@supacloud/compiler 0.44.1 → 0.45.1

package/dist/config.d.ts

@@ -17,6 +17,7 @@ export interface SupaCloudConfig {
     moduleBoundaryPreset?: ModuleBoundaryPresetName;
     moduleBoundaries?: NonNullable<CompileOptions["moduleBoundaries"]>;
     typeSafety?: NonNullable<CompileOptions["typeSafety"]>;
+    databaseGovernance?: NonNullable<CompileOptions["databaseGovernance"]>;
     allowRouteCommandBindings?: boolean;
     disallowControllerDirectDb?: boolean;
     detectOrphanModules?: boolean;
@@ -44,6 +45,7 @@ export declare function resolveSupacloudConfig(config?: SupaCloudConfig, cwd?: s
     commandCapabilities?: CommandExecutionCapabilities;
     moduleBoundaries?: NonNullable<CompileOptions["moduleBoundaries"]>;
     typeSafety?: NonNullable<CompileOptions["typeSafety"]>;
+    databaseGovernance?: NonNullable<CompileOptions["databaseGovernance"]>;
     allowRouteCommandBindings?: boolean;
     disallowControllerDirectDb?: boolean;
     detectOrphanModules?: boolean;

package/dist/database-governance-runtime.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseGovernanceOptions, Diagnostic } from "./types";
+export declare function enforceDatabaseGovernance(options: DatabaseGovernanceOptions): Promise<{
+    diagnostics: Diagnostic[];
+}>;

package/dist/database-governance-worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/database-governance-worker.js

