ts-prorm-orm 1.2.3 → 2.0.0

package/CHANGELOG.md

@@ -5,16 +5,147 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.2.3]
+## [2.0.0]
+
+### Breaking
+
+- **JSON/JSONB columns now return parsed values on every dialect.** Previously
+  the PostgreSQL and MySQL drivers returned an object while SQLite (and any
+  dialect storing JSON as TEXT) returned the raw string. Reads are now
+  consistent, which means **code that called `JSON.parse` on the result under
+  SQLite must drop that call** — it will now be parsing an object.
+
+  This is the only change requiring action on upgrade. Text that isn't valid
+  JSON is still returned as-is rather than throwing, so rows written by earlier
+  versions read back correctly.
+
+### Changed
+
+- **JSON/JSONB columns now round-trip losslessly, and read back as parsed
+  values on every dialect.** Two separate problems, fixed together.
+
+  *Reads were dialect-specific.* The PostgreSQL and MySQL drivers already
+  returned an object; SQLite (and anything else storing JSON as TEXT) returned
+  the raw string, so the same model code behaved differently per engine.
+  `findAll`/`findOne`/`findByPk` now parse the string form everywhere.
+  **If you were calling `JSON.parse` yourself on SQLite, remove it** — the value
+  arrives parsed. Values that are already objects are untouched, and text that
+  isn't valid JSON is returned as-is rather than throwing, so rows written
+  before this release still read back correctly.
+
+  *Writes were asymmetric with reads.* A string value was written to the column
+  **unencoded** while the read side parsed unconditionally, so any string that
+  happened to be valid JSON changed type on the way back: `'123'` returned the
+  number `123`, `'true'` a boolean, `'{"a":1}'` an object, and
+  `'12345678901234567890'` came back as `12345678901234567000` — silent
+  precision loss. It also wrote invalid JSON on PostgreSQL, which rejects a bare
+  `hello` for a `json` column. Every value is now encoded on write, strings
+  included, in both the `define()` and class-based paths.
+
+- **JSON/JSONB values were not serialized on write at all in some paths.** A
+  plain object survived by accident (the dialect's value escaper stringifies
+  objects), but an array was expanded into the `(a, b)` IN-list form and
+  produced invalid SQL. `create`, `bulkCreate`, `update` and `upsert` now
+  serialize explicitly.
 
