@wxn0brp/db-core 0.12.11 → 0.12.13

package/dist/customFileCpu.js

@@ -1,7 +1,15 @@
+import { QueryValidationError } from "./errors.js";
 import { matchObj, updateObj } from "./utils/process.js";
 import { updateFindObject } from "./utils/updateFindObject.js";
 export function pathRepair(path) {
-    return path.replace(/\/+/g, "/");
+    const repaired = path.replace(/\/+/g, "/");
+    if (repaired.split(/[/\\]+/).includes("..")) {
+        throw new QueryValidationError("Path traversal is not allowed", {
+            op: "pathRepair",
+            path,
+        });
+    }
+    return repaired;
 }
 export class CustomFileCpu {
     requireClone;

package/dist/db/multiStorage.js

@@ -33,15 +33,12 @@ export class MultiBackend extends ActionsBase {
     }
     async findOne(config) {
         for (const backend of this.backends) {
-            try {
-                const result = await backend.findOne({
-                    ...config,
-                });
-                if (result !== null && result !== undefined) {
-                    return result;
-                }
+            const result = await backend.findOne({
+                ...config,
+            });
+            if (result !== null && result !== undefined) {
+                return result;
             }
-            catch { }
         }
         return null;
     }
@@ -53,14 +50,11 @@ export class MultiBackend extends ActionsBase {
     }
     async updateOne(config) {
         for (const backend of this.backends) {
-            try {
-                const result = await backend.updateOne({
-                    ...config,
-                });
-                if (result)
-                    return result;
-            }
-            catch (error) { }
+            const result = await backend.updateOne({
+                ...config,
+            });
+            if (result)
+                return result;
         }
         return null;
     }
@@ -72,14 +66,11 @@ export class MultiBackend extends ActionsBase {
     }
     async removeOne(config) {
         for (const backend of this.backends) {
-            try {
-                const result = await backend.removeOne({
-                    ...config,
-                });
-                if (result)
-                    return result;
-            }
-            catch (error) { }
+            const result = await backend.removeOne({
+                ...config,
+            });
+            if (result)
+                return result;
         }
         return null;
     }

package/dist/db/transaction.d.ts

@@ -23,10 +23,10 @@ export declare class Transaction {
     updateOneOrAdd<T = Data>(q: VQueryT.UpdateOneOrAdd<T>): Promise<VQueryT.UpdateOneOrAddResult<T>>;
     toggleOne<T = Data>(q: VQueryT.ToggleOne<T>): Promise<VQueryT.ToggleOneResult<T>>;
     count<T = Data>(q: VQueryT.Count<T>): Promise<number>;
-    ensureCollection(collection: string): Promise<boolean>;
-    issetCollection(collection: string): Promise<boolean>;
+    ensureCollection(collection: string | VQueryT.Collection): Promise<boolean>;
+    issetCollection(collection: string | VQueryT.Collection): Promise<boolean>;
     getCollections(): Promise<string[]>;
-    removeCollection(collection: string): Promise<boolean>;
+    removeCollection(target: string | VQueryT.Collection): Promise<boolean>;
     commit(): Promise<void>;
     rollback(): Promise<void>;
 }

package/dist/db/transaction.js

@@ -1,5 +1,5 @@
 import { wrapAdapterError } from "../errors.js";
-import { Collection } from "../helpers/collection.js";
+import { Collection, resolveCollection } from "../helpers/collection.js";
 import { applyAddDefaults, applyBulkAddDefaults, applyCountDefaults, applyFindDefaults, applyFindOneDefaults, applyRemoveDefaults, applyToggleOneDefaults, applyUpdateDefaults, applyUpdateOneOrAddDefaults, } from "../helpers/queryDefaults.js";
 /**
  * Transaction context. Operations are executed directly through the parent
@@ -60,16 +60,16 @@ export class Transaction {
         return this._parent.execute("count", q, this.handle);
     }
     ensureCollection(collection) {
-        return this._parent.execute("ensureCollection", collection, this.handle);
+        return this._parent.execute("ensureCollection", resolveCollection(collection), this.handle);
     }
     issetCollection(collection) {
-        return this._parent.execute("issetCollection", collection, this.handle);
+        return this._parent.execute("issetCollection", resolveCollection(collection), this.handle);
     }
     getCollections() {
         return this._parent.execute("getCollections", {}, this.handle);
     }
-    removeCollection(collection) {
-        return this._parent.execute("removeCollection", collection, this.handle);
+    removeCollection(target) {
+        return this._parent.execute("removeCollection", resolveCollection(target), this.handle);
     }
     async commit() {
         try {

package/dist/db/valthera.d.ts

@@ -20,9 +20,9 @@ export declare class ValtheraClass implements ValtheraCompatible {
     adapter: ActionsBase;
     executor: ExecutorInterface;
     emitter: VEE<{
-        [K in keyof Omit<ValtheraCompatible, "c">]: (query: VQuery, result: Awaited<ReturnType<ValtheraCompatible[K]>>) => void;
+        [K in keyof Omit<ValtheraCompatible, "c">]: (query: VQuery, result: Awaited<ReturnType<ValtheraCompatible[K]>>, collection?: string) => void;
     } & {
-        "*": (name: keyof Omit<ValtheraCompatible, "c">, query: VQuery, result: any) => void;
+        "*": (name: keyof Omit<ValtheraCompatible, "c">, query: VQuery, result: any, collection?: string) => void;
     }>;
     version: string;
     _plugins: ValtheraPlugin[];
@@ -43,11 +43,11 @@ export declare class ValtheraClass implements ValtheraCompatible {
     /**
      * Check and create the specified collection if it doesn't exist.
      */
-    ensureCollection(collection: string): Promise<boolean>;
+    ensureCollection(collection: string | VQueryT.Collection): Promise<boolean>;
     /**
      * Check if a collection exists.
      */
-    issetCollection(collection: string): Promise<boolean>;
+    issetCollection(collection: string | VQueryT.Collection): Promise<boolean>;
     /**
      * Add data to a database.
      */
@@ -88,7 +88,7 @@ export declare class ValtheraClass implements ValtheraCompatible {
     /**
      * Removes a database collection from the database.
      */
-    removeCollection(collection: string): Promise<boolean>;
+    removeCollection(target: string | VQueryT.Collection): Promise<boolean>;
     /**
      * Create an index on a collection.
      */

