Mle 29889 param binding accept cts query

.npmrc

@@ -1 +1,6 @@
 engine-strict=true
+registry=https://pkg.harness.io/pkg/ct8onj8YTdaXtKaFsYCRLg/org-marklogic-npm/npm/
+@jsr:registry=https://pkg.harness.io/pkg/ct8onj8YTdaXtKaFsYCRLg/org-marklogic-npm/npm/
+ignore-scripts=true
+# cooldown in days (14 days)
+min-release-age=14

Jenkinsfile

@@ -55,7 +55,7 @@ def runAuditReport() {
 		cd node-client-api
 		npm ci
 		rm -rf $WORKSPACE/npm-audit-report.json || true
-		npm audit --audit-level=moderate --json > $WORKSPACE/npm-audit-report.json
+		npm audit --audit-level=moderate --json > $WORKSPACE/npm-audit-report.json || true
 	'''
 }
 
@@ -125,7 +125,7 @@ pipeline {
   agent none
 
   triggers {
-    parameterizedCron(env.BRANCH_NAME == "develop" ? "00 02 * * * % regressions=true" : "")
+    parameterizedCron(env.BRANCH_NAME == "develop" ? "00 05 * * * % regressions=true" : "")
   }
 
   parameters {
@@ -151,6 +151,7 @@ pipeline {
     stage('pull-request-tests') {
       agent { label 'nodeclientpool' }
       steps {
+        // npm audit is non-blocking; Harness Artifact Repository does not currently support it so failures are ignored.
         runAuditReport()
         runLint()
         runTypeCheck()

etc/test-setup-users.js

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 */
 var valcheck = require('core-util-is');
 
@@ -68,6 +68,16 @@ function setupUsers(manager, done) {
             'privilege-name': 'xdmp-get-session-field',
             action: 'http://marklogic.com/xdmp/privileges/xdmp-get-session-field',
             kind: 'execute'
+          },
+          {
+            'privilege-name': 'xdmp-lock-acquire',
+            action: 'http://marklogic.com/xdmp/privileges/xdmp-lock-acquire',
+            kind: 'execute'
+          },
+          {
+            'privilege-name': 'xdmp-lock-release',
+            action: 'http://marklogic.com/xdmp/privileges/xdmp-lock-release',
+            kind: 'execute'
           }
         ]
       }

lib/plan-builder-base.js

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 */
 'use strict';
 
@@ -58,8 +58,18 @@ function castArg(arg, funcName, paramName, argPos, paramTypes) {
     } else if (arg instanceof Number || arg instanceof Boolean || arg instanceof String) {
       arg = arg.valueOf();
     } else if (arg instanceof types.ServerType) {
+      // We added new VecVector ServerType which is not a sub-type of Item. This makes it a one-off type
+      // as paramTypes will not include VecVector in any other type checks.
+      // And if we get here the arg must be and only be a VecVector (arg._ns === 'vec') or we throw an Error      
       if(arg._ns === 'vec'){
-        return arg._args;
+        return arg;
+      }
+      // cts.param() is a valid placeholder wherever a cts.query is accepted (e.g. as a direct
+      // sub-query argument to cts.orQuery, cts.andQuery, cts.notQuery, etc.). A global bypass
+      // here avoids updating every composite CTS function paramdef. Serialisation already works:
+      // exportObject converts _ns/_fn/_args -> ns/fn/args.
+      if (arg._ns === 'cts' && arg._fn === 'param') {
+        return arg;
       }
       throw new Error(
         `${argLabel(funcName, paramName, argPos)} must have type ${typeLabel(paramTypes)}`
@@ -133,6 +143,13 @@ function castArg(arg, funcName, paramName, argPos, paramTypes) {
             throw new Error(
                 'bm25LengthWeight must be a number'
             );
+          case 'fragment':
+            if (['document', 'properties', 'locks', 'any'].includes(value)) {
+              return true;
+            }
+            throw new Error(
+                `${argLabel(funcName, paramName, argPos)} fragment can only be 'document', 'properties', 'locks', or 'any'`
+            );
           default:
             return false;
         }});
@@ -401,6 +418,26 @@ function castArg(arg, funcName, paramName, argPos, paramTypes) {
             });
           }
           return true;
+        case 'PlanTransitiveClosureOptions':
+          const planTransitiveClosureOptionsSet = new Set(['minLength', 'min-length', 'maxLength', 'max-length']);
+          if(Object.getPrototypeOf(arg) === Map.prototype){
+            arg.forEach((value, key) => {
+              if(!planTransitiveClosureOptionsSet.has(key)) {
+                throw new Error(
+                    `${argLabel(funcName, paramName, argPos)} has invalid key- ${key}`
+                );
+              }
+            });
+          } else if (typeof arg === 'object') {
+            Object.keys(arg).forEach(key => {
+              if(!planTransitiveClosureOptionsSet.has(key)) {
+                throw new Error(
+                    `${argLabel(funcName, paramName, argPos)} has invalid key- ${key}`
+                );
+              }
+            });
+          }
+          return true;
       default:
         return false;
       }