fastify-auto-sqlapi 0.1.1 → 0.1.3

package/dist/lib/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAQ/C,sCAAsC;AACtC,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,WAA0B,CAAC;AAEhE,qBAAa,WAAW;;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,KAAK,CAAS;gBAEV,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU;IAKnD,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAE/B;IAED,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAE9B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,SAAS,IAAI,UAAU,CAAC,WAAW,CAAC,CAEvC;IAED,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI7B,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAIrC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAmGlB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAgB7B,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAkB7B,UAAU,CACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAoB/B,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAuB/B,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,QAAQ,EACf,cAAc,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,MAAM,CAAC;IAuBZ,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,MAAM,CAAC;IAYZ,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACxC,SAAS,EACT,OAAa,EACb,KAAK,EACL,MAAM,EACN,KAAY,EACZ,OAAY,EACZ,KAAU,EACV,QAAgB,GACjB,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAchC;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,WAAW,CAGb"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAQ/C,sCAAsC;AACtC,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,WAA0B,CAAC;AAEhE,qBAAa,WAAW;;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,KAAK,CAAS;gBAEV,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU;IAKnD,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAE/B;IAED,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAE9B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,iFAAiF;IACjF,IAAI,SAAS,IAAI,UAAU,CAAC,WAAW,CAAC,CAEvC;IAED,mFAAmF;IACnF,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAED,uEAAuE;IACvE,IAAI,WAAW,IAAI,UAAU,CAAC,aAAa,CAAC,CAE3C;IAED,IAAI,SAAS,IAAI,UAAU,CAAC,WAAW,CAAC,CAEvC;IAED,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI7B,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAIrC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAQxB;;;;;;;;;OASG;IACG,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAmHnE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAgB7B,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAkB7B,UAAU,CACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAoB/B,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAuB/B,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,QAAQ,EACf,cAAc,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,MAAM,CAAC;IAuBZ,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,MAAM,CAAC;IAYZ,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACxC,SAAS,EACT,OAAa,EACb,KAAK,EACL,MAAM,EACN,KAAY,EACZ,OAAY,EACZ,KAAU,EACV,QAAgB,GACjB,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAchC;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,WAAW,CAGb"}

package/dist/lib/db.js

@@ -23,6 +23,18 @@ export class QueryClient {
     get dialectName() {
         return this.dialect.name;
     }
+    /** ConditionBuilder dialect ('postgres' | 'mysql') for per-instance builders. */
+    get cbDialect() {
+        return this.dialect.cbDialect;
+    }
+    /** Whether the dialect supports `RETURNING` (postgres/mariadb: yes, mysql: no). */
+    get supportsReturning() {
+        return this.dialect.supportsReturning;
+    }
+    /** Build the ` RETURNING <quoted pk>` suffix ('' when unsupported). */
+    get returningPk() {
+        return this.dialect.returningPk.bind(this.dialect);
+    }
     get dateTrunc() {
         return this.dialect.dateTrunc.bind(this.dialect);
     }
@@ -39,6 +51,41 @@ export class QueryClient {
         }
         return this.client.query(text, values);
     }
+    /**
+     * Run `fn` inside a DB transaction on a dedicated connection (BEGIN/COMMIT, with
+     * ROLLBACK + rethrow on error). Requires the underlying Queryable to expose
+     * `connect()`; when it does not (legacy custom adapters), `fn` runs directly on
+     * this client without transactional guarantees.
+     *
+     * Nested calls join the outer transaction: the tx QueryClient wraps a dedicated
+     * connection that has no `connect()`, so an inner `withTransaction` is a no-op
+     * wrapper around the same connection.
+     */
+    async withTransaction(fn) {
+        if (!this.client.connect)
+            return fn(this);
+        const conn = await this.client.connect();
+        const tx = new QueryClient(conn, this.dialect);
+        tx.setDebug(this.debug);
+        try {
+            await conn.query('BEGIN');
+            const result = await fn(tx);
+            await conn.query('COMMIT');
+            return result;
+        }
+        catch (err) {
+            try {
+                await conn.query('ROLLBACK');
+            }
+            catch {
+                // The connection is broken: surface the original error, not the rollback failure.
+            }
+            throw err;
+        }
+        finally {
+            await conn.release();
+        }
+    }
     // Quote a list of fields
     #q(fields) {
         return fields.map((f) => this.dialect.qi(f)).join(', ');

