runic-py 0.3.4__tar.gz → 0.3.6__tar.gz

{runic_py-0.3.4 → runic_py-0.3.6}/.gitignore

@@ -86,6 +86,9 @@ develop-eggs/
 dist/
 dmypy.json
 docs/_build/
+docs/.vitepress/cache/
+docs/.vitepress/dist/
+docs/node_modules/
 Documents/
 downloads/
 eggs/
@@ -123,3 +126,5 @@ var/
 venv.bak/
 venv/
 wheels/
+.playwright-mcp/
+.playwright/

{runic_py-0.3.4 → runic_py-0.3.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: runic-py
-Version: 0.3.4
+Version: 0.3.6
 Summary: Graph schema migrations and OGM for Cypher-based graph databases.
 Project-URL: Homepage, https://runic-py.readthedocs.io/en/latest/
 Project-URL: Repository, https://github.com/jenreh/runic
@@ -36,13 +36,13 @@ Requires-Dist: neo4j<7.0.0,>=6.2.0; extra == 'neo4j'
 Description-Content-Type: text/markdown
 
 <div align="center">
-  <img src="https://raw.githubusercontent.com/jenreh/runic/refs/heads/main/docs/source/_static/runic.svg" width="240" alt="Runic logo">
+  <img src="https://raw.githubusercontent.com/jenreh/runic/refs/heads/main/docs/public/runic.svg" width="240" alt="Runic logo">
 
 # Runic
 
 **Graph schema migrations and OGM for Cypher-based graph databases.**
 
-![Version](https://img.shields.io/badge/version-0.3.4-blue)
+![Version](https://img.shields.io/badge/version-0.3.6-blue)
 [![PyPI](https://img.shields.io/pypi/v/runic-py.svg)](https://pypi.org/project/runic-py/)
 [![Python](https://img.shields.io/badge/python-3.14%2B-orange)](https://www.python.org)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE.md)

{runic_py-0.3.4 → runic_py-0.3.6}/README.md

@@ -1,11 +1,11 @@
 <div align="center">
-  <img src="https://raw.githubusercontent.com/jenreh/runic/refs/heads/main/docs/source/_static/runic.svg" width="240" alt="Runic logo">
+  <img src="https://raw.githubusercontent.com/jenreh/runic/refs/heads/main/docs/public/runic.svg" width="240" alt="Runic logo">
 
 # Runic
 
 **Graph schema migrations and OGM for Cypher-based graph databases.**
 
-![Version](https://img.shields.io/badge/version-0.3.4-blue)
+![Version](https://img.shields.io/badge/version-0.3.6-blue)
 [![PyPI](https://img.shields.io/pypi/v/runic-py.svg)](https://pypi.org/project/runic-py/)
 [![Python](https://img.shields.io/badge/python-3.14%2B-orange)](https://www.python.org)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE.md)

{runic_py-0.3.4 → runic_py-0.3.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "runic-py"
-version = "0.3.4"
+version = "0.3.6"
 description = "Graph schema migrations and OGM for Cypher-based graph databases."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -37,7 +37,7 @@ all = [
 [dependency-groups]
 dev = [
     "bump-my-version==1.3.0",
-    "deepeval==4.0.5",
+    "deepeval==4.0.6",
     "detect-secrets==1.5.0",
     "falkordb>=1.6.1",
     "falkordblite==0.10.0",
@@ -54,7 +54,7 @@ dev = [
     "sphinx-copybutton==0.5.2",
     "sphinx-design==0.7.0",
     "sphinx==9.1.0",
-    "ty==0.0.44",
+    "ty==0.0.47",
 ]
 
 [project.scripts]
@@ -93,7 +93,7 @@ exclude = [
 
 [tool.bumpversion]
 commit = false
-current_version = "0.3.4"
+current_version = "0.3.6"
 tag = false
 allow-dirty = false
 
@@ -107,25 +107,6 @@ filename = "README.md"
 search = '![Version](https://img.shields.io/badge/version-{current_version}-blue)'
 replace = '![Version](https://img.shields.io/badge/version-{new_version}-blue)'
 
