@stacksjs/orm 0.72.103 → 0.73.1

package/dist/auto-crud.d.ts

@@ -84,7 +84,7 @@ export declare function getWritableFields(model: {
  * columns). The result stays keyed by attribute name — setters, casts and
  * validation rules all look fields up by that spelling.
  */
-export declare function filterFillable(body: any, fillableFields: string[]): Record<string, any>;
+export declare function filterFillable(body: Record<string, unknown> | null | undefined, fillableFields: string[]): Record<string, unknown>;
 /**
  * Normalize JSON-safe values for validators whose in-process type cannot be
  * represented directly in a request body. `schema.date()` validates a Date
@@ -92,7 +92,7 @@ export declare function filterFillable(body: any, fillableFields: string[]): Rec
  * stored write payload unchanged and normalize only the value passed to the
  * validator.
  */
-export declare function normalizeValidationValue(rule: any, value: unknown): unknown;
+export declare function normalizeValidationValue(rule: { name?: unknown } | null | undefined, value: unknown): unknown;
 /**
  * Drop attribute keys flagged `hidden: true` from an incoming write body.
  * Must drop BOTH spellings — accepting the snake spelling in filterFillable
@@ -108,7 +108,7 @@ export declare function dropHiddenInputs(data: Record<string, any>, hiddenFields
  * `payment_details` on public reads. Response-side mirror of
  * `dropHiddenInputs`.
  */
-export declare function stripHidden(record: any, hiddenFields: string[]): any;
+export declare function stripHidden<T extends Record<string, unknown>>(record: T | null | undefined, hiddenFields: string[]): T | null | undefined;
 /**
  * Build the read-path column allowlist for a model: a map from BOTH the
  * attribute-name spelling and its snake_case column spelling to the real
@@ -141,7 +141,7 @@ export declare function buildReadColumnMap(attributes: Record<string, unknown> |
  *   ?sort=-rating           → ORDER BY rating DESC
  *   ?sort=discountType,name → ORDER BY discount_type ASC, name ASC
  */
-export declare function applySorting(query: any, sortParam: string | null, columns: ReadonlyMap<string, string>): any;
+export declare function applySorting<Q extends { orderBy: (_column: string, _direction: 'asc' | 'desc') => Q }>(query: Q, sortParam: string | null, columns: ReadonlyMap<string, string>): Q;
 declare function safeJSON(s: string): unknown;
 declare function safeJSONOrEmpty(_s: string): unknown;
 /**

package/dist/define-model.d.ts

@@ -50,7 +50,7 @@ export declare function withoutValidation<T>(fn: () => T | Promise<T>): Promise<
  * decides for itself how many queries that costs; without it this falls back to
  * projecting each row, which is what a column-rearranging `shape` wants anyway.
  */
-export declare function projectDocumentsFromTrait(models: any[], config: SearchableTraitConfig): Promise<Record<string, unknown>[]>;
+export declare function projectDocumentsFromTrait(config: SearchableTraitConfig): Promise<Record<string, unknown>[]>;
 export declare function defineModel<const TDef extends ModelDefinition>(definition: TDef): StacksModelStatic<TDef>;
 /**
  * Normalize a ModelInstance (or array of them, or already-plain row) into
@@ -65,7 +65,7 @@ export declare function defineModel<const TDef extends ModelDefinition>(definiti
  * the latter pattern silently leaks `hidden: true` fields (e.g. license_plate,
  * vin, password hashes) into responses.
  */
-export declare function toAttrs<T = any>(value: any): T;
+export declare function toAttrs<T = unknown>(value: unknown): T;
 /**
  * Thrown when a direct write fails a declared `validation.rule`.
  *
@@ -164,6 +164,48 @@ export declare interface TraitMethods {
  * the render layer.
  */
 export type CastType = 'string' | 'number' | 'boolean' | 'json' | 'datetime' | 'date' | 'array' | 'integer' | 'float';
+/**
+ * Wrap a bun-query-builder ModelInstance in a Proxy that:
+ *
+ *   1. Forwards attribute reads to `_attributes` so `user.password` /
+ *      `car.slug` work (instead of returning undefined and silently
+ *      breaking auth, ownership checks, etc.).
+ *   2. Cleans up `{ ...instance }` spreads — only attribute keys appear,
+ *      not the model's private `_attributes` / `_original` / etc. fields.
+ *   3. Keeps every instance method (.update, .save, .toJSON, etc.) bound
+ *      to the underlying instance.
+ *
+ * Hidden fields (`hidden: true` attrs) are NOT auto-stripped — call
+ * `toAttrs(instance)` or `instance.toJSON()` for that. This proxy is about
+ * making direct property access work, not about output sanitization.
+ */
+/**
+ * A model instance, in the terms this proxy reads it.
+ *
+ * `wrapModelInstance` is generic over `T extends object`, so nothing inside
+ * the handler knew that its target carries `_attributes`, `save`, `isDirty`
+ * and the rest - and it reached for them through 31 separate
+ * `target` casts. Each one unchecked the whole instance, so a
+ * renamed internal (`_attributes` is the one this file is built on) would
+ * have gone unnoticed at every single site.
+ *
+ * Named once, and the target narrowed to it once, so the handler body is
+ * checked against the members it genuinely depends on.
+ */
+/**
+ * The shared model definition, as this handler mutates it.
+ *
+ * `saveAsync` blanks `def.set` around the inner `save()` so the sync path does
+ * not run the setters a second time, then restores it on a `finally`. That
+ * assignment is to a `readonly` field, and on an object the comment there
+ * already notes is shared across every instance of the model - which the
+ * `(target)` reads made invisible at the point of assignment.
+ */
+declare type MutableModelDefinition = Omit<ModelDefinition, 'set'> & {
+  set?: ModelDefinition['set']
+  /** Trait method bags, attached by the trait installers. */
+  __traitMethods?: unknown
+}
 declare type BQBModelAttribute = BQBModelDefinition['attributes'][string];
 export type StacksModelAttribute = Omit<BQBModelAttribute, 'factory'> & {
   factory?: (faker: Faker) => unknown

package/dist/index.d.ts

@@ -75,8 +75,8 @@ export declare const DeliveryRoute: ReturnType<typeof lazyModel<typeof import('.
 export declare const DeliveryStop: ReturnType<typeof lazyModel<typeof import('./models/commerce/DeliveryStop').default>>;
 export declare const Deployment: ReturnType<typeof lazyModel<typeof import('./models/Deployment').default>>;
 export declare const DigitalDelivery: ReturnType<typeof lazyModel<typeof import('./models/commerce/DigitalDelivery').default>>;
-export declare const Driver: ReturnType<typeof lazyModel<typeof import('./models/commerce/Driver').default>>;
-export declare const DriverPing: ReturnType<typeof lazyModel<typeof import('./models/commerce/DriverPing').default>>;
+export declare const Courier: ReturnType<typeof lazyModel<typeof import('./models/commerce/Courier').default>>;
+export declare const CourierPing: ReturnType<typeof lazyModel<typeof import('./models/commerce/CourierPing').default>>;
 export declare const CampaignSend: ReturnType<typeof lazyModel<typeof import('./models/CampaignSend').default>>;
 export declare const EmailList: ReturnType<typeof lazyModel<typeof import('./models/EmailList').default>>;
 export declare const EmailListSubscriber: ReturnType<typeof lazyModel<typeof import('./models/EmailListSubscriber').default>>;