@coldge.com/gitbase 1.0.2 → 1.0.3

package/dist/schema/extractor.js

@@ -1,24 +1,41 @@
 import { runQuery } from '../api/supabase.js';
 import * as Queries from './queries.js';
 export async function extractSchema(projectRef) {
-    const tables = await extractTables(projectRef);
-    const functions = await extractFunctions(projectRef);
-    const views = await extractViews(projectRef);
-    const triggers = await extractTriggers(projectRef);
-    const policies = await extractPolicies(projectRef);
-    const types = await extractTypes(projectRef);
-    return { tables, functions, views, triggers, policies, types };
+    // All extractors run in parallel for maximum performance
+    const [extensions, types, sequences, tables, matviews, views, functions, triggers, policies, grants, publications] = await Promise.all([
+        extractExtensions(projectRef),
+        extractTypes(projectRef),
+        extractSequences(projectRef),
+        extractTables(projectRef),
+        extractMaterializedViews(projectRef),
+        extractViews(projectRef),
+        extractFunctions(projectRef),
+        extractTriggers(projectRef),
+        extractPolicies(projectRef),
+        extractGrants(projectRef),
+        extractPublications(projectRef),
+    ]);
+    return {
+        extensions, types, sequences, tables, matviews,
+        views, functions, triggers, policies, grants, publications
+    };
 }
 async function extractTables(projectRef) {
     const tableList = await runQuery(projectRef, Queries.LIST_TABLES);
     if (!Array.isArray(tableList))
         return {};
     const tables = {};
-    for (const row of tableList) {
+    // Process all tables concurrently instead of sequentially
+    await Promise.all(tableList.map(async (row) => {
         const tableName = row.table_name;
         const rlsEnabled = row.rls_enabled;
-        const columns = await runQuery(projectRef, Queries.GET_COLUMNS(tableName));
-        let sql = `CREATE TABLE public."${tableName}" (\n`;
+        // Fetch columns, constraints, and indexes in parallel per table
+        const [columns, constraints, indexes] = await Promise.all([
+            runQuery(projectRef, Queries.GET_COLUMNS(tableName)),
+            runQuery(projectRef, Queries.GET_TABLE_CONSTRAINTS(tableName)),
+            runQuery(projectRef, Queries.GET_TABLE_INDEXES(tableName)),
+        ]);
+        // Column definitions
         const colDefs = columns.map(c => {
             let line = `    "${c.column_name}" ${c.data_type}`;
             if (c.is_nullable === 'NO')
@@ -27,13 +44,23 @@ async function extractTables(projectRef) {
                 line += ` DEFAULT ${c.column_default}`;
             return line;
         });
-        sql += colDefs.join(',\n');
+        // Constraint definitions (PK, FK, UNIQUE, CHECK)
+        const constraintDefs = constraints.map(c => {
+            return `    CONSTRAINT "${c.name}" ${c.definition}`;
+        });
+        const allDefs = [...colDefs, ...constraintDefs];
+        let sql = `CREATE TABLE public."${tableName}" (\n`;
+        sql += allDefs.join(',\n');
         sql += '\n);';
+        // Standalone index statements (non-primary, appended after CREATE TABLE)
+        for (const idx of indexes) {
+            sql += `\n${idx.definition};`;
+        }
         if (rlsEnabled) {
             sql += `\nALTER TABLE public."${tableName}" ENABLE ROW LEVEL SECURITY;`;
         }
         tables[tableName] = sql;
-    }
+    }));
     return tables;
 }
 async function extractFunctions(projectRef) {
@@ -56,6 +83,16 @@ async function extractViews(projectRef) {
     }
     return result;
 }
+async function extractMaterializedViews(projectRef) {
+    const matviews = await runQuery(projectRef, Queries.LIST_MAT_VIEWS);
+    if (!Array.isArray(matviews))
+        return {};
+    const result = {};
+    for (const v of matviews) {
+        result[v.name] = `CREATE MATERIALIZED VIEW public."${v.name}" AS\n${v.definition}`;
+    }
+    return result;
+}
 async function extractTriggers(projectRef) {
     const triggers = await runQuery(projectRef, Queries.LIST_TRIGGERS);
