metal-orm 1.0.82 → 1.0.83

package/dist/index.d.cts

@@ -1820,6 +1820,8 @@ interface CompilerContext {
     params: unknown[];
     /** Function to add a parameter and get its placeholder */
     addParameter(value: unknown): string;
+    /** Whether Param operands are allowed (for schema generation) */
+    allowParams?: boolean;
 }
 /**
  * Result of SQL compilation
@@ -1854,6 +1856,9 @@ declare abstract class Dialect implements SelectCompiler, InsertCompiler, Update
      * @returns Compiled query with SQL and parameters
      */
     compileSelect(ast: SelectQueryNode): CompiledQuery;
+    compileSelectWithOptions(ast: SelectQueryNode, options?: {
+        allowParams?: boolean;
+    }): CompiledQuery;
     compileInsert(ast: InsertQueryNode): CompiledQuery;
     compileUpdate(ast: UpdateQueryNode): CompiledQuery;
     compileDelete(ast: DeleteQueryNode): CompiledQuery;
@@ -1894,9 +1899,12 @@ declare abstract class Dialect implements SelectCompiler, InsertCompiler, Update
     protected compileSelectForExists(ast: SelectQueryNode, ctx: CompilerContext): string;
     /**
      * Creates a new compiler context
+     * @param options - Optional compiler context options
      * @returns Compiler context with parameter management
      */
-    protected createCompilerContext(): CompilerContext;
+    protected createCompilerContext(options?: {
+        allowParams?: boolean;
+    }): CompilerContext;
     /**
      * Formats a parameter placeholder
      * @param index - Parameter index
@@ -4312,6 +4320,11 @@ declare class SelectQueryBuilder<T = EntityInstance<TableDef>, TTable extends Ta
      * Ensures that if no columns are selected, all columns from the table are selected by default.
      */
     private ensureDefaultSelection;
+    /**
+     * Validates that the query does not contain Param operands.
+     * Param proxies are only for schema generation, not execution.
+     */
+    private validateNoParamOperands;
     /**
      * Executes the query and returns hydrated results.
      * If the builder was created with an entity constructor (e.g. via selectFromEntity),

package/dist/index.d.ts

@@ -1820,6 +1820,8 @@ interface CompilerContext {
     params: unknown[];
     /** Function to add a parameter and get its placeholder */
     addParameter(value: unknown): string;
+    /** Whether Param operands are allowed (for schema generation) */
+    allowParams?: boolean;
 }
 /**
  * Result of SQL compilation
@@ -1854,6 +1856,9 @@ declare abstract class Dialect implements SelectCompiler, InsertCompiler, Update
      * @returns Compiled query with SQL and parameters
      */
     compileSelect(ast: SelectQueryNode): CompiledQuery;
+    compileSelectWithOptions(ast: SelectQueryNode, options?: {
+        allowParams?: boolean;
+    }): CompiledQuery;
     compileInsert(ast: InsertQueryNode): CompiledQuery;
     compileUpdate(ast: UpdateQueryNode): CompiledQuery;
     compileDelete(ast: DeleteQueryNode): CompiledQuery;
@@ -1894,9 +1899,12 @@ declare abstract class Dialect implements SelectCompiler, InsertCompiler, Update
     protected compileSelectForExists(ast: SelectQueryNode, ctx: CompilerContext): string;
     /**
      * Creates a new compiler context
+     * @param options - Optional compiler context options
      * @returns Compiler context with parameter management
      */
-    protected createCompilerContext(): CompilerContext;
+    protected createCompilerContext(options?: {
+        allowParams?: boolean;
+    }): CompilerContext;
     /**
      * Formats a parameter placeholder
      * @param index - Parameter index
@@ -4312,6 +4320,11 @@ declare class SelectQueryBuilder<T = EntityInstance<TableDef>, TTable extends Ta
      * Ensures that if no columns are selected, all columns from the table are selected by default.
      */
     private ensureDefaultSelection;
+    /**
+     * Validates that the query does not contain Param operands.
+     * Param proxies are only for schema generation, not execution.
+     */
+    private validateNoParamOperands;
     /**
      * Executes the query and returns hydrated results.
      * If the builder was created with an entity constructor (e.g. via selectFromEntity),