package/dist/db/valthera.js

@@ -1,9 +1,11 @@
 import { VEE } from "@wxn0brp/event-emitter";
-import { AdapterCloseError, AdapterInitError, ErrorCodes, isValtheraError, QueryValidationError, TransactionError, wrapAdapterError, } from "../errors.js";
-import { Collection } from "../helpers/collection.js";
+import * as errors from "../errors.js";
+import { Collection, resolveCollection } from "../helpers/collection.js";
 import { SmartExecutor } from "../helpers/executor.js";
 import { genId } from "../helpers/gen.js";
-import { applyAddDefaults, applyBulkAddDefaults, applyCountDefaults, applyFindDefaults, applyFindOneDefaults, applyRemoveDefaults, applyToggleOneDefaults, applyUpdateDefaults, applyUpdateOneOrAddDefaults, } from "../helpers/queryDefaults.js";
+import { rewriteOp } from "../helpers/plugin.js";
+import * as queryDefaults from "../helpers/queryDefaults.js";
+import { getOpKind, isKnownOp } from "../utils/opKind.js";
 import { version } from "../version.js";
 import { Transaction } from "./transaction.js";
 /**
@@ -50,9 +52,9 @@ export class ValtheraClass {
             return;
         const self = this;
         const failInit = (err) => {
-            if (isValtheraError(err))
+            if (errors.isValtheraError(err))
                 throw err;
-            throw new AdapterInitError(err, {
+            throw new errors.AdapterInitError(err, {
                 adapter: self.adapter?.version,
             });
         };
@@ -99,9 +101,9 @@ export class ValtheraClass {
                 await self.adapter.close(...args);
             }
             catch (err) {
-                if (isValtheraError(err))
+                if (errors.isValtheraError(err))
                     throw err;
-                throw new AdapterCloseError(err, {
+                throw new errors.AdapterCloseError(err, {
                     adapter: self.adapter?.version,
                 });
             }
@@ -112,7 +114,7 @@ export class ValtheraClass {
         await this.init();
         const collection = typeof query === "string" ? query : query?.collection;
         if (!collection && name !== "getCollections")
-            throw new QueryValidationError(`Missing "collection" for operation "${String(name)}"`, {
+            throw new errors.QueryValidationError(`Missing "collection" for operation "${String(name)}"`, {
                 op: name,
             });
         if (txHandle && query && typeof query === "object")
@@ -122,26 +124,41 @@ export class ValtheraClass {
         let idx = 0;
         const ctx = {
             op: name,
+            kind: getOpKind(name),
+            collection,
             query,
             next: async () => {
                 if (idx < plugins.length)
                     return plugins[idx++].execute(ctx);
+                if (txHandle && ctx.query && typeof ctx.query === "object")
+                    ctx.query.transaction = txHandle;
+                if (!isKnownOp(ctx.op))
+                    throw new errors.QueryValidationError(`Unknown operation "${ctx.op}"`, {
+                        op: ctx.op,
+                    });
                 try {
                     if (txHandle)
-                        return await self.adapter[ctx.op](query, txHandle);
+                        return await self.adapter[ctx.op](ctx.query, txHandle);
                     return await self.executor.addOp(self.adapter[ctx.op].bind(self.adapter), ctx.query, typeof ctx.query === "string" ? ctx.query : ctx.query.collection);
                 }
                 catch (err) {
-                    throw wrapAdapterError(err, {
+                    throw errors.wrapAdapterError(err, {
                         op: ctx.op,
-                        collection,
+                        collection: typeof ctx.query === "string" ? ctx.query : ctx.query?.collection,
                         adapter: self.adapter?.version,
                     });
                 }
             },
+            setOp(op, q) {
+                rewriteOp(ctx, op, q);
+            },
+            setQuery(q) {
+                rewriteOp(ctx, ctx.op, q);
+            },
         };
         const result = await ctx.next();
-        this.emitter.emit(ctx.op, ctx.query, result);
+        const emittedCollection = typeof ctx.query === "string" ? ctx.query : ctx.query?.collection;
+        this.emitter.emit(ctx.op, ctx.query, result, emittedCollection);
         return result;
     }
     /**
@@ -164,85 +181,86 @@ export class ValtheraClass {
      * Check and create the specified collection if it doesn't exist.
      */
     async ensureCollection(collection) {
-        return await this.execute("ensureCollection", collection);
+        return await this.execute("ensureCollection", resolveCollection(collection));
     }
     /**
      * Check if a collection exists.
      */
     async issetCollection(collection) {
-        return await this.execute("issetCollection", collection);
+        return await this.execute("issetCollection", resolveCollection(collection));
     }
     /**
      * Add data to a database.
      */
     add(query) {
-        applyAddDefaults(query);
+        queryDefaults.applyAddDefaults(query);
         return this.execute("add", query);
     }
     bulkAdd(query) {
-        applyBulkAddDefaults(query);
+        queryDefaults.applyBulkAddDefaults(query);
         return this.execute("bulkAdd", query);
     }
     /**
      * Find data in a database.
      */
     find(query) {
-        applyFindDefaults(query);
+        queryDefaults.applyFindDefaults(query);
         return this.execute("find", query);
     }
     /**
      * Find one data entry in a database.
      */
     findOne(query) {
-        applyFindOneDefaults(query);
+        queryDefaults.applyFindOneDefaults(query);
         return this.execute("findOne", query);
     }
     /**
      * Update data in a database.
      */
     update(query) {
-        applyUpdateDefaults(query);
+        queryDefaults.applyUpdateDefaults(query);
         return this.execute("update", query);
     }
     /**
      * Update one data entry in a database.
      */
     updateOne(query) {
-        applyUpdateDefaults(query);
+        queryDefaults.applyUpdateDefaults(query);
         return this.execute("updateOne", query);
     }
     /**
      * Remove data from a database.
      */
     remove(query) {
-        applyRemoveDefaults(query);
+        queryDefaults.applyRemoveDefaults(query);
         return this.execute("remove", query);
     }
     /**
      * Remove one data entry from a database.
      */
     removeOne(query) {
-        applyRemoveDefaults(query);
+        queryDefaults.applyRemoveDefaults(query);
         return this.execute("removeOne", query);
     }
     /**
      * Asynchronously updates one entry in a database or adds a new one if it doesn't exist.
      */
     updateOneOrAdd(query) {
-        applyUpdateOneOrAddDefaults(query);
+        queryDefaults.applyUpdateOneOrAddDefaults(query);
         return this.execute("updateOneOrAdd", query);
     }
     /**
      * Asynchronously removes one entry in a database or adds a new one if it doesn't exist. Usage e.g. for toggling a flag.
      */
     toggleOne(query) {
-        applyToggleOneDefaults(query);
+        queryDefaults.applyToggleOneDefaults(query);
         return this.execute("toggleOne", query);
     }
     /**
      * Removes a database collection from the database.
      */
-    removeCollection(collection) {
+    removeCollection(target) {
+        const collection = resolveCollection(target);
         this._collections.delete(collection);
         return this.execute("removeCollection", collection);
     }
@@ -274,7 +292,7 @@ export class ValtheraClass {
         });
     }
     count(query) {
-        applyCountDefaults(query);
+        queryDefaults.applyCountDefaults(query);
         return this.execute("count", query);
     }
     /**
@@ -319,7 +337,7 @@ export class ValtheraClass {
                 handle = await this.adapter.beginTransaction(genId(), collections);
             }
             catch (err) {
-                throw wrapAdapterError(err, {
+                throw errors.wrapAdapterError(err, {
                     op: "beginTransaction",
                     adapter: this.adapter?.version,
                 });
@@ -335,8 +353,8 @@ export class ValtheraClass {
                     await tx.rollback();
                 }
                 catch (rollbackErr) {
-                    throw new TransactionError("Transaction failed and rollback failed", {
-                        code: ErrorCodes.TRANSACTION_ROLLBACK_FAILED,
+                    throw new errors.TransactionError("Transaction failed and rollback failed", {
+                        code: errors.ErrorCodes.TRANSACTION_ROLLBACK_FAILED,
                         cause: new AggregateError([
                             err,
                             rollbackErr,

