turbine-orm 0.37.0 → 0.38.0

package/dist/cjs/cli/studio.js

@@ -21,8 +21,9 @@
  *     $N params compiled through the query builders
  *   • Read routes run in a READ ONLY transaction (belt-and-suspenders)
  *   • Write routes (only when `--write` is set) run in a plain BEGIN/COMMIT
- *     transaction, require a matching Origin header (CSRF), and target exactly
- *     one row by its full primary key
+ *     transaction, require a matching Origin header (CSRF), and address every
+ *     row by its full primary key (single row, or a capped `rows` array of
+ *     PK-addressed statements run atomically)
  *   • 30s statement timeout via parameterized set_config()
  *   • Per-session rate limiting, cross-origin refusal, security headers, and a
  *     per-request CSP nonce for the inline script (no `unsafe-inline`)
@@ -31,9 +32,10 @@
  * every row-bearing response (the literal `•• redacted ••`) unless the server
  * was started with `--show-pii`.
  *
- * Write model (opt-in): update/insert/delete a single row. DDL and multi-row or
- * unconditional writes are deliberately unsupported. Use the CLI or migrate for
- * schema changes and bulk operations.
+ * Write model (opt-in): update a single row; insert/delete one row or a capped
+ * list of PK-addressed rows in one all-or-nothing transaction. DDL and
+ * predicate-based (unconditional) writes are deliberately unsupported. Use the
+ * CLI or migrate for schema changes and true bulk operations.
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -140,6 +142,9 @@ async function startStudio(options) {
         showPii: demo ? false : options.showPii === true,
         demo,
         dialect,
+        // Demo never touches disk: saved queries live (and die) with the process,
+        // and the user's real .turbine/studio-queries.json is never read.
+        memorySavedQueries: demo ? { version: 1, queries: [] } : undefined,
     };
     const server = (0, node_http_1.createServer)((req, res) => {
         handleRequest(req, res, ctx).catch((err) => {
@@ -454,6 +459,18 @@ async function apiTableRows(res, ctx, rawTableName, params) {
         .map((c) => c.name);
     const hasSearch = search.length > 0 && textColumns.length > 0;
     const pattern = hasSearch ? `%${escapeLikePattern(search)}%` : null;
+    // Per-column filters: `filters` is a JSON array of { column, op, value }
+    // composed by the Data tab's filter bar. Every column is validated against
+    // the metadata, every op against a fixed whitelist, and every value is a
+    // parameter — same discipline as the builder route.
+    let filters;
+    try {
+        filters = parseTableFilters(params.get('filters'), table, redactedPii);
+    }
+    catch (err) {
+        sendJson(res, 400, { error: `[turbine] ${err instanceof Error ? err.message : String(err)}` });
+        return;
+    }
     // Parameter placeholder + case-insensitive LIKE condition differ by engine.
     // Postgres: numbered `$N` + `ILIKE`. Demo (SQLite): named `:pN` (bound by
     // name from the positional value array, matching Turbine's own SQLite path)
@@ -463,22 +480,46 @@ async function apiTableRows(res, ctx, rawTableName, params) {
     const likeCond = (col, n) => ctx.demo
         ? `LOWER(${(0, index_js_1.quoteIdent)(col)}) LIKE LOWER(${ph(n)}) ESCAPE '\\'`
         : `${(0, index_js_1.quoteIdent)(col)} ILIKE ${ph(n)} ESCAPE '\\'`;
-    // Main query: $1 = limit, $2 = offset, $3 = pattern (if search)
-    const mainValues = [limit, offset];
-    let mainWhere = '';
-    if (hasSearch && pattern !== null) {
-        mainValues.push(pattern);
-        const conds = textColumns.map((c) => likeCond(c, 3));
-        mainWhere = `WHERE (${conds.join(' OR ')})`;
-    }
-    // Count query: $1 = pattern (if search)
-    const countValues = [];
-    let countWhere = '';
-    if (hasSearch && pattern !== null) {
-        countValues.push(pattern);
-        const conds = textColumns.map((c) => likeCond(c, 1));
-        countWhere = `WHERE (${conds.join(' OR ')})`;
-    }
+    // Build the WHERE conditions (search OR-set + per-column filters) once per
+    // query, numbering parameters from `startIndex` so the main query (params
+    // begin after limit/offset) and the count query (params begin at 1) each get
+    // indices matching their own value arrays.
