turbine-orm 0.36.1 → 0.38.0

package/dist/cli/studio.js

@@ -20,8 +20,9 @@
  *     $N params compiled through the query builders
  *   • Read routes run in a READ ONLY transaction (belt-and-suspenders)
  *   • Write routes (only when `--write` is set) run in a plain BEGIN/COMMIT
- *     transaction, require a matching Origin header (CSRF), and target exactly
- *     one row by its full primary key
+ *     transaction, require a matching Origin header (CSRF), and address every
+ *     row by its full primary key (single row, or a capped `rows` array of
+ *     PK-addressed statements run atomically)
  *   • 30s statement timeout via parameterized set_config()
  *   • Per-session rate limiting, cross-origin refusal, security headers, and a
  *     per-request CSP nonce for the inline script (no `unsafe-inline`)
@@ -30,9 +31,10 @@
  * every row-bearing response (the literal `•• redacted ••`) unless the server
  * was started with `--show-pii`.
  *
- * Write model (opt-in): update/insert/delete a single row. DDL and multi-row or
- * unconditional writes are deliberately unsupported. Use the CLI or migrate for
- * schema changes and bulk operations.
+ * Write model (opt-in): update a single row; insert/delete one row or a capped
+ * list of PK-addressed rows in one all-or-nothing transaction. DDL and
+ * predicate-based (unconditional) writes are deliberately unsupported. Use the
+ * CLI or migrate for schema changes and true bulk operations.
  */
 import { spawn } from 'node:child_process';
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
@@ -43,6 +45,7 @@ import { dirname, resolve as pathResolve } from 'node:path';
 import pg from 'pg';
 import { introspect } from '../introspect.js';
 import { QueryInterface, quoteIdent } from '../query/index.js';
+import { createDemoContext } from './studio-demo.js';
 import { STUDIO_HTML } from './studio-ui.generated.js';
 // ---------------------------------------------------------------------------
 // Main entry point
@@ -57,35 +60,55 @@ import { STUDIO_HTML } from './studio-ui.generated.js';
  *   process.on('SIGINT', () => studio.dispose().then(() => process.exit(0)));
  */
 export async function startStudio(options) {
-    const pool = new pg.Pool({
-        connectionString: options.url,
-        max: 4, // small pool — single-user tool
-        idleTimeoutMillis: 10_000,
-    });
-    // Verify connectivity before starting the server — fail fast.
-    const probe = await pool.connect();
-    try {
-        await probe.query('SELECT 1');
+    const demo = options.demo === true;
+    let pool;
+    let metadata;
+    let dialect;
+    let statementTimeout;
+    if (demo) {
+        // Seeded in-memory SQLite store: no DATABASE_URL, no network. Each launch
+        // starts pristine and nothing is ever persisted.
+        const demoCtx = createDemoContext();
+        pool = demoCtx.pool;
+        metadata = demoCtx.metadata;
+        dialect = demoCtx.dialect;
+        // SQLite has no set_config / statement_timeout GUC; a harmless no-op keeps
+        // the shared execution path (which issues this before each query) uniform.
+        statementTimeout = { sql: 'SELECT 1', params: [] };
     }
-    finally {
-        probe.release();
+    else {
+        // pg.Pool satisfies the PgCompatPool contract (same as the external-pool
+        // seam in client.ts); the cast keeps one typed pool field for both modes.
+        pool = new pg.Pool({
+            connectionString: options.url,
+            max: 4, // small pool — single-user tool
+            idleTimeoutMillis: 10_000,
+        });
+        // Verify connectivity before starting the server — fail fast.
+        const probe = await pool.connect();
+        try {
+            await probe.query('SELECT 1');
+        }
+        finally {
+            probe.release();
+        }
+        metadata = await introspect({
+            connectionString: options.url,
+            schema: options.schema,
+            include: options.include,
+            exclude: options.exclude,
+        });
+        statementTimeout = options.adapter?.statementTimeout?.(30) ?? {
+            // Postgres rejects parameters in `SET LOCAL` (`SET LOCAL ... = $1` is a
+            // syntax error). `set_config(name, value, is_local=true)` is the
+            // parameterizable, transaction-local equivalent and works on every
+            // Postgres-compatible engine.
+            sql: `SELECT set_config('statement_timeout', $1, true)`,
+            params: ['30s'],
+        };
     }
-    const metadata = await introspect({
-        connectionString: options.url,
-        schema: options.schema,
-        include: options.include,
-        exclude: options.exclude,
-    });
     const authToken = randomBytes(24).toString('hex');
     const stateDir = pathResolve(options.stateDir ?? '.turbine');
-    const statementTimeout = options.adapter?.statementTimeout?.(30) ?? {
-        // Postgres rejects parameters in `SET LOCAL` (`SET LOCAL ... = $1` is a
-        // syntax error). `set_config(name, value, is_local=true)` is the
-        // parameterizable, transaction-local equivalent and works on every
-        // Postgres-compatible engine.
