@warlock.js/cascade 4.15.0 → 5.0.0

package/esm/errors/unsafe-raw-expression.error.d.mts

@@ -0,0 +1,23 @@
+//#region ../cascade/src/errors/unsafe-raw-expression.error.d.ts
+/**
+ * Error thrown when a string expression is passed to `whereRaw()` /
+ * `orWhereRaw()` on the MongoDB driver.
+ *
+ * String raw expressions used to compile to `{ $where: "<js>" }`, which MongoDB
+ * evaluates as JavaScript inside the server for every scanned document — a
+ * server-side JS injection sink when any part of the string is
+ * request-controlled, and an unindexed full-scan DoS vector even when trusted.
+ *
+ * Use the object form instead, e.g. `whereRaw({ $expr: { $gt: ["$stock", "$reserved"] } })`.
+ */
+declare class UnsafeRawExpressionError extends Error {
+  /**
+   * Creates a new UnsafeRawExpressionError.
+   *
+   * @param message - Descriptive error message
+   */
+  constructor(message: string);
+}
+//#endregion
+export { UnsafeRawExpressionError };
+//# sourceMappingURL=unsafe-raw-expression.error.d.mts.map

package/esm/errors/unsafe-raw-expression.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafe-raw-expression.error.d.mts","names":[],"sources":["../../../../../../../cascade/src/errors/unsafe-raw-expression.error.ts"],"mappings":";;AAWA;;;;;;;;AAMoC;;cANvB,wBAAA,SAAiC,KAAK;;;;;;cAM9B,OAAA;AAAA"}

package/esm/errors/unsafe-raw-expression.error.mjs

@@ -0,0 +1,28 @@
+//#region ../cascade/src/errors/unsafe-raw-expression.error.ts
+/**
+* Error thrown when a string expression is passed to `whereRaw()` /
+* `orWhereRaw()` on the MongoDB driver.
+*
+* String raw expressions used to compile to `{ $where: "<js>" }`, which MongoDB
+* evaluates as JavaScript inside the server for every scanned document — a
+* server-side JS injection sink when any part of the string is
+* request-controlled, and an unindexed full-scan DoS vector even when trusted.
+*
+* Use the object form instead, e.g. `whereRaw({ $expr: { $gt: ["$stock", "$reserved"] } })`.
+*/
+var UnsafeRawExpressionError = class UnsafeRawExpressionError extends Error {
+	/**
+	* Creates a new UnsafeRawExpressionError.
+	*
+	* @param message - Descriptive error message
+	*/
+	constructor(message) {
+		super(message);
+		this.name = "UnsafeRawExpressionError";
+		if (Error.captureStackTrace) Error.captureStackTrace(this, UnsafeRawExpressionError);
+	}
+};
+
+//#endregion
+export { UnsafeRawExpressionError };
+//# sourceMappingURL=unsafe-raw-expression.error.mjs.map

package/esm/errors/unsafe-raw-expression.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafe-raw-expression.error.mjs","names":[],"sources":["../../../../../../../cascade/src/errors/unsafe-raw-expression.error.ts"],"sourcesContent":["/**\r\n * Error thrown when a string expression is passed to `whereRaw()` /\r\n * `orWhereRaw()` on the MongoDB driver.\r\n *\r\n * String raw expressions used to compile to `{ $where: \"<js>\" }`, which MongoDB\r\n * evaluates as JavaScript inside the server for every scanned document — a\r\n * server-side JS injection sink when any part of the string is\r\n * request-controlled, and an unindexed full-scan DoS vector even when trusted.\r\n *\r\n * Use the object form instead, e.g. `whereRaw({ $expr: { $gt: [\"$stock\", \"$reserved\"] } })`.\r\n */\r\nexport class UnsafeRawExpressionError extends Error {\r\n  /**\r\n   * Creates a new UnsafeRawExpressionError.\r\n   *\r\n   * @param message - Descriptive error message\r\n   */\r\n  public constructor(message: string) {\r\n    super(message);\r\n    this.name = \"UnsafeRawExpressionError\";\r\n\r\n    // Maintains proper stack trace for where error was thrown (V8 only)\r\n    if (Error.captureStackTrace) {\r\n      Error.captureStackTrace(this, UnsafeRawExpressionError);\r\n    }\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;AAWA,IAAa,2BAAb,MAAa,iCAAiC,MAAM;;;;;;CAMlD,AAAO,YAAY,SAAiB;EAClC,MAAM,OAAO;EACb,KAAK,OAAO;EAGZ,IAAI,MAAM,mBACR,MAAM,kBAAkB,MAAM,wBAAwB;CAE1D;AACF"}

package/esm/index.d.mts

@@ -27,6 +27,8 @@ import { databaseTransactionContext } from "./context/database-transaction-conte
 import { DataSourceRegistryEvent, DataSourceRegistryListener, dataSourceRegistry } from "./data-source/data-source-registry.mjs";
 import { MissingDataSourceError } from "./errors/missing-data-source.error.mjs";
 import { TransactionRollbackError } from "./errors/transaction-rollback.error.mjs";
+import { UnsafeFilterError } from "./errors/unsafe-filter.error.mjs";
+import { UnsafeRawExpressionError } from "./errors/unsafe-raw-expression.error.mjs";
 import { ModelRef, RegisterModel, RegisterModelOptions, cleanupModelsRegistery, getAllModelsFromRegistry, getModelFromRegistry, registerModelInRegistry, removeModelFromRegistery, resolveModelClass, resolveModelName, tryResolveModelClass, verifyRegisteredRelations } from "./model/register-model.mjs";
 import { BelongsTo, BelongsToMany, HasMany, HasOne, RELATION_METADATA_KEY } from "./model/relation-decorators.mjs";
 import { DatabaseRemover } from "./remover/database-remover.mjs";
@@ -46,6 +48,8 @@ import { modelSync } from "./sync/model-sync.mjs";
 import { ModelSyncOperation } from "./sync/model-sync-operation.mjs";
 import { DEFAULT_MAX_SYNC_DEPTH, SyncContextManager } from "./sync/sync-context.mjs";
 import { SyncManager } from "./sync/sync-manager.mjs";
+import { escapeRegex, likePatternToRegexSource, resolveLikePattern } from "./utils/escape-regex.mjs";
+import { sanitizeFilter, sanitizeFilterValue } from "./utils/sanitize-filter.mjs";
 import { ModelTransformCallback, useModelTransformer } from "./utils/database-writer.utils.mjs";
 import { DefineModelOptions, ModelType, defineModel } from "./utils/define-model.mjs";
 import { onceConnected, onceDisconnected } from "./utils/once-connected.mjs";
@@ -65,6 +69,6 @@ import { PostgresQueryBuilder } from "./drivers/postgres/postgres-query-builder.
 import { PostgresOperationType, PostgresParserOperation, PostgresParserOptions, PostgresQueryParser } from "./drivers/postgres/postgres-query-parser.mjs";
 import { PostgresSyncAdapter } from "./drivers/postgres/postgres-sync-adapter.mjs";
 import { MongoClientOptions, TransactionOptions } from "mongodb";
-export { $agg, $expr, AggregateExpression, AggregateFunction, AlterSchema, ArithmeticExpression, type BaseQueryRuleOptions, type BaseUniqueRuleOptions, BelongsTo, BelongsToMany, type BelongsToManyOptions, type BelongsToOptions, BuildUpdateOperationsResult, type ChildModel, ChunkCallback, ColumnBuilder, ColumnDefinition, ColumnExpression, ColumnExpressionInput, ColumnExpressionType, ColumnMap, ColumnRefExpression, ColumnType, ConnectionOptions, CreateDatabaseOptions, CreateDatabaseResult, CursorPaginationOptions, CursorPaginationResult, DEFAULT_MAX_SYNC_DEPTH, DataSource, DataSourceOptions, DataSourceRegistryEvent, DataSourceRegistryListener, DatabaseDirtyTracker, DatabaseDriver, DatabaseRemover, DatabaseRestorer, DatabaseWriter, DatabaseWriterValidationError, DefineModelOptions, DeleteStrategy, DetachedColumnBuilder, DriverContract, DriverEvent, DriverEventListener, DriverQuery, DriverTransactionContract, DropAllTablesResult, DropDatabaseOptions, type EmbedKey, type ExistsRuleOptions, ExportMigrationsSQLOptions, ForeignKeyBuilder, ForeignKeyDefinition, FullTextIndexOptions, GenerateIdOptions, GeoIndexOptions, type GlobalScopeDefinition, type GlobalScopeOptions, GroupByInput, HasMany, type HasManyOptions, HasOne, type HasOneOptions, HavingInput, IdGeneratorContract, IndexDefinition, IndexEntry, InsertResult, JoinOptions, LiteralExpression, type LoadedRelationResult, type LoadedRelationsMap, type LocalScopeCallback, LockForUpdateOptions, Migration, MigrationAlterOptions, MigrationConstructor, MigrationContract, MigrationCreateOptions, MigrationDefaults, MigrationDriverContract, MigrationDriverFactory, type MigrationRecord, type MigrationResult, MigrationRunner, type MigrationRunnerOptions, type MigrationStatus, MissingDataSourceError, Model, ModelDefaultConfig, ModelDefaults, ModelEventListener, ModelEventName, ModelEvents, ModelRef, type ModelSchema, type ModelSnapshot, type ModelSyncConfig, type ModelSyncContract, ModelSyncOperation, type ModelSyncOperationContract, ModelTransformCallback, ModelType, type MongoClientOptions, MongoDbDriver, MongoDriverOptions, MongoIdGenerator, MongoMigrationDriver, MongoQueryBuilder, MongoSyncAdapter, NamingConvention, OnDeletedEventContext, Operation, OperationType, OrderDirection, PaginationOptions, PaginationResult, PendingOperation, PipelineStage, type PivotData, type PivotIds, PivotOperations, PostgresBlueprint, PostgresConnectionConfig, PostgresCopyOptions, PostgresDialect, PostgresDriver, PostgresIsolationLevel, PostgresMigrationDriver, PostgresNotification, PostgresOperation, PostgresOperationType, PostgresParserOperation, PostgresParserOptions, PostgresPoolConfig, PostgresQueryBuilder, PostgresQueryParser, PostgresQueryResult, PostgresSyncAdapter, PostgresTransactionOptions, PostgresWhereClause, QueryBuilderContract, RELATION_METADATA_KEY, RawColumnExpression, RawExpression, RawQueryResult, RegisterModel, RegisterModelOptions, type RelationConstraintCallback, type RelationConstraints, RelationDefaults, type RelationDefinition, type RelationDefinitions, RelationHydrator, RelationLoader, type RelationType, RemoverContract, RemoverOptions, RemoverResult, RestorerContract, RestorerOptions, RestorerResult, RollbackMigrationsOptions, type RollbackOptions, type RunMigrationsOptions, type ScopeTiming, type SerializedRelation, SqlAggregateFunction, SqlDeleteOperation, SqlDialectContract, SqlGroupClause, SqlHavingClause, SqlInsertOperation, SqlJoinClause, SqlJoinType, SqlOrderClause, SqlQueryConfig, SqlQueryResult, SqlSelectClause, SqlUpdateOperation, SqlWhereOperation, SqlWhereType, StrictMode, SyncAdapterContract, type SyncConfig, type SyncContext, SyncContextManager, type SyncEventPayload, SyncInstruction, type SyncInstructionOptions, SyncManager, type SyncResult, type TableIndexInformation, TransactionContext, type TransactionOptions, TransactionRollbackError, UniqueEntry, type UniqueRuleOptions, UpdateOperations, UpdateResult, UuidStrategy, VectorIndexOptions, WhereCallback, WhereObject, WhereOperator, WriterContract, WriterOptions, WriterResult, arrayBigInt, arrayBoolean, arrayDate, arrayDecimal, arrayFloat, arrayInt, arrayJson, arrayText, arrayTimestamp, arrayUuid, bigInt, bigInteger, binary, blobCol, boolCol as bool, boolCol, char, cleanupModelsRegistery, connectToDatabase, createDatabase, createPivotOperations, dataSourceRegistry, databaseDataSourceContext, databaseTransactionContext, date, dateTime, decimal, defineModel, double, dropAllTables, enumCol, exportMigrationsSQL, float, freshMigrate, geometry, getAllModelsFromRegistry, getDatabaseDriver, getModelFromRegistry, globalModelEvents, int, integer, ipAddress, isAggregateExpression, isColumnExpression, isMongoDBDriverLoaded, json, lineString, listExecutedMigrations, listPendingMigrations, longText, macAddress, mediumText, migrate, migrationRunner, modelSync, objectCol, onceConnected, onceDisconnected, point, polygon, registerModelInRegistry, removeModelFromRegistery, resolveModelClass, resolveModelName, rollbackMigrations, runMigrations, setCol, smallInt, smallInteger, string, text, time, timestamp, tinyInt, tinyInteger, toColumnExpression, transaction, tryResolveModelClass, ulid, useModelTransformer, uuid, vector, verifyRegisteredRelations, year };
+export { $agg, $expr, AggregateExpression, AggregateFunction, AlterSchema, ArithmeticExpression, type BaseQueryRuleOptions, type BaseUniqueRuleOptions, BelongsTo, BelongsToMany, type BelongsToManyOptions, type BelongsToOptions, BuildUpdateOperationsResult, type ChildModel, ChunkCallback, ColumnBuilder, ColumnDefinition, ColumnExpression, ColumnExpressionInput, ColumnExpressionType, ColumnMap, ColumnRefExpression, ColumnType, ConnectionOptions, CreateDatabaseOptions, CreateDatabaseResult, CursorPaginationOptions, CursorPaginationResult, DEFAULT_MAX_SYNC_DEPTH, DataSource, DataSourceOptions, DataSourceRegistryEvent, DataSourceRegistryListener, DatabaseDirtyTracker, DatabaseDriver, DatabaseRemover, DatabaseRestorer, DatabaseWriter, DatabaseWriterValidationError, DefineModelOptions, DeleteStrategy, DetachedColumnBuilder, DriverContract, DriverEvent, DriverEventListener, DriverQuery, DriverTransactionContract, DropAllTablesResult, DropDatabaseOptions, type EmbedKey, type ExistsRuleOptions, ExportMigrationsSQLOptions, ForeignKeyBuilder, ForeignKeyDefinition, FullTextIndexOptions, GenerateIdOptions, GeoIndexOptions, type GlobalScopeDefinition, type GlobalScopeOptions, GroupByInput, HasMany, type HasManyOptions, HasOne, type HasOneOptions, HavingInput, IdGeneratorContract, IndexDefinition, IndexEntry, InsertResult, JoinOptions, LiteralExpression, type LoadedRelationResult, type LoadedRelationsMap, type LocalScopeCallback, LockForUpdateOptions, Migration, MigrationAlterOptions, MigrationConstructor, MigrationContract, MigrationCreateOptions, MigrationDefaults, MigrationDriverContract, MigrationDriverFactory, type MigrationRecord, type MigrationResult, MigrationRunner, type MigrationRunnerOptions, type MigrationStatus, MissingDataSourceError, Model, ModelDefaultConfig, ModelDefaults, ModelEventListener, ModelEventName, ModelEvents, ModelRef, type ModelSchema, type ModelSnapshot, type ModelSyncConfig, type ModelSyncContract, ModelSyncOperation, type ModelSyncOperationContract, ModelTransformCallback, ModelType, type MongoClientOptions, MongoDbDriver, MongoDriverOptions, MongoIdGenerator, MongoMigrationDriver, MongoQueryBuilder, MongoSyncAdapter, NamingConvention, OnDeletedEventContext, Operation, OperationType, OrderDirection, PaginationOptions, PaginationResult, PendingOperation, PipelineStage, type PivotData, type PivotIds, PivotOperations, PostgresBlueprint, PostgresConnectionConfig, PostgresCopyOptions, PostgresDialect, PostgresDriver, PostgresIsolationLevel, PostgresMigrationDriver, PostgresNotification, PostgresOperation, PostgresOperationType, PostgresParserOperation, PostgresParserOptions, PostgresPoolConfig, PostgresQueryBuilder, PostgresQueryParser, PostgresQueryResult, PostgresSyncAdapter, PostgresTransactionOptions, PostgresWhereClause, QueryBuilderContract, RELATION_METADATA_KEY, RawColumnExpression, RawExpression, RawQueryResult, RegisterModel, RegisterModelOptions, type RelationConstraintCallback, type RelationConstraints, RelationDefaults, type RelationDefinition, type RelationDefinitions, RelationHydrator, RelationLoader, type RelationType, RemoverContract, RemoverOptions, RemoverResult, RestorerContract, RestorerOptions, RestorerResult, RollbackMigrationsOptions, type RollbackOptions, type RunMigrationsOptions, type ScopeTiming, type SerializedRelation, SqlAggregateFunction, SqlDeleteOperation, SqlDialectContract, SqlGroupClause, SqlHavingClause, SqlInsertOperation, SqlJoinClause, SqlJoinType, SqlOrderClause, SqlQueryConfig, SqlQueryResult, SqlSelectClause, SqlUpdateOperation, SqlWhereOperation, SqlWhereType, StrictMode, SyncAdapterContract, type SyncConfig, type SyncContext, SyncContextManager, type SyncEventPayload, SyncInstruction, type SyncInstructionOptions, SyncManager, type SyncResult, type TableIndexInformation, TransactionContext, type TransactionOptions, TransactionRollbackError, UniqueEntry, type UniqueRuleOptions, UnsafeFilterError, UnsafeRawExpressionError, UpdateOperations, UpdateResult, UuidStrategy, VectorIndexOptions, WhereCallback, WhereObject, WhereOperator, WriterContract, WriterOptions, WriterResult, arrayBigInt, arrayBoolean, arrayDate, arrayDecimal, arrayFloat, arrayInt, arrayJson, arrayText, arrayTimestamp, arrayUuid, bigInt, bigInteger, binary, blobCol, boolCol as bool, boolCol, char, cleanupModelsRegistery, connectToDatabase, createDatabase, createPivotOperations, dataSourceRegistry, databaseDataSourceContext, databaseTransactionContext, date, dateTime, decimal, defineModel, double, dropAllTables, enumCol, escapeRegex, exportMigrationsSQL, float, freshMigrate, geometry, getAllModelsFromRegistry, getDatabaseDriver, getModelFromRegistry, globalModelEvents, int, integer, ipAddress, isAggregateExpression, isColumnExpression, isMongoDBDriverLoaded, json, likePatternToRegexSource, lineString, listExecutedMigrations, listPendingMigrations, longText, macAddress, mediumText, migrate, migrationRunner, modelSync, objectCol, onceConnected, onceDisconnected, point, polygon, registerModelInRegistry, removeModelFromRegistery, resolveLikePattern, resolveModelClass, resolveModelName, rollbackMigrations, runMigrations, sanitizeFilter, sanitizeFilterValue, setCol, smallInt, smallInteger, string, text, time, timestamp, tinyInt, tinyInteger, toColumnExpression, transaction, tryResolveModelClass, ulid, useModelTransformer, uuid, vector, verifyRegisteredRelations, year };
 import "./validation/plugins/database-rules-plugin.mjs";
 import "./validation/plugins/embed-validator-plugin.mjs";

