turbine-orm 0.35.0 → 0.36.1

package/dist/cjs/cli/studio.js

@@ -2,36 +2,52 @@
 /**
  * turbine-orm CLI — Studio
  *
- * A local, read-only web UI for browsing databases, exploring relations,
- * and composing queries visually. ORM-native since v0.19: there is no
- * raw-SQL input surface — the Query tab builds `findMany` args that are
- * validated against introspected metadata and compiled by QueryInterface
- * (`/api/builder`). Pure Node (built-in `http` module), no runtime
- * dependencies beyond `pg`. CLI defaults to 127.0.0.1 and refuses non-loopback
- * hosts unless `npx turbine studio --allow-remote` is set.
+ * A local web UI for browsing databases, exploring relations, and composing
+ * queries visually. ORM-native since v0.19: there is no raw-SQL input surface.
+ * The Query tab builds `findMany` args that are validated against introspected
+ * metadata and compiled by QueryInterface (`/api/builder`). Pure Node (built-in
+ * `http` module), no runtime dependencies beyond `pg`. CLI defaults to 127.0.0.1
+ * and refuses non-loopback hosts unless `npx turbine studio --allow-remote`.
+ *
+ * Read-only by default. `turbine studio --write` opts in to single-row writes
+ * (see the write model below); without the flag the write API routes do not
+ * exist (they 404) and the UI renders no write affordances.
  *
  * Security model:
  *   • Loopback by default; CLI refuses non-loopback without --allow-remote
  *   • Random auth token generated per process, required in Cookie header
- *   • No SQL input surface at all — every identifier in a builder request is
- *     validated against the introspected schema; all values are $N params
- *   • Every query runs in a READ ONLY transaction (belt-and-suspenders)
+ *   • No SQL input surface at all: every identifier in a builder or write
+ *     request is validated against the introspected schema; all values are
+ *     $N params compiled through the query builders
+ *   • Read routes run in a READ ONLY transaction (belt-and-suspenders)
+ *   • Write routes (only when `--write` is set) run in a plain BEGIN/COMMIT
+ *     transaction, require a matching Origin header (CSRF), and target exactly
+ *     one row by its full primary key
  *   • 30s statement timeout via parameterized set_config()
- *   • Per-session rate limiting, CSP + security headers, cross-origin refusal
+ *   • Per-session rate limiting, cross-origin refusal, security headers, and a
+ *     per-request CSP nonce for the inline script (no `unsafe-inline`)
+ *
+ * PII: columns tagged `pii` in code-first metadata are redacted server-side in
+ * every row-bearing response (the literal `•• redacted ••`) unless the server
+ * was started with `--show-pii`.
  *
- * Not implemented (deliberately): row editing, DDL, destructive operations.
- * Studio is for inspection. Use the CLI, migrate, or raw SQL for writes.
+ * Write model (opt-in): update/insert/delete a single row. DDL and multi-row or
+ * unconditional writes are deliberately unsupported. Use the CLI or migrate for
+ * schema changes and bulk operations.
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PII_REDACTED = void 0;
 exports.startStudio = startStudio;
+exports.handleRequest = handleRequest;
 exports.apiTableRows = apiTableRows;
 exports.resolveColumnName = resolveColumnName;
 exports.isTextishType = isTextishType;
 exports.escapeLikePattern = escapeLikePattern;
 exports.apiBuilder = apiBuilder;
+exports.apiRowWrite = apiRowWrite;
 exports.apiListSavedQueries = apiListSavedQueries;
 exports.apiCreateSavedQuery = apiCreateSavedQuery;
 exports.apiDeleteSavedQuery = apiDeleteSavedQuery;
@@ -88,7 +104,17 @@ async function startStudio(options) {
         params: ['30s'],
     };
     const rateLimiter = new Map();
-    const ctx = { pool, metadata, options, authToken, stateDir, statementTimeout, rateLimiter };
+    const ctx = {
+        pool,
+        metadata,
+        options,
+        authToken,
+        stateDir,
+        statementTimeout,
+        rateLimiter,
+        writable: options.write === true,
+        showPii: options.showPii === true,
+    };
     const server = (0, node_http_1.createServer)((req, res) => {
         handleRequest(req, res, ctx).catch((err) => {
             sendJson(res, 500, { error: err instanceof Error ? err.message : String(err) });
@@ -157,7 +183,7 @@ async function handleRequest(req, res, ctx) {
             res.end();
             return;
         }
-        sendHtml(res, 200, studio_ui_generated_js_1.STUDIO_HTML);
+        sendHtml(res, 200, studio_ui_generated_js_1.STUDIO_HTML, cspNonce());
         return;
     }
     // Favicon — answered before the auth gate so the browser's automatic request
@@ -200,6 +226,26 @@ async function handleRequest(req, res, ctx) {
         const id = decodeURIComponent(pathname.slice('/api/saved-queries/'.length));
         return apiDeleteSavedQuery(res, ctx, id);
     }
+    // Write routes: ONLY exist in write mode. In read-only mode they fall through
+    // to the 404 below (deliberately not 403: a read-only Studio has no such API).
