velocious 1.0.445 → 1.0.447

package/README.md

@@ -1453,7 +1453,7 @@ database: {
 }
 ```
 
-`pool.max` caps live async-tracked connections for that pool. When the cap is reached, new checkouts wait until a matching checked-in connection can be handed over or capacity is freed. The built-in debug endpoint reports each in-use connection's `checkedOutForMs`, each idle connection's `idleForMs`, and queued `pendingCheckouts[].waitingForMs` so production diagnostics can distinguish long-held checkouts from pool-capacity waits.
+`pool.max` caps live async-tracked connections for that pool and defaults to `10` when omitted. When the cap is reached, new checkouts wait until a matching checked-in connection can be handed over or capacity is freed. Set `pool.max` to `null` only when a process is deliberately allowed to open an unbounded number of database connections. The built-in debug endpoint reports each in-use connection's `checkedOutForMs`, each idle connection's `idleForMs`, and queued `pendingCheckouts[].waitingForMs` so production diagnostics can distinguish long-held checkouts from pool-capacity waits.
 
 # Websockets
 

package/build/configuration-types.js

@@ -44,7 +44,7 @@
  * @property {boolean} [options.trustServerCertificate] - Whether to trust the server certificate (MSSQL).
  * @property {string} [password] - Password for the SQL user.
  * @property {object} [pool] - Connection pool configuration.
- * @property {number} [pool.max] - Maximum number of connections.
+ * @property {number | null} [pool.max] - Maximum number of connections. Set null to disable the cap.
  * @property {number} [pool.min] - Minimum number of connections.
  * @property {number} [pool.idleTimeoutMillis] - Idle timeout before releasing a connection.
  * @property {string} [server] - SQL server hostname.
@@ -54,7 +54,7 @@
 /**
  * @typedef {object} DatabasePoolConfiguration
  * @property {number | null} [idleTimeoutMillis] - Idle timeout before closing a checked-in async-tracked connection. Set null to disable idle reaping. Default: 5000.
- * @property {number} [max] - Maximum live async-tracked connections for this pool. Extra checkouts wait until a matching connection is checked in or capacity is freed.
+ * @property {number | null} [max] - Maximum live async-tracked connections for this pool. Defaults to 10. Extra checkouts wait until a matching connection is checked in or capacity is freed. Set null to disable the cap.
  */
 
 /**

package/build/database/pool/async-tracked-multi-connection.js

@@ -6,6 +6,7 @@ import BasePool, {POOL_CONFIGURATION_KEY} from "./base.js"
 export const CLOSED_CONNECTION = Symbol("velociousClosedConnection")
 const IDLE_CONNECTION_CHECKED_IN_AT = Symbol("velociousIdleConnectionCheckedInAt")
 const CONNECTION_CHECKED_OUT_AT = Symbol("velociousConnectionCheckedOutAt")
+const DEFAULT_MAX_CONNECTIONS = 10
 const DEFAULT_IDLE_TIMEOUT_MILLIS = 5000
 
 /**
@@ -285,9 +286,10 @@ export default class VelociousDatabasePoolAsyncTrackedMultiConnection extends Ba
   maxConnections() {
     const value = this.getConfiguration().pool?.max
 
+    if (value === null) return
     if (this.validMaxConnections(value)) return value
 
-    return
+    return DEFAULT_MAX_CONNECTIONS
   }
 
   /**

package/build/database/record/index.js

@@ -7,13 +7,13 @@
 
 /**
  * LifecycleCallbackType type.
- * @template {VelociousDatabaseRecord} [T=VelociousDatabaseRecord]
+ * @template [T=VelociousDatabaseRecord]
  * @typedef {((model: T) => void | Promise<void>) | string} LifecycleCallbackType
  */
 
 /**
  * Model class constructor type used for static `this` typing.
- * @template {VelociousDatabaseRecord} T
+ * @template T
  * @typedef {{new (changes?: Record<string, unknown>): T}} ModelConstructor
  */
 
@@ -507,101 +507,101 @@ class VelociousDatabaseRecord {
 
   /**
    * Runs before validation.
-   * @template {typeof VelociousDatabaseRecord} MC
-   * @this {MC}
-   * @param {LifecycleCallbackType<InstanceType<MC>>} callback - Callback function or instance method name.
+   * @template R
+   * @this {ModelConstructor<R>}
+   * @param {LifecycleCallbackType<R>} callback - Callback function or instance method name.
