@mikro-orm/core 7.2.0-dev.13 → 7.2.0-dev.15

package/entity/EntityLoader.js

@@ -1,5 +1,5 @@
 import { QueryHelper } from '../utils/QueryHelper.js';
-import { Utils } from '../utils/Utils.js';
+import { DANGEROUS_PROPERTY_NAMES, Utils } from '../utils/Utils.js';
 import { ValidationError } from '../errors.js';
 import { LoadStrategy, PopulatePath, ReferenceKind, } from '../enums.js';
 import { Reference } from './Reference.js';
@@ -124,10 +124,10 @@ export class EntityLoader {
     mergeNestedPopulate(populate) {
         const tmp = populate.reduce((ret, item) => {
             /* v8 ignore next */
-            if (item.field === PopulatePath.ALL) {
+            if (item.field === PopulatePath.ALL || DANGEROUS_PROPERTY_NAMES.includes(item.field)) {
                 return ret;
             }
-            if (!ret[item.field]) {
+            if (!Object.hasOwn(ret, item.field)) {
                 ret[item.field] = item;
                 return ret;
             }
@@ -229,9 +229,10 @@ export class EntityLoader {
                 }
                 toPopulate.push(entity);
             }
-            else if (refValue == null && !helper(entity).__loadedProperties.has(prop.name)) {
+            else if (refValue == null && !prop.object && !helper(entity).__loadedProperties.has(prop.name)) {
                 // FK columns weren't loaded (partial loading) — need to re-fetch them.
                 // If the property IS in __loadedProperties, the FK was loaded and is genuinely null.
+                // Object-embedded virtual props are skipped — they are populated via the embeddable instance.
                 needsFkLoad.push(entity);
             }
         }
@@ -445,7 +446,10 @@ export class EntityLoader {
                 }
             }
         }
-        if ([ReferenceKind.ONE_TO_ONE, ReferenceKind.MANY_TO_ONE].includes(prop.kind) && items.length !== children.length) {
+        // a missing target row means an orphaned reference, unless the query was narrowed by a populate condition
+        if ([ReferenceKind.ONE_TO_ONE, ReferenceKind.MANY_TO_ONE].includes(prop.kind) &&
+            items.length !== children.length &&
+            Utils.isEmpty(options.where)) {
             const nullVal = this.#em.config.get('forceUndefined') ? undefined : null;
             const itemsMap = new Set();
             const childrenMap = new Set();
@@ -620,7 +624,7 @@ export class EntityLoader {
         if (!Utils.isEmpty(prop.where)) {
             where = { $and: [where, prop.where] };
         }
-        const map = await this.#driver.loadFromPivotTable(prop, ids, where, orderBy, this.#em.getTransactionContext(), options2, pivotJoin);
+        const map = await this.#em.withSessionContext(this.#em.getTransactionContext(), ctx => this.#driver.loadFromPivotTable(prop, ids, where, orderBy, ctx, options2, pivotJoin));
         const children = [];
         const isUnionTargetMN = QueryHelper.isUnionTargetPolymorphic(prop);
         for (let i = 0; i < filtered.length; i++) {
@@ -667,7 +671,8 @@ export class EntityLoader {
                     }
                     return cond;
                 });
-                if (child.length > 0) {
+                // partial extraction from `$or` is unsound — the parent may have matched via a dropped branch
+                if (child.length > 0 && (op === '$and' || child.length === where[op].length)) {
                     subCond[op] = child;
                 }
             }

package/entity/EntityRepository.js

@@ -224,7 +224,11 @@ export class EntityRepository {
         }
         const entityName = entities[0].constructor.name;
         const repoType = Utils.className(this.entityName);
-        if (entityName && repoType !== entityName) {
+        // compare class identity where possible, as minifiers can mangle two classes to the same name
+        const entityMeta = entities[0].__meta;
+        const repoMeta = this.getEntityManager().getMetadata?.().find(this.entityName);
+        const mismatch = entityMeta && repoMeta ? entityMeta.class !== repoMeta.class : entityName && repoType !== entityName;
+        if (mismatch) {
             throw ValidationError.fromWrongRepositoryType(entityName, repoType, method);
         }
     }

