turbine-orm 0.4.0 → 0.7.0

package/dist/query.js

@@ -5,12 +5,13 @@
  * that builds parameterized SQL and executes it through the connection pool.
  *
  * Nested relations use json_build_object + json_agg subqueries for single-query
- * resolution — the technique that benchmarks proved 2-3x faster than Prisma.
+ * resolution — a PostgreSQL-native approach that eliminates N+1 query patterns.
  *
  * Schema-driven: all column names, types, and relations come from introspected
  * metadata — nothing is hardcoded.
  */
-import { snakeToCamel, camelToSnake } from './schema.js';
+import { CircularRelationError, NotFoundError, RelationError, TimeoutError, ValidationError, wrapPgError, } from './errors.js';
+import { camelToSnake, snakeToCamel } from './schema.js';
 // ---------------------------------------------------------------------------
 // Identifier quoting — prevents SQL injection via table/column names
 // ---------------------------------------------------------------------------
@@ -26,6 +27,13 @@ import { snakeToCamel, camelToSnake } from './schema.js';
 export function quoteIdent(name) {
     return `"${name.replace(/"/g, '""')}"`;
 }
+/**
+ * Escape single quotes for use as string keys in json_build_object().
+ * Doubles single quotes per SQL quoting rules.
+ */
+function escSingleQuote(s) {
+    return s.replace(/'/g, "''");
+}
 /**
  * Escape LIKE pattern metacharacters: %, _, and \.
  * Must be used with `ESCAPE '\'` in the LIKE clause.
@@ -35,22 +43,41 @@ function escapeLike(value) {
 }
 /** Known operator keys — used to detect operator objects vs plain values */
 const OPERATOR_KEYS = new Set([
-    'gt', 'gte', 'lt', 'lte', 'not', 'in', 'notIn',
-    'contains', 'startsWith', 'endsWith',
+    'gt',
+    'gte',
+    'lt',
+    'lte',
+    'not',
+    'in',
+    'notIn',
+    'contains',
+    'startsWith',
+    'endsWith',
+    'mode',
 ]);
 /** Check if a value is a where operator object (has at least one known operator key) */
 function isWhereOperator(value) {
-    if (value === null || value === undefined || typeof value !== 'object' || Array.isArray(value) || value instanceof Date) {
+    if (value === null ||
+        value === undefined ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        value instanceof Date) {
         return false;
     }
     const keys = Object.keys(value);
     return keys.length > 0 && keys.every((k) => OPERATOR_KEYS.has(k));
 }
+/** Known atomic-update operator keys — used to detect operator objects vs plain JSON values */
+const UPDATE_OPERATOR_KEYS = new Set(['set', 'increment', 'decrement', 'multiply', 'divide']);
 /** Known JSONB operator keys */
 const JSONB_OPERATOR_KEYS = new Set(['path', 'equals', 'contains', 'hasKey']);
 /** Check if a value is a JSONB filter object */
 function isJsonFilter(value) {
-    if (value === null || value === undefined || typeof value !== 'object' || Array.isArray(value) || value instanceof Date) {
+    if (value === null ||
+        value === undefined ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        value instanceof Date) {
         return false;
     }
     const keys = Object.keys(value);
@@ -60,38 +87,124 @@ function isJsonFilter(value) {
 const ARRAY_OPERATOR_KEYS = new Set(['has', 'hasEvery', 'hasSome', 'isEmpty']);
 /** Check if a value is an Array filter object */
 function isArrayFilter(value) {
-    if (value === null || value === undefined || typeof value !== 'object' || Array.isArray(value) || value instanceof Date) {
+    if (value === null ||
+        value === undefined ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        value instanceof Date) {
         return false;
     }
     const keys = Object.keys(value);
     return keys.length > 0 && keys.some((k) => ARRAY_OPERATOR_KEYS.has(k));
 }
+// ---------------------------------------------------------------------------
+// LRU cache — bounded SQL template cache to prevent memory leaks
+// ---------------------------------------------------------------------------
+/**
+ * Simple LRU (Least Recently Used) cache with a fixed maximum size.
+ * When the cache exceeds maxSize, the oldest (least recently used) entry is evicted.
+ * Uses Map insertion order for O(1) eviction.
+ */
+class LRUCache {
+    maxSize;
+    cache = new Map();
+    constructor(maxSize) {
+        this.maxSize = maxSize;
+    }
+    get(key) {
+        const value = this.cache.get(key);
+        if (value !== undefined) {
+            // Move to end (most recently used)
+            this.cache.delete(key);
+            this.cache.set(key, value);
+        }
+        return value;
+    }
+    set(key, value) {
+        if (this.cache.has(key)) {
+            this.cache.delete(key);
+        }
+        else if (this.cache.size >= this.maxSize) {
+            // Delete oldest (first) entry
+            const firstKey = this.cache.keys().next().value;
+            if (firstKey !== undefined)
+                this.cache.delete(firstKey);
+        }
+        this.cache.set(key, value);
+    }
+    get size() {
+        return this.cache.size;
+    }
+}
 export class QueryInterface {
     pool;
     table;
     schema;
     tableMeta;
     /** SQL template cache: cacheKey → sql string (params are always positional $1,$2,...) */
-    sqlCache = new Map();
+    sqlCache = new LRUCache(1000);
     middlewares;
-    // Fast path: pre-computed flag — true when this table has zero date/timestamp columns.
-    // When true, parseRow can skip the per-field dateCols.has() check entirely.
-    hasNoDateColumns;
-    constructor(pool, table, schema, middlewares) {
+    defaultLimit;
+    warnOnUnlimited;
+    /** Pre-computed column type lookups (avoids linear scans per query) */
+    columnPgTypeMap;
+    columnArrayTypeMap;
+    constructor(pool, table, schema, middlewares, options) {
         this.pool = pool;
         this.table = table;
         this.schema = schema;
         const meta = schema.tables[table];
         if (!meta) {
-            throw new Error(`[turbine] Unknown table "${table}". Available: ${Object.keys(schema.tables).join(', ')}`);
+            throw new ValidationError(`[turbine] Unknown table "${table}". Available: ${Object.keys(schema.tables).join(', ')}`);
         }
         this.tableMeta = meta;
         this.middlewares = middlewares ?? [];
-        this.hasNoDateColumns = meta.dateColumns.size === 0;
+        this.defaultLimit = options?.defaultLimit;
+        this.warnOnUnlimited = options?.warnOnUnlimited ?? false;
+        // Pre-compute column type lookup maps (TASK-26)
+        this.columnPgTypeMap = new Map();
+        this.columnArrayTypeMap = new Map();
+        for (const col of this.tableMeta.columns) {
+            this.columnPgTypeMap.set(col.name, col.pgType);
+            this.columnArrayTypeMap.set(col.name, col.pgArrayType);
+        }
+    }
+    /**
+     * Execute a pool.query with an optional timeout.
+     * If timeout is set, races the query against a timer and rejects on expiry.
+     * pg driver errors are translated to typed Turbine errors via wrapPgError.
+     */
+    async queryWithTimeout(sql, params, timeout) {
+        if (!timeout) {
+            try {
+                return await this.pool.query(sql, params);
+            }
+            catch (err) {
+                throw wrapPgError(err);
+            }
+        }
+        let timer;
+        const timeoutPromise = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new TimeoutError(timeout)), timeout);
+        });
+        try {
+            return await Promise.race([this.pool.query(sql, params), timeoutPromise]);
+        }
+        catch (err) {
+            throw wrapPgError(err);
+        }
+        finally {
+            clearTimeout(timer);
+        }
     }
     /**
      * Execute a query through the middleware chain.
