@sap/cds-dk 10.0.7 → 10.1.1

package/lib/lint/eslintHelp.json

@@ -1,5 +1,5 @@
 {
-  "version": "10.7.0",
+  "version": "10.8.0",
   "help": "\n# SYNOPSIS\n\n    *cds lint* [options] file.js [file.js] [dir]\n\n    Runs environment checks and/or checks the specified models\n    based on the ESLint framework\n\n# OPTIONS\n    \n    Basic configuration:\n      --no-config-lookup               Disable look up for eslint.config.js\n      -c, --config path::String        Use this configuration instead of eslint.config.js, eslint.config.mjs, or eslint.config.cjs\n      --inspect-config                 Open the config inspector with the current configuration\n      --ext [String]                   Specify additional file extensions to lint\n      --global [String]                Define global variables\n      --parser String                  Specify the parser to be used\n      --parser-options Object          Specify parser options\n    \n    Specify Rules and Plugins:\n      --plugin [String]                Specify plugins\n      --rule Object                    Specify rules\n    \n    Fix Problems:\n      --fix                            Automatically fix problems\n      --fix-dry-run                    Automatically fix problems without saving the changes to the file system\n      --fix-type Array                 Specify the types of fixes to apply (directive, problem, suggestion, layout)\n    \n    Ignore Files:\n      --no-ignore                      Disable use of ignore files and patterns\n      --ignore-pattern [String]        Patterns of files to ignore\n    \n    Use stdin:\n      --stdin                          Lint code provided on <STDIN> - default: false\n      --stdin-filename String          Specify filename to process STDIN as\n    \n    Handle Warnings:\n      --quiet                          Report errors only - default: false\n      --max-warnings Int               Number of warnings to trigger nonzero exit code - default: -1\n    \n    Output:\n      -o, --output-file path::String   Specify file to write report to\n      -f, --format String              Use a specific output format - default: stylish\n      --color, --no-color              Force enabling/disabling of color\n    \n    Inline configuration comments:\n      --no-inline-config               Prevent comments from changing config or rules\n      --report-unused-disable-directives  Adds reported errors for unused eslint-disable and eslint-enable directives\n      --report-unused-disable-directives-severity String  Chooses severity level for reporting unused eslint-disable and eslint-enable directives - either: off, warn, error, 0, 1, or 2\n      --report-unused-inline-configs String  Adds reported errors for unused eslint inline config comments - either: off, warn, error, 0, 1, or 2\n    \n    Caching:\n      --cache                          Only check changed files - default: false\n      --cache-file path::String        Path to the cache file. Deprecated: use --cache-location - default: .eslintcache\n      --cache-location path::String    Path to the cache file or directory\n      --cache-strategy String          Strategy to use for detecting changed files in the cache - either: metadata or content - default: metadata\n    \n    Suppressing Violations:\n      --suppress-all                   Suppress all violations - default: false\n      --suppress-rule [String]         Suppress specific rules\n      --suppressions-location path::String  Specify the location of the suppressions file\n      --prune-suppressions             Prune unused suppressions - default: false\n      --pass-on-unpruned-suppressions  Ignore unused suppressions - default: false\n    \n    Miscellaneous:\n      --init                           Run config initialization wizard - default: false\n      --env-info                       Output execution environment information - default: false\n      --no-error-on-unmatched-pattern  Prevent errors when pattern is unmatched\n      --exit-on-fatal-error            Exit with exit code 2 in case of fatal error - default: false\n      --no-warn-ignored                Suppress warnings when the file list includes ignored files\n      --pass-on-no-patterns            Exit with exit code 0 in case no file patterns are passed\n      --debug                          Output debugging information\n      -h, --help                       Show help\n      -v, --version                    Output the version number\n      --print-config path::String      Print the configuration for the given file\n      --stats                          Add statistics to the lint report - default: false\n      --flag [String]                  Enable a feature flag\n      --mcp                            Start the ESLint MCP server\n      --concurrency Int|String         Number of linting threads, auto to choose automatically, off for no multithreading - default: off\n    \n",
   "options": [
     "--config",

