@drzl/cli 4.37.0 → 4.39.0

package/dist/cli.js

@@ -30,19 +30,20 @@ import {
   nestjsOutDir,
   nextOutDir,
   openApiFetchOutDir,
+  pothosOutDir,
   seedOutDir,
   tableAliases,
   tableFilterWarnings,
   tanstackStartOutDir,
   trpcOutDir,
   tsRestOutDir
-} from "./chunk-EQ4OSVMJ.js";
+} from "./chunk-VG6SD2GP.js";
 
 // src/cli.ts
 import { qualifiedTableName as qualifiedTableName2, SchemaAnalyzer as SchemaAnalyzer2 } from "@drzl/analyzer";
 import chokidar from "chokidar";
 import { Command } from "commander";
-import * as path7 from "path";
+import * as path8 from "path";
 
 // src/output.ts
 import { Chalk } from "chalk";
@@ -531,6 +532,17 @@ function fastCheckOptions(g, cfg) {
   };
 }
 
+// src/pothos-options.ts
+function pothosOptions(g, cfg) {
+  return {
+    outputDir: pothosOutDir(g, cfg),
+    naming: g.naming,
+    outputHeader: g.outputHeader,
+    format: g.format,
+    importExtension: g.importExtension
+  };
+}
+
 // src/h3-options.ts
 var VALIDATOR_DEFAULT_DIRS6 = {
   zod: "src/validators/zod",
@@ -893,6 +905,14 @@ var GENERATORS = [
     outputDir: (g, cfg) => fastCheckOutDir(g, cfg),
     options: (g, cfg) => fastCheckOptions(g, cfg)
   },
+  {
+    kind: "pothos",
+    specifier: "@drzl/generator-pothos",
+    load: () => import("@drzl/generator-pothos"),
+    construct: (m, analysis) => new m.PothosGenerator(analysis),
+    outputDir: (g, cfg) => pothosOutDir(g, cfg),
+    options: (g, cfg) => pothosOptions(g, cfg)
+  },
   {
     kind: "service",
     specifier: "@drzl/generator-service",
@@ -1136,14 +1156,109 @@ import { parseCheck as parseCheck2 } from "@drzl/validation-core";
 
