prisma-generator-express 1.57.0 → 1.58.1

package/src/copy/materializedRouter.ts

@@ -48,6 +48,8 @@ type MaterializedRouterOptions = {
 
 const IDENT_RE = /^[A-Za-z_][A-Za-z0-9_]*$/
 
+export const forbidden = (message: string): HttpError => new HttpError(403, message)
+
 const quoteIdent = (name: string): string => {
   if (!IDENT_RE.test(name))
     throw new HttpError(400, 'invalid identifier: ' + name)
@@ -144,9 +146,46 @@ const enforceAllowlist = (orderBy: OrderByDef, allowed?: string[]): void => {
   }
 }
 
+const validateViewIdentifier = (
+  viewName: string,
+  fieldName: string,
+  value: string,
+): void => {
+  if (!IDENT_RE.test(value)) {
+    throw new Error(
+      'materializedViewsRouter: invalid ' + fieldName + ' identifier for view "' +
+      viewName + '": ' + value,
+    )
+  }
+}
+
+const validateViewConfig = (viewName: string, def: ViewDef): void => {
+  validateViewIdentifier(viewName, 'relation', def.relation)
+  if (def.schema) validateViewIdentifier(viewName, 'schema', def.schema)
+  const ob = def.orderBy
+  if (typeof ob === 'string') validateViewIdentifier(viewName, 'orderBy', ob)
+  else if (ob) validateViewIdentifier(viewName, 'orderBy.field', ob.field)
+  if (def.allowedOrderBy) {
+    for (const field of def.allowedOrderBy) {
+      validateViewIdentifier(viewName, 'allowedOrderBy[]', field)
+    }
+  }
+  if (!def.allowedOrderBy && !def.orderBy) {
+    console.warn(
+      '[materializedViewsRouter] view "' + viewName +
+      '" has neither `orderBy` nor `allowedOrderBy` set. ' +
+      'Clients can sort by any valid identifier, which may cause full table scans.',
+    )
+  }
+}
+
 export const materializedViewsRouter = (
   opts: MaterializedRouterOptions,
 ): Router => {
+  for (const [name, def] of Object.entries(opts.views)) {
+    validateViewConfig(name, def)
+  }
+
   const router = express.Router()
   const basePath = normalizeBasePath(opts.basePath)
   const defaultLimit = opts.defaultLimit ?? 50
@@ -230,4 +269,4 @@ export const materializedViewsRouter = (
   )
 
   return router
-}
+}

package/src/copy/misc.ts

@@ -17,15 +17,32 @@ export function isSafeKey(key: string): boolean {
 
 export function sanitizeKeys<T>(value: T): T {
   if (Array.isArray(value)) {
-    return value.map(sanitizeKeys) as T
+    let mutated = false
+    const out: unknown[] = new Array(value.length)
+    for (let i = 0; i < value.length; i++) {
+      const sanitized = sanitizeKeys(value[i])
+      if (sanitized !== value[i]) mutated = true
+      out[i] = sanitized
+    }
+    return (mutated ? out : value) as T
   }
   if (isPlainObject(value)) {
-    const result: Record<string, unknown> = {}
-    for (const key of Object.keys(value)) {
-      if (!isSafeKey(key)) continue
-      result[key] = sanitizeKeys((value as Record<string, unknown>)[key])
+    const keys = Object.keys(value)
+    let hasUnsafe = false
+    let childrenMutated = false
+    const sanitizedChildren: Record<string, unknown> = {}
+    for (const key of keys) {
+      if (!isSafeKey(key)) {
+        hasUnsafe = true
+        continue
+      }
+      const original = (value as Record<string, unknown>)[key]
+      const sanitized = sanitizeKeys(original)
+      if (sanitized !== original) childrenMutated = true
+      sanitizedChildren[key] = sanitized
     }
-    return result as T
+    if (!hasUnsafe && !childrenMutated) return value
+    return sanitizedChildren as T
   }
   return value
 }

package/src/copy/operationDefinitions.ts

@@ -5,6 +5,7 @@ export interface OperationDef {
   method: HttpMethod
   pathSuffix: string
   configKey: string
+  excludeFromEnableAll?: boolean
 }
 
