npm - turbine-orm - Versions diffs - 0.49.0 → 0.50.0 - Mend

turbine-orm 0.49.0 → 0.50.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (157) hide show

package/README.md +122 -39
package/dist/cjs/adapters/cockroachdb.d.ts +39 -0
package/dist/cjs/adapters/index.d.ts +110 -0
package/dist/cjs/adapters/yugabytedb.d.ts +51 -0
package/dist/cjs/cli/config.d.ts +181 -0
package/dist/cjs/cli/config.js +32 -6
package/dist/cjs/cli/destructive.d.ts +38 -0
package/dist/cjs/cli/index.d.ts +359 -0
package/dist/cjs/cli/index.js +228 -56
package/dist/cjs/cli/loader.d.ts +61 -0
package/dist/cjs/cli/mcp.d.ts +42 -0
package/dist/cjs/cli/migrate.d.ts +356 -0
package/dist/cjs/cli/migrate.js +131 -40
package/dist/cjs/cli/observe-ui.d.ts +1 -0
package/dist/cjs/cli/observe-ui.js +14 -5
package/dist/cjs/cli/observe.d.ts +25 -0
package/dist/cjs/cli/observe.js +49 -12
package/dist/cjs/cli/pii-tags.d.ts +53 -0
package/dist/cjs/cli/prisma-report.d.ts +33 -0
package/dist/cjs/cli/prisma-report.js +73 -0
package/dist/cjs/cli/prisma-resolve.d.ts +106 -0
package/dist/cjs/cli/prisma-resolve.js +1 -0
package/dist/cjs/cli/prisma-schema.d.ts +176 -0
package/dist/cjs/cli/prisma-schema.js +82 -4
package/dist/cjs/cli/rate-limit.d.ts +32 -0
package/dist/cjs/cli/rate-limit.js +45 -0
package/dist/cjs/cli/studio-demo.d.ts +43 -0
package/dist/cjs/cli/studio-ui.generated.d.ts +1 -0
package/dist/cjs/cli/studio.d.ts +207 -0
package/dist/cjs/cli/studio.js +136 -71
package/dist/cjs/cli/ui.d.ts +73 -0
package/dist/cjs/cli/ui.js +51 -9
package/dist/cjs/client.d.ts +837 -0
package/dist/cjs/client.js +3 -0
package/dist/cjs/dialect.d.ts +516 -0
package/dist/cjs/dialect.js +37 -12
package/dist/cjs/errors.d.ts +370 -0
package/dist/cjs/generate.d.ts +137 -0
package/dist/cjs/generate.js +39 -6
package/dist/cjs/index-advisor.d.ts +153 -0
package/dist/cjs/index-stats.d.ts +384 -0
package/dist/cjs/index.d.ts +55 -0
package/dist/cjs/index.js +7 -2
package/dist/cjs/introspect.d.ts +269 -0
package/dist/cjs/mssql.d.ts +232 -0
package/dist/cjs/mssql.js +6 -0
package/dist/cjs/mysql.d.ts +173 -0
package/dist/cjs/mysql.js +16 -0
package/dist/cjs/nested-write.d.ts +96 -0
package/dist/cjs/nested-write.js +414 -24
package/dist/cjs/observe.d.ts +115 -0
package/dist/cjs/optional-peer-import.d.cts +72 -0
package/dist/cjs/pipeline-submittable.d.ts +93 -0
package/dist/cjs/pipeline.d.ts +71 -0
package/dist/cjs/powdb-introspect.d.ts +84 -0
package/dist/cjs/powdb.d.ts +931 -0
package/dist/cjs/powdb.js +106 -21
package/dist/cjs/powql.d.ts +592 -0
package/dist/cjs/powql.js +42 -6
package/dist/cjs/prisma-compat.d.ts +283 -0
package/dist/cjs/prisma-compat.js +167 -9
package/dist/cjs/query/aggregates.d.ts +92 -0
package/dist/cjs/query/aggregates.js +7 -3
package/dist/cjs/query/batched-loader.d.ts +193 -0
package/dist/cjs/query/builder.d.ts +849 -0
package/dist/cjs/query/builder.js +571 -65
package/dist/cjs/query/compound-unique.d.ts +51 -0
package/dist/cjs/query/deferred.d.ts +223 -0
package/dist/cjs/query/filters.d.ts +201 -0
package/dist/cjs/query/index.d.ts +14 -0
package/dist/cjs/query/index.js +6 -1
package/dist/cjs/query/relations.d.ts +609 -0
