feat: add intercept hook for middleware

[aqrln]

Middleware intercept hook + framework SPI for content-addressed middleware

Refs: TML-2143

Summary

Lands the framework-level SPI from the cache-middleware project — everything a
cross-family interceptor needs to short-circuit query execution, but none of
the user-facing surface that consumes it. Specifically:

• A new intercept hook on RuntimeMiddleware that lets middleware substitute
  rows for an execution without invoking the driver.
• A source: 'driver' | 'middleware' field on AfterExecuteResult so observers
  can tell driver-served from middleware-served executions apart.
• A new contentHash(exec) method on RuntimeMiddlewareContext that returns a
  bounded, opaque digest identifying the (storage, statement, params) tuple
  of a lowered execution. Implemented for both SQL and Mongo runtimes.
• Two new helpers in @prisma-next/utils — canonicalStringify and
  hashContent — that the runtime contentHash implementations compose.

The cache middleware package and the user-facing .annotate(...) surface (SQL
DSL + ORM Collection) are deliberately not in this PR — they have
unresolved API questions and will land in a follow-up. After this PR a
hand-written RuntimeMiddleware can already intercept executions and key off
ctx.contentHash(exec); we just don't expose any product feature that does so.

Motivation

Today RuntimeMiddleware is observer-only: beforeExecute, onRow, and
afterExecute can inspect execution and raise errors, but they cannot
substitute a result. That blocks the whole class of interception use cases
listed in TML-2143 — caching, mocking, rate limiting, circuit breaking — and
forces those features to live outside the middleware pipeline as bespoke
wrappers around lanes or runtimes.

Two prerequisites already landed on main:

• beforeCompile rewrite hook (TML-2306) — SQL middleware can rewrite the
  AST between lane .build() and adapter.lower().
• Single-tier runtime (TML-2242, ADR 204) — runtime-executor was
  collapsed into @prisma-next/framework-components. Both SqlRuntimeImpl and
  MongoRuntimeImpl now extend RuntimeCore<TPlan, TExec, TMiddleware>, whose
  template is runBeforeCompile → lower → runWithMiddleware. That means
  runWithMiddleware is the single canonical implementation of the middleware
  lifecycle and both families inherit any hook added there.

This PR adds the second piece of the TML-2143 vision — short-circuiting with
static results — by introducing intercept in exactly one place
(runWithMiddleware). There is no per-family wiring; Mongo picks it up by
inheritance, and the cross-family integration test pins that.

What's in this PR

Framework-components — middleware SPI

• RuntimeMiddleware.intercept?(plan, ctx) — new optional hook.
  Returning undefined (or omitting the hook) is passthrough; returning an
  InterceptResult short-circuits execution.

  intercept?(plan: TPlan, ctx: RuntimeMiddlewareContext): Promise<InterceptResult | undefined>
  
  interface InterceptResult {
    readonly rows:
      | AsyncIterable<Record<string, unknown>>
      | Iterable<Record<string, unknown>>
  }

  rows accepts arrays, sync generators, and async generators — for await
  natively handles all three via the Symbol.asyncIterator /
  Symbol.iterator fallback, so the orchestrator iterates without branching
  on the variant. Cached arrays are the common case; the streaming variants
  cover future use cases like mock layers replaying recordings.

• AfterExecuteResult.source: 'driver' | 'middleware' — required field.
  Telemetry middleware round-trips it on its afterExecute events. Existing
  in-repo AfterExecuteResult fixtures across framework-components,
  sql-runtime, and middleware-telemetry test suites are updated.

• RuntimeMiddlewareContext.contentHash(exec) — required, returns
  Promise<string>. Family runtimes own the implementation; middleware
  authors against the framework type without family-specific imports or
  runtime probing. (Cross-family middleware that need a per-execution
  identity — caching, request coalescing — cannot synthesize one from a
  content-free ExecutionPlan marker, so the family runtime supplies the
  canonical key.)

  Async because the underlying digest helper uses WebCrypto's
  crypto.subtle.digest.

runWithMiddleware orchestrator wiring

The lifecycle becomes:

1. Run the intercept chain in registration order. First non-undefined
   result wins; subsequent middleware's intercept does not fire. On hit:
   emit ctx.log.debug?({ event: 'middleware.intercept', middleware: mw.name }),
   set source = 'middleware', and use the intercepted rows as the row
   source. On all-passthrough: source = 'driver', row source is
   runDriver().
2. If source === 'driver', run the beforeExecute chain. On the hit path
   it is skipped — beforeExecute semantically means "about to hit the
   driver."
3. Iterate the row source. On the driver path, fire onRow per row. On the
   hit path, skip onRow (intercepted rows did not originate from a driver
   row stream). Either way, yield each row to the consumer in order.
4. Fire afterExecute on success with { rowCount, latencyMs, completed: true, source }.
5. Fire afterExecute on error with completed: false and the appropriate
   source. Errors thrown by afterExecute on the error path remain
   swallowed — original error rethrown. (Existing semantics, unchanged.)

runDriver() is invoked lazily — only after the intercept chain resolves
to passthrough. This matters for factories that do eager work on invocation
(acquiring a connection, sending a query): they must not run on the
intercepted hit path.

One source-tracking subtlety worth flagging for review: source is set to
'middleware' before awaiting an intercept hook, then reverted to
'driver' if the hook returns undefined. This makes a hook that throws
report as a middleware-source failure rather than a driver-source failure.
An earlier draft of the wiring set source only after a successful return,
which mis-attributed errors thrown inside intercept.

Family runtimes — contentHash implementations

• SQL (packages/2-sql/5-runtime/src/content-hash.ts):

  hashContent(`${exec.meta.storageHash}|${exec.sql}|${canonicalStringify(exec.params)}`)
  

  Lives in its own module so the cache middleware (when it lands) can be
  tested with mock contexts, but the SQL runtime owns the production
  implementation. Deliberately does not reuse computeSqlFingerprint —
  that helper strips literals to group executions by statement shape (used
  by telemetry), which is the opposite of what contentHash needs:
  per-execution discrimination, not per-statement-shape grouping.

• Mongo (packages/2-mongo-family/7-runtime/src/content-hash.ts):

  hashContent(`${exec.meta.storageHash}|${canonicalStringify(exec.command)}`)
  

  Two components instead of three: MongoExecutionPlan.command is the wire
  command itself, so canonicalizing it captures both structure (collection,
  kind) and parameters (document/filter/update/pipeline) in one pass. No
  separate "rendered statement" component is needed.

@prisma-next/utils — new modules

• canonical-stringify.ts — deterministic JSON-like serializer.
  Two values that are structurally equivalent (regardless of object key
  insertion order) produce the same string; values that differ in any
  meaningful way — including types JSON would conflate (BigInt(1) vs 1,
  +0 vs -0, null vs undefined, Date vs ISO string, Buffer vs
  number array) — produce different strings. Throws on functions, symbols,
  and circular references.

• hash-content.ts — hashContent(value: string): Promise<string>,
  returning `sha512:${hex}`. Wraps WebCrypto's
  crypto.subtle.digest('SHA-512', …). Output is fixed-length (135 chars)
  regardless of input size and self-describing (the sha512: prefix lets a
  future migration to a different hash produce visibly distinct keys, and is
  consistent with the sha256:HEXDIGEST shape already used by
  meta.storageHash).

