@objectstack/driver-sql 10.2.0 → 11.0.0

package/dist/index.mjs

@@ -2,6 +2,7 @@
 import { parseAutonumberFormat, renderAutonumber, missingFieldValues } from "@objectstack/spec/data";
 import { StorageNameMapping } from "@objectstack/spec/system";
 import { ExternalSchemaModeViolationError } from "@objectstack/spec/shared";
+import { resolveMultiOrgEnabled } from "@objectstack/types";
 
 // src/schema-drift.ts
 var BUILTIN_COLUMNS = /* @__PURE__ */ new Set(["id", "created_at", "updated_at"]);
@@ -141,6 +142,39 @@ var NUMERIC_SCALAR_TYPES = /* @__PURE__ */ new Set([
   "slider",
   "progress"
 ]);
+var AUDIT_TIMESTAMP_COLUMNS = ["created_at", "updated_at"];
+function repairNaiveUtcAuditTimestamp(value) {
+  if (typeof value !== "string") return value;
+  const s = value.trim();
+  if (s === "") return value;
+  if (/[Zz]$/.test(s) || /[+-]\d{2}:?\d{2}$/.test(s)) return value;
+  const m = /^(\d{4}-\d{2}-\d{2})[ T](\d{2}:\d{2}:\d{2}(?:\.\d+)?)$/.exec(s);
+  if (!m) return value;
+  const d = /* @__PURE__ */ new Date(`${m[1]}T${m[2]}Z`);
+  return Number.isNaN(d.getTime()) ? value : d.toISOString();
+}
+function isNowDefaultValue(v) {
+  return typeof v === "string" && /^now\(\)$/i.test(v.trim());
+}
+function normalizeSqliteDatetimeOutput(value) {
+  if (value == null) return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) return value;
+    const d = new Date(value);
+    return Number.isNaN(d.getTime()) ? value : d.toISOString();
+  }
+  if (value instanceof Date) {
+    return Number.isNaN(value.getTime()) ? value : value.toISOString();
+  }
+  if (typeof value !== "string") return value;
+  const s = value.trim();
+  if (s === "") return value;
+  if (/^-?\d+$/.test(s)) {
+    const d = new Date(Number(s));
+    return Number.isNaN(d.getTime()) ? value : d.toISOString();
+  }
+  return repairNaiveUtcAuditTimestamp(s);
+}
 var SqlDriver = class {
   constructor(config) {
     // IDataDriver metadata
@@ -151,6 +185,7 @@ var SqlDriver = class {
     this.numericFields = {};
     this.dateFields = {};
     this.datetimeFields = {};
+    this.timeFields = {};
     /**
      * Federation read path (ADR-0015). For external objects whose physical
      * remote table differs from the object name, these map between the two so
@@ -510,6 +545,7 @@ var SqlDriver = class {
     await this.fillAutoNumberFields(object, toInsert, options);
     const builder = this.getBuilder(object, options);
     const formatted = this.applyWriteColumnMap(object, this.formatInput(object, toInsert));
+    this.stampInsertTimestamps(object, formatted);
     const result = await builder.insert(formatted).returning("*");
     return this.formatOutput(object, result[0]);
   }
@@ -737,18 +773,39 @@ var SqlDriver = class {
       row[cfg.name] = renderAutonumber({ tokens: cfg.tokens, seq: next, record: row, now, timezone }).value;
     }
   }
+  /**
+   * Stamp the builtin audit timestamps to one canonical ISO-8601-with-`Z`
+   * instant on the SQLite write paths (`create`/`bulkCreate`/`upsert`), so
+   * INSERT and UPDATE agree on a single zone-explicit format.
+   *
+   * Without this, an insert that omits `created_at`/`updated_at` falls back to
+   * the column's `CURRENT_TIMESTAMP` default, which on SQLite renders a
+   * zone-NAIVE, space-separated `'YYYY-MM-DD HH:MM:SS'` (no millis, no zone) —
+   * the same ambiguity the old UPDATE stamp had. Stamping app-side (rather than
+   * changing the column default) fixes this for EXISTING tenant databases
+   * immediately, since their tables keep the legacy default. Legacy/raw rows
+   * still written zone-naive are repaired on read by
+   * `repairNaiveUtcAuditTimestamp`.
