feat: add bind parameter support to Model#bulkCreate - #17752

packages/core/src/model.d.ts (1)

1212-1218: Add parameterStyle option: good; consider DRYing the union and tighten docs.

• Suggest exporting a shared alias (e.g., export type ParameterStyle = 'replacement' | 'bind') and reusing it here and in QueryInterface types to prevent drift.
• Minor doc nit: end the “Defaults to …” sentence with a period and optionally add a “Since” tag.

+export type ParameterStyle = 'replacement' | 'bind';
 ...
-  parameterStyle?: 'replacement' | 'bind';
+  parameterStyle?: ParameterStyle;

packages/core/test/integration/model/bulk-create.test.js (1)

170-213: Bind-mode assertion coverage looks good; add a control test for replacement mode.

To lock backward-compatibility, add a sibling test with parameterStyle: 'replacement' asserting the previous literal/placeholder shape for each dialect.

packages/core/test/unit/sql/insert.test.js (1)

378-395: Add bind assertions for stronger coverage

This case changes queries to use bind placeholders but does not assert the bind map. Adding the expected binds (e.g., sequelize_1: 0, sequelize_2: null) would improve signal and catch regressions.

packages/core/test/unit/query-interface/bulk-insert.test.ts (1)

66-68: Optionally validate bind values for edge indices

Quick sanity check (first/last) catches off‑by‑one mistakes in placeholder sequencing.

const bind = stub.getCall(0).args[1].bind;
expect(bind).to.include({ sequelize_1: 'user0' });
expect(bind).to.have.property('sequelize_2000', 'user1999');

Also applies to: 72-72

packages/core/src/abstract-dialect/query-interface.d.ts (2)

38-41: Document parameterStyle and its default/usage

Add JSDoc so users understand defaults, when to choose each mode, and the PG bind limit caveat mentioned in the PR description.

-export interface QiBulkInsertOptions extends QiOptionsWithReplacements {
-  parameterStyle?: 'replacement' | 'bind';
-}
+/**
+ * Bulk-insert options.
+ *
+ * parameterStyle controls how values are sent to the driver:
+ * - 'bind' (recommended): uses driver bind parameters and returns `{ query, bind }` internally.
+ *   This is safer and avoids SQL injection, but some drivers impose a maximum bind count
+ *   (e.g., PostgreSQL ~65,535). Chunk very large payloads if you hit this limit.
+ * - 'replacement': inlines values via named replacements. Prefer 'bind' unless you need to
+ *   bypass a driver's bind-count limit or you rely on SQL-level string interpolation.
+ *
+ * If omitted, the dialect default is used.
+ */
+export interface QiBulkInsertOptions extends QiOptionsWithReplacements {
+  /** Per-query override of the parameterization style. */
+  parameterStyle?: 'replacement' | 'bind';
+}

---

352-356: Augment method docs to mention parameterStyle (outside type area)

Consider updating the JSDoc of bulkInsert to reference QiBulkInsertOptions#parameterStyle, default behavior per dialect, and the PG bind-count limit to set user expectations.

If helpful, I can draft the JSDoc block.

packages/core/test/unit/dialects/sqlite/query-generator.test.js (1)

294-301: Consider adding a 'replacement' mode case for bulkInsertQuery (SQLite)

You already cover replacement mode at QueryInterface level. Adding one QueryGenerator-level case for { parameterStyle: 'replacement' } would fully exercise both shapes here too.

packages/core/src/abstract-dialect/query-generator.js (3)

292-309: parameterStyle precedence is good; guard incompatible combos

Current logic correctly requires explicit { parameterStyle: 'bind' }. If a caller passes parameterStyle: 'bind' together with bindParam: false, we silently inline values, which is surprising.

Normalize options:

-    let bindParam = options.bindParam === undefined ? this.bindParam(bind) : options.bindParam;
+    let bindParam = options.bindParam === undefined ? this.bindParam(bind) : options.bindParam;
+    if (options.parameterStyle === 'bind' && bindParam === false) {
+      bindParam = this.bindParam(bind);
+    }

Alternatively, throw if this mismatch is detected.

