fastify-auto-sqlapi 0.1.2 → 0.1.4

package/dist/lib/cli/tables-codegen.js

@@ -20,15 +20,34 @@ export function parseSchemaFile(content) {
     }
     if (fields.length === 0)
         return null;
+    // primaryKey: ["code"] — emitted by generate-schema from DB introspection
+    let primary;
+    const pkMatch = content.match(/primaryKey:\s*\[([^\]]*)\]/);
+    if (pkMatch) {
+        primary = pkMatch[1]
+            .split(',')
+            .map((s) => s.trim().replace(/^["']|["']$/g, ''))
+            .filter(Boolean);
+        if (primary.length === 0)
+            primary = undefined;
+    }
     return {
         schemaName: exportMatch[1],
         tableName: tableNameMatch[1],
         fields,
         fieldTypes,
+        primary,
     };
 }
 // ─── Detection ───────────────────────────────────────────────
 function detectPrimaryKey(schema) {
+    // Preferred source: the PK introspected from the DB (primaryKey in the schema file).
+    if (schema.primary?.length) {
+        const pk = schema.primary.length === 1 ? schema.primary[0] : schema.primary;
+        const first = schema.primary[0];
+        return { pk, autoIncrement: schema.fieldTypes[first]?.includes('Optional') ?? false };
+    }
+    // Heuristic fallback for hand-written/legacy schema files without primaryKey.
     if (schema.fields.includes('id')) {
         return { pk: 'id', autoIncrement: schema.fieldTypes['id']?.includes('Optional') ?? false };
     }
@@ -39,6 +58,18 @@ function detectPrimaryKey(schema) {
     }
     return { pk: schema.fields[0], autoIncrement: false };
 }
+/** First PK field: used for defaultOrder, relations and example snippets. */
+function pkFirst(pk) {
+    return Array.isArray(pk) ? pk[0] : pk;
+}
+/** Render the `primary:` value for the defineTable template. */
+function formatPrimary(pk) {
+    return Array.isArray(pk) ? `[${pk.map((p) => `'${p}'`).join(', ')}]` : `'${pk}'`;
+}
+/** All PK fields as an array, for "non-PK field" lookups in example snippets. */
+function pkFields(pk) {
+    return Array.isArray(pk) ? pk : [pk];
+}
 export function detectRelations(schemas) {
     const tableBySnakeName = new Map();
     for (const schema of schemas) {
@@ -55,7 +86,7 @@ export function detectRelations(schemas) {
                 const { pk } = detectPrimaryKey(parent);
                 relations.push({
                     parentSchemaName: parent.schemaName,
-                    parentField: pk,
+                    parentField: pkFirst(pk),
                     childSchemaName: schema.schemaName,
                     childField: field,
                 });
@@ -113,7 +144,7 @@ export function generateSingleTableFile(schema, allSchemas) {
     lines.push(``);
     lines.push(`// Fields: ${schema.fields.join(', ')}`);
     lines.push(`export const ${tableVarName} = defineTable({`);
-    lines.push(`  primary: '${pk}',`);
+    lines.push(`  primary: ${formatPrimary(pk)},`);
     lines.push(`  ...exportTableInfo(Schema),`);
     // Commented example with extraFilters + extendedCondition
     lines.push(`  // ...exportTableInfo(`);
@@ -123,9 +154,9 @@ export function generateSingleTableFile(schema, allSchemas) {
     lines.push(`  //     if (filters.q) condition.isILike(Schema.col('${schema.fields.includes('name') ? 'name' : schema.fields[0]}'), \`%\${filters.q}%\`);`);
     lines.push(`  //   }`);
     lines.push(`  // ),`);
-    lines.push(`  defaultOrder: '${pk}',`);
+    lines.push(`  defaultOrder: '${pkFirst(pk)}',`);
     if (autoIncrement) {
-        lines.push(`  excludeFromCreation: ['${pk}'],`);
+        lines.push(`  excludeFromCreation: ['${pkFirst(pk)}'],`);
     }
     else {
         lines.push(`  // excludeFromCreation: [],`);
@@ -140,14 +171,14 @@ export function generateSingleTableFile(schema, allSchemas) {
     else {
         lines.push(`  // allowedReadJoins: [],`);
     }
-    lines.push(`  // upsertMap: buildUpsertRules(buildUpsertRule(Schema, ['${pk}'])),`);
+    lines.push(`  // upsertMap: buildUpsertRules(buildUpsertRule(Schema, [${pkFields(pk).map((p) => `'${p}'`).join(', ')}])),`);
     // schemaOverrides: suggest email format if email field exists, otherwise minLength on first string field
     const emailField = schema.fields.find(f => f.toLowerCase().includes('email'));
     if (emailField) {
         lines.push(`  // schemaOverrides: { ${emailField}: Type.String({ format: 'email' }) },`);
     }
     else {
-        const stringField = schema.fields.find(f => f !== pk && schema.fieldTypes[f]?.includes('String'));
+        const stringField = schema.fields.find(f => !pkFields(pk).includes(f) && schema.fieldTypes[f]?.includes('String'));
         if (stringField) {
             lines.push(`  // schemaOverrides: { ${stringField}: Type.String({ minLength: 1 }) },`);
         }
@@ -156,7 +187,7 @@ export function generateSingleTableFile(schema, allSchemas) {
         }
     }
     // validate: use first non-PK field for example
-    const exampleField = schema.fields.find(f => f !== pk) || schema.fields[0];
+    const exampleField = schema.fields.find(f => !pkFields(pk).includes(f)) || schema.fields[0];
     lines.push(`  validate: async (db, req, main, secondaries) => {`);
     lines.push(`    const errors: ValidationError[] = [];`);
     lines.push(`    // if (!main.${exampleField}) errors.push(['${exampleField}', 'required']);`);
@@ -225,11 +256,11 @@ export function generateTablesFile(schemas) {
         lines.push(`// ─── ${schema.tableName} ──────────────────────────────`);
         lines.push(`// Fields: ${schema.fields.join(', ')}`);
         lines.push(`const ${tableVarName} = defineTable({`);
-        lines.push(`  primary: '${pk}',`);
+        lines.push(`  primary: ${formatPrimary(pk)},`);
         lines.push(`  ...exportTableInfo(${schema.schemaName}),`);
-        lines.push(`  defaultOrder: '${pk}',`);
+        lines.push(`  defaultOrder: '${pkFirst(pk)}',`);
         if (autoIncrement) {
-            lines.push(`  excludeFromCreation: ['${pk}'],`);
+            lines.push(`  excludeFromCreation: ['${pkFirst(pk)}'],`);
         }
         else {
             lines.push(`  // excludeFromCreation: [],`);
@@ -244,9 +275,9 @@ export function generateTablesFile(schemas) {
         else {
             lines.push(`  // allowedReadJoins: [],`);
         }
-        lines.push(`  // upsertMap: buildUpsertRules(buildUpsertRule(${schema.schemaName}, ['${pk}'])),`);
+        lines.push(`  // upsertMap: buildUpsertRules(buildUpsertRule(${schema.schemaName}, [${pkFields(pk).map((p) => `'${p}'`).join(', ')}])),`);
         lines.push(`  // schemaOverrides: {},`);
-        const exampleFieldLegacy = schema.fields.find(f => f !== pk) || schema.fields[0];
+        const exampleFieldLegacy = schema.fields.find(f => !pkFields(pk).includes(f)) || schema.fields[0];
         lines.push(`  validate: async (db, req, main, secondaries) => {`);
         lines.push(`    const errors: ValidationError[] = [];`);
         lines.push(`    // if (!main.${exampleFieldLegacy}) errors.push(['${exampleFieldLegacy}', 'required']);`);