  Two reasons the canonical string is hashed rather than used directly as a
  Map key: (a) bounded memory — a query bound to a 10 MB JSON column
  would otherwise produce a 10 MB cache key, scaling to gigabytes at
  maxEntries=1000; (b) sensitive-data isolation — parameter values
  appear verbatim in the canonical string and would otherwise leak into
  debug logs, Redis KEYS/MONITOR output, persistence dumps, and any
  user-supplied CacheStore implementation.

  WebCrypto over node:crypto for portability — Deno, Bun, browsers, edge
  workers all expose globalThis.crypto.subtle without a Node-specific
  import.

What's not in this PR (follow-ups)

These are explicitly out of scope here. They have unresolved API questions
that I'd rather not resolve under the same review.

• defineAnnotation + ValidAnnotations + assertAnnotationsApplicable
  — the typed annotation surface with operation-kind applicability
  ('read' / 'write'). This is the gate that makes "caching a mutation"
  structurally impossible, but the precise shape of the handle, the
  brand mechanism, and the namespace-reservation policy are still in
  flux.
• Lane annotation surface — .annotate(...) on the SQL DSL builders and
  the ORM Collection terminals. Blocked on the previous bullet.
• @prisma-next/middleware-cache package — cacheAnnotation,
  CacheStore interface, in-memory LRU default, transaction-scope guard.
  This is the eventual proof point and the April stop condition for VP4.

The full plan is in projects/middleware-intercept-and-cache/plan.md
(included as docs in this PR). Follow-up refactorings surfaced during this
work are recorded in projects/middleware-intercept-and-cache/follow-ups.md
— most notably the suggestion to drop the Row generic from
runWithMiddleware and consolidate the as Row cast to a single site in
RuntimeCore.execute. Deferred to keep this PR's review surface focused.

Test coverage

Unit — @prisma-next/utils

• canonical-stringify.test.ts — primitives (incl. NaN, ±Infinity, ±0),
  BigInt (n suffix vs number), Date (tagged + ISO), Buffer /
  Uint8Array (tagged + hex), arrays (order-preserving), plain objects
  (key-sorted, recursive), null vs undefined, throws on functions /
  symbols / circular refs.
• hash-content.test.ts — fixed-length sha512: output, deterministic across
  repeated calls, discriminates on trailing characters and separator
  placement, output does not embed input (opacity), UTF-8 multi-byte
  handling, Unicode normalization is byte-significant (NFC vs NFD).

Unit — framework-components

• runtime-middleware.types.test-d.ts — intercept is optional;
  InterceptResult.rows accepts arrays, sync generators, async generators;
  rejects rows whose elements are not Record<string, unknown> (negative
  test); intercept narrows alongside other hooks when TPlan is narrowed
  (e.g. SqlMiddleware sees plan.sql / plan.params).
• run-with-middleware.intercept.test.ts — 17 cases across chain semantics
  (3), hit path (7), miss path (3), and error path (4). Highlights:
  • First interceptor wins; second's intercept does not fire.
  • Mixed observer-then-interceptor chain: when the downstream intercepts,
    the upstream observer's beforeExecute is not called either.
  • Hit path skips beforeExecute and onRow; afterExecute fires once
    with source: 'middleware' and correct rowCount; runDriver factory
    is not invoked.
  • All three row-source variants (array, sync Iterable, AsyncIterable)
    work without orchestrator branching.
  • Interceptor throw → afterExecute fires with completed: false,
    source: 'middleware', error rethrown; afterExecute-during-error
    swallow semantics preserved.
  • Throw mid-iteration of intercepted rows → rowCount reflects rows
    yielded before the throw.
• The pre-existing 6 runWithMiddleware tests (zero / single / multi
  middleware, error paths, swallow, partial-hook) all continue to pass; the
  one assertion against observedResult now sees source: 'driver'
  explicitly.

Unit — family runtimes

• sql-runtime/test/content-hash.test.ts — stability (same plan / repeated
  invocations / object-key order in params), discrimination (storageHash,
  sql, param values, param position, BigInt vs number, null vs
  undefined, Date instants, Buffer bytes), shape
  (sha512:[0-9a-f]{128}), opacity (no raw SQL or params embedded).
• mongo-runtime/test/content-hash.test.ts — analogous: stability over
  shuffled document/filter key order, discrimination on collection name,
  command kind, document/filter values, aggregate pipeline content and
  stage order, shape, opacity.

Integration

• sql-runtime/test/intercept-decoding.test.ts — when an SqlMiddleware
  intercepts and returns raw rows, those rows go through the SQL runtime's
  normal codec decode pass (single row, multiple rows, async-iterable rows,
  byte-identical decoded output vs driver-served rows for the same wire
  value). This is the contract that lets the eventual cache middleware
  store raw rows cheaply: cache the raw, decode on the way out.
• test/integration/test/cross-package/cross-family-middleware.test.ts —
  registers a single generic interceptor on both an SQL runtime
  (MockSqlRuntime extending RuntimeCore) and a real MongoRuntimeImpl,
  asserts that the interceptor short-circuits execution in both families
  via the same runWithMiddleware orchestrator. The Mongo runtime needs
  no production change to pick this up; the test pins that.

Risk and migration

• Public API additions only within the framework-components SPI. The new
  contentHash field on RuntimeMiddlewareContext is required, but the
  type is internal to runtime authors — every concrete construction site
  in this repo is updated, and the typechecker enforces completeness for
  out-of-tree authors. The new source field on AfterExecuteResult is
  also required; tests using toMatchObject continue to pass without
  changes, and the few sites constructing AfterExecuteResult directly
  are updated.
• No behavior change on the miss path. The orchestrator's existing 6
  unit tests pass without modification. The only observable change for
  middleware that does not implement intercept is the new
  source: 'driver' value in AfterExecuteResult.
• No new runtime dependency outside the workspace. Mongo runtime now
  depends on @prisma-next/utils for the shared serializer / hasher (it
  was already a SQL-runtime dep); no third-party additions.

Sequencing

This is M1 of projects/middleware-intercept-and-cache. Once it lands the
follow-up PR will add the defineAnnotation surface (M1.7+), the lane
annotation builders (M2), and the @prisma-next/middleware-cache package
(M3) — at which point the April stop condition for TML-2143 / WS3 VP4 is
met (a repeated query served from cache without hitting the database).

Summary by CodeRabbit

• New Features

  • Middleware can short‑circuit query execution and return intercepted rows; executions are now labeled by source (driver | middleware).
  • Framework runtimes expose a contentHash API; deterministic content-hash utilities and canonical serializer added for stable keying.

• Documentation

  • Runtime & middleware docs and spec updated to describe interception, content‑hash usage, and cache middleware design.

• Tests

  • Extensive tests added/updated for interception, hashing, decoding, telemetry, and cross‑family integration.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds a middleware interception hook (first non-undefined wins), per-execution content-hash utilities (canonicalStringify, hashContent) with SQL/Mongo wiring, propagates a source discriminator to afterExecute/telemetry, and updates tests, types, exports, and docs to exercise interception and hashing.

