uql-orm 0.9.2 → 0.9.4

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to this project will be documented in this file. Please add
 
 date format is [yyyy-mm-dd]
 
+## [0.9.4] - 2026-06-29
+
+### Bug Fixes
+
+- **`$entity` dual-API restored**: Querier read/delete methods (`findOne`, `findMany`, `findManyAndCount`, `count`, `deleteMany`, `findManyStream`) now use TypeScript overloads instead of union types, enabling correct entity inference for both `(Entity, query)` and `({ $entity: Entity, ...query })` call patterns.
+- **`$select` / `$exclude` overlap resolved**: Both are now structurally identical map types (`{ [K in FieldKey<E>]?: BooleanLike }`) — whitelist (`$select`) vs. blacklist (`$exclude`). `$exclude` reverted to map form (was incorrectly changed to array), matching runtime `Object.entries()` usage.
+- **`$exclude` JSDoc**: Updated comment from "array of field names" to map syntax `{ name: true }`.
+
+### Security
+
+- **Comprehensive security tests** (`querySecurity.spec.ts`): 33+ tests covering prototype pollution via `$where`/`$select`/`$exclude`/`$populate`, SQL injection in WHERE values and identifiers, `$skip`/`$limit` coercion edge cases, `$ne`/`$or`/`$in` operator safety, relation field safety, and field validation across all entity types.
+
+### [0.9.3] - 2026-06-26
+
+### Bug Fixes
+
+- **`snakeCase` null pass-through**: Restored `null`/`undefined` passthrough (was collapsed to `''`). `upperFirst`/`lowerFirst` now also guard early on falsy input.
+
+### Improvements
+
+- **`QueryPopulateRelationOptions` nullable fix**: Uses `NonNullable<E>` so nullable relations (`Profile | null`) correctly infer `QueryUnique<Profile>` rather than `QueryUnique<Profile | null>`.
+- **`JsonFieldPaths` array support**: Now handles arrays of JSON (`Json<T>[]`) for MongoDB.
+
 ## [0.9.2] - 2026-06-10
 
 ### Bug Fixes

package/dist/browser/type/request.d.ts

@@ -24,6 +24,6 @@ type RequestErrorNotification = {
     readonly phase: 'error';
 } & RequestErrorResponse & RequestBaseNotification;
 export type RequestNotification = RequestSuccessNotification | RequestErrorNotification;
-export type RequestCallback = (msg: RequestNotification) => any;
+export type RequestCallback = (msg: RequestNotification) => void;
 export {};
 //# sourceMappingURL=request.d.ts.map

package/dist/browser/type/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/browser/type/request.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sBAAsB,CAAC,CAAC,IAAI;IACtC,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG;IAChD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAA;CAAE,CAAC;AAClE,KAAK,0BAA0B,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA;CAAE,GAAG,uBAAuB,CAAC;AACjH,KAAK,wBAAwB,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AAC7G,MAAM,MAAM,mBAAmB,GAAG,0BAA0B,GAAG,wBAAwB,CAAC;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,mBAAmB,KAAK,GAAG,CAAC"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/browser/type/request.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sBAAsB,CAAC,CAAC,IAAI;IACtC,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG;IAChD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAA;CAAE,CAAC;AAClE,KAAK,0BAA0B,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA;CAAE,GAAG,uBAAuB,CAAC;AACjH,KAAK,wBAAwB,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AAC7G,MAAM,MAAM,mBAAmB,GAAG,0BAA0B,GAAG,wBAAwB,CAAC;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,mBAAmB,KAAK,IAAI,CAAC"}

package/dist/browser/uql-browser.min.js

@@ -958,6 +958,7 @@ function ensureMeta(entity) {
     }
     meta = {
         entity,
+        id: '',
         fields: {},
         relations: {}
     };