package/dist/index.js

@@ -389,6 +389,14 @@ var toLiteralNode = (value) => ({
   type: "Literal",
   value: value instanceof Date ? value.toISOString() : value
 });
+var toParamNode = (value) => {
+  if (typeof value !== "object" || value === null) return void 0;
+  const type = Object.getOwnPropertyDescriptor(value, "type")?.value;
+  if (type !== "Param") return void 0;
+  const name = Object.getOwnPropertyDescriptor(value, "name")?.value;
+  if (typeof name !== "string") return void 0;
+  return { type: "Param", name };
+};
 var columnRefToNode = (col2) => {
   if (!col2.table) {
     throw new Error(
@@ -398,6 +406,10 @@ var columnRefToNode = (col2) => {
   return { type: "Column", table: col2.table, name: col2.name };
 };
 var toOperandNode = (value) => {
+  const paramNode = toParamNode(value);
+  if (paramNode) {
+    return paramNode;
+  }
   if (isOperandNode(value)) {
     return value;
   }
@@ -407,6 +419,10 @@ var toOperandNode = (value) => {
   return columnRefToNode(value);
 };
 var valueToOperand = (value) => {
+  const paramNode = toParamNode(value);
+  if (paramNode) {
+    return paramNode;
+  }
   if (isOperandNode(value)) {
     return value;
   }
@@ -848,7 +864,7 @@ var buildParamProxy = (name) => {
         const nextName2 = name ? `${name}.${trimmed}` : trimmed;
         return buildParamProxy(nextName2);
       }
-      if (prop in t) {
+      if (prop in t && name === "") {
         return t[prop];
       }
       const nextName = name ? `${name}.${prop}` : prop;
@@ -867,9 +883,6 @@ var createParamProxy = () => {
       if (typeof prop === "string" && prop.startsWith("$")) {
         return buildParamProxy(prop.slice(1));
       }
-      if (prop in t) {
-        return t[prop];
-      }
       return buildParamProxy(String(prop));
     }
   });
@@ -1286,6 +1299,16 @@ var Dialect = class _Dialect {
       params: [...ctx.params]
     };
   }
+  compileSelectWithOptions(ast, options = {}) {
+    const ctx = this.createCompilerContext(options);
+    const normalized = this.normalizeSelectAst(ast);
+    const rawSql = this.compileSelectAst(normalized, ctx).trim();
+    const sql = rawSql.endsWith(";") ? rawSql : `${rawSql};`;
+    return {
+      sql,
+      params: [...ctx.params]
+    };
+  }
   compileInsert(ast) {
     const ctx = this.createCompilerContext();
     const rawSql = this.compileInsertAst(ast, ctx).trim();
@@ -1356,13 +1379,15 @@ var Dialect = class _Dialect {
   }
   /**
    * Creates a new compiler context
+   * @param options - Optional compiler context options
    * @returns Compiler context with parameter management
    */
-  createCompilerContext() {
+  createCompilerContext(options = {}) {
     const params = [];
     let counter = 0;
     return {
       params,
+      allowParams: options.allowParams ?? false,
       addParameter: (value) => {
         counter += 1;
         params.push(value);
@@ -1584,7 +1609,12 @@ var Dialect = class _Dialect {
   }
   registerDefaultOperandCompilers() {
     this.registerOperandCompiler("Literal", (literal, ctx) => ctx.addParameter(literal.value));
-    this.registerOperandCompiler("Param", (_param, ctx) => ctx.addParameter(null));
+    this.registerOperandCompiler("Param", (_param, ctx) => {
+      if (!ctx.allowParams) {
+        throw new Error("Cannot compile query with Param operands. Param proxies are only for schema generation (getSchema()). If you need real parameters, use literal values.");
+      }
+      return ctx.addParameter(null);
+    });
     this.registerOperandCompiler("AliasRef", (alias, _ctx) => {
       void _ctx;
       return this.quoteIdentifier(alias.name);
@@ -7453,6 +7483,227 @@ var buildFilterParameters = (table, where, from, options = {}) => {
   }];
 };
 