package/entity/defineEntity.d.ts

@@ -1,6 +1,6 @@
 import type { EntityManager } from '../EntityManager.js';
 import type { ColumnType, PropertyOptions, ReferenceOptions, EnumOptions, EmbeddedOptions, ManyToOneOptions, OneToManyOptions, OneToOneOptions, ManyToManyOptions, IndexColumnOptions } from '../metadata/types.js';
-import type { AnyString, GeneratedColumnCallback, Constructor, CheckCallback, FilterQuery, EntityName, Dictionary, EntityMetadata, PrimaryKeyProp, EntityRepositoryType, Hidden, Opt, Primary, EntityClass, EntitySchemaWithMeta, InferEntity, MaybeReturnType, Ref, LazyRef, IndexCallback, TriggerCallback, FormulaCallback, EntityCtor, IsNever, IWrappedEntity, DefineConfig, Config, MaybePromise, IndexHints, ExtractDefineEntityProperties } from '../typings.js';
+import type { AnyString, GeneratedColumnCallback, Constructor, CheckCallback, FilterQuery, EntityName, Dictionary, EntityMetadata, PrimaryKeyProp, EntityRepositoryType, Hidden, Opt, Primary, EntityClass, EntitySchemaWithMeta, InferEntity, MaybeReturnType, Ref, LazyRef, IndexCallback, TriggerCallback, FormulaCallback, EntityCtor, IsNever, IWrappedEntity, DefineConfig, Config, MaybePromise, IndexHints, OptionalProps, ExtractDefineEntityProperties } from '../typings.js';
 import type { Raw } from '../utils/RawQueryFragment.js';
 import type { ScalarReference } from './Reference.js';
 import type { SerializeOptions } from '../serialization/EntitySerializer.js';
@@ -22,7 +22,7 @@ type HasKind<Options, K extends string> = Options extends {
     kind: infer X extends string;
 } ? X extends K ? true : false : false;
 /** Lightweight chain result type for property builders - reduces type instantiation cost by avoiding full class resolution. */
-export interface PropertyChain<Value, Options> {
+export interface PropertyChain<in out Value, in out Options> {
     '~type'?: {
         value: Value;
     };
@@ -112,7 +112,7 @@ export interface PropertyChain<Value, Options> {
     getter(getter?: boolean): PropertyChain<Value, Options>;
     getterName(getterName: string): PropertyChain<Value, Options>;
     serializedPrimaryKey(serializedPrimaryKey?: boolean): PropertyChain<Value, Options>;
-    serializer(serializer: (value: Value, options?: SerializeOptions<any>) => any): PropertyChain<Value, Options>;
+    serializer(serializer: (value: SerializerValue<Value, Options>, options?: SerializeOptions<any>) => any): PropertyChain<Value, Options>;
     serializedName(serializedName: string): PropertyChain<Value, Options>;
     groups(...groups: string[]): PropertyChain<Value, Options>;
     customOrder(...customOrder: string[] | number[] | boolean[]): PropertyChain<Value, Options>;
@@ -180,7 +180,7 @@ export interface PropertyChain<Value, Options> {
     foreignKeyName(foreignKeyName: string): HasKind<Options, 'm:1' | '1:m' | '1:1' | 'm:n'> extends true ? PropertyChain<Value, Options> : never;
 }
 /** @internal */
-export declare class UniversalPropertyOptionsBuilder<Value, Options, IncludeKeys extends BuilderKeys> implements Record<Exclude<UniversalPropertyKeys, ExcludeKeys>, any> {
+export declare class UniversalPropertyOptionsBuilder<in out Value, in out Options, in out IncludeKeys extends BuilderKeys> implements Record<Exclude<UniversalPropertyKeys, ExcludeKeys>, any> {
     '~options': Options;
     '~type'?: {
         value: Value;
@@ -627,7 +627,7 @@ type PartialWhere<TProperties, TBase> = string | FilterQuery<{
     [K in AllKeys<TProperties, TBase> & string]?: unknown;
 }>;
 /** Metadata descriptor for `defineEntity()`, combining entity options with property definitions. */
-export interface EntityMetadataWithProperties<TName extends string, TTableName extends string, TProperties extends Record<string, any>, TPK extends (keyof TProperties)[] | undefined = undefined, TBase = never, TRepository = never, TForceObject extends boolean = false, TDiscriminatorColumn extends string | undefined = undefined, TDiscriminatorValue extends string | number | undefined = undefined, TBaseDiscriminatorColumn extends string | undefined = undefined> extends Omit<Partial<EntityMetadata<InferEntityFromProperties<TProperties, TPK, TBase, TRepository>>>, 'properties' | 'extends' | 'primaryKeys' | 'hooks' | 'discriminator' | 'discriminatorColumn' | 'discriminatorValue' | 'versionProperty' | 'concurrencyCheckKeys' | 'serializedPrimaryKey' | 'indexes' | 'uniques' | 'triggers' | 'repository' | 'filters' | 'orderBy'> {
+export interface EntityMetadataWithProperties<TName extends string, TTableName extends string, TProperties extends Record<string, any>, TPK extends (keyof TProperties)[] | undefined = undefined, TBase = never, TRepository = never, TForceObject extends boolean = false, TDiscriminatorColumn extends string | undefined = undefined, TDiscriminatorValue extends string | number | undefined = undefined, TBaseDiscriminatorColumn extends string | undefined = undefined, TEmbeddable extends boolean = false> extends Omit<Partial<EntityMetadata<InferEntityFromProperties<TProperties, TPK, TBase, TRepository>>>, 'properties' | 'extends' | 'primaryKeys' | 'hooks' | 'discriminator' | 'discriminatorColumn' | 'discriminatorValue' | 'versionProperty' | 'concurrencyCheckKeys' | 'serializedPrimaryKey' | 'indexes' | 'uniques' | 'triggers' | 'repository' | 'filters' | 'orderBy'> {
     name: TName;
     tableName?: TTableName;
     extends?: {
@@ -647,8 +647,12 @@ export interface EntityMetadataWithProperties<TName extends string, TTableName e
         entity?: EntityName<any> | EntityName<any>[];
         args?: boolean;
         strict?: boolean;
+        rls?: boolean | {
+            setting?: string;
+        };
     }>;
     forceObject?: TForceObject;
+    embeddable?: TEmbeddable;
     inheritance?: 'tpt';
     orderBy?: {
         [K in Extract<AllKeys<TProperties, TBase>, string>]?: QueryOrderKeysFlat;
@@ -699,7 +703,7 @@ export interface EntityMetadataWithProperties<TName extends string, TTableName e
     }[];
 }
 /** Defines an entity schema using property builders, with full type inference from the property definitions. */
-export declare function defineEntity<const TName extends string, const TTableName extends string, const TProperties extends Record<string, any>, const TPK extends (keyof TProperties)[] | undefined = undefined, const TBase = never, const TRepository = never, const TForceObject extends boolean = false, const TDiscriminatorColumn extends string | undefined = undefined, const TDiscriminatorValue extends string | number | undefined = undefined, const TBaseDiscriminatorColumn extends string | undefined = undefined>(meta: EntityMetadataWithProperties<TName, TTableName, TProperties, TPK, TBase, TRepository, TForceObject, TDiscriminatorColumn, TDiscriminatorValue, TBaseDiscriminatorColumn>): EntitySchemaWithMeta<TName, TTableName, InferEntityFromProperties<TProperties, TPK, TBase, TRepository, TForceObject, TBaseDiscriminatorColumn, TDiscriminatorValue>, TBase, TProperties, EntityCtor<InferEntityFromProperties<TProperties, TPK, TBase, TRepository, TForceObject, TBaseDiscriminatorColumn, TDiscriminatorValue>>, TDiscriminatorColumn>;
