grafeo-ogm 2.6.0 → 2.6.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 2.6.1 (2026-10-18) — security fixes
+
+> **Security patch.** Fixes two authorization bypasses in node-level security, both present since policies were introduced: `upsert` ignored the `update` row filter on an existing node, and mutation responses returned nodes the context cannot read. Both affect **1.7.0–2.6.0**. OGMs without `policies` compile the same policy-free Cypher as before. Upgrade if you use `policies`.
+
+### Security
+
+- **`upsert` rewrote existing nodes the context could not update (high).** The MERGE put the `update` input in `ON MATCH SET` with no policy predicate. Only the update `WITH CHECK` restrictives ran, at the application layer. So a context for which a direct `update` matched 0 rows could still rewrite the node through `upsert`, including the owner field that the `update` policy keys on, and so take ownership of it. With `policies: { Chart: [permissive({ operations: ['update'], when: (c) => ({ ownerId: c.uid }) })] }`, user `u1` could run `Chart.upsert({ where: { id: 'c2' }, create: {…}, update: { ownerId: 'u1' } })` on a chart owned by `u2` and become its owner. The MERGE now applies the type's `update` row filter to the node it matches. That is the same clause a direct `update` puts in its `WHERE`: the applicable `update` permissives OR-ed (inherited interface policies included), and `false` when none applies. The update `WITH CHECK` still runs on the input. `createMany({ skipDuplicates: true, labels })` had the same gap in default mode: the runtime `labels` were `SET` on every existing node the MERGE matched. A matched node is now relabelled only when it passes the `update` row filter (a label change is an update, as `setLabels` enforces). Introduced with policies in 1.7.0 (`90ef75e`, v1.7.0-beta.0), where the upsert MERGE carried no row predicate.
+- **Mutation responses returned nodes the context cannot read (medium).** `create`, `update` and `upsert` returned every node they wrote. Nested selections were filtered by their target types' `read` policies, but the root node was not. A context that could update a node, but whose `read` policy hid it, got the whole node back, including the fields `find` withholds. `update({ where: { id }, update: {} })` was enough to read it. A context that could create a node its read policy hides got it back the same way. The response projection now applies the root type's `read` policy to each node in its post-write state, just as `find` would filter it. Writes are unchanged: an `update` still needs only the `update` policy, as documented for nested writes. Present since 1.7.0, whose mutation projections passed the `read` bundle to nested selections only.
+
+### Behavior change
+
+- **`upsert` on an existing node** is now updated only when the node passes the type's `update` row filter. If it fails the filter, nothing is written (no update and no create) and `upsert` returns `null`, as a direct `update` that matches 0 rows returns no row. The create path (no node matches) is unchanged, and the matched node does not need to be readable, as with `update`. Under `policyDefaults: { onDeny: 'throw' }`, `upsert` still throws `PolicyDeniedError` before compile when no `update` permissive applies, as `update` does. **`createMany({ skipDuplicates: true, labels })`** in default mode no longer relabels existing nodes that fail the `update` row filter. It never throws for this, because the call is a create. Types without an `update` policy, overrides and bypasses compile the MERGE exactly as before.
+- **Mutation responses** leave out every node the context cannot read after the write. It is missing from `create` / `update`'s `<plural>` array, and `upsert` returns `null`. The write still lands, and `info` counters still count it. Types without a `read` policy, overrides and bypasses compile exactly as before.
+
 ## 2.6.0 (2026-10-18) — strict mode
 
 > **Minor release.** It adds an opt-in `strict` mode with the corrected behaviour for input shapes that 2.x compiles in surprising ways. **There are no behaviour changes without `strict`.** With `strict` unset or `false`, every input compiles to the same Cypher as in 2.5.4 and returns the same results. The one exception is the aggregate fix under Fixes, where a query that used to crash now returns `null` for the affected keys. Apart from that, the only difference is the deprecation warnings described below. Generated types are unchanged.

package/README.md

@@ -1526,6 +1526,8 @@ Writes follow one principle: **a nested write enforces exactly what the equivale
 
 Write restrictives and create default-deny are checked before the query runs, so a rejected nested write throws `PolicyDeniedError` and nothing is written.
 