package/dist/helpers/addId.js

@@ -1,4 +1,14 @@
+import { QueryValidationError } from "../errors.js";
+import { isUnsafeKey } from "../utils/security.js";
 import { genId } from "./gen.js";
+function assertSafeIdKey(idKey) {
+    if (!isUnsafeKey(idKey))
+        return;
+    throw new QueryValidationError("Unsafe idKey", {
+        op: "addId",
+        idKey,
+    });
+}
 export async function addId(query, actions, defaultGen = true) {
     const collection = query.collection;
     const data = query.data;
@@ -6,6 +16,7 @@ export async function addId(query, actions, defaultGen = true) {
     const { idKey = "_id", numberId } = actions.adapterOpts;
     if (!id_gen)
         return data;
+    assertSafeIdKey(idKey);
     if (data[idKey])
         return data;
     if (!numberId) {
@@ -45,6 +56,7 @@ export async function addIdBulk(query, actions, defaultGen = true) {
     const { idKey = "_id", numberId } = actions.adapterOpts;
     if (!id_gen)
         return;
+    assertSafeIdKey(idKey);
     if (!numberId) {
         for (const data of query.datas) {
             if (!data[idKey])

package/dist/helpers/assignDataPush.js

@@ -1,3 +1,4 @@
+import { isUnsafeKey } from "../utils/security.js";
 export function assignDataPush(data) {
     if (!data)
         return {};
@@ -7,6 +8,8 @@ export function assignDataPush(data) {
         return {};
     const obj = {};
     for (const key of Object.keys(data)) {
+        if (isUnsafeKey(key))
+            continue;
         if (!key.startsWith("$")) {
             obj[key] = data[key];
             continue;
@@ -14,7 +17,10 @@ export function assignDataPush(data) {
         const dk = data[key];
         if (Array.isArray(dk))
             continue;
-        Object.keys(dk).forEach(k => (obj[k] = dk[k]));
+        Object.keys(dk).forEach(k => {
+            if (!isUnsafeKey(k))
+                obj[k] = dk[k];
+        });
     }
     return obj;
 }