package/dist/lib/engine/bulk/bulk-delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-delete.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-delete.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAiC5F"}
+{"version":3,"file":"bulk-delete.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-delete.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAiE5F"}

package/dist/lib/engine/bulk/bulk-delete.js

@@ -1,30 +1,53 @@
 import { ConditionBuilder } from 'node-condition-builder';
-import { buildTenantDeleteWhere } from '../../tenant.js';
+import { buildTenantDeleteWhere, assertTenantOwnsAll } from '../../tenant.js';
 import { primaryAsString } from '../../../types.js';
 export async function bulkDeleteEngine(params) {
-    const { db, tableConf, ids, tenant } = params;
+    const { db, tableConf, ids, tenant, request } = params;
     if (!ids.length)
         return [];
     const pk = primaryAsString(tableConf.primary);
     const pkCol = tableConf.Schema.col(pk);
     const tableName = tableConf.Schema.tableName;
+    if (tableConf.beforeBulkDelete) {
+        // Enforce tenant ownership of every id before the hook (single batched SELECT), so it
+        // never runs for rows the tenant cannot access. Called once with all ids — no loop.
+        await assertTenantOwnsAll(db, tenant, tableName, pkCol, ids);
+        await tableConf.beforeBulkDelete(db, request, ids);
+    }
     let where;
     let values;
     if (tenant) {
         ({ where, values } = buildTenantDeleteWhere(db, tableName, pkCol, ids, tenant));
     }
     else {
-        const cb = new ConditionBuilder('AND');
+        const cb = new ConditionBuilder('AND', db.cbDialect);
         cb.isIn(db.qi(pkCol), ids);
         where = cb.build(1, db.ph);
         values = cb.getValues();
     }
-    const result = await db.query(`DELETE FROM ${db.qi(tableName)} WHERE ${where}`, values);
-    // Return PK-only for each deleted record
-    if (result.affectedRows === ids.length) {
-        return ids.map((id) => ({ main: { [pk]: id } }));
+    let results;
+    if (db.supportsReturning) {
+        const result = await db.query(`DELETE FROM ${db.qi(tableName)} WHERE ${where}${db.returningPk(db.qi(pkCol))}`, values);
+        // Happy path: everything requested was deleted
+        if (result.affectedRows === ids.length) {
+            results = ids.map((id) => ({ main: { [pk]: id } }));
+        }
+        else {
+            // Partial delete: RETURNING tells exactly which rows went away
+            results = result.rows.map((r) => ({ main: { [pk]: r[pkCol] } }));
+        }
+    }
+    else {
+        // No RETURNING (mysql): affectedRows alone cannot tell WHICH ids were deleted on a
+        // partial match, so look up the rows visible through the same WHERE before deleting.
+        const existing = await db.query(`SELECT ${db.qi(pkCol)} AS pk FROM ${db.qi(tableName)} WHERE ${where}`, values);
+        await db.query(`DELETE FROM ${db.qi(tableName)} WHERE ${where}`, values);
+        results = existing.rows.map((r) => ({ main: { [pk]: r.pk } }));
+    }
+    // Called once with the ACTUALLY deleted ids (possibly a subset of the requested ones)
+    if (tableConf.afterBulkDelete && results.length > 0) {
+        const deletedIds = results.map((r) => r.main[pk]);
+        await tableConf.afterBulkDelete(db, request, deletedIds);
     }
-    // Partial delete: best effort (no RETURNING on MySQL)
-    const deletedCount = result.affectedRows;
-    return ids.slice(0, deletedCount).map((id) => ({ main: { [pk]: id } }));
+    return results;
 }

package/dist/lib/engine/bulk/bulk-upsert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-upsert.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkF5F"}
+{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-upsert.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkF5F"}

