@sap/cds-dk 10.0.7 → 10.1.0

package/node_modules/@sap/cds/libx/odata/parse/cqn2odata.js

@@ -232,44 +232,6 @@ function _xpr(expr, target, kind, isLambda, navPrefix = []) {
   return res.join('%20')
 }
 
-const _keysOfWhere = (where, kind, target) => {
-  if (!Array.isArray(where) || !where.length) return ''
-
-  if (kind === 'rest') {
-    const keys = where.length === 1 ? getProp(where[0], 'val') : getProp(where[2], 'val')
-    return `/${keys}`
-  }
-
-  if (where.length === 3) {
-    const [left, op, right] = where
-    if (op === '=' && (('val' in left && right.ref) || (left.ref && 'val' in right))) {
-      const formattedValue =
-        'val' in left
-          ? formatVal(left.val, right.ref.join('/'), target, kind)
-          : formatVal(right.val, left.ref.join('/'), target, kind)
-
-      return `(${encodeURIComponent(formattedValue)})`
-    }
-  }
-
-  const res = []
-  for (const cur of where) {
-    if (hasValidProps(cur, 'ref')) {
-      res.push(_format(cur))
-    } else if (hasValidProps(cur, 'val')) {
-      // find previous ref
-      const element = res[res.length - 2]
-      res.push(_format(cur, element, target, kind))
-    } else if (cur === 'and') {
-      res.push(',')
-    } else {
-      res.push(cur)
-    }
-  }
-
-  return `(${res.join('')})`
-}
-
 function _getQueryTarget(entity, propOrEntity, model) {
   if (!entity) {
     // if there is no entity yet, we need to look it up in the model
@@ -302,8 +264,8 @@ const _params = (args, kind, target) => {
   return `(${_params.join(',')})`
 }
 
-function _from(from, kind, model) {
-  let ref = getProp(from, 'ref')
+function _from(subject, kind, model) {
+  let ref = getProp(subject, 'ref')
   ref = (Array.isArray(ref) && ref) || [ref]
 
   const path = []
@@ -311,21 +273,63 @@ function _from(from, kind, model) {
 
   for (const curRef of ref) {
     if (hasValidProps(curRef, 'where', 'id')) {
+      // Format a request URL based on req.subject[n].ref
+
       const { where, id } = curRef
       queryTarget = model && _getQueryTarget(queryTarget, id, model)
-      const keys = _keysOfWhere(where, kind, queryTarget)
+
+      // Format URL keys from req.subject.ref[n].where
+      let keys = ''
+
+      if (Array.isArray(where) && where.length) {
+        if (kind === 'rest') {
+          if (where.length !== 1 && where[1] !== '=')
+            cds.error(
+              500,
+              `Invalid subject: 'where' must specify a key via equality (key = value), got: ${JSON.stringify(where)}`
+            )
+          const val = where.length === 1 ? getProp(where[0], 'val') : getProp(where[2], 'val')
+          keys = `/${val}`
+        } else if (where.length === 3) {
+          const [left, op, right] = where
+
+          if (op === '=' && left.ref && 'val' in right) {
+            keys = `(${encodeURIComponent(formatVal(right.val, left.ref.join('/'), queryTarget, kind))})`
+            // REVISIT: keys in req.subject should already use the correct order
+          } else if (op === '=' && right.ref && 'val' in left) {
+            keys = `(${encodeURIComponent(formatVal(left.val, right.ref.join('/'), queryTarget, kind))})`
+          } else {
+            cds.error(
+              500,
+              `Invalid subject: 'where' must specify a key via equality (key = value), got: ${JSON.stringify(where)}`
+            )
+          }
+        } else {
+          const res = []
+          for (const cur of where) {
+            if (hasValidProps(cur, 'ref')) {
+              res.push(_format(cur))
+            } else if (hasValidProps(cur, 'val')) {
+              const element = res[res.length - 2]
+              res.push(_format(cur, element, queryTarget, kind))
+            } else if (cur === 'and') {
+              res.push(',')
+            } else {
+              res.push(cur)
+            }
+          }
+
+          keys = `(${res.join('')})`
+        }
+      }
+
       path.push(`${id}${keys}`)
     } else if (hasValidProps(curRef, 'id') && 'args' in curRef) {
       const { args, id } = curRef
       queryTarget = model && _getQueryTarget(queryTarget, id, model)
       const params = _params(args, kind, queryTarget)
       path.push(`${id}${params}`)
-      // args are only set in case the entity has parameters.
-      // Check model if that is the case and if so, conform to the OData representation for
-      // Views with parameters, meaning the actual entity is behind /Set
-      if (queryTarget?.params) {
-        path.push(`Set`)
-      }
+      if (queryTarget?.params) path.push(`Set`)
     } else if (typeof curRef === 'string') {
       queryTarget = model && _getQueryTarget(queryTarget, curRef, model)
       path.push(curRef)
@@ -523,7 +527,9 @@ function getOptions(cqnPart, url, kind, target, isCount) {
   for (const opt in cqnPart) {
     const cqnPartOpt = cqnPart[opt]
     if (cqnPartOpt === undefined) continue
-    if (!hasValidProps(cqnPart, opt)) throw new Error(`Feature not supported: SELECT statement with .${opt}`)
+
+    if (!hasValidProps(cqnPart, opt)) cds.error(500, `Feature not supported: SELECT statement with .${opt}`)
+
     const parser = parsers[opt]
     const parsed = parser && parser(cqnPartOpt, url, kind, target, isCount)
     const parsedOpts = (Array.isArray(parsed) && parsed) || (parsed && [parsed]) || []
@@ -541,18 +547,22 @@ const _isCount = SELECT => {
   return false
 }
 
