@graphoria/server 0.1.5 → 0.2.1

package/src/configuration/rest/handleRESTRequestFactory.ts

@@ -18,6 +18,7 @@ import { databasesConnections, repositoryMap } from "../../singletons/databases"
 import { queueManager } from "../../singletons/queues";
 import { S200, S401, S404 } from "../../utils/responses";
 import { buildApiRoutes } from "../rest";
+import { parseStringParams } from "./parseStringParams";
 import { logger } from "../../logging";
 
 // Build remote REST route matchers
@@ -114,24 +115,25 @@ export const handleRESTRequestFactory = (
         });
       }
 
-      // Validate and parse path parameters with Zod
-      const pathVariables = route.rest!.pathParams?.parse(pathParameters) as Record<
-        string,
-        unknown
-      >;
+      // Validate and parse each REST parameter source with Zod. A source is
+      // left `undefined` when its schema is not configured; that `undefined` is
+      // forwarded to `beforeRequest` so the hook can tell the sources apart,
+      // while `allVariables` stays identical because spreading `undefined` is a
+      // no-op. Path and query values are strings on the wire, so
+      // `parseStringParams` converts the keys declared as `z.boolean()` first.
+      const pathVariables = parseStringParams(route.rest!.pathParams, pathParameters);
 
       const paramsQuery = new URLSearchParams(url.search);
       const paramsQueryDictionary = Object.fromEntries(paramsQuery.entries());
 
-      const queryVariables = (route.rest!.queryParams?.parse(paramsQueryDictionary) ??
-        {}) as Record<string, unknown>;
+      const queryVariables = parseStringParams(route.rest!.queryParams, paramsQueryDictionary);
 
-      let bodyVariables: Record<string, unknown> = {};
+      let bodyVariables: Record<string, unknown> | undefined;
 
       if (req.method === "POST") {
         const body = req.body ? await req.json() : {};
 
-        bodyVariables = (route.rest!.body?.parse(body) ?? {}) as Record<string, unknown>;
+        bodyVariables = route.rest!.body?.parse(body) as Record<string, unknown> | undefined;
       }
 
       // Prepare all variables for the request
@@ -150,6 +152,9 @@ export const handleRESTRequestFactory = (
         (await route.hooks?.beforeRequest?.(
           {
             input: allVariables,
+            pathParams: pathVariables,
+            queryParams: queryVariables,
+            body: bodyVariables,
           },
           routesInitDataPromises[route.routeKey],
         )) ?? allVariables;
@@ -286,6 +291,19 @@ export const handleRESTRequestFactory = (
         }
       }
 
+      // Apply the operation's afterRequest hook (if configured) to a GraphQL
+      // result. The hook receives the unwrapped `data` payload; its return
+      // replaces `data`, leaving the rest of the envelope (e.g. `sqlQueries`)
+      // intact.
+      const applyAfterRequest = async (result: Awaited<ReturnType<typeof gql.handler>>) => {
+        if (!route.hooks?.afterRequest) return result;
+
+        return {
+          ...result,
+          data: await route.hooks.afterRequest({ output: result.data }),
+        };
+      };
+
       // Check if this route has caching enabled
       const cache = route.routeKey ? getCache(route.routeKey) : undefined;
 
@@ -299,7 +317,8 @@ export const handleRESTRequestFactory = (
           role: session?.role,
         });
 
-        // Try to get from cache first
+        // Try to get from cache first. A cached entry has already been through
+        // afterRequest, so serve it directly without re-running the hook.
         const cachedResult = await cache.get(cacheKey);
         if (cachedResult) {
           log.debug({ route: route.routeKey }, "rest cache hit");
@@ -308,10 +327,13 @@ export const handleRESTRequestFactory = (
         log.debug({ route: route.routeKey }, "rest cache miss");
 
         try {
-          // Execute the GraphQL request
-          const result = await gql.handler(queryAnalysis!, variables, req, session);
+          // Execute the GraphQL request, then transform via afterRequest before
+          // caching so hits and misses return the same shape.
+          const result = await applyAfterRequest(
+            await gql.handler(queryAnalysis!, variables, req, session),
+          );
 
