alepha 0.23.0 → 0.24.0

package/src/orm/core/services/Repository.ts

@@ -8,7 +8,7 @@ import {
   type StaticEncode,
   type TObject,
   type TSchema,
-  t,
+  z,
 } from "alepha";
 import { type DateTime, DateTimeProvider } from "alepha/datetime";
 import { $logger } from "alepha/logger";
@@ -427,30 +427,30 @@ export abstract class Repository<T extends TObject> {
 
       let schema: TObject = this.entity.schema;
       if (columns) {
-        schema = t.pick(schema, columns);
+        schema = schema.pick(
+          Object.fromEntries(columns.map((c) => [c, true])) as never,
+        ) as TObject;
       }
 
+      // Build joinedSchema once per query (not per row) to avoid SchemaValidator
+      // cache growth — each buildSchemaWithJoins() produces a fresh schema object.
+      const joinedSchema = joins.length
+        ? this.relationManager.buildSchemaWithJoins(schema, joins)
+        : null;
+
       if (joins.length) {
-        rows = rows.map((row: any) => {
-          // Clone schema for each row to avoid mutation
-          const rowSchema = { ...schema, properties: { ...schema.properties } };
-          return this.relationManager.mapRowWithJoins(
+        rows = rows.map((row: any) =>
+          this.relationManager.mapRowWithJoins(
             row[this.tableName],
             row,
-            rowSchema,
+            schema,
             joins,
-          );
-        });
+          ),
+        );
       }
 
       rows = rows.map((row) => {
-        // For joined queries, build a schema that includes all nested joins
-        if (joins.length) {
-          const joinedSchema = this.relationManager.buildSchemaWithJoins(
-            schema,
-            joins,
-          );
-          // Clean the row with the full joined schema (including nested relations)
+        if (joinedSchema) {
           return this.cleanWithJoins(row, joinedSchema, joins);
         }
         return this.clean(row, schema);
@@ -545,10 +545,11 @@ export abstract class Repository<T extends TObject> {
     tasks.push(
       this.findMany(
         {
+          ...query,
           offset,
+          // one extra row is the next-page sentinel `createPagination` looks for
           limit: limit + 1,
           orderBy,
-          ...query,
         },
         opts,
       ).then((it) => {
@@ -1489,20 +1490,32 @@ export abstract class Repository<T extends TObject> {
       return where;
     }
 
+    const strict = orgField.data?.strict === true;
     const value = this.resolveOrganizationValue();
     if (!value) {
+      if (strict) {
+        // Fail closed: refuse rather than fall through to an unfiltered query
+        // that would expose every tenant's rows on a sensitive table.
+        throw new AlephaError(
+          `Refusing to query tenant-scoped entity '${this.tableName}' with no resolved tenant/organization in context (strict tenancy).`,
+        );
+      }
       return where;
     }
 
     return {
       and: [
         where,
-        {
-          or: [
-            { [orgField.key]: { eq: value } },
-            { [orgField.key]: { isNull: true } },
-          ],
-        } as any,
+        // Strict entities drop the `OR org IS NULL` escape so a scoped tenant
+        // never sees global/NULL rows.
+        strict
+          ? ({ [orgField.key]: { eq: value } } as any)
+          : ({
+              or: [
+                { [orgField.key]: { eq: value } },
+                { [orgField.key]: { isNull: true } },
+              ],
+            } as any),
       ],
     } as PgQueryWhereOrSQL<T>;
   }
@@ -1513,13 +1526,25 @@ export abstract class Repository<T extends TObject> {
       return;
     }
 
-    if (data[orgField.key] != null) {
+    // An explicit value — including an explicit `null` "global row" — is a
+    // deliberate, auditable choice and is honored as-is. Strict only guards
+    // the fail-open accident: the org column simply omitted.
+    if (orgField.key in data && data[orgField.key] !== undefined) {
       return;
     }
 
     const value = this.resolveOrganizationValue();
     if (value) {
       data[orgField.key] = value;
+      return;
+    }
+
+    if (orgField.data?.strict === true) {
+      // Fail closed: an unscoped insert would create a NULL/global row on a
+      // sensitive table. Require an explicit organization or a resolved tenant.
+      throw new AlephaError(
+        `Refusing to insert into tenant-scoped entity '${this.tableName}' with no organization set and no resolved tenant in context (strict tenancy).`,
+      );
     }
   }
 
@@ -1560,7 +1585,7 @@ export abstract class Repository<T extends TObject> {
   ): PgInsertValue<PgTableWithColumns<SchemaToTableConfig<T>>> {
     const schema = insert
       ? this.entity.insertSchema // insert
-      : (t.partial(this.entity.updateSchema) as TObject); // update
+      : (this.entity.updateSchema.partial() as TObject); // update
 
