@simtlix/simfinity-core 3.5.2 → 3.5.3

package/src/runtime.js

@@ -1,8 +1,10 @@
 import { configureQueryLimits, getQueryMaxPageSize } from './query-limits.js';
+import { configureMutationLimits, getMaxNestedOperations } from './mutation-limits.js';
 import {
   GraphQLObjectType, GraphQLString, GraphQLID, GraphQLSchema, GraphQLList,
   GraphQLNonNull, GraphQLInputObjectType, GraphQLScalarType,
-  GraphQLInt, GraphQLEnumType, GraphQLBoolean, Kind,
+  GraphQLInt, GraphQLEnumType, GraphQLBoolean, GraphQLError, GraphQLInterfaceType, GraphQLUnionType,
+  Kind, getNamedType,
 } from 'graphql';
 
 import SimfinityError from './errors/simfinity.error.js';
@@ -11,6 +13,7 @@ import QLOperator from './const/QLOperator.js';
 import QLValue from './const/QLValue.js';
 import QLSort from './const/QLSort.js';
 import { collectQueryPathEntries, collectQueryPaths, walkQueryPath } from './query-plan.js';
+import { relationFieldOwners } from './relation-owners.js';
 import './introspection.js';
 
 // Resolvers Simfinity generates. Any other resolver on a registered type when its schema is first
@@ -28,7 +31,53 @@ const listApplicationResolvedFields = (gqltype) => new Set(Object.entries(gqltyp
 const hasApplicationResolver = (gqltype, fieldName) => (
   applicationResolvedFields.get(gqltype) || listApplicationResolvedFields(gqltype)
 ).has(fieldName);
+// Object types whose relation fields hold resolvers and filter arguments generated by one runtime,
+// mapped to that runtime. Those resolvers read through its adapter, registrations and middleware,
+// so a bound type cannot be registered in, or reached from, another runtime's schema.
+const runtimeBoundTypes = new WeakMap();
 const forbiddenPath = (message) => new SimfinityError(message, 'FORBIDDEN_FILTER_PATH', 403);
+
+// Query scopes restrict reads, so a scope Simfinity cannot run must fail rather than be skipped.
+const SCOPE_OPERATIONS = ['find', 'get_by_id', 'aggregate'];
+const invalidScope = (typeName, detail) => new SimfinityError(
+  `${typeName} extensions.scope ${detail}`, 'INVALID_SCOPE', 500,
+);
+const validateScope = (gqltype) => {
+  const extensions = gqltype.extensions || {};
+  if (!Object.hasOwn(extensions, 'scope')) return;
+  const { scope } = extensions;
+  if (!scope || typeof scope !== 'object' || Array.isArray(scope)
+    || ![Object.prototype, null].includes(Object.getPrototypeOf(scope))) {
+    throw invalidScope(gqltype.name, 'must be a plain object of find, get_by_id or aggregate functions');
+  }
+  // Every own string key, enumerable or not, because getScope reads any of them.
+  for (const operation of Object.getOwnPropertyNames(scope)) {
+    if (!SCOPE_OPERATIONS.includes(operation)) {
+      throw invalidScope(gqltype.name, `has unknown operation ${operation}; use find, get_by_id or aggregate`);
+    }
+    if (typeof scope[operation] !== 'function') {
+      throw invalidScope(gqltype.name, `${operation} must be a function`);
+    }
+  }
+};
+
+// Returns the type's scope function for an operation, or null when it declares none. Revalidates
+// on each call because extensions stay mutable after createSchema.
+const getScope = (gqltype, operation) => {
+  if (!gqltype?.extensions || !Object.hasOwn(gqltype.extensions, 'scope')) return null;
+  validateScope(gqltype);
+  const { scope } = gqltype.extensions;
+  return Object.hasOwn(scope, operation) ? scope[operation] : null;
+};
+
+const requireRegisteredType = (dict, type, fieldName, ownerName) => {
+  const registration = dict.types[type.name];
+  if (!registration) {
+    throw new SimfinityError(`Field ${ownerName ? `${ownerName}.` : ''}${fieldName} references ${type.name}, which is not `
+      + 'registered; register it with connect() or addNoEndpointType()', 'UNREGISTERED_RELATION_TARGET', 500);
+  }
+  return registration;
+};
 const SCOPE_IGNORED_ARGS = new Set(['sort', 'pagination', 'aggregation']);
 
