@everystack/model 0.4.4 → 0.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/model",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Declare a table's schema, validation, and authorization once — compiled to migrations, RLS, and handler config",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/can.ts

@@ -40,6 +40,24 @@ export interface AbilityCondition {
   where?: unknown;
   /** Escape hatch: a verbatim RLS predicate, preserved and diffed by normalized text. */
   sql?: unknown;
+  /**
+   * The WRITE predicate, when it differs from the read predicate.
+   *
+   * A policy has two halves: `USING` decides which rows you may TARGET, `WITH CHECK`
+   * decides what a row may BECOME. Postgres defaults the second to the first, which is
+   * usually what you want — and is what every other condition here compiles to.
+   *
+   * They differ when a row may be written into a shape its author could not have selected
+   * by, or vice versa. The dangerous direction is a WITH CHECK WEAKER than the USING: if
+   * `USING` says "your own row, and only while it is a draft" but `WITH CHECK` says only
+   * "your own row", the owner can move their own row out of draft — past whatever the
+   * state guard was protecting.
+   *
+   * Declare it when the live policy has one, so the model states the real rule instead of
+   * silently tightening it to the USING clause. Omit it and the read predicate governs
+   * both, unchanged.
+   */
+  check?: unknown;
 }
 
 export interface Ability {

package/src/derived.ts

@@ -196,6 +196,54 @@ export function arg(name: string, type: string, opts?: { default?: RawSql }): Ar
   return { name, type, ...(opts?.default ? { default: opts.default.sql } : {}) };
 }
 
+/** SQL type aliases → the spelling PostgreSQL's `format_type` prints. Base names only. */
+const BASE_TYPE_ALIASES: Record<string, string> = {
+  int: 'integer', int4: 'integer', int2: 'smallint', int8: 'bigint',
+  serial: 'integer', bigserial: 'bigint', smallserial: 'smallint',
+  bool: 'boolean', float4: 'real', float8: 'double precision', float: 'double precision',
+  decimal: 'numeric', varchar: 'character varying', char: 'character', bpchar: 'character',
+  timestamptz: 'timestamp with time zone', timetz: 'time with time zone',
+  timestamp: 'timestamp without time zone', time: 'time without time zone',
+  varbit: 'bit varying',
+};
+
+/**
+ * One declared argument type in the CATALOG's spelling: aliases resolved, typmods
+ * dropped, array dimensionality kept as `[]` per dimension.
+ *
+ * A function's identity in PostgreSQL is name + argument types, so this is what makes a
+ * DECLARED signature comparable to a live one. Typmods go because a function argument
+ * carries none — PostgreSQL discards length/precision on arguments, so `varchar(20)` and
+ * `varchar` are ONE type here. An unrecognized name (a domain, an enum, an extension
+ * type) passes through lowercased; the catalog prints those verbatim too.
+ */
+export function normalizeArgType(raw: string): string {
+  let t = raw.trim().replace(/\s+/g, ' ');
+  if (t === '') return t;
+
+  // Array dimensionality, both spellings: `text[]`, `text[3][3]`, `text ARRAY`, `text ARRAY[4]`.
+  let dims = 0;
+  for (;;) {
+    const arrayKeyword = /\s+array(\s*\[\s*\d*\s*\])?$/i.exec(t);
+    if (arrayKeyword) { dims += 1; t = t.slice(0, arrayKeyword.index).trim(); continue; }
+    const bracket = /\[\s*\d*\s*\]$/.exec(t);
+    if (bracket) { dims += 1; t = t.slice(0, bracket.index).trim(); continue; }
+    break;
+  }
+
+  t = t.replace(/\([^)]*\)/g, ' ').replace(/\s+/g, ' ').trim();
+  // A quoted part ("char", "MyType") keeps its case; everything else folds down.
+  if (!t.includes('"')) t = t.toLowerCase();
+  t = t.replace(/^pg_catalog\./, '');
+
+  return (BASE_TYPE_ALIASES[t] ?? t) + '[]'.repeat(dims);
+}
+
+/** `(integer, text)` — a declared signature in the catalog's spelling, parens included. */
+export function functionArgSignature(args: readonly ArgSpec[]): string {
+  return `(${args.map((a) => normalizeArgType(a.type)).join(', ')})`;
+}
+
 /** `returns: setof(posts)` — a descriptor ref, so a typo is a TS error and the dep comes free. */
 export interface SetofReturn {
   setof: ModelDescriptor | ViewDescriptor | MaterializedViewDescriptor;

package/src/index.ts

@@ -31,6 +31,7 @@ export type { Module, ModuleDefinition } from './module';
 export {
   defineView, defineMaterializedView, defineFunction, defineSql, defineSequence,
   trigger, arg, setof, validateTriggersFor, SIMPLE_DROP_KINDS,
+  normalizeArgType, functionArgSignature,
 } from './derived';
 export type {
   DerivedDescriptor, ViewDescriptor, MaterializedViewDescriptor, FunctionDescriptor,