-          // Cache the result
+          // Cache the (already transformed) result
           await cache.set(cacheKey, result);
 
           return new S200(result);
@@ -321,7 +343,9 @@ export const handleRESTRequestFactory = (
         }
       } else if (queryAnalysis) {
         // No caching for this route, execute normally
-        return new S200(await gql.handler(queryAnalysis, variables, req, session));
+        return new S200(
+          await applyAfterRequest(await gql.handler(queryAnalysis, variables, req, session)),
+        );
       }
 
       // Fallback - should not reach here if endpoint is properly configured

package/src/configuration/rest/parseStringParams.ts

@@ -0,0 +1,92 @@
+import type { z } from "zod";
+
+/**
+ * The slice of Zod's runtime schema internals this module walks to find which
+ * keys of a `z.object()` ultimately validate a boolean.
+ */
+type SchemaDef = {
+  type: string;
+  innerType?: { def: SchemaDef };
+  in?: { def: SchemaDef };
+  shape?: Record<string, { def: SchemaDef }>;
+};
+
+/** Wrappers that keep the validated type of the schema they wrap. */
+const wrappers = new Set([
+  "optional",
+  "nullable",
+  "nonoptional",
+  "default",
+  "prefault",
+  "catch",
+  "readonly",
+]);
+
+/** Accepted spellings, matching the ones `z.stringbool()` recognizes. */
+const truthy = new Set(["true", "1", "yes", "on", "y", "enabled"]);
+const falsy = new Set(["false", "0", "no", "off", "n", "disabled"]);
+
+const defOf = (schema: z.ZodType) => (schema as unknown as { def: SchemaDef }).def;
+
+const resolveType = (def: SchemaDef): string => {
+  if (wrappers.has(def.type) && def.innerType) return resolveType(def.innerType.def);
+  // A pipe validates its input side, so `z.stringbool()` resolves to a string.
+  if (def.type === "pipe" && def.in) return resolveType(def.in.def);
+
+  return def.type;
+};
+
+// Schemas are created once at config time, so the key scan is done once per schema.
+const booleanKeysCache = new WeakMap<z.ZodType, Set<string>>();
+
+const booleanKeys = (schema: z.ZodType) => {
+  const cached = booleanKeysCache.get(schema);
+  if (cached) return cached;
+
+  const keys = new Set<string>();
+  for (const [key, field] of Object.entries(defOf(schema).shape ?? {})) {
+    if (resolveType(field.def) === "boolean") keys.add(key);
+  }
+
+  booleanKeysCache.set(schema, keys);
+
+  return keys;
+};
+
+/**
+ * Parses path or query parameters, which always arrive as strings.
+ *
+ * A parameter declared as `z.boolean()` — the declaration that makes the
+ * OpenAPI docs render a true/false picker instead of a free-text box — would
+ * never parse on its own, so those keys (and only those) are converted before
+ * validation. A value that spells neither true nor false is left as the string
+ * it was, so Zod still reports it as invalid.
+ *
+ * Returns `undefined` when no schema is configured for that source, which is
+ * what the REST handler forwards to `beforeRequest`.
+ */
+export const parseStringParams = (
+  schema: z.ZodType | undefined,
+  values: Record<string, string | string[]>,
+): Record<string, unknown> | undefined => {
+  if (!schema) return undefined;
+
+  const keys = booleanKeys(schema);
+
+  if (keys.size === 0) return schema.parse(values) as Record<string, unknown>;
+
+  const coerced: Record<string, unknown> = { ...values };
+
+  for (const key of keys) {
+    const value = coerced[key];
+
+    if (typeof value !== "string") continue;
+
+    const spelling = value.toLowerCase();
+
+    if (truthy.has(spelling)) coerced[key] = true;
+    else if (falsy.has(spelling)) coerced[key] = false;
+  }
+
+  return schema.parse(coerced) as Record<string, unknown>;
+};

package/src/databases/common.ts

@@ -4,6 +4,7 @@ import type { SelectionAnalysis, VariableDefinition } from "../analyzeQuery/type
 import type { MergedEntities } from "../configuration/getSchemas/mergeEntities";
 import type { DatabaseType, RelationshipCondition, VirtualColumn } from "../types/configuration";
 
+import { FILTER_OPERATORS } from "../config/types/auth";
 import { applyDirectives } from "./directives";
 
