@sap/cds 8.8.3 → 8.9.1

package/CHANGELOG.md

@@ -4,6 +4,50 @@
 - The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](https://semver.org/).
 
+## Version 8.9.1 - 2025-04-03
+
+### Fixed
+
+- `cds.env` merging for `null` values
+- Best-effort mechanisms for lambda support on OData V2 remote services (usage of functions in lambda expressions)
+- Use extended model in `enterprise-messaging` inbound handlers
+
+## Version 8.9.0 - 2025-03-31
+
+### Added
+
+- Support for parallel multi-instance processing of outbox entries
+- Remote services: ensure request correlation by guaranteeing outgoing header `x-correlation-id`
+- Support for `@odata.bind` to reference foreign keys
+- Support for plugins in ESM format
+- Dependency to `@eslint/js` so that `eslint` works w/o the application having to install it.
+- IAS: In the `client_credentials` flow, the array of `ias_apis` (if present) is added to the technical user's roles
+- Opt-in feature `cds.features.consistent_params` for `req.params` always being an array of objects
+  + That is, no more plain values for single-keyed entities with key `ID`
+  + Will become the default in `@sap/cds^9`
+
+### Changed
+
+- Invalid draft requests now have status code 400
+- Allow ESM loading of handler files (`.js`, `.ts`) in all situations, incl. test runs with Jest's `--experimental-vm-modules` option.
+- Application and remote services now throw the error `Target <yourTarget> cannot be resolved for service <yourService>` when the query cannot be resolved to the service entity. Setting the feature flag `cds.env.features.restrict_service_scope` to false disables this.
+- Accept 2xx status codes set in custom operation handlers
+- Implicit orderby elements are marked as such and are no longer considered for requests to remote services
+
+### Fixed
+
+- Lean draft: Proper navigation to the service entity of draft-administrative data
+- Unprocessed foreign keys from expressions of semi join conditions in `UPDATE.data`
+- Kafka: Each topic will have a dedicated consumer-group id (configurable with `consumerGroup`)
+- Foreign-key calculation based on navigation path
+- `cds.env` shortcuts like `cds.requires.db === 'hana'` are normalized to `cds.requires.db.kind === 'hana'` when combined from multiple sources
+- Error handling for invalid access of an entity that does not have a key, by key, through REST
+- `cds.validate` crashed with unknown target
+- `cds.parse.expr` parsed SAP HANA native functions like `current_utctimestamp` erroneously as `ref`
+- `null` values in logger if `custom_fields` are configured
+- User-provided instances of SAP Cloud Logging should have either tag `cloud-logging` or `Cloud Logging`
+- The `@odata.context` for entities and views with parameters should refer to the EntityType with `/Set` at the end e.g. `../$metadata#ViewWithParamType(1)/Set`
+
 ## Version 8.8.3 - 2025-03-20
 
 ### Fixed
@@ -31,7 +75,7 @@
 - Add missing 'and' between conditions in object notation of QL
 - Multiline payloads in `$batch` sub requests
 - Instance-based authorization for modeling like `$user.<property> is null`
-- Respect `cds.odata.contextAbsoluteUrl` in new OData adapter 
+- Respect `cds.odata.contextAbsoluteUrl` in new OData adapter
 - `cds.odata.context_with_columns` also applies to singletons
 
 ## Version 8.8.0 - 2025-03-03
@@ -46,9 +90,9 @@
 - Support implicit function parameters calls with @prefix
 - `cds.test` now uses package `@cap-js/cds-test` if installed, otherwise prints a hint to install it. With cds 9, this package will be required.
 - Operation response streaming
-  + OData: Operations returning `cds.LargeBinary` annotated with `@Core.MediaType` may send stream responses. 
-  + REST: Operations may send stream responses. 
-  + Annotations `@Core.MediaType`, `@Core.ContentDisposition.Filename` and `@Core.ContentDisposition.Type` on operation return types will be considered. 
+  + OData: Operations returning `cds.LargeBinary` annotated with `@Core.MediaType` may send stream responses.
+  + REST: Operations may send stream responses.
+  + Annotations `@Core.MediaType`, `@Core.ContentDisposition.Filename` and `@Core.ContentDisposition.Type` on operation return types will be considered.
 
