@mikro-orm/core 7.2.0-dev.8 → 7.2.0

package/utils/Cursor.js

@@ -58,6 +58,7 @@ export class Cursor {
     hasPrevPage;
     hasNextPage;
     #definition;
+    #meta;
     constructor(items, totalCount, options, meta) {
         this.items = items;
         this.totalCount = totalCount;
@@ -76,6 +77,7 @@ export class Cursor {
             }
         }
         this.#definition = Cursor.getDefinition(meta, orderBy);
+        this.#meta = meta;
     }
     get startCursor() {
         if (this.items.length === 0) {
@@ -93,37 +95,46 @@ export class Cursor {
      * Computes the cursor value for a given entity.
      */
     from(entity) {
-        const processEntity = (entity, prop, direction, object = false) => {
-            if (Utils.isPlainObject(direction)) {
-                const unwrapped = Reference.unwrapReference(entity[prop]);
-                // Check if the relation is loaded - for nested properties, undefined means not populated
-                if (Utils.isEntity(unwrapped) && !helper(unwrapped).isInitialized()) {
-                    throw CursorError.entityNotPopulated(entity, prop);
-                }
-                return Utils.keys(direction).reduce((o, key) => {
-                    Object.assign(o, processEntity(unwrapped, key, direction[key], true));
-                    return o;
-                }, {});
-            }
-            let value = entity[prop];
-            // Allow null/undefined values in cursor - they will be handled in createCursorCondition
-            // undefined can occur with forceUndefined config option which converts null to undefined
-            if (value == null) {
-                return object ? { [prop]: null } : null;
-            }
-            if (Utils.isEntity(value, true)) {
-                value = helper(value).getPrimaryKey();
-            }
-            if (Utils.isScalarReference(value)) {
-                value = value.unwrap();
+        const value = this.#definition.map(([key, direction]) => Cursor.serialize(this.#meta.properties, entity, key, direction));
+        return Cursor.encode(value);
+    }
+    /** Serializes a single cursor value, walking nested directions and reading the owner's properties. */
+    static serialize(properties, owner, key, direction) {
+        const prop = properties[key];
+        let value = owner[key];
+        if (Utils.isPlainObject(direction)) {
+            const unwrapped = Reference.unwrapReference(value);
+            // for nested properties, an uninitialized relation means not populated
+            if (Utils.isEntity(unwrapped) && !helper(unwrapped).isInitialized()) {
+                throw CursorError.entityNotPopulated(owner, key);
             }
-            if (object) {
-                return { [prop]: value };
+            if (unwrapped == null || typeof unwrapped !== 'object') {
+                return unwrapped;
             }
-            return value;
-        };
-        const value = this.#definition.map(([key, direction]) => processEntity(entity, key, direction));
-        return Cursor.encode(value);
+            const childProps = prop?.kind === ReferenceKind.EMBEDDED ? prop.embeddedProps : prop?.targetMeta?.properties;
+            return Utils.keys(direction).reduce((o, childKey) => {
+                o[childKey] = Cursor.serialize(childProps ?? {}, unwrapped, childKey, direction[childKey]);
+                return o;
+            }, {});
+        }
+        // allow null/undefined values in cursor - they will be handled in createCursorCondition
+        // undefined can occur with forceUndefined config option which converts null to undefined
+        if (value == null) {
+            return null;
+        }
+        if (Utils.isEntity(value, true)) {
+            value = helper(value).getPrimaryKey();
+        }
+        if (Utils.isScalarReference(value)) {
+            value = value.unwrap();
+        }
+        // only types implementing `fromJSON` own their wire format, others keep the raw JS value,
+        // so their cursors stay decodable by the `convertToJSValue` fallback
+        if (prop?.customType?.fromJSON) {
+            // the platform is assigned to the type instance during discovery
+            return prop.customType.toJSON(value, prop.customType.platform);
+        }
+        return value;
     }
     *[Symbol.iterator]() {
         for (const item of this.items) {
@@ -138,12 +149,11 @@ export class Cursor {
      */
     static for(meta, entity, orderBy) {
         const definition = this.getDefinition(meta, orderBy);
-        return Cursor.encode(definition.map(([key]) => {
-            const value = entity[key];
-            if (value === undefined) {
+        return Cursor.encode(definition.map(([key, direction]) => {
+            if (entity[key] === undefined) {
                 throw CursorError.missingValue(meta.className, key);
             }
-            return value;
+            return this.serialize(meta.properties, entity, key, direction);
         }));
     }
     static encode(value) {

