turbine-orm 0.37.0 → 0.38.0

package/dist/cjs/query/relations.js

@@ -88,6 +88,7 @@ const index_advisor_js_1 = require("../index-advisor.js");
 const schema_js_1 = require("../schema.js");
 const batched_loader_js_1 = require("./batched-loader.js");
 const filters_js_1 = require("./filters.js");
+const utils_js_1 = require("./utils.js");
 const whereMod = __importStar(require("./where.js"));
 const writesMod = __importStar(require("./writes.js"));
 /** Relations already warned about missing FK indexes (once per process, dev only). */
@@ -388,10 +389,10 @@ function buildOrderBy(qi, orderBy, params, lateralSink) {
     // are validated in the relation branch below, so skip them here.
     if (process.env.NODE_ENV !== 'production') {
         for (const [key, value] of Object.entries(orderBy)) {
-            if (isRelationOrderByValue(qi, value) && qi.tableMeta.relations[key])
+            if (isRelationOrderByValue(qi, value) && (0, utils_js_1.ownLookup)(qi.tableMeta.relations, key))
                 continue;
             const snakeKey = (0, schema_js_1.camelToSnake)(key);
-            if (!qi.tableMeta.columns.some((c) => c.name === snakeKey) && !(key in qi.tableMeta.columnMap)) {
+            if (!qi.tableMeta.columns.some((c) => c.name === snakeKey) && !Object.hasOwn(qi.tableMeta.columnMap, key)) {
                 console.warn(`[turbine] Unknown orderBy field "${key}" for table "${qi.tableMeta.name}". ` +
                     'This will cause a runtime error.');
             }
@@ -473,7 +474,7 @@ function nullsSuffix(qi, nulls) {
  * camelCase-named DB columns like "sortOrder").
  */
 function resolveOrderByColumn(_qi, table, meta, key) {
-    const col = meta.columnMap[key] ?? (0, schema_js_1.camelToSnake)(key);
+    const col = (0, utils_js_1.ownLookup)(meta.columnMap, key) ?? (0, schema_js_1.camelToSnake)(key);
     if (!meta.allColumns.includes(col)) {
         throw new errors_js_1.ValidationError(`[turbine] Unknown field "${key}" in orderBy on table "${table}". ` +
             `Known fields: ${Object.keys(meta.columnMap).join(', ') || '(none)'}.`);
@@ -591,7 +592,7 @@ function buildRelationOrderBy(qi, relName, value, alias, params, ctx, lateralSin
         .map(([col, dirValue]) => {
         // columnMap-first resolution (camelToSnake fallback): mirrors the
         // scalar orderBy path so camelCase-named DB columns resolve here too.
-        const snakeCol = targetMeta.columnMap[col] ?? (0, schema_js_1.camelToSnake)(col);
+        const snakeCol = (0, utils_js_1.ownLookup)(targetMeta.columnMap, col) ?? (0, schema_js_1.camelToSnake)(col);
         if (!targetMeta.allColumns.includes(snakeCol)) {
             throw new errors_js_1.ValidationError(`[turbine] Unknown column "${col}" in orderBy on relation "${relName}" (table "${relDef.to}").`);
         }
@@ -1059,7 +1060,7 @@ function resolveTargetColumns(qi, spec, targetMeta, includePii) {
         // opt-in and comes back regardless of the query's `includePii`.
         const selectedFields = Object.entries(spec.select)
             .filter(([, v]) => v)
-            .map(([k]) => targetMeta.columnMap[k] ?? (0, schema_js_1.camelToSnake)(k));
+            .map(([k]) => (0, utils_js_1.ownLookup)(targetMeta.columnMap, k) ?? (0, schema_js_1.camelToSnake)(k));
         return selectedFields.filter((col) => targetMeta.allColumns.includes(col));
     }
     // Default / omit-only relation projection: PII columns are excluded unless
@@ -1069,7 +1070,7 @@ function resolveTargetColumns(qi, spec, targetMeta, includePii) {
     if (spec !== true && spec.omit) {
         const omittedFields = new Set(Object.entries(spec.omit)
             .filter(([, v]) => v)
-            .map(([k]) => targetMeta.columnMap[k] ?? (0, schema_js_1.camelToSnake)(k)));
+            .map(([k]) => (0, utils_js_1.ownLookup)(targetMeta.columnMap, k) ?? (0, schema_js_1.camelToSnake)(k)));
         return targetMeta.allColumns.filter((col) => !omittedFields.has(col) && !(hasPii && piiCols.has(col)));
     }
     if (hasPii) {