package/dist/lib/db.d.ts

@@ -13,10 +13,27 @@ export declare class QueryClient {
     get qi(): (id: string) => string;
     get ph(): (i: number) => string;
     get dialectName(): string;
+    /** ConditionBuilder dialect ('postgres' | 'mysql') for per-instance builders. */
+    get cbDialect(): SqlDialect['cbDialect'];
+    /** Whether the dialect supports `RETURNING` (postgres/mariadb: yes, mysql: no). */
+    get supportsReturning(): boolean;
+    /** Build the ` RETURNING <quoted pk>` suffix ('' when unsupported). */
+    get returningPk(): SqlDialect['returningPk'];
     get dateTrunc(): SqlDialect['dateTrunc'];
     setDebug(mode: boolean): void;
     expression(value: string): Expression;
     query<T = Record<string, unknown>>(text: string, values?: unknown[]): Promise<SqlResult<T>>;
+    /**
+     * Run `fn` inside a DB transaction on a dedicated connection (BEGIN/COMMIT, with
+     * ROLLBACK + rethrow on error). Requires the underlying Queryable to expose
+     * `connect()`; when it does not (legacy custom adapters), `fn` runs directly on
+     * this client without transactional guarantees.
+     *
+     * Nested calls join the outer transaction: the tx QueryClient wraps a dedicated
+     * connection that has no `connect()`, so an inner `withTransaction` is a no-op
+     * wrapper around the same connection.
+     */
+    withTransaction<T>(fn: (tx: QueryClient) => Promise<T>): Promise<T>;
     insert(table: string, record: DbRecord, pkCol: string | string[]): Promise<Record<string, unknown>>;
     insertOrUpdate(table: string, record: DbRecord, conflictKeys: string[], pkCol: string | string[]): Promise<Record<string, unknown>>;
     bulkInsert(table: string, records: DbRecord[], pkCol: string | string[], chunkSize?: number): Promise<Record<string, unknown>[]>;