+    if (ctx.writable && pathname.startsWith('/api/row/') && req.method === 'POST') {
+        // CSRF: a state-changing request MUST carry a same-origin Origin header. The
+        // top-of-handler check already rejects a MISMATCHED origin (403); this also
+        // rejects an ABSENT one, which read (GET) routes tolerate for curl ergonomics
+        // but a browser always sends on a cross-scheme/site POST. `fetch` from the
+        // Studio page always sets it for same-origin, so the real UI is unaffected.
+        if (origin !== expectedOrigin) {
+            sendJson(res, 403, { error: 'a matching Origin header is required for write requests' });
+            return;
+        }
+        const op = pathname.slice('/api/row/'.length);
+        if (op === 'update')
+            return apiRowWrite(req, res, ctx, 'update');
+        if (op === 'insert')
+            return apiRowWrite(req, res, ctx, 'insert');
+        if (op === 'delete')
+            return apiRowWrite(req, res, ctx, 'delete');
+    }
     sendJson(res, 404, { error: 'not found' });
 }
 // ---------------------------------------------------------------------------
@@ -269,6 +315,7 @@ async function apiSchema(res, ctx) {
             nullable: col.nullable,
             hasDefault: col.hasDefault,
             isPrimaryKey: tbl.primaryKey.includes(col.name),
+            pii: col.pii === true,
         })),
         relations: Object.entries(tbl.relations).map(([name, rel]) => ({
             name,
@@ -294,6 +341,10 @@ async function apiSchema(res, ctx) {
         schema: ctx.options.schema,
         tables: tables.map((t) => ({ ...t, estimatedRows: counts.get(t.name) ?? 0 })),
         enums: ctx.metadata.enums,
+        // Client-config flags the UI reads to gate write affordances / PII masking.
+        // Read-only Studio reports `writable: false` so the UI renders no write UI.
+        writable: ctx.writable === true,
+        showPii: ctx.showPii === true,
     });
 }
 // ---------------------------------------------------------------------------
@@ -311,10 +362,14 @@ async function apiTableRows(res, ctx, rawTableName, params) {
     const dir = params.get('dir')?.toLowerCase() === 'desc' ? 'DESC' : 'ASC';
     // orderBy — accept either the Postgres column name (snake) or the TS field
     // name (camel). Always emit the Postgres column in the SQL.
+    // When redaction is on, PII columns are excluded from orderBy (and from the
+    // search OR-set below): a redacted value must not be inferable through sort
+    // position or substring probing.
+    const redactedPii = ctx.showPii ? NO_PII_KEYS : piiKeysForTable(table);
     let orderByClause = '';
     if (orderByRaw) {
         const col = resolveColumnName(table, orderByRaw);
-        if (col)
+        if (col && !redactedPii.has(col))
             orderByClause = `ORDER BY ${(0, index_js_1.quoteIdent)(col)} ${dir}`;
     }
     if (!orderByClause && table.primaryKey.length > 0 && table.primaryKey[0]) {
@@ -324,7 +379,9 @@ async function apiTableRows(res, ctx, rawTableName, params) {
     // parameterized so injection is impossible. Each query gets its own
     // WHERE clause with parameter indices matching that query's param array.
