@rebasepro/server-postgresql 0.6.1 → 0.7.0

package/src/schema/generate-postgres-ddl.ts

@@ -0,0 +1,116 @@
+import { promises as fsPromises } from "fs";
+import * as fs from "fs";
+import path from "path";
+import { pathToFileURL } from "url";
+import chokidar from "chokidar";
+import { generatePostgresDdl, generatePostgresPoliciesDdl } from "./generate-postgres-ddl-logic";
+import { EntityCollection } from "@rebasepro/types";
+import { logger } from "@rebasepro/server-core";
+
+
+const runGeneration = async (collectionsFilePath?: string, outputPath?: string) => {
+    try {
+        if (!collectionsFilePath) {
+            logger.error("Error: No collections file path provided. Skipping schema generation.");
+            return;
+        }
+
+        const resolvedPath = path.resolve(collectionsFilePath);
+        let collections: EntityCollection[] = [];
+        const stats = fs.statSync(resolvedPath);
+
+        if (stats.isDirectory()) {
+            const files = fs.readdirSync(resolvedPath);
+            for (const file of files) {
+                if ((file.endsWith(".ts") || file.endsWith(".js")) &&
+                    !file.includes(".test.") &&
+                    !file.endsWith(".d.ts") &&
+                    file !== "index.ts" && file !== "index.js") {
+
+                    const filePath = path.join(resolvedPath, file);
+                    try {
+                        const fileUrl = pathToFileURL(filePath).href;
+                        const module = await import(fileUrl);
+                        if (module && module.default) {
+                            collections.push(module.default);
+                        }
+                    } catch (err: unknown) {
+                        const message = err instanceof Error ? err.message : String(err);
+                        logger.error(`Error loading ${file}`, { detail: message });
+                    }
+                }
+            }
+        } else {
+            const fileUrl = pathToFileURL(resolvedPath).href + `?t=${Date.now()}`;
+            const imported = await import(fileUrl);
+            collections = imported.backendCollections || imported.collections;
+        }
+
+        if (!collections || !Array.isArray(collections)) {
+            collections = [];
+        }
+
+        // Sort collections by slug alphabetically to ensure deterministic DDL generation
+        collections.sort((a, b) => a.slug.localeCompare(b.slug));
+
+        const ddlContent = await generatePostgresDdl(collections, { includePolicies: false });
+        const policiesContent = generatePostgresPoliciesDdl(collections);
+
+        if (outputPath) {
+            const outputDir = path.dirname(outputPath);
+            await fsPromises.mkdir(outputDir, { recursive: true });
+            await fsPromises.writeFile(outputPath, ddlContent);
+            logger.info(`✅ PostgreSQL DDL generated successfully at ${outputPath}`);
+
+            const policiesPath = path.join(outputDir, "policies.sql");
+            await fsPromises.writeFile(policiesPath, policiesContent);
+            logger.info(`✅ PostgreSQL Policies DDL generated successfully at ${policiesPath}`);
+        } else {
+            logger.info("✅ PostgreSQL DDL generated successfully.");
+            logger.info(String(ddlContent));
+            logger.info("\n✅ PostgreSQL Policies DDL generated successfully.");
+            logger.info(String(policiesContent));
+        }
+
+    } catch (error) {
+        logger.error("Error generating DDL schema", { error: error });
+    }
+};
+
+const main = () => {
+    const collectionsFilePathArg = process.argv.find(arg => arg.startsWith("--collections="));
+    const collectionsFilePath = collectionsFilePathArg ? collectionsFilePathArg.split("=")[1] : process.argv[2];
+
+    const outputPathArg = process.argv.find(arg => arg.startsWith("--output="));
+    const outputPath = outputPathArg ? outputPathArg.split("=")[1] : undefined;
+
+    const watch = process.argv.includes("--watch");
+
+    if (!collectionsFilePath) {
+        logger.info("Usage: ts-node generate-postgres-ddl.ts <path-to-collections-file> [--output <path-to-output-file>] [--watch]");
+        return;
+    }
+
+    const resolvedPath = path.resolve(process.cwd(), collectionsFilePath);
+    const resolvedOutputPath = outputPath ? path.resolve(process.cwd(), outputPath) : undefined;
+
+    if (watch) {
+        logger.info(`Watching for changes in ${resolvedPath}...`);
+        const watcher = chokidar.watch(resolvedPath, {
+            persistent: true,
+            ignoreInitial: false
+        });
+
+        watcher.on("all", (event, filePath) => {
+            logger.info(`[${event}] ${filePath}. Regenerating DDL schema...`);
+            runGeneration(resolvedPath, resolvedOutputPath);
+        });
+    } else {
+        runGeneration(resolvedPath, resolvedOutputPath);
+    }
+};
+
+// This check ensures the script only runs when executed directly
+if (import.meta.url.endsWith(process.argv[1])) {
+    main();
+}

