@mikro-orm/core 7.0.10-dev.10 → 7.0.10-dev.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "7.0.10-dev.10",
+  "version": "7.0.10-dev.11",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",

package/utils/RawQueryFragment.d.ts

@@ -4,6 +4,8 @@ declare const rawFragmentSymbolBrand: unique symbol;
 export type RawQueryFragmentSymbol = symbol & {
     readonly [rawFragmentSymbolBrand]: true;
 };
+/** Checks whether the given value is a `RawQueryFragment` instance. */
+export declare function isRaw(value: unknown): value is RawQueryFragment;
 /** Represents a raw SQL fragment with optional parameters, usable as both a value and an object key via Symbol coercion. */
 export declare class RawQueryFragment<Alias extends string = string> {
     #private;
@@ -30,8 +32,6 @@ export declare class RawQueryFragment<Alias extends string = string> {
     static getKnownFragment(key: unknown): RawQueryFragment | undefined;
 }
 export { RawQueryFragment as Raw };
-/** Checks whether the given value is a `RawQueryFragment` instance. */
-export declare function isRaw(value: unknown): value is RawQueryFragment;
 /** @internal */
 export declare const ALIAS_REPLACEMENT = "[::alias::]";
 /** @internal */

package/utils/RawQueryFragment.js

@@ -1,21 +1,53 @@
 import { Utils } from './Utils.js';
-const rawSymbol = Symbol('RawQueryFragment');
+// Brand lives on the prototype so JSON payloads — whose proto is
+// `Object.prototype` — cannot forge it. String key, not a `Symbol.for(...)`,
+// so each CJS/ESM copy of this module independently installs it on its own
+// prototype without publishing a global key for the marker that controls raw
+// SQL assembly. The string is namespaced so it does not collide with property
+// names users might independently install on their own prototypes.
+const RAW_FRAGMENT_BRAND = '__mikroOrmRawFragment';
+// Back-references from a fragment's symbol key to the fragment itself, shared
+// across CJS/ESM module copies via globalThis: when one copy creates a fragment
+// via `raw('…')` and stores its symbol in a where-clause object key, the other
+// copy still needs to recover the original fragment to assemble SQL.
+const REGISTRY_KEY = Symbol.for('@mikro-orm/core/RawQueryFragment.references');
+const rawQueryReferences = (globalThis[REGISTRY_KEY] ??=
+    new WeakMap());
+/** Checks whether the given value is a `RawQueryFragment` instance. */
+export function isRaw(value) {
+    if (value == null || typeof value !== 'object') {
+        return false;
+    }
+    // Fast path: intra-module instances and their subclasses.
+    // eslint-disable-next-line no-use-before-define
+    if (value instanceof RawQueryFragment) {
+        return true;
+    }
+    // Walk the prototype chain starting from the *prototype* (not the value) so
+    // own-property spoofing from JSON payloads cannot forge the brand. Stop at
+    // `Object.prototype`, which is never branded — that bails plain objects,
+    // JSON payloads, and built-ins like `Date`/`Array`/`Map` at depth 1.
+    for (let p = Object.getPrototypeOf(value); p != null && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
+        if (Object.hasOwn(p, RAW_FRAGMENT_BRAND)) {
+            return true;
+        }
+    }
+    return false;
+}
 /** Represents a raw SQL fragment with optional parameters, usable as both a value and an object key via Symbol coercion. */
 export class RawQueryFragment {
     sql;
     params;
-    static #rawQueryReferences = new WeakMap();
     #key;
     constructor(sql, params = []) {
         this.sql = sql;
         this.params = params;
-        Object.defineProperty(this, rawSymbol, { value: true, enumerable: false });
     }
     /** Returns a unique symbol key for this fragment, creating and caching it on first access. */
     get key() {
         if (!this.#key) {
             this.#key = Symbol(this.toJSON());
-            RawQueryFragment.#rawQueryReferences.set(this.#key, this);
+            rawQueryReferences.set(this.#key, this);
         }
         return this.#key;