     if (!Array.isArray(triggers))
@@ -73,7 +110,6 @@ async function extractPolicies(projectRef) {
     const result = {};
     for (const p of policies) {
         let sql = `CREATE POLICY "${p.name}"\nON public."${p.tablename}"\nFOR ${p.cmd}`;
-        // Handle roles
         let roles = p.roles;
         if (Array.isArray(roles)) {
             roles = roles.join(', ');
@@ -81,9 +117,8 @@ async function extractPolicies(projectRef) {
         else if (typeof roles === 'string' && roles.startsWith('{')) {
             roles = roles.replace(/^\{|\}$/g, '').split(',').join(', ');
         }
-        if (roles) {
+        if (roles)
             sql += `\nTO ${roles}`;
-        }
         if (p.qual)
             sql += `\nUSING (${p.qual})`;
         if (p.with_check)
@@ -94,20 +129,142 @@ async function extractPolicies(projectRef) {
     return result;
 }
 async function extractTypes(projectRef) {
-    const types = await runQuery(projectRef, Queries.LIST_TYPES);
-    if (!Array.isArray(types))
-        return {};
+    const [enums, composites, domains] = await Promise.all([
+        runQuery(projectRef, Queries.LIST_ENUM_TYPES),
+        runQuery(projectRef, Queries.LIST_COMPOSITE_TYPES),
+        runQuery(projectRef, Queries.LIST_DOMAIN_TYPES),
+    ]);
     const result = {};
-    // Group by type name since list returns rows of (name, label) for enums
-    const grouped = {};
-    for (const t of types) {
-        if (!grouped[t.name])
-            grouped[t.name] = [];
-        grouped[t.name].push(t.label);
-    }
-    for (const [name, labels] of Object.entries(grouped)) {
+    // Enum types
+    const enumGrouped = {};
+    for (const t of enums) {
+        if (!enumGrouped[t.name])
+            enumGrouped[t.name] = [];
+        enumGrouped[t.name].push(t.label);
+    }
+    for (const [name, labels] of Object.entries(enumGrouped)) {
         const labelsStr = labels.map(l => `'${l}'`).join(', ');
         result[name] = `CREATE TYPE public."${name}" AS ENUM (${labelsStr});`;
     }
+    // Composite types
+    const compGrouped = {};
+    for (const c of composites) {
+        if (!compGrouped[c.name])
+            compGrouped[c.name] = [];
+        compGrouped[c.name].push({ col_name: c.col_name, col_type: c.col_type });
+    }
+    for (const [name, cols] of Object.entries(compGrouped)) {
+        const colDefs = cols.map(c => `    "${c.col_name}" ${c.col_type}`).join(',\n');
+        result[name] = `CREATE TYPE public."${name}" AS (\n${colDefs}\n);`;
+    }
+    // Domain types
+    for (const d of domains) {
+        let sql = `CREATE DOMAIN public."${d.name}" AS ${d.base_type}`;
+        if (d.default_val)
+            sql += `\n    DEFAULT ${d.default_val}`;
+        if (d.not_null)
+            sql += `\n    NOT NULL`;
+        if (d.check_expr)
+            sql += `\n    ${d.check_expr}`;
+        sql += ';';
+        result[d.name] = sql;
+    }
+    return result;
+}
+async function extractExtensions(projectRef) {
+    const exts = await runQuery(projectRef, Queries.LIST_EXTENSIONS);
+    if (!Array.isArray(exts))
+        return {};
+    const result = {};
+    for (const e of exts) {
+        // Always use IF NOT EXISTS so applying this snapshot is safe on any project
+        result[e.name] = `CREATE EXTENSION IF NOT EXISTS "${e.name}" WITH SCHEMA ${e.schema};`;
+    }
+    return result;
+}
+async function extractGrants(projectRef) {
+    const [tableGrants, functionGrants] = await Promise.all([
+        runQuery(projectRef, Queries.LIST_TABLE_GRANTS),
+        runQuery(projectRef, Queries.LIST_FUNCTION_GRANTS),
+    ]);
+    // Group table grants by table name
+    const tableMap = {};
+    for (const g of tableGrants) {
+        if (!tableMap[g.table_name])
+            tableMap[g.table_name] = [];
+        const grantOption = g.is_grantable === 'YES' ? ' WITH GRANT OPTION' : '';
+        tableMap[g.table_name].push(`GRANT ${g.privileges} ON TABLE public."${g.table_name}" TO ${g.grantee}${grantOption};`);
+    }
+    // Group function grants by function name
+    const funcMap = {};
+    for (const g of functionGrants) {