package/src/services/EntityPersistService.ts

@@ -40,19 +40,21 @@ export class EntityPersistService {
         const collection = getCollectionByPath(collectionPath, this.registry);
         const table = getTableForCollection(collection, this.registry);
         const idInfoArray = getPrimaryKeys(collection, this.registry);
-        const idInfo = idInfoArray[0];
-        const idField = table[idInfo.fieldName as keyof typeof table] as AnyPgColumn;
-
-        if (!idField) {
-            throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
-        }
 
         const parsedIdObj = parseIdValues(entityId, idInfoArray);
-        const parsedId = parsedIdObj[idInfo.fieldName];
+
+        const conditions = [];
+        for (const info of idInfoArray) {
+            const field = table[info.fieldName as keyof typeof table] as AnyPgColumn;
+            if (!field) {
+                throw new Error(`ID field '${info.fieldName}' not found in table for collection '${collectionPath}'`);
+            }
+            conditions.push(eq(field, parsedIdObj[info.fieldName]));
+        }
 
         await this.db
             .delete(table)
-            .where(eq(idField, parsedId));
+            .where(and(...conditions));
     }
 
     /**

package/src/services/entityService.ts

@@ -180,12 +180,37 @@ export class EntityService implements EntityRepository {
     /**
      * Execute raw SQL
      */
-    async executeSql(sqlText: string): Promise<Record<string, unknown>[]> {
+    async executeSql(sqlText: string, params?: unknown[]): Promise<Record<string, unknown>[]> {
         if (process.env.NODE_ENV !== "production") {
-            console.debug("Executing raw SQL:", sqlText);
+            console.debug("Executing raw SQL:", sqlText, params?.length ? `with ${params.length} params` : "");
         }
         const { sql } = await import("drizzle-orm");
-        const result = await this.db.execute(sql.raw(sqlText));
+
+        let result;
+        if (params && params.length > 0) {
+            // Build a parameterized query using Drizzle's sql tagged template.
+            // Split the SQL text on $1, $2, … placeholders and interleave
+            // with sql.param() calls so the underlying pg driver binds them safely.
+            const parts = sqlText.split(/\$(\d+)/);
+            const chunks: ReturnType<typeof sql.raw | typeof sql.param>[] = [];
+            for (let i = 0; i < parts.length; i++) {
+                if (i % 2 === 0) {
+                    // Literal SQL text fragment
+                    if (parts[i].length > 0) {
+                        chunks.push(sql.raw(parts[i]));
+                    }
+                } else {
+                    // Parameter reference — $N (1-indexed)
+                    const paramIndex = Number(parts[i]) - 1;
+                    chunks.push(sql.param(params[paramIndex]));
+                }
+            }
+            const query = sql.join(chunks, sql.raw(""));
+            result = await this.db.execute(query);
+        } else {
+            result = await this.db.execute(sql.raw(sqlText));
+        }
+
         const rows = result.rows;
         if (process.env.NODE_ENV !== "production") {
             console.debug(`SQL executed successfully. Returned ${Array.isArray(rows) ? rows.length : "non-array"} rows.`);

package/src/utils/pg-error-utils.ts

@@ -68,6 +68,22 @@ export function extractCauseMessage(error: unknown): string | null {
     return null;
 }
 