@@ -0,0 +1,159 @@
+// src/database-governance-runtime.ts
+import { readFile, realpath } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  lintModule,
+  readCatalog,
+  reconcileModule
+} from "@supacloud/db";
+import { databaseSources } from "@supacloud/db/source-contracts";
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var text = (value) => typeof value === "string" && value.trim().length > 0;
+var texts = (value) => Array.isArray(value) && Array.from(value).every(text);
+var declarations = (value, required, check) => Array.isArray(value) && Array.from(value).every((entry) => record(entry) && required.every((key) => text(entry[key])) && check(entry));
+function normalizeModule(value, file) {
+  if (!record(value) || !text(value.name) || !texts(value.tables) || !declarations(value.policies, ["name", "table", "source"], (entry) => ["select", "insert", "update", "delete", "all"].includes(String(entry.operation)) && texts(entry.roles) && entry.roles.length > 0 && [entry.usingExpr, entry.checkExpr].every((expr) => expr === undefined || expr === null || typeof expr === "string") && (entry.tests === undefined || texts(entry.tests))) || !declarations(value.functions, ["name", "source"], (entry) => ["invoker", "definer"].includes(String(entry.security)) && (entry.signature === undefined || text(entry.signature)) && (entry.tests === undefined || texts(entry.tests))) || !declarations(value.triggers, ["name", "table", "source"], (entry) => entry.enabled === undefined || typeof entry.enabled === "boolean") || !declarations(value.grants, ["object", "privilege", "role", "source"], () => true)) {
+    throw new Error(`Invalid database module: ${file}`);
+  }
+  return value;
+}
+async function loadModules(projectRoot, moduleFile) {
+  const file = await withinRoot(projectRoot, moduleFile);
+  const imported = await import(pathToFileURL(file).href);
+  const exported = imported.default ?? imported.modules;
+  if (exported === undefined)
+    throw new Error(`Database module file ${moduleFile} must export default or modules`);
+  return (Array.isArray(exported) ? exported : [exported]).map((value) => normalizeModule(value, moduleFile));
+}
+function governanceDiagnostic(message, code = "database-governance") {
+  return {
+    severity: "error",
+    code,
+    message,
+    suggestion: "Fix the database source contract, module manifest or live catalog before compiling."
+  };
+}
+async function enforceDatabaseGovernance(options) {
+  const projectRoot = await realpath(options.projectRoot ?? ".");
+  const sourceReport = await databaseSources(projectRoot, "check");
+  const diagnostics = sourceReport.findings.map((finding) => governanceDiagnostic(`${finding.file}: ${finding.message}`, "database-source-contract"));
+  if (!sourceReport.ok && diagnostics.length === 0) {
+    diagnostics.push(governanceDiagnostic("Database source contract check failed without findings."));
+  }
+  if (diagnostics.length > 0)
+    return { diagnostics };
+  if (options.mode === "check")
+    return { diagnostics };
+  const modules = await loadModules(projectRoot, options.moduleFile ?? "db/modules.ts");
+  if (!modules.length || new Set(modules.map((module) => module.name)).size !== modules.length || modules.some((module) => !module.tables.length && !module.functions.length)) {
+    return { diagnostics: [governanceDiagnostic("Enforced governance requires nonempty, uniquely named database modules.")] };
+  }
+  const readSql = async (path) => readFile(await withinRoot(projectRoot, path), "utf8");
+  for (const module of modules) {
+    for (const issue of await lintModule(module, readSql)) {
+      diagnostics.push(governanceDiagnostic(`${issue.file}${issue.line ? `:${issue.line}` : ""}: ${issue.message}`, "database-sql-contract"));
+    }
+    for (const entry of [...module.functions, ...module.policies]) {
+      for (const path of entry.tests ?? [])
+        await readSql(path);
+    }
+  }
+  if (diagnostics.length)
+    return { diagnostics };
+  const databaseUrlEnv = options.databaseUrlEnv ?? "DATABASE_URL";
+  const databaseUrl = options.databaseUrl ?? process.env[databaseUrlEnv];
+  if (!databaseUrl) {
+    diagnostics.push(governanceDiagnostic(`Database governance mode "enforce" requires ${databaseUrlEnv} for live Catalog reconciliation.`, "database-catalog-unavailable"));
+    return { diagnostics };
+  }
+  if (typeof Bun === "undefined" || typeof Bun.SQL !== "function") {
+    diagnostics.push(governanceDiagnostic("Database governance requires a Bun runtime for Catalog reconciliation.", "database-catalog-unavailable"));
+    return { diagnostics };
+  }
+  const client = new Bun.SQL(databaseUrl);
+  const executor = {
+    async query(sql, params) {
+      return await client.unsafe(sql, params ?? []);
+    }
+  };
+  try {
+    const catalog = await readCatalog(executor, options.schemas ?? ["public"]);
+    for (const module of modules) {
+      for (const issue of reconcileModule(module, catalog).issues) {
+        diagnostics.push(governanceDiagnostic(`${module.name}:${issue.object}: ${issue.message}`, `database-catalog-${issue.code}`));
+      }
+    }
+  } catch {
+    diagnostics.push(governanceDiagnostic("Live Catalog reconciliation failed. Check the selected read-only database connection.", "database-catalog-unavailable"));
+  } finally {
+    await client.close({ timeout: 0 }).catch(() => {});
+  }
+  return { diagnostics };
+}
+async function withinRoot(root, path) {
+  const file = await realpath(resolve(root, path));
+  const local = relative(root, file);
+  if (local === ".." || local.startsWith(`..${sep}`) || isAbsolute(local))
+    throw new Error("Database path escapes project root.");
+  return file;
+}
+
+// src/database-governance.ts
+import { execFile } from "node:child_process";
+import { resolve as resolve2 } from "node:path";
+import { fileURLToPath } from "node:url";
+function assertDatabaseGovernance(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Invalid databaseGovernance configuration.");
+  const entry = value;
+  if (entry["mode"] !== "off" && entry["mode"] !== "check" && entry["mode"] !== "enforce" || Object.keys(entry).some((key) => !["mode", "projectRoot", "moduleFile", "databaseUrl", "databaseUrlEnv", "schemas"].includes(key)) || ["projectRoot", "moduleFile", "databaseUrl", "databaseUrlEnv"].some((key) => entry[key] !== undefined && (typeof entry[key] !== "string" || !entry[key].trim())) || entry["databaseUrlEnv"] !== undefined && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(entry["databaseUrlEnv"])) || entry["schemas"] !== undefined && (!Array.isArray(entry["schemas"]) || !entry["schemas"].length || !entry["schemas"].every((schema) => typeof schema === "string" && schema.trim()))) {
+    throw new Error("Invalid databaseGovernance mode, paths, connection or schemas.");
+  }
+}
+async function checkDatabaseGovernance(rootDir, value) {
+  if (value === undefined)
+    return [];
+  const failure = () => [{
+    severity: "error",
+    code: "database-governance",
+    message: "Database governance could not be verified. Check configuration, installed @supacloud/db, Bun and read-only database access."
+  }];
+  try {
+    assertDatabaseGovernance(value);
+    if (value.mode === "off")
+      return [];
+    const options = { ...value, projectRoot: resolve2(rootDir, value.projectRoot ?? ".") };
+    const worker = fileURLToPath(new URL(import.meta.url.endsWith(".ts") ? "./database-governance-worker.ts" : "./database-governance-worker.js", import.meta.url));
+    const output = await new Promise((accept, reject) => {
+      const child = execFile(process.versions.bun ? process.execPath : "bun", ["--no-env-file", worker], { timeout: 30000, killSignal: "SIGKILL", maxBuffer: 1024 * 1024 }, (error, stdout) => error ? reject(error) : accept(stdout));
+      child.stdin?.on("error", reject);
+      child.stdin?.end(JSON.stringify(options));
+    });
+    const report = JSON.parse(output);
+    if (!report || typeof report !== "object" || !("diagnostics" in report) || !Array.isArray(report.diagnostics))
+      return failure();
+    const diagnostics = [];
+    for (const item of report.diagnostics) {
+      if (!item || typeof item !== "object" || !("code" in item) || typeof item.code !== "string" || !item.code.startsWith("database-") || !("message" in item) || typeof item.message !== "string" || !("severity" in item) || item.severity !== "error")
+        return failure();
+      diagnostics.push({ severity: "error", code: item.code, message: item.message });
+    }
+    return diagnostics;
+  } catch {
+    return failure();
+  }
+}
+
+// src/database-governance-worker.ts
+try {
+  const options = JSON.parse(await Bun.stdin.text());
+  assertDatabaseGovernance(options);
+  process.stdout.write(JSON.stringify(await enforceDatabaseGovernance(options)));
+} catch {
+  process.stdout.write(JSON.stringify({ diagnostics: [{
+    severity: "error",
+    code: "database-governance",
+    message: "Database source, module or Catalog verification failed. Check the selected project and database."
+  }] }));
+}

package/dist/database-governance.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseGovernanceOptions, Diagnostic } from "./types";
+export declare function assertDatabaseGovernance(value: unknown): asserts value is DatabaseGovernanceOptions;
+/** A fresh, bounded process avoids stale module imports during incremental compilation. */
+export declare function checkDatabaseGovernance(rootDir: string, value: DatabaseGovernanceOptions | undefined): Promise<Diagnostic[]>;