@supacloud/cli 0.40.0 → 0.41.0

package/dist/index.js

@@ -239502,6 +239502,61 @@ function migrationExecutionStatements(statements) {
   const hasOuterTransaction = /^(?:BEGIN(?:\s+(?:WORK|TRANSACTION))?|START\s+TRANSACTION)$/i.test(first) && /^(?:COMMIT|END)(?:\s+(?:WORK|TRANSACTION))?$/i.test(last);
   return hasOuterTransaction ? statements.slice(1, -1) : [...statements];
 }
+function skipSqlTrivia(sql, start) {
+  let cursor = start;
+  for (;; ) {
+    while (cursor < sql.length && /\s/.test(sql[cursor]))
+      cursor++;
+    if (sql.startsWith("--", cursor)) {
+      cursor = lineCommentEnd(sql, cursor);
+      continue;
+    }
+    if (sql.startsWith("/*", cursor)) {
+      cursor = blockCommentEnd(sql, cursor);
+      continue;
+    }
+    return cursor;
+  }
+}
+function doStatementBody(sql, keywordEnd) {
+  let cursor = skipSqlTrivia(sql, keywordEnd);
+  if (/^LANGUAGE\b/i.test(sql.slice(cursor))) {
+    cursor += "LANGUAGE".length;
+    cursor = skipSqlTrivia(sql, cursor);
+    if (sql[cursor] === "'")
+      cursor = maskSingleQuotedString(sql, cursor).end;
+    else if (sql[cursor] === '"')
+      cursor = maskDoubleQuotedIdentifier(sql, cursor).end;
+    else {
+      const languageName = /^[A-Za-z_][A-Za-z0-9_]*/.exec(sql.slice(cursor));
+      if (!languageName)
+        return null;
+      cursor += languageName[0].length;
+    }
+    cursor = skipSqlTrivia(sql, cursor);
+  }
+  if (sql[cursor] === "'") {
+    const end = maskSingleQuotedString(sql, cursor).end;
+    return sql.slice(cursor + 1, Math.max(cursor + 1, end - 1));
+  }
+  const tag = sql[cursor] === "$" ? dollarQuoteTagAt(sql, cursor) : "";
+  if (!tag)
+    return null;
+  const bodyEnd = sql.indexOf(tag, cursor + tag.length);
+  return bodyEnd === -1 ? null : sql.slice(cursor + tag.length, bodyEnd);
+}
+function topLevelDoBodies(sql) {
+  const masked = maskSqlPolicyNoise(sql);
+  const doKeywordPattern = /(?:^|;)\s*DO\b/gi;
+  const bodies = [];
+  let match;
+  while ((match = doKeywordPattern.exec(masked)) !== null) {
+    const body = doStatementBody(sql, doKeywordPattern.lastIndex);
+    if (body !== null)
+      bodies.push(body);
+  }
+  return bodies;
+}
 function splitTopLevelClauses(sql) {
   const masked = maskSqlNoise(sql);
   const clauses = [];
@@ -239596,14 +239651,6 @@ var RISK_RULES = [
     description: "Renames table. Causes immediate downtime for application code.",
     recommendation: "Follow Expand-Contract: Create a view or alias table during transition."
   },
-  {
-    type: "manual_review_do_block",
-    level: "HIGH",
-    pattern: /^\s*DO\b/i,
-    description: "DO blocks can execute dynamic or procedural DDL that static rules cannot inspect safely.",
-    recommendation: "Move schema changes into explicit SQL statements; push_migrations rejects opaque procedural SQL.",
-    blocksTransactionalPush: true
-  },
   {
     type: "manual_review_procedural_definition",
     level: "HIGH",
@@ -239705,7 +239752,7 @@ var MIGRATION_LEDGER_RELATION_END = String.raw`(?=$|[\s,;(*])`;
 var MIGRATION_LEDGER_DDL_OR_MAINTENANCE_PREFIX = String.raw`(?:CREATE\s+(?:UNIQUE\s+)?INDEX\b[^;]*\bON\s+(?:ONLY\s+)?|CREATE\s+(?:CONSTRAINT\s+)?TRIGGER\b[^;]*\bON\s+|DROP\s+TRIGGER\s+(?:IF\s+EXISTS\s+)?[^;]*\bON\s+|CREATE\s+RULE\b[^;]*\bTO\s+|DROP\s+RULE\s+(?:IF\s+EXISTS\s+)?[^;]*\bON\s+|CREATE\s+POLICY\b[^;]*\bON\s+|ALTER\s+POLICY\b[^;]*\bON\s+|DROP\s+POLICY\s+(?:IF\s+EXISTS\s+)?[^;]*\bON\s+|COMMENT\s+ON\s+TABLE\s+|SECURITY\s+LABEL(?:\s+FOR\s+[^;\s]+)?\s+ON\s+TABLE\s+|REINDEX(?:\s*\([^;)]*\))?\s+TABLE\s+(?:CONCURRENTLY\s+)?|CLUSTER(?:\s+VERBOSE)?\s+|VACUUM(?:\s*\([^;)]*\))?(?:\s+(?:FULL|FREEZE|VERBOSE|ANALYZE))*\s+|ANALYZE(?:\s*\([^;)]*\))?(?:\s+VERBOSE)?\s+)`;