Changes

Interception + Content-Hashing Flow

Layer / File(s)	Summary
Data Shape / Utilities packages/1-framework/0-foundation/utils/src/canonical-stringify.ts, packages/1-framework/0-foundation/utils/src/hash-content.ts, packages/1-framework/0-foundation/utils/src/exports/*, packages/1-framework/0-foundation/utils/package.json, packages/1-framework/0-foundation/utils/tsdown.config.ts	Add canonicalStringify(value): string (deterministic, type-tagged serialization with cycle detection) and hashContent(value): Promise<string> (SHA‑512 → sha512:<128-hex>). Add re-export entry modules, package exports entries, and tsdown entries.
Core SPI / Types packages/1-framework/1-core/framework-components/src/execution/runtime-middleware.ts, packages/1-framework/1-core/framework-components/src/exports/runtime.ts	Extend RuntimeMiddlewareContext with contentHash(exec): Promise<string>; add optional `RuntimeMiddleware.intercept(plan, ctx): Promise<InterceptResult
Orchestration / Control Flow packages/1-framework/1-core/framework-components/src/execution/run-with-middleware.ts	Implement interception phase: call middleware intercept in registration order until first non-undefined wins; on hit set middleware rowSource, skip beforeExecute/onRow and set source='middleware'; on miss continue driver path and set source='driver'. Emit debug log on win.
Family Runtime Wiring packages/2-sql/5-runtime/src/content-hash.ts, packages/2-sql/5-runtime/src/sql-runtime.ts, packages/2-mongo-family/7-runtime/src/content-hash.ts, packages/2-mongo-family/7-runtime/src/mongo-runtime.ts	Add computeSqlContentHash and computeMongoContentHash that compose plan identity from meta.storageHash + canonicalized SQL/command/params and return hashContent(...). Inject contentHash callback into SQL and Mongo middleware contexts.
Exports / Packaging packages/1-framework/0-foundation/utils/package.json, packages/1-framework/0-foundation/utils/tsdown.config.ts, packages/1-framework/0-foundation/utils/src/exports/*	Expose new public subpaths ./canonical-stringify and ./hash-content and add them to tsdown entries; add small re-export modules for those entry points.
Telemetry packages/3-extensions/middleware-telemetry/src/telemetry-middleware.ts	Add optional `source?: 'driver'
Tests — Framework & Orchestration packages/1-framework/1-core/framework-components/test/*, packages/1-framework/1-core/framework-components/test/*.types.test-d.ts	Add interception unit tests (chain semantics, hit/miss/error, iterable variants), add type tests covering intercept, extend many test fixtures to include ctx.contentHash.
Tests — Utilities packages/1-framework/0-foundation/utils/test/*	Add exhaustive tests for canonicalStringify (primitives, typed arrays, objects, cycles, errors) and hashContent (format, determinism, discrimination, large inputs, UTF‑8 handling).
Tests — SQL & Mongo & Integration packages/2-sql/5-runtime/test/*, packages/2-mongo-family/7-runtime/test/*, test/integration/test/cross-package/cross-family-middleware.test.ts	Add content-hash unit tests, middleware-context wiring tests, SQL interception decoding tests, and a cross-family integration test verifying family-agnostic interceptor short-circuits and telemetry source: 'middleware'.
Docs & Spec docs/architecture docs/subsystems/4. Runtime & Middleware Framework.md, projects/middleware-intercept-and-cache/*.md	Document RuntimeMiddleware.intercept semantics, InterceptResult shape, AfterExecuteResult.source, content-hash utilities, testing strategy, and a plan/spec for a cache middleware using ctx.contentHash.

sequenceDiagram
    participant Runtime as RuntimeCore
    participant Runner as runWithMiddleware
    participant M1 as Middleware A
    participant M2 as Middleware B
    participant Driver
    participant Consumer

    rect rgba(200,150,255,0.5)
    Note over Runtime,Consumer: Intercept Hit Path
    Runtime->>Runner: execute(plan)
    Runner->>M1: intercept(plan, ctx)
    M1-->>Runner: InterceptResult { rows }
    Runner->>M1: afterExecute({ source: 'middleware', rowCount, completed })
    Runner->>Consumer: yield rows
    Runner-->>Runtime: complete
    end

    rect rgba(150,200,255,0.5)
    Note over Runtime,Consumer: Passthrough (Miss) Path
    Runtime->>Runner: execute(plan)
    Runner->>M1: intercept(plan, ctx)
    M1-->>Runner: undefined
    Runner->>M2: intercept(plan, ctx)
    M2-->>Runner: undefined
    Runner->>M1: beforeExecute(plan, ctx)
    Runner->>Driver: runDriver(plan)
    Driver-->>Runner: AsyncIterable<row>
    Runner->>M1: onRow(row, ctx)
    Runner->>Consumer: yield row
    Runner->>M1: afterExecute({ source: 'driver', rowCount, completed })
    Runner-->>Runtime: complete
    end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Poem

🐰 I nibble strings to make them neat,
I fold bytes to hex with tiny feet.
Middleware hops—first to shout "I win!"
Drivers wait while hashes hum within.
A hop, a hash, a cached spring begins.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 29.63% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the primary change: adding an intercept hook for middleware, which is the main feature introduced across the PR's framework components.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cache-middleware-intercept

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pkg-pr-new]

Open in StackBlitz

@prisma-next/mongo-runtime

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-runtime@409

@prisma-next/family-mongo

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/family-mongo@409

@prisma-next/sql-runtime

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-runtime@409

@prisma-next/family-sql

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/family-sql@409

@prisma-next/extension-arktype-json

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/extension-arktype-json@409

@prisma-next/middleware-telemetry

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/middleware-telemetry@409

@prisma-next/mongo

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo@409

@prisma-next/extension-paradedb

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/extension-paradedb@409

@prisma-next/extension-pgvector

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/extension-pgvector@409

@prisma-next/postgres

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/postgres@409

@prisma-next/sql-orm-client

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-orm-client@409

@prisma-next/sqlite

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sqlite@409

@prisma-next/target-mongo

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/target-mongo@409

@prisma-next/adapter-mongo

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/adapter-mongo@409

@prisma-next/driver-mongo

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/driver-mongo@409

@prisma-next/contract

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/contract@409

@prisma-next/utils

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/utils@409

@prisma-next/config

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/config@409

@prisma-next/errors

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/errors@409

@prisma-next/framework-components

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/framework-components@409

@prisma-next/operations

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/operations@409

@prisma-next/ts-render

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/ts-render@409

@prisma-next/contract-authoring

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/contract-authoring@409

@prisma-next/ids

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/ids@409

@prisma-next/psl-parser

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/psl-parser@409

@prisma-next/psl-printer

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/psl-printer@409

@prisma-next/cli

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/cli@409

@prisma-next/emitter

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/emitter@409

@prisma-next/migration-tools

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/migration-tools@409

prisma-next

npm i https://pkg.pr.new/prisma/prisma-next@409

@prisma-next/vite-plugin-contract-emit

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/vite-plugin-contract-emit@409

