grafeo-ogm 1.13.0 → 2.0.0

package/dist/esm/utils/cypher-sort-projection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cypher-sort-projection.d.ts","sourceRoot":"","sources":["../../../src/utils/cypher-sort-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAO1D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,MAAM,CAQR;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,CAAC;IAClE,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtC,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAsCnC"}
+{"version":3,"file":"cypher-sort-projection.d.ts","sourceRoot":"","sources":["../../../src/utils/cypher-sort-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAS1D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,MAAM,CAQR;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,CAAC;IAClE,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtC,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAgDnC"}

package/dist/esm/utils/cypher-sort-projection.js

@@ -1,4 +1,4 @@
-import { assertSafeIdentifier, assertSortDirection, escapeIdentifier, } from './validation';
+import { assertPlainObject, assertSafeIdentifier, assertSingleSortKey, assertSortDirection, escapeIdentifier, } from './validation';
 /**
  * Builds the `CALL { ... }` subquery used to project an `@cypher` field
  * for `ORDER BY`. The user's statement is embedded verbatim with `this`
@@ -39,6 +39,9 @@ export function buildCypherSortProjection(statement, nodeVar) {
  *
  * The returned `pre` string is intended to be appended BEFORE the `RETURN`,
  * and `orderBy` to be appended AFTER it.
+ *
+ * Each entry must carry exactly ONE ordering key — precedence comes from the
+ * entry's position in the array. Multi-key entries throw (`assertSingleSortKey`).
  */
 export function compileSortClause(args) {
     const { sort, nodeVar, propertyLookup, preserveVars = [] } = args;
@@ -46,11 +49,20 @@ export function compileSortClause(args) {
     const sortItems = [];
     const carriedAliases = [];
     for (const sortObj of sort) {
+        // `Object.entries(null)` is a bare TypeError from inside the compiler;
+        // callers expect OGMError for every malformed input on this path.
+        assertPlainObject(sortObj, 'Sort entry');
         const entries = Object.entries(sortObj);
+        // A zero-key entry contributes no ordering (rather than a wrong one), so
+        // it stays a silent skip. A multi-key entry is always a mistake.
         if (entries.length === 0)
             continue;
+        // Validate every key, not just the surviving one, so `assertSingleSortKey`
+        // only ever interpolates identifier-shaped strings into its message.
+        for (const [key] of entries)
+            assertSafeIdentifier(key, 'sort field');
+        assertSingleSortKey(entries);
         const [field, direction] = entries[0];
-        assertSafeIdentifier(field, 'sort field');
         const validDirection = assertSortDirection(direction);
         const propDef = propertyLookup(field);
         if (propDef?.isCypher && propDef.cypherStatement) {

package/dist/esm/utils/cypher-sort-projection.js.map

@@ -1 +1 @@
-{"version":3,"file":"cypher-sort-projection.js","sourceRoot":"","sources":["../../../src/utils/cypher-sort-projection.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAEtB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,OAAe;IAEf,OAAO;QACL,QAAQ;QACR,UAAU,OAAO,EAAE;QACnB,UAAU,OAAO,UAAU;QAC3B,KAAK,SAAS,EAAE;QAChB,GAAG;KACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAKjC;IACC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAiC,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtC,oBAAoB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,UAAU,KAAK,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;YACrD,oBAAoB,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;YAEvD,QAAQ,CAAC,IAAI,CACX,yBAAyB,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAC5D,CAAC;YAEF,MAAM,KAAK,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,cAAc,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CACX,QAAQ,OAAO,GAAG,QAAQ,KAAK,gBAAgB,CAAC,UAAU,CAAC,OAAO,KAAK,EAAE,CAC1E,CAAC;YACF,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,cAAc,EAAE,CAAC,CAAC;QAC/C,CAAC;;YACC,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;KACpE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cypher-sort-projection.js","sourceRoot":"","sources":["../../../src/utils/cypher-sort-projection.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAEtB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,OAAe;IAEf,OAAO;QACL,QAAQ;QACR,UAAU,OAAO,EAAE;QACnB,UAAU,OAAO,UAAU;QAC3B,KAAK,SAAS,EAAE;QAChB,GAAG;KACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAKjC;IACC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,uEAAuE;QACvE,kEAAkE;QAClE,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAEzC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAiC,CAAC,CAAC;QAClE,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,2EAA2E;QAC3E,qEAAqE;QACrE,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO;YAAE,oBAAoB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACrE,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,cAAc,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,UAAU,KAAK,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;YACrD,oBAAoB,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;YAEvD,QAAQ,CAAC,IAAI,CACX,yBAAyB,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAC5D,CAAC;YAEF,MAAM,KAAK,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,cAAc,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CACX,QAAQ,OAAO,GAAG,QAAQ,KAAK,gBAAgB,CAAC,UAAU,CAAC,OAAO,KAAK,EAAE,CAC1E,CAAC;YACF,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,cAAc,EAAE,CAAC,CAAC;QAC/C,CAAC;;YACC,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;KACpE,CAAC;AACJ,CAAC"}