-const _select = (cqn, kind, model) => {
+const _select = (cqn, subject, kind, model) => {
+  const { url, queryTarget } = _from(subject, kind, model)
+
   const SELECT = getProp(cqn, 'SELECT')
-  const { url, queryTarget } = _from(getProp(SELECT, 'from'), kind, model)
   const isCount = _isCount(SELECT)
   const queryOptions = getOptions(SELECT, url, kind, queryTarget, isCount).join('&')
-  const path = `${url}${isCount ? '/$count' : ''}${queryOptions ? `?${queryOptions}` : ''}`
-  return { method: 'GET', path }
+
+  return {
+    method: 'GET',
+    path: `${url}${isCount ? '/$count' : ''}${queryOptions ? `?${queryOptions}` : ''}`
+  }
 }
 
-const _insert = (cqn, kind, model) => {
+const _insert = (cqn, subject, kind, model) => {
   const INSERT = getProp(cqn, 'INSERT')
-  const { url } = _from(getProp(INSERT, 'into'), kind, model)
+  const { url } = _from(subject, kind, model)
   const body = _copyData(
     Array.isArray(INSERT.entries) && INSERT.entries.length === 1 ? INSERT.entries[0] : INSERT.entries
   )
@@ -572,44 +582,31 @@ const _copyData = data => {
   return copied
 }
 
-const _update = (cqn, kind, model, method) => {
-  const UPDATE = getProp(cqn, 'UPDATE')
-  const { url, queryTarget } = _from(getProp(UPDATE, 'entity'), kind, model)
-  let keys = ''
-
-  if (UPDATE.where) {
-    if (_isOdataUrlWithKeys(url, kind)) {
-      throw new Error('Cannot generate URL for UPDATE CQN. Conflicting .from and .where')
-    }
-    keys = _keysOfWhere(getProp(UPDATE, 'where'), kind, queryTarget)
-  }
-
+const _update = (cqn, subject, kind, model, method = 'PATCH') => {
+  const { url } = _from(subject, kind, model)
   // TODO: support for .set as well
-  const body = _copyData(UPDATE.data)
-  return { method: method || 'PATCH', path: `${url}${keys}`, body }
+  const body = _copyData(getProp(cqn, 'UPDATE').data)
+  return { method, path: url, body }
 }
 
-const _delete = (cqn, kind, model) => {
-  const DELETE = getProp(cqn, 'DELETE')
-  const { url, queryTarget } = _from(getProp(DELETE, 'from'), kind, model)
-  let keys = ''
+const _delete = (subject, kind, model) => {
+  const { url } = _from(subject, kind, model)
+  return { method: 'DELETE', path: url }
+}
 