package/lib/mtx/auth_manager.js

@@ -1,5 +1,5 @@
 const cds = require('../cds');
-const { SettingsManager } = require('./settings_manager');
+const { SettingsManager, OAUTH_PATH, OAUTH_PATH_LEGACY_TOKEN } = require('./settings_manager');
 const { ParamCollection } = require('./params');
 const { getMessage } = require('./util/logging');
 const { buildResponseError, buildNetworkError, parseResponseBody } = require('./util/request');
@@ -39,28 +39,107 @@ function reqParams(method, params) {
     const url = params.get('tokenUrl');
     const d = {};
     const ignored = {};
-    if (params.has('subdomain')) {
-        d.subdomain = params.get('subdomain');
-    }
-    if (params.has('refreshToken')) {
-        d.refresh_token = params.get('refreshToken');
-        const param = ['passcode', 'clientid'].find(param => params.has(param));
-        if (param) {
-            ignored[param] = 'refresh token is present';
+    const headers = { 'content-type': 'application/x-www-form-urlencoded' };
+    const tls = {};
+    if (params.get('directUaa')) {
+        d.grant_type = 'client_credentials';
+        d.client_id = params.get('clientid');
+        if (params.has('key')) {
+            tls.cert = params.get('certificate');
+            tls.key = params.get('key');
+        } else {
+            const encoded = Buffer.from(`${params.get('clientid')}:${params.get('clientsecret')}`).toString('base64');
+            headers.Authorization = `Basic ${encoded}`;
+        }
+    } else {
+        if (params.has('subdomain')) {
+            d.subdomain = params.get('subdomain');
+        }
+        if (params.has('refreshToken')) {
+            d.refresh_token = params.get('refreshToken');
+            const param = ['passcode', 'clientid'].find(param => params.has(param));
+            if (param) {
+                ignored[param] = 'refresh token is present';
+            }
+        } else if (params.has('passcode')) {
+            d.passcode = params.get('passcode');
+        } else if (params.has('clientsecret')) {
+            d.clientid = params.get('clientid');
+            d.clientsecret = params.get('clientsecret');
         }
-    } else if (params.has('passcode')) {
-        d.passcode = params.get('passcode');
-    } else if (params.has('clientsecret')) {
-        d.clientid = params.get('clientid');
-        d.clientsecret = params.get('clientsecret');
-    } else if (params.has('key')) {
-        d.clientid = params.get('clientid');
-        d.key = params.get('key');
     }
     const data = new URLSearchParams(d).toString();
-    return method === 'post'
-        ? { url, data, ignored }
-        : { url: `${url}?${data}`, data: undefined, ignored };
+    const req = method === 'post'
+        ? { url, data, method, headers, ...tls }
+        : { url: `${url}?${data}`, data: undefined, method, headers, ...tls };
+    return { req, ignored };
+}
+
+function toResponse(res, body) {
+    const status = res.statusCode;
+    return {
+        ok: status >= 200 && status < 300,
+        status,
+        statusText: res.statusMessage ?? '',
+        headers: { get: name => res.headers[name.toLowerCase()] },
+        json: async () => JSON.parse(body),
+        text: async () => body
+    };
+}
+
+function postTokenViaMtls(url, data, headers, { cert, key }) {
+    const https = require('node:https');
+    const u = new URL(url);
+    return new Promise((resolve, reject) => {
+        const request = https.request({
+            hostname: u.hostname,
+            port: u.port || 443,
+            path: `${u.pathname}${u.search}`,
+            method: 'POST',
+            headers,
+            cert,
+            key
+        }, res => {
+            let body = '';
+            res.setEncoding('utf8');
+            res.on('data', chunk => { body += chunk; });
+            res.on('end', () => resolve(toResponse(res, body)));
+        });
+        request.on('error', reject);
+        if (data) {
+            request.write(data);
+        }
+        request.end();
+    });
+}
+
+async function postTokenTo(req, params) {
+    const { url, data, method, headers, cert, key } = req;
+    DEBUG?.(`Getting authentication token from ${method.toUpperCase()} ${params.obfuscateQueryParams(url)}`);
+    const response = cert
+        ? await postTokenViaMtls(url, data, headers, { cert, key })
+        : await fetch(url, {
+            method: method.toUpperCase(),
+            body: data,
+            headers
+        });
+    if (!response.ok) {
+        throw await buildResponseError(method, url, response);
+    }
+    return parseResponseBody(response);
+}
+
+async function postToken(req, params) {
+    try {
+        return await postTokenTo(req, params);
+    } catch (e) {
+        if (e.status !== 404 || !req.url.includes(OAUTH_PATH)) {
+            throw e;
+        }
+        req.url = req.url.replace(OAUTH_PATH, OAUTH_PATH_LEGACY_TOKEN);
+        DEBUG?.(`Token endpoint not found, retrying against legacy path ${params.obfuscateQueryParams(req.url)}`);
+        return postTokenTo(req, params);
+    }
 }
 
