@mikro-orm/core 7.2.7-dev.10 → 7.2.7-dev.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "7.2.7-dev.10",
+  "version": "7.2.7-dev.11",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",

package/utils/QueryHelper.js

@@ -3,7 +3,7 @@ import { DANGEROUS_PROPERTY_NAMES, Utils } from './Utils.js';
 import { ARRAY_OPERATORS, GroupOperator, JSON_KEY_OPERATORS, ReferenceKind } from '../enums.js';
 import { JsonType } from '../types/JsonType.js';
 import { helper } from '../entity/wrap.js';
-import { isRaw, Raw } from './RawQueryFragment.js';
+import { isRaw, isSubquery, Raw } from './RawQueryFragment.js';
 import { MetadataError, ValidationError } from '../errors.js';
 /** @internal */
 export class QueryHelper {
@@ -458,7 +458,8 @@ export class QueryHelper {
         if (Array.isArray(cond) && !(key && ARRAY_OPERATORS.includes(key))) {
             return cond.map(v => QueryHelper.processCustomType(prop, v, platform, key, fromQuery));
         }
-        if (isRaw(cond)) {
+        // a query builder renders as a sub-query, not as a value of the property type
+        if (isRaw(cond) || isSubquery(cond)) {
             return cond;
         }
         return prop.customType.convertToDatabaseValue(cond, platform, { fromQuery, key, mode: 'query' });

package/utils/RawQueryFragment.d.ts

@@ -1,11 +1,15 @@
-import type { AnyString, Dictionary, EntityKey } from '../typings.js';
+import type { AnyString, Dictionary, EntityKey, Subquery } from '../typings.js';
 declare const rawFragmentSymbolBrand: unique symbol;
 /** Branded symbol type used as a unique key for tracking raw SQL fragments in object properties. */
 export type RawQueryFragmentSymbol = symbol & {
     readonly [rawFragmentSymbolBrand]: true;
 };
+/** Prototype brand of query builders usable as sub-queries; a symbol so JSON payloads cannot carry it, `Symbol.for` so package copies agree. */
+export declare const SUBQUERY_BRAND: unique symbol;
 /** Checks whether the given value is a `RawQueryFragment` instance. */
 export declare function isRaw(value: unknown): value is RawQueryFragment;
+/** Checks whether the given value is a query builder usable as a sub-query (its prototype carries the `SUBQUERY_BRAND`). */
+export declare function isSubquery(value: unknown): value is Subquery;
 /** Represents a raw SQL fragment with optional parameters, usable as both a value and an object key via Symbol coercion. */
 export declare class RawQueryFragment<Alias extends string = string> {
     #private;

package/utils/RawQueryFragment.js

@@ -1,11 +1,6 @@
 import { Utils } from './Utils.js';
-// Brand lives on the prototype so JSON payloads — whose proto is
-// `Object.prototype` — cannot forge it. String key, not a `Symbol.for(...)`,
-// so each CJS/ESM copy of this module independently installs it on its own
-// prototype without publishing a global key for the marker that controls raw
-// SQL assembly. The string is namespaced so it does not collide with property
-// names users might independently install on their own prototypes.
-const RAW_FRAGMENT_BRAND = '__mikroOrmRawFragment';
+// Prototype brand of raw fragments; `Symbol.for` so package copies agree.
+const RAW_FRAGMENT_BRAND = Symbol.for('mikro-orm.raw-fragment');
 // Back-references from a fragment's symbol key to the fragment itself, shared
 // across CJS/ESM module copies via globalThis: when one copy creates a fragment
 // via `raw('…')` and stores its symbol in a where-clause object key, the other
@@ -13,6 +8,20 @@ const RAW_FRAGMENT_BRAND = '__mikroOrmRawFragment';
 const REGISTRY_KEY = Symbol.for('@mikro-orm/core/RawQueryFragment.references');
 const rawQueryReferences = (globalThis[REGISTRY_KEY] ??=
     new WeakMap());
+/** Prototype brand of query builders usable as sub-queries; a symbol so JSON payloads cannot carry it, `Symbol.for` so package copies agree. */
+export const SUBQUERY_BRAND = Symbol.for('mikro-orm.subquery');
+function hasPrototypeBrand(value, brand) {
+    // Walk the prototype chain starting from the *prototype* (not the value) so
+    // own-property spoofing from JSON payloads cannot forge the brand. Stop at
+    // `Object.prototype`, which is never branded — that bails plain objects,
+    // JSON payloads, and built-ins like `Date`/`Array`/`Map` at depth 1.
+    for (let p = Object.getPrototypeOf(value); p != null && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
+        if (Object.hasOwn(p, brand)) {
+            return true;
+        }
+    }
+    return false;
+}
 /** Checks whether the given value is a `RawQueryFragment` instance. */
 export function isRaw(value) {
     if (value == null || typeof value !== 'object') {
@@ -23,16 +32,11 @@ export function isRaw(value) {
     if (value instanceof RawQueryFragment) {
         return true;
     }
-    // Walk the prototype chain starting from the *prototype* (not the value) so
-    // own-property spoofing from JSON payloads cannot forge the brand. Stop at
-    // `Object.prototype`, which is never branded — that bails plain objects,
-    // JSON payloads, and built-ins like `Date`/`Array`/`Map` at depth 1.
-    for (let p = Object.getPrototypeOf(value); p != null && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
-        if (Object.hasOwn(p, RAW_FRAGMENT_BRAND)) {
-            return true;
-        }
-    }
-    return false;
+    return hasPrototypeBrand(value, RAW_FRAGMENT_BRAND);
+}
+/** Checks whether the given value is a query builder usable as a sub-query (its prototype carries the `SUBQUERY_BRAND`). */
+export function isSubquery(value) {
+    return value != null && typeof value === 'object' && hasPrototypeBrand(value, SUBQUERY_BRAND);
 }
 /** Represents a raw SQL fragment with optional parameters, usable as both a value and an object key via Symbol coercion. */
 export class RawQueryFragment {

package/utils/Utils.js

@@ -153,7 +153,7 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.2.7-dev.10';
+    static #ORM_VERSION = '7.2.7-dev.11';
     /** Default session variable name backing an RLS filter argument (`current_setting('mikro.<filter>.<arg>')`). */
     static getRlsSettingName(filterName, argName) {
         return `mikro.${filterName}.${argName}`;