     const search = params.get('search')?.trim() ?? '';
-    const textColumns = table.columns.filter((c) => isTextishType(c.pgType)).map((c) => c.name);
+    const textColumns = table.columns
+        .filter((c) => isTextishType(c.pgType) && !redactedPii.has(c.name))
+        .map((c) => c.name);
     const hasSearch = search.length > 0 && textColumns.length > 0;
     const pattern = hasSearch ? `%${escapeLikePattern(search)}%` : null;
     // Main query: $1 = limit, $2 = offset, $3 = pattern (if search)
@@ -356,7 +413,7 @@ async function apiTableRows(res, ctx, rawTableName, params) {
         sendJson(res, 200, {
             table: table.name,
             columns: result.fields.map((f) => ({ name: f.name, dataTypeID: f.dataTypeID })),
-            rows: result.rows.map((r) => serializeRow(r)),
+            rows: result.rows.map((r) => serializeRow(redactFlatRow(r, redactedPii))),
             total: Number(countResult.rows[0]?.count ?? 0),
             limit,
             offset,
@@ -433,10 +490,12 @@ async function apiBuilder(req, res, ctx) {
         const result = await client.query(deferred.sql, deferred.params);
         const elapsedMs = Date.now() - started;
         await client.query('COMMIT');
+        const rawRows = result.rows;
+        const redactedRows = ctx.showPii ? rawRows : redactBuilderRows(rawRows, tableName, args.with, ctx.metadata);
         sendJson(res, 200, {
             sql: deferred.sql,
             columns: result.fields.map((f) => ({ name: f.name, dataTypeID: f.dataTypeID })),
-            rows: result.rows.map((r) => serializeRow(r)),
+            rows: redactedRows.map((r) => serializeRow(r)),
             rowCount: result.rowCount ?? result.rows.length,
             elapsedMs,
         });
@@ -454,6 +513,163 @@ async function apiBuilder(req, res, ctx) {
         client.release();
     }
 }
+// ---------------------------------------------------------------------------
+// API: /api/row/update | /api/row/insert | /api/row/delete (single-row writes)
+//
+// Write mode only (the routes do not exist otherwise). Every column identifier
+// is validated against the introspected metadata and the statement is compiled
+// through the query builders (`buildUpdate`/`buildCreate`/`buildDelete`) so all
+// values are $N params; there is no raw SQL. update/delete require the caller
+// to supply the FULL primary key in `where`; the effective predicate is rebuilt
+// from those PK values alone, so a write can only ever touch one row.
+// ---------------------------------------------------------------------------
+async function apiRowWrite(req, res, ctx, op) {
+    const body = await readJsonBody(req);
+    const tableName = typeof body?.table === 'string' ? body.table : '';
+    const table = ctx.metadata.tables[tableName];
+    if (!table) {
+        sendJson(res, 400, { error: unknownTableMessage(tableName, ctx) });
+        return;
+    }
+    if (table.isView) {
+        sendJson(res, 400, { error: `[turbine] "${tableName}" is a view; Studio cannot write to it.` });
+        return;
+    }
+    const data = (body?.data && typeof body.data === 'object' ? body.data : {});
+    const rawWhere = (body?.where && typeof body.where === 'object' ? body.where : {});
+    // Validate every column name up front for a clean typed 400 (the builders
+    // would also reject unknowns, but an explicit check keeps the message clear).
+    if (op === 'insert' || op === 'update') {
+        const badKey = firstUnknownColumn(table, data);
+        if (badKey) {
+            sendJson(res, 400, { error: `[turbine] unknown column "${badKey}" on table "${tableName}"` });
+            return;
+        }
+        if (!Object.keys(data).some((k) => data[k] !== undefined)) {
+            sendJson(res, 400, { error: '[turbine] `data` must include at least one column' });
+            return;
+        }
+    }
+    // update/delete: require the table to have a PK and the caller to cover it.
+    let effectiveWhere = rawWhere;
+    if (op === 'update' || op === 'delete') {
+        if (table.primaryKey.length === 0) {
+            sendJson(res, 400, {
+                error: `[turbine] "${tableName}" has no primary key; single-row writes require one.`,
+            });
+            return;
+        }
+        const pk = extractPkWhere(table, rawWhere);
+        if ('error' in pk) {
+            sendJson(res, 400, { error: `[turbine] ${pk.error}` });
+            return;
+        }
+        // Empty-where can never happen by construction (PK covered above); assert.