package/src/model.ts

@@ -74,6 +74,19 @@ export interface ModelDefinition {
    * is past the state — a satisfied rename is an inert notice.
    */
   renamedFrom?: string;
+  /**
+   * `movedFrom: 'old_schema'` — a one-shot migration hint, the cross-schema twin
+   * of `renamedFrom`. The SAME table name changed `schema` (e.g. `stats` → `curated`);
+   * the diff cannot distinguish a move from a CREATE-in-new-schema + an undeclared
+   * orphan left behind, so the marker carries the intent and the diff emits one
+   * `ALTER TABLE <old_schema>.<table> SET SCHEMA <schema>` (data, indexes, policies,
+   * grants, triggers and owned sequences all ride along) instead of CREATE plus a
+   * stranded copy. Names the OLD schema; the new schema is this model's `schema`.
+   * Remove it once every environment is past the state — a satisfied move is an
+   * inert notice. Cannot be combined with `renamedFrom` (declare the move first,
+   * the rename in a later increment).
+   */
+  movedFrom?: string;
   /**
    * `true` removes the table from the generic data API — `deriveHandlerConfig`
    * skips it, so it never enters `exposedTables`. Default `false`. Package-owned
@@ -111,6 +124,8 @@ export interface ModelDescriptor {
   private: boolean;
   /** One-shot rename hint: this table used to be named `renamedFrom` (same schema). */
   renamedFrom?: string;
+  /** One-shot move hint: this table used to live in schema `movedFrom` (same name) — emits SET SCHEMA. */
+  movedFrom?: string;
   /** Triggers on this table (compute — reconciled, never migrated; excluded from the base fingerprint). */
   triggers: TriggerSpec[];
   /**
@@ -161,6 +176,18 @@ export function defineModel(table: string, def: ModelDefinition): ModelDescripto
 
   validateTriggersFor('table', table, def.triggers ?? []);
 
+  // A rename and a move in one increment can't be composed from two independent markers
+  // (each names only half the source — old name OR old schema — so the diff would miss the
+  // real `old_schema.old_name` table and silently degrade to CREATE + orphan, the exact bug
+  // both markers exist to prevent). Forbid the pair; sequence them across two increments.
+  if (def.renamedFrom && def.movedFrom) {
+    throw new Error(
+      `model '${table}': cannot declare both renamedFrom ('${def.renamedFrom}') and movedFrom ('${def.movedFrom}') ` +
+        `in one increment — the diff can't locate the source. Apply the move first (movedFrom), then the rename ` +
+        `(renamedFrom) in a later increment.`,
+    );
+  }
+
   return {
     table,
     fields: def.fields,
@@ -173,6 +200,7 @@ export function defineModel(table: string, def: ModelDefinition): ModelDescripto
     schema: def.schema ?? 'public',
     private: def.private ?? false,
     ...(def.renamedFrom ? { renamedFrom: def.renamedFrom } : {}),
+    ...(def.movedFrom ? { movedFrom: def.movedFrom } : {}),
     triggers: def.triggers ?? [],
   };
 }

package/src/module.ts

@@ -21,7 +21,7 @@
 
 import type { ModelDescriptor } from './model';
 import type { DerivedDescriptor, SequenceDescriptor } from './derived';
-import { rejectHoles } from './derived';
+import { rejectHoles, functionArgSignature } from './derived';
 
 export interface ModuleDefinition {
   /** The package's Models (schema + authz). */
@@ -71,15 +71,21 @@ export function defineModule(def: ModuleDefinition): Module {
   rejectHoles('defineModule', 'models', def.models);
   rejectHoles('defineModule', 'derived', def.derived);
   rejectHoles('defineModule', 'sequences', def.sequences);
-  // Derived identity is one name per kind: `DROP FUNCTION` renders no argument list, so
-  // v1 rejects function overloads outright, and same-name relations collide in the
-  // catalog anyway — caught here, at composition, before any SQL exists.
+  // Derived identity is one name per kind — except FUNCTIONS, which PostgreSQL identifies
+  // by name + argument types. Two same-name relations collide in the catalog and are
+  // caught here, at composition, before any SQL exists; two functions differing in their
+  // signature are two objects and always were. (Overloads used to be rejected outright
+  // because everything downstream keyed on `schema.name` — the drop rendered no argument
+  // list and provenance held one row for two live functions. It carries the signature now.)
   const seen = new Set<string>();
   for (const d of def.derived ?? []) {
-    const identity = `${d.kind === 'sql' ? d.objectKind : d.kind}:${d.name}`;
+    const kind = d.kind === 'sql' ? d.objectKind : d.kind;
+    const signature = d.kind === 'function' ? functionArgSignature(d.args) : '';
+    const identity = `${kind}:${d.name}${signature}`;
     if (seen.has(identity)) {
       throw new Error(
-        `defineModule: two derived declarations of '${d.name}' (${identity}) — one ${d.kind} per name (function overloads are v1-rejected; rename, or collapse to one signature with arg defaults).`,
+        `defineModule: two derived declarations of '${d.name}${signature}' (${identity}) — one ${d.kind} per `
+        + `${d.kind === 'function' ? 'signature (same name, DIFFERENT argument types, is an overload and is fine)' : 'name'}.`,
       );
     }
     seen.add(identity);