@happyvertical/smrt-core 0.30.0

package/dist/schema/schema-manager.js

@@ -0,0 +1,283 @@
+import { createLogger } from "@happyvertical/logger";
+import { detectEngine, getDDLStrategy } from "./ddl/index.js";
+class SchemaManager {
+  db;
+  engine;
+  options;
+  // Per-instance logger: the `debug` option must actually emit debug traces, so
+  // the level follows it (a fixed level: 'info' would filter every debug call).
+  logger;
+  constructor(db, options = {}) {
+    this.db = db;
+    this.options = options;
+    this.logger = createLogger({ level: options.debug ? "debug" : "info" });
+    if (options.engine) {
+      this.engine = options.engine;
+    } else if (db.exportTable) {
+      this.engine = "json";
+    } else {
+      this.engine = detectEngine(db.url);
+    }
+  }
+  /**
+   * Ensure a table exists with the correct schema
+   *
+   * If table doesn't exist, creates it with DDL from the engine-specific strategy.
+   * If table exists but is missing columns, adds them via ALTER TABLE ADD COLUMN.
+   *
+   * @param schema - The schema definition
+   */
+  async ensureTable(schema) {
+    const { tableName } = schema;
+    const exists = await this.db.tableExists(tableName);
+    if (exists) {
+      await this.addMissingColumns(tableName, schema);
+      if (this.options.debug) {
+        this.logger.debug(
+          `[SchemaManager] Table "${tableName}" already exists, checked for missing columns`
+        );
+      }
+      return;
+    }
+    const strategy = getDDLStrategy(this.engine);
+    const ddl = {
+      createTable: strategy.generateCreateTable(schema),
+      indexes: strategy.generateIndexes(schema),
+      triggers: strategy.generateTriggers(schema)
+    };
+    if (this.db.syncSchema) {
+      const fullSchema = [
+        ddl.createTable,
+        ...ddl.indexes,
+        ...this.options.skipTriggers ? [] : ddl.triggers
+      ].join(";\n");
+      if (this.options.debug) {
+        this.logger.debug(
+          `[SchemaManager] Using adapter syncSchema for "${tableName}"`,
+          { fullSchema }
+        );
+      }
+      try {
+        await this.db.syncSchema(fullSchema);
+        const createdSuccessfully = await this.db.tableExists(tableName);
+        if (createdSuccessfully) {
+          if (this.options.debug) {
+            this.logger.debug(
+              `[SchemaManager] Table "${tableName}" created via adapter syncSchema`
+            );
+          }
+          return;
+        }
+        this.logger.warn(
+          `[SchemaManager] syncSchema returned but table "${tableName}" doesn't exist, falling back to direct DDL`
+        );
+      } catch (syncError) {
+        this.logger.warn(
+          `[SchemaManager] syncSchema failed for "${tableName}", falling back to direct DDL`,
+          { error: syncError }
+        );
+      }
+    }
+    if (this.options.debug) {
+      this.logger.debug(
+        `[SchemaManager] Creating table "${tableName}" for ${this.engine} (direct DDL)`,
+        { createTable: ddl.createTable }
+      );
+    }
+    await this.db.query(ddl.createTable);
+    for (const indexSQL of ddl.indexes) {
+      if (this.options.debug) {
+        this.logger.debug(`[SchemaManager] Creating index`, { indexSQL });
+      }
+      await this.db.query(indexSQL);
+    }
+    if (!this.options.skipTriggers) {
+      for (const triggerSQL of ddl.triggers) {
+        if (this.options.debug) {
+          this.logger.debug(`[SchemaManager] Creating trigger`, { triggerSQL });
+        }
+        await this.db.query(triggerSQL);
+      }
+    }
+    if (this.options.debug) {
+      this.logger.debug(
+        `[SchemaManager] Table "${tableName}" created successfully`
+      );
+    }
+  }
+  /**
+   * Get existing column names from a database table
+   *
+   * Uses engine-appropriate introspection:
+   * - SQLite/DuckDB: PRAGMA table_info
+   * - PostgreSQL: information_schema.columns
+   *
+   * @param tableName - Name of the table to inspect
+   * @returns Set of existing column names (lowercase)
+   */
+  async getExistingColumns(tableName) {
+    const columns = /* @__PURE__ */ new Set();
+    try {
+      if (this.engine === "postgres") {
+        const result = await this.db.query(
+          "SELECT column_name FROM information_schema.columns WHERE table_name = $1",
+          tableName
+        );
+        const rows = Array.isArray(result) ? result : result?.rows ?? [];
+        for (const row of rows) {
+          columns.add(row.column_name);
+        }
+      } else {
+        const result = await this.db.query(
+          `PRAGMA table_info(${this.quoteIdentifier(tableName)})`
+        );
+        const rows = Array.isArray(result) ? result : result?.rows ?? [];
+        for (const row of rows) {
+          columns.add(row.name);
+        }
+      }
+    } catch (error) {
+      if (this.options.debug) {
+        this.logger.warn(
+          `[SchemaManager] Failed to introspect columns for "${tableName}"`,
+          { error }
+        );
+      }
+    }
+    return columns;
+  }
+  /**
+   * Add missing columns to an existing table via ALTER TABLE ADD COLUMN
+   *
+   * Compares the schema's expected columns against the table's actual columns
+   * and adds any that are missing. This handles the race condition where a table
+   * is created with base fields by one code path, then a later code path needs
+   * additional columns from a more complete schema.
+   *
+   * SQLite limitation: ALTER TABLE ADD COLUMN cannot add NOT NULL columns
+   * without a DEFAULT value. We relax NOT NULL for such columns.
+   *
+   * @param tableName - Name of the existing table
+   * @param schema - The full schema definition with expected columns
+   */
+  async addMissingColumns(tableName, schema) {
+    if (!schema.columns || Object.keys(schema.columns).length === 0) {
+      return;
+    }
+    const existingColumns = await this.getExistingColumns(tableName);
+    if (existingColumns.size === 0) {
+      return;
+    }
+    const strategy = getDDLStrategy(this.engine);
+    let addedCount = 0;
+    for (const [colName, colDef] of Object.entries(schema.columns)) {
+      if (existingColumns.has(colName)) {
+        continue;
+      }
+      const safeDef = { ...colDef };
+      if (safeDef.notNull && safeDef.defaultValue === void 0 && !safeDef.primaryKey) {
+        safeDef.notNull = false;
+      }
+      if (safeDef.primaryKey) {
+        continue;
+      }
+      const colSQL = strategy.generateColumnDefinition(colName, safeDef);
+      const alterSQL = `ALTER TABLE ${this.quoteIdentifier(tableName)} ADD COLUMN ${colSQL}`;
+      try {
+        await this.db.query(alterSQL);
+        addedCount++;
+        if (this.options.debug) {
+          this.logger.debug(
+            `[SchemaManager] Added column "${colName}" to "${tableName}"`
+          );
+        }
+      } catch (error) {
+        if (this.options.debug) {
+          this.logger.warn(
+            `[SchemaManager] Failed to add column "${colName}" to "${tableName}"`,
+            { error }
+          );
+        }
+      }
+    }
+    if (addedCount > 0 && this.options.debug) {
+      this.logger.debug(
+        `[SchemaManager] Added ${addedCount} missing column(s) to "${tableName}"`
+      );
+    }
+  }
+  quoteIdentifier(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+  }
+  /**
+   * Create multiple tables with dependency ordering
+   *
+   * @param schemas - Array of schema definitions
+   */
+  async ensureTables(schemas) {
+    const sorted = this.sortByDependencies(schemas);
+    for (const schema of sorted) {
+      await this.ensureTable(schema);
+    }
+  }
+  /**
+   * Generate DDL without executing (useful for debugging/preview)
+   *
+   * @param schema - The schema definition
+   * @returns Engine-specific DDL
+   */
+  generateDDL(schema) {
+    const strategy = getDDLStrategy(this.engine);
+    return {
+      createTable: strategy.generateCreateTable(schema),
+      indexes: strategy.generateIndexes(schema),
+      triggers: strategy.generateTriggers(schema)
+    };
+  }
+  /**
+   * Get the detected/configured database engine
+   */
+  getEngine() {
+    return this.engine;
+  }
+  /**
+   * Sort schemas by dependencies (topological sort)
+   *
+   * Ensures tables are created in the correct order based on foreign key dependencies.