 var MIGRATION_LEDGER_MODIFICATION_PATTERN = new RegExp(String.raw`\b(?:(?:CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?|INSERT\s+INTO\s+(?:ONLY\s+)?|UPDATE\s+(?:ONLY\s+)?|DELETE\s+FROM\s+(?:ONLY\s+)?|MERGE\s+INTO\s+(?:ONLY\s+)?|ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?|COPY\s+)` + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`|(?:DROP\s+TABLE\s+(?:IF\s+EXISTS\s+)?|TRUNCATE(?:\s+TABLE)?\s+|LOCK\s+(?:TABLE\s+)?)[^;]*` + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`|` + MIGRATION_LEDGER_DDL_OR_MAINTENANCE_PREFIX + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`)`, "i");
 var NON_TABLE_PRIVILEGE_TARGET = String.raw`(?:ALL\s+(?:FUNCTIONS|PROCEDURES|ROUTINES|SEQUENCES)\s+IN\s+SCHEMA|DATABASE|DOMAIN|FOREIGN\s+DATA\s+WRAPPER|FOREIGN\s+SERVER|FUNCTION|LANGUAGE|LARGE\s+OBJECT|PARAMETER|PROCEDURE|ROUTINE|SCHEMA|SEQUENCE|TABLESPACE|TYPE)\b`;
-var MIGRATION_LEDGER_PRIVILEGE_PATTERN = new RegExp(String.raw`\b(?:GRANT|REVOKE)\b[^;]*\bON\s+(?:(?:TABLE\s+)?(?!` + NON_TABLE_PRIVILEGE_TARGET + String.raw`)(?:(?!\b(?:TO|FROM)\b)[^;])*?` + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`(?=[^;]*\b(?:TO|FROM)\b)|ALL\s+TABLES\s+IN\s+SCHEMA\s+"?(?:supabase_migrations|public)"?(?=$|[\s,;]))`, "i");
+var MIGRATION_LEDGER_PRIVILEGE_PATTERN = new RegExp(String.raw`\b(?:GRANT|REVOKE)\b[^;]*\bON\s+(?:(?:TABLE\s+)?(?!` + NON_TABLE_PRIVILEGE_TARGET + String.raw`)(?:(?!\b(?:TO|FROM)\b)[^;])*?` + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`(?=[^;]*\b(?:TO|FROM)\b)|ALL\s+TABLES\s+IN\s+SCHEMA\s+"?supabase_migrations"?(?=$|[\s,;]))`, "i");
 var PUSH_BLOCKER_RULES = [
   {
     type: "unsupported_project_scope_management",
@@ -239832,6 +239879,7 @@ var MIGRATION_LEDGER_BLOCKER_RULES = [
     blocksTransactionalPush: true
   }
 ];
+var DO_BODY_BLOCKER_RULES = PUSH_BLOCKER_RULES.filter((rule) => rule.type !== "unsupported_transaction_control");
 function matchingRisks(rawStatement, maskedStatement, rules) {
   return rules.filter((rule) => rule.pattern.test(maskedStatement) && !rule.excludePattern?.test(maskedStatement)).map((rule) => ({
     level: rule.level,
@@ -239908,6 +239956,13 @@ function analyzeMigrationSql(sql) {
     risks.push(...matchingRisks(rawStatement, masked, PUSH_BLOCKER_RULES));
     risks.push(...matchingRisks(rawStatement, policyMasked, QUOTED_FUNCTION_BLOCKER_RULES));
     risks.push(...matchingRisks(rawStatement, policyMasked, MIGRATION_LEDGER_BLOCKER_RULES));
+    for (const body of topLevelDoBodies(rawStatement)) {
+      const maskedBody = maskSqlNoise(body);
+      const policyMaskedBody = maskSqlPolicyNoise(body);
+      risks.push(...matchingRisks(body, maskedBody, DO_BODY_BLOCKER_RULES));
+      risks.push(...matchingRisks(body, policyMaskedBody, QUOTED_FUNCTION_BLOCKER_RULES));
+      risks.push(...matchingRisks(body, policyMaskedBody, MIGRATION_LEDGER_BLOCKER_RULES));
+    }
   }
   return risks;
 }
@@ -246635,9 +246690,9 @@ function parseModule(candidate, nameByNode, ctx) {
           className: cls.getName() ?? "<anonymous>",
           name: stringLiteralProp(meta, "name") ?? cls.getName() ?? "<anonymous>",
           permission: stringLiteralProp(meta, "permission"),
-          transaction: stringLiteralProp(meta, "transaction"),
+          transaction: commandModeProp(meta, "transaction") ?? "none",
           audit: stringLiteralProp(meta, "audit"),
-          idempotency: stringLiteralProp(meta, "idempotency")
+          idempotency: commandModeProp(meta, "idempotency") ?? "none"
         });
       }
     }
@@ -246665,6 +246720,10 @@ function parseModule(candidate, nameByNode, ctx) {
     exports
   };
 }
+function commandModeProp(object, name) {
+  const value = stringLiteralProp(object, name);
+  return value === "required" || value === "none" ? value : undefined;