    * @returns {void}
    */
   static beforeValidation(callback) {
-    this.registerLifecycleCallback("beforeValidation", /** @type {LifecycleCallbackType} */ (callback))
+    VelociousDatabaseRecord.registerLifecycleCallback.call(this, "beforeValidation", /** @type {LifecycleCallbackType} */ (callback))
   }
 
   /**
    * Runs before save.
-   * @template {typeof VelociousDatabaseRecord} MC
-   * @this {MC}
-   * @param {LifecycleCallbackType<InstanceType<MC>>} callback - Callback function or instance method name.
+   * @template R
+   * @this {ModelConstructor<R>}
+   * @param {LifecycleCallbackType<R>} callback - Callback function or instance method name.
    * @returns {void}
    */
   static beforeSave(callback) {
-    this.registerLifecycleCallback("beforeSave", /** @type {LifecycleCallbackType} */ (callback))
+    VelociousDatabaseRecord.registerLifecycleCallback.call(this, "beforeSave", /** @type {LifecycleCallbackType} */ (callback))
   }
 
   /**
    * Runs before create.
-   * @template {typeof VelociousDatabaseRecord} MC
-   * @this {MC}
-   * @param {LifecycleCallbackType<InstanceType<MC>>} callback - Callback function or instance method name.
+   * @template R
+   * @this {ModelConstructor<R>}
+   * @param {LifecycleCallbackType<R>} callback - Callback function or instance method name.
    * @returns {void}
    */
   static beforeCreate(callback) {
-    this.registerLifecycleCallback("beforeCreate", /** @type {LifecycleCallbackType} */ (callback))
+    VelociousDatabaseRecord.registerLifecycleCallback.call(this, "beforeCreate", /** @type {LifecycleCallbackType} */ (callback))
   }
 
   /**
    * Runs before update.
-   * @template {typeof VelociousDatabaseRecord} MC
-   * @this {MC}
-   * @param {LifecycleCallbackType<InstanceType<MC>>} callback - Callback function or instance method name.
+   * @template R
+   * @this {ModelConstructor<R>}
+   * @param {LifecycleCallbackType<R>} callback - Callback function or instance method name.
    * @returns {void}
    */
   static beforeUpdate(callback) {
-    this.registerLifecycleCallback("beforeUpdate", /** @type {LifecycleCallbackType} */ (callback))
+    VelociousDatabaseRecord.registerLifecycleCallback.call(this, "beforeUpdate", /** @type {LifecycleCallbackType} */ (callback))
   }
 
   /**
    * Runs before destroy.
-   * @template {typeof VelociousDatabaseRecord} MC
-   * @this {MC}
-   * @param {LifecycleCallbackType<InstanceType<MC>>} callback - Callback function or instance method name.
+   * @template R
+   * @this {ModelConstructor<R>}
+   * @param {LifecycleCallbackType<R>} callback - Callback function or instance method name.
    * @returns {void}
    */
   static beforeDestroy(callback) {
-    this.registerLifecycleCallback("beforeDestroy", /** @type {LifecycleCallbackType} */ (callback))
+    VelociousDatabaseRecord.registerLifecycleCallback.call(this, "beforeDestroy", /** @type {LifecycleCallbackType} */ (callback))
   }
 
   /**
    * Runs after save.
-   * @template {typeof VelociousDatabaseRecord} MC
-   * @this {MC}
-   * @param {LifecycleCallbackType<InstanceType<MC>>} callback - Callback function or instance method name.
+   * @template R
+   * @this {ModelConstructor<R>}
+   * @param {LifecycleCallbackType<R>} callback - Callback function or instance method name.
    * @returns {void}
    */
   static afterSave(callback) {
-    this.registerLifecycleCallback("afterSave", /** @type {LifecycleCallbackType} */ (callback))
+    VelociousDatabaseRecord.registerLifecycleCallback.call(this, "afterSave", /** @type {LifecycleCallbackType} */ (callback))
   }
 
   /**
    * Runs after create.
-   * @template {typeof VelociousDatabaseRecord} MC
-   * @this {MC}
-   * @param {LifecycleCallbackType<InstanceType<MC>>} callback - Callback function or instance method name.
+   * @template R
+   * @this {ModelConstructor<R>}
+   * @param {LifecycleCallbackType<R>} callback - Callback function or instance method name.