+   */
+  sortByDependencies(schemas) {
+    const byName = /* @__PURE__ */ new Map();
+    const sorted = [];
+    const visited = /* @__PURE__ */ new Set();
+    const visiting = /* @__PURE__ */ new Set();
+    for (const schema of schemas) {
+      byName.set(schema.tableName, schema);
+    }
+    const visit = (tableName) => {
+      if (visited.has(tableName)) return;
+      if (visiting.has(tableName)) {
+        this.logger.warn(
+          `[SchemaManager] Circular dependency detected involving ${tableName}`
+        );
+        return;
+      }
+      const schema = byName.get(tableName);
+      if (!schema) return;
+      visiting.add(tableName);
+      for (const dep of schema.dependencies || []) {
+        visit(dep);
+      }
+      visiting.delete(tableName);
+      visited.add(tableName);
+      sorted.push(schema);
+    };
+    for (const schema of schemas) {
+      visit(schema.tableName);
+    }
+    return sorted;
+  }
+}
+export {
+  SchemaManager
+};
+//# sourceMappingURL=schema-manager.js.map

package/dist/schema/schema-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-manager.js","sources":["../../src/schema/schema-manager.ts"],"sourcesContent":["/**\n * Schema Manager - Direct DDL Execution for SMRT\n *\n * SMRT handles ALL database maintenance directly.\n * SDK SQL remains a pure query/CRUD layer.\n *\n * This module replaces the use of SDK's syncSchema() with direct DDL execution\n * using engine-specific DDL strategies.\n */\n\nimport { createLogger } from '@happyvertical/logger';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport {\n  type DatabaseEngine,\n  detectEngine,\n  type EngineSpecificDDL,\n  getDDLStrategy,\n} from './ddl/index.js';\nimport type { SchemaDefinition } from './types.js';\n\n/**\n * Schema Manager Options\n */\nexport interface SchemaManagerOptions {\n  /** Force engine type (overrides auto-detection) */\n  engine?: DatabaseEngine;\n  /** Whether to skip triggers (useful for DuckDB-backed JSON) */\n  skipTriggers?: boolean;\n  /** Log DDL statements before execution */\n  debug?: boolean;\n}\n\n/**\n * Schema Manager\n *\n * Handles direct DDL execution for database schema management.\n * Replaces SDK's syncSchema() with SMRT-controlled schema creation.\n */\nexport class SchemaManager {\n  private db: DatabaseInterface;\n  private engine: DatabaseEngine;\n  private options: SchemaManagerOptions;\n  // Per-instance logger: the `debug` option must actually emit debug traces, so\n  // the level follows it (a fixed level: 'info' would filter every debug call).\n  private logger: ReturnType<typeof createLogger>;\n\n  constructor(db: DatabaseInterface, options: SchemaManagerOptions = {}) {\n    this.db = db;\n    this.options = options;\n    this.logger = createLogger({ level: options.debug ? 'debug' : 'info' });\n\n    // Detect or use provided engine\n    if (options.engine) {\n      this.engine = options.engine;\n    } else if ((db as any).exportTable) {\n      // JSON adapter detected (has unique exportTable method)\n      // JSON adapter uses DuckDB internally, but native UUID values do not\n      // round-trip through the SDK row objects as canonical UUID strings.\n      this.engine = 'json';\n    } else {\n      this.engine = detectEngine(db.url);\n    }\n  }\n\n  /**\n   * Ensure a table exists with the correct schema\n   *\n   * If table doesn't exist, creates it with DDL from the engine-specific strategy.\n   * If table exists but is missing columns, adds them via ALTER TABLE ADD COLUMN.\n   *\n   * @param schema - The schema definition\n   */\n  async ensureTable(schema: SchemaDefinition): Promise<void> {\n    const { tableName } = schema;\n\n    // Check if table already exists\n    const exists = await this.db.tableExists(tableName);\n    if (exists) {\n      // Table exists — check for missing columns and add them\n      // This handles the case where a table was created with a partial schema\n      // (e.g., base SmrtObject fields only) and needs additional columns\n      await this.addMissingColumns(tableName, schema);\n\n      if (this.options.debug) {\n        this.logger.debug(\n          `[SchemaManager] Table \"${tableName}\" already exists, checked for missing columns`,\n        );\n      }\n      return;\n    }\n\n    // Generate DDL using engine-specific strategy\n    const strategy = getDDLStrategy(this.engine);\n    const ddl: EngineSpecificDDL = {\n      createTable: strategy.generateCreateTable(schema),\n      indexes: strategy.generateIndexes(schema),\n      triggers: strategy.generateTriggers(schema),\n    };\n\n    // Prefer adapter's syncSchema if available (handles adapter-specific transformations)\n    // This is critical for JSON adapter which needs to convert UNIQUE indexes to\n    // inline constraints for DuckDB compatibility\n    if ((this.db as any).syncSchema) {\n      // Combine DDL into single schema string for adapter's syncSchema\n      const fullSchema = [\n        ddl.createTable,\n        ...ddl.indexes,\n        ...(this.options.skipTriggers ? [] : ddl.triggers),\n      ].join(';\\n');\n\n      if (this.options.debug) {\n        this.logger.debug(\n          `[SchemaManager] Using adapter syncSchema for \"${tableName}\"`,\n          { fullSchema },\n        );\n      }\n\n      try {\n        await (this.db as any).syncSchema(fullSchema);\n\n        // FIX #735: Verify table was actually created\n        // Some adapters (notably PostgreSQL) may silently fail to create tables\n        // when syncSchema returns without error but doesn't execute the DDL\n        const createdSuccessfully = await this.db.tableExists(tableName);\n        if (createdSuccessfully) {\n          if (this.options.debug) {\n            this.logger.debug(\n              `[SchemaManager] Table \"${tableName}\" created via adapter syncSchema`,\n            );\n          }\n          return;\n        }\n\n        // Table wasn't created - fall through to direct DDL execution\n        this.logger.warn(\n          `[SchemaManager] syncSchema returned but table \"${tableName}\" doesn't exist, falling back to direct DDL`,\n        );\n      } catch (syncError) {\n        // syncSchema failed - fall through to direct DDL execution\n        this.logger.warn(\n          `[SchemaManager] syncSchema failed for \"${tableName}\", falling back to direct DDL`,\n          { error: syncError },\n        );\n      }\n    }\n\n    // Fallback: Execute DDL directly (for adapters without syncSchema)\n    if (this.options.debug) {\n      this.logger.debug(\n        `[SchemaManager] Creating table \"${tableName}\" for ${this.engine} (direct DDL)`,\n        { createTable: ddl.createTable },\n      );\n    }\n\n    await this.db.query(ddl.createTable);\n\n    // Execute indexes\n    for (const indexSQL of ddl.indexes) {\n      if (this.options.debug) {\n        this.logger.debug(`[SchemaManager] Creating index`, { indexSQL });\n      }\n      await this.db.query(indexSQL);\n    }\n\n    // Execute triggers (unless skipped)\n    if (!this.options.skipTriggers) {\n      for (const triggerSQL of ddl.triggers) {\n        if (this.options.debug) {\n          this.logger.debug(`[SchemaManager] Creating trigger`, { triggerSQL });\n        }\n        await this.db.query(triggerSQL);\n      }\n    }\n\n    if (this.options.debug) {\n      this.logger.debug(\n        `[SchemaManager] Table \"${tableName}\" created successfully`,\n      );\n    }\n  }\n\n  /**\n   * Get existing column names from a database table\n   *\n   * Uses engine-appropriate introspection:\n   * - SQLite/DuckDB: PRAGMA table_info\n   * - PostgreSQL: information_schema.columns\n   *\n   * @param tableName - Name of the table to inspect\n   * @returns Set of existing column names (lowercase)\n   */\n  private async getExistingColumns(tableName: string): Promise<Set<string>> {\n    const columns = new Set<string>();\n\n    try {\n      if (this.engine === 'postgres') {\n        const result = await this.db.query(\n          'SELECT column_name FROM information_schema.columns WHERE table_name = $1',\n          tableName,\n        );\n        const rows = Array.isArray(result)\n          ? result\n          : ((result as any)?.rows ?? []);\n        for (const row of rows) {\n          columns.add(row.column_name);\n        }\n      } else {\n        // SQLite and DuckDB use PRAGMA\n        const result = await this.db.query(\n          `PRAGMA table_info(${this.quoteIdentifier(tableName)})`,\n        );\n        const rows = Array.isArray(result)\n          ? result\n          : ((result as any)?.rows ?? []);\n        for (const row of rows) {\n          columns.add(row.name);\n        }\n      }\n    } catch (error) {\n      // If introspection fails, return empty set (no columns will be added)\n      if (this.options.debug) {\n        this.logger.warn(\n          `[SchemaManager] Failed to introspect columns for \"${tableName}\"`,\n          { error },\n        );\n      }\n    }\n\n    return columns;\n  }\n\n  /**\n   * Add missing columns to an existing table via ALTER TABLE ADD COLUMN\n   *\n   * Compares the schema's expected columns against the table's actual columns\n   * and adds any that are missing. This handles the race condition where a table\n   * is created with base fields by one code path, then a later code path needs\n   * additional columns from a more complete schema.\n   *\n   * SQLite limitation: ALTER TABLE ADD COLUMN cannot add NOT NULL columns\n   * without a DEFAULT value. We relax NOT NULL for such columns.\n   *\n   * @param tableName - Name of the existing table\n   * @param schema - The full schema definition with expected columns\n   */\n  private async addMissingColumns(\n    tableName: string,\n    schema: SchemaDefinition,\n  ): Promise<void> {\n    if (!schema.columns || Object.keys(schema.columns).length === 0) {\n      return;\n    }\n\n    const existingColumns = await this.getExistingColumns(tableName);\n    if (existingColumns.size === 0) {\n      // Introspection failed or returned no columns — skip to avoid errors\n      return;\n    }\n\n    const strategy = getDDLStrategy(this.engine);\n    let addedCount = 0;\n\n    for (const [colName, colDef] of Object.entries(schema.columns)) {\n      if (existingColumns.has(colName)) {\n        continue; // Column already exists\n      }\n\n      // SQLite limitation: ALTER TABLE ADD COLUMN cannot have NOT NULL\n      // without a DEFAULT value. Relax NOT NULL for such columns.\n      const safeDef = { ...colDef };\n      if (\n        safeDef.notNull &&\n        safeDef.defaultValue === undefined &&\n        !safeDef.primaryKey\n      ) {\n        safeDef.notNull = false;\n      }\n\n      // Cannot add PRIMARY KEY columns via ALTER TABLE\n      if (safeDef.primaryKey) {\n        continue;\n      }\n\n      const colSQL = strategy.generateColumnDefinition(colName, safeDef);\n      const alterSQL = `ALTER TABLE ${this.quoteIdentifier(tableName)} ADD COLUMN ${colSQL}`;\n\n      try {\n        await this.db.query(alterSQL);\n        addedCount++;\n\n        if (this.options.debug) {\n          this.logger.debug(\n            `[SchemaManager] Added column \"${colName}\" to \"${tableName}\"`,\n          );\n        }\n      } catch (error) {\n        // Column might already exist (race condition) or other issue\n        // Log and continue — don't fail the entire operation\n        if (this.options.debug) {\n          this.logger.warn(\n            `[SchemaManager] Failed to add column \"${colName}\" to \"${tableName}\"`,\n            { error },\n          );\n        }\n      }\n    }\n\n    if (addedCount > 0 && this.options.debug) {\n      this.logger.debug(\n        `[SchemaManager] Added ${addedCount} missing column(s) to \"${tableName}\"`,\n      );\n    }\n  }\n\n  private quoteIdentifier(name: string): string {\n    return `\"${name.replace(/\"/g, '\"\"')}\"`;\n  }\n\n  /**\n   * Create multiple tables with dependency ordering\n   *\n   * @param schemas - Array of schema definitions\n   */\n  async ensureTables(schemas: SchemaDefinition[]): Promise<void> {\n    // Sort by dependencies (topological sort)\n    const sorted = this.sortByDependencies(schemas);\n\n    for (const schema of sorted) {\n      await this.ensureTable(schema);\n    }\n  }\n\n  /**\n   * Generate DDL without executing (useful for debugging/preview)\n   *\n   * @param schema - The schema definition\n   * @returns Engine-specific DDL\n   */\n  generateDDL(schema: SchemaDefinition): EngineSpecificDDL {\n    const strategy = getDDLStrategy(this.engine);\n    return {\n      createTable: strategy.generateCreateTable(schema),\n      indexes: strategy.generateIndexes(schema),\n      triggers: strategy.generateTriggers(schema),\n    };\n  }\n\n  /**\n   * Get the detected/configured database engine\n   */\n  getEngine(): DatabaseEngine {\n    return this.engine;\n  }\n\n  /**\n   * Sort schemas by dependencies (topological sort)\n   *\n   * Ensures tables are created in the correct order based on foreign key dependencies.