package/dist/cjs/query/relations.js +693 -46
package/dist/cjs/query/types.d.ts +1300 -0
package/dist/cjs/query/utils.d.ts +209 -0
package/dist/cjs/query/utils.js +208 -1
package/dist/cjs/query/warn-registry.d.ts +68 -0
package/dist/cjs/query/warn-registry.js +9 -0
package/dist/cjs/query/where-compile.d.ts +139 -0
package/dist/cjs/query/where.d.ts +548 -0
package/dist/cjs/query/where.js +58 -22
package/dist/cjs/query/writes.d.ts +172 -0
package/dist/cjs/query/writes.js +105 -12
package/dist/cjs/realtime.d.ts +70 -0
package/dist/cjs/schema-builder.d.ts +354 -0
package/dist/cjs/schema-metadata.d.ts +83 -0
package/dist/cjs/schema-sql.d.ts +217 -0
package/dist/cjs/schema-sql.js +23 -5
package/dist/cjs/schema.d.ts +356 -0
package/dist/cjs/schema.js +125 -0
package/dist/cjs/seed.d.ts +15 -0
package/dist/cjs/serverless.d.ts +142 -0
package/dist/cjs/sqlite.d.ts +143 -0
package/dist/cjs/sqlite.js +4 -0
package/dist/cjs/typed-sql.d.ts +102 -0
package/dist/cli/config.d.ts +18 -4
package/dist/cli/config.js +31 -6
package/dist/cli/index.d.ts +123 -0
package/dist/cli/index.js +223 -58
package/dist/cli/migrate.d.ts +59 -10
package/dist/cli/migrate.js +128 -41
package/dist/cli/observe-ui.d.ts +1 -1
package/dist/cli/observe-ui.js +14 -5
package/dist/cli/observe.d.ts +7 -1
package/dist/cli/observe.js +48 -12
package/dist/cli/prisma-report.d.ts +14 -0
package/dist/cli/prisma-report.js +72 -0
package/dist/cli/prisma-resolve.d.ts +6 -0
package/dist/cli/prisma-resolve.js +1 -0
package/dist/cli/prisma-schema.d.ts +62 -2
package/dist/cli/prisma-schema.js +81 -4
package/dist/cli/rate-limit.d.ts +32 -0
package/dist/cli/rate-limit.js +40 -0
package/dist/cli/studio.d.ts +5 -5
package/dist/cli/studio.js +135 -70
package/dist/cli/ui.d.ts +1 -1
package/dist/cli/ui.js +51 -9
package/dist/client.d.ts +40 -0
package/dist/client.js +3 -0
package/dist/dialect.d.ts +17 -1
package/dist/dialect.js +37 -12
package/dist/generate.js +40 -7
package/dist/index.d.ts +1 -1
package/dist/index.js +1 -1
package/dist/mssql.js +6 -0
package/dist/mysql.js +16 -0
package/dist/nested-write.d.ts +2 -0
package/dist/nested-write.js +415 -25
package/dist/powdb.d.ts +4 -2
package/dist/powdb.js +106 -21
package/dist/powql.d.ts +5 -0
package/dist/powql.js +42 -6
package/dist/prisma-compat.d.ts +2 -0
package/dist/prisma-compat.js +166 -8
package/dist/query/aggregates.js +7 -3
package/dist/query/builder.d.ts +292 -21
package/dist/query/builder.js +570 -64
package/dist/query/deferred.d.ts +39 -0
package/dist/query/index.d.ts +1 -1
package/dist/query/index.js +1 -1
package/dist/query/relations.d.ts +173 -5
package/dist/query/relations.js +688 -47
package/dist/query/types.d.ts +123 -39
package/dist/query/utils.d.ts +116 -0
package/dist/query/utils.js +198 -0
package/dist/query/warn-registry.d.ts +9 -0
package/dist/query/warn-registry.js +9 -0
package/dist/query/where.d.ts +38 -1
package/dist/query/where.js +58 -23
package/dist/query/writes.d.ts +42 -1
package/dist/query/writes.js +104 -13
package/dist/schema-sql.d.ts +14 -0
package/dist/schema-sql.js +23 -5
package/dist/schema.d.ts +38 -0
package/dist/schema.js +123 -0
package/dist/sqlite.js +4 -0
package/package.json +77 -28