 async function fetchToken(params) {
@@ -71,29 +150,16 @@ async function fetchToken(params) {
     let responseData, error;
     const method = 'post';
     do {
-        const { url, data, ignored } = reqParams(method, params);
+        const { req, ignored } = reqParams(method, params);
         if (Object.keys(ignored).length) {
             console.log(`Ignoring parameters for fetching token: ${Object.entries(ignored).map(([param, reason]) => `${param} (${reason})`).join(', ')}.`);
         }
-        DEBUG?.(`Getting authentication token from ${method.toUpperCase()} ${params.obfuscateQueryParams(url)}`);
         error = undefined;
         try {
-            const response = await fetch(url, {
-                method: method.toUpperCase(),
-                body: data,
-                headers: { 'content-type': 'application/x-www-form-urlencoded' }
-            });
-            if (!response.ok) {
-                throw await buildResponseError(method, url, response);
-            }
-            responseData = await parseResponseBody(response);
+            responseData = await postToken(req, params);
             break;
         } catch (e) {
-            if (e.status) {
-                error = e;
-            } else {
-                error = buildNetworkError(method, url, e);
-            }
+            error = e.status ? e : buildNetworkError(method, req.url, e);
             DEBUG?.(`HTTP status ${error.status}`);
             if (params.has('refreshToken')) {
                 DEBUG?.('Discarding invalid refresh token');
@@ -122,7 +188,7 @@ async function fetchToken(params) {
                 message += `. Ensure the client credentials are correct`;
             }
         } else {
-            message = 'error on token request';
+            message = 'token request failed';
         }
         throw new Error(message + '.', { cause: error });
     }

package/lib/mtx/params.js

@@ -178,7 +178,8 @@ class BasicParams {
         this.password               = new Param('password',               undefined, { obfuscate: ObfuscationLevel.full });
         this.clientid               = new Param('clientid',               undefined);
         this.clientsecret           = new Param('clientsecret',           undefined, { obfuscate: ObfuscationLevel.partial });
-        this.key                    = new Param('key',                    undefined, { obfuscate: ObfuscationLevel.partial }); // private key of client certificate
+        this.certificate            = new Param('certificate',            undefined, { obfuscate: ObfuscationLevel.partial }); // client certificate for mTLS
+        this.key                    = new Param('key',                    undefined, { obfuscate: ObfuscationLevel.partial }); // private key of the client certificate
         this.tokenStorage           = new Param('tokenStorage',           undefined, { allowedValues: ['plain', 'keyring'] });
         this.clearOtherTokenStorage = new Param('clearOtherTokenStorage', false, { internal: true });
         this.plain                  = new Param('plain',                  false, { internal: true }); // for backward compatibility - superseded by tokenStorage
@@ -195,7 +196,6 @@ class BasicParams {
     }
 }
 