package/utils/DataloaderUtils.js

@@ -197,7 +197,8 @@ export class DataloaderUtils {
                 const prop = group[0][0].property;
                 const options = {};
                 const wrap = (cond) => ({ [prop.name]: cond });
-                const orderBy = Utils.asArray(group[0][1]?.orderBy).map(o => wrap(o));
+                // `findChildrenFromPivotTable` expects the `orderBy` relative to the target entity, so no wrapping here
+                const orderBy = Utils.asArray(group[0][1]?.orderBy);
                 const populate = wrap(group[0][1]?.populate);
                 const owners = group.map(c => c[0].owner);
                 const $or = [];

package/utils/EntityComparator.d.ts

@@ -80,6 +80,8 @@ export declare class EntityComparator {
     private getGenericComparator;
     private getPropertyComparator;
     private wrap;
+    /** Renders a key as a single-quoted JS string literal, safe to embed in generated code. */
+    private quote;
     private safeKey;
     /**
      * Sets the toArray helper in the context if not already set.

package/utils/EntityComparator.js

@@ -587,7 +587,7 @@ export class EntityComparator {
                 }
             }
             else if (prop.polymorphic) {
-                const discriminatorMapKey = `discriminatorMapReverse_${prop.name}`;
+                const discriminatorMapKey = `discriminatorMapReverse_${this.safeKey(prop.name)}`;
                 const reverseMap = new Map();
                 for (const [key, value] of Object.entries(prop.discriminatorMap)) {
                     reverseMap.set(value, key);
@@ -758,10 +758,14 @@ export class EntityComparator {
         return this.getGenericComparator(this.wrap(prop.name), `!equals(last${this.wrap(prop.name)}, current${this.wrap(prop.name)})`);
     }
     wrap(key) {
-        if (/^\[.*]$/.exec(key)) {
+        if (/^\[idx_\d+]$/.exec(key)) {
             return key;
         }
-        return /^\w+$/.exec(key) ? `.${key}` : `['${key}']`;
+        return /^\w+$/.exec(key) ? `.${key}` : `[${this.quote(key)}]`;
+    }
+    /** Renders a key as a single-quoted JS string literal, safe to embed in generated code. */
+    quote(key) {
+        return `'${key.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
     }
     safeKey(key) {
         return key.replace(/\W/g, '_');

package/utils/QueryHelper.d.ts

@@ -37,6 +37,18 @@ export declare class QueryHelper {
     static inlinePrimaryKeyObjects<T extends object>(where: Dictionary, meta: EntityMetadata<T>, metadata: MetadataStorage, key?: string): boolean;
     static processWhere<T extends object>(options: ProcessWhereOptions<T>): FilterQuery<T>;
     static getActiveFilters<T>(meta: EntityMetadata<T>, options: FilterOptions | undefined, filters: Dictionary<FilterDef>): FilterDef[];
+    /** @internal Sentinel wrapping for arguments accessed while statically resolving an `rls` filter condition. */
+    static readonly RLS_SENTINEL_PREFIX = "__mikro_rls_arg__";
+    /** @internal */
+    static readonly RLS_SENTINEL_SUFFIX = "__";
+    /**
+     * Resolves an `rls` filter's condition to a static `FilterQuery`. Function conditions are called with a proxy `args`
+     * that yields a unique sentinel per accessed argument, real `type`/`entityName` strings (validated to not affect the
+     * result), and a poison proxy or `undefined` for the remaining runtime-only parameters.
+     *
+     * @internal
+     */
+    static resolveRlsFilterCond(filter: FilterDef, accessed: Set<string>, entityName?: string): Dictionary;
     static mergePropertyFilters(propFilters: FilterOptions | undefined, options: FilterOptions | undefined): FilterOptions | undefined;
     static isFilterActive<T>(meta: EntityMetadata<T>, filterName: string, filter: FilterDef, options: Dictionary<boolean | Dictionary>): boolean;
     static processCustomType<T extends object>(prop: EntityProperty<T>, cond: FilterQuery<T>, platform: Platform, key?: string, fromQuery?: boolean): FilterQuery<T>;