      * If no middlewares are registered, executes directly.
+     *
+     * Middleware can inspect and log query parameters, modify results after execution,
+     * and measure timing. Note: query SQL is generated before middleware runs, so
+     * modifying params.args in middleware will NOT affect the executed SQL.
+     * To intercept queries before SQL generation, use the raw() method instead.
      */
     async executeWithMiddleware(action, args, executor) {
         if (this.middlewares.length === 0) {
@@ -110,25 +223,13 @@ export class QueryInterface {
         };
         return next(params);
     }
-    /**
-     * Generate a cache key for a query shape.
-     * Same where-keys + same with-clause = same SQL template.
-     */
-    cacheKey(op, whereKeys, withClause, extra) {
-        let key = `${op}:${whereKeys.sort().join(',')}`;
-        if (withClause)
-            key += `:w=${JSON.stringify(Object.keys(withClause).sort())}`;
-        if (extra)
-            key += `:${extra}`;
-        return key;
-    }
     // -------------------------------------------------------------------------
     // findUnique
     // -------------------------------------------------------------------------
     async findUnique(args) {
         return this.executeWithMiddleware('findUnique', args, async () => {
             const deferred = this.buildFindUnique(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout);
             return deferred.transform(result);
         });
     }
@@ -137,15 +238,12 @@ export class QueryInterface {
         const whereObj = args.where;
         // Check if all where values are simple (plain equality, no operators/null/OR)
         const whereKeys = Object.keys(whereObj).filter((k) => whereObj[k] !== undefined);
-        const isSimpleWhere = !whereObj['OR'] && !whereObj['AND'] && !whereObj['NOT'] && whereKeys.every((k) => {
-            const v = whereObj[k];
-            return v !== null && !isWhereOperator(v) && !isJsonFilter(v) && !isArrayFilter(v);
-        });
-        // -----------------------------------------------------------------------
-        // Fast path: no relations, simple equality where — cache SQL template.
-        // Generates: SELECT col1, col2 FROM "table" WHERE "id" = $1 LIMIT 1
-        // No json_build_object, no subqueries, no COALESCE wrappers.
-        // -----------------------------------------------------------------------
+        const isSimpleWhere = !whereObj.OR &&
+            whereKeys.every((k) => {
+                const v = whereObj[k];
+                return v !== null && !isWhereOperator(v);
+            });
+        // For simple queries (no nested with, no operators), use cached SQL template
         if (!args.with && isSimpleWhere) {
             const colKey = columnsList ? columnsList.join(',') : '*';
             const ck = `fu:${whereKeys.sort().join(',')}:c=${colKey}`;
@@ -155,34 +253,25 @@ export class QueryInterface {
                 const qt = quoteIdent(this.table);
                 const whereClauses = whereKeys.map((k, i) => `${this.toSqlColumn(k)} = $${i + 1}`);
                 const whereSql = whereClauses.length > 0 ? ` WHERE ${whereClauses.join(' AND ')}` : '';
-                const selectExpr = columnsList
-                    ? columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ')
-                    : `${qt}.*`;
+                const selectExpr = columnsList ? columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ') : `${qt}.*`;
                 sql = `SELECT ${selectExpr} FROM ${qt}${whereSql} LIMIT 1`;
                 this.sqlCache.set(ck, sql);
             }
-            // Fast path: skip date coercion when table has no date columns
-            const transformRow = this.hasNoDateColumns
-                ? (row) => this.parseRowFast(row)
-                : (row) => this.parseRow(row, this.table);
             return {
                 sql,
                 params,
                 transform: (result) => {
                     const row = result.rows[0];
-                    return row ? transformRow(row) : null;
+                    return row ? this.parseRow(row, this.table) : null;
                 },
                 tag: `${this.table}.findUnique`,
             };
         }
         // General path: supports operators, null, OR, nested with
         const { sql: whereSql, params } = this.buildWhere(args.where);
-        // Fast path: no relations, skip json_agg (but where has operators/null/OR)
         if (!args.with) {
             const qt = quoteIdent(this.table);
-            const selectExpr = columnsList
-                ? columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ')
-                : `${qt}.*`;
+            const selectExpr = columnsList ? columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ') : `${qt}.*`;
             const sql = `SELECT ${selectExpr} FROM ${qt}${whereSql} LIMIT 1`;
             return {
                 sql,
@@ -211,85 +300,21 @@ export class QueryInterface {
     // findMany
     // -------------------------------------------------------------------------
     async findMany(args) {
+        // Warn if no limit specified and warnOnUnlimited is enabled
+        const hasExplicitLimit = args?.limit !== undefined || args?.take !== undefined;
+        if (this.warnOnUnlimited && !hasExplicitLimit) {
+            console.warn(`[turbine] findMany() called without limit on table "${this.table}". Set defaultLimit in config to prevent unbounded queries.`);
+        }
         return this.executeWithMiddleware('findMany', (args ?? {}), async () => {
             const deferred = this.buildFindMany(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args?.timeout);
             return deferred.transform(result);
         });
     }
     buildFindMany(args) {
+        const { sql: whereSql, params } = args?.where ? this.buildWhere(args.where) : { sql: '', params: [] };
         const columnsList = this.resolveColumns(args?.select, args?.omit);
         const qt = quoteIdent(this.table);
-        const hasWith = !!(args?.with);
-        // -----------------------------------------------------------------------
-        // Fast path: no relations, no cursor, no distinct — cache SQL template
-        // Skip json_agg subquery machinery entirely for simple table scans.