-[[tool.bumpversion.files]]
-filename = "docs/source/index.rst"
-search = '.. |Github| image:: https://img.shields.io/badge/release-{current_version}-yellow?logo=github'
-replace = '.. |Github| image:: https://img.shields.io/badge/release-{new_version}-yellow?logo=github'
-
-[[tool.bumpversion.files]]
-filename = "docs/source/index.rst"
-search = '   :target: https://github.com/jenreh/runic/tree/v{current_version}'
-replace = '   :target: https://github.com/jenreh/runic/tree/v{new_version}'
-
-[[tool.bumpversion.files]]
-filename = "docs/source/conf.py"
-search = 'version = "{current_version}"'
-replace = 'version = "{new_version}"'
-
-[[tool.bumpversion.files]]
-filename = "docs/source/conf.py"
-search = 'release = "{current_version}"'
-replace = 'release = "{new_version}"'
 
 [tool.ruff]
 cache-dir = ".cache/ruff"

runic_py-0.3.6/runic/cypher.py

@@ -0,0 +1,76 @@
+"""Cypher escaping helpers shared by the migrate and OGM subsystems.
+
+Cypher (and the FalkorDB/Neo4j/Memgraph dialects) cannot bind *identifiers*
+(labels, relationship types, property keys) or DDL-internal string literals as
+query parameters.  These helpers make such interpolation safe:
+
+* :func:`escape_identifier` backtick-quotes an identifier, doubling embedded
+  backticks.  Use it for pattern positions such as ``(n:{label})`` or
+  ``[r:{rel_type}]``.
+* :func:`escape_string` produces a single-quoted Cypher string literal with
+  backslashes and single quotes escaped.  Use it for procedure string arguments
+  and DDL option maps (for example ``CALL db.idx.fulltext.createNodeIndex``).
+
+Both functions reject control characters, which can never appear in a legal
+identifier or option value and are a strong signal of an injection attempt.
+"""
+
+from __future__ import annotations
+
+import re
+
+_CONTROL_CHARS = frozenset(chr(c) for c in range(0x20)) | {"\x7f"}
+
+# Labels, relationship types, and similar schema identifiers that come from
+# model *definitions* are interpolated directly into Cypher patterns
+# (``(n:{label})``, ``[r:{rel_type}]``).  They are validated once at definition
+# time against this pattern so every downstream interpolation is safe by
+# construction — see :func:`validate_identifier`.
+_IDENTIFIER_RE = re.compile(r"[A-Za-z_][A-Za-z0-9_]*")
+
+
+def validate_identifier(name: str, kind: str = "identifier") -> str:
+    """Return ``name`` if it is a safe Cypher schema identifier, else raise.
+
+    Used at model-definition chokepoints (node labels, edge types, relationship
+    types) so the value can be interpolated into Cypher patterns without risk of
+    injection.  The accepted form is a simple identifier: a letter or underscore
+    followed by letters, digits, or underscores.
+    """
+    if not isinstance(name, str) or not _IDENTIFIER_RE.fullmatch(name):
+        msg = (
+            f"invalid Cypher {kind} {name!r}; must match "
+            f"{_IDENTIFIER_RE.pattern} (a letter/underscore followed by "
+            "letters, digits, or underscores)"
+        )
+        raise ValueError(msg)
+    return name
+
+
+def _reject_control_chars(value: str, kind: str) -> None:
+    if any(ch in _CONTROL_CHARS for ch in value):
+        msg = f"illegal control character in Cypher {kind}: {value!r}"
+        raise ValueError(msg)
+
+
+def escape_identifier(name: str) -> str:
+    """Return ``name`` as a backtick-quoted Cypher identifier.
+
+    Embedded backticks are doubled so the value cannot break out of the quoting.
+    Safe for use in pattern positions, e.g. ``f"(n:{escape_identifier(label)})"``.
+    """
+    _reject_control_chars(name, "identifier")
+    escaped = name.replace("`", "``")
+    return f"`{escaped}`"
+
+
+def escape_string(value: str) -> str:
+    """Return ``value`` as a single-quoted, escaped Cypher string literal.
+
+    Backslashes and single quotes are escaped so the value cannot break out of
+    the literal.  Safe for procedure arguments and DDL option maps, e.g.
+    ``f"language: {escape_string(language)}"``.
+    """
+    _reject_control_chars(value, "string literal")
+    escaped = value.replace("\\", "\\\\").replace("'", "\\'")
+    return f"'{escaped}'"

