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClD,IACC,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC;YAC7C,YAAY,KAAK,QAAQ,EACxB,CAAC;YACF,MAAM,IAAI,UAAU,CACnB,SAAS,EACT,GAAG,IAAI,wCAAwC,QAAQ,EAAE,CACzD,CAAC;QACH,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,GAAG,YAAY,UAAU;YAAE,MAAM,GAAG,CAAC;QACzC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/atlas",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Atlas — Data Mapper ORM for the Ream framework",
   "license": "MIT",
   "type": "module",

package/src/AtlasProvider.ts

@@ -25,7 +25,7 @@ import {
 	type AsyncDatabaseConnection,
 	createNapiConnection,
 } from "./adapters/NapiDbAdapter.js";
-import { setAtlasDialect } from "./query/native.js";
+import { clearCastRegistry, setAtlasDialect } from "./query/native.js";
 import {
 	type DatabaseAdapter,
 	MigrationRunner,
@@ -221,6 +221,14 @@ export default class AtlasProvider {
 		const named = [...this.#connections.entries()];
 		const results = await Promise.allSettled(named.map(([, c]) => c.close()));
 		this.#connections.clear();
+
+		// Release the module-level singletons this provider populated at boot so a
+		// re-boot starts clean and `db.*` can't dereference a now-closed handle.
+		// `clearDb` is ownership-guarded, so clearing every connection only unbinds
+		// the one still owning the singleton.
+		const { clearDb } = await import("./services/db.js");
+		for (const [, conn] of named) clearDb(conn);
+		clearCastRegistry();
 		const errors = results
 			.map((r, i) =>
 				r.status === "rejected" ? { name: named[i][0], error: r.reason } : null,

package/src/BaseEntity.ts

@@ -11,18 +11,23 @@
  * @implements FR29, FR35, stories 32.1 through 32.5
  */
 
+import { getRelationMetadata } from "./decorators/entity.js";
 import { MassAssignmentError } from "./errors.js";
+import {
+	COLUMN_SERIALIZE_KEY,
+	COMPUTED_KEY,
+	type ColumnSerializeConfig,
+} from "./metadata-keys.js";
 
 export interface DomainEvent {
 	name: string;
 	data: Record<string, unknown>;
 }
 
-/** Symbol metadata key for the computed-property registry on an entity class. */
-export const COMPUTED_KEY = Symbol.for("atlas:computed");
-
-/** Symbol metadata key for the serialize-as / serializer overrides on columns. */
-export const COLUMN_SERIALIZE_KEY = Symbol.for("atlas:columnSerialize");
+// COMPUTED_KEY / COLUMN_SERIALIZE_KEY / ColumnSerializeConfig moved to
+// ./metadata-keys.js to break the BaseEntity ↔ entity-decorator runtime cycle
+// (fallow 2026-06-14). Re-exported here for backward compatibility.
+export { COLUMN_SERIALIZE_KEY, COMPUTED_KEY };
 
 /** Symbol property key used by entities to back-reference their hydrating repo. */
 export const REPO_REF = Symbol.for("atlas:repoRef");
@@ -115,13 +120,7 @@ export type RelationProxy =
 	| BelongsToRelationProxy
 	| ManyToManyRelationProxy;
 
-/** Per-column serialization config (populated by @Column options). */
-export interface ColumnSerializeConfig {
-	/** Rename this column at toJSON time (e.g. `password` → `passwordHash`). Null = hidden. */
-	serializeAs?: string | null;
-	/** Transform function applied to the value at toJSON time. */
-	serialize?: (value: unknown) => unknown;
-}
+export type { ColumnSerializeConfig };
 
 /**
  * Internal reserved keys on BaseEntity that must never be treated as database
@@ -495,6 +494,13 @@ export class BaseEntity {
 			ctor.visible && ctor.visible.length > 0 ? new Set(ctor.visible) : null;
 
 		const serializeConfig = getColumnSerializeConfig(ctor);
+		// Relation `serializeAs` overrides — a preloaded relation is a plain
+		// property on the instance, so it shows up in `Object.keys` below. Without
+		// this map the `serializeAs` declared on @HasOne/@HasMany/etc. was silently
+		// ignored (the relation always serialized under its property name).
+		const relByKey = new Map(
+			getRelationMetadata(ctor).map((r) => [r.propertyKey, r]),
+		);
 		const result: Record<string, unknown> = {};
 
 		// Regular columns (respecting hidden/visible + serialize overrides)
@@ -503,6 +509,15 @@ export class BaseEntity {
 			if (visible && !visible.has(key)) continue;
 			if (hidden.has(key)) continue;
 