package/dist/esm/utils/validation.d.ts

@@ -44,11 +44,83 @@ export declare function assertSafeLabel(label: string): string;
  * Validate sort direction is strictly ASC or DESC.
  */
 export declare function assertSortDirection(direction: string): 'ASC' | 'DESC';
+/**
+ * Assert that a single `sort` array entry carries exactly one ordering key.
+ *
+ * v2.0.0 — pre-2.0.0 `compileSortClause` read only `Object.entries(entry)[0]`
+ * and silently discarded the rest, so `[{ a: 'ASC', b: 'DESC' }]` compiled to
+ * `ORDER BY n.a ASC` with no error and no log: a successful query answering a
+ * different question. Which key survived depended purely on source insertion
+ * order.
+ *
+ * Ordering precedence must be carried by ARRAY POSITION, never by object key
+ * order. Honoring every key would only move the bug: graphql-js
+ * `coerceInputValue` rebuilds input objects by iterating the schema's field
+ * definitions, so the key order a client wrote is already gone by the time the
+ * object reaches the OGM.
+ *
+ * Callers must validate each key with `assertSafeIdentifier` BEFORE calling
+ * this, so the keys interpolated into the message are known-safe.
+ */
+export declare function assertSingleSortKey(entries: ReadonlyArray<[string, unknown]>): void;
+/**
+ * Assert that a fulltext input object references exactly one index.
+ *
+ * v2.0.0 — the same silent-truncation defect fixed for `sort` (see
+ * `assertSingleSortKey`) also lived in `FulltextCompiler`, at three sites that
+ * each guarded the empty case and then read `Object.keys(input)[0]`. A leaf
+ * naming two indexes searched only the first and dropped the second with no
+ * error, so the query returned a strictly WIDER result set than asked for — a
+ * filter that silently stops filtering.
+ *
+ * Multiple indexes are expressed with the existing `AND` / `OR` combinators,
+ * which compile to correlated subqueries and `UNION` respectively.
+ *
+ * Phrase values are never echoed: they are user data and may carry control
+ * characters or sensitive content. Callers must validate each key with
+ * `assertSafeIdentifier` BEFORE calling this.
+ */
+export declare function assertSingleFulltextKey(entries: ReadonlyArray<[string, unknown]>, subject: string): void;
+/**
+ * Assert that a fulltext input carrying `OR` / `AND` / `NOT` carries nothing
+ * else alongside it.
+ *
+ * v2.0.0 — the dispatch in `FulltextCompiler.compileNode` tests the operators
+ * in order (`OR`, then `AND`, then `NOT`) and returns on the first hit, so any
+ * remaining top-level key was silently discarded:
+ *
+ * - `{ OR: [...], AND: [...] }` compiled the OR branch only.
+ * - `{ OR: [...], SomeIndex: {...} }` compiled the OR branch only.
+ * - `{ NOT: {...}, AND: [...] }` compiled the AND branch only — an exclusion
+ *   filter vanished entirely, which inverts the caller's intent rather than
+ *   merely widening the result set.
+ *
+ * Operators nest instead of stacking: `{ AND: [{ OR: [...] }, { ... }] }`.
+ *
+ * Only the recognised operator names — fixed literals — are interpolated into
+ * the message. Sibling keys are counted, never echoed, because they have not
+ * been identifier-validated at this point in the pipeline.
+ */
+export declare function assertSingleFulltextOperator(keys: readonly string[]): void;
 /**
  * Type guard that narrows an unknown value to a plain object.
  * Returns false for null, arrays, and non-object primitives.
  */
 export declare function isPlainObject(value: unknown): value is Record<string, unknown>;
+/**
+ * Assert that a value the compilers are about to enumerate — with
+ * `Object.entries`, `Object.keys`, or the `in` operator — is a plain object.
+ *
+ * v2.0.0 — without this, `sort: [null]` surfaced as a bare
+ * `TypeError: Cannot convert undefined or null to object` thrown from deep
+ * inside the compiler, and fulltext inputs failed similarly on `'OR' in input`.
+ * Both escaped `catch (e) { if (e instanceof OGMError) … }`, even though every
+ * other malformed input on those paths is an `OGMError`.
+ *
+ * Only the value's KIND is reported, never the value itself — the caller may
+ * have handed us anything.
+ */
+export declare function assertPlainObject(value: unknown, subject: string): void;
 /**
  * Merge parameter records into the target. Skips merge if `source` is empty
  * or undefined. Returns the target for chaining.
@@ -57,4 +129,11 @@ export declare function isPlainObject(value: unknown): value is Record<string, u
  * declarative and centralize parameter accumulation logic.
  */
 export declare function mergeParams(target: Record<string, unknown>, source: Record<string, unknown> | undefined): Record<string, unknown>;
+/**
+ * Assert that a `_MATCHES` regex pattern is provably free of catastrophic
+ * backtracking. Throws `OGMError` on anything it cannot prove linear. Only
+ * string values reach here; the value is already parameterized, so this is a
+ * semantic guard on the operator, never string interpolation.
+ */
+export declare function assertSafeRegexPattern(pattern: string, context: string): void;
 //# sourceMappingURL=validation.d.ts.map

package/dist/esm/utils/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/utils/validation.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAKhE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAG1E;AAKD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAKzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAI3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAMrE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzB"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/utils/validation.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAKhE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAG1E;AAKD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAKzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAI3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAMrE;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,IAAI,CAkBN;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,EAAE,MAAM,GACd,IAAI,CAUN;AAKD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAe1E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAevE;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzB;AA0HD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAqD7E"}