fastify-auto-sqlapi 0.2.0 → 0.2.2

package/dist/lib/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAQ/C,sCAAsC;AACtC,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,WAA0B,CAAC;AAEhE,qBAAa,WAAW;;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,KAAK,CAAS;gBAEV,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU;IAKnD,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAE/B;IAED,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAE9B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,iFAAiF;IACjF,IAAI,SAAS,IAAI,UAAU,CAAC,WAAW,CAAC,CAEvC;IAED,mFAAmF;IACnF,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAED,uEAAuE;IACvE,IAAI,WAAW,IAAI,UAAU,CAAC,aAAa,CAAC,CAE3C;IAED,IAAI,SAAS,IAAI,UAAU,CAAC,WAAW,CAAC,CAEvC;IAED,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI7B,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAIrC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAQxB;;;;;;;;;OASG;IACG,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAmHnE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAgB7B,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAkB7B,UAAU,CACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAoB/B,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAuB/B,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,QAAQ,EACf,cAAc,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,MAAM,CAAC;IA4BZ,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,QAAQ,EACf,cAAc,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,MAAM,CAAC;IAsBZ,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACxC,SAAS,EACT,OAAa,EACb,KAAK,EACL,MAAM,EACN,KAAY,EACZ,OAAY,EACZ,KAAU,EACV,QAAgB,GACjB,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAchC;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,WAAW,CAGb"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAQ/C,sCAAsC;AACtC,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,WAA0B,CAAC;AAEhE,qBAAa,WAAW;;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,KAAK,CAAS;gBAEV,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU;IAKnD,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAE/B;IAED,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAE9B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,iFAAiF;IACjF,IAAI,SAAS,IAAI,UAAU,CAAC,WAAW,CAAC,CAEvC;IAED,mFAAmF;IACnF,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAED,uEAAuE;IACvE,IAAI,WAAW,IAAI,UAAU,CAAC,aAAa,CAAC,CAE3C;IAED,IAAI,SAAS,IAAI,UAAU,CAAC,WAAW,CAAC,CAEvC;IAED,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI7B,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAIrC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAQxB;;;;;;;;;OASG;IACG,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAmHnE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAgB7B,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAkB7B,UAAU,CACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAoBrC;;;;OAIG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EAAE,EACnB,YAAY,EAAE,MAAM,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,SAAS,SAAqB,EAC9B,aAAa,GAAE,MAAM,EAAO,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAwB/B,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,QAAQ,EACf,cAAc,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,MAAM,CAAC;IA4BZ,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,QAAQ,EACf,cAAc,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,MAAM,CAAC;IAsBZ,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACxC,SAAS,EACT,OAAa,EACb,KAAK,EACL,MAAM,EACN,KAAY,EACZ,OAAY,EACZ,KAAU,EACV,QAAgB,GACjB,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAchC;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,WAAW,CAGb"}

package/dist/lib/db.js

@@ -195,11 +195,17 @@ export class QueryClient {
         }
         return results;
     }
-    async bulkInsertOrUpdate(table, records, conflictKeys, pkCol, chunkSize = DEFAULT_CHUNK_SIZE) {
+    /**
+     * `immutableCols` are written when the row is inserted but left untouched when the statement
+     * lands on an existing row — like the conflict keys, which are never in the update set either.
+     * Used by tenant isolation to keep an upsert from re-assigning a row's owner.
+     */
+    async bulkInsertOrUpdate(table, records, conflictKeys, pkCol, chunkSize = DEFAULT_CHUNK_SIZE, immutableCols = []) {
         if (!records.length)
             return [];
         const fields = Object.keys(records[0]);
-        const upsertClause = this.dialect.upsertSql(this.#q(conflictKeys), this.dialect.upsertUpdateSet(fields, conflictKeys));
+        const keepAsIs = immutableCols.length ? [...conflictKeys, ...immutableCols] : conflictKeys;
+        const upsertClause = this.dialect.upsertSql(this.#q(conflictKeys), this.dialect.upsertUpdateSet(fields, keepAsIs));
         const returning = this.dialect.returningPk(this.#quotedPkCols(pkCol));
         const results = [];
         for (let i = 0; i < records.length; i += chunkSize) {

package/dist/lib/engine/bulk/bulk-upsert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-upsert.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAEV,gBAAgB,EAChB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AA4D3B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA0C5F"}
+{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-upsert.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAEV,gBAAgB,EAChB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AA+D3B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA0C5F"}

