@mikro-orm/core 7.1.16-dev.10 → 7.1.16-dev.11

package/types/StringType.js

@@ -1,8 +1,17 @@
 import { Type } from './Type.js';
-/** Maps a database VARCHAR column to a JS `string`. */
-export class StringType extends Type {
-    getColumnType(prop, platform) {
-        return platform.getVarcharTypeDeclarationSQL(prop);
+/** @internal */
+export class BaseStringType extends Type {
+    options;
+    constructor(options = {}) {
+        super();
+        this.options = options;
+        // a defined `compareValues` replaces the inline `!==` comparator, so only provide it when normalization is configured
+        if (options.trim || options.case) {
+            this.compareValues = (a, b) => this.normalize(a) === this.normalize(b);
+        }
+    }
+    convertToDatabaseValue(value) {
+        return this.normalize(value);
     }
     compareAsType() {
         return 'string';
@@ -10,6 +19,27 @@ export class StringType extends Type {
     ensureComparable() {
         return false;
     }
+    normalize(value) {
+        if (value == null) {
+            return value;
+        }
+        if (this.options.trim) {
+            value = value.trim();
+        }
+        if (this.options.case === 'upper') {
+            return value.toUpperCase();
+        }
+        if (this.options.case === 'lower') {
+            return value.toLowerCase();
+        }
+        return value;
+    }
+}
+/** Maps a database VARCHAR column to a JS `string`. */
+export class StringType extends BaseStringType {
+    getColumnType(prop, platform) {
+        return platform.getVarcharTypeDeclarationSQL(prop);
+    }
     getDefaultLength(platform) {
         return platform.getDefaultVarcharLength();
     }

package/types/TextType.d.ts

@@ -1,9 +1,7 @@
-import { Type } from './Type.js';
+import { BaseStringType } from './StringType.js';
 import type { Platform } from '../platforms/Platform.js';
 import type { EntityProperty } from '../typings.js';
 /** Maps a database TEXT column (unbounded length) to a JS `string`. */
-export declare class TextType extends Type<string | null | undefined, string | null | undefined> {
+export declare class TextType extends BaseStringType {
     getColumnType(prop: EntityProperty, platform: Platform): string;
-    compareAsType(): string;
-    ensureComparable(): boolean;
 }

package/types/TextType.js

@@ -1,13 +1,7 @@
-import { Type } from './Type.js';
+import { BaseStringType } from './StringType.js';
 /** Maps a database TEXT column (unbounded length) to a JS `string`. */
-export class TextType extends Type {
+export class TextType extends BaseStringType {
     getColumnType(prop, platform) {
         return platform.getTextTypeDeclarationSQL(prop);
     }
-    compareAsType() {
-        return 'string';
-    }
-    ensureComparable() {
-        return false;
-    }
 }

package/types/Type.d.ts

@@ -59,6 +59,17 @@ export declare abstract class Type<JSType = string, DBType = JSType> {
      * By default uses the runtime value.
      */
     toJSON(value: JSType, platform: Platform): JSType | DBType;
+    /**
+     * Converts a value from its serialized JSON form back to its JS representation. Used when
+     * decoding cursor values. The input is what `toJSON` produced, after a `JSON.parse` round
+     * trip, and never an already restored JS value. Cursors are client supplied, so the value
+     * can be any JSON shape: validate it and throw for values the type cannot restore, and
+     * `findByCursor` surfaces the failure as a `CursorError`.
+     * Implementing this method also makes cursor encoding use `toJSON`. Without it, cursors
+     * carry the raw JS value, and decoding falls back to `convertToJSValue`, with type-based
+     * `Date` restoration for date-like columns.
+     */
+    fromJSON?(value: unknown, platform: Platform): JSType;
     /**
      * Gets the SQL declaration snippet for a field of this type.
      */