+			// Preloaded relation: honour its `serializeAs` (rename, or `null` hides
+			// it from the JSON). The nested entity serializes via its own toJSON.
+			const rel = relByKey.get(key);
+			if (rel) {
+				if (rel.serializeAs === null) continue;
+				result[rel.serializeAs ?? key] = this[key];
+				continue;
+			}
+
 			const cfg = serializeConfig[key];
 			if (cfg?.serializeAs === null) continue; // explicit hide
 

package/src/BaseRepository.ts

@@ -351,15 +351,10 @@ export class BaseRepository<T extends BaseEntity> {
 	// ─── Finders ──────────────────────────────────────────────
 
 	async find(id: string | number | bigint): Promise<T | null> {
-		const wheres: Array<Record<string, unknown>> = [
-			{ column: this.#primaryKey, operator: "=", value: id, type: "and" },
-		];
-		this.#appendSoftScope(wheres);
-		const { sql, params } = this.#compileSelect({ wheres, limit: 1 });
-		const rows = await this.#db.query<Row>(sql, params);
-		const row = rows[0];
-		if (!row) return null;
-		return this.#hydrate(row);
+		// Route through the query builder so the read hooks (beforeFind/afterFind)
+		// fire and a `beforeFind` hook can mutate the query — the previous direct
+		// `#compileSelect` fast path bypassed every read hook silently.
+		return this.query().where(this.#primaryKey, id).first();
 	}
 
 	async findOrFail(id: string | number): Promise<T> {
@@ -373,60 +368,34 @@ export class BaseRepository<T extends BaseEntity> {
 	}
 
 	async findBy(column: string, value: unknown): Promise<T | null> {
-		const col = this.#resolveColumn(column);
-		const wheres: Array<Record<string, unknown>> = [
-			{ column: col, operator: "=", value, type: "and" },
-		];
-		this.#appendSoftScope(wheres);
-		const { sql, params } = this.#compileSelect({ wheres, limit: 1 });
-		const rows = await this.#db.query<Row>(sql, params);
-		const row = rows[0];
-		if (!row) return null;
-		return this.#hydrate(row);
+		// Through the builder for read-hook parity (see `find`).
+		return this.query().where(column, value).first();
 	}
 
 	async all(): Promise<T[]> {
-		const wheres: Array<Record<string, unknown>> = [];
-		this.#appendSoftScope(wheres);
-		return this.#runSelect({ wheres });
+		// Through the builder so beforeFetch/afterFetch fire. The builder applies
+		// the soft-delete scope by default, exactly like the old fast path.
+		return this.query().exec();
 	}
 
 	async allWithTrashed(): Promise<T[]> {
-		return this.#runSelect({});
+		return this.query().withTrashed().exec();
 	}
 
 	async onlyTrashed(): Promise<T[]> {
 		if (!this.#softDeletes) return [];
-		return this.#runSelect({
-			wheres: [
-				{
-					column: "deleted_at",
-					operator: "IS NOT NULL",
-					value: null,
-					type: "and",
-				},
-			],
-		});
+		return this.query().onlyTrashed().exec();
 	}
 
 	async where(column: string, value: unknown): Promise<T[]> {
-		const col = this.#resolveColumn(column);
-		const wheres: Array<Record<string, unknown>> = [
-			{ column: col, operator: "=", value, type: "and" },
-		];
-		this.#appendSoftScope(wheres);
-		// Order by the resolved primary key (DESC = most recent insert first when
-		// the PK is an auto-increment integer or a monotonic UUID). Previously
-		// this hard-coded `rowid DESC`, which is a SQLite-only pseudo-column and
-		// blew up on Postgres/MySQL the moment the app ran against a real driver.
-		// Using the PK works on every dialect and matches the user's actual
-		// schema — the ordering contract is "most recent first by PK" for
-		// `repo.where(col, val)` as a convenience finder.
-		const pkCol = camelToSnake(this.#primaryKey);
-		return this.#runSelect({
-			wheres,
-			orderBy: [{ column: pkCol, direction: "desc" }],
-		});
+		// Order by the primary key (DESC = most recent insert first when the PK is
+		// an auto-increment integer or a monotonic UUID). The ordering contract is
+		// "most recent first by PK" for `repo.where(col, val)` as a convenience
+		// finder. Through the builder for read-hook parity (see `find`).
+		return this.query()
+			.where(column, value)
+			.orderBy(this.#primaryKey, "desc")
+			.exec();
 	}
 