     // Extract raw SQL expressions before codec validation — TypeBox would
     // reject them since they aren't plain values of the declared type
@@ -1582,7 +1607,20 @@ export abstract class Repository<T extends TObject> {
       unknown
     >;
 
-    return { ...encoded, ...sqlValues } as PgInsertValue<
+    // On UPDATE, only persist the fields the caller explicitly provided.
+    // Validating against a (partial) schema re-applies every field's default —
+    // zod's `ZodDefault` fills in its default whenever the key is ABSENT — which
+    // would clobber unrelated existing columns (e.g. an unrelated `status` update
+    // resetting `dunningAttempt` back to its default 0). Inserts still want the
+    // injected defaults, so the filtering is update-only.
+    const result = insert
+      ? encoded
+      : Object.keys(scalarData).reduce<Record<string, unknown>>((acc, key) => {
+          acc[key] = encoded[key];
+          return acc;
+        }, {});
+
+    return { ...result, ...sqlValues } as PgInsertValue<
       PgTableWithColumns<SchemaToTableConfig<T>>
     >;
   }
@@ -1595,13 +1633,24 @@ export abstract class Repository<T extends TObject> {
     schema: T,
   ): Static<T> {
     for (const key of Object.keys(schema.properties)) {
-      const value = schema.properties[key];
+      const prop = schema.properties[key];
+      // Unwrap optional/nullable so format detection works on the base type.
+      const value = z.schema.unwrap(prop);
+
+      // An optional field maps to a NULLABLE column; the driver returns `null`
+      // for an empty column. Normalize to "absent" so it satisfies the
+      // optional schema and the `T | undefined` contract (the schema only
+      // accepts `undefined`, not `null`).
+      if (row[key] === null && z.schema.isOptional(prop)) {
+        delete row[key];
+        continue;
+      }
 
       // convert PG date-time and date to ISO strings
       if (typeof row[key] === "string") {
-        if (t.schema.isDateTime(value)) {
+        if (z.schema.isDateTime(value)) {
           row[key] = this.dateTimeProvider.of(row[key]).toISOString();
-        } else if (t.schema.isDate(value)) {
+        } else if (z.schema.isDate(value)) {
           row[key] = this.dateTimeProvider
             .of(`${row[key]}T00:00:00Z`)
             .toISOString()
@@ -1609,9 +1658,15 @@ export abstract class Repository<T extends TObject> {
         }
       }
 
-      // convert BigInt to string
-      if (typeof row[key] === "bigint" && t.schema.isBigInt(value)) {
-        row[key] = row[key].toString();
+      // convert BigInt to string for `z.bigint()` (string-format) columns.
+      // Postgres bigint columns hand back a JS `bigint`; the SQLite builder maps
+      // a bigint primary key to an integer column that returns a plain `number`.
+      // Both must become a string to satisfy the string-typed bigint schema.
+      if (
+        (typeof row[key] === "bigint" || typeof row[key] === "number") &&
+        z.schema.isBigInt(value)
+      ) {
+        row[key] = String(row[key]);
       }
     }
 
@@ -1711,7 +1766,7 @@ export abstract class Repository<T extends TObject> {
   protected getWhereId(id: string | number): PgQueryWhere<T> {
     return {
       [this.id.key]: {
-        eq: t.schema.isString(this.id.type) ? String(id) : Number(id),
+        eq: z.schema.isString(this.id.type) ? String(id) : Number(id),
       },
     } as PgQueryWhere<T>;
   }

package/src/orm/core/services/SqliteModelBuilder.ts

@@ -4,8 +4,7 @@ import {
   type Static,
   type TObject,
   type TSchema,
-  type TString,
-  t,
+  z,
 } from "alepha";
 import { type BuildColumns, sql } from "drizzle-orm";
 import * as pg from "drizzle-orm/sqlite-core";
@@ -115,13 +114,14 @@ export class SqliteModelBuilder extends ModelBuilder {
     enums: Map<string, unknown>,
     tables: Map<string, unknown>,
   ): SchemaToSqliteBuilder<T> => {
-    return Object.entries(schema.properties).reduce<
+    return Object.entries(schema.properties as Record<string, any>).reduce<
       Partial<SchemaToSqliteBuilder<T>>
     >((columns, [key, value]) => {
       let col = this.mapFieldToSqliteColumn(tableName, key, value, enums);
 