package/esm/index.mjs

@@ -4,6 +4,8 @@ import { DataSource } from "./data-source/data-source.mjs";
 import { MissingDataSourceError } from "./errors/missing-data-source.error.mjs";
 import { dataSourceRegistry } from "./data-source/data-source-registry.mjs";
 import { TransactionRollbackError } from "./errors/transaction-rollback.error.mjs";
+import { UnsafeFilterError } from "./errors/unsafe-filter.error.mjs";
+import { UnsafeRawExpressionError } from "./errors/unsafe-raw-expression.error.mjs";
 import { DatabaseDirtyTracker } from "./database-dirty-tracker.mjs";
 import { ModelEvents, globalModelEvents } from "./events/model-events.mjs";
 import { BelongsTo, BelongsToMany, HasMany, HasOne, RELATION_METADATA_KEY } from "./model/relation-decorators.mjs";
@@ -14,6 +16,7 @@ import { SyncManager } from "./sync/sync-manager.mjs";
 import { ModelSyncOperation } from "./sync/model-sync-operation.mjs";
 import { modelSync } from "./sync/model-sync.mjs";
 import { DatabaseRemover } from "./remover/database-remover.mjs";
+import { sanitizeFilter, sanitizeFilterValue } from "./utils/sanitize-filter.mjs";
 import { RelationHydrator } from "./relations/relation-hydrator.mjs";
 import { DatabaseWriterValidationError } from "./validation/database-writer-validation-error.mjs";
 import "./validation/index.mjs";
@@ -26,6 +29,7 @@ import { $agg, isAggregateExpression } from "./expressions/aggregate-expressions
 import { $expr, isColumnExpression, toColumnExpression } from "./expressions/column-expressions.mjs";
 import { MongoIdGenerator } from "./drivers/mongodb/mongodb-id-generator.mjs";
 import { MongoMigrationDriver } from "./drivers/mongodb/mongodb-migration-driver.mjs";
+import { escapeRegex, likePatternToRegexSource, resolveLikePattern } from "./utils/escape-regex.mjs";
 import { MongoQueryBuilder } from "./drivers/mongodb/mongodb-query-builder.mjs";
 import { MongoSyncAdapter } from "./drivers/mongodb/mongodb-sync-adapter.mjs";
 import { MongoDbDriver, isMongoDBDriverLoaded } from "./drivers/mongodb/mongodb-driver.mjs";
@@ -51,4 +55,4 @@ import { createDatabase, dropAllTables } from "./operations/database.mjs";
 import { exportMigrationsSQL, freshMigrate, listExecutedMigrations, listPendingMigrations, rollbackMigrations, runMigrations } from "./operations/migrations.mjs";
 import "./operations/index.mjs";
 
-export { $agg, $expr, BelongsTo, BelongsToMany, ColumnBuilder, DEFAULT_MAX_SYNC_DEPTH, DataSource, DatabaseDirtyTracker, DatabaseRemover, DatabaseRestorer, DatabaseWriter, DatabaseWriterValidationError, DetachedColumnBuilder, ForeignKeyBuilder, HasMany, HasOne, Migration, MigrationRunner, MissingDataSourceError, Model, ModelEvents, ModelSyncOperation, MongoDbDriver, MongoIdGenerator, MongoMigrationDriver, MongoQueryBuilder, MongoSyncAdapter, PivotOperations, PostgresBlueprint, PostgresDialect, PostgresDriver, PostgresMigrationDriver, PostgresQueryBuilder, PostgresQueryParser, PostgresSyncAdapter, RELATION_METADATA_KEY, RegisterModel, RelationHydrator, RelationLoader, SyncContextManager, SyncManager, TransactionRollbackError, arrayBigInt, arrayBoolean, arrayDate, arrayDecimal, arrayFloat, arrayInt, arrayJson, arrayText, arrayTimestamp, arrayUuid, bigInt, bigInteger, binary, blobCol, boolCol as bool, boolCol, char, cleanupModelsRegistery, connectToDatabase, createDatabase, createPivotOperations, dataSourceRegistry, databaseDataSourceContext, databaseTransactionContext, date, dateTime, decimal, defineModel, double, dropAllTables, enumCol, exportMigrationsSQL, float, freshMigrate, geometry, getAllModelsFromRegistry, getDatabaseDriver, getModelFromRegistry, globalModelEvents, int, integer, ipAddress, isAggregateExpression, isColumnExpression, isMongoDBDriverLoaded, json, lineString, listExecutedMigrations, listPendingMigrations, longText, macAddress, mediumText, migrate, migrationRunner, modelSync, objectCol, onceConnected, onceDisconnected, point, polygon, registerModelInRegistry, removeModelFromRegistery, resolveModelClass, resolveModelName, rollbackMigrations, runMigrations, setCol, smallInt, smallInteger, string, text, time, timestamp, tinyInt, tinyInteger, toColumnExpression, transaction, tryResolveModelClass, ulid, useModelTransformer, uuid, vector, verifyRegisteredRelations, year };
+export { $agg, $expr, BelongsTo, BelongsToMany, ColumnBuilder, DEFAULT_MAX_SYNC_DEPTH, DataSource, DatabaseDirtyTracker, DatabaseRemover, DatabaseRestorer, DatabaseWriter, DatabaseWriterValidationError, DetachedColumnBuilder, ForeignKeyBuilder, HasMany, HasOne, Migration, MigrationRunner, MissingDataSourceError, Model, ModelEvents, ModelSyncOperation, MongoDbDriver, MongoIdGenerator, MongoMigrationDriver, MongoQueryBuilder, MongoSyncAdapter, PivotOperations, PostgresBlueprint, PostgresDialect, PostgresDriver, PostgresMigrationDriver, PostgresQueryBuilder, PostgresQueryParser, PostgresSyncAdapter, RELATION_METADATA_KEY, RegisterModel, RelationHydrator, RelationLoader, SyncContextManager, SyncManager, TransactionRollbackError, UnsafeFilterError, UnsafeRawExpressionError, arrayBigInt, arrayBoolean, arrayDate, arrayDecimal, arrayFloat, arrayInt, arrayJson, arrayText, arrayTimestamp, arrayUuid, bigInt, bigInteger, binary, blobCol, boolCol as bool, boolCol, char, cleanupModelsRegistery, connectToDatabase, createDatabase, createPivotOperations, dataSourceRegistry, databaseDataSourceContext, databaseTransactionContext, date, dateTime, decimal, defineModel, double, dropAllTables, enumCol, escapeRegex, exportMigrationsSQL, float, freshMigrate, geometry, getAllModelsFromRegistry, getDatabaseDriver, getModelFromRegistry, globalModelEvents, int, integer, ipAddress, isAggregateExpression, isColumnExpression, isMongoDBDriverLoaded, json, likePatternToRegexSource, lineString, listExecutedMigrations, listPendingMigrations, longText, macAddress, mediumText, migrate, migrationRunner, modelSync, objectCol, onceConnected, onceDisconnected, point, polygon, registerModelInRegistry, removeModelFromRegistery, resolveLikePattern, resolveModelClass, resolveModelName, rollbackMigrations, runMigrations, sanitizeFilter, sanitizeFilterValue, setCol, smallInt, smallInteger, string, text, time, timestamp, tinyInt, tinyInteger, toColumnExpression, transaction, tryResolveModelClass, ulid, useModelTransformer, uuid, vector, verifyRegisteredRelations, year };

package/esm/model/methods/accessor-methods.mjs

@@ -31,7 +31,45 @@ function unsetFields(model, ...fields) {
 	model.dirtyTracker.unset(fields);
 	return model;
 }
+/**
+* Identity columns that a mass-assignment payload may never carry into an
+* already-persisted model. `merge()` is the method request bodies reach
+* (`model.merge(req.body)` / `save({ merge })`), and the primary key is what
+* the UPDATE filter is built from — letting it through means a payload of
+* `{ id: "<victim-id>" }` rewrites which document the save targets. Both the
+* configured primary key and the two framework identity columns are dropped,
+* because `id` and `_id` are managed by the writer/driver either way.
+*
+* A NEW model is untouched: creating with an explicit id is a legitimate flow,
+* and the writer itself merges the driver-returned document (`_id`, defaults)
+* back onto the instance before it is marked persisted.
+*/
+function stripIdentityColumns(model, values) {
+	if (model.isNew) return values;
+	const identityColumns = new Set([
+		model.getPrimaryKey(),
+		"id",
+		"_id"
+	]);
+	const blockedKeys = Object.keys(values).filter((key) => identityColumns.has(key));
+	if (blockedKeys.length === 0) return values;
+	const safeValues = { ...values };
+	for (const key of blockedKeys) delete safeValues[key];
+	return safeValues;
+}
 function mergeFields(model, values) {
+	return mergeDriverFields(model, stripIdentityColumns(model, values));
+}
+/**
+* Merge a document the DRIVER produced (generated `_id`, `RETURNING *`, DB
+* defaults) back onto the model, identity columns included.
+*
+* Framework-internal counterpart of {@link mergeFields}: the write pipeline is
+* the one caller allowed to set identity columns on an already-persisted
+* instance, because the values come from the database rather than from a
+* request. Never route caller-supplied data through this.
+*/
+function mergeDriverFields(model, values) {
 	model.data = merge(model.data, values);
 	model.dirtyTracker.mergeChanges(values);
 	return model;
@@ -50,5 +88,5 @@ function getBooleanField(model, key, defaultValue) {
 }
 
 //#endregion
-export { decrementField, getBooleanField, getFieldValue, getNumberField, getOnlyFields, getStringField, hasField, incrementField, mergeFields, setFieldValue, unsetFields };
+export { decrementField, getBooleanField, getFieldValue, getNumberField, getOnlyFields, getStringField, hasField, incrementField, mergeDriverFields, mergeFields, setFieldValue, unsetFields };
 //# sourceMappingURL=accessor-methods.mjs.map