---

408-428: Return shape: always { query, bind }

Returning { query, bind } even in replacement mode (bind is {}) matches the new contract. Please update or add JSDoc above bulkInsertQuery to document the new return shape for consumers.

---

118-126: Consistent “no-bind” conditions

You disable bindParam under searchPath and EXCEPTION, which is consistent with insertQuery/updateQuery patterns. Consider extracting a tiny helper (e.g., getEffectiveBindParam(options, bindObj)) to avoid drift among methods.

Also applies to: 301-309

packages/core/test/unit/dialects/postgres/query-generator.test.js (1)

560-1026: Solid coverage for bind-mode bulkInsert; add a couple of guard tests

The bind-mode expectations, identifier quoting, dates, null/undefined, JSON, schema-qualified tables, ignoreDuplicates, and updateOnDuplicate are well covered. Two gaps to future-proof:

• Add a test where parameterStyle is 'replacement' to assert fallback emits inlined values and returns { bind: {} }.
• Add a test with parameterStyle 'bind' + searchPath set to verify it gracefully falls back to replacements (no $sequelize_* placeholders), still returning { bind: {} }.

I can draft these tests if helpful.

packages/core/test/unit/dialects/mariadb/query-generator.test.js (1)

349-566: Bind vs replacement behavior is validated; nice boolean and date cases

Good assertions for bind mode, defaulting to replacement when parameterStyle is omitted, and explicit 'replacement'. Consider adding one negative/edge case:

• With parameterStyle 'bind' and large row counts (e.g., >1k values), verify it still returns placeholders and a long bind map. This helps document the behavior vs. driver limits even if MariaDB itself doesn’t impose a strict placeholder cap.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

packages/core/test/unit/query-interface/bulk-insert.test.ts (2)

103-113: Replacement mode assertions cover the contract

Asserting empty binds and preserved replacements + SQL checks is exactly what we need.

---

49-51: Dialiect-agnostic bind assertions will fail on db2/mssql; gate by dialect and assert cardinality

db2 & mssql expectations inline values (no binds) but these assertions unconditionally expect a bind map. This will fail on those dialect runs. Also add the 1000-size check here (you added it for the 2000 test only).

-    const { bind } = stub.getCall(0).args[1];
-    expect(bind).to.include({ sequelize_1: 'user0' });
-    expect(bind).to.have.property('sequelize_1000', 'user999');
+    const opts = stub.getCall(0).args[1];
+    if (['db2', 'mssql'].includes(sequelize.dialect.name)) {
+      expect(opts.bind ?? {}).to.deep.equal({});
+    } else {
+      const { bind } = opts;
+      expect(Object.keys(bind)).to.have.lengthOf(1000);
+      expect(bind).to.include({ sequelize_1: 'user0' });
+      expect(bind).to.have.property('sequelize_1000', 'user999');
+    }

packages/ibmi/src/query-generator.js (1)

346-350: Nit: Prefer removeTrailingSemicolon + a single check for consistency and fewer string ops.

Small cleanup to mirror updateQuery and avoid duplicating slice logic.

Apply:

-    let { query } = generated;
-    if (query.at(-1) === ';') {
-      query = query.slice(0, -1);
-      query = `SELECT * FROM FINAL TABLE (${query})`;
-    }
+    let { query } = generated;
+    const hadSemicolon = query.at(-1) === ';';
+    query = removeTrailingSemicolon(query);
+    if (hadSemicolon) {
+      query = `SELECT * FROM FINAL TABLE (${query})`;
+    }

(Optional follow-up: apply the same pattern in insertQuery for uniformity.)

packages/core/test/unit/query-interface/bulk-insert.test.ts (1)

54-85: Optional: add a targeted Postgres bind-limit regression test

Given the 65,535 bind-parameter limit in Postgres, consider a unit test that simulates exceeding this (e.g., many columns × rows) to assert we throw a helpful error or chunk as designed.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

packages/core/test/unit/query-interface/bulk-insert.test.ts (2)

103-110: Replacement mode: assert binds empty and replacements forwarded

To fully prove “do not parse replacements outside raw SQL,” also check options.bind is empty and options.replacements is preserved.

