@mikro-orm/core 7.2.7-dev.9 → 7.2.7

package/metadata/MetadataDiscovery.js

@@ -817,11 +817,14 @@ export class MetadataDiscovery {
         else {
             pivotMeta2.compositePK = true;
         }
+        // STI entities share one table, so any m:n within the hierarchy is self-referencing, named after the root
+        const stiRoot = meta.root.inheritanceType === 'sti' ? meta.root : undefined;
+        const baseMeta = stiRoot ?? meta;
         // handle self-referenced m:n with same default field names
-        if (meta.className === targetType &&
+        if ((meta.className === targetType || stiRoot === targetMeta.root) &&
             prop.joinColumns.every((joinColumn, idx) => joinColumn === prop.inverseJoinColumns[idx])) {
             // use tableName only when explicitly provided by user, otherwise use className for backwards compatibility
-            const baseName = this.isExplicitTableName(meta) ? meta.tableName : meta.className;
+            const baseName = this.isExplicitTableName(baseMeta) ? baseMeta.tableName : baseMeta.className;
             prop.joinColumns = prop.referencedColumnNames.map(name => this.#namingStrategy.joinKeyColumnName(baseName + '_1', name, meta.compositePK));
             prop.inverseJoinColumns = prop.referencedColumnNames.map(name => this.#namingStrategy.joinKeyColumnName(baseName + '_2', name, meta.compositePK));
             if (prop.inversedBy) {
@@ -829,13 +832,18 @@ export class MetadataDiscovery {
                 prop2.inverseJoinColumns = prop.joinColumns;
                 prop2.joinColumns = prop.inverseJoinColumns;
             }
-            // propagate updated joinColumns to all child entities that inherit this property (STI)
-            for (const childMeta of this.#discovered.filter(m => m.root === meta && m !== meta)) {
+            // propagate updated joinColumns to all entities of the hierarchy that inherit this property or its inverse (STI)
+            for (const childMeta of this.#discovered.filter(m => m.root === baseMeta)) {
                 const childProp = childMeta.properties[prop.name];
                 if (childProp) {
                     childProp.joinColumns = prop.joinColumns;
                     childProp.inverseJoinColumns = prop.inverseJoinColumns;
                 }
+                const childProp2 = prop.inversedBy ? childMeta.properties[prop.inversedBy] : undefined;
+                if (childProp2) {
+                    childProp2.inverseJoinColumns = prop.joinColumns;
+                    childProp2.joinColumns = prop.inverseJoinColumns;
+                }
             }
         }
         // Union-target polymorphic M:N: discriminator + target FK share the pivot across multiple target types

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "7.2.7-dev.9",
+  "version": "7.2.7",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",

package/serialization/EntitySerializer.js

@@ -4,20 +4,50 @@ import { ReferenceKind } from '../enums.js';
 import { Reference } from '../entity/Reference.js';
 import { SerializationContext } from './SerializationContext.js';
 import { isRaw } from '../utils/RawQueryFragment.js';
-/** Returns true when any entry in `items` is `propName`, the wildcard `*`, or a dot-path under `propName`. */
-function matchesPath(items, propName) {
-    return items.some(item => item === propName || item === '*' || item.startsWith(propName + '.'));
+// Keyed by option objects created for a single `serialize()` call, so caller-owned options are never cached.
+const preparedOptions = new WeakMap();
+function createPathLookup(items) {
+    const heads = new Set();
+    let all = false;
+    for (const item of items) {
+        const dot = item.indexOf('.');
+        heads.add(dot === -1 ? item : item.substring(0, dot));
+        all ||= item === '*';
+    }
+    return { all, heads };
+}
+/**
+ * Copies caller options once per `serialize()` call, so the derived child options and path lookups can be cached
+ * for every entity of the call without ever caching an options object the caller might mutate later.