 // Common aggregation types
@@ -25,10 +26,36 @@ export interface GroupByInfo {
   cteAlias: string;
 }
 
+// isOperatorObject decides whether a filter object is a column filter or a nested
+// relation, so an operator missing from this set is not merely unhandled — the
+// whole filter is routed to the relation branch and dropped. Shared with the
+// config schema so the two cannot drift.
+const OPERATORS = new Set<string>(FILTER_OPERATORS);
+
 const isOperatorObject = (obj: object): boolean =>
-  Object.keys(obj).some((key) =>
-    ["eq", "neq", "gt", "gte", "lt", "lte", "like", "in", "is_null", "is_not_null"].includes(key),
-  );
+  Object.keys(obj).some((key) => OPERATORS.has(key));
+
+// These operators branch on the operand instead of binding it. Every literal in a
+// query document is hoisted into a generated variable (analyzeQuery/valueExtractors),
+// so the operand arrives as "$name" — testing that string for truthiness would make
+// `is_null: false` behave exactly like `is_null: true`. Resolve the real boolean.
+const NULL_CHECK_OPERATORS = new Set(["is_null", "is_not_null", "not_null"]);
+
+const resolveBooleanOperand = (
+  operand: unknown,
+  variables: Record<string, unknown>,
+  variablesDefinition: VariableDefinition[],
+): boolean => {
+  if (!isString(operand) || !operand.startsWith("$")) return Boolean(operand);
+
+  const name = operand.substring(1);
+
+  // The hash-key path passes the request variables without the generated defaults,
+  // so fall back to the definition's defaultValue for hoisted literals.
+  return name in variables
+    ? Boolean(variables[name])
+    : Boolean(variablesDefinition.find((v) => v.name === name)?.defaultValue);
+};
 
 export const generateTableAlias = (level: number): string => `t${level}`;
 
@@ -47,6 +74,8 @@ export const buildConditions = (
   tableAlias: string,
   level: number,
   aliasMap: { [alias: string]: string },
+  /** Query name of the table being filtered — resolves its virtual columns. */
+  tableName?: string,
 ): string => {
   if (!whereArgs) return "";
 
@@ -58,25 +87,50 @@ export const buildConditions = (
     if (isOperatorObject(value)) {
       for (const [operator, operand] of Object.entries(value)) {
         // All values are now variable references (e.g., "$varName" or ["$var1", "$var2"])
-        const resolvedValue = Array.isArray(operand)
-          ? operand.map((op) => {
-              if (isString(op) && op.startsWith("$")) {
-                const index = variablesDefinition.findIndex((v) => v.name === op.substring(1));
-                return `${mappingDbTypeCharVar[dbType]}${index + 1}`;
-              }
-              return op;
-            })
-          : isString(operand) && operand.startsWith("$")
-            ? `${mappingDbTypeCharVar[dbType]}${variablesDefinition.findIndex((v) => v.name === operand.substring(1)) + 1}`
-            : operand;
-
-        const condition = buildCondition(tableAlias, fieldName, operator, resolvedValue, dbType);
+        const resolvedValue = NULL_CHECK_OPERATORS.has(operator)
+          ? resolveBooleanOperand(operand, variables, variablesDefinition)
+          : Array.isArray(operand)
+            ? operand.map((op) => {
+                if (isString(op) && op.startsWith("$")) {
+                  const index = variablesDefinition.findIndex((v) => v.name === op.substring(1));
+                  return `${mappingDbTypeCharVar[dbType]}${index + 1}`;
+                }
+                return op;
+              })
+            : isString(operand) && operand.startsWith("$")
+              ? `${mappingDbTypeCharVar[dbType]}${variablesDefinition.findIndex((v) => v.name === operand.substring(1)) + 1}`
+              : operand;
+
+        const condition = buildCondition(
+          columnTargetFp(dbType)(entities, tableName, fieldName, tableAlias),
+          fieldName,
+          operator,
+          resolvedValue,
+          dbType,
+        );
 