-  if (DELETE.where) {
-    if (_isOdataUrlWithKeys(url, kind)) {
-      throw new Error('Cannot generate URL for DELETE CQN. Conflicting .from and .where')
-    }
+module.exports.cqn2odata = (cqn, { kind, model } = {}) => {
+  let { query, subject, method } = cqn
 
-    keys = _keysOfWhere(getProp(DELETE, 'where'), kind, queryTarget)
+  if (!subject) {
+    query = cds.ql(cqn)
+    subject = query._subject && { ref: query._subject.ref }
+    method = undefined
   }
 
-  return { method: 'DELETE', path: `${url}${keys}` }
-}
-
-module.exports.cqn2odata = (cqn, { kind, model, method }) => {
-  if (cqn.SELECT) return _select(cqn, kind, model)
-  if (cqn.INSERT) return _insert(cqn, kind, model)
-  if (cqn.UPDATE) return _update(cqn, kind, model, method)
-  if (cqn.DELETE) return _delete(cqn, kind, model)
+  if (query.SELECT) return _select(query, subject, kind, model)
+  if (query.INSERT) return _insert(query, subject, kind, model)
+  if (query.UPDATE) return _update(query, subject, kind, model, method)
+  if (query.DELETE) return _delete(subject, kind, model)
 
-  throw new Error('Unknown CQN object cannot be translated to URL: ' + JSON.stringify(cqn))
+  throw new Error('Unknown CQN object cannot be translated to URL: ' + JSON.stringify(query))
 }

package/node_modules/@sap/cds/libx/queue/SchedulingService.js

@@ -9,6 +9,20 @@ const $taskProcessorRegistered = Symbol('task processor registered')
 
 const FLUSH = 'flush'
 
+// Node's `setTimeout` delay is a 32-bit signed int; larger values emit a
+// `TimeoutOverflowWarning` and are clamped to 1ms (firing almost immediately).
+const MAX_TIMEOUT_MS = 2 ** 31 - 1
+
+// Like `setTimeout`, but chains multiple timers when `delay` exceeds the 32-bit
+// limit so the callback still fires at its exact scheduled time. The timer is
+// unref'd so it never keeps the process alive.
+const _setLongTimeout = (cb, delay) => {
+  const step = Math.min(delay, MAX_TIMEOUT_MS)
+  const remaining = delay - step
+  const timer = setTimeout(remaining > 0 ? () => _setLongTimeout(cb, remaining) : cb, step)
+  return timer.unref()
+}
+
 let T0
 
 module.exports = class SchedulingService extends cds.Service {
@@ -116,7 +130,7 @@ module.exports = class SchedulingService extends cds.Service {
 
     if (!flushOpts?.after) return cb()
 
-    setTimeout(cb, flushOpts?.after).unref()
+    _setLongTimeout(cb, flushOpts.after)
   }
 
   scheduleTask = async (tasks, queueName, taskOpts, context = cds.context) => {
@@ -154,7 +168,8 @@ module.exports = class SchedulingService extends cds.Service {
     if (this._markers.has(marker.ID)) return
 
     this._markers.add(marker.ID)
-    setTimeout(() => this._markers.delete(marker.ID), after + this.marker_interval_ms * 2).unref()
+    // Evict the in-memory dedup entry once the marker can no longer be re-derived.
+    _setLongTimeout(() => this._markers.delete(marker.ID), after + this.marker_interval_ms * 2)
 
     await cds.tx(new cds.EventContext({ tenant: T0 }), async () => {
       LOG._debug && LOG.debug(`Write marker for queue ${queueName} of tenant ${tenant} at ${marker.timestamp}`)

package/node_modules/@sap/cds/libx/queue/processing.js

@@ -152,9 +152,7 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
     const config = tenant ? { tenant, user: cds.User.privileged } : { user: cds.User.privileged }
     config.after = 1 // make sure spawn puts its cb on the `timer` queue (via setTimeout), which is also used by `taskRunner`
 
