@saasicat/cli 0.12.0 → 0.13.0

package/bin/saasicat.js

@@ -53,6 +53,19 @@ function resolveFragmentsDir() {
 async function selectFragmentFiles(dir, filter) {
     const files = (await readdir(dir)).filter((f) => f.endsWith('.prisma')).sort();
     if (!filter) return files;
+
+    // A selector that matches nothing is a typo, and silently dropping it would
+    // leave part of the requested schema surface unchecked while the command
+    // still exits 0 — the worst outcome for something used as a CI gate.
+    const available = new Set(files.map((f) => f.split('-')[0]));
+    const unknown = filter.filter((prefix) => !available.has(prefix));
+    if (unknown.length > 0) {
+        console.error(
+            `✗ Unbekannte Fragmente: ${unknown.join(', ')}. ` +
+                `Verfügbar: ${[...available].join(', ')}`,
+        );
+        process.exit(1);
+    }
     return files.filter((f) => filter.includes(f.split('-')[0]));
 }
 

package/dist/index.cjs

@@ -67,6 +67,7 @@ __export(index_exports, {
   UserPortDoctorCheck: () => UserPortDoctorCheck,
   WhoAmIFlow: () => WhoAmIFlow,
   applyFragmentBlocks: () => applyFragmentBlocks,
+  blankStringLiterals: () => blankStringLiterals,
   blockBodyLines: () => blockBodyLines,
   breaksContract: () => breaksContract,
   checkSchema: () => checkSchema,
@@ -78,7 +79,8 @@ __export(index_exports, {
   parseEnumValues: () => parseEnumValues,
   parseFields: () => parseFields,
   parseSchema: () => parseSchema,
-  stripLineComment: () => stripLineComment
+  stripLineComment: () => stripLineComment,
+  structuralOnly: () => structuralOnly
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -1111,7 +1113,7 @@ var PLATFORM_DOCTOR_CHECK_PROVIDERS = [
 
 // src/prisma-blocks.ts
 function stripLineComment(line) {
-  const commentStart = line.indexOf("//");
+  const commentStart = blankStringLiterals(line).indexOf("//");
   return commentStart === -1 ? line : line.slice(0, commentStart);
 }
 __name(stripLineComment, "stripLineComment");
@@ -1119,11 +1121,45 @@ function declarationPattern(keyword) {
   return new RegExp(`^\\s*${keyword}\\s+([A-Za-z_][A-Za-z0-9_]*)\\s*\\{`);
 }
 __name(declarationPattern, "declarationPattern");
+function blankStringLiterals(line) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (const char of line) {
+    if (!inString) {
+      out += char;
+      if (char === '"') inString = true;
+      continue;
+    }
+    if (escaped) {
+      out += " ";
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      out += " ";
+      escaped = true;
+      continue;
+    }
+    if (char === '"') {
+      out += '"';
+      inString = false;
+      continue;
+    }
+    out += " ";
+  }
+  return out;
+}
+__name(blankStringLiterals, "blankStringLiterals");
+function structuralOnly(line) {
+  return stripLineComment(blankStringLiterals(line));
+}
+__name(structuralOnly, "structuralOnly");
 function extractBlockNames(schema, keyword) {
   const pattern = declarationPattern(keyword);
   const names = [];
   for (const line of schema.split("\n")) {
-    const match = stripLineComment(line).match(pattern);
+    const match = structuralOnly(line).match(pattern);
     if (match) names.push(match[1]);
   }
   return names;
@@ -1134,7 +1170,7 @@ function extractBlocks(schema, keyword) {
   const blocks = /* @__PURE__ */ new Map();
   let current = null;
   for (const rawLine of schema.split("\n")) {
-    const stripped = stripLineComment(rawLine);
+    const stripped = structuralOnly(rawLine);
     const openCount = (stripped.match(/\{/g) ?? []).length;
     const closeCount = (stripped.match(/\}/g) ?? []).length;
     if (!current) {
@@ -1163,7 +1199,7 @@ function blockBodyLines(block) {
   const bodyStart = block.indexOf("{");
   const bodyEnd = block.lastIndexOf("}");
   if (bodyStart === -1 || bodyEnd <= bodyStart) return [];
-  return block.slice(bodyStart + 1, bodyEnd).split("\n").map((line) => stripLineComment(line).trim()).filter((line) => line.length > 0 && !line.startsWith("@@"));
+  return block.slice(bodyStart + 1, bodyEnd).split("\n").map((line) => structuralOnly(line).trim()).filter((line) => line.length > 0 && !line.startsWith("@@"));
 }
 __name(blockBodyLines, "blockBodyLines");
 