package/dist/lib/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAQ/C,sCAAsC;AACtC,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,WAA0B,CAAC;AAEhE,qBAAa,WAAW;;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,KAAK,CAAS;gBAEV,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU;IAKnD,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAE/B;IAED,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAE9B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,SAAS,IAAI,UAAU,CAAC,WAAW,CAAC,CAEvC;IAED,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI7B,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAIrC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAmGlB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAgB7B,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAkB7B,UAAU,CACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAoB/B,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAuB/B,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,QAAQ,EACf,cAAc,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,MAAM,CAAC;IAuBZ,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,MAAM,CAAC;IAYZ,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACxC,SAAS,EACT,OAAa,EACb,KAAK,EACL,MAAM,EACN,KAAY,EACZ,OAAY,EACZ,KAAU,EACV,QAAgB,GACjB,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAchC;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,WAAW,CAGb"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAQ/C,sCAAsC;AACtC,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,WAA0B,CAAC;AAEhE,qBAAa,WAAW;;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,KAAK,CAAS;gBAEV,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU;IAKnD,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAE/B;IAED,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAE9B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,iFAAiF;IACjF,IAAI,SAAS,IAAI,UAAU,CAAC,WAAW,CAAC,CAEvC;IAED,mFAAmF;IACnF,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAED,uEAAuE;IACvE,IAAI,WAAW,IAAI,UAAU,CAAC,aAAa,CAAC,CAE3C;IAED,IAAI,SAAS,IAAI,UAAU,CAAC,WAAW,CAAC,CAEvC;IAED,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI7B,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAIrC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAQxB;;;;;;;;;OASG;IACG,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAmHnE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAgB7B,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAkB7B,UAAU,CACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAoB/B,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAuB/B,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,QAAQ,EACf,cAAc,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,MAAM,CAAC;IAuBZ,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,MAAM,CAAC;IAYZ,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACxC,SAAS,EACT,OAAa,EACb,KAAK,EACL,MAAM,EACN,KAAY,EACZ,OAAY,EACZ,KAAU,EACV,QAAgB,GACjB,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAchC;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,WAAW,CAGb"}

package/dist/lib/db.js

@@ -23,6 +23,18 @@ export class QueryClient {
     get dialectName() {
         return this.dialect.name;
     }
+    /** ConditionBuilder dialect ('postgres' | 'mysql') for per-instance builders. */
+    get cbDialect() {
+        return this.dialect.cbDialect;
+    }
+    /** Whether the dialect supports `RETURNING` (postgres/mariadb: yes, mysql: no). */
+    get supportsReturning() {
+        return this.dialect.supportsReturning;
+    }
+    /** Build the ` RETURNING <quoted pk>` suffix ('' when unsupported). */
+    get returningPk() {
+        return this.dialect.returningPk.bind(this.dialect);
+    }
     get dateTrunc() {
         return this.dialect.dateTrunc.bind(this.dialect);
     }
@@ -39,6 +51,41 @@ export class QueryClient {
         }
         return this.client.query(text, values);
     }
+    /**
+     * Run `fn` inside a DB transaction on a dedicated connection (BEGIN/COMMIT, with
+     * ROLLBACK + rethrow on error). Requires the underlying Queryable to expose
+     * `connect()`; when it does not (legacy custom adapters), `fn` runs directly on
+     * this client without transactional guarantees.
+     *
+     * Nested calls join the outer transaction: the tx QueryClient wraps a dedicated
+     * connection that has no `connect()`, so an inner `withTransaction` is a no-op
+     * wrapper around the same connection.
+     */
+    async withTransaction(fn) {
+        if (!this.client.connect)
+            return fn(this);
+        const conn = await this.client.connect();
+        const tx = new QueryClient(conn, this.dialect);
+        tx.setDebug(this.debug);
+        try {
+            await conn.query('BEGIN');
+            const result = await fn(tx);
+            await conn.query('COMMIT');
+            return result;
+        }
+        catch (err) {
+            try {
+                await conn.query('ROLLBACK');
+            }
+            catch {
+                // The connection is broken: surface the original error, not the rollback failure.
+            }
+            throw err;
+        }
+        finally {
+            await conn.release();
+        }
+    }
     // Quote a list of fields
     #q(fields) {
         return fields.map((f) => this.dialect.qi(f)).join(', ');

