@rebasepro/server-postgres 0.25.0 → 0.26.0

package/dist/{doctor-DvJH-IQG.js → doctor-DW_mlTzz.js}

@@ -1,18 +1,20 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { n as __exportAll } from "./rolldown-runtime-V7rFbMRe.js";
-import { a as diagnoseDbError, r as deepestErrorMessage, u as parseHostInfo } from "./cli-errors-DwQnNATs.js";
-import { i as outError, r as out, t as chalk } from "./source-Bv5KPeIx.js";
-import { n as planSchema, t as columnPgType } from "./plan-schema-CXOucCw-.js";
-import { t as generateSchema } from "./generate-drizzle-schema-logic-DA3zM8zc.js";
-import { r as renderPgType } from "./render-ddl-CQNwZdse.js";
-import { n as describeDeclarationDifferences, t as compareGeneratedDeclarations } from "./generated-schema-staleness-FlxM2i4i.js";
+import { i as __exportAll } from "./cli-prompt-DXG0yk-h.js";
+import { a as diagnoseDbError, r as deepestErrorMessage, u as parseHostInfo } from "./cli-errors-DsYyNYzd.js";
+import { i as outError, r as out, t as chalk } from "./source-fZb92pN8.js";
+import { n as planSchema, t as columnPgType } from "./plan-schema-Czf3q4-Q.js";
+import { t as generateSchema } from "./generate-drizzle-schema-logic-CPzCRD-8.js";
+import { r as renderPgType } from "./render-ddl-4v88y-Gv.js";
+import { r as readGeneratedSchemaDrift, t as describeSchemaDifference } from "./generated-schema-diff-eZCklRZQ.js";
+import { n as describeDeclarationDifferences, t as compareGeneratedDeclarations } from "./generated-schema-staleness-BvNF3i-s.js";
 import { loadCollectionsFromDirectory } from "@rebasepro/server";
-import { computeSchemaVersion, getDeclaredSubcollections, isManyToMany, isPostgresCollectionConfig } from "@rebasepro/types";
-import { effectiveAccess, fieldKeyForColumn, findRelation, getTableName, isRelationRequired, relationalCollections, resolveCollectionRelations, resolveJunctionSpecs, sortCollectionsBySlug, toCollectionAccessor, toSafeIdentifier } from "@rebasepro/common";
+import { DEFAULT_DATA_SOURCE_KEY, computeSchemaVersion, getDeclaredSubcollections, isManyToMany, isPostgresCollectionConfig } from "@rebasepro/types";
+import { effectiveAccess, fieldKeyForColumn, findRelation, getTableName, isRelationRequired, relationalCollections, resolveCollectionRelations, resolveJunctionSpecs, restrictedFieldNames, sortCollectionsBySlug, toCollectionAccessor, toSafeIdentifier } from "@rebasepro/common";
 import { toPostgresIdentifier, toSnakeCase } from "@rebasepro/utils";
 import * as fs$1 from "fs";
 import { promises } from "fs";
+import { pathToFileURL } from "url";
 //#region ../codegen/dist/index.es.js
 /**
 * A schema that cannot be expressed as a valid TypeScript file.
@@ -234,20 +236,40 @@ function line(key, type, optional) {
 * reader who holds `hr` and one who does not. The server is the enforcement
 * point; the types describe the surface a caller may name.
 *
-* Keyed by the property name *and* by its column name, the same pair the
-* server's `stripUnreadable` deletes, so a foreign key or a relation addressed
-* under the column name cannot put the property back.
+* Every spelling the server restricts, read from the server's own function
+* (`restrictedFieldNames`): the property name, its column name, and — for a
+* closed to-one relation — the foreign key that names the same row. Keying on
+* the property and column alone, which this used to, kept `authorId` on all
+* three types for an `excludeFromApi` `author`, though the server strips it
+* from every read and refuses it on every write.