 export const OPERATION_DEFS: OperationDef[] = [
@@ -86,6 +87,13 @@ export const OPERATION_DEFS: OperationDef[] = [
     pathSuffix: '/groupby',
     configKey: 'groupBy',
   },
+  {
+    name: 'updateEach',
+    method: 'post',
+    pathSuffix: '/each',
+    configKey: 'updateEach',
+    excludeFromEnableAll: true,
+  },
 ]
 
 export const READ_OPERATION_NAMES = new Set([
@@ -110,5 +118,7 @@ export function isOperationEnabled(
   config: Record<string, any>,
   def: OperationDef,
 ): boolean {
+  if (config[def.configKey] === false) return false
+  if (def.excludeFromEnableAll) return !!config[def.configKey]
   return !!(config.enableAll || config[def.configKey])
 }

package/src/copy/operationRuntime.ts

@@ -104,6 +104,7 @@ const PRISMA_ERROR_MAP: Record<string, { status: number; message: string }> = {
   P2024: { status: 503, message: 'Connection pool timeout' },
   P2025: { status: 404, message: 'Record not found' },
   P2026: { status: 501, message: 'Feature not supported by the current database provider' },
+  P2027: { status: 400, message: 'Multiple errors occurred during transaction execution' },
   P2028: { status: 500, message: 'Transaction API error' },
   P2030: { status: 400, message: 'Cannot find a fulltext index for the search' },
   P2033: { status: 400, message: 'Number out of range for the field type' },
@@ -122,9 +123,15 @@ function asErrorShape(error: unknown): ErrorShape {
   return {}
 }
 
+function isProduction(): boolean {
+  return typeof process !== 'undefined' && process.env && process.env.NODE_ENV === 'production'
+}
+
 export function mapError(error: unknown): HttpError {
   if (error instanceof HttpError) return error
   const e = asErrorShape(error)
+  const isProd = isProduction()
+
   if (e.name === 'ShapeError') return new HttpError(400, e.message || 'Shape validation failed')
   if (e.name === 'CallerError') return new HttpError(400, e.message || 'Caller validation failed')
   if (e.name === 'PolicyError') return new HttpError(403, e.message || 'Policy denied')
@@ -139,24 +146,34 @@ export function mapError(error: unknown): HttpError {
     const mapped = PRISMA_ERROR_MAP[e.code]
     if (mapped) {
       const detail = e.message
-      return new HttpError(mapped.status, detail ? mapped.message + ': ' + detail : mapped.message)
+      const shouldStripDetail = isProd && mapped.status >= 500
+      return new HttpError(
+        mapped.status,
+        !shouldStripDetail && detail ? mapped.message + ': ' + detail : mapped.message,
+      )
     }
     if (e.code.startsWith('P')) {
       const msg = e.message || 'Database operation failed'
       console.warn('[prisma-generator-express] Unmapped Prisma error code:', e.code, msg)
-      return new HttpError(500, msg)
+      return new HttpError(500, isProd ? 'Internal server error' : msg)
     }
   }
   if (typeof e.name === 'string') {
     if (e.name === 'PrismaClientValidationError') return new HttpError(400, e.message || 'Invalid query parameters')
     if (e.name === 'PrismaClientKnownRequestError') return new HttpError(400, e.message || 'Database request error')
-    if (e.name === 'PrismaClientInitializationError') return new HttpError(503, e.message || 'Database connection failed')
-    if (e.name === 'PrismaClientRustPanicError') return new HttpError(500, e.message || 'Internal database engine error')
-    if (e.name === 'PrismaClientUnknownRequestError') return new HttpError(500, e.message || 'Unknown database error')
+    if (e.name === 'PrismaClientInitializationError') {
+      return new HttpError(503, isProd ? 'Service unavailable' : (e.message || 'Database connection failed'))
+    }
+    if (e.name === 'PrismaClientRustPanicError') {
+      return new HttpError(500, isProd ? 'Internal server error' : (e.message || 'Internal database engine error'))
+    }
+    if (e.name === 'PrismaClientUnknownRequestError') {
+      return new HttpError(500, isProd ? 'Internal server error' : (e.message || 'Unknown database error'))
+    }
   }
   const msg = error instanceof Error ? error.message : String(error)
   console.error('[prisma-generator-express] Unhandled error:', error)
-  return new HttpError(500, msg || 'Internal server error')
+  return new HttpError(500, isProd ? 'Internal server error' : (msg || 'Internal server error'))
 }
 