    * @returns {void}
    */
   static afterCreate(callback) {
-    this.registerLifecycleCallback("afterCreate", /** @type {LifecycleCallbackType} */ (callback))
+    VelociousDatabaseRecord.registerLifecycleCallback.call(this, "afterCreate", /** @type {LifecycleCallbackType} */ (callback))
   }
 
   /**
    * Runs after update.
-   * @template {typeof VelociousDatabaseRecord} MC
-   * @this {MC}
-   * @param {LifecycleCallbackType<InstanceType<MC>>} callback - Callback function or instance method name.
+   * @template R
+   * @this {ModelConstructor<R>}
+   * @param {LifecycleCallbackType<R>} callback - Callback function or instance method name.
    * @returns {void}
    */
   static afterUpdate(callback) {
-    this.registerLifecycleCallback("afterUpdate", /** @type {LifecycleCallbackType} */ (callback))
+    VelociousDatabaseRecord.registerLifecycleCallback.call(this, "afterUpdate", /** @type {LifecycleCallbackType} */ (callback))
   }
 
   /**
    * Runs after destroy.
-   * @template {typeof VelociousDatabaseRecord} MC
-   * @this {MC}
-   * @param {LifecycleCallbackType<InstanceType<MC>>} callback - Callback function or instance method name.
+   * @template R
+   * @this {ModelConstructor<R>}
+   * @param {LifecycleCallbackType<R>} callback - Callback function or instance method name.
    * @returns {void}
    */
   static afterDestroy(callback) {
-    this.registerLifecycleCallback("afterDestroy", /** @type {LifecycleCallbackType} */ (callback))
+    VelociousDatabaseRecord.registerLifecycleCallback.call(this, "afterDestroy", /** @type {LifecycleCallbackType} */ (callback))
   }
 
   /**

package/build/environment-handlers/node/cli/commands/generate/base-models.js

@@ -115,12 +115,48 @@ export default class DbGenerateModel extends BaseCommand {
           velociousPath = "velocious/build/src"
         }
 
+        const columns = await table.getColumns()
+        const writeAttributeTypeName = `${modelNameCamelized}WriteAttributes`
+        const nestedWriteAttributes = this.nestedWriteAttributesForModel({modelClass})
+
         fileContent += `import DatabaseRecord from "${velociousPath}/database/record/index.js"\n\n`
+        fileContent += "/**\n"
+        fileContent += ` * Attributes accepted when creating or updating ${modelNameCamelized} records.\n`
+        fileContent += ` * @typedef {object} ${writeAttributeTypeName}\n`
+        for (const column of columns) {
+          const deburredColumnName = deburrColumnName(column.getName())
+          const camelizedColumnName = inflection.camelize(deburredColumnName, true)
+          const setterJsdocType = this.jsDocSetterTypeFromColumn(column, modelClass)
+
+          if (setterJsdocType) {
+            fileContent += ` * @property {${setterJsdocType}${column.getNull() ? " | null" : ""}} [${camelizedColumnName}] - Value for the ${camelizedColumnName} attribute.\n`
+          }
+        }
+        for (const nestedWriteAttribute of nestedWriteAttributes) {
+          fileContent += ` * @property {${nestedWriteAttribute.propertyType}} [${nestedWriteAttribute.propertyName}] - Nested ${nestedWriteAttribute.relationshipName} attributes.\n`
+        }
+        fileContent += " */\n\n"
 
         const hasManyRelationFilePath = `${velociousPath}/database/record/instance-relationships/has-many.js`
 
         fileContent += `export default class ${modelNameCamelized}Base extends DatabaseRecord {\n`
 
+        fileContent += "  /**\n"
+        fileContent += `   * Creates a ${modelNameCamelized} record.\n`
+        fileContent += `   * @template {typeof ${modelNameCamelized}Base} T\n`
+        fileContent += "   * @this {T}\n"
+        fileContent += `   * @param {${writeAttributeTypeName}} [attributes] - Attributes for the new record.\n`
+        fileContent += "   * @returns {Promise<InstanceType<T>>} - Persisted record.\n"
+        fileContent += "   */\n"
+        fileContent += "  static async create(attributes) { return /** @type {Promise<InstanceType<T>>} */ (super.create(attributes)) }\n\n"
+
+        fileContent += "  /**\n"
+        fileContent += `   * Updates this ${modelNameCamelized} record.\n`
+        fileContent += `   * @param {${writeAttributeTypeName}} attributes - Attributes to assign before saving.\n`
+        fileContent += "   * @returns {Promise<void>} - Resolves when the record is saved.\n"
+        fileContent += "   */\n"
+        fileContent += "  async update(attributes) { return await super.update(attributes) }\n\n"
+
       // --- getModelClass() override (fixes polymorphic typing in JS/JSDoc) ---
       if (await fileExists(sourceModelFullFilePath)) {
         // Model file exists (e.g. src/models/ticket.js) → return typeof Ticket
@@ -138,7 +174,6 @@ export default class DbGenerateModel extends BaseCommand {
         fileContent += `  getModelClass() { return /** @type {typeof ${modelNameCamelized}Base} */ (this.constructor) }\n\n`
       }
 
-      const columns = await table.getColumns()
       let methodsCount = 0
 
       for (const column of columns) {
@@ -416,4 +451,35 @@ export default class DbGenerateModel extends BaseCommand {
 
     return this.jsDocTypeFromColumn(column, modelClass)
   }
+
+  /**
+   * Runs nested write attributes for model.
