fastify-auto-sqlapi 0.0.4 → 0.0.5

package/dist/lib/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK/C,sCAAsC;AACtC,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,WAA0B,CAAC;AAEhE,qBAAa,WAAW;;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,KAAK,CAAS;gBAEV,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU;IAKnD,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAE/B;IAED,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAE9B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI7B,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAIrC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IA6FlB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAoB7B,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAuB7B,UAAU,CACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IA2B/B,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IA+B/B,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,QAAQ,EACf,cAAc,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,MAAM,CAAC;IAuBZ,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,MAAM,CAAC;IAYZ,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACxC,SAAS,EACT,OAAa,EACb,KAAK,EACL,MAAM,EACN,KAAY,EACZ,OAAY,EACZ,KAAU,EACV,QAAgB,GACjB,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAchC;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,WAAW,CAGb"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK/C,sCAAsC;AACtC,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,WAA0B,CAAC;AAEhE,qBAAa,WAAW;;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,KAAK,CAAS;gBAEV,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU;IAKnD,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAE/B;IAED,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAE9B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI7B,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAIrC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IA6FlB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAoB7B,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAuB7B,UAAU,CACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IA+B/B,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAiC/B,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,QAAQ,EACf,cAAc,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,MAAM,CAAC;IAuBZ,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,MAAM,CAAC;IAYZ,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACxC,SAAS,EACT,OAAa,EACb,KAAK,EACL,MAAM,EACN,KAAY,EACZ,OAAY,EACZ,KAAU,EACV,QAAgB,GACjB,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAchC;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,WAAW,CAGb"}

package/dist/lib/db.js

@@ -149,8 +149,12 @@ export class QueryClient {
                 results.push(...result.rows);
             }
             else {
-                for (const rec of chunk) {
-                    results.push(this.#mysqlPkResult(pkCol, rec, result.insertId));
+                // MySQL: insertId is the FIRST generated ID of the multi-row insert.
+                // Subsequent rows follow sequentially assuming auto_increment_increment=1 (default).
+                const firstId = result.insertId;
+                for (let j = 0; j < chunk.length; j++) {
+                    const id = typeof firstId === 'number' ? firstId + j : undefined;
+                    results.push(this.#mysqlPkResult(pkCol, chunk[j], id));
                 }
             }
         }
@@ -174,8 +178,10 @@ export class QueryClient {
                 results.push(...result.rows);
             }
             else {
-                for (const rec of chunk) {
-                    results.push(this.#mysqlPkResult(pkCol, rec, result.insertId));
+                const firstId = result.insertId;
+                for (let j = 0; j < chunk.length; j++) {
+                    const id = typeof firstId === 'number' ? firstId + j : undefined;
+                    results.push(this.#mysqlPkResult(pkCol, chunk[j], id));
                 }
             }
         }

package/dist/lib/engine/bulk/bulk-upsert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-upsert.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAGjB,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAgG5F"}
+{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-upsert.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAGjB,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoG5F"}