 // Moves a joined type's scope group below the relation path that entered it.
@@ -105,22 +154,85 @@ const GraphQLJSON = new GraphQLScalarType({
   },
 });
 
-export const buildErrorFormatter = (callback) => {
-  const formatError = (err) => {
-    let result = null;
-    if (err instanceof SimfinityError) {
-      result = err;
-    } else {
-      result = new InternalServerError(err.message, err);
-    }
+// graphql-js wraps a value thrown while resolving a field (locatedError): the wrapper has the field
+// path and repeats the thrown error's message. A thrown non-Error becomes a NonErrorThrown whose
+// message prints the value.
+const isFieldErrorWrapper = (error) => Array.isArray(error.path) && error.originalError != null
+  && error.message === error.originalError.message
+  // locatedError adds no code of its own, so a thrown GraphQLError with its own code is not a wrapper.
+  && (error.originalError instanceof SimfinityError || typeof error.extensions?.code !== 'string'
+    || error.extensions === error.originalError.extensions);
+const thrownValueOf = (error) => (error.name === 'NonErrorThrown' && Object.hasOwn(error, 'thrownValue')
+  ? error.thrownValue : error);
+
+// The SimfinityError behind a GraphQLError, such as one a custom scalar threw, followed only through
+// GraphQLErrors; any other hidden cause is ignored.
+const simfinityCauseOf = (error) => {
+  let cause = error.originalError;
+  while (cause instanceof GraphQLError) cause = cause.originalError;
+  return cause instanceof SimfinityError ? cause : null;
+};
 
-    if (callback) {
-      const formattedError = callback(result);
-      return formattedError || result;
-    }
-    return result;
-  };
-  return formatError;
+// Request errors (syntax, validation, variable coercion) and application GraphQLErrors keep their own
+// message and extensions, such as the http status a server adds. A SimfinityError cause supplies only
+// the code and status, so a scalar's or application's hidden cause never replaces them.
+const classifyGraphQLError = (error) => {
+  const simfinity = simfinityCauseOf(error)?.extensions ?? {};
+  const extensions = error.extensions || {};
+  const code = [simfinity.code, extensions.code].find((value) => typeof value === 'string') ?? 'BAD_REQUEST';
+  const status = [simfinity.status, extensions.status].find(Number.isInteger)
+    ?? (code === 'INTERNAL_SERVER_ERROR' ? 500 : 400);
+  const classified = new SimfinityError(error.message, code, status);
+  classified.extensions = { ...extensions, ...classified.extensions };
+  return classified;
+};
+
+const classifyValue = (value) => {
+  if (value instanceof SimfinityError) return value;
+  if (value instanceof GraphQLError) return classifyGraphQLError(value);
+  // Never keep a non-Error value, such as a server's hook payload with request variables, as the cause.
+  return value instanceof Error
+    ? new InternalServerError(value.message, value)
+    : new InternalServerError('Unexpected error value');
+};
+
+// Errors raised while executing a field have a path; request errors (syntax, validation, variable
+// coercion) never do. GraphQL servers pass the GraphQLError that graphql-js created around the value
+// a resolver threw, and that value is classified, without unwrapping a GraphQLError the resolver
+// threw any further. A thrown GraphQLError that already has a path is passed as is.
+// graphql-js raises its own code-less GraphQLErrors there too when it cannot complete a value (scalar
+// or enum serialization, isTypeOf, abstract type resolution, a non-iterable list), and some print the
+// value. So a GraphQLError raised there is an application error only with its own code or a
+// SimfinityError cause; any other is unexpected.
+const classifyError = (error) => {
+  if (!(error instanceof GraphQLError)) return classifyValue(error);
+  if (!Array.isArray(error.path)) {
+    // Scalar validation errors can wrap a plain Error unchanged, with or without nodes. A server
+    // may report a source-stream failure in the same shape, so only an explicit internal cause
+    // identifies it as unexpected; applications must mark those failures at their source.
+    const cause = simfinityCauseOf(error);
+    return cause instanceof InternalServerError ? cause : classifyValue(error);
+  }
+  const thrown = isFieldErrorWrapper(error) ? thrownValueOf(error.originalError) : error;
+  if (thrown instanceof GraphQLError && typeof thrown.extensions?.code !== 'string' && !simfinityCauseOf(thrown)) {
+    return new InternalServerError(thrown.message, thrown);
+  }
+  return classifyValue(thrown);
+};
+
+export const buildErrorFormatter = (callback) => (error) => {
+  const classified = classifyError(error);
+  const chosen = (callback && callback(classified)) || classified;
+  if (chosen instanceof GraphQLError) return chosen;
+  const located = error instanceof GraphQLError ? error : null;
+  return new GraphQLError(chosen.message, {
+    nodes: located?.nodes,
+    source: located?.source,
+    positions: located?.positions,
+    path: located?.path,
+    originalError: chosen,
+    extensions: chosen.extensions && typeof chosen.extensions === 'object' ? { ...chosen.extensions } : {},
+  });
 };
 