 ### Changed
 

package/_i18n/i18n_en_US_saptrc.properties

@@ -70,6 +70,9 @@ LanguageCode=NhI8Yd8pNFS7omWQsk5aJw_Language Code
 #XTIT: Language Code Description
 LanguageCode.Description=ajmXdjo3lK0nfaMLCpvPMw_Language code as specified by ISO 639-1
 
+#XTIT Time zone code
+TimeZoneCode=Y0KTpmsmzoysYLT6jDQEkQ_Time Zone Code
+
 #XTIT: User Identifier
 UserID=cjI0FCsEZ2aD8ERc6G/xZw_User ID
 

package/bin/colors.js

@@ -0,0 +1,2 @@
+// to have same structure as in @sap/cds-test
+module.exports = require('../lib/utils/colors')

package/bin/test.js

@@ -1,97 +1,125 @@
 #!/usr/bin/env node
-
-module.exports = Object.assign ( test, {
-  options: [
-    '--files',
-    '--include',
-    '--exclude',
-    '--pattern',
-    '--skip',
-  ],
-  flags: [
-    '--verbose',
-    '--unmute',
-    '--silent',
-    '--quiet',
-    '--list',
-    '--recent',
-    '--passed',
-    '--failed',
-  ],
-  shortcuts: [ '-f', '-i', '-x', '-p', null, '-v', '-u', '-s', '-q', '-l' ],
-  help: `
-`})
-
-
 /* eslint-disable no-console */
-const { DIMMED, RESET } = require('../lib/utils/colors')
 
-async function test (argv,o) {
-  const _recent = require('os').userInfo().homedir + '/.cds-test-recent.json'
-  const recent = require('fs').existsSync(_recent) ? require(_recent) : {}
-  if (!o.recent) {
-    o.files = await find (argv, o, recent)
-  } else {
-    Object.assign (o,recent.options)
-    console.log ('\nchest',...o.argv)
-  }
-  if (o.list) return list (o.files)
-  if (o.skip) process.env._chest_skip = o.skip
-  if (o.files.length > 1) console.log(DIMMED,`\nRunning ${o.files.length} test suite${o.files.length > 1 ? 's' : ''}...`, RESET)
-  const test = require('node:test').run({ ...o, concurrency:true })
-  require('../lib/test/reporter')(test, test.options = o)
+const options = {
+  'timeout':  { type:'string',  short:'t' },
+  'verbose':  { type:'boolean', short:'v' },
+  'unmute':   { type:'boolean', short:'u' },
+  'silent':   { type:'boolean', short:'s' },
+  'quiet':    { type:'boolean', short:'q' },
+  'list':     { type:'boolean', short:'l' },
+  'recent':   { type:'boolean' },
+  'passed':   { type:'boolean' },
+  'failed':   { type:'boolean' },
+  'match':    { type:'string', default: '(.test.js|.spec.js)$' },
+  'skip':     { type:'string', default: '^(gen,*.tmp)$' },
+  'only':     { type:'string'},
+  'help':     { type:'boolean', short:'h' },
+  'workers':  { type:'string', short:'w' },
 }
 
+const USAGE = `
+Usage:
 
-async function find (argv,o,recent) {
+  cds test [ options ] [ patterns ]
 
-  // pre-process options
-  const { pattern = '.spec.js,.test.js', include, exclude = '_out' } = o,
-    patterns = pattern?.split(',') || [],
-    includes = include?.split(',') || [],
-    excludes = exclude?.split(',') || []
+Options:
 
-  // return recent results if --passed or --failed is used
-  if (o.passed) return recent.passed
-  if (o.failed) return recent.failed
+  -l, --list     List found test files
+  -q, --quiet    No output at all
+  -s, --silent   No output
+  -t, --timeout  in milliseconds
+  -u, --unmute   Unmute output
+  -v, --verbose  Increase verbosity
+  -w, --workers  Specify number of workers
+  -?, --help     Displays this usage info
 