package/dist/helpers/collection.d.ts

@@ -6,6 +6,7 @@ import { DbFindOpts, FindOpts } from "../types/options.js";
 import { VQueryT } from "../types/query.js";
 import { VContext } from "../types/types.js";
 import { ValtheraCompatible } from "../types/valthera.js";
+export declare function resolveCollection(target: string | VQueryT.Collection): string;
 export declare class Collection<D = Data> {
     db: ValtheraCompatible;
     collection: string;

package/dist/helpers/collection.js

@@ -1,3 +1,6 @@
+export function resolveCollection(target) {
+    return typeof target === "string" ? target : target.collection;
+}
 export class Collection {
     db;
     collection;

package/dist/helpers/forge.js

@@ -1,9 +1,22 @@
+import { isUnsafeKey } from "../utils/security.js";
+function hasApiProperty(target, prop) {
+    if (isUnsafeKey(prop))
+        return false;
+    let current = target;
+    while (current && current !== Object.prototype) {
+        if (Object.hasOwn(current, prop))
+            return true;
+        current = Object.getPrototypeOf(current);
+    }
+    return false;
+}
 export function forgeTypedValthera(target) {
     return new Proxy(target, {
         get(target, prop, receiver) {
-            if (prop in target) {
+            if (typeof prop === "symbol")
+                return Reflect.get(target, prop, receiver);
+            if (hasApiProperty(target, prop))
                 return Reflect.get(target, prop, receiver);
-            }
             return target.c(prop);
         },
         set(target, prop, value, receiver) {

package/dist/helpers/plugin.d.ts

@@ -0,0 +1,2 @@
+import { PluginContext } from "../types/plugin.js";
+export declare function rewriteOp(ctx: PluginContext, op: string, query?: any): void;

package/dist/helpers/plugin.js

@@ -0,0 +1,9 @@
+import { getOpKind } from "../utils/opKind.js";
+export function rewriteOp(ctx, op, query) {
+    ctx.op = op;
+    if (query !== undefined)
+        ctx.query = query;
+    ctx.kind = getOpKind(op);
+    const q = ctx.query;
+    ctx.collection = typeof q === "string" ? q : q?.collection;
+}

package/dist/helpers/relation.js

@@ -1,21 +1,32 @@
 import { QueryValidationError } from "../errors.js";
+import { hasUnsafeSegment, isUnsafeKey } from "../utils/security.js";
 export function pickByPath(obj, paths) {
     const result = {};
     for (const path of paths) {
+        if (hasUnsafeSegment(path))
+            continue;
         let src = obj;
         let dst = result;
         for (let i = 0; i < path.length; i++) {
             const k = path[i];
             if (src == null)
                 break;
+            const isOwn = Object.hasOwn(src, k);
+            if (!isOwn && k in Object(src))
+                break;
             if (i === path.length - 1) {
                 dst[k] = src[k];
+                break;
             }
-            else {
-                dst[k] ||= {};
-                dst = dst[k];
-                src = src[k];
-            }
+            if (!Object.hasOwn(dst, k) ||
+                typeof dst[k] !== "object" ||
+                dst[k] === null ||
+                Array.isArray(dst[k]))
+                dst[k] = {};
+            if (!isOwn)
+                break;
+            dst = dst[k];
+            src = src[k];
         }
     }
     return result;
@@ -71,10 +82,12 @@ export async function processRelations(dbs, cfg, data, parentList = null) {
     if (targets.length === 0)
         return;
     for (const key in cfg) {
-        if (!Object.hasOwn(cfg, key))
+        if (!Object.hasOwn(cfg, key) || isUnsafeKey(key))
             continue;
         const rel = cfg[key];
         const { pk = "_id", fk = "_id", type = "1", path, as = key, select, dbFindOpts = {}, through, } = rel;
+        if (isUnsafeKey(as))
+            continue;
         const [dbKey, collection] = path;
         const db = dbs[dbKey];
         if (type === "1") {
@@ -150,7 +163,7 @@ export async function processRelations(dbs, cfg, data, parentList = null) {
                 acc[id] ||= [];
                 acc[id].push(row);
                 return acc;
-            }, {});
+            }, Object.create(null));
             for (const item of targets)
                 item[as] = grouped[item[pk]] || [];
             if (rel.relations)

package/dist/types/plugin.d.ts

@@ -1,8 +1,13 @@
 import type { ValtheraClass } from "../db/valthera.js";
+import type { PluginOpKind } from "../utils/opKind.js";
 export interface PluginContext {
     op: string;
+    kind: PluginOpKind;
+    collection?: string;
     query: any;
     next: () => Promise<any>;
+    setOp(op: string, query?: any): void;
+    setQuery(query: any): void;
 }
 export interface ValtheraPlugin {
     name: string;

package/dist/types/query.d.ts

@@ -94,4 +94,7 @@ export declare namespace VQueryT {
     type Count<T = Data> = QueryBase<T> & {
         search: Search<T, false>;
     };
+    interface Collection {
+        collection: string;
+    }
 }