 export { SimfinityError, InternalServerError };
@@ -152,6 +264,7 @@ export const createRuntime = (adapter) => {
   }
 
   const stateValue = adapter.stateValue || ((state) => state.name);
+  const runtimeIdentity = {};
   const typesDict = { types: {} };
   const waitingInputType = {};
   const typesDictForUpdate = { types: {} };
@@ -167,6 +280,9 @@ export const createRuntime = (adapter) => {
   };
 
   const use = (middleware) => {
+    if (typeof middleware !== 'function') {
+      throw new SimfinityError('Middleware must be a function', 'INVALID_MIDDLEWARE', 500);
+    }
     middlewares.push(middleware);
   };
 
@@ -176,6 +292,69 @@ export const createRuntime = (adapter) => {
     preventCollectionCreation = !!prevent;
   };
 
+  const assertNotBoundElsewhere = (gqltype) => {
+    const owner = runtimeBoundTypes.get(gqltype);
+    if (owner !== undefined && owner !== runtimeIdentity) {
+      throw new SimfinityError(
+        `Type ${gqltype.name} is bound to another Simfinity runtime. Its relation fields resolve through the runtime `
+          + 'that first created a schema reaching the type; define separate GraphQL types for each runtime, for example with a factory function',
+        'TYPE_BOUND_TO_OTHER_RUNTIME',
+        409,
+      );
+    }
+  };
+
+  const isForeign = (owner) => owner !== undefined && owner !== runtimeIdentity;
+  // A field copied, with toConfig() or a field spread, from a type after another runtime generated
+  // its relation resolver keeps that resolver or its extensions object. The extensions object counts
+  // only for a field whose resolver is untagged, such as one other code wrapped in place. A field
+  // without a resolver gets this runtime's own. graphql-js never runs interface field resolvers, so
+  // interface fields are not checked; the types they reference are.
+  const assertFieldsNotBoundElsewhere = (gqltype) => {
+    if (gqltype instanceof GraphQLInterfaceType) return;
+    for (const [fieldName, field] of Object.entries(gqltype.getFields())) {
+      if (!field.resolve) continue;
+      const resolverOwner = relationFieldOwners.get(field.resolve);
+      if (isForeign(resolverOwner)
+        || (resolverOwner === undefined && isForeign(relationFieldOwners.get(field.extensions)))) {
+        throw new SimfinityError(
+          `Field ${gqltype.name}.${fieldName} was copied from a relation field that another Simfinity runtime generated, `
+            + 'with its resolver or its extensions; define the field for each runtime instead of copying it from a type '
+            + 'that runtime already used',
+          'TYPE_BOUND_TO_OTHER_RUNTIME',
+          409,
+        );
+      }
+    }
+  };
+
+  // Object and interface types a schema of this runtime can reach from its registered types and
+  // custom mutation results, following the same references as GraphQLSchema.
+  const collectSchemaOutputTypes = () => {
+    const visited = new Set();
+    const outputTypes = [];
+    const visit = (type) => {
+      const named = type && getNamedType(type);
+      if (!named || visited.has(named)) return;
+      visited.add(named);
+      if (named instanceof GraphQLUnionType) {
+        named.getTypes().forEach(visit);
+        return;
+      }
+      if (!(named instanceof GraphQLObjectType || named instanceof GraphQLInterfaceType)) return;
+      outputTypes.push(named);
+      named.getInterfaces().forEach(visit);
+      for (const field of Object.values(named.getFields())) visit(field.type);
+    };
+    for (const { gqltype } of Object.values(typesDict.types)) visit(gqltype);
+    for (const { outputModel } of Object.values(registeredMutations)) visit(outputModel);
+    return outputTypes;
+  };
+
+  const hasUnresolvedRelation = (gqltype) => Object.values(gqltype.getFields()).some(
+    (field) => field.extensions?.relation && !field.extensions.relation.embedded && !field.resolve,
+  );
+
 const QLFilter = new GraphQLInputObjectType({
   name: 'QLFilter',
   fields: () => ({
@@ -402,12 +581,13 @@ const createOneToManyInputType = (inputNamePrefix, fieldEntryName,
 };
 
