turbine-orm 0.37.0 → 0.38.0

package/dist/query/batched-loader.js

@@ -49,6 +49,7 @@
 import { CircularRelationError, RelationError, UnsupportedFeatureError, ValidationError } from '../errors.js';
 import { normalizeKeyColumns } from '../schema.js';
 import { isRelationPickOrderBy } from './filters.js';
+import { ownLookup } from './utils.js';
 /**
  * Max parent keys per follow-up query. On Postgres the whole key set travels as
  * ONE array parameter (`= ANY($1)`), so this is not a bind-parameter limit — it
@@ -123,7 +124,7 @@ export function neededParentKeyFields(parentMeta, withClause) {
             }
             continue;
         }
-        const rel = parentMeta.relations[relName];
+        const rel = ownLookup(parentMeta.relations, relName);
         if (!rel)
             continue; // unknown relation — the join path throws; let the loader surface it
         for (const col of localKeyColumns(rel)) {
@@ -161,7 +162,7 @@ export function resolveCountRelations(parentMeta, countSpec) {
     for (const [relName, enabled] of Object.entries(countSpec)) {
         if (!enabled)
             continue;
-        const rel = parentMeta.relations[relName];
+        const rel = ownLookup(parentMeta.relations, relName);
         if (!rel) {
             throw new RelationError(`[turbine] Unknown relation "${relName}" in _count on table "${parentMeta.name}". ` +
                 `Available: ${Object.keys(parentMeta.relations).join(', ')}`);
@@ -232,7 +233,7 @@ export async function loadRelationsBatched(ctx, parents, withClause, timeout, de
             loads.push(loadCounts(ctx, parents, spec));
             continue;
         }
-        const rel = ctx.parentMeta.relations[relName];
+        const rel = ownLookup(ctx.parentMeta.relations, relName);
         if (!rel) {
             throw new ValidationError(`[turbine] Unknown relation "${relName}" on table "${ctx.parentMeta.name}". ` +
                 `Available: ${Object.keys(ctx.parentMeta.relations).join(', ')}`);

package/dist/query/builder.js

@@ -18,7 +18,7 @@ import * as aggMod from './aggregates.js';
 import { includeKeysForBatching, loadRelationsBatched, neededParentKeyFields, rejectNestedPickOrder, stripFields, } from './batched-loader.js';
 import { isJsonPathOrderBy, isOrderBySpec, isRelationPickOrderBy, isVectorOrderBy, isWhereOperator, sortedEntries, } from './filters.js';
 import * as relationsMod from './relations.js';
-import { LRUCache, parseDbDate, sqlToPreparedName } from './utils.js';
+import { LRUCache, ownLookup, parseDbDate, sqlToPreparedName } from './utils.js';
 import * as whereMod from './where.js';
 import * as writesMod from './writes.js';
 /**
@@ -856,7 +856,7 @@ export class QueryInterface {
             !whereObj.NOT &&
             whereKeys.every((k) => {
                 const v = whereObj[k];
-                return v !== null && !isWhereOperator(v) && !this.tableMeta.relations[k];
+                return v !== null && !isWhereOperator(v) && !ownLookup(this.tableMeta.relations, k);
             });
         // Simple path: plain equality, no operators/null/OR
         if (!args.with && isSimpleWhere) {
@@ -1095,7 +1095,7 @@ export class QueryInterface {
         const withFp = args?.with ? this.withFingerprint(args.with) : '';
         const orderFp = args?.orderBy
             ? Object.entries(args.orderBy)
-                .map(([k, d]) => `${k}:${this.orderByEntryFingerprint(d, this.tableMeta.relations[k]?.to)}`)
+                .map(([k, d]) => `${k}:${this.orderByEntryFingerprint(d, ownLookup(this.tableMeta.relations, k)?.to)}`)
                 .join(',')
             : '';
         const cursorFp = args?.cursor
@@ -1681,7 +1681,11 @@ export class QueryInterface {
     }
     /** Convert camelCase field name to snake_case column name (unquoted, for non-SQL uses) */
     toColumn(field) {
-        const mapped = this.tableMeta.columnMap[field];
+        // Prototype-safe lookup: a plain-object `columnMap` would otherwise return
+        // an inherited member (e.g. Object.prototype.constructor) for a field named
+        // "constructor" / "toString" / "__proto__", bypassing the unknown-field
+        // check below and returning a non-string as the column name.
+        const mapped = ownLookup(this.tableMeta.columnMap, field);
         if (mapped)
             return mapped;
         // Fall back to camelToSnake ONLY if that snake_cased name also exists as a
@@ -1691,7 +1695,7 @@ export class QueryInterface {
         // SQL injection and catching typos like `where: { emial: 'x' }` with a
         // clear error instead of a cryptic Postgres "column does not exist".
         const snake = camelToSnake(field);
-        if (this.tableMeta.reverseColumnMap?.[snake]) {
+        if (this.tableMeta.reverseColumnMap && ownLookup(this.tableMeta.reverseColumnMap, snake)) {
             return snake;
         }
         if (this.tableMeta.allColumns?.includes(snake)) {
@@ -1786,7 +1790,7 @@ export class QueryInterface {
             // pick.where / pick.orderBy paths). To-one relation orderBy carries the
             // target's global filter once per ordered column.
             if (this.isRelationOrderByValue(dir)) {
-                const relDef = this.tableMeta.relations[key];
+                const relDef = ownLookup(this.tableMeta.relations, key);
                 if (relDef && isRelationPickOrderBy(dir)) {
                     this.collectRelationPickOrderParams(key, relDef, dir, params);
                 }