+ */
+function prepareOptions(options) {
+    if (preparedOptions.has(options)) {
+        return options;
+    }
+    const prepared = {
+        ...options,
+        populate: options.populate ? Utils.asArray(options.populate) : options.populate,
+    };
+    preparedOptions.set(prepared, { children: new Map() });
+    return prepared;
+}
+function pathLookup(options, key) {
+    return (preparedOptions.get(options)[key] ??= createPathLookup(options[key]));
+}
+/** Returns true when any entry in `options[key]` is `propName`, the wildcard `*`, or a dot-path under `propName`. */
+function matchesPath(options, key, propName) {
+    const lookup = pathLookup(options, key);
+    return lookup.all || lookup.heads.has(propName);
 }
 function isVisible(meta, propName, options) {
     const prop = meta.properties[propName];
     if (options.groups && prop?.groups) {
         return prop.groups.some(g => options.groups.includes(g));
     }
-    if (Array.isArray(options.fields) && options.fields.length > 0 && !matchesPath(options.fields, propName)) {
+    if (Array.isArray(options.fields) && options.fields.length > 0 && !matchesPath(options, 'fields', propName)) {
         return false;
     }
-    if (Array.isArray(options.populate) &&
-        options.populate.find(item => item === propName || item.startsWith(propName + '.'))) {
+    if (Array.isArray(options.populate) && pathLookup(options, 'populate').heads.has(propName)) {
         return true;
     }
     if (options.exclude?.find(item => item === propName)) {
@@ -30,7 +60,7 @@ function isVisible(meta, propName, options) {
 function isPopulated(propName, options) {
     if (typeof options.populate !== 'boolean' &&
         Array.isArray(options.populate) &&
-        matchesPath(options.populate, propName)) {
+        matchesPath(options, 'populate', propName)) {
         return true;
     }
     if (typeof options.populate === 'boolean') {
@@ -45,10 +75,10 @@ export class EntitySerializer {
         const wrapped = helper(entity);
         const meta = wrapped.__meta;
         let contextCreated = false;
+        options = prepareOptions(options);
         if (!wrapped.__serializationContext.root) {
             const root = new SerializationContext();
             SerializationContext.propagate(root, entity, (meta, prop) => meta.properties[prop]?.kind !== ReferenceKind.SCALAR);
-            options.populate = (options.populate ? Utils.asArray(options.populate) : options.populate);
             contextCreated = true;
         }
         const root = wrapped.__serializationContext.root;
@@ -145,7 +175,8 @@ export class EntitySerializer {
         if (entity[prop] instanceof Function) {
             const returnValue = entity[prop]();
             if (!options.ignoreSerializers && serializer) {
-                return serializer(returnValue, this.extractChildOptions(options, prop));
+                // copy, so a serializer mutating its options cannot leak into the cached child options
+                return serializer(returnValue, { ...this.extractChildOptions(options, prop) });
             }
             return returnValue;
         }
@@ -186,7 +217,12 @@ export class EntitySerializer {
         return prop.customType.toJSON(value, platform);
     }
     static extractChildOptions(options, prop) {
-        return {
+        const prepared = preparedOptions.get(options);
+        const cached = prepared.children.get(prop);
+        if (cached) {
+            return cached;
+        }
+        const child = {
             ...options,
             populate: Array.isArray(options.populate)
                 ? Utils.extractChildElements(options.populate, prop, '*')
@@ -194,6 +230,9 @@ export class EntitySerializer {
             exclude: Array.isArray(options.exclude) ? Utils.extractChildElements(options.exclude, prop) : options.exclude,
             fields: Array.isArray(options.fields) ? this.extractChildFields(options.fields, prop) : options.fields,
         };
+        prepared.children.set(prop, child);
+        preparedOptions.set(child, { children: new Map() });
+        return child;
     }
     /**
      * Extracts the nested `fields` whitelist for a child property. A bare parent name (`fields: ['books']`) or a
@@ -269,8 +308,9 @@ export class EntitySerializer {
  * ```
  */
 export function serialize(entities, options) {
+    const prepared = prepareOptions(options ?? {});
     if (Array.isArray(entities)) {
-        return entities.map(e => EntitySerializer.serialize(e, options));
+        return entities.map(e => EntitySerializer.serialize(e, prepared));
     }
-    return EntitySerializer.serialize(entities, options);