package/utils/QueryHelper.js

@@ -1,9 +1,10 @@
 import { Reference } from '../entity/Reference.js';
-import { Utils } from './Utils.js';
+import { DANGEROUS_PROPERTY_NAMES, Utils } from './Utils.js';
 import { ARRAY_OPERATORS, GroupOperator, JSON_KEY_OPERATORS, ReferenceKind } from '../enums.js';
 import { JsonType } from '../types/JsonType.js';
 import { helper } from '../entity/wrap.js';
 import { isRaw, Raw } from './RawQueryFragment.js';
+import { MetadataError } from '../errors.js';
 /** @internal */
 export class QueryHelper {
     static SUPPORTED_OPERATORS = ['>', '<', '<=', '>=', '!', '!='];
@@ -237,7 +238,11 @@ export class QueryHelper {
             // oxfmt-ignore
             const isJsonProperty = prop?.customType instanceof JsonType && !isRaw(value) && (Utils.isPlainObject(value) ? !['$eq', '$elemMatch'].includes(Object.keys(value)[0]) : !Array.isArray(value));
             if (isJsonProperty && prop?.kind !== ReferenceKind.EMBEDDED) {
-                return this.processJsonCondition(o, value, [prop.fieldNames[0]], platform, aliased);
+                // an explicit alias prefix (e.g. `a.meta`) has to survive, otherwise the condition falls back to the root alias
+                const explicitAlias = key.includes('.')
+                    ? key.split('.').slice(0, -1).join('.')
+                    : undefined;
+                return this.processJsonCondition(o, value, [prop.fieldNames[0]], platform, aliased && explicitAlias != null ? explicitAlias : aliased);
             }
             // oxfmt-ignore
             if (Array.isArray(value) && !Utils.isOperator(key) && !QueryHelper.isSupportedOperator(key) && !(customExpression && Raw.getKnownFragment(key).params.length > 0) && options.type !== 'orderBy') {
@@ -269,7 +274,11 @@ export class QueryHelper {
             options.forEach(filter => (opts[filter] = true));
         }
         else if (Utils.isPlainObject(options)) {
-            Object.keys(options).forEach(filter => (opts[filter] = options[filter]));
+            Object.keys(options).forEach(filter => {
+                if (!DANGEROUS_PROPERTY_NAMES.includes(filter)) {
+                    opts[filter] = options[filter];
+                }
+            });
         }
         return Object.keys(filters)
             .filter(f => QueryHelper.isFilterActive(meta, f, filters[f], opts))
@@ -278,6 +287,68 @@ export class QueryHelper {
             return filters[f];
         });
     }
+    /** @internal Sentinel wrapping for arguments accessed while statically resolving an `rls` filter condition. */
+    static RLS_SENTINEL_PREFIX = '__mikro_rls_arg__';
+    /** @internal */
+    static RLS_SENTINEL_SUFFIX = '__';
+    /**
+     * Resolves an `rls` filter's condition to a static `FilterQuery`. Function conditions are called with a proxy `args`
+     * that yields a unique sentinel per accessed argument, real `type`/`entityName` strings (validated to not affect the
+     * result), and a poison proxy or `undefined` for the remaining runtime-only parameters.
+     *
+     * @internal
+     */
+    static resolveRlsFilterCond(filter, accessed, entityName) {
+        if (!(filter.cond instanceof Function)) {
+            return filter.cond;
+        }
+        const args = new Proxy({}, {
+            get: (_target, prop) => {
+                if (typeof prop === 'symbol') {
+                    // e.g. coercing `args` itself in a template literal triggers a `Symbol.toPrimitive` lookup
+                    throw MetadataError.rlsFilterUnsupportedCond(filter.name);
+                }
+                accessed.add(prop);
+                return `${this.RLS_SENTINEL_PREFIX}${prop}${this.RLS_SENTINEL_SUFFIX}`;
+            },
+        });
+        const poison = new Proxy({}, {
+            get: () => {
+                throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+            },
+        });
+        // property access on the poison proxies throws, but equality/truthiness checks (`type === 'read'`,
+        // `entityName === 'X'`, `options ? a : b`) cannot be trapped — vary all three across the evaluations and require
+        // identical results, so a command-, entity-, or options-dependent condition cannot silently compile one branch.
+        // `entityName` uses the real class name (plus two derived-distinct variants) so an `=== '<name>'` check diverges;
+        // `options` alternates the poison proxy and `undefined` so a truthiness check flips. `em` stays poison throughout.
+        const name = entityName ?? `${this.RLS_SENTINEL_PREFIX}entity${this.RLS_SENTINEL_SUFFIX}`;
+        const evaluate = (type, entity, options) => {
+            let result;
+            try {
+                result = filter.cond(args, type, poison, options, entity);
+            }
+            catch (e) {
+                // a raw TypeError from touching the `undefined` options/em must fail closed like the poison proxy does,
+                // but the descriptive MetadataErrors thrown above are already correct — let them surface unchanged
+                if (e instanceof MetadataError) {
+                    throw e;
+                }
+                throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+            }
+            if (result instanceof Promise) {
+                throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+            }
+            return result;
+        };
+        const read = evaluate('read', name, poison);
+        const update = evaluate('update', `${name}\0a`, undefined);
+        const del = evaluate('delete', `${name}\0b`, poison);
+        if (JSON.stringify(read) !== JSON.stringify(update) || JSON.stringify(read) !== JSON.stringify(del)) {
+            throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+        }
+        return read;
+    }
     static mergePropertyFilters(propFilters, options) {
         if (!options || !propFilters || options === true || propFilters === true) {
             return options ?? propFilters;
@@ -297,7 +368,7 @@ export class QueryHelper {
         return Utils.mergeConfig({}, propFilters, options);
     }
     static isFilterActive(meta, filterName, filter, options) {
-        if (filter.entity && !filter.entity.includes(meta.className)) {
+        if (filter.entity && !Utils.asArray(filter.entity).some(e => Utils.matchesEntity(e, meta))) {
             return false;
         }
         if (options[filterName] === false) {