package/dist/lib/engine/bulk/bulk-upsert.js

@@ -1,4 +1,4 @@
-import { camelcaseObject, snakecaseRecord } from '../../naming.js';
+import { snakecaseRecord } from '../../naming.js';
 import { removeExcludedFields, processSecondaries, processDeletions } from '../write-helpers.js';
 import { injectTenantValue, validateTenantFK } from '../../tenant.js';
 import { runValidation, runBulkValidation } from '../validate.js';
@@ -7,18 +7,35 @@ export async function bulkUpsertEngine(params) {
     const { db, tableConf, dbTables, request, items, tenant } = params;
     if (!items.length)
         return [];
+    const schema = tableConf.Schema;
     const pk = primaryAsString(tableConf.primary);
-    const pkCol = tableConf.Schema.col(pk);
-    // 1. Prepare all main records
-    const preparedMains = items.map((item) => {
-        let rec = snakecaseRecord(item.main);
-        rec = removeExcludedFields(rec, tableConf);
-        return rec;
+    const pkCol = schema.col(pk);
+    // 1. Mutable camelCase copies of each item.main
+    const inputMains = items.map((item) => ({ ...item.main }));
+    // 2. Custom validation (camelCase)
+    if (tableConf.validateBulk) {
+        await runBulkValidation(db, request, tableConf, items);
+    }
+    else {
+        for (let i = 0; i < items.length; i++) {
+            await runValidation(db, request, tableConf, inputMains[i], items[i].secondaries);
+        }
+    }
+    // 3. beforeInsert hook per record (camelCase)
+    if (tableConf.beforeInsert) {
+        for (const rec of inputMains) {
+            await tableConf.beforeInsert(db, request, rec);
+        }
+    }
+    // 4. Convert to DB format (after user mutations)
+    const preparedMains = inputMains.map((rec) => {
+        let converted = snakecaseRecord(rec, schema);
+        converted = removeExcludedFields(converted, tableConf);
+        return converted;
     });
-    // 1b. Tenant: inject or validate FK
+    // 5. Tenant: inject or validate FK (enforced after user mutations)
     if (tenant) {
         if ('through' in tenant.scope) {
-            // Indirect: collect all FK values, validate in batch
             const scope = tenant.scope;
             const fkCol = scope.through.localField;
             const fkValues = preparedMains.map((rec) => rec[fkCol]);
@@ -30,40 +47,27 @@ export async function bulkUpsertEngine(params) {
             }
         }
     }
-    // 2. Custom validation (receives original camelCase records)
-    if (tableConf.validateBulk) {
-        await runBulkValidation(db, request, tableConf, items);
-    }
-    else {
-        for (let i = 0; i < items.length; i++) {
-            await runValidation(db, request, tableConf, items[i].main, items[i].secondaries);
-        }
-    }
-    // 3. beforeInsert hook per record
-    if (tableConf.beforeInsert) {
-        for (const rec of preparedMains) {
-            await tableConf.beforeInsert(db, request, rec);
-        }
-    }
-    // 4. Bulk upsert all mains in one query → returns PK-only
-    const upsertKeys = tableConf.upsertMap?.get(tableConf.Schema);
+    // 6. Bulk upsert all mains in one query → returns PK-only
+    const upsertKeys = tableConf.upsertMap?.get(schema);
     let pkRows;
     if (upsertKeys) {
-        const conflictCols = upsertKeys.map((k) => tableConf.Schema.col(k));
-        pkRows = await db.bulkInsertOrUpdate(tableConf.Schema.tableName, preparedMains, conflictCols, pkCol);
+        const conflictCols = upsertKeys.map((k) => schema.col(k));
+        pkRows = await db.bulkInsertOrUpdate(schema.tableName, preparedMains, conflictCols, pkCol);
     }
     else {
-        pkRows = await db.bulkInsert(tableConf.Schema.tableName, preparedMains, pkCol);
+        pkRows = await db.bulkInsert(schema.tableName, preparedMains, pkCol);
     }
-    const pksCamel = pkRows.map((r) => camelcaseObject(r));
-    // 5. Process secondaries and deletions per item
+    // 7. Process secondaries, deletions, afterInsert per item (all camelCase)
     const results = [];
     for (let i = 0; i < items.length; i++) {
         const item = items[i];
-        const mainPk = pksCamel[i];
-        const result = { main: mainPk };
-        // For FK auto-fill in secondaries, merge input record + PK
-        const mainForFK = { ...camelcaseObject(preparedMains[i]), ...mainPk };
+        const mainPk = pkRows[i]; // PK-only (already in camelCase field name since PK uses camelCase field)
+        // pkRows entries come from SQL RETURNING or insertId — keys are DB column names.
+        // For simple PK named the same in API and DB (like 'id') this is transparent.
+        // If PK name differs (rare), the user should not rely on mainPk for FK auto-fill — it's the merged inputMain that drives FK.
+        const result = { main: { [pk]: mainPk[pkCol] ?? mainPk[pk] } };
+        // FK auto-fill: input camelCase + generated PK
+        const mainForFK = { ...inputMains[i], [pk]: mainPk[pkCol] ?? mainPk[pk] };
         if (item.secondaries && Object.keys(item.secondaries).length > 0) {
             const sec = await processSecondaries(db, tableConf, dbTables, mainForFK, item.secondaries);
             if (Object.keys(sec).length > 0)
@@ -74,7 +78,7 @@ export async function bulkUpsertEngine(params) {
             if (Object.keys(del).length > 0)
                 result.deletions = del;
         }
-        // 6. afterInsert hook per item
+        // 8. afterInsert hook per item (camelCase)
         if (tableConf.afterInsert) {
             await tableConf.afterInsert(db, request, mainForFK, result.secondaries);
         }