 ### Fixed
 
+- **`FindOptions.lock` never reached the dialect.** `findAll({ lock: 'UPDATE',
+  transaction: t })` compiled to a plain SELECT, so code written to serialize
+  concurrent updates took no lock at all. It is now forwarded, and PostgreSQL /
+  MySQL emit `FOR UPDATE` / `FOR SHARE` / `LOCK IN SHARE MODE` as documented.
+  Dialects without row-level locking (SQLite) still ignore it.
+- **`FindOptions.union` / `unionType` were silently no-ops** on models built by
+  `prorm.define()` — the branches were declared, documented and compiled by the
+  dialects, but never passed to them, so only the main query ran.
+- **`FindOptions.using` never worked.** It resolved the target through
+  `prorm.connectionManager`, which nothing ever set, so every call threw
+  `Connection 'x' not found. Available: none`; the class-based path then called
+  `.get()` on a plain object. `ConnectionManager.addConnection()` now registers
+  itself on the instance it creates, and `using` is implemented on both query
+  paths.
 - **`raw: true` was accepted and ignored.** Rows came back as full model
   instances carrying `save`/`update`/`destroy` and internal bookkeeping fields
   — slower than asked for, and wrong for grouped aggregates that correspond to
   no model instance. It now returns plain row objects.
 - `normalizeOperatorKeys` is exported from the package root, alongside the
   `operatorToWhereKey` and `getOperatorString` helpers it belongs with.
+- **Row locking never compiled from the object form.** `lock: { level: 'UPDATE' }`
+  — and any object carrying `nowait` / `skipLocked` — emitted no lock clause at
+  all. Every documented shape now compiles across 9 dialects, including SQL
+  Server's table-hint syntax (`WITH (UPDLOCK, ROWLOCK, READPAST)`). A level a
+  dialect lacks throws naming the supported levels.
+- **Composite unique constraints were never emitted.** Neither the `uniqueKeys`
+  model option nor the attribute-level `uniqueKey` grouping produced any SQL, so
+  uniqueness the model declared was never enforced by the database. Worse,
+  `sync({ alter: true })` *destroyed* constraints that had been emitted, because
+  SQLite implements `changeColumn` by rebuilding the table and the rebuild
+  dropped the `UNIQUE` clause. Both declaration forms now emit a real
+  constraint, and declared keys are re-applied after an alter.
+- **Partial indexes.** `IndexOptions.where` compiled to bound placeholders,
+  which no database accepts in a `CREATE INDEX` predicate. Db2, SAP HANA and
+  ClickHouse silently dropped the predicate and returned an **unfiltered**
+  index; MariaDB and Oracle emitted a `WHERE` clause they have never accepted.
+  Predicates are now inlined as escaped literals where supported, and dialects
+  without partial indexes throw with the reason.
+- **`ORDER BY` was broken on three dialects.** `[['name','DESC']]` produced
+  `ORDER BY [0] NAME, [1] DESC` on SQL Server and Snowflake; on Oracle a plain
+  `'name'` emitted one term per *character*. The `asc()` / `desc()` / `random()`
+  helpers were silently ignored on every dialect and on all four graph
+  dialects. `random()` now resolves per engine — `NEWID()` on SQL Server, where
+  `RAND()` is a per-query constant and would not shuffle at all.
+- **Two filtering `include`s on the same parent column** merged into a shape the
+  where-builders don't recognise, collapsed to `"id" = ?`, and returned one
+  arbitrary parent.
+- **`{ all: true }` includes** were never expanded, and did not compose with
+  `required: true`.
+- **A bare-model include** (`include: [Post]`) threw a `TypeError` at the top
+  level and silently loaded nothing when nested; 11 documented `IncludeOptions`
+  fields were being dropped when include entries were rebuilt.
+- **`findAndCountAll` ignored `union`**, so `count` described only the main
+  branch while `rows` covered all of them.
+- **Foreign-key check toggling emitted MySQL syntax on PostgreSQL.** It now
+  routes per dialect family, and dialects with no session-level switch throw
+  naming their own alternative.
+- **The published package could ship a stale build.** `npm run build` was a
+  plain `tsc`, which emits but never deletes, so a leftover `dist/logging.js`
+  from a removed source file shadowed `dist/logging/index.js` — Node resolves a
+  file before a directory — and the built package threw
+  `logQuery is not a function` on `bulkCreate`. The test suite could not catch
+  it, because it runs against `src/`. `build` now cleans first, and
+  `check:package` fails the publish on any stale output.
+
+### Added
+
+- **30 previously unreachable exports.** `src/cache`, `src/audit`,
+  `src/prisma-migrate`, the `@Audit` decorator, `GraphCapabilityError` and
+  `DataLineage` were implemented but not exported, and the `exports` map allowed
+  no deep imports either. Five colliding cache type names are aliased so no
+  existing export changed meaning. `ts-prorm-orm/cache`, `/audit`, `/graph` and
+  `/prisma-migrate` subpaths expose them under their real names.
+- **Bun support.** The SQLite dialect now resolves its driver per runtime:
+  `better-sqlite3` on Node, the built-in `bun:sqlite` on Bun. Bun needs no
+  native build step, and under Bun the better-sqlite3 addon may not be
+  installable at all. The two APIs differ in one place — bun:sqlite has no
+  `db.pragma()` — so the driver module adds it, keeping a single shape for the
+  dialect to code against with no runtime branching in the SQL layer. Under Bun
+  it still falls back to better-sqlite3 if that is what a project already
+  depends on. `scripts/bun-smoke.ts` exercises CRUD, operators, eager loading,
+  ordering, JSON, aggregates, paranoid deletes and transactions on Bun.
+- **Documentation.** 29 developer guides plus an index, with every SQL example
+  captured from the running code rather than written from memory.
+- **Tests.** ~4,000 connection-free tests across dialects, models, query
+  builders, compliance, optimizers, schema, graph and the CLI. `collectCoverageFrom`
+  now scopes coverage to shipped source (`src/test.ts` was inflating the
+  denominator despite being excluded from the build); no coverage threshold is
+  enforced.
+
+### Removed
+
+- **`docs-next`** and its entire Vercel deployment pipeline. Documentation is
+  now a static React viewer published to GitLab Pages, and database image
+  mirroring moved to the project's own GitLab Container Registry.
+
 
 ## [1.2.2]
 
@@ -42,6 +173,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - **`avg()`** — the one standard aggregate that was missing.
+- Removed `src/hooks/` — a 488-line model-level hook system imported by nothing
+  and exported from nowhere, the third such parallel implementation found (after
+  the association decorators and the duplicate eager-loaders). Its `HookName`
+  union was salvaged into `core/types`.
 - `exports` now permits `ts-prorm-orm/package.json`, which build tooling and
   version checks commonly read.
 