package/esm/model/methods/accessor-methods.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"accessor-methods.mjs","names":[],"sources":["../../../../../../../../cascade/src/model/methods/accessor-methods.ts"],"sourcesContent":["import { get, merge, only, set, unset } from \"@mongez/reinforcements\";\nimport type { Model } from \"../model\";\n\n/**\n * Sentinel symbol to distinguish a genuinely missing field from a field\n * whose value is `undefined`. Encapsulated here — callers use `hasField()`.\n */\nconst MISSING_VALUE = Symbol(\"missing\");\n\nexport function getFieldValue(model: Model, field: string, defaultValue?: unknown): any {\n  return get(model.data, field, defaultValue);\n}\n\nexport function setFieldValue(model: Model, field: string, value: unknown): Model {\n  const path = String(field);\n  set(model.data, path, value);\n\n  const partial: Record<string, unknown> = {};\n  set(partial, path, value);\n  model.dirtyTracker.mergeChanges(partial);\n\n  return model;\n}\n\nexport function hasField(model: Model, field: string): boolean {\n  return get(model.data, field, MISSING_VALUE as any) !== MISSING_VALUE;\n}\n\nexport function incrementField(model: Model, field: string, amount?: number): Model {\n  const value = getFieldValue(model, field, 0) as number;\n  const incrementedValue = value + (amount ?? 1);\n  return setFieldValue(model, field, incrementedValue);\n}\n\nexport function decrementField(model: Model, field: string, amount?: number): Model {\n  const value = getFieldValue(model, field, 0) as number;\n  const decrementedValue = value - (amount ?? 1);\n  return setFieldValue(model, field, decrementedValue);\n}\n\nexport function unsetFields(model: Model, ...fields: string[]): Model {\n  model.data = unset(model.data, fields);\n  model.dirtyTracker.unset(fields);\n\n  return model;\n}\n\nexport function mergeFields(model: Model, values: Record<string, unknown>): Model {\n  model.data = merge(model.data, values) as any;\n  model.dirtyTracker.mergeChanges(values);\n  return model;\n}\n\nexport function getOnlyFields(model: Model, fields: string[]): Record<string, unknown> {\n  return only(model.data, fields);\n}\n\nexport function getStringField(model: Model, key: string, defaultValue?: string): string | undefined {\n  return getFieldValue(model, key, defaultValue) as string | undefined;\n}\n\nexport function getNumberField(model: Model, key: string, defaultValue?: number): number | undefined {\n  return getFieldValue(model, key, defaultValue) as number | undefined;\n}\n\nexport function getBooleanField(model: Model, key: string, defaultValue?: boolean): boolean | undefined {\n  return getFieldValue(model, key, defaultValue) as boolean | undefined;\n}\n"],"mappings":";;;;;;;AAOA,MAAM,gBAAgB,OAAO,SAAS;AAEtC,SAAgB,cAAc,OAAc,OAAe,cAA6B;CACtF,OAAO,IAAI,MAAM,MAAM,OAAO,YAAY;AAC5C;AAEA,SAAgB,cAAc,OAAc,OAAe,OAAuB;CAChF,MAAM,OAAO,OAAO,KAAK;CACzB,IAAI,MAAM,MAAM,MAAM,KAAK;CAE3B,MAAM,UAAmC,CAAC;CAC1C,IAAI,SAAS,MAAM,KAAK;CACxB,MAAM,aAAa,aAAa,OAAO;CAEvC,OAAO;AACT;AAEA,SAAgB,SAAS,OAAc,OAAwB;CAC7D,OAAO,IAAI,MAAM,MAAM,OAAO,aAAoB,MAAM;AAC1D;AAEA,SAAgB,eAAe,OAAc,OAAe,QAAwB;CAGlF,OAAO,cAAc,OAAO,OAFd,cAAc,OAAO,OAAO,CACb,KAAK,UAAU,EACO;AACrD;AAEA,SAAgB,eAAe,OAAc,OAAe,QAAwB;CAGlF,OAAO,cAAc,OAAO,OAFd,cAAc,OAAO,OAAO,CACb,KAAK,UAAU,EACO;AACrD;AAEA,SAAgB,YAAY,OAAc,GAAG,QAAyB;CACpE,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM;CACrC,MAAM,aAAa,MAAM,MAAM;CAE/B,OAAO;AACT;AAEA,SAAgB,YAAY,OAAc,QAAwC;CAChF,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM;CACrC,MAAM,aAAa,aAAa,MAAM;CACtC,OAAO;AACT;AAEA,SAAgB,cAAc,OAAc,QAA2C;CACrF,OAAO,KAAK,MAAM,MAAM,MAAM;AAChC;AAEA,SAAgB,eAAe,OAAc,KAAa,cAA2C;CACnG,OAAO,cAAc,OAAO,KAAK,YAAY;AAC/C;AAEA,SAAgB,eAAe,OAAc,KAAa,cAA2C;CACnG,OAAO,cAAc,OAAO,KAAK,YAAY;AAC/C;AAEA,SAAgB,gBAAgB,OAAc,KAAa,cAA6C;CACtG,OAAO,cAAc,OAAO,KAAK,YAAY;AAC/C"}
+{"version":3,"file":"accessor-methods.mjs","names":[],"sources":["../../../../../../../../cascade/src/model/methods/accessor-methods.ts"],"sourcesContent":["import { get, merge, only, set, unset } from \"@mongez/reinforcements\";\nimport type { Model } from \"../model\";\n\n/**\n * Sentinel symbol to distinguish a genuinely missing field from a field\n * whose value is `undefined`. Encapsulated here — callers use `hasField()`.\n */\nconst MISSING_VALUE = Symbol(\"missing\");\n\nexport function getFieldValue(model: Model, field: string, defaultValue?: unknown): any {\n  return get(model.data, field, defaultValue);\n}\n\nexport function setFieldValue(model: Model, field: string, value: unknown): Model {\n  const path = String(field);\n  set(model.data, path, value);\n\n  const partial: Record<string, unknown> = {};\n  set(partial, path, value);\n  model.dirtyTracker.mergeChanges(partial);\n\n  return model;\n}\n\nexport function hasField(model: Model, field: string): boolean {\n  return get(model.data, field, MISSING_VALUE as any) !== MISSING_VALUE;\n}\n\nexport function incrementField(model: Model, field: string, amount?: number): Model {\n  const value = getFieldValue(model, field, 0) as number;\n  const incrementedValue = value + (amount ?? 1);\n  return setFieldValue(model, field, incrementedValue);\n}\n\nexport function decrementField(model: Model, field: string, amount?: number): Model {\n  const value = getFieldValue(model, field, 0) as number;\n  const decrementedValue = value - (amount ?? 1);\n  return setFieldValue(model, field, decrementedValue);\n}\n\nexport function unsetFields(model: Model, ...fields: string[]): Model {\n  model.data = unset(model.data, fields);\n  model.dirtyTracker.unset(fields);\n\n  return model;\n}\n\n/**\n * Identity columns that a mass-assignment payload may never carry into an\n * already-persisted model. `merge()` is the method request bodies reach\n * (`model.merge(req.body)` / `save({ merge })`), and the primary key is what\n * the UPDATE filter is built from — letting it through means a payload of\n * `{ id: \"<victim-id>\" }` rewrites which document the save targets. Both the\n * configured primary key and the two framework identity columns are dropped,\n * because `id` and `_id` are managed by the writer/driver either way.\n *\n * A NEW model is untouched: creating with an explicit id is a legitimate flow,\n * and the writer itself merges the driver-returned document (`_id`, defaults)\n * back onto the instance before it is marked persisted.\n */\nfunction stripIdentityColumns(\n  model: Model,\n  values: Record<string, unknown>,\n): Record<string, unknown> {\n  if (model.isNew) return values;\n\n  const identityColumns = new Set([model.getPrimaryKey(), \"id\", \"_id\"]);\n  const blockedKeys = Object.keys(values).filter(key => identityColumns.has(key));\n\n  if (blockedKeys.length === 0) return values;\n\n  // Copy — the caller's object (often the request body itself) is not ours to mutate.\n  const safeValues = { ...values };\n  for (const key of blockedKeys) {\n    delete safeValues[key];\n  }\n\n  return safeValues;\n}\n\nexport function mergeFields(model: Model, values: Record<string, unknown>): Model {\n  return mergeDriverFields(model, stripIdentityColumns(model, values));\n}\n\n/**\n * Merge a document the DRIVER produced (generated `_id`, `RETURNING *`, DB\n * defaults) back onto the model, identity columns included.\n *\n * Framework-internal counterpart of {@link mergeFields}: the write pipeline is\n * the one caller allowed to set identity columns on an already-persisted\n * instance, because the values come from the database rather than from a\n * request. Never route caller-supplied data through this.\n */\nexport function mergeDriverFields(model: Model, values: Record<string, unknown>): Model {\n  model.data = merge(model.data, values) as any;\n  model.dirtyTracker.mergeChanges(values);\n  return model;\n}\n\nexport function getOnlyFields(model: Model, fields: string[]): Record<string, unknown> {\n  return only(model.data, fields);\n}\n\nexport function getStringField(model: Model, key: string, defaultValue?: string): string | undefined {\n  return getFieldValue(model, key, defaultValue) as string | undefined;\n}\n\nexport function getNumberField(model: Model, key: string, defaultValue?: number): number | undefined {\n  return getFieldValue(model, key, defaultValue) as number | undefined;\n}\n\nexport function getBooleanField(model: Model, key: string, defaultValue?: boolean): boolean | undefined {\n  return getFieldValue(model, key, defaultValue) as boolean | undefined;\n}\n"],"mappings":";;;;;;;AAOA,MAAM,gBAAgB,OAAO,SAAS;AAEtC,SAAgB,cAAc,OAAc,OAAe,cAA6B;CACtF,OAAO,IAAI,MAAM,MAAM,OAAO,YAAY;AAC5C;AAEA,SAAgB,cAAc,OAAc,OAAe,OAAuB;CAChF,MAAM,OAAO,OAAO,KAAK;CACzB,IAAI,MAAM,MAAM,MAAM,KAAK;CAE3B,MAAM,UAAmC,CAAC;CAC1C,IAAI,SAAS,MAAM,KAAK;CACxB,MAAM,aAAa,aAAa,OAAO;CAEvC,OAAO;AACT;AAEA,SAAgB,SAAS,OAAc,OAAwB;CAC7D,OAAO,IAAI,MAAM,MAAM,OAAO,aAAoB,MAAM;AAC1D;AAEA,SAAgB,eAAe,OAAc,OAAe,QAAwB;CAGlF,OAAO,cAAc,OAAO,OAFd,cAAc,OAAO,OAAO,CACb,KAAK,UAAU,EACO;AACrD;AAEA,SAAgB,eAAe,OAAc,OAAe,QAAwB;CAGlF,OAAO,cAAc,OAAO,OAFd,cAAc,OAAO,OAAO,CACb,KAAK,UAAU,EACO;AACrD;AAEA,SAAgB,YAAY,OAAc,GAAG,QAAyB;CACpE,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM;CACrC,MAAM,aAAa,MAAM,MAAM;CAE/B,OAAO;AACT;;;;;;;;;;;;;;AAeA,SAAS,qBACP,OACA,QACyB;CACzB,IAAI,MAAM,OAAO,OAAO;CAExB,MAAM,kBAAkB,IAAI,IAAI;EAAC,MAAM,cAAc;EAAG;EAAM;CAAK,CAAC;CACpE,MAAM,cAAc,OAAO,KAAK,MAAM,CAAC,CAAC,QAAO,QAAO,gBAAgB,IAAI,GAAG,CAAC;CAE9E,IAAI,YAAY,WAAW,GAAG,OAAO;CAGrC,MAAM,aAAa,EAAE,GAAG,OAAO;CAC/B,KAAK,MAAM,OAAO,aAChB,OAAO,WAAW;CAGpB,OAAO;AACT;AAEA,SAAgB,YAAY,OAAc,QAAwC;CAChF,OAAO,kBAAkB,OAAO,qBAAqB,OAAO,MAAM,CAAC;AACrE;;;;;;;;;;AAWA,SAAgB,kBAAkB,OAAc,QAAwC;CACtF,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM;CACrC,MAAM,aAAa,aAAa,MAAM;CACtC,OAAO;AACT;AAEA,SAAgB,cAAc,OAAc,QAA2C;CACrF,OAAO,KAAK,MAAM,MAAM,MAAM;AAChC;AAEA,SAAgB,eAAe,OAAc,KAAa,cAA2C;CACnG,OAAO,cAAc,OAAO,KAAK,YAAY;AAC/C;AAEA,SAAgB,eAAe,OAAc,KAAa,cAA2C;CACnG,OAAO,cAAc,OAAO,KAAK,YAAY;AAC/C;AAEA,SAAgB,gBAAgB,OAAc,KAAa,cAA6C;CACtG,OAAO,cAAc,OAAO,KAAK,YAAY;AAC/C"}

package/esm/model/methods/delete-methods.mjs

@@ -1,14 +1,15 @@
 import { DatabaseRemover } from "../../remover/database-remover.mjs";
+import { sanitizeFilter } from "../../utils/sanitize-filter.mjs";
 
 //#region ../cascade/src/model/methods/delete-methods.ts
 async function destroyModel(model, options) {
 	return new DatabaseRemover(model).destroy(options);
 }
 async function deleteRecords(ModelClass, filter) {
-	return ModelClass.getDriver().deleteMany(ModelClass.table, filter);
+	return ModelClass.getDriver().deleteMany(ModelClass.table, filter ? sanitizeFilter(filter) : filter);
 }
 async function deleteOneRecord(ModelClass, filter) {
-	return ModelClass.getDriver().delete(ModelClass.table, filter);
+	return ModelClass.getDriver().delete(ModelClass.table, filter ? sanitizeFilter(filter) : filter);
 }
 
 //#endregion

package/esm/model/methods/delete-methods.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"delete-methods.mjs","names":[],"sources":["../../../../../../../../cascade/src/model/methods/delete-methods.ts"],"sourcesContent":["import { DatabaseRemover } from \"../../remover/database-remover\";\nimport type { DeleteStrategy } from \"../../types\";\nimport type { RemoverResult } from \"../../contracts\";\nimport type { ChildModel, Model } from \"../model\";\n\nexport async function destroyModel(\n  model: Model,\n  options?: { strategy?: DeleteStrategy; skipEvents?: boolean },\n): Promise<RemoverResult> {\n  const remover = new DatabaseRemover(model);\n  return remover.destroy(options);\n}\n\nexport async function deleteRecords(\n  ModelClass: ChildModel<any>,\n  filter?: Record<string, unknown>,\n): Promise<number> {\n  return ModelClass.getDriver().deleteMany(ModelClass.table, filter);\n}\n\nexport async function deleteOneRecord(\n  ModelClass: ChildModel<any>,\n  filter?: Record<string, unknown>,\n): Promise<number> {\n  return ModelClass.getDriver().delete(ModelClass.table, filter);\n}\n"],"mappings":";;;AAKA,eAAsB,aACpB,OACA,SACwB;CAExB,OAAO,IADa,gBAAgB,KACvB,CAAC,CAAC,QAAQ,OAAO;AAChC;AAEA,eAAsB,cACpB,YACA,QACiB;CACjB,OAAO,WAAW,UAAU,CAAC,CAAC,WAAW,WAAW,OAAO,MAAM;AACnE;AAEA,eAAsB,gBACpB,YACA,QACiB;CACjB,OAAO,WAAW,UAAU,CAAC,CAAC,OAAO,WAAW,OAAO,MAAM;AAC/D"}
+{"version":3,"file":"delete-methods.mjs","names":[],"sources":["../../../../../../../../cascade/src/model/methods/delete-methods.ts"],"sourcesContent":["import { DatabaseRemover } from \"../../remover/database-remover\";\r\nimport type { DeleteStrategy } from \"../../types\";\r\nimport type { RemoverResult } from \"../../contracts\";\r\nimport { sanitizeFilter } from \"../../utils/sanitize-filter\";\r\nimport type { ChildModel, Model } from \"../model\";\r\n\r\nexport async function destroyModel(\r\n  model: Model,\r\n  options?: { strategy?: DeleteStrategy; skipEvents?: boolean },\r\n): Promise<RemoverResult> {\r\n  const remover = new DatabaseRemover(model);\r\n  return remover.destroy(options);\r\n}\r\n\r\nexport async function deleteRecords(\r\n  ModelClass: ChildModel<any>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<number> {\r\n  return ModelClass.getDriver().deleteMany(ModelClass.table, filter ? sanitizeFilter(filter) : filter);\r\n}\r\n\r\nexport async function deleteOneRecord(\r\n  ModelClass: ChildModel<any>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<number> {\r\n  return ModelClass.getDriver().delete(ModelClass.table, filter ? sanitizeFilter(filter) : filter);\r\n}\r\n"],"mappings":";;;;AAMA,eAAsB,aACpB,OACA,SACwB;CAExB,OAAO,IADa,gBAAgB,KACvB,CAAC,CAAC,QAAQ,OAAO;AAChC;AAEA,eAAsB,cACpB,YACA,QACiB;CACjB,OAAO,WAAW,UAAU,CAAC,CAAC,WAAW,WAAW,OAAO,SAAS,eAAe,MAAM,IAAI,MAAM;AACrG;AAEA,eAAsB,gBACpB,YACA,QACiB;CACjB,OAAO,WAAW,UAAU,CAAC,CAAC,OAAO,WAAW,OAAO,SAAS,eAAe,MAAM,IAAI,MAAM;AACjG"}

package/esm/model/methods/query-methods.mjs

@@ -1,4 +1,6 @@
 import { dataSourceRegistry } from "../../data-source/data-source-registry.mjs";
+import { sanitizeFilter } from "../../utils/sanitize-filter.mjs";
+import { warnUndeclaredSensitiveFields } from "./serialization-methods.mjs";
 
 //#region ../cascade/src/model/methods/query-methods.ts
 function buildQuery(ModelClass, BaseModel) {
@@ -71,7 +73,7 @@ function decreaseField(ModelClass, filter, field, amount) {
 	return ModelClass.query().where(filter).decrement(field, amount);
 }
 async function performAtomic(ModelClass, filter, operations) {
-	return (await ModelClass.getDriver().atomic(ModelClass.table, filter, operations)).modifiedCount;
+	return (await ModelClass.getDriver().atomic(ModelClass.table, sanitizeFilter(filter), operations)).modifiedCount;
 }
 async function updateById(ModelClass, id, data) {
 	return (await ModelClass.getDriver().update(ModelClass.table, { [ModelClass.primaryKey]: id }, { $set: data })).modifiedCount;
@@ -81,17 +83,17 @@ async function findAndUpdateRecords(ModelClass, filter, update) {
 	return await ModelClass.query().where(filter).get();
 }
 async function findOneAndUpdateRecord(ModelClass, filter, update) {
-	const result = await ModelClass.getDriver().findOneAndUpdate(ModelClass.table, filter, update);
+	const result = await ModelClass.getDriver().findOneAndUpdate(ModelClass.table, sanitizeFilter(filter), update);
 	if (!result) return null;
 	return new ModelClass(result);
 }
 async function findAndReplaceRecord(ModelClass, filter, document) {
-	const result = await ModelClass.getDriver().replace(ModelClass.table, filter, document);
+	const result = await ModelClass.getDriver().replace(ModelClass.table, sanitizeFilter(filter), document);
 	if (!result) return null;
 	return new ModelClass(result);
 }
 async function findOneAndDeleteRecord(ModelClass, filter, options) {
-	const result = await ModelClass.getDriver().findOneAndDelete(ModelClass.table, filter, options);
+	const result = await ModelClass.getDriver().findOneAndDelete(ModelClass.table, sanitizeFilter(filter), options);
 	if (!result) return null;
 	const model = ModelClass.hydrate(result);
 	model.dirtyTracker.reset();
@@ -113,6 +115,7 @@ function resolveDataSource(ModelClass) {
 		if (Object.keys(mergedDefaults).length > 0) ModelClass.applyModelDefaults(mergedDefaults);
 		ModelClass._defaultsApplied = true;
 	}
+	warnUndeclaredSensitiveFields(ModelClass);
 	return dataSource;
 }
 