+   * @param {object} args - Arguments.
+   * @param {typeof import("../../../../../database/record/index.js").default} args.modelClass - Model class.
+   * @returns {Array<{propertyName: string, propertyType: string, relationshipName: string}>} - Nested write attributes.
+   */
+  nestedWriteAttributesForModel({modelClass}) {
+    const acceptedNestedAttributes = modelClass._acceptedNestedAttributes || {}
+    const nestedWriteAttributes = []
+
+    for (const relationshipName of Object.keys(acceptedNestedAttributes)) {
+      const relationship = modelClass.getRelationshipByName(relationshipName)
+      const relationshipType = relationship.getType()
+      const targetModelClass = relationship.getTargetModelClass()
+
+      if (!targetModelClass) throw new Error(`Relationship '${relationshipName}' on '${modelClass.getModelName()}' has no target model class`)
+
+      const targetModelFileName = inflection.dasherize(inflection.underscore(targetModelClass.getModelName()))
+      const targetWriteTypeName = `${inflection.camelize(targetModelClass.getModelName().replaceAll("-", "_"))}WriteAttributes`
+      const nestedType = `import("./${targetModelFileName}.js").${targetWriteTypeName}${acceptedNestedAttributes[relationshipName]?.allowDestroy ? " & {_destroy?: boolean}" : ""}`
+
+      nestedWriteAttributes.push({
+        propertyName: `${relationshipName}Attributes`,
+        propertyType: relationshipType == "hasMany" ? `Array<${nestedType}>` : nestedType,
+        relationshipName
+      })
+    }
+
+    return nestedWriteAttributes
+  }
 }

package/build/environment-handlers/node/cli/commands/generate/frontend-models.js

@@ -228,7 +228,12 @@ export default class DbGenerateFrontendModels extends BaseCommand {
       ? modelConfig.attachments
       : {}
     const attributesTypeName = `${className}Attributes`
+    const createAttributesTypeName = `${className}CreateAttributes`
+    const updateAttributesTypeName = `${className}UpdateAttributes`
     const attributeNames = attributes.map((attribute) => attribute.name)
+    const permittedCreateParams = this.permittedParamsForGenerator(resourceClass || null, "create")
+    const permittedUpdateParams = this.permittedParamsForGenerator(resourceClass || null, "update")
+    const nestedWriteTypes = this.nestedWriteTypesForModel({className, permittedParams: permittedCreateParams.concat(permittedUpdateParams), relationships})
     const builtInCollectionCommands = {
       create: modelConfig.builtInCollectionCommands.create || "create",
       index: modelConfig.builtInCollectionCommands.index || "index"
@@ -268,8 +273,32 @@ export default class DbGenerateFrontendModels extends BaseCommand {
       fileContent += ` * @property {${attribute.jsDocType}} ${attribute.name} - Attribute value.\n`
     }
     fileContent += " */\n"
+    for (const nestedWriteType of nestedWriteTypes) {
+      fileContent += "/**\n"
+      fileContent += ` * Attributes accepted for nested ${nestedWriteType.relationshipName} writes.\n`
+      fileContent += ` * @typedef {object} ${nestedWriteType.typeName}\n`
+      for (const nestedAttribute of nestedWriteType.attributes) {
+        fileContent += ` * @property {${nestedAttribute.type}} [${nestedAttribute.name}] - Nested ${nestedAttribute.name} value.\n`
+      }
+      fileContent += " */\n"
+    }
+    fileContent += this.writeAttributesTypedef({attributes, attributesTypeName, nestedWriteTypes, permittedParams: permittedCreateParams, typeName: createAttributesTypeName})
+    fileContent += this.writeAttributesTypedef({attributes, attributesTypeName, nestedWriteTypes, permittedParams: permittedUpdateParams, typeName: updateAttributesTypeName})
     fileContent += `/** Frontend model for ${className}. */\n`