-  // check if argv is a list of files or directories
-  const {lstat} = require('fs').promises, files=[], roots=[]
-  await Promise.all (argv.map (async x => {
-    let ls = await lstat(x).catch(()=>{})
-    if (!ls) return includes.push(x)
-    if (ls.isDirectory()) return roots.push(x.replace(/\/$/,''))
-    if (ls.isFile()) return files.push(x)
-    else return includes.push(x)
-  }))
-  if (files.length && !roots.length && !includes.length) return files //> all files resolved
+  --match        Pick matching files, default: ${options.match.default}
+  --skip         Skip matching files, default: ${options.skip.default}
+  --only         Run only the matching tests
+  --failed       Repeat recently failed test suite(s)
+  --passed       Repeat recently passed test suite(s)
+  --recent       Repeat recently run test suite(s)
+`
 
-  // Prepare UNIX find command to fetch matching files
-  let find = `find -L ${roots.join(' ')||'.'} -type f`
-  if (patterns.length) find += ` \\( ${ patterns.map (p=>`-name "${p.replace(/^([^*])/,'*$1')}"`).join(' -o ') } \\)`
-  if (includes.length) find += ` \\( ${ includes.map (p=>`-regex .*${p.replace(/\./g,'\\\\.')}.*`).join(' -o ') } \\)`
-  if (excludes.length) find += ` \\( ${ excludes.map (x=>`! -regex .*${x.replace(/\./g,'\\\\.')}.*`).join(' ') } \\)`
+const { DIMMED, YELLOW, GRAY, RESET } = require('./colors')
+const regex4 = s => !s ? null : RegExp (s.replace(/[,.*]/g, s => ({ ',': '|', '.': '\\.', '*': '.*' })[s]))
+const recent = () => {try { return require(home+'/.cds-test-recent.json') } catch {/* egal */}}
+const os = require('os'), home = os.userInfo().homedir
 
-  // Execute find command and return list of files
-  const exec = require('node:util') .promisify (require('node:child_process').exec)
-  const { stdout } = await exec (find)
-  return files.concat (stdout.split('\n').slice(0, -1).sort())
+async function test (argv,o) {
+  if (o.help || argv == '?') return console.log (USAGE)
+  if (o.recent) o = { ...o, ...recent().options }
+  if (o.passed) o.files = recent().passed
+  if (o.failed) o.files = recent().failed
+  if (!o.files) o.files = await fetch (argv,o)
+  if (o.list) return list (o.files)
+  if (o.skip) process.env._chest_skip = o.skip
+  if (o.files.length > 1) console.log (DIMMED,`\nRunning ${o.files.length} test suites...`, RESET)
+  const test = require('node:test').run({ ...o,
+    execArgv: [ '--require', require.resolve('../lib/fixtures/node-test.js') ],
+    timeout: +o.timeout || undefined,
+    concurrency: +o.workers || true,
+    testNamePatterns: regex4 (o.only), only: false,
+  })
+  require('./reporter')(test, test.options = o)
 }
 
+async function fetch (argv,o) {
+  const patterns = regex4 (argv.join('|')) || { test: ()=> true }
+  const tests = regex4 (o.match || options.match.default) || { test: ()=> true }
+  const skip = regex4 (o.skip || options.skip.default) || { test: ()=> false }
+  const ignore = /^(\..*|node_modules|_out)$/
+  const files = []
+  const fs = require('node:fs'), path = require('node:path')
+  const _read = fs.promises.readdir
+  const _isdir = x => fs.statSync(x).isDirectory()
+  await async function _visit (dir) {
+    const entries = await _read (dir)
+    return Promise.all (entries.map (each => {
+      if (ignore.test(each) || skip.test(each = path.join (dir,each))) return
+      if (tests.test(each)) return patterns.test(each) && files.push(each)
+      if (_isdir(each)) return _visit (each)
+    }))
+  } (process.cwd())
+  if (!files.length) throw YELLOW+`\n No matching test files found. \n`+RESET
+  return files
+}
 
 function list (files) {
   const { relative } = require('node:path'), cwd = process.cwd()
+  const time = (performance.now() / 1000).toFixed(3)
   console.log()
-  console.log(`Found ${files.length} test file${files.length > 1 ? 's' : ''}:`, DIMMED, '\n')
+  console.log(`Found these matching test files:`, DIMMED, '\n')
   for (let f of files) console.log('  ', relative(cwd, f))
-  console.log(RESET)
+  console.log(RESET+'\n', files.length, 'total')
+  console.log(GRAY, time+'s', RESET, '\n')
 }
 