-        sql: `SELECT set_config('statement_timeout', $1, true)`,
-        params: ['30s'],
-    };
     const rateLimiter = new Map();
     const ctx = {
         pool,
@@ -95,8 +118,15 @@ export async function startStudio(options) {
         stateDir,
         statementTimeout,
         rateLimiter,
-        writable: options.write === true,
-        showPii: options.showPii === true,
+        // Demo always boots read-only + PII redacted; the in-UI switcher flips these
+        // live. Non-demo honors the CLI flags.
+        writable: demo ? false : options.write === true,
+        showPii: demo ? false : options.showPii === true,
+        demo,
+        dialect,
+        // Demo never touches disk: saved queries live (and die) with the process,
+        // and the user's real .turbine/studio-queries.json is never read.
+        memorySavedQueries: demo ? { version: 1, queries: [] } : undefined,
     };
     const server = createServer((req, res) => {
         handleRequest(req, res, ctx).catch((err) => {
@@ -229,9 +259,40 @@ export async function handleRequest(req, res, ctx) {
         if (op === 'delete')
             return apiRowWrite(req, res, ctx, 'delete');
     }
+    // Demo mode switcher: ONLY exists in demo mode (404 otherwise). Flips the live
+    // read-only / PII / write toggles on the in-memory store. State-changing, so it
+    // requires a matching Origin like the write routes.
+    if (ctx.demo && pathname === '/api/demo/mode' && req.method === 'POST') {
+        if (origin !== expectedOrigin) {
+            sendJson(res, 403, { error: 'a matching Origin header is required for mode changes' });
+            return;
+        }
+        return apiDemoMode(req, res, ctx);
+    }
     sendJson(res, 404, { error: 'not found' });
 }
 // ---------------------------------------------------------------------------
+// API: /api/demo/mode: live mode switcher (demo mode only)
+//
+// Mutates the shared StudioContext so the change applies to every subsequent
+// request: `writable` gates the (already-registered) `/api/row/*` routes and the
+// UI's write affordances; `showPii` toggles server-side PII redaction. The two
+// are independent toggles. The UI re-fetches `/api/schema` afterwards to re-read
+// the effective state.
+// ---------------------------------------------------------------------------
+export async function apiDemoMode(req, res, ctx) {
+    const body = await readJsonBody(req);
+    if (typeof body.writable === 'boolean')
+        ctx.writable = body.writable;
+    if (typeof body.showPii === 'boolean')
+        ctx.showPii = body.showPii;
+    sendJson(res, 200, {
+        demo: true,
+        writable: ctx.writable === true,
+        showPii: ctx.showPii === true,
+    });
+}
+// ---------------------------------------------------------------------------
 // Auth
 // ---------------------------------------------------------------------------
 function isAuthorized(req, expectedToken) {
@@ -308,17 +369,28 @@ async function apiSchema(res, ctx) {
             referenceKey: rel.referenceKey,
         })),
     }));
-    // Row counts — cheap enough to fetch inline. Use pg_class reltuples as
-    // a fast estimate so we don't hammer big tables with SELECT COUNT(*).
-    const countsResult = await ctx.pool.query(`SELECT c.relname, c.reltuples::bigint::text AS reltuples
-     FROM pg_class c
-     JOIN pg_namespace n ON n.oid = c.relnamespace
-     WHERE n.nspname = $1 AND c.relkind = 'r'`, [ctx.options.schema]);
+    // Row counts (cheap enough to fetch inline).
     const counts = new Map();
-    for (const row of countsResult.rows) {
-        // pg_class.reltuples is -1 on PG14+ until a table is ANALYZEd; clamp so the
-        // sidebar never shows a negative estimate.
-        counts.set(row.relname, Math.max(0, Number(row.reltuples)));
+    if (ctx.demo) {
+        // The demo dataset is tiny and in-memory: an exact per-table COUNT(*) is
+        // instant, and SQLite has no pg_class estimate to read.
+        for (const t of tables) {
+            const r = await ctx.pool.query(`SELECT COUNT(*) AS count FROM ${quoteIdent(t.name)}`);
+            counts.set(t.name, Number(r.rows[0]?.count ?? 0));
+        }
+    }
+    else {
+        // Use pg_class reltuples as a fast estimate so we don't hammer big tables
+        // with SELECT COUNT(*).
+        const countsResult = await ctx.pool.query(`SELECT c.relname, c.reltuples::bigint::text AS reltuples
+       FROM pg_class c
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+       WHERE n.nspname = $1 AND c.relkind = 'r'`, [ctx.options.schema]);
+        for (const row of countsResult.rows) {
+            // pg_class.reltuples is -1 on PG14+ until a table is ANALYZEd; clamp so the
+            // sidebar never shows a negative estimate.