+        if (Object.keys(pk.where).length === 0) {
+            sendJson(res, 400, { error: '[turbine] refusing a write with an empty predicate' });
+            return;
+        }
+        effectiveWhere = pk.where;
+    }
+    let deferred;
+    try {
+        const qi = new index_js_1.QueryInterface(ctx.pool, tableName, ctx.metadata, [], {
+            warnOnUnlimited: false,
+            sqlCache: false,
+            preparedStatements: false,
+        });
+        if (op === 'insert') {
+            deferred = qi.buildCreate({ data });
+        }
+        else if (op === 'update') {
+            deferred = qi.buildUpdate({ where: effectiveWhere, data });
+        }
+        else {
+            deferred = qi.buildDelete({ where: effectiveWhere });
+        }
+    }
+    catch (err) {
+        sendJson(res, 400, { error: err instanceof Error ? err.message : String(err) });
+        return;
+    }
+    const client = await ctx.pool.connect();
+    try {
+        // A real write transaction, NOT `READ ONLY`. Same parameterized
+        // statement-timeout + search_path pin as the read paths.
+        await client.query('BEGIN');
+        await client.query(ctx.statementTimeout.sql, ctx.statementTimeout.params);
+        await client.query(`SELECT set_config('search_path', $1, true)`, [ctx.options.schema]);
+        const result = await client.query(deferred.sql, deferred.params);
+        await client.query('COMMIT');
+        const row = result.rows[0];
+        if (!row) {
+            const msg = op === 'insert' ? 'insert returned no row' : 'no row matched the primary key';
+            sendJson(res, 404, { error: `[turbine] ${msg}` });
+            return;
+        }
+        // The echoed row is redacted the same way as any read (unless --show-pii),
+        // even though a write to a pii column is allowed.
+        const piiKeys = ctx.showPii ? NO_PII_KEYS : piiKeysForTable(table);
+        sendJson(res, 200, {
+            operation: op,
+            row: serializeRow(redactFlatRow(row, piiKeys)),
+            rowCount: result.rowCount ?? 1,
+        });
+    }
+    catch (err) {
+        try {
+            await client.query('ROLLBACK');
+        }
+        catch {
+            /* ignore */
+        }
+        sendJson(res, 400, { error: err instanceof Error ? err.message : String(err) });
+    }
+    finally {
+        client.release();
+    }
+}
+/**
+ * Return the first key in `obj` that does not resolve to a real column on
+ * `table` (accepting either the camelCase field or snake_case column name), or
+ * `null` when every key is valid. Skips `undefined` values.
+ */
+function firstUnknownColumn(table, obj) {
+    for (const k of Object.keys(obj)) {
+        if (obj[k] === undefined)
+            continue;
+        if (!resolveColumnName(table, k))
+            return k;
+    }
+    return null;
+}
+/**
+ * Build a primary-key-only `where` from the caller's `where`. Every PK column
+ * must be present (as its field or column name) with a scalar value; anything
+ * else is rejected so a write can only ever target one row. Keys are emitted as
+ * the camelCase field name (the query builder accepts field or column names).
+ */
+function extractPkWhere(table, where) {
+    const resolved = new Map();
+    for (const [k, v] of Object.entries(where)) {
+        const col = resolveColumnName(table, k);
+        if (col)
+            resolved.set(col, v);
+    }
+    const pkWhere = {};
+    for (const pkCol of table.primaryKey) {
+        if (!resolved.has(pkCol)) {
+            return { error: `\`where\` must fully cover the primary key (missing "${pkCol}")` };
+        }
+        const v = resolved.get(pkCol);
+        if (v === undefined || v === null || typeof v === 'object') {
+            return { error: `primary key "${pkCol}" must be a scalar value in \`where\`` };
+        }
+        const field = table.reverseColumnMap[pkCol] ?? pkCol;
+        pkWhere[field] = v;
+    }
+    return { where: pkWhere };
+}
 function savedQueriesPath(ctx) {
     return (0, node_path_1.resolve)(ctx.stateDir, 'studio-queries.json');
 }
@@ -541,6 +757,94 @@ function apiDeleteSavedQuery(res, ctx, id) {
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
+// PII redaction
+// ---------------------------------------------------------------------------
+/** The literal replacement value for a redacted PII cell. */
+exports.PII_REDACTED = '•• redacted ••';
+/** Shared empty key set for the `--show-pii` fast path (no redaction). */
+const NO_PII_KEYS = new Set();
+/**
+ * The set of keys (both snake_case column and camelCase field names) for the
+ * table's PII-tagged columns. Covering both spellings means the same set works
+ * for `SELECT *` rows (snake keys) and for json_build_object relation rows
+ * (camel keys).