package/dist/query/relations.js

@@ -17,6 +17,7 @@ import { missingIndexForRelation } from '../index-advisor.js';
 import { camelToSnake, normalizeKeyColumns, snakeToCamel } from '../schema.js';
 import { resolveCountRelations } from './batched-loader.js';
 import { isJsonPathOrderBy, isOrderBySpec, isRelationPickOrderBy, isVectorOrderBy, normalizeOrderBy, sortedEntries, } from './filters.js';
+import { ownLookup } from './utils.js';
 import * as whereMod from './where.js';
 import * as writesMod from './writes.js';
 /** Relations already warned about missing FK indexes (once per process, dev only). */
@@ -317,10 +318,10 @@ export function buildOrderBy(qi, orderBy, params, lateralSink) {
     // are validated in the relation branch below, so skip them here.
     if (process.env.NODE_ENV !== 'production') {
         for (const [key, value] of Object.entries(orderBy)) {
-            if (isRelationOrderByValue(qi, value) && qi.tableMeta.relations[key])
+            if (isRelationOrderByValue(qi, value) && ownLookup(qi.tableMeta.relations, key))
                 continue;
             const snakeKey = camelToSnake(key);
-            if (!qi.tableMeta.columns.some((c) => c.name === snakeKey) && !(key in qi.tableMeta.columnMap)) {
+            if (!qi.tableMeta.columns.some((c) => c.name === snakeKey) && !Object.hasOwn(qi.tableMeta.columnMap, key)) {
                 console.warn(`[turbine] Unknown orderBy field "${key}" for table "${qi.tableMeta.name}". ` +
                     'This will cause a runtime error.');
             }
@@ -402,7 +403,7 @@ export function nullsSuffix(qi, nulls) {
  * camelCase-named DB columns like "sortOrder").
  */
 export function resolveOrderByColumn(_qi, table, meta, key) {
-    const col = meta.columnMap[key] ?? camelToSnake(key);
+    const col = ownLookup(meta.columnMap, key) ?? camelToSnake(key);
     if (!meta.allColumns.includes(col)) {
         throw new ValidationError(`[turbine] Unknown field "${key}" in orderBy on table "${table}". ` +
             `Known fields: ${Object.keys(meta.columnMap).join(', ') || '(none)'}.`);
@@ -520,7 +521,7 @@ export function buildRelationOrderBy(qi, relName, value, alias, params, ctx, lat
         .map(([col, dirValue]) => {
         // columnMap-first resolution (camelToSnake fallback): mirrors the
         // scalar orderBy path so camelCase-named DB columns resolve here too.
-        const snakeCol = targetMeta.columnMap[col] ?? camelToSnake(col);
+        const snakeCol = ownLookup(targetMeta.columnMap, col) ?? camelToSnake(col);
         if (!targetMeta.allColumns.includes(snakeCol)) {
             throw new ValidationError(`[turbine] Unknown column "${col}" in orderBy on relation "${relName}" (table "${relDef.to}").`);
         }
@@ -988,7 +989,7 @@ export function resolveTargetColumns(qi, spec, targetMeta, includePii) {
         // opt-in and comes back regardless of the query's `includePii`.
         const selectedFields = Object.entries(spec.select)
             .filter(([, v]) => v)
-            .map(([k]) => targetMeta.columnMap[k] ?? camelToSnake(k));
+            .map(([k]) => ownLookup(targetMeta.columnMap, k) ?? camelToSnake(k));
         return selectedFields.filter((col) => targetMeta.allColumns.includes(col));
     }
     // Default / omit-only relation projection: PII columns are excluded unless
@@ -998,7 +999,7 @@ export function resolveTargetColumns(qi, spec, targetMeta, includePii) {
     if (spec !== true && spec.omit) {
         const omittedFields = new Set(Object.entries(spec.omit)
             .filter(([, v]) => v)
-            .map(([k]) => targetMeta.columnMap[k] ?? camelToSnake(k)));
+            .map(([k]) => ownLookup(targetMeta.columnMap, k) ?? camelToSnake(k)));
         return targetMeta.allColumns.filter((col) => !omittedFields.has(col) && !(hasPii && piiCols.has(col)));
     }
     if (hasPii) {