\n   */\n  private sortByDependencies(schemas: SchemaDefinition[]): SchemaDefinition[] {\n    const byName = new Map<string, SchemaDefinition>();\n    const sorted: SchemaDefinition[] = [];\n    const visited = new Set<string>();\n    const visiting = new Set<string>();\n\n    // Index by table name\n    for (const schema of schemas) {\n      byName.set(schema.tableName, schema);\n    }\n\n    // DFS topological sort\n    const visit = (tableName: string) => {\n      if (visited.has(tableName)) return;\n      if (visiting.has(tableName)) {\n        // Circular dependency - continue anyway (FK might be nullable)\n        this.logger.warn(\n          `[SchemaManager] Circular dependency detected involving ${tableName}`,\n        );\n        return;\n      }\n\n      const schema = byName.get(tableName);\n      if (!schema) return; // External dependency, skip\n\n      visiting.add(tableName);\n\n      // Visit dependencies first\n      for (const dep of schema.dependencies || []) {\n        visit(dep);\n      }\n\n      visiting.delete(tableName);\n      visited.add(tableName);\n      sorted.push(schema);\n    };\n\n    // Visit all schemas\n    for (const schema of schemas) {\n      visit(schema.tableName);\n    }\n\n    return sorted;\n  }\n}\n\n/**\n * Create a SchemaManager instance\n *\n * @param db - Database interface\n * @param options - Optional configuration\n * @returns SchemaManager instance\n */\nexport function createSchemaManager(\n  db: DatabaseInterface,\n  options?: SchemaManagerOptions,\n): SchemaManager {\n  return new SchemaManager(db, options);\n}\n"],"names":[],"mappings":";;AAsCO,MAAM,cAAc;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EAER,YAAY,IAAuB,UAAgC,IAAI;AACrE,SAAK,KAAK;AACV,SAAK,UAAU;AACf,SAAK,SAAS,aAAa,EAAE,OAAO,QAAQ,QAAQ,UAAU,QAAQ;AAGtE,QAAI,QAAQ,QAAQ;AAClB,WAAK,SAAS,QAAQ;AAAA,IACxB,WAAY,GAAW,aAAa;AAIlC,WAAK,SAAS;AAAA,IAChB,OAAO;AACL,WAAK,SAAS,aAAa,GAAG,GAAG;AAAA,IACnC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YAAY,QAAyC;AACzD,UAAM,EAAE,cAAc;AAGtB,UAAM,SAAS,MAAM,KAAK,GAAG,YAAY,SAAS;AAClD,QAAI,QAAQ;AAIV,YAAM,KAAK,kBAAkB,WAAW,MAAM;AAE9C,UAAI,KAAK,QAAQ,OAAO;AACtB,aAAK,OAAO;AAAA,UACV,0BAA0B,SAAS;AAAA,QAAA;AAAA,MAEvC;AACA;AAAA,IACF;AAGA,UAAM,WAAW,eAAe,KAAK,MAAM;AAC3C,UAAM,MAAyB;AAAA,MAC7B,aAAa,SAAS,oBAAoB,MAAM;AAAA,MAChD,SAAS,SAAS,gBAAgB,MAAM;AAAA,MACxC,UAAU,SAAS,iBAAiB,MAAM;AAAA,IAAA;AAM5C,QAAK,KAAK,GAAW,YAAY;AAE/B,YAAM,aAAa;AAAA,QACjB,IAAI;AAAA,QACJ,GAAG,IAAI;AAAA,QACP,GAAI,KAAK,QAAQ,eAAe,CAAA,IAAK,IAAI;AAAA,MAAA,EACzC,KAAK,KAAK;AAEZ,UAAI,KAAK,QAAQ,OAAO;AACtB,aAAK,OAAO;AAAA,UACV,iDAAiD,SAAS;AAAA,UAC1D,EAAE,WAAA;AAAA,QAAW;AAAA,MAEjB;AAEA,UAAI;AACF,cAAO,KAAK,GAAW,WAAW,UAAU;AAK5C,cAAM,sBAAsB,MAAM,KAAK,GAAG,YAAY,SAAS;AAC/D,YAAI,qBAAqB;AACvB,cAAI,KAAK,QAAQ,OAAO;AACtB,iBAAK,OAAO;AAAA,cACV,0BAA0B,SAAS;AAAA,YAAA;AAAA,UAEvC;AACA;AAAA,QACF;AAGA,aAAK,OAAO;AAAA,UACV,kDAAkD,SAAS;AAAA,QAAA;AAAA,MAE/D,SAAS,WAAW;AAElB,aAAK,OAAO;AAAA,UACV,0CAA0C,SAAS;AAAA,UACnD,EAAE,OAAO,UAAA;AAAA,QAAU;AAAA,MAEvB;AAAA,IACF;AAGA,QAAI,KAAK,QAAQ,OAAO;AACtB,WAAK,OAAO;AAAA,QACV,mCAAmC,SAAS,SAAS,KAAK,MAAM;AAAA,QAChE,EAAE,aAAa,IAAI,YAAA;AAAA,MAAY;AAAA,IAEnC;AAEA,UAAM,KAAK,GAAG,MAAM,IAAI,WAAW;AAGnC,eAAW,YAAY,IAAI,SAAS;AAClC,UAAI,KAAK,QAAQ,OAAO;AACtB,aAAK,OAAO,MAAM,kCAAkC,EAAE,UAAU;AAAA,MAClE;AACA,YAAM,KAAK,GAAG,MAAM,QAAQ;AAAA,IAC9B;AAGA,QAAI,CAAC,KAAK,QAAQ,cAAc;AAC9B,iBAAW,cAAc,IAAI,UAAU;AACrC,YAAI,KAAK,QAAQ,OAAO;AACtB,eAAK,OAAO,MAAM,oCAAoC,EAAE,YAAY;AAAA,QACtE;AACA,cAAM,KAAK,GAAG,MAAM,UAAU;AAAA,MAChC;AAAA,IACF;AAEA,QAAI,KAAK,QAAQ,OAAO;AACtB,WAAK,OAAO;AAAA,QACV,0BAA0B,SAAS;AAAA,MAAA;AAAA,IAEvC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,mBAAmB,WAAyC;AACxE,UAAM,8BAAc,IAAA;AAEpB,QAAI;AACF,UAAI,KAAK,WAAW,YAAY;AAC9B,cAAM,SAAS,MAAM,KAAK,GAAG;AAAA,UAC3B;AAAA,UACA;AAAA,QAAA;AAEF,cAAM,OAAO,MAAM,QAAQ,MAAM,IAC7B,SACE,QAAgB,QAAQ,CAAA;AAC9B,mBAAW,OAAO,MAAM;AACtB,kBAAQ,IAAI,IAAI,WAAW;AAAA,QAC7B;AAAA,MACF,OAAO;AAEL,cAAM,SAAS,MAAM,KAAK,GAAG;AAAA,UAC3B,qBAAqB,KAAK,gBAAgB,SAAS,CAAC;AAAA,QAAA;AAEtD,cAAM,OAAO,MAAM,QAAQ,MAAM,IAC7B,SACE,QAAgB,QAAQ,CAAA;AAC9B,mBAAW,OAAO,MAAM;AACtB,kBAAQ,IAAI,IAAI,IAAI;AAAA,QACtB;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AAEd,UAAI,KAAK,QAAQ,OAAO;AACtB,aAAK,OAAO;AAAA,UACV,qDAAqD,SAAS;AAAA,UAC9D,EAAE,MAAA;AAAA,QAAM;AAAA,MAEZ;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAc,kBACZ,WACA,QACe;AACf,QAAI,CAAC,OAAO,WAAW,OAAO,KAAK,OAAO,OAAO,EAAE,WAAW,GAAG;AAC/D;AAAA,IACF;AAEA,UAAM,kBAAkB,MAAM,KAAK,mBAAmB,SAAS;AAC/D,QAAI,gBAAgB,SAAS,GAAG;AAE9B;AAAA,IACF;AAEA,UAAM,WAAW,eAAe,KAAK,MAAM;AAC3C,QAAI,aAAa;AAEjB,eAAW,CAAC,SAAS,MAAM,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AAC9D,UAAI,gBAAgB,IAAI,OAAO,GAAG;AAChC;AAAA,MACF;AAIA,YAAM,UAAU,EAAE,GAAG,OAAA;AACrB,UACE,QAAQ,WACR,QAAQ,iBAAiB,UACzB,CAAC,QAAQ,YACT;AACA,gBAAQ,UAAU;AAAA,MACpB;AAGA,UAAI,QAAQ,YAAY;AACtB;AAAA,MACF;AAEA,YAAM,SAAS,SAAS,yBAAyB,SAAS,OAAO;AACjE,YAAM,WAAW,eAAe,KAAK,gBAAgB,SAAS,CAAC,eAAe,MAAM;AAEpF,UAAI;AACF,cAAM,KAAK,GAAG,MAAM,QAAQ;AAC5B;AAEA,YAAI,KAAK,QAAQ,OAAO;AACtB,eAAK,OAAO;AAAA,YACV,iCAAiC,OAAO,SAAS,SAAS;AAAA,UAAA;AAAA,QAE9D;AAAA,MACF,SAAS,OAAO;AAGd,YAAI,KAAK,QAAQ,OAAO;AACtB,eAAK,OAAO;AAAA,YACV,yCAAyC,OAAO,SAAS,SAAS;AAAA,YAClE,EAAE,MAAA;AAAA,UAAM;AAAA,QAEZ;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,KAAK,KAAK,QAAQ,OAAO;AACxC,WAAK,OAAO;AAAA,QACV,yBAAyB,UAAU,0BAA0B,SAAS;AAAA,MAAA;AAAA,IAE1E;AAAA,EACF;AAAA,EAEQ,gBAAgB,MAAsB;AAC5C,WAAO,IAAI,KAAK,QAAQ,MAAM,IAAI,CAAC;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,SAA4C;AAE7D,UAAM,SAAS,KAAK,mBAAmB,OAAO;AAE9C,eAAW,UAAU,QAAQ;AAC3B,YAAM,KAAK,YAAY,MAAM;AAAA,IAC/B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,YAAY,QAA6C;AACvD,UAAM,WAAW,eAAe,KAAK,MAAM;AAC3C,WAAO;AAAA,MACL,aAAa,SAAS,oBAAoB,MAAM;AAAA,MAChD,SAAS,SAAS,gBAAgB,MAAM;AAAA,MACxC,UAAU,SAAS,iBAAiB,MAAM;AAAA,IAAA;AAAA,EAE9C;AAAA;AAAA;AAAA;AAAA,EAKA,YAA4B;AAC1B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,mBAAmB,SAAiD;AAC1E,UAAM,6BAAa,IAAA;AACnB,UAAM,SAA6B,CAAA;AACnC,UAAM,8BAAc,IAAA;AACpB,UAAM,+BAAe,IAAA;AAGrB,eAAW,UAAU,SAAS;AAC5B,aAAO,IAAI,OAAO,WAAW,MAAM;AAAA,IACrC;AAGA,UAAM,QAAQ,CAAC,cAAsB;AACnC,UAAI,QAAQ,IAAI,SAAS,EAAG;AAC5B,UAAI,SAAS,IAAI,SAAS,GAAG;AAE3B,aAAK,OAAO;AAAA,UACV,0DAA0D,SAAS;AAAA,QAAA;AAErE;AAAA,MACF;AAEA,YAAM,SAAS,OAAO,IAAI,SAAS;AACnC,UAAI,CAAC,OAAQ;AAEb,eAAS,IAAI,SAAS;AAGtB,iBAAW,OAAO,OAAO,gBAAgB,CAAA,GAAI;AAC3C,cAAM,GAAG;AAAA,MACX;AAEA,eAAS,OAAO,SAAS;AACzB,cAAQ,IAAI,SAAS;AACrB,aAAO,KAAK,MAAM;AAAA,IACpB;AAGA,eAAW,UAAU,SAAS;AAC5B,YAAM,OAAO,SAAS;AAAA,IACxB;AAEA,WAAO;AAAA,EACT;AACF;"}

package/dist/schema/sql-identifiers.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Shared SQL identifier / literal / default-value formatters.