package/dist/lib/engine/bulk/bulk-upsert.js

@@ -1,6 +1,6 @@
 import { camelcaseObject } from '../../naming.js';
 import { processSecondaries, processDeletions, prepareInsertRecord } from '../write-helpers.js';
-import { enforceTenantOnWrites, assertTenantOwnsConflicts } from '../../tenant.js';
+import { enforceTenantOnWrites, assertTenantOwnsConflicts, tenantImmutableColumns, } from '../../tenant.js';
 import { runBulkValidation } from '../validate.js';
 import { primaryAsCols } from '../../../types.js';
 /** One bulk statement for every main row, returning the PKs only. */
@@ -12,9 +12,10 @@ function upsertMains(params, preparedMains, pkCol) {
         return db.bulkInsert(schema.tableName, preparedMains, pkCol);
     }
     const conflictCols = upsertKeys.map((k) => schema.col(k));
-    // Tenant isolation: a conflicting upsert must not overwrite rows owned by another tenant.
+    // Tenant isolation: a conflicting upsert must not overwrite rows owned by another tenant, nor
+    // re-assign the owner of a row it legitimately updates.
     return assertTenantOwnsConflicts(db, tenant, schema.tableName, conflictCols, preparedMains)
-        .then(() => db.bulkInsertOrUpdate(schema.tableName, preparedMains, conflictCols, pkCol));
+        .then(() => db.bulkInsertOrUpdate(schema.tableName, preparedMains, conflictCols, pkCol, undefined, tenantImmutableColumns(tenant)));
 }
 /** Secondaries, deletions and the afterInsert hook for one upserted item. */
 async function finalizeUpsertedItem(params, item, inputMain, pkRow) {
@@ -26,12 +27,12 @@ async function finalizeUpsertedItem(params, item, inputMain, pkRow) {
     // FK auto-fill: input camelCase + generated PK
     const mainForFK = { ...inputMain, ...mainPkCamel };
     if (item.secondaries && Object.keys(item.secondaries).length > 0) {
-        const sec = await processSecondaries({ db, tableConf, dbTables, mainRecord: mainForFK, tenant }, item.secondaries);
+        const sec = await processSecondaries({ db, tableConf, dbTables, mainRecord: mainForFK, tenant, request }, item.secondaries);
         if (Object.keys(sec).length > 0)
             result.secondaries = sec;
     }
     if (item.deletions && Object.keys(item.deletions).length > 0) {
-        const del = await processDeletions({ db, tableConf, dbTables, mainRecord: mainForFK, tenant }, item.deletions);
+        const del = await processDeletions({ db, tableConf, dbTables, mainRecord: mainForFK, tenant, request }, item.deletions);
         if (Object.keys(del).length > 0)
             result.deletions = del;
     }

package/dist/lib/engine/read-hooks.d.ts

@@ -0,0 +1,19 @@
+import type { ApiRequest } from '../../types/request.js';
+import type { QueryClient } from '../db.js';
+import type { ITable, ReadSource } from '../../types.js';
+/**
+ * Run a table's `afterRead` hook over the rows a read produced.
+ *
+ * Every read path funnels through this one helper so the hook has a single meaning: it is
+ * handed camelCase rows of `tableConf`'s own table, in one batch, and mutates them in place.
+ * Batching is the contract, not an optimisation — a hook that decrypts through a remote KMS
+ * gets one call per result set instead of one per row.
+ *
+ * `tableConf` is resolved by the caller, which on a join is the JOINED table's config
+ * (`dbTables[joinSchema.tableName]`). That is what makes the hook follow a relation without
+ * being declared on the host, the way `readExclude` and `tenantScope` do (ADR 0010).
+ *
+ * An empty result set is skipped: there is nothing to transform, and the hook may be costly.
+ */
+export declare function runAfterRead(db: QueryClient, request: ApiRequest | undefined, rows: Record<string, unknown>[], tableConf: ITable | undefined, source: ReadSource, alias?: string): Promise<void>;
+//# sourceMappingURL=read-hooks.d.ts.map

package/dist/lib/engine/read-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-hooks.d.ts","sourceRoot":"","sources":["../../../src/lib/engine/read-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAoB,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,UAAU,GAAG,SAAS,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAC/B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,UAAU,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/lib/engine/read-hooks.js

@@ -0,0 +1,20 @@
+/**
+ * Run a table's `afterRead` hook over the rows a read produced.
+ *
+ * Every read path funnels through this one helper so the hook has a single meaning: it is
+ * handed camelCase rows of `tableConf`'s own table, in one batch, and mutates them in place.
+ * Batching is the contract, not an optimisation — a hook that decrypts through a remote KMS
+ * gets one call per result set instead of one per row.
+ *
+ * `tableConf` is resolved by the caller, which on a join is the JOINED table's config
+ * (`dbTables[joinSchema.tableName]`). That is what makes the hook follow a relation without
+ * being declared on the host, the way `readExclude` and `tenantScope` do (ADR 0010).
+ *
+ * An empty result set is skipped: there is nothing to transform, and the hook may be costly.
+ */
+export async function runAfterRead(db, request, rows, tableConf, source, alias) {
+    if (!tableConf?.afterRead || rows.length === 0)
+        return;
+    const ctx = alias === undefined ? { source } : { source, alias };
+    await tableConf.afterRead(db, request, rows, ctx);
+}

package/dist/lib/engine/rest/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/get.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9D,wBAAsB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAsCrE"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/get.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9D,wBAAsB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CA0CrE"}