 // src/doctor.ts
 import { lengthMeasure, parseCheck } from "@drzl/validation-core";
+
+// src/auth-tables.ts
+var SIGNATURES = [
+  {
+    model: "account",
+    // `providerId` beside `accountId` is the distinctive pair: it is a link to an external identity
+    // provider, which an application table has no reason to model this way.
+    required: ["accountId", "providerId", "userId"],
+    supporting: ["accessToken", "refreshToken", "idToken", "password", "scope"],
+    conventionalName: "account",
+    secrets: ["accessToken", "refreshToken", "idToken", "password"]
+  },
+  {
+    model: "session",
+    required: ["token", "expiresAt", "userId"],
+    supporting: ["ipAddress", "userAgent"],
+    conventionalName: "session",
+    // A session token is a bearer credential: whoever reads it is that user until it expires.
+    secrets: ["token"]
+  },
+  {
+    model: "verification",
+    // `identifier` and `value` are deliberately generic names, which is why `expiresAt` is required
+    // too: the three together are a short-lived token store and little else.
+    required: ["identifier", "value", "expiresAt"],
+    supporting: [],
+    conventionalName: "verification",
+    secrets: ["value"]
+  },
+  {
+    model: "user",
+    required: ["email", "emailVerified"],
+    supporting: ["name", "image"],
+    conventionalName: "user",
+    secrets: []
+  }
+];
+function columnKeys(table) {
+  const out = /* @__PURE__ */ new Map();
+  for (const c of table.columns) out.set(normalise(c.name), c);
+  return out;
+}
+function normalise(name) {
+  return name.replace(/[_-]/g, "").toLowerCase();
+}
+function has(keys, name) {
+  return keys.has(normalise(name));
+}
+function actualName(table, wanted) {
+  return table.columns.find((c) => normalise(c.name) === normalise(wanted))?.name;
+}
+function matchOne(table, sig) {
+  const keys = columnKeys(table);
+  const missing = sig.required.filter((r) => !has(keys, r));
+  if (missing.length) return void 0;
+  const supporting = sig.supporting.filter((s) => has(keys, s));
+  const nameMatches = normalise(table.name) === normalise(sig.conventionalName) || normalise(table.name) === `${normalise(sig.conventionalName)}s`;
+  const confidence = supporting.length > 0 || nameMatches ? "strong" : "likely";
+  const matched = [...sig.required, ...supporting].map((c) => actualName(table, c)).filter((c) => Boolean(c));
+  const secrets = sig.secrets.map((c) => actualName(table, c)).filter((c) => Boolean(c));
+  return { table: table.name, model: sig.model, confidence, matched, secrets };
+}
+function detectAuthTables(analysis) {
+  const found = [];
+  for (const table of analysis.tables) {
+    for (const sig of SIGNATURES) {
+      const m = matchOne(table, sig);
+      if (m) {
+        found.push(m);
+        break;
+      }
+    }
+  }
+  const hasNonUser = found.some((f) => f.model !== "user");
+  return hasNonUser ? found : found.filter((f) => f.model !== "user");
+}
+function authTablesWithSecrets(matches) {
+  return matches.filter((m) => m.secrets.length > 0);
+}
+function excludeSuggestion(matches) {
+  const names = [...new Set(matches.map((m) => m.table))].sort();
+  return `exclude: [${names.map((n) => `'${n}'`).join(", ")}]`;
+}
+function authTableWarnings(analysis) {
+  const risky = authTablesWithSecrets(detectAuthTables(analysis));
+  if (!risky.length) return [];
+  const lines = risky.map(
+    (m) => `"${m.table}" looks like an authentication library's ${m.model} table and holds ${m.secrets.map((c) => `"${c}"`).join(", ")}. Generating for it publishes ${m.secrets.length === 1 ? "that column" : "those columns"}.`
+  );
+  return [
+    `drzl generate: ${lines.join(" ")} Keep ${risky.length === 1 ? "it" : "them"} out with ${excludeSuggestion(risky)}, or leave it if the route is deliberate.`
+  ];
+}
+
+// src/doctor.ts
 import { Chalk as Chalk2 } from "chalk";
 var PLAIN = new Chalk2({ level: 0 });
 var HANDLED_CODES = /* @__PURE__ */ new Set(["DRZL_ANL_UNKNOWN_COLUMN"]);
-function splitPath(path8) {
-  if (!path8) return {};
-  const dot = path8.lastIndexOf(".");
-  if (dot <= 0) return { table: path8 };
-  return { table: path8.slice(0, dot), column: path8.slice(dot + 1) };
+function splitPath(path9) {
+  if (!path9) return {};
+  const dot = path9.lastIndexOf(".");
+  if (dot <= 0) return { table: path9 };
+  return { table: path9.slice(0, dot), column: path9.slice(dot + 1) };
 }
 function namedColumns(parsed) {
   const out = [];
@@ -1308,6 +1423,18 @@ function buildDoctorReport(analysis, schemaPath) {
       hint: i.hint
     });
   }
+  for (const match of detectAuthTables(analysis)) {
+    const secrets = match.secrets.length ? ` It holds ${match.secrets.map((c) => `\`${c}\``).join(", ")}, which a generated read route would return to whoever calls it.` : "";
+    findings.push({
+      kind: "auth-table",
+      // A warning rather than an error: this is a real leak and it is also a guess about someone
+      // else's schema, and a doctor that failed the build on a guess would be switched off.
+      level: "warn",
+      table: match.table,
+      message: `"${match.table}" matches the shape of an authentication library's ${match.model} table (${match.matched.join(", ")}).${secrets}`,
+      hint: `Keep it out of every generator with ${excludeSuggestion([match])}.`
+    });
+  }
   for (const i of analysis.issues) {
     if (i.code !== "DRZL_ANL_UNKNOWN_COLUMN") continue;
     findings.push({
@@ -1346,6 +1473,11 @@ var SECTIONS = [
     title: "Columns DRZL cannot type",
     why: "These get a validator that accepts any value."
   },
+  {
+    kinds: ["auth-table"],
+    title: "Tables that look like an authentication library's",
+    why: "Every generator loops over every table it finds, so these get routes too."
+  },
   {
     kinds: ["check-declined", "check-unknown-column", "check-not-scalar", "check-uncountable"],
     title: "CHECK constraints DRZL does not enforce",
@@ -1678,11 +1810,11 @@ function issueTouches(issue, table) {
   return dot > 0 && own.includes(issue.path.slice(0, dot));
 }
 function issueColumn(issue, table) {
-  const path8 = issue.path ?? "";
+  const path9 = issue.path ?? "";
   const names = namesOf(table);
   for (const prefix of [names.qualified, names.tsName, names.name, table.name]) {
-    if (path8.startsWith(`${prefix}.`)) {
-      const rest = path8.slice(prefix.length + 1);
+    if (path9.startsWith(`${prefix}.`)) {
+      const rest = path9.slice(prefix.length + 1);
       if (table.columns.some((c) => c.name === rest)) return rest;
     }
   }
@@ -2841,6 +2973,79 @@ function displayPath(file, cwd = process.cwd()) {
   return rel && !rel.startsWith("..") ? rel : file;
 }
 