+**Mutation responses are reads.** The nodes that `create`, `update` and `upsert` return are filtered by the root type's `read` policy, checked against the node as it is after the write, just as `find` would filter them. A write to a node the context may update or create but not read still happens, but that node is left out of the response: it is missing from the `<plural>` array, and `upsert` returns `null`. The `info` counters still count it. Nested selections in the response were already filtered by their own target-type policies. Before v2.6.1 the root node came back in full, including fields its `read` policy hides.
+
 > **A type without policies is open, but not a gateway.** Before v2.3.0, reading or writing through a type with no policies of its own skipped the policies of the types beyond it, and nested writes enforced no target-type policy at all. If a nested write into a protected type now gets filtered or denied, add the matching policy for that operation on the target type, or perform the write directly on its model.
 
 #### Enforcement boundary
@@ -1614,7 +1616,7 @@ How it works:
 #### Limitations
 
 - **`@cypher` scalar fields inside a policy `where`-partial throw when the policy is injected into nested-selection enforcement.** Refactor the policy to use stored properties or a relationship traversal.
-- **`upsert`** evaluates create- and update-side policies at the application layer (MERGE has no WHERE). Documented limit; full MERGE-aware enforcement is not yet implemented.
+- **`upsert`** enforces exactly what the equivalent direct calls would. When no node matches the `where`, it creates one under the `create` policy (default-deny and `WITH CHECK`). When a node matches, the type's `update` row filter applies to it, the same clause a direct `update` puts in its `WHERE`: the node is updated only if it passes, and if it fails nothing is written and `upsert` returns `null`, just as a direct `update` matches 0 rows. The update input is also checked against the update `WITH CHECK`. As with `update`, the matched node does not have to be readable. With `skipDuplicates`, `createMany` adds default-mode `labels` to an existing node it matches only if that node passes the `update` row filter. Before v2.6.1 only the `WITH CHECK` ran, so `upsert` could rewrite any existing node, including the owner field the update policy keys on.
 - **Restrictives are split into read-side and write-side flavors.** A restrictive's `operations` array determines which `when` signature applies. Read-side ops (`read|delete|aggregate|count`) → `when(ctx)` returns a where-partial or boolean. Write-side ops (`create|update`) → `when(ctx, input)` returns a boolean only. Mixed arrays (e.g. `['read', 'create']`) are rejected at construction time — split into two restrictives. Each flavor is invoked exactly once per query (read-side at compile, write-side at the application layer). Use `isReadRestrictive` / `isWriteRestrictive` if you need to inspect a policy at runtime.
 - **InterfaceModel branches.** Each implementer's `CASE` branch is exactly the policy clause that implementer's own model enforces, including the interface-level policies it inherits. An implementer with no policies of its own therefore gets only the interface-level ones. The OGM emits a `logger.warn` at construction time when an interface has policies and one of its implementers does not. Silence it by registering an explicit policy on each implementer.
 - **`edge` filters in nested-write `where`** (connect, disconnect, nested update and delete) are not supported and throw.