+   *
+   * Only fills a slot the caller left empty — an explicit value (a seed fixture,
+   * the sys_metadata writer, a service outbox) is preserved. No-op for
+   * timestamp-less objects and for Postgres/MySQL, whose native `now()` column
+   * default already stores a zone-aware TIMESTAMP.
+   */
+  stampInsertTimestamps(object, formatted) {
+    if (!this.isSqlite || !this.tablesWithTimestamps.has(object)) return;
+    const iso = (/* @__PURE__ */ new Date()).toISOString();
+    for (const col of AUDIT_TIMESTAMP_COLUMNS) {
+      if (formatted[col] === void 0 || formatted[col] === null) formatted[col] = iso;
+    }
+  }
   async update(object, id, data, options) {
     this.auditMissingTenant(object, "update", options);
     const builder = this.getBuilder(object, options).where("id", id);
     this.applyTenantScope(builder, object, options);
     const formatted = this.applyWriteColumnMap(object, this.formatInput(object, data));
     if (this.tablesWithTimestamps.has(object)) {
-      if (this.isSqlite) {
-        const now = /* @__PURE__ */ new Date();
-        formatted.updated_at = now.toISOString().replace("T", " ").replace("Z", "");
-      } else {
-        formatted.updated_at = this.knex.fn.now();
-      }
+      formatted.updated_at = this.isSqlite ? (/* @__PURE__ */ new Date()).toISOString() : this.knex.fn.now();
     }
     await builder.update(formatted);
     const readback = this.getBuilder(object, options).where("id", id);
@@ -768,9 +825,12 @@ var SqlDriver = class {
     this.injectTenantOnInsert(object, toUpsert, options);
     await this.fillAutoNumberFields(object, toUpsert, options);
     const formatted = this.applyWriteColumnMap(object, this.formatInput(object, toUpsert));
+    this.stampInsertTimestamps(object, formatted);
     const mergeKeys = conflictKeys && conflictKeys.length > 0 ? conflictKeys : ["id"];
     const builder = this.getBuilder(object, options);
-    await builder.insert(formatted).onConflict(mergeKeys).merge();
+    const mergeColumns = Object.keys(formatted).filter((c) => c !== "created_at");
+    const insertion = builder.insert(formatted).onConflict(mergeKeys);
+    await (mergeColumns.length > 0 ? insertion.merge(mergeColumns) : insertion.merge());
     const readback = this.getBuilder(object, options).where("id", toUpsert.id);
     this.applyTenantScope(readback, object, options);
     const result = await readback.first();
@@ -792,6 +852,7 @@ var SqlDriver = class {
       if (row && typeof row === "object") {
         this.injectTenantOnInsert(object, row, options);
         await this.fillAutoNumberFields(object, row, options);
+        this.stampInsertTimestamps(object, row);
       }
     }
     const builder = this.getBuilder(object, options);
@@ -1047,6 +1108,37 @@ var SqlDriver = class {
     this.assertSchemaMutable("dropTable");
     await this.knex.schema.dropTableIfExists(object);
   }
+  /**
+   * Resolve the per-table tenant-isolation column for a schema, honoring an
+   * explicit tenancy opt-out. Single source of truth for both {@link initObjects}
+   * and {@link registerExternalObject} (they previously inlined this logic and
+   * drifted).
+   *
+   * Precedence:
+   *  1. `tenancy.enabled === false` → `null` (NO driver-level org scope), even
+   *     when the object carries an `organization_id` column. Platform-global
+   *     objects (e.g. `sys_license`) keep an optional, often-NULL org FK but must
+   *     NOT be tenant-scoped: otherwise an authenticated caller's active-org
+   *     `DriverOptions.tenantId` injects `WHERE organization_id = <org>` and every
+   *     NULL-org / cross-org row silently disappears (the platform admin then
+   *     reads zero licenses while an unscoped/anonymous read still sees them).