package/utils/RawQueryFragment.d.ts

@@ -61,6 +61,12 @@ export declare const ALIAS_REPLACEMENT_RE = "\\[::alias::\\]";
  * await em.find(User, { [raw(alias => `lower(${alias}.name)`)]: name.toLowerCase() });
  * ```
  *
+ * Named parameters are supported via an object of parameters, use `:name` for values and `:name:` for identifiers:
+ *
+ * ```ts
+ * raw('select :col: from geo where city = :city or region = :city', { col: 'city', city: 'Brno' });
+ * ```
+ *
  * You can also use the `sql` tagged template function, which works the same, but supports only the simple string signature:
  *
  * ```ts

package/utils/RawQueryFragment.js

@@ -146,6 +146,12 @@ export const ALIAS_REPLACEMENT_RE = '\\[::alias::\\]';
  * await em.find(User, { [raw(alias => `lower(${alias}.name)`)]: name.toLowerCase() });
  * ```
  *
+ * Named parameters are supported via an object of parameters, use `:name` for values and `:name:` for identifiers:
+ *
+ * ```ts
+ * raw('select :col: from geo where city = :city or region = :city', { col: 'city', city: 'Brno' });
+ * ```
+ *
  * You can also use the `sql` tagged template function, which works the same, but supports only the simple string signature:
  *
  * ```ts
@@ -191,13 +197,16 @@ export function raw(sql, params) {
         return Utils.getPrimaryKeyHash(sql);
     }
     if (typeof params === 'object' && !Array.isArray(params)) {
-        const pairs = Object.entries(params);
+        const dict = params;
         const objectParams = [];
-        for (const [key, value] of pairs) {
-            sql = sql.replace(`:${key}:`, '??');
-            sql = sql.replace(`:${key}`, '?');
-            objectParams.push(value);
-        }
+        // single left-to-right scan keeps values in SQL-placeholder order while `::` casts and unknown tokens stay untouched
+        sql = sql.replace(/(?<!:):([$\w]+)(:(?!:))?/g, (match, key, identifier) => {
+            if (!Object.hasOwn(dict, key)) {
+                return match;
+            }
+            objectParams.push(dict[key]);
+            return identifier ? '??' : '?';
+        });
         return new RawQueryFragment(sql, objectParams);
     }
     return new RawQueryFragment(sql, params);

package/utils/TransactionManager.js

@@ -239,7 +239,7 @@ export class TransactionManager {
         return TransactionContext.create(fork, () => fork.getConnection().transactional(async (trx) => {
             fork.setTransactionContext(trx);
             return this.executeTransactionFlow(fork, cb, propagateToUpperContext, em);
-        }, { ...options, eventBroadcaster }));
+        }, { sessionContext: fork.getTransactionSessionContext(), ...options, eventBroadcaster }));
     }
     /**
      * Executes transaction workflow with entity synchronization.

package/utils/Utils.d.ts

@@ -1,4 +1,4 @@
-import type { CompiledFunctions, Dictionary, EntityData, EntityDictionary, EntityKey, EntityMetadata, EntityName, EntityProperty, Primary } from '../typings.js';
+import type { CompiledFunctions, Dictionary, EntityCtor, EntityData, EntityDictionary, EntityKey, EntityMetadata, EntityName, EntityProperty, Primary } from '../typings.js';
 import type { Platform } from '../platforms/Platform.js';
 import { ScalarReference } from '../entity/Reference.js';
 import { Collection } from '../entity/Collection.js';
@@ -33,6 +33,8 @@ export declare function parseJsonSafe<T = unknown>(value: unknown): T;
 export declare class Utils {
     #private;
     static readonly PK_SEPARATOR = "~~~";
+    /** Default session variable name backing an RLS filter argument (`current_setting('mikro.<filter>.<arg>')`). */
+    static getRlsSettingName(filterName: string, argName: string): string;
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */
@@ -58,7 +60,7 @@ export declare class Utils {
     /**
      * Gets array without duplicates.
      */
-    static unique<T = string>(items: T[]): T[];
+    static unique<T = string>(items: T[], equals?: (a: T, b: T) => boolean): T[];
     /**
      * Merges all sources into the target recursively.
      */
@@ -129,6 +131,16 @@ export declare class Utils {
      * Gets string name of given class.
      */
     static className<T>(classOrName: string | EntityName<T>): string;
+    /**
+     * Normalizes an entity reference for identity-safe matching: keeps class references
+     * (minifiers can mangle two classes to the same name) and falls back to the class name otherwise.
+     */
+    static classOrName<T>(classOrName: string | EntityName<T>): EntityCtor<T> | string;
+    /**
+     * Checks whether the given entity reference points at the given metadata,
+     * comparing classes by identity and strings by class name.
+     */
+    static matchesEntity<T>(classOrName: string | EntityName<T>, meta: EntityMetadata<any>): boolean;
     static extractChildElements(items: readonly string[], prefix: string, allSymbol?: string): string[];
     /**
      * Tries to detect TypeScript support.

