@apso/cli 0.43.4 → 0.45.0

package/dist/lib/types/auth.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isApiKeyAuth = exports.isJwtAuth = exports.isDbSessionAuth = exports.API_KEY_AUTH_DEFAULTS = exports.JWT_AUTH_DEFAULTS = exports.DB_SESSION_AUTH_DEFAULTS = void 0;
+exports.resolveApiKeyAuth = exports.resolveJwtAuth = exports.isApiKeyAuth = exports.isJwtAuth = exports.isDbSessionAuth = exports.API_KEY_AUTH_DEFAULTS = exports.JWT_AUTH_DEFAULTS = exports.DB_SESSION_AUTH_DEFAULTS = void 0;
 /**
  * Default values for DB session auth configuration
  */
@@ -28,6 +28,7 @@ exports.JWT_AUTH_DEFAULTS = {
 exports.API_KEY_AUTH_DEFAULTS = {
     apiKeyHeader: "x-api-key",
     apiKeyEntity: "ApiKey",
+    keyField: "keyHash",
 };
 /**
  * Type guard: Check if auth config is DB session based
@@ -46,7 +47,8 @@ exports.isDbSessionAuth = isDbSessionAuth;
 function isJwtAuth(auth) {
     return (auth.provider === "auth0" ||
         auth.provider === "clerk" ||
-        auth.provider === "cognito");
+        auth.provider === "cognito" ||
+        auth.provider === "jwt");
 }
 exports.isJwtAuth = isJwtAuth;
 /**
@@ -58,3 +60,60 @@ function isApiKeyAuth(auth) {
     return auth.provider === "api-key";
 }
 exports.isApiKeyAuth = isApiKeyAuth;
+/**
+ * Claim defaults per provider. Clerk's v2 session token nests the active
+ * organization under `o`; Cognito puts group membership in `cognito:groups`.
+ */
+const PROVIDER_CLAIMS = {
+    auth0: { userId: "sub", email: "email" },
+    clerk: { userId: "sub", email: "email", workspaceId: "o.id", roles: "o.rol" },
+    cognito: { userId: "sub", email: "email", roles: "cognito:groups" },
+    jwt: { userId: "sub", email: "email", roles: "roles" },
+};
+const ALLOWED_ALGORITHMS = new Set([
+    "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384",
+    "EdDSA",
+]);
+/**
+ * Fill JWT defaults and reject configs that would generate an unsafe check.
+ * Only asymmetric algorithms are accepted: the key comes from the issuer's
+ * JWKS, so there is no shared secret to configure or leak.
+ */
+function resolveJwtAuth(auth) {
+    var _a, _b, _c, _d, _e, _f;
+    const issuer = (_b = (_a = auth.jwt) === null || _a === void 0 ? void 0 : _a.issuer) === null || _b === void 0 ? void 0 : _b.trim();
+    if (!issuer)
+        throw new Error(`auth.jwt.issuer is required for the "${auth.provider}" provider`);
+    const algorithms = ((_c = auth.jwt.algorithms) === null || _c === void 0 ? void 0 : _c.length)
+        ? auth.jwt.algorithms
+        : ["RS256"];
+    const bad = algorithms.filter((a) => !ALLOWED_ALGORITHMS.has(a));
+    if (bad.length > 0)
+        throw new Error(`auth.jwt.algorithms: ${bad.join(", ")} not supported; use ${[
+            ...ALLOWED_ALGORITHMS,
+        ].join(", ")}`);
+    const claims = { ...PROVIDER_CLAIMS[auth.provider], ...auth.claims };
+    return {
+        provider: auth.provider,
+        issuer,
+        audience: ((_d = auth.jwt.audience) === null || _d === void 0 ? void 0 : _d.trim()) || undefined,
+        jwksUri: ((_e = auth.jwt.jwksUri) === null || _e === void 0 ? void 0 : _e.trim()) ||
+            `${issuer.replace(/\/+$/, "")}/.well-known/jwks.json`,
+        algorithms,
+        authorizedParties: (_f = auth.jwt.authorizedParties) !== null && _f !== void 0 ? _f : [],
+        claims: { ...claims, userId: claims.userId || "sub" },
+    };
+}
+exports.resolveJwtAuth = resolveJwtAuth;
+/** Fill API key defaults. */
+function resolveApiKeyAuth(auth) {
+    return {
+        provider: "api-key",
+        apiKeyHeader: (auth.apiKeyHeader || exports.API_KEY_AUTH_DEFAULTS.apiKeyHeader).toLowerCase(),
+        apiKeyEntity: auth.apiKeyEntity || exports.API_KEY_AUTH_DEFAULTS.apiKeyEntity,
+        keyField: auth.keyField || exports.API_KEY_AUTH_DEFAULTS.keyField,
+        workspaceField: auth.workspaceField || "organizationId",
+        roleField: auth.roleField,
+    };
+}
+exports.resolveApiKeyAuth = resolveApiKeyAuth;

package/dist/lib/types/generator.d.ts

@@ -153,6 +153,11 @@ export interface ControllerGenerationOptions extends EntityGenerationOptions {
      * Relationship map for join queries
      */
     relationshipMap: RelationshipMap;
+    /**
+     * The .apsorc auth config; with scopeBy it limits every query to the
+     * caller's tenant
+     */
+    auth?: AuthConfig;
 }
 /**
  * Options for generating services
@@ -247,6 +252,7 @@ export interface LanguageGenerator {
     generateIndexModule(entities: Entity[], apiType: string, opts?: {
         emitEvents?: boolean;
         http?: boolean;
+        auth?: AuthConfig;
     }): Promise<GeneratedFile[]>;
     /**
      * Generate guard files (auth, scope, etc.)