@prisma-next/mongo-codec

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-codec@409

@prisma-next/mongo-contract

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-contract@409

@prisma-next/mongo-value

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-value@409

@prisma-next/mongo-contract-psl

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-contract-psl@409

@prisma-next/mongo-contract-ts

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-contract-ts@409

@prisma-next/mongo-emitter

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-emitter@409

@prisma-next/mongo-schema-ir

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-schema-ir@409

@prisma-next/mongo-query-ast

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-query-ast@409

@prisma-next/mongo-orm

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-orm@409

@prisma-next/mongo-query-builder

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-query-builder@409

@prisma-next/mongo-lowering

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-lowering@409

@prisma-next/mongo-wire

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/mongo-wire@409

@prisma-next/sql-contract

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-contract@409

@prisma-next/sql-errors

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-errors@409

@prisma-next/sql-operations

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-operations@409

@prisma-next/sql-schema-ir

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-schema-ir@409

@prisma-next/sql-contract-psl

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-contract-psl@409

@prisma-next/sql-contract-ts

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-contract-ts@409

@prisma-next/sql-contract-emitter

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-contract-emitter@409

@prisma-next/sql-lane-query-builder

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-lane-query-builder@409

@prisma-next/sql-relational-core

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-relational-core@409

@prisma-next/sql-builder

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/sql-builder@409

@prisma-next/target-postgres

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/target-postgres@409

@prisma-next/target-sqlite

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/target-sqlite@409

@prisma-next/adapter-postgres

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/adapter-postgres@409

@prisma-next/adapter-sqlite

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/adapter-sqlite@409

@prisma-next/driver-postgres

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/driver-postgres@409

@prisma-next/driver-sqlite

npm i https://pkg.pr.new/prisma/prisma-next/@prisma-next/driver-sqlite@409

commit: 6c1e0f6

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/1-framework/0-foundation/utils/src/canonical-stringify.ts`:
- Around line 79-100: The current serializer accepts any object and uses
Object.keys in writePlainObject, which hides symbol-keyed properties and
collapses non-plain objects (Map, Set, RegExp, class instances) into identical
representations; update the logic so writePlainObject only accepts true plain
objects (check Object.getPrototypeOf(obj) === Object.prototype ||
Object.getPrototypeOf(obj) === null) and reject (throw) any other object types
(Map, Set, RegExp, Date, class instances) upstream in the write function, and
also detect symbol-keyed properties via Object.getOwnPropertySymbols(obj) and
throw if any exist so callers are forced to handle those cases explicitly;
reference writePlainObject and write to locate where to add these guards and
where to surface the errors.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: d7ab81c9-cbce-4630-a095-9a33d4419846

📥 Commits

Reviewing files that changed from the base of the PR and between fba7f45 and 0bd6ea9.

⛔ Files ignored due to path filters (4)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• projects/middleware-intercept-and-cache/follow-ups.md is excluded by !projects/**
• projects/middleware-intercept-and-cache/plan.md is excluded by !projects/**
• projects/middleware-intercept-and-cache/spec.md is excluded by !projects/**

📒 Files selected for processing (33)

• packages/1-framework/0-foundation/utils/package.json
• packages/1-framework/0-foundation/utils/src/canonical-stringify.ts
• packages/1-framework/0-foundation/utils/src/exports/canonical-stringify.ts
• packages/1-framework/0-foundation/utils/src/exports/hash-content.ts
• packages/1-framework/0-foundation/utils/src/hash-content.ts
• packages/1-framework/0-foundation/utils/test/canonical-stringify.test.ts
• packages/1-framework/0-foundation/utils/test/hash-content.test.ts
• packages/1-framework/0-foundation/utils/tsdown.config.ts
• packages/1-framework/1-core/framework-components/src/exports/runtime.ts
• packages/1-framework/1-core/framework-components/src/run-with-middleware.ts
• packages/1-framework/1-core/framework-components/src/runtime-middleware.ts
• packages/1-framework/1-core/framework-components/test/mock-family.test.ts
• packages/1-framework/1-core/framework-components/test/run-with-middleware.intercept.test.ts
• packages/1-framework/1-core/framework-components/test/run-with-middleware.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.types.test-d.ts
• packages/1-framework/1-core/framework-components/test/runtime-middleware.types.test-d.ts
• packages/2-mongo-family/7-runtime/package.json
• packages/2-mongo-family/7-runtime/src/content-hash.ts
• packages/2-mongo-family/7-runtime/src/mongo-runtime.ts
• packages/2-mongo-family/7-runtime/test/content-hash.test.ts
• packages/2-mongo-family/7-runtime/test/mongo-middleware.test.ts
• packages/2-mongo-family/7-runtime/test/mongo-runtime.types.test-d.ts
• packages/2-sql/5-runtime/src/content-hash.ts
• packages/2-sql/5-runtime/src/sql-runtime.ts
• packages/2-sql/5-runtime/test/before-compile-chain.test.ts
• packages/2-sql/5-runtime/test/budgets.test.ts
• packages/2-sql/5-runtime/test/content-hash.test.ts
• packages/2-sql/5-runtime/test/intercept-decoding.test.ts
• packages/2-sql/5-runtime/test/lints.test.ts
• packages/3-extensions/middleware-telemetry/src/telemetry-middleware.ts
• packages/3-extensions/middleware-telemetry/test/telemetry-middleware.test.ts
• test/integration/test/cross-package/cross-family-middleware.test.ts

[coderabbitai]

Actionable comments posted: 6

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/1-framework/1-core/framework-components/src/runtime-middleware.ts (1)

89-115: ⚠️ Potential issue | 🟠 Major

Align RuntimeMiddleware's default plan type to match the runtime's actual type.

A middleware authored as plain RuntimeMiddleware has plan: QueryPlan, but ctx.contentHash() accepts only ExecutionPlan. Since ExecutionPlan extends QueryPlan, you cannot pass a QueryPlan where an ExecutionPlan is expected—requiring an unnecessary cast. The docstring confirms these hooks run on the lowered plan (which is an ExecutionPlan). Changing the default from QueryPlan to ExecutionPlan aligns the type with runtime reality and enables contentHash usage without casting.

Suggested direction

-export interface RuntimeMiddleware<TPlan extends QueryPlan = QueryPlan> {
+export interface RuntimeMiddleware<TPlan extends ExecutionPlan = ExecutionPlan> {

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/1-framework/1-core/framework-components/src/runtime-middleware.ts`
around lines 89 - 115, The RuntimeMiddleware generic default should be
ExecutionPlan not QueryPlan: update the RuntimeMiddleware<TPlan extends
QueryPlan = QueryPlan> declaration so the default type parameter is
ExecutionPlan (e.g., RuntimeMiddleware<TPlan extends QueryPlan = ExecutionPlan>)
so hooks like intercept and beforeExecute receive the lowered ExecutionPlan and
can call ctx.contentHash() without casting; adjust any imports/type names if
necessary and ensure references to intercept and beforeExecute in this file
remain consistent.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@projects/middleware-intercept-and-cache/plan.md`:
- Around line 42-47: The plan references a stale hashing API and sync behavior:
update all mentions (including the checklist items for hashContent,
SqlRuntimeImpl/MongoRuntimeImpl, tests and acceptance criteria) to match the
landed API where contentHash(exec) returns a Promise<string> and the digest
prefix is "sha512:<hex>" (not "blake2b512:"); adjust descriptions to require
async contentHash signatures (Promise) and change expected regexes in tests to
^sha512:[0-9a-f]{128}$, and ensure references to computeSqlFingerprint are kept
separate from contentHash behavior in the SqlRuntimeImpl and MongoRuntimeImpl
items (use hashContent + canonicalStringify as described but with the
async/sha512 contract).