+            counts.set(row.relname, Math.max(0, Number(row.reltuples)));
+        }
     }
     sendJson(res, 200, {
         schema: ctx.options.schema,
@@ -328,6 +400,8 @@ async function apiSchema(res, ctx) {
         // Read-only Studio reports `writable: false` so the UI renders no write UI.
         writable: ctx.writable === true,
         showPii: ctx.showPii === true,
+        // Demo flag drives the in-UI mode switcher + persistent demo banner.
+        demo: ctx.demo === true,
     });
 }
 // ---------------------------------------------------------------------------
@@ -367,35 +441,93 @@ export async function apiTableRows(res, ctx, rawTableName, params) {
         .map((c) => c.name);
     const hasSearch = search.length > 0 && textColumns.length > 0;
     const pattern = hasSearch ? `%${escapeLikePattern(search)}%` : null;
-    // Main query: $1 = limit, $2 = offset, $3 = pattern (if search)
-    const mainValues = [limit, offset];
-    let mainWhere = '';
-    if (hasSearch && pattern !== null) {
-        mainValues.push(pattern);
-        const conds = textColumns.map((c) => `${quoteIdent(c)} ILIKE $3 ESCAPE '\\'`);
-        mainWhere = `WHERE (${conds.join(' OR ')})`;
-    }
-    // Count query: $1 = pattern (if search)
-    const countValues = [];
-    let countWhere = '';
-    if (hasSearch && pattern !== null) {
-        countValues.push(pattern);
-        const conds = textColumns.map((c) => `${quoteIdent(c)} ILIKE $1 ESCAPE '\\'`);
-        countWhere = `WHERE (${conds.join(' OR ')})`;
-    }
-    const qualifiedTable = `${quoteIdent(ctx.options.schema)}.${quoteIdent(table.name)}`;
-    const sql = `SELECT * FROM ${qualifiedTable} ${mainWhere} ${orderByClause} LIMIT $1 OFFSET $2`;
-    const countSql = `SELECT COUNT(*)::text AS count FROM ${qualifiedTable} ${countWhere}`;
+    // Per-column filters: `filters` is a JSON array of { column, op, value }
+    // composed by the Data tab's filter bar. Every column is validated against
+    // the metadata, every op against a fixed whitelist, and every value is a
+    // parameter — same discipline as the builder route.
+    let filters;
+    try {
+        filters = parseTableFilters(params.get('filters'), table, redactedPii);
+    }
+    catch (err) {
+        sendJson(res, 400, { error: `[turbine] ${err instanceof Error ? err.message : String(err)}` });
+        return;
+    }
+    // Parameter placeholder + case-insensitive LIKE condition differ by engine.
+    // Postgres: numbered `$N` + `ILIKE`. Demo (SQLite): named `:pN` (bound by
+    // name from the positional value array, matching Turbine's own SQLite path)
+    // + `LOWER(col) LIKE LOWER(:pN)` (explicit case-fold, ASCII). The escape char
+    // (`\`) is identical. When demo is off these produce byte-identical SQL.
+    const ph = (n) => (ctx.demo ? `:p${n}` : `$${n}`);
+    const likeCond = (col, n) => ctx.demo
+        ? `LOWER(${quoteIdent(col)}) LIKE LOWER(${ph(n)}) ESCAPE '\\'`
+        : `${quoteIdent(col)} ILIKE ${ph(n)} ESCAPE '\\'`;
+    // Build the WHERE conditions (search OR-set + per-column filters) once per
+    // query, numbering parameters from `startIndex` so the main query (params
+    // begin after limit/offset) and the count query (params begin at 1) each get
+    // indices matching their own value arrays.
+    const buildWhere = (startIndex) => {
+        let n = startIndex;
+        const conds = [];
+        const values = [];
+        if (hasSearch && pattern !== null) {
+            values.push(pattern);
+            const idx = n++;
+            conds.push(`(${textColumns.map((c) => likeCond(c, idx)).join(' OR ')})`);
+        }
+        for (const f of filters) {
+            if (f.op === 'isNull') {
+                conds.push(`${quoteIdent(f.column)} IS NULL`);
+            }
+            else if (f.op === 'notNull') {
+                conds.push(`${quoteIdent(f.column)} IS NOT NULL`);
+            }
+            else if (f.op === 'contains') {
+                values.push(`%${escapeLikePattern(String(f.value))}%`);
+                conds.push(likeCond(f.column, n++));
+            }
+            else {
+                const sqlOp = FILTER_OPS[f.op];
+                values.push(f.value);
+                conds.push(`${quoteIdent(f.column)} ${sqlOp} ${ph(n++)}`);
+            }
+        }
+        return { where: conds.length ? `WHERE ${conds.join(' AND ')}` : '', values };
+    };
+    // Main query: $1 = limit, $2 = offset, then search/filter params.