package/dist/lib/engine/rest/get.js

@@ -28,5 +28,5 @@ export async function getEngine(params) {
         err.statusCode = 404;
         throw err;
     }
-    return { main: camelcaseObject(rows[0]) };
+    return { main: camelcaseObject(rows[0], tableConf.Schema) };
 }

package/dist/lib/engine/rest/insert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/insert.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAGb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAyE9E"}
+{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/insert.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAGb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA2E9E"}

package/dist/lib/engine/rest/insert.js

@@ -5,15 +5,23 @@ import { runValidation } from '../validate.js';
 import { primaryAsString } from '../../../types.js';
 export async function insertEngine(params) {
     const { db, tableConf, dbTables, request, record, secondaries, tenant } = params;
+    const schema = tableConf.Schema;
     const pk = primaryAsString(tableConf.primary);
-    const pkCol = tableConf.Schema.col(pk);
-    // 1. Prepare main record
-    let mainRecord = snakecaseRecord(record);
+    const pkCol = schema.col(pk);
+    // 1. Mutable copy of input in camelCase (user-facing format)
+    const inputRecord = { ...record };
+    // 2. Custom validation (camelCase)
+    await runValidation(db, request, tableConf, inputRecord, secondaries);
+    // 3. beforeInsert hook (camelCase — user can mutate with schema field names)
+    if (tableConf.beforeInsert) {
+        await tableConf.beforeInsert(db, request, inputRecord);
+    }
+    // 4. Convert to DB format (after all user mutations)
+    let mainRecord = snakecaseRecord(inputRecord, schema);
     mainRecord = removeExcludedFields(mainRecord, tableConf);
-    // 1b. Tenant: inject or validate
+    // 5. Tenant: inject or validate (enforced after user mutations for security)
     if (tenant) {
         if ('through' in tenant.scope) {
-            // Indirect: validate FK belongs to tenant
             const scope = tenant.scope;
             const fkCol = scope.through.localField;
             const fkValue = mainRecord[fkCol];
@@ -23,36 +31,29 @@ export async function insertEngine(params) {
             injectTenantValue(mainRecord, tenant.scope, tenant.ids);
         }
     }
-    // 2. Custom validation (receives original camelCase record)
-    await runValidation(db, request, tableConf, record, secondaries);
-    // 3. beforeInsert hook
-    if (tableConf.beforeInsert) {
-        await tableConf.beforeInsert(db, request, mainRecord);
-    }
-    // 4. Insert main → returns PK-only
+    // 6. Insert main → returns PK-only
     let pkResult;
-    const upsertKeys = tableConf.upsertMap?.get(tableConf.Schema);
+    const upsertKeys = tableConf.upsertMap?.get(schema);
     if (upsertKeys) {
-        const conflictCols = upsertKeys.map((k) => tableConf.Schema.col(k));
-        pkResult = await db.insertOrUpdate(tableConf.Schema.tableName, mainRecord, conflictCols, pkCol);
+        const conflictCols = upsertKeys.map((k) => schema.col(k));
+        pkResult = await db.insertOrUpdate(schema.tableName, mainRecord, conflictCols, pkCol);
     }
     else {
-        pkResult = await db.insert(tableConf.Schema.tableName, mainRecord, pkCol);
+        pkResult = await db.insert(schema.tableName, mainRecord, pkCol);
     }
-    const mainPkCamel = camelcaseObject(pkResult);
-    // 5. Secondaries: need full record for FK auto-fill
+    const mainPkCamel = camelcaseObject(pkResult, schema);
+    // 7. Secondaries: need full record for FK auto-fill (camelCase)
     let secondaryResults;
     if (secondaries && Object.keys(secondaries).length > 0) {
-        // Merge input record + PK for FK auto-fill
-        const mainForFK = { ...camelcaseObject(mainRecord), ...mainPkCamel };
+        const mainForFK = { ...inputRecord, ...mainPkCamel };
         secondaryResults = await processSecondaries(db, tableConf, dbTables, mainForFK, secondaries);
     }
-    // 6. afterInsert hook
+    // 8. afterInsert hook (camelCase — input merged with generated PK)
     if (tableConf.afterInsert) {
-        const mainForHook = { ...camelcaseObject(mainRecord), ...mainPkCamel };
+        const mainForHook = { ...inputRecord, ...mainPkCamel };
         await tableConf.afterInsert(db, request, mainForHook, secondaryResults);
     }
-    // 7. Return PK-only
+    // 9. Return PK-only
     const result = { main: mainPkCamel };
     if (secondaryResults && Object.keys(secondaryResults).length > 0) {
         result.secondaries = secondaryResults;