         if (condition) {
           conditions.push(condition);
         }
       }
     } else if (typeof value === "object" && !Array.isArray(value)) {
+      // Only entities (tables/views) appear in queriesMap. An operator-less filter object on a
+      // column (e.g. `{ col: {} }`) has no operator keys, so it lands here despite not being a
+      // relation; skip it as a no-op instead of dereferencing a missing queriesMap entry.
+      const nestedEntity = entities.queriesMap[fieldName];
+      if (!nestedEntity) {
+        const [unknownOperator] = Object.keys(value as object);
+        // A non-empty filter object on something that is not a relation can only
+        // be a column filter whose operator we do not implement. Dropping it here
+        // would return every row.
+        if (unknownOperator) {
+          throw new Error(
+            `Unsupported filter operator "${unknownOperator}" on column "${fieldName}"`,
+          );
+        }
+        continue;
+      }
+
       const nestedTableAlias = `t${level}`;
 
       const parentTableName = aliasMap[tableAlias];
@@ -90,6 +144,11 @@ export const buildConditions = (
         dbType,
       );
 
+      // Record this relation's alias→table so a deeper nested where (3+ levels) can resolve
+      // its own parent via aliasMap[tableAlias]; without it the next recursion sees undefined
+      // and emits a join-less "WHERE  AND (...)".
+      aliasMap[nestedTableAlias] = fieldName;
+
       const nestedConditions = buildConditions(
         entities,
         dbType,
@@ -99,11 +158,12 @@ export const buildConditions = (
         nestedTableAlias,
         level + 1,
         aliasMap,
+        fieldName,
       );
 
       const existsClause = `EXISTS (
       SELECT 1
-      FROM ${entities.queriesMap[fieldName]!.dottedQuotedName} ${nestedTableAlias}
+      FROM ${nestedEntity.dottedQuotedName} ${nestedTableAlias}
       WHERE ${joinCondition}${nestedConditions ? ` AND (${nestedConditions})` : ""}
     )`;
 
@@ -142,6 +202,42 @@ export const qualifiedNameFp =
     return `${wrap(schema)}.${wrap(name)}`;
   };
 
+const renderVirtualColumn = (vc: VirtualColumn): string =>
+  vc.function ? `(${vc.function}(${vc.params?.join(", ")}))` : `(${vc.expression})`;
+
+/**
+ * What a column name compiles to on the left of a comparison or in ORDER BY.
+ *
+ * A virtual column has no physical counterpart, so emitting `alias."name"` for
+ * one produces `column t1.name does not exist`. WHERE and ORDER BY both go
+ * through here so they cannot disagree about what a column is.
+ */
+const columnTargetFp =
+  (dbType: DatabaseType) =>
+  (
+    entities: MergedEntities,
+    tableName: string | undefined,
+    colName: string,
+    tableAlias: string,
+  ): string => {
+    const virtualColumn = tableName ? entities.isVirtualColumn(tableName, colName) : undefined;
+
+    return virtualColumn
+      ? renderVirtualColumn(virtualColumn as VirtualColumn)
+      : `${tableAlias}.${wrapIdentifierFp(dbType)(sqlColumnName(entities, tableName, colName))}`;
+  };
+
+/**
+ * The SQL identifier a GraphQL field name compiles to. A column GraphQL cannot
+ * spell is exposed under a sanitised field name, so the name the client sent is
+ * not necessarily the name the database knows.
+ */
+export const sqlColumnName = (
+  entities: MergedEntities,
+  tableName: string | undefined,
+  fieldName: string,
+): string => (tableName ? entities.columnSqlName(tableName, fieldName) : fieldName);
+
 // Helper to resolve variable values
 const resolveVariable = <T>(value: unknown, variables: Record<string, unknown>): T => {
   if (isString(value) && value.startsWith("$")) {
@@ -151,43 +247,51 @@ const resolveVariable = <T>(value: unknown, variables: Record<string, unknown>):
 };
 