+ */
+function piiKeysForTable(table) {
+    const keys = new Set();
+    for (const col of table.columns) {
+        if (col.pii === true) {
+            keys.add(col.name);
+            keys.add(col.field);
+        }
+    }
+    return keys;
+}
+/**
+ * Redact PII keys in a single flat row. Returns the row unchanged when there is
+ * nothing to redact (no allocation); otherwise a shallow copy with each present,
+ * non-null PII value replaced by {@link PII_REDACTED}. A null/undefined value
+ * carries no PII, so it is left as-is.
+ */
+function redactFlatRow(row, piiKeys) {
+    if (piiKeys.size === 0)
+        return row;
+    let out = null;
+    for (const k of Object.keys(row)) {
+        if (piiKeys.has(k) && row[k] !== null && row[k] !== undefined) {
+            if (!out)
+                out = { ...row };
+            out[k] = exports.PII_REDACTED;
+        }
+    }
+    return out ?? row;
+}
+/**
+ * Redact PII in builder result rows, walking the `with` tree so nested relation
+ * rows are redacted against THEIR target table's PII columns (relation rows
+ * arrive as parsed json objects keyed by camelCase field names).
+ */
+function redactBuilderRows(rows, tableName, withClause, metadata) {
+    const table = metadata.tables[tableName];
+    if (!table)
+        return rows;
+    const piiKeys = piiKeysForTable(table);
+    const relEntries = withClause && typeof withClause === 'object'
+        ? Object.entries(withClause).filter(([, v]) => v)
+        : [];
+    // Nothing to do at this level or below → return as-is.
+    if (piiKeys.size === 0 && relEntries.length === 0)
+        return rows;
+    return rows.map((row) => {
+        const out = { ...row };
+        for (const k of piiKeys) {
+            if (k in out && out[k] !== null && out[k] !== undefined)
+                out[k] = exports.PII_REDACTED;
+        }
+        for (const [relName, relVal] of relEntries) {
+            const rel = table.relations[relName];
+            if (!rel)
+                continue;
+            const nestedWith = relVal && typeof relVal === 'object' ? relVal.with : undefined;
+            const child = out[relName];
+            if (Array.isArray(child)) {
+                out[relName] = redactBuilderRows(child, rel.to, nestedWith, metadata);
+            }
+            else if (child && typeof child === 'object') {
+                out[relName] = redactBuilderRows([child], rel.to, nestedWith, metadata)[0];
+            }
+        }
+        return out;
+    });
+}
+/**
+ * A fresh CSP nonce for one HTML response. Base64 of 16 random bytes; the value
+ * is stamped into both the `Content-Security-Policy` header and the inline
+ * `<script nonce="...">` tag(s) so `unsafe-inline` can be dropped from script-src.
+ */
+function cspNonce() {
+    return (0, node_crypto_1.randomBytes)(16).toString('base64');
+}
 function clampInt(value, fallback, min, max) {
     if (value == null)
         return fallback;
@@ -596,7 +900,9 @@ function sendJson(res, status, body) {
         'Cache-Control': 'no-store',
         'X-Content-Type-Options': 'nosniff',
         'Referrer-Policy': 'no-referrer',
-        'Content-Security-Policy': "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-ancestors 'none'",
+        // JSON responses render no document; no inline script is needed, so keep
+        // script-src to 'self' with no 'unsafe-inline'.
+        'Content-Security-Policy': "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-ancestors 'none'",
     });
     res.end(payload);
 }
@@ -607,7 +913,10 @@ function sendText(res, status, body) {
     });
     res.end(body);
 }
-function sendHtml(res, status, body) {
+function sendHtml(res, status, template, nonce) {
+    // Stamp the per-request nonce into the inline <script nonce="__CSP_NONCE__">
+    // tag(s) so the CSP can use a nonce instead of 'unsafe-inline'.