 type SpeedExtensionFactory = (opts: { postgres?: unknown; sqlite?: unknown; debug?: boolean }) => unknown
@@ -248,14 +265,16 @@ export function applyPaginationLimits(
   config?: PaginationConfig,
   hasGuardShape?: boolean,
 ): Record<string, unknown> {
-  if (!config || hasGuardShape) return query
+  if (!config) return query
   const result: Record<string, unknown> = { ...query }
-  if (result.take === undefined && config.defaultLimit !== undefined) {
+  if (!hasGuardShape && result.take === undefined && config.defaultLimit !== undefined) {
     result.take = config.defaultLimit
   }
   if (config.maxLimit !== undefined && result.take !== undefined) {
     const takeNum = Number(result.take)
-    if (Math.abs(takeNum) > config.maxLimit) {
+    if (!Number.isFinite(takeNum)) {
+      result.take = config.maxLimit
+    } else if (Math.abs(takeNum) > config.maxLimit) {
       result.take = takeNum < 0 ? -config.maxLimit : config.maxLimit
     }
   }

package/src/copy/routeConfig.express.ts

@@ -47,15 +47,15 @@ export type ReadOperationConfig<
 }
 
 type ReadOperationOverrides<TShape, TCtx, TPrisma> = {
-  findFirst?: ReadOperationConfig<TShape, TCtx, TPrisma>
-  findFirstOrThrow?: ReadOperationConfig<TShape, TCtx, TPrisma>
-  findUnique?: ReadOperationConfig<TShape, TCtx, TPrisma>
-  findUniqueOrThrow?: ReadOperationConfig<TShape, TCtx, TPrisma>
-  findMany?: ReadOperationConfig<TShape, TCtx, TPrisma>
-  findManyPaginated?: ReadOperationConfig<TShape, TCtx, TPrisma>
-  count?: ReadOperationConfig<TShape, TCtx, TPrisma>
-  aggregate?: ReadOperationConfig<TShape, TCtx, TPrisma>
-  groupBy?: ReadOperationConfig<TShape, TCtx, TPrisma>
+  findFirst?: ReadOperationConfig<TShape, TCtx, TPrisma> | false
+  findFirstOrThrow?: ReadOperationConfig<TShape, TCtx, TPrisma> | false
+  findUnique?: ReadOperationConfig<TShape, TCtx, TPrisma> | false
+  findUniqueOrThrow?: ReadOperationConfig<TShape, TCtx, TPrisma> | false
+  findMany?: ReadOperationConfig<TShape, TCtx, TPrisma> | false
+  findManyPaginated?: ReadOperationConfig<TShape, TCtx, TPrisma> | false
+  count?: ReadOperationConfig<TShape, TCtx, TPrisma> | false
+  aggregate?: ReadOperationConfig<TShape, TCtx, TPrisma> | false
+  groupBy?: ReadOperationConfig<TShape, TCtx, TPrisma> | false
 }
 
 export type RouteConfig<

package/src/copy/routeConfig.hono.ts

@@ -1,4 +1,4 @@
-import type { Context, Next } from 'hono'
+import type { Context } from 'hono'
 import type {
   BaseOperationConfig,
   BaseRouteConfig,
@@ -44,18 +44,76 @@ export type GeneratedHonoEnv<TEnv extends HonoEnvBase = HonoEnvBase> = {
   Bindings: TEnv['Bindings']
 }
 
-export type HonoHookHandler<TEnv extends HonoEnvBase = HonoEnvBase> = (
+export type HonoBeforeHook<TEnv extends HonoEnvBase = HonoEnvBase> = (
   c: Context<GeneratedHonoEnv<TEnv>>,
-  next: Next,
 ) => Promise<Response | void> | Response | void
 