+    const buildWhere = (startIndex) => {
+        let n = startIndex;
+        const conds = [];
+        const values = [];
+        if (hasSearch && pattern !== null) {
+            values.push(pattern);
+            const idx = n++;
+            conds.push(`(${textColumns.map((c) => likeCond(c, idx)).join(' OR ')})`);
+        }
+        for (const f of filters) {
+            if (f.op === 'isNull') {
+                conds.push(`${(0, index_js_1.quoteIdent)(f.column)} IS NULL`);
+            }
+            else if (f.op === 'notNull') {
+                conds.push(`${(0, index_js_1.quoteIdent)(f.column)} IS NOT NULL`);
+            }
+            else if (f.op === 'contains') {
+                values.push(`%${escapeLikePattern(String(f.value))}%`);
+                conds.push(likeCond(f.column, n++));
+            }
+            else {
+                const sqlOp = FILTER_OPS[f.op];
+                values.push(f.value);
+                conds.push(`${(0, index_js_1.quoteIdent)(f.column)} ${sqlOp} ${ph(n++)}`);
+            }
+        }
+        return { where: conds.length ? `WHERE ${conds.join(' AND ')}` : '', values };
+    };
+    // Main query: $1 = limit, $2 = offset, then search/filter params.
+    const mainW = buildWhere(3);
+    const mainValues = [limit, offset, ...mainW.values];
+    const mainWhere = mainW.where;
+    // Count query: params start at $1.
+    const countW = buildWhere(1);
+    const countValues = countW.values;
+    const countWhere = countW.where;
     // Demo runs against an unqualified in-memory SQLite table (no schemas);
     // Postgres qualifies with the configured `--schema`.
     const qualifiedTable = ctx.demo
@@ -548,6 +589,78 @@ function escapeLikePattern(s) {
     return s.replace(/\\/g, '\\\\').replace(/%/g, '\\%').replace(/_/g, '\\_');
 }
 // ---------------------------------------------------------------------------
+// Data-tab per-column filters
+// ---------------------------------------------------------------------------
+/** Scalar comparison ops → SQL operator. `contains`/`isNull`/`notNull` compile separately. */
+const FILTER_OPS = {
+    equals: '=',
+    not: '<>',
+    gt: '>',
+    gte: '>=',
+    lt: '<',
+    lte: '<=',
+};
+const FILTER_OP_NAMES = new Set([...Object.keys(FILTER_OPS), 'contains', 'isNull', 'notNull']);
+/** Hard cap on filter clauses per request — the UI never composes more. */
+const MAX_TABLE_FILTERS = 10;
+/**
+ * Parse + validate the Data tab's `filters` query param. Throws with a clear
+ * message on any invalid shape; the caller turns that into a 400. Filters on
+ * redacted PII columns are refused outright (a filter is a value-probing
+ * oracle, same reason redacted columns are excluded from search and orderBy).