-        // -----------------------------------------------------------------------
-        if (!hasWith && !args?.cursor && !args?.distinct) {
-            const whereObj = args?.where;
-            const whereKeys = whereObj
-                ? Object.keys(whereObj).filter((k) => whereObj[k] !== undefined)
-                : [];
-            // Check if all where values are simple equality (no operators, null, OR/AND/NOT)
-            const isSimpleWhere = !whereObj || (!whereObj['OR'] && !whereObj['AND'] && !whereObj['NOT'] && whereKeys.every((k) => {
-                const v = whereObj[k];
-                return v !== null && !isWhereOperator(v) && !isJsonFilter(v) && !isArrayFilter(v);
-            }));
-            if (isSimpleWhere) {
-                // Build cache key: operation + where keys + columns + orderBy + hasLimit + hasOffset
-                const colKey = columnsList ? columnsList.join(',') : '*';
-                const orderKey = args?.orderBy ? Object.entries(args.orderBy).map(([k, d]) => `${k}:${d}`).join(',') : '';
-                const hasLimit = args?.limit !== undefined || args?.take !== undefined;
-                const hasOffset = args?.offset !== undefined;
-                const ck = `fm:${whereKeys.sort().join(',')}:c=${colKey}:o=${orderKey}:l=${hasLimit ? '1' : '0'}:off=${hasOffset ? '1' : '0'}`;
-                let sql = this.sqlCache.get(ck);
-                const params = whereKeys.map((k) => whereObj[k]);
-                if (!sql) {
-                    // Build SQL template once and cache it
-                    const selectExpr = columnsList
-                        ? columnsList.map((c) => `${qt}.${quoteIdent(c)}`).join(', ')
-                        : `${qt}.*`;
-                    const whereClauses = whereKeys.map((k, i) => `${this.toSqlColumn(k)} = $${i + 1}`);
-                    const whereSql = whereClauses.length > 0 ? ` WHERE ${whereClauses.join(' AND ')}` : '';
-                    sql = `SELECT ${selectExpr} FROM ${qt}${whereSql}`;
-                    if (args?.orderBy) {
-                        sql += ` ORDER BY ${this.buildOrderBy(args.orderBy)}`;
-                    }
-                    // Placeholders for LIMIT/OFFSET — positions are stable since where params come first
-                    if (hasLimit) {
-                        sql += ` LIMIT $${params.length + 1}`;
-                    }
-                    if (hasOffset) {
-                        sql += ` OFFSET $${params.length + (hasLimit ? 2 : 1)}`;
-                    }
-                    this.sqlCache.set(ck, sql);
-                }
-                // Append runtime param values for LIMIT and OFFSET
-                const effectiveLimit = args?.take ?? args?.limit;
-                if (effectiveLimit !== undefined) {
-                    params.push(Number(effectiveLimit));
-                }
-                if (args?.offset !== undefined) {
-                    params.push(Number(args.offset));
-                }
-                // Fast path: no relations, use parseRow (or parseRowFast when no date columns)
-                const parseRow = this.hasNoDateColumns
-                    ? (row) => this.parseRowFast(row)
-                    : (row) => this.parseRow(row, this.table);
-                return {
-                    sql,
-                    params,
-                    transform: (result) => result.rows.map(parseRow),
-                    tag: `${this.table}.findMany`,
-                };
-            }
-        }
-        // -----------------------------------------------------------------------
-        // General path: supports operators, null, OR, cursor, distinct, nested with
-        // -----------------------------------------------------------------------
-        const { sql: whereSql, params } = args?.where
-            ? this.buildWhere(args.where)
-            : { sql: '', params: [] };
         // Distinct support
         let distinctPrefix = '';
         if (args?.distinct && args.distinct.length > 0) {
@@ -297,7 +322,7 @@ export class QueryInterface {
             distinctPrefix = `DISTINCT ON (${distinctCols.join(', ')}) `;
         }
         let selectClause;
-        if (hasWith) {
+        if (args?.with) {
             selectClause = this.buildSelectWithRelations(this.table, args.with, params, columnsList);
         }
         else if (columnsList) {
@@ -331,8 +356,8 @@ export class QueryInterface {
         if (args?.orderBy) {
             sql += ` ORDER BY ${this.buildOrderBy(args.orderBy)}`;
         }
-        // take overrides limit when cursor pagination is used
-        const effectiveLimit = args?.take ?? args?.limit;
+        // take overrides limit when cursor pagination is used; fall back to defaultLimit
+        const effectiveLimit = args?.take ?? args?.limit ?? this.defaultLimit;
         if (effectiveLimit !== undefined) {
             params.push(Number(effectiveLimit));
             sql += ` LIMIT $${params.length}`;
@@ -344,19 +369,74 @@ export class QueryInterface {
         return {
             sql,
             params,
-            transform: (result) => result.rows.map((row) => hasWith
-                ? this.parseNestedRow(row, this.table)
-                : this.parseRow(row, this.table)),
+            transform: (result) => result.rows.map((row) => args?.with ? this.parseNestedRow(row, this.table) : this.parseRow(row, this.table)),
             tag: `${this.table}.findMany`,
         };
     }
     // -------------------------------------------------------------------------
+    // findManyStream — async iterable using PostgreSQL cursors
+    // -------------------------------------------------------------------------
+    /**
+     * Stream rows from a findMany query using PostgreSQL cursors.
+     * Returns an AsyncIterable that yields individual rows, fetching in batches internally.
+     *
+     * Uses DECLARE CURSOR within a dedicated transaction on a single pooled connection.
+     * The cursor is automatically closed and the connection released when iteration
+     * completes or is terminated early (e.g. `break` from `for await`).
+     *
+     * @example
+     * ```ts
+     * for await (const user of db.users.findManyStream({ where: { orgId: 1 }, batchSize: 500 })) {
+     *   process.stdout.write(`${user.email}\n`);
+     * }
+     * ```
+     */
+    async *findManyStream(args) {
+        const batchSize = Math.max(1, Math.floor(Number(args?.batchSize ?? 100)));
+        const deferred = this.buildFindMany(args);
+        const hasRelations = !!args?.with;
+        // Acquire a dedicated connection — cursors require a single connection in a transaction
+        const client = await this.pool.connect();
+        const cursorName = `turbine_cursor_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+        const quotedCursor = quoteIdent(cursorName);
+        try {
+            await client.query('BEGIN');
+            await client.query(`DECLARE ${quotedCursor} NO SCROLL CURSOR FOR ${deferred.sql}`, deferred.params);
+            while (true) {
+                const batch = await client.query(`FETCH ${batchSize} FROM ${quotedCursor}`);
+                if (batch.rows.length === 0)
+                    break;
+                for (const row of batch.rows) {
+                    yield (hasRelations ? this.parseNestedRow(row, this.table) : this.parseRow(row, this.table));
+                }
+                if (batch.rows.length < batchSize)
+                    break;
+            }
+            await client.query(`CLOSE ${quotedCursor}`);
+            await client.query('COMMIT');
+        }
+        catch (err) {
+            // Rollback on error (also closes cursor implicitly)
+            try {
+                await client.query('ROLLBACK');
+            }
+            catch {
+                // Connection may already be broken — ignore rollback error
+            }
+            // Wrap pg constraint errors so streaming surfaces typed errors like the rest of the API
+            throw wrapPgError(err);
+        }
+        finally {
+            client.release();
+        }
+    }
+    // -------------------------------------------------------------------------
     // findFirst — like findMany but returns a single row or null
     // -------------------------------------------------------------------------
     async findFirst(args) {
         return this.executeWithMiddleware('findFirst', (args ?? {}), async () => {
             const deferred = this.buildFindFirst(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args?.timeout);
             return deferred.transform(result);
         });
     }
@@ -380,7 +460,7 @@ export class QueryInterface {
     async findFirstOrThrow(args) {
         return this.executeWithMiddleware('findFirstOrThrow', (args ?? {}), async () => {
             const deferred = this.buildFindFirstOrThrow(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args?.timeout);
             return deferred.transform(result);
         });
     }
@@ -392,7 +472,11 @@ export class QueryInterface {
             transform: (result) => {
                 const row = inner.transform(result);
                 if (row === null) {
-                    throw new Error('Record not found');
+                    throw new NotFoundError({
+                        table: this.table,
+                        where: args?.where,
+                        operation: 'findFirstOrThrow',
+                    });