+// src/core/ast/ast-validation.ts
+var hasParamOperandsInExpression = (expr) => {
+  let hasParams = false;
+  visitExpression(expr, {
+    visitBinaryExpression: (node) => {
+      visitOperand(node.left, {
+        visitParam: () => {
+          hasParams = true;
+        },
+        otherwise: () => {
+        }
+      });
+      visitOperand(node.right, {
+        visitParam: () => {
+          hasParams = true;
+        },
+        otherwise: () => {
+        }
+      });
+      if (node.escape) {
+        visitOperand(node.escape, {
+          visitParam: () => {
+            hasParams = true;
+          },
+          otherwise: () => {
+          }
+        });
+      }
+    },
+    visitLogicalExpression: (node) => {
+      node.operands.forEach((operand) => {
+        if (hasParamOperandsInExpression(operand)) {
+          hasParams = true;
+        }
+      });
+    },
+    visitNullExpression: () => {
+    },
+    visitInExpression: (node) => {
+      visitOperand(node.left, {
+        visitParam: () => {
+          hasParams = true;
+        },
+        otherwise: () => {
+        }
+      });
+      if (Array.isArray(node.right)) {
+        node.right.forEach((operand) => visitOperand(operand, {
+          visitParam: () => {
+            hasParams = true;
+          },
+          otherwise: () => {
+          }
+        }));
+      }
+    },
+    visitExistsExpression: () => {
+    },
+    visitBetweenExpression: (node) => {
+      visitOperand(node.left, {
+        visitParam: () => {
+          hasParams = true;
+        },
+        otherwise: () => {
+        }
+      });
+      visitOperand(node.lower, {
+        visitParam: () => {
+          hasParams = true;
+        },
+        otherwise: () => {
+        }
+      });
+      visitOperand(node.upper, {
+        visitParam: () => {
+          hasParams = true;
+        },
+        otherwise: () => {
+        }
+      });
+    },
+    visitArithmeticExpression: (node) => {
+      visitOperand(node.left, {
+        visitParam: () => {
+          hasParams = true;
+        },
+        otherwise: () => {
+        }
+      });
+      visitOperand(node.right, {
+        visitParam: () => {
+          hasParams = true;
+        },
+        otherwise: () => {
+        }
+      });
+    },
+    visitBitwiseExpression: (node) => {
+      visitOperand(node.left, {
+        visitParam: () => {
+          hasParams = true;
+        },
+        otherwise: () => {
+        }
+      });
+      visitOperand(node.right, {
+        visitParam: () => {
+          hasParams = true;
+        },
+        otherwise: () => {
+        }
+      });
+    },
+    otherwise: () => {
+    }
+  });
+  return hasParams;
+};
+var hasParamOperandsInOperand = (operand) => {
+  let hasParams = false;
+  visitOperand(operand, {
+    visitColumn: () => {
+    },
+    visitLiteral: () => {
+    },
+    visitParam: () => {
+      hasParams = true;
+    },
+    visitFunction: (node) => {
+      node.args?.forEach((arg) => {
+        if (hasParamOperandsInOperand(arg)) {
+          hasParams = true;
+        }
+      });
+    },
+    visitJsonPath: () => {
+    },
+    visitScalarSubquery: () => {
+    },
+    visitCaseExpression: (node) => {
+      node.conditions.forEach((cond) => {
+        if (hasParamOperandsInExpression(cond.when)) {
+          hasParams = true;
+        }
+        if (hasParamOperandsInOperand(cond.then)) {
+          hasParams = true;
+        }
+      });
+      if (node.else && hasParamOperandsInOperand(node.else)) {
+        hasParams = true;
+      }
+    },
+    visitCast: (node) => {
+      if (hasParamOperandsInOperand(node.expression)) {
+        hasParams = true;
+      }
+    },
+    visitWindowFunction: (node) => {
+      node.args?.forEach((arg) => {
+        if (hasParamOperandsInOperand(arg)) {
+          hasParams = true;
+        }
+      });
+      node.orderBy?.forEach((ord) => {
+        if (ord.term) {
+          if (hasParamOperandsInOperand(ord.term)) {
+            hasParams = true;
+          }
+        }
+      });