package/dist/lib/engine/rest/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAGb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAgI9E"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAGb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAkI9E"}

package/dist/lib/engine/rest/update.js

@@ -1,4 +1,4 @@
-import { camelcaseObject, snakecaseRecord } from '../../naming.js';
+import { snakecaseRecord } from '../../naming.js';
 import { processSecondaries, processDeletions } from '../write-helpers.js';
 import { stripTenantColumn, buildTenantCondition, buildTenantJoin } from '../../tenant.js';
 import { runValidation } from '../validate.js';
@@ -6,51 +6,53 @@ import { ConditionBuilder } from 'node-condition-builder';
 import { primaryAsString } from '../../../types.js';
 export async function updateEngine(params) {
     const { db, tableConf, dbTables, request, record, secondaries, deletions, tenant } = params;
-    // 1. Prepare: extract PK, snakecase, build update fields
+    const schema = tableConf.Schema;
     const pk = primaryAsString(tableConf.primary);
-    const pkCol = tableConf.Schema.col(pk);
-    const snaked = snakecaseRecord(record);
-    const pkValue = snaked[pkCol];
+    const pkCol = schema.col(pk);
+    const pkValue = record[pk];
     if (pkValue == null) {
         const error = new Error(`Primary key "${pk}" is required`);
         error.statusCode = 400;
         throw error;
     }
+    // 1. Tenant ownership check (indirect) — do it early so user mutations don't run on records they can't access
+    if (tenant && 'through' in tenant.scope) {
+        const scope = tenant.scope;
+        const tableName = schema.tableName;
+        const cb = new ConditionBuilder('AND');
+        cb.isEqual(`${db.qi(tableName)}.${db.qi(pkCol)}`, pkValue);
+        cb.append(buildTenantCondition(db, scope, tenant.ids));
+        const checkWhere = cb.build(1, db.ph);
+        const checkValues = cb.getValues();
+        const joinSql = buildTenantJoin(db, scope, tableName);
+        const checkSql = `SELECT 1 FROM ${db.qi(tableName)} ${joinSql} WHERE ${checkWhere} LIMIT 1`;
+        const checkResult = await db.query(checkSql, checkValues);
+        if (checkResult.rows.length === 0) {
+            const error = new Error('Record not found');
+            error.statusCode = 404;
+            throw error;
+        }
+    }
+    // 2. Mutable copy of input in camelCase
+    const inputRecord = { ...record };
+    // 3. Custom validation (camelCase)
+    await runValidation(db, request, tableConf, inputRecord, secondaries);
+    // 4. beforeUpdate hook (camelCase — user can mutate with schema field names)
+    if (tableConf.beforeUpdate) {
+        await tableConf.beforeUpdate(db, request, inputRecord);
+    }
+    // 5. Convert to DB format (after all user mutations)
+    const snaked = snakecaseRecord(inputRecord, schema);
     const updateFields = { ...snaked };
     delete updateFields[pkCol];
-    // 1b. Tenant: strip tenant column from update fields + validate ownership
+    // 6. Strip tenant column (user cannot change tenant of an existing record)
     if (tenant) {
         stripTenantColumn(updateFields, tenant.scope);
-        if ('through' in tenant.scope) {
-            // Indirect: verify the record belongs to tenant via subquery
-            const scope = tenant.scope;
-            const tableName = tableConf.Schema.tableName;
-            const cb = new ConditionBuilder('AND');
-            cb.isEqual(`${db.qi(tableName)}.${db.qi(pkCol)}`, pkValue);
-            cb.append(buildTenantCondition(db, scope, tenant.ids));
-            const checkWhere = cb.build(1, db.ph);
-            const checkValues = cb.getValues();
-            const joinSql = buildTenantJoin(db, scope, tableName);
