velocious 1.0.570 → 1.0.572

package/README.md

@@ -15,6 +15,7 @@
 * Declarative client sync scopes with per-scope cursors, automatic mutation tracking, realtime delivery, and `sync`/`pull` progress reporting for "X of Y" import screens (see [docs/sync-client.md](docs/sync-client.md))
 * Reactive `useLiveQuery(Model.where(...))` queries that stay current from committed local model changes across local writes, pulls, and realtime (see [docs/live-queries.md](docs/live-queries.md))
 * Server-side sync envelope replay orchestration for app-owned sync receivers (see [docs/sync-envelope-replay-service.md](docs/sync-envelope-replay-service.md))
+* AwesomeTasks-shaped offline sync proof using routed resources, domain commands, signed offline grants, and peer-forwarded mutations (see [docs/awesome-tasks-offline-sync-proof.md](docs/awesome-tasks-offline-sync-proof.md))
 * SQLite web persistence that automatically prefers OPFS, then IndexedDB, and migrates legacy persisted bytes when possible (see [docs/sqlite-web-persistence.md](docs/sqlite-web-persistence.md))
 * Expo / Metro compatibility guidance and a real Expo export check (see [docs/expo-metro-compatibility.md](docs/expo-metro-compatibility.md))
 * Gap-less positional lists with automatic reordering via `actsAsList`, including models with numeric, string, or UUID primary keys (see [docs/acts-as-list.md](docs/acts-as-list.md))
@@ -26,8 +27,10 @@
 * Translated model attributes with current-locale relationship sorting (see [docs/translations.md](docs/translations.md))
 * Cross-process broadcast bus for `broadcastToChannel` via `velocious beacon`, including background job runner processes (see [docs/beacon.md](docs/beacon.md))
 * Configurable HTTP server worker handlers plus backpressured, descriptor-only file responses with completion callbacks (see [docs/http-server.md](docs/http-server.md))
+* Default-on buffered HTTP response compression with Brotli/gzip content negotiation, global and per-response opt-outs, and HEAD-correct representation headers (see [docs/http-server.md](docs/http-server.md#response-compression))
 * Background jobs with failure events for production reporting and authorized database-scoped dashboard count snapshots/deltas (see [docs/background-jobs.md](docs/background-jobs.md) and [docs/background-jobs-dashboard.md](docs/background-jobs-dashboard.md))
 * Durable one-off background-job scheduling with exact epoch timestamps (see [docs/scheduled-background-job-enqueue.md](docs/scheduled-background-job-enqueue.md))
+* Mountable authenticated callable deployment API with allowlisted projects/stages, immutable-revision validation, idempotent runs, duplicate-safe interruption reconciliation, and adapter-owned execution for integrations like Rampway (see [docs/deployment-api.md](docs/deployment-api.md))
 * Rails-style request and database query logging (see [docs/logging.md](docs/logging.md))
 * EJS-backed mailers with delivery, queueing, and payload rendering support (see [docs/mailers.md](docs/mailers.md))
 * Trusted reverse proxy handling for `request.remoteAddress()` (see [docs/trusted-proxies.md](docs/trusted-proxies.md))
@@ -93,6 +96,45 @@ npm run test:expo
 
 Maintainers cutting a package release must follow the [Velocious release runbook](docs/releasing.md); `npm run release:patch` commits, pushes, and publishes rather than acting as a local-only version command.
 
+# Docker development environment
+
+The checked-in root `Dockerfile` and `compose.yml` define one canonical `dev` service used by humans, CI, and agent systems alike (see [docs/docker-development-environment.md](docs/docker-development-environment.md)). The image is Ubuntu 26.04 LTS (pinned by digest) with Node.js 24.x from signed NodeSource, the universal apt coding/debugging baseline, and the newest published provider CLIs; it is source-independent — no project source is copied and no project dependencies are installed at image build time.
+
+Prerequisites: Docker with the Compose v2 plugin, and this repository checked out at `$DEV_HOME_PATH/velocious` (default `DEV_HOME_PATH`: `/home/dev`).
+
+First-use setup: copy `.env.example` to the git-ignored `.env` and set `GH_CONFIG_SOURCE_PATH` to an existing host GitHub CLI config directory:
+
+```bash
+cp .env.example .env
+```
+
+`$DEV_HOME_PATH` must be a dedicated development home that already exists, holds no credentials or secrets, and is owned by (or at least writable by) UID/GID 1000 — the in-container `dev` user. Do not point it at a general host home directory, and do not recursively chown an existing home; the external environment owns safe initial provisioning.