package/dist/lib/types/index.d.ts

@@ -3,5 +3,5 @@ export { FieldType, Field, ComputedField } from "./field";
 export { Index } from "./indices";
 export { JSONValue } from "./json";
 export { RelationshipType, Association, ApsorcRelationship, Relationship, RelationshipForTemplate, RelationshipMap, } from "./relationship";
-export { AuthProviderType, BaseAuthConfig, DbSessionAuthConfig, JwtConfig, JwtClaimsMapping, JwtAuthConfig, ApiKeyAuthConfig, AuthConfig, AuthContext, DB_SESSION_AUTH_DEFAULTS, JWT_AUTH_DEFAULTS, API_KEY_AUTH_DEFAULTS, isDbSessionAuth, isJwtAuth, isApiKeyAuth, } from "./auth";
+export { AuthProviderType, BaseAuthConfig, DbSessionAuthConfig, JwtConfig, JwtClaimsMapping, JwtAuthConfig, ApiKeyAuthConfig, AuthConfig, AuthContext, DB_SESSION_AUTH_DEFAULTS, JWT_AUTH_DEFAULTS, API_KEY_AUTH_DEFAULTS, isDbSessionAuth, isJwtAuth, isApiKeyAuth, ResolvedJwtAuth, ResolvedApiKeyAuth, resolveJwtAuth, resolveApiKeyAuth, } from "./auth";
 export { TargetLanguage, GeneratedFile, ValidationResult, PythonLanguageConfig, GoLanguageConfig, TypeScriptLanguageConfig, LanguageConfig, GeneratorConfig, EntityGenerationOptions, ControllerGenerationOptions, ServiceGenerationOptions, DtoGenerationOptions, MigrationGenerationOptions, LanguageGenerator, GeneratorFactory, GeneratorRegistry, } from "./generator";

package/dist/lib/types/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isApiKeyAuth = exports.isJwtAuth = exports.isDbSessionAuth = exports.API_KEY_AUTH_DEFAULTS = exports.JWT_AUTH_DEFAULTS = exports.DB_SESSION_AUTH_DEFAULTS = void 0;
+exports.resolveApiKeyAuth = exports.resolveJwtAuth = exports.isApiKeyAuth = exports.isJwtAuth = exports.isDbSessionAuth = exports.API_KEY_AUTH_DEFAULTS = exports.JWT_AUTH_DEFAULTS = exports.DB_SESSION_AUTH_DEFAULTS = void 0;
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "DB_SESSION_AUTH_DEFAULTS", { enumerable: true, get: function () { return auth_1.DB_SESSION_AUTH_DEFAULTS; } });
 Object.defineProperty(exports, "JWT_AUTH_DEFAULTS", { enumerable: true, get: function () { return auth_1.JWT_AUTH_DEFAULTS; } });
@@ -8,3 +8,5 @@ Object.defineProperty(exports, "API_KEY_AUTH_DEFAULTS", { enumerable: true, get:
 Object.defineProperty(exports, "isDbSessionAuth", { enumerable: true, get: function () { return auth_1.isDbSessionAuth; } });
 Object.defineProperty(exports, "isJwtAuth", { enumerable: true, get: function () { return auth_1.isJwtAuth; } });
 Object.defineProperty(exports, "isApiKeyAuth", { enumerable: true, get: function () { return auth_1.isApiKeyAuth; } });
+Object.defineProperty(exports, "resolveJwtAuth", { enumerable: true, get: function () { return auth_1.resolveJwtAuth; } });
+Object.defineProperty(exports, "resolveApiKeyAuth", { enumerable: true, get: function () { return auth_1.resolveApiKeyAuth; } });

package/dist/lib/utils/crud-deps.d.ts

@@ -24,3 +24,16 @@ export declare function ensureCrudDeps(projectDir: string): string[];
  * @returns {string[]} Names added (empty when nothing changed or no package.json).