 const graphQLListInputType = (dict, fieldEntry, fieldEntryName,
-  inputNamePrefix, connectionField, preserveOuterNonNull) => {
+  inputNamePrefix, connectionField, preserveOuterNonNull, ownerName) => {
   const listShape = getListShape(fieldEntry.type);
   if (!listShape) return null;
   const { itemType } = listShape;
 
-  if (itemType instanceof GraphQLObjectType && dict.types[itemType.name].inputType) {
+  if (itemType instanceof GraphQLObjectType
+    && requireRegisteredType(dict, itemType, fieldEntryName, ownerName).inputType) {
     if (!fieldEntry.extensions || !fieldEntry.extensions.relation
       || !fieldEntry.extensions.relation.embedded) {
       const oneToMany = createOneToManyInputType(inputNamePrefix, fieldEntryName,
@@ -471,7 +651,8 @@ const buildInputType = (gqltype) => {
               fieldArg.type = fieldEntry.type instanceof GraphQLNonNull
                 ? new GraphQLNonNull(IdInputType) : IdInputType;
               fieldArgForUpdate.type = IdInputType;
-            } else if (typesDict.types[fieldEntryNameValue].inputType
+            } else if (requireRegisteredType(typesDict, unwrapNonNull(fieldEntry.type), fieldEntryName,
+              gqltype.name).inputType
               && typesDictForUpdate.types[fieldEntryNameValue].inputType) {
               fieldArg.type = typesDict.types[fieldEntryNameValue].inputType;
               fieldArgForUpdate.type = typesDictForUpdate.types[fieldEntryNameValue].inputType;
@@ -488,10 +669,10 @@ const buildInputType = (gqltype) => {
           } else {
             const listInputTypeForAdd = graphQLListInputType(typesDict, fieldEntry,
               fieldEntryName, `${gqltype.name}A`,
-              fieldEntry.extensions?.relation?.connectionField, true);
+              fieldEntry.extensions?.relation?.connectionField, true, gqltype.name);
             const listInputTypeForUpdate = graphQLListInputType(typesDictForUpdate, fieldEntry,
               fieldEntryName, `${gqltype.name}U`,
-              fieldEntry.extensions?.relation?.connectionField, false);
+              fieldEntry.extensions?.relation?.connectionField, false, gqltype.name);
             if (listInputTypeForAdd && listInputTypeForUpdate) {
               fieldArg.type = listInputTypeForAdd;
               fieldArgForUpdate.type = listInputTypeForUpdate;
@@ -904,8 +1085,34 @@ const saveObject = async (typeName, args, session, context) => {
   ), type.model);
 };
 