-      if ("default" in value && value.default != null) {
-        col = col.default(value.default as any);
+      const defaultValue = z.schema.getDefault(value);
+      if (defaultValue != null) {
+        col = col.default(defaultValue as any);
       }
 
       if (PG_PRIMARY_KEY in value) {
@@ -160,7 +160,7 @@ export class SqliteModelBuilder extends ModelBuilder {
         });
       }
 
-      if (schema.required?.includes(key)) {
+      if (z.schema.requiredKeys(schema).includes(key)) {
         col = col.notNull();
       }
 
@@ -172,23 +172,15 @@ export class SqliteModelBuilder extends ModelBuilder {
   mapFieldToSqliteColumn = (
     tableName: string,
     fieldName: string,
-    value: TSchema,
+    value: any,
     enums: Map<string, any>,
   ) => {
     const key = this.toColumnName(fieldName);
 
-    if (
-      // is nullish ?
-      "anyOf" in value &&
-      Array.isArray(value.anyOf) &&
-      value.anyOf.length === 2 &&
-      value.anyOf.some((it: TSchema) => t.schema.isNull(it))
-    ) {
-      // then, remove nullish
-      value = value.anyOf.find((it: TSchema) => !t.schema.isNull(it))!;
-    }
+    // Peel optional / nullable / default wrappers to the underlying type.
+    value = z.schema.unwrap(value);
 
-    if (t.schema.isInteger(value)) {
+    if (z.schema.isInteger(value)) {
       if (PG_SERIAL in value || PG_IDENTITY in value) {
         return pg
           .integer(key, { mode: "number" })
@@ -198,7 +190,7 @@ export class SqliteModelBuilder extends ModelBuilder {
       return pg.integer(key);
     }
 
-    if (t.schema.isBigInt(value)) {
+    if (z.schema.isBigInt(value)) {
       if (PG_PRIMARY_KEY in value || PG_IDENTITY in value) {
         return pg
           .integer(key, { mode: "number" })
@@ -208,66 +200,67 @@ export class SqliteModelBuilder extends ModelBuilder {
       return pg.integer(key, { mode: "number" });
     }
 
-    if (t.schema.isNumber(value)) {
+    if (z.schema.isNumber(value)) {
       if (PG_IDENTITY in value) {
         return pg
           .integer(key, { mode: "number" })
           .primaryKey({ autoIncrement: true });
       }
 
-      return pg.numeric(key);
+      // Native real column — returns a JS number (sqlite `numeric` yields a
+      // string, which strict `z.number()` validation rejects).
+      return pg.real(key);
     }
 
-    if (t.schema.isString(value)) {
+    if (z.schema.isString(value)) {
       return this.mapStringToSqliteColumn(key, value);
     }
 
-    if (t.schema.isBoolean(value)) {
+    if (z.schema.isBoolean(value)) {
       return this.sqliteBool(key, value);
     }
 
-    if (t.schema.isObject(value)) {
+    if (z.schema.isObject(value)) {
       return this.sqliteJson(key, value);
     }
 
-    if (t.schema.isRecord(value)) {
+    if (z.schema.isRecord(value)) {
       return this.sqliteJson(key, value);
     }
 
-    if (t.schema.isAny(value)) {
+    if (z.schema.isAny(value)) {
       return this.sqliteJson(key, value);
     }
 
-    if (t.schema.isArray(value)) {
-      if (t.schema.isObject(value.items)) {
+    if (z.schema.isArray(value)) {
+      if (z.schema.isObject(value.items)) {
+        return this.sqliteJson(key, value);
+      }
+      if (z.schema.isRecord(value.items)) {
         return this.sqliteJson(key, value);
       }
-      if (t.schema.isRecord(value.items)) {
+      if (z.schema.isAny(value.items)) {
         return this.sqliteJson(key, value);
       }
-      if (t.schema.isAny(value.items)) {
+      if (z.schema.isString(value.items)) {
         return this.sqliteJson(key, value);
       }
-      if (t.schema.isString(value.items)) {
+      if (z.schema.isInteger(value.items)) {
         return this.sqliteJson(key, value);
       }
-      if (t.schema.isInteger(value.items)) {
+      if (z.schema.isNumber(value.items)) {
         return this.sqliteJson(key, value);
       }
-      if (t.schema.isNumber(value.items)) {
+      if (z.schema.isBoolean(value.items)) {
         return this.sqliteJson(key, value);
       }
-      if (t.schema.isBoolean(value.items)) {
+      if (z.schema.isEnum(value.items)) {
         return this.sqliteJson(key, value);
       }
     }
 