 
-if (!module.parent) try {
-  const [ argv, options ] = require('./args') (test, process.argv.slice(2))
-  test (argv, options)
-} catch (err) {
-  console.error(err) // eslint-disable-line no-console
-  process.exitCode = 1
+if (!module.parent) {
+  const { positionals, values } = require('node:util').parseArgs ({ options, allowPositionals: true })
+  test (positionals, values) .catch (e => console.error(e), process.exitCode = 1)
 }
+
+else module.exports = Object.assign ( test, {
+  options: [
+    '--files',
+    '--match',
+    '--skip',
+    '--timeout',
+    '--workers',
+  ],
+  flags: [
+    '--verbose',
+    '--unmute',
+    '--silent',
+    '--quiet',
+    '--list',
+    '--recent',
+    '--passed',
+    '--failed',
+  ],
+  shortcuts: [ '-f', null, null, '-t', '-w', '-v', '-u', '-s', '-q', '-l' ],
+  help: USAGE
+})

package/eslint.config.mjs

@@ -1,3 +1,11 @@
+import eslint_js from '@eslint/js'
+
+/**
+ * Makes the eslint config object available for external use.
+ */
+export const eslint = eslint_js.configs
+
+
 /**
  * Recommended ESLint config for @sap/cds projects.
  */
@@ -118,10 +126,14 @@ export const ignores = [
  * monorepo, other cap impl projects, as well as in cap-based projects.
  * Currently the same as internal, could differ in the future.
  */
-export const recommended = [ defaults, browser, tests, {ignores} ]
-await import('@eslint/js').then( // add recommended eslint rules if available
-  ({default:eslint}) => recommended.unshift (eslint.configs.recommended)
-).catch(()=>{})
+export const recommended = [
+  eslint.recommended,
+  defaults,
+  browser,
+  tests,
+  { ignores },
+  { files: ['bin/*.js'], rules: { 'no-console': 'off' } },
+]
 
 /**
  * Default export is for internal use in @sap/cds and cap/dev projects.

package/lib/compile/for/lean_drafts.js

@@ -142,6 +142,10 @@ module.exports = function cds_compile_for_lean_drafts(csn) {
         if (e._target['@odata.draft.enabled'] === false) continue // happens for texts if @fiori.draft.enabled is not set
         _redirect(newEl, addDraftEntity(e._target, model))
       }
+      if (e.name === 'DraftAdministrativeData') {
+        // redirect to DraftAdministrativeData service entity
+        _redirect(newEl, active._service.entities.DraftAdministrativeData)
+      }
       Object.defineProperty (newEl,'parent',{value:draft,enumerable:false, configurable: true, writable: true})
 