                 }
                 return row;
             },
@@ -405,7 +489,7 @@ export class QueryInterface {
     async findUniqueOrThrow(args) {
         return this.executeWithMiddleware('findUniqueOrThrow', args, async () => {
             const deferred = this.buildFindUniqueOrThrow(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout);
             return deferred.transform(result);
         });
     }
@@ -417,7 +501,11 @@ export class QueryInterface {
             transform: (result) => {
                 const row = inner.transform(result);
                 if (row === null) {
-                    throw new Error('Record not found');
+                    throw new NotFoundError({
+                        table: this.table,
+                        where: args.where,
+                        operation: 'findUniqueOrThrow',
+                    });
                 }
                 return row;
             },
@@ -430,7 +518,7 @@ export class QueryInterface {
     async create(args) {
         return this.executeWithMiddleware('create', args, async () => {
             const deferred = this.buildCreate(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout);
             return deferred.transform(result);
         });
     }
@@ -445,8 +533,13 @@ export class QueryInterface {
             params,
             transform: (result) => {
                 const row = result.rows[0];
-                if (!row)
-                    throw new Error('[turbine] Expected a row but query returned none');
+                if (!row) {
+                    throw new NotFoundError({
+                        table: this.table,
+                        operation: 'create',
+                        message: `[turbine] create on "${this.table}" returned no row from RETURNING * — this should never happen.`,
+                    });
+                }
                 return this.parseRow(row, this.table);
             },
             tag: `${this.table}.create`,
@@ -458,7 +551,7 @@ export class QueryInterface {
     async createMany(args) {
         return this.executeWithMiddleware('createMany', args, async () => {
             const deferred = this.buildCreateMany(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout);
             return deferred.transform(result);
         });
     }
@@ -505,29 +598,32 @@ export class QueryInterface {
     async update(args) {
         return this.executeWithMiddleware('update', args, async () => {
             const deferred = this.buildUpdate(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout);
             return deferred.transform(result);
         });
     }
     buildUpdate(args) {
         const setEntries = Object.entries(args.data).filter(([, v]) => v !== undefined);
-        // Build SET params first
+        // Build SET params first (supports atomic operators: set/increment/decrement/multiply/divide)
         const params = [];
-        const setClauses = setEntries.map(([k, v]) => {
-            params.push(v);
-            return `${this.toSqlColumn(k)} = $${params.length}`;
-        });
+        const setClauses = setEntries.map(([k, v]) => this.buildSetClause(k, v, params));
         // Build WHERE using the shared params array (continues numbering after SET params)
         const whereClause = this.buildWhereClause(args.where, params);
         const whereSql = whereClause ? ` WHERE ${whereClause}` : '';
+        this.assertMutationHasPredicate('update', whereSql, args.allowFullTableScan);
         const sql = `UPDATE ${quoteIdent(this.table)} SET ${setClauses.join(', ')}${whereSql} RETURNING *`;
         return {
             sql,
             params,
             transform: (result) => {
                 const row = result.rows[0];
-                if (!row)
-                    throw new Error('[turbine] Expected a row but query returned none');
+                if (!row) {
+                    throw new NotFoundError({
+                        table: this.table,
+                        where: args.where,
+                        operation: 'update',
+                    });
+                }
                 return this.parseRow(row, this.table);
             },
             tag: `${this.table}.update`,
@@ -539,20 +635,26 @@ export class QueryInterface {
     async delete(args) {
         return this.executeWithMiddleware('delete', args, async () => {
             const deferred = this.buildDelete(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout);
             return deferred.transform(result);
         });
     }
     buildDelete(args) {
         const { sql: whereSql, params } = this.buildWhere(args.where);
+        this.assertMutationHasPredicate('delete', whereSql, args.allowFullTableScan);
         const sql = `DELETE FROM ${quoteIdent(this.table)}${whereSql} RETURNING *`;
         return {
             sql,
             params,
             transform: (result) => {
                 const row = result.rows[0];
-                if (!row)
-                    throw new Error('[turbine] Expected a row but query returned none');
+                if (!row) {
+                    throw new NotFoundError({
+                        table: this.table,
+                        where: args.where,
+                        operation: 'delete',
+                    });
+                }
                 return this.parseRow(row, this.table);
             },
             tag: `${this.table}.delete`,
@@ -564,7 +666,7 @@ export class QueryInterface {
     async upsert(args) {
         return this.executeWithMiddleware('upsert', args, async () => {
             const deferred = this.buildUpsert(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout);
             return deferred.transform(result);
         });
     }
@@ -595,8 +697,14 @@ export class QueryInterface {
             params,
             transform: (result) => {
                 const row = result.rows[0];
-                if (!row)
-                    throw new Error('[turbine] Expected a row but query returned none');
+                if (!row) {
+                    throw new NotFoundError({
+                        table: this.table,
+                        where: args.where,
+                        operation: 'upsert',
+                        message: `[turbine] upsert on "${this.table}" returned no row from RETURNING * — this should never happen.`,
+                    });
+                }
                 return this.parseRow(row, this.table);
             },
             tag: `${this.table}.upsert`,
@@ -608,21 +716,19 @@ export class QueryInterface {
     async updateMany(args) {
         return this.executeWithMiddleware('updateMany', args, async () => {
             const deferred = this.buildUpdateMany(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout);
             return deferred.transform(result);
         });
     }
     buildUpdateMany(args) {
         const setEntries = Object.entries(args.data).filter(([, v]) => v !== undefined);
-        // Build SET params first
+        // Build SET params first (supports atomic operators: set/increment/decrement/multiply/divide)
         const params = [];
-        const setClauses = setEntries.map(([k, v]) => {
-            params.push(v);
-            return `${this.toSqlColumn(k)} = $${params.length}`;
-        });
+        const setClauses = setEntries.map(([k, v]) => this.buildSetClause(k, v, params));
         // Build WHERE using the shared params array (continues numbering after SET params)
         const whereClause = this.buildWhereClause(args.where, params);
         const whereSql = whereClause ? ` WHERE ${whereClause}` : '';
+        this.assertMutationHasPredicate('updateMany', whereSql, args.allowFullTableScan);
         const sql = `UPDATE ${quoteIdent(this.table)} SET ${setClauses.join(', ')}${whereSql}`;
         return {
             sql,
@@ -637,12 +743,13 @@ export class QueryInterface {
     async deleteMany(args) {
         return this.executeWithMiddleware('deleteMany', args, async () => {
             const deferred = this.buildDeleteMany(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout);
             return deferred.transform(result);
         });
     }
     buildDeleteMany(args) {
         const { sql: whereSql, params } = this.buildWhere(args.where);
+        this.assertMutationHasPredicate('deleteMany', whereSql, args.allowFullTableScan);
         const sql = `DELETE FROM ${quoteIdent(this.table)}${whereSql}`;
         return {
             sql,
@@ -657,14 +764,12 @@ export class QueryInterface {
     async count(args) {
         return this.executeWithMiddleware('count', (args ?? {}), async () => {
             const deferred = this.buildCount(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args?.timeout);
             return deferred.transform(result);
         });
     }
     buildCount(args) {
-        const { sql: whereSql, params } = args?.where
-            ? this.buildWhere(args.where)
-            : { sql: '', params: [] };
+        const { sql: whereSql, params } = args?.where ? this.buildWhere(args.where) : { sql: '', params: [] };
         const sql = `SELECT COUNT(*)::int AS count FROM ${quoteIdent(this.table)}${whereSql}`;
         return {
             sql,
@@ -679,16 +784,22 @@ export class QueryInterface {
     async groupBy(args) {
         return this.executeWithMiddleware('groupBy', args, async () => {
             const deferred = this.buildGroupBy(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout);