package/utils/Utils.js

@@ -153,7 +153,11 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.2.0-dev.8';
+    static #ORM_VERSION = '7.2.0';
+    /** Default session variable name backing an RLS filter argument (`current_setting('mikro.<filter>.<arg>')`). */
+    static getRlsSettingName(filterName, argName) {
+        return `mikro.${filterName}.${argName}`;
+    }
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */
@@ -216,10 +220,13 @@ export class Utils {
     /**
      * Gets array without duplicates.
      */
-    static unique(items) {
+    static unique(items, equals) {
         if (items.length < 2) {
             return items;
         }
+        if (equals) {
+            return items.filter((a, idx) => items.findIndex(b => equals(a, b)) === idx);
+        }
         return [...new Set(items)];
     }
     /**
@@ -562,6 +569,21 @@ export class Utils {
         }
         return classOrName.name;
     }
+    /**
+     * Normalizes an entity reference for identity-safe matching: keeps class references
+     * (minifiers can mangle two classes to the same name) and falls back to the class name otherwise.
+     */
+    static classOrName(classOrName) {
+        return typeof classOrName === 'function' ? classOrName : Utils.className(classOrName);
+    }
+    /**
+     * Checks whether the given entity reference points at the given metadata,
+     * comparing classes by identity and strings by class name.
+     */
+    static matchesEntity(classOrName, meta) {
+        const ref = Utils.classOrName(classOrName);
+        return typeof ref === 'function' ? ref === meta.class : ref === meta.className;
+    }
     static extractChildElements(items, prefix, allSymbol) {
         return items
             .filter(field => field === allSymbol || field.startsWith(`${prefix}.`))
@@ -584,7 +606,8 @@ export class Utils {
                 return (arg.includes('ts-node') || // check for ts-node loader
                     arg.includes('@swc-node/register') || // check for swc-node/register loader
                     arg.includes('node_modules/tsx/') || // check for tsx loader
-                    arg.includes('@oxc-node/core') // check for oxc-node loader
+                    arg.includes('@oxc-node/core') || // check for oxc-node loader
+                    arg.includes('@nubjs/loader') // check for Nub loader
                 );
             }));
     }
@@ -836,7 +859,11 @@ export class Utils {
             return await import(module);
         }
         catch (err) {
-            if (warning && err.code === 'ERR_MODULE_NOT_FOUND') {
+            // only a missing module is expected here, anything else is a real failure inside the module
+            if (!['ERR_MODULE_NOT_FOUND', 'MODULE_NOT_FOUND'].includes(err.code)) {
+                throw err;
+            }
+            if (warning) {
                 // eslint-disable-next-line no-console
                 console.warn(warning);
             }

package/utils/env-vars.js

@@ -88,6 +88,7 @@ export function loadEnvironmentVars() {
     read3('createForeignKeyConstraints', bool);
     read3('ignoreTriggers', bool);
     read3('ignoreRoutines', bool);
+    read3('ignorePolicies', bool);
     cleanup(ret, 'schemaGenerator');
     ret.seeder = {};
     const read4 = read.bind(null, ret.seeder, 'MIKRO_ORM_SEEDER_');

package/utils/index.d.ts

@@ -10,4 +10,5 @@ export * from './EntityComparator.js';
 export * from './RawQueryFragment.js';
 export * from './env-vars.js';
 export * from './upsert-utils.js';
+export * from './rls-utils.js';
 export * from './partition-utils.js';

package/utils/index.js

@@ -10,4 +10,5 @@ export * from './EntityComparator.js';
 export * from './RawQueryFragment.js';
 export * from './env-vars.js';
 export * from './upsert-utils.js';
+export * from './rls-utils.js';
 export * from './partition-utils.js';