{runic_py-0.3.4 → runic_py-0.3.6}/runic/migrate/adapters/_base.py

@@ -230,7 +230,7 @@ class GraphAdapterBase(ABC):
         current = self.get_checksums()
         current[rev_id] = checksum
         current_by = self.get_installed_by()
-        if installed_by:
+        if installed_by is not None:
             current_by[rev_id] = installed_by
         self.run_query(
             _SET_TRACKING_QUERY,

{runic_py-0.3.4 → runic_py-0.3.6}/runic/migrate/adapters/age.py

@@ -57,15 +57,24 @@ class AGEAdapter(GraphAdapterBase, GraphAdapter):
         return self._graph_name
 
     def execute(self, cypher: str, params: dict[str, Any]) -> Any:
-        result = self._driver.execute(cypher, params)
-        self._driver.commit()
+        try:
+            result = self._driver.execute(cypher, params)
+            self._driver.commit()
+        except Exception:
+            # Clear the aborted transaction so the adapter remains usable.
+            self._driver.rollback()
+            raise
         return result
 
     def run_query(self, query: str, params: dict | None = None) -> Any:
-        result = self._driver.execute(query, params or {})
         # AGEDriver no longer auto-commits; the adapter owns the transaction
         # lifecycle for write operations (not managed by an OGM Session here).
-        self._driver.commit()
+        try:
+            result = self._driver.execute(query, params or {})
+            self._driver.commit()
+        except Exception:
+            self._driver.rollback()
+            raise
         return result
 
     def run_ro_query(self, query: str) -> Any:

{runic_py-0.3.4 → runic_py-0.3.6}/runic/migrate/adapters/falkordb.py

@@ -4,6 +4,7 @@ import logging
 import time
 from typing import Any
 
+from runic.cypher import escape_identifier, escape_string
 from runic.migrate import introspect
 from runic.migrate.adapters import GraphAdapter
 from runic.migrate.adapters._base import _encode_kv_list, _parse_kv_list
@@ -18,6 +19,10 @@ log = logging.getLogger(__name__)
 _POLL_RETRIES = 30
 _POLL_INTERVAL = 0.5
 
+# FalkorDB vector index similarity functions are a closed set; reject anything
+# else early rather than interpolate an unknown value into the OPTIONS map.
+_VECTOR_SIMILARITY_FUNCTIONS = frozenset({"euclidean", "cosine"})
+
 _VERSION_LABEL = "_FalkorMigrateVersion"
 _GET_VERSION_QUERY = f"MATCH (v:{_VERSION_LABEL}) RETURN v.revisions, v.revision"
 _SET_VERSION_QUERY = (
@@ -197,15 +202,17 @@ class FalkorDBAdapter(GraphAdapter):
     # ------------------------------------------------------------------
 
     def create_range_index(self, label: str, prop: str, *, rel: bool = False) -> None:
+        label_id = escape_identifier(label)
+        prop_id = escape_identifier(prop)
         if rel:
-            query = f"CREATE INDEX FOR ()-[r:{label}]->() ON (r.{prop})"
+            query = f"CREATE INDEX FOR ()-[r:{label_id}]->() ON (r.{prop_id})"
         else:
-            query = f"CREATE INDEX FOR (n:{label}) ON (n.{prop})"
+            query = f"CREATE INDEX FOR (n:{label_id}) ON (n.{prop_id})"
         log.info("creating range index on %s.%s", label, prop)
         self._driver.execute(query, {})
 
     def drop_range_index(self, label: str, prop: str, *, rel: bool = False) -> None:  # noqa: ARG002
-        query = f"DROP INDEX ON :{label}({prop})"
+        query = f"DROP INDEX ON :{escape_identifier(label)}({escape_identifier(prop)})"
         log.info("dropping range index on %s.%s", label, prop)
         self._driver.execute(query, {})
 