+/**
+ * Detect whether an error is specifically a role-switching permission failure
+ * (e.g. "permission denied to set role" or "must be member of role"),
+ * as opposed to a table-level permission denial.
+ *
+ * This is used by the backend driver to auto-disable role switching when the
+ * connection user lacks SET ROLE privileges, rather than surfacing a confusing
+ * error to the Studio SQL Editor user.
+ */
+export function isRoleSwitchingPermissionError(error: unknown): boolean {
+    const pgError = extractPgError(error);
+    if (!pgError || pgError.code !== "42501") return false;
+    const msg = pgError.message.toLowerCase();
+    return msg.includes("set role") || msg.includes("member of role");
+}
+
 /**
  * Translate a raw PostgreSQL error into a user-friendly message.
  *

package/src/utils/table-classification.ts

@@ -0,0 +1,16 @@
+/**
+ * Table Classification Utility
+ *
+ * Re-exports shared classification logic from @rebasepro/common.
+ * This module exists for backward compatibility — prefer importing directly
+ * from @rebasepro/common in new code.
+ */
+export {
+  type TableCategory,
+  REBASE_INTERNAL_SCHEMAS,
+  REBASE_INTERNAL_PREFIXES,
+  classifyTable,
+  isRebaseInternalTable,
+  detectJunctionTables,
+  JUNCTION_TABLES_SQL,
+} from "@rebasepro/common";

package/src/websocket.ts

@@ -403,6 +403,15 @@ colors: true }));
                             if (process.env.NODE_ENV !== "production") {
                                 wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
                             }
+                            const auditSession = clientSessions.get(clientId);
+                            console.log("[SQL Audit] WebSocket SQL execution", JSON.stringify({
+                                sql: typeof sql === "string" ? sql.substring(0, 500) : sql,
+                                options,
+                                resultRows: Array.isArray(result) ? result.length : "unknown",
+                                userId: auditSession?.user?.userId ?? "unknown",
+                                roles: auditSession?.user?.roles ?? [],
+                                isAdmin: auditSession?.user?.isAdmin ?? false,
+                            }));
                             const response = {
                                 type: "EXECUTE_SQL_SUCCESS",
                                 payload: { result },

package/test/auth-default-policies.test.ts

@@ -0,0 +1,89 @@
+import { EntityCollection, PostgresCollection } from "@rebasepro/types";
+import { generatePostgresPoliciesDdl } from "../src/schema/generate-postgres-ddl-logic";
+import { getEffectiveSecurityRules } from "../src/schema/auth-default-policies";
+
+describe("auth collection default RLS policies", () => {
+    const adminWrite = "string_to_array(auth.roles(), ',') && ARRAY['admin']";
+
+    it("injects admin write policies (permissive grant + restrictive gate) when an auth collection has no security rules", () => {
+        const collection: PostgresCollection = {
+            slug: "users",
+            table: "users",
+            name: "Users",
+            auth: true,
+            properties: {
+                id: { type: "string", isId: "uuid" },
+                roles: { type: "array", columnType: "text[]", of: { type: "string" } }
+            }
+        };
+
+        const ddl = generatePostgresPoliciesDdl([collection]);
+
+        expect(ddl).toContain("FORCE ROW LEVEL SECURITY");
+        // Restrictive gate exists for every write op.
+        expect(ddl).toContain("AS RESTRICTIVE FOR INSERT");
+        expect(ddl).toContain("AS RESTRICTIVE FOR UPDATE");
+        expect(ddl).toContain("AS RESTRICTIVE FOR DELETE");
+        expect(ddl).toContain(adminWrite);
+    });
+
+    it("keeps an author's permissive owner write rule but the restrictive gate still blocks non-admins", () => {
+        const collection: PostgresCollection = {
+            slug: "users",
+            table: "users",
+            name: "Users",
+            auth: true,
+            properties: {
+                id: { type: "string", isId: "uuid" },
+                roles: { type: "array", columnType: "text[]", of: { type: "string" } }
+            },
+            // The dangerous case: author lets users edit their own row.
+            securityRules: [
+                { name: "edit_own", operation: "update", ownerField: "id" }
+            ]
+        };
+
+        const rules = getEffectiveSecurityRules(collection);
+        const gate = rules.find(r => r.name === "users_require_admin_write");
+        const grant = rules.find(r => r.name === "users_default_admin_write");
+
+        // Author rule preserved.
+        expect(rules.find(r => r.name === "edit_own")).toBeDefined();
+        // Restrictive gate added covering all write ops.
+        expect(gate).toBeDefined();
+        expect(gate?.mode).toBe("restrictive");
+        expect(gate?.operations).toEqual(["insert", "update", "delete"]);
+        // Permissive grant added.
+        expect(grant).toBeDefined();
+        expect(grant?.mode).toBeUndefined();
+
+        // The generated SQL AND's the restrictive gate, so a self-update by a
+        // non-admin cannot pass — only admins/server can write.
+        const ddl = generatePostgresPoliciesDdl([collection]);
+        expect(ddl).toContain("AS RESTRICTIVE FOR UPDATE");
+    });
+
+    it("can be opted out with disableDefaultAuthPolicies", () => {
+        const collection: PostgresCollection = {
+            slug: "users",
+            table: "users",
+            name: "Users",
+            auth: true,
+            disableDefaultAuthPolicies: true,
+            properties: { id: { type: "string", isId: "uuid" } }
+        };
+
+        expect(getEffectiveSecurityRules(collection)).toHaveLength(0);
+    });
+
+    it("leaves non-auth collections untouched", () => {
+        const collection: EntityCollection = {
+            slug: "products",
+            table: "products",
+            name: "Products",
+            properties: { name: { type: "string" } }
+        };
+
+        expect(getEffectiveSecurityRules(collection)).toHaveLength(0);
+    });
+});