@@ -1248,17 +1284,18 @@ function parseEnumValues(block) {
 }
 __name(parseEnumValues, "parseEnumValues");
 function attributeFieldLists(block, attribute) {
-  const pattern = new RegExp(`@@${attribute}\\(([^)]*\\])`, "g");
+  const pattern = new RegExp(`@@${attribute}\\(\\s*(\\[[^\\]]*\\])`, "g");
   return new Set([
     ...block.matchAll(pattern)
   ].map((match) => match[1].replace(/\s+/g, "")));
 }
 __name(attributeFieldLists, "attributeFieldLists");
 function parseBlockAttributes(name, block) {
+  const active = block.split("\n").map(stripLineComment).join("\n");
   return {
-    indexes: attributeFieldLists(block, "index"),
-    uniques: attributeFieldLists(block, "unique"),
-    map: block.match(/@@map\("([^"]+)"\)/)?.[1] ?? name
+    indexes: attributeFieldLists(active, "index"),
+    uniques: attributeFieldLists(active, "unique"),
+    map: active.match(/@@map\("([^"]+)"\)/)?.[1] ?? name
   };
 }
 __name(parseBlockAttributes, "parseBlockAttributes");
@@ -2485,6 +2522,7 @@ UserCommands = _ts_decorate14([
   UserPortDoctorCheck,
   WhoAmIFlow,
   applyFragmentBlocks,
+  blankStringLiterals,
   blockBodyLines,
   breaksContract,
   checkSchema,
@@ -2496,5 +2534,6 @@ UserCommands = _ts_decorate14([
   parseEnumValues,
   parseFields,
   parseSchema,
-  stripLineComment
+  stripLineComment,
+  structuralOnly
 });

package/dist/index.d.cts

@@ -327,11 +327,32 @@ declare class AdminManifestDoctorCheck implements DoctorCheck {
 declare const PLATFORM_DOCTOR_CHECK_PROVIDERS: Array<Type<DoctorCheck>>;
 
 /**
- * Cuts off a trailing `//` comment. Deliberately index-based instead of
- * `replace(/\/\/.*$/, '')`: the regex backtracks quadratically on lines with
- * many single slashes.
+ * Cuts off a trailing `//` comment, ignoring `//` inside string literals — a
+ * `@default("http://x")` must survive intact. The position is found on a
+ * string-blanked copy, but the original line is what gets cut, so quoted
+ * content is preserved.
+ *
+ * Deliberately index-based instead of `replace(/\/\/.*$/, '')`: the regex
+ * backtracks quadratically on lines with many single slashes.
  */
 declare function stripLineComment(line: string): string;
+/**
+ * Blanks the contents of double-quoted strings, keeping the quotes and the
+ * line length so column positions stay put. Brace counting must not see
+ * `@default("}")` as the end of a model — it would close the block early and
+ * every field below it would look missing.
+ *
+ * A linear scan rather than `"(?:[^"\\]|\\.)*"`: that pattern backtracks
+ * quadratically on many repeated `\"` (CodeQL `js/polynomial-redos`), and this
+ * runs over every line of a consumer schema.
+ */
+declare function blankStringLiterals(line: string): string;
+/**
+ * Comment- and string-safe view of a line, for structural scanning. Strings are
+ * blanked first: `@default("http://x")` contains `//`, and stripping comments
+ * before that would cut the line in half.
+ */
+declare function structuralOnly(line: string): string;
 /** Returns the names of all top-level `<keyword> X { … }` blocks. */
 declare function extractBlockNames(schema: string, keyword: string): string[];
 /**
@@ -454,6 +475,11 @@ declare function parseEnumValues(block: string): string[];
  * Parses the block-level attributes of a `model`. Comparing these is what
  * catches a missing index or unique constraint — differences the field-level
  * comparison is blind to.
+ *
+ * The block is reduced to its structural content first. A consumer who
+ * comments out `// @@unique([tenantId])` has removed the constraint, and
+ * reading the raw text would count it as present — passing the very check that
+ * exists to catch its absence.
  */
 declare function parseBlockAttributes(name: string, block: string): BlockAttributes;
 /** Parses every `model` and `enum` declaration of a Prisma schema. */
@@ -661,4 +687,4 @@ declare class UserCommands extends CommandRunner {
     parsePassword(val: string): string;
 }
 
