turbine-orm 0.77.1 → 0.78.0

package/dist/cjs/query/writes.js

@@ -403,7 +403,15 @@ function buildUpdate(qi, args) {
     // The empty-`where` guard checks the USER predicate only, a global filter
     // must never turn an unguarded mass update into an allowed one.
     const userHasPredicate = !whereMod.userPredicateIsEmpty(qi, userWhere) || !!lock;
-    whereMod.assertMutationHasPredicate(qi, 'update', userHasPredicate ? ' WHERE x' : '', (0, types_js_1.resolveUnsafeFlag)(args.allowFullTableScan, 'allowFullTableScan'));
+    const allowFullTableScan = (0, types_js_1.resolveUnsafeFlag)(args.allowFullTableScan, 'allowFullTableScan');
+    whereMod.assertMutationHasPredicate(qi, 'update', userHasPredicate ? ' WHERE x' : '', allowFullTableScan);
+    // `update` returns ONE row, so its where must identify one: the 0.73
+    // `findUnique` rule (query/compound-unique.ts) applied to the write that has
+    // the same shape. On the USER's where, before the global filter is merged
+    // (a filter narrows, it never identifies), and skipped only under the
+    // explicit full-table opt-in, which already means "every row".
+    if (!allowFullTableScan)
+        (0, compound_unique_js_1.assertMutationWhereIdentifiesOneRow)(qi.tableMeta, qi.table, userWhere, 'update');
     // The SQL is built from the global-filter-merged where (soft-delete keeps an
     // update from touching already-deleted rows).
     const whereObj = (whereMod.mergeGlobalFilter(qi, userWhere) ?? {});
@@ -536,7 +544,12 @@ function buildDelete(qi, args) {
     // Prisma compound-unique selector → the column conjunction (before the guard).
     const userWhere = (0, compound_unique_js_1.expandCompoundUniqueWhere)(qi.tableMeta, args.where);
     // Guard the USER predicate (a global filter must not satisfy the guard).
-    whereMod.assertMutationHasPredicate(qi, 'delete', whereMod.userPredicateIsEmpty(qi, userWhere) ? '' : ' WHERE x', (0, types_js_1.resolveUnsafeFlag)(args.allowFullTableScan, 'allowFullTableScan'));
+    const allowFullTableScan = (0, types_js_1.resolveUnsafeFlag)(args.allowFullTableScan, 'allowFullTableScan');
+    whereMod.assertMutationHasPredicate(qi, 'delete', whereMod.userPredicateIsEmpty(qi, userWhere) ? '' : ' WHERE x', allowFullTableScan);
+    // Same identity rule as `update` (see buildUpdate): one returned row means
+    // one addressed row. `deleteMany` is the many-row path.
+    if (!allowFullTableScan)
+        (0, compound_unique_js_1.assertMutationWhereIdentifiesOneRow)(qi.tableMeta, qi.table, userWhere, 'delete');
     const whereObj = (whereMod.mergeGlobalFilter(qi, userWhere) ?? {});
     const whereFp = whereMod.fingerprintWhere(qi, whereObj);
     const ck = `d:${whereFp}${whereMod.globalFilterCacheSegment(qi)}`;
@@ -590,6 +603,23 @@ function buildUpsert(qi, args) {
     qi.currentSkip = (0, types_js_1.resolveSkipGlobalFilters)(args.skipGlobalFilters);
     // Prisma compound-unique selector on the conflict target → its member columns.
     const upsertWhere = (0, compound_unique_js_1.expandCompoundUniqueWhere)(qi.tableMeta, args.where);
+    // An upsert's `where` becomes the CONFLICT TARGET, so it carries the same
+    // one-row contract `update` / `delete` do and is refused by the same rule
+    // (query/compound-unique.ts), with its own sentence because the consequence
+    // differs. Without it a non-unique `where` reached the server as
+    // `ON CONFLICT ("role")` and came back as a bare SQLSTATE 42P10 on
+    // PostgreSQL, and WORSE than an error on the engines that do not read the