@@ -142,6 +277,69 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **Query logging fired twice and ignored per-query overrides.** The user's
+  `logging` callback was handed to the internal Logger as well as being invoked
+  by the query path, so it ran on both - and the Logger's copy honoured no
+  per-query setting, making `findAll({ logging: false })` log anyway. The
+  internal Logger now handles only slow-query detection and its own levels.
+- **Four operations logged nothing at all.** `count`, `bulkCreate`, `increment`
+  and the aggregates never emitted a line, so turning logging on showed an
+  incomplete picture of what the ORM was doing. Every operation now routes
+  through one path.
+- **`instance.validate({ hooks: true })` ran no hooks.** It read a
+  `_hooksManager` property that nothing ever assigned, so the flag was accepted
+  and both `beforeValidate` and `afterValidate` were skipped. Both call sites
+  (prorm.ts and models/model.ts) now use the model's declared hooks, the same
+  source every other lifecycle hook comes from.
+
+### Added
+
+- **Sequelize-compatible query logging.** `logging` accepts `false`, `true` or a
+  `(sql, timing)` function at instance level, overridable per query - so one
+  noisy call can be traced without enabling logging globally, and one call can
+  be silenced without disabling it. Adds `benchmark` (append elapsed time) and
+  `logQueryParameters` (append bound values, off by default since bound values
+  routinely contain credentials). The resolution logic lives in
+  `src/logging/query-logging.ts` and is exported: `logQuery`,
+  `resolveQueryLogger`, `formatQueryLog`.
+- **`unset<Association>()` on belongsTo** — clears the foreign key and persists
+  it. `set<Association>(null)` does the same thing and now explicitly accepts
+  null, but reads as an assignment rather than a removal.
+- **`HookName` / `ModelHookMap` types** — hook names as a union rather than
+  `string`, so a misspelled hook is a compile error instead of a callback that
+  silently never runs.
+- **`@AbstractModel`** — a base class that defines fields shared by several
+  models without getting a table of its own. Columns declared on it, and any
+  `@PrimaryKey` / `@AutoIncrement` / defaults on them, are inherited by the
+  concrete models that extend it; a subclass may redeclare a column to override
+  it. Passing the abstract class to `addModel()` is an error naming the class.
+- **Finders**: `findOneOrFail` / `findByPkOrFail` (throw `EmptyResultError`
+  rather than returning null), `findLast` (inverts the ordering), `exists(where)`
+  (a COUNT rather than fetching a row), and `findInBatches` / `findEach` for
+  walking a large set without holding it in memory. Batching pages by primary
+  key rather than OFFSET, so per-batch cost stays flat and concurrent writes
+  cannot cause a page to be skipped.
+- **Eleven lifecycle hooks that never fired for model-level operations**:
+  `beforeUpdate`/`afterUpdate`, `beforeDestroy`/`afterDestroy`,
+  `beforeSave`/`afterSave`, `beforeFind`/`afterFind`, `beforeCount`, and
+  `beforeUpsert`/`afterUpsert`. They existed for instance methods only, so
+  `Model.update(...)` bypassed them entirely. `beforeFind` may return replacement
+  options and `afterFind` a replacement result set.
+- **`Model.increment()` / `Model.decrement()`** — add to or subtract from
+  numeric columns with `SET n = n + 1` in a single statement, so two concurrent
+  callers each apply their delta. Previously only per-instance helpers existed,
+  leaving a read-modify-write that silently drops one of two simultaneous
+  updates. Accepts a column, a list, or a per-column map; honours `where` and
+  paranoid filtering.
+- **`Model.bulkUpdate(rows)`** — write different values to many rows in one
+  statement, compiled as a `CASE` per column (portable across every supported
+  dialect) rather than one UPDATE per row. Columns a row omits keep their
+  current value; rows not listed are untouched. Identify rows by a non-primary
+  column with `{ key }`.
+
+
 ### Comprehensive Feature Reference
 
 This section provides a complete reference of all ORM features organized by category.