package/esm/model/methods/query-methods.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"query-methods.mjs","names":["ctor"],"sources":["../../../../../../../../cascade/src/model/methods/query-methods.ts"],"sourcesContent":["import type {\r\n  PaginationOptions,\r\n  PaginationResult,\r\n  QueryBuilderContract,\r\n  UpdateOperations,\r\n} from \"../../contracts\";\r\nimport type { DataSource } from \"../../data-source/data-source\";\r\nimport { dataSourceRegistry } from \"../../data-source/data-source-registry\";\r\nimport type { ChildModel, GlobalScopeDefinition, Model } from \"../model\";\r\n\r\nexport function buildQuery<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  BaseModel: typeof Model,\r\n): QueryBuilderContract<TModel> {\r\n  const queryBuilder = ModelClass.newQueryBuilder<TModel>();\r\n  const qb = queryBuilder;\r\n\r\n  // Collect global scopes from base Model and child model\r\n  const allGlobalScopes = new Map<string, GlobalScopeDefinition>([\r\n    ...BaseModel.globalScopes,\r\n    ...ModelClass.globalScopes,\r\n  ]);\r\n\r\n  queryBuilder.pendingGlobalScopes = allGlobalScopes;\r\n  queryBuilder.availableLocalScopes = ModelClass.localScopes;\r\n  queryBuilder.disabledGlobalScopes = new Set();\r\n  queryBuilder.relationDefinitions = ModelClass.relations;\r\n  queryBuilder.modelClass = ModelClass;\r\n\r\n  ModelClass.events().emitFetching(queryBuilder, {\r\n    table: ModelClass.table,\r\n    modelClass: ModelClass,\r\n  });\r\n\r\n  queryBuilder.hydrate((data: any) => {\r\n    return ModelClass.hydrate(data);\r\n  });\r\n\r\n  // Eager-loading runs inside the driver's `get()` so it works for any\r\n  // builder construction path (Model.query, Model.newQueryBuilder, custom\r\n  // subclassed builders). This hook only handles the model-level `fetched`\r\n  // event emission.\r\n  queryBuilder.onFetched(async (models: any[]) => {\r\n    await ModelClass.events().emit(\"fetched\", models as any, {});\r\n  });\r\n\r\n  return queryBuilder;\r\n}\r\n\r\nexport function buildNewQueryBuilder<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n): QueryBuilderContract<TModel> {\r\n  const dataSource = ModelClass.getDataSource();\r\n\r\n  if (ModelClass.builder) {\r\n    const BuilderClass = ModelClass.builder;\r\n    return new BuilderClass(ModelClass.table, dataSource) as QueryBuilderContract<TModel>;\r\n  }\r\n\r\n  const queryBuilder = dataSource.driver.queryBuilder<TModel>(ModelClass.table);\r\n  return queryBuilder;\r\n}\r\n\r\nexport async function findFirst<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<TModel | null> {\r\n  const query = ModelClass.query();\r\n  if (filter) {\r\n    query.where(filter);\r\n  }\r\n  return query.first();\r\n}\r\n\r\nexport async function findLast<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<TModel | null> {\r\n  const query = ModelClass.query();\r\n  if (filter) {\r\n    query.where(filter);\r\n  }\r\n\r\n  return query.last();\r\n}\r\n\r\nexport async function findAll<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<TModel[]> {\r\n  const query = ModelClass.query();\r\n  if (filter) {\r\n    query.where(filter);\r\n  }\r\n  return query.get();\r\n}\r\n\r\nexport function countRecords<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<number> {\r\n  const query = ModelClass.query();\r\n  if (filter) {\r\n    query.where(filter);\r\n  }\r\n  return query.count();\r\n}\r\n\r\nexport async function findById<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  id: string | number,\r\n): Promise<TModel | null> {\r\n  const query = ModelClass.query();\r\n  return query.where(ModelClass.primaryKey, id).first();\r\n}\r\n\r\nexport async function paginateRecords<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  options: PaginationOptions & { filter?: Record<string, unknown> } = {},\r\n): Promise<PaginationResult<TModel>> {\r\n  const query = ModelClass.query();\r\n  if (options.filter) {\r\n    query.where(options.filter);\r\n  }\r\n\r\n  return query.paginate({\r\n    limit: options.limit,\r\n    page: options.page,\r\n  });\r\n}\r\n\r\nexport async function findLatest<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<TModel[]> {\r\n  const query = ModelClass.query();\r\n  if (filter) {\r\n    query.where(filter);\r\n  }\r\n  return (await query.latest()) as unknown as TModel[];\r\n}\r\n\r\nexport function increaseField<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  field: string,\r\n  amount: number,\r\n): Promise<number> {\r\n  const query = ModelClass.query().where(filter);\r\n  return query.increment(field, amount);\r\n}\r\n\r\nexport function decreaseField<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  field: string,\r\n  amount: number,\r\n): Promise<number> {\r\n  const query = ModelClass.query().where(filter);\r\n  return query.decrement(field, amount);\r\n}\r\n\r\nexport async function performAtomic<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  operations: UpdateOperations,\r\n): Promise<number> {\r\n  const result = await ModelClass.getDriver().atomic(ModelClass.table, filter, operations);\r\n  return result.modifiedCount;\r\n}\r\n\r\nexport async function updateById<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  id: string | number,\r\n  data: Record<string, unknown>,\r\n): Promise<number> {\r\n  const result = await ModelClass.getDriver().update(ModelClass.table, { [ModelClass.primaryKey]: id }, { $set: data });\r\n  return result.modifiedCount;\r\n}\r\n\r\nexport async function findAndUpdateRecords<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  update: UpdateOperations,\r\n): Promise<TModel[]> {\r\n  await performAtomic(ModelClass, filter, update);\r\n  return await ModelClass.query().where(filter).get();\r\n}\r\n\r\nexport async function findOneAndUpdateRecord<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  update: UpdateOperations,\r\n): Promise<TModel | null> {\r\n  const result = await ModelClass.getDriver().findOneAndUpdate(ModelClass.table, filter, update);\r\n  if (!result) return null;\r\n  const ctor = ModelClass as any;\r\n  return new ctor(result);\r\n}\r\n\r\nexport async function findAndReplaceRecord<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  document: Record<string, unknown>,\r\n): Promise<TModel | null> {\r\n  const result = await ModelClass.getDriver().replace(ModelClass.table, filter, document);\r\n  if (!result) return null;\r\n  const ctor = ModelClass as any;\r\n  return new ctor(result);\r\n}\r\n\r\nexport async function findOneAndDeleteRecord<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  options?: Record<string, unknown>,\r\n): Promise<TModel | null> {\r\n  const driver = ModelClass.getDriver();\r\n  const result = await driver.findOneAndDelete(ModelClass.table, filter, options);\r\n\r\n  if (!result) {\r\n    return null;\r\n  }\r\n\r\n  const model = ModelClass.hydrate(result as Record<string, unknown>);\r\n  model.dirtyTracker.reset();\r\n  return model;\r\n}\r\n\r\nexport function resolveDataSource<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n): DataSource {\r\n  const ref = ModelClass.dataSource;\r\n  let dataSource: DataSource;\r\n\r\n  if (typeof ref === \"string\") {\r\n    dataSource = dataSourceRegistry.get(ref);\r\n  } else if (ref) {\r\n    dataSource = ref;\r\n  } else {\r\n    dataSource = dataSourceRegistry.get();\r\n  }\r\n\r\n  if (!ModelClass.hasOwnProperty(\"_defaultsApplied\")) {\r\n    const driverDefaults = dataSource.driver.modelDefaults || {};\r\n    const dataSourceDefaults = dataSource.modelDefaults || {};\r\n\r\n    const mergedDefaults = {\r\n      ...driverDefaults,\r\n      ...dataSourceDefaults,\r\n    };\r\n\r\n    if (Object.keys(mergedDefaults).length > 0) {\r\n      (ModelClass as any).applyModelDefaults(mergedDefaults);\r\n    }\r\n\r\n    (ModelClass as any)._defaultsApplied = true;\r\n  }\r\n\r\n  return dataSource;\r\n}\r\n"],"mappings":";;;AAUA,SAAgB,WACd,YACA,WAC8B;CAC9B,MAAM,eAAe,WAAW,gBAAwB;CASxD,aAAa,sBAAsB,IALP,IAAmC,CAC7D,GAAG,UAAU,cACb,GAAG,WAAW,YAChB,CAEiD;CACjD,aAAa,uBAAuB,WAAW;CAC/C,aAAa,uCAAuB,IAAI,IAAI;CAC5C,aAAa,sBAAsB,WAAW;CAC9C,aAAa,aAAa;CAE1B,WAAW,OAAO,CAAC,CAAC,aAAa,cAAc;EAC7C,OAAO,WAAW;EAClB,YAAY;CACd,CAAC;CAED,aAAa,SAAS,SAAc;EAClC,OAAO,WAAW,QAAQ,IAAI;CAChC,CAAC;CAMD,aAAa,UAAU,OAAO,WAAkB;EAC9C,MAAM,WAAW,OAAO,CAAC,CAAC,KAAK,WAAW,QAAe,CAAC,CAAC;CAC7D,CAAC;CAED,OAAO;AACT;AAEA,SAAgB,qBACd,YAC8B;CAC9B,MAAM,aAAa,WAAW,cAAc;CAE5C,IAAI,WAAW,SAAS;EACtB,MAAM,eAAe,WAAW;EAChC,OAAO,IAAI,aAAa,WAAW,OAAO,UAAU;CACtD;CAGA,OADqB,WAAW,OAAO,aAAqB,WAAW,KACrD;AACpB;AAEA,eAAsB,UACpB,YACA,QACwB;CACxB,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QACF,MAAM,MAAM,MAAM;CAEpB,OAAO,MAAM,MAAM;AACrB;AAEA,eAAsB,SACpB,YACA,QACwB;CACxB,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QACF,MAAM,MAAM,MAAM;CAGpB,OAAO,MAAM,KAAK;AACpB;AAEA,eAAsB,QACpB,YACA,QACmB;CACnB,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QACF,MAAM,MAAM,MAAM;CAEpB,OAAO,MAAM,IAAI;AACnB;AAEA,SAAgB,aACd,YACA,QACiB;CACjB,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QACF,MAAM,MAAM,MAAM;CAEpB,OAAO,MAAM,MAAM;AACrB;AAEA,eAAsB,SACpB,YACA,IACwB;CAExB,OADc,WAAW,MACd,CAAC,CAAC,MAAM,WAAW,YAAY,EAAE,CAAC,CAAC,MAAM;AACtD;AAEA,eAAsB,gBACpB,YACA,UAAoE,CAAC,GAClC;CACnC,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QAAQ,QACV,MAAM,MAAM,QAAQ,MAAM;CAG5B,OAAO,MAAM,SAAS;EACpB,OAAO,QAAQ;EACf,MAAM,QAAQ;CAChB,CAAC;AACH;AAEA,eAAsB,WACpB,YACA,QACmB;CACnB,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QACF,MAAM,MAAM,MAAM;CAEpB,OAAQ,MAAM,MAAM,OAAO;AAC7B;AAEA,SAAgB,cACd,YACA,QACA,OACA,QACiB;CAEjB,OADc,WAAW,MAAM,CAAC,CAAC,MAAM,MAC5B,CAAC,CAAC,UAAU,OAAO,MAAM;AACtC;AAEA,SAAgB,cACd,YACA,QACA,OACA,QACiB;CAEjB,OADc,WAAW,MAAM,CAAC,CAAC,MAAM,MAC5B,CAAC,CAAC,UAAU,OAAO,MAAM;AACtC;AAEA,eAAsB,cACpB,YACA,QACA,YACiB;CAEjB,QAAO,MADc,WAAW,UAAU,CAAC,CAAC,OAAO,WAAW,OAAO,QAAQ,UAAU,EAC1E,CAAC;AAChB;AAEA,eAAsB,WACpB,YACA,IACA,MACiB;CAEjB,QAAO,MADc,WAAW,UAAU,CAAC,CAAC,OAAO,WAAW,OAAO,GAAG,WAAW,aAAa,GAAG,GAAG,EAAE,MAAM,KAAK,CAAC,EACvG,CAAC;AAChB;AAEA,eAAsB,qBACpB,YACA,QACA,QACmB;CACnB,MAAM,cAAc,YAAY,QAAQ,MAAM;CAC9C,OAAO,MAAM,WAAW,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI;AACpD;AAEA,eAAsB,uBACpB,YACA,QACA,QACwB;CACxB,MAAM,SAAS,MAAM,WAAW,UAAU,CAAC,CAAC,iBAAiB,WAAW,OAAO,QAAQ,MAAM;CAC7F,IAAI,CAAC,QAAQ,OAAO;CAEpB,OAAO,IAAIA,WAAK,MAAM;AACxB;AAEA,eAAsB,qBACpB,YACA,QACA,UACwB;CACxB,MAAM,SAAS,MAAM,WAAW,UAAU,CAAC,CAAC,QAAQ,WAAW,OAAO,QAAQ,QAAQ;CACtF,IAAI,CAAC,QAAQ,OAAO;CAEpB,OAAO,IAAIA,WAAK,MAAM;AACxB;AAEA,eAAsB,uBACpB,YACA,QACA,SACwB;CAExB,MAAM,SAAS,MADA,WAAW,UACA,CAAC,CAAC,iBAAiB,WAAW,OAAO,QAAQ,OAAO;CAE9E,IAAI,CAAC,QACH,OAAO;CAGT,MAAM,QAAQ,WAAW,QAAQ,MAAiC;CAClE,MAAM,aAAa,MAAM;CACzB,OAAO;AACT;AAEA,SAAgB,kBACd,YACY;CACZ,MAAM,MAAM,WAAW;CACvB,IAAI;CAEJ,IAAI,OAAO,QAAQ,UACjB,aAAa,mBAAmB,IAAI,GAAG;MAClC,IAAI,KACT,aAAa;MAEb,aAAa,mBAAmB,IAAI;CAGtC,IAAI,CAAC,WAAW,eAAe,kBAAkB,GAAG;EAClD,MAAM,iBAAiB,WAAW,OAAO,iBAAiB,CAAC;EAC3D,MAAM,qBAAqB,WAAW,iBAAiB,CAAC;EAExD,MAAM,iBAAiB;GACrB,GAAG;GACH,GAAG;EACL;EAEA,IAAI,OAAO,KAAK,cAAc,CAAC,CAAC,SAAS,GACvC,AAAC,WAAmB,mBAAmB,cAAc;EAGvD,AAAC,WAAmB,mBAAmB;CACzC;CAEA,OAAO;AACT"}
+{"version":3,"file":"query-methods.mjs","names":["ctor"],"sources":["../../../../../../../../cascade/src/model/methods/query-methods.ts"],"sourcesContent":["import type {\r\n  PaginationOptions,\r\n  PaginationResult,\r\n  QueryBuilderContract,\r\n  UpdateOperations,\r\n} from \"../../contracts\";\r\nimport type { DataSource } from \"../../data-source/data-source\";\r\nimport { dataSourceRegistry } from \"../../data-source/data-source-registry\";\r\nimport { sanitizeFilter } from \"../../utils/sanitize-filter\";\r\nimport type { ChildModel, GlobalScopeDefinition, Model } from \"../model\";\r\nimport { warnUndeclaredSensitiveFields } from \"./serialization-methods\";\r\n\r\nexport function buildQuery<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  BaseModel: typeof Model,\r\n): QueryBuilderContract<TModel> {\r\n  const queryBuilder = ModelClass.newQueryBuilder<TModel>();\r\n  const qb = queryBuilder;\r\n\r\n  // Collect global scopes from base Model and child model\r\n  const allGlobalScopes = new Map<string, GlobalScopeDefinition>([\r\n    ...BaseModel.globalScopes,\r\n    ...ModelClass.globalScopes,\r\n  ]);\r\n\r\n  queryBuilder.pendingGlobalScopes = allGlobalScopes;\r\n  queryBuilder.availableLocalScopes = ModelClass.localScopes;\r\n  queryBuilder.disabledGlobalScopes = new Set();\r\n  queryBuilder.relationDefinitions = ModelClass.relations;\r\n  queryBuilder.modelClass = ModelClass;\r\n\r\n  ModelClass.events().emitFetching(queryBuilder, {\r\n    table: ModelClass.table,\r\n    modelClass: ModelClass,\r\n  });\r\n\r\n  queryBuilder.hydrate((data: any) => {\r\n    return ModelClass.hydrate(data);\r\n  });\r\n\r\n  // Eager-loading runs inside the driver's `get()` so it works for any\r\n  // builder construction path (Model.query, Model.newQueryBuilder, custom\r\n  // subclassed builders). This hook only handles the model-level `fetched`\r\n  // event emission.\r\n  queryBuilder.onFetched(async (models: any[]) => {\r\n    await ModelClass.events().emit(\"fetched\", models as any, {});\r\n  });\r\n\r\n  return queryBuilder;\r\n}\r\n\r\nexport function buildNewQueryBuilder<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n): QueryBuilderContract<TModel> {\r\n  const dataSource = ModelClass.getDataSource();\r\n\r\n  if (ModelClass.builder) {\r\n    const BuilderClass = ModelClass.builder;\r\n    return new BuilderClass(ModelClass.table, dataSource) as QueryBuilderContract<TModel>;\r\n  }\r\n\r\n  const queryBuilder = dataSource.driver.queryBuilder<TModel>(ModelClass.table);\r\n  return queryBuilder;\r\n}\r\n\r\nexport async function findFirst<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<TModel | null> {\r\n  const query = ModelClass.query();\r\n  if (filter) {\r\n    query.where(filter);\r\n  }\r\n  return query.first();\r\n}\r\n\r\nexport async function findLast<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<TModel | null> {\r\n  const query = ModelClass.query();\r\n  if (filter) {\r\n    query.where(filter);\r\n  }\r\n\r\n  return query.last();\r\n}\r\n\r\nexport async function findAll<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<TModel[]> {\r\n  const query = ModelClass.query();\r\n  if (filter) {\r\n    query.where(filter);\r\n  }\r\n  return query.get();\r\n}\r\n\r\nexport function countRecords<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<number> {\r\n  const query = ModelClass.query();\r\n  if (filter) {\r\n    query.where(filter);\r\n  }\r\n  return query.count();\r\n}\r\n\r\nexport async function findById<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  id: string | number,\r\n): Promise<TModel | null> {\r\n  const query = ModelClass.query();\r\n  return query.where(ModelClass.primaryKey, id).first();\r\n}\r\n\r\nexport async function paginateRecords<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  options: PaginationOptions & { filter?: Record<string, unknown> } = {},\r\n): Promise<PaginationResult<TModel>> {\r\n  const query = ModelClass.query();\r\n  if (options.filter) {\r\n    query.where(options.filter);\r\n  }\r\n\r\n  return query.paginate({\r\n    limit: options.limit,\r\n    page: options.page,\r\n  });\r\n}\r\n\r\nexport async function findLatest<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter?: Record<string, unknown>,\r\n): Promise<TModel[]> {\r\n  const query = ModelClass.query();\r\n  if (filter) {\r\n    query.where(filter);\r\n  }\r\n  return (await query.latest()) as unknown as TModel[];\r\n}\r\n\r\nexport function increaseField<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  field: string,\r\n  amount: number,\r\n): Promise<number> {\r\n  const query = ModelClass.query().where(filter);\r\n  return query.increment(field, amount);\r\n}\r\n\r\nexport function decreaseField<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  field: string,\r\n  amount: number,\r\n): Promise<number> {\r\n  const query = ModelClass.query().where(filter);\r\n  return query.decrement(field, amount);\r\n}\r\n\r\n// The atomic/find-and-modify statics below forward their filter straight to\r\n// the driver — they never pass through where(), so they must run the same\r\n// operator-injection check themselves. Only the FILTER is sanitized; update\r\n// operators ($set/$inc/…) are the point of these APIs and stay untouched.\r\nexport async function performAtomic<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  operations: UpdateOperations,\r\n): Promise<number> {\r\n  const result = await ModelClass.getDriver().atomic(\r\n    ModelClass.table,\r\n    sanitizeFilter(filter),\r\n    operations,\r\n  );\r\n  return result.modifiedCount;\r\n}\r\n\r\nexport async function updateById<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  id: string | number,\r\n  data: Record<string, unknown>,\r\n): Promise<number> {\r\n  const result = await ModelClass.getDriver().update(ModelClass.table, { [ModelClass.primaryKey]: id }, { $set: data });\r\n  return result.modifiedCount;\r\n}\r\n\r\nexport async function findAndUpdateRecords<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  update: UpdateOperations,\r\n): Promise<TModel[]> {\r\n  await performAtomic(ModelClass, filter, update);\r\n  return await ModelClass.query().where(filter).get();\r\n}\r\n\r\nexport async function findOneAndUpdateRecord<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  update: UpdateOperations,\r\n): Promise<TModel | null> {\r\n  const result = await ModelClass.getDriver().findOneAndUpdate(\r\n    ModelClass.table,\r\n    sanitizeFilter(filter),\r\n    update,\r\n  );\r\n  if (!result) return null;\r\n  const ctor = ModelClass as any;\r\n  return new ctor(result);\r\n}\r\n\r\nexport async function findAndReplaceRecord<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  document: Record<string, unknown>,\r\n): Promise<TModel | null> {\r\n  const result = await ModelClass.getDriver().replace(\r\n    ModelClass.table,\r\n    sanitizeFilter(filter),\r\n    document,\r\n  );\r\n  if (!result) return null;\r\n  const ctor = ModelClass as any;\r\n  return new ctor(result);\r\n}\r\n\r\nexport async function findOneAndDeleteRecord<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Record<string, unknown>,\r\n  options?: Record<string, unknown>,\r\n): Promise<TModel | null> {\r\n  const driver = ModelClass.getDriver();\r\n  const result = await driver.findOneAndDelete(ModelClass.table, sanitizeFilter(filter), options);\r\n\r\n  if (!result) {\r\n    return null;\r\n  }\r\n\r\n  const model = ModelClass.hydrate(result as Record<string, unknown>);\r\n  model.dirtyTracker.reset();\r\n  return model;\r\n}\r\n\r\nexport function resolveDataSource<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n): DataSource {\r\n  const ref = ModelClass.dataSource;\r\n  let dataSource: DataSource;\r\n\r\n  if (typeof ref === \"string\") {\r\n    dataSource = dataSourceRegistry.get(ref);\r\n  } else if (ref) {\r\n    dataSource = ref;\r\n  } else {\r\n    dataSource = dataSourceRegistry.get();\r\n  }\r\n\r\n  if (!ModelClass.hasOwnProperty(\"_defaultsApplied\")) {\r\n    const driverDefaults = dataSource.driver.modelDefaults || {};\r\n    const dataSourceDefaults = dataSource.modelDefaults || {};\r\n\r\n    const mergedDefaults = {\r\n      ...driverDefaults,\r\n      ...dataSourceDefaults,\r\n    };\r\n\r\n    if (Object.keys(mergedDefaults).length > 0) {\r\n      (ModelClass as any).applyModelDefaults(mergedDefaults);\r\n    }\r\n\r\n    (ModelClass as any)._defaultsApplied = true;\r\n  }\r\n\r\n  // First data-source resolution is the earliest per-class hook every model\r\n  // passes through — warn here (once) if the schema carries credential-shaped\r\n  // fields that toJSON() would expose.\r\n  warnUndeclaredSensitiveFields(ModelClass);\r\n\r\n  return dataSource;\r\n}\r\n"],"mappings":";;;;;AAYA,SAAgB,WACd,YACA,WAC8B;CAC9B,MAAM,eAAe,WAAW,gBAAwB;CASxD,aAAa,sBAAsB,IALP,IAAmC,CAC7D,GAAG,UAAU,cACb,GAAG,WAAW,YAChB,CAEiD;CACjD,aAAa,uBAAuB,WAAW;CAC/C,aAAa,uCAAuB,IAAI,IAAI;CAC5C,aAAa,sBAAsB,WAAW;CAC9C,aAAa,aAAa;CAE1B,WAAW,OAAO,CAAC,CAAC,aAAa,cAAc;EAC7C,OAAO,WAAW;EAClB,YAAY;CACd,CAAC;CAED,aAAa,SAAS,SAAc;EAClC,OAAO,WAAW,QAAQ,IAAI;CAChC,CAAC;CAMD,aAAa,UAAU,OAAO,WAAkB;EAC9C,MAAM,WAAW,OAAO,CAAC,CAAC,KAAK,WAAW,QAAe,CAAC,CAAC;CAC7D,CAAC;CAED,OAAO;AACT;AAEA,SAAgB,qBACd,YAC8B;CAC9B,MAAM,aAAa,WAAW,cAAc;CAE5C,IAAI,WAAW,SAAS;EACtB,MAAM,eAAe,WAAW;EAChC,OAAO,IAAI,aAAa,WAAW,OAAO,UAAU;CACtD;CAGA,OADqB,WAAW,OAAO,aAAqB,WAAW,KACrD;AACpB;AAEA,eAAsB,UACpB,YACA,QACwB;CACxB,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QACF,MAAM,MAAM,MAAM;CAEpB,OAAO,MAAM,MAAM;AACrB;AAEA,eAAsB,SACpB,YACA,QACwB;CACxB,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QACF,MAAM,MAAM,MAAM;CAGpB,OAAO,MAAM,KAAK;AACpB;AAEA,eAAsB,QACpB,YACA,QACmB;CACnB,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QACF,MAAM,MAAM,MAAM;CAEpB,OAAO,MAAM,IAAI;AACnB;AAEA,SAAgB,aACd,YACA,QACiB;CACjB,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QACF,MAAM,MAAM,MAAM;CAEpB,OAAO,MAAM,MAAM;AACrB;AAEA,eAAsB,SACpB,YACA,IACwB;CAExB,OADc,WAAW,MACd,CAAC,CAAC,MAAM,WAAW,YAAY,EAAE,CAAC,CAAC,MAAM;AACtD;AAEA,eAAsB,gBACpB,YACA,UAAoE,CAAC,GAClC;CACnC,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QAAQ,QACV,MAAM,MAAM,QAAQ,MAAM;CAG5B,OAAO,MAAM,SAAS;EACpB,OAAO,QAAQ;EACf,MAAM,QAAQ;CAChB,CAAC;AACH;AAEA,eAAsB,WACpB,YACA,QACmB;CACnB,MAAM,QAAQ,WAAW,MAAM;CAC/B,IAAI,QACF,MAAM,MAAM,MAAM;CAEpB,OAAQ,MAAM,MAAM,OAAO;AAC7B;AAEA,SAAgB,cACd,YACA,QACA,OACA,QACiB;CAEjB,OADc,WAAW,MAAM,CAAC,CAAC,MAAM,MAC5B,CAAC,CAAC,UAAU,OAAO,MAAM;AACtC;AAEA,SAAgB,cACd,YACA,QACA,OACA,QACiB;CAEjB,OADc,WAAW,MAAM,CAAC,CAAC,MAAM,MAC5B,CAAC,CAAC,UAAU,OAAO,MAAM;AACtC;AAMA,eAAsB,cACpB,YACA,QACA,YACiB;CAMjB,QAAO,MALc,WAAW,UAAU,CAAC,CAAC,OAC1C,WAAW,OACX,eAAe,MAAM,GACrB,UACF,EACa,CAAC;AAChB;AAEA,eAAsB,WACpB,YACA,IACA,MACiB;CAEjB,QAAO,MADc,WAAW,UAAU,CAAC,CAAC,OAAO,WAAW,OAAO,GAAG,WAAW,aAAa,GAAG,GAAG,EAAE,MAAM,KAAK,CAAC,EACvG,CAAC;AAChB;AAEA,eAAsB,qBACpB,YACA,QACA,QACmB;CACnB,MAAM,cAAc,YAAY,QAAQ,MAAM;CAC9C,OAAO,MAAM,WAAW,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI;AACpD;AAEA,eAAsB,uBACpB,YACA,QACA,QACwB;CACxB,MAAM,SAAS,MAAM,WAAW,UAAU,CAAC,CAAC,iBAC1C,WAAW,OACX,eAAe,MAAM,GACrB,MACF;CACA,IAAI,CAAC,QAAQ,OAAO;CAEpB,OAAO,IAAIA,WAAK,MAAM;AACxB;AAEA,eAAsB,qBACpB,YACA,QACA,UACwB;CACxB,MAAM,SAAS,MAAM,WAAW,UAAU,CAAC,CAAC,QAC1C,WAAW,OACX,eAAe,MAAM,GACrB,QACF;CACA,IAAI,CAAC,QAAQ,OAAO;CAEpB,OAAO,IAAIA,WAAK,MAAM;AACxB;AAEA,eAAsB,uBACpB,YACA,QACA,SACwB;CAExB,MAAM,SAAS,MADA,WAAW,UACA,CAAC,CAAC,iBAAiB,WAAW,OAAO,eAAe,MAAM,GAAG,OAAO;CAE9F,IAAI,CAAC,QACH,OAAO;CAGT,MAAM,QAAQ,WAAW,QAAQ,MAAiC;CAClE,MAAM,aAAa,MAAM;CACzB,OAAO;AACT;AAEA,SAAgB,kBACd,YACY;CACZ,MAAM,MAAM,WAAW;CACvB,IAAI;CAEJ,IAAI,OAAO,QAAQ,UACjB,aAAa,mBAAmB,IAAI,GAAG;MAClC,IAAI,KACT,aAAa;MAEb,aAAa,mBAAmB,IAAI;CAGtC,IAAI,CAAC,WAAW,eAAe,kBAAkB,GAAG;EAClD,MAAM,iBAAiB,WAAW,OAAO,iBAAiB,CAAC;EAC3D,MAAM,qBAAqB,WAAW,iBAAiB,CAAC;EAExD,MAAM,iBAAiB;GACrB,GAAG;GACH,GAAG;EACL;EAEA,IAAI,OAAO,KAAK,cAAc,CAAC,CAAC,SAAS,GACvC,AAAC,WAAmB,mBAAmB,cAAc;EAGvD,AAAC,WAAmB,mBAAmB;CACzC;CAKA,8BAA8B,UAAU;CAExC,OAAO;AACT"}