-    // REVISIT: do we really need cds.spawn (e.g., for extended model)?
-    const _spawn = (fn, o) => setTimeout(() => cds._with(o, fn), 1).unref()
-    const _begin = cds.db.kind === 'sqlite' ? _spawn : cds.spawn.bind(cds)
+    const _begin = cds.spawn.bind(cds)
     const _tx = cds.tx.bind(cds)
 
     const processing_fn = async () => {

package/node_modules/@sap/cds/libx/rest/RestAdapter.js

@@ -13,11 +13,9 @@ const operation = require('./middleware/operation')
 
 const { postProcessData } = require('./post-processing')
 
-
 class RestRequest extends cds.Request {}
 RestRequest.prototype.protocol = 'rest' // for batch subrequests where prototype is not properly set
 
-
 class RestAdapter extends HttpAdapter {
   request4(args) {
     return new RestRequest(args)
@@ -81,22 +79,20 @@ class RestAdapter extends HttpAdapter {
 
         if (status && res.statusCode === 200) res.status(status) //> only set status if not yet modified
 
-        if (req.method === 'HEAD') res.type('json').set('content-length', JSON.stringify(result).length).end()
-        else res.send(typeof result === 'number' ? result.toString() : result)
+        res.send(typeof result === 'number' ? result.toString() : result)
       }, next)
     })
 
     return router
   }
 
-
   normalized(err) {
     err = super.normalized(err)
-    // Actually `code` is only required by OData, but we had that applied to 
+    // Actually `code` is only required by OData, but we had that applied to
     // REST as well, so we keep it here for compatibility with legacy behavior.
     if (typeof err.code !== 'string') err.code = String(err.code || err.status || '')
     return err
   }
 }
 
-module.exports = RestAdapter
+module.exports = RestAdapter

package/node_modules/@sap/cds/libx/rest/middleware/delete.js

@@ -1,5 +1,5 @@
-/** 
- * @param {import('../RestAdapter')} adapter 
+/**
+ * @param {import('../RestAdapter')} adapter
  * the adapter instance in which this middleware is used
  */
 module.exports = exports = adapter => exports.delete.bind(adapter)
@@ -8,7 +8,7 @@ module.exports = exports = adapter => exports.delete.bind(adapter)
  * @type {import('express').Handler}
  * @this import('../RestAdapter')
  */
-exports.delete = async function rest_delete (req, res) {
+exports.delete = async function rest_delete(req, res) {
   const { _query: query, _data: data, _params: params } = req
 
   await this.service.dispatch(this.request4({ query, data, params, req, res }))

package/node_modules/@sap/cds/libx/rest/middleware/parse.js

@@ -1,5 +1,5 @@
-/** 
- * @param {import('../RestAdapter')} adapter 
+/**
+ * @param {import('../RestAdapter')} adapter
  * the adapter instance in which this middleware is used
  */
 module.exports = exports = adapter => exports.parse.bind(adapter)
@@ -84,12 +84,17 @@ exports.parse = function parse_odata_url(req, res, next) {
         cds.error(errorMsg, { code: 400 })
       }
       if (!one) {
-      if (req.method === 'PATCH') throw cds.error ({ status: 405, code: `INVALID_${req.method}` })
-        const entity = definition, keys = {}, data = req.body || {}
-        for (let k in entity.keys) keys[k] = data[k]
-          || entity.keys[k]['@cds.on.insert']?.['='] === '$user' && cds.context?.user?.id
-          || cds.error ({ status: 405, code: `INVALID_${req.method}` })
-        from.ref[0] = { id: from.ref[0], where: cds.ql.predicate (keys) }
+        if (req.method === 'PATCH') throw cds.error({ status: 405, code: `INVALID_${req.method}` })
+        const entity = definition,
+          keys = {},
+          data = req.body || {}
+        for (let k in entity.keys) {
+          keys[k] =
+            data[k] ||
+            (entity.keys[k]['@cds.on.insert']?.['='] === '$user' && cds.context?.user?.id) ||
+            cds.error({ status: 405, code: `INVALID_${req.method}` })
+        }
+        from.ref[0] = { id: from.ref[0], where: cds.ql.predicate(keys) }
       }
       query = UPDATE(_target)
       break