+}
 function parseProvider(el, exportsSet, ctx) {
   const file = sourcePath(ctx.rootDir, el.getSourceFile().getFilePath());
   const line = el.getStartLineNumber();
@@ -246817,6 +246876,11 @@ function parseController(el, ctx) {
               schemaImports[schemaExpr.getText()] = importPath;
           }
         }
+        const commandExpr = getProp(optionsArg, "command");
+        if (commandExpr && import_ts_morph.Node.isIdentifier(commandExpr)) {
+          const commandDecl = resolveDeclaration(commandExpr)[0];
+          route.command = commandDecl && import_ts_morph.Node.isClassDeclaration(commandDecl) ? commandDecl.getName() ?? commandExpr.getText() : commandExpr.getText();
+        }
       }
       routes.push(route);
     }
@@ -247052,6 +247116,16 @@ var INTERFACES = `export interface CompiledRoute {
   params?: unknown;
   query?: unknown;
   response?: unknown;
+  command?: string;
+}
+
+export interface CompiledCommand {
+  className: string;
+  name: string;
+  permission: string;
+  transaction: "required" | "none";
+  audit?: string;
+  idempotency: "required" | "none";
 }
 
 export interface CompiledController {
@@ -247070,12 +247144,15 @@ export interface CompiledModule {
   createRequestScope?(
     services: Record<string, unknown>,
     ctx: unknown,
+    imported?: Record<string, Record<string, unknown>>,
   ): Record<string, unknown>;
   createJobScope?(
     services: Record<string, unknown>,
     ctx: unknown,
+    imported?: Record<string, Record<string, unknown>>,
   ): Record<string, unknown>;
   controllers: CompiledController[];
+  commands: CompiledCommand[];
 }`;
 async function generateApplication(graph, options) {
   const modules = topoSortModules(graph.modules);
@@ -247094,7 +247171,7 @@ async function generateApplication(graph, options) {
     ...imports.size > 0 ? [""] : [],
     INTERFACES,
     "",
-    "export function createCompiledModules(deps: Record<string, unknown>): CompiledModule[] {",
+    "export function createCompiledModules(): CompiledModule[] {",
     "  return [",
     ...descriptorEntries.map((entry) => indent(entry, 4) + ","),
     "  ];",
@@ -247225,6 +247302,7 @@ class ModuleGenerator {
       lines.push(`  createJobScope: create${this.pascal}JobScope,`);
     }
     lines.push(`  controllers: ${this.renderControllers()},`);
+    lines.push(`  commands: ${JSON.stringify(this.module.commands)},`);
     lines.push(`}`);
     return lines.join(`
 `);
@@ -247249,6 +247327,8 @@ class ModuleGenerator {
             fields.push(`${field}: ${local}`);
           }
         }
+        if (route.command)
+          fields.push(`command: ${JSON.stringify(route.command)}`);
         return `{ ${fields.join(", ")} }`;
       });
       return [
@@ -247282,6 +247362,7 @@ ${indent(item, 2)}`).join(",")}
       `function create${this.pascal}${suffix}(`,
       `  services: Record<string, unknown>,`,
       `  ctx: unknown,`,
+      `  imported: Record<string, Record<string, unknown>> = {},`,
       `): Record<string, unknown> {`,
       indent(this.renderFactoryBody(kind), 2),
       `}`
@@ -247380,7 +247461,7 @@ ${indent(item, 2)}`).join(",")}
         continue;
       if (kind === "services")
         return `imported.${importName}.${camelName(token)}`;
-      return `services.${camelName(token)}`;
+      return `imported.${importName}.${camelName(token)}`;
     }
     if (kind === "services")
       return `deps.${camelName(token)}`;
@@ -247441,6 +247522,42 @@ function validateGraph(graph, strict = false) {
   const warn2 = (code, message, file, line) => {
     diagnostics.push({ severity: strict ? "error" : "warn", code, message, file, line });
   };
+  const modulesByName = new Map;