package/dist/cjs/cli/observe-ui.js CHANGED Viewed

@@ -87,9 +87,11 @@ exports.OBSERVE_HTML = `<!doctype html>
     <h2>Error rates</h2>
     <div id="errors-table"></div>
   </div>
-  <script>
+  <script nonce="__CSP_NONCE__">
     let currentRange = '1h';
-    const token = document.cookie.match(/turbine_observe_token=([a-f0-9]+)/)?.[1] || '';
+    // Anchored on a cookie boundary so a decoy cookie whose name ends with this
+    // one cannot shadow the real token.
+    const token = document.cookie.match(/(?:^|;\\s*)turbine_observe_token=([a-f0-9]+)/)?.[1] || '';
     const headers = { 'x-turbine-token': token };
     document.querySelector('.controls').addEventListener('click', e => {
@@ -142,13 +144,20 @@ exports.OBSERVE_HTML = `<!doctype html>
         .replace(/'/g, '&#39;');
     }
+    // Numeric sink: counts are integer aggregates, but they are still values
+    // arriving over the wire, so coerce rather than interpolating them raw.
+    function num(v) {
+      const n = Number(v);
+      return Number.isFinite(n) ? String(n) : '0';
+    }
     function renderModels(data) {
       const el = document.getElementById('models-table');
       if (!data || data.length === 0) { el.innerHTML = '<p class="empty">No data yet</p>'; return; }
       let html = '<table><thead><tr><th>Model</th><th>Action</th><th class="num">Count</th><th class="num">Avg (ms)</th><th class="num">P95 (ms)</th><th class="num">P99 (ms)</th></tr></thead><tbody>';
       for (const row of data) {
         html += '<tr><td>' + escapeHtml(row.model) + '</td><td>' + escapeHtml(row.action) + '</td>'
-          + '<td class="num">' + row.count + '</td>'
+          + '<td class="num">' + num(row.count) + '</td>'
           + '<td class="num">' + row.avg_ms.toFixed(1) + '</td>'
           + '<td class="num">' + row.p95_ms.toFixed(1) + '</td>'
           + '<td class="num">' + row.p99_ms.toFixed(1) + '</td></tr>';
@@ -165,8 +174,8 @@ exports.OBSERVE_HTML = `<!doctype html>
         const rate = row.count > 0 ? (row.error_count / row.count * 100).toFixed(1) : '0.0';
         const cls = parseFloat(rate) > 5 ? 'error-rate' : 'low-error';
         html += '<tr><td>' + escapeHtml(row.model) + '</td><td>' + escapeHtml(row.action) + '</td>'
-          + '<td class="num">' + row.count + '</td>'
-          + '<td class="num">' + row.error_count + '</td>'
+          + '<td class="num">' + num(row.count) + '</td>'
+          + '<td class="num">' + num(row.error_count) + '</td>'
           + '<td class="num ' + cls + '">' + rate + '%</td></tr>';
       }
       html += '</tbody></table>';

package/dist/cjs/cli/observe.d.ts ADDED Viewed

@@ -0,0 +1,25 @@
+/**
+ * turbine-orm CLI: Observe
+ *
+ * A local, read-only dashboard for viewing query metrics stored in
+ * _turbine_metrics. Same security model as Studio: loopback binding,
+ * random token, HttpOnly cookie, CSP headers, read-only transactions.
+ */
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+import pg from 'pg';
+export interface ObserveOptions {
+    url: string;
+    port: number;
+    host: string;
+    openBrowser: boolean;
+}
+export interface ObserveServerHandle {
+    dispose: () => Promise<void>;
+    authToken: string;
+    url: string;
+}
+export declare function startObserve(options: ObserveOptions): Promise<ObserveServerHandle>;
+export declare function handleRequest(req: IncomingMessage, res: ServerResponse, pool: pg.Pool, options: ObserveOptions, authToken: string, rateLimiter: Map<string, {
+    count: number;
+    resetAt: number;
+}>): Promise<void>;