+   *     The declarative branch below already respected `enabled !== false`; the
+   *     implicit `organization_id` fallback did not — this closes that gap.
+   *  2. Declared `tenancy.tenantField` (when that field exists on the object).
+   *  3. Implicit `organization_id` column detection (legacy objects whose
+   *     multi-tenant column was injected by the kernel without a spec migration).
+   */
+  computeTenantField(schema) {
+    const tenancyDecl = schema?.tenancy;
+    if (tenancyDecl?.enabled === false) return null;
+    const fields = schema?.fields;
+    if (tenancyDecl?.tenantField) {
+      const declared = String(tenancyDecl.tenantField);
+      if (fields && Object.prototype.hasOwnProperty.call(fields, declared)) return declared;
+    }
+    if (fields && Object.prototype.hasOwnProperty.call(fields, "organization_id")) return "organization_id";
+    return null;
+  }
   /**
    * Batch-initialise tables from an array of object definitions.
    */
@@ -1097,19 +1189,9 @@ var SqlDriver = class {
     const numericCols = [];
     const dateCols = [];
     const datetimeCols = [];
+    const timeCols = [];
     const autoNumberCols = [];
-    const tenancyDecl = schema?.tenancy;
-    let tenantField = null;
-    if (tenancyDecl && tenancyDecl.enabled !== false && tenancyDecl.tenantField) {
-      const declared = String(tenancyDecl.tenantField);
-      if (schema.fields && Object.prototype.hasOwnProperty.call(schema.fields, declared)) {
-        tenantField = declared;
-      }
-    }
-    if (!tenantField) {
-      const hasOrgField = !!(schema.fields && Object.prototype.hasOwnProperty.call(schema.fields, "organization_id"));
-      tenantField = hasOrgField ? "organization_id" : null;
-    }
+    const tenantField = this.computeTenantField(schema);
     if (schema.fields) {
       for (const [name, field] of Object.entries(schema.fields)) {
         const type = field.type || "string";
@@ -1118,6 +1200,7 @@ var SqlDriver = class {
         if (NUMERIC_SCALAR_TYPES.has(type) && !field.multiple) numericCols.push(name);
         if (type === "date") dateCols.push(name);
         if (type === "datetime") datetimeCols.push(name);
+        if (type === "time") timeCols.push(name);
         if (type === "auto_number" || type === "autonumber") {
           const rawFmt = typeof field.autonumberFormat === "string" && field.autonumberFormat ? field.autonumberFormat : typeof field.format === "string" && field.format ? field.format : "";
           const fmt = rawFmt || "{0000}";
@@ -1132,9 +1215,10 @@ var SqlDriver = class {
     this.tenantFieldByTable[key] = tenantField;
     if (dateCols.length) this.dateFields[key] = new Set(dateCols);
     if (datetimeCols.length) this.datetimeFields[key] = new Set(datetimeCols);
+    if (timeCols.length) this.timeFields[key] = new Set(timeCols);
   }
   async initObjects(objects) {
-    var _a, _b;
+    var _a, _b, _c;
     this.assertSchemaMutable("initObjects");
     await this.ensureDatabaseExists();
     for (const obj of objects) {
@@ -1147,18 +1231,7 @@ var SqlDriver = class {
       const booleanCols = [];
       const numericCols = [];
       const autoNumberCols = [];
-      const tenancyDecl = obj?.tenancy;
-      let tenantField = null;
-      if (tenancyDecl && tenancyDecl.enabled !== false && tenancyDecl.tenantField) {
-        const declared = String(tenancyDecl.tenantField);
-        if (obj.fields && Object.prototype.hasOwnProperty.call(obj.fields, declared)) {
-          tenantField = declared;
-        }
-      }
-      if (!tenantField) {
-        const hasOrgField = !!(obj.fields && Object.prototype.hasOwnProperty.call(obj.fields, "organization_id"));
-        tenantField = hasOrgField ? "organization_id" : null;
-      }
+      const tenantField = this.computeTenantField(obj);
       if (obj.fields) {
         for (const [name, field] of Object.entries(obj.fields)) {
           const type = field.type || "string";
@@ -1177,6 +1250,9 @@ var SqlDriver = class {