package/types/index.d.ts

@@ -15,7 +15,7 @@ import { IntervalType } from './IntervalType.js';
 import { JsonType } from './JsonType.js';
 import { MediumIntType } from './MediumIntType.js';
 import { SmallIntType } from './SmallIntType.js';
-import { StringType } from './StringType.js';
+import { type StringTypeOptions, StringType } from './StringType.js';
 import { TextType } from './TextType.js';
 import { TimeType } from './TimeType.js';
 import { TinyIntType } from './TinyIntType.js';
@@ -23,7 +23,7 @@ import { type IType, type TransformContext, Type } from './Type.js';
 import { Uint8ArrayType } from './Uint8ArrayType.js';
 import { UnknownType } from './UnknownType.js';
 import { UuidType } from './UuidType.js';
-export type { TransformContext, IType };
+export type { TransformContext, IType, StringTypeOptions };
 export { Type, DateType, TimeType, DateTimeType, BigIntType, BlobType, Uint8ArrayType, ArrayType, EnumArrayType, EnumType, JsonType, IntegerType, SmallIntType, TinyIntType, MediumIntType, FloatType, DoubleType, BooleanType, DecimalType, StringType, UuidType, TextType, UnknownType, IntervalType, CharacterType, };
 /** Registry of all built-in type constructors, keyed by their short name (e.g., `types.integer`, `types.uuid`). */
 export declare const types: {

package/typings.d.ts

@@ -654,6 +654,16 @@ export type SerializeDTO<T, H extends string = never, E extends string = never,
 };
 type TargetKeys<T> = T extends EntityClass<infer P> ? keyof P : keyof T;
 type PropertyName<T> = IsUnknown<T> extends false ? TargetKeys<T> : string;
+/** Resolved `through` option of a virtual to-one relation, populated during discovery. */
+export interface ThroughRelation {
+    entity: EntityClass;
+    where?: FilterQuery<any>;
+    orderBy?: QueryOrderMap<any>[];
+    /** M:1 property on the `through` entity pointing back to the owner. */
+    ownerProperty: string;
+    /** M:1 property on the `through` entity pointing to the target, undefined when the target is selected directly. */
+    targetProperty?: string;
+}
 /** Table reference object passed to formula callbacks, including alias and schema information. */
 export type FormulaTable = {
     alias: string;
@@ -711,6 +721,8 @@ export type IndexCallback<T> = (columns: Record<PropertyName<T>, string>, table:
 export type FormulaCallback<T> = (columns: FormulaColumns<T>, table: FormulaTable) => string | Raw;
 /** Callback for CHECK constraint expressions. Receives column mappings and table info. */
 export type CheckCallback<T> = (columns: SchemaColumns<T>, table: SchemaTable) => string | Raw;
+/** Callback for row level security policy expressions. Receives column mappings and table info. */
+export type PolicyCallback<T> = (columns: SchemaColumns<T>, table: SchemaTable) => string | Raw;
 /** Callback for trigger body expressions. Receives column mappings and table info. */
 export type TriggerCallback<T> = (columns: Record<PropertyName<T>, string>, table: SchemaTable) => string | Raw;
 /**
@@ -725,6 +737,28 @@ export interface CheckConstraint<T = any> {
     property?: string;
     expression: string | Raw | CheckCallback<T>;
 }
+/** Definition of a PostgreSQL row level security policy on a table. */
+export interface PolicyDef<T = any> {