 const buildCondition = (
-  tableAlias: string,
+  target: string,
   field: string,
   operator: string,
   value: unknown,
   dbType: DatabaseType,
 ): string | null => {
-  const wrappedField = wrapIdentifierFp(dbType)(field);
-
   switch (operator) {
     case "eq":
-      return `${tableAlias}.${wrappedField} = ${value}`;
+      return `${target} = ${value}`;
     case "neq":
-      return `${tableAlias}.${wrappedField} <> ${value}`;
+      return `${target} <> ${value}`;
     case "gt":
-      return `${tableAlias}.${wrappedField} > ${value}`;
+      return `${target} > ${value}`;
     case "gte":
-      return `${tableAlias}.${wrappedField} >= ${value}`;
+      return `${target} >= ${value}`;
     case "lt":
-      return `${tableAlias}.${wrappedField} < ${value}`;
+      return `${target} < ${value}`;
     case "lte":
-      return `${tableAlias}.${wrappedField} <= ${value}`;
+      return `${target} <= ${value}`;
+    // PostgreSQL and MySQL treat a backslash as the LIKE escape by default;
+    // T-SQL has no default escape character at all, so `100\%` matched a literal
+    // backslash and found nothing. Declare the escape to make the three agree.
     case "like":
-      return `${tableAlias}.${wrappedField} LIKE ${value}`;
+      return dbType === "mssql" ? `${target} LIKE ${value} ESCAPE '\\'` : `${target} LIKE ${value}`;
     case "in":
-      return `${tableAlias}.${wrappedField} IN (${
-        Array.isArray(value) ? value.join(", ") : value
-      })`;
+      return `${target} IN (${Array.isArray(value) ? value.join(", ") : value})`;
     case "is_null":
-      return value
-        ? `${tableAlias}.${wrappedField} IS NULL`
-        : `${tableAlias}.${wrappedField} IS NOT NULL`;
+      return value ? `${target} IS NULL` : `${target} IS NOT NULL`;
     case "is_not_null":
-      return value
-        ? `${tableAlias}.${wrappedField} IS NOT NULL`
-        : `${tableAlias}.${wrappedField} IS NULL`;
+    case "not_null":
+      return value ? `${target} IS NOT NULL` : `${target} IS NULL`;
+    case "between": {
+      const bounds = Array.isArray(value) ? value : [];
+      if (bounds.length !== 2) {
+        throw new Error(
+          `Filter operator "between" on column "${field}" expects exactly two values, received ${bounds.length}`,
+        );
+      }
+      return `${target} BETWEEN ${bounds[0]} AND ${bounds[1]}`;
+    }
+    // Returning null here would drop the condition, so a filter Graphoria cannot
+    // honour would widen the result set instead of failing — a role filter naming
+    // an unimplemented operator would return the whole table.
     default:
-      return null;
+      throw new Error(`Unsupported filter operator "${operator}" on column "${field}"`);
   }
 };
 
@@ -377,6 +481,7 @@ export const buildWhereClauseFp =
         tableAlias,
         level + 1,
         aliasMap,
+        field.name ?? aliasMap[tableAlias],
       ),
       parentTableName && parentTableAlias
         ? findJoinCondition(
@@ -413,7 +518,6 @@ const parseOrderDirection = (direction: string): { sort: string; nulls?: string
 export const buildOrderByClauseFp =
   (dbType: DatabaseType = "pg") =>
   (entities: MergedEntities, field: SelectionAnalysis, tableAlias: string): string => {
-    const wrap = wrapIdentifierFp(dbType);
     if (field.arguments?.["orderBy"]) {
       const orderBy = field.arguments?.["orderBy"];
       // orderBy is an array or object of { column: direction } - no variable resolution needed
@@ -433,16 +537,18 @@ export const buildOrderByClauseFp =
           const [colName, direction] = Object.entries(ob)[0];
           const { sort, nulls } = parseOrderDirection(direction as string);
 
-          const virtualColumn = entities.isVirtualColumn(field.name, colName);
+          // Resolved once, above the NULLS branch: a virtual column has to expand
+          // to its expression in every emission below, not only the default one.
+          const target = columnTargetFp(dbType)(entities, field.name, colName, tableAlias);
 