+export type HonoAfterHook<TEnv extends HonoEnvBase = HonoEnvBase> = (
+  c: Context<GeneratedHonoEnv<TEnv>>,
+) => Promise<Response | void> | Response | void
+
+/** @deprecated use HonoBeforeHook or HonoAfterHook */
+export type HonoHookHandler<TEnv extends HonoEnvBase = HonoEnvBase> = HonoBeforeHook<TEnv>
+
 export type OperationConfig<
   TShape = Record<string, unknown>,
   TEnv extends HonoEnvBase = HonoEnvBase,
-> = BaseOperationConfig<HonoHookHandler<TEnv>, TShape>
+> = Omit<BaseOperationConfig<HonoBeforeHook<TEnv>, TShape>, 'before' | 'after'> & {
+  before?: HonoBeforeHook<TEnv>[]
+  after?: HonoAfterHook<TEnv>[]
+}
+
+export type UpdateEachConfig<TEnv extends HonoEnvBase = HonoEnvBase> = {
+  before?: HonoBeforeHook<TEnv>[]
+  after?: HonoAfterHook<TEnv>[]
+}
+
+type HonoOpKeys =
+  | 'findUnique'
+  | 'findUniqueOrThrow'
+  | 'findFirst'
+  | 'findFirstOrThrow'
+  | 'findMany'
+  | 'findManyPaginated'
+  | 'create'
+  | 'createMany'
+  | 'createManyAndReturn'
+  | 'update'
+  | 'updateMany'
+  | 'updateManyAndReturn'
+  | 'upsert'
+  | 'delete'
+  | 'deleteMany'
+  | 'aggregate'
+  | 'count'
+  | 'groupBy'
+  | 'updateEach'
 
 export type RouteConfig<
   TShape = Record<string, unknown>,
   TCtx = unknown,
   TEnv extends HonoEnvBase = HonoEnvBase,
-> = BaseRouteConfig<HonoHookHandler<TEnv>, Context<GeneratedHonoEnv<TEnv>>, TShape, TCtx>
+> = Omit<
+  BaseRouteConfig<HonoBeforeHook<TEnv>, Context<GeneratedHonoEnv<TEnv>>, TShape, TCtx>,
+  HonoOpKeys
+> & {
+  findUnique?: OperationConfig<TShape, TEnv> | false
+  findUniqueOrThrow?: OperationConfig<TShape, TEnv> | false
+  findFirst?: OperationConfig<TShape, TEnv> | false
+  findFirstOrThrow?: OperationConfig<TShape, TEnv> | false
+  findMany?: OperationConfig<TShape, TEnv> | false
+  findManyPaginated?: OperationConfig<TShape, TEnv> | false
+  create?: OperationConfig<TShape, TEnv> | false
+  createMany?: OperationConfig<TShape, TEnv> | false
+  createManyAndReturn?: OperationConfig<TShape, TEnv> | false
+  update?: OperationConfig<TShape, TEnv> | false
+  updateMany?: OperationConfig<TShape, TEnv> | false
+  updateManyAndReturn?: OperationConfig<TShape, TEnv> | false
+  upsert?: OperationConfig<TShape, TEnv> | false
+  delete?: OperationConfig<TShape, TEnv> | false
+  deleteMany?: OperationConfig<TShape, TEnv> | false
+  aggregate?: OperationConfig<TShape, TEnv> | false
+  count?: OperationConfig<TShape, TEnv> | false
+  groupBy?: OperationConfig<TShape, TEnv> | false
+  updateEach?: UpdateEachConfig<TEnv>
+}

package/src/copy/routeConfig.ts

@@ -91,10 +91,14 @@ export interface BaseOperationConfig<HookHandler, TShape = Record<string, unknow
   before?: HookHandler[]
   after?: HookHandler[]
   shape?: TShape
-  dropGuard?: boolean
   pagination?: Partial<PaginationConfig>
 }
 