+    const mainW = buildWhere(3);
+    const mainValues = [limit, offset, ...mainW.values];
+    const mainWhere = mainW.where;
+    // Count query: params start at $1.
+    const countW = buildWhere(1);
+    const countValues = countW.values;
+    const countWhere = countW.where;
+    // Demo runs against an unqualified in-memory SQLite table (no schemas);
+    // Postgres qualifies with the configured `--schema`.
+    const qualifiedTable = ctx.demo
+        ? quoteIdent(table.name)
+        : `${quoteIdent(ctx.options.schema)}.${quoteIdent(table.name)}`;
+    const sql = `SELECT * FROM ${qualifiedTable} ${mainWhere} ${orderByClause} LIMIT ${ph(1)} OFFSET ${ph(2)}`;
+    // Postgres casts the bigint COUNT to text to avoid int8 precision loss on the
+    // wire; SQLite returns a safe integer directly, so no cast.
+    const countSql = `SELECT COUNT(*)${ctx.demo ? '' : '::text'} AS count FROM ${qualifiedTable} ${countWhere}`;
     const client = await ctx.pool.connect();
     try {
-        await client.query('BEGIN READ ONLY');
-        await client.query(ctx.statementTimeout.sql, ctx.statementTimeout.params);
+        // Demo: the in-memory SQLite handle is a single synchronous connection with
+        // no READ ONLY txn mode or statement_timeout GUC, so we skip the read
+        // transaction wrapper entirely. Postgres keeps its belt-and-suspenders
+        // READ ONLY transaction + timeout.
+        if (!ctx.demo) {
+            await client.query('BEGIN READ ONLY');
+            await client.query(ctx.statementTimeout.sql, ctx.statementTimeout.params);
+        }
         const result = await client.query(sql, mainValues);
         const countResult = await client.query(countSql, countValues);
-        await client.query('COMMIT');
+        if (!ctx.demo)
+            await client.query('COMMIT');
         sendJson(res, 200, {
             table: table.name,
-            columns: result.fields.map((f) => ({ name: f.name, dataTypeID: f.dataTypeID })),
+            columns: resultColumns(result, result.rows),
             rows: result.rows.map((r) => serializeRow(redactFlatRow(r, redactedPii))),
             total: Number(countResult.rows[0]?.count ?? 0),
             limit,
@@ -404,11 +536,13 @@ export async function apiTableRows(res, ctx, rawTableName, params) {
         });
     }
     catch (err) {
-        try {
-            await client.query('ROLLBACK');
-        }
-        catch {
-            /* ignore */
+        if (!ctx.demo) {
+            try {
+                await client.query('ROLLBACK');
+            }
+            catch {
+                /* ignore */
+            }
         }
         throw err;
     }
@@ -437,6 +571,78 @@ export function escapeLikePattern(s) {
     return s.replace(/\\/g, '\\\\').replace(/%/g, '\\%').replace(/_/g, '\\_');
 }
 // ---------------------------------------------------------------------------
+// Data-tab per-column filters
+// ---------------------------------------------------------------------------
+/** Scalar comparison ops → SQL operator. `contains`/`isNull`/`notNull` compile separately. */
+const FILTER_OPS = {
+    equals: '=',
+    not: '<>',
+    gt: '>',
+    gte: '>=',
+    lt: '<',
+    lte: '<=',
+};
+const FILTER_OP_NAMES = new Set([...Object.keys(FILTER_OPS), 'contains', 'isNull', 'notNull']);
+/** Hard cap on filter clauses per request — the UI never composes more. */
+const MAX_TABLE_FILTERS = 10;
+/**
+ * Parse + validate the Data tab's `filters` query param. Throws with a clear
+ * message on any invalid shape; the caller turns that into a 400. Filters on
+ * redacted PII columns are refused outright (a filter is a value-probing
+ * oracle, same reason redacted columns are excluded from search and orderBy).