package/dist/lib/engine/bulk/bulk-delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-delete.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-delete.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAwC5F"}
+{"version":3,"file":"bulk-delete.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-delete.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAiE5F"}

package/dist/lib/engine/bulk/bulk-delete.js

@@ -20,17 +20,34 @@ export async function bulkDeleteEngine(params) {
         ({ where, values } = buildTenantDeleteWhere(db, tableName, pkCol, ids, tenant));
     }
     else {
-        const cb = new ConditionBuilder('AND');
+        const cb = new ConditionBuilder('AND', db.cbDialect);
         cb.isIn(db.qi(pkCol), ids);
         where = cb.build(1, db.ph);
         values = cb.getValues();
     }
-    const result = await db.query(`DELETE FROM ${db.qi(tableName)} WHERE ${where}`, values);
-    // Return PK-only for each deleted record
-    if (result.affectedRows === ids.length) {
-        return ids.map((id) => ({ main: { [pk]: id } }));
+    let results;
+    if (db.supportsReturning) {
+        const result = await db.query(`DELETE FROM ${db.qi(tableName)} WHERE ${where}${db.returningPk(db.qi(pkCol))}`, values);
+        // Happy path: everything requested was deleted
+        if (result.affectedRows === ids.length) {
+            results = ids.map((id) => ({ main: { [pk]: id } }));
+        }
+        else {
+            // Partial delete: RETURNING tells exactly which rows went away
+            results = result.rows.map((r) => ({ main: { [pk]: r[pkCol] } }));
+        }
     }
-    // Partial delete: best effort (no RETURNING on MySQL)
-    const deletedCount = result.affectedRows;
-    return ids.slice(0, deletedCount).map((id) => ({ main: { [pk]: id } }));
+    else {
+        // No RETURNING (mysql): affectedRows alone cannot tell WHICH ids were deleted on a
+        // partial match, so look up the rows visible through the same WHERE before deleting.
+        const existing = await db.query(`SELECT ${db.qi(pkCol)} AS pk FROM ${db.qi(tableName)} WHERE ${where}`, values);
+        await db.query(`DELETE FROM ${db.qi(tableName)} WHERE ${where}`, values);
+        results = existing.rows.map((r) => ({ main: { [pk]: r.pk } }));
+    }
+    // Called once with the ACTUALLY deleted ids (possibly a subset of the requested ones)
+    if (tableConf.afterBulkDelete && results.length > 0) {
+        const deletedIds = results.map((r) => r.main[pk]);
+        await tableConf.afterBulkDelete(db, request, deletedIds);
+    }
+    return results;
 }

package/dist/lib/engine/bulk/bulk-upsert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-upsert.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkF5F"}
+{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-upsert.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoF5F"}