+    /** Policy name. Auto-generated if omitted. */
+    name?: string;
+    /** DML command the policy applies to. Defaults to `'all'`. */
+    command?: 'select' | 'insert' | 'update' | 'delete' | 'all';
+    /** Whether the policy is permissive (OR-combined) or restrictive (AND-combined). Defaults to `'permissive'`. */
+    type?: 'permissive' | 'restrictive';
+    /** Database roles the policy applies to. Defaults to `PUBLIC`. */
+    roles?: string[];
+    /** `USING` expression filtering visible rows. Can be a string, Raw query, or callback receiving column name mappings. */
+    using?: string | Raw | PolicyCallback<T>;
+    /** `WITH CHECK` expression validating written rows. Can be a string, Raw query, or callback receiving column name mappings. */
+    check?: string | Raw | PolicyCallback<T>;
+}
+/** Per-context database session state applied for row level security (session variables and role). */
+export interface SessionContext {
+    /** Session variables set via `set_config`, typically referenced by RLS policies through `current_setting()`. `Date` values are serialized to ISO 8601. */
+    variables?: Dictionary<string | number | boolean | Date>;
+    /** Database role to switch to for the duration of the context (`set local role` / `set role`). */
+    role?: string;
+}
 /** Definition of a database trigger on a table. */
 export interface TriggerDef<T = any> {
     /** Trigger name. Auto-generated if omitted. */
@@ -1020,6 +1054,7 @@ export interface EntityProperty<Owner = any, Target = any> {
     fixedOrderColumn?: string;
     pivotTable: string;
     pivotEntity: EntityClass<Target>;
+    through?: ThroughRelation;
     joinColumns: string[];
     ownColumns: string[];
     inverseJoinColumns: string[];
@@ -1172,6 +1207,9 @@ export interface EntityMetadata<Entity = any, Class extends EntityCtor<Entity> =
     }[];
     checks: CheckConstraint<Entity>[];
     triggers: TriggerDef<Entity>[];
+    policies: PolicyDef<Entity>[];
+    /** Enables row level security on the table. `'force'` also enables it for the table owner. Implied by non-empty `policies`, unless set to `false`, which keeps the policies staged but RLS disabled. */
+    rowLevelSecurity?: boolean | 'force';
     repositoryClass?: string;
     repository: () => EntityClass<EntityRepository<any>>;
     hooks: {
@@ -1499,6 +1537,15 @@ type FilterDefResolved<T extends object = any> = {
     entity?: EntityName<T> | EntityName<T>[];
     args?: boolean;
     strict?: boolean;
+    /**
+     * Also materializes this filter as a PostgreSQL row level security policy on the entity's table, and stages the
+     * matching session variables when its params are enabled via `em.setFilterParams()`. The `cond` must be compilable
+     * to a static expression (no access to `em`/`type`/`options`, not async). Each referenced argument maps to a session
+     * variable named `mikro.<filterName>.<argName>`; pass `{ setting }` to override that name for a single-argument filter.
+     */
+    rls?: boolean | {
+        setting?: string;
+    };
 };
 /** Definition of a query filter that can be registered globally or per-entity via `@Filter()`. */
 export type FilterDef<T extends EntityName | readonly EntityName[] = any> = FilterDefResolved<EntityFromInput<T>> & {