             return deferred.transform(result);
         });
     }
     buildGroupBy(args) {
+        const meta = this.schema.tables[this.table];
+        if (meta) {
+            for (const key of args.by) {
+                if (!(key in meta.columnMap)) {
+                    throw new ValidationError(`Unknown column "${key}" in groupBy for table "${this.table}"`);
+                }
+            }
+        }
         const groupColsRaw = args.by.map((k) => this.toColumn(k));
         const groupCols = groupColsRaw.map((c) => quoteIdent(c));
-        const { sql: whereSql, params } = args.where
-            ? this.buildWhere(args.where)
-            : { sql: '', params: [] };
+        const { sql: whereSql, params } = args.where ? this.buildWhere(args.where) : { sql: '', params: [] };
         // Build SELECT expressions: group-by columns + aggregate functions
         const selectExprs = [...groupCols];
         // _count
@@ -701,7 +812,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._sum)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`SUM(${quoteIdent(col)}) AS _sum_${col}`);
+                    selectExprs.push(`SUM(${quoteIdent(col)}) AS ${quoteIdent('_sum_' + col)}`);
                 }
             }
         }
@@ -710,7 +821,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._avg)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`AVG(${quoteIdent(col)})::float AS _avg_${col}`);
+                    selectExprs.push(`AVG(${quoteIdent(col)})::float AS ${quoteIdent('_avg_' + col)}`);
                 }
             }
         }
@@ -719,7 +830,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._min)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MIN(${quoteIdent(col)}) AS _min_${col}`);
+                    selectExprs.push(`MIN(${quoteIdent(col)}) AS ${quoteIdent('_min_' + col)}`);
                 }
             }
         }
@@ -728,7 +839,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._max)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MAX(${quoteIdent(col)}) AS _max_${col}`);
+                    selectExprs.push(`MAX(${quoteIdent(col)}) AS ${quoteIdent('_max_' + col)}`);
                 }
             }
         }
@@ -806,14 +917,31 @@ export class QueryInterface {
     async aggregate(args) {
         return this.executeWithMiddleware('aggregate', args, async () => {
             const deferred = this.buildAggregate(args);
-            const result = await this.pool.query(deferred.sql, deferred.params);
+            const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout);
             return deferred.transform(result);
         });
     }
     buildAggregate(args) {
-        const { sql: whereSql, params } = args.where
-            ? this.buildWhere(args.where)
-            : { sql: '', params: [] };
+        const { sql: whereSql, params } = args.where ? this.buildWhere(args.where) : { sql: '', params: [] };
+        const meta = this.schema.tables[this.table];
+        if (meta) {
+            for (const group of [args._sum, args._avg, args._min, args._max]) {
+                if (group && typeof group === 'object') {
+                    for (const key of Object.keys(group)) {
+                        if (!(key in meta.columnMap)) {
+                            throw new ValidationError(`Unknown column "${key}" in aggregate for table "${this.table}"`);
+                        }
+                    }
+                }
+            }
+            if (args._count && typeof args._count === 'object') {
+                for (const key of Object.keys(args._count)) {
+                    if (!(key in meta.columnMap)) {
+                        throw new ValidationError(`Unknown column "${key}" in aggregate for table "${this.table}"`);
+                    }
+                }
+            }
+        }
         const selectExprs = [];
         // _count
         if (args._count === true) {
@@ -823,7 +951,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._count)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`COUNT(${quoteIdent(col)})::int AS _count_${col}`);
+                    selectExprs.push(`COUNT(${quoteIdent(col)})::int AS ${quoteIdent('_count_' + col)}`);
                 }
             }
         }
@@ -832,7 +960,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._sum)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`SUM(${quoteIdent(col)}) AS _sum_${col}`);
+                    selectExprs.push(`SUM(${quoteIdent(col)}) AS ${quoteIdent('_sum_' + col)}`);
                 }
             }
         }
@@ -841,7 +969,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._avg)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`AVG(${quoteIdent(col)})::float AS _avg_${col}`);
+                    selectExprs.push(`AVG(${quoteIdent(col)})::float AS ${quoteIdent('_avg_' + col)}`);
                 }
             }
         }
@@ -850,7 +978,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._min)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MIN(${quoteIdent(col)}) AS _min_${col}`);
+                    selectExprs.push(`MIN(${quoteIdent(col)}) AS ${quoteIdent('_min_' + col)}`);
                 }
             }
         }
@@ -859,7 +987,7 @@ export class QueryInterface {
             for (const [field, enabled] of Object.entries(args._max)) {
                 if (enabled) {
                     const col = this.toColumn(field);
-                    selectExprs.push(`MAX(${quoteIdent(col)}) AS _max_${col}`);
+                    selectExprs.push(`MAX(${quoteIdent(col)}) AS ${quoteIdent('_max_' + col)}`);
                 }
             }
         }
@@ -971,6 +1099,67 @@ export class QueryInterface {
     toSqlColumn(field) {
         return quoteIdent(this.toColumn(field));
     }
+    /**
+     * Build a single SET clause entry for update/updateMany.
+     *
+     * Supports plain values and atomic operator objects ({ set, increment,
+     * decrement, multiply, divide }). An operator object is detected ONLY when
+     * it has EXACTLY one key that is one of the 5 operator keys — this avoids
+     * misinterpreting JSON column values like `{ set: 'x' }` as operators
+     * (real operator objects always have exactly one key, and a plain JSON
+     * payload that happens to have a single `set` key is extremely unusual).
+     * Multi-key objects are always treated as plain (JSON) values.
+     *
+     * Returns the SQL fragment (e.g., `"view_count" = "view_count" + $3`) and
+     * pushes any required params onto the shared params array so that WHERE
+     * clause numbering continues correctly afterward.
+     */
+    buildSetClause(key, value, params) {
+        const col = this.toSqlColumn(key);
+        // Detect atomic-operator object: plain object (not null, not array, not
+        // Date, not Buffer) with EXACTLY one key matching an operator name.
+        if (value !== null &&
+            typeof value === 'object' &&
+            !Array.isArray(value) &&
+            !(value instanceof Date) &&
+            !Buffer.isBuffer(value)) {
+            const v = value;
+            const keys = Object.keys(v);
+            if (keys.length === 1 && UPDATE_OPERATOR_KEYS.has(keys[0])) {
+                const op = keys[0];
+                const opValue = v[op];
+                if (op === 'set') {
+                    params.push(opValue);
+                    return `${col} = $${params.length}`;
+                }
+                // Arithmetic operators: must be finite numbers
+                if (typeof opValue !== 'number' || !Number.isFinite(opValue)) {
+                    throw new ValidationError(`[turbine] update operator "${op}" on "${this.table}.${key}" requires a finite number, got ${typeof opValue}`);
+                }
+                if (op === 'increment') {
+                    params.push(opValue);
+                    return `${col} = ${col} + $${params.length}`;
+                }
+                if (op === 'decrement') {
+                    params.push(opValue);
+                    return `${col} = ${col} - $${params.length}`;
+                }
+                if (op === 'multiply') {
+                    params.push(opValue);
+                    return `${col} = ${col} * $${params.length}`;
+                }
+                if (op === 'divide') {
+                    params.push(opValue);
+                    return `${col} = ${col} / $${params.length}`;
+                }
+            }
+            // Fall through: multi-key objects or non-operator single-key objects
+            // are treated as plain values (e.g., JSONB column payloads).
+        }
+        // Plain value (including null, Date, Buffer, arrays, JSON objects)
+        params.push(value);
+        return `${col} = $${params.length}`;
+    }
     /** Build WHERE clause from a where object (supports operators, NULL, OR) */
     buildWhere(where) {
         const params = [];
@@ -979,6 +1168,22 @@ export class QueryInterface {
             return { sql: '', params: [] };
         return { sql: ` WHERE ${clause}`, params };
     }
+    /**
+     * Refuse mutations with an empty predicate unless explicitly opted in.
+     *
+     * An empty `where` (e.g. `{}` or `{ id: undefined }`) resolves to a
+     * mutation with no filter — a common footgun when a caller's filter
+     * value accidentally resolves to `undefined`. This guard throws
+     * `ValidationError` in that case unless `allowFullTableScan: true`.