Apply this diff:

     expect(stub.callCount).to.eq(1);
-    const firstCall = stub.getCall(0);
+    const firstCall = stub.getCall(0);
+    const opts = firstCall.args[1];
+    expect(opts.bind ?? {}).to.deep.equal({});
+    expect(opts.replacements).to.deep.equal({ injection: 'raw sql' });

---

66-69: >1000 test: dialect-gate bind-size assertion; also verify transaction forwarding and representative mappings

Unconditionally expecting 2000 binds will break on db2/mssql where values are inlined. Also assert transaction propagation and sample bind values for supported dialects.

Apply this diff:

-    const firstCall = stub.getCall(0);
-    const firstOpts = firstCall.args[1];
-    expect(firstOpts).to.have.property('bind');
-    expect(Object.keys(firstOpts.bind)).to.have.lengthOf(2000);
+    const firstCall = stub.getCall(0);
+    const firstOpts = firstCall.args[1];
+    expect(firstOpts.transaction).to.equal(transaction);
+    if (['db2', 'mssql'].includes(sequelize.dialect.name)) {
+      expect(firstOpts.bind ?? {}).to.deep.equal({});
+    } else {
+      expect(firstOpts).to.have.property('bind');
+      expect(Object.keys(firstOpts.bind)).to.have.lengthOf(2000);
+      expect(firstOpts.bind).to.include({ sequelize_1: 'user0' });
+      expect(firstOpts.bind).to.have.property('sequelize_2000', 'user1999');
+    }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

packages/core/test/unit/query-interface/bulk-insert.test.ts (2)

49-51: Gate bind assertions by dialect; also assert count in bind-mode

db2 & mssql inline literals here, so unconditional bind checks will fail. Add dialect guard and (for bind-mode) assert cardinality = 1000 to catch regressions.

-    const { bind } = stub.getCall(0).args[1];
-    expect(bind).to.include({ sequelize_1: 'user0' });
-    expect(bind).to.have.property('sequelize_1000', 'user999');
+    const bind = stub.getCall(0).args[1].bind ?? {};
+    if (['db2', 'mssql'].includes(sequelize.dialect.name)) {
+      expect(bind).to.deep.equal({});
+    } else {
+      expect(Object.keys(bind)).to.have.lengthOf(1000);
+      expect(bind).to.include({ sequelize_1: 'user0' });
+      expect(bind).to.have.property('sequelize_1000', 'user999');
+    }

---

110-111: Replacement mode: assert binds empty and replacements preserved

To fully prove “do not parse replacements outside raw SQL,” assert empty bind map and intact replacements.

   expect(stub.callCount).to.eq(1);
   const firstCall = stub.getCall(0);
+  const firstOpts = firstCall.args[1];
+  expect(firstOpts.bind ?? {}).to.deep.equal({});
+  expect(firstOpts.replacements).to.deep.equal({ injection: 'raw sql' });
 
   expectPerDialect(() => firstCall.args[0], {

Also applies to: 114-127

packages/core/src/abstract-dialect/query-generator.js (1)

292-310: Tighten binding enablement and result shape

Current logic can still attach an empty bind map to result when binding is effectively disabled. Consider a single “bindingEnabled” flag to centralize gating (parameterStyle, searchPath, exception) and only include result.bind when true.