package/esm/model/methods/serialization-methods.mjs

@@ -1,20 +1,65 @@
 //#region ../cascade/src/model/methods/serialization-methods.ts
+/**
+* Field names that commonly hold credentials/secrets. Used only to emit a
+* one-time warning when such a field exists in a model's schema but is not
+* covered by `hidden`/`resource`/`toJsonColumns` — the fail-open default
+* (`toJSON()` returns the raw document) would leak it.
+*/
+const SENSITIVE_FIELD_PATTERN = /^(password|passwordHash|secret|token|apiKey|api_key)$/i;
+const warnedModelClasses = /* @__PURE__ */ new WeakSet();
+/**
+* Warn once per model class when its schema declares a sensitive-looking field
+* that serialization would expose: no `hidden` entry for it, no `resource`
+* class, and no `toJsonColumns` allow-list excluding it.
+*
+* A warning rather than an error — the fail-open `toJSON()` default is kept
+* for compatibility, but it should at least be loud.
+*/
+function warnUndeclaredSensitiveFields(ModelClass) {
+	if (warnedModelClasses.has(ModelClass)) return;
+	warnedModelClasses.add(ModelClass);
+	const schema = ModelClass.schema;
+	if (!schema) return;
+	const hidden = ModelClass.hidden ?? [];
+	const toJsonColumns = ModelClass.toJsonColumns;
+	const exposed = Object.keys(schema.schema).filter((field) => {
+		if (!SENSITIVE_FIELD_PATTERN.test(field)) return false;
+		if (hidden.includes(field)) return false;
+		if (ModelClass.resource) return false;
+		if (toJsonColumns && toJsonColumns.length > 0 && !toJsonColumns.includes(field)) return false;
+		return true;
+	});
+	if (exposed.length === 0) return;
+	console.warn(`[cascade] Model "${ModelClass.name}" (table "${ModelClass.table}") has sensitive-looking schema field(s) ${exposed.map((field) => `"${field}"`).join(", ")} that toJSON()/JSON.stringify() will include in output. Add them to \`static hidden = [...]\` (or configure \`resource\`/\`toJsonColumns\`) so they cannot leak via res.json(model).`);
+}
+/**
+* Return `data` without the model's `hidden` top-level fields.
+* Returns `data` untouched (same reference) when nothing is hidden.
+*/
+function stripHiddenFields(data, hidden) {
+	if (hidden.length === 0) return data;
+	const output = { ...data };
+	for (const field of hidden) delete output[field];
+	return output;
+}
 function modelToJSON(model) {
 	const ModelClass = model.self();
 	const resource = ModelClass.resource;
+	const hidden = ModelClass.hidden ?? [];
+	warnUndeclaredSensitiveFields(ModelClass);
 	if (!resource) {
 		const toJsonColumns = ModelClass.toJsonColumns;
-		if (toJsonColumns && toJsonColumns.length > 0) return model.only(toJsonColumns);
-		return model.data;
+		if (toJsonColumns && toJsonColumns.length > 0) return stripHiddenFields(model.only(toJsonColumns), hidden);
+		return stripHiddenFields(model.data, hidden);
 	}
 	const resourceColumns = ModelClass.resourceColumns;
 	let data = resourceColumns !== void 0 && resourceColumns.length > 0 ? model.only(resourceColumns) : { ...model.data };
 	for (const [relationName, relatedModel] of model.loadedRelations) if (Array.isArray(relatedModel)) data[relationName] = relatedModel.map((m) => m instanceof Object && typeof m.toJSON === "function" ? m.toJSON() : m);
 	else if (relatedModel instanceof Object && typeof relatedModel.toJSON === "function") data[relationName] = relatedModel.toJSON();
 	else data[relationName] = relatedModel;
-	return new resource(data).toJSON();
+	return new resource(stripHiddenFields(data, hidden)).toJSON();
 }
 
 //#endregion
-export { modelToJSON };
+export { modelToJSON, warnUndeclaredSensitiveFields };
 //# sourceMappingURL=serialization-methods.mjs.map

