prisma-sql 1.76.2 → 1.78.0

package/dist/index.js

@@ -6311,6 +6311,31 @@ function normalizeArgsForDialect(dialect, args) {
   if (dialect !== "postgres") return args;
   return applyPostgresDistinctOrderBy(args);
 }
+function normalizeCompoundCursor(cursor, model) {
+  const keys = Object.keys(cursor);
+  if (keys.length !== 1) return cursor;
+  const key = keys[0];
+  const value = cursor[key];
+  const scalarSet = getScalarFieldSet(model);
+  if (scalarSet.has(key)) return cursor;
+  if (!isPlainObject(value)) return cursor;
+  const nested = value;
+  const nestedKeys = Object.keys(nested);
+  if (nestedKeys.length === 0) return cursor;
+  for (const nk of nestedKeys) {
+    if (!scalarSet.has(nk)) return cursor;
+  }
+  return nested;
+}
+function normalizeArgsCompoundCursor(args, model) {
+  if (!isNotNullish(args.cursor) || !isPlainObject(args.cursor)) return args;
+  const flat = normalizeCompoundCursor(
+    args.cursor,
+    model
+  );
+  if (flat === args.cursor) return args;
+  return __spreadProps(__spreadValues({}, args), { cursor: flat });
+}
 function buildCursorClauseIfAny(input) {
   const { cursor, orderBy, tableName, alias, params, skip, dialect, model } = input;
   if (!isNotNullish(cursor)) return {};
@@ -6408,7 +6433,8 @@ function buildSelectSql(input) {
   assertSafeTableRef(from.tableName);
   const dialectToUse = resolveDialect(dialect);
   const argsForSql = normalizeArgsForNegativeTake(method, args);
-  const normalizedArgs = normalizeArgsForDialect(dialectToUse, argsForSql);
+  const argsWithDialect = normalizeArgsForDialect(dialectToUse, argsForSql);
+  const normalizedArgs = normalizeArgsCompoundCursor(argsWithDialect, model);
   validateDistinct(model, normalizedArgs.distinct);
   validateOrderBy(model, normalizedArgs.orderBy);
   validateCursor(model, normalizedArgs.cursor, normalizedArgs.distinct);
@@ -8073,6 +8099,14 @@ function buildKey(row, fields) {
 }
 
 // src/builder/select/reducer.ts
+var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function assertSafePropertyName(name) {
+  if (UNSAFE_PROPERTY_NAMES.has(name)) {
+    throw new Error(
+      `Unsafe property name '${name}' rejected to prevent prototype pollution`
+    );
+  }
+}
 function buildRelationScalarCols(relModel, relPath, includeAllScalars, selectedScalarFields) {
   const jsonSet = getJsonFieldSet(relModel);
   const scalarFields = includeAllScalars ? getScalarFieldNames(relModel) : selectedScalarFields;
@@ -8104,6 +8138,7 @@ function buildReducerConfig(parentModel, includeSpec, allModels, prefix = "", de
   const modelMap = new Map(allModels.map((m) => [m.name, m]));
   for (const [incName, incValue] of Object.entries(includeSpec)) {
     if (incValue === false) continue;
+    assertSafePropertyName(incName);
     const field = parentModel.fields.find((f) => f.name === incName);
     if (!field || !field.isRelation) {
       throw new Error(
@@ -8181,7 +8216,7 @@ function initNestedPlaceholders(obj, nested) {
 function materializeRelationObject(row, rel) {
   const relKey = buildKey(row, rel.keyCols);
   if (relKey == null) return null;
-  const obj = {};
+  const obj = /* @__PURE__ */ Object.create(null);
   for (const c of rel.scalarCols) {
     obj[c.fieldName] = parseJsonIfNeeded(c.isJson, row[c.colName]);
   }
@@ -8249,7 +8284,7 @@ function reduceFlatRows(rows, config) {
     if (parentKey == null) continue;
     let record = resultMap.get(parentKey);
     if (!record) {
-      record = {};
+      record = /* @__PURE__ */ Object.create(null);
       for (const fieldName of parentScalarFields) {
         record[fieldName] = maybeParseJson(
           row[fieldName],