           if (nulls) {
             if (dbType === "pg") {
               // PostgreSQL supports NULLS FIRST/LAST natively
-              return `${tableAlias}.${wrap(colName)} ${sort} NULLS ${nulls}`;
+              return `${target} ${sort} NULLS ${nulls}`;
             } else if (dbType === "mysql") {
               // MySQL: Use CASE statement for NULL handling
               const nullFirst = nulls === "FIRST";
-              return `CASE WHEN ${tableAlias}.${wrap(colName)} IS NULL THEN ${nullFirst ? 0 : 1} ELSE ${nullFirst ? 1 : 0} END, ${tableAlias}.${wrap(colName)} ${sort}`;
+              return `CASE WHEN ${target} IS NULL THEN ${nullFirst ? 0 : 1} ELSE ${nullFirst ? 1 : 0} END, ${target} ${sort}`;
             } else {
               // MSSQL requires CASE statements for NULL handling
               const nullFirst = nulls === "FIRST";
@@ -450,23 +556,16 @@ export const buildOrderByClauseFp =
 
               if ((nullFirst && isAsc) || (!nullFirst && !isAsc)) {
                 // NULLs naturally come first in this combination
-                return `${tableAlias}.${wrap(colName)} ${sort}`;
+                return `${target} ${sort}`;
               } else {
                 // Need to force NULL positioning with CASE
-                return `CASE WHEN ${tableAlias}.${wrap(colName)} IS NULL THEN ${nullFirst ? 0 : 1} ELSE ${nullFirst ? 1 : 0} END, ${tableAlias}.${wrap(colName)} ${sort}`;
+                return `CASE WHEN ${target} IS NULL THEN ${nullFirst ? 0 : 1} ELSE ${nullFirst ? 1 : 0} END, ${target} ${sort}`;
               }
             }
-          } else {
-            // No explicit NULL handling - use database defaults
-            if (virtualColumn) {
-              const vc = virtualColumn as VirtualColumn;
-              return `(
-                ${vc.function ? `${vc.function}(${vc.params?.join(", ")})` : `${vc.expression}`}
-              ) ${sort}`;
-            }
-
-            return `${tableAlias}.${wrap(colName)} ${sort}`;
           }
+
+          // No explicit NULL handling - use database defaults
+          return `${target} ${sort}`;
         })
         .join(", ");
 
@@ -612,7 +711,7 @@ export const processFieldSelectionsFp =
               selectClauses.push([`${colName}`, `(${vc.expression})`]);
             }
           } else {
-            let querySelector = `${tableAlias}.${wrapIdentifierFp(dbType)(sel.name)}`;
+            let querySelector = `${tableAlias}.${wrapIdentifierFp(dbType)(sqlColumnName(entities, tableName, sel.name))}`;
 
             // Apply all directives using the handler registry
             querySelector = applyDirectives(
@@ -733,14 +832,6 @@ export const buildPaginationClauseFp =
   (field: SelectionAnalysis, variablesDefinition: VariableDefinition[] = []): string => {
     const args = field.arguments;
 
-    // MSSQL requires ORDER BY for pagination
-    if (
-      dbType === "mssql" &&
-      (!args || args["limit"] === undefined || args["orderBy"] === undefined)
-    ) {
-      return "";
-    }
-
     if (!args || args["limit"] === undefined) {
       return "";
     }
@@ -756,10 +847,16 @@ export const buildPaginationClauseFp =
       ? toPositionalPlaceholder(args["offset"], variablesDefinition, dbType)
       : "0";
 
-    // Return database-specific syntax
-    return dbType === "mssql"
-      ? `OFFSET ${offsetPlaceholder} ROWS FETCH NEXT ${limitPlaceholder} ROWS ONLY`
-      : `LIMIT ${limitPlaceholder} OFFSET ${offsetPlaceholder}`;
+    if (dbType !== "mssql") {
+      return `LIMIT ${limitPlaceholder} OFFSET ${offsetPlaceholder}`;
+    }
+
+    // T-SQL only accepts OFFSET/FETCH after an ORDER BY. Dropping the limit when
+    // the query has none returned the whole table instead, so supply the
+    // order-agnostic ORDER BY that T-SQL accepts for exactly this case.
+    const orderByFallback = args["orderBy"] === undefined ? "ORDER BY (SELECT NULL) " : "";
+
+    return `${orderByFallback}OFFSET ${offsetPlaceholder} ROWS FETCH NEXT ${limitPlaceholder} ROWS ONLY`;
   };
 
 export const buildPaginationClausePG = buildPaginationClauseFp("pg");

package/src/databases/directives.ts

@@ -10,10 +10,12 @@ export type DirectiveHandler = (
   dbType: DatabaseType,
 ) => string;
 