package/dist/cjs/cli/observe.js CHANGED Viewed

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * turbine-orm CLI — Observe
+ * turbine-orm CLI: Observe
  *
  * A local, read-only dashboard for viewing query metrics stored in
  * _turbine_metrics. Same security model as Studio: loopback binding,
@@ -11,10 +11,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startObserve = startObserve;
+exports.handleRequest = handleRequest;
 const node_crypto_1 = require("node:crypto");
 const node_http_1 = require("node:http");
 const pg_1 = __importDefault(require("pg"));
 const observe_ui_js_1 = require("./observe-ui.js");
+const rate_limit_js_1 = require("./rate-limit.js");
 // ---------------------------------------------------------------------------
 // Main entry point
 // ---------------------------------------------------------------------------
@@ -32,8 +34,9 @@ async function startObserve(options) {
         probe.release();
     }
     const authToken = (0, node_crypto_1.randomBytes)(24).toString('hex');
+    const rateLimiter = new Map();
     const server = (0, node_http_1.createServer)((req, res) => {
-        handleRequest(req, res, pool, options, authToken).catch((err) => {
+        handleRequest(req, res, pool, options, authToken, rateLimiter).catch((err) => {
             sendJson(res, 500, { error: err instanceof Error ? err.message : String(err) });
         });
     });
@@ -61,7 +64,7 @@ async function startObserve(options) {
 // ---------------------------------------------------------------------------
 // Request routing
 // ---------------------------------------------------------------------------
-async function handleRequest(req, res, pool, options, authToken) {
+async function handleRequest(req, res, pool, options, authToken, rateLimiter) {
     const hostPart = options.host.includes(':') && !options.host.startsWith('[') ? `[${options.host}]` : options.host;
     const expectedOrigin = `http://${hostPart}:${options.port}`;
     const origin = req.headers.origin;
@@ -85,10 +88,21 @@ async function handleRequest(req, res, pool, options, authToken) {
             res.end();
             return;
         }
-        sendHtml(res, 200, observe_ui_js_1.OBSERVE_HTML);
+        sendHtml(res, 200, observe_ui_js_1.OBSERVE_HTML, cspNonce());
         return;
     }
-    if (!isAuthorized(req, authToken)) {
+    // Rate limiting: the same fixed window as Studio (shared implementation), applied
+    // before the auth gate so unauthenticated probing is throttled too, and keyed
+    // per caller so the two never share a bucket.
+    const authorized = isAuthorized(req, authToken);
+    const rateLimitResult = (0, rate_limit_js_1.checkRateLimit)(rateLimiter, `${authorized ? 'session' : 'anon'}:${(0, rate_limit_js_1.callerKey)(req)}`);
+    if (!rateLimitResult.allowed) {
+        const retryAfter = Math.ceil((rateLimitResult.resetAt - Date.now()) / 1000);
+        res.setHeader('Retry-After', String(retryAfter));
+        sendJson(res, 429, { error: 'Rate limit exceeded', retryAfter });
+        return;
+    }
+    if (!authorized) {
         sendJson(res, 401, { error: 'unauthorized' });
         return;
     }
@@ -109,7 +123,10 @@ function isAuthorized(req, expectedToken) {
         return true;
     }
     const cookieHeader = req.headers.cookie ?? '';
-    const match = /turbine_observe_token=([a-f0-9]+)/.exec(cookieHeader);
+    // Anchored on a cookie boundary: unanchored, a decoy cookie whose name merely
+    // ENDS with this one (`x_turbine_observe_token=...`) matched first and the real
+    // token was never compared, denying the legitimate session.
+    const match = /(?:^|;\s*)turbine_observe_token=([a-f0-9]+)/.exec(cookieHeader);
     if (match?.[1] && constantTimeEqual(match[1], expectedToken)) {
         return true;
     }
@@ -206,19 +223,39 @@ const SECURITY_HEADERS = {
     'X-Content-Type-Options': 'nosniff',
     'X-Frame-Options': 'DENY',
     'Referrer-Policy': 'no-referrer',
-    'Content-Security-Policy': "default-src 'self'; script-src 'unsafe-inline'; style-src 'unsafe-inline'",
 };
+/**
+ * A fresh CSP nonce for one HTML response, matching Studio's posture: the value
+ * is stamped into both the header and the inline `<script nonce="...">` tag so
+ * script-src drops `unsafe-inline`.
+ */
+function cspNonce() {
+    return (0, node_crypto_1.randomBytes)(16).toString('base64');
+}
+/** Non-document responses render no markup, so no inline script is allowed at all. */
+const JSON_CSP = "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'";
 function sendJson(res, status, body) {
     const payload = JSON.stringify(body);
-    res.writeHead(status, { ...SECURITY_HEADERS, 'Content-Type': 'application/json' });
+    res.writeHead(status, {
+        ...SECURITY_HEADERS,
+        'Content-Security-Policy': JSON_CSP,
+        'Content-Type': 'application/json',
+    });
     res.end(payload);
 }
-function sendHtml(res, status, html) {
-    res.writeHead(status, { ...SECURITY_HEADERS, 'Content-Type': 'text/html; charset=utf-8' });
-    res.end(html);
+function sendHtml(res, status, html, nonce) {
+    const body = html.replaceAll('__CSP_NONCE__', nonce);
+    res.writeHead(status, {
+        ...SECURITY_HEADERS,
+        // style-src keeps 'unsafe-inline' (the dashboard styles inline, and nonces
+        // do not cover style attributes); script-src moves to the per-request nonce.
+        'Content-Security-Policy': `default-src 'none'; script-src 'self' 'nonce-${nonce}'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-ancestors 'none'`,
+        'Content-Type': 'text/html; charset=utf-8',
+    });
+    res.end(body);
 }
 function sendText(res, status, text) {
-    res.writeHead(status, { ...SECURITY_HEADERS, 'Content-Type': 'text/plain' });
+    res.writeHead(status, { ...SECURITY_HEADERS, 'Content-Security-Policy': JSON_CSP, 'Content-Type': 'text/plain' });
     res.end(text);
 }
 // ---------------------------------------------------------------------------