+export interface BaseUpdateEachConfig<HookHandler> {
+  before?: HookHandler[]
+  after?: HookHandler[]
+}
+
 export interface BaseRouteConfig<
   HookHandler,
   RequestType,
@@ -106,7 +110,6 @@ export interface BaseRouteConfig<
   customUrlPrefix?: string
   specBasePath?: string
   disableOpenApi?: boolean
-  dropGuard?: boolean
   disablePostReads?: boolean
   scalarCdnUrl?: string
   openApiTitle?: string
@@ -122,26 +125,45 @@ export interface BaseRouteConfig<
   resolveContext?: (request: RequestType) => TCtx | Promise<TCtx>
   queryBuilder?: QueryBuilderConfig | false
   pagination?: PaginationConfig
-  findUnique?: BaseOperationConfig<HookHandler, TShape>
-  findUniqueOrThrow?: BaseOperationConfig<HookHandler, TShape>
-  findFirst?: BaseOperationConfig<HookHandler, TShape>
-  findFirstOrThrow?: BaseOperationConfig<HookHandler, TShape>
-  findMany?: BaseOperationConfig<HookHandler, TShape>
-  findManyPaginated?: BaseOperationConfig<HookHandler, TShape>
-  create?: BaseOperationConfig<HookHandler, TShape>
-  createMany?: BaseOperationConfig<HookHandler, TShape>
-  createManyAndReturn?: BaseOperationConfig<HookHandler, TShape>
-  update?: BaseOperationConfig<HookHandler, TShape>
-  updateMany?: BaseOperationConfig<HookHandler, TShape>
-  updateManyAndReturn?: BaseOperationConfig<HookHandler, TShape>
-  upsert?: BaseOperationConfig<HookHandler, TShape>
-  delete?: BaseOperationConfig<HookHandler, TShape>
-  deleteMany?: BaseOperationConfig<HookHandler, TShape>
-  updateEach?: BaseOperationConfig<HookHandler, TShape>
-  aggregate?: BaseOperationConfig<HookHandler, TShape>
-  count?: BaseOperationConfig<HookHandler, TShape>
-  groupBy?: BaseOperationConfig<HookHandler, TShape>
+  findUnique?: BaseOperationConfig<HookHandler, TShape> | false
+  findUniqueOrThrow?: BaseOperationConfig<HookHandler, TShape> | false
+  findFirst?: BaseOperationConfig<HookHandler, TShape> | false
+  findFirstOrThrow?: BaseOperationConfig<HookHandler, TShape> | false
+  findMany?: BaseOperationConfig<HookHandler, TShape> | false
+  findManyPaginated?: BaseOperationConfig<HookHandler, TShape> | false
+  create?: BaseOperationConfig<HookHandler, TShape> | false
+  createMany?: BaseOperationConfig<HookHandler, TShape> | false
+  createManyAndReturn?: BaseOperationConfig<HookHandler, TShape> | false
+  update?: BaseOperationConfig<HookHandler, TShape> | false
+  updateMany?: BaseOperationConfig<HookHandler, TShape> | false
+  updateManyAndReturn?: BaseOperationConfig<HookHandler, TShape> | false
+  upsert?: BaseOperationConfig<HookHandler, TShape> | false
+  delete?: BaseOperationConfig<HookHandler, TShape> | false
+  deleteMany?: BaseOperationConfig<HookHandler, TShape> | false
+  updateEach?: BaseUpdateEachConfig<HookHandler>
+  aggregate?: BaseOperationConfig<HookHandler, TShape> | false
+  count?: BaseOperationConfig<HookHandler, TShape> | false
+  groupBy?: BaseOperationConfig<HookHandler, TShape> | false
 }
 
 export type OperationConfig = BaseOperationConfig<unknown>
-export type RouteConfig = BaseRouteConfig<unknown, unknown>
+export type RouteConfig = BaseRouteConfig<unknown, unknown>
+
+export function validateCountSourceWhere(
+  cs: PaginationCountSource | undefined,
+  location: string,
+): void {
+  if (!cs) return
+  if ((cs as { type?: string }).type !== 'materializedView') return
+  const where = (cs as { where?: Record<string, unknown> }).where
+  if (!where) return
+  for (const [key, value] of Object.entries(where)) {
+    if (value === null) continue
+    if (typeof value === 'object') {
+      throw new Error(
+        location + ': countSource.where["' + key + '"] must be scalar or null; got ' +
+        (Array.isArray(value) ? 'array' : 'object'),
+      )
+    }
+  }
+}

package/src/generators/generateFastifyHandler.ts

@@ -75,6 +75,17 @@ export async function ${exportName}(
 }`
   }).join('\n')
 