+    // conflict target back: MySQL's `ON DUPLICATE KEY UPDATE` ignores it and
+    // keys off whichever unique index the row happens to violate, and SQL
+    // Server's `MERGE ... ON` matches every row the predicate matches and
+    // updates all of them.
+    //
+    // Before any SQL is assembled, and this is the only where-guard `upsert`
+    // runs: `{}` and `{ email: undefined }` are refused here too, and by the
+    // right sentence. The empty-`where` guard's own message points at
+    // `allowFullTableScan: UNSAFE`, which is not an option on `UpsertArgs` at
+    // all, so borrowing it here would name a way out that does not exist.
+    (0, compound_unique_js_1.assertMutationWhereIdentifiesOneRow)(qi.tableMeta, qi.table, upsertWhere, 'upsert');
     // Build the INSERT part from create data
     const createEntries = writeEntries(qi, args.create);
     const columns = createEntries.map(([k]) => qi.toSqlColumn(k));
@@ -599,25 +629,47 @@ function buildUpsert(qi, args) {
     // The conflict target comes from `where` keys, must be unique/PK columns
     const conflictKeys = Object.keys(upsertWhere).filter((k) => upsertWhere[k] !== undefined);
     const conflictColumns = conflictKeys.map((k) => qi.toSqlColumn(k));
-    // Build the UPDATE SET part
+    // The conflict-UPDATE SET goes through the SAME operator-aware compiler as
+    // `update()` (buildSetClause), so `set` / `increment` / `decrement` /
+    // `multiply` / `divide` mean here what they mean there and a misspelled
+    // operator gets the same E003. This branch used to bind each value directly,
+    // which stored an operator OBJECT as the JSON text `{"set":"x"}` in a text
+    // column with no error at all. buildSetClause pushes onto `params` as it
+    // goes, so the numbering continues after the create params exactly as the
+    // hand-rolled `paramIdx` did. No SQL cache here (the statement is rebuilt per
+    // call), so the fingerprint / collect mirrors update() keeps are not needed.
     const updateEntries = writeEntries(qi, args.update);
-    let paramIdx = createParams.length + 1;
-    const setClauses = updateEntries.map(([k]) => {
-        const clause = `${qi.toSqlColumn(k)} = ${qi.p(paramIdx)}${whereMod.enumCastSuffix(qi, qi.toColumn(k))}`;
-        paramIdx++;
-        return clause;
-    });
-    const updateParams = updateEntries.map(([k, v]) => coerceWriteValue(qi, k, v));
-    const params = [...createParams, ...updateParams];
+    const params = [...createParams];
+    const refQualifier = upsertReferenceQualifier(qi);
+    const setClauses = updateEntries.map(([k, v]) => buildSetClause(qi, k, v, params, refQualifier));
     // Global filter → restrict the conflict-UPDATE (soft-delete / tenancy) so an
     // upsert never resurrects a soft-deleted row or writes across tenants. Only
-    // on engines whose upsert can carry a predicate (Postgres); the gf params
-    // continue the placeholder numbering after create+update params.
+    // on engines whose upsert can carry a predicate (Postgres, SQLite); the gf
+    // params continue the placeholder numbering after create+update params.
+    //
+    // Compiled against the TABLE QUALIFIER, not bare: in `ON CONFLICT ... DO
+    // UPDATE ... WHERE` both the target table and `excluded` are in scope, so an
+    // unqualified column is ambiguous and PostgreSQL rejected EVERY upsert on a
+    // globally filtered table at parse time (42702), insert path included.
     let updateWhere;