+    return EntitySerializer.serialize(entities, prepared);
 }

package/typings.d.ts

@@ -1625,7 +1625,8 @@ export type UnboxArray<T> = T extends any[] ? ArrayElement<T> : T;
 /** Extracts the element type from an array type. */
 export type ArrayElement<ArrayType extends unknown[]> = ArrayType extends (infer ElementType)[] ? ElementType : never;
 /** Unwraps a property type from its wrapper (Reference, Collection, or array) to the inner entity type. */
-export type ExpandProperty<T> = T extends LazyRef.Brand<infer U> ? unknown extends U ? NotLazyRef<U, NonNullable<T>> : NonNullable<U> : T extends ReferenceShape<infer U> ? NonNullable<U> : T extends CollectionShape<infer U> ? NonNullable<U> : T extends (infer U)[] ? NonNullable<U> : NonNullable<T>;
+export type ExpandProperty<T> = ExpandPropertyOf<T, T>;
+type ExpandPropertyOf<T, R> = T extends LazyRef.Brand<infer U> ? unknown extends U ? NotLazyRef<U, NonNullable<R>> : NonNullable<U> : T extends ReferenceShape<infer U> ? NonNullable<U> : T extends CollectionShape<infer U> ? NonNullable<U> : T extends (infer U)[] ? NonNullable<U> : NonNullable<T>;
 type LoadedLoadable<T, E extends object> = T extends CollectionShape ? LoadedCollection<E> : T extends ScalarReference<infer U> ? LoadedScalarReference<U> : T extends LazyRef.Brand<any> ? E : T extends ReferenceShape ? T & LoadedReference<E> : T extends Scalar ? T : T extends (infer U)[] ? U extends Scalar ? T : E[] : E;
 type IsTrue<T> = IsNever<T> extends true ? false : T extends boolean ? (T extends true ? true : false) : false;
 type StringLiteral<T> = T extends string ? (string extends T ? never : T) : never;

package/utils/QueryHelper.js

@@ -3,7 +3,7 @@ import { DANGEROUS_PROPERTY_NAMES, Utils } from './Utils.js';
 import { ARRAY_OPERATORS, GroupOperator, JSON_KEY_OPERATORS, ReferenceKind } from '../enums.js';
 import { JsonType } from '../types/JsonType.js';
 import { helper } from '../entity/wrap.js';
-import { isRaw, Raw } from './RawQueryFragment.js';
+import { isRaw, isSubquery, Raw } from './RawQueryFragment.js';
 import { MetadataError, ValidationError } from '../errors.js';
 /** @internal */
 export class QueryHelper {
@@ -458,7 +458,8 @@ export class QueryHelper {
         if (Array.isArray(cond) && !(key && ARRAY_OPERATORS.includes(key))) {
             return cond.map(v => QueryHelper.processCustomType(prop, v, platform, key, fromQuery));
         }
-        if (isRaw(cond)) {
+        // a query builder renders as a sub-query, not as a value of the property type
+        if (isRaw(cond) || isSubquery(cond)) {
             return cond;
         }
         return prop.customType.convertToDatabaseValue(cond, platform, { fromQuery, key, mode: 'query' });

package/utils/RawQueryFragment.d.ts

@@ -1,11 +1,15 @@
-import type { AnyString, Dictionary, EntityKey } from '../typings.js';
+import type { AnyString, Dictionary, EntityKey, Subquery } from '../typings.js';
 declare const rawFragmentSymbolBrand: unique symbol;
 /** Branded symbol type used as a unique key for tracking raw SQL fragments in object properties. */
 export type RawQueryFragmentSymbol = symbol & {
     readonly [rawFragmentSymbolBrand]: true;
 };
+/** Prototype brand of query builders usable as sub-queries; a symbol so JSON payloads cannot carry it, `Symbol.for` so package copies agree. */
+export declare const SUBQUERY_BRAND: unique symbol;
 /** Checks whether the given value is a `RawQueryFragment` instance. */
 export declare function isRaw(value: unknown): value is RawQueryFragment;
+/** Checks whether the given value is a query builder usable as a sub-query (its prototype carries the `SUBQUERY_BRAND`). */
+export declare function isSubquery(value: unknown): value is Subquery;
 /** Represents a raw SQL fragment with optional parameters, usable as both a value and an object key via Symbol coercion. */
 export declare class RawQueryFragment<Alias extends string = string> {
     #private;

package/utils/RawQueryFragment.js

@@ -1,11 +1,6 @@
 import { Utils } from './Utils.js';
-// Brand lives on the prototype so JSON payloads — whose proto is
-// `Object.prototype` — cannot forge it. String key, not a `Symbol.for(...)`,
-// so each CJS/ESM copy of this module independently installs it on its own
-// prototype without publishing a global key for the marker that controls raw
-// SQL assembly. The string is namespaced so it does not collide with property
-// names users might independently install on their own prototypes.
-const RAW_FRAGMENT_BRAND = '__mikroOrmRawFragment';
+// Prototype brand of raw fragments; `Symbol.for` so package copies agree.