package/esm/model/methods/serialization-methods.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"serialization-methods.mjs","names":[],"sources":["../../../../../../../../cascade/src/model/methods/serialization-methods.ts"],"sourcesContent":["import type { GenericObject } from \"@mongez/reinforcements\";\nimport type { Model } from \"../model\";\n\nexport function modelToJSON(model: Model): Record<string, unknown> {\n  const ModelClass = model.self();\n  const resource = ModelClass.resource;\n\n  if (!resource) {\n    const toJsonColumns = ModelClass.toJsonColumns;\n    if (toJsonColumns && toJsonColumns.length > 0) {\n      return model.only(toJsonColumns);\n    }\n    return model.data;\n  }\n\n  const resourceColumns = ModelClass.resourceColumns;\n  let data: GenericObject =\n    resourceColumns !== undefined && resourceColumns.length > 0\n      ? model.only(resourceColumns)\n      : { ...model.data };\n\n  for (const [relationName, relatedModel] of model.loadedRelations) {\n    if (Array.isArray(relatedModel)) {\n      data[relationName] = relatedModel.map((m) =>\n        m instanceof Object && typeof m.toJSON === \"function\" ? m.toJSON() : m,\n      );\n    } else if (relatedModel instanceof Object && typeof relatedModel.toJSON === \"function\") {\n      data[relationName] = relatedModel.toJSON();\n    } else {\n      data[relationName] = relatedModel;\n    }\n  }\n\n  return new resource(data).toJSON();\n}\n"],"mappings":";AAGA,SAAgB,YAAY,OAAuC;CACjE,MAAM,aAAa,MAAM,KAAK;CAC9B,MAAM,WAAW,WAAW;CAE5B,IAAI,CAAC,UAAU;EACb,MAAM,gBAAgB,WAAW;EACjC,IAAI,iBAAiB,cAAc,SAAS,GAC1C,OAAO,MAAM,KAAK,aAAa;EAEjC,OAAO,MAAM;CACf;CAEA,MAAM,kBAAkB,WAAW;CACnC,IAAI,OACF,oBAAoB,UAAa,gBAAgB,SAAS,IACtD,MAAM,KAAK,eAAe,IAC1B,EAAE,GAAG,MAAM,KAAK;CAEtB,KAAK,MAAM,CAAC,cAAc,iBAAiB,MAAM,iBAC/C,IAAI,MAAM,QAAQ,YAAY,GAC5B,KAAK,gBAAgB,aAAa,KAAK,MACrC,aAAa,UAAU,OAAO,EAAE,WAAW,aAAa,EAAE,OAAO,IAAI,CACvE;MACK,IAAI,wBAAwB,UAAU,OAAO,aAAa,WAAW,YAC1E,KAAK,gBAAgB,aAAa,OAAO;MAEzC,KAAK,gBAAgB;CAIzB,OAAO,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO;AACnC"}
+{"version":3,"file":"serialization-methods.mjs","names":[],"sources":["../../../../../../../../cascade/src/model/methods/serialization-methods.ts"],"sourcesContent":["import type { GenericObject } from \"@mongez/reinforcements\";\nimport type { ChildModel, Model } from \"../model\";\n\n/**\n * Field names that commonly hold credentials/secrets. Used only to emit a\n * one-time warning when such a field exists in a model's schema but is not\n * covered by `hidden`/`resource`/`toJsonColumns` — the fail-open default\n * (`toJSON()` returns the raw document) would leak it.\n */\nconst SENSITIVE_FIELD_PATTERN = /^(password|passwordHash|secret|token|apiKey|api_key)$/i;\n\nconst warnedModelClasses = new WeakSet<object>();\n\n/**\n * Warn once per model class when its schema declares a sensitive-looking field\n * that serialization would expose: no `hidden` entry for it, no `resource`\n * class, and no `toJsonColumns` allow-list excluding it.\n *\n * A warning rather than an error — the fail-open `toJSON()` default is kept\n * for compatibility, but it should at least be loud.\n */\nexport function warnUndeclaredSensitiveFields(ModelClass: ChildModel<Model>): void {\n  if (warnedModelClasses.has(ModelClass)) return;\n  warnedModelClasses.add(ModelClass);\n\n  const schema = ModelClass.schema;\n  if (!schema) return;\n\n  const hidden = ModelClass.hidden ?? [];\n  const toJsonColumns = ModelClass.toJsonColumns;\n\n  const exposed = Object.keys(schema.schema).filter((field) => {\n    if (!SENSITIVE_FIELD_PATTERN.test(field)) return false;\n    if (hidden.includes(field)) return false;\n    if (ModelClass.resource) return false;\n    if (toJsonColumns && toJsonColumns.length > 0 && !toJsonColumns.includes(field)) return false;\n    return true;\n  });\n\n  if (exposed.length === 0) return;\n\n  console.warn(\n    `[cascade] Model \"${ModelClass.name}\" (table \"${ModelClass.table}\") has sensitive-looking schema field(s) ${exposed\n      .map((field) => `\"${field}\"`)\n      .join(\", \")} that toJSON()/JSON.stringify() will include in output. ` +\n      `Add them to \\`static hidden = [...]\\` (or configure \\`resource\\`/\\`toJsonColumns\\`) so they cannot leak via res.json(model).`,\n  );\n}\n\n/**\n * Return `data` without the model's `hidden` top-level fields.\n * Returns `data` untouched (same reference) when nothing is hidden.\n */\nfunction stripHiddenFields(\n  data: Record<string, unknown>,\n  hidden: string[],\n): Record<string, unknown> {\n  if (hidden.length === 0) return data;\n\n  const output = { ...data };\n  for (const field of hidden) {\n    delete output[field];\n  }\n  return output;\n}\n\nexport function modelToJSON(model: Model): Record<string, unknown> {\n  const ModelClass = model.self();\n  const resource = ModelClass.resource;\n  const hidden = ModelClass.hidden ?? [];\n\n  warnUndeclaredSensitiveFields(ModelClass);\n\n  if (!resource) {\n    const toJsonColumns = ModelClass.toJsonColumns;\n    if (toJsonColumns && toJsonColumns.length > 0) {\n      return stripHiddenFields(model.only(toJsonColumns), hidden);\n    }\n    return stripHiddenFields(model.data, hidden);\n  }\n\n  const resourceColumns = ModelClass.resourceColumns;\n  let data: GenericObject =\n    resourceColumns !== undefined && resourceColumns.length > 0\n      ? model.only(resourceColumns)\n      : { ...model.data };\n\n  for (const [relationName, relatedModel] of model.loadedRelations) {\n    if (Array.isArray(relatedModel)) {\n      data[relationName] = relatedModel.map((m) =>\n        m instanceof Object && typeof m.toJSON === \"function\" ? m.toJSON() : m,\n      );\n    } else if (relatedModel instanceof Object && typeof relatedModel.toJSON === \"function\") {\n      data[relationName] = relatedModel.toJSON();\n    } else {\n      data[relationName] = relatedModel;\n    }\n  }\n\n  return new resource(stripHiddenFields(data, hidden)).toJSON();\n}\n"],"mappings":";;;;;;;AASA,MAAM,0BAA0B;AAEhC,MAAM,qCAAqB,IAAI,QAAgB;;;;;;;;;AAU/C,SAAgB,8BAA8B,YAAqC;CACjF,IAAI,mBAAmB,IAAI,UAAU,GAAG;CACxC,mBAAmB,IAAI,UAAU;CAEjC,MAAM,SAAS,WAAW;CAC1B,IAAI,CAAC,QAAQ;CAEb,MAAM,SAAS,WAAW,UAAU,CAAC;CACrC,MAAM,gBAAgB,WAAW;CAEjC,MAAM,UAAU,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,QAAQ,UAAU;EAC3D,IAAI,CAAC,wBAAwB,KAAK,KAAK,GAAG,OAAO;EACjD,IAAI,OAAO,SAAS,KAAK,GAAG,OAAO;EACnC,IAAI,WAAW,UAAU,OAAO;EAChC,IAAI,iBAAiB,cAAc,SAAS,KAAK,CAAC,cAAc,SAAS,KAAK,GAAG,OAAO;EACxF,OAAO;CACT,CAAC;CAED,IAAI,QAAQ,WAAW,GAAG;CAE1B,QAAQ,KACN,oBAAoB,WAAW,KAAK,YAAY,WAAW,MAAM,2CAA2C,QACzG,KAAK,UAAU,IAAI,MAAM,EAAE,CAAC,CAC5B,KAAK,IAAI,EAAE,qLAEhB;AACF;;;;;AAMA,SAAS,kBACP,MACA,QACyB;CACzB,IAAI,OAAO,WAAW,GAAG,OAAO;CAEhC,MAAM,SAAS,EAAE,GAAG,KAAK;CACzB,KAAK,MAAM,SAAS,QAClB,OAAO,OAAO;CAEhB,OAAO;AACT;AAEA,SAAgB,YAAY,OAAuC;CACjE,MAAM,aAAa,MAAM,KAAK;CAC9B,MAAM,WAAW,WAAW;CAC5B,MAAM,SAAS,WAAW,UAAU,CAAC;CAErC,8BAA8B,UAAU;CAExC,IAAI,CAAC,UAAU;EACb,MAAM,gBAAgB,WAAW;EACjC,IAAI,iBAAiB,cAAc,SAAS,GAC1C,OAAO,kBAAkB,MAAM,KAAK,aAAa,GAAG,MAAM;EAE5D,OAAO,kBAAkB,MAAM,MAAM,MAAM;CAC7C;CAEA,MAAM,kBAAkB,WAAW;CACnC,IAAI,OACF,oBAAoB,UAAa,gBAAgB,SAAS,IACtD,MAAM,KAAK,eAAe,IAC1B,EAAE,GAAG,MAAM,KAAK;CAEtB,KAAK,MAAM,CAAC,cAAc,iBAAiB,MAAM,iBAC/C,IAAI,MAAM,QAAQ,YAAY,GAC5B,KAAK,gBAAgB,aAAa,KAAK,MACrC,aAAa,UAAU,OAAO,EAAE,WAAW,aAAa,EAAE,OAAO,IAAI,CACvE;MACK,IAAI,wBAAwB,UAAU,OAAO,aAAa,WAAW,YAC1E,KAAK,gBAAgB,aAAa,OAAO;MAEzC,KAAK,gBAAgB;CAIzB,OAAO,IAAI,SAAS,kBAAkB,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO;AAC9D"}

package/esm/model/methods/write-methods.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"write-methods.d.mts","names":[],"sources":["../../../../../../../../cascade/src/model/methods/write-methods.ts"],"mappings":";;;;KAmBY,iBAAA;;;;;;EAMV,SAAA;;;;;;;;;;;;;;EAeA,IAAI;AAAA"}
+{"version":3,"file":"write-methods.d.mts","names":[],"sources":["../../../../../../../../cascade/src/model/methods/write-methods.ts"],"mappings":";;;;KAoBY,iBAAA;;;;;;EAMV,SAAA;;;;;;;;;;;;;;EAeA,IAAI;AAAA"}

package/esm/model/methods/write-methods.mjs

@@ -1,3 +1,4 @@
+import { mergeDriverFields } from "./accessor-methods.mjs";
 import { emitModelEvent } from "./instance-event-methods.mjs";
 import { DatabaseWriter } from "../../writer/database-writer.mjs";
 
@@ -163,10 +164,7 @@ async function createManyBulk(ModelClass, chunks) {
 			const results = await driver.insertMany(table, preparedDocuments);
 			models.forEach((model, index) => {
 				const result = results[index];
-				if (result) {
-					const returnedDocument = "document" in result ? result.document : result;
-					model.merge(returnedDocument);
-				}
+				if (result) mergeDriverFields(model, "document" in result ? result.document : result);
 				model.dirtyTracker.reset();
 				model.isNew = false;
 			});