package/test/cli-helpers-extended.test.ts

@@ -0,0 +1,324 @@
+import { getDevDatabaseUrl, getTableIncludesFromCollections } from "../src/cli-helpers";
+import { EntityCollection } from "@rebasepro/types";
+import * as fs from "fs";
+import * as path from "path";
+import { execSync } from "child_process";
+
+// ── Mock pg globally so dynamic import("pg") resolves to our mock ────────
+
+const mockQuery = jest.fn();
+const mockConnect = jest.fn();
+const mockEnd = jest.fn();
+
+jest.mock("pg", () => ({
+    Client: jest.fn().mockImplementation(() => ({
+        connect: mockConnect,
+        query: mockQuery,
+        end: mockEnd,
+    })),
+}));
+
+describe("CLI Helpers — Extended", () => {
+
+    beforeEach(() => {
+        jest.clearAllMocks();
+    });
+
+    // ── getDevDatabaseUrl ────────────────────────────────────────────────
+
+    describe("getDevDatabaseUrl", () => {
+
+        it("should handle password with special characters (@ in password)", () => {
+            // The URL class percent-encodes special chars, so the output may differ slightly
+            const dbUrl = "postgresql://user:p%40ss@localhost:5432/mydb";
+            const result = getDevDatabaseUrl(dbUrl);
+            expect(result).toContain("mydb_dev_diff");
+            expect(result).toContain("p%40ss");
+            expect(result).toContain("localhost:5432");
+        });
+
+        it("should handle password with encoded special characters", () => {
+            const dbUrl = "postgresql://admin:p%23word%21@db.host.com:5432/production";
+            const result = getDevDatabaseUrl(dbUrl);
+            expect(result).toContain("production_dev_diff");
+            expect(result).toContain("p%23word%21");
+        });
+
+        it("should handle URL with multiple query parameters", () => {
+            const dbUrl = "postgresql://user:pass@localhost:5432/testdb?sslmode=require&connect_timeout=10";
+            const result = getDevDatabaseUrl(dbUrl);
+            expect(result).toBe("postgresql://user:pass@localhost:5432/testdb_dev_diff?sslmode=require&connect_timeout=10");
+        });
+
+        it("should handle URL without port", () => {
+            const dbUrl = "postgresql://user:pass@localhost/mydb";
+            const result = getDevDatabaseUrl(dbUrl);
+            expect(result).toContain("mydb_dev_diff");
+        });
+
+        it("should handle URL with path containing only the database name", () => {
+            const dbUrl = "postgres://u:p@host:5432/db_name";
+            const result = getDevDatabaseUrl(dbUrl);
+            expect(result).toContain("db_name_dev_diff");
+        });
+
+        it("should fall back to concatenation for totally invalid URLs", () => {
+            expect(getDevDatabaseUrl("")).toBe("_dev_diff");
+            expect(getDevDatabaseUrl("just-some-text")).toBe("just-some-text_dev_diff");
+        });
+    });
+
+    // ── resolveLocalBin ─────────────────────────────────────────────────
+
+    describe("resolveLocalBin", () => {
+        // We test this function by using real fs — we just pick a binary
+        // that is known to exist (like "jest") vs. one that doesn't.
+
+        it("should find a binary that exists in node_modules/.bin", () => {
+            // "jest" should be installed in the monorepo node_modules
+            const { resolveLocalBin } = require("../src/cli-helpers");
+            const result = resolveLocalBin("jest");
+            // Should either find it or return null (depending on install structure)
+            // We just check the contract: string | null
+            if (result !== null) {
+                expect(typeof result).toBe("string");
+                expect(result).toContain("jest");
+            }
+        });
+
+        it("should return null for a binary that definitely does not exist", () => {
+            const { resolveLocalBin } = require("../src/cli-helpers");
+            const result = resolveLocalBin("__nonexistent_binary_xyz_12345__");
+            expect(result).toBeNull();
+        });
+    });
+
+    // ── ensureDevDatabaseExists ─────────────────────────────────────────
+
+    describe("ensureDevDatabaseExists", () => {
+
+        it("should not create database when it already exists", async () => {
+            mockConnect.mockResolvedValue(undefined);
+            mockEnd.mockResolvedValue(undefined);
+            mockQuery.mockResolvedValue({ rowCount: 1, rows: [{ "?column?": 1 }] });
+
+            const { ensureDevDatabaseExists } = require("../src/cli-helpers");