+
+Normal usage:
+
+```bash
+docker compose up --build --detach dev
+docker compose exec dev bash
+scripts/docker-run.sh npm ci   # one-off command in a disposable container
+```
+
+The dev service preserves the complete `$DEV_HOME_PATH` bind at `/home/dev`, so dependencies, caches, settings, and `node_modules` persist naturally across runs. Install dependencies with the normal package commands inside the service (for example `docker compose exec dev npm ci`), never at image build time.
+
+Concurrent isolated instances use the standard Compose project-name contract plus a distinct development home per instance:
+
+```bash
+COMPOSE_PROJECT_NAME=velocious-review DEV_HOME_PATH=/srv/dev-homes/review \
+  docker compose up --build --detach dev
+```
+
+GitHub CLI authentication is the sole authorized credential boundary: the host config directory named by `GH_CONFIG_SOURCE_PATH` is mounted read-only at `/home/dev/.config/gh`, with container-side `GH_CONFIG_DIR` pointing there. Do not add SSH keys or other credential mounts. Kimi (and other provider) credentials are intentionally kept out of the tracked Compose files — they are an external operational override layered on by the calling environment. Threadwire is not installed in the image or the project; it remains parent orchestration resolved through unversioned `npx` outside the container.
+
+After changing the Docker artifacts, run the checked-in static contract verifier:
+
+```bash
+npm run verify:docker-dev-environment
+```
+
 # Code quality (fallow)
 
 [fallow](https://github.com/fallow-rs/fallow) analyzes the codebase for unused/dead code, duplication, and complexity. CI runs it as a **regression gate**: it fails only on findings beyond the committed baseline in `fallow-baselines/`, so existing backlog never blocks a PR but new issues do.
@@ -1831,6 +1873,8 @@ this.getConfiguration().getWebsocketEvents().publish(channel, payload)
 this.renderJsonArg({status: "published"})
 ```
 
+Publishes are queued per channel: events on the same channel are persisted and dispatched in FIFO order, while a slow or failing channel never delays unrelated channels. `configuration.awaitPendingBroadcasts()` settles once every broadcast accepted before the call has settled. See [docs/websocket-channels.md](docs/websocket-channels.md#publish-ordering-and-failure-semantics) for the full ordering and failure contract.
+
 ## Websocket channels
 
 You can resolve websocket channel classes from subscribe messages and let them decide which streams to allow:
@@ -2365,6 +2409,8 @@ When the server runs in the `development` environment, Velocious watches applica
 
 Starting the HTTP server creates `tmp/server.lock` under the configured application directory before Beacon, workers, or the TCP listener start. A second server for the same app fails fast with the lock owner details instead of partially starting. Normal shutdown removes the lock; stale locks with a dead local PID are reclaimed automatically, while locks from another host or unreadable metadata should be removed manually only after confirming no server is running. See [docs/http-server.md](docs/http-server.md#server-lock).
 
+Buffered string and `Uint8Array` responses are compressed with Brotli (`br`) or gzip by default whenever request negotiation and response eligibility allow — no opt-in is required. Disable compression globally with `httpServer.compression: false` or `httpServer.compression: {enabled: false}`, and tune it with `threshold`/`brotliQuality`/`gzipLevel` overrides. Negotiation honors `Accept-Encoding` q-values, wildcards, and identity semantics (empty `406` when no acceptable representation exists), merges `Accept-Encoding` into `Vary`, and skips streamed `sendFile` responses, already-encoded or `no-transform` responses, server-sent events, partial/range responses, bodyless statuses, and non-allowlisted content types. Transformation is additionally excluded automatically for credentialed traffic and validator-carrying responses — requests with `Authorization`/`Cookie` and responses with `Set-Cookie`, `ETag`, `Digest`, or `Content-Digest` are never compressed (compression-oracle protection, and validators stay application-owned). Controllers opt out per response with `response.disableCompression()`, and HEAD requests compute GET-equivalent representation headers without emitting a body. See [docs/http-server.md](docs/http-server.md#response-compression).
+
 # Authorization (CanCan-style)
 
 Define resource classes with an `abilities()` method and use `can` / `cannot` rules to constrain model access.