package/dist/types/valthera.d.ts

@@ -6,8 +6,8 @@ import { VQueryT } from "./query.js";
 export interface ValtheraCompatible {
     c<T = Data>(collection: string): Collection<T>;
     getCollections(): Promise<string[]>;
-    ensureCollection(collection: string): Promise<boolean>;
-    issetCollection(collection: string): Promise<boolean>;
+    ensureCollection(collection: string | VQueryT.Collection): Promise<boolean>;
+    issetCollection(collection: string | VQueryT.Collection): Promise<boolean>;
     add<T = Data>(query: VQueryT.Add<T>): Promise<T>;
     find<T = Data>(query: VQueryT.Find<T>): Promise<T[]>;
     findOne<T = Data>(query: VQueryT.FindOne<T>): Promise<T | null>;
@@ -15,7 +15,7 @@ export interface ValtheraCompatible {
     updateOne<T = Data>(query: VQueryT.Update<T>): Promise<T | null>;
     remove<T = Data>(query: VQueryT.Remove<T>): Promise<T[]>;
     removeOne<T = Data>(query: VQueryT.Remove<T>): Promise<T | null>;
-    removeCollection(collection: string): Promise<boolean>;
+    removeCollection(collection: string | VQueryT.Collection): Promise<boolean>;
     updateOneOrAdd<T = Data>(query: VQueryT.UpdateOneOrAdd<T>): Promise<VQueryT.UpdateOneOrAddResult<T>>;
     toggleOne<T = Data>(query: VQueryT.ToggleOne<T>): Promise<VQueryT.ToggleOneResult<T>>;
     createIndex(collection: string, fields: string[], opts?: IndexOpts): Promise<void>;

package/dist/utils/action.js

@@ -1,4 +1,8 @@
 import { compareSafe } from "./compare.js";
+import { isUnsafeKey } from "./security.js";
+function getOwnValue(obj, key) {
+    return Object.hasOwn(obj, key) ? obj[key] : undefined;
+}
 export async function findUtil(query, fileCpuOrData, files, fileCpuOpts) {
     const { dbFindOpts = {} } = query;
     const { reverse = false, offset = 0, sortBy, sortAsc = true, min, max, avg, sum, distinct, groupBy, count, } = dbFindOpts;
@@ -69,18 +73,18 @@ export async function findUtil(query, fileCpuOrData, files, fileCpuOpts) {
     const hasAggregations = min || max || avg || sum || groupBy || count;
     if (hasAggregations) {
         const groups = new Map();
-        const groupKeys = Array.isArray(groupBy)
+        const groupKeys = (Array.isArray(groupBy)
             ? groupBy
             : groupBy
                 ? [
                     groupBy,
                 ]
-                : [];
+                : []).filter(key => !isUnsafeKey(key));
         if (groupKeys.length) {
             for (const data of datas) {
-                let key = String(data[groupKeys[0]] ?? "");
+                let key = String(getOwnValue(data, groupKeys[0]) ?? "");
                 for (let i = 1; i < groupKeys.length; i++) {
-                    key += "|" + String(data[groupKeys[i]] ?? "");
+                    key += "|" + String(getOwnValue(data, groupKeys[i]) ?? "");
                 }
                 let group = groups.get(key);
                 if (!group) {
@@ -98,14 +102,18 @@ export async function findUtil(query, fileCpuOrData, files, fileCpuOpts) {
             const result = {};
             if (groupKeys.length) {
                 const sample = groupItems[0];
-                for (const k of groupKeys)
-                    result[k] = sample[k];
+                for (const k of groupKeys) {
+                    if (Object.hasOwn(sample, k))
+                        result[k] = sample[k];
+                }
             }
             if (count) {
                 for (const [outKey, srcKey] of Object.entries(count)) {
+                    if (isUnsafeKey(outKey))
+                        continue;
                     let c = 0;
                     for (let i = 0; i < groupItems.length; i++) {
-                        const v = groupItems[i][srcKey];
+                        const v = getOwnValue(groupItems[i], srcKey);
                         if (v !== undefined && v !== null)
                             c++;
                     }
@@ -118,9 +126,11 @@ export async function findUtil(query, fileCpuOrData, files, fileCpuOpts) {
             const sumEntries = sum ? Object.entries(sum) : null;
             if (minEntries) {
                 for (const [outKey, srcField] of minEntries) {
+                    if (isUnsafeKey(outKey))
+                        continue;
                     let best = null;
                     for (let i = 0; i < groupItems.length; i++) {
-                        const v = groupItems[i][srcField];
+                        const v = getOwnValue(groupItems[i], srcField);
                         if (typeof v === "number") {
                             if (best === null || v < best)
                                 best = v;
@@ -131,9 +141,11 @@ export async function findUtil(query, fileCpuOrData, files, fileCpuOpts) {
             }
             if (maxEntries) {
                 for (const [outKey, srcField] of maxEntries) {
+                    if (isUnsafeKey(outKey))
+                        continue;
                     let best = null;
                     for (let i = 0; i < groupItems.length; i++) {
-                        const v = groupItems[i][srcField];
+                        const v = getOwnValue(groupItems[i], srcField);
                         if (typeof v === "number") {
                             if (best === null || v > best)
                                 best = v;
@@ -144,10 +156,12 @@ export async function findUtil(query, fileCpuOrData, files, fileCpuOpts) {
             }
             if (avgEntries) {
                 for (const [outKey, srcField] of avgEntries) {
+                    if (isUnsafeKey(outKey))
+                        continue;
                     let total = 0;
                     let c = 0;
                     for (let i = 0; i < groupItems.length; i++) {
-                        const v = groupItems[i][srcField];
+                        const v = getOwnValue(groupItems[i], srcField);
                         if (typeof v === "number") {
                             total += v;
                             c++;
@@ -158,10 +172,12 @@ export async function findUtil(query, fileCpuOrData, files, fileCpuOpts) {
             }
             if (sumEntries) {
                 for (const [outKey, srcField] of sumEntries) {
+                    if (isUnsafeKey(outKey))
+                        continue;
                     let total = 0;
                     let c = 0;
                     for (let i = 0; i < groupItems.length; i++) {
-                        const v = groupItems[i][srcField];
+                        const v = getOwnValue(groupItems[i], srcField);
                         if (typeof v === "number") {
                             total += v;
                             c++;
@@ -174,11 +190,11 @@ export async function findUtil(query, fileCpuOrData, files, fileCpuOpts) {
         }
         datas = aggregated;
     }
-    if (distinct) {
+    if (distinct && !isUnsafeKey(distinct)) {
         const seen = new Set();
         const result = [];
         for (let i = 0; i < datas.length; i++) {
-            const val = datas[i][distinct];
+            const val = getOwnValue(datas[i], distinct);
             const key = typeof val === "object" && val !== null ? JSON.stringify(val) : val;
             if (!seen.has(key)) {
                 seen.add(key);
@@ -195,7 +211,7 @@ export async function findUtil(query, fileCpuOrData, files, fileCpuOpts) {
             datas.sort((a, b) => {
                 for (const { field, asc = true } of sortBy) {
                     const dir = asc ? 1 : -1;
-                    const cmp = compareSafe(a[field], b[field]) * dir;
+                    const cmp = compareSafe(getOwnValue(a, field), getOwnValue(b, field)) * dir;
                     if (cmp !== 0)
                         return cmp;
                 }
@@ -204,7 +220,7 @@ export async function findUtil(query, fileCpuOrData, files, fileCpuOpts) {
         }
         else {
             const dir = sortAsc ? 1 : -1;
-            datas.sort((a, b) => compareSafe(a[sortBy], b[sortBy]) * dir);
+            datas.sort((a, b) => compareSafe(getOwnValue(a, sortBy), getOwnValue(b, sortBy)) * dir);
         }
     }
     if (offset > 0 || limit !== -1) {