+    const body = template.replaceAll('__CSP_NONCE__', nonce);
     res.writeHead(status, {
         'Content-Type': 'text/html; charset=utf-8',
         'Content-Length': Buffer.byteLength(body),
@@ -615,7 +924,9 @@ function sendHtml(res, status, body) {
         'X-Content-Type-Options': 'nosniff',
         'X-Frame-Options': 'DENY',
         'Referrer-Policy': 'no-referrer',
-        'Content-Security-Policy': "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-ancestors 'none'",
+        // style-src keeps 'unsafe-inline' (nonces don't cover style="" attributes,
+        // which the UI relies on); script-src moves to the per-request nonce.
+        'Content-Security-Policy': `default-src 'none'; script-src 'self' 'nonce-${nonce}'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-ancestors 'none'`,
     });
     res.end(body);
 }

package/dist/cjs/cli/ui.js

@@ -229,5 +229,11 @@ function stripAnsi(s) {
 // Redact password from connection URL
 // ---------------------------------------------------------------------------
 function redactUrl(url) {
-    return url.replace(/:([^@/:]+)@/, ':***@');
+    return (url
+        // Userinfo credentials: `:secret@` in any authority (global: a string may
+        // carry more than one URL, e.g. a primary + replica connection pair).
+        .replace(/:([^@/:]+)@/g, ':***@')
+        // Query-string password params: `password=`, `sslpassword=`, and similar,
+        // case-insensitive. Value runs up to the next `&`, `#`, or end of string.
+        .replace(/([?&][^=&#]*password)=([^&#]*)/gi, '$1=***'));
 }

package/dist/cjs/dialect.js

@@ -105,7 +105,7 @@ exports.postgresDialect = {
         return `COALESCE((${subquery}), ${fallback})`;
     },
     buildReturningClause(selection = '*') {
-        return ` RETURNING ${selection}`;
+        return ` RETURNING ${selection === '*' ? '*' : selection.join(', ')}`;
     },
     buildInsertStatement(input) {
         return `INSERT INTO ${input.table} (${input.columns.join(', ')}) VALUES (${input.valuePlaceholders.join(', ')})${this.buildReturningClause(input.returning)}`;

package/dist/cjs/generate.js

@@ -168,8 +168,13 @@ function generateTypes(schema, options) {
         for (const col of table.columns) {
             const pkNote = table.primaryKey.includes(col.name) ? ' (primary key)' : '';
             const nullNote = col.nullable ? ' (nullable)' : '';
-            lines.push(`  /** Column: ${col.name} — ${col.pgType}${pkNote}${nullNote} */`);
-            lines.push(`  ${col.field}: ${columnTsType(col, schema.enums)};`);
+            // PII columns are excluded from default projections, so the field is
+            // absent unless the query names it in `select` or passes `includePii`.
+            // The emitted type marks it optional so it tells the truth about absence.
+            const piiNote = col.pii ? ' (PII: absent unless selected or includePii)' : '';
+            const optional = col.pii ? '?' : '';
+            lines.push(`  /** Column: ${col.name}, ${col.pgType}${pkNote}${nullNote}${piiNote} */`);
+            lines.push(`  ${col.field}${optional}: ${columnTsType(col, schema.enums)};`);
         }
         lines.push('}');
         lines.push('');
@@ -531,6 +536,17 @@ function generateMetadata(schema, options) {
             lines.push(`        { name: '${escSQ(idx.name)}', columns: [${idx.columns.map((c) => `'${escSQ(c)}'`).join(', ')}], unique: ${idx.unique}, definition: ${JSON.stringify(idx.definition)} },`);
         }
         lines.push('      ],');
+        // checks: introspected named CHECK constraints. Emitted only when present
+        // (byte-stable for check-less tables) and sorted by name so `--no-timestamp`
+        // output is deterministic regardless of catalog row order.