 */
-function excludedApiKeys(properties) {
-	const excluded = /* @__PURE__ */ new Set();
-	for (const [key, rawProp] of Object.entries(properties)) {
-		const prop = rawProp;
-		const access = effectiveAccess(prop);
-		if (access?.read?.length !== 0 || access?.write?.length !== 0) continue;
-		excluded.add(key);
-		if (prop.columnName) excluded.add(prop.columnName);
+function excludedApiKeys(collection) {
+	const unreadable = closedNames(collection, "read");
+	const unwritable = closedNames(collection, "write");
+	return new Set([...unreadable].filter((name) => unwritable.has(name)));
+}
+/**
+* The names nobody may read (or write), as the server judges them: no viewer
+* is the trusted plane, which every role-naming rule admits, so what is left
+* is exactly the empty rules.
+*
+* `restrictedFieldNames` resolves the relations of a closed relation property
+* to find its foreign key. When those cannot be resolved — already warned
+* about by the caller — the property and column names are still closed.
+*/
+function closedNames(collection, kind) {
+	try {
+		return restrictedFieldNames(collection, void 0, kind).refused;
+	} catch {
+		const names = /* @__PURE__ */ new Set();
+		for (const [key, rawProp] of Object.entries(collection.properties ?? {})) {
+			const prop = rawProp;
+			if (effectiveAccess(prop)?.[kind]?.length !== 0) continue;
+			names.add(key);
+			if (prop.columnName) names.add(prop.columnName);
+		}
+		return names;
 	}
-	return excluded;
 }
 /**
 * The keys nobody may write: `access: { write: [] }`, readable or not.
@@ -259,17 +281,11 @@ function excludedApiKeys(properties) {
 * generated `create({ computed })` compiled and could only ever be a 400.
 *
 * A write rule naming *roles* is not this: some caller can write it, and one
-* generated shape cannot say which.
+* generated shape cannot say which. A closed to-one relation's foreign key is:
+* the server refuses `reviewerId` exactly as it refuses `reviewer`.
 */
-function unwritableKeys(properties) {
-	const unwritable = /* @__PURE__ */ new Set();
-	for (const [key, rawProp] of Object.entries(properties)) {
-		const prop = rawProp;
-		if (effectiveAccess(prop)?.write?.length !== 0) continue;
-		unwritable.add(key);
-		if (prop.columnName) unwritable.add(prop.columnName);
-	}
-	return unwritable;
+function unwritableKeys(collection) {
+	return closedNames(collection, "write");
 }
 function generateTypedefs(input) {
 	const collections = sortCollectionsBySlug(input);
@@ -301,7 +317,7 @@ function generateTypedefs(input) {
 		lines.push(`  ${emitKey(accessors.get(collection.slug))}: {`);
 		lines.push("    Row: {");
 		const emittedKeys = /* @__PURE__ */ new Set();
-		const excluded = excludedApiKeys(properties);
+		const excluded = excludedApiKeys(collection);
 		for (const key of excluded) emittedKeys.add(key);
 		for (const [key, rawProp] of Object.entries(properties)) {
 			const prop = rawProp;
@@ -335,7 +351,7 @@ function generateTypedefs(input) {
 		}
 		lines.push("    };");
 		lines.push("    Insert: {");
-		const notWritable = /* @__PURE__ */ new Set([...excluded, ...unwritableKeys(properties)]);
+		const notWritable = /* @__PURE__ */ new Set([...excluded, ...unwritableKeys(collection)]);
 		emittedKeys.clear();
 		for (const key of notWritable) emittedKeys.add(key);
 		for (const [key, rawProp] of Object.entries(properties)) {
@@ -347,8 +363,8 @@ function generateTypedefs(input) {
 			lines.push(line(key, writableType(prop, tsType), isOptional));
 			emittedKeys.add(key);
 		}
-		emitWritableRelations(lines, collection, properties, resolvedRelations, emittedKeys, false);
-		lines.push("    };");
+		const eitherSpelling = emitWritableRelations(lines, collection, properties, resolvedRelations, emittedKeys, false);
+		lines.push(eitherSpelling.length === 0 ? "    };" : `    } & ${eitherSpelling.join(" & ")};`);
 		lines.push("    Update: {");
 		emittedKeys.clear();
 		for (const key of notWritable) emittedKeys.add(key);
@@ -362,14 +378,15 @@ function generateTypedefs(input) {
 		}
 		emitWritableRelations(lines, collection, properties, resolvedRelations, emittedKeys, true);
 		lines.push("    };");
-		if (Object.keys(resolvedRelations).length === 0) lines.push("    Relations: Record<never, never>;");
+		const includable = Object.entries(resolvedRelations).filter(([key]) => !excluded.has(key));
+		if (includable.length === 0) lines.push("    Relations: Record<never, never>;");
 		else lines.push("    Relations: {");
-		for (const [key, relation] of Object.entries(resolvedRelations)) {
+		for (const [key, relation] of includable) {
 			const slug = resolveTargetCollection(relation)?.slug ?? relation.targetSlug;
 			const accessor = slug ? accessors.get(slug) : void 0;
 			lines.push(`      ${emitKey(key)}: ${accessor ? emitString(accessor) : "never"};`);
 		}
-		if (Object.keys(resolvedRelations).length > 0) lines.push("    };");
+		if (includable.length > 0) lines.push("    };");
 		lines.push(`    Slug: ${emitString(collection.slug)};`);
 		lines.push("  };");
 	}
@@ -489,14 +506,38 @@ function includeHelperLines() {
 * finds there is one. A relation whose `relationName` differs from its property
 * key is reachable as the property and not as the name, so emitting the name
 * would have offered a key that writes to a column that does not exist.