+export declare function defineEntity<const TName extends string, const TTableName extends string, const TProperties extends Record<string, any>, const TPK extends (keyof TProperties)[] | undefined = undefined, const TBase = never, const TRepository = never, const TForceObject extends boolean = false, const TDiscriminatorColumn extends string | undefined = undefined, const TDiscriminatorValue extends string | number | undefined = undefined, const TBaseDiscriminatorColumn extends string | undefined = undefined, const TEmbeddable extends boolean = false>(meta: EntityMetadataWithProperties<TName, TTableName, TProperties, TPK, TBase, TRepository, TForceObject, TDiscriminatorColumn, TDiscriminatorValue, TBaseDiscriminatorColumn, TEmbeddable>): EntitySchemaWithMeta<TName, TTableName, InferEntityFromProperties<TProperties, TPK, TBase, TRepository, TForceObject, TBaseDiscriminatorColumn, TDiscriminatorValue, TEmbeddable>, TBase, TProperties, EntityCtor<InferEntityFromProperties<TProperties, TPK, TBase, TRepository, TForceObject, TBaseDiscriminatorColumn, TDiscriminatorValue, TEmbeddable>>, TDiscriminatorColumn>;
 export declare namespace defineEntity {
     export { propertyBuilders as properties };
 }
@@ -734,22 +738,24 @@ type InferTypeByString<T extends string> = T extends keyof typeof types ? InferJ
 type InferJSType<T> = T extends typeof Type<infer TValue, any> ? NonNullable<TValue> : never;
 type InferColumnType<T extends string> = T extends 'int' | 'int4' | 'integer' | 'bigint' | 'int8' | 'int2' | 'tinyint' | 'smallint' | 'mediumint' ? number : T extends 'double' | 'double precision' | 'real' | 'float8' | 'decimal' | 'numeric' | 'float' | 'float4' ? number : T extends 'datetime' | 'time' | 'time with time zone' | 'timestamp' | 'timestamp with time zone' | 'timetz' | 'timestamptz' | 'date' | 'interval' ? Date : T extends 'ObjectId' | 'objectId' | 'character varying' | 'varchar' | 'char' | 'character' | 'uuid' | 'text' | 'tinytext' | 'mediumtext' | 'longtext' | 'enum' ? string : T extends 'boolean' | 'bool' | 'bit' ? boolean : T extends 'blob' | 'tinyblob' | 'mediumblob' | 'longblob' | 'bytea' ? Buffer : T extends 'point' | 'line' | 'lseg' | 'box' | 'circle' | 'path' | 'polygon' | 'geometry' ? number[] : T extends 'tsvector' | 'tsquery' ? string[] : T extends 'json' | 'jsonb' ? any : any;
 type BaseEntityMethodKeys = 'toObject' | 'toPOJO' | 'serialize' | 'assign' | 'populate' | 'init' | 'toReference';
+interface BaseEntityMethods<in out Entity extends object> extends Pick<IWrappedEntity<Entity>, BaseEntityMethodKeys> {
+}
 /** Infers the entity type from a `defineEntity()` properties map, resolving builders, base classes, and primary keys. */
-export type InferEntityFromProperties<Properties extends Record<string, any>, PK extends (keyof Properties)[] | undefined = undefined, Base = never, Repository = never, ForceObject extends boolean = false, BaseDiscriminatorColumn extends string | undefined = undefined, DiscriminatorValue extends string | number | undefined = undefined> = (IsNever<Base> extends true ? {} : Base extends {
+export type InferEntityFromProperties<Properties extends Record<string, any>, PK extends (keyof Properties)[] | undefined = undefined, Base = never, Repository = never, ForceObject extends boolean = false, BaseDiscriminatorColumn extends string | undefined = undefined, DiscriminatorValue extends string | number | undefined = undefined, Embeddable extends boolean = false> = (IsNever<Base> extends true ? {} : Base extends {
     toObject(...args: any[]): any;
-} ? Pick<IWrappedEntity<{
+} ? BaseEntityMethods<{
     -readonly [K in keyof Properties]: InferBuilderValue<MaybeReturnType<Properties[K]>>;
 } & {
     [PrimaryKeyProp]?: InferCombinedPrimaryKey<Properties, PK, Base>;
 } & (IsNever<Repository> extends true ? {} : {
     [EntityRepositoryType]?: Repository extends Constructor<infer R> ? R : Repository;
-}) & NarrowDiscriminator<Omit<Base, typeof PrimaryKeyProp>, BaseDiscriminatorColumn, DiscriminatorValue>>, BaseEntityMethodKeys> : {}) & {
+}) & NarrowDiscriminator<Omit<Base, typeof PrimaryKeyProp>, BaseDiscriminatorColumn, DiscriminatorValue, Embeddable>> : {}) & {
     -readonly [K in keyof Properties]: InferBuilderValue<MaybeReturnType<Properties[K]>>;
 } & {
     [PrimaryKeyProp]?: InferCombinedPrimaryKey<Properties, PK, Base>;
 } & (IsNever<Repository> extends true ? {} : {
     [EntityRepositoryType]?: Repository extends Constructor<infer R> ? R : Repository;
-}) & (IsNever<Base> extends true ? {} : NarrowDiscriminator<Omit<Base, typeof PrimaryKeyProp>, BaseDiscriminatorColumn, DiscriminatorValue>) & (ForceObject extends true ? {
+}) & (IsNever<Base> extends true ? {} : NarrowDiscriminator<Omit<Base, typeof PrimaryKeyProp>, BaseDiscriminatorColumn, DiscriminatorValue, Embeddable>) & (ForceObject extends true ? {
     [Config]?: DefineConfig<{
         forceObject: true;
     }>;
@@ -757,13 +763,26 @@ export type InferEntityFromProperties<Properties extends Record<string, any>, PK
     [IndexHints]?: [Omit<ExtractBaseProperties<Base>, keyof Properties> & Properties];
 };
 type ExtractBaseProperties<Base> = [ExtractDefineEntityProperties<Base>] extends [infer P extends Record<string, any>] ? [P] extends [never] ? {} : P : {};
-type NarrowDiscriminator<Base, DiscColumn extends string | undefined, DiscValue> = DiscColumn extends string ? DiscColumn extends keyof Base ? DiscValue extends string | number ? Omit<Base, DiscColumn> & {
+type ExtractOptionalProps<Base> = Base extends {
+    [OptionalProps]?: infer K;
+} ? (K extends string ? K : never) : never;
+type NarrowDiscriminator<Base, DiscColumn extends string | undefined, DiscValue, Embeddable extends boolean = false> = DiscColumn extends string ? DiscColumn extends keyof Base ? DiscValue extends string | number ? Embeddable extends true ? Omit<Base, DiscColumn> & {
     [K in DiscColumn]: DiscValue;
+} : Omit<Base, DiscColumn | typeof OptionalProps> & {
+    [K in DiscColumn]: DiscValue;
+} & {
+    [OptionalProps]?: DiscColumn | ExtractOptionalProps<Base>;
 } : Base : Base : Base;
 type InferCombinedPrimaryKey<Properties extends Record<string, any>, PK, Base> = PK extends undefined ? CombinePrimaryKeys<InferPrimaryKey<Properties>, ExtractBasePrimaryKey<Base>> : PK;
-type ExtractBasePrimaryKey<Base> = Base extends {
+type ExtractBasePrimaryKey<Base> = typeof PrimaryKeyProp extends keyof Base ? Base extends {
     [PrimaryKeyProp]?: infer BasePK;
-} ? BasePK : never;
+} ? BasePK : never : [keyof Base] extends [never] ? never : Base extends {
+    _id?: any;
+} ? '_id' : Base extends {
+    id?: any;
+} ? 'id' : Base extends {
+    uuid?: any;
+} ? 'uuid' : never;
 type CombinePrimaryKeys<ChildPK, BasePK> = [ChildPK] extends [never] ? BasePK : [BasePK] extends [never] ? IsUnion<ChildPK> extends true ? ChildPK[] : ChildPK : ChildPK | BasePK;
 /** Extracts the primary key property names from a properties map by finding builders with `primary: true`. */
 export type InferPrimaryKey<Properties extends Record<string, any>> = {
@@ -790,6 +809,8 @@ type InferBuilderValue<Builder> = Builder extends {
 type MaybeArray<Value, Options> = Options extends {
     array: true;
 } ? Value[] : Value;
+/** The runtime value passed to a custom serializer — the property value as stored on the entity (e.g. `Collection`/`Ref` for relations). Skips `MaybeMapToPk`, as its `Primary<Value>` branch is too costly for the type checker. */
+type SerializerValue<Value, Options> = MaybeNullable<MaybeRelationRef<MaybeArray<Value, Options>, Options>, Options>;
 type MaybeMapToPk<Value, Options> = Options extends {
     mapToPk: true;
 } ? Primary<Value> : Value;