           if (type === "datetime") {
             ((_b = this.datetimeFields)[tableName] ?? (_b[tableName] = /* @__PURE__ */ new Set())).add(name);
           }
+          if (type === "time") {
+            ((_c = this.timeFields)[tableName] ?? (_c[tableName] = /* @__PURE__ */ new Set())).add(name);
+          }
           if (type === "auto_number" || type === "autonumber") {
             const rawFmt = typeof field.autonumberFormat === "string" && field.autonumberFormat ? field.autonumberFormat : typeof field.format === "string" && field.format ? field.format : "";
             const fmt = rawFmt || "{0000}";
@@ -1662,8 +1738,7 @@ var SqlDriver = class {
   }
   isMultiTenantMode() {
     if (this._multiTenantMode === void 0) {
-      const raw = process.env.OS_MULTI_ORG_ENABLED ?? process.env.OS_MULTI_TENANT ?? "false";
-      this._multiTenantMode = String(raw).toLowerCase() !== "false";
+      this._multiTenantMode = resolveMultiOrgEnabled();
     }
     return this._multiTenantMode;
   }
@@ -1779,6 +1854,32 @@ var SqlDriver = class {
     }
     return value;
   }
+  /**
+   * Read-side repair for a `Field.time` value to its wall-clock time-of-day
+   * (`Field.time` is a tz-naive time-of-day, not an instant — #2004). This is a
+   * deliberately NARROW, read-only normalization (no write/filter counterpart):
+   * it only strips a leading `YYYY-MM-DD` date — exactly what a legacy
+   * `defaultValue: 'NOW()'` column took when the default was still the full
+   * `CURRENT_TIMESTAMP` (or a full ISO datetime that leaked into the column) —
+   * and any trailing zone, leaving the time portion. A value that is ALREADY a
+   * bare time-of-day (`HH:MM[:SS[.fff]]`, with or without `Z`/offset) is returned
+   * untouched, so the common case never changes and no write/read asymmetry is
+   * introduced. A `Date`/epoch-ms (defensive — a Date bound to a time column)
+   * maps to its UTC time-of-day. `null`/unrecognised shapes pass through.
+   */
+  toTimeOnly(value) {
+    if (value == null) return value;
+    if (value instanceof Date) {
+      return Number.isNaN(value.getTime()) ? value : value.toISOString().slice(11, 19);
+    }
+    if (typeof value === "number" && Number.isFinite(value)) {
+      const d = new Date(value);
+      return Number.isNaN(d.getTime()) ? value : d.toISOString().slice(11, 19);
+    }
+    if (typeof value !== "string") return value;
+    const m = /^\d{4}-\d{2}-\d{2}[ T](\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?)(?:[Zz]|[+-]\d{2}:?\d{2})?$/.exec(value.trim());
+    return m ? m[1] : value;
+  }
   /**
    * Normalise a filter value for a single column so the comparison the
    * driver sends to SQLite matches the on-disk representation.
@@ -2063,6 +2164,41 @@ var SqlDriver = class {
     return sql;
   }
   // ── Column creation helper ──────────────────────────────────────────────────
+  /**
+   * The driver-native column DEFAULT for a `defaultValue: 'NOW()'` field.
+   *
+   * Postgres/MySQL use native `now()` — a real zone-aware TIMESTAMP that never
+   * had the ambiguity below. SQLite has no timestamp type and `knex.fn.now()`
+   * compiles to `CURRENT_TIMESTAMP`, which renders a timezone-NAIVE,
+   * space-separated `'YYYY-MM-DD HH:MM:SS'` (no millis, no zone). `Date.parse`
+   * reads such a zone-less string as LOCAL time, so a stored UTC wall-clock
+   * shifts by the host offset on a non-UTC runtime — the same class of bug
+   * ADR-0074 fixed for the builtin audit columns. Emit a canonical instead:
+   *   - datetime → ISO-8601 with explicit `Z` (`2026-06-26T10:34:13.891Z`),
+   *                matching `new Date().toISOString()` and the value
+   *                `formatInput`'s `NOW()` safety-net writes;
+   *   - date     → `YYYY-MM-DD` UTC calendar day (matches `toDateOnly`, so the
+   *                stored default already equals what an explicit write stores);
+   *   - time     → `HH:MM:SS.fff` UTC time-of-day (not a full timestamp).
