@mikro-orm/sql 7.2.0-dev.2 → 7.2.0-dev.20

package/AbstractSqlConnection.d.ts

@@ -1,5 +1,5 @@
 import { type ControlledTransaction, type Dialect, Kysely } from 'kysely';
-import { type AnyEntity, Connection, type Dictionary, type EntityData, type IsolationLevel, type LogContext, type LoggingOptions, type MaybePromise, type QueryResult, type RawQueryFragment, type Transaction, type TransactionEventBroadcaster } from '@mikro-orm/core';
+import { type AnyEntity, Connection, type Dictionary, type EntityData, type IsolationLevel, type LogContext, type LoggingOptions, type MaybePromise, type QueryResult, type RawQueryFragment, type SessionContext, type Transaction, type TransactionEventBroadcaster } from '@mikro-orm/core';
 import type { AbstractSqlPlatform } from './AbstractSqlPlatform.js';
 import { NativeQueryBuilder } from './query/NativeQueryBuilder.js';
 /** Base class for SQL database connections, built on top of Kysely. */
@@ -36,6 +36,13 @@ export declare abstract class AbstractSqlConnection extends Connection {
     getClient<T = any>(): Kysely<T>;
     /** Ensures the Kysely client is initialized, creating it asynchronously if needed. */
     initClient(): Promise<void>;
+    /**
+     * Guards `getNativeClient()` overrides — drivers only capture their client while building their
+     * own dialect, which `driverOptions` carrying a ready-made Kysely instance or dialect skips.
+     *
+     * @internal
+     */
+    protected requireNativeClient<T>(client: T | undefined | null): T;
     /** Executes a callback within a transaction, committing on success and rolling back on error. */
     transactional<T>(cb: (trx: Transaction<ControlledTransaction<any, any>>) => Promise<T>, options?: {
         isolationLevel?: IsolationLevel;
@@ -43,6 +50,7 @@ export declare abstract class AbstractSqlConnection extends Connection {
         ctx?: ControlledTransaction<any>;
         eventBroadcaster?: TransactionEventBroadcaster;
         loggerContext?: LogContext;
+        sessionContext?: SessionContext;
     }): Promise<T>;
     /** Begins a new transaction or creates a savepoint if a transaction context already exists. */
     begin(options?: {
@@ -51,16 +59,35 @@ export declare abstract class AbstractSqlConnection extends Connection {
         ctx?: ControlledTransaction<any, any>;
         eventBroadcaster?: TransactionEventBroadcaster;
         loggerContext?: LogContext;
+        sessionContext?: SessionContext;
     }): Promise<ControlledTransaction<any, any>>;
+    /** Applies session variables (`set_config`) and role (`set local role`) for the current transaction. */
+    private applySessionContext;
+    /**
+     * Quotes a role name as a single PostgreSQL identifier. Unlike `platform.quoteIdentifier`, which treats a dot as a
+     * schema qualifier, a role like `my.role` must be quoted whole (`"my.role"`) with embedded quotes doubled.
+     */
+    protected static quoteRole(role: string): string;
+    /** Serializes a session variable for `set_config()`; `Date` values use ISO 8601 so casts like `::timestamptz` parse. */
+    protected stringifySessionVariable(value: unknown): string;
     /** Commits the transaction or releases the savepoint. */
     commit(ctx: ControlledTransaction<any, any>, eventBroadcaster?: TransactionEventBroadcaster, loggerContext?: LogContext): Promise<void>;
     /** Rolls back the transaction or rolls back to the savepoint. */
     rollback(ctx: ControlledTransaction<any, any>, eventBroadcaster?: TransactionEventBroadcaster, loggerContext?: LogContext): Promise<void>;
+    /**
+     * Waits until the transaction's connection has no query in flight. Kysely runs `rollback` straight
+     * on that connection instead of going through its connection provider, so a rollback caused by an
+     * aborted query would otherwise be sent while the aborted query is still running. That not only
+     * queues the rollback behind it on the server, it also overwrites the query id Kysely compares
+     * against before firing the `'cancel query'`/`'kill session'` control statement — the control
+     * statement is then discarded as stale and the abort never reaches the database.