package/dist/cjs/compilers/mutation.compiler.d.ts

@@ -7,6 +7,16 @@ export interface MutationResult {
     cypher: string;
     params: Record<string, unknown>;
 }
+/**
+ * v2.6.1 — a row filter on `n` that gates the MATCH side of a MERGE (the
+ * root type's `update` policy, compiled by `WhereCompiler.compile`). An
+ * empty `cypher` means "no filter" and leaves the emitted Cypher unchanged.
+ */
+export interface MatchGuard {
+    cypher: string;
+    params: Record<string, unknown>;
+    preludes?: string[];
+}
 /**
  * Compiles create, update, delete, and label mutations into Cypher + params.
  */
@@ -228,8 +238,14 @@ export declare class MutationCompiler {
     /**
      * Generate MERGE (upsert) Cypher with ON CREATE SET / ON MATCH SET.
      * Scalar properties only — nested relationship ops are not supported.
+     *
+     * v2.6.1 — `updateGuard` is the root type's `update` row filter on `n`
+     * (compiled by the caller with `preserveVars: ['__matched']`). When it
+     * is non-empty, an EXISTING node is updated only when it passes the
+     * guard, exactly like a direct `update`; one that fails it is left
+     * untouched and no row is returned. See `buildGuardedMerge`.
      */
-    compileMerge(where: Record<string, unknown>, create: Record<string, unknown>, update: Record<string, unknown>, nodeDef: NodeDefinition, labels?: string[]): MutationResult;
+    compileMerge(where: Record<string, unknown>, create: Record<string, unknown>, update: Record<string, unknown>, nodeDef: NodeDefinition, labels?: string[], updateGuard?: MatchGuard): MutationResult;
     /**
      * Generate SET/REMOVE labels Cypher.
      */
@@ -243,7 +259,15 @@ export declare class MutationCompiler {
      * Scalar properties only — no nested relationship operations.
      * Returns count of created nodes.
      */
-    compileCreateMany(data: Record<string, unknown>[], nodeDef: NodeDefinition, skipDuplicates?: boolean, labels?: string[]): MutationResult;
+    compileCreateMany(data: Record<string, unknown>[], nodeDef: NodeDefinition, skipDuplicates?: boolean, labels?: string[], 
+    /**
+     * v2.6.1 — the root type's `update` row filter on `n`. With
+     * `skipDuplicates` and default-mode `labels`, an EXISTING node the
+     * MERGE matched is relabelled only when it passes this guard (a label
+     * change is an update, as `setLabels` enforces); created nodes get the
+     * labels in `ON CREATE SET`.
+     */
+    updateGuard?: MatchGuard): MutationResult;
     /**
      * Resolve the PropertyDefinition of an edge (relationship) property so
      * Int/BigInt edge writes get the same Integer coercion as node writes.