@@ -220,26 +227,29 @@ class FalkorDBAdapter(GraphAdapter):
         language: str | None = None,
         stopwords: list[str] | None = None,
     ) -> None:
+        props_str = ", ".join(escape_string(p) for p in props)
         if language or stopwords:
-            map_parts = [f"label: '{label}'"]
+            map_parts = [f"label: {escape_string(label)}"]
             if language:
-                map_parts.append(f"language: '{language}'")
+                map_parts.append(f"language: {escape_string(language)}")
             if stopwords:
-                sw = "[" + ", ".join(f"'{w}'" for w in stopwords) + "]"
+                sw = "[" + ", ".join(escape_string(w) for w in stopwords) + "]"
                 map_parts.append(f"stopwords: {sw}")
             map_literal = "{" + ", ".join(map_parts) + "}"
-            props_str = ", ".join(f"'{p}'" for p in props)
             query = f"CALL db.idx.fulltext.createNodeIndex({map_literal}, {props_str})"
         else:
-            props_str = ", ".join(f"'{p}'" for p in props)
-            query = f"CALL db.idx.fulltext.createNodeIndex('{label}', {props_str})"
+            query = (
+                "CALL db.idx.fulltext.createNodeIndex("
+                f"{escape_string(label)}, {props_str})"
+            )
         log.info("creating fulltext index on %s %s", label, list(props))
         self._driver.execute(query, {})
 
     def drop_fulltext_index(self, label: str, *props: str) -> None:
         log.info("dropping fulltext index on %s %s", label, list(props))
+        label_id = escape_identifier(label)
         for prop in props:
-            query = f"DROP FULLTEXT INDEX FOR (n:{label}) ON (n.{prop})"
+            query = f"DROP FULLTEXT INDEX FOR (n:{label_id}) ON (n.{escape_identifier(prop)})"
             self._driver.execute(query, {})
 
     # ------------------------------------------------------------------
@@ -257,16 +267,29 @@ class FalkorDBAdapter(GraphAdapter):
         ef_construction: int = 200,
         ef_runtime: int = 10,
     ) -> None:
+        if similarity not in _VECTOR_SIMILARITY_FUNCTIONS:
+            msg = (
+                f"unsupported vector similarity function {similarity!r}; "
+                f"expected one of {sorted(_VECTOR_SIMILARITY_FUNCTIONS)}"
+            )
+            raise ValueError(msg)
+        label_id = escape_identifier(label)
+        prop_id = escape_identifier(prop)
         options = (
-            f"{{dimension: {dimension}, similarityFunction: '{similarity}', "
+            f"{{dimension: {dimension}, similarityFunction: {escape_string(similarity)}, "
             f"M: {m}, efConstruction: {ef_construction}, efRuntime: {ef_runtime}}}"
         )
-        query = f"CREATE VECTOR INDEX FOR (n:{label}) ON (n.{prop}) OPTIONS {options}"
+        query = (
+            f"CREATE VECTOR INDEX FOR (n:{label_id}) ON (n.{prop_id}) OPTIONS {options}"
+        )
         log.info("creating vector index on %s.%s", label, prop)
         self._driver.execute(query, {})
 
     def drop_vector_index(self, label: str, prop: str) -> None:
-        query = f"DROP VECTOR INDEX FOR (n:{label}) (n.{prop})"
+        query = (
+            f"DROP VECTOR INDEX FOR (n:{escape_identifier(label)}) "
+            f"(n.{escape_identifier(prop)})"
+        )
         log.info("dropping vector index on %s.%s", label, prop)
         self._driver.execute(query, {})
 
@@ -285,7 +308,7 @@ class FalkorDBAdapter(GraphAdapter):
         self._db.execute_command(
             "GRAPH.CONSTRAINT",
             "CREATE",
-            label,
+            self._graph.name,
             kind,
             entity,
             label,
@@ -296,11 +319,18 @@ class FalkorDBAdapter(GraphAdapter):
         self._poll_constraint(label, props)
 
     def _poll_constraint(self, label: str, props: list[str]) -> None:
+        target_props = list(props)
         for _ in range(_POLL_RETRIES):
             result = self._driver.execute("CALL db.constraints()", {})
             for row in result.rows:
-                entry = row[0]
-                status = entry[4] if isinstance(entry, (list, tuple)) else str(entry)
+                # Each row is a flat list of columns, consistent with
+                # introspect.read_live_schema():
+                #   [type, label, properties, entity_type, status]
+                if not isinstance(row, (list, tuple)) or len(row) < 5:
+                    continue
+                if row[1] != label or list(row[2]) != target_props:
+                    continue
+                status = row[4]
                 if status == "FAILED":
                     raise ConstraintFailedError(f"constraint on {label}.{props} failed")
                 if status == "OPERATIONAL":
@@ -318,7 +348,7 @@ class FalkorDBAdapter(GraphAdapter):
         self._db.execute_command(
             "GRAPH.CONSTRAINT",
             "DROP",
-            label,
+            self._graph.name,
             kind,
             entity,
             label,