package/README.md

@@ -29,6 +29,13 @@ A TypeScript ORM supporting multiple database dialects with full TypeScript supp
 - **Validation**: Built-in and custom validators
 - **Stored Procedures**: Create and call stored procedures (across supported dialects)
 - **Triggers**: Database triggers with FOR EACH ROW and WHEN clauses (across supported dialects)
+- **Query logging**: Sequelize-compatible `logging` (`false` / `true` / a
+  `(sql, timing)` function), overridable per query, plus `benchmark` for elapsed
+  time and `logQueryParameters` for bound values. Every operation logs, not just
+  some
+- **Bulk writes**: `increment`/`decrement` do the arithmetic in the database, so
+  concurrent updates don't lose each other; `bulkUpdate` writes different values
+  to many rows in one statement instead of one round trip per row
 - **Aggregates**: `count`, `sum`, `avg`, `min`, `max` — all issuing real SQL
   aggregates and honouring `where`, scopes, soft-deletes and relation filters;
   `group` + `having` for grouped results
@@ -646,29 +653,30 @@ npm run diagram:model
 
 ## Documentation
 
-Full documentation is available in the `docs/` directory:
-
-- [Getting Started](./docs/) - Main documentation entry point
-- [Dialects](./docs/dialects/) - Database-specific documentation
-  - [SQLite](./docs/dialects/sqlite.md)
-  - [MySQL](./docs/dialects/mysql.md)
-  - [PostgreSQL](./docs/dialects/postgres.md)
-  - [MariaDB](./docs/dialects/mariadb.md)
-  - [Oracle](./docs/dialects/oracle.md)
-  - [MSSQL](./docs/dialects/mssql.md)
-- [API Reference](./docs/api/) - API documentation
-  - [Models](./docs/api/models.md)
-  - [Query Builder](./docs/api/queries.md)
-  - [Hooks](./docs/api/hooks.md)
-  - [Associations](./docs/api/associations.md)
-
-Additional documentation:
-- [Models](./docs/MODELS.md) - Model definition
-- [Migrations](./docs/MIGRATIONS.md) - Database migrations
-- [Associations](./docs/ASSOCIATIONS.md) - Relationship types
-- [Hooks](./docs/HOOKS.md) - Lifecycle hooks
-- [Stored Procedures](./docs/STORED_PROCEDURES.md) - Advanced database features
-- [Triggers](./docs/TRIGGERS.md) - Database triggers
+Full documentation is in the [`docs/`](./docs/README.md) directory — start
+there for the complete index.
+
+**Core**
+- [Defining models](./docs/guides/models.md) · [Data types](./docs/guides/data-types.md) · [Querying](./docs/guides/querying.md) · [Query operators](./docs/guides/query-operators.md)
+- [SQL function builders](./docs/guides/sql-functions.md) · [Associations](./docs/guides/associations.md) · [Eager loading](./docs/guides/eager-loading.md) · [Scopes](./docs/guides/scopes.md) · [Hooks](./docs/guides/hooks.md) · [Validation](./docs/guides/validation.md) · [Virtual fields](./docs/guides/virtual-fields.md)
+- [Transactions](./docs/guides/transactions.md) · [Bulk operations](./docs/guides/bulk-operations.md) · [Raw queries](./docs/guides/raw-queries.md) · [Streaming](./docs/guides/streams.md) · [Error handling](./docs/guides/error-handling.md)
+
+**Schema**
+- [Indexes & constraints](./docs/guides/indexes-and-constraints.md) · [Schema objects](./docs/guides/schema-objects.md) (views, triggers, procedures, sequences, RLS, partitions)
+- [Migrations](./docs/guides/migrations.md) · [QueryInterface](./docs/guides/query-interface.md) · [Schema diffing](./docs/guides/schema-diffing.md) · [Prisma import](./docs/guides/prisma-import.md)
+
+**Connections & performance**
+- [Connection pooling](./docs/guides/connection-pooling.md) · [Multiple databases](./docs/guides/multiple-databases.md) · [Read replicas](./docs/guides/replication.md)
+- [Caching](./docs/guides/caching.md) · [Query optimization](./docs/guides/query-optimization.md) · [Logging](./docs/guides/logging.md)
+
+**Extending & operating**
+- [Decorators](./docs/guides/decorators.md) · [TypeScript types](./docs/guides/typescript-types.md) · [External fields](./docs/guides/external-fields.md) · [SQL constants](./docs/guides/sql-constants.md) · [Extension catalogue](./docs/guides/extensions.md)
+- [Audit logging](./docs/guides/audit-logging.md) · [User management](./docs/guides/user-management.md) · [Compliance](./docs/guides/compliance.md) · [Foreign data wrappers](./docs/guides/foreign-data-wrappers.md) · [Runbooks](./docs/runbooks/README.md)
+
+**Databases & tooling**
+- [Database types](./docs/database-types.md) · [SQL dialects](./docs/dialects/README.md) ([SQLite](./docs/dialects/sqlite.md), [PostgreSQL](./docs/dialects/postgres.md), [MySQL](./docs/dialects/mysql.md), [MariaDB](./docs/dialects/mariadb.md), [Oracle](./docs/dialects/oracle.md), [MSSQL](./docs/dialects/mssql.md), …)
+- [Store adapters](./docs/stores/README.md) · [Graph databases](./docs/guides/graph-databases.md) · [SQLite advanced](./docs/guides/sqlite-advanced.md)
+- [CLI](./docs/guides/cli.md) · [Diagrams](./docs/diagrams/README.md) · [Docker & sandboxes](./docs/guides/docker/)
 