package/typings.js

@@ -49,6 +49,7 @@ export class EntityMetadata {
         this.uniques = [];
         this.checks = [];
         this.triggers = [];
+        this.policies = [];
         this.referencingProperties = [];
         this.concurrencyCheckKeys = new Set();
         Object.assign(this, meta);

package/unit-of-work/UnitOfWork.js

@@ -472,6 +472,7 @@ export class UnitOfWork {
                 const loggerContext = Utils.merge({ id: this.#em._id }, this.#em.getLoggerContext({ disableContextResolution: true }));
                 await this.#em.getConnection('write').transactional(trx => this.persistToDatabase(groups, trx), {
                     ctx: oldTx,
+                    sessionContext: this.#em.getTransactionSessionContext(),
                     eventBroadcaster: new TransactionEventBroadcaster(this.#em),
                     loggerContext,
                 });

package/utils/Configuration.d.ts

@@ -233,6 +233,12 @@ export type MigrationsOptions = {
      * @default true
      */
     snapshot?: boolean;
+    /**
+     * Update the snapshot from the database schema when running migrations up or down.
+     * Disable to keep the snapshot managed solely by `migration:create`.
+     * @default true
+     */
+    snapshotOnMigrate?: boolean;
     /** Custom name for the snapshot file. */
     snapshotName?: string;
     /**
@@ -433,7 +439,7 @@ export interface Options<Driver extends IDatabaseDriver = IDatabaseDriver, EM ex
      */
     filters: Dictionary<{
         name?: string;
-    } & Omit<FilterDef, 'name'>>;
+    } & Omit<FilterDef, 'name' | 'rls'>>;
     /**
      * Metadata discovery configuration options.
      * Controls how entities are discovered and validated.
@@ -474,6 +480,12 @@ export interface Options<Driver extends IDatabaseDriver = IDatabaseDriver, EM ex
      * @default false
      */
     disableTransactions?: boolean;
+    /**
+     * How `em.setSessionContext()` session variables/role are applied for row level security.
+     * `'transaction'` (default) emits `set_config(..., true)` inside each transaction; `'connection'` applies them on every pooled connection acquire (PostgreSQL only).
+     * @default 'transaction'
+     */
+    sessionContext?: 'transaction' | 'connection';
     /**
      * Enable verbose logging of internal operations.
      * @default false
@@ -834,6 +846,14 @@ export interface Options<Driver extends IDatabaseDriver = IDatabaseDriver, EM ex
          * @default false
          */
         ignoreRoutines?: boolean;
+        /**
+         * Leave row level security policies unmanaged. Declared policies are still created and RLS is still enabled or
+         * forced based on the entity metadata, but existing policies are never dropped or altered and RLS is never
+         * disabled or unforced — use this to protect hand-written policies from being removed when they are not
+         * mirrored in the entity definitions.
+         * @default false
+         */
+        ignorePolicies?: boolean;
         /**
          * Table names or patterns to skip during schema generation.
          * @default []

package/utils/Configuration.js

@@ -7,7 +7,7 @@ import { Utils } from '../utils/Utils.js';
 import { Routine } from '../metadata/Routine.js';
 import { MetadataValidator } from '../metadata/MetadataValidator.js';
 import { MetadataProvider } from '../metadata/MetadataProvider.js';
-import { NotFoundError } from '../errors.js';
+import { MetadataError, NotFoundError, ValidationError } from '../errors.js';
 import { RequestContext } from './RequestContext.js';
 import { DataloaderType, FlushMode, LoadStrategy, PopulateHint } from '../enums.js';
 import { MemoryCacheAdapter } from '../cache/MemoryCacheAdapter.js';
@@ -71,6 +71,7 @@ const DEFAULTS = {
     ensureDatabase: true,
     ensureIndexes: false,
     batchSize: 300,
+    sessionContext: 'transaction',
     debug: false,
     ignoreDeprecations: false,
     verbose: false,
@@ -84,6 +85,7 @@ const DEFAULTS = {
         dropTables: true,
         safe: false,
         snapshot: true,
+        snapshotOnMigrate: true,
         emit: 'ts',
         // mirrors `NamingStrategy.classToMigrationName`, so the file name matches the class it declares
         fileName: (timestamp, name) => `Migration${timestamp}${name ? '_' + name.replace(/[^$\p{ID_Continue}]+/gu, '_') : ''}`,
@@ -93,6 +95,7 @@ const DEFAULTS = {
         ignoreSchema: [],
         ignoreTriggers: false,
         ignoreRoutines: false,
+        ignorePolicies: false,
         skipTables: [],
         skipViews: [],
         skipColumns: {},
@@ -392,7 +395,15 @@ export class Configuration {
         }
         this.#options.schema ??= this.#platform.getDefaultSchemaName();
         this.#options.charset ??= this.#platform.getDefaultCharset();
+        // fail closed instead of silently applying no session state on drivers without the reserve hook (e.g. pglite)
+        if (this.#options.sessionContext === 'connection' && !this.#platform.supportsConnectionSessionContext()) {
+            throw ValidationError.connectionSessionContextNotSupported();
+        }
         Object.keys(this.#options.filters).forEach(key => {
+            // global filters have no entity to attach a policy to, so `rls` is only valid on entity-scoped filters
+            if (this.#options.filters[key].rls) {
+                throw MetadataError.rlsFilterMustBeEntityScoped(key);
+            }
             this.#options.filters[key].default ??= true;
         });
         if (!this.#options.filtersOnRelations) {