+    },
+    visitCollate: (node) => {
+      if (hasParamOperandsInOperand(node.expression)) {
+        hasParams = true;
+      }
+    },
+    visitAliasRef: () => {
+    },
+    otherwise: () => {
+    }
+  });
+  return hasParams;
+};
+var hasParamOperandsInQuery = (ast) => {
+  if (ast.where && hasParamOperandsInExpression(ast.where)) {
+    return true;
+  }
+  if (ast.having && hasParamOperandsInExpression(ast.having)) {
+    return true;
+  }
+  ast.columns?.forEach((col2) => {
+    if (typeof col2 === "object" && col2 !== null && "type" in col2) {
+      if (hasParamOperandsInOperand(col2)) {
+        return true;
+      }
+    }
+  });
+  ast.orderBy?.forEach((ord) => {
+    if (ord.term) {
+      if (hasParamOperandsInOperand(ord.term)) {
+        return true;
+      }
+    }
+  });
+  if (ast.ctes) {
+    for (const cte of ast.ctes) {
+      if (cte.query.where && hasParamOperandsInExpression(cte.query.where)) {
+        return true;
+      }
+    }
+  }
+  if (ast.setOps) {
+    for (const op of ast.setOps) {
+      if (hasParamOperandsInQuery(op.query)) {
+        return true;
+      }
+    }
+  }
+  return false;
+};
+
 // src/query-builder/select.ts
 var SelectQueryBuilder = class _SelectQueryBuilder {
   env;
@@ -7926,6 +8177,17 @@ var SelectQueryBuilder = class _SelectQueryBuilder {
     }
     return this;
   }
+  /**
+   * Validates that the query does not contain Param operands.
+   * Param proxies are only for schema generation, not execution.
+   */
+  validateNoParamOperands() {
+    const ast = this.context.hydration.applyToAst(this.context.state.ast);
+    const hasParams = hasParamOperandsInQuery(ast);
+    if (hasParams) {
+      throw new Error("Cannot execute query containing Param operands. Param proxies are only for schema generation (getSchema()). If you need real parameters, use literal values.");
+    }
+  }
   /**
    * Executes the query and returns hydrated results.
    * If the builder was created with an entity constructor (e.g. via selectFromEntity),
@@ -7939,6 +8201,7 @@ var SelectQueryBuilder = class _SelectQueryBuilder {
    * users[0] instanceof User; // true
    */
   async execute(ctx) {
+    this.validateNoParamOperands();
     if (this.entityConstructor) {
       return this.executeAs(this.entityConstructor, ctx);
     }
@@ -7957,6 +8220,7 @@ var SelectQueryBuilder = class _SelectQueryBuilder {
    * rows[0] instanceof User; // false
    */
   async executePlain(ctx) {
+    this.validateNoParamOperands();
     const builder = this.ensureDefaultSelection();
     const rows = await executeHydratedPlain(ctx, builder);
     return rows;
@@ -7976,6 +8240,7 @@ var SelectQueryBuilder = class _SelectQueryBuilder {
    * users[0].getFullName();   // works!
    */
   async executeAs(entityClass, ctx) {
+    this.validateNoParamOperands();
     const builder = this.ensureDefaultSelection();
     const results = await executeHydrated(ctx, builder);
     return materializeAs(entityClass, results);
@@ -7987,6 +8252,7 @@ var SelectQueryBuilder = class _SelectQueryBuilder {
    * const total = await qb.count(session);
    */
   async count(session) {
+    this.validateNoParamOperands();
     return executeCount(this.context, this.env, session);
   }
   /**
@@ -7996,6 +8262,7 @@ var SelectQueryBuilder = class _SelectQueryBuilder {
    * const { items, totalItems, page, pageSize } = await qb.executePaged(session, { page: 1, pageSize: 20 });
    */
   async executePaged(session, options) {
+    this.validateNoParamOperands();
     const builder = this.ensureDefaultSelection();
     return executePagedQuery(builder, session, options, (sess) => builder.count(sess));
   }
@@ -8010,6 +8277,7 @@ var SelectQueryBuilder = class _SelectQueryBuilder {
    * const users = await qb.executeWithContexts(execCtx, hydCtx);
    */
   async executeWithContexts(execCtx, hydCtx) {
+    this.validateNoParamOperands();
     const builder = this.ensureDefaultSelection();
     const results = await executeHydratedWithContexts(execCtx, hydCtx, builder);
     if (this.entityConstructor) {