  */
 export declare function addMissingDeps(projectDir: string, deps: Record<string, string>): string[];
+/** JWT verification library the generated TypeScript JWT guard imports. */
+export declare const JOSE_DEP: Record<string, string>;
+/** JWT verification library the generated Python auth module imports. */
+export declare const PYJWT_DEP = "PyJWT[crypto]>=2.8.0";
+/**
+ * Add a requirement to pyproject.toml's [project] dependencies list unless a
+ * requirement for the same package is already there.
+ *
+ * @param {string} projectDir - Directory holding pyproject.toml.
+ * @param {string} requirement - A PEP 508 requirement, e.g. "PyJWT[crypto]>=2.8.0".
+ * @returns {boolean} True when pyproject.toml was changed.
+ */
+export declare function addMissingPythonDep(projectDir: string, requirement: string): boolean;

package/dist/lib/utils/crud-deps.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.addMissingDeps = exports.ensureCrudDeps = exports.APSO_CRUD_DEPS = void 0;
+exports.addMissingPythonDep = exports.PYJWT_DEP = exports.JOSE_DEP = exports.addMissingDeps = exports.ensureCrudDeps = exports.APSO_CRUD_DEPS = void 0;
 const tslib_1 = require("tslib");
 const fs = tslib_1.__importStar(require("fs"));
 const path = tslib_1.__importStar(require("path"));
@@ -56,3 +56,39 @@ function addMissingDeps(projectDir, deps) {
     return missing;
 }
 exports.addMissingDeps = addMissingDeps;
+/** JWT verification library the generated TypeScript JWT guard imports. */
+exports.JOSE_DEP = { jose: "^5.10.0" };
+/** JWT verification library the generated Python auth module imports. */
+exports.PYJWT_DEP = "PyJWT[crypto]>=2.8.0";
+/**
+ * Add a requirement to pyproject.toml's [project] dependencies list unless a
+ * requirement for the same package is already there.
+ *
+ * @param {string} projectDir - Directory holding pyproject.toml.
+ * @param {string} requirement - A PEP 508 requirement, e.g. "PyJWT[crypto]>=2.8.0".
+ * @returns {boolean} True when pyproject.toml was changed.
+ */
+function addMissingPythonDep(projectDir, requirement) {
+    var _a;
+    const file = path.join(projectDir, "pyproject.toml");
+    if (!fs.existsSync(file))
+        return false;
+    const text = fs.readFileSync(file, "utf8");
+    const name = requirement.split(/[ !<=>[~]/)[0].toLowerCase();
+    // The list's closing bracket sits on its own line, or ends a one-line list;
+    // brackets inside requirements ("uvicorn[standard]") are not the end.
+    const list = (_a = /^dependencies\s*=\s*\[(.*)][^\S\n]*$/m.exec(text)) !== null && _a !== void 0 ? _a : /^dependencies\s*=\s*\[([\S\s]*?)^]/m.exec(text);
+    if (!list)
+        return false;
+    const declared = [...list[1].matchAll(/["']([^"']+)["']/g)].map((m) => m[1].split(/[ !<=>[~]/)[0].toLowerCase());
+    if (declared.includes(name))
+        return false;
+    const body = list[1].replace(/\s*$/, "");
+    const sep = body.trim() === "" || body.trim().endsWith(",") ? "" : ",";
+    const updated = text.slice(0, list.index) +
+        `dependencies = [${body}${sep}\n    "${requirement}",\n]` +
+        text.slice(list.index + list[0].length);
+    fs.writeFileSync(file, updated);
+    return true;
+}
+exports.addMissingPythonDep = addMissingPythonDep;

package/dist/lib/verify/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * Pre-deploy checks for a generated service: generate the migration from the
- * deployed schema, run it and check for drift (TypeScript only, on PGlite),
- * and smoke test the endpoints. The CLI and the in-browser editor (which runs
+ * deployed schema, run it and check for drift (on PGlite), and smoke test the
+ * endpoints. The CLI and the in-browser editor (which runs
  * the CLI in a WebContainer) share these steps.