package/utils/Cursor.d.ts

@@ -61,6 +61,8 @@ export declare class Cursor<Entity extends object, Hint extends string = never,
      * Computes the cursor value for a given entity.
      */
     from(entity: Entity | Loaded<Entity, Hint, Fields, Excludes>): string;
+    /** Serializes a single cursor value, walking nested directions and reading the owner's properties. */
+    private static serialize;
     [Symbol.iterator](): IterableIterator<Loaded<Entity, Hint, Fields, Excludes>>;
     get length(): number;
     /**

package/utils/Cursor.js

@@ -58,6 +58,7 @@ export class Cursor {
     hasPrevPage;
     hasNextPage;
     #definition;
+    #meta;
     constructor(items, totalCount, options, meta) {
         this.items = items;
         this.totalCount = totalCount;
@@ -76,6 +77,7 @@ export class Cursor {
             }
         }
         this.#definition = Cursor.getDefinition(meta, orderBy);
+        this.#meta = meta;
     }
     get startCursor() {
         if (this.items.length === 0) {
@@ -93,37 +95,46 @@ export class Cursor {
      * Computes the cursor value for a given entity.
      */
     from(entity) {
-        const processEntity = (entity, prop, direction, object = false) => {
-            if (Utils.isPlainObject(direction)) {
-                const unwrapped = Reference.unwrapReference(entity[prop]);
-                // Check if the relation is loaded - for nested properties, undefined means not populated
-                if (Utils.isEntity(unwrapped) && !helper(unwrapped).isInitialized()) {
-                    throw CursorError.entityNotPopulated(entity, prop);
-                }
-                return Utils.keys(direction).reduce((o, key) => {
-                    Object.assign(o, processEntity(unwrapped, key, direction[key], true));
-                    return o;
-                }, {});
-            }
-            let value = entity[prop];
-            // Allow null/undefined values in cursor - they will be handled in createCursorCondition
-            // undefined can occur with forceUndefined config option which converts null to undefined
-            if (value == null) {
-                return object ? { [prop]: null } : null;
-            }
-            if (Utils.isEntity(value, true)) {
-                value = helper(value).getPrimaryKey();
-            }
-            if (Utils.isScalarReference(value)) {
-                value = value.unwrap();
+        const value = this.#definition.map(([key, direction]) => Cursor.serialize(this.#meta.properties, entity, key, direction));
+        return Cursor.encode(value);
+    }
+    /** Serializes a single cursor value, walking nested directions and reading the owner's properties. */
+    static serialize(properties, owner, key, direction) {
+        const prop = properties[key];
+        let value = owner[key];
+        if (Utils.isPlainObject(direction)) {
+            const unwrapped = Reference.unwrapReference(value);
+            // for nested properties, an uninitialized relation means not populated
+            if (Utils.isEntity(unwrapped) && !helper(unwrapped).isInitialized()) {
+                throw CursorError.entityNotPopulated(owner, key);
             }
-            if (object) {
-                return { [prop]: value };
+            if (unwrapped == null || typeof unwrapped !== 'object') {
+                return unwrapped;
             }
-            return value;
-        };
-        const value = this.#definition.map(([key, direction]) => processEntity(entity, key, direction));
-        return Cursor.encode(value);
+            const childProps = prop?.kind === ReferenceKind.EMBEDDED ? prop.embeddedProps : prop?.targetMeta?.properties;
+            return Utils.keys(direction).reduce((o, childKey) => {
+                o[childKey] = Cursor.serialize(childProps ?? {}, unwrapped, childKey, direction[childKey]);
+                return o;
+            }, {});
+        }
+        // allow null/undefined values in cursor - they will be handled in createCursorCondition
+        // undefined can occur with forceUndefined config option which converts null to undefined
+        if (value == null) {
+            return null;
+        }
+        if (Utils.isEntity(value, true)) {
+            value = helper(value).getPrimaryKey();
+        }
+        if (Utils.isScalarReference(value)) {
+            value = value.unwrap();
+        }
+        // only types implementing `fromJSON` own their wire format, others keep the raw JS value,
+        // so their cursors stay decodable by the `convertToJSValue` fallback
+        if (prop?.customType?.fromJSON) {
+            // the platform is assigned to the type instance during discovery
+            return prop.customType.toJSON(value, prop.customType.platform);
+        }
+        return value;
     }
     *[Symbol.iterator]() {
         for (const item of this.items) {
@@ -138,12 +149,11 @@ export class Cursor {
      */
     static for(meta, entity, orderBy) {
         const definition = this.getDefinition(meta, orderBy);
-        return Cursor.encode(definition.map(([key]) => {
-            const value = entity[key];
-            if (value === undefined) {
+        return Cursor.encode(definition.map(([key, direction]) => {
+            if (entity[key] === undefined) {
                 throw CursorError.missingValue(meta.className, key);
             }
-            return value;
+            return this.serialize(meta.properties, entity, key, direction);
         }));
     }
     static encode(value) {