 	// ─── Create / Save / Delete ───────────────────────────────
@@ -450,6 +419,7 @@ export class BaseRepository<T extends BaseEntity> {
 		await this.#insert(entity);
 		await fireHooks(this.#entityClass, "afterCreate", entity);
 		await fireHooks(this.#entityClass, "afterSave", entity);
+		await this.#dispatchDomainEvents(entity);
 		return entity;
 	}
 
@@ -494,6 +464,17 @@ export class BaseRepository<T extends BaseEntity> {
 		}
 		await fireHooks(this.#entityClass, "afterSave", entity);
 
+		await this.#dispatchDomainEvents(entity);
+	}
+
+	/**
+	 * Flush the entity's accumulated domain events through `onDomainEvents`.
+	 * On dispatch failure the events are re-queued on the entity and the error
+	 * propagates, so a caller can retry without losing them. Shared by `save`,
+	 * `create` and `createMany` — every persistence path that produces a live
+	 * entity must dispatch, otherwise events silently vanish on batch inserts.
+	 */
+	async #dispatchDomainEvents(entity: BaseEntity): Promise<void> {
 		const events = entity.flushDomainEvents();
 		if (events.length > 0 && this.onDomainEvents) {
 			try {
@@ -576,6 +557,9 @@ export class BaseRepository<T extends BaseEntity> {
 			await fireHooks(this.#entityClass, "afterCreate", e);
 			await fireHooks(this.#entityClass, "afterSave", e);
 		}
+		for (const e of entities) {
+			await this.#dispatchDomainEvents(e);
+		}
 		return entities;
 	}
 
@@ -908,43 +892,6 @@ export class BaseRepository<T extends BaseEntity> {
 
 	// ─── Private helpers ──────────────────────────────────────
 
-	#compileSelect(opts: {
-		wheres?: Array<Record<string, unknown>>;
-		orderBy?: Array<Record<string, unknown>>;
-		limit?: number;
-	}): { sql: string; params: unknown[] } {
-		const spec = {
-			kind: "select",
-			table: this.#tableName,
-			select: ["*"],
-			wheres: opts.wheres ?? [],
-			orderBy: opts.orderBy ?? [],
-			groupBy: [],
-			having: [],
-			limit: opts.limit ?? null,
-			offset: null,
-			distinct: false,
-			ctes: [],
-			unions: [],
-			// Cast WHERE params on native-typed columns (uuid/timestamp/…) so a
-			// `WHERE id = $1` on a uuid PK emits `$1::uuid` — otherwise Postgres
-			// rejects it with `operator does not exist: uuid = text`.
-			casts: this.#castTypes,
-		};
-		const compiled = compileStatementNative(spec, this.#dialect);
-		return { sql: compiled.statements[0], params: compiled.params };
-	}
-
-	async #runSelect(opts: {
-		wheres?: Array<Record<string, unknown>>;
-		orderBy?: Array<Record<string, unknown>>;
-		limit?: number;
-	}): Promise<T[]> {
-		const { sql, params } = this.#compileSelect(opts);
-		const rows = await this.#db.query<Row>(sql, params);
-		return rows.map((r) => this.#hydrate(r));
-	}
-
 	async #runDelete(wheres: Array<Record<string, unknown>>): Promise<void> {
 		const compiled = compileStatementNative(
 			{ kind: "delete", table: this.#tableName, wheres },
@@ -1023,17 +970,6 @@ export class BaseRepository<T extends BaseEntity> {
 		return {};
 	}
 
-	#appendSoftScope(wheres: Array<Record<string, unknown>>): void {
-		if (this.#softDeletes) {
-			wheres.push({
-				column: "deleted_at",
-				operator: "IS NULL",
-				value: null,
-				type: "and",
-			});
-		}
-	}
-
 	async #insert(entity: T): Promise<void> {
 		// Auto-generate the PK when declared via `@PrimaryKey({ generated })`.
 		this.#applyPrimaryKeyGenerator(entity);
@@ -1314,6 +1250,10 @@ export class BaseRepository<T extends BaseEntity> {
 		const relatedRepo = new BaseRepository<BaseEntity>(relatedClass, this.#db, {
 			dialect: this.#dialect,
 		});
+		// Propagate the domain-event sink so entities persisted through a relation
+		// proxy (user.related('posts').create(...)) dispatch their events too —
+		// otherwise the related entity's events silently vanish.
+		relatedRepo.onDomainEvents = this.onDomainEvents;
 		const db = this.#db;
 
 		// FK column naming: belongsTo stores the FK on THIS side; has* / m2m on the OTHER side.