package/dist/cjs/compilers/mutation.compiler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mutation.compiler.d.ts","sourceRoot":"","sources":["../../../src/compilers/mutation.compiler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,cAAc,EAGd,cAAc,EACf,MAAM,iBAAiB,CAAC;AAqBzB,OAAO,EAAqB,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AA4DD;;GAEG;AACH,qBAAa,gBAAgB;IAsBzB,OAAO,CAAC,MAAM;IArBhB;;;OAGG;IACH,OAAO,CAAC,UAAU,CAA6B;IAE/C,OAAO,CAAC,MAAM,CAAC,CAAY;IAE3B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAgB;IAE5C,4DAA4D;IAC5D,OAAO,CAAC,UAAU,CAAa;gBAGrB,MAAM,EAAE,cAAc,EAC9B,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,SAAS,CAAC;QACnB,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;KACzB;IAOH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,0BAA0B;IAwDlC;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,sBAAsB;IAU9B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,yBAAyB;IA+BjC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAQxB,8EAA8E;IAC9E,WAAW,IAAI,IAAI;IAInB,OAAO,CAAC,oBAAoB;IAQ5B;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAqBnB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IASxB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAc5B;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA6BrB;;;OAGG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACjC,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,mBAAmB;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/B,cAAc;IA+DjB;;OAEG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC/C,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,UAAU,GAAE,MAAM,GAAG,OAAgB;IACrC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,mBAAmB;IACnC;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/B,cAAc;IAsFjB;;;;;;;;OAQG;IACH,aAAa,CACX,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACrC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,mBAAmB;IACnC,gEAAgE;IAChE,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/B,cAAc;IA+CjB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,iBAAiB;IAqFzB;;;OAGG;IACH,YAAY,CACV,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,cAAc;IAuJjB;;OAEG;IACH,gBAAgB,CACd,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,SAAS,CAAC,EAAE,MAAM,EAAE,EACpB,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,cAAc;IA2CjB;;;;OAIG;IACH,iBAAiB,CACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAC/B,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,OAAO,EACxB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,cAAc;IAiMjB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,qBAAqB;IA4C7B,OAAO,CAAC,wBAAwB;IAgFhC;;;OAGG;IACH,OAAO,CAAC,iCAAiC;IA8KzC;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;IAyDrB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA+LxB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,gBAAgB;IAiJxB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAsDxB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IA+C7B,yEAAyE;IACzE,OAAO,CAAC,mBAAmB;IA6I3B;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAyC;IAEhE,OAAO,CAAC,cAAc;IAStB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;IAoB1B,0EAA0E;IAC1E,OAAO,CAAC,kBAAkB;IAO1B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IA4C9B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAygBhC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAcvC;IAEF;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAY3B,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,6BAA6B;IAkCrC,OAAO,CAAC,qBAAqB;CAQ9B;AAoCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiDzB;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,GACrB,cAAc,GAAG,IAAI,CAiBvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAenC"}
+{"version":3,"file":"mutation.compiler.d.ts","sourceRoot":"","sources":["../../../src/compilers/mutation.compiler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,cAAc,EAGd,cAAc,EACf,MAAM,iBAAiB,CAAC;AAqBzB,OAAO,EAAqB,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AA4DD;;GAEG;AACH,qBAAa,gBAAgB;IAsBzB,OAAO,CAAC,MAAM;IArBhB;;;OAGG;IACH,OAAO,CAAC,UAAU,CAA6B;IAE/C,OAAO,CAAC,MAAM,CAAC,CAAY;IAE3B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAgB;IAE5C,4DAA4D;IAC5D,OAAO,CAAC,UAAU,CAAa;gBAGrB,MAAM,EAAE,cAAc,EAC9B,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,SAAS,CAAC;QACnB,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;KACzB;IAOH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,0BAA0B;IAwDlC;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,sBAAsB;IAU9B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,yBAAyB;IA+BjC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAQxB,8EAA8E;IAC9E,WAAW,IAAI,IAAI;IAInB,OAAO,CAAC,oBAAoB;IAQ5B;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAqBnB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IASxB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAc5B;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA6BrB;;;OAGG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACjC,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,mBAAmB;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/B,cAAc;IA+DjB;;OAEG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC/C,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,UAAU,GAAE,MAAM,GAAG,OAAgB;IACrC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,mBAAmB;IACnC;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/B,cAAc;IAsFjB;;;;;;;;OAQG;IACH,aAAa,CACX,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACrC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,mBAAmB;IACnC,gEAAgE;IAChE,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/B,cAAc;IA+CjB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,iBAAiB;IAqFzB;;;;;;;;;OASG;IACH,YAAY,CACV,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,WAAW,CAAC,EAAE,UAAU,GACvB,cAAc;IAkKjB;;OAEG;IACH,gBAAgB,CACd,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,SAAS,CAAC,EAAE,MAAM,EAAE,EACpB,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,cAAc;IA2CjB;;;;OAIG;IACH,iBAAiB,CACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAC/B,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,OAAO,EACxB,MAAM,CAAC,EAAE,MAAM,EAAE;IACjB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,UAAU,GACvB,cAAc;IA6NjB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,qBAAqB;IA4C7B,OAAO,CAAC,wBAAwB;IAgFhC;;;OAGG;IACH,OAAO,CAAC,iCAAiC;IA8KzC;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;IAyDrB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA+LxB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,gBAAgB;IAiJxB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAsDxB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IA+C7B,yEAAyE;IACzE,OAAO,CAAC,mBAAmB;IA6I3B;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAyC;IAEhE,OAAO,CAAC,cAAc;IAStB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;IAoB1B,0EAA0E;IAC1E,OAAO,CAAC,kBAAkB;IAO1B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IA4C9B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAygBhC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAcvC;IAEF;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAY3B,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,6BAA6B;IAkCrC,OAAO,CAAC,qBAAqB;CAQ9B;AAoCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiDzB;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,GACrB,cAAc,GAAG,IAAI,CAiBvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAenC"}