package/dist/lib/engine/rest/get.js

@@ -3,9 +3,10 @@ import { camelcaseObject } from '../../naming.js';
 import { buildTenantCondition, buildTenantJoin } from '../../tenant.js';
 import { httpError } from '../../errors.js';
 import { readableSelectColumns } from '../../read-access.js';
+import { runAfterRead } from '../read-hooks.js';
 import { primaryAsString, isCompositePrimary } from '../../../types.js';
 export async function getEngine(params) {
-    const { db, tableConf, id, tenant } = params;
+    const { db, tableConf, id, tenant, request } = params;
     if (isCompositePrimary(tableConf.primary)) {
         throw httpError(400, `Table "${tableConf.Schema.tableName}" has a composite primary key: get-by-id would match on "${primaryAsString(tableConf.primary)}" alone. Use search with all PK fields.`);
     }
@@ -15,10 +16,11 @@ export async function getEngine(params) {
     // shared with the through table would be ambiguous.
     cb.isEqual(`${db.qi(tableConf.Schema.tableName)}.${db.qi(pkCol)}`, id);
     const joins = [];
-    if (tenant) {
-        cb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableConf.Schema.tableName));
-        if ('through' in tenant.scope) {
-            joins.push(buildTenantJoin(db, tenant.scope, tableConf.Schema.tableName));
+    if (tenant?.scope) {
+        const scope = tenant.scope;
+        cb.append(buildTenantCondition(db, scope, tenant.ids, tableConf.Schema.tableName));
+        if ('through' in scope) {
+            joins.push(buildTenantJoin(db, scope, tableConf.Schema.tableName));
         }
     }
     const where = cb.build(1, db.ph);
@@ -33,5 +35,7 @@ export async function getEngine(params) {
     });
     if (rows.length === 0)
         throw httpError(404, `Record not found: ${id}`);
-    return { main: camelcaseObject(rows[0], tableConf.Schema) };
+    const main = camelcaseObject(rows[0], tableConf.Schema);
+    await runAfterRead(db, request, [main], tableConf, 'get');
+    return { main };
 }

package/dist/lib/engine/rest/insert.js

@@ -32,7 +32,7 @@ export async function insertEngine(params) {
         let secondaryResults;
         if (secondaries && Object.keys(secondaries).length > 0) {
             const mainForFK = { ...inputRecord, ...mainPkCamel };
-            secondaryResults = await processSecondaries({ db: tx, tableConf, dbTables, mainRecord: mainForFK, tenant }, secondaries);
+            secondaryResults = await processSecondaries({ db: tx, tableConf, dbTables, mainRecord: mainForFK, tenant, request }, secondaries);
         }
         // 5. afterInsert hook (camelCase — input merged with generated PK)
         if (tableConf.afterInsert) {

package/dist/lib/engine/rest/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAiC3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA2G9E"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAiC3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA+G9E"}

package/dist/lib/engine/rest/update.js

@@ -1,4 +1,5 @@
 import { snakecaseRecord } from '../../naming.js';
+import { removeWriteExcluded } from '../../write-access.js';
 import { processSecondaries, processDeletions } from '../write-helpers.js';
 import { stripTenantColumn, assertTenantOwnership, buildTenantUpdateExtra, enforceTenantFKOnUpdate, } from '../../tenant.js';
 import { runValidation } from '../validate.js';
@@ -46,22 +47,25 @@ export async function updateEngine(params) {
     if (tableConf.beforeUpdate) {
         await tableConf.beforeUpdate(db, request, inputRecord);
     }
-    // 5. Convert to DB format (after all user mutations)
+    // 5. Drop what the database will not be told about (generated columns, writeExclude).
+    //    After the hook on purpose: the column refuses a value whoever assigned it.
+    removeWriteExcluded(inputRecord, tableConf, schema);
+    // 6. Convert to DB format (after all user mutations)
     const snaked = snakecaseRecord(inputRecord, schema);
     const updateFields = { ...snaked };
     for (const c of pkCols)
         delete updateFields[c];
-    // 6. Strip tenant column (user cannot change tenant of an existing record).
+    // 7. Strip tenant column (user cannot change tenant of an existing record).
     //    For indirect scopes the tenant link is the through-FK (localField): it may be changed,
     //    but only to another value the caller owns — re-validate the new FK against the tenant.
-    if (tenant) {
+    if (tenant?.scope) {
         stripTenantColumn(updateFields, tenant.scope);
         await enforceTenantFKOnUpdate(db, tenant, updateFields);
     }
-    // Steps 7-9 are atomic: a failure in secondaries or deletions rolls back the main
+    // Steps 8-10 are atomic: a failure in secondaries or deletions rolls back the main
     // update too. Degrades to non-transactional when the adapter has no connect().
     return db.withTransaction(async (tx) => {
-        // 7. Update main
+        // 8. Update main
         const hasFieldsToUpdate = Object.keys(updateFields).length > 0;
         const extraCondition = buildTenantUpdateExtra(tx, tenant);
         // WHERE matching every primary key column (single or composite).
@@ -76,23 +80,23 @@ export async function updateEngine(params) {
         }
         // Build the main response (PK-only — every PK field)
         const mainResult = Object.fromEntries(pkFields.map((f, i) => [f, pkValues[i]]));
-        // 8. Secondaries (upsert/insert with FK auto-fill — camelCase)
+        // 9. Secondaries (upsert/insert with FK auto-fill — camelCase)
         let secondaryResults;
         if (secondaries && Object.keys(secondaries).length > 0) {
             const mainForFK = { ...inputRecord };
-            secondaryResults = await processSecondaries({ db: tx, tableConf, dbTables, mainRecord: mainForFK, tenant }, secondaries);
+            secondaryResults = await processSecondaries({ db: tx, tableConf, dbTables, mainRecord: mainForFK, tenant, request }, secondaries);
         }
-        // 9. Deletions (FK auto-fill from main like secondaries)
+        // 10. Deletions (FK auto-fill from main like secondaries)
         let deletionResults;
         if (deletions && Object.keys(deletions).length > 0) {
             const mainForFK = { ...inputRecord };
-            deletionResults = await processDeletions({ db: tx, tableConf, dbTables, mainRecord: mainForFK, tenant }, deletions);
+            deletionResults = await processDeletions({ db: tx, tableConf, dbTables, mainRecord: mainForFK, tenant, request }, deletions);
         }
-        // 10. afterUpdate hook (inside the transaction: throwing rolls everything back)
+        // 11. afterUpdate hook (inside the transaction: throwing rolls everything back)
         if (tableConf.afterUpdate) {
             await tableConf.afterUpdate(tx, request, inputRecord, secondaryResults, deletionResults);
         }
-        // 11. Return PK-only
+        // 12. Return PK-only
         const result = { main: mainResult };
         if (secondaryResults && Object.keys(secondaryResults).length > 0) {
             result.secondaries = secondaryResults;

package/dist/lib/engine/search/join-families.d.ts

@@ -1,3 +1,12 @@
+/**
+ * The four join families, each executed against the rows the main query returned.
+ *
+ *   joinMustExist  child -> main, 1:N   EXISTS filter on the main query (returns no rows)
+ *   joinMultiple   child -> main, 1:N   side query, rows under result.joinMultiple.<alias>
+ *   joinGroup      child -> main, 1:N   aggregations under result.joinGroup.<alias>
+ *   joinLeft       parent -> main, N:1  real LEFT JOIN on demand + side query for the rows
+ */
+import type { ApiRequest } from '../../../types/request.js';
 import type { QueryClient } from '../../db.js';
 import type { QueryParams } from '../query-params.js';
 import type { DbTables, ITable, JoinFetchRequest, JoinGroupRequest, JoinRefFilter, TenantContext } from '../../../types.js';
@@ -26,9 +35,9 @@ export declare function buildLeftJoinOnClauses(db: QueryClient, dbTables: DbTabl
 /** The WHERE fragments a `joinLeft` request's own filters and conditions contribute. */
 export declare function buildLeftJoinFilters(db: QueryClient, dbTables: DbTables, tableConf: ITable, aliasesNeedingJoin: Set<string>, joinLeft: Record<string, JoinFetchRequest> | undefined, startIdx: number): LeftJoinFilterBuild;
 /** joinMultiple: 1:N children, returned as rows under `result.joinMultiple.<alias>`. */
-export declare function executeJoinMultiple(db: QueryClient, dbTables: DbTables, tableConf: ITable, mainResults: Record<string, unknown>[], joinMultiple: Record<string, JoinFetchRequest>, tenant?: TenantContext): Promise<Record<string, Record<string, unknown>[]>>;
+export declare function executeJoinMultiple(db: QueryClient, dbTables: DbTables, tableConf: ITable, mainResults: Record<string, unknown>[], joinMultiple: Record<string, JoinFetchRequest>, tenant?: TenantContext, request?: ApiRequest): Promise<Record<string, Record<string, unknown>[]>>;
 /** joinLeft: N:1 parents, returned as rows under `result.joinLeft.<alias>`. */
-export declare function executeJoinLeft(db: QueryClient, dbTables: DbTables, tableConf: ITable, mainResults: Record<string, unknown>[], joinLeft: Record<string, JoinFetchRequest>, tenant?: TenantContext): Promise<Record<string, Record<string, unknown>[]>>;
+export declare function executeJoinLeft(db: QueryClient, dbTables: DbTables, tableConf: ITable, mainResults: Record<string, unknown>[], joinLeft: Record<string, JoinFetchRequest>, tenant?: TenantContext, request?: ApiRequest): Promise<Record<string, Record<string, unknown>[]>>;
 export declare function executeJoinGroup(db: QueryClient, dbTables: DbTables, tableConf: ITable, mainResults: Record<string, unknown>[], joinGroup: Record<string, JoinGroupRequest>, tenant?: TenantContext): Promise<Record<string, Record<string, unknown>>>;
 export declare function buildJoinMustExistClauses(params: QueryParams, db: QueryClient, dbTables: DbTables, tableConf: ITable, joinMustExist: Record<string, JoinRefFilter>, tenant?: TenantContext): string;
 export {};