+// src/manifest.ts
+import path4 from "path";
+import { promises as fs4 } from "fs";
+var MANIFEST_VERSION = 1;
+var MANIFEST_PATH = path4.join(".drzl", "manifest.json");
+function toPosix(p) {
+  return p.split(path4.sep).join("/");
+}
+function manifestEntries(files, root) {
+  const rel = files.map((f) => toPosix(path4.relative(root, f)));
+  return [...new Set(rel)].sort();
+}
+async function readManifest(root) {
+  try {
+    const raw = await fs4.readFile(path4.join(root, MANIFEST_PATH), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || parsed.version !== MANIFEST_VERSION || !Array.isArray(parsed.files) || !parsed.files.every((f) => typeof f === "string")) {
+      return void 0;
+    }
+    return { version: MANIFEST_VERSION, files: parsed.files };
+  } catch {
+    return void 0;
+  }
+}
+async function writeManifest(root, files) {
+  const manifest = { version: MANIFEST_VERSION, files: manifestEntries(files, root) };
+  const target = path4.join(root, MANIFEST_PATH);
+  await fs4.mkdir(path4.dirname(target), { recursive: true });
+  await fs4.writeFile(target, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+}
+async function staleFiles(previous, writtenNow, root) {
+  if (!previous) return [];
+  const current = new Set(manifestEntries(writtenNow, root));
+  const gone = previous.files.filter((f) => !current.has(f));
+  const out = [];
+  for (const file of gone) {
+    let present = true;
+    try {
+      await fs4.access(path4.join(root, file));
+    } catch {
+      present = false;
+    }
+    out.push({ file, present });
+  }
+  return out;
+}
+async function pruneStale(root, stale) {
+  const deleted = [];
+  for (const entry of stale) {
+    if (!entry.present) continue;
+    const target = path4.resolve(root, entry.file);
+    const inside = target === root || target.startsWith(root + path4.sep);
+    if (!inside) continue;
+    try {
+      await fs4.rm(target);
+      deleted.push(entry.file);
+    } catch {
+    }
+  }
+  return deleted;
+}
+function staleWarning(stale) {
+  const present = stale.filter((s) => s.present);
+  if (!present.length) return void 0;
+  const list = present.map((s) => s.file).join(", ");
+  return `drzl generate: ${present.length} file(s) written by a previous run were not written by this one, and are still on disk: ${list}. That usually means a table was renamed or removed. Delete them with \`drzl generate --prune\`, which removes only files a previous run recorded writing.`;
+}
+function nextManifestFiles(writtenNow, stale, root) {
+  const kept = stale.filter((s) => s.present).map((s) => path4.resolve(root, s.file));
+  return manifestEntries([...writtenNow, ...kept], root);
+}
+
 // src/unified-diff.ts
 var DEFAULT_DIFF_LIMITS = {
   maxLines: 4e3,
@@ -3083,8 +3288,8 @@ function createRebuildScheduler(options) {
 