     fileContent += `export default class ${className} extends FrontendModelBase {\n`
+    fileContent += "  /**\n"
+    fileContent += `   * Creates a ${className}.\n`
+    fileContent += `   * @param {${createAttributesTypeName}} [attributes] - Attributes for the new model.\n`
+    fileContent += `   * @returns {Promise<${className}>} - Persisted model.\n`
+    fileContent += "   */\n"
+    fileContent += `  static async create(attributes = {}) { return /** @type {Promise<${className}>} */ (super.create(attributes)) }\n\n`
+
+    fileContent += "  /**\n"
+    fileContent += `   * Updates this ${className}.\n`
+    fileContent += `   * @param {${updateAttributesTypeName}} [newAttributes] - Attributes to assign before saving.\n`
+    fileContent += `   * @returns {Promise<${className}>} - Updated model.\n`
+    fileContent += "   */\n"
+    fileContent += `  async update(newAttributes = {}) { return /** @type {Promise<${className}>} */ (super.update(newAttributes)) }\n\n`
     fileContent += "  /** @returns {FrontendModelResourceConfig} - Resource config. */\n"
     fileContent += "  static resourceConfig() {\n"
     fileContent += "    return {\n"
@@ -522,6 +551,146 @@ export default class DbGenerateFrontendModels extends BaseCommand {
     return content
   }
 
+  /**
+   * Runs write attributes typedef.
+   * @param {object} args - Arguments.
+   * @param {Array<{jsDocType: string, name: string}>} args.attributes - Generated read attributes.
+   * @param {string} args.attributesTypeName - Generated read attributes typedef name.
+   * @param {Array<{attributes: Array<{name: string, type: string}>, relationshipName: string, typeName: string}>} args.nestedWriteTypes - Nested write typedefs.
+   * @param {Array<string | Record<string, ?>>} args.permittedParams - Resource permitted params spec.
+   * @param {string} args.typeName - Typedef name.
+   * @returns {string} - Generated typedef source.
+   */
+  writeAttributesTypedef({attributes, attributesTypeName, nestedWriteTypes, permittedParams, typeName}) {
+    let output = "/**\n"
+
+    output += ` * Attributes accepted by ${typeName}.\n`
+    output += ` * @typedef {object} ${typeName}\n`
+
+    const attributesByName = new Map(attributes.map((attribute) => [attribute.name, attribute]))
+    const nestedWriteTypesByKey = new Map(nestedWriteTypes.map((nestedWriteType) => [`${nestedWriteType.relationshipName}Attributes`, nestedWriteType]))
+
+    for (const entry of permittedParams) {
+      if (typeof entry == "string") {
+        const attribute = attributesByName.get(entry)
+        const type = attribute ? `${attributesTypeName}[${JSON.stringify(attribute.name)}]` : "?"
+
+        output += ` * @property {${type}} [${entry}] - Permitted ${entry} value.\n`
+      } else if (entry && typeof entry == "object" && !Array.isArray(entry)) {
+        for (const key of Object.keys(entry)) {
+          const nestedWriteType = nestedWriteTypesByKey.get(key)
+          const type = nestedWriteType ? `Array<${nestedWriteType.typeName}>` : "Array<Record<string, ?>>"
+
+          output += ` * @property {${type}} [${key}] - Permitted nested ${key} values.\n`
+        }
+      }
+    }
+
+    output += " */\n"
+
+    return output
+  }
+
+  /**
+   * Runs nested write types for model.
+   * @param {object} args - Arguments.
+   * @param {string} args.className - Frontend model class name.
+   * @param {Array<string | Record<string, ?>>} args.permittedParams - Combined permitted params specs.
+   * @param {Array<{autoload: boolean, relationshipName: string, targetClassName: string, targetFileName: string, type: "belongsTo" | "hasOne" | "hasMany"}>} args.relationships - Generated relationships.