package/esm/model/methods/write-methods.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"write-methods.mjs","names":[],"sources":["../../../../../../../../cascade/src/model/methods/write-methods.ts"],"sourcesContent":["import { DatabaseWriter } from \"../../writer/database-writer\";\nimport type { InsertResult, WriterOptions } from \"../../contracts\";\nimport type { ChildModel, Model, ModelSchema } from \"../model\";\nimport { emitModelEvent } from \"./instance-event-methods\";\n\n/**\n * Default number of rows processed per chunk by {@link createManyRecords}.\n *\n * Chunking keeps a single huge `createMany` call from flooding the driver:\n * the default path runs each chunk's `save()` calls under one `Promise.all`,\n * and the bulk path emits one multi-row `insertMany` per chunk so the\n * generated `INSERT ... VALUES (...),(...)` stays under the database's bind\n * parameter ceiling.\n */\nexport const DEFAULT_CREATE_MANY_BATCH_SIZE = 500;\n\n/**\n * Options for {@link createManyRecords} (and `Model.createMany`).\n */\nexport type CreateManyOptions = {\n  /**\n   * Number of rows processed per chunk.\n   *\n   * @default 500 ({@link DEFAULT_CREATE_MANY_BATCH_SIZE})\n   */\n  batchSize?: number;\n\n  /**\n   * Route each chunk through the driver's native multi-row insert\n   * (`insertMany`) instead of per-row `save()`.\n   *\n   * **Tradeoff:** the bulk path is 10–100× faster for large arrays but\n   * SKIPS the per-row lifecycle: `saving` / `creating` / `created` / `saved`\n   * events, instance hooks, and sync operations are NOT emitted. Casts,\n   * timestamps, defaults and id-generation that the writer normally applies\n   * ARE still applied (the rows are prepped through the same writer pipeline),\n   * so persisted columns match the default path.\n   *\n   * @default false\n   */\n  bulk?: boolean;\n};\n\nexport async function saveModel<TModel extends Model>(\n  model: TModel,\n  options?: WriterOptions & { merge?: Partial<ModelSchema> },\n): Promise<TModel> {\n  if (options?.merge) {\n    model.merge(options.merge);\n  }\n  const writer = new DatabaseWriter(model);\n  await writer.save(options);\n  return model;\n}\n\nexport async function createRecord<\n  TModel extends Model,\n  TSchema extends ModelSchema = TModel extends Model<infer S> ? S : ModelSchema,\n>(ModelClass: ChildModel<TModel>, data: Partial<TSchema>): Promise<TModel> {\n  const model = new ModelClass(data);\n  await model.save();\n  return model;\n}\n\n/**\n * Split an array into sequential chunks of at most `size` elements.\n *\n * @param items - The array to split.\n * @param size - Maximum chunk length (callers pass a value `>= 1`).\n * @returns An array of chunks preserving the original order.\n */\nfunction chunkArray<TItem>(items: TItem[], size: number): TItem[][] {\n  const chunks: TItem[][] = [];\n\n  for (let index = 0; index < items.length; index += size) {\n    chunks.push(items.slice(index, index + size));\n  }\n\n  return chunks;\n}\n\n/**\n * Create many records, chunking the work so a huge array can't overwhelm the\n * driver.\n *\n * Two strategies are available via `options.bulk`:\n *\n * - **Default (`bulk` falsy):** each row is persisted through `save()`, so\n *   model hooks, lifecycle events, casts and generated ids are all preserved.\n *   Rows are processed in sequential chunks of `batchSize`, each chunk running\n *   under a single `Promise.all`, so an array of millions of rows can't open\n *   millions of concurrent inserts at once.\n *\n * - **Bulk (`bulk: true`):** each chunk is routed to the driver's native\n *   multi-row insert (`insertMany`) for 10–100× throughput. This SKIPS the\n *   per-row save lifecycle (no `saving` / `creating` / `created` / `saved`\n *   events, hooks, or sync). Rows are still prepped through the writer\n *   pipeline (validation, casting, timestamps, defaults, id-generation) so the\n *   persisted columns match the default path, and the values returned by the\n *   driver (generated `_id`, timestamps, SQL `RETURNING *`) are merged back\n *   onto the returned models.\n *\n * Both strategies return the created model instances (an empty array is a\n * no-op that never touches the driver).\n *\n * @param ModelClass - The model class to create records for.\n * @param data - The rows to insert.\n * @param options - Chunking / bulk options.\n * @returns The created model instances.\n *\n * @example\n * ```typescript\n * // Default: per-row save(), chunked in batches of 500\n * const users = await User.createMany(rows);\n *\n * // Bulk: one multi-row INSERT per 1000-row chunk (skips per-row hooks)\n * const users = await User.createMany(rows, { bulk: true, batchSize: 1000 });\n * ```\n */\nexport async function createManyRecords<\n  TModel extends Model,\n  TSchema extends ModelSchema = TModel extends Model<infer S> ? S : ModelSchema,\n>(\n  ModelClass: ChildModel<TModel>,\n  data: Partial<TSchema>[],\n  options: CreateManyOptions = {},\n): Promise<TModel[]> {\n  if (data.length === 0) {\n    return [];\n  }\n\n  const batchSize =\n    options.batchSize && options.batchSize > 0\n      ? options.batchSize\n      : DEFAULT_CREATE_MANY_BATCH_SIZE;\n\n  const chunks = chunkArray(data, batchSize);\n\n  if (options.bulk === true) {\n    return await createManyBulk(ModelClass, chunks);\n  }\n\n  const created: TModel[] = [];\n\n  for (const chunk of chunks) {\n    const models = chunk.map((item) => new ModelClass(item)) as TModel[];\n\n    // Reserve one contiguous id block for the whole chunk (1 counter op instead\n    // of N), pre-seeding each id-less model so its per-row save() no-ops id-gen.\n    await assignIdBlock(ModelClass, models);\n\n    const chunkModels = await Promise.all(\n      models.map(async (model) => {\n        await model.save();\n        return model;\n      }),\n    );\n\n    created.push(...chunkModels);\n  }\n\n  return created;\n}\n\n/**\n * Reserve a single contiguous id block for one chunk and pre-assign the ids to\n * the models that don't already carry one, so the per-row writer's id\n * generation no-ops (its `model.get(\"id\")` guard short-circuits). This turns N\n * per-row counter round-trips into ONE per chunk.\n *\n * Falls back to per-row generation (a no-op here) when:\n * - the model disables auto-generation (`autoGenerateId === false`) — e.g. SQL,\n *   which uses native `SERIAL`;\n * - the data source's id generator has no batch API (`generateNextIds`) — the\n *   optional contract member is feature-detected;\n * - the model uses a random initial id / increment — a random stride can't form\n *   a contiguous block, so those models keep per-row generation.\n *\n * Only models WITHOUT a caller-supplied id consume a block slot, so a chunk\n * mixing supplied and auto ids allocates exactly the right number (no gaps).\n *\n * @param ModelClass - The model class being inserted.\n * @param models - The freshly-constructed (unsaved) models for one chunk.\n */\nasync function assignIdBlock<TModel extends Model>(\n  ModelClass: ChildModel<TModel>,\n  models: TModel[],\n): Promise<void> {\n  if (!ModelClass.autoGenerateId || ModelClass.randomInitialId || ModelClass.randomIncrement) {\n    return;\n  }\n\n  const idGenerator = ModelClass.getDataSource().idGenerator;\n\n  if (!idGenerator || typeof idGenerator.generateNextIds !== \"function\") {\n    return;\n  }\n\n  const idLessModels = models.filter((model) => !model.get(\"id\"));\n\n  if (idLessModels.length === 0) {\n    return;\n  }\n\n  const ids = await idGenerator.generateNextIds({\n    table: ModelClass.table,\n    initialId: ModelClass.initialId || 1,\n    incrementIdBy: ModelClass.incrementIdBy || 1,\n    count: idLessModels.length,\n  });\n\n  // Enforce the contract at this pluggable, feature-detected boundary: a\n  // non-conforming generator returning the wrong count would otherwise set\n  // `id = undefined` on the unmatched rows, the per-row writer would silently\n  // re-generate single ids, and the reserved block would no longer match what\n  // is persisted. Fail loud instead of corrupting the sequence.\n  if (ids.length !== idLessModels.length) {\n    throw new Error(\n      `generateNextIds returned ${ids.length} id(s) for ${idLessModels.length} row(s) on ` +\n        `\"${ModelClass.table}\" — a batch id generator must return exactly the requested count.`,\n    );\n  }\n\n  idLessModels.forEach((model, index) => {\n    model.set(\"id\", ids[index]);\n  });\n}\n\n/**\n * Bulk variant of {@link createManyRecords}: prep each row through the writer\n * pipeline (validation, casting, timestamps, defaults, id-generation) without\n * touching the database, then flush each chunk with a single\n * `driver.insertMany` call.\n *\n * The writer reuse is achieved by swapping the driver's single-row `insert`\n * for a capturing stub for the lifetime of the bulk operation: running\n * `writer.save({ skipEvents, skipSync })` exercises the real prep but records\n * the prepared document instead of issuing N single-row inserts. The original\n * `insert` is always restored in `finally`.\n *\n * @param ModelClass - The model class to create records for.\n * @param chunks - Pre-chunked rows.\n * @returns The created model instances with driver-returned values merged in.\n */\nasync function createManyBulk<\n  TModel extends Model,\n  TSchema extends ModelSchema = TModel extends Model<infer S> ? S : ModelSchema,\n>(ModelClass: ChildModel<TModel>, chunks: Partial<TSchema>[][]): Promise<TModel[]> {\n  const dataSource = ModelClass.getDataSource();\n  const driver = dataSource.driver;\n  const table = ModelClass.table;\n  // Keep the exact original reference so it can be restored verbatim (binding a\n  // copy would, for a spied driver, replace the spy with a non-spy wrapper).\n  const originalInsert = driver.insert;\n\n  // Capture the prepared (validated/casted/timestamped/id-generated) document\n  // instead of inserting it per row, so the writer's prep runs exactly once\n  // per model while the actual write is deferred to a single insertMany.\n  driver.insert = (async (\n    _table: string,\n    document: Record<string, unknown>,\n  ): Promise<InsertResult> => {\n    return { document };\n  }) as typeof driver.insert;\n\n  const created: TModel[] = [];\n\n  try {\n    for (const chunk of chunks) {\n      const models = chunk.map((item) => new ModelClass(item)) as TModel[];\n\n      // Reserve one contiguous id block for the whole chunk (1 counter op\n      // instead of N), pre-seeding each id-less model so the per-row writer's\n      // id generation no-ops.\n      await assignIdBlock(ModelClass, models);\n\n      // Prep every model through the real writer pipeline. The captured\n      // `insert` keeps this off the wire while still mutating each model's\n      // data with casts/timestamps/defaults/generated ids.\n      const preparedDocuments = await Promise.all(\n        models.map(async (model) => {\n          const writer = new DatabaseWriter(model);\n          await writer.save({ skipEvents: true, skipSync: true });\n          return { ...model.data } as Record<string, unknown>;\n        }),\n      );\n\n      const results = await driver.insertMany(table, preparedDocuments);\n\n      // Merge driver-returned values (generated _id, timestamps, RETURNING *)\n      // back onto each model so the returned instances reflect persisted state.\n      models.forEach((model, index) => {\n        const result = results[index] as InsertResult | Record<string, unknown> | undefined;\n\n        if (result) {\n          const returnedDocument =\n            \"document\" in (result as Record<string, unknown>)\n              ? (result as InsertResult).document\n              : result;\n\n          model.merge(returnedDocument as Record<string, unknown>);\n        }\n\n        model.dirtyTracker.reset();\n        model.isNew = false;\n      });\n\n      created.push(...models);\n    }\n  } finally {\n    driver.insert = originalInsert;\n  }\n\n  return created;\n}\n\nexport async function findOrCreateRecord<\n  TModel extends Model,\n  TSchema extends ModelSchema = TModel extends Model<infer S> ? S : ModelSchema,\n>(\n  ModelClass: ChildModel<TModel>,\n  filter: Partial<TSchema>,\n  data: Partial<TSchema>,\n): Promise<TModel> {\n  const existing = await ModelClass.first(filter as Record<string, unknown>);\n\n  if (existing) {\n    return existing;\n  }\n\n  return await createRecord(ModelClass, { ...filter, ...data } as Partial<TSchema>);\n}\n\nexport async function upsertRecord<\n  TModel extends Model,\n  TSchema extends ModelSchema = TModel extends Model<infer S> ? S : ModelSchema,\n>(\n  ModelClass: ChildModel<TModel>,\n  filter: Partial<TSchema>,\n  data: Partial<TSchema>,\n  options?: Record<string, unknown>,\n): Promise<TModel> {\n  const driver = ModelClass.getDriver();\n  const mergedData = { ...filter, ...data } as Record<string, unknown>;\n\n  const tempModel = new ModelClass(mergedData as Partial<TSchema>);\n  tempModel.isNew = true;\n\n  await emitModelEvent(tempModel, \"saving\", {\n    isInsert: true,\n    options,\n    mode: \"upsert\",\n  });\n\n  const createdAtColumn = ModelClass.createdAtColumn;\n  const updatedAtColumn = ModelClass.updatedAtColumn;\n\n  if (createdAtColumn !== false && createdAtColumn !== undefined) {\n    const createdAtKey = createdAtColumn as string;\n    if (!mergedData[createdAtKey]) {\n      mergedData[createdAtKey] = new Date();\n    }\n  }\n\n  if (updatedAtColumn !== false && updatedAtColumn !== undefined) {\n    const updatedAtKey = updatedAtColumn as string;\n    mergedData[updatedAtKey] = new Date();\n  }\n\n  await emitModelEvent(tempModel, \"saving\", { filter, data: mergedData, options, mode: \"upsert\" });\n\n  const result = await driver.upsert(ModelClass.table, filter as Record<string, unknown>, mergedData, options);\n\n  const model = ModelClass.hydrate(result as Record<string, unknown>) as TModel;\n  model.dirtyTracker.reset();\n\n  await emitModelEvent(model, \"saved\", { filter, data: result, options, mode: \"upsert\" });\n\n  return model;\n}\n"],"mappings":";;;;;;;;;;;;;AAcA,MAAa,iCAAiC;AA6B9C,eAAsB,UACpB,OACA,SACiB;CACjB,IAAI,SAAS,OACX,MAAM,MAAM,QAAQ,KAAK;CAG3B,MAAM,IADa,eAAe,KACvB,CAAC,CAAC,KAAK,OAAO;CACzB,OAAO;AACT;AAEA,eAAsB,aAGpB,YAAgC,MAAyC;CACzE,MAAM,QAAQ,IAAI,WAAW,IAAI;CACjC,MAAM,MAAM,KAAK;CACjB,OAAO;AACT;;;;;;;;AASA,SAAS,WAAkB,OAAgB,MAAyB;CAClE,MAAM,SAAoB,CAAC;CAE3B,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,MACjD,OAAO,KAAK,MAAM,MAAM,OAAO,QAAQ,IAAI,CAAC;CAG9C,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,eAAsB,kBAIpB,YACA,MACA,UAA6B,CAAC,GACX;CACnB,IAAI,KAAK,WAAW,GAClB,OAAO,CAAC;CAQV,MAAM,SAAS,WAAW,MAJxB,QAAQ,aAAa,QAAQ,YAAY,IACrC,QAAQ,eAG2B;CAEzC,IAAI,QAAQ,SAAS,MACnB,OAAO,MAAM,eAAe,YAAY,MAAM;CAGhD,MAAM,UAAoB,CAAC;CAE3B,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,SAAS,MAAM,KAAK,SAAS,IAAI,WAAW,IAAI,CAAC;EAIvD,MAAM,cAAc,YAAY,MAAM;EAEtC,MAAM,cAAc,MAAM,QAAQ,IAChC,OAAO,IAAI,OAAO,UAAU;GAC1B,MAAM,MAAM,KAAK;GACjB,OAAO;EACT,CAAC,CACH;EAEA,QAAQ,KAAK,GAAG,WAAW;CAC7B;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;AAsBA,eAAe,cACb,YACA,QACe;CACf,IAAI,CAAC,WAAW,kBAAkB,WAAW,mBAAmB,WAAW,iBACzE;CAGF,MAAM,cAAc,WAAW,cAAc,CAAC,CAAC;CAE/C,IAAI,CAAC,eAAe,OAAO,YAAY,oBAAoB,YACzD;CAGF,MAAM,eAAe,OAAO,QAAQ,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC;CAE9D,IAAI,aAAa,WAAW,GAC1B;CAGF,MAAM,MAAM,MAAM,YAAY,gBAAgB;EAC5C,OAAO,WAAW;EAClB,WAAW,WAAW,aAAa;EACnC,eAAe,WAAW,iBAAiB;EAC3C,OAAO,aAAa;CACtB,CAAC;CAOD,IAAI,IAAI,WAAW,aAAa,QAC9B,MAAM,IAAI,MACR,4BAA4B,IAAI,OAAO,aAAa,aAAa,OAAO,cAClE,WAAW,MAAM,kEACzB;CAGF,aAAa,SAAS,OAAO,UAAU;EACrC,MAAM,IAAI,MAAM,IAAI,MAAM;CAC5B,CAAC;AACH;;;;;;;;;;;;;;;;;AAkBA,eAAe,eAGb,YAAgC,QAAiD;CAEjF,MAAM,SADa,WAAW,cACN,CAAC,CAAC;CAC1B,MAAM,QAAQ,WAAW;CAGzB,MAAM,iBAAiB,OAAO;CAK9B,OAAO,UAAU,OACf,QACA,aAC0B;EAC1B,OAAO,EAAE,SAAS;CACpB;CAEA,MAAM,UAAoB,CAAC;CAE3B,IAAI;EACF,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,SAAS,MAAM,KAAK,SAAS,IAAI,WAAW,IAAI,CAAC;GAKvD,MAAM,cAAc,YAAY,MAAM;GAKtC,MAAM,oBAAoB,MAAM,QAAQ,IACtC,OAAO,IAAI,OAAO,UAAU;IAE1B,MAAM,IADa,eAAe,KACvB,CAAC,CAAC,KAAK;KAAE,YAAY;KAAM,UAAU;IAAK,CAAC;IACtD,OAAO,EAAE,GAAG,MAAM,KAAK;GACzB,CAAC,CACH;GAEA,MAAM,UAAU,MAAM,OAAO,WAAW,OAAO,iBAAiB;GAIhE,OAAO,SAAS,OAAO,UAAU;IAC/B,MAAM,SAAS,QAAQ;IAEvB,IAAI,QAAQ;KACV,MAAM,mBACJ,cAAe,SACV,OAAwB,WACzB;KAEN,MAAM,MAAM,gBAA2C;IACzD;IAEA,MAAM,aAAa,MAAM;IACzB,MAAM,QAAQ;GAChB,CAAC;GAED,QAAQ,KAAK,GAAG,MAAM;EACxB;CACF,UAAU;EACR,OAAO,SAAS;CAClB;CAEA,OAAO;AACT;AAEA,eAAsB,mBAIpB,YACA,QACA,MACiB;CACjB,MAAM,WAAW,MAAM,WAAW,MAAM,MAAiC;CAEzE,IAAI,UACF,OAAO;CAGT,OAAO,MAAM,aAAa,YAAY;EAAE,GAAG;EAAQ,GAAG;CAAK,CAAqB;AAClF;AAEA,eAAsB,aAIpB,YACA,QACA,MACA,SACiB;CACjB,MAAM,SAAS,WAAW,UAAU;CACpC,MAAM,aAAa;EAAE,GAAG;EAAQ,GAAG;CAAK;CAExC,MAAM,YAAY,IAAI,WAAW,UAA8B;CAC/D,UAAU,QAAQ;CAElB,MAAM,eAAe,WAAW,UAAU;EACxC,UAAU;EACV;EACA,MAAM;CACR,CAAC;CAED,MAAM,kBAAkB,WAAW;CACnC,MAAM,kBAAkB,WAAW;CAEnC,IAAI,oBAAoB,SAAS,oBAAoB,QAAW;EAC9D,MAAM,eAAe;EACrB,IAAI,CAAC,WAAW,eACd,WAAW,gCAAgB,IAAI,KAAK;CAExC;CAEA,IAAI,oBAAoB,SAAS,oBAAoB,QAAW;EAC9D,MAAM,eAAe;EACrB,WAAW,gCAAgB,IAAI,KAAK;CACtC;CAEA,MAAM,eAAe,WAAW,UAAU;EAAE;EAAQ,MAAM;EAAY;EAAS,MAAM;CAAS,CAAC;CAE/F,MAAM,SAAS,MAAM,OAAO,OAAO,WAAW,OAAO,QAAmC,YAAY,OAAO;CAE3G,MAAM,QAAQ,WAAW,QAAQ,MAAiC;CAClE,MAAM,aAAa,MAAM;CAEzB,MAAM,eAAe,OAAO,SAAS;EAAE;EAAQ,MAAM;EAAQ;EAAS,MAAM;CAAS,CAAC;CAEtF,OAAO;AACT"}