+   *
+   * NOTE: a DDL default only governs NEWLY-created columns. An existing column
+   * keeps its legacy `CURRENT_TIMESTAMP` default and still emits naive text on a
+   * defaulted insert; `formatOutput` repairs those to canonical on read
+   * (`normalizeSqliteDatetimeOutput` for datetime, `toDateOnly` for date), so
+   * reads are uniform without a schema migration.
+   */
+  nowColumnDefault(type) {
+    if (!this.isSqlite) return this.knex.fn.now();
+    switch (type) {
+      case "date":
+        return this.knex.raw("(strftime('%Y-%m-%d', 'now'))");
+      case "time":
+        return this.knex.raw("(strftime('%H:%M:%f', 'now'))");
+      // datetime (and any non-temporal field that opts into NOW()): canonical instant.
+      default:
+        return this.knex.raw("(strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))");
+    }
+  }
   createColumn(table, name, field) {
     if (field.multiple) {
       table.json(name);
@@ -2120,7 +2256,12 @@ var SqlDriver = class {
       case "time":
         col = table.time(name);
         break;
+      // `user` is a lookup specialized to sys_user (ADR: lookup → sys_user). Same
+      // physical storage as any lookup: a string column holding the related row id
+      // (multiple ⇒ JSON, handled at the top of createColumn). No bespoke storage
+      // primitive — it shares this exact DDL path so reads/$expand/FK stay uniform.
       case "lookup":
+      case "user":
         col = table.string(name);
         if (field.reference_to) {
           table.foreign(name).references("id").inTable(field.reference_to);
@@ -2142,12 +2283,12 @@ var SqlDriver = class {
     if (col) {
       if (field.unique) col.unique();
       if (field.required) col.notNullable();
-      if ((type === "datetime" || type === "date" || type === "time") && typeof field.defaultValue === "string" && /^now\(\)$/i.test(field.defaultValue.trim())) {
-        col.defaultTo(this.knex.fn.now());
+      if ((type === "datetime" || type === "date" || type === "time") && isNowDefaultValue(field.defaultValue)) {
+        col.defaultTo(this.nowColumnDefault(type));
       } else if (field.defaultValue !== void 0 && field.defaultValue !== null) {
         const dv = field.defaultValue;
-        if (typeof dv === "string" && /^now\(\)$/i.test(dv.trim())) {
-          col.defaultTo(this.knex.fn.now());
+        if (isNowDefaultValue(dv)) {
+          col.defaultTo(this.nowColumnDefault(type));
         } else if (typeof dv !== "object") {
           col.defaultTo(dv);
         }
@@ -2321,6 +2462,17 @@ var SqlDriver = class {
           }
         }
       }
+      for (const col of AUDIT_TIMESTAMP_COLUMNS) {
+        if (data[col] !== void 0) data[col] = repairNaiveUtcAuditTimestamp(data[col]);
+      }
+      const datetimeFields = this.datetimeFields[object];
+      if (datetimeFields && datetimeFields.size > 0) {
+        for (const field of datetimeFields) {
+          if (data[field] !== void 0) {
+            data[field] = normalizeSqliteDatetimeOutput(data[field]);
+          }
+        }
+      }
     }
     const dateFields = this.dateFields[object];
     if (dateFields && dateFields.size > 0) {
@@ -2331,6 +2483,15 @@ var SqlDriver = class {
         if (normalized !== v) data[field] = normalized;
       }
     }
+    const timeFields = this.timeFields[object];
+    if (timeFields && timeFields.size > 0) {
+      for (const field of timeFields) {
+        const v = data[field];
+        if (v == null) continue;
+        const normalized = this.toTimeOnly(v);
+        if (normalized !== v) data[field] = normalized;
+      }
+    }
     return data;
   }
   // ── Introspection internals ─────────────────────────────────────────────────