package/build/background-jobs/web/authorization.js

@@ -1,37 +1,6 @@
 // @ts-check
 
-import crypto from "node:crypto"
-
-/**
- * Constant-time comparison so token checks don't leak length/contents through
- * timing. Returns false for differing lengths before the timing-safe compare.
- * @param {string} a - First value.
- * @param {string} b - Second value.
- * @returns {boolean} - Whether the values are equal.
- */
-function safeEqual(a, b) {
-  const bufferA = Buffer.from(String(a))
-  const bufferB = Buffer.from(String(b))
-
-  if (bufferA.length !== bufferB.length) return false
-
-  return crypto.timingSafeEqual(bufferA, bufferB)
-}
-
-/**
- * Runs bearer token.
- * @param {import("../../http-server/client/request.js").default | import("../../http-server/client/websocket-request.js").default} request - Request object.
- * @returns {string | null} - Bearer token from the Authorization header, if any.
- */
-function bearerToken(request) {
-  const header = request.header("authorization")
-
-  if (typeof header !== "string") return null
-
-  const match = header.match(/^Bearer\s+(.+)$/i)
-
-  return match ? match[1].trim() : null
-}
+import {bearerToken, constantTimeEqual} from "../../utils/bearer-token.js"
 
 /**
  * Runs is loopback.
@@ -72,7 +41,7 @@ export async function authorizeJobsRequest({ability, configuration, options, req
 
   if (accessTokens.length > 0 && token) {
     for (const accessToken of accessTokens) {
-      if (safeEqual(token, accessToken)) return true
+      if (constantTimeEqual(token, accessToken)) return true
     }
   }
 

package/build/background-jobs/web/path-matcher.js

@@ -1,28 +1,13 @@
 // @ts-check
 
+import {mountSubPath, normalizeMountPrefix} from "../../utils/mount-prefix.js"
+
 /**
  * @typedef {object} JobsApiMatch
  * @property {string} action - Controller action to run.
  * @property {Record<string, string>} params - Extra params extracted from the path.
  */
-
-/**
- * Normalizes a mount prefix: ensures a leading slash and strips any trailing
- * slash so `/velocious/jobs/` and `/velocious/jobs` behave identically.
- * @param {string} at - Raw mount prefix.
- * @returns {string} - Normalized prefix.
- */
-export function normalizeMountPrefix(at) {
-  if (typeof at !== "string" || !at.startsWith("/")) {
-    throw new Error(`mount requires an 'at' path starting with '/', got: ${String(at)}`)
-  }
-
-  if (at.length > 1 && at.endsWith("/")) {
-    return at.slice(0, -1)
-  }
-
-  return at
-}
+export {normalizeMountPrefix}
 
 /**
  * Matches an incoming request against the read-only jobs API routes that live
@@ -35,19 +20,9 @@ export function normalizeMountPrefix(at) {
  * @returns {JobsApiMatch | null} - Matched action or null.
  */
 export function matchJobsApiPath({prefix, path, method}) {
-  /** @type {string} */
-  let subPath
+  const subPath = mountSubPath({prefix, path})
 
-  if (prefix === "/") {
-    // Root mount: the whole path is the sub-path (avoid building a "//" guard).
-    subPath = path
-  } else if (path === prefix) {
-    subPath = "/"
-  } else if (path.startsWith(`${prefix}/`)) {
-    subPath = path.slice(prefix.length)
-  } else {
-    return null
-  }
+  if (subPath === null) return null
 
   if (method === "GET" && subPath === "/api/health") return {action: "health", params: {}}
   if (method === "GET" && subPath === "/api/stats") return {action: "stats", params: {}}

package/build/configuration-types.js

@@ -249,8 +249,25 @@
  * @property {number} [unreachableReportMs] - Grace window (ms) a beacon connect/disconnect blip must persist before it is reported as a framework-error. Transient outages that recover within this window (e.g. a deploy restarting the broker) are not reported. Defaults to 30000.
  */
 
+/**
+ * @typedef {object} HttpCompressionConfiguration
+ * @property {boolean} [enabled] - Whether buffered response compression is enabled. Defaults to true; set false to disable globally.
+ * @property {number} [threshold] - Minimum buffered body size in bytes before compression is applied. Defaults to 1024.
+ * @property {number} [brotliQuality] - Brotli encoder quality (0-11). Defaults to 4.
+ * @property {number} [gzipLevel] - Gzip compression level (0-9). Defaults to 6.