In `@projects/middleware-intercept-and-cache/spec.md`:
- Line 145: Reword the ambiguous phrase about raw vs decoded rows to clarify
that interceptors/cache middleware store raw (undecoded) rows while the SQL
runtime performs the decode before returning rows to callers; update the text
referencing InterceptResult.rows, runWithMiddleware, and onRow to something like
“cache middleware stores raw rows; the SQL runtime decodes them the same way as
driver rows before yielding to consumers,” and apply the same clarification to
the other occurrence that mentions returned/decoded rows.
- Line 359: The file fails markdownlint MD047 for trailing newlines; open the
spec.md and ensure the end of the file after the "ORM terminal enumeration."
paragraph contains exactly one newline character (no extra blank lines or
missing newline). Remove any extra trailing blank lines and add a single
trailing '\n' so the file ends with one newline.
- Line 133: The spec incorrectly documents
RuntimeMiddlewareContext.contentHash(exec: ExecutionPlan) as returning string
while the runtime API is async (Promise<string>); update the spec text (all
mentions of contentHash, including the later occurrences that duplicate this
contract) to state that contentHash returns a Promise<string> and explain that
implementations must return a bounded, opaque digest produced asynchronously
(e.g., by calling hashContent) so typings and runtime behavior match the
framework API and tests referencing RuntimeMiddlewareContext.contentHash and
ExecutionPlan remain correct.
- Line 133: The spec's `contentHash(exec: ExecutionPlan)` description must be
updated to match the implementation: change the signature to `contentHash(exec:
ExecutionPlan): Promise<string>`, and replace BLAKE2b-512 references with
"SHA-512 via WebCrypto"; specify the output format as the literal prefix
`sha512:` followed by a 128-character hex digest (fixed 135-character string
total). Update every occurrence of the old algorithm/format (including the main
`contentHash` requirement and the "Open Questions" hashing discussion) so they
reference the async return type, SHA-512/WebCrypto, and the `sha512:HEX128`
output format consistently.
- Around line 182-191: The fenced TypeScript snippet defining CacheStore and
CachedEntry lacks blank lines before and after the ```typescript block; add a
single blank line immediately above the opening ```typescript fence and a single
blank line immediately below the closing ``` fence so the CacheStore and
CachedEntry code block is surrounded by blank lines to satisfy markdownlint
MD031.

---

Outside diff comments:
In `@packages/1-framework/1-core/framework-components/src/runtime-middleware.ts`:
- Around line 89-115: The RuntimeMiddleware generic default should be
ExecutionPlan not QueryPlan: update the RuntimeMiddleware<TPlan extends
QueryPlan = QueryPlan> declaration so the default type parameter is
ExecutionPlan (e.g., RuntimeMiddleware<TPlan extends QueryPlan = ExecutionPlan>)
so hooks like intercept and beforeExecute receive the lowered ExecutionPlan and
can call ctx.contentHash() without casting; adjust any imports/type names if
necessary and ensure references to intercept and beforeExecute in this file
remain consistent.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 55571a78-cfc7-4476-8fe2-30426b8a5b4f

📥 Commits

Reviewing files that changed from the base of the PR and between 0bd6ea9 and 2525dbe.

📒 Files selected for processing (27)

• packages/1-framework/0-foundation/utils/package.json
• packages/1-framework/0-foundation/utils/src/exports/hash-content.ts
• packages/1-framework/0-foundation/utils/src/hash-content.ts
• packages/1-framework/0-foundation/utils/test/hash-content.test.ts
• packages/1-framework/0-foundation/utils/tsdown.config.ts
• packages/1-framework/1-core/framework-components/src/runtime-middleware.ts
• packages/1-framework/1-core/framework-components/test/mock-family.test.ts
• packages/1-framework/1-core/framework-components/test/run-with-middleware.intercept.test.ts
• packages/1-framework/1-core/framework-components/test/run-with-middleware.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.types.test-d.ts
• packages/1-framework/1-core/framework-components/test/runtime-middleware.types.test-d.ts
• packages/2-mongo-family/7-runtime/src/content-hash.ts
• packages/2-mongo-family/7-runtime/src/mongo-runtime.ts
• packages/2-mongo-family/7-runtime/test/content-hash.test.ts
• packages/2-mongo-family/7-runtime/test/mongo-middleware.test.ts
• packages/2-mongo-family/7-runtime/test/mongo-runtime.types.test-d.ts
• packages/2-sql/5-runtime/src/content-hash.ts
• packages/2-sql/5-runtime/src/sql-runtime.ts
• packages/2-sql/5-runtime/test/before-compile-chain.test.ts
• packages/2-sql/5-runtime/test/budgets.test.ts
• packages/2-sql/5-runtime/test/content-hash.test.ts
• packages/2-sql/5-runtime/test/lints.test.ts
• packages/3-extensions/middleware-telemetry/test/telemetry-middleware.test.ts
• projects/middleware-intercept-and-cache/plan.md
• projects/middleware-intercept-and-cache/spec.md
• test/integration/test/cross-package/cross-family-middleware.test.ts

[coderabbitai]

🧹 Nitpick comments (1)

packages/1-framework/1-core/framework-components/test/run-with-middleware.intercept.test.ts (1)

580-587: ⚡ Quick win

Replace inline conditional object spread with ifDefined() helper.

The conditional spread in mw() breaks the repo’s TS object-spread convention. Prefer ifDefined() for this pattern.

♻️ Suggested refactor

+import { ifDefined } from '@prisma-next/utils/defined';
...
       function mw(label: string, doesIntercept: boolean): RuntimeMiddleware<MockExec> {
         return {
           name: label,
-          ...(doesIntercept
-            ? {
-                async intercept(): Promise<InterceptResult | undefined> {
-                  events.push(`${label}:intercept`);
-                  throw interceptError;
-                },
-              }
-            : {}),
+          ...ifDefined(
+            doesIntercept,
+            {
+              async intercept(): Promise<InterceptResult | undefined> {
+                events.push(`${label}:intercept`);
+                throw interceptError;
+              },
+            },
+          ),
           async afterExecute(_plan, result) {
             observed.push({
               label,
               source: result.source,
               completed: result.completed,

As per coding guidelines, “Use ifDefined() from @prisma-next/utils/defined for conditional object spreads instead of inline conditional spread patterns.”