-            const checkSql = `SELECT 1 FROM ${db.qi(tableName)} ${joinSql} WHERE ${checkWhere} LIMIT 1`;
-            const checkResult = await db.query(checkSql, checkValues);
-            if (checkResult.rows.length === 0) {
-                const error = new Error('Record not found');
-                error.statusCode = 404;
-                throw error;
-            }
-        }
-    }
-    // 2. Custom validation (receives original camelCase record)
-    await runValidation(db, request, tableConf, record, secondaries);
-    // 3. beforeUpdate hook
-    if (tableConf.beforeUpdate) {
-        await tableConf.beforeUpdate(db, request, updateFields);
     }
-    // 4. Update main
+    // 7. Update main
     const hasFieldsToUpdate = Object.keys(updateFields).length > 0;
     let extraCondition;
     if (tenant && !('through' in tenant.scope)) {
-        // Direct: add tenant to WHERE
         extraCondition = new ConditionBuilder('AND');
         if (tenant.ids.length === 1) {
             extraCondition.isEqual(tenant.scope.column, tenant.ids[0]);
@@ -60,7 +62,7 @@ export async function updateEngine(params) {
         }
     }
     if (hasFieldsToUpdate) {
-        const affectedRows = await db.update(tableConf.Schema.tableName, updateFields, { [pkCol]: pkValue }, extraCondition);
+        const affectedRows = await db.update(schema.tableName, updateFields, { [pkCol]: pkValue }, extraCondition);
         if (affectedRows === 0) {
             const error = new Error(`Record not found`);
             error.statusCode = 404;
@@ -69,14 +71,14 @@ export async function updateEngine(params) {
     }
     else {
         // No fields to update: verify the record exists (for secondaries/deletions)
-        let whereSql = `${db.qi(tableConf.Schema.tableName)}.${db.qi(pkCol)} = ${db.ph(1)}`;
+        let whereSql = `${db.qi(schema.tableName)}.${db.qi(pkCol)} = ${db.ph(1)}`;
         const whereValues = [pkValue];
         if (extraCondition) {
             whereSql += ` AND ${extraCondition.build(2, db.ph)}`;
             whereValues.push(...extraCondition.getValues());
         }
         const rows = await db.select({
-            tableName: tableConf.Schema.tableName,
+            tableName: schema.tableName,
             where: whereSql,
             values: whereValues,
             limit: '1',
@@ -89,19 +91,18 @@ export async function updateEngine(params) {
     }
     // Build the main response (PK-only)
     const mainResult = { [pk]: pkValue };
-    // 5. Secondaries (upsert/insert with FK auto-fill)
+    // 8. Secondaries (upsert/insert with FK auto-fill — camelCase)
     let secondaryResults;
     if (secondaries && Object.keys(secondaries).length > 0) {
-        // Merge input fields + PK for FK auto-fill
-        const mainForFK = { ...camelcaseObject(snaked) };
+        const mainForFK = { ...inputRecord };
         secondaryResults = await processSecondaries(db, tableConf, dbTables, mainForFK, secondaries);
     }
-    // 6. Deletions
+    // 9. Deletions
     let deletionResults;
     if (deletions && Object.keys(deletions).length > 0) {
         deletionResults = await processDeletions(db, tableConf, deletions);
     }
-    // 7. Return PK-only
+    // 10. Return PK-only
     const result = { main: mainResult };
     if (secondaryResults && Object.keys(secondaryResults).length > 0) {
         result.secondaries = secondaryResults;

package/dist/lib/engine/search/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,QAAQ,EAER,YAAY,EACZ,YAAY,EASb,MAAM,mBAAmB,CAAC;AA+V3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CAyDvB"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,QAAQ,EAER,YAAY,EACZ,YAAY,EAUb,MAAM,mBAAmB,CAAC;AA+lB3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CA2EvB"}