-// TODO pass these as extra arguments to lib functions
 /**
  * All known params including those needed for specific commands.
  */
@@ -216,6 +216,7 @@ class AllParams extends BasicParams {
 
         // `login` PARAMS
         this.skipToken              = new Param('skipToken',              false, { internal: true });
+        this.directUaa              = new Param('directUaa',              false, { internal: true }); // client-credentials login goes directly to the authorization server
         this.saveRefreshToken       = new Param('saveRefreshToken',       false, { internal: true });
 
         // `logout` PARAMS

package/lib/mtx/settings_manager.js

@@ -34,9 +34,10 @@ const KEYRING_DESC = {
 };
 
 const MTX_FULLY_QUALIFIED = 'com.sap.cds.mtx';
-const OAUTH_PATH_LEGACY = '/mtx/v1/oauth/token';
-const OAUTH_PATH = '/-/cds/login/token';
-const OAUTH_META_PATH = '/-/cds/login/authorization-metadata';
+const OAUTH_PATH_LEGACY_TOKEN = '/-/cds/login/token';
+const OAUTH_PATH = '/-/cds/login/grant';
+const OAUTH_META_PATH = '/-/cds/login/grant-metadata';
+const OAUTH_UAA_PATH = '/oauth/token';
 
 const SETTINGS_DIR = path.join(os.homedir(), CONFIG_SUBDIRS[os.platform()] || '', MTX_FULLY_QUALIFIED);
 const SETTINGS_FILE = 'projects.json';
@@ -102,12 +103,40 @@ async function getTokenUrl(params, renewUrl) {
     if (!params.has('appUrl')) {
         throw 'Failed to determine token URL: app URL not given';
     }
+    if (params.has('clientid')) {
+        return deriveUaaTokenUrl(params);
+    }
     return appUrlWith(OAUTH_PATH, params);
 }
 
-async function fetchPasscodeUrl(params) {
+function uaaTokenUrl(passcodeUrl, { mtls } = {}) {
+    const url = new URL(passcodeUrl);
+    url.pathname = url.pathname.replace(/\/passcode\/*$/, '').replace(/\/+$/, '') + OAUTH_UAA_PATH;
+    url.search = '';
+    if (mtls) {
+        url.hostname = url.hostname.replace(/\.authentication\./, '.authentication.cert.');
+    }
+    return url.toString();
+}
+
+async function deriveUaaTokenUrl(params) {
+    const mtls = params.has('key');
+    const metadata = await fetchAuthMetadata(params);
+    const announced = mtls ? metadata?.cert_token_url : metadata?.token_url;
+    const passcodeUrl = metadata?.passcode_url;
+    const tokenUrl = announced ?? (passcodeUrl && uaaTokenUrl(passcodeUrl, { mtls }));
+    if (!tokenUrl) {
+        throw 'Cannot determine the authorization server for client-credentials login. ' +
+            'Ensure MTX is running with extensibility enabled and up to date.';
+    }
+    params.set('directUaa', true);
+    DEBUG?.(`Derived authorization-server token URL for ${mtls ? 'mTLS' : 'client-credentials'} login: ${tokenUrl}`);
+    return tokenUrl;
+}
+
+async function fetchAuthMetadata(params) {
     let fetchUrl = appUrlWith(OAUTH_META_PATH, params);
-    DEBUG?.(`Trying to get passcode URL from GET`, fetchUrl);
+    DEBUG?.(`Trying to get authorization metadata from GET`, fetchUrl);
     if (params.has('subdomain')) {
         const u = new URL(fetchUrl);
         u.searchParams.set('subdomain', params.get('subdomain'));
@@ -124,10 +153,10 @@ async function fetchPasscodeUrl(params) {
         if (error.status === 404) {
             DEBUG?.(`Request unsupported by server, ignoring (${error.message.replace(/ *Details:.*/s, '')})`);
         } else if (error.status) {
-            DEBUG?.(getMessage(`Getting passcode URL failed`, { error }));
+            DEBUG?.(getMessage(`Getting authorization metadata failed`, { error }));
         } else {
             const netError = buildNetworkError('GET', fetchUrl, error);
-            DEBUG?.(getMessage(`Getting passcode URL failed`, { error: netError }));
+            DEBUG?.(getMessage(`Getting authorization metadata failed`, { error: netError }));
         }
         return undefined;
     }
@@ -139,7 +168,7 @@ async function fetchPasscodeUrl(params) {
         DEBUG?.(`Unsupported signed metadata received. Since these should take precedence, ignoring response.`);
         return undefined;
     }
-    return responseData.passcode_url;
+    return responseData;
 }
 