package/utils/QueryHelper.d.ts

@@ -37,6 +37,18 @@ export declare class QueryHelper {
     static inlinePrimaryKeyObjects<T extends object>(where: Dictionary, meta: EntityMetadata<T>, metadata: MetadataStorage, key?: string): boolean;
     static processWhere<T extends object>(options: ProcessWhereOptions<T>): FilterQuery<T>;
     static getActiveFilters<T>(meta: EntityMetadata<T>, options: FilterOptions | undefined, filters: Dictionary<FilterDef>): FilterDef[];
+    /** @internal Sentinel wrapping for arguments accessed while statically resolving an `rls` filter condition. */
+    static readonly RLS_SENTINEL_PREFIX = "__mikro_rls_arg__";
+    /** @internal */
+    static readonly RLS_SENTINEL_SUFFIX = "__";
+    /**
+     * Resolves an `rls` filter's condition to a static `FilterQuery`. Function conditions are called with a proxy `args`
+     * that yields a unique sentinel per accessed argument, real `type`/`entityName` strings (validated to not affect the
+     * result), and a poison proxy or `undefined` for the remaining runtime-only parameters.
+     *
+     * @internal
+     */
+    static resolveRlsFilterCond(filter: FilterDef, accessed: Set<string>, entityName?: string): Dictionary;
     static mergePropertyFilters(propFilters: FilterOptions | undefined, options: FilterOptions | undefined): FilterOptions | undefined;
     static isFilterActive<T>(meta: EntityMetadata<T>, filterName: string, filter: FilterDef, options: Dictionary<boolean | Dictionary>): boolean;
     static processCustomType<T extends object>(prop: EntityProperty<T>, cond: FilterQuery<T>, platform: Platform, key?: string, fromQuery?: boolean): FilterQuery<T>;