+        if (!funcMap[g.routine_name])
+            funcMap[g.routine_name] = [];
+        const grantOption = g.is_grantable === 'YES' ? ' WITH GRANT OPTION' : '';
+        funcMap[g.routine_name].push(`GRANT ${g.privileges} ON FUNCTION public."${g.routine_name}" TO ${g.grantee}${grantOption};`);
+    }
+    const result = {};
+    // One file per table: "grants/table__tablename"
+    for (const [tableName, stmts] of Object.entries(tableMap)) {
+        result[`table__${tableName}`] = stmts.join('\n');
+    }
+    // One file per function: "grants/function__funcname"
+    for (const [funcName, stmts] of Object.entries(funcMap)) {
+        result[`function__${funcName}`] = stmts.join('\n');
+    }
+    return result;
+}
+async function extractPublications(projectRef) {
+    const pubs = await runQuery(projectRef, Queries.LIST_PUBLICATIONS);
+    if (!Array.isArray(pubs))
+        return {};
+    const result = {};
+    for (const p of pubs) {
+        const ops = [];
+        if (p.pubinsert)
+            ops.push('insert');
+        if (p.pubupdate)
+            ops.push('update');
+        if (p.pubdelete)
+            ops.push('delete');
+        if (p.pubtruncate)
+            ops.push('truncate');
+        const withClause = ops.length > 0 ? ` WITH (publish = '${ops.join(', ')}')` : '';
+        let sql;
+        if (p.puballtables) {
+            sql = `CREATE PUBLICATION "${p.pubname}" FOR ALL TABLES${withClause};`;
+        }
+        else {
+            // Fetch the specific tables in this publication
+            const tables = await runQuery(projectRef, Queries.LIST_PUBLICATION_TABLES(p.pubname));
+            if (tables.length === 0) {
+                sql = `CREATE PUBLICATION "${p.pubname}"${withClause};`;
+            }
+            else {
+                const tableList = tables.map(t => `public."${t.table_name}"`).join(', ');
+                sql = `CREATE PUBLICATION "${p.pubname}" FOR TABLE ${tableList}${withClause};`;
+            }
+        }
+        result[p.pubname] = sql;
+    }
+    return result;
+}
+async function extractSequences(projectRef) {
+    const seqs = await runQuery(projectRef, Queries.LIST_SEQUENCES);
+    if (!Array.isArray(seqs))
+        return {};
+    const result = {};
+    for (const s of seqs) {
+        const cycle = s.cycle_option === 'YES' ? 'CYCLE' : 'NO CYCLE';
+        result[s.name] = [
+            `CREATE SEQUENCE IF NOT EXISTS public."${s.name}"`,
+            `    AS ${s.data_type}`,
+            `    START WITH ${s.start_value}`,
+            `    INCREMENT BY ${s.increment}`,
+            `    MINVALUE ${s.minimum_value}`,
+            `    MAXVALUE ${s.maximum_value}`,
+            `    ${cycle};`,
+        ].join('\n');
+    }
     return result;
 }

package/dist/schema/queries.js

@@ -1,17 +1,49 @@
+// All dynamic queries return { text, values } objects to prevent SQL injection.
+// Static queries (no user input) remain plain strings.
 export const LIST_TABLES = `
 SELECT c.relname as table_name, c.relrowsecurity as rls_enabled
 FROM pg_class c
 JOIN pg_namespace n ON n.oid = c.relnamespace
-WHERE n.nspname = 'public' 
+WHERE n.nspname = 'public'
 AND c.relkind = 'r'
 ORDER BY c.relname;
 `;
-export const GET_COLUMNS = (tableName) => `
-SELECT column_name, data_type, is_nullable, column_default
-FROM information_schema.columns
-WHERE table_schema = 'public' AND table_name = '${tableName}'
-ORDER BY ordinal_position;
-`;
+/** Parameterized — safe against SQL injection */
+export const GET_COLUMNS = (tableName) => ({
+    text: `
+        SELECT column_name, data_type, is_nullable, column_default
+        FROM information_schema.columns
+        WHERE table_schema = 'public' AND table_name = $1
+        ORDER BY ordinal_position
+    `,
+    values: [tableName]
+});
+/** All constraints (PK, FK, UNIQUE, CHECK) for a table — parameterized */
+export const GET_TABLE_CONSTRAINTS = (tableName) => ({
+    text: `
+        SELECT c.conname as name, pg_get_constraintdef(c.oid) as definition, c.contype
+        FROM pg_constraint c
+        JOIN pg_class t ON t.oid = c.conrelid
+        JOIN pg_namespace n ON n.oid = t.relnamespace