 function getKeyringAccountName(params) {
@@ -289,8 +318,9 @@ class SettingsManager {
         }
         async function updateTokenUrl() {
             const tokenUrl = secure(params.get('tokenUrl'), 'token URL');
+            const machineLogin = params.has('clientid');
             const renewUrl = !logout && !params.get('skipToken')
-                && (!tokenUrl || tokenUrl.includes('//-/cds') || tokenUrl.includes(OAUTH_PATH_LEGACY)
+                && (machineLogin || !tokenUrl || tokenUrl.includes('//-/cds') || !tokenUrl.includes(OAUTH_PATH)
                     || params.get('appUrl') !== loadedSettings.get('appUrl')
                     || params.get('subdomain') !== loadedSettings.get('subdomain'));
             if (renewUrl) {
@@ -303,7 +333,6 @@ class SettingsManager {
                 }
             }
         }
-
         await updateAppUrl();
         await updateTokenUrl();
     }
@@ -353,16 +382,9 @@ class SettingsManager {
                 throw 'Clientsecret cannot be empty';
             }
         }
-        async function addKey() {
-            params.set('key', await Question.askQuestion('key: ', undefined, true));
-            console.log();
-            if (params.get('key') === '') {
-                throw 'Key cannot be empty';
-            }
-        }
         async function addPasscode() {
             if (!params.has('passcodeUrl')) {
-                const passcodeUrl = await fetchPasscodeUrl(params);
+                const passcodeUrl = (await fetchAuthMetadata(params))?.passcode_url;
                 if (passcodeUrl) {
                     params.set('passcodeUrl', passcodeUrl);
                 }
@@ -440,15 +462,8 @@ class SettingsManager {
             return;
         }
 
-        if (params.get('clientid') && !logout) {
-            if (params.has('key')) {
-                if (params.get('key') === 'ask') {
-                    params.delete('key');
-                    await addKey();
-                }
-            } else if (!params.has('clientsecret')) {
-                await addClientSecret();
-            }
+        if (params.get('clientid') && !logout && !params.has('clientsecret') && !params.has('key')) {
+            await addClientSecret();
         }
 
         await addAuthSettings();
@@ -714,5 +729,7 @@ class SettingsManager {
 module.exports = {
     SettingsManager,
     other,
-    notifyLogin
+    notifyLogin,
+    OAUTH_PATH,
+    OAUTH_PATH_LEGACY_TOKEN
 };

package/lib/mtx/tenant_action.js

@@ -20,7 +20,6 @@ const DEFAULT_LOCALHOST_PASSWORD = '';
 
 module.exports = class TenantAction {
 
-    // TODO JSDoc
     /**
      * @param command {string} the command to execute: 'subscribe', 'upgrade' or 'unsubscribe'
      */