package/dist/lib/engine/search/join-families.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"join-families.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/join-families.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAEV,QAAQ,EAER,MAAM,EACN,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EAGb,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAI3B,UAAU,eAAe;IACvB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAED,UAAU,mBAAmB;IAC3B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAsED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,aAAa,GACrB,eAAe,CAgCjB;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,EACtD,QAAQ,EAAE,MAAM,GACf,mBAAmB,CA0CrB;AAmGD,wFAAwF;AACxF,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC9C,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAKpD;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC1C,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAKpD;AAsGD,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACtC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAqClD;AAyBD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,WAAW,EACnB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EAC5C,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CA4BR"}
+{"version":3,"file":"join-families.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/join-families.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAoBtD,OAAO,KAAK,EAEV,QAAQ,EAER,MAAM,EACN,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EAGb,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAI3B,UAAU,eAAe;IACvB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAED,UAAU,mBAAmB;IAC3B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAsED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,aAAa,GACrB,eAAe,CAgCjB;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,EACtD,QAAQ,EAAE,MAAM,GACf,mBAAmB,CA0CrB;AAyGD,wFAAwF;AACxF,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC9C,MAAM,CAAC,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAMpD;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC1C,MAAM,CAAC,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAMpD;AAsGD,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACtC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAqClD;AAyBD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,WAAW,EACnB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EAC5C,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CA4BR"}

package/dist/lib/engine/search/join-families.js

@@ -1,15 +1,8 @@
-/**
- * The four join families, each executed against the rows the main query returned.
- *
- *   joinMustExist  child -> main, 1:N   EXISTS filter on the main query (returns no rows)
- *   joinMultiple   child -> main, 1:N   side query, rows under result.joinMultiple.<alias>
- *   joinGroup      child -> main, 1:N   aggregations under result.joinGroup.<alias>
- *   joinLeft       parent -> main, N:1  real LEFT JOIN on demand + side query for the rows
- */
 import { ConditionBuilder, Expression } from 'node-condition-builder';
 import { assertReadable, assertFiltersReadable, hasOwnField, ownField } from '../../read-access.js';
 import { ALLOWED_SET } from '../../condition-methods.js';
 import { err400, validateSchemaField, evaluateComputedField, mapRowsToCamelCase, buildSelectionColumns, } from './fields.js';
+import { runAfterRead } from '../read-hooks.js';
 import { appendJoinTenantScope, subqueryAlias, requireJoin, extractJoinRefs, } from './joins.js';
 import { tenantForTable, buildTenantRowGuard } from '../../tenant.js';
 import { dispatchConditionMethod, buildJoinRefCondition } from './conditions.js';
@@ -152,7 +145,7 @@ function scopeJoinSideQuery(cb, db, joinSchema, joinField, ids, joinTableConf, t
     const where = cb.build(1, db.ph);
     return { where, values: cb.getValues(), tenantJoins };
 }
-async function fetchJoinRows(db, dbTables, tableConf, mainResults, requests, mode, tenant) {
+async function fetchJoinRows(db, dbTables, tableConf, mainResults, requests, mode, tenant, request) {
     const result = {};
     for (const [alias, ref] of Object.entries(requests)) {
         const joinDef = requireJoin(tableConf, alias, mode.requireUnique);
@@ -182,22 +175,27 @@ async function fetchJoinRows(db, dbTables, tableConf, mainResults, requests, mod
             joins: tenantJoins.length > 0 ? tenantJoins : undefined,
         });
         result[alias] = mapRowsToCamelCase(rows, joinSchema);
+        // The joined table's own hook, not the host's: a transform belongs to the table that
+        // owns the column, wherever its rows surface.
+        await runAfterRead(db, request, result[alias], joinTableConf, mode.source, alias);
     }
     return result;
 }
 /** joinMultiple: 1:N children, returned as rows under `result.joinMultiple.<alias>`. */
-export function executeJoinMultiple(db, dbTables, tableConf, mainResults, joinMultiple, tenant) {
+export function executeJoinMultiple(db, dbTables, tableConf, mainResults, joinMultiple, tenant, request) {
     return fetchJoinRows(db, dbTables, tableConf, mainResults, joinMultiple, {
+        source: 'joinMultiple',
         requireUnique: false,
         applyRefCondition: true,
-    }, tenant);
+    }, tenant, request);
 }
 /** joinLeft: N:1 parents, returned as rows under `result.joinLeft.<alias>`. */
-export function executeJoinLeft(db, dbTables, tableConf, mainResults, joinLeft, tenant) {
+export function executeJoinLeft(db, dbTables, tableConf, mainResults, joinLeft, tenant, request) {
     return fetchJoinRows(db, dbTables, tableConf, mainResults, joinLeft, {
+        source: 'joinLeft',
         requireUnique: true,
         applyRefCondition: false,
-    }, tenant);
+    }, tenant, request);
 }
 /**
  * Resolve `aggregations.by` to a SQL expression. Accepts:

package/dist/lib/engine/search/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EAGb,MAAM,mBAAmB,CAAC;AAwP3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CAsFvB"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EAGb,MAAM,mBAAmB,CAAC;AAyP3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CA4FvB"}

