feat(compiler): implement @oneOf input objects

[abernix]

Summary

Implements the @oneOf input objects directive, which became part of the stable GraphQL spec in September 2025. @oneOf lets a schema author say "exactly one of these fields must be provided" — it's a discriminated-union pattern that the type system enforces rather than leaving to resolver logic.

Closes #882.

How it works — three validation layers

The interesting design question is when each constraint should fire. We ended up with three complementary layers:

1. Schema validation (validation/input_object.rs) — when a developer writes a @oneOf type, every field must already be nullable and carry no default. These aren't runtime concerns; they're structural invariants the schema has to uphold before any query is written.

2. Static document validation (validation/value.rs) — when a query is compiled, a variable used to satisfy a @oneOf field must itself be declared non-null. A nullable variable is unsafe because it could legally be omitted at runtime, which would make the field-count invariant impossible to enforce without executing the query. This is the rule that most other implementations miss or leave to runtime. We validated against Apollo Kotlin, Hot Chocolate, Strawberry, graphql-java, and juniper — our static check is stricter than juniper and graphql-java, but strictly correct per spec.

3. Runtime coercion (request/coerce_variable_values) — when variables arrive at execution time, exactly one field must be provided and it must be non-null. This is the canonical spec rule and the last line of defense for literal values or dynamic inputs the static analysis can't see.

What's new in the public API

• directive @oneOf on INPUT_OBJECT is now a built-in.
• InputObjectType::is_one_of() -> bool — clean check without digging into directives.
• __Type.isOneOf: Boolean! in the introspection schema — returns true for @oneOf types, null for everything else (matching the spec's introspection definition).
• Five new diagnostic variants covering both schema- and document-level violations.

Fuzz coverage

Two complementary fuzz targets:

• one_of — structure-aware, using apollo-smith. We extended smith so it generates @oneOf input types naturally (with all invariants pre-satisfied at generation time), which means the fuzzer spends its budget on schema shape diversity rather than discarding malformed SDL. Asserts that is_one_of() always agrees with directive presence, and all field invariants hold.

• one_of_exec — the schema-invariant target can't reach document-level rules, because valid schema SDL and valid executable SDL are different constraint domains. This second target fixes a rich @oneOf schema and fuzzes only the executable document. It confirmed coverage of all five @oneOf-specific code paths in both validation/value.rs and coerce_variable_values.

Version

apollo-compiler bumps to 1.32.0 — minor because is_one_of() and the introspection field are new public API. apollo-smith bumps to 0.15.3 — minor because Ty::as_nullable() is new public API.

Notes

The production federation path (Rover + JS composition) preserves @oneOf through the supergraph correctly. Rust in-process composition currently strips all directives from input types during merge — that's a separate pre-existing gap and is tracked as a follow-up, not a blocker for this PR.

[martinbonnin]

One comment from graphql/graphql-spec#1211 but looks good otherwise!

Nice test suite!

[martinbonnin]

This will need to implement graphql/graphql-spec#1211 for schemas like this:

type Query {
  foo(arg: A): Int
}

input A @oneOf {
  # oh no, we can't create an instance of A
  a: A
}