+ *
+ * SMRT's schema + migration layers previously re-implemented identifier
+ * quoting and default-value formatting in several places, and a few of those
+ * copies interpolated values raw (`"${name}"`, `'${path}'`) or treated any
+ * string containing `(` as raw SQL. Those unsafe copies allowed a developer
+ * free-string (a `tableName`, a `@meta` field name used as a JSON path, a
+ * column default) that happened to contain a `"` or `'` to break out of the
+ * intended token and inject arbitrary DDL.
+ *
+ * This module is the single safe implementation that every DDL strategy,
+ * the schema generator/aggregator, the registry schema-builder, and the
+ * migration generator route through. It matches the escaping semantics that
+ * `migrations/differ.ts` and `schema/schema-manager.ts` already used
+ * correctly, so the codebase converges on one behaviour.
+ *
+ * IMPORTANT: keep this a pure, dependency-free utility (no runtime imports of
+ * registry/collection/object). It is imported by `schema/ddl/*`,
+ * `schema/index-utils.ts`, `schema/schema-aggregator.ts`,
+ * `schema/generator.ts`, `registry/schema-builder.ts`, and
+ * `migrations/generator.ts`.
+ */
+/**
+ * Quote a SQL identifier (table/column/index/trigger name) by wrapping it in
+ * double quotes and escaping any embedded double quote as `""`.
+ *
+ * This is the ANSI / PostgreSQL / SQLite / DuckDB delimited-identifier rule.
+ * A name containing a `"` is rendered as a single valid token rather than
+ * closing the identifier early and leaking the remainder into the statement.
+ *
+ * @example
+ * quoteIdentifier('users')        // => "users"
+ * quoteIdentifier('we"ird')       // => "we""ird"   (single valid token)
+ */
+export declare function quoteIdentifier(name: string): string;
+/**
+ * Quote a SQL string literal by wrapping it in single quotes and escaping any
+ * embedded single quote as `''`.
+ *
+ * @example
+ * quoteStringLiteral("O'Hara")    // => 'O''Hara'
+ */
+export declare function quoteStringLiteral(value: string): string;
+/**
+ * Validate that a string is a well-formed, injection-safe SQL scalar
+ * function-call default, e.g. `datetime('now')` or `coalesce(0, 1)`.
+ *
+ * The old formatters treated ANY string containing `(` as raw SQL, so a
+ * "default" like `f(x') ; DROP TABLE t; --` was passed through untouched and
+ * injected. This validator instead requires the value to be *only* a function
+ * call whose arguments are themselves safe literals (numbers, properly-quoted
+ * string literals, the NULL keyword, or nested function calls). Anything that
+ * doesn't parse cleanly — stray quotes, statement terminators, trailing
+ * tokens — is rejected and the caller falls back to quoting it as data.
+ *
+ * @internal exported for testing
+ */
+export declare function isSafeSqlFunctionDefault(value: string): boolean;
+/**
+ * Format a column default value into a safe SQL fragment for a `DEFAULT`
+ * clause.
+ *
+ * Behaviour (converging the previously-divergent copies):
+ * - JS `null`/`undefined` => the SQL `NULL` keyword.
+ * - A string that exactly matches a known SQL keyword/niladic-function default
+ *   (case-insensitive, e.g. `current_timestamp`, `uuid_generate_v4()`) =>
+ *   passed through verbatim.
+ * - A string that is a well-formed, injection-safe SQL function call
+ *   (e.g. `datetime('now')`) => passed through verbatim.
+ * - Everything else is formatted *by column type* and always quoted/escaped
+ *   as data. A literal string `"null"`/`"NULL"` is therefore stored as the
+ *   string for a TEXT column, NOT folded to SQL NULL.
+ *
+ * @param value - The raw default value (any JS value).
+ * @param type - The column's SQL type (case-insensitive). Controls literal
+ *   formatting (TEXT/VARCHAR quote, INTEGER/REAL numeric, BOOLEAN, JSON, ...).
+ * @param options - Engine-specific overrides:
+ *   - `booleanLiterals`: how to render boolean true/false (default `TRUE`/`FALSE`;
+ *     SQLite passes `['1','0']`).
+ *   - `nonStringTimestampDefault`: what a non-string TIMESTAMP default falls
+ *     back to (default `CURRENT_TIMESTAMP`).
+ */
+export declare function formatDefaultValue(value: unknown, type: string, options?: {
+    booleanLiterals?: [trueLiteral: string, falseLiteral: string];
+    nonStringTimestampDefault?: string;
+}): string;
+/**
+ * Conservative identifier allowlist for values that will be interpolated into
+ * SQL contexts where quoting is not sufficient — specifically the JSON-path
+ * segment of a JSON-path index expression, which is embedded as a *string
+ * literal* into a dialect function/operator (`json_extract("col", '$.path')`,
+ * `"col"->>'path'`).
+ *
+ * Allows a dotted path of simple identifier segments (e.g. `a`, `a.b.c`).
+ * A JSON path / column that doesn't match is rejected so it can be quoted as
+ * a plain literal instead of being interpolated raw.
+ */
+export declare function isSafeIdentifierPath(value: string): boolean;
+/**
+ * Allowlist for a single SQL identifier with no dots (e.g. a column name).
+ * Stricter than {@link isSafeIdentifierPath}: use this for the *column* of a
+ * JSON-path index (a real column name is always a simple identifier), and
+ * {@link isSafeIdentifierPath} for the dotted *path* segment.