  */
 /// <reference types="node" />
@@ -16,6 +16,7 @@
 import { Entity } from "../types/entity";
 import { TargetLanguage } from "../types/generator";
 import { RelationshipMap } from "../types/relationship";
+import { Finding } from "./review";
 export interface Step {
     name: string;
     ok: boolean;
@@ -33,30 +34,46 @@ export declare const pgliteEnv: (dataDir: string) => NodeJS.ProcessEnv;
  * it, and schema:sync.
  */
 export declare function buildBaseline(projectDir: string, baselineApsorc: string, dataDir: string, cliBin: string): Promise<Step>;
-/**
- * Why `apso migrate` can't run for this project's language, or undefined.
- * ponytail: Python (Alembic) and Go (goose) have no local scratch database to
- * build the baseline on; add when they get one like PGlite for TypeScript.
- */
-export declare const migrateUnsupported: (language?: TargetLanguage) => string | undefined;
 export interface GenerateResult {
     ok: boolean;
     needed: boolean;
     file?: string;
     steps: Step[];
+    /** Statements in the generated migration that lose data or fail on rows. */
+    findings?: Finding[];
 }
 /** Generate a migration from the deployed schema (baselineApsorc) to the project's entities. */
 export declare function generateMigration(projectDir: string, baselineApsorc: string, name: string, cliBin: string): Promise<GenerateResult>;
 export interface CheckResult {
     ok: boolean;
     steps: Step[];
+    findings?: Finding[];
 }
+type Counts = Record<string, {
+    rows: number;
+    values: Record<string, number>;
+    distinct?: Record<string, string[]>;
+}>;
+/**
+ * Rows and values present before the migration and missing after it,
+ * following the tables and columns the migration renames. A column or table
+ * whose values all turn up in another column after the migration was moved,
+ * not lost (a field moved to a new table, a foreign key moved to a join table).
+ */
+export declare function dataLoss(before: Counts, after: Counts, source: string): string[];
+/** Losses the user accepted by name: a table, or table.column. */
+export declare const unaccepted: (lost: string[], accept: string[]) => string[];
 export declare function supportsPglite(projectDir: string): boolean;
 /**
  * Run a migration on a fresh copy of the deployed schema, then check that the
  * database matches the project's entities (a second generate finds nothing).
  */
-export declare function verifyMigration(projectDir: string, baselineApsorc: string, migrationFile: string, cliBin: string, skipBuild?: boolean): Promise<CheckResult>;
+export declare function verifyMigration(projectDir: string, baselineApsorc: string, migrationFile: string, cliBin: string, { skipBuild, seedFile, checkFile, acceptLoss, }?: {
+    skipBuild?: boolean;
+    seedFile?: string;
+    checkFile?: string;
+    acceptLoss?: string[];
+}): Promise<CheckResult>;
 /** The route each language's generated controller serves an entity on. */
 export declare const entityRoute: (language: TargetLanguage, name: string) => string;
 export interface SmokeOptions {
@@ -77,3 +94,4 @@ export declare function readDotEnv(projectDir: string): Record<string, string>;
 export declare const cliBinPath: (root: string) => string;
 /** Print a check's steps (or JSON) through the command's logger. */
 export declare function report(log: (s: string) => void, result: CheckResult, json: boolean, summary?: string): void;
+export {};

package/dist/lib/verify/index.js

@@ -1,12 +1,12 @@
 "use strict";
 /**
  * Pre-deploy checks for a generated service: generate the migration from the
- * deployed schema, run it and check for drift (TypeScript only, on PGlite),
- * and smoke test the endpoints. The CLI and the in-browser editor (which runs
+ * deployed schema, run it and check for drift (on PGlite), and smoke test the
+ * endpoints. The CLI and the in-browser editor (which runs
  * the CLI in a WebContainer) share these steps.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.report = exports.cliBinPath = exports.readDotEnv = exports.smokeTest = exports.entityRoute = exports.verifyMigration = exports.supportsPglite = exports.generateMigration = exports.migrateUnsupported = exports.buildBaseline = exports.pgliteEnv = exports.run = void 0;
+exports.report = exports.cliBinPath = exports.readDotEnv = exports.smokeTest = exports.entityRoute = exports.verifyMigration = exports.supportsPglite = exports.unaccepted = exports.dataLoss = exports.generateMigration = exports.buildBaseline = exports.pgliteEnv = exports.run = void 0;
 const tslib_1 = require("tslib");
 const child_process_1 = require("child_process");
 const fs = tslib_1.__importStar(require("fs"));
@@ -15,8 +15,13 @@ const net = tslib_1.__importStar(require("net"));
 const os = tslib_1.__importStar(require("os"));
 const path = tslib_1.__importStar(require("path"));
 const pluralize_1 = tslib_1.__importDefault(require("pluralize"));
+const apsorc_parser_1 = require("../apsorc-parser");
+const ddl_1 = require("../ddl");
+const catalog_1 = require("../ddl/catalog");
+const migration_file_1 = require("../ddl/migration-file");
 const casing_1 = require("../utils/casing");
 const crud_plan_1 = require("./crud-plan");
+const review_1 = require("./review");
 // eslint-disable-next-line no-control-regex
 const plain = (s) => s.replace(/\u001B\[[\d;]*m/g, "");
 const tail = (s, n = 4000) => {
@@ -85,19 +90,6 @@ async function buildBaseline(projectDir, baselineApsorc, dataDir, cliBin) {
     }
 }
 exports.buildBaseline = buildBaseline;
-/**
- * Why `apso migrate` can't run for this project's language, or undefined.