package/dist/query/utils.d.ts

@@ -13,6 +13,16 @@
  *   quoteIdent('user name')   → '"user name"'
  */
 export declare function quoteIdent(name: string): string;
+/**
+ * Prototype-safe own-property read for the plain metadata maps (columnMap,
+ * relations, reverseColumnMap). These are constructed as plain objects, so a
+ * bare `map[key]` for a user-supplied field name like "constructor",
+ * "toString", or "__proto__" returns an inherited member from
+ * `Object.prototype` — a truthy value that slips past validation and produces a
+ * cryptic `TypeError` instead of a clean `ValidationError`. Returns `undefined`
+ * unless `key` is an OWN enumerable/non-enumerable property.
+ */
+export declare function ownLookup<T>(map: Record<string, T>, key: string): T | undefined;
 /**
  * Escape single quotes for use as string keys in json_build_object().
  * Doubles single quotes per SQL quoting rules.

package/dist/query/utils.js

@@ -18,6 +18,18 @@
 export function quoteIdent(name) {
     return `"${name.replace(/"/g, '""')}"`;
 }
+/**
+ * Prototype-safe own-property read for the plain metadata maps (columnMap,
+ * relations, reverseColumnMap). These are constructed as plain objects, so a
+ * bare `map[key]` for a user-supplied field name like "constructor",
+ * "toString", or "__proto__" returns an inherited member from
+ * `Object.prototype` — a truthy value that slips past validation and produces a
+ * cryptic `TypeError` instead of a clean `ValidationError`. Returns `undefined`
+ * unless `key` is an OWN enumerable/non-enumerable property.
+ */
+export function ownLookup(map, key) {
+    return Object.hasOwn(map, key) ? map[key] : undefined;
+}
 /**
  * Escape single quotes for use as string keys in json_build_object().
  * Doubles single quotes per SQL quoting rules.