-    if (
-      t.schema.isUnsafe(value) &&
-      "type" in value &&
-      value.type === "string"
-    ) {
-      return this.mapStringToSqliteColumn(key, value as any);
+    if (z.schema.isEnum(value)) {
+      return this.mapStringToSqliteColumn(key, value);
     }
 
     throw new AlephaError(
@@ -275,8 +268,8 @@ export class SqliteModelBuilder extends ModelBuilder {
     );
   };
 
-  mapStringToSqliteColumn = (key: string, value: TString) => {
-    if (value.format === "uuid") {
+  mapStringToSqliteColumn = (key: string, value: any) => {
+    if (z.schema.format(value) === "uuid") {
       if (PG_PRIMARY_KEY in value) {
         return pg
           .text(key)
@@ -287,11 +280,11 @@ export class SqliteModelBuilder extends ModelBuilder {
       return pg.text(key);
     }
 
-    if (value.format === "byte") {
+    if (z.schema.format(value) === "binary") {
       return this.sqliteJson(key, value);
     }
 
-    if (value.format === "date-time") {
+    if (z.schema.format(value) === "date-time") {
       if (PG_CREATED_AT in value) {
         return this.sqliteDateTime(key, {}).default(
           sql`(unixepoch('subsec') * 1000)`,
@@ -305,7 +298,7 @@ export class SqliteModelBuilder extends ModelBuilder {
       return this.sqliteDateTime(key, {});
     }
 
-    if (value.format === "date") {
+    if (z.schema.format(value) === "date") {
       return this.sqliteDate(key, {});
     }
 

package/src/orm/postgres/__tests__/BunPostgresProvider.bun.spec.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it } from "bun:test";
-import { Alepha, t } from "alepha";
+import { Alepha, z } from "alepha";
 import { $entity, $repository, DatabaseProvider, db } from "alepha/orm";
 import { BunPostgresProvider } from "../providers/BunPostgresProvider.ts";
 
@@ -7,12 +7,12 @@ import { BunPostgresProvider } from "../providers/BunPostgresProvider.ts";
 
 const users = $entity({
   name: "users",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
     createdAt: db.createdAt(),
     updatedAt: db.updatedAt(),
-    name: t.text(),
-    role: db.default(t.text(), "user"),
+    name: z.text(),
+    role: db.default(z.text(), "user"),
   }),
   indexes: [{ column: "name", unique: true }],
 });

package/src/orm/postgres/providers/CloudflareHyperdriveProvider.ts

@@ -1,4 +1,4 @@
-import { $env, $hook, $inject, AlephaError, t } from "alepha";
+import { $env, $hook, $inject, AlephaError, z } from "alepha";
 import { DatabaseProvider, type SQLLike } from "alepha/orm";
 import { sql } from "drizzle-orm";
 import type { PgDatabase } from "drizzle-orm/pg-core";
@@ -18,11 +18,9 @@ import { PostgresModelBuilder } from "../services/PostgresModelBuilder.ts";
 export class CloudflareHyperdriveProvider extends DatabaseProvider {
   protected readonly builder = $inject(PostgresModelBuilder);
   protected readonly env = $env(
-    t.object({
-      DATABASE_URL: t.string({
-        description: "Expect to be 'hyperdrive://BINDING'",
-      }),
-      POSTGRES_SCHEMA: t.optional(t.text()),
+    z.object({
+      DATABASE_URL: z.string().describe("Expect to be 'hyperdrive://BINDING'"),
+      POSTGRES_SCHEMA: z.text().optional(),
     }),
   );
 

package/src/orm/postgres/schemas/postgresEnvSchema.ts

@@ -1,30 +1,30 @@
-import { type Static, t } from "alepha";
+import { type Static, z } from "alepha";
 
 /**
  * PostgreSQL-specific environment schema.
  *
  * Additional env vars for PostgreSQL providers on top of `databaseEnvSchema`.
  */
-export const postgresEnvSchema = t.object({
+export const postgresEnvSchema = z.object({
   /**
    * PostgreSQL schema name (defaults to `"public"` when unset).
    */
-  POSTGRES_SCHEMA: t.optional(t.text()),
+  POSTGRES_SCHEMA: z.text().optional(),
 
   /**
    * Maximum number of connections in the pool.
    */
-  POOL_MAX: t.optional(t.integer()),
+  POOL_MAX: z.integer().optional(),
 
   /**
    * Seconds a connection can be idle before being closed.
    */
-  POOL_IDLE_TIMEOUT: t.optional(t.integer()),
+  POOL_IDLE_TIMEOUT: z.integer().optional(),
 
   /**
    * Seconds to wait when establishing a new connection.
    */
-  POOL_CONNECT_TIMEOUT: t.optional(t.integer()),
+  POOL_CONNECT_TIMEOUT: z.integer().optional(),
 });
 
 declare module "alepha" {