package/lib/mtx/util/credentials.js

@@ -0,0 +1,62 @@
+const CLIENT_ID_ENV = 'CDS_LOGIN_CLIENT_ID';
+const CLIENT_SECRET_ENV = 'CDS_LOGIN_CLIENT_SECRET';
+const CLIENT_CERT_ENV = 'CDS_LOGIN_CLIENT_CERT';
+const CLIENT_KEY_ENV = 'CDS_LOGIN_CLIENT_KEY';
+
+function clientId(inlineId) {
+    const clientid = inlineId ?? process.env[CLIENT_ID_ENV];
+    if (!clientid) {
+        throw `Client ID required: pass it as --client <id> or via the ${CLIENT_ID_ENV} environment variable.`;
+    }
+    return clientid;
+}
+
+function splitFirst(value, separator) {
+    const i = value.indexOf(separator);
+    return i === -1 ? [value, undefined] : [value.slice(0, i), value.slice(i + separator.length)];
+}
+
+/**
+ * Resolve `--client` credentials, each part falling back to the environment
+ * (`CDS_LOGIN_CLIENT_ID`/`CDS_LOGIN_CLIENT_SECRET`). Splits on the first colon only;
+ * an empty client ID (`:secret`) is rejected.
+ * @returns {{ clientid?: string, clientsecret?: string }}
+ */
+function clientCredentials(clientOption) {
+    if (!clientOption) {
+        return {};
+    }
+    const [id, secret] = typeof clientOption === 'string' ? splitFirst(clientOption, ':') : [];
+    return { clientid: clientId(id), clientsecret: secret ?? process.env[CLIENT_SECRET_ENV] };
+}
+
+/**
+ * Resolve `--mtls` credentials: client ID inline or from `CDS_LOGIN_CLIENT_ID`,
+ * certificate and key only from `CDS_LOGIN_CLIENT_CERT`/`CDS_LOGIN_CLIENT_KEY`.
+ * An inline `:key` is rejected.
+ * @returns {{ clientid?: string, certificate?: string, key?: string }}
+ */
+function clientCertificate(mtlsOption) {
+    if (!mtlsOption) {
+        return {};
+    }
+    if (typeof mtlsOption === 'string' && mtlsOption.includes(':')) {
+        throw `The client key cannot be passed on the command line. Pass only the client ID as --mtls <id>, and provide the certificate and key via the ${CLIENT_CERT_ENV} and ${CLIENT_KEY_ENV} environment variables.`;
+    }
+    const id = typeof mtlsOption === 'string' ? mtlsOption : undefined;
+    const certificate = process.env[CLIENT_CERT_ENV];
+    const key = process.env[CLIENT_KEY_ENV];
+    if (!certificate || !key) {
+        throw `Client certificate and key required: set the ${CLIENT_CERT_ENV} and ${CLIENT_KEY_ENV} environment variables.`;
+    }
+    return { clientid: clientId(id), certificate, key };
+}
+
+module.exports = {
+    clientCredentials,
+    clientCertificate,
+    CLIENT_ID_ENV,
+    CLIENT_SECRET_ENV,
+    CLIENT_CERT_ENV,
+    CLIENT_KEY_ENV
+};