+  const commandsByName = new Map;
+  const routesByKey = new Map;
+  for (const module of graph.modules) {
+    const previousModule = modulesByName.get(module.name);
+    if (previousModule) {
+      error("duplicate-module", `模块名 ${module.name} 重复（首次声明于 ${previousModule.file}:${previousModule.line}）`, module.file, module.line);
+    } else {
+      modulesByName.set(module.name, module);
+    }
+    for (const command of module.commands) {
+      const previousName = commandsByName.get(command.name);
+      if (previousName) {
+        error("duplicate-command", `command 名 ${command.name} 重复（首次由模块 ${previousName.module.name} 的 ${previousName.className} 声明）`, module.file, module.line);
+      } else {
+        commandsByName.set(command.name, { module, className: command.className });
+      }
+    }
+  }
+  for (const module of graph.modules) {
+    for (const controller of module.controllers) {
+      for (const route of controller.routes) {
+        const fullPath = joinRoutePaths(controller.path, route.path);
+        const key = `${route.method} ${fullPath}`;
+        const previous = routesByKey.get(key);
+        if (previous) {
+          error("duplicate-route", `路由 ${key} 重复（首次声明于模块 ${previous.module.name} 的 ${previous.controller.className}）`, controller.file);
+        } else {
+          routesByKey.set(key, { module, controller });
+        }
+        if (route.command && !module.commands.some((command) => command.className === route.command)) {
+          error("route-command-unresolved", `路由 ${key} 绑定的 command 类 ${route.command} 未在模块 ${module.name} 声明`, controller.file);
+        }
+      }
+    }
+  }
   for (const module of graph.modules) {
     const seen = new Map;
     for (const provider of module.providers) {
@@ -247472,13 +247589,18 @@ function validateGraph(graph, strict = false) {
     }
     for (const command of module.commands) {
       if (!command.permission) {
-        warn2("command-missing-permission", `模块 ${module.name} 的 command ${command.name} (${command.className}) 未声明 permission`, module.file, module.line);
+        error("command-missing-permission", `模块 ${module.name} 的 command ${command.name} (${command.className}) 未声明 permission`, module.file, module.line);
       }
     }
   }
   diagnostics.push(...detectCycles(graph, resolveDep));
   return diagnostics;
 }
+function joinRoutePaths(prefix, path) {
+  const joined = `${prefix}/${path}`.replace(/\/{2,}/g, "/");
+  const normalized = joined.length > 1 ? joined.replace(/\/+$/, "") : joined;
+  return normalized.replace(/:[^/]+/g, ":param");
+}
 function detectCycles(graph, resolveDep) {
   const diagnostics = [];
   const nodeId = (ref) => `${ref.module.name}:${ref.provider.token}`;
@@ -247921,6 +248043,18 @@ JOIN pg_language l ON l.oid = p.prolang
 WHERE n.nspname = ANY($1)
 ORDER BY n.nspname, p.proname
 `;
+var TRIGGERS_SQL = `
+SELECT n.nspname AS schema,
+       c.relname AS table,
+       t.tgname AS name,
+       t.tgenabled <> 'D' AS enabled
+FROM pg_trigger t
+JOIN pg_class c ON c.oid = t.tgrelid
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE NOT t.tgisinternal
+  AND n.nspname = ANY($1)
+ORDER BY n.nspname, c.relname, t.tgname
+`;
 var GRANTS_SQL = `
 SELECT table_schema AS object_schema,
        table_name AS object_name,
@@ -247953,10 +248087,11 @@ function extractSearchPath(config) {
 }
 async function readCatalog(executor, schemas = ["public"]) {
   const params = [schemas];
-  const [tableRows, policyRows, functionRows, grantRows] = await Promise.all([
+  const [tableRows, policyRows, functionRows, triggerRows, grantRows] = await Promise.all([
     executor.query(TABLES_SQL, params),
     executor.query(POLICIES_SQL, params),
     executor.query(FUNCTIONS_SQL, params),