package/dist/query/where-compile.js

@@ -34,6 +34,7 @@
  * step.
  */
 import { findArrayUniqueKey, findJsonUniqueKey, fingerprintArrayFilterShape, fingerprintJsonFilterShape, fingerprintOperatorShape, isArrayFilter, isJsonFilter, isTextSearchFilter, isUnmatchedPlainObject, isVectorFilter, isWhereOperator, sortedKeys, VECTOR_DISTANCE_COMPARATORS, } from './filters.js';
+import { ownLookup } from './utils.js';
 /** True when a normalized relation filter carries at least one cardinality key. */
 function isRelationFilterObj(filterObj) {
     return ('some' in filterObj || 'every' in filterObj || 'none' in filterObj || 'is' in filterObj || 'isNot' in filterObj);
@@ -73,7 +74,7 @@ export function walkWhere(host, where) {
             events.push({ kind: 'not', condition: value });
             continue;
         }
-        const relDef = host.tableMeta.relations[key];
+        const relDef = ownLookup(host.tableMeta.relations, key);
         if (relDef && typeof value === 'object' && value !== null && !Array.isArray(value)) {
             const filterObj = host.normalizeRelationFilter(relDef, value);
             if (isRelationFilterObj(filterObj)) {

package/dist/query/where.js

@@ -13,7 +13,7 @@
 import { UnsupportedFeatureError, ValidationError } from '../errors.js';
 import { camelToSnake } from '../schema.js';
 import { assertBindableEqualsOperand, findArrayUniqueKey, findJsonUniqueKey, isArrayFilter, isColumnRef, isJsonFilter, isUnmatchedPlainObject, isWhereOperator, JSON_RANGE_OPERATORS, VECTOR_DISTANCE_COMPARATORS, VECTOR_METRIC_OPERATORS, validateTextSearchConfig, } from './filters.js';
-import { escapeLike, OPERATOR_KEYS } from './utils.js';
+import { escapeLike, OPERATOR_KEYS, ownLookup } from './utils.js';
 import { classifyScalarForSql, fingerprintScalarToken, walkWhere, } from './where-compile.js';
 /**
  * Produce a value-invariant fingerprint of a where clause.
@@ -663,7 +663,7 @@ export function buildScopedWhere(qi, scope, where, params) {
  */
 export function buildScopedScalarClause(qi, scope, field, value, params, clauses) {
     const meta = scope.meta;
-    const col = meta.columnMap[field] ?? camelToSnake(field);
+    const col = ownLookup(meta.columnMap, field) ?? camelToSnake(field);
     if (!meta.allColumns.includes(col))
         throw scope.unknownColumn(field);
     const qCol = `${scope.qualifier}${qi.q(col)}`;
@@ -740,7 +740,7 @@ export function collectScopedScalarParams(qi, scope, field, value, params) {
     if (value === null)
         return;
     const meta = scope.meta;
-    const col = meta.columnMap[field] ?? camelToSnake(field);
+    const col = ownLookup(meta.columnMap, field) ?? camelToSnake(field);
     if (typeof value === 'object' && !Array.isArray(value) && isJsonFilter(value)) {
         const colType = pgTypeForColumn(qi, meta, col);
         if (isJsonColumnType(qi, colType)) {
@@ -1011,7 +1011,7 @@ export function resolveColumnRef(_qi, ref, ctx, mode) {
             `Case-insensitive column-to-column comparison is not supported: use client.sql\`...\` ` +
             `for lower(a) = lower(b).`);
     }
-    const col = ctx.meta.columnMap[ref.col] ?? camelToSnake(ref.col);
+    const col = ownLookup(ctx.meta.columnMap, ref.col) ?? camelToSnake(ref.col);
     if (!ctx.meta.allColumns.includes(col)) {
         throw new ValidationError(`[turbine] Unknown field "${ref.col}" referenced by { col } in where on table "${ctx.table}". ` +
             `Known fields: ${Object.keys(ctx.meta.columnMap).join(', ') || '(none)'}.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turbine-orm",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Postgres-native TypeScript ORM — runs on Neon, Vercel Postgres, Cloudflare, Supabase. Streaming cursors, typed errors, single-query nested relations. One dependency, no WASM engine",
   "type": "module",
   "exports": {