 ### Architecture / Component Guides
 
@@ -676,7 +684,7 @@ In-depth, code-level reference docs for each major subsystem, living alongside t
 
 - [Dialects](src/dialects/README.md) - The `Dialect` interface and per-database (SQLite/MySQL/PostgreSQL/MariaDB/Oracle/MSSQL/CockroachDB/Redshift/Db2/Snowflake/ClickHouse/DuckDB/HANA/Spanner) implementations of connections, DDL, views, partitioning, RLS, and query building.
 - [Models](src/models/README.md) - The model layer: attribute/data types, `prorm.define()`, associations, scopes, indexes/constraints, and the model registry.
-- [Query Builders](src/query-builders/README.md) - Translates `where`/`order`/`limit`/`include` options into dialect-specific SQL strings and bound parameter values. Includes a typed SQL function-builder library (`src/query-builders/functions/**` - window functions, date/time, JSON paths, string/math functions, CASE expressions, cross-dialect aggregates, full-text search) usable via `import { ... } from 'ts-prorm-orm'`; see [SQL Functions](docs/query-features/queries.md#sql-functions) for worked examples.
+- [Query Builders](src/query-builders/README.md) - Translates `where`/`order`/`limit`/`include` options into dialect-specific SQL strings and bound parameter values. Includes a typed SQL function-builder library (`src/query-builders/functions/**` - window functions, date/time, JSON paths, string/math functions, CASE expressions, cross-dialect aggregates, full-text search) usable via `import { ... } from 'ts-prorm-orm'`; see [`src/query-builders/README.md`](src/query-builders/README.md) for the function list.
 - [Extension Catalog](src/extensions/README.md) - A discoverability reference (not executable code) of ~124 verified real extensions/plugins/licensed features across dialects, queryable via `findExtension()`/`listExtensionsForDialect()`/`listExtensionsByCategory()`/`searchExtensions()`.
 - [Query Optimizers](src/query-optimizers/README.md) - Opt-in performance tooling (query hints, explain plans, slow-query logging, batch optimization, prepared-statement/result caching).
 - [Migrations](src/migrations/README.md) - Migration files, the `Migrator`, `PrormMeta` history tracking, seeders, `QueryInterface`, and schema diffing (`src/schema/`).

package/dist/compliance/index.d.ts

@@ -91,3 +91,5 @@ export { DSARWorkflow, DSARRequest, RequestStatus, RequestType, FulfillmentOptio
 export { PrivacyImpactAssessment, AssessmentStatus, RiskSeverity, PIARecord, RiskRecord, PIACreateOptions, RiskRecordOptions, } from './privacy-impact-assessment';
 export { BackupVerification, BackupSource, BackupConfig, BackupMetadata, VerificationResult, VerificationSchedule, VerificationHistoryEntry, } from './backup-verification';
 export { QueryFirewall, FirewallRule, FirewallRuleType, FirewallMode, FirewallModeEnum, FirewallOptions, QueryAnalysis, QueryOperation, BlockedQuery, getRecommendedRules, FIREWALL_RULES, OWASP_SQL_INJECTION_PATTERNS, CIS_BENCHMARK_RULES, PCI_DSS_RULES, HIPAA_RULES, SOX_RULES, NIST_CSF_RULES, POSTGRESQL_RULES, MYSQL_RULES, MARIADB_RULES, MSSQL_RULES, ORACLE_RULES, SQLITE_RULES, DATABASE_RULES, DatabaseType, FirewallRules, FirewallRuleDecoratorOptions, PostgreSQLFirewall, MySQLFirewall, MariaDBFirewall, MSSQLFirewall, OracleFirewall, SQLiteFirewall, applyFirewallRulesToModel, } from './query-firewall';
+export { DataLineage, LineageTrack, getLineageFields, getLineageOptions, createDerivedRecord, createComputedRecord, applyHooks as applyLineageHooks, } from './data-lineage';
+export type { DataSource, TransformationRecord, LineageRecord, LineageChain, LineageOptions, LineageTrackOptions, } from './data-lineage';