- * ponytail: Python (Alembic) and Go (goose) have no local scratch database to
- * build the baseline on; add when they get one like PGlite for TypeScript.
- */
-const migrateUnsupported = (language = "typescript") => {
-    if (language === "python")
-        return "apso migrate supports TypeScript services only for now. This is a Python service: use Alembic directly (alembic revision --autogenerate, alembic upgrade head, alembic check).";
-    if (language === "go")
-        return "apso migrate supports TypeScript services only for now. This is a Go service: write goose migrations in migrations/ and run them with `go run cmd/migrate/main.go up`.";
-    return undefined;
-};
-exports.migrateUnsupported = migrateUnsupported;
 /** Generate a migration from the deployed schema (baselineApsorc) to the project's entities. */
 async function generateMigration(projectDir, baselineApsorc, name, cliBin) {
     const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "apso-pglite-"));
@@ -129,6 +121,9 @@ async function generateMigration(projectDir, baselineApsorc, name, cliBin) {
             needed: true,
             file: file && path.join("src", "migrations", file),
             steps,
+            findings: file
+                ? (0, review_1.reviewMigration)(fs.readFileSync(path.join(migrationsDir, file), "utf8"))
+                : undefined,
         };
     }
     finally {
@@ -148,6 +143,96 @@ ds.initialize()
   .then((ran) => { console.log("ran " + ran.map((m) => m.name).join(", ")); return ds.destroy(); })
   .catch((e) => { console.error(e && e.message ? e.message : e); process.exit(1); });
 `;
+// Row and non-null value counts per table and column of the PGlite database
+// at PGLITE_DATA_DIR, after running the SQL file in argv[1] if given, plus each
+// column's distinct values (as text) so data moved to another table is found.
+const COUNT_ROWS = `
+const fs = require("fs");
+const { PGlite } = require("@electric-sql/pglite");
+(async () => {
+  const db = new PGlite(process.env.PGLITE_DATA_DIR);
+  if (process.argv[1]) await db.exec(fs.readFileSync(process.argv[1], "utf8"));
+  const cols = (await db.query("SELECT table_name, column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name <> 'migrations'")).rows;
+  const out = {};
+  for (const { table_name: t, column_name: c } of cols) {
+    const q = '"' + c + '"';
+    const r = (await db.query("SELECT count(*)::int AS rows, count(" + q + ")::int AS vals, (SELECT array_agg(v) FROM (SELECT DISTINCT " + q + "::text AS v FROM \\"" + t + "\\" WHERE " + q + " IS NOT NULL LIMIT 1000) d) AS dv FROM \\"" + t + "\\"")).rows[0];
+    out[t] = out[t] || { rows: r.rows, values: {}, distinct: {} };
+    out[t].values[c] = r.vals;
+    out[t].distinct[c] = r.dv || [];
+  }
+  console.log(JSON.stringify(out));
+  await db.close();
+})().catch((e) => { console.error(e.message); process.exit(1); });
+`;
+// Assertions the user wrote for this migration: each SELECT returns rows with a
+// boolean "ok" and a "label", the same format as the eval checks.
+const RUN_CHECKS = `
+const fs = require("fs");
+const { PGlite } = require("@electric-sql/pglite");
+(async () => {
+  const db = new PGlite(process.env.PGLITE_DATA_DIR);
+  const failed = [];
+  for (const r of await db.exec(fs.readFileSync(process.argv[1], "utf8")))
+    for (const row of r.rows) if ("ok" in row && row.ok !== true) failed.push(row.label || JSON.stringify(row));
+  await db.close();
+  if (failed.length) { console.error("Failed checks:\\n" + failed.join("\\n")); process.exit(1); }
+})().catch((e) => { console.error(e.message); process.exit(1); });
+`;
+// Filled in by the database on insert, so a moved row gets new ones.