+ */
+function parseTableFilters(raw, table, redactedPii) {
+    if (!raw)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('`filters` must be a JSON array');
+    }
+    if (!Array.isArray(parsed))
+        throw new Error('`filters` must be a JSON array');
+    if (parsed.length > MAX_TABLE_FILTERS) {
+        throw new Error(`too many filters (max ${MAX_TABLE_FILTERS})`);
+    }
+    const out = [];
+    for (const item of parsed) {
+        if (!item || typeof item !== 'object' || Array.isArray(item)) {
+            throw new Error('each filter must be an object { column, op, value }');
+        }
+        const f = item;
+        const col = typeof f.column === 'string' ? resolveColumnName(table, f.column) : null;
+        if (!col) {
+            throw new Error(`unknown filter column "${String(f.column)}" on table "${table.name}"`);
+        }
+        if (redactedPii.has(col)) {
+            throw new Error(`column "${col}" is PII-redacted; filtering on it is disabled (run with --show-pii to enable)`);
+        }
+        const op = typeof f.op === 'string' ? f.op : '';
+        if (!FILTER_OP_NAMES.has(op)) {
+            throw new Error(`unknown filter op "${op}" (expected one of: ${[...FILTER_OP_NAMES].join(', ')})`);
+        }
+        if (op === 'isNull' || op === 'notNull') {
+            out.push({ column: col, op });
+            continue;
+        }
+        const value = f.value;
+        const t = typeof value;
+        if (value === null || value === undefined || (t !== 'string' && t !== 'number' && t !== 'boolean')) {
+            throw new Error(`filter on "${col}" needs a scalar value (use isNull/notNull for null checks)`);
+        }
+        if (op === 'contains') {
+            const colMeta = table.columns.find((c) => c.name === col);
+            if (!colMeta || !isTextishType(colMeta.pgType)) {
+                throw new Error(`contains only applies to text columns ("${col}" is ${colMeta?.pgType ?? 'unknown'})`);
+            }
+        }
+        out.push({ column: col, op, value });
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
 // API: /api/builder — Turbine ORM findMany spec runner
 // ---------------------------------------------------------------------------
 async function apiBuilder(req, res, ctx) {
@@ -622,15 +735,24 @@ async function apiBuilder(req, res, ctx) {
     }
 }
 // ---------------------------------------------------------------------------
-// API: /api/row/update | /api/row/insert | /api/row/delete (single-row writes)
+// API: /api/row/update | /api/row/insert | /api/row/delete (PK-addressed writes)
 //
 // Write mode only (the routes do not exist otherwise). Every column identifier
 // is validated against the introspected metadata and the statement is compiled
 // through the query builders (`buildUpdate`/`buildCreate`/`buildDelete`) so all
 // values are $N params; there is no raw SQL. update/delete require the caller
 // to supply the FULL primary key in `where`; the effective predicate is rebuilt
-// from those PK values alone, so a write can only ever touch one row.
+// from those PK values alone, so a statement can only ever touch one row.
+//
+// Bulk form (insert/delete only): pass `rows: [...]` instead of `data`/`where`
+// — an array of data objects (insert) or PK-where objects (delete). Each entry
+// goes through the exact same per-row validation and compiles to its own
+// single-row statement; all statements run in ONE transaction (all-or-nothing,
+// capped at MAX_BULK_ROWS). Predicate-based bulk writes stay deliberately
+// unsupported — every row is still addressed by its full primary key.
 // ---------------------------------------------------------------------------
+/** Hard cap on rows per bulk insert/delete request (matches the max page size). */
+const MAX_BULK_ROWS = 500;
 async function apiRowWrite(req, res, ctx, op) {
     const body = await readJsonBody(req);
     const tableName = typeof body?.table === 'string' ? body.table : '';
@@ -643,23 +765,51 @@ async function apiRowWrite(req, res, ctx, op) {
         sendJson(res, 400, { error: `[turbine] "${tableName}" is a view; Studio cannot write to it.` });
         return;
     }
-    const data = (body?.data && typeof body.data === 'object' ? body.data : {});
-    const rawWhere = (body?.where && typeof body.where === 'object' ? body.where : {});
-    // Validate every column name up front for a clean typed 400 (the builders
-    // would also reject unknowns, but an explicit check keeps the message clear).
-    if (op === 'insert' || op === 'update') {
-        const badKey = firstUnknownColumn(table, data);
-        if (badKey) {
-            sendJson(res, 400, { error: `[turbine] unknown column "${badKey}" on table "${tableName}"` });
+    // Bulk form: `rows` replaces `data` (insert) / `where` (delete).