     if (qi.dialect.supportsUpsertUpdateWhere) {
         const gf = whereMod.resolveGlobalFilter(qi, qi.table);
-        if (gf)
-            updateWhere = whereMod.buildWhereClause(qi, gf, params) ?? undefined;
+        if (gf) {
+            // Compiled through a scope whose FROM-item reference is ALREADY RENDERED
+            // (`"users"`), which is what the target table is inside `ON CONFLICT ...
+            // DO UPDATE`. `aliasWhereScope` is the wrong seam for that: it takes a
+            // BARE alias and quotes it itself for the nested-relation correlation
+            // parent, so handing it `q(table)` produced a triple-quoted reference
+            // inside an EXISTS body and the whole statement failed with 42P01
+            // whenever the configured global filter was a relation filter rather
+            // than a plain column. A bare table name is not the answer either: it
+            // would leave the qualifier unquoted and break every table whose name
+            // needs quoting. `buildRenderedRefWhere` is the rendered-reference seam,
+            // one parameter with one meaning, used for the qualifier and the
+            // correlation parent alike, and shared with the batched `_count`
+            // follow-up, which had the identical bug.
+            updateWhere = whereMod.buildRenderedRefWhere(qi, qi.table, qi.tableMeta, qi.q(qi.table), gf, params) ?? undefined;
+        }
     }
     const sql = qi.dialect.buildUpsertStatement({
         table: qi.q(qi.table),
@@ -634,11 +686,21 @@ function buildUpsert(qi, args) {
         transform: (result) => {
             const row = result.rows[0];
             if (!row) {
+                // With a conflict-UPDATE predicate in play there IS a way to get no
+                // row: the key conflicts with a row the global filter hides, the
+                // predicate is false for it, the engine skips the update, and the
+                // insert cannot happen either because the key is taken. Nothing was
+                // written and the hidden row is untouched; say so, rather than "this
+                // should never happen".
                 throw new errors_js_1.NotFoundError({
                     table: qi.table,
                     where: args.where,
                     operation: 'upsert',
-                    message: `upsert on "${qi.table}" returned no row from RETURNING *; this should never happen.`,
+                    message: updateWhere
+                        ? `upsert on "${qi.table}" wrote nothing: the row that conflicts on the given key is excluded by the ` +
+                            `configured global filter for "${qi.table}", so it was neither updated (the filter hides it) nor ` +
+                            'inserted (the key is taken). Pass `skipGlobalFilters: UNSAFE` to address it anyway.'
+                        : `upsert on "${qi.table}" returned no row from RETURNING *; this should never happen.`,
                 });
             }
             return parseWriteRow(qi, row);
@@ -654,6 +716,29 @@ function buildUpsert(qi, args) {
             : undefined,
     };
 }
+/**
+ * The qualifier an upsert's arithmetic SET operator reads its column through.
+ *
+ * `INSERT ... ON CONFLICT DO UPDATE SET n = n + 1` is 42702 on PostgreSQL
+ * because `n` could be the target row's or `excluded`'s, so the reference is
+ * qualified with the table name on every engine whose upsert statement names
+ * the table directly (PostgreSQL, SQLite, MySQL all accept `"t"."n"` there).