package/entity/defineEntity.js

@@ -496,7 +496,7 @@ export class StringPropertyOptionsBuilder extends UniversalPropertyOptionsBuilde
 export class OneToManyOptionsBuilderOnlyMappedBy extends UniversalPropertyOptionsBuilder {
     /** Point to the owning side property name. */
     mappedBy(mappedBy) {
-        return new UniversalPropertyOptionsBuilder({ ...this['~options'], mappedBy });
+        return this.assignOptions({ mappedBy });
     }
 }
 function createPropertyBuilders(options) {

package/enums.d.ts

@@ -1,4 +1,4 @@
-import type { EntityKey, ExpandProperty } from './typings.js';
+import type { EntityKey, ExpandProperty, SessionContext } from './typings.js';
 import type { InflightQueryAbortStrategy, Transaction } from './connections/Connection.js';
 import type { LogContext } from './logging/Logger.js';
 /** Controls when the `EntityManager` flushes pending changes to the database. */
@@ -307,6 +307,8 @@ export interface TransactionOptions {
     flushMode?: FlushMode | `${FlushMode}`;
     ignoreNestedTransactions?: boolean;
     loggerContext?: LogContext;
+    /** @internal database session context applied on `begin()` (set via `em.setSessionContext()`). */
+    sessionContext?: SessionContext;
     /**
      * `AbortSignal` cancelling every query within the transaction (including the implicit flush).
      * Cancelling mid-transaction triggers a rollback once the in-flight query settles.