+{"version":3,"file":"write-methods.mjs","names":[],"sources":["../../../../../../../../cascade/src/model/methods/write-methods.ts"],"sourcesContent":["import { DatabaseWriter } from \"../../writer/database-writer\";\r\nimport type { InsertResult, WriterOptions } from \"../../contracts\";\r\nimport type { ChildModel, Model, ModelSchema } from \"../model\";\r\nimport { mergeDriverFields } from \"./accessor-methods\";\r\nimport { emitModelEvent } from \"./instance-event-methods\";\r\n\r\n/**\r\n * Default number of rows processed per chunk by {@link createManyRecords}.\r\n *\r\n * Chunking keeps a single huge `createMany` call from flooding the driver:\r\n * the default path runs each chunk's `save()` calls under one `Promise.all`,\r\n * and the bulk path emits one multi-row `insertMany` per chunk so the\r\n * generated `INSERT ... VALUES (...),(...)` stays under the database's bind\r\n * parameter ceiling.\r\n */\r\nexport const DEFAULT_CREATE_MANY_BATCH_SIZE = 500;\r\n\r\n/**\r\n * Options for {@link createManyRecords} (and `Model.createMany`).\r\n */\r\nexport type CreateManyOptions = {\r\n  /**\r\n   * Number of rows processed per chunk.\r\n   *\r\n   * @default 500 ({@link DEFAULT_CREATE_MANY_BATCH_SIZE})\r\n   */\r\n  batchSize?: number;\r\n\r\n  /**\r\n   * Route each chunk through the driver's native multi-row insert\r\n   * (`insertMany`) instead of per-row `save()`.\r\n   *\r\n   * **Tradeoff:** the bulk path is 10–100× faster for large arrays but\r\n   * SKIPS the per-row lifecycle: `saving` / `creating` / `created` / `saved`\r\n   * events, instance hooks, and sync operations are NOT emitted. Casts,\r\n   * timestamps, defaults and id-generation that the writer normally applies\r\n   * ARE still applied (the rows are prepped through the same writer pipeline),\r\n   * so persisted columns match the default path.\r\n   *\r\n   * @default false\r\n   */\r\n  bulk?: boolean;\r\n};\r\n\r\nexport async function saveModel<TModel extends Model>(\r\n  model: TModel,\r\n  options?: WriterOptions & { merge?: Partial<ModelSchema> },\r\n): Promise<TModel> {\r\n  if (options?.merge) {\r\n    model.merge(options.merge);\r\n  }\r\n  const writer = new DatabaseWriter(model);\r\n  await writer.save(options);\r\n  return model;\r\n}\r\n\r\nexport async function createRecord<\r\n  TModel extends Model,\r\n  TSchema extends ModelSchema = TModel extends Model<infer S> ? S : ModelSchema,\r\n>(ModelClass: ChildModel<TModel>, data: Partial<TSchema>): Promise<TModel> {\r\n  const model = new ModelClass(data);\r\n  await model.save();\r\n  return model;\r\n}\r\n\r\n/**\r\n * Split an array into sequential chunks of at most `size` elements.\r\n *\r\n * @param items - The array to split.\r\n * @param size - Maximum chunk length (callers pass a value `>= 1`).\r\n * @returns An array of chunks preserving the original order.\r\n */\r\nfunction chunkArray<TItem>(items: TItem[], size: number): TItem[][] {\r\n  const chunks: TItem[][] = [];\r\n\r\n  for (let index = 0; index < items.length; index += size) {\r\n    chunks.push(items.slice(index, index + size));\r\n  }\r\n\r\n  return chunks;\r\n}\r\n\r\n/**\r\n * Create many records, chunking the work so a huge array can't overwhelm the\r\n * driver.\r\n *\r\n * Two strategies are available via `options.bulk`:\r\n *\r\n * - **Default (`bulk` falsy):** each row is persisted through `save()`, so\r\n *   model hooks, lifecycle events, casts and generated ids are all preserved.\r\n *   Rows are processed in sequential chunks of `batchSize`, each chunk running\r\n *   under a single `Promise.all`, so an array of millions of rows can't open\r\n *   millions of concurrent inserts at once.\r\n *\r\n * - **Bulk (`bulk: true`):** each chunk is routed to the driver's native\r\n *   multi-row insert (`insertMany`) for 10–100× throughput. This SKIPS the\r\n *   per-row save lifecycle (no `saving` / `creating` / `created` / `saved`\r\n *   events, hooks, or sync). Rows are still prepped through the writer\r\n *   pipeline (validation, casting, timestamps, defaults, id-generation) so the\r\n *   persisted columns match the default path, and the values returned by the\r\n *   driver (generated `_id`, timestamps, SQL `RETURNING *`) are merged back\r\n *   onto the returned models.\r\n *\r\n * Both strategies return the created model instances (an empty array is a\r\n * no-op that never touches the driver).\r\n *\r\n * @param ModelClass - The model class to create records for.\r\n * @param data - The rows to insert.\r\n * @param options - Chunking / bulk options.\r\n * @returns The created model instances.\r\n *\r\n * @example\r\n * ```typescript\r\n * // Default: per-row save(), chunked in batches of 500\r\n * const users = await User.createMany(rows);\r\n *\r\n * // Bulk: one multi-row INSERT per 1000-row chunk (skips per-row hooks)\r\n * const users = await User.createMany(rows, { bulk: true, batchSize: 1000 });\r\n * ```\r\n */\r\nexport async function createManyRecords<\r\n  TModel extends Model,\r\n  TSchema extends ModelSchema = TModel extends Model<infer S> ? S : ModelSchema,\r\n>(\r\n  ModelClass: ChildModel<TModel>,\r\n  data: Partial<TSchema>[],\r\n  options: CreateManyOptions = {},\r\n): Promise<TModel[]> {\r\n  if (data.length === 0) {\r\n    return [];\r\n  }\r\n\r\n  const batchSize =\r\n    options.batchSize && options.batchSize > 0\r\n      ? options.batchSize\r\n      : DEFAULT_CREATE_MANY_BATCH_SIZE;\r\n\r\n  const chunks = chunkArray(data, batchSize);\r\n\r\n  if (options.bulk === true) {\r\n    return await createManyBulk(ModelClass, chunks);\r\n  }\r\n\r\n  const created: TModel[] = [];\r\n\r\n  for (const chunk of chunks) {\r\n    const models = chunk.map((item) => new ModelClass(item)) as TModel[];\r\n\r\n    // Reserve one contiguous id block for the whole chunk (1 counter op instead\r\n    // of N), pre-seeding each id-less model so its per-row save() no-ops id-gen.\r\n    await assignIdBlock(ModelClass, models);\r\n\r\n    const chunkModels = await Promise.all(\r\n      models.map(async (model) => {\r\n        await model.save();\r\n        return model;\r\n      }),\r\n    );\r\n\r\n    created.push(...chunkModels);\r\n  }\r\n\r\n  return created;\r\n}\r\n\r\n/**\r\n * Reserve a single contiguous id block for one chunk and pre-assign the ids to\r\n * the models that don't already carry one, so the per-row writer's id\r\n * generation no-ops (its `model.get(\"id\")` guard short-circuits). This turns N\r\n * per-row counter round-trips into ONE per chunk.\r\n *\r\n * Falls back to per-row generation (a no-op here) when:\r\n * - the model disables auto-generation (`autoGenerateId === false`) — e.g. SQL,\r\n *   which uses native `SERIAL`;\r\n * - the data source's id generator has no batch API (`generateNextIds`) — the\r\n *   optional contract member is feature-detected;\r\n * - the model uses a random initial id / increment — a random stride can't form\r\n *   a contiguous block, so those models keep per-row generation.\r\n *\r\n * Only models WITHOUT a caller-supplied id consume a block slot, so a chunk\r\n * mixing supplied and auto ids allocates exactly the right number (no gaps).\r\n *\r\n * @param ModelClass - The model class being inserted.\r\n * @param models - The freshly-constructed (unsaved) models for one chunk.\r\n */\r\nasync function assignIdBlock<TModel extends Model>(\r\n  ModelClass: ChildModel<TModel>,\r\n  models: TModel[],\r\n): Promise<void> {\r\n  if (!ModelClass.autoGenerateId || ModelClass.randomInitialId || ModelClass.randomIncrement) {\r\n    return;\r\n  }\r\n\r\n  const idGenerator = ModelClass.getDataSource().idGenerator;\r\n\r\n  if (!idGenerator || typeof idGenerator.generateNextIds !== \"function\") {\r\n    return;\r\n  }\r\n\r\n  const idLessModels = models.filter((model) => !model.get(\"id\"));\r\n\r\n  if (idLessModels.length === 0) {\r\n    return;\r\n  }\r\n\r\n  const ids = await idGenerator.generateNextIds({\r\n    table: ModelClass.table,\r\n    initialId: ModelClass.initialId || 1,\r\n    incrementIdBy: ModelClass.incrementIdBy || 1,\r\n    count: idLessModels.length,\r\n  });\r\n\r\n  // Enforce the contract at this pluggable, feature-detected boundary: a\r\n  // non-conforming generator returning the wrong count would otherwise set\r\n  // `id = undefined` on the unmatched rows, the per-row writer would silently\r\n  // re-generate single ids, and the reserved block would no longer match what\r\n  // is persisted. Fail loud instead of corrupting the sequence.\r\n  if (ids.length !== idLessModels.length) {\r\n    throw new Error(\r\n      `generateNextIds returned ${ids.length} id(s) for ${idLessModels.length} row(s) on ` +\r\n        `\"${ModelClass.table}\" — a batch id generator must return exactly the requested count.`,\r\n    );\r\n  }\r\n\r\n  idLessModels.forEach((model, index) => {\r\n    model.set(\"id\", ids[index]);\r\n  });\r\n}\r\n\r\n/**\r\n * Bulk variant of {@link createManyRecords}: prep each row through the writer\r\n * pipeline (validation, casting, timestamps, defaults, id-generation) without\r\n * touching the database, then flush each chunk with a single\r\n * `driver.insertMany` call.\r\n *\r\n * The writer reuse is achieved by swapping the driver's single-row `insert`\r\n * for a capturing stub for the lifetime of the bulk operation: running\r\n * `writer.save({ skipEvents, skipSync })` exercises the real prep but records\r\n * the prepared document instead of issuing N single-row inserts. The original\r\n * `insert` is always restored in `finally`.\r\n *\r\n * @param ModelClass - The model class to create records for.\r\n * @param chunks - Pre-chunked rows.\r\n * @returns The created model instances with driver-returned values merged in.\r\n */\r\nasync function createManyBulk<\r\n  TModel extends Model,\r\n  TSchema extends ModelSchema = TModel extends Model<infer S> ? S : ModelSchema,\r\n>(ModelClass: ChildModel<TModel>, chunks: Partial<TSchema>[][]): Promise<TModel[]> {\r\n  const dataSource = ModelClass.getDataSource();\r\n  const driver = dataSource.driver;\r\n  const table = ModelClass.table;\r\n  // Keep the exact original reference so it can be restored verbatim (binding a\r\n  // copy would, for a spied driver, replace the spy with a non-spy wrapper).\r\n  const originalInsert = driver.insert;\r\n\r\n  // Capture the prepared (validated/casted/timestamped/id-generated) document\r\n  // instead of inserting it per row, so the writer's prep runs exactly once\r\n  // per model while the actual write is deferred to a single insertMany.\r\n  driver.insert = (async (\r\n    _table: string,\r\n    document: Record<string, unknown>,\r\n  ): Promise<InsertResult> => {\r\n    return { document };\r\n  }) as typeof driver.insert;\r\n\r\n  const created: TModel[] = [];\r\n\r\n  try {\r\n    for (const chunk of chunks) {\r\n      const models = chunk.map((item) => new ModelClass(item)) as TModel[];\r\n\r\n      // Reserve one contiguous id block for the whole chunk (1 counter op\r\n      // instead of N), pre-seeding each id-less model so the per-row writer's\r\n      // id generation no-ops.\r\n      await assignIdBlock(ModelClass, models);\r\n\r\n      // Prep every model through the real writer pipeline. The captured\r\n      // `insert` keeps this off the wire while still mutating each model's\r\n      // data with casts/timestamps/defaults/generated ids.\r\n      const preparedDocuments = await Promise.all(\r\n        models.map(async (model) => {\r\n          const writer = new DatabaseWriter(model);\r\n          await writer.save({ skipEvents: true, skipSync: true });\r\n          return { ...model.data } as Record<string, unknown>;\r\n        }),\r\n      );\r\n\r\n      const results = await driver.insertMany(table, preparedDocuments);\r\n\r\n      // Merge driver-returned values (generated _id, timestamps, RETURNING *)\r\n      // back onto each model so the returned instances reflect persisted state.\r\n      models.forEach((model, index) => {\r\n        const result = results[index] as InsertResult | Record<string, unknown> | undefined;\r\n\r\n        if (result) {\r\n          const returnedDocument =\r\n            \"document\" in (result as Record<string, unknown>)\r\n              ? (result as InsertResult).document\r\n              : result;\r\n\r\n          // Driver-returned identity (generated _id / RETURNING *) — merged\r\n          // through the framework-internal path so it is not treated as mass\r\n          // assignment on a model the writer has already marked persisted.\r\n          mergeDriverFields(model, returnedDocument as Record<string, unknown>);\r\n        }\r\n\r\n        model.dirtyTracker.reset();\r\n        model.isNew = false;\r\n      });\r\n\r\n      created.push(...models);\r\n    }\r\n  } finally {\r\n    driver.insert = originalInsert;\r\n  }\r\n\r\n  return created;\r\n}\r\n\r\nexport async function findOrCreateRecord<\r\n  TModel extends Model,\r\n  TSchema extends ModelSchema = TModel extends Model<infer S> ? S : ModelSchema,\r\n>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Partial<TSchema>,\r\n  data: Partial<TSchema>,\r\n): Promise<TModel> {\r\n  const existing = await ModelClass.first(filter as Record<string, unknown>);\r\n\r\n  if (existing) {\r\n    return existing;\r\n  }\r\n\r\n  return await createRecord(ModelClass, { ...filter, ...data } as Partial<TSchema>);\r\n}\r\n\r\nexport async function upsertRecord<\r\n  TModel extends Model,\r\n  TSchema extends ModelSchema = TModel extends Model<infer S> ? S : ModelSchema,\r\n>(\r\n  ModelClass: ChildModel<TModel>,\r\n  filter: Partial<TSchema>,\r\n  data: Partial<TSchema>,\r\n  options?: Record<string, unknown>,\r\n): Promise<TModel> {\r\n  const driver = ModelClass.getDriver();\r\n  const mergedData = { ...filter, ...data } as Record<string, unknown>;\r\n\r\n  const tempModel = new ModelClass(mergedData as Partial<TSchema>);\r\n  tempModel.isNew = true;\r\n\r\n  await emitModelEvent(tempModel, \"saving\", {\r\n    isInsert: true,\r\n    options,\r\n    mode: \"upsert\",\r\n  });\r\n\r\n  const createdAtColumn = ModelClass.createdAtColumn;\r\n  const updatedAtColumn = ModelClass.updatedAtColumn;\r\n\r\n  if (createdAtColumn !== false && createdAtColumn !== undefined) {\r\n    const createdAtKey = createdAtColumn as string;\r\n    if (!mergedData[createdAtKey]) {\r\n      mergedData[createdAtKey] = new Date();\r\n    }\r\n  }\r\n\r\n  if (updatedAtColumn !== false && updatedAtColumn !== undefined) {\r\n    const updatedAtKey = updatedAtColumn as string;\r\n    mergedData[updatedAtKey] = new Date();\r\n  }\r\n\r\n  await emitModelEvent(tempModel, \"saving\", { filter, data: mergedData, options, mode: \"upsert\" });\r\n\r\n  const result = await driver.upsert(ModelClass.table, filter as Record<string, unknown>, mergedData, options);\r\n\r\n  const model = ModelClass.hydrate(result as Record<string, unknown>) as TModel;\r\n  model.dirtyTracker.reset();\r\n\r\n  await emitModelEvent(model, \"saved\", { filter, data: result, options, mode: \"upsert\" });\r\n\r\n  return model;\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;AAeA,MAAa,iCAAiC;AA6B9C,eAAsB,UACpB,OACA,SACiB;CACjB,IAAI,SAAS,OACX,MAAM,MAAM,QAAQ,KAAK;CAG3B,MAAM,IADa,eAAe,KACvB,CAAC,CAAC,KAAK,OAAO;CACzB,OAAO;AACT;AAEA,eAAsB,aAGpB,YAAgC,MAAyC;CACzE,MAAM,QAAQ,IAAI,WAAW,IAAI;CACjC,MAAM,MAAM,KAAK;CACjB,OAAO;AACT;;;;;;;;AASA,SAAS,WAAkB,OAAgB,MAAyB;CAClE,MAAM,SAAoB,CAAC;CAE3B,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,MACjD,OAAO,KAAK,MAAM,MAAM,OAAO,QAAQ,IAAI,CAAC;CAG9C,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,eAAsB,kBAIpB,YACA,MACA,UAA6B,CAAC,GACX;CACnB,IAAI,KAAK,WAAW,GAClB,OAAO,CAAC;CAQV,MAAM,SAAS,WAAW,MAJxB,QAAQ,aAAa,QAAQ,YAAY,IACrC,QAAQ,eAG2B;CAEzC,IAAI,QAAQ,SAAS,MACnB,OAAO,MAAM,eAAe,YAAY,MAAM;CAGhD,MAAM,UAAoB,CAAC;CAE3B,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,SAAS,MAAM,KAAK,SAAS,IAAI,WAAW,IAAI,CAAC;EAIvD,MAAM,cAAc,YAAY,MAAM;EAEtC,MAAM,cAAc,MAAM,QAAQ,IAChC,OAAO,IAAI,OAAO,UAAU;GAC1B,MAAM,MAAM,KAAK;GACjB,OAAO;EACT,CAAC,CACH;EAEA,QAAQ,KAAK,GAAG,WAAW;CAC7B;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;AAsBA,eAAe,cACb,YACA,QACe;CACf,IAAI,CAAC,WAAW,kBAAkB,WAAW,mBAAmB,WAAW,iBACzE;CAGF,MAAM,cAAc,WAAW,cAAc,CAAC,CAAC;CAE/C,IAAI,CAAC,eAAe,OAAO,YAAY,oBAAoB,YACzD;CAGF,MAAM,eAAe,OAAO,QAAQ,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC;CAE9D,IAAI,aAAa,WAAW,GAC1B;CAGF,MAAM,MAAM,MAAM,YAAY,gBAAgB;EAC5C,OAAO,WAAW;EAClB,WAAW,WAAW,aAAa;EACnC,eAAe,WAAW,iBAAiB;EAC3C,OAAO,aAAa;CACtB,CAAC;CAOD,IAAI,IAAI,WAAW,aAAa,QAC9B,MAAM,IAAI,MACR,4BAA4B,IAAI,OAAO,aAAa,aAAa,OAAO,cAClE,WAAW,MAAM,kEACzB;CAGF,aAAa,SAAS,OAAO,UAAU;EACrC,MAAM,IAAI,MAAM,IAAI,MAAM;CAC5B,CAAC;AACH;;;;;;;;;;;;;;;;;AAkBA,eAAe,eAGb,YAAgC,QAAiD;CAEjF,MAAM,SADa,WAAW,cACN,CAAC,CAAC;CAC1B,MAAM,QAAQ,WAAW;CAGzB,MAAM,iBAAiB,OAAO;CAK9B,OAAO,UAAU,OACf,QACA,aAC0B;EAC1B,OAAO,EAAE,SAAS;CACpB;CAEA,MAAM,UAAoB,CAAC;CAE3B,IAAI;EACF,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,SAAS,MAAM,KAAK,SAAS,IAAI,WAAW,IAAI,CAAC;GAKvD,MAAM,cAAc,YAAY,MAAM;GAKtC,MAAM,oBAAoB,MAAM,QAAQ,IACtC,OAAO,IAAI,OAAO,UAAU;IAE1B,MAAM,IADa,eAAe,KACvB,CAAC,CAAC,KAAK;KAAE,YAAY;KAAM,UAAU;IAAK,CAAC;IACtD,OAAO,EAAE,GAAG,MAAM,KAAK;GACzB,CAAC,CACH;GAEA,MAAM,UAAU,MAAM,OAAO,WAAW,OAAO,iBAAiB;GAIhE,OAAO,SAAS,OAAO,UAAU;IAC/B,MAAM,SAAS,QAAQ;IAEvB,IAAI,QASF,kBAAkB,OAPhB,cAAe,SACV,OAAwB,WACzB,MAK8D;IAGtE,MAAM,aAAa,MAAM;IACzB,MAAM,QAAQ;GAChB,CAAC;GAED,QAAQ,KAAK,GAAG,MAAM;EACxB;CACF,UAAU;EACR,OAAO,SAAS;CAClB;CAEA,OAAO;AACT;AAEA,eAAsB,mBAIpB,YACA,QACA,MACiB;CACjB,MAAM,WAAW,MAAM,WAAW,MAAM,MAAiC;CAEzE,IAAI,UACF,OAAO;CAGT,OAAO,MAAM,aAAa,YAAY;EAAE,GAAG;EAAQ,GAAG;CAAK,CAAqB;AAClF;AAEA,eAAsB,aAIpB,YACA,QACA,MACA,SACiB;CACjB,MAAM,SAAS,WAAW,UAAU;CACpC,MAAM,aAAa;EAAE,GAAG;EAAQ,GAAG;CAAK;CAExC,MAAM,YAAY,IAAI,WAAW,UAA8B;CAC/D,UAAU,QAAQ;CAElB,MAAM,eAAe,WAAW,UAAU;EACxC,UAAU;EACV;EACA,MAAM;CACR,CAAC;CAED,MAAM,kBAAkB,WAAW;CACnC,MAAM,kBAAkB,WAAW;CAEnC,IAAI,oBAAoB,SAAS,oBAAoB,QAAW;EAC9D,MAAM,eAAe;EACrB,IAAI,CAAC,WAAW,eACd,WAAW,gCAAgB,IAAI,KAAK;CAExC;CAEA,IAAI,oBAAoB,SAAS,oBAAoB,QAAW;EAC9D,MAAM,eAAe;EACrB,WAAW,gCAAgB,IAAI,KAAK;CACtC;CAEA,MAAM,eAAe,WAAW,UAAU;EAAE;EAAQ,MAAM;EAAY;EAAS,MAAM;CAAS,CAAC;CAE/F,MAAM,SAAS,MAAM,OAAO,OAAO,WAAW,OAAO,QAAmC,YAAY,OAAO;CAE3G,MAAM,QAAQ,WAAW,QAAQ,MAAiC;CAClE,MAAM,aAAa,MAAM;CAEzB,MAAM,eAAe,OAAO,SAAS;EAAE;EAAQ,MAAM;EAAQ;EAAS,MAAM;CAAS,CAAC;CAEtF,OAAO;AACT"}