+     */
+    assertMutationHasPredicate(operation, whereSql, allowFullTableScan) {
+        if (whereSql.length > 0)
+            return;
+        if (allowFullTableScan === true)
+            return;
+        throw new ValidationError(`[turbine] ${operation} on "${this.table}" refused: the \`where\` clause is empty. ` +
+            `Pass \`allowFullTableScan: true\` to opt in, or check that your filter values are defined.`);
+    }
     /**
      * Build the inner WHERE expression (without the WHERE keyword).
      * Returns null if no conditions exist.
@@ -1197,24 +1402,30 @@ export class QueryInterface {
             params.push(op.notIn);
             clauses.push(`${column} != ALL($${params.length})`);
         }
+        // Use ILIKE for case-insensitive mode, LIKE otherwise
+        const likeOp = op.mode === 'insensitive' ? 'ILIKE' : 'LIKE';
         if (op.contains !== undefined) {
             params.push(`%${escapeLike(op.contains)}%`);
-            clauses.push(`${column} LIKE $${params.length} ESCAPE '\\'`);
+            clauses.push(`${column} ${likeOp} $${params.length} ESCAPE '\\'`);
         }
         if (op.startsWith !== undefined) {
             params.push(`${escapeLike(op.startsWith)}%`);
-            clauses.push(`${column} LIKE $${params.length} ESCAPE '\\'`);
+            clauses.push(`${column} ${likeOp} $${params.length} ESCAPE '\\'`);
         }
         if (op.endsWith !== undefined) {
             params.push(`%${escapeLike(op.endsWith)}`);
-            clauses.push(`${column} LIKE $${params.length} ESCAPE '\\'`);
+            clauses.push(`${column} ${likeOp} $${params.length} ESCAPE '\\'`);
         }
         return clauses;
     }
     /** Build ORDER BY clause from an object */
     buildOrderBy(orderBy) {
+        const meta = this.schema.tables[this.table];
         return Object.entries(orderBy)
             .map(([key, dir]) => {
+            if (meta && !(key in meta.columnMap)) {
+                throw new ValidationError(`Unknown column "${key}" in orderBy for table "${this.table}"`);
+            }
             const safeDir = dir.toLowerCase() === 'desc' ? 'DESC' : 'ASC';
             return `${this.toSqlColumn(key)} ${safeDir}`;
         })
@@ -1249,22 +1460,6 @@ export class QueryInterface {
         }
         return parsed;
     }
-    /**
-     * Fast path: parse a flat row when the table has NO date columns.
-     * Only renames snake_case -> camelCase via the pre-computed reverseMap.
-     * Skips all date coercion checks — avoids Set.has() per field per row.
-     * Used by findUnique/findMany fast paths when hasNoDateColumns is true.
-     */
-    parseRowFast(row) {
-        const parsed = {};
-        const reverseMap = this.tableMeta.reverseColumnMap;
-        const keys = Object.keys(row);
-        for (let i = 0; i < keys.length; i++) {
-            const col = keys[i];
-            parsed[reverseMap[col] ?? col] = row[col];
-        }
-        return parsed;
-    }
     /** Parse a row that may contain JSON nested relation columns */
     parseNestedRow(row, table) {
         const parsed = this.parseRow(row, table);
@@ -1279,6 +1474,7 @@ export class QueryInterface {
                         parsed[relName] = JSON.parse(rawValue);
                     }
                     catch {
+                        console.warn(`[turbine] Warning: Failed to parse JSON for relation "${relName}" on table "${this.table}". Using raw value.`);
                         parsed[relName] = rawValue;
                     }
                 }
@@ -1298,52 +1494,173 @@ export class QueryInterface {
         return parsed;
     }
     /**
-     * Build a SELECT clause with nested relation subqueries.
+     * Build a SELECT clause that includes both base columns and nested relation subqueries.
+     *
+     * For each relation specified in the `with` clause, this method generates a correlated
+     * subquery using PostgreSQL's `json_agg(json_build_object(...))` pattern. The result
+     * is a single SQL SELECT clause that resolves the full object tree in one query --
+     * no N+1 problem.
+     *
+     * **How it works:**
+     * 1. Resolves the base columns for the root table (all columns, or a subset via `columnsList`).
+     * 2. Iterates over each key in the `with` clause, looking up the relation definition.
+     * 3. For each relation, delegates to {@link buildRelationSubquery} to generate a
+     *    correlated subquery that returns JSON (array for hasMany, object for belongsTo/hasOne).
+     * 4. Each subquery is aliased as the relation name in the final SELECT.
+     *
+     * **aliasCounter:** A shared `{ n: number }` object is passed through all nesting levels.
+     * Each call to `buildRelationSubquery` increments it to produce unique table aliases
+     * (`t0`, `t1`, `t2`, ...) across arbitrarily deep relation trees, preventing alias
+     * collisions in the generated SQL.
      *
-     * Uses json_build_object + json_agg — the same approach as the raw-pg benchmark
-     * queries. Generates a single SQL statement that resolves the full object tree.
+     * **Example output:**
+     * ```sql
+     * "users"."id", "users"."name", "users"."email",
+     * (SELECT COALESCE(json_agg(json_build_object('id', t0."id", 'title', t0."title")), '[]'::json)
+     *   FROM "posts" t0 WHERE t0."user_id" = "users"."id") AS "posts"
+     * ```
      *
-     * Nested where values are parameterized via the shared params array to prevent
-     * SQL injection.
+     * @param table - The root table name (e.g. `"users"`).
+     * @param withClause - An object mapping relation names to their include specs
+     *                     (`true` for default inclusion, or `WithOptions` for select/omit/where/orderBy/limit).
+     * @param params - Shared parameter array for parameterized values (`$1`, `$2`, ...).
+     *                 Nested where/limit values are pushed here to prevent SQL injection.
+     * @param columnsList - Optional subset of columns to include in the SELECT. When `null`
+     *                      or omitted, all columns from the table's schema metadata are used.
+     * @param depth - Current nesting depth, passed through to {@link buildRelationSubquery}
+     *                for circular-relation detection. Defaults to `0` at the top level.
+     * @param path - Breadcrumb trail of relation names traversed so far, used in error
+     *               messages when circular or too-deep nesting is detected.
+     * @returns A complete SELECT clause string (without the `SELECT` keyword) containing
+     *          base columns and relation subqueries.
      */
-    buildSelectWithRelations(table, withClause, params, columnsList) {
+    buildSelectWithRelations(table, withClause, params, columnsList, depth, path) {
         const meta = this.schema.tables[table];
         if (!meta)
-            throw new Error(`[turbine] Unknown table "${table}"`);
+            throw new ValidationError(`[turbine] Unknown table "${table}"`);
         const cols = columnsList ?? meta.allColumns;
         const qtbl = quoteIdent(table);
-        const baseCols = cols
-            .map((col) => `${qtbl}.${quoteIdent(col)}`)
-            .join(', ');
+        const baseCols = cols.map((col) => `${qtbl}.${quoteIdent(col)}`).join(', ');
         const relationSelects = [];
         const aliasCounter = { n: 0 };
         for (const [relName, relSpec] of Object.entries(withClause)) {
             const relDef = meta.relations[relName];
             if (!relDef) {
-                throw new Error(`[turbine] Unknown relation "${relName}" on table "${table}". ` +
+                throw new RelationError(`[turbine] Unknown relation "${relName}" on table "${table}". ` +
                     `Available: ${Object.keys(meta.relations).join(', ')}`);
             }
             // The main table is not aliased, so pass table name as parentRef
-            const subquery = this.buildRelationSubquery(relDef, relSpec, params, table, aliasCounter);
+            const subquery = this.buildRelationSubquery(relDef, relSpec, params, table, aliasCounter, depth, path);
             relationSelects.push(`(${subquery}) AS ${quoteIdent(relName)}`);
         }
         return [baseCols, ...relationSelects].join(', ');
     }
     /**
-     * Build a json_agg subquery for a relation.