+// Counts the added, updated and deleted entries of referenced collections, at every nesting level that
+// iterateOnCollectionFields executes, and stops once the configured maximum is exceeded.
+const assertNestedOperations = (gqltype, input, limit, state = { count: 0 }) => {
+  if (!input || typeof input !== 'object') return;
+  for (const [fieldName, field] of Object.entries(gqltype.getFields())) {
+    const value = input[fieldName];
+    const relation = field.extensions?.relation;
+    const listShape = getListShape(field.type);
+    if (value == null || !relation || relation.embedded || !listShape
+      || !(listShape.itemType instanceof GraphQLObjectType)) continue;
+    for (const key of ['added', 'updated', 'deleted']) {
+      if (!Array.isArray(value[key])) continue;
+      state.count += value[key].length;
+      if (state.count > limit) {
+        throw new SimfinityError(`A mutation may perform at most ${limit} nested collection operations`,
+          'NESTED_OPERATIONS_EXCEEDED', 400);
+      }
+      if (key !== 'deleted') {
+        for (const item of value[key]) assertNestedOperations(listShape.itemType, item, limit, state);
+      }
+    }
+  }
+};
+
 const executeOperation = (Model, gqltype, controller, args, operation, actionField,
   session, context, inputType) => {
+  const limit = getMaxNestedOperations();
+  if (limit !== null && operation !== operations.DELETE) assertNestedOperations(gqltype, args, limit);
   const inputSnapshot = operation === operations.DELETE ? args : cloneInput(args, inputType);
   return adapter.withTransaction(
     session,
@@ -982,39 +1189,41 @@ const executeItemFunction = async (gqltype, collectionField, objectId, session,
 const shouldNotBeIncludedInSchema = (includedTypes,
   type) => includedTypes && !includedTypes.includes(type);
 
+// Runs the chain in registration order. The rest of the chain runs at most once, and is awaited
+// even when a middleware calls next() without awaiting it, so its errors still cancel the operation
+// and never become unhandled rejections; a middleware that fails after starting it rejects only once
+// it settles. A next() called after the middleware finished does nothing, so later middleware never
+// runs after the operation.
 const executeMiddleware = async (context) => {
-  const buildNext = (middlewaresParam) => {
-    if (!middlewaresParam) {
-      return async () => {};
-    }
-    return async () => {
-      const middleware = middlewaresParam[0];
-      if (middleware) {
-        await middleware(context, buildNext(middlewaresParam.slice(1)));
+  const run = async (index) => {
+    if (index >= middlewares.length) return;
+    let downstream;
+    let finished = false;
+    const next = () => {
+      if (!downstream && !finished) {
+        downstream = run(index + 1);
+        // Handled here because the middleware may await other work first; awaited below.
+        downstream.catch(() => {});
       }
+      return downstream ?? Promise.resolve();
     };
+    try {
+      await middlewares[index](context, next);
+    } catch (error) {
+      finished = true;
+      if (downstream) await downstream.catch(() => {});
+      throw error;
+    }
+    finished = true;
+    if (downstream) await downstream;
   };
-
-  await buildNext(middlewares)();
+  await run(0);
 };
 
 const executeScope = async (params) => {
   const { type, args, operation, context } = params;
-
-  if (!type || !type.gqltype || !type.gqltype.extensions) {
-    return null;
-  }
-
-  const extensions = type.gqltype.extensions;
-  if (!extensions.scope || !extensions.scope[operation]) {
-    return null;
-  }
-
-  const scopeFunction = extensions.scope[operation];
-  if (typeof scopeFunction !== 'function') {
-    return null;
-  }
-
+  const scopeFunction = getScope(type?.gqltype, operation);
+  if (!scopeFunction) return null;
   return scopeFunction({ type, args, operation, context });
 };
 