+ */
+
+/**
+ * @typedef {object} NormalizedHttpCompressionConfiguration
+ * @property {boolean} enabled - Whether buffered HTTP response compression is enabled.
+ * @property {number} threshold - Minimum buffered body size in bytes before compression is applied.
+ * @property {number} brotliQuality - Brotli encoder quality (0-11).
+ * @property {number} gzipLevel - Gzip compression level (0-9).
+ */
+
 /**
  * @typedef {object} HttpServerConfiguration
+ * @property {boolean | HttpCompressionConfiguration} [compression] - Buffered response compression. Enabled with documented defaults when absent; false or {enabled: false} disables it globally.
  * @property {string} [host] - Hostname to bind the HTTP server to.
  * @property {boolean} [inProcess] - Run HTTP handlers in the main thread instead of worker threads.
  * @property {number} [maxWorkers] - Backward-compatible alias for workers.

package/build/configuration.js

@@ -120,6 +120,10 @@ const DEFAULT_WEBSOCKET_INBOUND_MAX_PENDING_MESSAGES = 256
 const DEFAULT_WEBSOCKET_OUTBOUND_MAX_PENDING_BYTES = 16 * 1024 * 1024
 const DEFAULT_WEBSOCKET_OUTBOUND_MAX_PENDING_FRAMES = 256
 
+const DEFAULT_COMPRESSION_THRESHOLD = 1024
+const DEFAULT_COMPRESSION_BROTLI_QUALITY = 4
+const DEFAULT_COMPRESSION_GZIP_LEVEL = 6
+
 /**
  * Validates a positive safe integer configuration value.
  * @param {?} value - Configured positive safe integer.
@@ -136,6 +140,63 @@ function positiveSafeInteger(value, name, defaultValue) {
   return value
 }
 
+/**
+ * Validates an integer configuration value inside an inclusive range.
+ * @param {?} value - Configured integer.
+ * @param {string} name - Configuration key.
+ * @param {number} min - Minimum accepted value (inclusive).
+ * @param {number} max - Maximum accepted value (inclusive).
+ * @param {number} defaultValue - Default value.
+ * @returns {number} - Validated configured or default value.
+ */
+function integerInRange(value, name, min, max, defaultValue) {
+  if (value === undefined) return defaultValue
+  if (typeof value !== "number" || !Number.isInteger(value) || value < min || value > max) {
+    throw new TypeError(`${name} must be an integer between ${min} and ${max}`)
+  }
+
+  return value
+}
+
+/**
+ * Normalizes the buffered HTTP response compression configuration. Compression is
+ * enabled by default when the setting is absent; `false` or `{enabled: false}`
+ * disables it globally.
+ * @param {boolean | import("./configuration-types.js").HttpCompressionConfiguration | undefined} value - Configured compression value.
+ * @returns {import("./configuration-types.js").NormalizedHttpCompressionConfiguration} - Normalized compression configuration.
+ */
+function normalizeHttpCompression(value) {
+  if (value === undefined || value === true) {
+    return {enabled: true, threshold: DEFAULT_COMPRESSION_THRESHOLD, brotliQuality: DEFAULT_COMPRESSION_BROTLI_QUALITY, gzipLevel: DEFAULT_COMPRESSION_GZIP_LEVEL}
+  }
+
+  if (value === false) {
+    return {enabled: false, threshold: DEFAULT_COMPRESSION_THRESHOLD, brotliQuality: DEFAULT_COMPRESSION_BROTLI_QUALITY, gzipLevel: DEFAULT_COMPRESSION_GZIP_LEVEL}
+  }
+
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`httpServer.compression must be a boolean or an object, got: ${String(value)}`)
+  }
+
+  const {brotliQuality, enabled, gzipLevel, threshold, ...restCompression} = value
+  const restCompressionKeys = Object.keys(restCompression)
+
+  if (restCompressionKeys.length > 0) {
+    throw new TypeError(`httpServer.compression received unknown keys: ${restCompressionKeys.join(", ")} (supported: brotliQuality, enabled, gzipLevel, threshold)`)
+  }
+
+  if (enabled !== undefined && typeof enabled !== "boolean") {
+    throw new TypeError(`httpServer.compression.enabled must be a boolean, got: ${String(enabled)}`)
+  }
+
+  return {
+    enabled: enabled ?? true,
+    threshold: positiveSafeInteger(threshold, "httpServer.compression.threshold", DEFAULT_COMPRESSION_THRESHOLD),
+    brotliQuality: integerInRange(brotliQuality, "httpServer.compression.brotliQuality", 0, 11, DEFAULT_COMPRESSION_BROTLI_QUALITY),
+    gzipLevel: integerInRange(gzipLevel, "httpServer.compression.gzipLevel", 0, 9, DEFAULT_COMPRESSION_GZIP_LEVEL)
+  }
+}
+
 export default class VelociousConfiguration {
   /**
    * Close database connections promise.