package/dist/cjs/cli/pii-tags.d.ts ADDED Viewed

@@ -0,0 +1,53 @@
+/**
+ * PII tags for tools that build their schema from live introspection.
+ *
+ * `ColumnMetadata.pii` is a CODE-FIRST declaration: it comes from
+ * `defineSchema({ pii: true })` or the fluent `.pii()`, and `introspect.ts`
+ * never sets it (there is no reliable way to infer "this column holds personal
+ * data" from a Postgres catalog, and guessing would be worse than not trying).
+ *
+ * Studio and the MCP server introspect a live database, so on their own they
+ * see NO tags at all and their redaction is inert. This module closes that gap
+ * by reading the tags out of the generated `metadata.ts` that `turbine
+ * generate` writes, and handing back a table → column-name map the caller
+ * layers onto its introspected metadata.
+ *
+ * The generated file is TypeScript in the user's project, so it cannot simply
+ * be imported by a compiled CLI. It is read as TEXT and scanned for the exact
+ * shapes `generate.ts` emits (`serializeColumn`: one column object per line,
+ * `pii: true` only when tagged). Nothing is executed. A file that does not
+ * parse yields no tags, and the caller decides what to say about that.
+ */
+/** Table name → the snake_case column names tagged `pii: true`. */
+export type PiiTagMap = Record<string, string[]>;
+export interface PiiTagSource {
+    /** Absolute path that was read. */
+    path: string;
+    tags: PiiTagMap;
+    /** Total tagged columns, across tables. */
+    count: number;
+}
+/**
+ * Scan generated-metadata source text for PII-tagged columns.
+ *
+ * Exported for testing; callers normally use {@link loadPiiTags}.
+ */
+export declare function parsePiiTags(source: string): PiiTagMap;
+/**
+ * Read PII tags from the generated metadata in `outDir`, or return `null` when
+ * there is no readable generated metadata there. Never throws.
+ */
+export declare function loadPiiTags(outDir: string): PiiTagSource | null;
+/**
+ * Apply `tags` to introspected metadata, in place. Only columns that exist in
+ * the live schema are tagged, so a stale generated file can never invent one.
+ * Returns the number of columns actually tagged.
+ */
+export declare function applyPiiTags(metadata: {
+    tables: Record<string, {
+        columns: {
+            name: string;
+            pii?: boolean;
+        }[];
+    }>;
+}, tags: PiiTagMap): number;