package/dist/compliance/index.js

@@ -70,7 +70,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPIIFields = exports.getClassification = exports.FieldClassification = exports.Classify = exports.DataClassifier = exports.createDSARResponse = exports.exportStream = exports.exportData = exports.DataPortabilityExporter = exports.applyPseudonymizationHooks = exports.Pseudonymize = exports.detokenize = exports.tokenize = exports.configure = exports.PseudonymizationService = exports.isImmutable = exports.enableVersioning = exports.makeImmutable = exports.ImmutableRecord = exports.applyMaskingHooks = exports.maskMany = exports.mask = exports.maskValue = exports.maskField = exports.Mask = exports.MaskPatternEnum = exports.DataMasker = exports.registerHooks = exports.rlsMiddleware = exports.runInContext = exports.getContext = exports.setContext = exports.apply = exports.initRLS = exports.RLS = exports.RowLevelSecurity = exports.ConsentVersioning = exports.LegalBasisEnum = exports.ConsentRecord = exports.RightToErasure = exports.DataRetentionPolicy = exports.TLSEnforcer = exports.getEncryptedFields = exports.applyEncryptionHooks = exports.Encrypt = exports.decryptValue = exports.encryptValue = exports.configureFieldEncryption = exports.FieldEncryption = exports.ComplianceAuditTrail = void 0;
 exports.SensitiveDataDiscovery = exports.getRecommendedLimits = exports.satisfiesCompliance = exports.checkRateLimit = exports.initRateLimiter = exports.getGlobalLimiter = exports.getRateLimitOptions = exports.RateLimit = exports.RateLimiter = exports.isArchived = exports.isFrozen = exports.applyWORMHooks = exports.getWORMOptions = exports.WORM = exports.WORMStorage = exports.getTenantIsolationOptions = exports.getTenantAuditMetadata = exports.sessionIsolationMiddleware = exports.TenantIsolation = exports.SessionIsolation = exports.initBreachDetector = exports.getGlobalBreachDetector = exports.BreachDetector = exports.analyzeQuerySecurity = exports.initSecurityMonitor = exports.getGlobalMonitor = exports.ComplianceSecurityMonitor = exports.SecurityMonitor = exports.isImmutableModel = exports.hasAudit = exports.getSecurityFrameworks = exports.getDatabaseSecurity = exports.getTableSecurity = exports.DatabaseSecurity = exports.Table = exports.setupAllSecurity = exports.setupSecurity = exports.getAllFrameworks = exports.getFrameworkCategory = exports.isValidFramework = exports.FrameworkCount = exports.FrameworkRequirements = exports.FrameworkCategories = exports.AllFrameworks = exports.SecurityFramework = exports.Security = exports.autoDiscover = exports.isSensitive = exports.getPCIFields = exports.getPHIFields = void 0;
-exports.applyFirewallRulesToModel = exports.SQLiteFirewall = exports.OracleFirewall = exports.MSSQLFirewall = exports.MariaDBFirewall = exports.MySQLFirewall = exports.PostgreSQLFirewall = exports.FirewallRules = exports.DATABASE_RULES = exports.SQLITE_RULES = exports.ORACLE_RULES = exports.MSSQL_RULES = exports.MARIADB_RULES = exports.MYSQL_RULES = exports.POSTGRESQL_RULES = exports.NIST_CSF_RULES = exports.SOX_RULES = exports.HIPAA_RULES = exports.PCI_DSS_RULES = exports.CIS_BENCHMARK_RULES = exports.OWASP_SQL_INJECTION_PATTERNS = exports.FIREWALL_RULES = exports.getRecommendedRules = exports.FirewallModeEnum = exports.QueryFirewall = exports.BackupVerification = exports.PrivacyImpactAssessment = exports.DSARWorkflow = exports.generateTransferReport = exports.getComplianceTransfers = exports.CrossBorderLog = exports.generateComplianceReport = exports.getPatterns = exports.unregisterPattern = exports.registerPattern = void 0;
+exports.applyLineageHooks = exports.createComputedRecord = exports.createDerivedRecord = exports.getLineageOptions = exports.getLineageFields = exports.LineageTrack = exports.DataLineage = exports.applyFirewallRulesToModel = exports.SQLiteFirewall = exports.OracleFirewall = exports.MSSQLFirewall = exports.MariaDBFirewall = exports.MySQLFirewall = exports.PostgreSQLFirewall = exports.FirewallRules = exports.DATABASE_RULES = exports.SQLITE_RULES = exports.ORACLE_RULES = exports.MSSQL_RULES = exports.MARIADB_RULES = exports.MYSQL_RULES = exports.POSTGRESQL_RULES = exports.NIST_CSF_RULES = exports.SOX_RULES = exports.HIPAA_RULES = exports.PCI_DSS_RULES = exports.CIS_BENCHMARK_RULES = exports.OWASP_SQL_INJECTION_PATTERNS = exports.FIREWALL_RULES = exports.getRecommendedRules = exports.FirewallModeEnum = exports.QueryFirewall = exports.BackupVerification = exports.PrivacyImpactAssessment = exports.DSARWorkflow = exports.generateTransferReport = exports.getComplianceTransfers = exports.CrossBorderLog = exports.generateComplianceReport = exports.getPatterns = exports.unregisterPattern = exports.registerPattern = void 0;
 // Audit Trail
 var audit_trail_1 = require("./audit-trail");
 Object.defineProperty(exports, "ComplianceAuditTrail", { enumerable: true, get: function () { return audit_trail_1.ComplianceAuditTrail; } });
@@ -258,3 +258,15 @@ Object.defineProperty(exports, "MSSQLFirewall", { enumerable: true, get: functio
 Object.defineProperty(exports, "OracleFirewall", { enumerable: true, get: function () { return query_firewall_1.OracleFirewall; } });
 Object.defineProperty(exports, "SQLiteFirewall", { enumerable: true, get: function () { return query_firewall_1.SQLiteFirewall; } });
 Object.defineProperty(exports, "applyFirewallRulesToModel", { enumerable: true, get: function () { return query_firewall_1.applyFirewallRulesToModel; } });
+// Data Lineage
+// `applyHooks` is aliased to `applyLineageHooks` for the same reason
+// data-masker's and pseudonymization's are: three modules in this barrel each
+// export a function by that name.
+var data_lineage_1 = require("./data-lineage");
+Object.defineProperty(exports, "DataLineage", { enumerable: true, get: function () { return data_lineage_1.DataLineage; } });
+Object.defineProperty(exports, "LineageTrack", { enumerable: true, get: function () { return data_lineage_1.LineageTrack; } });
+Object.defineProperty(exports, "getLineageFields", { enumerable: true, get: function () { return data_lineage_1.getLineageFields; } });
+Object.defineProperty(exports, "getLineageOptions", { enumerable: true, get: function () { return data_lineage_1.getLineageOptions; } });
+Object.defineProperty(exports, "createDerivedRecord", { enumerable: true, get: function () { return data_lineage_1.createDerivedRecord; } });
+Object.defineProperty(exports, "createComputedRecord", { enumerable: true, get: function () { return data_lineage_1.createComputedRecord; } });
+Object.defineProperty(exports, "applyLineageHooks", { enumerable: true, get: function () { return data_lineage_1.applyHooks; } });