+            await ensureDevDatabaseExists(
+                "postgresql://user:pass@localhost:5432/mydb",
+                "postgresql://user:pass@localhost:5432/mydb_dev_diff"
+            );
+
+            expect(mockConnect).toHaveBeenCalledTimes(1);
+            // Should query pg_database
+            expect(mockQuery).toHaveBeenCalledWith(
+                "SELECT 1 FROM pg_database WHERE datname = $1",
+                ["mydb_dev_diff"]
+            );
+            // Should NOT issue CREATE DATABASE since rowCount is 1
+            expect(mockQuery).toHaveBeenCalledTimes(1);
+            expect(mockEnd).toHaveBeenCalledTimes(1);
+        });
+
+        it("should create database when it does not exist", async () => {
+            mockConnect.mockResolvedValue(undefined);
+            mockEnd.mockResolvedValue(undefined);
+            mockQuery
+                .mockResolvedValueOnce({ rowCount: 0, rows: [] })  // SELECT 1 FROM pg_database
+                .mockResolvedValueOnce(undefined);                  // CREATE DATABASE
+
+            const { ensureDevDatabaseExists } = require("../src/cli-helpers");
+            await ensureDevDatabaseExists(
+                "postgresql://user:pass@localhost:5432/mydb",
+                "postgresql://user:pass@localhost:5432/mydb_dev_diff"
+            );
+
+            expect(mockQuery).toHaveBeenCalledTimes(2);
+            expect(mockQuery).toHaveBeenNthCalledWith(1,
+                "SELECT 1 FROM pg_database WHERE datname = $1",
+                ["mydb_dev_diff"]
+            );
+            expect(mockQuery).toHaveBeenNthCalledWith(2,
+                'CREATE DATABASE "mydb_dev_diff"'
+            );
+        });
+
+        it("should silently catch connection errors", async () => {
+            mockConnect.mockRejectedValue(new Error("connection refused"));
+
+            const { ensureDevDatabaseExists } = require("../src/cli-helpers");
+            // Should not throw
+            await expect(
+                ensureDevDatabaseExists(
+                    "postgresql://user:pass@localhost:5432/mydb",
+                    "postgresql://user:pass@localhost:5432/mydb_dev_diff"
+                )
+            ).resolves.toBeUndefined();
+        });
+    });
+
+    // ── getTableExcludes ────────────────────────────────────────────────
+
+    describe("getTableExcludes (via getTableIncludesFromCollections path)", () => {
+
+        it("should always include atlas_schema_revisions.* in excludes", async () => {
+            // We test the logic indirectly: getTableExcludes calls getTableIncludes
+            // then queries the DB. We mock pg to return known tables.
+
+            mockConnect.mockResolvedValue(undefined);
+            mockEnd.mockResolvedValue(undefined);
+            mockQuery.mockResolvedValue({
+                rows: [
+                    { full_name: "public.users" },
+                    { full_name: "public.sessions" },
+                    { full_name: "public.migrations" },
+                ],
+            });
+
+            // We can't easily mock getTableIncludes (it does dynamic imports of collection files)
+            // So we test the subcomponent: getTableIncludesFromCollections
+            const collections: EntityCollection[] = [
+                {
+                    slug: "users",
+                    table: "users",
+                    name: "Users",
+                    properties: { name: { type: "string" } },
+                },
+            ];
+
+            const includes = await getTableIncludesFromCollections(collections);
+            expect(includes).toContain("public.users");
+            expect(includes).not.toContain("public.sessions");
+        });
+    });
+
+    // ── getTableIncludesFromCollections ──────────────────────────────────
+
+    describe("getTableIncludesFromCollections", () => {
+
+        it("should return empty array for empty collections", async () => {
+            const includes = await getTableIncludesFromCollections([]);
+            expect(includes).toEqual([]);
+        });
+
+        it("should handle collection with custom schema", async () => {
+            const collections: EntityCollection[] = [
+                {
+                    slug: "orders",
+                    table: "orders",
+                    name: "Orders",
+                    schema: "sales",
+                    properties: { total: { type: "number" } },
+                },
+            ];
+