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@packages/1-framework/1-core/framework-components/test/run-with-middleware.intercept.test.ts`
around lines 580 - 587, Replace the inline conditional object spread inside the
mw(...) call with the ifDefined helper: import ifDefined from
'@prisma-next/utils/defined' and replace the ...(doesIntercept ? { async
intercept(): Promise<InterceptResult | undefined> {
events.push(`${label}:intercept`); throw interceptError; }, } : {}) pattern with
...ifDefined(doesIntercept, { async intercept(): Promise<InterceptResult |
undefined> { events.push(`${label}:intercept`); throw interceptError; } }); keep
the same intercept function, doesIntercept flag, interceptError, events and
label identifiers unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In
`@packages/1-framework/1-core/framework-components/test/run-with-middleware.intercept.test.ts`:
- Around line 580-587: Replace the inline conditional object spread inside the
mw(...) call with the ifDefined helper: import ifDefined from
'@prisma-next/utils/defined' and replace the ...(doesIntercept ? { async
intercept(): Promise<InterceptResult | undefined> {
events.push(`${label}:intercept`); throw interceptError; }, } : {}) pattern with
...ifDefined(doesIntercept, { async intercept(): Promise<InterceptResult |
undefined> { events.push(`${label}:intercept`); throw interceptError; } }); keep
the same intercept function, doesIntercept flag, interceptError, events and
label identifiers unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: d57da623-bd3b-4867-96d1-4b39a8d007ed

📥 Commits

Reviewing files that changed from the base of the PR and between 2525dbe and 2218fae.

⛔ Files ignored due to path filters (2)

• projects/middleware-intercept-and-cache/plan.md is excluded by !projects/**
• projects/middleware-intercept-and-cache/spec.md is excluded by !projects/**

📒 Files selected for processing (26)

• packages/1-framework/0-foundation/utils/package.json
• packages/1-framework/0-foundation/utils/src/exports/hash-content.ts
• packages/1-framework/0-foundation/utils/src/hash-content.ts
• packages/1-framework/0-foundation/utils/test/hash-content.test.ts
• packages/1-framework/0-foundation/utils/tsdown.config.ts
• packages/1-framework/1-core/framework-components/src/runtime-middleware.ts
• packages/1-framework/1-core/framework-components/test/mock-family.test.ts
• packages/1-framework/1-core/framework-components/test/run-with-middleware.intercept.test.ts
• packages/1-framework/1-core/framework-components/test/run-with-middleware.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.types.test-d.ts
• packages/1-framework/1-core/framework-components/test/runtime-middleware.types.test-d.ts
• packages/2-mongo-family/7-runtime/src/content-hash.ts
• packages/2-mongo-family/7-runtime/src/mongo-runtime.ts
• packages/2-mongo-family/7-runtime/test/content-hash.test.ts
• packages/2-mongo-family/7-runtime/test/mongo-middleware.test.ts
• packages/2-mongo-family/7-runtime/test/mongo-runtime.types.test-d.ts
• packages/2-sql/5-runtime/src/content-hash.ts
• packages/2-sql/5-runtime/src/sql-runtime.ts
• packages/2-sql/5-runtime/test/before-compile-chain.test.ts
• packages/2-sql/5-runtime/test/budgets.test.ts
• packages/2-sql/5-runtime/test/content-hash.test.ts
• packages/2-sql/5-runtime/test/intercept-decoding.test.ts
• packages/2-sql/5-runtime/test/lints.test.ts
• packages/3-extensions/middleware-telemetry/test/telemetry-middleware.test.ts
• test/integration/test/cross-package/cross-family-middleware.test.ts

✅ Files skipped from review due to trivial changes (8)

• packages/1-framework/0-foundation/utils/tsdown.config.ts
• packages/2-sql/5-runtime/test/lints.test.ts
• packages/1-framework/0-foundation/utils/src/exports/hash-content.ts
• packages/1-framework/1-core/framework-components/test/run-with-middleware.test.ts
• packages/2-mongo-family/7-runtime/test/mongo-runtime.types.test-d.ts
• packages/2-sql/5-runtime/test/before-compile-chain.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.test.ts
• packages/1-framework/0-foundation/utils/test/hash-content.test.ts

🚧 Files skipped from review as they are similar to previous changes (9)

• packages/2-sql/5-runtime/src/sql-runtime.ts
• packages/1-framework/0-foundation/utils/src/hash-content.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.types.test-d.ts
• packages/2-mongo-family/7-runtime/test/mongo-middleware.test.ts
• packages/1-framework/0-foundation/utils/package.json
• packages/2-mongo-family/7-runtime/src/mongo-runtime.ts
• packages/2-sql/5-runtime/src/content-hash.ts
• test/integration/test/cross-package/cross-family-middleware.test.ts
• packages/2-sql/5-runtime/test/intercept-decoding.test.ts

[coderabbitai]

♻️ Duplicate comments (1)

packages/1-framework/0-foundation/utils/src/canonical-stringify.ts (1)

57-100: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Reject non-plain objects and symbol-keyed properties before hashing.

Object.keys() drops symbol fields, and the current fallback serializes Map, Set, boxed primitives, RegExp, and class instances as if they were plain objects. That can collapse distinct inputs onto the same content hash and break execution identity.

💡 Suggested hardening

 function write(value: unknown, seen: Set<object>): string {
@@
-    return writePlainObject(obj as Record<string, unknown>, seen);
+    if (!isPlainObject(obj)) {
+      throw new TypeError('canonicalStringify: unsupported object type');
+    }
+    return writePlainObject(obj, seen);
   } finally {
     seen.delete(obj);
   }
 }
+
+function isPlainObject(value: object): value is Record<string, unknown> {
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
 
 function writePlainObject(obj: Record<string, unknown>, seen: Set<object>): string {
+  if (Object.getOwnPropertySymbols(obj).length > 0) {
+    throw new TypeError('canonicalStringify: symbol-keyed properties are not supported');
+  }
   const keys = Object.keys(obj).sort();

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/1-framework/0-foundation/utils/src/canonical-stringify.ts` around
lines 57 - 100, Reject non-plain objects and symbol-keyed properties before
hashing by adding validation in the object path (the branch that currently does
"const obj = value as object" and the writePlainObject function). Specifically,
before calling writePlainObject or adding to seen, throw a TypeError if
Object.getOwnPropertySymbols(obj).length > 0, if Object.getPrototypeOf(obj) is
not Object.prototype or null (to reject class instances, Map, Set, RegExp, boxed
primitives, etc.), or if obj is a boxed primitive (obj instanceof
String/Number/Boolean) or any builtin container (Map/Set) — keep Date and
Uint8Array special-cases as they are. Implement these checks either immediately
after "const obj = value as object" or at the top of writePlainObject so callers
(write and writePlainObject) will reject unsafe objects instead of serializing
them as plain objects.

🧹 Nitpick comments (2)

packages/2-sql/5-runtime/test/intercept-decoding.test.ts (1)

208-223: ⚡ Quick win

Drive the intercept-decoding check through a query plan.

createJsonProjectionPlan() returns a pre-lowered SqlExecutionPlan, so this suite never exercises runBeforeCompile or the SQL lowering path. If the cache-interceptor behavior is meant to be validated end-to-end, please switch this helper to a SqlQueryPlan so the runtime still performs lowering before decoding.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/2-sql/5-runtime/test/intercept-decoding.test.ts` around lines 208 -
223, The test helper createJsonProjectionPlan currently returns a pre-lowered
SqlExecutionPlan which bypasses runBeforeCompile and the SQL lowering path;
change this helper to return a SqlQueryPlan (or construct the equivalent
query-plan object that the runtime expects) so the runtime will perform lowering
before decoding; update the helper's return type and construction to produce a
SqlQueryPlan (referencing createJsonProjectionPlan, SqlExecutionPlan ->
SqlQueryPlan, and ensuring runBeforeCompile is exercised) so the
cache-interceptor behavior is validated end-to-end.

packages/1-framework/1-core/framework-components/test/run-with-middleware.intercept.test.ts (1)

577-616: 💤 Low value

Replace the conditional spread in mw with ifDefined().