 // src/init.ts
 import { SchemaAnalyzer } from "@drzl/analyzer";
-import * as fs4 from "fs";
-import * as path4 from "path";
+import * as fs5 from "fs";
+import * as path5 from "path";
 var INIT_GENERATOR_CHOICES = [
   { kind: "zod", packageName: "@drzl/generator-zod", label: "Zod validators" },
   { kind: "valibot", packageName: "@drzl/generator-valibot", label: "Valibot validators" },
@@ -3155,7 +3360,7 @@ async function detectSchema(cwd) {
     kitFiles = null;
   }
   if (kitFiles && kitPath) {
-    const rel = path4.relative(cwd, kitPath) || path4.basename(kitPath);
+    const rel = path5.relative(cwd, kitPath) || path5.basename(kitPath);
     const report = await classifySchemaCandidate(kitFiles);
     if (report.verdict === "confirmed" || report.verdict === "unverified") {
       notes.push(
@@ -3171,10 +3376,10 @@ async function detectSchema(cwd) {
     }
     notes.push(`${rel} names schema files that declare no Drizzle tables; looking elsewhere.`);
   }
-  const present = schemaCandidates().filter((c) => fs4.existsSync(path4.resolve(cwd, c)));
+  const present = schemaCandidates().filter((c) => fs5.existsSync(path5.resolve(cwd, c)));
   const unverified = [];
   for (const file of present) {
-    const report = await classifySchemaCandidate(path4.resolve(cwd, file));
+    const report = await classifySchemaCandidate(path5.resolve(cwd, file));
     if (report.verdict === "confirmed") {
       notes.push(
         `Schema found at ${file} (${report.tables} table${report.tables === 1 ? "" : "s"})`
@@ -3276,7 +3481,7 @@ async function promptForPlan(args) {
       if (answer === null) endedEarly = true;
       else if (answer.trim()) {
         const typed = answer.trim();
-        const report = await classifySchemaCandidate(path4.resolve(cwd, typed));
+        const report = await classifySchemaCandidate(path5.resolve(cwd, typed));
         if (report.verdict === "confirmed") {
           write(`  ${typed}: ${report.tables} table${report.tables === 1 ? "" : "s"}`);
         } else if (report.verdict === "unverified") {
@@ -3338,8 +3543,8 @@ function parseGeneratorsFlag(value) {
   return parts;
 }
 async function runInit(args) {
-  const target = path4.resolve(args.cwd, "drzl.config.ts");
-  const existing = CONFIG_FILE_NAMES.find((name) => fs4.existsSync(path4.resolve(args.cwd, name)));
+  const target = path5.resolve(args.cwd, "drzl.config.ts");
+  const existing = CONFIG_FILE_NAMES.find((name) => fs5.existsSync(path5.resolve(args.cwd, name)));
   if (existing) {
     args.error(
       `drzl init: ${existing} already exists, so nothing was written. Delete it, or edit it by hand; init never overwrites a config, and will not write one that shadows it either.`
@@ -3378,8 +3583,8 @@ async function runInit(args) {
       generators: fromFlag ?? [DEFAULT_GENERATOR_KIND]
     };
     if (args.schemaFlag) {
-      const full = path4.resolve(args.cwd, args.schemaFlag);
-      if (!fs4.existsSync(full)) {
+      const full = path5.resolve(args.cwd, args.schemaFlag);
+      if (!fs5.existsSync(full)) {
         args.log(`--schema ${args.schemaFlag} is not there yet. Writing it anyway.`);
       } else if ((await classifySchemaCandidate(full)).verdict === "rejected") {
         args.log(`--schema ${args.schemaFlag} declares no Drizzle tables. Writing it anyway.`);
@@ -3387,7 +3592,7 @@ async function runInit(args) {
     }
   }
   try {
-    fs4.writeFileSync(target, renderInitConfig(plan), { flag: "wx" });
+    fs5.writeFileSync(target, renderInitConfig(plan), { flag: "wx" });
   } catch (e) {
     if (e?.code === "EEXIST") {
       args.error(
@@ -3411,9 +3616,9 @@ async function runInit(args) {
 