+    const bulkRows = Array.isArray(body?.rows) ? body.rows : null;
+    if (bulkRows) {
+        if (op === 'update') {
+            sendJson(res, 400, { error: '[turbine] bulk update is not supported; update rows one at a time' });
             return;
         }
-        if (!Object.keys(data).some((k) => data[k] !== undefined)) {
-            sendJson(res, 400, { error: '[turbine] `data` must include at least one column' });
+        if (bulkRows.length === 0) {
+            sendJson(res, 400, { error: '[turbine] `rows` must include at least one entry' });
+            return;
+        }
+        if (bulkRows.length > MAX_BULK_ROWS) {
+            sendJson(res, 400, { error: `[turbine] too many rows (max ${MAX_BULK_ROWS} per request)` });
             return;
         }
     }
-    // update/delete: require the table to have a PK and the caller to cover it.
-    let effectiveWhere = rawWhere;
+    const data = (body?.data && typeof body.data === 'object' ? body.data : {});
+    const rawWhere = (body?.where && typeof body.where === 'object' ? body.where : {});
+    // Per-statement inputs, validated up front for a clean typed 400 (the
+    // builders would also reject unknowns, but explicit checks keep messages
+    // clear and stop before any statement has run).
+    const inserts = [];
+    const wheres = [];
+    if (op === 'insert') {
+        const candidates = bulkRows ?? [data];
+        for (let i = 0; i < candidates.length; i++) {
+            const rowLabel = bulkRows ? ` (rows[${i}])` : '';
+            const rowData = candidates[i];
+            if (!rowData || typeof rowData !== 'object' || Array.isArray(rowData)) {
+                sendJson(res, 400, { error: `[turbine] each insert row must be an object${rowLabel}` });
+                return;
+            }
+            const rec = rowData;
+            const badKey = firstUnknownColumn(table, rec);
+            if (badKey) {
+                sendJson(res, 400, { error: `[turbine] unknown column "${badKey}" on table "${tableName}"${rowLabel}` });
+                return;
+            }
+            if (!Object.keys(rec).some((k) => rec[k] !== undefined)) {
+                sendJson(res, 400, { error: `[turbine] \`data\` must include at least one column${rowLabel}` });
+                return;
+            }
+            inserts.push(rec);
+        }
+    }
     if (op === 'update' || op === 'delete') {
         if (table.primaryKey.length === 0) {
             sendJson(res, 400, {
@@ -667,19 +817,39 @@ async function apiRowWrite(req, res, ctx, op) {
             });
             return;
         }
-        const pk = extractPkWhere(table, rawWhere);
-        if ('error' in pk) {
-            sendJson(res, 400, { error: `[turbine] ${pk.error}` });
+        const candidates = op === 'delete' && bulkRows ? bulkRows : [rawWhere];
+        for (let i = 0; i < candidates.length; i++) {
+            const rowLabel = bulkRows ? ` (rows[${i}])` : '';
+            const rowWhere = candidates[i];
+            if (!rowWhere || typeof rowWhere !== 'object' || Array.isArray(rowWhere)) {
+                sendJson(res, 400, { error: `[turbine] each delete target must be a where object${rowLabel}` });
+                return;
+            }
+            const pk = extractPkWhere(table, rowWhere);
+            if ('error' in pk) {
+                sendJson(res, 400, { error: `[turbine] ${pk.error}${rowLabel}` });
+                return;
+            }
+            // Empty-where can never happen by construction (PK covered above); assert.
+            if (Object.keys(pk.where).length === 0) {
+                sendJson(res, 400, { error: '[turbine] refusing a write with an empty predicate' });
+                return;
+            }
+            wheres.push(pk.where);
+        }
+    }
+    if (op === 'update') {
+        const badKey = firstUnknownColumn(table, data);
+        if (badKey) {
+            sendJson(res, 400, { error: `[turbine] unknown column "${badKey}" on table "${tableName}"` });
             return;
         }
-        // Empty-where can never happen by construction (PK covered above); assert.