+            const includes = await getTableIncludesFromCollections(collections);
+            expect(includes).toContain("sales.orders");
+        });
+
+        it("should deduplicate table names", async () => {
+            const collections: EntityCollection[] = [
+                {
+                    slug: "users",
+                    table: "users",
+                    name: "Users",
+                    properties: { name: { type: "string" } },
+                },
+                {
+                    slug: "users_alias",
+                    table: "users", // same table
+                    name: "Users Alias",
+                    properties: { email: { type: "string" } },
+                },
+            ];
+
+            const includes = await getTableIncludesFromCollections(collections);
+            // "public.users" should appear only once
+            const userEntries = includes.filter(i => i === "public.users");
+            expect(userEntries).toHaveLength(1);
+        });
+
+        it("should include junction tables from many-to-many relations", async () => {
+            const tagsCollection: EntityCollection = {
+                slug: "tags",
+                table: "tags",
+                name: "Tags",
+                properties: { name: { type: "string" } },
+            };
+
+            const postsCollection: EntityCollection = {
+                slug: "posts",
+                table: "posts",
+                name: "Posts",
+                properties: { title: { type: "string" } },
+                relations: [
+                    {
+                        relationName: "tags",
+                        target: () => tagsCollection,
+                        cardinality: "many",
+                        direction: "owning",
+                        through: {
+                            table: "posts_to_tags",
+                            sourceColumn: "post_id",
+                            targetColumn: "tag_id",
+                        },
+                    },
+                ],
+            };
+
+            const includes = await getTableIncludesFromCollections([postsCollection, tagsCollection]);
+            expect(includes).toContain("public.posts");
+            expect(includes).toContain("public.tags");
+            expect(includes).toContain("public.posts_to_tags");
+        });
+
+        it("should include junction tables with custom schema from target collection", async () => {
+            const categoriesCollection: EntityCollection = {
+                slug: "categories",
+                table: "categories",
+                name: "Categories",
+                schema: "catalog",
+                properties: { name: { type: "string" } },
+            };
+
+            const productsCollection: EntityCollection = {
+                slug: "products",
+                table: "products",
+                name: "Products",
+                properties: { title: { type: "string" } },
+                relations: [
+                    {
+                        relationName: "categories",
+                        target: () => categoriesCollection,
+                        cardinality: "many",
+                        direction: "owning",
+                        through: {
+                            table: "products_categories",
+                            sourceColumn: "product_id",
+                            targetColumn: "category_id",
+                        },
+                    },
+                ],
+            };
+
+            const includes = await getTableIncludesFromCollections([productsCollection, categoriesCollection]);
+            expect(includes).toContain("public.products");
+            expect(includes).toContain("catalog.categories");
+            // Junction table uses the target collection's schema
+            expect(includes).toContain("catalog.products_categories");
+        });
+
+        it("should handle collection without explicit table (uses slug)", async () => {
+            const collections: EntityCollection[] = [
+                {
+                    slug: "customers",
+                    name: "Customers",
+                    properties: { name: { type: "string" } },
+                },
+            ];
+
+            const includes = await getTableIncludesFromCollections(collections);
+            // getTableName falls back to slug → "customers"
+            expect(includes).toContain("public.customers");
+        });
+    });
+});