       for (const key in newEl) {

package/lib/compile/parse.js

@@ -25,7 +25,7 @@ exports.cql = function cql (x,...etc) { try {
 exports.path = function path (x,...etc) {
   if (x.raw) return parse.ttl (path, x,...etc)
   if (cds.model?.definitions[x]) return {ref:[x]}
-  if (/^([\w_.$]+)$/.test(x)) return {ref:[x]} // optimized parsing of simple paths of length 1
+  if (/^([\w_.$]+)$/.test(x)) return {ref:[x]}  // optimized parsing of simple paths of length 1
   const [,head,tail] = /^([\w._]+)(?::(\w+))?$/.exec(x)||[]
   if (tail) return {ref:[head,...tail.split('.')]}
   if (head) return {ref:[head]}
@@ -36,11 +36,11 @@ exports.path = function path (x,...etc) {
 exports.expr = function expr (x,...etc) {
   if (x.raw) return parse.ttl (expr, x,...etc)
   if (typeof x !== 'string') throw cds.error.expected `${{x}} to be an expression string`
-  if (x in globals) return globals[x]                      // optimized parsing of true, false, null
-  if (/^([\d.]+)$/.test(x)) return {val:Number(x)}        // optimized parsing of numeric vals
-  if (/^([\w_$]+)$/.test(x)) return {ref:[x]}            // optimized parsing of simple refs of length 1
-  if (/^([\w_.$]+)$/.test(x)) return {ref:x.split('.')} // optimized parsing of simple refs of length > 1
-  try { return cdsc.parse.expr(x,undefined,{ messages:[], ...etc[0] }) } catch(e) {
+  if (x in globals) return globals[x]                         // optimized parsing of true, false, null
+  if (/^([\d.]+)$/.test(x)) return {val:Number(x)}           // optimized parsing of numeric vals
+  if (/^([\w_$]+)$/.test(x)) return native[x] || {ref:[x]}  // optimized parsing of simple refs of length 1
+  if (/^([\w_.$]+)$/.test(x)) return {ref:x.split('.')}    // optimized parsing of simple refs of length > 1
+  try { return cdsc.parse.expr (x,undefined,{ messages:[], ...etc[0] }) } catch(e) {
     // cds-compiler v5 does not put messages into `e.message` anymore; render them explicitly
     e.message = !e.messages ? e.message : e.toString();
     e.message = e.message.replace('<expr>.cds:1:',`In '${e.expr = x}' at `)
@@ -108,6 +108,26 @@ exports._select = (prefix, ttl, suffix) => {
   return cds.parse.cql (strings, ...values).SELECT
 }
 
+const native = {
+  current_date         : { func: 'current_date' },
+  current_time         : { func: 'current_time' },
+  current_timestamp    : { func: 'current_timestamp' },
+  current_user         : { func: 'current_user' },
+  current_utcdate      : { func: 'current_utcdate' },
+  current_utctime      : { func: 'current_utctime' },
+  current_utctimestamp : { func: 'current_utctimestamp' },
+  session_user         : { func: 'session_user' },
+  sysuuid              : { func: 'sysuuid' },
+  CURRENT_DATE         : { func: 'current_date' },
+  CURRENT_USER         : { func: 'current_user' },
+  CURRENT_TIME         : { func: 'current_time' },
+  CURRENT_TIMESTAMP    : { func: 'current_timestamp' },
+  CURRENT_UTCDATE      : { func: 'current_utcdate' },
+  CURRENT_UTCTIME      : { func: 'current_utctime' },
+  CURRENT_UTCTIMESTAMP : { func: 'current_utctimestamp' },
+  SESSION_USER         : { func: 'session_user' },
+  SYSUUID              : { func: 'sysuuid' },
+}
 const is_cqn = x => typeof x === 'object' && (
   'ref' in x ||
   'val' in x ||

package/lib/env/cds-env.js

@@ -470,7 +470,9 @@ function _merge (dst, src, _profiles) {
       else _merge (dst[p], v, _profiles)
       continue
     }
-
+    else if (typeof v === 'string' && typeof dst[p] === 'object' && dst[p]?.kind) {
+      dst[p].kind = v  // requires.db = 'foo' -> requires.db.kind = 'foo'
+    }
     else if (v !== undefined) dst[p] = v
   }
   if (profiled.length > 0 && !_profiles.has('production')) {

package/lib/env/cds-requires.js

@@ -1,4 +1,3 @@
-const { deprecated: cds_utils_deprecated } = require('../utils/cds-utils')
 const _runtime = '@sap/cds/libx/_runtime'
 
 exports = module.exports = {
@@ -81,12 +80,10 @@ const _authentication_strategies = {
 
 for (let each of Object.values(_authentication_strategies)) {
   Object.defineProperty (each, 'strategy', {get() {
-    if (process.env.NODE_ENV !== 'production') cds_utils_deprecated({ old: 'auth.strategy', use: 'auth.kind' })
     return { jwt: 'JWT', mocked: 'mock' }[this.kind] || this.kind
   }})
 }
 