package/dist/cjs/compilers/mutation.compiler.js

@@ -603,8 +603,14 @@ class MutationCompiler {
     /**
      * Generate MERGE (upsert) Cypher with ON CREATE SET / ON MATCH SET.
      * Scalar properties only — nested relationship ops are not supported.
+     *
+     * v2.6.1 — `updateGuard` is the root type's `update` row filter on `n`
+     * (compiled by the caller with `preserveVars: ['__matched']`). When it
+     * is non-empty, an EXISTING node is updated only when it passes the
+     * guard, exactly like a direct `update`; one that fails it is left
+     * untouched and no row is returned. See `buildGuardedMerge`.
      */
-    compileMerge(where, create, update, nodeDef, labels) {
+    compileMerge(where, create, update, nodeDef, labels, updateGuard) {
         const labelStr = this.getCachedLabelString(nodeDef);
         const lines = [];
         const params = {};
@@ -730,9 +736,15 @@ class MutationCompiler {
             updateSets.push(`n.${(0, validation_1.escapeIdentifier)(key)} = ${valueExpr}`);
             params[paramName] = (0, write_coercion_1.coerceWriteValue)(value, propDef);
         }
-        if (updateSets.length > 0)
+        if (updateGuard !== undefined && updateGuard.cypher !== '') {
+            const guarded = buildGuardedMerge(labelStr, mergeProps, updateGuard, updateSets, params);
+            lines.unshift(...guarded.before);
+            lines.push(...guarded.after);
+        }
+        else if (updateSets.length > 0)
             lines.push(`ON MATCH SET ${updateSets.join(', ')}`);
-        // Extra labels
+        // Extra labels. v2.6.1 — with an update guard, the rows that reach this
+        // SET are the created node and an existing node that passed the guard.
         if (labels && labels.length > 0 && !labelsOnCreate) {
             const validatedLabels = labels.map((l) => (0, validation_1.assertSafeLabel)(l)).join(':');
             lines.push(`SET n:${validatedLabels}`);
@@ -782,7 +794,15 @@ class MutationCompiler {
      * Scalar properties only — no nested relationship operations.
      * Returns count of created nodes.
      */
-    compileCreateMany(data, nodeDef, skipDuplicates, labels) {
+    compileCreateMany(data, nodeDef, skipDuplicates, labels, 
+    /**
+     * v2.6.1 — the root type's `update` row filter on `n`. With
+     * `skipDuplicates` and default-mode `labels`, an EXISTING node the
+     * MERGE matched is relabelled only when it passes this guard (a label
+     * change is an update, as `setLabels` enforces); created nodes get the
+     * labels in `ON CREATE SET`.
+     */
+    updateGuard) {
         if (data.length === 0)
             return { cypher: 'RETURN 0 AS count', params: {} };
         const labelStr = this.getCachedLabelString(nodeDef);
@@ -855,6 +875,12 @@ class MutationCompiler {
         });
         params.items = sanitizedItems;
         lines.push('UNWIND $items AS item');
+        const guardedLabels = Boolean(skipDuplicates) &&
+            !this.strictMode.strict &&
+            labels !== undefined &&
+            labels.length > 0 &&
+            updateGuard !== undefined &&
+            updateGuard.cypher !== '';
         if (skipDuplicates) {
             // MERGE key: the unique/id fields EVERY item supplies — an item
             // missing one would MERGE on null, which Neo4j rejects.
@@ -887,7 +913,11 @@ class MutationCompiler {
                 params[paramName] = bound;
             }
             // v2.6.0 — strict: labels only on the nodes MERGE creates.
-            if (this.strictMode.strict && labels && labels.length > 0)
+            // v2.6.1 — also with an update guard: the matched nodes are
+            // relabelled below, only where the guard passes.
+            if ((this.strictMode.strict || guardedLabels) &&
+                labels &&
+                labels.length > 0)