+const GENERATED = new Set(["created_at", "updated_at"]);
+/**
+ * Rows and values present before the migration and missing after it,
+ * following the tables and columns the migration renames. A column or table
+ * whose values all turn up in another column after the migration was moved,
+ * not lost (a field moved to a new table, a foreign key moved to a join table).
+ */
+function dataLoss(before, after, source) {
+    var _a, _b, _c, _d;
+    const tables = new Map([...source.matchAll(/ALTER TABLE "([^"]+)" RENAME TO "([^"]+)"/g)].map((m) => [m[1], m[2]]));
+    const columns = new Map([...source.matchAll(/ALTER TABLE "([^"]+)" RENAME COLUMN "([^"]+)" TO "([^"]+)"/g)].map((m) => [`${m[1]}.${m[2]}`, m[3]]));
+    // Only tables the migration creates count, and not their ids: small integer
+    // values (foreign keys) would otherwise match any existing id column.
+    const afterValues = Object.entries(after)
+        .filter(([t]) => !before[t] && ![...tables.values()].includes(t))
+        .flatMap(([, a]) => {
+        var _a;
+        return Object.entries((_a = a.distinct) !== null && _a !== void 0 ? _a : {})
+            .filter(([c]) => c !== "id")
+            .map(([, v]) => new Set(v));
+    });
+    const moved = (t, c) => {
+        var _a, _b;
+        const vals = (_b = (_a = before[t].distinct) === null || _a === void 0 ? void 0 : _a[c]) !== null && _b !== void 0 ? _b : [];
+        return vals.length > 0 && afterValues.some((s) => vals.every((v) => s.has(v)));
+    };
+    const lost = [];
+    for (const [t, { rows, values }] of Object.entries(before)) {
+        if (!rows)
+            continue;
+        const t2 = (_a = tables.get(t)) !== null && _a !== void 0 ? _a : t;
+        const now = after[t2];
+        if (!now) {
+            const gone = Object.keys(values).filter((c) => values[c] > 0 && !GENERATED.has(c) && !moved(t, c));
+            if (gone.length > 0)
+                lost.push(`table ${t}: all ${rows} rows`);
+            continue;
+        }
+        if (now.rows < rows)
+            lost.push(`table ${t}: ${rows - now.rows} of ${rows} rows`);
+        for (const [c, n] of Object.entries(values)) {
+            const c2 = (_c = (_b = columns.get(`${t}.${c}`)) !== null && _b !== void 0 ? _b : columns.get(`${t2}.${c}`)) !== null && _c !== void 0 ? _c : c;
+            const kept = (_d = now.values[c2]) !== null && _d !== void 0 ? _d : 0;
+            if (n > kept && !(kept === 0 && moved(t, c)))
+                lost.push(`${t}.${c}: ${n - kept} of ${n} values`);
+        }
+    }
+    return lost;
+}
+exports.dataLoss = dataLoss;
+/** Losses the user accepted by name: a table, or table.column. */
+const unaccepted = (lost, accept) => lost.filter((l) => !accept.some((a) => l.startsWith(`${a}:`) || l.startsWith(`table ${a}:`)));
+exports.unaccepted = unaccepted;
 /**
  * Projects from the v1 template have no PGlite support in src/orm.config.ts,
  * so the checks cannot run locally. They pass as skipped rather than block a
@@ -176,9 +261,17 @@ exports.supportsPglite = supportsPglite;
  * Run a migration on a fresh copy of the deployed schema, then check that the
  * database matches the project's entities (a second generate finds nothing).