+ */
+function parseTableFilters(raw, table, redactedPii) {
+    if (!raw)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('`filters` must be a JSON array');
+    }
+    if (!Array.isArray(parsed))
+        throw new Error('`filters` must be a JSON array');
+    if (parsed.length > MAX_TABLE_FILTERS) {
+        throw new Error(`too many filters (max ${MAX_TABLE_FILTERS})`);
+    }
+    const out = [];
+    for (const item of parsed) {
+        if (!item || typeof item !== 'object' || Array.isArray(item)) {
+            throw new Error('each filter must be an object { column, op, value }');
+        }
+        const f = item;
+        const col = typeof f.column === 'string' ? resolveColumnName(table, f.column) : null;
+        if (!col) {
+            throw new Error(`unknown filter column "${String(f.column)}" on table "${table.name}"`);
+        }
+        if (redactedPii.has(col)) {
+            throw new Error(`column "${col}" is PII-redacted; filtering on it is disabled (run with --show-pii to enable)`);
+        }
+        const op = typeof f.op === 'string' ? f.op : '';
+        if (!FILTER_OP_NAMES.has(op)) {
+            throw new Error(`unknown filter op "${op}" (expected one of: ${[...FILTER_OP_NAMES].join(', ')})`);
+        }
+        if (op === 'isNull' || op === 'notNull') {
+            out.push({ column: col, op });
+            continue;
+        }
+        const value = f.value;
+        const t = typeof value;
+        if (value === null || value === undefined || (t !== 'string' && t !== 'number' && t !== 'boolean')) {
+            throw new Error(`filter on "${col}" needs a scalar value (use isNull/notNull for null checks)`);
+        }
+        if (op === 'contains') {
+            const colMeta = table.columns.find((c) => c.name === col);
+            if (!colMeta || !isTextishType(colMeta.pgType)) {
+                throw new Error(`contains only applies to text columns ("${col}" is ${colMeta?.pgType ?? 'unknown'})`);
+            }
+        }
+        out.push({ column: col, op, value });
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
 // API: /api/builder — Turbine ORM findMany spec runner
 // ---------------------------------------------------------------------------
 export async function apiBuilder(req, res, ctx) {
@@ -453,6 +659,9 @@ export async function apiBuilder(req, res, ctx) {
             warnOnUnlimited: false,
             sqlCache: false,
             preparedStatements: false,
+            // Demo compiles SQLite SQL (`:pN`, json_group_array, …); Postgres default
+            // when unset.
+            dialect: ctx.dialect,
         });
         deferred = qi.buildFindMany(args);
     }
@@ -462,33 +671,44 @@ export async function apiBuilder(req, res, ctx) {
     }
     const client = await ctx.pool.connect();
     try {
-        await client.query('BEGIN READ ONLY');
-        await client.query(ctx.statementTimeout.sql, ctx.statementTimeout.params);
-        // QueryInterface emits unqualified table identifiers, which resolve via
-        // the connection's search_path. Pin it to the configured --schema so the
-        // Query tab reads the same schema as the Data tab (set_config is
-        // transaction-local and fully parameterized).
-        await client.query(`SELECT set_config('search_path', $1, true)`, [ctx.options.schema]);
+        if (!ctx.demo) {
+            await client.query('BEGIN READ ONLY');
+            await client.query(ctx.statementTimeout.sql, ctx.statementTimeout.params);
+            // QueryInterface emits unqualified table identifiers, which resolve via
+            // the connection's search_path. Pin it to the configured --schema so the
+            // Query tab reads the same schema as the Data tab (set_config is
+            // transaction-local and fully parameterized). Demo has no schemas.
+            await client.query(`SELECT set_config('search_path', $1, true)`, [ctx.options.schema]);
+        }
         const started = Date.now();
         const result = await client.query(deferred.sql, deferred.params);
         const elapsedMs = Date.now() - started;
-        await client.query('COMMIT');
-        const rawRows = result.rows;
+        if (!ctx.demo)
+            await client.query('COMMIT');
+        // Postgres auto-parses json/jsonb relation columns into JS values via its
+        // type parsers; the SQLite demo driver returns them as raw JSON strings. So
+        // in demo mode, parse relation columns back into arrays/objects (walking the
+        // `with` tree) to match the Postgres shape before redaction + serialization.
+        const rawRows = ctx.demo
+            ? parseDemoRelationRows(result.rows, tableName, args.with, ctx.metadata)
+            : result.rows;
         const redactedRows = ctx.showPii ? rawRows : redactBuilderRows(rawRows, tableName, args.with, ctx.metadata);
         sendJson(res, 200, {
             sql: deferred.sql,
-            columns: result.fields.map((f) => ({ name: f.name, dataTypeID: f.dataTypeID })),
+            columns: resultColumns(result, result.rows),
             rows: redactedRows.map((r) => serializeRow(r)),
             rowCount: result.rowCount ?? result.rows.length,
             elapsedMs,
         });
     }
     catch (err) {
-        try {
-            await client.query('ROLLBACK');
-        }
-        catch {
-            /* ignore */
+        if (!ctx.demo) {
+            try {
+                await client.query('ROLLBACK');
+            }
+            catch {
+                /* ignore */
+            }
         }
         sendJson(res, 400, { error: err instanceof Error ? err.message : String(err) });
     }
@@ -497,15 +717,24 @@ export async function apiBuilder(req, res, ctx) {
     }
 }
 // ---------------------------------------------------------------------------
-// API: /api/row/update | /api/row/insert | /api/row/delete (single-row writes)
+// API: /api/row/update | /api/row/insert | /api/row/delete (PK-addressed writes)
 //
 // Write mode only (the routes do not exist otherwise). Every column identifier
 // is validated against the introspected metadata and the statement is compiled
 // through the query builders (`buildUpdate`/`buildCreate`/`buildDelete`) so all
 // values are $N params; there is no raw SQL. update/delete require the caller
 // to supply the FULL primary key in `where`; the effective predicate is rebuilt
-// from those PK values alone, so a write can only ever touch one row.