+*
+* A **required** `belongsTo` is satisfied by either spelling — the server's
+* required check reads both (`write-validation.ts`). Emitting each name as a
+* required key made a create name the same row twice to compile. So on an
+* `Insert` both names go in optional, and the requirement comes back as one
+* returned `({ authorId: T } | { author: T })` for the caller to intersect
+* with the object. Both stay in the object so `keyof Insert` still names them.
 */
 function emitWritableRelations(lines, collection, properties, resolvedRelations, emittedKeys, allOptional) {
+	const spellings = /* @__PURE__ */ new Map();
+	const addSpelling = (relation, key) => {
+		if (emittedKeys.has(key)) return;
+		const keys = spellings.get(relation) ?? [];
+		if (!keys.includes(key)) keys.push(key);
+		spellings.set(relation, keys);
+	};
+	for (const relation of Object.values(resolvedRelations)) if (relation.kind === "belongsTo" && relation.localKey) addSpelling(relation, fieldKeyForColumn(collection, relation.localKey));
+	for (const [key, rawProp] of Object.entries(properties)) {
+		if (rawProp.type !== "relation") continue;
+		const relation = findRelation(resolvedRelations, key);
+		if (relation?.kind === "belongsTo" && relation.localKey) addSpelling(relation, key);
+	}
+	const eitherSpelling = [];
 	const emit = (key, relation) => {
 		if (emittedKeys.has(key)) return;
 		const required = isRelationRequired(collection, relation);
 		const type = required ? foreignKeyType(relation) : `${foreignKeyType(relation)} | null`;
-		lines.push(line(key, type, allOptional || !required));
+		const names = spellings.get(relation) ?? [key];
+		const oneOfSeveral = required && !allOptional && names.length > 1;
+		lines.push(line(key, type, allOptional || !required || oneOfSeveral));
 		emittedKeys.add(key);
+		if (oneOfSeveral && names[0] === key) eitherSpelling.push(`(${names.map((name) => `{ ${emitKey(name)}: ${type} }`).join(" | ")})`);
 	};
 	for (const relation of Object.values(resolvedRelations)) if (relation.kind === "belongsTo" && relation.localKey) emit(fieldKeyForColumn(collection, relation.localKey), relation);
 	for (const [key, rawProp] of Object.entries(properties)) {
@@ -504,6 +545,14 @@ function emitWritableRelations(lines, collection, properties, resolvedRelations,
 		const relation = findRelation(resolvedRelations, key);
 		if (relation?.kind === "belongsTo" && relation.localKey) emit(key, relation);
 	}
+	for (const [key, rawProp] of Object.entries(properties)) {
+		if (rawProp.type !== "relation" || emittedKeys.has(key)) continue;
+		const relation = findRelation(resolvedRelations, key);
+		const toOneWritable = relation?.kind === "hasOne" || relation?.kind === "via" && relation.cardinality === "one" && relation.writable;
+		if (!relation || !toOneWritable) continue;
+		lines.push(line(key, `${foreignKeyType(relation)} | null`, true));
+		emittedKeys.add(key);
+	}
 	for (const [key, relation] of Object.entries(resolvedRelations)) {
 		if (relation.cardinality !== "many" || !relation.writable) continue;
 		if (emittedKeys.has(key)) continue;
@@ -513,6 +562,7 @@ function emitWritableRelations(lines, collection, properties, resolvedRelations,
 		lines.push(line(key, `Array<${element}>`, true));
 		emittedKeys.add(key);
 	}
+	return eitherSpelling;
 }
 /**
 * The `_pivot` a many-to-many link carries: the junction's payload columns,
@@ -545,6 +595,7 @@ var doctor_exports = /* @__PURE__ */ __exportAll({
 	checkCollectionsVsDatabase: () => checkCollectionsVsDatabase,
 	checkCollectionsVsSchema: () => checkCollectionsVsSchema,
 	checkCollectionsVsSdk: () => checkCollectionsVsSdk,
+	generatedSchemaDriftIssues: () => generatedSchemaDriftIssues,
 	getExpectedColumnType: () => getExpectedColumnType,
 	junctionKeyIssues: () => junctionKeyIssues,
 	loadCollections: () => loadCollections,
@@ -860,7 +911,63 @@ function junctionKeyIssues(junctionPlan, dbColumns, dbPk, displayName) {
 	issues.push(...primaryKeyIssues(junctionPlan, dbPk, displayName));
 	return issues;
 }
-async function checkCollectionsVsDatabase(collections, databaseUrl) {
+/** A table as the other issues name it: bare in `public`, `schema.table` elsewhere. */
+function displayTableOf(difference, collections) {
+	const collection = difference.collection ? collections.find((c) => c.slug === difference.collection) : void 0;
+	const schema = collection && isPostgresCollectionConfig(collection) ? collection.schema : void 0;
+	return schema && schema !== "public" ? `${schema}.${difference.table}` : difference.table;
+}
+/** Which of the doctor's own categories already says what a boot difference says. */
+var COVERING_CATEGORY = {
+	"missing-table": "missing_table",
+	"missing-column": "missing_column",
+	type: "type_mismatch",
+	nullability: "nullability_mismatch",
+	"extra-column": "extra_column"
+};
+/** What to do about one boot difference, said the way the boot warning says it. */
+function generatedDriftFix(difference) {
+	switch (difference.kind) {
+		case "nullability": return difference.generated === "NOT NULL" ? "`rebase db push` applies it; a NOT NULL needs every row filled first (UPDATE the empty ones, or give the property a default). Boot adds one only with a new column on an empty table. If the collections changed since schema.generated.ts was written, run `rebase schema generate` first." : "`rebase db push` drops the NOT NULL, which boot never does. If the column should stay required, mark the property `validation: { required: true }`. If the collections changed since schema.generated.ts was written, run `rebase schema generate` first.";
+		case "extra-column": return "Boot never drops a column, so its data is still there. `rebase db push` removes it (it asks first, since that deletes the data), or a migration does (`rebase db generate`). If a property should still read it, declare it again. If the collections changed since schema.generated.ts was written, run `rebase schema generate` first.";
+		case "type": return "`rebase db push` converts it (it asks first when values may not convert), or a migration does. If the collections changed since schema.generated.ts was written, run `rebase schema generate` first.";
+		case "missing-column": return "`rebase db push` adds it. If the collections changed since schema.generated.ts was written, run `rebase schema generate` first.";
+		case "missing-table": return "Run `rebase db push` or `rebase db generate && rebase db migrate`";
+	}
+}
+/**
+* Boot's drift warnings, as doctor issues — one per difference, in boot's own
+* words ({@link describeSchemaDifference}), and a warning, as boot raises them.
+*
+* Except where an issue the collections-side checks above already raised says
+* the same thing: a missing table, a missing column or a type mismatch on the
+* same column. Nullability and columns no collection declares are boot's alone;
+* the doctor never compared them, which is how it came to say "In sync" beside
+* a boot that had just warned about both.
+*/
+function generatedSchemaDriftIssues(differences, already, collections) {
+	const bare = (table) => table?.split(".").pop();
+	const covered = (difference) => already.some((issue) => issue.category === COVERING_CATEGORY[difference.kind] && bare(issue.table) === difference.table && (difference.kind === "missing-table" || issue.column === difference.column));
+	return differences.filter((difference) => !covered(difference)).map((difference) => ({
+		severity: "warning",
+		category: COVERING_CATEGORY[difference.kind],
+		table: displayTableOf(difference, collections),
+		...difference.column ? { column: difference.column } : {},
+		...difference.generated ? { expected: difference.generated } : {},
+		...difference.live ? { actual: difference.live } : {},
+		message: describeSchemaDifference(difference),
+		fix: generatedDriftFix(difference)
+	}));
+}
+/**
+* The collections whose tables the default database holds — the filter boot
+* applies before it reads the catalogue, for the same reason: a collection
+* routed to `database("analytics")` has no table here.
+*/
+function defaultSourceCollections(collections) {
+	return collections.filter((c) => !c.dataSource || c.dataSource === DEFAULT_DATA_SOURCE_KEY);
+}
+async function checkCollectionsVsDatabase(collections, databaseUrl, options = {}) {
 	const issues = [];
 	const pgModule = await import("pg");
 	const { Pool } = pgModule.default ?? pgModule;
@@ -1099,6 +1206,15 @@ async function checkCollectionsVsDatabase(collections, databaseUrl) {
 			}
 		}
 		if (plan) issues.push(...orphanedJunctionIssues(plan, columnsByTable, pksByTable, fksByTable));
+		if (options.generated) {
+			const differences = await readGeneratedSchemaDrift({
+				client: pool,
+				generated: options.generated,
+				collections: defaultSourceCollections(collections),
+				defaultSchema: "public"
+			});
+			issues.push(...generatedSchemaDriftIssues(differences, issues, collections));
+		}
 	} finally {
 		await pool.end();
 	}
@@ -1221,6 +1337,8 @@ function formatCategory(cat) {
 		missing_table: "Missing Table",
 		missing_column: "Missing Column",
 		type_mismatch: "Type Mismatch",
+		nullability_mismatch: "Nullability Mismatch",
+		extra_column: "Extra Column",
 		missing_constraint: "Missing Constraint",
 		primary_key_mismatch: "Primary Key Mismatch",
 		schema_stale: "Stale Schema",
@@ -1233,6 +1351,22 @@ function formatCategory(cat) {
 		sdk_ungeneratable: "SDK Cannot Be Generated"
 	}[cat];
 }
+var isRecord = (value) => typeof value === "object" && value !== null;
+/**
+* The `tables` export of `schema.generated.ts`, imported as boot imports it.
+*
+* Nothing, and no error, when the file is not there: phase 1 reports that, and
+* boot then has nothing to compare either.
+*/
+async function loadGeneratedTables(schemaPath) {
+	if (!fs$1.existsSync(schemaPath)) return {};
+	try {
+		const module = await import(pathToFileURL(schemaPath).href);
+		return isRecord(module) && isRecord(module.tables) ? { tables: module.tables } : {};
+	} catch (err) {
+		return { error: err instanceof Error ? err.message : String(err) };
+	}
+}
 async function runDoctor(options) {
 	out();
 	out(chalk.bold("  🩺 Loading collections..."));
@@ -1249,7 +1383,17 @@ async function runDoctor(options) {
 	if (options.databaseUrl) {
 		out(chalk.gray("  Checking Collections → Database..."));
 		try {
-			schemaToDatabase = await checkCollectionsVsDatabase(collections, options.databaseUrl);
+			const generated = await loadGeneratedTables(options.schemaPath);
+			schemaToDatabase = await checkCollectionsVsDatabase(collections, options.databaseUrl, { generated: generated.tables });
+			if (generated.error) {
+				schemaToDatabase.issues.push({
+					severity: "warning",
+					category: "schema_stale",
+					message: `schema.generated.ts could not be loaded, so it was not compared against the database as boot compares it: ${generated.error}`,
+					fix: "Run `rebase schema generate`, then `rebase doctor` again"
+				});
+				schemaToDatabase.passed = false;
+			}
 		} catch (err) {
 			const banner = diagnoseDbError(err, options.databaseUrl);
 			if (banner) outError(banner);
@@ -1297,4 +1441,4 @@ async function runDoctor(options) {
 //#endregion
 export { loadCollections as n, runDoctor as r, doctor_exports as t };
 
-//# sourceMappingURL=doctor-DvJH-IQG.js.map
+//# sourceMappingURL=doctor-DW_mlTzz.js.map