+        WHERE n.nspname = 'public' AND t.relname = $1
+        ORDER BY c.contype, c.conname
+    `,
+    values: [tableName]
+});
+/** Non-primary indexes for a table — parameterized */
+export const GET_TABLE_INDEXES = (tableName) => ({
+    text: `
+        SELECT pg_get_indexdef(i.indexrelid) as definition
+        FROM pg_index i
+        JOIN pg_class t ON t.oid = i.indrelid
+        JOIN pg_class ix ON ix.oid = i.indexrelid
+        JOIN pg_namespace n ON n.oid = t.relnamespace
+        WHERE n.nspname = 'public' AND t.relname = $1
+        AND NOT i.indisprimary
+        ORDER BY ix.relname
+    `,
+    values: [tableName]
+});
 export const LIST_FUNCTIONS = `
 SELECT proname as name, pg_get_functiondef(oid) as definition
 FROM pg_proc
@@ -24,6 +56,12 @@ FROM information_schema.views
 WHERE table_schema = 'public'
 ORDER BY table_name;
 `;
+export const LIST_MAT_VIEWS = `
+SELECT matviewname as name, pg_get_viewdef(matviewname::regclass) as definition
+FROM pg_matviews
+WHERE schemaname = 'public'
+ORDER BY matviewname;
+`;
 export const LIST_TRIGGERS = `
 SELECT tgname as name, pg_get_triggerdef(oid) as definition
 FROM pg_trigger
@@ -37,7 +75,8 @@ FROM pg_policies
 WHERE schemaname = 'public'
 ORDER BY tablename, policyname;
 `;
-export const LIST_TYPES = `
+/** Enum types only */
+export const LIST_ENUM_TYPES = `
 SELECT t.typname as name, e.enumlabel as label
 FROM pg_type t
 JOIN pg_enum e ON t.oid = e.enumtypid
@@ -45,3 +84,116 @@ JOIN pg_namespace n ON n.oid = t.typnamespace
 WHERE n.nspname = 'public'
 ORDER BY t.typname, e.enumsortorder;
 `;
+/** Composite types */
+export const LIST_COMPOSITE_TYPES = `
+SELECT t.typname as name, a.attname as col_name,
+       pg_catalog.format_type(a.atttypid, a.atttypmod) as col_type
+FROM pg_type t
+JOIN pg_class c ON c.oid = t.typrelid
+JOIN pg_attribute a ON a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped
+JOIN pg_namespace n ON n.oid = t.typnamespace
+WHERE n.nspname = 'public' AND t.typtype = 'c'
+ORDER BY t.typname, a.attnum;
+`;
+/** All sequences in the public schema */
+export const LIST_SEQUENCES = `
+SELECT sequence_name as name, data_type, start_value, minimum_value,
+       maximum_value, increment, cycle_option
+FROM information_schema.sequences
+WHERE sequence_schema = 'public'
+ORDER BY sequence_name;
+`;
+/**
+ * All installed extensions (excluding the always-present plpgsql).
+ * Applied with CREATE EXTENSION IF NOT EXISTS — never dropped during revert.
+ */
+export const LIST_EXTENSIONS = `
+SELECT e.extname as name, e.extversion as version,
+       n.nspname as schema
+FROM pg_extension e
+JOIN pg_namespace n ON n.oid = e.extnamespace
+WHERE e.extname != 'plpgsql'
+ORDER BY e.extname;
+`;
+/**
+ * All explicit grants on tables in the public schema.
+ * Excludes internal Supabase/Postgres system roles.
+ * Grouped so each row = one grantee + one table + all their privileges combined.
+ */
+export const LIST_TABLE_GRANTS = `
+SELECT
+    table_name,
+    grantee,
+    string_agg(privilege_type, ', ' ORDER BY privilege_type) as privileges,
+    is_grantable
+FROM information_schema.role_table_grants
+WHERE table_schema = 'public'
+  AND grantee NOT IN (
+      'postgres', 'supabase_admin', 'supabase_auth_admin',
+      'supabase_storage_admin', 'dashboard_user', 'pg_monitor',
+      'pg_read_all_data', 'pg_write_all_data'
+  )
+GROUP BY table_name, grantee, is_grantable
+ORDER BY table_name, grantee;
+`;
+/**
+ * All explicit grants on functions in the public schema.
+ */
+export const LIST_FUNCTION_GRANTS = `
+SELECT
+    routine_name,
+    grantee,
+    string_agg(privilege_type, ', ' ORDER BY privilege_type) as privileges,
+    is_grantable
+FROM information_schema.role_routine_grants
+WHERE routine_schema = 'public'
+  AND grantee NOT IN (
+      'postgres', 'supabase_admin', 'supabase_auth_admin',
+      'supabase_storage_admin', 'dashboard_user', 'pg_monitor',
+      'pg_read_all_data', 'pg_write_all_data'
+  )
+GROUP BY routine_name, grantee, is_grantable
+ORDER BY routine_name, grantee;
+`;
+/**
+ * All publications (used by Supabase Realtime).