package/dist/lib/engine/search/search.js

@@ -5,6 +5,7 @@ import { MAX_CONDITIONS, MAX_ORDER_BY_PARTS } from '../../condition-methods.js';
 import { primaryAsString } from '../../../types.js';
 import { err400, resolveFieldRef, evaluateComputedField, refValues, renderRef, mapRowsToCamelCase, } from './fields.js';
 import { assertJoinFilterKeys, requireJoin } from './joins.js';
+import { runAfterRead } from '../read-hooks.js';
 import { collectOrderByLeftAliases, validateOrderBy, convertConfiguredOrder } from './order-by.js';
 import { applyConditions, applyComputedFilters } from './conditions.js';
 import { appendAggConditions } from './aggregations.js';
@@ -153,10 +154,11 @@ function buildMainCondition(params) {
         applyConditions(condition, conditions, tableConf.Schema, tableConf, db);
     }
     const tenantJoins = [];
-    if (tenant) {
-        condition.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableConf.Schema.tableName));
-        if ('through' in tenant.scope) {
-            tenantJoins.push(buildTenantJoin(db, tenant.scope, tableConf.Schema.tableName));
+    if (tenant?.scope) {
+        const scope = tenant.scope;
+        condition.append(buildTenantCondition(db, scope, tenant.ids, tableConf.Schema.tableName));
+        if ('through' in scope) {
+            tenantJoins.push(buildTenantJoin(db, scope, tableConf.Schema.tableName));
         }
     }
     return { condition, tenantJoins };
@@ -186,12 +188,12 @@ function collectLeftJoinAliases(params) {
  * it returned.
  */
 async function attachJoinResults(result, dbTables, params, main) {
-    const { db, tableConf, joinMultiple, joinLeft, joinGroup, tenant } = params;
+    const { db, tableConf, joinMultiple, joinLeft, joinGroup, tenant, request } = params;
     if (joinMultiple && Object.keys(joinMultiple).length > 0) {
-        result.joinMultiple = await executeJoinMultiple(db, dbTables, tableConf, main, joinMultiple, tenant);
+        result.joinMultiple = await executeJoinMultiple(db, dbTables, tableConf, main, joinMultiple, tenant, request);
     }
     if (joinLeft && Object.keys(joinLeft).length > 0) {
-        result.joinLeft = await executeJoinLeft(db, dbTables, tableConf, main, joinLeft, tenant);
+        result.joinLeft = await executeJoinLeft(db, dbTables, tableConf, main, joinLeft, tenant, request);
     }
     if (joinGroup && Object.keys(joinGroup).length > 0) {
         result.joinGroup = await executeJoinGroup(db, dbTables, tableConf, main, joinGroup, tenant);
@@ -247,6 +249,11 @@ export async function searchEngine(dbTables, params) {
     }
     const result = { main };
     await attachJoinResults(result, dbTables, params, main);
+    // After the joins, not before: they correlate to the main rows by the values the DB
+    // returned (`fk IN (ids)`), and a hook that rewrites the column holding that key would
+    // have them look for a value no child row carries. `main` is the same array either way,
+    // so the response still carries the hook's mutations.
+    await runAfterRead(db, params.request, main, tableConf, 'search');
     if (pagination) {
         result.pagination = pagination;
     }

package/dist/lib/engine/validate.d.ts

@@ -1,6 +1,6 @@
-import type { FastifyRequest } from 'fastify';
+import type { ApiRequest } from '../../types/request.js';
 import type { QueryClient } from '../db.js';
 import type { ITable, BulkValidatorItem } from '../../types.js';
-export declare function runValidation(db: QueryClient, request: FastifyRequest, tableConf: ITable, main: Record<string, unknown>, secondaries?: Record<string, Record<string, unknown>[]>): Promise<void>;
-export declare function runBulkValidation(db: QueryClient, request: FastifyRequest, tableConf: ITable, items: BulkValidatorItem[]): Promise<void>;
+export declare function runValidation(db: QueryClient, request: ApiRequest, tableConf: ITable, main: Record<string, unknown>, secondaries?: Record<string, Record<string, unknown>[]>): Promise<void>;
+export declare function runBulkValidation(db: QueryClient, request: ApiRequest, tableConf: ITable, items: BulkValidatorItem[]): Promise<void>;
 //# sourceMappingURL=validate.d.ts.map

package/dist/lib/engine/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/lib/engine/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAmB,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAgBjF,wBAAsB,aAAa,CACjC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACtD,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,iBAAiB,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAOf"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/lib/engine/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAmB,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAgBjF,wBAAsB,aAAa,CACjC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACtD,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,iBAAiB,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/lib/engine/write-helpers.d.ts