-export { AUDIT_QUERY_PORT_TOKEN, AdminCommands, AdminManifestDoctorCheck, AdminMfaSetupCommand, AdminWhoamiCommand, type ApplyResult, AuditCommands, AuditTailCommand, AuditTailFlow, type AuditTailOptions, type BlockAttributeKind, type BlockAttributes, CLI_CONTEXT_CONFIG_TOKEN, type CheckSeverity, type CliContextConfig, CliContextModule, type CliContextModuleOptions, CliContextService, CliError, type CliIdentity, DEFAULT_MANIFEST_CHECKS, DOCTOR_CHECKS_TOKEN, DiscoveryCommands, DiscoveryScanCommand, DiscoverySnapshotDoctorCheck, type DoctorCheck, type DoctorCheckResult, DoctorCommands, DoctorFlow, type DoctorReport, type FieldMismatch, type FieldMismatchReason, type FieldSignature, MANIFEST_ACCESS_PORT_TOKEN, MANIFEST_CHECKS_TOKEN, type ManifestCheck, ManifestCheckCommand, type ManifestCheckReport, type ManifestCheckResult, ManifestCliFlow, ManifestCommands, type ManifestDiff, ManifestDumpCommand, ManifestHashCommand, ManifestValidateCommand, MfaSetupFlow, type MfaSetupOptions, type MfaSetupResult, type MissingBlockAttribute, type MissingEnumValue, type MissingField, PLATFORM_DOCTOR_CHECK_PROVIDERS, type ParsedSchema, PlanCatalogDoctorCheck, type SchemaCheckReport, USER_MANAGEMENT_PORT_TOKEN, USER_PORT_TOKEN, UserCommands, UserPortDoctorCheck, WhoAmIFlow, type WhoAmIResult, applyFragmentBlocks, blockBodyLines, breaksContract, checkSchema, extractBlockNames, extractBlocks, extractModelBlocks, extractModelNames, parseBlockAttributes, parseEnumValues, parseFields, parseSchema, stripLineComment };
+export { AUDIT_QUERY_PORT_TOKEN, AdminCommands, AdminManifestDoctorCheck, AdminMfaSetupCommand, AdminWhoamiCommand, type ApplyResult, AuditCommands, AuditTailCommand, AuditTailFlow, type AuditTailOptions, type BlockAttributeKind, type BlockAttributes, CLI_CONTEXT_CONFIG_TOKEN, type CheckSeverity, type CliContextConfig, CliContextModule, type CliContextModuleOptions, CliContextService, CliError, type CliIdentity, DEFAULT_MANIFEST_CHECKS, DOCTOR_CHECKS_TOKEN, DiscoveryCommands, DiscoveryScanCommand, DiscoverySnapshotDoctorCheck, type DoctorCheck, type DoctorCheckResult, DoctorCommands, DoctorFlow, type DoctorReport, type FieldMismatch, type FieldMismatchReason, type FieldSignature, MANIFEST_ACCESS_PORT_TOKEN, MANIFEST_CHECKS_TOKEN, type ManifestCheck, ManifestCheckCommand, type ManifestCheckReport, type ManifestCheckResult, ManifestCliFlow, ManifestCommands, type ManifestDiff, ManifestDumpCommand, ManifestHashCommand, ManifestValidateCommand, MfaSetupFlow, type MfaSetupOptions, type MfaSetupResult, type MissingBlockAttribute, type MissingEnumValue, type MissingField, PLATFORM_DOCTOR_CHECK_PROVIDERS, type ParsedSchema, PlanCatalogDoctorCheck, type SchemaCheckReport, USER_MANAGEMENT_PORT_TOKEN, USER_PORT_TOKEN, UserCommands, UserPortDoctorCheck, WhoAmIFlow, type WhoAmIResult, applyFragmentBlocks, blankStringLiterals, blockBodyLines, breaksContract, checkSchema, extractBlockNames, extractBlocks, extractModelBlocks, extractModelNames, parseBlockAttributes, parseEnumValues, parseFields, parseSchema, stripLineComment, structuralOnly };