package/errors.d.ts

@@ -25,6 +25,13 @@ export declare class ValidationError<T extends AnyEntity = AnyEntity> extends Er
     static invalidCompositeIdentifier(meta: EntityMetadata): ValidationError;
     static cannotCommit(): ValidationError;
     static cannotUseGlobalContext(): ValidationError;
+    static sessionContextNotSupported(): ValidationError;
+    static sessionContextRequiresImplicitTransactions(): ValidationError;
+    static sessionContextWithDisabledTransactions(): ValidationError;
+    static sessionContextInsideTransaction(action?: 'set' | 'clear'): ValidationError;
+    static cannotStageNonScalarSessionVariable(filterName: string, argName: string): ValidationError;
+    static sessionContextStreamRequiresTransaction(): ValidationError;
+    static connectionSessionContextNotSupported(): ValidationError;
     static cannotUseOperatorsInsideEmbeddables(entityName: EntityName, propName: string, payload: unknown): ValidationError;
     static cannotUseGroupOperatorsInsideScalars(entityName: EntityName, propName: string, payload: unknown): ValidationError;
     static invalidEmbeddableQuery(entityName: EntityName, propName: string, embeddableType: string): ValidationError;
@@ -60,6 +67,7 @@ export declare class MetadataError<T extends AnyEntity = AnyEntity> extends Vali
     static duplicateFieldName(entityName: EntityName, names: [string, string][]): MetadataError;
     static multipleDecorators(entityName: string, propertyName: string): MetadataError;
     static missingMetadata(entity: string): MetadataError;
+    static ambiguousEntityName(className: string): MetadataError;
     static invalidPrimaryKey(meta: EntityMetadata, prop: EntityProperty, requiredName: string): MetadataError;
     static invalidManyToManyWithPivotEntity(meta1: EntityMetadata, prop1: EntityProperty, meta2: EntityMetadata, prop2: EntityProperty): MetadataError;
     static targetIsAbstract(meta: EntityMetadata, prop: EntityProperty): MetadataError;
@@ -76,6 +84,30 @@ export declare class MetadataError<T extends AnyEntity = AnyEntity> extends Vali
     static tptNotSupportedByDriver(meta: EntityMetadata): MetadataError;
     /** Thrown when database triggers are defined on an entity using a driver that does not support them. */
     static triggersNotSupportedByDriver(meta: EntityMetadata): MetadataError;
+    /** Thrown when row level security is declared on an entity using a driver that does not support it. */
+    static rowLevelSecurityNotSupportedByDriver(meta: EntityMetadata): MetadataError;
+    /** Thrown when row level security is declared on a non-root entity of an STI hierarchy. */
+    static rowLevelSecurityOnNonRootStiEntity(meta: EntityMetadata): MetadataError;
+    /** Thrown when two policies on the same entity are given the same explicit name. */
+    static duplicatePolicyName(meta: EntityMetadata, name: string): MetadataError;
+    /** Thrown when a filter flagged with `rls` is declared on a driver that does not support row level security. */
+    static rlsFilterNotSupportedByDriver(meta: EntityMetadata, filterName: string): MetadataError;
+    /** Thrown when a filter flagged with `rls` is declared on a non-root entity of an STI hierarchy. */
+    static rlsFilterOnNonRootStiEntity(meta: EntityMetadata, filterName: string): MetadataError;
+    /** Thrown when a global (config or EM registered) filter is flagged with `rls`; RLS filters must be entity scoped. */
+    static rlsFilterMustBeEntityScoped(filterName: string): MetadataError;
+    /** Thrown when an entity-scoped `rls` filter is registered at runtime via `em.addFilter()` instead of in metadata. */
+    static rlsFilterCannotBeRegisteredAtRuntime(filterName: string): MetadataError;
+    /** Thrown when a filter's custom `setting` is used with more than one argument. */
+    static rlsFilterMultiArgSetting(filterName: string, args: string[]): MetadataError;
+    /** Thrown when an `rls` filter's condition depends on runtime state and cannot be compiled to a static policy. */
+    static rlsFilterDependsOnRuntimeState(filterName: string): MetadataError;
+    /** Thrown when an `rls` filter compares against a column whose type has no automatic session-variable cast. */
+    static rlsFilterUncastableType(filterName: string, columnType: string): MetadataError;
+    /** Thrown when an `rls` filter references an argument outside of a direct comparison, which cannot be compiled. */
+    static rlsFilterUnsupportedCond(filterName: string): MetadataError;
+    /** Thrown when an `rls` filter compares against a column the schema generator does not manage. */
+    static rlsFilterUnmanagedColumn(filterName: string, column: string): MetadataError;
     private static fromMessage;
 }
 /** Error thrown when an entity lookup fails to find the expected result. */