-    const bind = Object.create(null);
-    let bindParam = options.bindParam === undefined ? this.bindParam(bind) : options.bindParam;
+    const bind = Object.create(null);
+    let bindParam = options.bindParam === undefined ? this.bindParam(bind) : options.bindParam;
+    let bindingEnabled = options.parameterStyle === 'bind';
 
-    // Require explicit opt-in to use bind parameters (for backwards compatibility)
-    // https://github.com/sequelize/sequelize/pull/17752#discussion_r1986317512
-    if (options.parameterStyle !== 'bind') {
-      bindParam = undefined;
-    }
+    // Require explicit opt-in (back-compat)
+    if (!bindingEnabled) bindParam = undefined;
 
     if (get(this, ['sequelize', 'options', 'prependSearchPath']) || options.searchPath) {
       // Not currently supported with search path (requires output of multiple queries)
-      bindParam = undefined;
+      bindingEnabled = false; bindParam = undefined;
     }
 
     if (this.dialect.supports.EXCEPTION && options.exception) {
       // Not currently supported with bind parameters (requires output of multiple queries)
-      bindParam = undefined;
+      bindingEnabled = false; bindParam = undefined;
     }
@@
-    const result = { query };
-    if (options.bindParam !== false) {
-      result.bind = bind;
-    }
+    const result = { query };
+    if (bindingEnabled && options.bindParam !== false) {
+      result.bind = bind;
+    }

Also applies to: 422-427

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

packages/core/test/unit/query-interface/bulk-insert.test.ts (2)

49-57: Add cardinality assertion for binds (rows <= 1000).

You validate first/last entries; also assert total bind count for binding dialects.

Apply:

     if (!['db2', 'mssql'].includes(sequelize.dialect.name)) {
       const firstArg = stub.getCall(0).args[1];
       if (firstArg && typeof firstArg === 'object') {
+        expect(Object.keys(firstArg.bind)).to.have.lengthOf(1000);
         expect(firstArg.bind).to.include({ sequelize_1: 'user0' });
         expect(firstArg.bind).to.have.property('sequelize_1000', 'user999');
       } else {
         throw new Error('expected the first arg to be an object');
       }
     }

---

120-137: Replacement mode: assert binds empty and replacements preserved.

This was suggested earlier; add explicit checks to guard regressions.

Apply:

   expect(stub.callCount).to.eq(1);
-  const firstCall = stub.getCall(0);
+  const firstCall = stub.getCall(0);
+  const firstOpts = firstCall.args[1];
+  expect(firstOpts.bind ?? {}).to.deep.equal({});
+  expect(firstOpts.replacements).to.deep.equal({ injection: 'raw sql' });

   expectPerDialect(() => firstCall.args[0], {

packages/core/test/unit/query-interface/bulk-insert.test.ts (1)

72-86: Also assert replacements are empty in bind mode.

Prevents accidental mixing of replacements with binds.

Apply:

     const firstOpts = firstCall.args[1];
     if (firstOpts && typeof firstOpts === 'object') {
       expect(firstOpts.transaction).to.equal(transaction);
+      expect(firstOpts.replacements ?? {}).to.deep.equal({});
       if (['db2', 'mssql'].includes(sequelize.dialect.name)) {
         expect(firstOpts.bind ?? {}).to.deep.equal({});
       } else {
         expect(firstOpts).to.have.property('bind');
         expect(Object.keys(firstOpts.bind || {})).to.have.lengthOf(2000);
         expect(firstOpts.bind).to.include({ sequelize_1: 'user0' });
         expect(firstOpts.bind).to.have.property('sequelize_2000', 'user1999');
       }
     } else {
       throw new Error('expected the options to be passed as an object');
     }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

packages/core/src/abstract-dialect/query-generator.js (2)

301-309: Align bind disabling with updateQuery (set options.bindParam = false).

Here you locally null out bindParam but still return result.bind (empty) because options.bindParam remains undefined. updateQuery (Line 454) sets options.bindParam = false, which suppresses bind emission. Consider aligning for consistency and to avoid returning an unused bind map.

Apply:

-  bindParam = undefined;
+  bindParam = undefined;
+  options.bindParam = false;

(Repeat for both searchPath and EXCEPTION branches.)

---

292-309: PG 65,535 bind cap: consider proactive guard or fallback.

Enabling binds for bulk inserts risks tripping PostgreSQL’s parameter limit. Optional: detect when Object.keys(bind).length exceeds the dialect cap and either (a) throw with an actionable message, or (b) regenerate the query in replacement mode (or ask the caller to chunk). Implementation might fit better in QueryInterface after receiving { query, bind }.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.