+ */
+export declare function isSafeIdentifier(value: string): boolean;
+//# sourceMappingURL=sql-identifiers.d.ts.map

package/dist/schema/sql-identifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-identifiers.d.ts","sourceRoot":"","sources":["../../src/schema/sql-identifiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AA6BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAiG/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9D,yBAAyB,CAAC,EAAE,MAAM,CAAC;CAC/B,GACL,MAAM,CAkER;AAiCD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/schema/sql-identifiers.js

@@ -0,0 +1,190 @@
+function quoteIdentifier(name) {
+  return `"${String(name).replace(/"/g, '""')}"`;
+}
+function quoteStringLiteral(value) {
+  return `'${String(value).replace(/'/g, "''")}'`;
+}
+const SQL_DEFAULT_KEYWORDS = /* @__PURE__ */ new Set([
+  "current_timestamp",
+  "current_date",
+  "current_time",
+  "localtime",
+  "localtimestamp",
+  "now()",
+  "uuid_generate_v4()",
+  "gen_random_uuid()",
+  "datetime('now')",
+  "date('now')",
+  "time('now')"
+]);
+function isSafeSqlFunctionDefault(value) {
+  const trimmed = value.trim();
+  if (!/^[A-Za-z_][A-Za-z0-9_.]*\s*\(.*\)$/s.test(trimmed)) {
+    return false;
+  }
+  let pos = 0;
+  const n = trimmed.length;
+  const skipWs = () => {
+    while (pos < n && /\s/.test(trimmed[pos])) pos++;
+  };
+  const parseArgument = () => {
+    skipWs();
+    if (pos >= n) return false;
+    const ch = trimmed[pos];
+    if (ch === "'") {
+      pos++;
+      while (pos < n) {
+        if (trimmed[pos] === "'") {
+          if (trimmed[pos + 1] === "'") {
+            pos += 2;
+            continue;
+          }
+          pos++;
+          return true;
+        }
+        pos++;
+      }
+      return false;
+    }
+    if (ch === "+" || ch === "-" || /[0-9]/.test(ch)) {
+      const numMatch = /^[+-]?(?:\d+\.?\d*|\.\d+)/.exec(trimmed.slice(pos));
+      if (!numMatch) return false;
+      pos += numMatch[0].length;
+      return true;
+    }
+    if (/[A-Za-z_]/.test(ch)) {
+      const identMatch = /^[A-Za-z_][A-Za-z0-9_.]*/.exec(trimmed.slice(pos));
+      if (!identMatch) return false;
+      pos += identMatch[0].length;
+      skipWs();
+      if (trimmed[pos] === "(") {
+        return parseCall();
+      }
+      const kw = identMatch[0].toLowerCase();
+      return kw === "null" || kw === "true" || kw === "false";
+    }
+    return false;
+  };
+  const parseCall = () => {
+    skipWs();
+    if (trimmed[pos] !== "(") return false;
+    pos++;
+    skipWs();
+    if (trimmed[pos] === ")") {
+      pos++;
+      return true;
+    }
+    while (true) {
+      if (!parseArgument()) return false;
+      skipWs();
+      if (trimmed[pos] === ",") {
+        pos++;
+        continue;
+      }
+      if (trimmed[pos] === ")") {
+        pos++;
+        return true;
+      }
+      return false;
+    }
+  };
+  const topIdent = /^[A-Za-z_][A-Za-z0-9_.]*/.exec(trimmed);
+  if (!topIdent) return false;
+  pos = topIdent[0].length;
+  skipWs();
+  if (!parseCall()) return false;
+  skipWs();
+  return pos === n;
+}
+function formatDefaultValue(value, type, options = {}) {
+  const [trueLiteral, falseLiteral] = options.booleanLiterals ?? [
+    "TRUE",
+    "FALSE"
+  ];
+  const nonStringTimestampDefault = options.nonStringTimestampDefault ?? "CURRENT_TIMESTAMP";
+  const upperTypeEarly = type.toUpperCase();
+  const isJsonType = upperTypeEarly === "JSON" || upperTypeEarly === "JSONB";
+  if ((value === null || value === void 0) && !isJsonType) {
+    return "NULL";
+  }
+  if (typeof value === "string") {
+    const candidate = value.trim();
+    if (SQL_DEFAULT_KEYWORDS.has(candidate.toLowerCase())) {
+      return value;
+    }
+    if (isSafeSqlFunctionDefault(value)) {
+      return value;
+    }
+  }
+  switch (upperTypeEarly) {
+    case "TEXT":
+    case "VARCHAR":
+    case "CHAR":
+    case "CLOB":
+    case "STRING":
+      return quoteStringLiteral(String(value));
+    case "INTEGER":
+    case "INT":
+    case "BIGINT":
+    case "SMALLINT":
+      return String(Math.floor(Number(value) || 0));
+    case "REAL":
+    case "FLOAT":
+    case "DOUBLE":
+    case "DOUBLE PRECISION":
+    case "DECIMAL":
+    case "NUMERIC":
+      return String(Number(value) || 0);
+    case "BOOLEAN":
+    case "BOOL":
+      return value ? trueLiteral : falseLiteral;
+    case "TIMESTAMP":
+    case "DATETIME":
+    case "DATE":
+    case "TIME":
+      if (typeof value === "string") {
+        return quoteStringLiteral(value);
+      }
+      return nonStringTimestampDefault;
+    case "JSON":
+    case "JSONB":
+      return formatJsonDefault(value);
+    default:
+      return quoteStringLiteral(String(value));
+  }
+}
+function formatJsonDefault(value) {
+  if (value === null || value === void 0) {
+    return "'null'";
+  }
+  if (typeof value === "string") {
+    if (value === "") {
+      return "'null'";
+    }
+    if (value === "[object Object]") {
+      return "'{}'";
+    }
+    try {
+      JSON.parse(value);
+      return quoteStringLiteral(value);
+    } catch {
+      return quoteStringLiteral(JSON.stringify(value));
+    }
+  }
+  return quoteStringLiteral(JSON.stringify(value));
+}
+function isSafeIdentifierPath(value) {
+  return /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(value);
+}
+function isSafeIdentifier(value) {
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(value);
+}
+export {
+  formatDefaultValue,
+  isSafeIdentifier,
+  isSafeIdentifierPath,
+  isSafeSqlFunctionDefault,
+  quoteIdentifier,
+  quoteStringLiteral
+};
+//# sourceMappingURL=sql-identifiers.js.map

package/dist/schema/sql-identifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-identifiers.js","sources":["../../src/schema/sql-identifiers.ts"],"sourcesContent":["/**\n * Shared SQL identifier / literal / default-value formatters.\n *\n * SMRT's schema + migration layers previously re-implemented identifier\n * quoting and default-value formatting in several places, and a few of those\n * copies interpolated values raw (`\"${name}\"`, `'${path}'`) or treated any\n * string containing `(` as raw SQL. Those unsafe copies allowed a developer\n * free-string (a `tableName`, a `@meta` field name used as a JSON path, a\n * column default) that happened to contain a `\"` or `'` to break out of the\n * intended token and inject arbitrary DDL.\n *\n * This module is the single safe implementation that every DDL strategy,\n * the schema generator/aggregator, the registry schema-builder, and the\n * migration generator route through. It matches the escaping semantics that\n * `migrations/differ.ts` and `schema/schema-manager.ts` already used\n * correctly, so the codebase converges on one behaviour.\n *\n * IMPORTANT: keep this a pure, dependency-free utility (no runtime imports of\n * registry/collection/object). It is imported by `schema/ddl/*`,\n * `schema/index-utils.ts`, `schema/schema-aggregator.ts`,\n * `schema/generator.ts`, `registry/schema-builder.ts`, and\n * `migrations/generator.ts`.\n */\n\n/**\n * Quote a SQL identifier (table/column/index/trigger name) by wrapping it in\n * double quotes and escaping any embedded double quote as `\"\"`.\n *\n * This is the ANSI / PostgreSQL / SQLite / DuckDB delimited-identifier rule.