+     * Generate a correlated subquery that returns JSON for a single relation.
+     *
+     * This is the core of Turbine's single-query nested relation strategy. For a given
+     * relation (e.g. `posts` on a `users` query), it produces a self-contained SQL subquery
+     * that PostgreSQL evaluates per parent row, returning either a JSON array (hasMany) or
+     * a single JSON object (belongsTo / hasOne).
+     *
+     * ### Algorithm overview
+     *
+     * 1. **Alias generation:** Allocates a unique alias (`t0`, `t1`, ...) from the shared
+     *    `aliasCounter` so that deeply nested subqueries never collide.
+     *
+     * 2. **Column resolution:** Honors `select` / `omit` options to control which columns
+     *    appear in the output JSON.
+     *
+     * 3. **`json_build_object`:** Builds a JSON object for each row by mapping camelCase
+     *    field names to their column values:
+     *    ```sql
+     *    json_build_object('id', t0."id", 'title', t0."title", 'createdAt', t0."created_at")
+     *    ```
+     *
+     * 4. **`json_agg` wrapping (hasMany):** For one-to-many relations, wraps the
+     *    `json_build_object` call in `json_agg(...)` to aggregate all matching child rows
+     *    into a JSON array. Uses `COALESCE(..., '[]'::json)` so the result is never NULL.
+     *    For belongsTo / hasOne, no aggregation is used -- just the single JSON object
+     *    with `LIMIT 1`.
      *
-     * All user-supplied values in nested where clauses are parameterized
-     * through the shared params array — no string interpolation.
+     * 5. **Correlation (WHERE clause):** Links the subquery to the parent row:
+     *    - **hasMany:** `alias.foreignKey = parentRef.referenceKey`
+     *      (e.g. `t0."user_id" = "users"."id"` -- child FK points to parent PK)
+     *    - **belongsTo / hasOne:** `alias.referenceKey = parentRef.foreignKey`
+     *      (e.g. `t0."id" = "posts"."author_id"` -- parent FK points to child PK)
      *
-     * @param parentRef - The alias (or table name) of the parent in the outer query.
-     *                    Used for the correlated WHERE clause: `child.fk = parentRef.pk`.
-     * @param aliasCounter - Shared counter for generating unique aliases across nested levels.
+     * 6. **Recursion:** If the spec includes a nested `with` clause, this method calls
+     *    itself recursively for each nested relation, passing the current alias as
+     *    `parentRef`. The nested subquery appears as an additional key in the
+     *    `json_build_object` call, wrapped in `COALESCE(..., '[]'::json)`.
+     *    Depth is incremented and capped at 10 to guard against circular relations.
+     *
+     * 7. **LIMIT / ORDER BY wrapping:** For hasMany relations with `limit` or `orderBy`,
+     *    the query is restructured into a two-level form:
+     *    ```sql
+     *    SELECT COALESCE(json_agg(json_build_object(...)), '[]'::json)
+     *    FROM (
+     *      SELECT t0.* FROM "posts" t0
+     *      WHERE t0."user_id" = "users"."id"
+     *      ORDER BY t0."created_at" DESC
+     *      LIMIT $1
+     *    ) t0i
+     *    ```
+     *    This ensures LIMIT and ORDER BY apply to the raw rows *before* `json_agg`
+     *    aggregation. Without the inner subquery, LIMIT would be meaningless because
+     *    `json_agg` produces a single aggregated row.
+     *
+     * 8. **Parameter threading:** All user-supplied values (where filters, limit) are
+     *    pushed to the shared `params` array with `$N` placeholders. No string
+     *    interpolation of user data ever occurs -- all identifiers go through
+     *    `quoteIdent()` and all values are parameterized.
+     *
+     * ### Example output (hasMany with nested relation)
+     * ```sql
+     * SELECT COALESCE(json_agg(json_build_object(
+     *   'id', t0."id",
+     *   'title', t0."title",
+     *   'comments', COALESCE((
+     *     SELECT COALESCE(json_agg(json_build_object('id', t1."id", 'body', t1."body")), '[]'::json)
+     *     FROM "comments" t1 WHERE t1."post_id" = t0."id"
+     *   ), '[]'::json)
+     * )), '[]'::json) FROM "posts" t0 WHERE t0."user_id" = "users"."id"
+     * ```
+     *
+     * @param relDef - The relation definition from schema metadata (contains `to`, `type`,
+     *                 `foreignKey`, `referenceKey`).
+     * @param spec - Either `true` (include with defaults) or a `WithOptions` object that
+     *               can specify `select`, `omit`, `where`, `orderBy`, `limit`, and nested `with`.
+     * @param params - Shared parameter array. User-supplied values are pushed here and
+     *                 referenced as `$1`, `$2`, etc. in the generated SQL.
+     * @param parentRef - The alias (e.g. `"t0"`) or table name (e.g. `"users"`) of the
+     *                    parent query. Used to build the correlated WHERE clause that ties
+     *                    child rows to their parent row.
+     * @param aliasCounter - Shared mutable counter (`{ n: number }`) for generating unique
+     *                       table aliases (`t0`, `t1`, `t2`, ...) across all nesting levels.
+     *                       Each call increments `n` by 1.
+     * @param depth - Current nesting depth (starts at `0`). Incremented on each recursive
+     *                call. If it reaches 10, a {@link CircularRelationError} is thrown.
+     * @param path - Breadcrumb trail of relation/table names traversed so far
+     *               (e.g. `["users", "posts", "comments"]`). Used in the error message
+     *               when circular or too-deep nesting is detected.
+     * @returns A complete SQL subquery string (without surrounding parentheses) that
+     *          evaluates to a JSON array (hasMany) or a JSON object (belongsTo/hasOne).
      */
-    buildRelationSubquery(relDef, spec, params, parentRef, aliasCounter) {
+    buildRelationSubquery(relDef, spec, params, parentRef, aliasCounter, depth, path) {
+        const currentDepth = depth ?? 0;
+        const currentPath = path ?? [this.table];
         const targetTable = relDef.to;
+        // Hard depth cap — the `with` clause is a finite JSON structure so users can't
+        // create true infinite recursion, but extremely deep nesting (10+ levels) produces
+        // unmanageably large SQL. Back-references (e.g. posts → user → posts) are allowed
+        // since they are legitimate queries (Prisma supports the same pattern).
+        if (currentDepth >= 10) {
+            throw new CircularRelationError([...currentPath, targetTable]);
+        }
         const targetMeta = this.schema.tables[targetTable];
         if (!targetMeta)
-            throw new Error(`[turbine] Unknown relation target "${targetTable}"`);
+            throw new RelationError(`[turbine] Unknown relation target "${targetTable}"`);
         // Generate a unique alias: t0, t1, t2, ...
         const alias = `t${aliasCounter.n++}`;
         // Resolve which columns to include based on select/omit
@@ -1361,18 +1678,24 @@ export class QueryInterface {
             targetColumns = targetMeta.allColumns.filter((col) => !omittedFields.has(col));
         }
         // Build json_build_object pairs for resolved columns
-        const jsonPairs = targetColumns.map((col) => `'${targetMeta.reverseColumnMap[col] ?? snakeToCamel(col)}', ${alias}.${quoteIdent(col)}`);
-        // Nested relations?