package/dist/cjs/cli/prisma-report.d.ts ADDED Viewed

@@ -0,0 +1,33 @@
+/**
+ * Render a {@link ResolutionResult} into the `prisma-migration-report.md`
+ * artifact and a short console summary. Pure leaf - string in, string out.
+ */
+import type { ResolutionResult } from './prisma-resolve.js';
+export interface ReportOptions {
+    /** Path the Prisma schema was read from (for the report header). */
+    schemaPath?: string;
+    /** Omit the volatile `Generated: <ISO>` line for reproducible output. */
+    noTimestamp?: boolean;
+}
+/**
+ * Build the full Markdown migration report.
+ */
+export declare function formatPrismaReport(result: ResolutionResult, options?: ReportOptions): string;
+/** One resolved many-to-many relation, named from both sides. */
+interface ManyToManyCallSite {
+    /** `Model.field` as written in schema.prisma (what application code says). */
+    prismaPath: string;
+    /** The Prisma field name on its own (what to grep for). */
+    prismaField: string;
+    /** The Turbine relation name (what `generated/metadata.ts` says). */
+    turbineName: string;
+    /** Junction table, when it could be named. */
+    junction?: string;
+}
+/** Every resolved manyToMany relation in the result, in model/field order. */
+export declare function manyToManyCallSites(result: ResolutionResult): ManyToManyCallSite[];
+/** Flat list of unresolved item descriptions across the whole result. */
+export declare function collectUnresolved(result: ResolutionResult): string[];
+/** A one-line-per-model console summary for the CLI. */
+export declare function summaryLines(result: ResolutionResult): string[];
+export {};