{runic_py-0.3.4 → runic_py-0.3.6}/runic/migrate/adapters/memgraph.py

@@ -76,7 +76,7 @@ class MemgraphAdapter(GraphAdapterBase, GraphAdapter):
             auth=self._driver.auth,
             database=graph_name,
             dialect=_MEMGRAPH_DIALECT,
-            encrypted=False,
+            encrypted=self._driver.encrypted,
         )
         return MemgraphAdapter(new_driver, graph_name)
 
@@ -196,7 +196,10 @@ class MemgraphAdapter(GraphAdapterBase, GraphAdapter):
                 if idx_type == "label+property" and prop:
                     specs.add(IndexSpec(label=label, property=prop, index_type="RANGE"))
         except Exception as exc:
-            log.warning("Memgraph SHOW INDEX INFO failed: %s", exc)
+            # Returning empty specs here would make autogenerate treat every
+            # index as missing; abort loudly instead of silently degrading.
+            log.error("Memgraph SHOW INDEX INFO failed: %s", exc)
+            raise
         try:
             result = self.run_ro_query("SHOW CONSTRAINT INFO")
             for row in result.rows:
@@ -214,5 +217,6 @@ class MemgraphAdapter(GraphAdapterBase, GraphAdapter):
                 for prop in prop_list:
                     specs.add(IndexSpec(label=label, property=prop, index_type=kind))
         except Exception as exc:
-            log.warning("Memgraph SHOW CONSTRAINT INFO failed: %s", exc)
+            log.error("Memgraph SHOW CONSTRAINT INFO failed: %s", exc)
+            raise
         return specs

{runic_py-0.3.4 → runic_py-0.3.6}/runic/migrate/adapters/neo4j.py

@@ -76,7 +76,7 @@ class Neo4jAdapter(GraphAdapterBase, GraphAdapter):
             auth=self._driver.auth,
             database=graph_name,
             dialect=_NEO4J_DIALECT,
-            encrypted=True,
+            encrypted=self._driver.encrypted,
         )
         return Neo4jAdapter(new_driver, graph_name)
 
@@ -213,7 +213,10 @@ class Neo4jAdapter(GraphAdapterBase, GraphAdapter):
                         IndexSpec(label=label, property=prop, index_type=idx_type)
                     )
         except Exception as exc:
-            log.warning("Neo4j SHOW INDEXES failed: %s", exc)
+            # Returning empty specs here would make autogenerate treat every
+            # index as missing; abort loudly instead of silently degrading.
+            log.error("Neo4j SHOW INDEXES failed: %s", exc)
+            raise
         try:
             result = self.run_ro_query(
                 "SHOW CONSTRAINTS YIELD type, entityType, labelsOrTypes, properties"
@@ -230,5 +233,6 @@ class Neo4jAdapter(GraphAdapterBase, GraphAdapter):
                         IndexSpec(label=label, property=prop, index_type="UNIQUE")
                     )
         except Exception as exc:
-            log.warning("Neo4j SHOW CONSTRAINTS failed: %s", exc)
+            log.error("Neo4j SHOW CONSTRAINTS failed: %s", exc)
+            raise
         return specs

{runic_py-0.3.4 → runic_py-0.3.6}/runic/migrate/autogen.py

@@ -56,53 +56,53 @@ def _constraint_key(c: UniqueConstraint | MandatoryConstraint) -> tuple:
 
 def _range_create(idx: RangeIndex) -> str:
     rel_arg = ", rel=True" if idx.rel else ""
-    return f'op.create_range_index("{idx.label}", "{idx.prop}"{rel_arg})'
+    return f"op.create_range_index({idx.label!r}, {idx.prop!r}{rel_arg})"
 
 
 def _range_drop(idx: RangeIndex) -> str:
     rel_arg = ", rel=True" if idx.rel else ""
-    return f'op.drop_range_index("{idx.label}", "{idx.prop}"{rel_arg})'
+    return f"op.drop_range_index({idx.label!r}, {idx.prop!r}{rel_arg})"
 