package/node_modules/@sap/cds/libx/rest/middleware/read.js

@@ -1,5 +1,5 @@
-/** 
- * @param {import('../RestAdapter')} adapter 
+/**
+ * @param {import('../RestAdapter')} adapter
  * the adapter instance in which this middleware is used
  */
 module.exports = exports = adapter => exports.read.bind(adapter)
@@ -8,7 +8,7 @@ module.exports = exports = adapter => exports.read.bind(adapter)
  * @type {import('express').Handler}
  * @this import('../RestAdapter')
  */
-exports.read = async function rest_read (req, res) {
+exports.read = async function rest_read(req, res) {
   const { _query: query, _target: target, _data: data, _params: params } = req
 
   let result,

package/node_modules/@sap/cds/libx/rest/middleware/upsert.js

@@ -1,5 +1,5 @@
-/** 
- * @param {import('../RestAdapter')} adapter 
+/**
+ * @param {import('../RestAdapter')} adapter
  * the adapter instance in which this middleware is used
  */
 module.exports = exports = adapter => exports.upsert.bind(adapter)

package/node_modules/@sap/cds/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "10.0.5",
+  "version": "10.1.0",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [

package/node_modules/@sap/cds-compiler/CHANGELOG.md

@@ -15,6 +15,45 @@ might use a deprecated flag only for a limited period of time.
 
 
 
+## Version 7.1.0 - 2026-08-27
+
+### Features
+
+- **compiler:**
+  + It is now possible to extend a view/projection with a `where` or `having` clause, even if it already had one.
+    Extensions are joined with `and` if such a clause already exists.
+  + Publishing an association with an empty filter is now supported. For a managed association, this turns it
+    into an unmanaged one. For an unmanaged association, it has no effect.
+  + `select one` is now supported in `parse.cql` and `parse.expr`.
+  + Compiler adds helper property `$backlink` to CSN. It enables compiler backends and other CSN consumers
+    to better handle backlink comparisons with `$self`. This property may vanish in future releases.
+- **odata:**
+  + Update OData vocabularies: Common and UI.
+- **sql:**
+  + Wrap predicate columns in `CASE ... WHEN` for SAP HANA.
+  + Support common `cds.Vector` functions on SAP HANA and Postgres.
+
+### Bug Fixes
+
+- **compiler:**
+  + Properly render structures with property `...` in CDL.
+  + Extending a `where`, `having` or `group by` clause from unrelated layers no longer results in an error.
+    A warning is emitted when extending an `order by` clause from unrelated layers.
+- **effective:**
+  + Correctly rewrite references in annotation expressions inside arrays.
+  + Add option to replace annotation expressions by strings to evade error situations.
+- **sql:**
+  + Don't dump while reporting an error for `$self` in a filter of a `from` reference.
+  + Correctly handle renamed target elements in backlink comparisons.
+
+### Improvements
+
+- **compiler:**
+  + Issue a warning that a type with an unmanaged association can only be used as an include.
+  + Omit empty extend for `extend … with definitions` from parsed CSN.
+
+
+
 ## Version 7.0.3 - 2026-07-21
 
 ### Bug Fixes
@@ -34,10 +73,10 @@ might use a deprecated flag only for a limited period of time.
 - **compiler:**
   + Avoid dump for a new association in a projection with backlink comparison while reporting a missing backlink target element.
   + Soften incompatibility concerning backlink comparisons: missing target elements which are referred to in the foreign keys or ON-condition of the backlink
-    association now only lead to a warning.
+    association now only lead to a warning, not an error.
   + Soften incompatibility concerning structure values for annotations: a structure property like `list` won't be rejected; we avoid an ambiguity with an
-    _expression_ `(1, 2, 3)` by putting `'=': true` next to `list: …` in the CSN, like in compiler v6. A `xpr` expression is rendered without a sibling `=`,
-    though.
+    _expression_ `(1, 2, 3)` by putting `'=': true` next to `list: …` in the CSN, like in compiler v6.
+    A `xpr` expression and an `#` enum symbol are rendered without a sibling `=`, though.
 