+// from those PK values alone, so a statement can only ever touch one row.
+//
+// Bulk form (insert/delete only): pass `rows: [...]` instead of `data`/`where`
+// — an array of data objects (insert) or PK-where objects (delete). Each entry
+// goes through the exact same per-row validation and compiles to its own
+// single-row statement; all statements run in ONE transaction (all-or-nothing,
+// capped at MAX_BULK_ROWS). Predicate-based bulk writes stay deliberately
+// unsupported — every row is still addressed by its full primary key.
 // ---------------------------------------------------------------------------
+/** Hard cap on rows per bulk insert/delete request (matches the max page size). */
+const MAX_BULK_ROWS = 500;
 export async function apiRowWrite(req, res, ctx, op) {
     const body = await readJsonBody(req);
     const tableName = typeof body?.table === 'string' ? body.table : '';
@@ -518,23 +747,51 @@ export async function apiRowWrite(req, res, ctx, op) {
         sendJson(res, 400, { error: `[turbine] "${tableName}" is a view; Studio cannot write to it.` });
         return;
     }
-    const data = (body?.data && typeof body.data === 'object' ? body.data : {});
-    const rawWhere = (body?.where && typeof body.where === 'object' ? body.where : {});
-    // Validate every column name up front for a clean typed 400 (the builders
-    // would also reject unknowns, but an explicit check keeps the message clear).
-    if (op === 'insert' || op === 'update') {
-        const badKey = firstUnknownColumn(table, data);
-        if (badKey) {
-            sendJson(res, 400, { error: `[turbine] unknown column "${badKey}" on table "${tableName}"` });
+    // Bulk form: `rows` replaces `data` (insert) / `where` (delete).
+    const bulkRows = Array.isArray(body?.rows) ? body.rows : null;
+    if (bulkRows) {
+        if (op === 'update') {
+            sendJson(res, 400, { error: '[turbine] bulk update is not supported; update rows one at a time' });
             return;
         }
-        if (!Object.keys(data).some((k) => data[k] !== undefined)) {
-            sendJson(res, 400, { error: '[turbine] `data` must include at least one column' });
+        if (bulkRows.length === 0) {
+            sendJson(res, 400, { error: '[turbine] `rows` must include at least one entry' });
             return;
         }
+        if (bulkRows.length > MAX_BULK_ROWS) {
+            sendJson(res, 400, { error: `[turbine] too many rows (max ${MAX_BULK_ROWS} per request)` });
+            return;
+        }
+    }
+    const data = (body?.data && typeof body.data === 'object' ? body.data : {});
+    const rawWhere = (body?.where && typeof body.where === 'object' ? body.where : {});
+    // Per-statement inputs, validated up front for a clean typed 400 (the
+    // builders would also reject unknowns, but explicit checks keep messages
+    // clear and stop before any statement has run).
+    const inserts = [];
+    const wheres = [];
+    if (op === 'insert') {
+        const candidates = bulkRows ?? [data];
+        for (let i = 0; i < candidates.length; i++) {
+            const rowLabel = bulkRows ? ` (rows[${i}])` : '';
+            const rowData = candidates[i];
+            if (!rowData || typeof rowData !== 'object' || Array.isArray(rowData)) {
+                sendJson(res, 400, { error: `[turbine] each insert row must be an object${rowLabel}` });
+                return;
+            }
+            const rec = rowData;
+            const badKey = firstUnknownColumn(table, rec);
+            if (badKey) {
+                sendJson(res, 400, { error: `[turbine] unknown column "${badKey}" on table "${tableName}"${rowLabel}` });
+                return;
+            }
+            if (!Object.keys(rec).some((k) => rec[k] !== undefined)) {
+                sendJson(res, 400, { error: `[turbine] \`data\` must include at least one column${rowLabel}` });
+                return;
+            }
+            inserts.push(rec);
+        }
     }
-    // update/delete: require the table to have a PK and the caller to cover it.