+   * @returns {Array<{attributes: Array<{name: string, type: string}>, relationshipName: string, typeName: string}>} - Nested write typedefs.
+   */
+  nestedWriteTypesForModel({className, permittedParams, relationships}) {
+    const relationshipsByName = new Map(relationships.map((relationship) => [relationship.relationshipName, relationship]))
+    const nestedWriteTypesByName = new Map()
+
+    for (const entry of permittedParams) {
+      if (!entry || typeof entry != "object" || Array.isArray(entry)) continue
+
+      for (const key of Object.keys(entry)) {
+        if (!key.endsWith("Attributes")) continue
+        const relationshipName = key.slice(0, -"Attributes".length)
+        const nestedSpec = entry[key]
+        const relationship = relationshipsByName.get(relationshipName)
+        let targetModelClass
+
+        if (relationship) {
+          try {
+            targetModelClass = this.getConfiguration().getModelClass(relationship.targetClassName)
+          } catch {
+            targetModelClass = undefined
+          }
+        }
+
+        if (nestedWriteTypesByName.has(relationshipName)) continue
+
+        nestedWriteTypesByName.set(relationshipName, {
+          attributes: this.nestedWriteAttributesForSpec({nestedSpec, targetModelClass}),
+          relationshipName,
+          typeName: `${className}${inflection.camelize(relationshipName)}NestedAttributes`
+        })
+      }
+    }
+
+    return Array.from(nestedWriteTypesByName.values())
+  }
+
+  /**
+   * Runs nested write attributes for spec.
+   * @param {object} args - Arguments.
+   * @param {?} args.nestedSpec - Nested permit spec.
+   * @param {typeof import("../../../../../database/record/index.js").default | undefined} args.targetModelClass - Target backend model class.
+   * @returns {Array<{name: string, type: string}>} - Nested write attributes.
+   */
+  nestedWriteAttributesForSpec({nestedSpec, targetModelClass}) {
+    if (!Array.isArray(nestedSpec)) return []
+
+    return nestedSpec.filter((entry) => typeof entry == "string").map((attributeName) => {
+      const attributeConfig = this.frontendAttributeConfigForModelAttribute({attributeName, modelClass: targetModelClass})
+
+      return {
+        name: attributeName,
+        type: attributeConfig ? this.jsDocTypeForFrontendAttribute({attributeConfig}) : "?"
+      }
+    })
+  }
+
+  /**
+   * Runs permitted params for generator.
+   * @param {import("../../../../../configuration-types.js").FrontendModelResourceClassType | null} resourceClass - Resource class.
+   * @param {"create" | "update"} action - Write action.
+   * @returns {Array<string | Record<string, ?>>} - Permitted params spec.
+   */
+  permittedParamsForGenerator(resourceClass, action) {
+    if (!resourceClass || typeof resourceClass !== "function") return []
+
+    const prototypeWithMethod = /**
+                                 * Resource prototype.
+                                 * @type {{permittedParams?: (arg?: object) => Array<string | Record<string, ?>>}}
+                                 */ (resourceClass.prototype)
+
+    if (typeof prototypeWithMethod?.permittedParams !== "function") return []
+
+    try {
+      const instance = new resourceClass({
+        ability: undefined,
+        context: {},
+        locals: {},
+        modelClass: resourceClass.ModelClass,
+        modelName: resourceClass.ModelClass?.getModelName?.() || resourceClass.name,
+        params: {},
+        resourceConfiguration: /**
+                                * Resource configuration.
+                                * @type {import("../../../../../configuration-types.js").FrontendModelResourceConfiguration}
+                                */ ({attributes: []})
+      })
+      const spec = instance.permittedParams({action, ability: undefined, locals: {}, params: {}})
+
+      return Array.isArray(spec) ? spec : []
+    } catch (error) {
+      throw new Error(`Failed to invoke ${resourceClass.name}.permittedParams() while generating frontend model write types: ${error instanceof Error ? error.message : String(error)}`, {cause: error})
+    }
+  }
+
   /**
    * Invokes a backend resource's `permittedParams()` instance method at
    * generation time and extracts the relationship names that accept

package/build/frontend-model-controller.js

@@ -465,22 +465,45 @@ function frontendModelAttachmentParams(params) {
 /**
  * Extract mutation attributes shared by create and update commands.