package/dist/lib/engine/bulk/bulk-upsert.js

@@ -1,14 +1,15 @@
+import { camelcaseObject } from '../../naming.js';
 import { processSecondaries, processDeletions, prepareInsertRecord } from '../write-helpers.js';
 import { enforceTenantOnWrites } from '../../tenant.js';
 import { runBulkValidation } from '../validate.js';
-import { primaryAsString } from '../../../types.js';
+import { primaryAsCols } from '../../../types.js';
 export async function bulkUpsertEngine(params) {
     const { db, tableConf, dbTables, request, items, tenant } = params;
     if (!items.length)
         return [];
     const schema = tableConf.Schema;
-    const pk = primaryAsString(tableConf.primary);
-    const pkCol = schema.col(pk);
+    // Full primary key columns — composite PKs need every column (see insertEngine).
+    const pkCol = primaryAsCols(tableConf.primary, (f) => schema.col(f));
     // 1. Bulk validation runs once for all items (skips per-item validate). Otherwise per-item
     //    validation happens inside prepareInsertRecord below.
     if (tableConf.validateBulk) {
@@ -34,12 +35,12 @@ export async function bulkUpsertEngine(params) {
     const results = [];
     for (let i = 0; i < items.length; i++) {
         const item = items[i];
-        const mainPk = pkRows[i]; // PK-only (already in camelCase field name since PK uses camelCase field)
-        // pkRows entries come from SQL RETURNING or insertId — keys are DB column names.
-        // For simple PK named the same in API and DB (like 'id') this is transparent.
-        const result = { main: { [pk]: mainPk[pkCol] ?? mainPk[pk] } };
+        // pkRows entries come from SQL RETURNING or mysql insertId synthesis — keys are DB
+        // column names; camelcaseObject maps them back to schema fields (full composite PK).
+        const mainPkCamel = camelcaseObject(pkRows[i], schema);
+        const result = { main: mainPkCamel };
         // FK auto-fill: input camelCase + generated PK
-        const mainForFK = { ...inputMains[i], [pk]: mainPk[pkCol] ?? mainPk[pk] };
+        const mainForFK = { ...inputMains[i], ...mainPkCamel };
         if (item.secondaries && Object.keys(item.secondaries).length > 0) {
             const sec = await processSecondaries(db, tableConf, dbTables, mainForFK, item.secondaries);
             if (Object.keys(sec).length > 0)

package/dist/lib/engine/rest/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/delete.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAY,MAAM,mBAAmB,CAAC;AAE9E,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAsB9E"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/delete.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAY,MAAM,mBAAmB,CAAC;AAE9E,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAiC9E"}

package/dist/lib/engine/rest/delete.js

@@ -1,20 +1,31 @@
-import { buildTenantDeleteWhere } from '../../tenant.js';
+import { buildTenantDeleteWhere, assertTenantOwnsAll } from '../../tenant.js';
 import { httpError } from '../../errors.js';
 import { primaryAsString } from '../../../types.js';
 export async function deleteEngine(params) {
-    const { db, tableConf, id, tenant } = params;
+    const { db, tableConf, id, tenant, request } = params;
     const pk = primaryAsString(tableConf.primary);
     const pkCol = tableConf.Schema.col(pk);
     const tableName = tableConf.Schema.tableName;
+    if (tableConf.beforeDelete) {
+        // Enforce tenant ownership before the hook so it never runs for rows the tenant
+        // cannot access. (When no hook is defined, the tenant-scoped DELETE below already
+        // prevents deleting non-owned rows, so the extra SELECT is skipped.)
+        await assertTenantOwnsAll(db, tenant, tableName, pkCol, [id]);
+        await tableConf.beforeDelete(db, request, id);
+    }
     if (!tenant) {
         const affectedRows = await db.delete(tableName, { [pkCol]: id });
         if (affectedRows === 0)
             throw httpError(404, `Record not found: ${id}`);
-        return { main: { [pk]: id } };
     }
-    const { where, values } = buildTenantDeleteWhere(db, tableName, pkCol, id, tenant);
-    const result = await db.query(`DELETE FROM ${db.qi(tableName)} WHERE ${where}`, values);
-    if (result.affectedRows === 0)
-        throw httpError(404, `Record not found: ${id}`);
+    else {
+        const { where, values } = buildTenantDeleteWhere(db, tableName, pkCol, id, tenant);
+        const result = await db.query(`DELETE FROM ${db.qi(tableName)} WHERE ${where}`, values);
+        if (result.affectedRows === 0)
+            throw httpError(404, `Record not found: ${id}`);
+    }
+    if (tableConf.afterDelete) {
+        await tableConf.afterDelete(db, request, id);
+    }
     return { main: { [pk]: id } };
 }