package/dist/connection-manager.js

@@ -37,6 +37,12 @@ class ConnectionManager {
             throw new Error(`Connection with name '${name}' already exists`);
         }
         const prorm = new prorm_1.Prorm(options);
+        // Let the instance find its siblings. This is what makes
+        // `Model.findAll({ using: 'other' })` resolvable: the query path looks the
+        // target connection up through `prorm.connectionManager`, which nothing
+        // used to set, so `using` failed with "Available: none" no matter how many
+        // connections had been added.
+        prorm.connectionManager = this;
         this.connections.set(name, prorm);
         // Set as default if it's the first connection
         if (this._defaultConnection === null) {
@@ -78,8 +84,11 @@ class ConnectionManager {
         if (!prorm) {
             return false;
         }
-        // Close the connection
+        // Close the connection and detach it from this manager, so a model still
+        // holding a reference to it can't route a `using` query through a
+        // registry it is no longer a member of.
         await prorm.close();
+        prorm.connectionManager = null;
         this.connections.delete(name);
         // Update default if needed
         if (this._defaultConnection === name) {
@@ -167,6 +176,9 @@ class ConnectionManager {
     async closeAll() {
         const closePromises = Array.from(this.connections.values()).map((seq) => seq.close());
         await Promise.all(closePromises);
+        for (const prorm of this.connections.values()) {
+            prorm.connectionManager = null;
+        }
         this.connections.clear();
         this._defaultConnection = null;
     }