package/dist/lib/engine/bulk/bulk-upsert.js

@@ -1,14 +1,15 @@
+import { camelcaseObject } from '../../naming.js';
 import { processSecondaries, processDeletions, prepareInsertRecord } from '../write-helpers.js';
-import { enforceTenantOnWrites } from '../../tenant.js';
+import { enforceTenantOnWrites, assertTenantOwnsConflicts } from '../../tenant.js';
 import { runBulkValidation } from '../validate.js';
-import { primaryAsString } from '../../../types.js';
+import { primaryAsCols } from '../../../types.js';
 export async function bulkUpsertEngine(params) {
     const { db, tableConf, dbTables, request, items, tenant } = params;
     if (!items.length)
         return [];
     const schema = tableConf.Schema;
-    const pk = primaryAsString(tableConf.primary);
-    const pkCol = schema.col(pk);
+    // Full primary key columns — composite PKs need every column (see insertEngine).
+    const pkCol = primaryAsCols(tableConf.primary, (f) => schema.col(f));
     // 1. Bulk validation runs once for all items (skips per-item validate). Otherwise per-item
     //    validation happens inside prepareInsertRecord below.
     if (tableConf.validateBulk) {
@@ -25,6 +26,8 @@ export async function bulkUpsertEngine(params) {
     let pkRows;
     if (upsertKeys) {
         const conflictCols = upsertKeys.map((k) => schema.col(k));
+        // Tenant isolation: a conflicting upsert must not overwrite rows owned by another tenant.
+        await assertTenantOwnsConflicts(db, tenant, schema.tableName, conflictCols, preparedMains);
         pkRows = await db.bulkInsertOrUpdate(schema.tableName, preparedMains, conflictCols, pkCol);
     }
     else {
@@ -34,12 +37,12 @@ export async function bulkUpsertEngine(params) {
     const results = [];
     for (let i = 0; i < items.length; i++) {
         const item = items[i];
-        const mainPk = pkRows[i]; // PK-only (already in camelCase field name since PK uses camelCase field)
-        // pkRows entries come from SQL RETURNING or insertId — keys are DB column names.
-        // For simple PK named the same in API and DB (like 'id') this is transparent.
-        const result = { main: { [pk]: mainPk[pkCol] ?? mainPk[pk] } };
+        // pkRows entries come from SQL RETURNING or mysql insertId synthesis — keys are DB
+        // column names; camelcaseObject maps them back to schema fields (full composite PK).
+        const mainPkCamel = camelcaseObject(pkRows[i], schema);
+        const result = { main: mainPkCamel };
         // FK auto-fill: input camelCase + generated PK
-        const mainForFK = { ...inputMains[i], [pk]: mainPk[pkCol] ?? mainPk[pk] };
+        const mainForFK = { ...inputMains[i], ...mainPkCamel };
         if (item.secondaries && Object.keys(item.secondaries).length > 0) {
             const sec = await processSecondaries(db, tableConf, dbTables, mainForFK, item.secondaries);
             if (Object.keys(sec).length > 0)

package/dist/lib/engine/rest/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/delete.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAY,MAAM,mBAAmB,CAAC;AAE9E,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA8B9E"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/delete.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAY,MAAM,mBAAmB,CAAC;AAE9E,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAiC9E"}

package/dist/lib/engine/rest/delete.js

@@ -17,11 +17,15 @@ export async function deleteEngine(params) {
         const affectedRows = await db.delete(tableName, { [pkCol]: id });
         if (affectedRows === 0)
             throw httpError(404, `Record not found: ${id}`);
-        return { main: { [pk]: id } };
     }
-    const { where, values } = buildTenantDeleteWhere(db, tableName, pkCol, id, tenant);
-    const result = await db.query(`DELETE FROM ${db.qi(tableName)} WHERE ${where}`, values);
-    if (result.affectedRows === 0)
-        throw httpError(404, `Record not found: ${id}`);
+    else {
+        const { where, values } = buildTenantDeleteWhere(db, tableName, pkCol, id, tenant);
+        const result = await db.query(`DELETE FROM ${db.qi(tableName)} WHERE ${where}`, values);
+        if (result.affectedRows === 0)
+            throw httpError(404, `Record not found: ${id}`);
+    }
+    if (tableConf.afterDelete) {
+        await tableConf.afterDelete(db, request, id);
+    }
     return { main: { [pk]: id } };
 }

package/dist/lib/engine/rest/get.js

@@ -6,7 +6,7 @@ import { primaryAsString } from '../../../types.js';
 export async function getEngine(params) {
     const { db, tableConf, id, tenant } = params;
     const pkCol = tableConf.Schema.col(primaryAsString(tableConf.primary));
-    const cb = new ConditionBuilder('AND');
+    const cb = new ConditionBuilder('AND', db.cbDialect);
     cb.isEqual(db.qi(pkCol), id);
     const joins = [];
     if (tenant) {

package/dist/lib/engine/rest/insert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/insert.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA0D9E"}
+{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/insert.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAiE9E"}