package/dist/index.d.ts

@@ -327,11 +327,32 @@ declare class AdminManifestDoctorCheck implements DoctorCheck {
 declare const PLATFORM_DOCTOR_CHECK_PROVIDERS: Array<Type<DoctorCheck>>;
 
 /**
- * Cuts off a trailing `//` comment. Deliberately index-based instead of
- * `replace(/\/\/.*$/, '')`: the regex backtracks quadratically on lines with
- * many single slashes.
+ * Cuts off a trailing `//` comment, ignoring `//` inside string literals — a
+ * `@default("http://x")` must survive intact. The position is found on a
+ * string-blanked copy, but the original line is what gets cut, so quoted
+ * content is preserved.
+ *
+ * Deliberately index-based instead of `replace(/\/\/.*$/, '')`: the regex
+ * backtracks quadratically on lines with many single slashes.
  */
 declare function stripLineComment(line: string): string;
+/**
+ * Blanks the contents of double-quoted strings, keeping the quotes and the
+ * line length so column positions stay put. Brace counting must not see
+ * `@default("}")` as the end of a model — it would close the block early and
+ * every field below it would look missing.
+ *
+ * A linear scan rather than `"(?:[^"\\]|\\.)*"`: that pattern backtracks
+ * quadratically on many repeated `\"` (CodeQL `js/polynomial-redos`), and this
+ * runs over every line of a consumer schema.
+ */
+declare function blankStringLiterals(line: string): string;
+/**
+ * Comment- and string-safe view of a line, for structural scanning. Strings are
+ * blanked first: `@default("http://x")` contains `//`, and stripping comments
+ * before that would cut the line in half.
+ */
+declare function structuralOnly(line: string): string;
 /** Returns the names of all top-level `<keyword> X { … }` blocks. */
 declare function extractBlockNames(schema: string, keyword: string): string[];
 /**
@@ -454,6 +475,11 @@ declare function parseEnumValues(block: string): string[];
  * Parses the block-level attributes of a `model`. Comparing these is what
  * catches a missing index or unique constraint — differences the field-level
  * comparison is blind to.
+ *
+ * The block is reduced to its structural content first. A consumer who
+ * comments out `// @@unique([tenantId])` has removed the constraint, and
+ * reading the raw text would count it as present — passing the very check that
+ * exists to catch its absence.
  */
 declare function parseBlockAttributes(name: string, block: string): BlockAttributes;
 /** Parses every `model` and `enum` declaration of a Prisma schema. */
@@ -661,4 +687,4 @@ declare class UserCommands extends CommandRunner {
     parsePassword(val: string): string;
 }
 