package/dist/core/expressions.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Raw SQL expression wrappers used by the Prorm instance API.
+ *
+ * `Literal` embeds SQL verbatim; `Col` references a column without quoting it
+ * as a value. Note that `src/operators.ts` also exposes `literal()`/`col()`
+ * factories producing a different shape - the dialects consume the operators
+ * form, so prefer those in new code.
+ */
+/**
+ * Represents a raw SQL literal value
+ * Used for inserting raw SQL expressions into queries
+ *
+ * @example
+ * // Use in default values
+ * createdAt: { type: DATE, defaultValue: prorm.literal('NOW()') }
+ *
+ * @example
+ * // Use in updates
+ * User.update({ count: prorm.literal('count + 1') }, {...})
+ *
+ * @example
+ * // Use in select with calculations
+ * User.findAll({ attributes: [[prorm.literal('1 + 1'), 'two']] })
+ */
+export declare class Literal {
+    readonly val: string;
+    constructor(sql: string);
+    /**
+     * Get the raw SQL string
+     */
+    toString(): string;
+}
+/**
+ * Class representing a column reference for use with Prorm functions
+ * Used to create properly quoted column identifiers
+ *
+ * @example
+ * // Single column: col('name') -> "name"
+ * // Table and column: col('User', 'name') -> "User"."name"
+ * // Dot notation: col('table.column') -> "table"."column"
+ */
+export declare class Col {
+    private readonly col;
+    /**
+     * Create a column reference
+     * @param tableOrColumn - Table name (if second param provided) or column name
+     * @param column - Column name (if first param is table name)
+     */
+    constructor(tableOrColumn: string, column?: string);
+    /**
+     * Get the SQL representation of the column
+     */
+    toSql(): string;
+    /**
+     * Get the column as a string
+     */
+    toString(): string;
+}

package/dist/core/expressions.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * Raw SQL expression wrappers used by the Prorm instance API.
+ *
+ * `Literal` embeds SQL verbatim; `Col` references a column without quoting it
+ * as a value. Note that `src/operators.ts` also exposes `literal()`/`col()`
+ * factories producing a different shape - the dialects consume the operators
+ * form, so prefer those in new code.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Col = exports.Literal = void 0;
+/**
+ * Represents a raw SQL literal value
+ * Used for inserting raw SQL expressions into queries
+ *
+ * @example
+ * // Use in default values
+ * createdAt: { type: DATE, defaultValue: prorm.literal('NOW()') }
+ *
+ * @example
+ * // Use in updates
+ * User.update({ count: prorm.literal('count + 1') }, {...})
+ *
+ * @example
+ * // Use in select with calculations
+ * User.findAll({ attributes: [[prorm.literal('1 + 1'), 'two']] })
+ */
+class Literal {
+    constructor(sql) {
+        this.val = sql;
+    }
+    /**
+     * Get the raw SQL string
+     */
+    toString() {
+        return this.val;
+    }
+}
+exports.Literal = Literal;
+/**
+ * Class representing a column reference for use with Prorm functions
+ * Used to create properly quoted column identifiers
+ *
+ * @example
+ * // Single column: col('name') -> "name"
+ * // Table and column: col('User', 'name') -> "User"."name"
+ * // Dot notation: col('table.column') -> "table"."column"
+ */
+class Col {
+    /**
+     * Create a column reference
+     * @param tableOrColumn - Table name (if second param provided) or column name
+     * @param column - Column name (if first param is table name)
+     */
+    constructor(tableOrColumn, column) {
+        if (column !== undefined) {
+            // col('User', 'name') -> "User"."name"
+            this.col = `"${tableOrColumn}"."${column}"`;
+        }
+        else if (tableOrColumn.includes('.')) {
+            // col('table.column') -> "table"."column"
+            const [table, col] = tableOrColumn.split('.');
+            this.col = `"${table}"."${col}"`;
+        }
+        else {
+            // col('name') -> "name"
+            this.col = `"${tableOrColumn}"`;
+        }
+    }
+    /**
+     * Get the SQL representation of the column
+     */
+    toSql() {
+        return this.col;
+    }
+    /**
+     * Get the column as a string
+     */
+    toString() {
+        return this.col;
+    }
+}
+exports.Col = Col;