package/utils/rls-utils.d.ts

@@ -0,0 +1,35 @@
+import type { MetadataStorage } from '../metadata/MetadataStorage.js';
+import type { Dictionary, FilterDef } from '../typings.js';
+/** An `rls`-flagged filter definition together with the entity it is declared on. @internal */
+export interface RlsFilterEntry {
+    filter: FilterDef;
+    entityName: string;
+}
+/**
+ * Collects all `rls`-flagged filter definitions with the given name (only entity-scoped filters can be `rls`).
+ * The full name -> defs lookup is built once and cached on the shared (immutable) MetadataStorage, so repeated
+ * `setFilterParams` calls and forks reuse it instead of walking every entity each time.
+ * @internal
+ */
+export declare function findRlsFilterDefs(metadata: MetadataStorage, name: string): RlsFilterEntry[];
+/**
+ * Drops the cached `rls` filter lookup — `MikroORM.discoverEntity()` mutates the shared MetadataStorage,
+ * so a lookup built before the call would miss the newly discovered filters.
+ *
+ * @internal
+ */
+export declare function clearRlsFilterDefsCache(metadata: MetadataStorage): void;
+/**
+ * Computes the `rls` session variables a set of same-named filter defs stages for the given args, mirroring the
+ * policy compilation (`current_setting` names and custom `setting` binding). Shared by staging and `fork({ session })`.
+ * @internal
+ */
+export declare function computeRlsFilterVariables(filters: RlsFilterEntry[], args: Dictionary): Dictionary<string | number | boolean | Date>;
+/**
+ * Computes which staged session variables a `setFilterParams` call may prune: the variables the OLD args staged for
+ * this filter that the new args no longer set, minus any variable another filter's current params still stage
+ * (a custom `setting` name can be shared by differently named filters). Recomputing from the old args rather than
+ * matching by prefix keeps a filter named `tenant` from also pruning a `tenant.x` filter's `mikro.tenant.x.*` variables.
+ * @internal
+ */
+export declare function computeRemovedRlsVariables(metadata: MetadataStorage, name: string, filters: RlsFilterEntry[], previousArgs: Dictionary, nextVariables: Dictionary, allFilterParams: Dictionary<Dictionary>): string[];