@@ -1049,7 +1258,7 @@ const inspectClientPaths = (gqltype, args, operation) => {
       const relation = field.extensions?.relation;
       if (!relation || relation.embedded) return;
       const target = typesDict.types[unwrapListAndNonNull(field.type).name];
-      if (typeof target?.gqltype?.extensions?.scope?.find !== 'function') return;
+      if (!getScope(target?.gqltype, 'find')) return;
       if (!joinedScopes.has(path)) {
         joinedScopes.set(path, {
           target,
@@ -1210,7 +1419,7 @@ const loadReference = (type, id, requiredId, context) => {
 const resolveById = async (type, args, context, requiredId) => {
   const requestedId = args.id;
   await executeMiddleware({ type, args, operation: 'get_by_id', context });
-  if (!type.gqltype.extensions?.scope?.get_by_id) {
+  if (!getScope(type.gqltype, 'get_by_id')) {
     if (requiredId != null && args.id === requestedId && typeof context === 'object' && context !== null
       && typeof adapter.getByIds === 'function' && type.gqltype.getFields().id) {
       return loadReference(type, args.id, requiredId, context);
@@ -1454,6 +1663,11 @@ const markReferencedTypesForModelGeneration = () => {
 const getRegistrations = () => Object.values(typesDict.types);
 
 const createSchema = (includedQueryTypes, includedMutationTypes, includedCustomMutations) => {
+  // Reject before models, resolvers or roots are built, so a rejected schema changes nothing.
+  Object.values(typesDict.types).forEach(({ gqltype }) => validateScope(gqltype));
+  const schemaTypes = collectSchemaOutputTypes();
+  schemaTypes.forEach(assertNotBoundElsewhere);
+  schemaTypes.forEach(assertFieldsNotBoundElsewhere);
   markReferencedTypesForModelGeneration();
   if (adapter.prepare) {
     adapter.prepare(getRegistrations(), { createCollection: !preventCollectionCreation });
@@ -1490,10 +1704,18 @@ const createSchema = (includedQueryTypes, includedMutationTypes, includedCustomM
     }
   });
 
-  return new GraphQLSchema({
+  const schema = new GraphQLSchema({
     query,
     mutation: buildMutation('Mutation', includedMutationTypes, includedCustomMutations),
   });
+  // Reserve reachable types whose relation fields still have no resolver, such as an unregistered
+  // custom mutation result, so another runtime cannot later generate resolvers this schema executes.
+  schemaTypes.forEach((type) => {
+    if (type instanceof GraphQLObjectType && hasUnresolvedRelation(type)) {
+      runtimeBoundTypes.set(type, runtimeIdentity);
+    }
+  });
+  return schema;
 };
 
 const getModel = (gqltype) => typesDict.types[gqltype.name]?.model;
@@ -1517,7 +1739,18 @@ const registerMutation = (name, description, inputModel, outputModel, callback)
   };
 };
 
+// Gives the field a new extensions object as well as the resolver, so a copy made before keeps
+// untagged extensions. It has a null prototype because graphql-js keeps such an object, rather than
+// copying it, when a type is rebuilt from toConfig().
+const claimRelationField = (fieldEntry, resolve, extensions = {}) => {
+  fieldEntry.extensions = Object.assign(Object.create(null), fieldEntry.extensions, extensions);
+  fieldEntry.resolve = markGenerated(resolve);
+  relationFieldOwners.set(fieldEntry.extensions, runtimeIdentity);
+  relationFieldOwners.set(fieldEntry.resolve, runtimeIdentity);
+};
+
 const autoGenerateResolvers = (gqltype) => {
+  assertFieldsNotBoundElsewhere(gqltype);
   const fields = gqltype.getFields();
 
   for (const [fieldName, fieldEntry] of Object.entries(fields)) {
@@ -1532,16 +1765,12 @@ const autoGenerateResolvers = (gqltype) => {
         relatedType,
         relation.connectionField || fieldName,
       );
-      const relatedTypeInfo = typesDict.types[relatedType.name];
+      const relatedTypeInfo = requireRegisteredType(typesDict, relatedType, fieldName, gqltype.name);
       const argsObject = createArgsForQuery(relatedTypeInfo.gqltype.getFields());
       if (connection.graphqlFieldName) delete argsObject[connection.graphqlFieldName];
 