-        if (Object.keys(pk.where).length === 0) {
-            sendJson(res, 400, { error: '[turbine] refusing a write with an empty predicate' });
+        if (!Object.keys(data).some((k) => data[k] !== undefined)) {
+            sendJson(res, 400, { error: '[turbine] `data` must include at least one column' });
             return;
         }
-        effectiveWhere = pk.where;
     }
-    let deferred;
+    let deferreds;
     try {
         const qi = new index_js_1.QueryInterface(ctx.pool, tableName, ctx.metadata, [], {
             warnOnUnlimited: false,
@@ -688,13 +858,14 @@ async function apiRowWrite(req, res, ctx, op) {
             dialect: ctx.dialect,
         });
         if (op === 'insert') {
-            deferred = qi.buildCreate({ data });
+            deferreds = inserts.map((rec) => qi.buildCreate({ data: rec }));
         }
         else if (op === 'update') {
-            deferred = qi.buildUpdate({ where: effectiveWhere, data });
+            const where = wheres[0];
+            deferreds = [qi.buildUpdate({ where, data })];
         }
         else {
-            deferred = qi.buildDelete({ where: effectiveWhere });
+            deferreds = wheres.map((where) => qi.buildDelete({ where }));
         }
     }
     catch (err) {
@@ -706,28 +877,48 @@ async function apiRowWrite(req, res, ctx, op) {
         // A real write transaction, NOT `READ ONLY`. Postgres also pins the
         // parameterized statement-timeout + search_path; demo (SQLite) has neither
         // GUC, so those are skipped, but the BEGIN/COMMIT is kept (SqlitePool
-        // supports it) so an in-memory write still applies atomically.
+        // supports it) so an in-memory write still applies atomically. Bulk
+        // requests are all-or-nothing: any per-row failure rolls back every row.
         await client.query('BEGIN');
         if (!ctx.demo) {
             await client.query(ctx.statementTimeout.sql, ctx.statementTimeout.params);
             await client.query(`SELECT set_config('search_path', $1, true)`, [ctx.options.schema]);
         }
-        const result = await client.query(deferred.sql, deferred.params);
-        await client.query('COMMIT');
-        const row = result.rows[0];
-        if (!row) {
-            const msg = op === 'insert' ? 'insert returned no row' : 'no row matched the primary key';
-            sendJson(res, 404, { error: `[turbine] ${msg}` });
-            return;
+        const returnedRows = [];
+        let rowCount = 0;
+        for (const deferred of deferreds) {
+            const result = await client.query(deferred.sql, deferred.params);
+            const row = result.rows[0];
+            if (!row) {
+                // A statement that touched nothing (stale PK, vanished row) aborts the
+                // whole request so a bulk delete can never half-apply.
+                await client.query('ROLLBACK');
+                const msg = op === 'insert' ? 'insert returned no row' : 'no row matched the primary key';
+                sendJson(res, 404, { error: `[turbine] ${msg}` });
+                return;
+            }
+            returnedRows.push(row);
+            rowCount += result.rowCount ?? 1;
         }
-        // The echoed row is redacted the same way as any read (unless --show-pii),
+        await client.query('COMMIT');
+        // The echoed rows are redacted the same way as any read (unless --show-pii),
         // even though a write to a pii column is allowed.
         const piiKeys = ctx.showPii ? NO_PII_KEYS : piiKeysForTable(table);
-        sendJson(res, 200, {
-            operation: op,
-            row: serializeRow(redactFlatRow(row, piiKeys)),
-            rowCount: result.rowCount ?? 1,
-        });
+        if (bulkRows) {
+            sendJson(res, 200, {
+                operation: op,
+                rows: returnedRows.map((row) => serializeRow(redactFlatRow(row, piiKeys))),
+                rowCount,
+            });
+        }
+        else {
+            const first = returnedRows[0];
+            sendJson(res, 200, {
+                operation: op,
+                row: serializeRow(redactFlatRow(first, piiKeys)),
+                rowCount,
+            });
+        }
     }
     catch (err) {
         try {
@@ -789,6 +980,12 @@ function savedQueriesPath(ctx) {
 /** One-shot flag so the legacy saved-query notice isn't logged on every request. */
 let legacyDropNoticeShown = false;
 function loadSavedQueries(ctx) {
+    // Demo mode: in-memory only — never read the user's real saved-query file.