package/dist/lib/engine/rest/get.js

@@ -6,7 +6,7 @@ import { primaryAsString } from '../../../types.js';
 export async function getEngine(params) {
     const { db, tableConf, id, tenant } = params;
     const pkCol = tableConf.Schema.col(primaryAsString(tableConf.primary));
-    const cb = new ConditionBuilder('AND');
+    const cb = new ConditionBuilder('AND', db.cbDialect);
     cb.isEqual(db.qi(pkCol), id);
     const joins = [];
     if (tenant) {

package/dist/lib/engine/rest/insert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/insert.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA0D9E"}
+{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/insert.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA+D9E"}

package/dist/lib/engine/rest/insert.js

@@ -1,42 +1,47 @@
 import { camelcaseObject } from '../../naming.js';
 import { processSecondaries, prepareInsertRecord } from '../write-helpers.js';
 import { enforceTenantOnWrites } from '../../tenant.js';
-import { primaryAsString } from '../../../types.js';
+import { primaryAsCols } from '../../../types.js';
 export async function insertEngine(params) {
     const { db, tableConf, dbTables, request, record, secondaries, tenant } = params;
     const schema = tableConf.Schema;
-    const pk = primaryAsString(tableConf.primary);
-    const pkCol = schema.col(pk);
+    // Full primary key columns (composite PKs need every column for RETURNING /
+    // mysql synthesis, otherwise the response is missing PK fields).
+    const pkCol = primaryAsCols(tableConf.primary, (f) => schema.col(f));
     // 1. Validate, run beforeInsert hook, snakecase, drop excluded fields.
     const { camel: inputRecord, snake: mainRecord } = await prepareInsertRecord({ db, tableConf, request }, record, secondaries);
-    // 2. Tenant: inject (direct) or validate FK (indirect) — enforced after user mutations
-    await enforceTenantOnWrites(db, tenant, [mainRecord]);
-    // 3. Insert main → returns PK-only
-    let pkResult;
-    const upsertKeys = tableConf.upsertMap?.get(schema);
-    if (upsertKeys) {
-        const conflictCols = upsertKeys.map((k) => schema.col(k));
-        pkResult = await db.insertOrUpdate(schema.tableName, mainRecord, conflictCols, pkCol);
-    }
-    else {
-        pkResult = await db.insert(schema.tableName, mainRecord, pkCol);
-    }
-    const mainPkCamel = camelcaseObject(pkResult, schema);
-    // 4. Secondaries: need full record for FK auto-fill (camelCase)
-    let secondaryResults;
-    if (secondaries && Object.keys(secondaries).length > 0) {
-        const mainForFK = { ...inputRecord, ...mainPkCamel };
-        secondaryResults = await processSecondaries(db, tableConf, dbTables, mainForFK, secondaries);
-    }
-    // 5. afterInsert hook (camelCase — input merged with generated PK)
-    if (tableConf.afterInsert) {
-        const mainForHook = { ...inputRecord, ...mainPkCamel };
-        await tableConf.afterInsert(db, request, mainForHook, secondaryResults);
-    }
-    // 6. Return PK-only
-    const result = { main: mainPkCamel };
-    if (secondaryResults && Object.keys(secondaryResults).length > 0) {
-        result.secondaries = secondaryResults;
-    }
-    return result;
+    // Steps 2-5 are atomic: a failure in secondaries or afterInsert rolls back the
+    // main insert too. Degrades to non-transactional when the adapter has no connect().
+    return db.withTransaction(async (tx) => {
+        // 2. Tenant: inject (direct) or validate FK (indirect) — enforced after user mutations
+        await enforceTenantOnWrites(tx, tenant, [mainRecord]);
+        // 3. Insert main → returns PK-only
+        let pkResult;
+        const upsertKeys = tableConf.upsertMap?.get(schema);
+        if (upsertKeys) {
+            const conflictCols = upsertKeys.map((k) => schema.col(k));
+            pkResult = await tx.insertOrUpdate(schema.tableName, mainRecord, conflictCols, pkCol);
+        }
+        else {
+            pkResult = await tx.insert(schema.tableName, mainRecord, pkCol);
+        }
+        const mainPkCamel = camelcaseObject(pkResult, schema);
+        // 4. Secondaries: need full record for FK auto-fill (camelCase)
+        let secondaryResults;
+        if (secondaries && Object.keys(secondaries).length > 0) {
+            const mainForFK = { ...inputRecord, ...mainPkCamel };
+            secondaryResults = await processSecondaries(tx, tableConf, dbTables, mainForFK, secondaries);
+        }
+        // 5. afterInsert hook (camelCase — input merged with generated PK)
+        if (tableConf.afterInsert) {
+            const mainForHook = { ...inputRecord, ...mainPkCamel };
+            await tableConf.afterInsert(tx, request, mainForHook, secondaryResults);
+        }
+        // 6. Return PK-only
+        const result = { main: mainPkCamel };
+        if (secondaryResults && Object.keys(secondaryResults).length > 0) {
+            result.secondaries = secondaryResults;
+        }
+        return result;
+    });
 }