 
 def _fulltext_create(idx: FulltextIndex) -> str:
-    props_args = ", ".join(f'"{p}"' for p in idx.props)
+    props_args = ", ".join(repr(p) for p in idx.props)
     extra: list[str] = []
     if idx.language:
-        extra.append(f'language="{idx.language}"')
+        extra.append(f"language={idx.language!r}")
     if idx.stopwords:
-        sw = "[" + ", ".join(f'"{w}"' for w in idx.stopwords) + "]"
+        sw = "[" + ", ".join(repr(w) for w in idx.stopwords) + "]"
         extra.append(f"stopwords={sw}")
     extra_str = (", " + ", ".join(extra)) if extra else ""
-    return f'op.create_fulltext_index("{idx.label}", {props_args}{extra_str})'
+    return f"op.create_fulltext_index({idx.label!r}, {props_args}{extra_str})"
 
 
 def _fulltext_drop(idx: FulltextIndex) -> str:
-    props_args = ", ".join(f'"{p}"' for p in idx.props)
-    return f'op.drop_fulltext_index("{idx.label}", {props_args})'
+    props_args = ", ".join(repr(p) for p in idx.props)
+    return f"op.drop_fulltext_index({idx.label!r}, {props_args})"
 
 
 def _vector_create(idx: VectorIndex) -> str:
     return (
-        f'op.create_vector_index("{idx.label}", "{idx.prop}", '
-        f'{idx.dimension}, "{idx.similarity}", '
+        f"op.create_vector_index({idx.label!r}, {idx.prop!r}, "
+        f"{idx.dimension}, {idx.similarity!r}, "
         f"m={idx.m}, ef_construction={idx.ef_construction}, ef_runtime={idx.ef_runtime})"
     )
 
 
 def _vector_drop(idx: VectorIndex) -> str:
-    return f'op.drop_vector_index("{idx.label}", "{idx.prop}")'
+    return f"op.drop_vector_index({idx.label!r}, {idx.prop!r})"
 
 
 def _constraint_create(c: UniqueConstraint | MandatoryConstraint) -> str:
     kind = "UNIQUE" if isinstance(c, UniqueConstraint) else "MANDATORY"
-    props_repr = "[" + ", ".join(f'"{p}"' for p in c.props) + "]"
-    return f'op.create_constraint("{kind}", "{c.entity}", "{c.label}", {props_repr})'
+    props_repr = "[" + ", ".join(repr(p) for p in c.props) + "]"
+    return f"op.create_constraint({kind!r}, {c.entity!r}, {c.label!r}, {props_repr})"
 
 
 def _constraint_drop(c: UniqueConstraint | MandatoryConstraint) -> str:
     kind = "UNIQUE" if isinstance(c, UniqueConstraint) else "MANDATORY"
-    props_repr = "[" + ", ".join(f'"{p}"' for p in c.props) + "]"
-    return f'op.drop_constraint("{kind}", "{c.entity}", "{c.label}", {props_repr})'
+    props_repr = "[" + ", ".join(repr(p) for p in c.props) + "]"
+    return f"op.drop_constraint({kind!r}, {c.entity!r}, {c.label!r}, {props_repr})"
 
 
 # ---------------------------------------------------------------------------

{runic_py-0.3.4 → runic_py-0.3.6}/runic/migrate/cli.py

@@ -35,12 +35,32 @@ def _resolve_config(config: Path) -> Path:
         return config
     if config == _DEFAULT_CONFIG and _MARKER_FILE.exists():
         candidate = Path(_MARKER_FILE.read_text().strip())
-        if candidate.exists():
+        if _is_safe_marker_target(candidate):
             log.debug("resolved config from .runic: %s", candidate)
             return candidate
     return config
 
 
+def _is_safe_marker_target(candidate: Path) -> bool:
+    """Return True if *candidate* is a regular file inside the project root.
+
+    The .runic marker is treated as a path that is later ``exec``-ed, so a
+    candidate escaping the project root (e.g. ``/etc/passwd`` or a symlink) is
+    rejected to prevent arbitrary-file execution via a tampered marker.
+    """
+    project_root = Path.cwd().resolve()
+    try:
+        resolved = candidate.resolve()
+        resolved.relative_to(project_root)
+    except OSError, ValueError:
+        log.warning("ignoring .runic target outside project root: %s", candidate)
+        return False
+    if not resolved.is_file():
+        log.warning("ignoring .runic target that is not a regular file: %s", candidate)
+        return False
+    return True
+
+
 _DB_CONNECTION_ERROR_NAMES = frozenset(
     {
         "AuthenticationError",