package/errors.js

@@ -94,6 +94,30 @@ export class ValidationError extends Error {
     static cannotUseGlobalContext() {
         return new ValidationError("Using global EntityManager instance methods for context specific actions is disallowed. If you need to work with the global instance's identity map, use `allowGlobalContext` configuration option or `fork()` instead.");
     }
+    static sessionContextNotSupported() {
+        return new ValidationError('Database session context (row level security) is only supported by the PostgreSQL driver. To test a PostgreSQL app without a server, use the `@mikro-orm/pglite` driver instead of sqlite.');
+    }
+    static sessionContextRequiresImplicitTransactions() {
+        return new ValidationError("Cannot set a database session context (row level security) with the 'transaction' strategy while 'implicitTransactions' is disabled. The context is applied on transaction begin, but writes would run without a transaction and silently bypass the policies. Enable 'implicitTransactions', wrap the work in 'em.transactional()', or use the 'connection' session context strategy.");
+    }
+    static sessionContextWithDisabledTransactions() {
+        return new ValidationError("Cannot set a database session context (row level security) with the 'transaction' strategy while transactions are disabled via 'disableTransactions'. The context is applied on transaction begin, so flushes would run without it and silently bypass the policies. Enable transactions, or use the 'connection' session context strategy.");
+    }
+    static sessionContextInsideTransaction(action = 'set') {
+        const advice = action === 'set'
+            ? "Set the session context before starting the transaction (e.g. via 'em.fork({ session })')."
+            : 'Clear the session context outside the transaction.';
+        return new ValidationError(`Cannot ${action} a database session context (row level security) inside an active transaction. The context is applied when the transaction begins or the connection is reserved, so the change would never reach an already-open transaction (with the 'connection' strategy the pinned connection was reserved with the previous context). ${advice}`);
+    }
+    static cannotStageNonScalarSessionVariable(filterName, argName) {
+        return new ValidationError(`Cannot stage the '${argName}' argument of filter '${filterName}' as a session variable (row level security) — only scalar values (string, number, boolean, Date) can be mirrored to the database policy backing the filter.`);
+    }
+    static sessionContextStreamRequiresTransaction() {
+        return new ValidationError("Cannot stream under a database session context (row level security) with the 'transaction' strategy outside a transaction. Streaming never opens the implicit transaction that applies the context, so the streamed rows would not be scoped by it (other tenants' rows would leak). Wrap the stream in 'em.transactional()', or use the 'connection' session context strategy.");
+    }
+    static connectionSessionContextNotSupported() {
+        return new ValidationError("The 'connection' session context strategy requires a driver that supports per-acquire connection hooks (the `postgresql` driver). Use the default 'transaction' strategy instead.");
+    }
     static cannotUseOperatorsInsideEmbeddables(entityName, propName, payload) {
         return new ValidationError(`Using operators inside embeddables is not allowed, move the operator above. (property: ${Utils.className(entityName)}.${propName}, payload: ${inspect(payload)})`);
     }
@@ -195,6 +219,9 @@ export class MetadataError extends ValidationError {
     static missingMetadata(entity) {
         return new MetadataError(`Metadata for entity ${entity} not found`);
     }
+    static ambiguousEntityName(className) {
+        return new MetadataError(`Entity name '${className}' is ambiguous, multiple discovered entity classes share it (possibly due to a minifier mangling class names). Use a class reference instead of a string name.`);
+    }
     static invalidPrimaryKey(meta, prop, requiredName) {
         return this.fromMessage(meta, prop, `has wrong field name, '${requiredName}' is required in current driver`);
     }
@@ -247,6 +274,54 @@ export class MetadataError extends ValidationError {
     static triggersNotSupportedByDriver(meta) {
         return new MetadataError(`Entity ${meta.className} defines database triggers which are not supported by the current driver. Triggers are only available with SQL drivers.`);
     }
+    /** Thrown when row level security is declared on an entity using a driver that does not support it. */
+    static rowLevelSecurityNotSupportedByDriver(meta) {
+        return new MetadataError(`Entity ${meta.className} declares row level security which is not supported by the current driver. Row level security is only available with the PostgreSQL driver. To test a PostgreSQL app without a server, use the \`@mikro-orm/pglite\` driver instead of sqlite.`);
+    }
+    /** Thrown when row level security is declared on a non-root entity of an STI hierarchy. */
+    static rowLevelSecurityOnNonRootStiEntity(meta) {
+        return new MetadataError(`Entity ${meta.className} declares row level security, but it is part of a single table inheritance hierarchy. Declare policies on the root entity ${meta.root.className} instead, as the whole hierarchy shares a single table.`);
+    }
+    /** Thrown when two policies on the same entity are given the same explicit name. */
+    static duplicatePolicyName(meta, name) {
+        return new MetadataError(`Entity ${meta.className} declares multiple row level security policies named '${name}'. Policy names must be unique per table; rename one of them or omit the name to use an auto-generated one.`);
+    }
+    /** Thrown when a filter flagged with `rls` is declared on a driver that does not support row level security. */
+    static rlsFilterNotSupportedByDriver(meta, filterName) {
+        return new MetadataError(`Filter '${filterName}' on entity ${meta.className} is flagged with 'rls', which is only supported by the PostgreSQL driver. To test a PostgreSQL app without a server, use the \`@mikro-orm/pglite\` driver instead of sqlite.`);
+    }
+    /** Thrown when a filter flagged with `rls` is declared on a non-root entity of an STI hierarchy. */
+    static rlsFilterOnNonRootStiEntity(meta, filterName) {
+        return new MetadataError(`Filter '${filterName}' on entity ${meta.className} is flagged with 'rls', but the entity is part of a single table inheritance hierarchy. Declare the filter on the root entity ${meta.root.className} instead, as the whole hierarchy shares a single table and the policy would never be created otherwise.`);
+    }
+    /** Thrown when a global (config or EM registered) filter is flagged with `rls`; RLS filters must be entity scoped. */
+    static rlsFilterMustBeEntityScoped(filterName) {
+        return new MetadataError(`Filter '${filterName}' is a global filter and cannot be flagged with 'rls'. RLS filters must be declared on an entity via @Filter() so a policy can be attached to its table.`);
+    }
+    /** Thrown when an entity-scoped `rls` filter is registered at runtime via `em.addFilter()` instead of in metadata. */
+    static rlsFilterCannotBeRegisteredAtRuntime(filterName) {
+        return new MetadataError(`Filter '${filterName}' cannot be flagged with 'rls' when registered at runtime via 'em.addFilter()'. RLS filters must be declared in entity metadata via the @Filter() decorator (or the entity 'filters' option) so a policy can be attached to the table.`);
+    }
+    /** Thrown when a filter's custom `setting` is used with more than one argument. */
+    static rlsFilterMultiArgSetting(filterName, args) {
+        return new MetadataError(`Filter '${filterName}' sets a custom 'setting' but references multiple arguments (${args.join(', ')}). A custom 'setting' is only allowed for single-argument RLS filters; remove it to use the default 'mikro.${filterName}.<arg>' names.`);
+    }
+    /** Thrown when an `rls` filter's condition depends on runtime state and cannot be compiled to a static policy. */
+    static rlsFilterDependsOnRuntimeState(filterName) {
+        return new MetadataError(`Filter '${filterName}' cannot be compiled to an RLS policy because its condition depends on runtime state (it accesses 'em', 'type', 'options' or 'entityName', or resolves asynchronously). Declare an explicit policy instead.`);
+    }
+    /** Thrown when an `rls` filter compares against a column whose type has no automatic session-variable cast. */
+    static rlsFilterUncastableType(filterName, columnType) {
+        return new MetadataError(`Filter '${filterName}' cannot be compiled to an RLS policy because the column type '${columnType}' has no automatic session-variable cast. Declare an explicit policy instead.`);
+    }
+    /** Thrown when an `rls` filter references an argument outside of a direct comparison, which cannot be compiled. */
+    static rlsFilterUnsupportedCond(filterName) {
+        return new MetadataError(`Filter '${filterName}' cannot be compiled to an RLS policy because it references an argument outside of a direct comparison (only expressions like { prop: args.x } are supported). Declare an explicit policy instead.`);
+    }
+    /** Thrown when an `rls` filter compares against a column the schema generator does not manage. */
+    static rlsFilterUnmanagedColumn(filterName, column) {
+        return new MetadataError(`Filter '${filterName}' cannot be compiled to an RLS policy because column '${column}' is not part of the managed schema (e.g. the property is marked 'persist: false' or the column is excluded via 'skipColumns'). Declare an explicit policy instead.`);
+    }
     static fromMessage(meta, prop, message) {
         return new MetadataError(`${meta.className}.${prop.name} ${message}`);
     }