+  const updateEachExportName = `${modelName}UpdateEach`
+  const updateEachHandler = `
+export async function ${updateEachExportName}(
+  request: FastifyRequest,
+  _reply: FastifyReply,
+): Promise<void> {
+  const atomic = request.headers['x-batch-atomic'] === 'true'
+  const data = await core.updateEach(buildContext(request), atomic)
+  ;(request as FastifyExtended).resultData = data
+}`
+
   return `import type { FastifyRequest, FastifyReply } from 'fastify'
 import * as core from './${modelName}Core${ext}'
 import type { OperationContext, FindManyPaginatedMode } from '../operationRuntime${ext}'
@@ -108,5 +119,6 @@ function buildContext(request: FastifyRequest): OperationContext {
 }
 ${readHandlers}
 ${writeHandlers}
+${updateEachHandler}
 `
 }

package/src/generators/generateHonoHandler.ts

@@ -50,7 +50,7 @@ export function generateHonoHandler(options: {
   const readHandlers = READ_OPS.map((op) => {
     const exportName = `${modelName}${op.charAt(0).toUpperCase() + op.slice(1)}`
     return `
-export async function ${exportName}(c: Context<HonoEnv>): Promise<void> {
+export async function ${exportName}(c: HandlerContext): Promise<void> {
   const data = await core.${coreFnName(op)}(buildContext(c))
   c.set('resultData', data)
 }`
@@ -61,34 +61,29 @@ export async function ${exportName}(c: Context<HonoEnv>): Promise<void> {
     const statusCode = CREATED_OPS.has(op) ? 201 : 200
 
     return `
-export async function ${exportName}(c: Context<HonoEnv>): Promise<void> {
+export async function ${exportName}(c: HandlerContext): Promise<void> {
   const data = await core.${coreFnName(op)}(buildContext(c))
   c.set('resultData', data)
   c.set('resultStatus', ${statusCode})
 }`
   }).join('\n')
 
+  const updateEachExportName = `${modelName}UpdateEach`
+  const updateEachHandler = `
+export async function ${updateEachExportName}(c: HandlerContext): Promise<void> {
+  const atomic = c.req.header('x-batch-atomic') === 'true'
+  const data = await core.updateEach(buildContext(c), atomic)
+  c.set('resultData', data)
+}`
+
   return `import type { Context } from 'hono'
 import * as core from './${modelName}Core${ext}'
-import type { OperationContext, FindManyPaginatedMode } from '../operationRuntime${ext}'
-
-type HonoVariables = {
-  prisma: unknown
-  postgres?: unknown
-  sqlite?: unknown
-  parsedQuery?: Record<string, unknown>
-  body?: unknown
-  routeConfig?: { pagination?: OperationContext['paginationConfig'] }
-  guardShape?: Record<string, unknown>
-  guardCaller?: string
-  findManyPaginatedMode?: FindManyPaginatedMode
-  resultData?: unknown
-  resultStatus?: number
-}
+import type { OperationContext } from '../operationRuntime${ext}'
+import type { HonoInternalVariables } from '../routeConfig.target${ext}'
 
-type HonoEnv = { Variables: HonoVariables }
+type HandlerContext = Context<{ Variables: HonoInternalVariables }>
 
-function buildContext(c: Context<HonoEnv>): OperationContext {
+function buildContext(c: HandlerContext): OperationContext {
   return {
     prisma: c.get('prisma'),
     postgres: c.get('postgres'),
@@ -98,10 +93,10 @@ function buildContext(c: Context<HonoEnv>): OperationContext {
     guardShape: c.get('guardShape'),
     guardCaller: c.get('guardCaller'),
     paginationConfig: c.get('routeConfig')?.pagination,
-    findManyPaginatedMode: c.get('findManyPaginatedMode'),
   }
 }
 ${readHandlers}
 ${writeHandlers}
+${updateEachHandler}
 `
 }

package/src/generators/generateImportPrismaStatement.ts

@@ -76,7 +76,16 @@ export function getGuardShapesImport(
   if (!outputValue) return null
 
   const shapesFilePath = path.join(guard.output.value, 'shapes.ts')
-  if (!fs.existsSync(shapesFilePath)) return null
+  if (!fs.existsSync(shapesFilePath)) {
+    console.warn(
+      '[prisma-generator-express] prisma-guard generator detected but "' +
+        shapesFilePath +
+        '" was not found. Guard shapes will not be imported for model "' +
+        modelName +
+        '". Declare the "guard" generator before "express" in schema.prisma and re-run prisma generate.',
+    )
+    return null
+  }
 