@@ -236,6 +297,7 @@ export default class VelociousConfiguration {
 
     this.httpServer = {
       ...(httpServer || {}),
+      compression: normalizeHttpCompression(httpServer?.compression),
       websocketInboundQueue: {
         maxPendingBytes: positiveSafeInteger(websocketInboundQueue?.maxPendingBytes, "httpServer.websocketInboundQueue.maxPendingBytes", DEFAULT_WEBSOCKET_INBOUND_MAX_PENDING_BYTES),
         maxPendingMessages: positiveSafeInteger(websocketInboundQueue?.maxPendingMessages, "httpServer.websocketInboundQueue.maxPendingMessages", DEFAULT_WEBSOCKET_INBOUND_MAX_PENDING_MESSAGES)
@@ -500,6 +562,14 @@ export default class VelociousConfiguration {
     return this.cors
   }
 
+  /**
+   * Runs get http server compression.
+   * @returns {import("./configuration-types.js").NormalizedHttpCompressionConfiguration} - Normalized buffered response compression configuration.
+   */
+  getHttpServerCompression() {
+    return this.httpServer.compression
+  }
+
   /**
    * Runs get cookie secret.
    * @returns {string | undefined} - Cookie secret.

package/build/database/drivers/base.js

@@ -961,6 +961,23 @@ export default class VelociousDatabaseDriversBase {
    */
   supportsDefaultPrimaryKeyUUID() { return false }
 
+  /**
+   * Executes an insert that carries an explicit primary-key value
+   * (client-generated offline-sync ids). Drivers whose auto-increment columns
+   * reject explicit values (MSSQL IDENTITY) override this to run the insert
+   * with identity insert enabled in a single request.
+   * @param {object} args - Options object.
+   * @param {QueryOptions} args.options - Query options for the standard query path.
+   * @param {string} args.sql - Generated insert SQL.
+   * @param {string} args.tableName - Table being inserted into.
+   * @returns {Promise<QueryResultType>} - Insert result.
+   */
+  async insertWithExplicitPrimaryKey({options, sql, tableName}) {
+    void tableName
+
+    return await this.query(sql, options)
+  }
+
   /**
    * Runs supports insert into returning.
    * @abstract

package/build/database/drivers/mssql/index.js

@@ -362,6 +362,36 @@ export default class VelociousDatabaseDriversMssql extends Base{
   shouldSetAutoIncrementWhenPrimaryKey() { return true }
   supportsDefaultPrimaryKeyUUID() { return true }
 
+  /**
+   * Runs an explicit primary-key insert as one batch request: SQL Server scopes
+   * IDENTITY_INSERT to the session, and node-mssql pool-backed requests may use
+   * a different physical session per query, so enabling it in a separate query
+   * can leave the actual INSERT on another session. A single batch keeps the
+   * whole sequence on one session by construction: enable, insert, disable on
+   * success, and a CATCH that disables and rethrows the original error.
+   * @param {object} args - Options object.
+   * @param {import("../base.js").QueryOptions} args.options - Query options for the standard query path.
+   * @param {string} args.sql - Generated insert SQL.
+   * @param {string} args.tableName - Table being inserted into.
+   * @returns {Promise<import("../base.js").QueryResultType>} - Insert result.
+   */
+  async insertWithExplicitPrimaryKey({options, sql, tableName}) {
+    const quotedTable = this.quoteTable(tableName)
+    const batch = [
+      `SET IDENTITY_INSERT ${quotedTable} ON;`,
+      "BEGIN TRY",
+      `${sql};`,
+      `SET IDENTITY_INSERT ${quotedTable} OFF;`,
+      "END TRY",
+      "BEGIN CATCH",
+      `SET IDENTITY_INSERT ${quotedTable} OFF;`,
+      "THROW;",
+      "END CATCH"
+    ].join("\n")
+
+    return await this.query(batch, options)
+  }
+
   /**
    * Runs escape.
    * @param {?} value - Value to use.

package/build/database/record/index.js

@@ -4248,15 +4248,21 @@ class VelociousDatabaseRecord {
    * @returns {Promise<void>} - Resolves when complete.
    */
   async _createNewRecord() {
-    if (!this.getModelClass().connection()["insertSql"]) {
-      throw new Error(`No insertSql on ${this.getModelClass().connection().constructor.name}`)
+    // Resolve the connection once and pin the whole insert path to it: a pool
+    // can resolve a different current connection across the awaits below, and
+    // the identity-insert wrapper is only effective on the exact session that
+    // ran SET IDENTITY_INSERT.
+    const connection = this._connection()
+
+    if (!connection["insertSql"]) {
+      throw new Error(`No insertSql on ${connection.constructor.name}`)
     }
 
     const data = Object.assign({}, this._belongsToChanges(), this.rawAttributes())
     const primaryKey = this.getModelClass().primaryKey()
     const primaryKeyColumn = this.getModelClass().getColumns().find((column) => column.getName() == primaryKey)
     const primaryKeyType = primaryKeyColumn?.getType()?.toLowerCase()
-    const driverSupportsDefaultUUID = typeof this._connection().supportsDefaultPrimaryKeyUUID == "function" && this._connection().supportsDefaultPrimaryKeyUUID()
+    const driverSupportsDefaultUUID = typeof connection.supportsDefaultPrimaryKeyUUID == "function" && connection.supportsDefaultPrimaryKeyUUID()
     const isUUIDPrimaryKey = primaryKeyType?.includes("uuid")
     const shouldAssignUUIDPrimaryKey = isUUIDPrimaryKey && !driverSupportsDefaultUUID
     this._setDefaultTimestampValues(data)
@@ -4270,14 +4276,20 @@ class VelociousDatabaseRecord {
 
     this._normalizeDateValuesForWrite(data)
 
-    const sql = this._connection().insertSql({
+    const sql = connection.insertSql({
       returnLastInsertedColumnNames: columnNames,
       tableName: this._tableName(),
       data
     })
-    const insertResult = await this._connection().query(sql, {logName: `${this.getModelClass().name} Create`})
-
-    await this._applyInsertResult({data, insertResult, primaryKey})
+    const insertOptions = {logName: `${this.getModelClass().name} Create`}
+    // Explicit primary-key inserts into auto-increment columns go through the
+    // driver's explicit-primary-key insert (MSSQL wraps it in IDENTITY_INSERT);
+    // everything else uses the plain query path.
+    const insertResult = hasUserProvidedPrimaryKey && primaryKeyColumn?.getAutoIncrement() === true
+      ? await connection.insertWithExplicitPrimaryKey({options: insertOptions, sql, tableName: this._tableName()})
+      : await connection.query(sql, insertOptions)
+
+    await this._applyInsertResult({connection, data, insertResult, primaryKey})
     this.setIsNewRecord(false)
 
     this._markLoadedRelationshipsPreloadedAfterCreate()
@@ -4303,10 +4315,10 @@ class VelociousDatabaseRecord {
 
   /**
    * Applies the database insert response to this record.
-   * @param {{data: Record<string, string | number | boolean | Date | null | undefined>, insertResult: Array<Record<string, string | number | boolean | Date | null | undefined>> | null | undefined, primaryKey: string}} options - Inserted data, connection result, and primary key column name.
+   * @param {{connection: import("../drivers/base.js").default, data: Record<string, string | number | boolean | Date | null | undefined>, insertResult: Array<Record<string, string | number | boolean | Date | null | undefined>> | null | undefined, primaryKey: string}} options - Pinned insert connection, inserted data, connection result, and primary key column name.
    * @returns {Promise<void>} - Resolves when complete.
    */
-  async _applyInsertResult({data, insertResult, primaryKey}) {
+  async _applyInsertResult({connection, data, insertResult, primaryKey}) {
     if (Array.isArray(insertResult) && insertResult[0] && insertResult[0][primaryKey]) {
       this._attributes = insertResult[0]
       this._changes = {}
@@ -4322,7 +4334,7 @@ class VelociousDatabaseRecord {
         return
       }
 
-      const id = await this._connection().lastInsertID()
+      const id = await connection.lastInsertID()
 
       await this._reloadWithId(id)
     }