+     */
+    private waitForIdleTransaction;
     private prepareQuery;
     /** Executes a SQL query and returns the result based on the method: `'all'` for rows, `'get'` for single row, `'run'` for affected count. */
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[], method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[] | Dictionary<unknown>, method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
     /** Executes a SQL query and returns an async iterable that yields results row by row. */
-    stream<T extends EntityData<AnyEntity>>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[], ctx?: Transaction<Kysely<any>>, loggerContext?: LoggingOptions, chunkSize?: number): AsyncIterableIterator<T>;
+    stream<T extends EntityData<AnyEntity>>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[] | Dictionary<unknown>, ctx?: Transaction<Kysely<any>>, loggerContext?: LoggingOptions, chunkSize?: number): AsyncIterableIterator<T>;
     /** @inheritDoc */
     executeDump(dump: string): Promise<void>;
     protected getSql(query: string, formatted: string, context?: LogContext): string;

package/AbstractSqlConnection.js

@@ -1,5 +1,5 @@
 import { CompiledQuery, Kysely } from 'kysely';
-import { Connection, EventType, isRaw, Utils, } from '@mikro-orm/core';
+import { Connection, EventType, isRaw, raw, Utils, } from '@mikro-orm/core';
 import { NativeQueryBuilder } from './query/NativeQueryBuilder.js';
 /**
  * Pulls cancellation controls out of a `loggerContext` payload, returning the abort options
@@ -101,6 +101,18 @@ export class AbstractSqlConnection extends Connection {
             await this.createKysely();
         }
     }
+    /**
+     * Guards `getNativeClient()` overrides — drivers only capture their client while building their
+     * own dialect, which `driverOptions` carrying a ready-made Kysely instance or dialect skips.
+     *
+     * @internal
+     */
+    requireNativeClient(client) {
+        if (client == null) {
+            throw new Error('The native client is not available, as it is owned by the Kysely instance or dialect passed via `driverOptions`. Access it through the object you provided there instead.');
+        }
+        return client;
+    }
     /** Executes a callback within a transaction, committing on success and rolling back on error. */
     async transactional(cb, options = {}) {
         const trx = await this.begin(options);
@@ -110,7 +122,15 @@ export class AbstractSqlConnection extends Connection {
             return ret;
         }
         catch (error) {
-            await this.rollback(trx, options.eventBroadcaster, options.loggerContext);
+            // A failing rollback must not mask why the transaction failed in the first place — the
+            // `'kill session'` abort strategy tears the connection down, so the rollback that follows can
+            // only ever report the dead connection.
+            try {
+                await this.rollback(trx, options.eventBroadcaster, options.loggerContext);
+            }
+            catch (rollbackError) {
+                this.logger.warn('query', `Failed to roll back transaction: ${rollbackError.message}`);
+            }
             throw error;
         }
     }
@@ -138,22 +158,46 @@ export class AbstractSqlConnection extends Connection {
             trxBuilder = trxBuilder.setAccessMode('read only');
         }
         const trx = await trxBuilder.execute();
-        if (options.ctx) {
-            const ctx = options.ctx;
-            ctx.index ??= 0;
-            const savepointName = `trx${ctx.index + 1}`;
-            Reflect.defineProperty(trx, 'index', { value: ctx.index + 1 });
-            Reflect.defineProperty(trx, 'savepointName', { value: savepointName });
-            this.logQuery(this.platform.getSavepointSQL(savepointName), options.loggerContext);
+        for (const query of this.platform.getBeginTransactionSQL(options)) {
+            this.logQuery(query, options.loggerContext);
         }
-        else {
-            for (const query of this.platform.getBeginTransactionSQL(options)) {
-                this.logQuery(query, options.loggerContext);
+        if (options.sessionContext) {
+            try {
+                await this.applySessionContext(trx, options.sessionContext, options.loggerContext);
+            }
+            catch (e) {
+                // roll back the freshly opened transaction so the pooled connection is released, not leaked
+                await trx.rollback().execute();
+                this.logQuery(this.platform.getRollbackTransactionSQL(), options.loggerContext);
+                throw e;
             }
         }
         await options.eventBroadcaster?.dispatchEvent(EventType.afterTransactionStart, trx);
         return trx;
     }
+    /** Applies session variables (`set_config`) and role (`set local role`) for the current transaction. */
+    async applySessionContext(trx, sessionContext, loggerContext) {
+        const variables = Object.entries(sessionContext.variables ?? {});
+        if (variables.length > 0) {
+            const parts = variables.map(() => 'set_config(?, ?, true)').join(', ');
+            const params = variables.flatMap(([key, value]) => [key, this.stringifySessionVariable(value)]);
+            await this.execute(`select ${parts}`, params, 'run', trx, loggerContext);
+        }
+        if (sessionContext.role) {
+            await this.execute(`set local role ${AbstractSqlConnection.quoteRole(sessionContext.role)}`, [], 'run', trx, loggerContext);
+        }
+    }
+    /**
+     * Quotes a role name as a single PostgreSQL identifier. Unlike `platform.quoteIdentifier`, which treats a dot as a
+     * schema qualifier, a role like `my.role` must be quoted whole (`"my.role"`) with embedded quotes doubled.