  */
-async function verifyMigration(projectDir, baselineApsorc, migrationFile, cliBin, skipBuild = false) {
+async function verifyMigration(projectDir, baselineApsorc, migrationFile, cliBin, { skipBuild = false, seedFile, checkFile, acceptLoss = [], } = {}) {
+    if (/\.(py|sql)$/.test(migrationFile))
+        return verifySqlMigration(projectDir, baselineApsorc, migrationFile, cliBin, {
+            seedFile,
+            checkFile,
+            acceptLoss,
+        });
     if (!supportsPglite(projectDir))
         return NO_PGLITE;
+    const source = fs.readFileSync(path.resolve(projectDir, migrationFile), "utf8");
+    const findings = (0, review_1.reviewMigration)(source);
     const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "apso-pglite-"));
     const steps = [];
     const done = (s) => {
@@ -187,25 +280,157 @@ async function verifyMigration(projectDir, baselineApsorc, migrationFile, cliBin
     };
     try {
         if (!done(await buildBaseline(projectDir, baselineApsorc, dataDir, cliBin)))
-            return { ok: false, steps };
+            return { ok: false, steps, findings };
+        const count = async (name, sql) => {
+            const r = await run(process.execPath, ["-e", COUNT_ROWS, ...(sql ? [sql] : [])], projectDir, (0, exports.pgliteEnv)(dataDir));
+            done(step(name, r));
+            return r.ok ? JSON.parse(r.output.trim().split("\n").pop()) : undefined;
+        };
+        // Seed rows make the migration face the data it will meet in production.
+        const before = seedFile ? await count("seed", path.resolve(seedFile)) : undefined;
+        if (seedFile && !before)
+            return { ok: false, steps, findings };
         const compiled = path
             .join("dist", path.relative("src", migrationFile))
             .replace(/\.ts$/, ".js");
         // --skip-build still builds when the migration isn't compiled yet.
         const needsBuild = !skipBuild || !fs.existsSync(path.join(projectDir, compiled));
         if (needsBuild && !done(step("build", await build(projectDir))))
-            return { ok: false, steps };
+            return { ok: false, steps, findings };
         const migrate = await run(process.execPath, ["-e", RUN_ONE_MIGRATION, compiled], projectDir, (0, exports.pgliteEnv)(dataDir));
         if (!done({ ...step("migrate", migrate), output: tail(migrate.output) }))
-            return { ok: false, steps };
+            return { ok: false, steps, findings };
+        if (before) {
+            const after = await count("count");
+            if (!after)
+                return { ok: false, steps, findings };
+            const lost = dataLoss(before, after, source);
+            const ok = (0, exports.unaccepted)(lost, acceptLoss).length === 0;
+            done({
+                name: "data",
+                ok,
+                output: lost.length > 0
+                    ? `The migration lost seeded data:\n${lost.join("\n")}${ok ? "" : "\nFix the migration. If data moved somewhere the check can't follow (e.g. a field split in two), prove it with --check and rerun with --accept-loss <table.column>."}`
+                    : undefined,
+            });
+            if (!ok)
+                return { ok: false, steps, findings };
+        }
+        if (checkFile &&
+            !done(step("check", await run(process.execPath, ["-e", RUN_CHECKS, path.resolve(checkFile)], projectDir, (0, exports.pgliteEnv)(dataDir)))))
+            return { ok: false, steps, findings };
         const drift = await typeorm(projectDir, ["migration:generate", "./src/migrations/drift", "--check"], (0, exports.pgliteEnv)(dataDir));
-        return { ok: done(step("drift", drift)), steps };
+        return { ok: done(step("drift", drift)), steps, findings };
     }
     finally {
         fs.rmSync(dataDir, { recursive: true, force: true });
     }
 }
 exports.verifyMigration = verifyMigration;
+const ddlOf = (apsorcFile) => (0, ddl_1.schemaDdl)((0, apsorc_parser_1.parseApsorcV2)(JSON.parse(fs.readFileSync(apsorcFile).toString()))).join(";\n");
+/**
+ * verifyMigration for an Alembic or goose migration. Python and Go services
+ * have no TypeORM, so Apso's DDL writer builds the deployed schema, the
+ * migration's SQL runs as written, and drift is a catalog diff against a
+ * fresh build of the new .apsorc. down then runs and must give back the
+ * deployed schema.
+ */
+async function verifySqlMigration(projectDir, baselineApsorc, migrationFile, cliBin, { seedFile, checkFile, acceptLoss = [] }) {
+    const { PGlite } = await Promise.resolve().then(() => tslib_1.__importStar(require("@electric-sql/pglite")));
+    const steps = [];
+    const done = (s) => {
+        steps.push(s);
+        return s.ok;
+    };
+    let sql;
+    try {
+        sql = (0, migration_file_1.migrationSql)(migrationFile, fs.readFileSync(path.resolve(projectDir, migrationFile), "utf8"));
+    }
+    catch (error) {
+        done({ name: "read", ok: false, output: error.message });
+        return { ok: false, steps };
+    }
+    const findings = (0, review_1.reviewMigration)((0, migration_file_1.typeormMigration)("Migration", [sql.up], { down: [] }));
+    const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "apso-pglite-"));
+    // The CLI's own PGlite: the project has no node_modules to load one from.