package/utils/rls-utils.js

@@ -0,0 +1,97 @@
+import { MetadataError, ValidationError } from '../errors.js';
+import { QueryHelper } from './QueryHelper.js';
+import { Utils } from './Utils.js';
+/** Lazily-built `rls` filter lookup keyed by the shared (immutable) MetadataStorage, so all forks reuse it. */
+const rlsFilterDefs = new WeakMap();
+/**
+ * Collects all `rls`-flagged filter definitions with the given name (only entity-scoped filters can be `rls`).
+ * The full name -> defs lookup is built once and cached on the shared (immutable) MetadataStorage, so repeated
+ * `setFilterParams` calls and forks reuse it instead of walking every entity each time.
+ * @internal
+ */
+export function findRlsFilterDefs(metadata, name) {
+    let cache = rlsFilterDefs.get(metadata);
+    if (!cache) {
+        cache = new Map();
+        for (const meta of metadata) {
+            for (const filterName of Object.keys(meta.filters)) {
+                const filter = meta.filters[filterName];
+                if (!filter.rls) {
+                    continue;
+                }
+                const defs = cache.get(filterName) ?? [];
+                // inheritance shares the same filter object across base and child metadata — keep a single entry
+                if (!defs.some(d => d.filter === filter)) {
+                    defs.push({ filter, entityName: meta.className });
+                }
+                cache.set(filterName, defs);
+            }
+        }
+        rlsFilterDefs.set(metadata, cache);
+    }
+    return cache.get(name) ?? [];
+}
+/**
+ * Drops the cached `rls` filter lookup — `MikroORM.discoverEntity()` mutates the shared MetadataStorage,
+ * so a lookup built before the call would miss the newly discovered filters.
+ *
+ * @internal
+ */
+export function clearRlsFilterDefsCache(metadata) {
+    rlsFilterDefs.delete(metadata);
+}
+/**
+ * Computes the `rls` session variables a set of same-named filter defs stages for the given args, mirroring the
+ * policy compilation (`current_setting` names and custom `setting` binding). Shared by staging and `fork({ session })`.
+ * @internal
+ */
+export function computeRlsFilterVariables(filters, args) {
+    const variables = {};
+    for (const { filter, entityName } of filters) {
+        const setting = typeof filter.rls === 'object' ? filter.rls.setting : undefined;
+        let settingArg;
+        if (setting) {
+            // mirror the policy compilation — a custom `setting` binds the single argument the condition accesses
+            const accessed = new Set();
+            QueryHelper.resolveRlsFilterCond(filter, accessed, entityName);
+            if (accessed.size > 1) {
+                throw MetadataError.rlsFilterMultiArgSetting(filter.name, [...accessed]);
+            }
+            settingArg = [...accessed][0];
+        }
+        for (const key of Object.keys(args)) {
+            const value = args[key];
+            // treat `undefined` like an omitted arg — staging it would serialize as the literal string 'undefined'
+            if (value === undefined) {
+                continue;
+            }