package/dist/lib/engine/rest/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA+F9E"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAqH9E"}

package/dist/lib/engine/rest/update.js

@@ -3,17 +3,19 @@ import { processSecondaries, processDeletions } from '../write-helpers.js';
 import { stripTenantColumn, assertTenantOwnership, buildTenantUpdateExtra, } from '../../tenant.js';
 import { runValidation } from '../validate.js';
 import { httpError } from '../../errors.js';
-import { primaryAsString } from '../../../types.js';
 export async function updateEngine(params) {
     const { db, tableConf, dbTables, request, record, secondaries, deletions, tenant } = params;
     const schema = tableConf.Schema;
-    const pk = primaryAsString(tableConf.primary);
-    const pkCol = schema.col(pk);
-    const pkValue = record[pk];
-    if (pkValue == null)
-        throw httpError(400, `Primary key "${pk}" is required`);
+    // Every primary key field/column: composite PKs must match on ALL columns, otherwise an
+    // UPDATE keyed on the first column alone would hit every row sharing that value.
+    const pkFields = Array.isArray(tableConf.primary) ? tableConf.primary : [tableConf.primary];
+    const pkCols = pkFields.map((f) => schema.col(f));
+    const pkValues = pkFields.map((f) => record[f]);
+    const missingIdx = pkValues.findIndex((v) => v == null);
+    if (missingIdx !== -1)
+        throw httpError(400, `Primary key "${pkFields[missingIdx]}" is required`);
     // 1. Tenant ownership check (indirect) — do it early so user mutations don't run on records they can't access
-    await assertTenantOwnership(db, tenant, schema.tableName, pkCol, pkValue);
+    await assertTenantOwnership(db, tenant, schema.tableName, pkCols, pkValues);
     // 2. Mutable copy of input in camelCase
     const inputRecord = { ...record };
     // 3. Custom validation (camelCase)
@@ -25,57 +27,69 @@ export async function updateEngine(params) {
     // 5. Convert to DB format (after all user mutations)
     const snaked = snakecaseRecord(inputRecord, schema);
     const updateFields = { ...snaked };
-    delete updateFields[pkCol];
+    for (const c of pkCols)
+        delete updateFields[c];
     // 6. Strip tenant column (user cannot change tenant of an existing record)
     if (tenant) {
         stripTenantColumn(updateFields, tenant.scope);
     }
-    // 7. Update main
-    const hasFieldsToUpdate = Object.keys(updateFields).length > 0;
-    const extraCondition = buildTenantUpdateExtra(tenant);
-    if (hasFieldsToUpdate) {
-        const affectedRows = await db.update(schema.tableName, updateFields, { [pkCol]: pkValue }, extraCondition);
-        if (affectedRows === 0)
-            throw httpError(404, `Record not found`);
-    }
-    else {
-        // No fields to update: verify the record exists (for secondaries/deletions)
-        let whereSql = `${db.qi(schema.tableName)}.${db.qi(pkCol)} = ${db.ph(1)}`;
-        const whereValues = [pkValue];
-        if (extraCondition) {
-            whereSql += ` AND ${extraCondition.build(2, db.ph)}`;
-            whereValues.push(...extraCondition.getValues());
+    // Steps 7-9 are atomic: a failure in secondaries or deletions rolls back the main
+    // update too. Degrades to non-transactional when the adapter has no connect().
+    return db.withTransaction(async (tx) => {
+        // 7. Update main
+        const hasFieldsToUpdate = Object.keys(updateFields).length > 0;
+        const extraCondition = buildTenantUpdateExtra(tx, tenant);
+        // WHERE matching every primary key column (single or composite).
+        const whereByPk = Object.fromEntries(pkCols.map((c, i) => [c, pkValues[i]]));
+        if (hasFieldsToUpdate) {
+            const affectedRows = await tx.update(schema.tableName, updateFields, whereByPk, extraCondition);
+            if (affectedRows === 0)
+                throw httpError(404, `Record not found`);