package/utils/QueryHelper.js

@@ -4,6 +4,7 @@ import { ARRAY_OPERATORS, GroupOperator, JSON_KEY_OPERATORS, ReferenceKind } fro
 import { JsonType } from '../types/JsonType.js';
 import { helper } from '../entity/wrap.js';
 import { isRaw, Raw } from './RawQueryFragment.js';
+import { MetadataError } from '../errors.js';
 /** @internal */
 export class QueryHelper {
     static SUPPORTED_OPERATORS = ['>', '<', '<=', '>=', '!', '!='];
@@ -286,6 +287,68 @@ export class QueryHelper {
             return filters[f];
         });
     }
+    /** @internal Sentinel wrapping for arguments accessed while statically resolving an `rls` filter condition. */
+    static RLS_SENTINEL_PREFIX = '__mikro_rls_arg__';
+    /** @internal */
+    static RLS_SENTINEL_SUFFIX = '__';
+    /**
+     * Resolves an `rls` filter's condition to a static `FilterQuery`. Function conditions are called with a proxy `args`
+     * that yields a unique sentinel per accessed argument, real `type`/`entityName` strings (validated to not affect the
+     * result), and a poison proxy or `undefined` for the remaining runtime-only parameters.
+     *
+     * @internal
+     */
+    static resolveRlsFilterCond(filter, accessed, entityName) {
+        if (!(filter.cond instanceof Function)) {
+            return filter.cond;
+        }
+        const args = new Proxy({}, {
+            get: (_target, prop) => {
+                if (typeof prop === 'symbol') {
+                    // e.g. coercing `args` itself in a template literal triggers a `Symbol.toPrimitive` lookup
+                    throw MetadataError.rlsFilterUnsupportedCond(filter.name);
+                }
+                accessed.add(prop);
+                return `${this.RLS_SENTINEL_PREFIX}${prop}${this.RLS_SENTINEL_SUFFIX}`;
+            },
+        });
+        const poison = new Proxy({}, {
+            get: () => {
+                throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+            },
+        });
+        // property access on the poison proxies throws, but equality/truthiness checks (`type === 'read'`,
+        // `entityName === 'X'`, `options ? a : b`) cannot be trapped — vary all three across the evaluations and require
+        // identical results, so a command-, entity-, or options-dependent condition cannot silently compile one branch.
+        // `entityName` uses the real class name (plus two derived-distinct variants) so an `=== '<name>'` check diverges;
+        // `options` alternates the poison proxy and `undefined` so a truthiness check flips. `em` stays poison throughout.
+        const name = entityName ?? `${this.RLS_SENTINEL_PREFIX}entity${this.RLS_SENTINEL_SUFFIX}`;
+        const evaluate = (type, entity, options) => {
+            let result;
+            try {
+                result = filter.cond(args, type, poison, options, entity);
+            }
+            catch (e) {
+                // a raw TypeError from touching the `undefined` options/em must fail closed like the poison proxy does,
+                // but the descriptive MetadataErrors thrown above are already correct — let them surface unchanged
+                if (e instanceof MetadataError) {
+                    throw e;
+                }
+                throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+            }
+            if (result instanceof Promise) {
+                throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+            }
+            return result;
+        };
+        const read = evaluate('read', name, poison);
+        const update = evaluate('update', `${name}\0a`, undefined);
+        const del = evaluate('delete', `${name}\0b`, poison);
+        if (JSON.stringify(read) !== JSON.stringify(update) || JSON.stringify(read) !== JSON.stringify(del)) {
+            throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+        }
+        return read;
+    }
     static mergePropertyFilters(propFilters, options) {
         if (!options || !propFilters || options === true || propFilters === true) {
             return options ?? propFilters;

package/utils/RawQueryFragment.d.ts

@@ -61,6 +61,12 @@ export declare const ALIAS_REPLACEMENT_RE = "\\[::alias::\\]";
  * await em.find(User, { [raw(alias => `lower(${alias}.name)`)]: name.toLowerCase() });
  * ```
  *
+ * Named parameters are supported via an object of parameters, use `:name` for values and `:name:` for identifiers:
+ *
+ * ```ts
+ * raw('select :col: from geo where city = :city or region = :city', { col: 'city', city: 'Brno' });
+ * ```
+ *
  * You can also use the `sql` tagged template function, which works the same, but supports only the simple string signature:
  *
  * ```ts