-    let effectiveWhere = rawWhere;
     if (op === 'update' || op === 'delete') {
         if (table.primaryKey.length === 0) {
             sendJson(res, 400, {
@@ -542,33 +799,55 @@ export async function apiRowWrite(req, res, ctx, op) {
             });
             return;
         }
-        const pk = extractPkWhere(table, rawWhere);
-        if ('error' in pk) {
-            sendJson(res, 400, { error: `[turbine] ${pk.error}` });
+        const candidates = op === 'delete' && bulkRows ? bulkRows : [rawWhere];
+        for (let i = 0; i < candidates.length; i++) {
+            const rowLabel = bulkRows ? ` (rows[${i}])` : '';
+            const rowWhere = candidates[i];
+            if (!rowWhere || typeof rowWhere !== 'object' || Array.isArray(rowWhere)) {
+                sendJson(res, 400, { error: `[turbine] each delete target must be a where object${rowLabel}` });
+                return;
+            }
+            const pk = extractPkWhere(table, rowWhere);
+            if ('error' in pk) {
+                sendJson(res, 400, { error: `[turbine] ${pk.error}${rowLabel}` });
+                return;
+            }
+            // Empty-where can never happen by construction (PK covered above); assert.
+            if (Object.keys(pk.where).length === 0) {
+                sendJson(res, 400, { error: '[turbine] refusing a write with an empty predicate' });
+                return;
+            }
+            wheres.push(pk.where);
+        }
+    }
+    if (op === 'update') {
+        const badKey = firstUnknownColumn(table, data);
+        if (badKey) {
+            sendJson(res, 400, { error: `[turbine] unknown column "${badKey}" on table "${tableName}"` });
             return;
         }
-        // Empty-where can never happen by construction (PK covered above); assert.
-        if (Object.keys(pk.where).length === 0) {
-            sendJson(res, 400, { error: '[turbine] refusing a write with an empty predicate' });
+        if (!Object.keys(data).some((k) => data[k] !== undefined)) {
+            sendJson(res, 400, { error: '[turbine] `data` must include at least one column' });
             return;
         }
-        effectiveWhere = pk.where;
     }
-    let deferred;
+    let deferreds;
     try {
         const qi = new QueryInterface(ctx.pool, tableName, ctx.metadata, [], {
             warnOnUnlimited: false,
             sqlCache: false,
             preparedStatements: false,
+            dialect: ctx.dialect,
         });
         if (op === 'insert') {
-            deferred = qi.buildCreate({ data });
+            deferreds = inserts.map((rec) => qi.buildCreate({ data: rec }));
         }
         else if (op === 'update') {
-            deferred = qi.buildUpdate({ where: effectiveWhere, data });
+            const where = wheres[0];
+            deferreds = [qi.buildUpdate({ where, data })];
         }
         else {
-            deferred = qi.buildDelete({ where: effectiveWhere });
+            deferreds = wheres.map((where) => qi.buildDelete({ where }));
         }
     }
     catch (err) {
@@ -577,27 +856,51 @@ export async function apiRowWrite(req, res, ctx, op) {
     }
     const client = await ctx.pool.connect();
     try {
-        // A real write transaction, NOT `READ ONLY`. Same parameterized
-        // statement-timeout + search_path pin as the read paths.
+        // A real write transaction, NOT `READ ONLY`. Postgres also pins the
+        // parameterized statement-timeout + search_path; demo (SQLite) has neither
+        // GUC, so those are skipped, but the BEGIN/COMMIT is kept (SqlitePool
+        // supports it) so an in-memory write still applies atomically. Bulk
+        // requests are all-or-nothing: any per-row failure rolls back every row.
         await client.query('BEGIN');
-        await client.query(ctx.statementTimeout.sql, ctx.statementTimeout.params);
-        await client.query(`SELECT set_config('search_path', $1, true)`, [ctx.options.schema]);
-        const result = await client.query(deferred.sql, deferred.params);
-        await client.query('COMMIT');
-        const row = result.rows[0];
-        if (!row) {
-            const msg = op === 'insert' ? 'insert returned no row' : 'no row matched the primary key';
-            sendJson(res, 404, { error: `[turbine] ${msg}` });
-            return;
+        if (!ctx.demo) {
+            await client.query(ctx.statementTimeout.sql, ctx.statementTimeout.params);
+            await client.query(`SELECT set_config('search_path', $1, true)`, [ctx.options.schema]);
         }
-        // The echoed row is redacted the same way as any read (unless --show-pii),
+        const returnedRows = [];
+        let rowCount = 0;
+        for (const deferred of deferreds) {
+            const result = await client.query(deferred.sql, deferred.params);
+            const row = result.rows[0];
+            if (!row) {
+                // A statement that touched nothing (stale PK, vanished row) aborts the
+                // whole request so a bulk delete can never half-apply.