 // src/sponsor.ts
 import { existsSync as existsSync3, mkdirSync, readFileSync, writeFileSync as writeFileSync2 } from "fs";
-import path5 from "path";
-var CACHE_DIR = path5.join(process.cwd(), "node_modules", ".cache", "@drzl");
-var CACHE_FILE = path5.join(CACHE_DIR, "sponsor-message.json");
+import path6 from "path";
+var CACHE_DIR = path6.join(process.cwd(), "node_modules", ".cache", "@drzl");
+var CACHE_FILE = path6.join(CACHE_DIR, "sponsor-message.json");
 var DEFAULT_INTERVAL_MS = 1e3 * 60 * 15;
 var shownThisProcess = false;
 var tips = [
@@ -3482,11 +3687,11 @@ function writeCache(payload) {
 
 // src/version.ts
 import { readFileSync as readFileSync2 } from "fs";
-import * as path6 from "path";
+import * as path7 from "path";
 import { fileURLToPath } from "url";
 var PACKAGE_NAME = "@drzl/cli";
 function moduleDir() {
-  return path6.dirname(fileURLToPath(import.meta.url));
+  return path7.dirname(fileURLToPath(import.meta.url));
 }
 function readVersionFrom(manifestPath) {
   let raw;
@@ -3509,7 +3714,7 @@ function readVersionFrom(manifestPath) {
   return manifest.version;
 }
 function readCliVersion() {
-  return readVersionFrom(path6.join(moduleDir(), "..", "package.json"));
+  return readVersionFrom(path7.join(moduleDir(), "..", "package.json"));
 }
 var CLI_VERSION = readCliVersion();
 