package/events/EventManager.js

@@ -43,7 +43,10 @@ export class EventManager {
         }));
         for (const listener of this.#listeners[event] ?? new Set()) {
             const entities = this.#entities.get(listener);
-            if (entities.size === 0 || !entity || entities.has(entity.constructor.name)) {
+            if (entities.size === 0 ||
+                !entity ||
+                entities.has(entity.constructor) ||
+                entities.has(entity.constructor.name)) {
                 listeners.push(listener[event].bind(listener));
             }
         }
@@ -68,7 +71,7 @@ export class EventManager {
         }
         for (const listener of this.#listeners[event] ?? new Set()) {
             const entities = this.#entities.get(listener);
-            if (entities.size === 0 || entities.has(meta.className)) {
+            if (entities.size === 0 || entities.has(meta.class) || entities.has(meta.className)) {
                 this.#cache.set(cacheKey, true);
                 return true;
             }
@@ -84,6 +87,6 @@ export class EventManager {
         if (!listener.getSubscribedEntities) {
             return new Set();
         }
-        return new Set(listener.getSubscribedEntities().map(name => Utils.className(name)));
+        return new Set(listener.getSubscribedEntities().map(name => Utils.classOrName(name)));
     }
 }

package/exceptions.d.ts

@@ -102,3 +102,8 @@ export declare class TableNotFoundException extends DatabaseObjectNotFoundExcept
  */
 export declare class UniqueConstraintViolationException extends ConstraintViolationException {
 }
+/**
+ * Exception for a row-level security policy violation (failed `WITH CHECK`) detected in the driver.
+ */
+export declare class RowLevelSecurityViolationException extends ConstraintViolationException {
+}

package/exceptions.js

@@ -115,3 +115,8 @@ export class TableNotFoundException extends DatabaseObjectNotFoundException {
  */
 export class UniqueConstraintViolationException extends ConstraintViolationException {
 }
+/**
+ * Exception for a row-level security policy violation (failed `WITH CHECK`) detected in the driver.
+ */
+export class RowLevelSecurityViolationException extends ConstraintViolationException {
+}

package/hydration/ObjectHydrator.d.ts

@@ -19,6 +19,8 @@ export declare class ObjectHydrator extends Hydrator {
     getEntityHydrator<T extends object>(meta: EntityMetadata<T>, type: 'full' | 'reference', normalizeAccessors?: boolean): EntityHydrator<T>;
     private createCollectionItemMapper;
     private wrap;
+    /** Renders a key as a single-quoted JS string literal, safe to embed in generated code. */
+    private quote;
     private safeKey;
 }
 export {};

package/hydration/ObjectHydrator.js

@@ -87,7 +87,7 @@ export class ObjectHydrator extends Hydrator {
             ret.push(`  if (data${dataKey} === null) {`);
             if (prop.ref) {
                 ret.push(`    entity${entityKey} = new ScalarReference();`);
-                ret.push(`    entity${entityKey}.bind(entity, '${prop.name}');`);
+                ret.push(`    entity${entityKey}.bind(entity, ${this.quote(prop.name)});`);
                 ret.push(`    entity${entityKey}.set(${nullVal});`);
             }
             else {
@@ -127,14 +127,14 @@ export class ObjectHydrator extends Hydrator {
             if (prop.ref) {
                 ret.push(`    const value = isScalarReference(entity${entityKey}) ? entity${entityKey}.unwrap() : entity${entityKey};`);
                 ret.push(`    entity${entityKey} = oldValue_${idx} ?? new ScalarReference(value);`);
-                ret.push(`    entity${entityKey}.bind(entity, '${prop.name}');`);
+                ret.push(`    entity${entityKey}.bind(entity, ${this.quote(prop.name)});`);
                 ret.push(`    entity${entityKey}.set(value);`);
             }
             ret.push(`  }`);
             if (prop.ref) {
                 ret.push(`  if (!entity${entityKey}) {`);
                 ret.push(`    entity${entityKey} = new ScalarReference();`);
-                ret.push(`    entity${entityKey}.bind(entity, '${prop.name}');`);
+                ret.push(`    entity${entityKey}.bind(entity, ${this.quote(prop.name)});`);
                 ret.push(`  }`);
             }
             return ret;
@@ -220,7 +220,7 @@ export class ObjectHydrator extends Hydrator {
             ret.push(`  }`);
             ret.push(`  if (Array.isArray(data${dataKey})) {`);
             ret.push(`    const items = data${dataKey}.map(value => createCollectionItem_${this.safeKey(prop.name)}(value, entity));`);
-            ret.push(`    const coll = Collection.create(entity, '${prop.name}', items, newEntity);`);
+            ret.push(`    const coll = Collection.create(entity, ${this.quote(prop.name)}, items, newEntity);`);
             ret.push(`    if (newEntity) {`);
             ret.push(`      coll.setDirty();`);
             ret.push(`    } else {`);
@@ -231,11 +231,11 @@ export class ObjectHydrator extends Hydrator {
             if (!this.platform.usesPivotTable() && prop.owner && prop.kind === ReferenceKind.MANY_TO_MANY) {
                 ret.push(`  } else if (!entity${entityKey} && Array.isArray(data${dataKey})) {`);
                 const items = this.platform.usesPivotTable() || !prop.owner ? 'undefined' : '[]';
-                ret.push(`    const coll = Collection.create(entity, '${prop.name}', ${items}, !!data${dataKey} || newEntity);`);
+                ret.push(`    const coll = Collection.create(entity, ${this.quote(prop.name)}, ${items}, !!data${dataKey} || newEntity);`);
                 ret.push(`    coll.setDirty(false);`);
             }
             ret.push(`  } else if (!entity${entityKey}) {`);
-            ret.push(`    const coll = Collection.create(entity, '${prop.name}', undefined, newEntity);`);
+            ret.push(`    const coll = Collection.create(entity, ${this.quote(prop.name)}, undefined, newEntity);`);
             ret.push(`    coll.setDirty(false);`);
             ret.push(`  }`);
             return ret;
@@ -431,10 +431,14 @@ export class ObjectHydrator extends Hydrator {
         return lines;
     }
     wrap(key) {
-        if (/^\[.*]$/.exec(key)) {
+        if (/^\[idx_\d+]$/.exec(key)) {
             return key;
         }
-        return /^\w+$/.exec(key) ? `.${key}` : `['${key}']`;
+        return /^\w+$/.exec(key) ? `.${key}` : `[${this.quote(key)}]`;
+    }
+    /** Renders a key as a single-quoted JS string literal, safe to embed in generated code. */
+    quote(key) {
+        return `'${key.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
     }
     safeKey(key) {
         return key.replace(/\W/g, '_');