package/node_modules/@cap-js/db-service/CHANGELOG.md

@@ -4,6 +4,23 @@
 - The format is based on [Keep a Changelog](http://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [3.1.0](https://github.com/cap-js/cds-dbs/compare/db-service-v3.0.1...db-service-v3.1.0) (2026-09-07)
+
+
+### Added
+
+* rank $search results by relevance ([#1725](https://github.com/cap-js/cds-dbs/issues/1725)) ([bc93160](https://github.com/cap-js/cds-dbs/commit/bc931601a721f7c9e00b89e6844ba064352b541d))
+
+
+### Fixed
+
+* **cqn4sql:** reject overly nested query expressions instead of crashing ([#1712](https://github.com/cap-js/cds-dbs/issues/1712)) ([29a45b7](https://github.com/cap-js/cds-dbs/commit/29a45b7daadbc77433b882148700d73c00efae62))
+* don't throw when releasing/destroying a resource that's no longer in the pool ([#1696](https://github.com/cap-js/cds-dbs/issues/1696)) ([5d3b277](https://github.com/cap-js/cds-dbs/commit/5d3b277a1cf7cac02e41f2f24975a8e9473e5b5e))
+* exclude cds.Vector from wildcard select expansion ([#1716](https://github.com/cap-js/cds-dbs/issues/1716)) ([398bacc](https://github.com/cap-js/cds-dbs/commit/398bacc2a74883dcd93acba288deae362570a4c1))
+* INSERT.from(SELECT) used non-existent `value`  ([#1565](https://github.com/cap-js/cds-dbs/issues/1565)) ([fd98844](https://github.com/cap-js/cds-dbs/commit/fd98844c83a78d6cf2b0b71344d3ee1d88528106))
+* **pool:** recover lost connection after stale acquire timeout ([#1724](https://github.com/cap-js/cds-dbs/issues/1724)) ([cf6af99](https://github.com/cap-js/cds-dbs/commit/cf6af991d02be7cf5f861e2a424d4d733b8f9238))
+* pql groupby path expression ([#1700](https://github.com/cap-js/cds-dbs/issues/1700)) ([82b5e03](https://github.com/cap-js/cds-dbs/commit/82b5e0385e680321f30c352f0f78ade6d25259a6))
+
 ## [3.0.1](https://github.com/cap-js/cds-dbs/compare/db-service-v3.0.0...db-service-v3.0.1) (2026-06-29)
 
 

package/node_modules/@cap-js/db-service/lib/common/generic-pool.js

@@ -150,7 +150,7 @@ constructor (factory, options = {}) {
       return
     }
     const loan = this._loans.get(resource)
-    if (!loan) throw new Error('Resource not currently part of this pool')
+    if (!loan) return
     this._loans.delete(resource)
     const pooledResource = loan.pooledResource
     pooledResource.idle()
@@ -164,7 +164,7 @@ constructor (factory, options = {}) {
       return
     }
     const loan = this._loans.get(resource)
-    if (!loan) throw new Error('Resource not currently part of this pool')
+    if (!loan) return
     this._loans.delete(resource)
     const pooledResource = loan.pooledResource
     await this.#destroy(pooledResource)
@@ -212,16 +212,13 @@ constructor (factory, options = {}) {
       for (let i = 0; i < needed; i++) this.#createResource()
     }
     const dispense = async resource => {
-      const request = this._queue.shift()
+      let request = this._queue.shift()
+      while (request && request.state !== RequestState.PENDING) request = this._queue.shift()
       if (!request) {
         resource.idle()
         this._available.add(resource)
         return false
       }
-      if (request.state !== RequestState.PENDING) {
-        this.#dispense()
-        return false
-      }
       this._loans.set(resource.obj, { pooledResource: resource })
       resource.update(ResourceState.ALLOCATED)
       request.resolve(resource.obj)

package/node_modules/@cap-js/db-service/lib/cqn2pql.js

@@ -18,7 +18,7 @@ class CQN2PQLRenderer extends CQN2SQL {
 
   column_expr(x, q) {
     // omit alias when target is a single source
-    if (q.SELECT.from.ref && x?.ref) x.ref = x.ref.slice(-1)
+    if (q.SELECT.from?.ref && x?.ref) x.ref = x.ref.slice(-1)
     return super.column_expr(x, q)
   }
 