-export { AUDIT_QUERY_PORT_TOKEN, AdminCommands, AdminManifestDoctorCheck, AdminMfaSetupCommand, AdminWhoamiCommand, type ApplyResult, AuditCommands, AuditTailCommand, AuditTailFlow, type AuditTailOptions, type BlockAttributeKind, type BlockAttributes, CLI_CONTEXT_CONFIG_TOKEN, type CheckSeverity, type CliContextConfig, CliContextModule, type CliContextModuleOptions, CliContextService, CliError, type CliIdentity, DEFAULT_MANIFEST_CHECKS, DOCTOR_CHECKS_TOKEN, DiscoveryCommands, DiscoveryScanCommand, DiscoverySnapshotDoctorCheck, type DoctorCheck, type DoctorCheckResult, DoctorCommands, DoctorFlow, type DoctorReport, type FieldMismatch, type FieldMismatchReason, type FieldSignature, MANIFEST_ACCESS_PORT_TOKEN, MANIFEST_CHECKS_TOKEN, type ManifestCheck, ManifestCheckCommand, type ManifestCheckReport, type ManifestCheckResult, ManifestCliFlow, ManifestCommands, type ManifestDiff, ManifestDumpCommand, ManifestHashCommand, ManifestValidateCommand, MfaSetupFlow, type MfaSetupOptions, type MfaSetupResult, type MissingBlockAttribute, type MissingEnumValue, type MissingField, PLATFORM_DOCTOR_CHECK_PROVIDERS, type ParsedSchema, PlanCatalogDoctorCheck, type SchemaCheckReport, USER_MANAGEMENT_PORT_TOKEN, USER_PORT_TOKEN, UserCommands, UserPortDoctorCheck, WhoAmIFlow, type WhoAmIResult, applyFragmentBlocks, blockBodyLines, breaksContract, checkSchema, extractBlockNames, extractBlocks, extractModelBlocks, extractModelNames, parseBlockAttributes, parseEnumValues, parseFields, parseSchema, stripLineComment };
+export { AUDIT_QUERY_PORT_TOKEN, AdminCommands, AdminManifestDoctorCheck, AdminMfaSetupCommand, AdminWhoamiCommand, type ApplyResult, AuditCommands, AuditTailCommand, AuditTailFlow, type AuditTailOptions, type BlockAttributeKind, type BlockAttributes, CLI_CONTEXT_CONFIG_TOKEN, type CheckSeverity, type CliContextConfig, CliContextModule, type CliContextModuleOptions, CliContextService, CliError, type CliIdentity, DEFAULT_MANIFEST_CHECKS, DOCTOR_CHECKS_TOKEN, DiscoveryCommands, DiscoveryScanCommand, DiscoverySnapshotDoctorCheck, type DoctorCheck, type DoctorCheckResult, DoctorCommands, DoctorFlow, type DoctorReport, type FieldMismatch, type FieldMismatchReason, type FieldSignature, MANIFEST_ACCESS_PORT_TOKEN, MANIFEST_CHECKS_TOKEN, type ManifestCheck, ManifestCheckCommand, type ManifestCheckReport, type ManifestCheckResult, ManifestCliFlow, ManifestCommands, type ManifestDiff, ManifestDumpCommand, ManifestHashCommand, ManifestValidateCommand, MfaSetupFlow, type MfaSetupOptions, type MfaSetupResult, type MissingBlockAttribute, type MissingEnumValue, type MissingField, PLATFORM_DOCTOR_CHECK_PROVIDERS, type ParsedSchema, PlanCatalogDoctorCheck, type SchemaCheckReport, USER_MANAGEMENT_PORT_TOKEN, USER_PORT_TOKEN, UserCommands, UserPortDoctorCheck, WhoAmIFlow, type WhoAmIResult, applyFragmentBlocks, blankStringLiterals, blockBodyLines, breaksContract, checkSchema, extractBlockNames, extractBlocks, extractModelBlocks, extractModelNames, parseBlockAttributes, parseEnumValues, parseFields, parseSchema, stripLineComment, structuralOnly };