This is the one spot that diverges from the repo’s test-file convention and makes the helper harder to scan. As per coding guidelines, use ifDefined() from @prisma-next/utils/defined for conditional object spreads instead of inline conditional spread patterns.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@packages/1-framework/1-core/framework-components/test/run-with-middleware.intercept.test.ts`
around lines 577 - 616, The mw helper currently uses an inline conditional
spread to add the intercept method; replace that pattern by importing and using
ifDefined from '@prisma-next/utils/defined' to conditionally include the
intercept property on the returned object in mw(label: string, doesIntercept:
boolean): RuntimeMiddleware<MockExec>, e.g. compute the intercept object when
doesIntercept is true and wrap it with ifDefined(...) when building the returned
object so the shape matches other tests; ensure the ifDefined import is added
and that the returned object still exposes name, afterExecute and the optional
intercept (throwing interceptError) exactly as before so runWithMiddleware and
the test assertions remain unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@packages/1-framework/0-foundation/utils/src/canonical-stringify.ts`:
- Around line 57-100: Reject non-plain objects and symbol-keyed properties
before hashing by adding validation in the object path (the branch that
currently does "const obj = value as object" and the writePlainObject function).
Specifically, before calling writePlainObject or adding to seen, throw a
TypeError if Object.getOwnPropertySymbols(obj).length > 0, if
Object.getPrototypeOf(obj) is not Object.prototype or null (to reject class
instances, Map, Set, RegExp, boxed primitives, etc.), or if obj is a boxed
primitive (obj instanceof String/Number/Boolean) or any builtin container
(Map/Set) — keep Date and Uint8Array special-cases as they are. Implement these
checks either immediately after "const obj = value as object" or at the top of
writePlainObject so callers (write and writePlainObject) will reject unsafe
objects instead of serializing them as plain objects.

---

Nitpick comments:
In
`@packages/1-framework/1-core/framework-components/test/run-with-middleware.intercept.test.ts`:
- Around line 577-616: The mw helper currently uses an inline conditional spread
to add the intercept method; replace that pattern by importing and using
ifDefined from '@prisma-next/utils/defined' to conditionally include the
intercept property on the returned object in mw(label: string, doesIntercept:
boolean): RuntimeMiddleware<MockExec>, e.g. compute the intercept object when
doesIntercept is true and wrap it with ifDefined(...) when building the returned
object so the shape matches other tests; ensure the ifDefined import is added
and that the returned object still exposes name, afterExecute and the optional
intercept (throwing interceptError) exactly as before so runWithMiddleware and
the test assertions remain unchanged.

In `@packages/2-sql/5-runtime/test/intercept-decoding.test.ts`:
- Around line 208-223: The test helper createJsonProjectionPlan currently
returns a pre-lowered SqlExecutionPlan which bypasses runBeforeCompile and the
SQL lowering path; change this helper to return a SqlQueryPlan (or construct the
equivalent query-plan object that the runtime expects) so the runtime will
perform lowering before decoding; update the helper's return type and
construction to produce a SqlQueryPlan (referencing createJsonProjectionPlan,
SqlExecutionPlan -> SqlQueryPlan, and ensuring runBeforeCompile is exercised) so
the cache-interceptor behavior is validated end-to-end.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 14272dfc-1040-4e52-8002-82ec30d2a918

📥 Commits

Reviewing files that changed from the base of the PR and between 2218fae and c67c412.

⛔ Files ignored due to path filters (4)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• projects/middleware-intercept-and-cache/follow-ups.md is excluded by !projects/**
• projects/middleware-intercept-and-cache/plan.md is excluded by !projects/**
• projects/middleware-intercept-and-cache/spec.md is excluded by !projects/**

📒 Files selected for processing (33)

• packages/1-framework/0-foundation/utils/package.json
• packages/1-framework/0-foundation/utils/src/canonical-stringify.ts
• packages/1-framework/0-foundation/utils/src/exports/canonical-stringify.ts
• packages/1-framework/0-foundation/utils/src/exports/hash-content.ts
• packages/1-framework/0-foundation/utils/src/hash-content.ts
• packages/1-framework/0-foundation/utils/test/canonical-stringify.test.ts
• packages/1-framework/0-foundation/utils/test/hash-content.test.ts
• packages/1-framework/0-foundation/utils/tsdown.config.ts
• packages/1-framework/1-core/framework-components/src/exports/runtime.ts
• packages/1-framework/1-core/framework-components/src/run-with-middleware.ts
• packages/1-framework/1-core/framework-components/src/runtime-middleware.ts
• packages/1-framework/1-core/framework-components/test/mock-family.test.ts
• packages/1-framework/1-core/framework-components/test/run-with-middleware.intercept.test.ts
• packages/1-framework/1-core/framework-components/test/run-with-middleware.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.types.test-d.ts
• packages/1-framework/1-core/framework-components/test/runtime-middleware.types.test-d.ts
• packages/2-mongo-family/7-runtime/package.json
• packages/2-mongo-family/7-runtime/src/content-hash.ts
• packages/2-mongo-family/7-runtime/src/mongo-runtime.ts
• packages/2-mongo-family/7-runtime/test/content-hash.test.ts
• packages/2-mongo-family/7-runtime/test/mongo-middleware.test.ts
• packages/2-mongo-family/7-runtime/test/mongo-runtime.types.test-d.ts
• packages/2-sql/5-runtime/src/content-hash.ts
• packages/2-sql/5-runtime/src/sql-runtime.ts
• packages/2-sql/5-runtime/test/before-compile-chain.test.ts
• packages/2-sql/5-runtime/test/budgets.test.ts
• packages/2-sql/5-runtime/test/content-hash.test.ts
• packages/2-sql/5-runtime/test/intercept-decoding.test.ts
• packages/2-sql/5-runtime/test/lints.test.ts
• packages/3-extensions/middleware-telemetry/src/telemetry-middleware.ts
• packages/3-extensions/middleware-telemetry/test/telemetry-middleware.test.ts
• test/integration/test/cross-package/cross-family-middleware.test.ts

✅ Files skipped from review due to trivial changes (15)

• packages/2-mongo-family/7-runtime/package.json
• packages/2-mongo-family/7-runtime/test/mongo-runtime.types.test-d.ts
• packages/1-framework/0-foundation/utils/tsdown.config.ts
• packages/1-framework/0-foundation/utils/src/exports/hash-content.ts
• packages/1-framework/1-core/framework-components/src/exports/runtime.ts
• packages/2-mongo-family/7-runtime/test/mongo-middleware.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.types.test-d.ts
• packages/1-framework/0-foundation/utils/package.json
• packages/1-framework/0-foundation/utils/src/exports/canonical-stringify.ts
• packages/2-sql/5-runtime/test/before-compile-chain.test.ts
• packages/1-framework/1-core/framework-components/test/mock-family.test.ts
• packages/1-framework/0-foundation/utils/test/hash-content.test.ts
• packages/1-framework/0-foundation/utils/test/canonical-stringify.test.ts
• packages/3-extensions/middleware-telemetry/src/telemetry-middleware.ts
• packages/1-framework/1-core/framework-components/test/runtime-middleware.types.test-d.ts

🚧 Files skipped from review as they are similar to previous changes (7)

• packages/2-sql/5-runtime/test/lints.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.test.ts
• packages/2-mongo-family/7-runtime/src/content-hash.ts
• packages/2-mongo-family/7-runtime/src/mongo-runtime.ts
• packages/2-sql/5-runtime/src/content-hash.ts
• packages/2-mongo-family/7-runtime/test/content-hash.test.ts
• packages/2-sql/5-runtime/test/content-hash.test.ts

[coderabbitai]

🧹 Nitpick comments (1)

packages/2-sql/5-runtime/src/sql-runtime.ts (1)

164-164: Avoid blind-casting exec in contentHash (line 164).