  * @param {Record<string, ?>} params - Frontend-model request params.
- * @returns {{attributes: Record<string, ?>, nestedAttributes: Record<string, ?> | null} | string} - Mutation attributes or validation error message.
+ * @returns {{attributes: Record<string, ?>, attachments: Record<string, ?> | null, nestedAttributes: Record<string, ?> | null} | string} - Mutation attributes or validation error message.
  */
 function frontendModelMutationAttributes(params) {
   const attributes = params.attributes
 
-  if (!attributes || typeof attributes !== "object") {
+  if (!isPlainObject(attributes)) {
     return "Expected model attributes."
   }
 
+  /** @type {Record<string, ?>} */
+  const regularAttributes = {}
+  /** @type {Record<string, ?>} */
+  const nestedAttributes = {}
+
+  for (const [attributeName, value] of Object.entries(attributes)) {
+    if (attributeName.endsWith("Attributes")) {
+      const relationshipName = attributeName.slice(0, -"Attributes".length)
+
+      if (!relationshipName) return `Invalid nested attributes key: ${attributeName}`
+      nestedAttributes[relationshipName] = value
+    } else {
+      regularAttributes[attributeName] = value
+    }
+  }
+
+  if (params.nestedAttributes !== undefined) {
+    if (!isPlainObject(params.nestedAttributes)) return "Expected nestedAttributes to be an object."
+
+    Object.assign(nestedAttributes, params.nestedAttributes)
+  }
+
+  if (params.attachments !== undefined && !isPlainObject(params.attachments)) {
+    return "Expected attachments to be an object."
+  }
+
   return {
-    attributes,
-    nestedAttributes: params.nestedAttributes && typeof params.nestedAttributes === "object"
-      ? /**
-         * Types the following value.
-          @type {Record<string, ?>} */ (params.nestedAttributes)
-      : null
+    attributes: regularAttributes,
+    attachments: params.attachments === undefined ? null : params.attachments,
+    nestedAttributes: Object.keys(nestedAttributes).length > 0 ? nestedAttributes : null
   }
 }
 
@@ -1036,11 +1059,12 @@ export default class FrontendModelController extends Controller {
    * Runs frontend model create record.
    * @param {Record<string, ?>} attributes - Create attributes.
    * @param {Record<string, ?> | null} [nestedAttributes] - Optional nested-attribute payload for cascading writes.
+   * @param {Record<string, ?> | null} [attachments] - Optional attachment payloads keyed by attachment name.
    * @returns {Promise<import("./database/record/index.js").default | null>} - Created model when authorized.
    */
-  async frontendModelCreateRecord(attributes, nestedAttributes = null) {
+  async frontendModelCreateRecord(attributes, nestedAttributes = null, attachments = null) {
     const resource = this.frontendModelResourceInstance()
-    const model = await resource.create(attributes, {nestedAttributes, controller: this})
+    const model = await resource.create(attributes, {attachments, nestedAttributes, controller: this})
 
     const authorizedModels = await this.frontendModelFilterAuthorizedModels({action: "create", models: [model]})
 
@@ -2943,7 +2967,11 @@ export default class FrontendModelController extends Controller {
       const mutationAttributes = frontendModelMutationAttributes(params)
       if (typeof mutationAttributes === "string") return this.frontendModelErrorPayload(mutationAttributes)
 
-      const model = await this.frontendModelCreateRecord(mutationAttributes.attributes, mutationAttributes.nestedAttributes)
+      const model = await this.frontendModelCreateRecord(
+        mutationAttributes.attributes,
+        mutationAttributes.nestedAttributes,
+        mutationAttributes.attachments
+      )
 
       if (!model) {
         return this.frontendModelErrorPayload(`${modelClass.name} not found.`)
@@ -3056,7 +3084,11 @@ export default class FrontendModelController extends Controller {
         return this.frontendModelErrorPayload(`${modelClass.name} not found.`)
       }
 
-      const updatedModel = await resource.update(model, mutationAttributes.attributes, {nestedAttributes: mutationAttributes.nestedAttributes, controller: this})
+      const updatedModel = await resource.update(model, mutationAttributes.attributes, {
+        attachments: mutationAttributes.attachments,
+        controller: this,
+        nestedAttributes: mutationAttributes.nestedAttributes
+      })
       const serializedModel = await resource.serialize(updatedModel, "update")
 
       return frontendModelSerializedModelSuccess(serializedModel)