+     */
+    static quoteRole(role) {
+        return `"${role.replaceAll('"', '""')}"`;
+    }
+    /** Serializes a session variable for `set_config()`; `Date` values use ISO 8601 so casts like `::timestamptz` parse. */
+    stringifySessionVariable(value) {
+        return value instanceof Date ? value.toISOString() : String(value);
+    }
     /** Commits the transaction or releases the savepoint. */
     async commit(ctx, eventBroadcaster, loggerContext) {
         if (ctx.isRolledBack) {
@@ -173,6 +217,7 @@ export class AbstractSqlConnection extends Connection {
     /** Rolls back the transaction or rolls back to the savepoint. */
     async rollback(ctx, eventBroadcaster, loggerContext) {
         await eventBroadcaster?.dispatchEvent(EventType.beforeTransactionRollback, ctx);
+        await this.waitForIdleTransaction(ctx);
         if ('savepointName' in ctx) {
             await ctx.rollbackToSavepoint(ctx.savepointName).execute();
             this.logQuery(this.platform.getRollbackToSavepointSQL(ctx.savepointName), loggerContext);
@@ -183,17 +228,32 @@ export class AbstractSqlConnection extends Connection {
         }
         await eventBroadcaster?.dispatchEvent(EventType.afterTransactionRollback, ctx);
     }
+    /**
+     * Waits until the transaction's connection has no query in flight. Kysely runs `rollback` straight
+     * on that connection instead of going through its connection provider, so a rollback caused by an
+     * aborted query would otherwise be sent while the aborted query is still running. That not only
+     * queues the rollback behind it on the server, it also overwrites the query id Kysely compares
+     * against before firing the `'cancel query'`/`'kill session'` control statement — the control
+     * statement is then discarded as stale and the abort never reaches the database.
+     */
+    async waitForIdleTransaction(ctx) {
+        await ctx.getExecutor().provideConnection(async () => undefined);
+    }
     prepareQuery(query, params = []) {
         if (query instanceof NativeQueryBuilder) {
             query = query.toRaw();
         }
+        if (typeof query === 'string' && !Array.isArray(params)) {
+            // plain object params hold named parameters, translate them via the `raw()` helper
+            query = raw(query, params);
+        }
         if (isRaw(query)) {
             params = query.params;
             query = query.sql;
         }
         query = this.config.get('onQuery')(query, params);
         const formatted = this.platform.formatQuery(query, params);
-        return { query, params, formatted };
+        return { query, params: params, formatted };
     }
     /** Executes a SQL query and returns the result based on the method: `'all'` for rows, `'get'` for single row, `'run'` for affected count. */
     async execute(query, params = [], method = 'all', ctx, loggerContext) {
@@ -227,7 +287,7 @@ export class AbstractSqlConnection extends Connection {
                 .stream(compiled, chunkSize ?? 100, abort ? { signal: abort.signal } : undefined);
             this.logQuery(sql, {
                 sql,
-                params,
+                params: q.params,
                 ...cleanCtx,
                 affected: Utils.isPlainObject(res) ? res.affectedRows : undefined,
             });
@@ -238,7 +298,7 @@ export class AbstractSqlConnection extends Connection {
             }
         }
         catch (e) {
-            this.logQuery(sql, { sql, params, ...cleanCtx, level: 'error' });
+            this.logQuery(sql, { sql, params: q.params, ...cleanCtx, level: 'error' });
             throw e;
         }
     }

package/AbstractSqlDriver.d.ts

@@ -100,7 +100,7 @@ export declare abstract class AbstractSqlDriver<Connection extends AbstractSqlCo
      */
     private convertOwnerPksForPivotQuery;
     private getPivotOrderBy;
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[], method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[] | Dictionary, method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
     stream<T extends object>(entityName: EntityName<T>, where: FilterQuery<T>, options: StreamOptions<T, any, any, any>): AsyncIterableIterator<T>;
     /**
      * 1:1 owner side needs to be marked for population so QB auto-joins the owner id
@@ -118,13 +118,6 @@ export declare abstract class AbstractSqlDriver<Connection extends AbstractSqlCo
     mergeJoinedResult<T extends object>(rawResults: EntityData<T>[], meta: EntityMetadata<T>, joinedProps: PopulateOptions<T>[]): EntityData<T>[];
     protected shouldHaveColumn<T, U>(meta: EntityMetadata<T>, prop: EntityProperty<U>, populate: readonly PopulateOptions<U>[], fields?: readonly InternalField<U>[], exclude?: readonly InternalField<U>[]): boolean;
     protected getFieldsForJoinedLoad<T extends object>(qb: AnyQueryBuilder<T>, meta: EntityMetadata<T>, options: FieldsForJoinedLoadOptions<T>): InternalField<T>[];
-    /**
-     * Walks the TPT inheritance chain of `leafMeta` and INNER JOINs each parent table.