{runic_py-0.3.4 → runic_py-0.3.6}/runic/migrate/context.py

@@ -9,6 +9,7 @@ from runic.migrate.adapters import GraphAdapter
 from runic.migrate.manifest import SchemaManifest
 from runic.migrate.operations import GraphOperations
 from runic.migrate.script import (
+    AmbiguousRevision,
     Revision,
     RevisionInfo,
     RevisionNotFound,
@@ -113,7 +114,9 @@ class Runic:
     def get_revision_message(self, rev_id: str) -> str | None:
         try:
             return self._script_dir.get_revision(rev_id).message
-        except Exception:
+        except RevisionNotFound, AmbiguousRevision:
+            # Expected when the revision is absent or the prefix is ambiguous;
+            # other errors (corrupt scripts, I/O) propagate rather than hide.
             return None
 
     def _resolve_upgrade_target(self, target: str) -> str:

{runic_py-0.3.4 → runic_py-0.3.6}/runic/migrate/introspect.py

@@ -465,6 +465,7 @@ def read_live_schema(graph: Any) -> LiveSchema:
         entity_type: str = row[_IDX_ENTITYTYPE]
         rel = entity_type == "RELATIONSHIP"
 
+        fulltext_props: list[str] = []
         for prop in props:
             prop_types: list[str] = types_dict.get(prop, [])
             if not prop_types:
@@ -473,13 +474,10 @@ def read_live_schema(graph: Any) -> LiveSchema:
             if idx_type == "RANGE":
                 range_indexes.append(RangeIndex(label=label, prop=prop, rel=rel))
             elif idx_type == "FULLTEXT":
-                sw = tuple(stopwords) if stopwords else None
-                lang = language if language and language != "english" else None
-                fulltext_indexes.append(
-                    FulltextIndex(
-                        label=label, props=[prop], language=lang, stopwords=sw
-                    )
-                )
+                # Accumulate all fulltext props of this label into a single
+                # multi-property index so it matches the grouped manifest spec
+                # (one FulltextIndex per label, not one per property).
+                fulltext_props.append(prop)
             elif idx_type == "VECTOR":
                 prop_opts: dict = options_dict.get(prop, {})
                 dimension: int = int(prop_opts.get("dimension", 0))
@@ -503,6 +501,15 @@ def read_live_schema(graph: Any) -> LiveSchema:
                     "unknown index type %r for %s.%s — skipping", idx_type, label, prop
                 )
 
+        if fulltext_props:
+            sw = tuple(stopwords) if stopwords else None
+            lang = language if language and language != "english" else None
+            fulltext_indexes.append(
+                FulltextIndex(
+                    label=label, props=fulltext_props, language=lang, stopwords=sw
+                )
+            )
+
     con_result = graph.ro_query("CALL db.constraints()")
     for row in con_result.result_set:
         if len(row) < _CON_MIN_COLS:

{runic_py-0.3.4 → runic_py-0.3.6}/runic/migrate/script.py

@@ -22,6 +22,16 @@ if TYPE_CHECKING:
 log = logging.getLogger(__name__)
 
 
+def _docstring_safe(text: str) -> str:
+    """Neutralise sequences that would break out of a ``\"\"\"`` docstring.
+
+    The migration ``message`` is interpolated raw into the generated module's
+    docstring.  Escaping every double-quote run prevents a crafted message from
+    terminating the docstring early and injecting executable code.
+    """
+    return text.replace('"', '\\"')
+
+
 class RevisionNotFound(Exception):
     pass
 
@@ -439,6 +449,7 @@ class ScriptDirectory:
             branch_labels=branch_labels or [],
             depends_on=depends_on or [],
             message=message,
+            doc_message=_docstring_safe(message),
             create_date=datetime.now(UTC),
             upgrade_body=upgrade_body,
             downgrade_body=downgrade_body,

{runic_py-0.3.4 → runic_py-0.3.6}/runic/migrate/templates/script.py.mako

@@ -1,4 +1,4 @@
-"""${message}
+"""${doc_message}
 
 Revision ID: ${up_revision}
 Revises: ${down_revision}

{runic_py-0.3.4 → runic_py-0.3.6}/runic/ogm/core/descriptors.py

@@ -396,6 +396,9 @@ def Relation(  # noqa: N802
                 target="Person",
             )
     """
+    from runic.cypher import validate_identifier
+
+    validate_identifier(relationship, "relationship type")
     return FieldDescriptor(
         relationship=relationship,
         direction=direction,