package/dist/index.js

@@ -1030,7 +1030,7 @@ var PLATFORM_DOCTOR_CHECK_PROVIDERS = [
 
 // src/prisma-blocks.ts
 function stripLineComment(line) {
-  const commentStart = line.indexOf("//");
+  const commentStart = blankStringLiterals(line).indexOf("//");
   return commentStart === -1 ? line : line.slice(0, commentStart);
 }
 __name(stripLineComment, "stripLineComment");
@@ -1038,11 +1038,45 @@ function declarationPattern(keyword) {
   return new RegExp(`^\\s*${keyword}\\s+([A-Za-z_][A-Za-z0-9_]*)\\s*\\{`);
 }
 __name(declarationPattern, "declarationPattern");
+function blankStringLiterals(line) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (const char of line) {
+    if (!inString) {
+      out += char;
+      if (char === '"') inString = true;
+      continue;
+    }
+    if (escaped) {
+      out += " ";
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      out += " ";
+      escaped = true;
+      continue;
+    }
+    if (char === '"') {
+      out += '"';
+      inString = false;
+      continue;
+    }
+    out += " ";
+  }
+  return out;
+}
+__name(blankStringLiterals, "blankStringLiterals");
+function structuralOnly(line) {
+  return stripLineComment(blankStringLiterals(line));
+}
+__name(structuralOnly, "structuralOnly");
 function extractBlockNames(schema, keyword) {
   const pattern = declarationPattern(keyword);
   const names = [];
   for (const line of schema.split("\n")) {
-    const match = stripLineComment(line).match(pattern);
+    const match = structuralOnly(line).match(pattern);
     if (match) names.push(match[1]);
   }
   return names;
@@ -1053,7 +1087,7 @@ function extractBlocks(schema, keyword) {
   const blocks = /* @__PURE__ */ new Map();
   let current = null;
   for (const rawLine of schema.split("\n")) {
-    const stripped = stripLineComment(rawLine);
+    const stripped = structuralOnly(rawLine);
     const openCount = (stripped.match(/\{/g) ?? []).length;
     const closeCount = (stripped.match(/\}/g) ?? []).length;
     if (!current) {
@@ -1082,7 +1116,7 @@ function blockBodyLines(block) {
   const bodyStart = block.indexOf("{");
   const bodyEnd = block.lastIndexOf("}");
   if (bodyStart === -1 || bodyEnd <= bodyStart) return [];
-  return block.slice(bodyStart + 1, bodyEnd).split("\n").map((line) => stripLineComment(line).trim()).filter((line) => line.length > 0 && !line.startsWith("@@"));
+  return block.slice(bodyStart + 1, bodyEnd).split("\n").map((line) => structuralOnly(line).trim()).filter((line) => line.length > 0 && !line.startsWith("@@"));
 }
 __name(blockBodyLines, "blockBodyLines");
 
@@ -1167,17 +1201,18 @@ function parseEnumValues(block) {
 }
 __name(parseEnumValues, "parseEnumValues");
 function attributeFieldLists(block, attribute) {
-  const pattern = new RegExp(`@@${attribute}\\(([^)]*\\])`, "g");
+  const pattern = new RegExp(`@@${attribute}\\(\\s*(\\[[^\\]]*\\])`, "g");
   return new Set([
     ...block.matchAll(pattern)
   ].map((match) => match[1].replace(/\s+/g, "")));
 }
 __name(attributeFieldLists, "attributeFieldLists");
 function parseBlockAttributes(name, block) {
+  const active = block.split("\n").map(stripLineComment).join("\n");
   return {
-    indexes: attributeFieldLists(block, "index"),
-    uniques: attributeFieldLists(block, "unique"),
-    map: block.match(/@@map\("([^"]+)"\)/)?.[1] ?? name
+    indexes: attributeFieldLists(active, "index"),
+    uniques: attributeFieldLists(active, "unique"),
+    map: active.match(/@@map\("([^"]+)"\)/)?.[1] ?? name
   };
 }
 __name(parseBlockAttributes, "parseBlockAttributes");
@@ -2403,6 +2438,7 @@ export {
   UserPortDoctorCheck,
   WhoAmIFlow,
   applyFragmentBlocks,
+  blankStringLiterals,
   blockBodyLines,
   breaksContract,
   checkSchema,
@@ -2414,5 +2450,6 @@ export {
   parseEnumValues,
   parseFields,
   parseSchema,
-  stripLineComment
+  stripLineComment,
+  structuralOnly
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saasicat/cli",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "CLI helpers for SaaS platform consumers. Provides CliContextService (identity, MFA, production confirm, audit tag).",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,9 +27,9 @@
   },
   "dependencies": {
     "qrcode-terminal": "^0.12.0",
-    "@saasicat/nest": "^0.12.0",
-    "@saasicat/spec": "^0.12.0",
-    "@saasicat/types": "^0.12.0"
+    "@saasicat/nest": "^0.13.0",
+    "@saasicat/spec": "^0.13.0",
+    "@saasicat/types": "^0.13.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",