package/node_modules/@cap-js/db-service/lib/cqn2sql.js

@@ -1088,7 +1088,7 @@ class CQN2SQLRenderer {
 
     const extractions = this._managed = this.managed(columns.map(c => ({ name: c, sql: `NEW.${this.quote(c)}` })), elements)
     const sql = extractions.length > columns.length
-      ? `SELECT ${extractions.map(c => `${c.insert} AS ${this.quote(c.name)}`)} FROM (${this.SELECT(src)}) AS NEW`
+      ? `SELECT ${extractions.map((c, i) => `${i < columns.length ? c.insert : c.onInsert} AS ${this.quote(c.name)}`)} FROM (${this.SELECT(src)}) AS NEW`
       : this.SELECT(src)
     if (extractions.length > columns.length) columns = this.columns = extractions.map(c => c.name)
     this.sql = `INSERT INTO ${this.quote(entity)}${alias ? ' as ' + this.quote(alias) : ''} (${columns.map(c => this.quote(transitions.mapping.get(c)?.ref?.[0] || c))}) ${sql}`
@@ -1161,12 +1161,12 @@ class CQN2SQLRenderer {
       const extractions = this._managed
       if (this.values) this.values = [] // Clear previously computed values
       const src = this.cqn4sql(UPSERT.from || UPSERT.as)
-      const aliasedQuery = cds.ql.SELECT
-        .columns(src.SELECT.columns
-          .map((c, i) => ({ ref: [this.column_name(c)], as: this.columns[i] }))
-        )
-        .from(src)
-      sql = `SELECT ${extractions.map(c => `${c.upsert}`)} FROM (${this.SELECT(aliasedQuery)}) AS NEW LEFT JOIN ${this.quote(entity)} AS OLD ON ${keyCompare}`
+      const aliasedQuery = `SELECT ${[
+        ...src.SELECT.columns.map((c, i) => this.column_expr({ ref: [this.column_name(c)], as: this.columns[i] })),
+        ...extractions.slice(src.SELECT.columns.length).map(c => `${elements[c.name].key ? c.onInsert : 'NULL'} AS ${this.quote(c.name)}`), // fill in missing default values
+      ]} FROM (${this.SELECT(src)})`
+
+      sql = `SELECT ${extractions.map(c => elements[c.name].key ? `NEW.${this.quote(c.name)}` : c.upsert)} FROM(${aliasedQuery}) AS NEW LEFT JOIN ${this.quote(entity)} AS OLD ON ${keyCompare} `
       if (extractions.length > columns.length) columns = this.columns = extractions.map(c => c.name)
       this.entries = [this.values]
     }
@@ -1574,9 +1574,11 @@ class CQN2SQLRenderer {
 
   managed_extract(name, element, converter) {
     const { UPSERT, INSERT } = this.cqn
-    const extract = !(INSERT?.entries || UPSERT?.entries) && (INSERT?.rows || UPSERT?.rows)
-      ? `value->>${this.string(`$[${this.columns.indexOf(name)}]`)}`
-      : `value->>${this.string(`$.${JSON.stringify(name)}`)}`
+    const extract = (INSERT?.entries || UPSERT?.entries)
+      ? `value->>${this.string(`$.${JSON.stringify(name)}`)}`
+      : (INSERT?.rows || UPSERT?.rows)
+        ? `value->>${this.string(`$[${this.columns.indexOf(name)}]`)}`
+        : `NEW.${this.quote(name)}` // in case of (INSERT?.from || UPSERT?.from)
     const sql = converter?.(extract) || extract
     return { extract, sql }
   }
@@ -1587,7 +1589,9 @@ class CQN2SQLRenderer {
   }
 
   managed_default(name, managed, src) {
-    return `(CASE WHEN json_type(value,${this.managed_extract(name).extract.slice(8)}) IS NULL THEN ${managed} ELSE ${src} END)`
+    const { UPSERT, INSERT } = this.cqn
+    const isJson = INSERT?.entries || UPSERT?.entries || INSERT?.rows || UPSERT?.rows
+    return `(CASE WHEN ${isJson ? `json_type(value,${this.managed_extract(name).extract.slice(8)})` : `NEW.${this.quote(name)}`} IS NULL THEN ${managed} ELSE ${src} END)`
   }
 }