@@ -1,4 +1,4 @@
-import type { FastifyRequest } from 'fastify';
+import type { ApiRequest } from '../../types/request.js';
 import type { QueryClient } from '../db.js';
 import type { ITable, DbTables, TenantContext } from '../../types.js';
 export declare function findSecondaryTableConf(dbTables: DbTables, joinTableName: string): ITable | undefined;
@@ -13,11 +13,13 @@ export interface WriteJoinPass {
     /** Main record (camelCase), the source of the FK auto-filled into every child row. */
     mainRecord: Record<string, unknown>;
     tenant?: TenantContext;
+    /** The request that triggered the write, handed to the child table's `beforeInsert`. */
+    request: ApiRequest;
 }
 interface PrepareCtx {
     db: QueryClient;
     tableConf: ITable;
-    request: FastifyRequest;
+    request: ApiRequest;
 }
 /**
  * Prepare a single record for INSERT/UPSERT:
@@ -26,7 +28,9 @@ interface PrepareCtx {
  *   3. drop excludeFromCreation fields (client-input whitelist; applied BEFORE the
  *      hook so values it assigns — e.g. a server-generated id — reach the INSERT)
  *   4. beforeInsert hook (caller can mutate the camelCase copy)
- *   5. snakecaseRecord → DB format
+ *   5. drop non-writable fields (generated columns, writeExclude) — AFTER the hook, because
+ *      the database refuses those values whoever assigned them
+ *   6. snakecaseRecord → DB format
  *
  * Returns both `camel` (input + hook mutations, used for FK auto-fill / afterInsert) and
  * `snake` (DB-ready record). The original `input` is left intact.

package/dist/lib/engine/write-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/engine/write-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAQ5C,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EAGR,aAAa,EACd,MAAM,gBAAgB,CAAC;AAqDxB,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,MAAM,GACpB,MAAM,GAAG,SAAS,CAKpB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,WAAW,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAmCD,UAAU,UAAU;IAClB,EAAE,EAAE,WAAW,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EACvD,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GACnC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAe7E;AAkCD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACrD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAiDpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACnD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAoBpD"}
+{"version":3,"file":"write-helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/engine/write-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAU5C,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EAGR,aAAa,EACd,MAAM,gBAAgB,CAAC;AAmCxB,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,MAAM,GACpB,MAAM,GAAG,SAAS,CAKpB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,WAAW,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,wFAAwF;IACxF,OAAO,EAAE,UAAU,CAAC;CACrB;AAmCD,UAAU,UAAU;IAClB,EAAE,EAAE,WAAW,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EACvD,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GACnC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAgB7E;AAkCD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACrD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CA0DpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACnD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAoBpD"}