@@ -3598,8 +3803,8 @@ withOutputFlags(
     const errors = res.issues.some((i) => i.level === "error");
     const code = unreadable ? EXIT_FAILED : errors ? EXIT_FINDINGS : EXIT_OK;
     if (opts.out && !opts.json) {
-      const fs5 = await import("fs/promises");
-      await fs5.writeFile(opts.out, JSON.stringify(res, null, 2), "utf8");
+      const fs6 = await import("fs/promises");
+      await fs6.writeFile(opts.out, JSON.stringify(res, null, 2), "utf8");
       spinner.succeed(`Analysis written to ${opts.out} in ${ms}ms`);
     } else {
       spinner.succeed(`Analyzed in ${ms}ms`);
@@ -3736,7 +3941,7 @@ async function explainSchemaSource(opts, out) {
       schema: source.schema,
       label: describeSchemaTarget(source.schema),
       config: cfg,
-      ...source.source === "drizzle-kit" && source.drizzleKitConfigPath ? { note: `Schema from ${path7.relative(process.cwd(), source.drizzleKitConfigPath)}` } : {}
+      ...source.source === "drizzle-kit" && source.drizzleKitConfigPath ? { note: `Schema from ${path8.relative(process.cwd(), source.drizzleKitConfigPath)}` } : {}
     };
   }
   const detected = await detectSchema(process.cwd());
@@ -3846,7 +4051,11 @@ withOutputFlags(
   ).option(
     "--check",
     "regenerate and fail if the result differs from what is on disk, without changing it"
-  ).option("--dry-run", "report what would be written, and write nothing", false)
+  ).option("--dry-run", "report what would be written, and write nothing", false).option(
+    "--prune",
+    "delete files a previous run wrote that this one did not, and nothing else",
+    false
+  )
 ).action(async (opts) => {
   const out = outputFor(opts);
   const planning = !!opts.check || !!opts.dryRun;
@@ -3896,7 +4105,7 @@ withOutputFlags(
         const n = source.schema.length;
         out.note(
           out.errStyle.gray(
-            `Schema from ${path7.relative(process.cwd(), source.drizzleKitConfigPath)} (${n} file${n === 1 ? "" : "s"})`
+            `Schema from ${path8.relative(process.cwd(), source.drizzleKitConfigPath)} (${n} file${n === 1 ? "" : "s"})`
           )
         );
       }
@@ -3925,6 +4134,7 @@ withOutputFlags(
       analysis.tables = filterTables(narrowed.tables, cfg);
       for (const w of [...narrowed.warnings, ...filterWarnings]) warn(w);
       for (const w of wideColumnWarning(analysis.issues)) warn(w);
+      for (const w of authTableWarnings(analysis)) warn(w);
       const empty = nothingToGenerate({
         schema: source.schema,
         analyzed: narrowed.tables,
@@ -3994,6 +4204,19 @@ withOutputFlags(
         files: e.files,
         changes: e.changes.map((c) => ({ file: displayPath(c.file), status: c.status }))
       }));
+      const previousManifest = await readManifest(process.cwd());
+      const writtenNow = plan.files.map((f) => f.file);
+      const stale = await staleFiles(previousManifest, writtenNow, process.cwd());
+      let stillStale = stale;
+      if (opts.prune && !planning) {
+        const removed = await pruneStale(process.cwd(), stale);
+        for (const file of removed) out.warn(`drzl generate: removed stale ${file}`);
+        const gone = new Set(removed);
+        stillStale = stale.filter((s) => !gone.has(s.file));
+      } else {
+        const warning = staleWarning(stale);
+        if (warning) warn(warning);
+      }
       if (planning) {
         const wrote = await verifyNothingWasWritten(outputDirs, existing);
         if (wrote.length) {
@@ -4003,6 +4226,14 @@ withOutputFlags(
           process.exit(EXIT_FAILED);
         }
       }
+      if (!planning) {
+        await writeManifest(
+          process.cwd(),
+          nextManifestFiles(writtenNow, stillStale, process.cwd()).map(
+            (f) => path8.resolve(process.cwd(), f)
+          )
+        );
+      }
       if (opts.check) {
         const drift = pendingChanges(plan);
         const upToDate = drift.length === 0;
@@ -4244,10 +4475,10 @@ program.command("watch").description("Watch schema and regenerate on changes").o
     return;
   }
   let cfg = loaded;
-  const abs = (p) => path7.resolve(process.cwd(), p);
+  const abs = (p) => path8.resolve(process.cwd(), p);
   const isInside = (child, parent) => {
-    const rel = path7.relative(parent, child);
-    return !!rel && !rel.startsWith("..") && !path7.isAbsolute(rel);
+    const rel = path8.relative(parent, child);
+    return !!rel && !rel.startsWith("..") && !path8.isAbsolute(rel);
   };
   let source;
   try {
@@ -4283,7 +4514,7 @@ program.command("watch").description("Watch schema and regenerate on changes").o
       if (full === dir || isInside(full, dir)) return true;
     }
     if (stats?.isDirectory()) return false;
-    const ext = path7.extname(full);
+    const ext = path8.extname(full);
     if (!ext) return false;
     return !WATCHED_EXTENSIONS.has(ext);
   };
@@ -4446,7 +4677,7 @@ program.command("watch").description("Watch schema and regenerate on changes").o
   } else {
     out.note(
       out.errStyle.gray(
-        "Watching:\n  " + Array.from(currentTargets).map((p) => path7.relative(process.cwd(), p)).join("\n  ")
+        "Watching:\n  " + Array.from(currentTargets).map((p) => path8.relative(process.cwd(), p)).join("\n  ")
       )
     );
   }