+const PLACEHOLDER_RE = /^[$@]\d+$/;
+
 // Wrap a value in SQL string quotes unless it's a positional placeholder ($1, @1, etc.)
 const sqlString = (value: unknown): string => {
   const s = String(value);
-  if (/^[$@]\d+$/.test(s)) return s;
+  if (PLACEHOLDER_RE.test(s)) return s;
   return `'${s}'`;
 };
 
@@ -32,12 +34,18 @@ export const DIRECTIVE_HANDLERS: Record<string, DirectiveHandler> = {
     `SUBSTRING(${querySelector}, ${directive.arguments!["start"]}, ${directive.arguments!["length"]})`,
   replace: (querySelector, directive) =>
     `REPLACE(${querySelector}, ${sqlString(directive.arguments!["find"])}, ${sqlString(directive.arguments!["replaceWith"])})`,
-  concat: (querySelector, directive) => {
-    const withValue = directive.arguments!["with"] as string;
+  concat: (querySelector, directive, dbType) => {
+    const rendered = sqlString(directive.arguments!["with"]);
+    // CONCAT is variadic "any" in PostgreSQL, so it gives the planner nothing to
+    // infer a bare placeholder from and the statement dies with
+    // "could not determine data type of parameter $n". The cast annotates the
+    // parameter type without unbinding the value.
+    const withValue =
+      dbType === "pg" && PLACEHOLDER_RE.test(rendered) ? `${rendered}::TEXT` : rendered;
     const position = (directive.arguments?.["position"] as string) ?? "after";
     return position === "before"
-      ? `CONCAT(${sqlString(withValue)}, ${querySelector})`
-      : `CONCAT(${querySelector}, ${sqlString(withValue)})`;
+      ? `CONCAT(${withValue}, ${querySelector})`
+      : `CONCAT(${querySelector}, ${withValue})`;
   },
   pad: (querySelector, directive, dbType) => {
     const length = directive.arguments!["length"] as number;
@@ -47,13 +55,23 @@ export const DIRECTIVE_HANDLERS: Record<string, DirectiveHandler> = {
       return side === "left"
         ? `LPAD(${querySelector}::TEXT, ${length}, ${char})`
         : `RPAD(${querySelector}::TEXT, ${length}, ${char})`;
-    } else {
+    }
+    // MySQL has LPAD/RPAD too, and needs no cast. It used to fall through to the
+    // SQL Server branch, where REPLICATE and VARCHAR(MAX) are syntax errors.
+    if (dbType === "mysql") {
       return side === "left"
-        ? `RIGHT(REPLICATE(${char}, ${length}) + CAST(${querySelector} AS VARCHAR(MAX)), ${length})`
-        : `LEFT(CAST(${querySelector} AS VARCHAR(MAX)) + REPLICATE(${char}, ${length}), ${length})`;
+        ? `LPAD(${querySelector}, ${length}, ${char})`
+        : `RPAD(${querySelector}, ${length}, ${char})`;
     }
+    // SQL Server: LPAD/RPAD only exist from 2022.
+    return side === "left"
+      ? `RIGHT(REPLICATE(${char}, ${length}) + CAST(${querySelector} AS VARCHAR(MAX)), ${length})`
+      : `LEFT(CAST(${querySelector} AS VARCHAR(MAX)) + REPLICATE(${char}, ${length}), ${length})`;
   },
   dateFormat: (querySelector, directive, dbType) => {
+    if (dbType === "mysql") {
+      throw new Error("@dateFormat is not supported on MySQL. Expose a virtual column instead.");
+    }
     const format = directive.arguments!["format"] as string;
     return dbType === "pg"
       ? `TO_CHAR(${querySelector}, ${sqlString(format)})`

package/src/databases/engines/mssql/connection.ts

@@ -145,7 +145,7 @@ export const callStoredProcedure = async (
     // never as SQL text, so reserved words need no delimiting here.
     const data = await request.execute(sp.dottedName);
 
-    return data?.recordset ?? false;
+    return !data?.returnValue;
   } catch (e: unknown) {
     logger("mssql").error({ err: e }, "stored procedure execution failed");
     return false;