+    executor.query(TRIGGERS_SQL, params),
     executor.query(GRANTS_SQL, params)
   ]);
   return {
@@ -247982,6 +248117,12 @@ async function readCatalog(executor, schemas = ["public"]) {
       searchPath: extractSearchPath(row.config),
       language: row.language
     })),
+    triggers: triggerRows.map((row) => ({
+      schema: row.schema,
+      table: row.table,
+      name: row.name,
+      enabled: row.enabled
+    })),
     grants: grantRows.map((row) => ({
       objectSchema: row.object_schema,
       objectName: row.object_name,
@@ -248035,6 +248176,20 @@ function reconcileModule(module, catalog) {
       push("error", "definer-without-search-path", fn.name, `security definer 函数 ${fn.name} 未设置固定 search_path（当前: ${cf.searchPath ?? "未设置"}）`);
     }
   }
+  for (const trigger of module.triggers) {
+    const [schema, table] = splitQualifiedName(trigger.table);
+    const found = catalog.triggers.some((ct) => ct.schema === schema && ct.table === table && ct.name === trigger.name);
+    if (!found) {
+      push("error", "missing-trigger", `${trigger.table}.${trigger.name}`, `声明的触发器 ${trigger.name} 在表 ${trigger.table} 的 catalog 中不存在`);
+    }
+  }
+  const declaredTriggerKeys = new Set(module.triggers.map((t) => `${t.table}::${t.name}`));
+  for (const ct of catalog.triggers) {
+    const qualified = `${ct.schema}.${ct.table}`;
+    if (ownedTables.has(qualified) && !declaredTriggerKeys.has(`${qualified}::${ct.name}`)) {
+      push("warn", "undeclared-trigger", `${qualified}.${ct.name}`, `归属表 ${qualified} 上存在未声明的触发器 ${ct.name}${ct.enabled ? "" : "（已禁用）"}，可能发生漂移`);
+    }
+  }
   for (const table of module.tables) {
     const [schema, name] = splitQualifiedName(table);
     const ct = catalog.tables.find((t) => t.schema === schema && t.name === name);
@@ -248066,6 +248221,8 @@ var SET_SEARCH_PATH_RE = /\bset\s+search_path\b/i;
 var GRANT_TO_PUBLIC_RE = /\bgrant\b[^;]*\bto\s+public\b/i;
 var DROP_WITHOUT_IF_EXISTS_RE = /\bdrop\s+(?:table|column)\s+(?!if\s+exists\b)/i;
 var ENABLE_RLS_RE = /\benable\s+row\s+level\s+security\b/i;
+var CREATE_POLICY_RE = /\bcreate\s+policy\b/i;
+var DROP_POLICY_IF_EXISTS_RE = /\bdrop\s+policy\s+if\s+exists\b/i;
 function lineOf(sql, index) {
   let line = 1;
   for (let i = 0;i < index; i += 1) {
@@ -248106,6 +248263,19 @@ function lintSql(sql, file) {
       line: lineOf(sql, drop.index)
     });
   }
+  const createPolicy = CREATE_POLICY_RE.exec(sql);
+  if (createPolicy) {
+    const dropPolicy = DROP_POLICY_IF_EXISTS_RE.exec(sql);
+    if (!dropPolicy || dropPolicy.index > createPolicy.index) {
+      issues.push({
+        severity: "warn",
+        code: "non-idempotent-policy",
+        message: "create policy 前缺少 drop policy if exists，策略不可重复执行",
+        file,
+        line: lineOf(sql, createPolicy.index)
+      });
+    }
+  }
   return issues;
 }
 async function lintModule(module, readFile2) {
@@ -250641,7 +250811,7 @@ function registerDeployTools(server2, http, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.40.0",
+  version: "0.41.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -250673,8 +250843,8 @@ var package_default = {
   },
   dependencies: {
     "@sinclair/typebox": "^0.34.52",
-    "@supacloud/compiler": "^0.1.0",
-    "@supacloud/db": "^0.1.0",
+    "@supacloud/compiler": "^0.2.0",
+    "@supacloud/db": "^0.2.0",
     fflate: "^0.8.3"
   },
   devDependencies: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -32,8 +32,8 @@
   },
   "dependencies": {
     "@sinclair/typebox": "^0.34.52",
-    "@supacloud/compiler": "^0.1.0",
-    "@supacloud/db": "^0.1.0",
+    "@supacloud/compiler": "^0.2.0",
+    "@supacloud/db": "^0.2.0",
     "fflate": "^0.8.3"
   },
   "devDependencies": {