+        if (table.checks && table.checks.length > 0) {
+            const sortedChecks = [...table.checks].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+            lines.push('      checks: [');
+            for (const chk of sortedChecks) {
+                lines.push(`        { name: '${escSQ(chk.name)}', expression: ${JSON.stringify(chk.expression)} },`);
+            }
+            lines.push('      ],');
+        }
         // isView — read-only marker; the runtime write guard reads it.
         if (table.isView)
             lines.push('      isView: true,');
@@ -734,6 +750,11 @@ function serializeColumn(col) {
     if (col.generationExpression !== undefined) {
         parts.push(`generationExpression: '${escSQ(col.generationExpression)}'`);
     }
+    // PII marker: emitted only when set, so untagged schemas stay byte-identical.
+    // Introspection never sets this (code-first declaration), but a metadata
+    // object built from `defineSchema` (pii: true) carries it through codegen.
+    if (col.pii)
+        parts.push(`pii: true`);
     if (col.maxLength !== undefined)
         parts.push(`maxLength: ${col.maxLength}`);
     return `{ ${parts.join(', ')} }`;

package/dist/cjs/index.js

@@ -35,7 +35,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyManyToManyRelations = exports.snakeToPascal = exports.snakeToCamel = exports.singularize = exports.pgTypeToTs = exports.pgArrayType = exports.normalizeKeyColumns = exports.isDateType = exports.camelToSnake = exports.validateChannel = exports.QueryInterface = exports.pipelineSupported = exports.executePipeline = exports.hasRelationFields = exports.executeNestedUpdate = exports.executeNestedCreate = exports.introspect = exports.generate = exports.wrapPgError = exports.ValidationError = exports.UnsupportedFeatureError = exports.UniqueConstraintError = exports.TurbineErrorCode = exports.TurbineError = exports.TimeoutError = exports.setErrorMessageMode = exports.SerializationFailureError = exports.RelationError = exports.ReadOnlyError = exports.PipelineError = exports.OptimisticLockError = exports.NotNullViolationError = exports.NotFoundError = exports.MigrationError = exports.getErrorMessageMode = exports.ForeignKeyError = exports.ExclusionConstraintError = exports.DeadlockError = exports.ConnectionError = exports.CircularRelationError = exports.CheckConstraintError = exports.postgresDialect = exports.withRetry = exports.TurbineClient = exports.TransactionClient = exports.yugabytedb = exports.timescale = exports.postgresql = exports.cockroachdb = exports.alloydb = void 0;
-exports.TypedSqlQuery = exports.buildTypedSql = exports.turbineHttp = exports.defineSeed = exports.schemaToSQLString = exports.schemaToSQL = exports.schemaPush = exports.schemaDiff = exports.schemaDefToMetadata = exports.table = exports.isDocFieldIndexDef = exports.defineSchema = exports.column = exports.ColumnBuilder = void 0;
+exports.TypedSqlQuery = exports.buildTypedSql = exports.turbineHttp = exports.defineSeed = exports.schemaToSQLString = exports.schemaToSQL = exports.schemaPush = exports.schemaDiff = exports.DestructivePushRefusal = exports.schemaDefToMetadata = exports.table = exports.isDocFieldIndexDef = exports.defineSchema = exports.column = exports.ColumnBuilder = void 0;
 var index_js_1 = require("./adapters/index.js");
 Object.defineProperty(exports, "alloydb", { enumerable: true, get: function () { return index_js_1.alloydb; } });
 Object.defineProperty(exports, "cockroachdb", { enumerable: true, get: function () { return index_js_1.cockroachdb; } });
@@ -119,6 +119,7 @@ var schema_metadata_js_1 = require("./schema-metadata.js");
 Object.defineProperty(exports, "schemaDefToMetadata", { enumerable: true, get: function () { return schema_metadata_js_1.schemaDefToMetadata; } });
 // Schema SQL — generate DDL, diff, and push
 var schema_sql_js_1 = require("./schema-sql.js");
+Object.defineProperty(exports, "DestructivePushRefusal", { enumerable: true, get: function () { return schema_sql_js_1.DestructivePushRefusal; } });
 Object.defineProperty(exports, "schemaDiff", { enumerable: true, get: function () { return schema_sql_js_1.schemaDiff; } });
 Object.defineProperty(exports, "schemaPush", { enumerable: true, get: function () { return schema_sql_js_1.schemaPush; } });
 Object.defineProperty(exports, "schemaToSQL", { enumerable: true, get: function () { return schema_sql_js_1.schemaToSQL; } });

package/dist/cjs/mssql.js

@@ -459,6 +459,23 @@ function mssqlColumnType(type, maxLength) {
 // ---------------------------------------------------------------------------
 // mssqlDialect — the full Dialect contract for SQL Server 2016+
 // ---------------------------------------------------------------------------
+/**
+ * Render the SQL Server `OUTPUT` clause for a write's returning selection.