The cast as SqlExecutionPlan doesn't verify that exec actually contains the required sql and params properties. Add a shape guard to ensure only properly lowered plans reach computeSqlContentHash().

Suggested change

-      contentHash: (exec) => computeSqlContentHash(exec as SqlExecutionPlan),
+      contentHash: (exec) => {
+        if (!('sql' in exec) || !('params' in exec)) {
+          throw runtimeError(
+            'RUNTIME.INVALID_PLAN',
+            'contentHash requires a lowered SQL execution plan',
+          );
+        }
+        return computeSqlContentHash(exec as SqlExecutionPlan);
+      },

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/2-sql/5-runtime/src/sql-runtime.ts` at line 164, The contentHash
callback blindly casts exec to SqlExecutionPlan before calling
computeSqlContentHash; add a shape/type guard that verifies exec has the
required properties (e.g., sql and params) and that they are the expected types
before invoking computeSqlContentHash, and handle non-matching shapes (return
undefined/null or skip hashing) so only valid lowered plans reach
computeSqlContentHash; update the contentHash implementation to perform this
runtime check referencing contentHash, computeSqlContentHash, SqlExecutionPlan
and exec.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@packages/2-sql/5-runtime/src/sql-runtime.ts`:
- Line 164: The contentHash callback blindly casts exec to SqlExecutionPlan
before calling computeSqlContentHash; add a shape/type guard that verifies exec
has the required properties (e.g., sql and params) and that they are the
expected types before invoking computeSqlContentHash, and handle non-matching
shapes (return undefined/null or skip hashing) so only valid lowered plans reach
computeSqlContentHash; update the contentHash implementation to perform this
runtime check referencing contentHash, computeSqlContentHash, SqlExecutionPlan
and exec.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: b3df5951-1c22-496f-911f-5a0a9ebed2af

📥 Commits

Reviewing files that changed from the base of the PR and between c67c412 and 9f41286.

⛔ Files ignored due to path filters (3)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• projects/middleware-intercept-and-cache/plan.md is excluded by !projects/**
• projects/middleware-intercept-and-cache/spec.md is excluded by !projects/**

📒 Files selected for processing (34)

• docs/architecture docs/subsystems/4. Runtime & Middleware Framework.md
• packages/1-framework/0-foundation/utils/package.json
• packages/1-framework/0-foundation/utils/src/canonical-stringify.ts
• packages/1-framework/0-foundation/utils/src/exports/canonical-stringify.ts
• packages/1-framework/0-foundation/utils/src/exports/hash-content.ts
• packages/1-framework/0-foundation/utils/src/hash-content.ts
• packages/1-framework/0-foundation/utils/test/canonical-stringify.test.ts
• packages/1-framework/0-foundation/utils/test/hash-content.test.ts
• packages/1-framework/0-foundation/utils/tsdown.config.ts
• packages/1-framework/1-core/framework-components/src/exports/runtime.ts
• packages/1-framework/1-core/framework-components/src/run-with-middleware.ts
• packages/1-framework/1-core/framework-components/src/runtime-middleware.ts
• packages/1-framework/1-core/framework-components/test/mock-family.test.ts
• packages/1-framework/1-core/framework-components/test/run-with-middleware.intercept.test.ts
• packages/1-framework/1-core/framework-components/test/run-with-middleware.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.types.test-d.ts
• packages/1-framework/1-core/framework-components/test/runtime-middleware.types.test-d.ts
• packages/2-mongo-family/7-runtime/package.json
• packages/2-mongo-family/7-runtime/src/content-hash.ts
• packages/2-mongo-family/7-runtime/src/mongo-runtime.ts
• packages/2-mongo-family/7-runtime/test/content-hash.test.ts
• packages/2-mongo-family/7-runtime/test/mongo-middleware.test.ts
• packages/2-mongo-family/7-runtime/test/mongo-runtime.types.test-d.ts
• packages/2-sql/5-runtime/src/content-hash.ts
• packages/2-sql/5-runtime/src/sql-runtime.ts
• packages/2-sql/5-runtime/test/before-compile-chain.test.ts
• packages/2-sql/5-runtime/test/budgets.test.ts
• packages/2-sql/5-runtime/test/content-hash.test.ts
• packages/2-sql/5-runtime/test/intercept-decoding.test.ts
• packages/2-sql/5-runtime/test/lints.test.ts
• packages/3-extensions/middleware-telemetry/src/telemetry-middleware.ts
• packages/3-extensions/middleware-telemetry/test/telemetry-middleware.test.ts
• test/integration/test/cross-package/cross-family-middleware.test.ts

✅ Files skipped from review due to trivial changes (11)

• packages/2-sql/5-runtime/test/before-compile-chain.test.ts
• packages/2-mongo-family/7-runtime/package.json
• packages/1-framework/0-foundation/utils/src/exports/hash-content.ts
• packages/1-framework/0-foundation/utils/src/exports/canonical-stringify.ts
• packages/1-framework/0-foundation/utils/tsdown.config.ts
• packages/2-mongo-family/7-runtime/src/content-hash.ts
• packages/1-framework/0-foundation/utils/package.json
• packages/1-framework/1-core/framework-components/test/runtime-core.types.test-d.ts
• packages/2-sql/5-runtime/test/lints.test.ts
• packages/1-framework/1-core/framework-components/src/runtime-middleware.ts
• packages/1-framework/0-foundation/utils/test/hash-content.test.ts

🚧 Files skipped from review as they are similar to previous changes (10)

• packages/2-mongo-family/7-runtime/test/mongo-runtime.types.test-d.ts
• packages/3-extensions/middleware-telemetry/src/telemetry-middleware.ts
• packages/1-framework/1-core/framework-components/src/exports/runtime.ts
• packages/1-framework/0-foundation/utils/src/hash-content.ts
• packages/3-extensions/middleware-telemetry/test/telemetry-middleware.test.ts
• packages/2-sql/5-runtime/src/content-hash.ts
• packages/2-mongo-family/7-runtime/src/mongo-runtime.ts
• packages/1-framework/1-core/framework-components/test/mock-family.test.ts
• packages/1-framework/1-core/framework-components/test/runtime-core.test.ts
• packages/1-framework/1-core/framework-components/src/run-with-middleware.ts