\n * A name containing a `\"` is rendered as a single valid token rather than\n * closing the identifier early and leaking the remainder into the statement.\n *\n * @example\n * quoteIdentifier('users')        // => \"users\"\n * quoteIdentifier('we\"ird')       // => \"we\"\"ird\"   (single valid token)\n */\nexport function quoteIdentifier(name: string): string {\n  return `\"${String(name).replace(/\"/g, '\"\"')}\"`;\n}\n\n/**\n * Quote a SQL string literal by wrapping it in single quotes and escaping any\n * embedded single quote as `''`.\n *\n * @example\n * quoteStringLiteral(\"O'Hara\")    // => 'O''Hara'\n */\nexport function quoteStringLiteral(value: string): string {\n  return `'${String(value).replace(/'/g, \"''\")}'`;\n}\n\n/**\n * SQL keyword / niladic-function defaults that are passed through verbatim.\n *\n * Compared case-insensitively against the *entire* trimmed value. This is an\n * explicit allowlist — unlike the old \"value contains `(`\" heuristic, an\n * arbitrary string that merely contains a parenthesis is NOT treated as raw\n * SQL.\n *\n * Deliberately excludes `null`/`NULL`: a literal string `\"null\"` used as a\n * default for a TEXT column must be stored as the string, not folded into the\n * SQL NULL keyword. Real SQL NULL is produced from a JS `null`/`undefined`\n * value (see formatDefaultValue), not from the string `\"null\"`.\n */\nconst SQL_DEFAULT_KEYWORDS = new Set<string>([\n  'current_timestamp',\n  'current_date',\n  'current_time',\n  'localtime',\n  'localtimestamp',\n  'now()',\n  'uuid_generate_v4()',\n  'gen_random_uuid()',\n  \"datetime('now')\",\n  \"date('now')\",\n  \"time('now')\",\n]);\n\n/**\n * Validate that a string is a well-formed, injection-safe SQL scalar\n * function-call default, e.g. `datetime('now')` or `coalesce(0, 1)`.\n *\n * The old formatters treated ANY string containing `(` as raw SQL, so a\n * \"default\" like `f(x') ; DROP TABLE t; --` was passed through untouched and\n * injected. This validator instead requires the value to be *only* a function\n * call whose arguments are themselves safe literals (numbers, properly-quoted\n * string literals, the NULL keyword, or nested function calls). Anything that\n * doesn't parse cleanly — stray quotes, statement terminators, trailing\n * tokens — is rejected and the caller falls back to quoting it as data.\n *\n * @internal exported for testing\n */\nexport function isSafeSqlFunctionDefault(value: string): boolean {\n  const trimmed = value.trim();\n  // Fast structural pre-check: identifier ... ( ... ) and nothing after.\n  if (!/^[A-Za-z_][A-Za-z0-9_.]*\\s*\\(.*\\)$/s.test(trimmed)) {\n    return false;\n  }\n\n  let pos = 0;\n  const n = trimmed.length;\n\n  const skipWs = () => {\n    while (pos < n && /\\s/.test(trimmed[pos])) pos++;\n  };\n\n  // Parse a single argument: a number, a single-quoted string literal, the\n  // NULL keyword, or a nested function call. Returns true on success and\n  // advances `pos`.\n  const parseArgument = (): boolean => {\n    skipWs();\n    if (pos >= n) return false;\n    const ch = trimmed[pos];\n\n    // Single-quoted string literal with doubled-quote escaping.\n    if (ch === \"'\") {\n      pos++; // opening quote\n      while (pos < n) {\n        if (trimmed[pos] === \"'\") {\n          if (trimmed[pos + 1] === \"'\") {\n            pos += 2; // escaped quote\n            continue;\n          }\n          pos++; // closing quote\n          return true;\n        }\n        pos++;\n      }\n      return false; // unterminated string\n    }\n\n    // Number (integer or decimal, optional sign).\n    if (ch === '+' || ch === '-' || /[0-9]/.test(ch)) {\n      const numMatch = /^[+-]?(?:\\d+\\.?\\d*|\\.\\d+)/.exec(trimmed.slice(pos));\n      if (!numMatch) return false;\n      pos += numMatch[0].length;\n      return true;\n    }\n\n    // Identifier-led: either the NULL/TRUE/FALSE keyword or a nested call.\n    if (/[A-Za-z_]/.test(ch)) {\n      const identMatch = /^[A-Za-z_][A-Za-z0-9_.]*/.exec(trimmed.slice(pos));\n      if (!identMatch) return false;\n      pos += identMatch[0].length;\n      skipWs();\n      if (trimmed[pos] === '(') {\n        return parseCall();\n      }\n      // Bare identifier is only allowed for a small set of literal keywords.\n      const kw = identMatch[0].toLowerCase();\n      return kw === 'null' || kw === 'true' || kw === 'false';\n    }\n\n    return false;\n  };\n\n  // Parse `( arg, arg, ... )` starting at the current `(`. Advances `pos`.\n  const parseCall = (): boolean => {\n    skipWs();\n    if (trimmed[pos] !== '(') return false;\n    pos++; // consume '('\n    skipWs();\n    if (trimmed[pos] === ')') {\n      pos++;\n      return true; // empty arg list, e.g. now()\n    }\n    while (true) {\n      if (!parseArgument()) return false;\n      skipWs();\n      if (trimmed[pos] === ',') {\n        pos++;\n        continue;\n      }\n      if (trimmed[pos] === ')') {\n        pos++;\n        return true;\n      }\n      return false; // unexpected token between args\n    }\n  };\n\n  // Top-level: identifier then a call, consuming the whole string.\n  const topIdent = /^[A-Za-z_][A-Za-z0-9_.]*/.exec(trimmed);\n  if (!topIdent) return false;\n  pos = topIdent[0].length;\n  skipWs();\n  if (!parseCall()) return false;\n  skipWs();\n  return pos === n; // no trailing tokens\n}\n\n/**\n * Format a column default value into a safe SQL fragment for a `DEFAULT`\n * clause.\n *\n * Behaviour (converging the previously-divergent copies):\n * - JS `null`/`undefined` => the SQL `NULL` keyword.\n * - A string that exactly matches a known SQL keyword/niladic-function default\n *   (case-insensitive, e.g. `current_timestamp`, `uuid_generate_v4()`) =>\n *   passed through verbatim.\n * - A string that is a well-formed, injection-safe SQL function call\n *   (e.g. `datetime('now')`) => passed through verbatim.\n * - Everything else is formatted *by column type* and always quoted/escaped\n *   as data. A literal string `\"null\"`/`\"NULL\"` is therefore stored as the\n *   string for a TEXT column, NOT folded to SQL NULL.\n *\n * @param value - The raw default value (any JS value).\n * @param type - The column's SQL type (case-insensitive). Controls literal\n *   formatting (TEXT/VARCHAR quote, INTEGER/REAL numeric, BOOLEAN, JSON, ...).\n * @param options - Engine-specific overrides:\n *   - `booleanLiterals`: how to render boolean true/false (default `TRUE`/`FALSE`;\n *     SQLite passes `['1','0']`).\n *   - `nonStringTimestampDefault`: what a non-string TIMESTAMP default falls\n *     back to (default `CURRENT_TIMESTAMP`).\n */\nexport function formatDefaultValue(\n  value: unknown,\n  type: string,\n  options: {\n    booleanLiterals?: [trueLiteral: string, falseLiteral: string];\n    nonStringTimestampDefault?: string;\n  } = {},\n): string {\n  const [trueLiteral, falseLiteral] = options.booleanLiterals ?? [\n    'TRUE',\n    'FALSE',\n  ];\n  const nonStringTimestampDefault =\n    options.nonStringTimestampDefault ?? 'CURRENT_TIMESTAMP';\n\n  const upperTypeEarly = type.toUpperCase();\n  const isJsonType = upperTypeEarly === 'JSON' || upperTypeEarly === 'JSONB';\n\n  // JS null/undefined => SQL NULL — EXCEPT for JSON columns, where a null\n  // default means the JSON `null` literal (`'null'`), not the SQL NULL keyword.\n  // (formatJsonDefault handles the null/undefined case.)