package/dist/cjs/cli/prisma-report.js CHANGED Viewed

@@ -5,6 +5,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatPrismaReport = formatPrismaReport;
+exports.manyToManyCallSites = manyToManyCallSites;
 exports.collectUnresolved = collectUnresolved;
 exports.summaryLines = summaryLines;
 const CHECK = 'OK';
@@ -112,6 +113,8 @@ function formatPrismaReport(result, options = {}) {
             L.push('');
         }
     }
+    // ---- Many-to-many call sites -----------------------------------------
+    L.push(...manyToManySection(result));
     // ---- Junction tables --------------------------------------------------
     const junctions = new Set();
     for (const m of result.models) {
@@ -161,6 +164,71 @@ function formatPrismaReport(result, options = {}) {
     L.push(SEMANTIC_DIVERGENCE);
     return `${L.join('\n')}\n`;
 }
+/** Every resolved manyToMany relation in the result, in model/field order. */
+function manyToManyCallSites(result) {
+    const out = [];
+    for (const m of result.models) {
+        for (const r of m.relations) {
+            if (r.status !== 'resolved' || !r.turbineName)
+                continue;
+            if (!r.manyToMany && !r.junction)
+                continue;
+            out.push({
+                prismaPath: `${m.prismaName}.${r.prismaName}`,
+                prismaField: r.prismaName,
+                turbineName: r.turbineName,
+                junction: r.junction,
+            });
+        }
+    }
+    return out;
+}
+/**
+ * The many-to-many audit section.
+ *
+ * A migration audit that greps the TURBINE relation names cannot find anything:
+ * application code written against the compat client uses the PRISMA field
+ * names, and the two are related only through `PRISMA_MAP`. That is true of
+ * every compat integration, so the report resolves the pairing itself rather
+ * than leaving it to a recipe the reader has to get right.
+ */
+function manyToManySection(result) {
+    const sites = manyToManyCallSites(result);
+    if (sites.length === 0) {
+        if (!result.noDb)
+            return [];
+        return [
+            '## Many-to-many relations (audit these call sites)',
+            '',
+            'Not determined: many-to-many relations are recognized from the live database.',
+            'Re-run without `--no-db` to get the audit list.',
+            '',
+        ];
+    }
+    const L = [];
+    L.push('## Many-to-many relations (audit these call sites)');
+    L.push('');
+    L.push('Turbine and Prisma name these relations differently, and your application code');
+    L.push('uses the PRISMA name. Grepping the Turbine relation name (for example');
+    L.push('`grep -rn "manyToMany" generated/`, then searching for the names it prints) finds');
+    L.push('nothing and silently reports a clean audit. Both names are paired below.');
+    L.push('');
+    L.push('| Prisma call site | Turbine relation | Junction table |');
+    L.push('| --- | --- | --- |');
+    for (const s of sites) {
+        L.push(`| \`${s.prismaPath}\` | \`${s.turbineName}\` | ${s.junction ? `\`${s.junction}\`` : '-'} |`);
+    }
+    L.push('');
+    L.push('Audit every write whose `data` nests one of the Prisma field names above');
+    L.push('(`connect`, `disconnect`, `set`, `connectOrCreate`, `create`, `update`, `upsert`,');
+    L.push('`delete`): those are the many-to-many writes in your codebase.');
+    L.push('');
+    L.push('```bash');
+    L.push(`grep -rEn "\\b(${[...new Set(sites.map((s) => s.prismaField))].sort().join('|')})\\b" src`);
+    L.push('```');
+    L.push('');
+    return L;
+}
 /** Flat list of unresolved item descriptions across the whole result. */
 function collectUnresolved(result) {
     const out = [];
@@ -200,6 +268,11 @@ phase-2 \`turbine-orm/prisma-compat\` adapter handles most of these translations
 - Aggregate / groupBy \`_count\`. Prisma returns \`_count\` as a record
   (\`{ _all: n }\` / per-field counts). Turbine's scalar \`_count: true\` returns a
   number. Reshape as needed (the phase-2 adapter does this both directions).
+- Paginated reads. Prisma appends an implicit \`ORDER BY <primary key> ASC\` to a
+  \`findMany\` with \`take\`/\`skip\`; core Turbine emits a bare \`LIMIT\`, which is not
+  deterministic (a row can appear on two pages or on none). The phase-2
+  \`prisma-compat\` adapter restores Prisma's ordering; on the core client, pass an
+  explicit \`orderBy\` or set \`implicitPkOrdering: true\`.
 - Relation-array order. Without an \`orderBy\` on a \`with\`/\`include\` clause, the
   order of a to-many relation array is unspecified in Turbine (\`json_agg\` order).
   Add an explicit \`orderBy\` where order matters.