         }
-        const rows = await db.select({
-            tableName: schema.tableName,
-            where: whereSql,
-            values: whereValues,
-            limit: '1',
-        });
-        if (rows.length === 0)
-            throw httpError(404, `Record not found`);
-    }
-    // Build the main response (PK-only)
-    const mainResult = { [pk]: pkValue };
-    // 8. Secondaries (upsert/insert with FK auto-fill — camelCase)
-    let secondaryResults;
-    if (secondaries && Object.keys(secondaries).length > 0) {
-        const mainForFK = { ...inputRecord };
-        secondaryResults = await processSecondaries(db, tableConf, dbTables, mainForFK, secondaries);
-    }
-    // 9. Deletions (FK auto-fill from main like secondaries)
-    let deletionResults;
-    if (deletions && Object.keys(deletions).length > 0) {
-        const mainForFK = { ...inputRecord };
-        deletionResults = await processDeletions(db, tableConf, mainForFK, deletions);
-    }
-    // 10. Return PK-only
-    const result = { main: mainResult };
-    if (secondaryResults && Object.keys(secondaryResults).length > 0) {
-        result.secondaries = secondaryResults;
-    }
-    if (deletionResults && Object.keys(deletionResults).length > 0) {
-        result.deletions = deletionResults;
-    }
-    return result;
+        else {
+            // No fields to update: verify the record exists (for secondaries/deletions)
+            const whereParts = pkCols.map((c, i) => `${tx.qi(schema.tableName)}.${tx.qi(c)} = ${tx.ph(i + 1)}`);
+            let whereSql = whereParts.join(' AND ');
+            const whereValues = [...pkValues];
+            if (extraCondition) {
+                whereSql += ` AND ${extraCondition.build(pkCols.length + 1, tx.ph)}`;
+                whereValues.push(...extraCondition.getValues());
+            }
+            const rows = await tx.select({
+                tableName: schema.tableName,
+                where: whereSql,
+                values: whereValues,
+                limit: '1',
+            });
+            if (rows.length === 0)
+                throw httpError(404, `Record not found`);
+        }
+        // Build the main response (PK-only — every PK field)
+        const mainResult = Object.fromEntries(pkFields.map((f, i) => [f, pkValues[i]]));
+        // 8. Secondaries (upsert/insert with FK auto-fill — camelCase)
+        let secondaryResults;
+        if (secondaries && Object.keys(secondaries).length > 0) {
+            const mainForFK = { ...inputRecord };
+            secondaryResults = await processSecondaries(tx, tableConf, dbTables, mainForFK, secondaries);
+        }
+        // 9. Deletions (FK auto-fill from main like secondaries)
+        let deletionResults;
+        if (deletions && Object.keys(deletions).length > 0) {
+            const mainForFK = { ...inputRecord };
+            deletionResults = await processDeletions(tx, tableConf, mainForFK, deletions);
+        }
+        // 10. afterUpdate hook (inside the transaction: throwing rolls everything back)
+        if (tableConf.afterUpdate) {
+            await tableConf.afterUpdate(tx, request, inputRecord, secondaryResults, deletionResults);
+        }
+        // 11. Return PK-only
+        const result = { main: mainResult };
+        if (secondaryResults && Object.keys(secondaryResults).length > 0) {
+            result.secondaries = secondaryResults;
+        }
+        if (deletionResults && Object.keys(deletionResults).length > 0) {
+            result.deletions = deletionResults;
+        }
+        return result;
+    });
 }

package/dist/lib/engine/search/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EAab,MAAM,mBAAmB,CAAC;AAy/B3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CAoIvB"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EAcb,MAAM,mBAAmB,CAAC;AAmiC3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CAoIvB"}