+ * SQL Server is the exception and keeps the bare reference: its `MERGE`
+ * aliases the target as `T`, so the TABLE NAME does not resolve there at all,
+ * and the alias belongs to that dialect's own `buildUpsertStatement` rather
+ * than to this module. An arithmetic operator in an mssql upsert may therefore
+ * still be refused by the server as an ambiguous column; that shape has never
+ * worked (it previously bound the operator OBJECT as the value), and the sound
+ * fix is for the dialect to publish its target alias, which is a change to
+ * `dialect.ts`. It fails loudly either way, so no wrong answer is possible.
+ * `set` and literal values reference no column and are unaffected everywhere.
+ *
+ * Gated on the dialect NAME, never on hook presence: every engine dialect
+ * spreads `postgresDialect`, so a presence test would say yes for all of them.
+ */
+function upsertReferenceQualifier(qi) {
+    return qi.dialect.name === 'mssql' ? '' : `${qi.q(qi.table)}.`;
+}
 function buildUpdateMany(qi, args) {
     assertWritable(qi, 'updateMany');
     qi.currentSkip = (0, types_js_1.resolveSkipGlobalFilters)(args.skipGlobalFilters);
@@ -916,9 +1001,19 @@ function assertNoGeneratedColumns(qi, data, operation) {
  * Returns the SQL fragment (e.g., `"view_count" = "view_count" + $3`) and
  * pushes any required params onto the shared params array so that WHERE
  * clause numbering continues correctly afterward.
+ *
+ * `refQualifier` prefixes the column REFERENCE an arithmetic operator reads
+ * from (`"view_count" = <qualifier>"view_count" + $n`). A plain `UPDATE` has
+ * one table in scope and passes nothing; `upsert` passes the table name,
+ * because inside `ON CONFLICT ... DO UPDATE SET` the target table and
+ * `excluded` are BOTH in scope and a bare reference is 42702 on PostgreSQL.
+ * The assignment target on the left stays bare on every engine (it can only
+ * ever be the target table's column), and `set` / literal values reference no
+ * column at all, so their SQL is byte-identical with or without a qualifier.
  */
-function buildSetClause(qi, key, value, params) {
+function buildSetClause(qi, key, value, params, refQualifier = '') {
     const col = qi.toSqlColumn(key);
+    const ref = `${refQualifier}${col}`;
     // Enum columns get an explicit `::"EnumName"` cast on their value bind
     // (see enumTypeForColumn); `''` everywhere else. Value-invariant, so the
     // SQL cache and collectSetParams are unaffected.
@@ -945,19 +1040,19 @@ function buildSetClause(qi, key, value, params) {
             }
             if (op === 'increment') {
                 params.push(opValue);
-                return `${col} = ${col} + ${qi.p(params.length)}`;
+                return `${col} = ${ref} + ${qi.p(params.length)}`;
             }
             if (op === 'decrement') {
                 params.push(opValue);
-                return `${col} = ${col} - ${qi.p(params.length)}`;
+                return `${col} = ${ref} - ${qi.p(params.length)}`;
             }
             if (op === 'multiply') {
                 params.push(opValue);
-                return `${col} = ${col} * ${qi.p(params.length)}`;
+                return `${col} = ${ref} * ${qi.p(params.length)}`;
             }
             if (op === 'divide') {
                 params.push(opValue);
-                return `${col} = ${col} / ${qi.p(params.length)}`;
+                return `${col} = ${ref} / ${qi.p(params.length)}`;
             }
         }
         // Fall through: multi-key objects or non-operator single-key objects