-     * Registers the parent aliases in `qb.state.tptAlias` so column resolution finds them
-     * when filter conditions reference parent-table columns.
-     * @internal
-     */
-    protected addTPTParentJoinsForRelation<T extends object>(qb: AnyQueryBuilder<T>, leafMeta: EntityMetadata, leafAlias: string, basePath: string): void;
     /**
      * Adds LEFT JOINs and fields for TPT polymorphic loading when populating a relation to a TPT base class.
      * @internal

package/AbstractSqlDriver.js

@@ -183,7 +183,9 @@ export class AbstractSqlDriver extends DatabaseDriver {
         if (typeof meta.expression === 'string') {
             return this.wrapVirtualExpressionInSubquery(meta, meta.expression, where, options, type);
         }
-        const em = this.createEntityManager();
+        // fork the caller EM so the callback inherits its filters, filter params and session context — a fork never
+        // resolves back to the ambient RequestContext EM, which would ignore the transaction/session context set below
+        const em = (options.em?.fork() ?? this.createEntityManager(false));
         em.setTransactionContext(options.ctx);
         const res = meta.expression(em, where, options);
         if (typeof res === 'string') {
@@ -209,7 +211,8 @@ export class AbstractSqlDriver extends DatabaseDriver {
             yield* this.wrapVirtualExpressionInSubqueryStream(meta, meta.expression, where, options, QueryType.SELECT);
             return;
         }
-        const em = this.createEntityManager();
+        // fork the caller EM for the same reason as in `findFromVirtual`
+        const em = (options.em?.fork() ?? this.createEntityManager(false));
         em.setTransactionContext(options.ctx);
         const res = meta.expression(em, where, options, true);
         if (typeof res === 'string') {
@@ -239,7 +242,17 @@ export class AbstractSqlDriver extends DatabaseDriver {
         const asKeyword = this.platform.usesAsKeyword() ? ' as ' : ' ';
         native.from(raw(`(${expression})${asKeyword}${this.platform.quoteIdentifier(qb.alias)}`));
         const query = native.compile();
-        const res = await this.execute(query.sql, query.params, 'all', options.ctx, withAbortContext(options.loggerContext, options));
+        const loggerContext = withAbortContext(options.loggerContext, options);
+        // virtual entities execute directly (not via QueryBuilder), so wrap in a short implicit transaction outside an
+        // existing one when a session context (row level security) needs to apply — mirrors the QueryBuilder wrap
+        const sessionContext = options.ctx ? undefined : options.em?.getTransactionSessionContext();
+        const conn = this.getConnection(this.resolveConnectionType(options));
+        const res = await (sessionContext
+            ? conn.transactional(trx => this.execute(query.sql, query.params, 'all', trx, loggerContext), {
+                sessionContext,
+                loggerContext,
+            })
+            : this.execute(query.sql, query.params, 'all', options.ctx, loggerContext));
         if (type === QueryType.COUNT) {
             return res[0].count;
         }
@@ -604,7 +617,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
         let pk;
         if (meta.primaryKeys.length > 1) {
             // owner has composite pk
-            pk = Utils.getPrimaryKeyCond(data, meta.primaryKeys);
+            pk = Utils.getOrderedPrimaryKeys(data, meta);
         }
         else {
             /* v8 ignore next */
@@ -887,10 +900,9 @@ export class AbstractSqlDriver extends DatabaseDriver {
         }
         const res = await this.execute(sql, params, 'run', options.ctx, withAbortContext(options.loggerContext, options));
         let pk;
-        /* v8 ignore next */
         if (pks.length > 1) {
             // owner has composite pk
-            pk = data.map(d => Utils.getPrimaryKeyCond(d, pks));
+            pk = data.map(d => Utils.getOrderedPrimaryKeys(d, meta));
         }
         else {
             res.row ??= {};
@@ -916,7 +928,11 @@ export class AbstractSqlDriver extends DatabaseDriver {
         if (!options.upsert && options.unionWhere?.length) {
             where = (await this.applyUnionWhere(meta, where, options, true));
         }
-        if (Utils.hasObjectKeys(data)) {
+        if (options.upsert && meta.tptParent) {
+            res = await this.nativeUpdateMany(entityName, [where], [data], options);
+        }
+        else if (Utils.hasObjectKeys(data) || (meta.inheritanceType === 'tpt' && meta.ownsVersionProperty())) {
+            // a TPT table declaring the version property is bumped even when only other tables of the hierarchy changed