+ */
+export const LIST_PUBLICATIONS = `
+SELECT
+    p.pubname as name,
+    p.puballtables,
+    p.pubinsert,
+    p.pubupdate,
+    p.pubdelete,
+    p.pubtruncate
+FROM pg_publication p
+ORDER BY p.pubname;
+`;
+/** Tables enrolled in a specific publication — parameterized */
+export const LIST_PUBLICATION_TABLES = (pubname) => ({
+    text: `
+        SELECT c.relname as table_name
+        FROM pg_publication p
+        JOIN pg_publication_rel pr ON pr.prpubid = p.oid
+        JOIN pg_class c ON c.oid = pr.prrelid
+        WHERE p.pubname = $1
+        ORDER BY c.relname
+    `,
+    values: [pubname]
+});
+/**
+ * Domain types in the public schema (CREATE DOMAIN ... AS base_type CHECK ...).
+ */
+export const LIST_DOMAIN_TYPES = `
+SELECT
+    t.typname as name,
+    pg_catalog.format_type(t.typbasetype, t.typtypmod) as base_type,
+    t.typnotnull as not_null,
+    t.typdefault as default_val,
+    pg_get_constraintdef(c.oid) as check_expr
+FROM pg_type t
+LEFT JOIN pg_constraint c ON c.contypid = t.oid AND c.contype = 'c'
+JOIN pg_namespace n ON n.oid = t.typnamespace
+WHERE n.nspname = 'public' AND t.typtype = 'd'
+ORDER BY t.typname;
+`;

package/dist/utils/hashing.js

@@ -1,9 +1,58 @@
 import crypto from 'crypto';
+import { parseSync, deparseSync } from 'pgsql-parser';
 export function hashString(content) {
     return crypto.createHash('sha1').update(content).digest('hex');
 }
+/**
+ * Canonicalizes a SQL string using the actual PostgreSQL parser (libpg_query via WASM).
+ *
+ * Strategy:
+ *   1. Strip SQL comments (they are semantically empty).
+ *   2. Parse the SQL into an AST via pgsql-parser (the real PG C parser).
+ *   3. Deparse the AST back to SQL — this produces a structurally normalized form.
+ *   4. Apply aggressive whitespace normalization post-deparse:
+ *        - Lowercase everything
+ *        - Collapse all whitespace runs to a single space
+ *        - Remove spaces adjacent to ( ) , ; = operators
+ *      This eliminates the residual whitespace variants that pgsql-parser's
+ *      deparser still allows through (e.g. "foo ( id" vs "foo(id").
+ *
+ * If the SQL is not a full parseable statement (e.g. a raw expression fragment
+ * stored in an old commit), the function falls back to best-effort text
+ * normalization and never throws.
+ */
 export function canonicalize(sql) {
-    // Basic normalization: trim
-    // In a real implementation, we would parse the SQL and reprint it deterministically.
-    return sql.trim();
+    if (!sql || sql.trim() === '')
+        return '';
+    // Strip comments first — they are semantically empty
+    const stripped = sql
+        .replace(/--[^\n]*/g, '') // single-line comments
+        .replace(/\/\*[\s\S]*?\*\//g, ''); // block comments
+    try {
+        const stmts = parseSync(stripped);
+        const deparsed = deparseSync(stmts);
+        return normalizeWhitespace(deparsed);
+    }
+    catch {
+        // Fallback for fragments / non-parseable SQL (e.g. raw expressions)
+        return normalizeWhitespace(stripped);
+    }
+}
+/**
+ * Applies deterministic whitespace normalization to a SQL string.
+ * After this step, two strings that are semantically identical will be equal
+ * regardless of original indentation, casing, or punctuation spacing.
+ */
+function normalizeWhitespace(sql) {
+    return sql
+        .toLowerCase()
+        .replace(/\s+/g, ' ') // collapse all whitespace
+        .replace(/\s*\(\s*/g, '(') // no spaces around open-paren
+        .replace(/\s*\)\s*/g, ')') // no spaces around close-paren
+        .replace(/\s*,\s*/g, ',') // no spaces around comma
+        .replace(/\s*;\s*/g, ';') // no spaces around semicolon
+        .replace(/\s*=\s*/g, '=') // no spaces around equals
+        .replace(/\(\s+/g, '(') // extra pass: leading space in parens
+        .replace(/\s+\)/g, ')') // extra pass: trailing space in parens
+        .trim();
 }