       fieldEntry.args = formatArgs(Object.entries(argsObject));
-      fieldEntry.extensions = {
-        ...fieldEntry.extensions,
-        simfinityQuery: { typeName: relatedType.name, operation: 'find' },
-      };
-      fieldEntry.resolve = markGenerated(async (parent, args, context) => {
+      claimRelationField(fieldEntry, async (parent, args, context) => {
         if (!relatedTypeInfo || !relatedTypeInfo.model) {
           throw new Error(`Related type ${relatedType.name} not found or not connected. Make sure it's connected with simfinity.connect() or simfinity.addNoEndpointType().`);
         }
@@ -1558,13 +1787,14 @@ const autoGenerateResolvers = (gqltype) => {
           params.args,
           null,
         );
-      });
+      }, { simfinityQuery: { typeName: relatedType.name, operation: 'find' } });
+      runtimeBoundTypes.set(gqltype, runtimeIdentity);
     } else if (fieldEntry.type instanceof GraphQLObjectType
       || (fieldEntry.type instanceof GraphQLNonNull && fieldEntry.type.ofType instanceof GraphQLObjectType)) {
       const relatedType = unwrapNonNull(fieldEntry.type);
       const connectionField = relation.connectionField || fieldName;
 
-      fieldEntry.resolve = markGenerated(async (parent, args, context) => {
+      claimRelationField(fieldEntry, async (parent, args, context) => {
         const relatedTypeInfo = typesDict.types[relatedType.name];
         if (!relatedTypeInfo || !relatedTypeInfo.model) {
           throw new Error(`Related type ${relatedType.name} not found or not connected. Make sure it's connected with simfinity.connect() or simfinity.addNoEndpointType().`);
@@ -1573,6 +1803,7 @@ const autoGenerateResolvers = (gqltype) => {
         const id = relatedId?._id || relatedId;
         return id ? resolveById(relatedTypeInfo, { id: String(id) }, context, id) : null;
       });
+      runtimeBoundTypes.set(gqltype, runtimeIdentity);
     }
   }
 };
@@ -1589,6 +1820,8 @@ const connect = (model, gqltype, simpleEntityEndpointName,
     stateMachine,
     onModelCreated,
   };
+  assertNotBoundElsewhere(gqltype);
+  validateScope(gqltype);
   if (adapter.validateRegistration) adapter.validateRegistration(registration);
 
   waitingInputType[gqltype.name] = {
@@ -1601,6 +1834,7 @@ const connect = (model, gqltype, simpleEntityEndpointName,
 };
 
 const addNoEndpointType = (gqltype) => {
+  assertNotBoundElsewhere(gqltype);
   const fields = gqltype.getFields();
   let needsModel = false;
   for (const fieldEntry of Object.values(fields)) {
@@ -1616,6 +1850,7 @@ const addNoEndpointType = (gqltype) => {
   const registration = {
     gqltype, endpoint: false, model: null, needsModel,
   };
+  validateScope(gqltype);
   if (adapter.validateRegistration) adapter.validateRegistration(registration);
 
   waitingInputType[gqltype.name] = { gqltype };
@@ -1683,6 +1918,7 @@ function formatArgs(argsArray) {
 
   return {
     configureQueryLimits,
+    configureMutationLimits,
     connect,
     addNoEndpointType,
     createSchema,

package/src/scalars/factory.js

@@ -1,5 +1,18 @@
 import { GraphQLScalarType, GraphQLString, GraphQLInt, GraphQLFloat, GraphQLBoolean, GraphQLID, Kind } from 'graphql';
 
+// The base each validated scalar delegates parsing to. A base exists before its scalar, so these links cannot cycle.
+const validatedBases = new WeakMap();
+
+// Follow validated-scalar chains to the scalar that defines the literal syntax. Any other scalar is the root, even
+// with a hand-set `baseScalarType` storage hint, because its own parseLiteral decides which literals it takes.
+const findRootScalar = (scalarType) => {
+  let root = scalarType;
+  while (validatedBases.has(root)) {
+    root = validatedBases.get(root);
+  }
+  return root;
+};
+
 export function createValidatedScalar(name, description, baseScalarType, validate) {
   if (!baseScalarType) {
     throw new Error('baseScalarType is required');
@@ -16,16 +29,21 @@ export function createValidatedScalar(name, description, baseScalarType, validat
     throw new Error('baseScalarType must be a standard GraphQL scalar type or a custom scalar with a valid name');
   }
 
