@metaobjectsdev/runtime-ts 0.15.20 → 0.15.21-rc.1

package/src/hono/index.ts

@@ -33,7 +33,10 @@ export type {
   FilterAllowlist,
   SortAllowlist,
 } from "../drizzle-fastify/filter-allowlist.js";
-import { isTruthyFlag } from "../drizzle-fastify/util.js";
+import { isTruthyFlag, coerceIdForColumn } from "../drizzle-fastify/util.js";
+// Back-compat re-export — the unsafe local copy was consolidated onto the one
+// shared (deprecated) helper so the three adapters can't silently diverge.
+export { parseId } from "../drizzle-fastify/util.js";
 
 // ---------------------------------------------------------------------------
 // Loose types — we don't bind to a specific Drizzle backend so the helper
@@ -156,10 +159,14 @@ export function mountListRoute(opts: VerbOptions): void {
 export function mountGetRoute(opts: VerbOptions): void {
   opts.app.get(`${opts.path}/:id`, async (c) => {
     const id = c.req.param("id") ?? "";
+    // Compare against the PK's real type — a numeric-LOOKING id on a TEXT pk
+    // must stay a string ('0123' ≠ '123'), or affinity matches the WRONG row.
+    const idValue = coerceIdForColumn(opts.table.id, id);
+    if (idValue === undefined) return c.json({ error: "invalid_id" }, 400);
     const row = await opts.db
       .select()
       .from(opts.table)
-      .where(eq(opts.table.id, parseId(id)))
+      .where(eq(opts.table.id, idValue))
       .get();
     return row ? c.json(row) : c.json({ error: "not_found" }, 404);
   });
@@ -186,10 +193,14 @@ export function mountUpdateRoute(opts: VerbOptions): void {
     if (!parsed.success) {
       return c.json({ error: "validation", issues: parsed.error.issues }, 400);
     }
+    // Compare against the PK's real type (see mountGetRoute) — a numeric-
+    // LOOKING id on a TEXT pk would otherwise UPDATE the wrong row.
+    const idValue = coerceIdForColumn(opts.table.id, id);
+    if (idValue === undefined) return c.json({ error: "invalid_id" }, 400);
     const result = await opts.db
       .update(opts.table)
       .set(parsed.data)
-      .where(eq(opts.table.id, parseId(id)))
+      .where(eq(opts.table.id, idValue))
       .returning();
     const row = (result as unknown[])[0];
     return row ? c.json(row) : c.json({ error: "not_found" }, 404);
@@ -205,9 +216,13 @@ export function mountUpdateRoute(opts: VerbOptions): void {
 export function mountDeleteRoute(opts: VerbOptions): void {
   opts.app.delete(`${opts.path}/:id`, async (c) => {
     const id = c.req.param("id") ?? "";
+    // Compare against the PK's real type (see mountGetRoute) — a numeric-
+    // LOOKING id on a TEXT pk would otherwise DELETE the wrong row (data loss).
+    const idValue = coerceIdForColumn(opts.table.id, id);
+    if (idValue === undefined) return c.json({ error: "invalid_id" }, 400);
     const result = await opts.db
       .delete(opts.table)
-      .where(eq(opts.table.id, parseId(id)));
+      .where(eq(opts.table.id, idValue));
     const affected = extractRowCount(result);
     if (affected > 0) {
       // 204 No Content — body must be empty.
@@ -221,17 +236,14 @@ function extractRowCount(result: unknown): number {
   if (typeof result === "number") return result;
   if (Array.isArray(result)) return result.length;
   if (result && typeof result === "object") {
-    const obj = result as { rowsAffected?: number | bigint; rowCount?: number };
+    const obj = result as { rowsAffected?: number | bigint; rowCount?: number; changes?: number };
     if (typeof obj.rowsAffected === "number") return obj.rowsAffected;
     if (typeof obj.rowsAffected === "bigint") return Number(obj.rowsAffected);
     if (typeof obj.rowCount === "number") return obj.rowCount;
+    // bun:sqlite / better-sqlite3 run() result shape.
+    if (typeof obj.changes === "number") return obj.changes;
   }
   return 0;
 }
 
-export function parseId(raw: string): number | string {
-  const n = Number(raw);
-  return Number.isFinite(n) && raw.trim() !== "" ? n : raw;
-}
-
 export { mountReadOnlyCrudRoutes, type MountReadOnlyOptions } from "./mount-read-only.js";

package/src/hono/mount-read-only.ts

@@ -10,7 +10,7 @@ import type {
   FilterAllowlist,
   SortAllowlist,
 } from "../drizzle-fastify/filter-allowlist.js";
-import { isTruthyFlag } from "../drizzle-fastify/util.js";
+import { isTruthyFlag, coerceIdForColumn, rawIdLiteral } from "../drizzle-fastify/util.js";
 