+    if (ctx.demo) {
+        if (!ctx.memorySavedQueries)
+            ctx.memorySavedQueries = { version: 1, queries: [] };
+        return ctx.memorySavedQueries;
+    }
     const file = savedQueriesPath(ctx);
     if (!(0, node_fs_1.existsSync)(file))
         return { version: 1, queries: [] };
@@ -814,6 +1011,11 @@ function loadSavedQueries(ctx) {
     }
 }
 function writeSavedQueries(ctx, data) {
+    // Demo mode: in-memory only — nothing is ever written to disk.
+    if (ctx.demo) {
+        ctx.memorySavedQueries = data;
+        return;
+    }
     const file = savedQueriesPath(ctx);
     const dir = (0, node_path_1.dirname)(file);
     if (!(0, node_fs_1.existsSync)(dir))

package/dist/cjs/errors.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ReadOnlyError = exports.UnsupportedFeatureError = exports.OptimisticLockError = exports.PipelineError = exports.ExclusionConstraintError = exports.CheckConstraintError = exports.SerializationFailureError = exports.DeadlockError = exports.NotNullViolationError = exports.ForeignKeyError = exports.UniqueConstraintError = exports.CircularRelationError = exports.MigrationError = exports.RelationError = exports.ConnectionError = exports.ValidationError = exports.TimeoutError = exports.NotFoundError = exports.TurbineError = exports.TurbineErrorCode = void 0;
 exports.setErrorMessageMode = setErrorMessageMode;
 exports.getErrorMessageMode = getErrorMessageMode;
+exports.describeTargetForMessage = describeTargetForMessage;
 exports.wrapPgError = wrapPgError;
 /** Error codes for all Turbine errors */
 exports.TurbineErrorCode = {
@@ -72,6 +73,32 @@ function setErrorMessageMode(mode) {
 function getErrorMessageMode() {
     return errorMessageMode;
 }
+/**
+ * Render a user-supplied `where` / `connect` target for a "no row found" error
+ * message, honoring the global {@link ErrorMessageMode}. In 'safe' mode (the
+ * default) only the key names are shown (`keys [email, id]`) so that PII values
+ * never leak into logs; in 'verbose' mode the full JSON serialization is used.
+ *
+ * This mirrors {@link NotFoundError}'s redaction so that every "no row found"
+ * message in the library follows one convention, including the nested-write
+ * connect/update failures which historically embedded the raw values.
+ */
+function describeTargetForMessage(target) {
+    if (errorMessageMode === 'verbose') {
+        try {
+            return JSON.stringify(target);
+        }
+        catch {
+            return '[unserializable]';
+        }
+    }
+    // safe mode: key names only
+    if (target === null || target === undefined || typeof target !== 'object') {
+        return 'keys []';
+    }
+    const keys = Object.keys(target);
+    return `keys [${keys.join(', ')}]`;
+}
 /**
  * Render a `where` clause for error messages. In 'safe' mode (the default),
  * only the keys are shown; values are stripped to avoid leaking PII into logs.