package/dist/utils/hasFields.js

@@ -7,7 +7,7 @@
 export function hasFields(obj, fields) {
     const keys = Object.keys(fields);
     return keys.every(key => {
-        if (obj[key] !== undefined) {
+        if (Object.hasOwn(obj, key)) {
             if (typeof fields[key] === "object" && fields[key] !== null) {
                 return hasFields(obj[key], fields[key]);
             }

package/dist/utils/hasFieldsAdvanced.js

@@ -1,6 +1,7 @@
 import { QueryValidationError } from "../errors.js";
 import { hasFields } from "./hasFields.js";
 import { compareIds } from "./id.js";
+import { isUnsafeKey } from "./security.js";
 /**
  * Checks if an object meets the criteria specified in the fields with operators.
  */
@@ -16,6 +17,8 @@ export function hasFieldsAdvanced(obj, fields) {
     const subsetFields = {};
     let hasSubset = false;
     for (const key in fields) {
+        if (!Object.hasOwn(fields, key) || isUnsafeKey(key))
+            continue;
         if (key.charCodeAt(0) === 36) {
             $fields[key.toLowerCase()] = fields[key];
         }
@@ -31,17 +34,17 @@ export function hasFieldsAdvanced(obj, fields) {
     if (Object.keys($fields).length === 0)
         return true;
     // Subset check
-    if ("$subset" in $fields && !hasFields(obj, $fields["$subset"]))
+    if (Object.hasOwn($fields, "$subset") && !hasFields(obj, $fields["$subset"]))
         return false;
     // Advanced operators
     if (!mainCheck(obj, $fields))
         return false;
     if (!checkNot(obj, $fields))
         return false;
-    if ("$and" in $fields) {
+    if (Object.hasOwn($fields, "$and")) {
         return $fields["$and"].every((subFields) => hasFieldsAdvanced(obj, subFields));
     }
-    if ("$or" in $fields) {
+    if (Object.hasOwn($fields, "$or")) {
         return $fields["$or"].some((subFields) => hasFieldsAdvanced(obj, subFields));
     }
     return true;
@@ -57,9 +60,9 @@ function mainCheck(obj, fields) {
         nin: (data, value) => !value.includes(data),
         type: (data, value) => typeof data === value,
         exists: (targetObj, shouldExist, key) => {
-            if (shouldExist && !(key in targetObj))
+            if (shouldExist && !Object.hasOwn(targetObj, key))
                 return false;
-            if (!shouldExist && key in targetObj)
+            if (!shouldExist && Object.hasOwn(targetObj, key))
                 return false;
             return true;
         },
@@ -93,7 +96,7 @@ function mainCheck(obj, fields) {
     });
 }
 function checkNot(obj, fields) {
-    if ("$not" in fields) {
+    if (Object.hasOwn(fields, "$not")) {
         return !hasFieldsAdvanced(obj, fields["$not"]);
     }
     return true;
@@ -101,11 +104,13 @@ function checkNot(obj, fields) {
 function _for(fields, obj, opts) {
     for (const [field, value] of Object.entries(fields)) {
         const fieldRaw = field.slice(1);
-        const fieldFn = opts[fieldRaw];
+        const fieldFn = Object.hasOwn(opts, fieldRaw) ? opts[fieldRaw] : undefined;
         if (!fieldFn)
             continue;
         for (const [key, val] of Object.entries(value)) {
-            const targetValue = obj?.[key];
+            if (isUnsafeKey(key))
+                continue;
+            const targetValue = obj != null && Object.hasOwn(obj, key) ? obj[key] : undefined;
             if (typeof val === "object" &&
                 val !== null &&
                 !Array.isArray(val) &&
@@ -131,7 +136,9 @@ function deepCheck(valueObj, targetObj, fieldFn, fieldRaw) {
     if (typeof targetObj !== "object" || targetObj === null)
         return false;
     for (const [k, v] of Object.entries(valueObj)) {
-        const targetValue = targetObj[k];
+        if (isUnsafeKey(k))
+            continue;
+        const targetValue = Object.hasOwn(targetObj, k) ? targetObj[k] : undefined;
         if (typeof v === "object" &&
             v !== null &&
             !Array.isArray(v) &&