+            // a non-scalar arg has no equivalent in the compiled `= current_setting(...)` comparison — the app-level
+            // filter would apply `$in`/`is null` semantics while the policy compares against `String(value)`
+            if (value === null || (typeof value === 'object' && !(value instanceof Date))) {
+                throw ValidationError.cannotStageNonScalarSessionVariable(filter.name, key);
+            }
+            const settingName = key === settingArg ? setting : Utils.getRlsSettingName(filter.name, key);
+            variables[settingName] = value;
+        }
+    }
+    return variables;
+}
+/**
+ * Computes which staged session variables a `setFilterParams` call may prune: the variables the OLD args staged for
+ * this filter that the new args no longer set, minus any variable another filter's current params still stage
+ * (a custom `setting` name can be shared by differently named filters). Recomputing from the old args rather than
+ * matching by prefix keeps a filter named `tenant` from also pruning a `tenant.x` filter's `mikro.tenant.x.*` variables.
+ * @internal
+ */
+export function computeRemovedRlsVariables(metadata, name, filters, previousArgs, nextVariables, allFilterParams) {
+    const removed = Object.keys(computeRlsFilterVariables(filters, previousArgs)).filter(key => !(key in nextVariables));
+    const keptByOthers = new Set();
+    for (const otherName of removed.length > 0 ? Object.keys(allFilterParams) : []) {
+        if (otherName !== name) {
+            for (const key of Object.keys(computeRlsFilterVariables(findRlsFilterDefs(metadata, otherName), allFilterParams[otherName]))) {
+                keptByOthers.add(key);
+            }
+        }
+    }
+    return removed.filter(key => !keptByOthers.has(key));
+}

package/utils/upsert-utils.d.ts

@@ -1,8 +1,16 @@
-import type { EntityData, EntityMetadata, FilterQuery } from '../typings.js';
+import type { EntityData, EntityKey, EntityMetadata, FilterQuery } from '../typings.js';
 import type { UpsertOptions } from '../drivers/IDatabaseDriver.js';
 import { type Raw } from '../utils/RawQueryFragment.js';
 /** @internal */
 export declare function getOnConflictFields<T>(meta: EntityMetadata<T> | undefined, data: EntityData<T>, uniqueFields: (keyof T)[] | Raw, options: UpsertOptions<T>): (keyof T)[];
+/**
+ * Detects properties that will get their value generated by an `onCreate` hook during the upsert,
+ * i.e. those with an `onCreate` hook and no value provided. Such values are meant for the insert
+ * clause only and must not overwrite an existing row via the `on conflict do update set` clause.
+ * The property filter mirrors `EntityFactory.assignDefaultValues`.
+ * @internal
+ */
+export declare function getOnCreateGeneratedFields<T extends object>(meta: EntityMetadata<T>, data: T | EntityData<T>): EntityKey<T>[];
 /** @internal */
 export declare function getOnConflictReturningFields<T, P extends string>(meta: EntityMetadata<T> | undefined, data: EntityData<T>, uniqueFields: (keyof T)[] | Raw, options: UpsertOptions<T, P>): (keyof T)[] | '*';
 /** @internal */