package/dist/cjs/nested-write.js

@@ -39,7 +39,7 @@ function extractRelationFields(data, tableMeta) {
     const scalars = {};
     const relations = {};
     for (const [key, value] of Object.entries(data)) {
-        if (key in tableMeta.relations &&
+        if (Object.hasOwn(tableMeta.relations, key) &&
             value !== null &&
             typeof value === 'object' &&
             !Array.isArray(value) &&
@@ -59,7 +59,7 @@ function extractRelationFields(data, tableMeta) {
  */
 function hasRelationFields(data, tableMeta) {
     for (const key of Object.keys(data)) {
-        if (key in tableMeta.relations) {
+        if (Object.hasOwn(tableMeta.relations, key)) {
             const val = data[key];
             if (val !== null && typeof val === 'object' && !Array.isArray(val) && !(val instanceof Date)) {
                 return true;
@@ -214,7 +214,7 @@ async function executeNestedUpdate(ctx, tableName, where, data, depth = 0, path
     else {
         parentRow = (await ctx.tx.table(tableName).findUnique({ where }));
         if (!parentRow) {
-            throw new errors_js_1.ValidationError(`[turbine] update: no ${tableName} row found matching ${JSON.stringify(where)}.`);
+            throw new errors_js_1.ValidationError(`[turbine] update: no ${tableName} row found matching ${(0, errors_js_1.describeTargetForMessage)(where)}.`);
         }
     }
     // Process each relation
@@ -297,7 +297,7 @@ async function processHasManyCreate(ctx, rel, ops, parentRow, depth, path, relNa
         if (items.length > 0) {
             // Check if any items have nested relations (need per-row recursion)
             const childTable = ctx.schema.tables[rel.to];
-            const hasNested = childTable && items.some((item) => Object.keys(item).some((k) => k in (childTable.relations ?? {})));
+            const hasNested = childTable && items.some((item) => Object.keys(item).some((k) => Object.hasOwn(childTable.relations ?? {}, k)));
             if (hasNested) {
                 // Per-row recursive create for items with nested relations
                 for (const item of items) {
@@ -357,7 +357,7 @@ async function resolveBelongsToForCreate(ctx, rel, ops, parentTable, depth, path
             const target = items[0];
             relatedRow = (await ctx.tx.table(rel.to).findUnique({ where: target }));
             if (!relatedRow) {
-                throw new errors_js_1.ValidationError(`[turbine] connect on "${relName}": no ${rel.to} row found matching ${JSON.stringify(target)}.`);
+                throw new errors_js_1.ValidationError(`[turbine] connect on "${relName}": no ${rel.to} row found matching ${(0, errors_js_1.describeTargetForMessage)(target)}.`);
             }
         }
     }
@@ -412,7 +412,7 @@ async function processBelongsToCreate(ctx, rel, ops, parentRow, parentTable, dep
             const target = items[0];
             const existing = await ctx.tx.table(rel.to).findUnique({ where: target });
             if (!existing) {
-                throw new errors_js_1.ValidationError(`[turbine] connect on "${relName}": no ${rel.to} row found matching ${JSON.stringify(target)}.`);
+                throw new errors_js_1.ValidationError(`[turbine] connect on "${relName}": no ${rel.to} row found matching ${(0, errors_js_1.describeTargetForMessage)(target)}.`);
             }
             const updateData = {};
             const relatedTable = ctx.schema.tables[rel.to];
@@ -442,7 +442,7 @@ async function batchConnect(ctx, rel, items, parentRow) {
     for (const target of items) {
         const existing = await ctx.tx.table(rel.to).findUnique({ where: target });
         if (!existing) {
-            throw new errors_js_1.ValidationError(`[turbine] connect: no ${rel.to} row found matching ${JSON.stringify(target)}.`);
+            throw new errors_js_1.ValidationError(`[turbine] connect: no ${rel.to} row found matching ${(0, errors_js_1.describeTargetForMessage)(target)}.`);
         }
     }
     // Build FK update data to point children at parent

package/dist/cjs/query/batched-loader.js

@@ -57,6 +57,7 @@ exports.loadRelationsBatched = loadRelationsBatched;
 const errors_js_1 = require("../errors.js");
 const schema_js_1 = require("../schema.js");
 const filters_js_1 = require("./filters.js");
+const utils_js_1 = require("./utils.js");
 /**
  * Max parent keys per follow-up query. On Postgres the whole key set travels as
  * ONE array parameter (`= ANY($1)`), so this is not a bind-parameter limit — it