     }
@@ -42,7 +74,7 @@ export class RawQueryFragment {
     }
     /** Checks whether the given value is a symbol that maps to a known raw query fragment. */
     static isKnownFragmentSymbol(key) {
-        return typeof key === 'symbol' && this.#rawQueryReferences.has(key);
+        return typeof key === 'symbol' && rawQueryReferences.has(key);
     }
     /** Checks whether an object has any symbol keys that are known raw query fragments. */
     static hasObjectFragments(object) {
@@ -51,20 +83,17 @@ export class RawQueryFragment {
     }
     /** Checks whether the given value is a RawQueryFragment instance or a known fragment symbol. */
     static isKnownFragment(key) {
-        if (key instanceof RawQueryFragment) {
-            return true;
-        }
-        return this.isKnownFragmentSymbol(key);
+        return isRaw(key) || this.isKnownFragmentSymbol(key);
     }
     /** Retrieves the RawQueryFragment associated with the given key (instance or symbol). */
     static getKnownFragment(key) {
-        if (key instanceof RawQueryFragment) {
+        if (isRaw(key)) {
             return key;
         }
         if (typeof key !== 'symbol') {
             return;
         }
-        return this.#rawQueryReferences.get(key);
+        return rawQueryReferences.get(key);
     }
     /** @ignore */
     /* v8 ignore next */
@@ -75,11 +104,19 @@ export class RawQueryFragment {
         return { sql: this.sql };
     }
 }
+// Non-enumerable so the brand is skipped by JSON/Object.keys/for-in, and locked
+// down (non-writable, non-configurable) so in-process code cannot delete or
+// overwrite it and thereby silently disable `isRaw` recognition for every
+// fragment in the process. Subclasses don't need mutability here — they inherit
+// the brand via the prototype chain, and sibling-copy classes install their own
+// brand on their own prototype (a different object), so lockdown only blocks
+// tampering with the canonical marker.
+Object.defineProperty(RawQueryFragment.prototype, RAW_FRAGMENT_BRAND, {
+    value: true,
+    writable: false,
+    configurable: false,
+});
 export { RawQueryFragment as Raw };
-/** Checks whether the given value is a `RawQueryFragment` instance. */
-export function isRaw(value) {
-    return typeof value === 'object' && value !== null && Object.hasOwn(value, rawSymbol);
-}
 /** @internal */
 export const ALIAS_REPLACEMENT = '[::alias::]';
 /** @internal */
@@ -140,7 +177,7 @@ export const ALIAS_REPLACEMENT_RE = '\\[::alias::\\]';
  * ```
  */
 export function raw(sql, params) {
-    if (sql instanceof RawQueryFragment) {
+    if (isRaw(sql)) {
         return sql;
     }
     if (sql instanceof Function) {

package/utils/Utils.js

@@ -22,13 +22,22 @@ export function compareObjects(a, b) {
     if (a === b || (a == null && b == null)) {
         return true;
     }
-    if (!a || !b || typeof a !== 'object' || typeof b !== 'object' || !compareConstructors(a, b)) {
+    if (!a || !b || typeof a !== 'object' || typeof b !== 'object') {
         return false;
     }
+    // Raw fragments are compared by `sql` + `params` *before* the constructor
+    // check, so that two fragments carrying the same SQL but constructed by
+    // different CJS/ESM copies of this module (different classes, different
+    // prototypes) still compare as equal. Without this, the dual-package hazard
+    // would produce spurious change-set diffs when a raw fragment is used as a
+    // property value.
     if (isRaw(a) && isRaw(b)) {
         // eslint-disable-next-line @typescript-eslint/no-use-before-define
         return a.sql === b.sql && compareArrays(a.params, b.params);
     }
+    if (!compareConstructors(a, b)) {
+        return false;
+    }
     if (a instanceof Date && b instanceof Date) {
         const timeA = a.getTime();
         const timeB = b.getTime();
@@ -132,7 +141,7 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.0.10-dev.10';
+    static #ORM_VERSION = '7.0.10-dev.11';
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */