@rebasepro/server-postgres 0.18.0 → 0.18.1

package/dist/schema/introspect-db.js

@@ -0,0 +1,866 @@
+import { createRequire as __createRequire } from "module";
+__createRequire(import.meta.url);
+import { a as __toESM, t as require___vite_browser_external } from "../__vite-browser-external-BnuHet1e.js";
+import { n as outError, r as outWarn, t as out } from "../cli-output-CNdMql-L.js";
+import { t as chalk } from "../source-Br7L7GOI.js";
+import { a as generateCollectionFile, f as classifyTables, i as buildTablesMap, l as mergeIndexContent, o as generateIndexContent, p as lookupCandidates, r as buildEnumMap, u as safeHostFromUrl } from "../introspect-db-logic-C6LQdTxj.js";
+import { t as require_arg } from "../arg-Dni7MzLB.js";
+import pg from "pg";
+import fs from "fs";
+import path from "path";
+import * as dotenv from "dotenv";
+//#region src/schema/introspect-db-project.ts
+var import___vite_browser_external = /* @__PURE__ */ __toESM(require___vite_browser_external(), 1);
+var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
+/**
+* What the project being introspected into can actually import.
+*
+* The generator is pure — `introspect-db-logic.ts` reads no files — so the one
+* question it cannot answer for itself lives here: which `defineCollection`, if
+* any, will resolve from the directory the collections are written to.
+*/
+/** How far up to look before giving up, if no project root announces itself. */
+var MAX_LEVELS = 8;
+/** Every dependency name a manifest declares, in any of the three fields. */
+function declaredDependencies(manifestPath) {
+	const names = /* @__PURE__ */ new Set();
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(manifestPath, "utf-8"));
+	} catch {
+		return names;
+	}
+	if (typeof parsed !== "object" || parsed === null) return names;
+	const manifest = parsed;
+	for (const field of [
+		"dependencies",
+		"devDependencies",
+		"peerDependencies"
+	]) {
+		const block = manifest[field];
+		if (typeof block === "object" && block !== null) for (const name of Object.keys(block)) names.add(name);
+	}
+	return names;
+}
+/**
+* Which `defineCollection` to generate against, for collections written to `outDir`.
+*
+* **The detection is the package manifests above the output directory**, unioned from
+* `outDir` up to and including the project root — the first ancestor holding a
+* `rebase.json`, or `MAX_LEVELS` up if there is none.
+*
+* That is the rule Node itself applies: a file in `config/collections` resolves a bare
+* specifier through `config/node_modules`, then `<project>/node_modules`, and so on up.
+* Reading the manifests along that same path answers the only question that matters —
+* *will this import resolve in the project I am writing into* — from the state on disk
+* at the moment of generation. The alternatives are all proxies for it: `rebase.json`'s
+* `apps` block says a CMS scaffold declared an admin app, and a `frontend/` directory
+* says one was scaffolded, but neither is what the compiler consults, and either can be
+* true of a project whose `config` package does not depend on `@rebasepro/cms-types`.
+*
+* Ambiguity resolves towards the admin panel: a project that declares both packages has
+* a panel, and `@rebasepro/cms-types` is the flavour that keeps the `admin` block.
+*/
+function detectCollectionBuilder(outDir) {
+	let dir = path.resolve(outDir);
+	const declared = /* @__PURE__ */ new Set();
+	for (let level = 0; level < MAX_LEVELS; level++) {
+		const manifest = path.join(dir, "package.json");
+		if (fs.existsSync(manifest)) for (const name of declaredDependencies(manifest)) declared.add(name);
+		if (fs.existsSync(path.join(dir, "rebase.json"))) break;
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	if (declared.has("@rebasepro/cms-types")) return "admin-types";
+	if (declared.has("@rebasepro/common")) return "common";
+	return "annotation";
+}
+//#endregion
+//#region src/schema/introspect-db-queries.ts
+/**
+* A Postgres identifier, quoted so that whatever is inside it stays inside it.
+*
+* Introspection reads table and schema names out of `pg_class` and puts them
+* straight back into SQL, and wrapping a name in double quotes is not the same
+* as escaping it: a table named `x" ; DROP TABLE users; --` closes the quote
+* and then the statement. Postgres's own escape for a quote inside a quoted
+* identifier is to double it, which is what this does.
+*
+* "The catalogue is trusted" is true of your own database, and is exactly the
+* assumption this tool cannot make. Introspection exists to be pointed at
+* databases somebody else built, and it runs with the privileges of whoever
+* ran it — which is usually a superuser, because that is who has a connection
+* string to a database they are adopting.
+*/
+function quoteIdentifier(name) {
+	return `"${name.replace(/"/g, "\"\"")}"`;
+}
+/** `"schema"."table"`, both halves quoted. */
+function quoteRelation(schema, table) {
+	return `${quoteIdentifier(schema)}.${quoteIdentifier(table)}`;
+}
+/**
+* Can this table's name be the name of the file describing it?
+*
+* Introspection writes `<collectionsDir>/<tableName>.ts`, and the table name
+* came from a database this tool did not create. Postgres will hold a table
+* called `../../../etc/cron.d/x`, and `path.join` resolves it — so without this
+* the generator writes a file wherever the name points, as whoever ran the
+* command.
+*
+* Deliberately narrow, and deliberately not a blocklist of `..` and `/`: the
+* question is "is this a plain file name?", and every answer that is not
+* obviously yes is a table better written by hand. NUL and the Windows
+* separator are in scope because a collections directory is checked out on
+* whatever machine the developer has.
+*/
+function isUsableFileName(name) {
+	if (name.length === 0 || name.length > 200) return false;
+	if (name === "." || name === "..") return false;
+	if (/[/\\:\u0000-\u001f]/.test(name)) return false;
+	return !name.startsWith(".") && !name.endsWith(".");
+}
+/**
+* Base tables, excluding partitions.
+*
+* `relispartition` is the reason this reads `pg_class` rather than
+* `information_schema.tables`, which reports every partition as a base table of
+* its own. Pagila partitions `payment` by month; introspected through
+* information_schema it yields `payment` plus 26 near-identical
+* `payment_p2022_*` collections, each with its own nav entry.
+*
+* `relkind = 'p'` (the partitioned parent) is included and `'r'` partitions are
+* dropped, which is the right way round: the parent is the queryable table.
+*/
+var TABLES_QUERY = `
+    SELECT c.relname AS table_name,
+           c.relkind = 'p' AS is_partitioned
+    FROM pg_class c
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname = $1
+      AND c.relkind IN ('r', 'p')
+      AND NOT c.relispartition
+      AND c.relname NOT LIKE 'drizzle_%'
+      AND c.relname NOT LIKE 'rebase_%'
+    ORDER BY c.relname
+`;
+/**
+* Columns, with the catalog facts that say a column is not the user's to edit.
+*
+* `is_generated`/`is_identity` are read for that reason: a generated column
+* rejects any write, so a form that offers it is offering a field that always
+* errors. `character_maximum_length` is the declared `varchar(n)` bound —
+* already enforced by the database, and free to surface as validation.
+*/
+var COLUMNS_QUERY = `
+    SELECT
+        c.table_name,
+        c.column_name,
+        c.data_type,
+        c.udt_name,
+        c.is_nullable,
+        c.column_default,
+        c.ordinal_position,
+        c.is_generated,
+        c.is_identity,
+        c.identity_generation,
+        c.character_maximum_length,
+        c.numeric_precision,
+        c.numeric_scale,
+        (SELECT a.atttypmod FROM pg_attribute a
+         JOIN pg_class pc ON a.attrelid = pc.oid
+         WHERE pc.relname = c.table_name
+           AND a.attname = c.column_name
+           AND pc.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = c.table_schema)) as atttypmod
+    FROM information_schema.columns c
+    WHERE c.table_schema = $1
+    ORDER BY c.table_name, c.ordinal_position
+`;
+var ENUMS_QUERY = `
+    SELECT t.typname AS enum_name,
+           e.enumlabel AS enum_value,
+           e.enumsortorder AS sort_order
+    FROM pg_type t
+    JOIN pg_enum e ON t.oid = e.enumtypid
+    JOIN pg_namespace n ON t.typnamespace = n.oid
+    WHERE n.nspname = $1
+    ORDER BY t.typname, e.enumsortorder
+`;
+/**
+* Primary key columns, in key order.
+*
+* `ORDER BY k.ord` matters for composite keys: the position of a column inside
+* the key is what tells a two-column PK made of two foreign keys apart from an
+* ordinary composite key, and `= ANY(i.indkey)` (the shape this replaced)
+* returns catalog order instead.
+*/
+var PRIMARY_KEYS_QUERY = `
+    SELECT t.relname AS table_name,
+           a.attname AS column_name
+    FROM pg_index i
+    JOIN pg_class t ON t.oid = i.indrelid
+    JOIN pg_namespace n ON n.oid = t.relnamespace
+    CROSS JOIN LATERAL unnest(i.indkey) WITH ORDINALITY AS k(attnum, ord)
+    JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum = k.attnum
+    WHERE i.indisprimary AND n.nspname = $1
+    ORDER BY t.relname, k.ord
+`;
+/**
+* Foreign keys, one row per referencing column, with the delete rule.
+*
+* Read from `pg_constraint` rather than through
+* `information_schema.constraint_column_usage`, which does not preserve the
+* pairing on a composite foreign key: it reports the cross product of the
+* constraint's columns, so a two-column FK comes back as four rows, two of them
+* pairing the wrong columns. `unnest(...) WITH ORDINALITY` on both sides joined
+* on the ordinal keeps each referencing column with the column it references.
+*
+* `confdeltype` is carried because `ON DELETE CASCADE` is the schema author
+* saying, in the database, that the child cannot outlive the parent — the one
+* unambiguous declaration of ownership a schema contains.
+*
+* Constraints declared on a *partition* are attributed to the partition root,
+* because that is the table this run generates a collection for. Pagila declares
+* `payment`'s three foreign keys on each monthly partition and none on the
+* parent, so reading `pg_constraint` at face value gives the `payment`
+* collection no relations at all. `pick = 1` then keeps one row per logical key,
+* preferring the root's own constraint when it has one, so a schema that
+* declares the key on the parent *and* inherits it onto 26 partitions does not
+* yield 27 copies of the same relation.
+*/
+var FOREIGN_KEYS_QUERY = `
+    WITH fk AS (
+        SELECT con.oid,
+               con.conname,
+               con.conrelid,
+               con.confrelid,
+               con.conkey,
+               con.confkey,
+               con.confdeltype,
+               COALESCE(pg_partition_root(con.conrelid), con.conrelid) AS root_oid,
+               row_number() OVER (
+                   PARTITION BY COALESCE(pg_partition_root(con.conrelid), con.conrelid),
+                                con.confrelid, con.conkey, con.confkey
+                   ORDER BY (con.conrelid = COALESCE(pg_partition_root(con.conrelid), con.conrelid)) DESC,
+                            con.oid
+               ) AS pick
+        FROM pg_constraint con
+        JOIN pg_namespace n ON n.oid = con.connamespace
+        WHERE con.contype = 'f' AND n.nspname = $1
+    )
+    SELECT root.relname AS table_name,
+           sa.attname AS column_name,
+           tgt.relname AS foreign_table_name,
+           ta.attname AS foreign_column_name,
+           fk.conname AS constraint_name,
+           s.ord::int AS ordinal,
+           CASE fk.confdeltype
+               WHEN 'a' THEN 'NO ACTION'
+               WHEN 'r' THEN 'RESTRICT'
+               WHEN 'c' THEN 'CASCADE'
+               WHEN 'n' THEN 'SET NULL'
+               WHEN 'd' THEN 'SET DEFAULT'
+           END AS delete_rule
+    FROM fk
+    JOIN pg_class root ON root.oid = fk.root_oid
+    JOIN pg_class tgt ON tgt.oid = fk.confrelid
+    CROSS JOIN LATERAL unnest(fk.conkey) WITH ORDINALITY AS s(attnum, ord)
+    JOIN pg_attribute sa ON sa.attrelid = fk.conrelid AND sa.attnum = s.attnum
+    CROSS JOIN LATERAL unnest(fk.confkey) WITH ORDINALITY AS f(attnum, ord)
+    JOIN pg_attribute ta ON ta.attrelid = fk.confrelid AND ta.attnum = f.attnum
+    WHERE fk.pick = 1 AND s.ord = f.ord
+    ORDER BY root.relname, fk.conname, s.ord
+`;
+/**
+* Unique constraints and unique indexes, as ordered column lists.
+*
+* Indexes rather than constraints alone, because `CREATE UNIQUE INDEX` and
+* `ADD CONSTRAINT ... UNIQUE` produce the same guarantee and schemas use both.
+* Partial indexes (`indpred IS NOT NULL`) are excluded: they promise uniqueness
+* only over the rows matching their predicate, which is not the promise a
+* `validation: { unique: true }` field makes.
+*/
+var UNIQUE_CONSTRAINTS_QUERY = `
+    SELECT t.relname AS table_name,
+           ic.relname AS constraint_name,
+           -- ::text, because the driver has no parser for an array of \`name\`
+           -- and hands back the raw \`{a,b}\` literal as a string. Every consumer
+           -- here indexes and compares it as an array, and a string of that
+           -- shape fails those silently rather than loudly.
+           array_agg(a.attname::text ORDER BY k.ord) AS column_names
+    FROM pg_index i
+    JOIN pg_class t ON t.oid = i.indrelid
+    JOIN pg_class ic ON ic.oid = i.indexrelid
+    JOIN pg_namespace n ON n.oid = t.relnamespace
+    CROSS JOIN LATERAL unnest(i.indkey) WITH ORDINALITY AS k(attnum, ord)
+    JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum = k.attnum
+    WHERE i.indisunique
+      AND NOT i.indisprimary
+      AND i.indpred IS NULL
+      AND n.nspname = $1
+      AND NOT t.relispartition
+    GROUP BY t.relname, ic.relname
+    ORDER BY t.relname, ic.relname
+`;
+/**
+* CHECK constraints, as the source text Postgres reproduces them from.
+*
+* `pg_get_constraintdef` output is normalized by the server — the parser in
+* {@link ./introspect-db-constraints.ts} reads that normalized form, not
+* whatever the author typed.
+*/
+var CHECK_CONSTRAINTS_QUERY = `
+    SELECT DISTINCT
+           root.relname AS table_name,
+           con.conname AS constraint_name,
+           pg_get_constraintdef(con.oid) AS definition
+    FROM pg_constraint con
+    JOIN pg_namespace n ON n.oid = con.connamespace
+    JOIN pg_class root ON root.oid = COALESCE(pg_partition_root(con.conrelid), con.conrelid)
+    WHERE con.contype = 'c'
+      AND n.nspname = $1
+    ORDER BY root.relname, con.conname
+`;
+/**
+* `COMMENT ON TABLE` / `COMMENT ON COLUMN`, which is documentation the author
+* already wrote and which nothing downstream has ever read.
+*/
+var COMMENTS_QUERY = `
+    SELECT t.relname AS table_name,
+           a.attname AS column_name,
+           d.description AS comment
+    FROM pg_description d
+    JOIN pg_class t ON t.oid = d.objoid
+    JOIN pg_namespace n ON n.oid = t.relnamespace
+    LEFT JOIN pg_attribute a ON a.attrelid = t.oid AND a.attnum = d.objsubid
+    WHERE n.nspname = $1
+      AND t.relkind IN ('r', 'p')
+      AND (d.objsubid = 0 OR a.attname IS NOT NULL)
+    ORDER BY t.relname, d.objsubid
+`;
+/**
+* Counts a table's rows, stopping once the answer can only be "more than
+* `limit`".
+*
+* Introspection asks this to tell a small reference table from a table that
+* merely looks like one (see `classifyTables`). `reltuples` would answer for
+* free but lies on a table that has never been analyzed — which is every table
+* in a database restored from a dump, i.e. exactly the case introspection meets
+* — and reports -1 there rather than an error, so the lie is silent.
+*
+* The subquery's LIMIT caps the work at `limit + 1` rows however large the
+* table is, so this stays cheap on a table with a billion rows.
+*/
+async function countRowsUpTo(client, schema, table, limit) {
+	const { rows } = await client.query(`SELECT count(*)::text AS count FROM (SELECT 1 FROM ${quoteRelation(schema, table)} LIMIT ${limit + 1}) probe`);
+	return Number(rows[0]?.count ?? 0);
+}
+/**
+* Reads everything the generator needs, in one pass.
+*
+* `rowCounts` is deliberately absent here: it costs a query per table and only
+* a handful of tables can possibly need it. The caller fills it in for the
+* candidates `lookupCandidates()` names.
+*/
+async function readSchemaMetadata(client, schema) {
+	const tables = await client.query(TABLES_QUERY, [schema]);
+	const columns = await client.query(COLUMNS_QUERY, [schema]);
+	const enumValues = await client.query(ENUMS_QUERY, [schema]);
+	const pks = await client.query(PRIMARY_KEYS_QUERY, [schema]);
+	const fks = await client.query(FOREIGN_KEYS_QUERY, [schema]);
+	const uniques = await client.query(UNIQUE_CONSTRAINTS_QUERY, [schema]);
+	const checks = await client.query(CHECK_CONSTRAINTS_QUERY, [schema]);
+	const comments = await client.query(COMMENTS_QUERY, [schema]);
+	const known = new Set(tables.rows.map((t) => t.table_name));
+	const scoped = (rows) => rows.filter((r) => known.has(r.table_name));
+	return {
+		schema,
+		tables: tables.rows,
+		columns: scoped(columns.rows),
+		enumValues: enumValues.rows,
+		pks: scoped(pks.rows),
+		fks: scoped(fks.rows).filter((fk) => known.has(fk.foreign_table_name)),
+		uniques: scoped(uniques.rows),
+		checks: scoped(checks.rows),
+		comments: scoped(comments.rows),
+		rowCounts: {}
+	};
+}
+//#endregion
+//#region src/schema/introspect-db-constraints.ts
+/** The length functions whose argument is the column being constrained. */
+var LENGTH_FUNCTIONS = /* @__PURE__ */ new Set([
+	"length",
+	"char_length",
+	"character_length",
+	"octet_length"
+]);
+/**
+* Splits on a separator that appears at paren depth 0 and outside string
+* literals.
+*
+* Depth tracking is the whole job: `ARRAY['a', 'b']` contains a comma that must
+* not split the enclosing argument list, and `'it''s'` contains a quote that
+* must not end the literal.
+*/
+function splitTopLevel(input, separator) {
+	const parts = [];
+	let depth = 0;
+	let inString = false;
+	let current = "";
+	for (let i = 0; i < input.length; i++) {
+		const ch = input[i];
+		if (inString) {
+			current += ch;
+			if (ch === "'") if (input[i + 1] === "'") current += input[++i];
+			else inString = false;
+			continue;
+		}
+		if (ch === "'") {
+			inString = true;
+			current += ch;
+			continue;
+		}
+		if (ch === "(" || ch === "[") depth++;
+		if (ch === ")" || ch === "]") depth--;
+		if (depth === 0 && input.startsWith(separator, i)) {
+			const before = input[i - 1];
+			const after = input[i + separator.length];
+			if (!/[A-Za-z]/.test(separator[0]) || (before === void 0 || !/[A-Za-z0-9_]/.test(before)) && (after === void 0 || !/[A-Za-z0-9_]/.test(after))) {
+				parts.push(current);
+				current = "";
+				i += separator.length - 1;
+				continue;
+			}
+		}
+		current += ch;
+	}
+	parts.push(current);
+	return parts.map((p) => p.trim()).filter((p) => p.length > 0);
+}
+/** Removes one layer of wrapping parentheses, repeatedly, when balanced. */
+function unwrapParens(input) {
+	let s = input.trim();
+	while (s.startsWith("(") && s.endsWith(")")) {
+		let depth = 0;
+		let balanced = true;
+		let inString = false;
+		for (let i = 0; i < s.length; i++) {
+			const ch = s[i];
+			if (inString) {
+				if (ch === "'") if (s[i + 1] === "'") i++;
+				else inString = false;
+				continue;
+			}
+			if (ch === "'") {
+				inString = true;
+				continue;
+			}
+			if (ch === "(") depth++;
+			else if (ch === ")") {
+				depth--;
+				if (depth === 0 && i < s.length - 1) {
+					balanced = false;
+					break;
+				}
+			}
+		}
+		if (!balanced) break;
+		s = s.slice(1, -1).trim();
+	}
+	return s;
+}
+/** Drops trailing `::type` casts, including array and quoted forms. */
+function stripCasts(input) {
+	let s = unwrapParens(input);
+	let previous;
+	do {
+		previous = s;
+		s = unwrapParens(s.replace(/::\s*"?[A-Za-z_][A-Za-z0-9_ ]*"?(\s*\(\s*\d+\s*(,\s*\d+\s*)?\))?(\s*\[\s*\])*\s*$/, "").trim());
+	} while (s !== previous);
+	return s;
+}
+/** A bare, unquoted column reference — anything else is an expression. */
+function asColumnName(input) {
+	const s = stripCasts(input);
+	if (/^[a-z_][a-z0-9_$]*$/i.test(s)) return s;
+	const quoted = s.match(/^"([^"]+)"$/);
+	return quoted ? quoted[1] : null;
+}
+/** `length(col)` and friends → the column they measure. */
+function asLengthOfColumn(input) {
+	const match = stripCasts(input).match(/^([a-z_]+)\s*\((.*)\)$/is);
+	if (!match || !LENGTH_FUNCTIONS.has(match[1].toLowerCase())) return null;
+	return asColumnName(match[2]);
+}
+/** A numeric literal, after casts are removed. Rejects anything else. */
+function asNumber(input) {
+	const s = stripCasts(input).replace(/^'(.*)'$/s, "$1");
+	if (!/^[+-]?(\d+\.?\d*|\.\d+)$/.test(s)) return null;
+	const n = Number(s);
+	return Number.isFinite(n) ? n : null;
+}
+/** A single-quoted string literal, with `''` unescaped. */
+function asStringLiteral(input) {
+	const s = stripCasts(input);
+	if (!s.startsWith("'") || !s.endsWith("'") || s.length < 2) return null;
+	const body = s.slice(1, -1);
+	if (/(^|[^'])'($|[^'])/.test(body)) return null;
+	return body.replace(/''/g, "'");
+}
+/** The element list of `ARRAY[…]`, or of a parenthesised `IN (…)` list. */
+function asValueList(input) {
+	const s = stripCasts(input);
+	const arrayMatch = s.match(/^ARRAY\s*\[(.*)\]$/is);
+	const body = arrayMatch ? arrayMatch[1] : s.startsWith("(") && s.endsWith(")") ? s.slice(1, -1) : null;
+	if (body === null) return null;
+	if (body.trim() === "") return null;
+	const values = [];
+	for (const element of splitTopLevel(body, ",")) {
+		const literal = asStringLiteral(element);
+		if (literal !== null) {
+			values.push(literal);
+			continue;
+		}
+		const numeric = asNumber(element);
+		if (numeric !== null) {
+			values.push(String(numeric));
+			continue;
+		}
+		return null;
+	}
+	return values;
+}
+/**
+* Parses one conjunct. Returns null when the shape is not one of the few this
+* understands, which is the signal to abandon the whole constraint.
+*/
+function parseTerm(rawTerm) {
+	const term = unwrapParens(rawTerm);
+	const anyMatch = term.match(/^(.*?)\s*=\s*ANY\s*(\(.*\))$/is);
+	const inMatch = anyMatch ? null : term.match(/^(.*?)\s+IN\s*(\(.*\))$/is);
+	const membership = anyMatch ?? inMatch;
+	if (membership) {
+		const column = asColumnName(membership[1]);
+		const values = asValueList(membership[2]);
+		if (!column || !values || values.length === 0) return null;
+		return {
+			column,
+			apply: (facts) => {
+				facts.enumValues = facts.enumValues ? facts.enumValues.filter((v) => values.includes(v)) : values;
+			}
+		};
+	}
+	for (const operator of [
+		">=",
+		"<=",
+		"<>",
+		"!=",
+		"=",
+		">",
+		"<"
+	]) {
+		const parts = splitTopLevel(term, operator);
+		if (parts.length !== 2) continue;
+		const [rawLeft, rawRight] = parts;
+		const lengthColumn = asLengthOfColumn(rawLeft);
+		if (lengthColumn) {
+			const bound = asNumber(rawRight);
+			if (bound === null) return null;
+			switch (operator) {
+				case ">=": return {
+					column: lengthColumn,
+					apply: (f) => {
+						f.lengthMin = Math.max(f.lengthMin ?? bound, bound);
+					}
+				};
+				case ">": return {
+					column: lengthColumn,
+					apply: (f) => {
+						f.lengthMin = Math.max(f.lengthMin ?? bound + 1, bound + 1);
+					}
+				};
+				case "<=": return {
+					column: lengthColumn,
+					apply: (f) => {
+						f.lengthMax = Math.min(f.lengthMax ?? bound, bound);
+					}
+				};
+				case "<": return {
+					column: lengthColumn,
+					apply: (f) => {
+						f.lengthMax = Math.min(f.lengthMax ?? bound - 1, bound - 1);
+					}
+				};
+				case "=": return {
+					column: lengthColumn,
+					apply: (f) => {
+						f.lengthMin = bound;
+						f.lengthMax = bound;
+					}
+				};
+				default: return null;
+			}
+		}
+		const column = asColumnName(rawLeft);
+		if (!column) continue;
+		if (operator === "=") {
+			const literal = asStringLiteral(rawRight);
+			if (literal !== null) return {
+				column,
+				apply: (facts) => {
+					facts.enumValues = facts.enumValues ? facts.enumValues.filter((v) => v === literal) : [literal];
+				}
+			};
+			const pinned = asNumber(rawRight);
+			if (pinned === null) return null;
+			return {
+				column,
+				apply: (f) => {
+					f.min = pinned;
+					f.max = pinned;
+				}
+			};
+		}
+		const bound = asNumber(rawRight);
+		if (bound === null) return null;
+		switch (operator) {
+			case ">=": return {
+				column,
+				apply: (f) => {
+					f.min = Math.max(f.min ?? bound, bound);
+				}
+			};
+			case ">": return {
+				column,
+				apply: (f) => {
+					f.moreThan = Math.max(f.moreThan ?? bound, bound);
+				}
+			};
+			case "<=": return {
+				column,
+				apply: (f) => {
+					f.max = Math.min(f.max ?? bound, bound);
+				}
+			};
+			case "<": return {
+				column,
+				apply: (f) => {
+					f.lessThan = Math.min(f.lessThan ?? bound, bound);
+				}
+			};
+			default: return null;
+		}
+	}
+	return null;
+}
+/**
+* Reads one constraint definition into per-column facts.
+*
+* Returns an empty map for anything not understood — including a constraint
+* that is understood but spans two columns (`start_date < end_date`), which no
+* per-property validation rule can express.
+*/
+function parseCheckDefinition(definition) {
+	const result = /* @__PURE__ */ new Map();
+	const body = definition.trim().replace(/\s+NOT\s+VALID\s*$/i, "").replace(/^CHECK\s*/i, "").trim();
+	if (body === definition.trim()) return result;
+	const expression = unwrapParens(body);
+	if (!expression) return result;
+	if (splitTopLevel(expression, " OR ").length > 1) return result;
+	const terms = splitTopLevel(expression, " AND ");
+	const parsed = [];
+	for (const term of terms) {
+		const one = parseTerm(term);
+		if (!one) return result;
+		parsed.push(one);
+	}
+	if (new Set(parsed.map((t) => t.column)).size !== 1) return result;
+	const facts = {};
+	for (const term of parsed) term.apply(facts);
+	if (Object.keys(facts).length === 0) return result;
+	result.set(parsed[0].column, facts);
+	return result;
+}
+/** Merges every readable CHECK in the schema into per-table, per-column facts. */
+function parseCheckConstraints(rows) {
+	const byTable = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const parsed = parseCheckDefinition(row.definition);
+		if (parsed.size === 0) continue;
+		let table = byTable.get(row.table_name);
+		if (!table) {
+			table = /* @__PURE__ */ new Map();
+			byTable.set(row.table_name, table);
+		}
+		for (const [column, facts] of parsed) {
+			const existing = table.get(column);
+			if (!existing) {
+				table.set(column, facts);
+				continue;
+			}
+			if (facts.enumValues) existing.enumValues = existing.enumValues ? existing.enumValues.filter((v) => facts.enumValues.includes(v)) : facts.enumValues;
+			if (facts.min !== void 0) existing.min = Math.max(existing.min ?? facts.min, facts.min);
+			if (facts.max !== void 0) existing.max = Math.min(existing.max ?? facts.max, facts.max);
+			if (facts.moreThan !== void 0) existing.moreThan = Math.max(existing.moreThan ?? facts.moreThan, facts.moreThan);
+			if (facts.lessThan !== void 0) existing.lessThan = Math.min(existing.lessThan ?? facts.lessThan, facts.lessThan);
+			if (facts.lengthMin !== void 0) existing.lengthMin = Math.max(existing.lengthMin ?? facts.lengthMin, facts.lengthMin);
+			if (facts.lengthMax !== void 0) existing.lengthMax = Math.min(existing.lengthMax ?? facts.lengthMax, facts.lengthMax);
+		}
+	}
+	return byTable;
+}
+//#endregion
+//#region src/schema/introspect-db.ts
+async function main() {
+	const args = (0, import_arg.default)({
+		"--output": String,
+		"--collections": String,
+		"--force": Boolean,
+		"--schema": String,
+		"--data-inference": Boolean,
+		"--no-data-inference": Boolean,
+		"-o": "--output",
+		"-c": "--collections",
+		"-f": "--force"
+	}, { permissive: true });
+	const cwd = process.cwd();
+	const defaultOutDir = path.basename(cwd) === "backend" ? path.resolve(cwd, "..", "config", "collections") : path.resolve(cwd, "config", "collections");
+	const outDir = args["--output"] || args["--collections"] || defaultOutDir;
+	const force = args["--force"] || false;
+	const pgSchema = args["--schema"] || "public";
+	if (!fs.existsSync(outDir)) fs.mkdirSync(outDir, { recursive: true });
+	const envPaths = [
+		process.env.DOTENV_CONFIG_PATH,
+		path.resolve(process.cwd(), ".env"),
+		path.resolve(process.cwd(), "../.env"),
+		path.resolve(process.cwd(), "../../.env")
+	].filter(Boolean);
+	for (const p of envPaths) if (fs.existsSync(p)) {
+		dotenv.config({
+			path: p,
+			quiet: true
+		});
+		break;
+	}
+	const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;
+	if (!databaseUrl) {
+		outError(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
+		process.exit(1);
+	}
+	const client = new pg.Client({ connectionString: databaseUrl });
+	try {
+		await client.connect();
+	} catch (err) {
+		outError(chalk.red(`✗ Failed to connect to database: ${err instanceof Error ? err.message : String(err)}`));
+		outError(chalk.gray("  Check your DATABASE_URL and ensure the database is reachable."));
+		process.exit(1);
+	}
+	const hostPart = safeHostFromUrl(databaseUrl);
+	out(chalk.gray(`Connected to database: ${hostPart}`));
+	out(chalk.gray(`Introspecting schema '${pgSchema}'...`));
+	try {
+		const metadata = await readSchemaMetadata(client, pgSchema);
+		const enumMap = buildEnumMap(metadata.enumValues);
+		const tablesMap = buildTablesMap(metadata.tables, metadata.columns, metadata.pks, metadata.fks);
+		const fks = metadata.fks;
+		for (const table of lookupCandidates(metadata, tablesMap)) try {
+			metadata.rowCounts[table] = await countRowsUpTo(client, pgSchema, table, 50);
+		} catch (err) {
+			out(chalk.gray(`  (skipped row count for ${table}: ${err instanceof Error ? err.message : String(err)})`));
+		}
+		const classifications = classifyTables(metadata, tablesMap);
+		const checkFacts = parseCheckConstraints(metadata.checks);