-
 const _services = {
 
   "app-service": {

package/lib/env/schemas/cds-rc.js

@@ -820,6 +820,17 @@ module.exports = {
           description: `Specifies whether the extension linter includes existing extensions. Default will be 'true' with the next major release.`,
           default: false
         },
+        'activate': {
+          type: 'object',
+          description: 'Activation settings',
+          additionalProperties: false,
+          properties: {
+            'skip-db': {
+              type: 'boolean',
+              description: 'Skip database activation.'
+            }
+          }
+        },
         'element-prefix': {
           type: 'array',
           description: 'Field names must start with one of these strings.',

package/lib/log/format/aspects/cls.js

@@ -9,6 +9,7 @@ cls_aspect.cf = () => [...cds.env.log.cls_custom_fields]
 const VCAP_SERVICES = process.env.VCAP_SERVICES ? JSON.parse(process.env.VCAP_SERVICES) : {}
 
 module.exports =
-  VCAP_SERVICES['cloud-logging'] || VCAP_SERVICES['user-provided']?.find(e => e.tags.includes('cloud-logging'))
+  VCAP_SERVICES['cloud-logging'] ||
+  VCAP_SERVICES['user-provided']?.find(e => e.tags.includes('cloud-logging') || e.tags.includes('Cloud Logging'))
     ? cls_aspect
     : () => {}

package/lib/log/format/json.js

@@ -29,7 +29,7 @@ const _extract_custom_fields_and_categories = (args, toLog, custom_fields) => {
     let filter4removed = false
     for (let i = 0; i < args.length; i++) {
       const arg = args[i]
-      if (typeof arg !== 'object') continue
+      if (typeof arg !== 'object' || arg === null) continue
       if ((custom_fields.size && _is_custom_fields(arg, custom_fields)) || _is_categories(arg)) {
         Object.assign(toLog, arg)
         args[i] = $remove

package/lib/plugins.js

@@ -35,9 +35,8 @@ exports.activate = async function () {
   const { plugins } = cds.env, { local } = cds.utils
   const loadPlugin = async ([plugin, conf]) => {
     DEBUG?.(`loading plugin ${plugin}:`, { impl: local(conf.impl) })
-    // TODO: support ESM plugins. But see cap/cds/pull/1838#issuecomment-1177200 !
-    const p = require (conf.impl)
-    if(p.activate) {
+    const p = cds.utils._import (conf.impl)
+    if (p.activate) {
       cds.log('plugins').warn(`WARNING: \n
   The @sap/cds plugin ${conf.impl} contains an 'activate' function, which is deprecated and won't be
   supported in future releases. Please rewrite the plugin to return a Promise within 'module.exports'.

package/lib/ql/SELECT.js

@@ -149,10 +149,11 @@ class SELECT extends Whereable {
     return this
   }
 
-  forUpdate ({ of, wait = cds.env.sql.lock_acquire_timeout || -1 } = {}) {
+  forUpdate ({ of, wait = cds.env.sql.lock_acquire_timeout || -1, ignoreLocked } = {}) {
     const sfu = this.SELECT.forUpdate = {}
     if (of) sfu.of = of.map (c => ({ref:c.split('.')}))
     if (wait >= 0) sfu.wait = wait
+    if (ignoreLocked) sfu.ignoreLocked = true
     return this
   }
 

package/lib/ql/cds-ql.js

@@ -35,6 +35,8 @@ exports.DELETE = require('./DELETE')
 exports.CREATE = require('./CREATE')
 exports.DROP   = require('./DROP')
 
+exports.resolve = require('./resolve');
+
 
 exports.predicate = require('./cds.ql-predicates')
 exports.columns = require('./cds.ql-projections')

package/lib/ql/cds.ql-predicates.js

@@ -48,8 +48,6 @@ function _qbe (o, xpr=[]) {
   let count = 0
   for (let k in o) { const x = o[k]
 