package/index.d.ts

@@ -3,7 +3,7 @@
  * @module core
  */
 export { EntityMetadata, PrimaryKeyProp, EntityRepositoryType, OptionalProps, EagerProps, HiddenProps, Config, EntityName, IndexHints, } from './typings.js';
-export type { CompiledFunctions, Constructor, ConnectionType, Dictionary, Primary, IPrimaryKey, ObjectQuery, FilterQuery, IWrappedEntity, InferEntityName, EntityData, Highlighter, MaybePromise, AnyEntity, EntityClass, EntityProperty, PopulateOptions, Populate, Loaded, New, LoadedReference, LoadedCollection, IMigrator, IMigrationGenerator, MigratorEvent, GetRepository, MigrationObject, DeepPartial, PrimaryProperty, Cast, IsUnknown, EntityDictionary, EntityDTO, EntityDTOFlat, EntityDTOProp, SerializeDTO, MigrationDiff, GenerateOptions, FilterObject, IndexFilterQuery, ExtractIndexHints, ExtractDefineEntityProperties, IndexName, IndexColumns, WithUsingOptions, IMigrationRunner, IEntityGenerator, ISeedManager, SeederObject, IMigratorStorage, RequiredEntityData, CheckCallback, TriggerCallback, IndexCallback, FormulaCallback, FormulaColumns, FormulaTable, SchemaTable, SchemaColumns, SchemaColumnRef, EntityDataPropValue, SimpleColumnMeta, Rel, Ref, LazyRef, ScalarRef, EntityRef, ISchemaGenerator, MigrationInfo, MigrateOptions, MigrationResult, MigrationRow, EntityKey, EntityValue, EntityDataValue, FilterKey, EntityType, FromEntityType, Selected, IsSubset, EntityProps, ExpandProperty, ExpandScalar, FilterItemValue, ExpandQuery, Scalar, ExpandHint, FilterValue, MergeLoaded, MergeSelected, TypeConfig, AnyString, ClearDatabaseOptions, CreateSchemaOptions, EnsureDatabaseOptions, UpdateSchemaOptions, DropSchemaOptions, RefreshDatabaseOptions, AutoPath, UnboxArray, MetadataProcessor, ImportsResolver, RequiredNullable, DefineConfig, Opt, Hidden, EntitySchemaWithMeta, InferEntity, CheckConstraint, TriggerDef, RoutineReturns, RoutineBodyCallback, RoutineJsBody, RoutineIgnoreField, RoutineParamConfig, RoutineConfig, RoutineRuntimeType, RoutineArgs, RoutineReturn, GeneratedColumnCallback, FilterDef, EntityCtor, Subquery, PopulateHintOptions, Prefixes, } from './typings.js';
+export type { CompiledFunctions, Constructor, ConnectionType, Dictionary, Primary, IPrimaryKey, ObjectQuery, FilterQuery, IWrappedEntity, InferEntityName, EntityData, Highlighter, MaybePromise, AnyEntity, EntityClass, EntityProperty, PopulateOptions, Populate, Loaded, New, LoadedReference, LoadedCollection, IMigrator, IMigrationGenerator, MigratorEvent, GetRepository, MigrationObject, DeepPartial, PrimaryProperty, Cast, IsUnknown, EntityDictionary, EntityDTO, EntityDTOFlat, EntityDTOProp, SerializeDTO, MigrationDiff, GenerateOptions, FilterObject, IndexFilterQuery, ExtractIndexHints, ExtractDefineEntityProperties, IndexName, IndexColumns, WithUsingOptions, IMigrationRunner, IEntityGenerator, ISeedManager, SeederObject, IMigratorStorage, RequiredEntityData, CheckCallback, TriggerCallback, IndexCallback, FormulaCallback, FormulaColumns, FormulaTable, SchemaTable, SchemaColumns, SchemaColumnRef, EntityDataPropValue, SimpleColumnMeta, Rel, Ref, LazyRef, ScalarRef, EntityRef, ISchemaGenerator, MigrationInfo, MigrateOptions, MigrationResult, MigrationRow, EntityKey, EntityValue, EntityDataValue, FilterKey, EntityType, FromEntityType, Selected, IsSubset, EntityProps, ExpandProperty, ExpandScalar, FilterItemValue, ExpandQuery, Scalar, ExpandHint, FilterValue, MergeLoaded, MergeSelected, TypeConfig, AnyString, ClearDatabaseOptions, CreateSchemaOptions, EnsureDatabaseOptions, UpdateSchemaOptions, DropSchemaOptions, RefreshDatabaseOptions, AutoPath, UnboxArray, MetadataProcessor, ImportsResolver, RequiredNullable, DefineConfig, Opt, Hidden, EntitySchemaWithMeta, InferEntity, CheckConstraint, TriggerDef, PolicyDef, PolicyCallback, SessionContext, RoutineReturns, RoutineBodyCallback, RoutineJsBody, RoutineIgnoreField, RoutineParamConfig, RoutineConfig, RoutineRuntimeType, RoutineArgs, RoutineReturn, GeneratedColumnCallback, FilterDef, EntityCtor, Subquery, PopulateHintOptions, Prefixes, } from './typings.js';
 export * from './enums.js';
 export * from './errors.js';
 export * from './exceptions.js';

package/metadata/MetadataDiscovery.d.ts

@@ -117,6 +117,7 @@ export declare class MetadataDiscovery {
     private createSchemaTable;
     private initCheckConstraints;
     private initTriggers;
+    private initPolicies;
     private initGeneratedColumn;
     private getDefaultVersionValue;
     private inferDefaultValue;