package/dist/cjs/cli/prisma-resolve.d.ts ADDED Viewed

@@ -0,0 +1,106 @@
+/**
+ * Resolve a parsed Prisma schema against live introspected Turbine metadata.
+ *
+ * Consumes a {@link PrismaSchemaAst} (from `cli/prisma-schema.ts`) plus a
+ * {@link SchemaMetadata} (from `introspect()`), and produces a
+ * {@link ResolutionResult}: a per-model/field/relation/compound-unique
+ * resolution report AND the typed {@link PrismaCompatMap} that only ever
+ * contains VERIFIED mappings. Anything that cannot be matched against the live
+ * database is reported UNRESOLVED with a reason and left out of the map - the
+ * database is the authority, and an ambiguous guess is worse than an honest gap.
+ *
+ * Pure leaf: no filesystem, database, or process access. Passing `schema: null`
+ * yields a parse-only report (every item `parsed`, no map) for `--no-db`.
+ */
+import { type PrismaCompatMap, type SchemaMetadata } from '../schema.js';
+import type { PrismaSchemaAst } from './prisma-schema.js';
+export { DEFAULT_EXCLUDED_TABLES } from '../introspect.js';
+export type ResolveStatus = 'resolved' | 'unresolved' | 'parsed';
+export interface ResolvedField {
+    prismaName: string;
+    /** Resolved Turbine field (camelCase), or null. */
+    turbineField: string | null;
+    /** Resolved snake_case database column, or null. */
+    column: string | null;
+    status: ResolveStatus;
+    reason?: string;
+}
+export interface ResolvedRelation {
+    prismaName: string;
+    /** Turbine relation name, or null. */
+    turbineName: string | null;
+    cardinality: 'one' | 'many' | null;
+    /** Target Prisma model this relation points at. */
+    targetModel: string;
+    /** Junction table for an m2m relation, if resolved. */
+    junction?: string;
+    /**
+     * True when the resolved Turbine relation is `manyToMany`. Distinct from
+     * {@link ResolvedRelation.junction}, which is absent when the junction table
+     * itself could not be named.
+     */
+    manyToMany?: boolean;
+    status: ResolveStatus;
+    reason?: string;
+}
+export interface ResolvedCompoundUnique {
+    /** Prisma selector name (explicit `name:`, else the field-name underscore-join). */
+    selector: string;
+    /** Prisma field names participating. */
+    prismaFields: string[];
+    /** Resolved Turbine field names (in order), or null. */
+    turbineFields: string[] | null;
+    kind: 'id' | 'unique';
+    status: ResolveStatus;
+    reason?: string;
+}
+export interface ResolvedModel {
+    prismaName: string;
+    kind: 'model' | 'view' | 'type';
+    /** Resolved snake_case table name, or null. */
+    table: string | null;
+    /** camelCase client accessor, or null. */
+    accessor: string | null;
+    /** True when the table name came from an explicit `@@map`. */
+    viaMap: boolean;
+    status: ResolveStatus;
+    reason?: string;
+    fields: ResolvedField[];
+    relations: ResolvedRelation[];
+    compoundUniques: ResolvedCompoundUnique[];
+}
+export interface ResolvedEnum {
+    prismaName: string;
+    turbineName: string | null;
+    status: ResolveStatus;
+    reason?: string;
+}
+export interface ResolutionResult {
+    models: ResolvedModel[];
+    enums: ResolvedEnum[];
+    /** The verified name map. Empty `models`/`enums` in `--no-db` mode. */
+    map: PrismaCompatMap;
+    /** True if any model/field/relation/compound-unique/enum is UNRESOLVED. */
+    hasUnresolved: boolean;
+    /** Non-fatal parser notes (skipped blocks/attributes). */
+    parseWarnings: string[];
+    /** True when resolution was skipped (`--no-db`): the report is parse-only. */
+    noDb: boolean;
+}
+/** Options controlling how names are resolved. */
+export interface ResolveOptions {
+    /**
+     * Resolve field names against the raw database column names instead of the
+     * camelCase default, matching a client generated with `--keep-column-names`.
+     * Applied by running the introspected metadata through {@link withDbFieldNames}
+     * up front, so every resolved `turbineField` (and compound-unique
+     * `turbineFields`) is the DB column spelling and the emitted PRISMA_MAP agrees
+     * with the generated client. Table names, accessors, and relations are
+     * unaffected (those never carry camelCased column names).
+     */
+    keepColumnNames?: boolean;
+}
+/**
+ * Resolve `ast` against introspected `schema` (or `null` for parse-only).
+ */
+export declare function resolvePrismaSchema(ast: PrismaSchemaAst, schema: SchemaMetadata | null, options?: ResolveOptions): ResolutionResult;

package/dist/cjs/cli/prisma-resolve.js CHANGED Viewed

@@ -346,6 +346,7 @@ function resolveRelation(model, fieldName, targetModelName, isList, modelTable,
             turbineName: def.name,
             cardinality,
             junction: def.type === 'manyToMany' ? def.through?.table : undefined,
+            manyToMany: def.type === 'manyToMany' ? true : undefined,
             status: 'resolved',
         };
     }