package/dist/utils/merge.js

@@ -1,3 +1,4 @@
+import { isUnsafeKey } from "./security.js";
 export function _deepMerge(target, ...sources) {
     if (!sources.length)
         return target;
@@ -6,6 +7,8 @@ export function _deepMerge(target, ...sources) {
         target = {};
     if (isObject(target) && isObject(source)) {
         for (const key in source) {
+            if (!Object.hasOwn(source, key) || isUnsafeKey(key))
+                continue;
             if (isObject(source[key])) {
                 if (!target[key])
                     Object.assign(target, {
@@ -30,8 +33,11 @@ function fastClone(obj) {
     if (obj instanceof Date)
         return new Date(obj.getTime());
     const result = {};
-    for (const key in obj)
+    for (const key in obj) {
+        if (!Object.hasOwn(obj, key) || isUnsafeKey(key))
+            continue;
         result[key] = fastClone(obj[key]);
+    }
     return result;
 }
 export function deepMerge(target, ...sources) {

package/dist/utils/opKind.d.ts

@@ -0,0 +1,9 @@
+export type PluginOpKind = "read" | "write" | "delete" | "collection" | "index" | "meta" | "control";
+export declare function getOpKind(op: string): PluginOpKind;
+export declare function isKnownOp(op: string): boolean;
+export declare function isMutation(kind: PluginOpKind): kind is "delete" | "write";
+export declare function isCollectionOp(op: string): boolean;
+export declare function isIndexOp(op: string): boolean;
+export declare function isMetaOp(op: string): boolean;
+export declare function isControlOp(op: string): boolean;
+export declare function isNoQueryOp(op: string): boolean;

package/dist/utils/opKind.js

@@ -0,0 +1,48 @@
+const OP_KINDS = {
+    find: "read",
+    findOne: "read",
+    count: "read",
+    add: "write",
+    bulkAdd: "write",
+    update: "write",
+    updateOne: "write",
+    updateOneOrAdd: "write",
+    toggleOne: "write",
+    remove: "delete",
+    removeOne: "delete",
+    ensureCollection: "collection",
+    issetCollection: "collection",
+    removeCollection: "collection",
+    createIndex: "index",
+    removeIndex: "index",
+    getCollections: "meta",
+    capabilities: "meta",
+    beginTransaction: "control",
+    commitTransaction: "control",
+    rollbackTransaction: "control",
+};
+export function getOpKind(op) {
+    return Object.hasOwn(OP_KINDS, op) ? OP_KINDS[op] : "write";
+}
+export function isKnownOp(op) {
+    return Object.hasOwn(OP_KINDS, op);
+}
+export function isMutation(kind) {
+    return kind === "write" || kind === "delete";
+}
+export function isCollectionOp(op) {
+    return getOpKind(op) === "collection";
+}
+export function isIndexOp(op) {
+    return getOpKind(op) === "index";
+}
+export function isMetaOp(op) {
+    return getOpKind(op) === "meta";
+}
+export function isControlOp(op) {
+    return getOpKind(op) === "control";
+}
+export function isNoQueryOp(op) {
+    const kind = getOpKind(op);
+    return kind === "collection" || kind === "meta";
+}

package/dist/utils/security.d.ts

@@ -0,0 +1,2 @@
+export declare function isUnsafeKey(key: string): boolean;
+export declare function hasUnsafeSegment(path: string[]): boolean;

package/dist/utils/security.js

@@ -0,0 +1,11 @@
+const UNSAFE_KEYS = new Set([
+    "__proto__",
+    "constructor",
+    "prototype",
+]);
+export function isUnsafeKey(key) {
+    return UNSAFE_KEYS.has(key);
+}
+export function hasUnsafeSegment(path) {
+    return path.some(segment => isUnsafeKey(segment));
+}

package/dist/utils/updateFindObject.js

@@ -1,14 +1,17 @@
+import { hasUnsafeSegment } from "./security.js";
 function resolvePath(path) {
     return Array.isArray(path) ? path : path.split(".");
 }
 function deleteNested(obj, path) {
     const segs = resolvePath(path);
-    if (segs.length === 0)
+    if (segs.length === 0 || hasUnsafeSegment(segs))
         return;
     let cur = obj;
     for (let i = 0; i < segs.length - 1; i++) {
         if (cur == null || typeof cur !== "object")
             return;
+        if (!Object.hasOwn(cur, segs[i]))
+            return;
         cur = cur[segs[i]];
     }
     if (cur != null && typeof cur === "object") {
@@ -39,12 +42,14 @@ export function updateFindObject(obj, findOpts) {
         const result = {};
         for (const field of select) {
             const segs = typeof field === "string" ? field.split(".") : field;
-            if (!segs.length)
+            if (!segs.length || hasUnsafeSegment(segs))
                 continue;
             let src = obj;
             let found = true;
             for (let i = 0; i < segs.length; i++) {
-                if (src == null || typeof src !== "object" || !(segs[i] in src)) {
+                if (src == null ||
+                    typeof src !== "object" ||
+                    !Object.hasOwn(src, segs[i])) {
                     found = false;
                     break;
                 }
@@ -54,7 +59,7 @@ export function updateFindObject(obj, findOpts) {
                 let dst = result;
                 for (let i = 0; i < segs.length - 1; i++) {
                     const s = segs[i];
-                    if (!(s in dst) ||
+                    if (!Object.hasOwn(dst, s) ||
                         typeof dst[s] !== "object" ||
                         Array.isArray(dst[s])) {
                         dst[s] = {};