                 onCreateSets.push(`n:${labels.map((l) => (0, validation_1.assertSafeLabel)(l)).join(':')}`);
             if (onCreateSets.length > 0)
                 lines.push(`ON CREATE SET ${onCreateSets.join(', ')}`);
@@ -908,7 +938,20 @@ class MutationCompiler {
             lines.push(`CREATE (n:${labelStr} { ${propParts.join(', ')} })`);
         }
         // Extra labels
-        if (labels &&
+        if (guardedLabels) {
+            // v2.6.1 — matched nodes are relabelled only where the update guard
+            // passes. Pre-2.6.1 `SET n:<labels>` ran on every node the MERGE
+            // returned, so an existing node the context could not update was
+            // relabelled. FOREACH keeps one row per item (invariant 2).
+            const validatedLabels = labels.map((l) => (0, validation_1.assertSafeLabel)(l)).join(':');
+            (0, validation_1.mergeParams)(params, updateGuard.params);
+            lines.push('WITH n');
+            if (updateGuard.preludes && updateGuard.preludes.length > 0)
+                lines.push(...updateGuard.preludes);
+            lines.push(`FOREACH (__l IN CASE WHEN ${updateGuard.cypher} THEN [1] ELSE [] END | SET n:${validatedLabels})`);
+            this.labelsOnMatchedNodes(nodeDef, 'createMany');
+        }
+        else if (labels &&
             labels.length > 0 &&
             !(skipDuplicates && this.strictMode.strict)) {
             const validatedLabels = labels.map((l) => (0, validation_1.assertSafeLabel)(l)).join(':');
@@ -2197,6 +2240,47 @@ function upsertRelationshipError(nodeDef, key, branch) {
     return new errors_1.OGMError(`upsert does not support relationship fields: "${key}" in "${branch}" (${nodeDef.typeName}). ` +
         `Use create() / update() for nested relationship operations.`);
 }
+/**
+ * v2.6.1 — the lines around an upsert MERGE that apply the root type's
+ * `update` row filter to the node it MATCHES, as a direct `update` does:
+ *
+ *   OPTIONAL MATCH (__existing:L { key })        ┐ before
+ *   WITH count(__existing) > 0 AS __matched      ┘
+ *   MERGE (n:L { key })
+ *   ON CREATE SET …
+ *   WITH n, __matched                            ┐ after
+ *   [@cypher preludes of the guard]              │
+ *   WHERE NOT __matched OR (<guard>)             │
+ *   FOREACH (__u IN CASE WHEN __matched THEN [1] ELSE [] END | SET …)
+ *
+ * A created node passes untouched by the update sets; an existing node is
+ * updated only when it passes the guard; one that fails it is neither
+ * updated nor returned (and the MERGE created nothing). Pre-2.6.1 the
+ * update went in `ON MATCH SET` with no row filter, so any context the
+ * WITH CHECK admitted rewrote any existing node — even its owner field.
+ *
+ * `count()` keeps one row before the MERGE whether 0, 1 or several nodes
+ * match (invariant 2); FOREACH needs no subquery after the write
+ * (invariant 1). Under a race, a node created between the OPTIONAL MATCH
+ * and the MERGE is matched with `__matched = false`: its properties are
+ * not updated (default-mode runtime `labels`, SET after this, still are).
+ */
+function buildGuardedMerge(labelStr, mergeProps, guard, updateSets, params) {
+    (0, validation_1.mergeParams)(params, guard.params);
+    const after = ['WITH n, __matched'];
+    if (guard.preludes && guard.preludes.length > 0)
+        after.push(...guard.preludes);
+    after.push(`WHERE NOT __matched OR (${guard.cypher})`);
+    if (updateSets.length > 0)
+        after.push(`FOREACH (__u IN CASE WHEN __matched THEN [1] ELSE [] END | SET ${updateSets.join(', ')})`);
+    return {
+        before: [
+            `OPTIONAL MATCH (__existing:${labelStr} { ${mergeProps.join(', ')} })`,
+            'WITH count(__existing) > 0 AS __matched',
+        ],
+        after,
+    };
+}
 /** `null` / `{}`: the whole-relationship (blanket) form, never per member. */
 function isBlanketSpec(spec) {
     if (spec == null)