-    if (k !== 'and' && k !== 'or' && count++) xpr.push('and')      //> add 'and' between conditions
-
     if (k.startsWith('not ')) { xpr.push('not'); k = k.slice(4) }
     switch (k) { // handle special cases like {and:{...}} or {or:{...}}
       case 'between':
@@ -61,7 +59,9 @@ function _qbe (o, xpr=[]) {
       case 'or':  xpr.push(k)
         _qbe(x,xpr)
         continue
-      case 'not': xpr.push(k)
+      case 'not': 
+        if (count++) xpr.push('and')  //> add 'and' between conditions
+        xpr.push(k)
         if (x && typeof x === 'object') x.in || x.like || x.exists || x.between ? _qbe(x,xpr) : xpr.push({xpr:_qbe(x)})
         else xpr.push(x === null ? 'null' : {val:x})
         continue
@@ -74,6 +74,7 @@ function _qbe (o, xpr=[]) {
         else xpr.push(x === null ? 'null' : {val:x})
         continue
       case 'exists':
+        if (count++) xpr.push('and')  //> add 'and' between conditions
         xpr.push(k,_ref(x)||x)
         continue
       case 'in': case 'IN': // REVISIT: 'IN' is for compatibility only
@@ -84,7 +85,8 @@ function _qbe (o, xpr=[]) {
         continue
     }
 
-    const a = cds.parse.ref(k)            //> turn key into a ref for the left side of the expression
+    const a = cds.parse.ref(k)        //> turn key into a ref for the left side of the expression
+    if (count++) xpr.push('and')      //> add 'and' between conditions
     if (!x || typeof x !== 'object')  xpr.push (a,'=',{val:x})
     else if (is_array(x))             xpr.push (a,'in',{list:x.map(_val)})
     else if (x.SELECT || x.list)      xpr.push (a,'in',x)

package/lib/ql/resolve.js

@@ -0,0 +1,46 @@
+const { resolveView, getTransition } = require('../../libx/_runtime/common/utils/resolveView')
+const cds = require('../../lib')
+
+const PERSISTENCE_TABLE = '@cds.persistence.table'
+const _isPersistenceTable = target =>
+  Object.prototype.hasOwnProperty.call(target, PERSISTENCE_TABLE) && target[PERSISTENCE_TABLE]
+
+// REVISIT revert after cds-dbs pr
+// REVISIT: Remove once we get rid of old db
+const _abortDB = resolve.abortDB = target => !!(_isPersistenceTable(target)|| !target.query?._target)
+const _defaultAbort = tx => e => e._service?.name === tx.definition?.name
+
+function resolve(query, tx, abortCondition) {
+  const ctx = cds.context
+  const abort = abortCondition ?? (typeof tx === 'function' ? tx : undefined)
+  const _tx = typeof tx === 'function' ? ctx?.tx : tx
+  const model = ctx?.model ?? _tx.model
+
+  return resolveView(query, model, _tx, abort || _defaultAbort(_tx))
+}
+
+resolve.resolve4db = (query, tx) => resolve(query, tx, _abortDB)
+
+// REVISIT: Remove once we get rid of composition tree
+resolve.table = target => {
+  if (target.query?._target && !_isPersistenceTable(target)) {
+    return resolve.table(target.query._target)
+  }
+  return target
+}
+
+// REVISIT: Remove argument `skipForbiddenViewCheck` once we get rid of composition tree
+resolve.transitions = (query, tx, abortCondition, skipForbiddenViewCheck) => {
+  const target = query?.target || query?._target
+
+  const abort = abortCondition ?? (typeof tx === 'function' ? tx : undefined)
+  const _tx = typeof tx === 'function' ? cds.context?.tx : tx
+
+  return getTransition(target, _tx, skipForbiddenViewCheck, undefined, {
+    abort: abort ?? (tx.isDatabaseService ? _abortDB : _defaultAbort(tx))
+  })
+}
+
+resolve.transitions4db = (query, tx, skipForbiddenViewCheck) => resolve.transitions(query, tx, _abortDB, skipForbiddenViewCheck)
+
+module.exports = resolve

package/lib/req/validate.js

@@ -5,6 +5,7 @@ const cds = require('..')
  * @returns {Error[]|undefined} an array of errors or undefined if no errors occurred
  */
 const conf = module.exports = exports = function validate (data, target, options={}) {
+  if (!target || target._unresolved) return
   const vc = new Validation (data, target, options)
   target.validate (data, null, vc)
   return vc.errors