package/dist/utils/updateObject.js

@@ -1,5 +1,6 @@
 import { QueryValidationError } from "../errors.js";
 import { _deepMerge } from "./merge.js";
+import { isUnsafeKey } from "./security.js";
 /**
  * Updates an object with new values.
  * @param obj - The object to update.
@@ -17,6 +18,8 @@ export function updateObjectAdvanced(obj, field) {
     let hasDollar = false;
     let hasSubset = false;
     for (const key in field) {
+        if (!Object.hasOwn(field, key) || isUnsafeKey(key))
+            continue;
         if (key.charCodeAt(0) === 36) {
             $fields[key.toLowerCase()] = field[key];
             hasDollar = true;
@@ -34,7 +37,7 @@ export function updateObjectAdvanced(obj, field) {
         updateObject(obj, subsetFields);
 }
 function deepMerge(obj, fields) {
-    if (!("$deepmerge" in fields))
+    if (!Object.hasOwn(fields, "$deepmerge"))
         return obj;
     if (Object.keys(obj).length === 0)
         return fields.$deepmerge;
@@ -86,10 +89,16 @@ function mainUpdate(obj, fields) {
                 ];
             }
             if (typeof item === "object" &&
+                item !== null &&
                 typeof updater === "object" &&
+                updater !== null &&
                 !Array.isArray(item) &&
                 !Array.isArray(updater)) {
-                Object.assign(item, updater);
+                for (const key of Object.keys(updater)) {
+                    if (isUnsafeKey(key))
+                        continue;
+                    item[key] = updater[key];
+                }
                 return item;
             }
             return updater;
@@ -98,7 +107,7 @@ function mainUpdate(obj, fields) {
             if (typeof item === "number" && typeof updater === "number") {
                 return item + updater;
             }
-            if (!(key in deepObj))
+            if (!Object.hasOwn(deepObj, key))
                 return updater;
             throw new QueryValidationError(`Cannot increment non-numeric value at key: ${key}`, {
                 op: "update",
@@ -109,7 +118,7 @@ function mainUpdate(obj, fields) {
             if (typeof item === "number" && typeof updater === "number") {
                 return item - updater;
             }
-            if (!(key in deepObj))
+            if (!Object.hasOwn(deepObj, key))
                 return -updater;
             throw new QueryValidationError(`Cannot decrement non-numeric value at key: ${key}`, {
                 op: "update",
@@ -117,14 +126,16 @@ function mainUpdate(obj, fields) {
             });
         },
         rename: (_, newKey, oldKey, deepObj) => {
-            if (oldKey in deepObj) {
+            if (isUnsafeKey(oldKey) || isUnsafeKey(newKey))
+                return;
+            if (Object.hasOwn(deepObj, oldKey)) {
                 deepObj[newKey] = deepObj[oldKey];
                 delete deepObj[oldKey];
             }
         },
         set: (_, value) => value,
         unset: (_, __, key, deepObj) => {
-            if (key in deepObj)
+            if (Object.hasOwn(deepObj, key))
                 delete deepObj[key];
         },
     });
@@ -135,20 +146,24 @@ function mainUpdate(obj, fields) {
  * @param newVal - An object containing new values to update in the target object.
  */
 function updateObject(obj, newVal) {
-    for (const key in newVal)
-        if (Object.hasOwn(newVal, key))
-            obj[key] = newVal[key];
+    for (const key in newVal) {
+        if (!Object.hasOwn(newVal, key) || isUnsafeKey(key))
+            continue;
+        obj[key] = newVal[key];
+    }
     return obj;
 }
 function _for(fields, obj, opts) {
     for (const [field, value] of Object.entries(fields)) {
         const fieldRaw = field.slice(1);
-        const fieldFn = opts[fieldRaw];
+        const fieldFn = Object.hasOwn(opts, fieldRaw) ? opts[fieldRaw] : undefined;
         if (!fieldFn)
             continue;
         for (const [key, val] of Object.entries(value)) {
+            if (isUnsafeKey(key))
+                continue;
             if (typeof val === "object" && val !== null && !Array.isArray(val)) {
-                if (!obj[key])
+                if (!Object.hasOwn(obj, key) || !obj[key])
                     obj[key] = {};
                 deepUpdateCheck(val, obj[key], fieldFn);
             }
@@ -162,8 +177,10 @@ function _for(fields, obj, opts) {
 }
 function deepUpdateCheck(valueObj, targetObj, fieldFn) {
     for (const [k, v] of Object.entries(valueObj)) {
+        if (isUnsafeKey(k))
+            continue;
         if (typeof v === "object" && v !== null && !Array.isArray(v)) {
-            if (!targetObj[k])
+            if (!Object.hasOwn(targetObj, k) || !targetObj[k])
                 targetObj[k] = {};
             deepUpdateCheck(v, targetObj[k], fieldFn);
         }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const version = "0.12.11";
+export declare const version = "0.12.13";

package/dist/version.js

@@ -1 +1 @@
-export const version = "0.12.11";
+export const version = "0.12.13";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wxn0brp/db-core",
-  "version": "0.12.11",
+  "version": "0.12.13",
   "types": "dist/index.d.ts",
   "main": "dist/index.js",
   "author": "wxn0brP",