+    const cliRoot = path.dirname(path.dirname(cliBin));
+    const script = (name, code, arg) => run(process.execPath, ["-e", code, ...(arg ? [path.resolve(arg)] : [])], cliRoot, (0, exports.pgliteEnv)(dataDir)).then((r) => {
+        done(step(name, r));
+        return r;
+    });
+    const exec = async (name, statements) => {
+        const db = new PGlite(dataDir);
+        try {
+            await db.exec(statements);
+            return done({ name, ok: true });
+        }
+        catch (error) {
+            return done({ name, ok: false, output: error.message });
+        }
+        finally {
+            await db.close();
+        }
+    };
+    const drift = async (name, apsorcFile) => {
+        const db = new PGlite(dataDir);
+        const fresh = new PGlite();
+        try {
+            await fresh.exec(ddlOf(apsorcFile));
+            const diff = (0, catalog_1.catalogDiff)(await (0, catalog_1.readCatalog)(fresh), await (0, catalog_1.readCatalog)(db));
+            return done({
+                name,
+                ok: diff.length === 0,
+                output: diff.length > 0 ? `The database differs from ${path.basename(apsorcFile)} (- missing, + extra):\n${diff.join("\n")}` : undefined,
+            });
+        }
+        finally {
+            await db.close();
+            await fresh.close();
+        }
+    };
+    try {
+        if (!(await exec("baseline", ddlOf(baselineApsorc))))
+            return { ok: false, steps, findings };
+        const count = async (name, file) => {
+            const r = await script(name, COUNT_ROWS, file);
+            return r.ok ? JSON.parse(r.output.trim().split("\n").pop()) : undefined;
+        };
+        const before = seedFile ? await count("seed", seedFile) : undefined;
+        if (seedFile && !before)
+            return { ok: false, steps, findings };
+        if (!(await exec("migrate", sql.up)))
+            return { ok: false, steps, findings };
+        if (before) {
+            const after = await count("count");
+            if (!after)
+                return { ok: false, steps, findings };
+            const lost = dataLoss(before, after, sql.up);
+            const ok = (0, exports.unaccepted)(lost, acceptLoss).length === 0;
+            done({
+                name: "data",
+                ok,
+                output: lost.length > 0
+                    ? `The migration lost seeded data:\n${lost.join("\n")}${ok ? "" : "\nFix the migration. If data moved somewhere the check can't follow (e.g. a field split in two), prove it with --check and rerun with --accept-loss <table.column>."}`
+                    : undefined,
+            });
+            if (!ok)
+                return { ok: false, steps, findings };
+        }
+        const checked = checkFile ? await script("check", RUN_CHECKS, checkFile) : undefined;
+        if (checked && !checked.ok)
+            return { ok: false, steps, findings };
+        if (!(await drift("drift", path.join(projectDir, ".apsorc"))))
+            return { ok: false, steps, findings };
+        if (sql.down === undefined)
+            done({ name: "down", ok: true, output: "down refuses to run (irreversible), so it was not tested." });
+        else if (!(await exec("down", sql.down)) || !(await drift("down drift", baselineApsorc)))
+            return { ok: false, steps, findings };
+        return { ok: true, steps, findings };
+    }
+    finally {
+        fs.rmSync(dataDir, { recursive: true, force: true });
+    }
+}
 const freePort = () => new Promise((resolve, reject) => {
     const s = net.createServer();
     s.listen(0, () => {
@@ -492,6 +717,7 @@ const cliBinPath = (root) => path.join(root, "bin", "run");
 exports.cliBinPath = cliBinPath;
 /** Print a check's steps (or JSON) through the command's logger. */
 function report(log, result, json, summary) {
+    var _a;
     if (json) {
         log(JSON.stringify(result));
         return;
@@ -501,6 +727,8 @@ function report(log, result, json, summary) {
         if (s.output)
             log(s.output.replace(/^/gm, "     "));
     }
+    for (const f of (_a = result.findings) !== null && _a !== void 0 ? _a : [])
+        log(`WARN ${f.code}: ${f.message}`);
     if (summary)
         log(summary);
 }

package/dist/lib/verify/review.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Review a TypeORM-generated migration for statements that lose data or fail
+ * on a populated database. TypeORM changes a column type by DROP + ADD, casts
+ * enums without remapping removed values, and adds NOT NULL columns as if the
+ * table were empty. The generated file is kept; each finding names a
+ * statement to rewrite.
+ */
+export interface Finding {
+    code: string;
+    table: string;
+    column?: string;
+    message: string;
+}
+export declare function reviewMigration(source: string): Finding[];