package/dist/lib/engine/rest/insert.js

@@ -1,42 +1,49 @@
 import { camelcaseObject } from '../../naming.js';
 import { processSecondaries, prepareInsertRecord } from '../write-helpers.js';
-import { enforceTenantOnWrites } from '../../tenant.js';
-import { primaryAsString } from '../../../types.js';
+import { enforceTenantOnWrites, assertTenantOwnsConflicts } from '../../tenant.js';
+import { primaryAsCols } from '../../../types.js';
 export async function insertEngine(params) {
     const { db, tableConf, dbTables, request, record, secondaries, tenant } = params;
     const schema = tableConf.Schema;
-    const pk = primaryAsString(tableConf.primary);
-    const pkCol = schema.col(pk);
+    // Full primary key columns (composite PKs need every column for RETURNING /
+    // mysql synthesis, otherwise the response is missing PK fields).
+    const pkCol = primaryAsCols(tableConf.primary, (f) => schema.col(f));
     // 1. Validate, run beforeInsert hook, snakecase, drop excluded fields.
     const { camel: inputRecord, snake: mainRecord } = await prepareInsertRecord({ db, tableConf, request }, record, secondaries);
-    // 2. Tenant: inject (direct) or validate FK (indirect) — enforced after user mutations
-    await enforceTenantOnWrites(db, tenant, [mainRecord]);
-    // 3. Insert main → returns PK-only
-    let pkResult;
-    const upsertKeys = tableConf.upsertMap?.get(schema);
-    if (upsertKeys) {
-        const conflictCols = upsertKeys.map((k) => schema.col(k));
-        pkResult = await db.insertOrUpdate(schema.tableName, mainRecord, conflictCols, pkCol);
-    }
-    else {
-        pkResult = await db.insert(schema.tableName, mainRecord, pkCol);
-    }
-    const mainPkCamel = camelcaseObject(pkResult, schema);
-    // 4. Secondaries: need full record for FK auto-fill (camelCase)
-    let secondaryResults;
-    if (secondaries && Object.keys(secondaries).length > 0) {
-        const mainForFK = { ...inputRecord, ...mainPkCamel };
-        secondaryResults = await processSecondaries(db, tableConf, dbTables, mainForFK, secondaries);
-    }
-    // 5. afterInsert hook (camelCase — input merged with generated PK)
-    if (tableConf.afterInsert) {
-        const mainForHook = { ...inputRecord, ...mainPkCamel };
-        await tableConf.afterInsert(db, request, mainForHook, secondaryResults);
-    }
-    // 6. Return PK-only
-    const result = { main: mainPkCamel };
-    if (secondaryResults && Object.keys(secondaryResults).length > 0) {
-        result.secondaries = secondaryResults;
-    }
-    return result;
+    // Steps 2-5 are atomic: a failure in secondaries or afterInsert rolls back the
+    // main insert too. Degrades to non-transactional when the adapter has no connect().
+    return db.withTransaction(async (tx) => {
+        // 2. Tenant: inject (direct) or validate FK (indirect) — enforced after user mutations
+        await enforceTenantOnWrites(tx, tenant, [mainRecord]);
+        // 3. Insert main → returns PK-only
+        let pkResult;
+        const upsertKeys = tableConf.upsertMap?.get(schema);
+        if (upsertKeys) {
+            const conflictCols = upsertKeys.map((k) => schema.col(k));
+            // Tenant isolation: a conflicting upsert must not overwrite a row owned by another tenant.
+            await assertTenantOwnsConflicts(tx, tenant, schema.tableName, conflictCols, [mainRecord]);
+            pkResult = await tx.insertOrUpdate(schema.tableName, mainRecord, conflictCols, pkCol);
+        }
+        else {
+            pkResult = await tx.insert(schema.tableName, mainRecord, pkCol);
+        }
+        const mainPkCamel = camelcaseObject(pkResult, schema);
+        // 4. Secondaries: need full record for FK auto-fill (camelCase)
+        let secondaryResults;
+        if (secondaries && Object.keys(secondaries).length > 0) {
+            const mainForFK = { ...inputRecord, ...mainPkCamel };
+            secondaryResults = await processSecondaries(tx, tableConf, dbTables, mainForFK, secondaries);
+        }
+        // 5. afterInsert hook (camelCase — input merged with generated PK)
+        if (tableConf.afterInsert) {
+            const mainForHook = { ...inputRecord, ...mainPkCamel };
+            await tableConf.afterInsert(tx, request, mainForHook, secondaryResults);
+        }
+        // 6. Return PK-only
+        const result = { main: mainPkCamel };
+        if (secondaryResults && Object.keys(secondaryResults).length > 0) {
+            result.secondaries = secondaryResults;
+        }
+        return result;
+    });
 }

package/dist/lib/engine/rest/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA+F9E"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAwH9E"}