+                await client.query('ROLLBACK');
+                const msg = op === 'insert' ? 'insert returned no row' : 'no row matched the primary key';
+                sendJson(res, 404, { error: `[turbine] ${msg}` });
+                return;
+            }
+            returnedRows.push(row);
+            rowCount += result.rowCount ?? 1;
+        }
+        await client.query('COMMIT');
+        // The echoed rows are redacted the same way as any read (unless --show-pii),
         // even though a write to a pii column is allowed.
         const piiKeys = ctx.showPii ? NO_PII_KEYS : piiKeysForTable(table);
-        sendJson(res, 200, {
-            operation: op,
-            row: serializeRow(redactFlatRow(row, piiKeys)),
-            rowCount: result.rowCount ?? 1,
-        });
+        if (bulkRows) {
+            sendJson(res, 200, {
+                operation: op,
+                rows: returnedRows.map((row) => serializeRow(redactFlatRow(row, piiKeys))),
+                rowCount,
+            });
+        }
+        else {
+            const first = returnedRows[0];
+            sendJson(res, 200, {
+                operation: op,
+                row: serializeRow(redactFlatRow(first, piiKeys)),
+                rowCount,
+            });
+        }
     }
     catch (err) {
         try {
@@ -659,6 +962,12 @@ function savedQueriesPath(ctx) {
 /** One-shot flag so the legacy saved-query notice isn't logged on every request. */
 let legacyDropNoticeShown = false;
 function loadSavedQueries(ctx) {
+    // Demo mode: in-memory only — never read the user's real saved-query file.
+    if (ctx.demo) {
+        if (!ctx.memorySavedQueries)
+            ctx.memorySavedQueries = { version: 1, queries: [] };
+        return ctx.memorySavedQueries;
+    }
     const file = savedQueriesPath(ctx);
     if (!existsSync(file))
         return { version: 1, queries: [] };
@@ -684,6 +993,11 @@ function loadSavedQueries(ctx) {
     }
 }
 function writeSavedQueries(ctx, data) {
+    // Demo mode: in-memory only — nothing is ever written to disk.
+    if (ctx.demo) {
+        ctx.memorySavedQueries = data;
+        return;
+    }
     const file = savedQueriesPath(ctx);
     const dir = dirname(file);
     if (!existsSync(dir))
@@ -820,6 +1134,52 @@ function redactBuilderRows(rows, tableName, withClause, metadata) {
         return out;
     });
 }
+/**
+ * Demo-only: parse relation columns that arrive as raw JSON strings from the
+ * SQLite driver back into arrays/objects, walking the `with` tree so nested
+ * relations are parsed at every level. This mirrors what Postgres' json/jsonb
+ * type parsers do automatically, so the builder response shape (and downstream
+ * redaction) is identical across engines. Rows without the named relation, or
+ * whose value is already a parsed object/array, pass through unchanged.
+ */
+function parseDemoRelationRows(rows, tableName, withClause, metadata) {
+    const table = metadata.tables[tableName];
+    if (!table)
+        return rows;
+    const relEntries = withClause && typeof withClause === 'object'
+        ? Object.entries(withClause).filter(([, v]) => v)
+        : [];
+    if (relEntries.length === 0)
+        return rows;
+    return rows.map((row) => {
+        const out = { ...row };
+        for (const [relName, relVal] of relEntries) {
+            const rel = table.relations[relName];
+            if (!rel)
+                continue;
+            let child = out[relName];
+            if (typeof child === 'string') {
+                try {
+                    child = JSON.parse(child);
+                }
+                catch {
+                    continue;
+                }
+            }
+            const nestedWith = relVal && typeof relVal === 'object' ? relVal.with : undefined;
+            if (Array.isArray(child)) {
+                out[relName] = parseDemoRelationRows(child, rel.to, nestedWith, metadata);
+            }
+            else if (child && typeof child === 'object') {
+                out[relName] = parseDemoRelationRows([child], rel.to, nestedWith, metadata)[0];
+            }
+            else {
+                out[relName] = child;
+            }
+        }
+        return out;
+    });
+}
 /**
  * A fresh CSP nonce for one HTML response. Base64 of 16 random bytes; the value
  * is stamped into both the `Content-Security-Policy` header and the inline
@@ -836,6 +1196,20 @@ function clampInt(value, fallback, min, max) {
         return fallback;
     return Math.min(Math.max(n, min), max);
 }
+/**
+ * Column descriptors for a result payload. Postgres results carry a `fields`
+ * array (name + OID); the SQLite demo driver does not, so we fall back to the
+ * keys of the first returned row (dataTypeID 0 = "unknown", which the UI treats
+ * generically). When `fields` is present this is byte-identical to the previous
+ * inline `result.fields.map(...)`.
+ */
+function resultColumns(result, rows) {
+    if (result.fields) {
+        return result.fields.map((f) => ({ name: f.name, dataTypeID: f.dataTypeID }));
+    }
+    const first = rows[0];
+    return first ? Object.keys(first).map((name) => ({ name, dataTypeID: 0 })) : [];
+}
 function serializeRow(row) {
     const out = {};
     for (const [k, v] of Object.entries(row)) {