             const qb = this.createQueryBuilder(entityName, options.ctx, 'write', options.convertCustomTypes, options.loggerContext).withSchema(this.getSchemaName(meta, options));
             qb.setAbortOptions(pickAbortOptions(options));
             if (options.upsert) {
@@ -942,15 +958,14 @@ export class AbstractSqlDriver extends DatabaseDriver {
                 qb.update(data).where(where);
                 // reload generated columns and version fields
                 const returning = [];
-                meta.props
+                this.getTableProps(meta)
                     .filter(prop => (prop.generated && !prop.primary) || prop.version)
                     .forEach(prop => returning.push(prop.name));
                 qb.returning(returning);
             }
             res = await this.rethrow(qb.execute('run', false));
         }
-        /* v8 ignore next */
-        const pk = pks.map(pk => Utils.extractPK(data[pk] || where, meta));
+        const pk = Utils.getOrderedPrimaryKeys({ ...where, ...data }, meta);
         await this.processManyToMany(meta, pk, collections, true, options);
         return res;
     }
@@ -959,13 +974,38 @@ export class AbstractSqlDriver extends DatabaseDriver {
         options.convertCustomTypes ??= true;
         const meta = this.metadata.get(entityName);
         if (options.upsert) {
+            if (meta.tptParent) {
+                // TPT parent tables go first, the PK they provide is the conflict target of this table
+                await this.nativeUpdateMany(meta.tptParent.class, where, data, options);
+                for (const [i, row] of data.entries()) {
+                    if (meta.primaryKeys.some(pk => row[pk] == null)) {
+                        const found = await this.findOne(meta.tptParent.class, where[i], {
+                            fields: meta.primaryKeys,
+                            ctx: options.ctx,
+                            connectionType: 'write',
+                            schema: options.schema,
+                        });
+                        meta.primaryKeys.forEach(pk => (row[pk] = found?.[pk]));
+                    }
+                }
+                options = { ...options, onConflictFields: meta.primaryKeys, onConflictWhere: undefined };
+            }
             const uniqueFields = options.onConflictFields ??
                 (Utils.isPlainObject(where[0])
                     ? Object.keys(where[0]).flatMap(key => Utils.splitPrimaryKeys(key))
                     : meta.primaryKeys);
             const qb = this.createQueryBuilder(entityName, options.ctx, 'write', options.convertCustomTypes, options.loggerContext).withSchema(this.getSchemaName(meta, options));
             qb.setAbortOptions(pickAbortOptions(options));
-            const returning = getOnConflictReturningFields(meta, data[0], uniqueFields, options);
+            let returning = getOnConflictReturningFields(meta, data[0], uniqueFields, options);
+            if (meta.inheritanceType === 'tpt') {
+                // each TPT table only carries its own columns, the entity is reloaded instead of mapping the returned rows
+                const own = (key) => meta.primaryKeys.includes(key) ||
+                    this.getTableProps(meta).some(prop => prop.name === key.split('.')[0]);
+                data = data.map(row => Object.fromEntries(Object.entries(row).filter(([key]) => own(key))));
+                options.onConflictMergeFields = options.onConflictMergeFields?.filter(f => own(f));
+                options.onConflictExcludeFields = options.onConflictExcludeFields?.filter(f => own(f));
+                returning = [];
+            }
             qb.insert(data)
                 .onConflict(uniqueFields)
                 .returning(returning);
@@ -979,7 +1019,8 @@ export class AbstractSqlDriver extends DatabaseDriver {
             if (options.onConflictWhere) {
                 qb.where(options.onConflictWhere);
             }
-            return this.rethrow(qb.execute('run', false));
+            const res = await this.rethrow(qb.execute('run', false));
+            return meta.inheritanceType === 'tpt' ? { ...res, row: undefined, rows: [] } : res;
         }
         const collections = options.processCollections ? data.map(d => this.extractManyToMany(meta, d)) : [];
         const keys = new Set();
@@ -994,7 +1035,10 @@ export class AbstractSqlDriver extends DatabaseDriver {
             }
         }
         // reload generated columns and version fields
-        meta.props.filter(prop => prop.generated || prop.version || prop.primary).forEach(prop => returning.add(prop.name));
+        meta.getPrimaryProps().forEach(prop => returning.add(prop.name));
+        this.getTableProps(meta)
+            .filter(prop => prop.generated || prop.version)