\n  if ((value === null || value === undefined) && !isJsonType) {\n    return 'NULL';\n  }\n\n  // Allowlisted SQL keyword / niladic-function defaults, plus well-formed,\n  // injection-safe function calls (e.g. datetime('now')) — passed through.\n  if (typeof value === 'string') {\n    const candidate = value.trim();\n    if (SQL_DEFAULT_KEYWORDS.has(candidate.toLowerCase())) {\n      return value;\n    }\n    if (isSafeSqlFunctionDefault(value)) {\n      return value;\n    }\n  }\n\n  switch (upperTypeEarly) {\n    case 'TEXT':\n    case 'VARCHAR':\n    case 'CHAR':\n    case 'CLOB':\n    case 'STRING':\n      return quoteStringLiteral(String(value));\n    case 'INTEGER':\n    case 'INT':\n    case 'BIGINT':\n    case 'SMALLINT':\n      return String(Math.floor(Number(value) || 0));\n    case 'REAL':\n    case 'FLOAT':\n    case 'DOUBLE':\n    case 'DOUBLE PRECISION':\n    case 'DECIMAL':\n    case 'NUMERIC':\n      return String(Number(value) || 0);\n    case 'BOOLEAN':\n    case 'BOOL':\n      return value ? trueLiteral : falseLiteral;\n    case 'TIMESTAMP':\n    case 'DATETIME':\n    case 'DATE':\n    case 'TIME':\n      if (typeof value === 'string') {\n        return quoteStringLiteral(value);\n      }\n      return nonStringTimestampDefault;\n    case 'JSON':\n    case 'JSONB':\n      return formatJsonDefault(value);\n    default:\n      return quoteStringLiteral(String(value));\n  }\n}\n\n/**\n * Format a JSON column default, ensuring the emitted literal is valid JSON.\n *\n * Mirrors the long-standing behaviour from base-strategy/generator/\n * schema-builder (issue #735): empty string and `[object Object]` are\n * sanitised, valid JSON strings are used as-is, and anything else is\n * JSON.stringify'd. The result is always a single-quoted, escaped SQL literal.\n */\nfunction formatJsonDefault(value: unknown): string {\n  if (value === null || value === undefined) {\n    return \"'null'\";\n  }\n\n  if (typeof value === 'string') {\n    if (value === '') {\n      return \"'null'\";\n    }\n    if (value === '[object Object]') {\n      return \"'{}'\";\n    }\n    try {\n      JSON.parse(value);\n      return quoteStringLiteral(value);\n    } catch {\n      return quoteStringLiteral(JSON.stringify(value));\n    }\n  }\n\n  return quoteStringLiteral(JSON.stringify(value));\n}\n\n/**\n * Conservative identifier allowlist for values that will be interpolated into\n * SQL contexts where quoting is not sufficient — specifically the JSON-path\n * segment of a JSON-path index expression, which is embedded as a *string\n * literal* into a dialect function/operator (`json_extract(\"col\", '$.path')`,\n * `\"col\"->>'path'`).\n *\n * Allows a dotted path of simple identifier segments (e.g. `a`, `a.b.c`).\n * A JSON path / column that doesn't match is rejected so it can be quoted as\n * a plain literal instead of being interpolated raw.\n */\nexport function isSafeIdentifierPath(value: string): boolean {\n  return /^[A-Za-z_][A-Za-z0-9_]*(?:\\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(value);\n}\n\n/**\n * Allowlist for a single SQL identifier with no dots (e.g. a column name).\n * Stricter than {@link isSafeIdentifierPath}: use this for the *column* of a\n * JSON-path index (a real column name is always a simple identifier), and\n * {@link isSafeIdentifierPath} for the dotted *path* segment.\n */\nexport function isSafeIdentifier(value: string): boolean {\n  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(value);\n}\n"],"names":[],"mappings":"AAoCO,SAAS,gBAAgB,MAAsB;AACpD,SAAO,IAAI,OAAO,IAAI,EAAE,QAAQ,MAAM,IAAI,CAAC;AAC7C;AASO,SAAS,mBAAmB,OAAuB;AACxD,SAAO,IAAI,OAAO,KAAK,EAAE,QAAQ,MAAM,IAAI,CAAC;AAC9C;AAeA,MAAM,2CAA2B,IAAY;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAgBM,SAAS,yBAAyB,OAAwB;AAC/D,QAAM,UAAU,MAAM,KAAA;AAEtB,MAAI,CAAC,sCAAsC,KAAK,OAAO,GAAG;AACxD,WAAO;AAAA,EACT;AAEA,MAAI,MAAM;AACV,QAAM,IAAI,QAAQ;AAElB,QAAM,SAAS,MAAM;AACnB,WAAO,MAAM,KAAK,KAAK,KAAK,QAAQ,GAAG,CAAC,EAAG;AAAA,EAC7C;AAKA,QAAM,gBAAgB,MAAe;AACnC,WAAA;AACA,QAAI,OAAO,EAAG,QAAO;AACrB,UAAM,KAAK,QAAQ,GAAG;AAGtB,QAAI,OAAO,KAAK;AACd;AACA,aAAO,MAAM,GAAG;AACd,YAAI,QAAQ,GAAG,MAAM,KAAK;AACxB,cAAI,QAAQ,MAAM,CAAC,MAAM,KAAK;AAC5B,mBAAO;AACP;AAAA,UACF;AACA;AACA,iBAAO;AAAA,QACT;AACA;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAGA,QAAI,OAAO,OAAO,OAAO,OAAO,QAAQ,KAAK,EAAE,GAAG;AAChD,YAAM,WAAW,4BAA4B,KAAK,QAAQ,MAAM,GAAG,CAAC;AACpE,UAAI,CAAC,SAAU,QAAO;AACtB,aAAO,SAAS,CAAC,EAAE;AACnB,aAAO;AAAA,IACT;AAGA,QAAI,YAAY,KAAK,EAAE,GAAG;AACxB,YAAM,aAAa,2BAA2B,KAAK,QAAQ,MAAM,GAAG,CAAC;AACrE,UAAI,CAAC,WAAY,QAAO;AACxB,aAAO,WAAW,CAAC,EAAE;AACrB,aAAA;AACA,UAAI,QAAQ,GAAG,MAAM,KAAK;AACxB,eAAO,UAAA;AAAA,MACT;AAEA,YAAM,KAAK,WAAW,CAAC,EAAE,YAAA;AACzB,aAAO,OAAO,UAAU,OAAO,UAAU,OAAO;AAAA,IAClD;AAEA,WAAO;AAAA,EACT;AAGA,QAAM,YAAY,MAAe;AAC/B,WAAA;AACA,QAAI,QAAQ,GAAG,MAAM,IAAK,QAAO;AACjC;AACA,WAAA;AACA,QAAI,QAAQ,GAAG,MAAM,KAAK;AACxB;AACA,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AACX,UAAI,CAAC,cAAA,EAAiB,QAAO;AAC7B,aAAA;AACA,UAAI,QAAQ,GAAG,MAAM,KAAK;AACxB;AACA;AAAA,MACF;AACA,UAAI,QAAQ,GAAG,MAAM,KAAK;AACxB;AACA,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,WAAW,2BAA2B,KAAK,OAAO;AACxD,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,SAAS,CAAC,EAAE;AAClB,SAAA;AACA,MAAI,CAAC,UAAA,EAAa,QAAO;AACzB,SAAA;AACA,SAAO,QAAQ;AACjB;AA0BO,SAAS,mBACd,OACA,MACA,UAGI,CAAA,GACI;AACR,QAAM,CAAC,aAAa,YAAY,IAAI,QAAQ,mBAAmB;AAAA,IAC7D;AAAA,IACA;AAAA,EAAA;AAEF,QAAM,4BACJ,QAAQ,6BAA6B;AAEvC,QAAM,iBAAiB,KAAK,YAAA;AAC5B,QAAM,aAAa,mBAAmB,UAAU,mBAAmB;AAKnE,OAAK,UAAU,QAAQ,UAAU,WAAc,CAAC,YAAY;AAC1D,WAAO;AAAA,EACT;AAIA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,YAAY,MAAM,KAAA;AACxB,QAAI,qBAAqB,IAAI,UAAU,YAAA,CAAa,GAAG;AACrD,aAAO;AAAA,IACT;AACA,QAAI,yBAAyB,KAAK,GAAG;AACnC,aAAO;AAAA,IACT;AAAA,EACF;AAEA,UAAQ,gBAAA;AAAA,IACN,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,mBAAmB,OAAO,KAAK,CAAC;AAAA,IACzC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO,KAAK,MAAM,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,IAC9C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO,OAAO,KAAK,KAAK,CAAC;AAAA,IAClC,KAAK;AAAA,IACL,KAAK;AACH,aAAO,QAAQ,cAAc;AAAA,IAC/B,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,UAAI,OAAO,UAAU,UAAU;AAC7B,eAAO,mBAAmB,KAAK;AAAA,MACjC;AACA,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO,kBAAkB,KAAK;AAAA,IAChC;AACE,aAAO,mBAAmB,OAAO,KAAK,CAAC;AAAA,EAAA;AAE7C;AAUA,SAAS,kBAAkB,OAAwB;AACjD,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,UAAU,IAAI;AAChB,aAAO;AAAA,IACT;AACA,QAAI,UAAU,mBAAmB;AAC/B,aAAO;AAAA,IACT;AACA,QAAI;AACF,WAAK,MAAM,KAAK;AAChB,aAAO,mBAAmB,KAAK;AAAA,IACjC,QAAQ;AACN,aAAO,mBAAmB,KAAK,UAAU,KAAK,CAAC;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,mBAAmB,KAAK,UAAU,KAAK,CAAC;AACjD;AAaO,SAAS,qBAAqB,OAAwB;AAC3D,SAAO,wDAAwD,KAAK,KAAK;AAC3E;AAQO,SAAS,iBAAiB,OAAwB;AACvD,SAAO,2BAA2B,KAAK,KAAK;AAC9C;"}

package/dist/schema/table-verifier.d.ts

@@ -0,0 +1,10 @@
+import { DatabaseInterface } from '@happyvertical/sql';
+/**
+ * Verify that a model table already exists.
+ *
+ * Runtime no longer creates application tables implicitly. This helper is the
+ * shared fail-fast path used by collections and objects before they touch app
+ * tables, while still caching successful checks to avoid repeated round-trips.
+ */
+export declare function verifyPersistenceTable(db: DatabaseInterface, tableName: string, className: string): Promise<void>;
+//# sourceMappingURL=table-verifier.d.ts.map