+const RAW_FRAGMENT_BRAND = Symbol.for('mikro-orm.raw-fragment');
 // Back-references from a fragment's symbol key to the fragment itself, shared
 // across CJS/ESM module copies via globalThis: when one copy creates a fragment
 // via `raw('…')` and stores its symbol in a where-clause object key, the other
@@ -13,6 +8,20 @@ const RAW_FRAGMENT_BRAND = '__mikroOrmRawFragment';
 const REGISTRY_KEY = Symbol.for('@mikro-orm/core/RawQueryFragment.references');
 const rawQueryReferences = (globalThis[REGISTRY_KEY] ??=
     new WeakMap());
+/** Prototype brand of query builders usable as sub-queries; a symbol so JSON payloads cannot carry it, `Symbol.for` so package copies agree. */
+export const SUBQUERY_BRAND = Symbol.for('mikro-orm.subquery');
+function hasPrototypeBrand(value, brand) {
+    // Walk the prototype chain starting from the *prototype* (not the value) so
+    // own-property spoofing from JSON payloads cannot forge the brand. Stop at
+    // `Object.prototype`, which is never branded — that bails plain objects,
+    // JSON payloads, and built-ins like `Date`/`Array`/`Map` at depth 1.
+    for (let p = Object.getPrototypeOf(value); p != null && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
+        if (Object.hasOwn(p, brand)) {
+            return true;
+        }
+    }
+    return false;
+}
 /** Checks whether the given value is a `RawQueryFragment` instance. */
 export function isRaw(value) {
     if (value == null || typeof value !== 'object') {
@@ -23,16 +32,11 @@ export function isRaw(value) {
     if (value instanceof RawQueryFragment) {
         return true;
     }
-    // Walk the prototype chain starting from the *prototype* (not the value) so
-    // own-property spoofing from JSON payloads cannot forge the brand. Stop at
-    // `Object.prototype`, which is never branded — that bails plain objects,
-    // JSON payloads, and built-ins like `Date`/`Array`/`Map` at depth 1.
-    for (let p = Object.getPrototypeOf(value); p != null && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
-        if (Object.hasOwn(p, RAW_FRAGMENT_BRAND)) {
-            return true;
-        }
-    }
-    return false;
+    return hasPrototypeBrand(value, RAW_FRAGMENT_BRAND);
+}
+/** Checks whether the given value is a query builder usable as a sub-query (its prototype carries the `SUBQUERY_BRAND`). */
+export function isSubquery(value) {
+    return value != null && typeof value === 'object' && hasPrototypeBrand(value, SUBQUERY_BRAND);
 }
 /** Represents a raw SQL fragment with optional parameters, usable as both a value and an object key via Symbol coercion. */
 export class RawQueryFragment {
@@ -121,6 +125,10 @@ export { RawQueryFragment as Raw };
 export const ALIAS_REPLACEMENT = '[::alias::]';
 /** @internal */
 export const ALIAS_REPLACEMENT_RE = '\\[::alias::\\]';
+// a query builder param is embedded as a sub-query instead of being bound as a value
+function toRawParam(param) {
+    return isSubquery(param) ? param.toRaw() : param;
+}
 /**
  * Creates raw SQL query fragment that can be assigned to a property or part of a filter. This fragment is represented
  * by `RawQueryFragment` class instance that can be serialized to a string, so it can be used both as an object value
@@ -204,12 +212,12 @@ export function raw(sql, params) {
             if (!Object.hasOwn(dict, key)) {
                 return match;
             }
-            objectParams.push(dict[key]);
+            objectParams.push(toRawParam(dict[key]));
             return identifier ? '??' : '?';
         });
         return new RawQueryFragment(sql, objectParams);
     }
-    return new RawQueryFragment(sql, params);
+    return new RawQueryFragment(sql, params?.map(toRawParam));
 }
 /**
  * Alternative to the `raw()` helper allowing to use it as a tagged template function for the simple cases.

package/utils/Utils.js

@@ -153,7 +153,7 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.2.7-dev.9';
+    static #ORM_VERSION = '7.2.7';
     /** Default session variable name backing an RLS filter argument (`current_setting('mikro.<filter>.<arg>')`). */
     static getRlsSettingName(filterName, argName) {
         return `mikro.${filterName}.${argName}`;
@@ -244,7 +244,7 @@ export class Utils {
     /**
      * Merges all sources into the target recursively.
      */
-    static _merge(target, sources, ignoreUndefined) {
+    static _merge(target, sources, ignoreUndefined, copies) {
         if (!sources.length) {
             return target;
         }
@@ -259,7 +259,13 @@ export class Utils {
                 }
                 if (Utils.isPlainObject(value)) {
                     if (!Utils.isObject(target[key])) {
-                        target[key] = Utils.copy(value);
+                        // copy plain objects but keep class instances by reference, tracking copies so cycles terminate
+                        const seen = copies ?? new WeakMap();
+                        if (!seen.has(value)) {
+                            seen.set(value, {});
+                            Utils._merge(seen.get(value), [value], ignoreUndefined, seen);
+                        }
+                        target[key] = seen.get(value);
                         continue;
                     }
                     /* v8 ignore next */