+            .forEach(prop => returning.add(prop.name));
         const pkCond = Utils.flatten(meta.primaryKeys.map(pk => meta.properties[pk].fieldNames))
             .map(pk => `${this.platform.quoteIdentifier(pk)} = ?`)
             .join(' and ');
@@ -1052,7 +1096,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
                 return sql;
             });
         }
-        if (meta.versionProperty) {
+        if (meta.ownsVersionProperty()) {
             const versionProperty = meta.properties[meta.versionProperty];
             const quotedFieldName = this.platform.quoteIdentifier(versionProperty.fieldNames[0]);
             sql += `${quotedFieldName} = `;
@@ -1065,14 +1109,15 @@ export class AbstractSqlDriver extends DatabaseDriver {
             sql += `, `;
         }
         sql = sql.substring(0, sql.length - 2) + ' where ';
-        const pkProps = meta.primaryKeys.concat(...meta.concurrencyCheckKeys);
+        const pkProps = meta.primaryKeys.concat(...meta.getOwnConcurrencyCheckKeys());
         const pks = Utils.flatten(pkProps.map(pk => meta.properties[pk].fieldNames));
         const useTupleIn = pks.length <= 1 || this.platform.allowsComparingTuples();
         const condTemplate = useTupleIn
             ? `(${pks.map(() => '?').join(', ')})`
             : `(${pks.map(pk => `${this.platform.quoteIdentifier(pk)} = ?`).join(' and ')})`;
         const conds = where.map(cond => {
-            if (Utils.isPlainObject(cond) && Utils.getObjectKeysSize(cond) === 1) {
+            // with multiple PK columns the condition is looked up by property name, so it needs to stay an object
+            if (pks.length === 1 && Utils.isPlainObject(cond) && Utils.getObjectKeysSize(cond) === 1) {
                 cond = Object.values(cond)[0];
             }
             if (pks.length > 1) {
@@ -1100,7 +1145,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
             sql += conds.join(' or ');
         }
         if (this.platform.usesReturningStatement() && returning.size > 0) {
-            const returningFields = Utils.flatten([...returning].map(prop => meta.properties[prop].fieldNames));
+            const returningFields = Utils.flatten([...returning].map(prop => (meta.properties[prop] ?? meta.root.properties[prop]).fieldNames));
             /* v8 ignore next */
             sql +=
                 returningFields.length > 0
@@ -1112,7 +1157,8 @@ export class AbstractSqlDriver extends DatabaseDriver {
         }
         const res = await this.rethrow(this.execute(sql, params, 'run', options.ctx, withAbortContext(options.loggerContext, options)));
         for (let i = 0; i < collections.length; i++) {
-            await this.processManyToMany(meta, where[i], collections[i], false, options);
+            const pk = Utils.getOrderedPrimaryKeys(where[i], meta);
+            await this.processManyToMany(meta, pk, collections[i], false, options);
         }
         return res;
     }
@@ -1300,7 +1346,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
             ],
             populateWhere: undefined,
             _populateWhere: 'infer',
-            populateFilter: this.wrapPopulateFilter(options, pivotProp2.name),
+            populateFilter: this.wrapPopulateFilter(options, pivotProp1.name),
         };
         if (pivotFindOptions._partitionLimit) {
             pivotFindOptions._partitionLimit.partitionBy = pivotProp2.name;
@@ -1316,7 +1362,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
                 }
             }
         }
-        return this.buildPivotResultMap(owners, res, pivotProp2.name, pivotProp1.name);
+        return this.buildPivotResultMap(owners, res, pivotProp2.name, pivotProp1.name, ownerMeta);
     }
     /**
      * Load from a polymorphic M:N pivot table.
@@ -1337,10 +1383,15 @@ export class AbstractSqlDriver extends DatabaseDriver {
     async loadPolymorphicPivotOwnerSide(prop, owners, where, orderBy, ctx, options, pivotJoin, inverseProp) {
         const pivotMeta = this.metadata.get(prop.pivotEntity);
         const targetMeta = prop.targetMeta;
-        // Build condition: discriminator = 'post' AND {discriminator} IN (...)
+        // `prop.discriminator` spans all owner FK columns but carries no target metadata, so a composite
+        // owner PK neither expands to a tuple condition nor gets mapped back; the virtual M:1 relation
+        // to this discriminator's owner describes the same columns as an actual relation
+        const ownerMeta = this.metadata.get(pivotMeta.polymorphicDiscriminatorMap[prop.discriminatorValue]);
+        const ownerProp = pivotMeta.properties[`${prop.discriminator}_${ownerMeta.tableName}`];
+        // Build condition: discriminator = 'post' AND {owner} IN (...)