@@ -131,7 +132,7 @@ function neededParentKeyFields(parentMeta, withClause) {
             }
             continue;
         }
-        const rel = parentMeta.relations[relName];
+        const rel = (0, utils_js_1.ownLookup)(parentMeta.relations, relName);
         if (!rel)
             continue; // unknown relation — the join path throws; let the loader surface it
         for (const col of localKeyColumns(rel)) {
@@ -169,7 +170,7 @@ function resolveCountRelations(parentMeta, countSpec) {
     for (const [relName, enabled] of Object.entries(countSpec)) {
         if (!enabled)
             continue;
-        const rel = parentMeta.relations[relName];
+        const rel = (0, utils_js_1.ownLookup)(parentMeta.relations, relName);
         if (!rel) {
             throw new errors_js_1.RelationError(`[turbine] Unknown relation "${relName}" in _count on table "${parentMeta.name}". ` +
                 `Available: ${Object.keys(parentMeta.relations).join(', ')}`);
@@ -240,7 +241,7 @@ async function loadRelationsBatched(ctx, parents, withClause, timeout, depth = 0
             loads.push(loadCounts(ctx, parents, spec));
             continue;
         }
-        const rel = ctx.parentMeta.relations[relName];
+        const rel = (0, utils_js_1.ownLookup)(ctx.parentMeta.relations, relName);
         if (!rel) {
             throw new errors_js_1.ValidationError(`[turbine] Unknown relation "${relName}" on table "${ctx.parentMeta.name}". ` +
                 `Available: ${Object.keys(ctx.parentMeta.relations).join(', ')}`);

package/dist/cjs/query/builder.js

@@ -892,7 +892,7 @@ class QueryInterface {
             !whereObj.NOT &&
             whereKeys.every((k) => {
                 const v = whereObj[k];
-                return v !== null && !(0, filters_js_1.isWhereOperator)(v) && !this.tableMeta.relations[k];
+                return v !== null && !(0, filters_js_1.isWhereOperator)(v) && !(0, utils_js_1.ownLookup)(this.tableMeta.relations, k);
             });
         // Simple path: plain equality, no operators/null/OR
         if (!args.with && isSimpleWhere) {
@@ -1131,7 +1131,7 @@ class QueryInterface {
         const withFp = args?.with ? this.withFingerprint(args.with) : '';
         const orderFp = args?.orderBy
             ? Object.entries(args.orderBy)
-                .map(([k, d]) => `${k}:${this.orderByEntryFingerprint(d, this.tableMeta.relations[k]?.to)}`)
+                .map(([k, d]) => `${k}:${this.orderByEntryFingerprint(d, (0, utils_js_1.ownLookup)(this.tableMeta.relations, k)?.to)}`)
                 .join(',')
             : '';
         const cursorFp = args?.cursor
@@ -1717,7 +1717,11 @@ class QueryInterface {
     }
     /** Convert camelCase field name to snake_case column name (unquoted, for non-SQL uses) */
     toColumn(field) {
-        const mapped = this.tableMeta.columnMap[field];
+        // Prototype-safe lookup: a plain-object `columnMap` would otherwise return
+        // an inherited member (e.g. Object.prototype.constructor) for a field named
+        // "constructor" / "toString" / "__proto__", bypassing the unknown-field
+        // check below and returning a non-string as the column name.
+        const mapped = (0, utils_js_1.ownLookup)(this.tableMeta.columnMap, field);
         if (mapped)
             return mapped;
         // Fall back to camelToSnake ONLY if that snake_cased name also exists as a
@@ -1727,7 +1731,7 @@ class QueryInterface {
         // SQL injection and catching typos like `where: { emial: 'x' }` with a
         // clear error instead of a cryptic Postgres "column does not exist".
         const snake = (0, schema_js_1.camelToSnake)(field);
-        if (this.tableMeta.reverseColumnMap?.[snake]) {
+        if (this.tableMeta.reverseColumnMap && (0, utils_js_1.ownLookup)(this.tableMeta.reverseColumnMap, snake)) {
             return snake;
         }
         if (this.tableMeta.allColumns?.includes(snake)) {
@@ -1822,7 +1826,7 @@ class QueryInterface {
             // pick.where / pick.orderBy paths). To-one relation orderBy carries the
             // target's global filter once per ordered column.
             if (this.isRelationOrderByValue(dir)) {
-                const relDef = this.tableMeta.relations[key];
+                const relDef = (0, utils_js_1.ownLookup)(this.tableMeta.relations, key);
                 if (relDef && (0, filters_js_1.isRelationPickOrderBy)(dir)) {
                     this.collectRelationPickOrderParams(key, relDef, dir, params);
                 }