+		const builder = detectCollectionBuilder(outDir);
+		if (builder === "annotation") {
+			outWarn(chalk.yellow(`⚠ Neither @rebasepro/cms-types nor @rebasepro/common is declared above ${outDir}.`));
+			outWarn(chalk.gray("  Generating plain type annotations, which widen the property keys to `string`: `propertiesOrder` and friends will not be checked. Add @rebasepro/common to the config package to turn that checking on."));
+		}
+		const joinTables = new Set(Array.from(classifications.values()).filter((c) => c.role === "junction").map((c) => c.table));
+		const roleCount = (role) => Array.from(classifications.values()).filter((c) => c.role === role).length;
+		out(chalk.blue(`Found ${tablesMap.size} tables.`));
+		out(chalk.gray(`  ${roleCount("entity")} entities, ${joinTables.size} join tables (folded into relations), ${roleCount("lookup")} code lists, ${roleCount("owned-child")} owned by another table (hidden from navigation).`));
+		let runDataInference = false;
+		if (args["--no-data-inference"]) runDataInference = false;
+		else if (args["--data-inference"] !== void 0) runDataInference = args["--data-inference"];
+		else if (!process.stdin.isTTY) out(chalk.gray("Skipping data inference (non-interactive run; pass --data-inference to enable)."));
+		else {
+			const rl = import___vite_browser_external.default.createInterface({
+				input: process.stdin,
+				output: process.stdout
+			});
+			runDataInference = (await new Promise((resolve) => rl.question(chalk.yellow("? Do you want to run comprehensive data inference on sampled rows to auto-detect types, formats, constraints, and UI configurations? (y/N) "), resolve))).trim().toLowerCase() === "y";
+			rl.close();
+		}
+		if (runDataInference) out(chalk.gray("Sampling database rows for data inference..."));
+		const generatedFiles = [];
+		const skippedFiles = [];
+		const tablesToProcess = Array.from(tablesMap.entries()).filter(([tableName]) => !joinTables.has(tableName));
+		const BATCH_SIZE = 10;
+		for (let i = 0; i < tablesToProcess.length; i += BATCH_SIZE) {
+			const batch = tablesToProcess.slice(i, i + BATCH_SIZE);
+			await Promise.all(batch.map(async ([tableName, meta]) => {
+				if (!isUsableFileName(tableName)) {
+					outWarn(chalk.yellow(`⚠ Skipping table ${JSON.stringify(tableName)}: its name cannot be used as a filename. Rename the table, or write this collection by hand.`));
+					skippedFiles.push(tableName);
+					return;
+				}
+				const filePath = path.join(outDir, `${tableName}.ts`);
+				if (fs.existsSync(filePath) && !force) {
+					skippedFiles.push(tableName);
+					return;
+				}
+				let sampleData = void 0;
+				if (runDataInference) try {
+					const { rows } = await client.query(`SELECT * FROM ${quoteRelation(pgSchema, tableName)} LIMIT 100`);
+					sampleData = rows;
+				} catch (err) {
+					outError(chalk.yellow(`⚠ Failed to sample data for table ${tableName}: ${err instanceof Error ? err.message : String(err)}`));
+				}
+				const fileContent = generateCollectionFile(tableName, meta, fks, joinTables, tablesMap, enumMap, sampleData, {
+					metadata,
+					classifications,
+					checkFacts,
+					builder
+				});
+				fs.writeFileSync(filePath, fileContent, "utf-8");
+				generatedFiles.push(tableName);
+				out(chalk.green(`  ✓ ${filePath}`));
+			}));
+		}
+		if (generatedFiles.length > 0) {
+			const indexPath = path.join(outDir, "index.ts");
+			if (fs.existsSync(indexPath) && !force) {
+				const merged = mergeIndexContent(fs.readFileSync(indexPath, "utf-8"), generatedFiles);
+				fs.writeFileSync(indexPath, merged, "utf-8");
+			} else {
+				const siblings = fs.readdirSync(outDir).filter((f) => f.endsWith(".ts") && f !== "index.ts").map((f) => f.replace(/\.ts$/, ""));
+				const indexContent = generateIndexContent([.../* @__PURE__ */ new Set([...generatedFiles, ...siblings])]);
+				fs.writeFileSync(indexPath, indexContent, "utf-8");
+			}
+			out(chalk.green(`  ✓ ${indexPath}`));
+		}
+		out("");
+		if (skippedFiles.length > 0) {
+			out(chalk.yellow(`⚠ Skipped ${skippedFiles.length} existing file(s): ${skippedFiles.join(", ")}`));
+			out(chalk.gray("  Use --force to overwrite existing files."));
+			out("");
+		}
+		out(chalk.bold.green(`✓ Introspected ${tablesMap.size} tables — generated ${generatedFiles.length} collection(s).`));
+		out(chalk.gray(`  Review the generated files in ${outDir} and customize properties as needed.`));
+		out("");
+	} catch (e) {
+		outError(chalk.red(`✗ Error introspecting database: ${e instanceof Error ? e.message : String(e)}`));
+		process.exit(1);
+	} finally {
+		await client.end();
+	}
+}
+main().catch((err) => {
+	outError(String(err));
+	process.exit(1);
+});
+//#endregion
+
+//# sourceMappingURL=introspect-db.js.map