         const cond = {
             [prop.discriminatorColumn]: prop.discriminatorValue,
-            [prop.discriminator]: { $in: owners.length === 1 && owners[0].length === 1 ? owners.map(o => o[0]) : owners },
+            [ownerProp.name]: { $in: owners.length === 1 && owners[0].length === 1 ? owners.map(o => o[0]) : owners },
         };
         if (!Utils.isEmpty(where)) {
             cond[inverseProp.name] = { ...where };
@@ -1351,9 +1402,13 @@ export class AbstractSqlDriver extends DatabaseDriver {
         const childExclude = !Utils.isEmpty(options?.exclude)
             ? options.exclude.map(f => `${inverseProp.name}.${f}`)
             : [];
+        // the owner relation is virtual, so its FK columns have to be selected via the pivot props that
+        // cover them; only the first owner of a shared pivot gets the flat prop named after the
+        // discriminator, and it keeps that owner's columns, so later owners get per-column props instead
+        const ownerFields = Utils.unique(prop.joinColumns.map(col => (pivotMeta.properties[col] ? col : prop.discriminator)));
         const fields = pivotJoin
-            ? [inverseProp.name, prop.discriminator, prop.discriminatorColumn]
-            : [inverseProp.name, prop.discriminator, prop.discriminatorColumn, ...childFields];
+            ? [inverseProp.name, ...ownerFields, prop.discriminatorColumn]
+            : [inverseProp.name, ...ownerFields, prop.discriminatorColumn, ...childFields];
         const res = await this.find(pivotMeta.class, cond, {
             ctx,
             ...options,
@@ -1374,7 +1429,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
             _populateWhere: 'infer',
             populateFilter: this.wrapPopulateFilter(options, inverseProp.name),
         });
-        return this.buildPivotResultMap(owners, res, prop.discriminator, inverseProp.name);
+        return this.buildPivotResultMap(owners, res, ownerProp.name, inverseProp.name, ownerMeta);
     }
     /**
      * Load from inverse side of polymorphic M:N (e.g., Tag -> Posts)
@@ -1423,7 +1478,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
             _populateWhere: 'infer',
             populateFilter: this.wrapPopulateFilter(options, ownerRelationName),
         });
-        return this.buildPivotResultMap(owners, res, tagProp.name, ownerRelationName);
+        return this.buildPivotResultMap(owners, res, tagProp.name, ownerRelationName, tagProp.targetMeta);
     }
     /**
      * Load a union-target polymorphic M:N pivot (e.g. Post.attachments -> Image | Video).
@@ -1519,19 +1574,23 @@ export class AbstractSqlDriver extends DatabaseDriver {
             }
         }
         const result = orphanedRows.size > 0 ? pivotRows.filter(r => !orphanedRows.has(r)) : pivotRows;
-        return this.buildPivotResultMap(owners, result, ownerProp.name, prop.discriminator);
+        return this.buildPivotResultMap(owners, result, ownerProp.name, prop.discriminator, ownerMeta);
     }
     /**
      * Build a map from owner PKs to their related entities from pivot table results.
      */
-    buildPivotResultMap(owners, results, keyProp, valueProp) {
+    buildPivotResultMap(owners, results, keyProp, valueProp, ownerMeta) {
         const map = {};
         for (const owner of owners) {
             const key = Utils.getPrimaryKeyHash(owner);
             map[key] = [];
         }
         for (const item of results) {
-            const key = Utils.getPrimaryKeyHash(Utils.asArray(item[keyProp]));
+            const fk = item[keyProp];
+            // the owner PKs are always flat, while the pivot FK follows the owner PK structure,
+            // so a PK built from a relation to another composite PK entity needs flattening too
+            const pks = ownerMeta && fk != null ? Utils.getOrderedPrimaryKeys(fk, ownerMeta) : Utils.asArray(fk);
+            const key = Utils.getPrimaryKeyHash(pks);
             const entity = item[valueProp];
             if (map[key]) {
                 map[key].push(entity);
@@ -1636,6 +1695,11 @@ export class AbstractSqlDriver extends DatabaseDriver {
             if (prop.kind === ReferenceKind.ONE_TO_ONE && prop.mapToPk && prop.owner) {
                 return false;
             }
+            // Polymorphic to-one flattened from an object embeddable lives inside a JSON column, so the join
+            // conditions would need JSON extraction for both the discriminator and the FK; fall back to SELECT_IN.
+            if (prop.polymorphic && prop.object && prop.embedded) {
+                return false;
+            }
             if (strategy !== LoadStrategy.JOINED) {
                 // force joined strategy for explicit 1:1 owner populate hint as it would require a join anyway
                 return prop.kind === ReferenceKind.ONE_TO_ONE && !prop.owner;
@@ -1657,8 +1721,23 @@ export class AbstractSqlDriver extends DatabaseDriver {
             const [propName, ref] = hint.field.split(':', 2);
             return { propName, ref, children: hint.children };
         });
+        // with `fixedOrder` the pivot PK is the order column, which is not guaranteed to be unique when the
+        // pivot table is managed externally, so we disambiguate the rows by their FKs on top of the PK
+        // (including virtual ones, as the owner FK of a polymorphic pivot is only mapped via non-persisted relations)
+        const pivotRelations = meta.pivotTable && !meta.compositePK ? meta.relations.filter(p => p.kind === ReferenceKind.MANY_TO_ONE) : [];
         for (const item of rawResults) {
-            const pk = Utils.getCompositeKeyHash(item, meta);
+            // flat hash, so nested composite PK values keep their own separators and cannot collide
+            let pk = Utils.getCompositeKeyHash(item, meta, false, undefined, true);
+            if (pivotRelations.length > 0) {
+                pk = Utils.getPrimaryKeyHash([
+                    pk,
+                    ...pivotRelations.flatMap(p => {
+                        const value = item[p.name];
+                        // composite FKs are mapped to an array of values, which `extractPK` does not accept
+                        return (Array.isArray(value) ? Utils.flatten(value, true) : Utils.extractPK(value, p.targetMeta));
+                    }),
+                ]);
+            }
             if (map[pk]) {
                 for (const { propName } of hints) {
                     if (!item[propName]) {
@@ -1751,7 +1830,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
                     // INNER JOINs get nested inside the polymorphic LEFT JOIN by processNestedJoins, which
                     // keeps the resulting query valid for rows pointing to other polymorphic targets.