 
 
@@ -55,9 +94,9 @@ might use a deprecated flag only for a limited period of time.
     unless the expression is a simple reference. An object as annotation value with a “primary expression property” like
     `ref` or `xpr` is always interpreted as an expression. Before, it was only interpreted as expression if the object also
     contained a property `=`.  In order to avoid ambiguities, it is not allowed to provide structured annotation values that
-    could be confused with expressions.
-  + Expression-like values that are not simple references are no longer allowed as comparator value for `... up to` when
-    extending array like annotation values. Simple references now are handled correctly.
+    could be confused with expressions. See also the fix in Version 7.0.2 (`=` is only omitted for `xpr` and `#`).
+  + Expression-like values that are not simple references or literals are no longer allowed (and partly ignored) as comparator value
+    for `... up to` when extending array-like annotation values. Simple references now are handled correctly.
   + `null` as annotation value is now propagated like any other value. Exceptions are `includes` with multiple structures/aspects:
     value `null` from a later include does not overwrite a value from an earlier include (no change compared to previous releases).
   + The compiler now reports an error when multiple `extend ... with <aspect>` statements introduce the same element or action.
@@ -66,6 +105,7 @@ might use a deprecated flag only for a limited period of time.
   + The rules for the propagation of `key` in queries have been simplified: Keys are propagated, if no explicit key is set in
     the query and all key elements of the primary base entity and of joined entities are selected.
   + No longer propagate the `key` property of the elements of structures which are included into a structured type.
+  + Replace option `v7KeyPropagation` by option `v6KeyPropagation` with inverted semantics.
   + It is no longer possible to extend built-in types by adding type properties.
   + Always propagate annotation with `elements` and `enum` expansion.
   + Ensure that recompiling a CSN of flavor `gensrc` / `xtended` does not change the element order.
@@ -113,6 +153,16 @@ might use a deprecated flag only for a limited period of time.
     (for the message IDs `type-missing-argument`, `type-unexpected-argument`, `ref-unsupported-type`, and `ref-unexpected-args`).
 
 
+## Version 6.9.4 - 2026-07-29
+
+### Bug Fixes
+
+- **effective:**
+  + Correctly rewrite references in annotation expressions inside arrays.
+  + Add option to replace annotation expressions by strings to evade error situations.
+
+
+
 ## Version 6.9.3 - 2026-06-17
 
 ### Bug Fixes
@@ -367,8 +417,10 @@ whose target does not exist.
 
 ### Added
 
-- compiler: `annotate … with @extension.code: [..., 'additional code']` even works
-  if no value for that annotation has been provided with the base definition.
+- compiler:
+  + `annotate … with @extension.code: [..., 'additional code']` even works
+    if no value for that annotation has been provided with the base definition.
+  + In the query section of a view definitions, `key` can now also be specified in top level inlines.
 - to.sql: Calculated elements can now be used next to (but not in) nested projections.
 - to.edm(x): The `@cds.api.ignore` annotation can now be applied to actions, functions, and their parameters.
 

package/node_modules/@sap/cds-compiler/bin/cdsc.js

@@ -377,7 +377,7 @@ async function executeCommandLine( command, options, args ) {
   function forEffective( model ) {
     const features = [
       'resolveSimpleTypes', 'resolveProjections',
-      'remapOdataAnnotations', 'keepLocalized',
+      'stringifyAnnoXpr', 'remapOdataAnnotations', 'keepLocalized',
     ];
     for (const feature of features) {
       if (options[feature]) // map to boolean equivalent
@@ -390,7 +390,7 @@ async function executeCommandLine( command, options, args ) {
   }
 
   function forSeal( model ) {
-    const features = [ 'remapOdataAnnotations', 'deriveAnalyticalAnnotations' ];
+    const features = [ 'stringifyAnnoXpr', 'remapOdataAnnotations', 'deriveAnalyticalAnnotations' ];
     for (const feature of features) {
       if (options[feature]) // map to boolean equivalent
         options[feature] = options[feature] === 'true';