package/dist/cjs/seed.d.ts

@@ -12,4 +12,20 @@ export type DefinedSeed = () => Promise<void>;
  * Exported for unit testing the frame parser in isolation.
  */
 export declare function parseStackFramePath(line: string): string | null;
+/**
+ * Declare a seed: `fn` receives a connected `TurbineClient` and is awaited.
+ *
+ * The returned function runs the seed on demand. When the module that calls
+ * `defineSeed` is itself the process entry point (`npx tsx seed.ts`, or the
+ * child `turbine seed` spawns), the seed also runs automatically.
+ *
+ * The client connects through `DATABASE_URL`. Under `turbine seed` that value
+ * is the configured connection string with `search_path` PINNED to the
+ * configured `schema` (as the `options=-c search_path` connection parameter,
+ * so it can never leak onto a pooled backend the way a `SET` would). Every
+ * unqualified table name the seed writes therefore lands in the same schema
+ * `push`, `generate` and the generated client use; a seed that must reach
+ * another schema qualifies the name. The default `public` adds nothing, so a
+ * project that never set `schema` connects exactly as before.
+ */
 export declare function defineSeed(fn: SeedFunction): DefinedSeed;

package/dist/cjs/seed.js

@@ -143,6 +143,22 @@ async function runSeed(fn) {
         await db.disconnect();
     }
 }
+/**
+ * Declare a seed: `fn` receives a connected `TurbineClient` and is awaited.
+ *
+ * The returned function runs the seed on demand. When the module that calls
+ * `defineSeed` is itself the process entry point (`npx tsx seed.ts`, or the
+ * child `turbine seed` spawns), the seed also runs automatically.
+ *
+ * The client connects through `DATABASE_URL`. Under `turbine seed` that value
+ * is the configured connection string with `search_path` PINNED to the
+ * configured `schema` (as the `options=-c search_path` connection parameter,
+ * so it can never leak onto a pooled backend the way a `SET` would). Every
+ * unqualified table name the seed writes therefore lands in the same schema
+ * `push`, `generate` and the generated client use; a seed that must reach
+ * another schema qualifies the name. The default `public` adds nothing, so a
+ * project that never set `schema` connects exactly as before.
+ */
 function defineSeed(fn) {
     const run = () => runSeed(fn);
     if (isDirectSeedModule()) {

package/dist/cli/config.d.ts

@@ -230,5 +230,11 @@ export declare function connectionStringHasPassword(connectionString: string): b
  * `.env` that holds the real value. The refusal lives here rather than at the
  * call site so no future caller can reintroduce the leak by passing the raw
  * `--url` through.
+ *
+ * `schema` is the RESOLVED Postgres schema (`--schema` or the default), written
+ * as the config's `schema` value. `init --schema app` probes `app` and then
+ * used to write `schema: 'public'` regardless, so the next documented step,
+ * `push`, diffed the starter schema against the wrong namespace and proposed
+ * dropping every column it found there.
  */
-export declare function configTemplate(connectionString?: string): string;
+export declare function configTemplate(connectionString?: string, schema?: string): string;

package/dist/cli/config.js

@@ -255,9 +255,18 @@ export function connectionStringHasPassword(connectionString) {
  * `.env` that holds the real value. The refusal lives here rather than at the
  * call site so no future caller can reintroduce the leak by passing the raw
  * `--url` through.
+ *
+ * `schema` is the RESOLVED Postgres schema (`--schema` or the default), written
+ * as the config's `schema` value. `init --schema app` probes `app` and then
+ * used to write `schema: 'public'` regardless, so the next documented step,
+ * `push`, diffed the starter schema against the wrong namespace and proposed
+ * dropping every column it found there.
  */
-export function configTemplate(connectionString) {
+export function configTemplate(connectionString, schema = 'public') {
     const inlineUrl = connectionString && !connectionStringHasPassword(connectionString) ? connectionString : undefined;
+    // Same delimiter rule as the URL below: a schema name is an arbitrary
+    // identifier, and a quote in it must not end the TS string early.
+    const schemaLiteral = schema.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
     // Single quotes are the string delimiter in the emitted TS, so a connection
     // string containing one would otherwise produce a config file that does not
     // parse (a password-free URL can still carry a quote in a query parameter).
@@ -278,7 +287,7 @@ ${urlLine}
   out: './generated/turbine',
 
   /** Postgres schema to introspect (default: public) */
-  schema: 'public',
+  schema: '${schemaLiteral}',
 
   /** Tables to exclude from generation */
   // exclude: ['_migrations', '_sessions'],

package/dist/cli/destructive.d.ts

@@ -28,7 +28,7 @@
  * migration runner. Two lexers is how this guard came to disagree with the
  * executor about what a file contained (see that module's header).
  */
-export type DestructiveKind = 'drop-table' | 'drop-schema' | 'drop-database' | 'drop-owned' | 'drop-matview' | 'drop-column' | 'drop-cascade' | 'detach-partition' | 'truncate' | 'delete' | 'update-without-where' | 'alter-column-type' | 'merge-delete' | 'rename' | 'dynamic-destructive';
+export type DestructiveKind = 'drop-table' | 'drop-schema' | 'drop-database' | 'drop-owned' | 'drop-matview' | 'drop-column' | 'drop-cascade' | 'detach-partition' | 'truncate' | 'delete' | 'update-without-where' | 'alter-column-type' | 'merge-delete' | 'rename' | 'rewrite-rule' | 'dynamic-destructive' | 'dynamic-unclassified';
 export interface DestructiveStatement {
     /** The offending SQL statement (trimmed, possibly long, display truncated) */
     statement: string;