-        if (spec !== true && spec.with) {
+        const jsonPairs = targetColumns.map((col) => `'${escSingleQuote(targetMeta.reverseColumnMap[col] ?? snakeToCamel(col))}', ${alias}.${quoteIdent(col)}`);
+        // Determine if this hasMany will take the wrapped subquery path (LIMIT or ORDER BY).
+        // When wrapping, nested relations are built in the wrapped path referencing innerAlias,
+        // so we must NOT build them here (they would push orphaned params).
+        const willWrap = relDef.type === 'hasMany' && spec !== true && (spec.limit !== undefined || spec.orderBy !== undefined);
+        // Nested relations — only in the non-wrapped path (wrapped path builds them separately)
+        if (!willWrap && spec !== true && spec.with) {
             for (const [nestedRelName, nestedSpec] of Object.entries(spec.with)) {
                 const nestedRelDef = targetMeta.relations[nestedRelName];
                 if (!nestedRelDef) {
-                    throw new Error(`[turbine] Unknown relation "${nestedRelName}" on table "${targetTable}". ` +
+                    throw new RelationError(`[turbine] Unknown relation "${nestedRelName}" on table "${targetTable}". ` +
                         `Available: ${Object.keys(targetMeta.relations).join(', ')}`);
                 }
                 // Recursively build nested subquery, passing THIS alias as the parent reference
-                const nestedSubquery = this.buildRelationSubquery(nestedRelDef, nestedSpec, params, alias, aliasCounter);
-                jsonPairs.push(`'${nestedRelName}', COALESCE((${nestedSubquery}), '[]'::json)`);
+                const nestedSubquery = this.buildRelationSubquery(nestedRelDef, nestedSpec, params, alias, aliasCounter, currentDepth + 1, [...currentPath, relDef.name]);
+                // Use '[]'::json for hasMany (empty array), NULL for belongsTo/hasOne (no object)
+                const fallback = nestedRelDef.type === 'hasMany' ? "'[]'::json" : 'NULL';
+                jsonPairs.push(`'${escSingleQuote(nestedRelName)}', COALESCE((${nestedSubquery}), ${fallback})`);
             }
         }
         const jsonObj = `json_build_object(${jsonPairs.join(', ')})`;
@@ -1386,7 +1709,7 @@ export class QueryInterface {
                 .map(([k, dir]) => {
                 const col = camelToSnake(k);
                 if (!targetMeta.allColumns.includes(col)) {
-                    throw new Error(`[turbine] Unknown column "${k}" in orderBy for table "${targetTable}"`);
+                    throw new ValidationError(`[turbine] Unknown column "${k}" in orderBy for table "${targetTable}"`);
                 }
                 const safeDir = dir.toLowerCase() === 'desc' ? 'DESC' : 'ASC';
                 return `${alias}.${quoteIdent(col)} ${safeDir}`;
@@ -1409,7 +1732,7 @@ export class QueryInterface {
             for (const [k, v] of Object.entries(spec.where)) {
                 const col = camelToSnake(k);
                 if (!targetMeta.allColumns.includes(col)) {
-                    throw new Error(`[turbine] Unknown column "${k}" in where for table "${targetTable}"`);
+                    throw new ValidationError(`[turbine] Unknown column "${k}" in where for table "${targetTable}"`);
                 }
                 params.push(v);
                 whereClause += ` AND ${alias}.${quoteIdent(col)} = $${params.length}`;
@@ -1430,15 +1753,18 @@ export class QueryInterface {
                 // Inner SELECT always needs all columns for WHERE/ORDER to work; json_build_object filters later
                 const innerSql = `SELECT ${targetMeta.allColumns.map((c) => `${alias}.${quoteIdent(c)}`).join(', ')} FROM ${qTarget} ${alias} WHERE ${whereClause}${orderClause}${limitClause}`;
                 // For the json_build_object, reference the inner alias — only include resolved columns
-                const innerJsonPairs = targetColumns.map((col) => `'${targetMeta.reverseColumnMap[col] ?? snakeToCamel(col)}', ${innerAlias}.${quoteIdent(col)}`);
-                // Re-add nested relation subqueries referencing innerAlias
+                const innerJsonPairs = targetColumns.map((col) => `'${escSingleQuote(targetMeta.reverseColumnMap[col] ?? snakeToCamel(col))}', ${innerAlias}.${quoteIdent(col)}`);
+                // Build nested relation subqueries referencing innerAlias
                 if (spec !== true && spec.with) {
-                    for (const [nestedRelName] of Object.entries(spec.with)) {
+                    for (const [nestedRelName, nestedSpec] of Object.entries(spec.with)) {
                         const nestedRelDef = targetMeta.relations[nestedRelName];
-                        if (nestedRelDef) {
-                            const nestedSub = this.buildRelationSubquery(nestedRelDef, spec.with[nestedRelName], params, innerAlias, aliasCounter);
-                            innerJsonPairs.push(`'${nestedRelName}', COALESCE((${nestedSub}), '[]'::json)`);
+                        if (!nestedRelDef) {
+                            throw new RelationError(`[turbine] Unknown relation "${nestedRelName}" on table "${targetTable}". ` +
+                                `Available: ${Object.keys(targetMeta.relations).join(', ')}`);
                         }
+                        const nestedSub = this.buildRelationSubquery(nestedRelDef, nestedSpec, params, innerAlias, aliasCounter, currentDepth + 1, [...currentPath, relDef.name]);
+                        const fallback = nestedRelDef.type === 'hasMany' ? "'[]'::json" : 'NULL';
+                        innerJsonPairs.push(`'${escSingleQuote(nestedRelName)}', COALESCE((${nestedSub}), ${fallback})`);
                     }
                 }
                 const innerJsonObj = `json_build_object(${innerJsonPairs.join(', ')})`;
@@ -1452,10 +1778,10 @@ export class QueryInterface {
     /**
      * Get the Postgres type for a column (e.g. 'jsonb', 'text', '_int4').
      * Used to detect JSONB/array columns for specialized operators.
+     * Uses pre-computed Map for O(1) lookup instead of linear scan.
      */
     getColumnPgType(column) {
-        const col = this.tableMeta.columns.find((c) => c.name === column);
-        return col?.pgType ?? 'text';
+        return this.columnPgTypeMap.get(column) ?? 'text';
     }
     /**
      * Get the Postgres base element type for an array column.
@@ -1542,13 +1868,15 @@ export class QueryInterface {
         }
         return clauses;
     }
-    /** Get the Postgres array type for a column (used by UNNEST in createMany) */
+    /**
+     * Get the Postgres array type for a column (used by UNNEST in createMany).
+     * Uses pre-computed Map for O(1) lookup instead of linear scan.
+     */
     getColumnArrayType(column) {
-        // Find the column metadata
-        const col = this.tableMeta.columns.find((c) => c.name === column);
-        if (col)
-            return col.pgArrayType;
-        // Fallback heuristic
+        const arrayType = this.columnArrayTypeMap.get(column);
+        if (arrayType)
+            return arrayType;
+        // Fallback heuristic for unknown columns
         if (column === 'id' || column.endsWith('_id'))
             return 'bigint[]';
         if (column.endsWith('_at'))