+  // Float takes integer literals too, as GraphQLFloat does, so an integral default printed as `5` stays valid.
   const kindMap = {
-    String: Kind.STRING,
-    Int: Kind.INT,
-    Float: Kind.FLOAT,
-    Boolean: Kind.BOOLEAN,
-    ID: Kind.STRING,
+    String: [Kind.STRING],
+    Int: [Kind.INT],
+    Float: [Kind.FLOAT, Kind.INT],
+    Boolean: [Kind.BOOLEAN],
+    ID: [Kind.STRING],
   };
 
-  const baseKind = kindMap[baseScalarType.name] || Kind.STRING;
+  // Custom root scalars define their own literal kinds, so their parseLiteral decides.
+  const rootScalarType = findRootScalar(baseScalarType);
+  const baseKinds = Object.hasOwn(kindMap, rootScalarType.name) ? kindMap[rootScalarType.name] : undefined;
 
+  // Input is parsed by the base first, so validators judge the same internal value for variables and literals.
+  // An undefined result is the base rejecting the input; GraphQL reports it without running the validator.
   const scalar = new GraphQLScalarType({
     name: `${name}_${baseScalarType.name}`,
     description,
@@ -34,19 +52,21 @@ export function createValidatedScalar(name, description, baseScalarType, validat
       return baseScalarType.serialize(value);
     },
     parseValue(value) {
-      validate(value);
-      return baseScalarType.parseValue(value);
+      const parsed = baseScalarType.parseValue(value);
+      if (parsed !== undefined) validate(parsed);
+      return parsed;
     },
     parseLiteral(ast, variables) {
-      if (ast.kind !== baseKind) {
+      if (baseKinds !== undefined && !baseKinds.includes(ast.kind)) {
         throw new Error(`${name}_${baseScalarType.name} must be a ${baseScalarType.name}`);
       }
       const value = baseScalarType.parseLiteral(ast, variables);
-      validate(value);
+      if (value !== undefined) validate(value);
       return value;
     },
   });
 
   scalar.baseScalarType = baseScalarType;
+  validatedBases.set(scalar, baseScalarType);
   return scalar;
 }

package/src/scalars/pattern.js

@@ -0,0 +1,16 @@
+// A cross-realm RegExp fails `instanceof RegExp` but keeps this tag.
+const isRegExp = (value) => Object.prototype.toString.call(value) === '[object RegExp]';
+
+/** Private RegExp copy shared by `validators.pattern()` and `createPatternStringScalar()`; not a published subpath. */
+export const compilePattern = (pattern) => {
+  if (typeof pattern !== 'string' && !isRegExp(pattern)) {
+    throw new TypeError('pattern must be a RegExp or a string');
+  }
+  return new RegExp(pattern);
+};
+
+/** Tests each value from its first character, so `g` and `y` keep no state between values. */
+export const matchesPattern = (regex, value) => {
+  regex.lastIndex = 0;
+  return regex.test(value);
+};

package/src/scalars.js

@@ -3,6 +3,7 @@ import {
 } from 'graphql';
 import { createValidatedScalar } from './scalars/factory.js';
 import { isEmailFormat } from './scalars/email.js';
+import { compilePattern, matchesPattern } from './scalars/pattern.js';
 
 /**
  * Email scalar - validates email format
@@ -152,7 +153,7 @@ export const createBoundedFloatScalar = (name, min, max) => {
  * @returns {GraphQLScalarType} A scalar type with pattern validation
  */
 export const createPatternStringScalar = (name, pattern, message) => {
-  const regex = typeof pattern === 'string' ? new RegExp(pattern) : pattern;
+  const regex = compilePattern(pattern);
   const errorMessage = message || 'Value does not match required pattern';
 
   return createValidatedScalar(
@@ -163,7 +164,7 @@ export const createPatternStringScalar = (name, pattern, message) => {
       if (typeof value !== 'string') {
         throw new Error('Value must be a string');
       }
-      if (!regex.test(value)) {
+      if (!matchesPattern(regex, value)) {
         throw new Error(errorMessage);
       }
     },