   const fromDir = path.join(outputValue, modelName)
   const shapesPath = path.join(guard.output.value, 'shapes')

package/src/generators/generateOperationCore.ts

@@ -184,7 +184,7 @@ ${paginatedBody}
   const skip = (typeof query.skip === 'number' ? query.skip : 0)
   const takeRaw = (typeof query.take === 'number' ? query.take : items.length)
   const absTake = Math.abs(takeRaw)
-  const hasMore = items.length >= absTake && skip + items.length < total
+  const hasMore = absTake > 0 && items.length >= absTake && skip + items.length < total
 
   return { data: items, total, hasMore }
 }
@@ -193,35 +193,76 @@ export async function updateEach(
   ctx: OperationContext,
   atomic: boolean,
 ): Promise<unknown> {
-  const body = ctx.body
-  if (!Array.isArray(body)) {
+  const rawBody = ctx.body
+  if (!Array.isArray(rawBody)) {
     throw new HttpError(400, 'updateEach body must be an array of { where, data } items')
   }
-  const items = body as Record<string, unknown>[]
-  const client = ctx.prisma as PrismaClientLike
+
+  const MAX_ITEMS_NON_ATOMIC = 1000
+  const MAX_ITEMS_ATOMIC = 100
+
+  if (atomic && rawBody.length > MAX_ITEMS_ATOMIC) {
+    throw new HttpError(
+      400,
+      'atomic updateEach body exceeds max size of ' + MAX_ITEMS_ATOMIC + ' items',
+    )
+  }
+  if (!atomic && rawBody.length > MAX_ITEMS_NON_ATOMIC) {
+    throw new HttpError(
+      400,
+      'updateEach body exceeds max size of ' + MAX_ITEMS_NON_ATOMIC + ' items',
+    )
+  }
+
+  const items = rawBody.map((item, index) => {
+    const sanitized = validateBody(item)
+    if (!('where' in sanitized) || sanitized.where === undefined) {
+      throw new HttpError(400, 'updateEach item at index ' + index + ' is missing "where"')
+    }
+    if (!('data' in sanitized) || sanitized.data === undefined) {
+      throw new HttpError(400, 'updateEach item at index ' + index + ' is missing "data"')
+    }
+    return sanitized
+  })
+  const extended = await getExtendedClient(ctx)
 
   if (atomic) {
-    if (typeof client.$transaction !== 'function') {
+    const txClient = extended as PrismaClientLike
+    if (typeof txClient.$transaction !== 'function') {
       throw new HttpError(500, 'Atomic updateEach requires transaction support on the Prisma client')
     }
-    const runInteractive = client.$transaction as unknown as <T>(
+    const runInteractive = txClient.$transaction as unknown as <T>(
       fn: (tx: unknown) => Promise<T>,
     ) => Promise<T>
     return runInteractive(async (tx) => {
       const txDelegate = getDelegate(tx, '${modelNameLower}')
-      return Promise.all(items.map((item) => txDelegate.update(item)))
+      const out: unknown[] = new Array(items.length)
+      for (let i = 0; i < items.length; i++) {
+        out[i] = await txDelegate.update(items[i])
+      }
+      return out
     })
   }
 
-  const delegate = getDelegate(client, '${modelNameLower}')
-  const settled = await Promise.allSettled(
-    items.map((item) => delegate.update(item)),
-  )
-  return settled.map((result) =>
-    result.status === 'fulfilled'
-      ? { status: 'ok', data: result.value }
-      : { status: 'error', error: mapError(result.reason).message },
-  )
+  const delegate = getDelegate(extended, '${modelNameLower}')
+  const CONCURRENCY = 8
+  const results: Array<{ status: 'ok'; data: unknown } | { status: 'error'; error: string }> =
+    new Array(items.length)
+  let cursor = 0
+  const workerCount = Math.min(CONCURRENCY, items.length)
+  const workers = Array.from({ length: workerCount }, async () => {
+    for (;;) {
+      const i = cursor++
+      if (i >= items.length) return
+      try {
+        results[i] = { status: 'ok', data: await delegate.update(items[i]) }
+      } catch (err) {
+        results[i] = { status: 'error', error: mapError(err).message }
+      }
+    }
+  })
+  await Promise.all(workers)
+  return results
 }
 `
 }