package/dist/lib/engine/write-helpers.js

@@ -1,6 +1,7 @@
 import { camelcaseObject, snakecaseRecord } from '../naming.js';
 import { runValidation } from './validate.js';
-import { tenantForTable, buildTenantRowGuard, enforceTenantOnWrites, assertTenantOwnsConflicts, } from '../tenant.js';
+import { removeWriteExcluded } from '../write-access.js';
+import { tenantForTable, buildTenantRowGuard, enforceTenantOnWrites, assertTenantOwnsConflicts, tenantImmutableColumns, } from '../tenant.js';
 /**
  * Resolve the write join an alias names, or undefined when the table does not declare it.
  *
@@ -14,26 +15,11 @@ function findWriteJoin(tableConf, alias) {
     return tableConf.allowedWriteJoins?.find((j) => j.alias === alias);
 }
 /**
- * Drop `excludeFromCreation` columns from a snake_case (DB-format) record.
+ * Drop `excludeFromCreation` fields from a camelCase record, in place.
  *
- * Exclusion is a whitelist on CLIENT input: call this on the client payload only,
- * BEFORE any server-side value is assigned (beforeInsert mutations, FK auto-fill),
- * so engine/hook-generated values on those fields reach the SQL.
- */
-function removeExcludedFields(record, tableConf) {
-    if (!tableConf.excludeFromCreation?.length)
-        return record;
-    const result = { ...record };
-    for (const field of tableConf.excludeFromCreation) {
-        const col = tableConf.Schema.col(field);
-        delete result[col];
-    }
-    return result;
-}
-/**
- * Same whitelist as `removeExcludedFields`, but for a camelCase record (schema
- * field names) and in place. Used on the client payload before the beforeInsert
- * hook runs.
+ * Exclusion is a whitelist on CLIENT input: call this on the client payload only, BEFORE any
+ * server-side value is assigned (beforeInsert mutations, FK auto-fill), so engine- and
+ * hook-generated values on those fields reach the SQL (ADR 0005).
  */
 function removeExcludedFieldsCamel(record, tableConf) {
     if (!tableConf.excludeFromCreation?.length)
@@ -71,7 +57,9 @@ function resolveWriteJoinTarget(joinDef, dbTables, mainRecord, tenant) {
  *   3. drop excludeFromCreation fields (client-input whitelist; applied BEFORE the
  *      hook so values it assigns — e.g. a server-generated id — reach the INSERT)
  *   4. beforeInsert hook (caller can mutate the camelCase copy)
- *   5. snakecaseRecord → DB format
+ *   5. drop non-writable fields (generated columns, writeExclude) — AFTER the hook, because
+ *      the database refuses those values whoever assigned them
+ *   6. snakecaseRecord → DB format
  *
  * Returns both `camel` (input + hook mutations, used for FK auto-fill / afterInsert) and
  * `snake` (DB-ready record). The original `input` is left intact.
@@ -88,6 +76,7 @@ export async function prepareInsertRecord(ctx, input, secondaries, options) {
     if (ctx.tableConf.beforeInsert) {
         await ctx.tableConf.beforeInsert(ctx.db, ctx.request, camel);
     }
+    removeWriteExcluded(camel, ctx.tableConf, ctx.tableConf.Schema);
     const snake = snakecaseRecord(camel, ctx.tableConf.Schema);
     return { camel, snake };
 }
@@ -121,23 +110,33 @@ async function forEachWriteJoin(pass, payload, writeAlias) {
  * where the child is upserted, hijack one of that tenant's existing rows via the conflict key.
  */
 export function processSecondaries(pass, secondaries) {
-    const { db, tableConf } = pass;
+    const { db, tableConf, request } = pass;
     return forEachWriteJoin(pass, secondaries, async (records, target, joinDef) => {
         const { joinSchema, joinCol, mainValue, childConf, childTenant } = target;
         const childPk = childConf?.primary || joinDef.joinField;
         const childPkCol = Array.isArray(childPk)
             ? childPk.map((f) => joinSchema.col(f))
             : joinSchema.col(childPk);
-        const preparedRecords = records.map((rec) => {
-            let prepared = snakecaseRecord(rec, joinSchema);
-            // Remove excluded fields from the client payload BEFORE the FK auto-fill:
-            // an excluded FK column must not strip the engine-injected value below.
+        // Same order as `prepareInsertRecord` (ADR 0005): the client whitelist runs first, then
+        // the child's own `beforeInsert`, then the DB format — so a value the hook assigns to an
+        // excluded field still reaches the INSERT. A secondary is a write like any other, and its
+        // table's transform has to run here too or a column that table encodes on the way in is
+        // stored raw whenever its rows arrive as another table's children.
+        const preparedRecords = [];
+        for (const rec of records) {
+            const camel = { ...rec };
             if (childConf) {
-                prepared = removeExcludedFields(prepared, childConf);
+                removeExcludedFieldsCamel(camel, childConf);
+                if (childConf.beforeInsert) {
+                    await childConf.beforeInsert(db, request, camel);
+                }
             }
+            removeWriteExcluded(camel, childConf, joinSchema);
+            const prepared = snakecaseRecord(camel, joinSchema);
+            // FK auto-fill last: the engine's own value, not the client's and not the hook's.
             prepared[joinCol] = mainValue;
-            return prepared;
-        });
+            preparedRecords.push(prepared);
+        }
         // Tenant enforcement runs after the FK auto-fill: for an indirect scope the through-FK
         // the engine just injected is the value being validated.
         await enforceTenantOnWrites(db, childTenant, preparedRecords);
@@ -148,7 +147,7 @@ export function processSecondaries(pass, secondaries) {
             // A conflicting upsert must not overwrite — or re-parent — a child row owned by
             // another tenant, which the ON CONFLICT key alone would happily match.
             await assertTenantOwnsConflicts(db, childTenant, joinSchema.tableName, conflictCols, preparedRecords);
-            pkRows = await db.bulkInsertOrUpdate(joinSchema.tableName, preparedRecords, conflictCols, childPkCol);
+            pkRows = await db.bulkInsertOrUpdate(joinSchema.tableName, preparedRecords, conflictCols, childPkCol, undefined, tenantImmutableColumns(childTenant));
         }
         else {
             pkRows = await db.bulkInsert(joinSchema.tableName, preparedRecords, childPkCol);

package/dist/lib/errors.d.ts

@@ -8,4 +8,28 @@
 export declare function httpError(statusCode: number, message: string): Error & {
     statusCode: number;
 };
+/**
+ * Replace an error escaping a route handler with one that carries no database detail.
+ *
+ * Driver messages name tables, columns and constraints, and the route error handler sends
+ * `error.message` verbatim — so a unique violation describes the schema to whoever
+ * triggered it. Errors the plugin raises itself are deliberate `4xx` with messages written
+ * for clients (`httpError`, `validationErrors`) and pass through untouched; everything
+ * else becomes a bare `500`.
+ *
+ * The original is attached as `cause`, so a consumer `setErrorHandler` can still apply its
+ * own policy — mapping SQLSTATE to a status code stays the consumer's decision (ADR 0006).
+ * No status code is remapped here: a `500` stays a `500`.
+ *
+ * `requestId` is carried on the sanitized error and rendered in the response body: it is the
+ * same value Fastify logs as `reqId` on every line, so the log entry holding the real error
+ * is one grep away from the client's `500`.
+ *
+ * With `exposeDebugInfo`, the original is also described in a `debugInfo` payload rendered
+ * beside those fields — additive, so the response a client codes against is the same one it
+ * gets in production. It is off by default and derived from nothing: `debug` belongs to the
+ * consumer, who may wire it to an environment variable, and no option may open an external
+ * channel as a side effect of meaning something internal. See ADR 0013.
+ */
+export declare function sanitizeRouteError(err: unknown, requestId?: string, exposeDebugInfo?: boolean): unknown;
 //# sourceMappingURL=errors.d.ts.map

package/dist/lib/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAI7F"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAI7F;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,eAAe,UAAQ,GACtB,OAAO,CAcT"}