package/dist/cjs/query/utils.js

@@ -7,6 +7,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OPERATOR_KEYS = exports.LRUCache = void 0;
 exports.quoteIdent = quoteIdent;
+exports.ownLookup = ownLookup;
 exports.escSingleQuote = escSingleQuote;
 exports.escapeLike = escapeLike;
 exports.fnv1a64Hex = fnv1a64Hex;
@@ -28,6 +29,18 @@ exports.parseDbDate = parseDbDate;
 function quoteIdent(name) {
     return `"${name.replace(/"/g, '""')}"`;
 }
+/**
+ * Prototype-safe own-property read for the plain metadata maps (columnMap,
+ * relations, reverseColumnMap). These are constructed as plain objects, so a
+ * bare `map[key]` for a user-supplied field name like "constructor",
+ * "toString", or "__proto__" returns an inherited member from
+ * `Object.prototype` — a truthy value that slips past validation and produces a
+ * cryptic `TypeError` instead of a clean `ValidationError`. Returns `undefined`
+ * unless `key` is an OWN enumerable/non-enumerable property.
+ */
+function ownLookup(map, key) {
+    return Object.hasOwn(map, key) ? map[key] : undefined;
+}
 /**
  * Escape single quotes for use as string keys in json_build_object().
  * Doubles single quotes per SQL quoting rules.

package/dist/cjs/query/where-compile.js

@@ -39,6 +39,7 @@ exports.walkWhere = walkWhere;
 exports.classifyScalarForSql = classifyScalarForSql;
 exports.fingerprintScalarToken = fingerprintScalarToken;
 const filters_js_1 = require("./filters.js");
+const utils_js_1 = require("./utils.js");
 /** True when a normalized relation filter carries at least one cardinality key. */
 function isRelationFilterObj(filterObj) {
     return ('some' in filterObj || 'every' in filterObj || 'none' in filterObj || 'is' in filterObj || 'isNot' in filterObj);
@@ -78,7 +79,7 @@ function walkWhere(host, where) {
             events.push({ kind: 'not', condition: value });
             continue;
         }
-        const relDef = host.tableMeta.relations[key];
+        const relDef = (0, utils_js_1.ownLookup)(host.tableMeta.relations, key);
         if (relDef && typeof value === 'object' && value !== null && !Array.isArray(value)) {
             const filterObj = host.normalizeRelationFilter(relDef, value);
             if (isRelationFilterObj(filterObj)) {

package/dist/cjs/query/where.js

@@ -723,7 +723,7 @@ function buildScopedWhere(qi, scope, where, params) {
  */
 function buildScopedScalarClause(qi, scope, field, value, params, clauses) {
     const meta = scope.meta;
-    const col = meta.columnMap[field] ?? (0, schema_js_1.camelToSnake)(field);
+    const col = (0, utils_js_1.ownLookup)(meta.columnMap, field) ?? (0, schema_js_1.camelToSnake)(field);
     if (!meta.allColumns.includes(col))
         throw scope.unknownColumn(field);
     const qCol = `${scope.qualifier}${qi.q(col)}`;
@@ -800,7 +800,7 @@ function collectScopedScalarParams(qi, scope, field, value, params) {
     if (value === null)
         return;
     const meta = scope.meta;
-    const col = meta.columnMap[field] ?? (0, schema_js_1.camelToSnake)(field);
+    const col = (0, utils_js_1.ownLookup)(meta.columnMap, field) ?? (0, schema_js_1.camelToSnake)(field);
     if (typeof value === 'object' && !Array.isArray(value) && (0, filters_js_1.isJsonFilter)(value)) {
         const colType = pgTypeForColumn(qi, meta, col);
         if (isJsonColumnType(qi, colType)) {
@@ -1071,7 +1071,7 @@ function resolveColumnRef(_qi, ref, ctx, mode) {
             `Case-insensitive column-to-column comparison is not supported: use client.sql\`...\` ` +
             `for lower(a) = lower(b).`);
     }
-    const col = ctx.meta.columnMap[ref.col] ?? (0, schema_js_1.camelToSnake)(ref.col);
+    const col = (0, utils_js_1.ownLookup)(ctx.meta.columnMap, ref.col) ?? (0, schema_js_1.camelToSnake)(ref.col);
     if (!ctx.meta.allColumns.includes(col)) {
         throw new errors_js_1.ValidationError(`[turbine] Unknown field "${ref.col}" referenced by { col } in where on table "${ctx.table}". ` +
             `Known fields: ${Object.keys(ctx.meta.columnMap).join(', ') || '(none)'}.`);