 // biome-ignore lint/suspicious/noExplicitAny: dynamic dispatch over user-supplied views
 type AnyView = any;
@@ -155,21 +155,22 @@ export function mountReadOnlyCrudRoutes(opts: MountReadOnlyOptions): void {
   app.get(`${path}/:id`, async (c) => {
     const id = c.req.param("id") ?? "";
     if (useRawSql) {
-      const numericId = Number(id);
-      if (!Number.isFinite(numericId)) {
-        return c.json({ error: "invalid_id" }, 400);
-      }
       // biome-ignore lint/suspicious/noExplicitAny: dynamic raw result
-      const rows = (await db.all(sql.raw(`SELECT * FROM "${viewName}" WHERE "${idCol}" = ${numericId} LIMIT 1`))) as any[];
+      const rows = (await db.all(sql.raw(`SELECT * FROM "${viewName}" WHERE "${idCol}" = ${rawIdLiteral(id)} LIMIT 1`))) as any[];
       const row = rows[0] ? camelizeRow(rows[0]) : undefined;
       return row ? c.json(row) : c.json({ error: "not_found" }, 404);
     }
     // biome-ignore lint/suspicious/noExplicitAny: Drizzle view column ref
     const colRef = (view as any)[idCol];
+    // Compare against the PK's real type — a uuid/text key must NOT go through Number().
+    const idValue = coerceIdForColumn(colRef, id);
+    if (idValue === undefined) {
+      return c.json({ error: "invalid_id" }, 400);
+    }
     const row = await db
       .select()
       .from(view)
-      .where(colRef !== undefined ? eq(colRef, Number(id)) : undefined)
+      .where(colRef !== undefined ? eq(colRef, idValue) : undefined)
       .get();
     return row ? c.json(row) : c.json({ error: "not_found" }, 404);
   });

package/src/object-manager.ts

@@ -96,10 +96,24 @@ export class ObjectManager {
     return { $and: [filter, disc] } as Filter;
   }
 
+  /**
+   * Coerce a raw string id (typically an HTTP path param) to the PK field's
+   * DECLARED type: a numeric-subtype pk gets Number(); a string/uuid pk keeps
+   * the string EXACTLY — '0123' and '123' are different keys, and Number()-ing
+   * them conflates the two (SQLite affinity then matches the WRONG row).
+   * Non-string ids and composite-pk entities pass through untouched.
+   */
+  private coerceIdArg(entity: MetaData, id: unknown): unknown {
+    if (typeof id !== "string") return id;
+    const pkFields = resolvePkFields(entity);
+    if (pkFields.length !== 1) return id;
+    return coercePkValue(entity, pkFields[0]!, id);
+  }
+
   async findById(entityName: string, id: unknown, opts: ReadOpts = {}): Promise<Row | null> {
     const entity = this.requireEntity(entityName);
     const pkField = resolvePkFields(entity)[0]!;
-    return this.findFirst(entityName, { [pkField]: id as string | number }, opts);
+    return this.findFirst(entityName, { [pkField]: this.coerceIdArg(entity, id) as string | number }, opts);
   }
 
   async findFirst(entityName: string, filter: Filter, opts: ReadOpts = {}): Promise<Row | null> {
@@ -204,7 +218,7 @@ export class ObjectManager {
 
     const coerced = coerceRowOnWrite(entity, restricted, driver.dialect);
     // FR-017 TPH: scope the by-id update to the subtype (cross-subtype → not found).
-    const spec = buildUpdateSpec(entity, coerced, id, this.columnNamingStrategy, this.tphScope(entity));
+    const spec = buildUpdateSpec(entity, coerced, this.coerceIdArg(entity, id), this.columnNamingStrategy, this.tphScope(entity));
     const dbRow = await driver.update(spec);
     if (dbRow === null) {
       const mode = opts.ifMissing ?? DEFAULT_IF_MISSING;
@@ -218,7 +232,7 @@ export class ObjectManager {
     const entity = this.requireEntity(entityName);
     const driver = opts.tx ?? this.driver;
     // FR-017 TPH: scope the by-id delete to the subtype (cross-subtype → not found).
-    const spec = buildDeleteSpec(entity, id, this.columnNamingStrategy, this.tphScope(entity));
+    const spec = buildDeleteSpec(entity, this.coerceIdArg(entity, id), this.columnNamingStrategy, this.tphScope(entity));
     const n = await driver.delete(spec);
     if (n === 0) {
       const mode = opts.ifMissing ?? DEFAULT_IF_MISSING;
@@ -498,7 +512,10 @@ const NUMERIC_SUBTYPES = new Set([
   FIELD_SUBTYPE_LONG, FIELD_SUBTYPE_DOUBLE, FIELD_SUBTYPE_FLOAT, FIELD_SUBTYPE_DECIMAL,
 ]);
 
-// decodeRef always returns strings; numeric PK fields need coercion back to number.
+// Coerce a raw string PK value to the field's declared type: numeric subtypes
+// get Number(); everything else keeps the string exactly. Serves decodeRef
+// (which always returns strings) AND raw HTTP path params via coerceIdArg —
+// a string/uuid pk must never be Number()-ed ('0123' ≠ '123').
 function coercePkValue(entity: MetaData, fieldName: string, rawValue: string): string | number {
   // ADR-0039: resolving — the PK field may be inherited from a BaseEntity via extends.
   const field = entity.children().find((c) => c.type === TYPE_FIELD && c.name === fieldName);