package/utils/RawQueryFragment.js

@@ -146,6 +146,12 @@ export const ALIAS_REPLACEMENT_RE = '\\[::alias::\\]';
  * await em.find(User, { [raw(alias => `lower(${alias}.name)`)]: name.toLowerCase() });
  * ```
  *
+ * Named parameters are supported via an object of parameters, use `:name` for values and `:name:` for identifiers:
+ *
+ * ```ts
+ * raw('select :col: from geo where city = :city or region = :city', { col: 'city', city: 'Brno' });
+ * ```
+ *
  * You can also use the `sql` tagged template function, which works the same, but supports only the simple string signature:
  *
  * ```ts
@@ -191,13 +197,16 @@ export function raw(sql, params) {
         return Utils.getPrimaryKeyHash(sql);
     }
     if (typeof params === 'object' && !Array.isArray(params)) {
-        const pairs = Object.entries(params);
+        const dict = params;
         const objectParams = [];
-        for (const [key, value] of pairs) {
-            sql = sql.replace(`:${key}:`, '??');
-            sql = sql.replace(`:${key}`, '?');
-            objectParams.push(value);
-        }
+        // single left-to-right scan keeps values in SQL-placeholder order while `::` casts and unknown tokens stay untouched
+        sql = sql.replace(/(?<!:):([$\w]+)(:(?!:))?/g, (match, key, identifier) => {
+            if (!Object.hasOwn(dict, key)) {
+                return match;
+            }
+            objectParams.push(dict[key]);
+            return identifier ? '??' : '?';
+        });
         return new RawQueryFragment(sql, objectParams);
     }
     return new RawQueryFragment(sql, params);

package/utils/RequestContext.d.ts

@@ -17,13 +17,13 @@ export declare class RequestContext {
      * If the handler is async, the return value needs to be awaited.
      * Uses `AsyncLocalStorage.run()`, suitable for regular express style middlewares with a `next` callback.
      */
-    static create<T>(em: EntityManager | EntityManager[], next: (...args: any[]) => T, options?: CreateContextOptions): T;
+    static create<T>(em: EntityManager | EntityManager[], next: (...args: any[]) => T, options?: ((name: string) => CreateContextOptions) | CreateContextOptions): T;
     /**
      * Creates new RequestContext instance and runs the code inside its domain.
      * If the handler is async, the return value needs to be awaited.
      * Uses `AsyncLocalStorage.enterWith()`, suitable for elysia style middlewares without a `next` callback.
      */
-    static enter(em: EntityManager | EntityManager[], options?: CreateContextOptions): void;
+    static enter(em: EntityManager | EntityManager[], options?: ((name: string) => CreateContextOptions) | CreateContextOptions): void;
     /**
      * Returns current RequestContext (if available).
      */

package/utils/RequestContext.js

@@ -50,10 +50,19 @@ export class RequestContext {
     static createContext(em, options = {}) {
         const forks = new Map();
         if (Array.isArray(em)) {
-            em.forEach(em => forks.set(em.name, em.fork({ useContext: true, ...options })));
+            if (typeof options === 'function') {
+                for (const emInstance of em) {
+                    forks.set(emInstance.name, emInstance.fork({ useContext: true, ...options(emInstance.name) }));
+                }
+            }
+            else {
+                for (const emInstance of em) {
+                    forks.set(emInstance.name, emInstance.fork({ useContext: true, ...options }));
+                }
+            }
         }
         else {
-            forks.set(em.name, em.fork({ useContext: true, ...options }));
+            forks.set(em.name, em.fork({ useContext: true, ...(typeof options === 'function' ? options(em.name) : options) }));
         }
         return new RequestContext(forks);
     }

package/utils/TransactionManager.js

@@ -239,7 +239,7 @@ export class TransactionManager {
         return TransactionContext.create(fork, () => fork.getConnection().transactional(async (trx) => {
             fork.setTransactionContext(trx);
             return this.executeTransactionFlow(fork, cb, propagateToUpperContext, em);
-        }, { ...options, eventBroadcaster }));
+        }, { sessionContext: fork.getTransactionSessionContext(), ...options, eventBroadcaster }));
     }
     /**
      * Executes transaction workflow with entity synchronization.

package/utils/Utils.d.ts

@@ -33,6 +33,8 @@ export declare function parseJsonSafe<T = unknown>(value: unknown): T;
 export declare class Utils {
     #private;
     static readonly PK_SEPARATOR = "~~~";
+    /** Default session variable name backing an RLS filter argument (`current_setting('mikro.<filter>.<arg>')`). */
+    static getRlsSettingName(filterName: string, argName: string): string;
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */