Prisma 7.10

Apply the Node.js 24, TypeScript 7, and JavaScript ES2026 prompts first. These rules cover Prisma 7.10 query safety, raw SQL, data models, selection, tenant isolation, transactions, connection security, logging, migrations, and deployment.

Query construction

• Use Prisma Client's structured query methods for attacker-influenced filters and values.
• Build dynamic where, orderBy, select, include, relation, and operation shapes from exact server-side allowlists, and never pass a request object as a whole where, orderBy, select, or include argument.
• Bound pagination, filter nesting, relation traversal, selected fields, result rows, and query duration.
• Prevent request data from removing mandatory tenant, ownership, soft-delete, or authorization predicates. Reject undefined and Prisma.skip for required filter values; Prisma silently omits undefined unless strictUndefinedChecks is enabled.
• Parse every request value bound to a scalar field in a Prisma where or data argument to its expected primitive type before query construction, for example with z.string().parse(body.token), then validate identifiers, enums, dates, numbers, JSON fields, and cross-field invariants. Scalar where positions also accept filter objects such as { not: '' } or { startsWith: 'a' }, so passing req.body or req.query fields straight into findFirst({ where: { resetToken } }) lets an attacker match any row or leak values by prefix; numeric update fields likewise accept operations such as { increment: n }.

Raw queries

• Prefer generated