                     if (targetMeta.inheritanceType === 'tpt' && targetMeta.tptParent) {
-                        this.addTPTParentJoinsForRelation(qb, targetMeta, tableAlias, targetPath);
+                        qb.addTPTParentJoins(targetMeta, tableAlias, targetPath);
                     }
                     // For polymorphic targets that are TPT base classes, also LEFT JOIN
                     // all descendant tables so child-specific fields can be selected.
@@ -1799,10 +1878,6 @@ export class AbstractSqlDriver extends DatabaseDriver {
                         : JoinType.leftJoin;
             const schema = prop.targetMeta.schema === '*' ? (options?.schema ?? this.config.get('schema')) : prop.targetMeta.schema;
             qb.join(field, tableAlias, {}, joinType, path, schema);
-            // For relations to TPT child entities, INNER JOIN parent tables (GH #7469)
-            if (meta2.inheritanceType === 'tpt' && meta2.tptParent) {
-                this.addTPTParentJoinsForRelation(qb, meta2, tableAlias, path);
-            }
             // For relations to TPT base classes, add LEFT JOINs for all child tables (polymorphic loading)
             if (meta2.inheritanceType === 'tpt' && meta2.tptChildren?.length && !ref) {
                 // Use the registry metadata to ensure allTPTDescendants is available
@@ -1849,25 +1924,6 @@ export class AbstractSqlDriver extends DatabaseDriver {
         }
         return fields;
     }
-    /**
-     * Walks the TPT inheritance chain of `leafMeta` and INNER JOINs each parent table.
-     * Registers the parent aliases in `qb.state.tptAlias` so column resolution finds them
-     * when filter conditions reference parent-table columns.
-     * @internal
-     */
-    addTPTParentJoinsForRelation(qb, leafMeta, leafAlias, basePath) {
-        let childAlias = leafAlias;
-        let childMeta = leafMeta;
-        while (childMeta.tptParent) {
-            const parentMeta = childMeta.tptParent;
-            const parentAlias = qb.getNextAlias(parentMeta.className);
-            qb.createAlias(parentMeta.class, parentAlias);
-            qb.state.tptAlias[`${leafAlias}:${parentMeta.className}`] = parentAlias;
-            qb.addPropertyJoin(childMeta.tptParentProp, childAlias, parentAlias, JoinType.innerJoin, `${basePath}.[tpt]${childMeta.className}`);
-            childAlias = parentAlias;
-            childMeta = parentMeta;
-        }
-    }
     /**
      * Adds LEFT JOINs and fields for TPT polymorphic loading when populating a relation to a TPT base class.
      * @internal
@@ -2087,7 +2143,20 @@ export class AbstractSqlDriver extends DatabaseDriver {
         const ret = {};
         for (const prop of meta.relations) {
             if (prop.kind === ReferenceKind.MANY_TO_MANY && data[prop.name]) {
-                ret[prop.name] = data[prop.name].map((item) => Utils.asArray(item));
+                // union targets are validated to have a single PK column, so a pivot row is always keyed
+                // by exactly `[discriminator, pk]` - anything else cannot address a target table
+                const discriminators = QueryHelper.isUnionTargetPolymorphic(prop)
+                    ? Object.keys(prop.discriminatorMap)
+                    : undefined;
+                ret[prop.name] = data[prop.name].map((item) => {
+                    const values = Utils.asArray(item);
+                    if (discriminators && !(values.length === 2 && discriminators.includes('' + values[0]))) {
+                        throw new Error(`Cannot resolve the discriminator value of ${meta.className}.${prop.name} from '${values.join(', ')}', ` +
+                            `as the same primary key can exist in any of the target tables. ` +
+                            `Pass the target as a [discriminator, ...primaryKey] tuple, e.g. ${JSON.stringify([discriminators[0], ...values])}.`);
+                    }
+                    return values;
+                });
                 delete data[prop.name];
             }
         }