+ * `'*'` → ` OUTPUT INSERTED.*` (byte-identical to the historical default); a
+ * quoted column list → ` OUTPUT INSERTED.[c1], INSERTED.[c2]`; each column
+ * carries its own `INSERTED.`/`DELETED.` prefix (a bare comma list is invalid
+ * T-SQL). Used to exclude PII columns from a write's returned row. Empty
+ * selection → no clause.
+ */
+function mssqlOutput(returning, alias) {
+    if (!returning)
+        return '';
+    if (returning === '*')
+        return ` OUTPUT ${alias}.*`;
+    if (returning.length === 0)
+        return '';
+    return ` OUTPUT ${returning.map((col) => `${alias}.${col}`).join(', ')}`;
+}
 /**
  * SQL Server 2016+ implementation of the {@link Dialect} contract. Bracket
  * identifier quoting (`[…]`), named `@pN` placeholders, the `FOR JSON PATH`
@@ -522,7 +539,7 @@ exports.mssqlDialect = {
         return '';
     },
     buildInsertStatement(input) {
-        const out = input.returning ? ` OUTPUT INSERTED.${input.returning}` : '';
+        const out = mssqlOutput(input.returning, 'INSERTED');
         return `INSERT INTO ${input.table} (${input.columns.join(', ')})${out} VALUES (${input.valuePlaceholders.join(', ')})`;
     },
     buildBulkInsertStatement(input) {
@@ -542,7 +559,7 @@ exports.mssqlDialect = {
         const placeholders = input.rowValues
             .map((row) => `(${row.map(() => this.paramPlaceholder(++n)).join(', ')})`)
             .join(', ');
-        const out = input.returning ? ` OUTPUT INSERTED.${input.returning}` : '';
+        const out = mssqlOutput(input.returning, 'INSERTED');
         // skipDuplicates has no single-statement equivalent here; ignored (documented).
         return {
             sql: `INSERT INTO ${input.table} (${input.columns.join(', ')})${out} VALUES ${placeholders}`,
@@ -557,7 +574,7 @@ exports.mssqlDialect = {
         const on = input.conflictColumns.map((c) => `T.${c} = S.${c}`).join(' AND ');
         const insertCols = input.insertColumns.join(', ');
         const sourceVals = input.insertColumns.map((c) => `S.${c}`).join(', ');
-        const out = input.returning ? ` OUTPUT INSERTED.${input.returning}` : '';
+        const out = mssqlOutput(input.returning, 'INSERTED');
         return (`MERGE INTO ${input.table} AS T ` +
             `USING (VALUES (${input.valuePlaceholders.join(', ')})) AS S (${insertCols}) ` +
             `ON (${on}) ` +
@@ -568,11 +585,11 @@ exports.mssqlDialect = {
     // UPDATE/DELETE inject OUTPUT mid-statement (between SET and WHERE / FROM and
     // WHERE) — a trailing clause would be invalid T-SQL.
     buildUpdateStatement(input) {
-        const out = input.returning ? ` OUTPUT INSERTED.${input.returning}` : '';
+        const out = mssqlOutput(input.returning, 'INSERTED');
         return `UPDATE ${input.table} SET ${input.setClauses.join(', ')}${out}${input.whereSql}`;
     },
     buildDeleteStatement(input) {
-        const out = input.returning ? ` OUTPUT DELETED.${input.returning}` : '';
+        const out = mssqlOutput(input.returning, 'DELETED');
         return `DELETE FROM ${input.table}${out}${input.whereSql}`;
     },
     // SQL Server has no LIMIT — emit OFFSET/FETCH, injecting a stable ORDER BY when