@vibeorm/schema 5.5.0 → 5.7.0

package/dist/collation.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Which dialect renders a field's `@collation`.
+ *
+ * MySQL and PostgreSQL both have column collations, in disjoint name
+ * namespaces: every MySQL collation is `binary` or `<character set>_<suffix>`
+ * over a closed list of character sets, while PostgreSQL names are libc
+ * locales (`C`, `POSIX`, `en_US.utf8`), ICU tags (`und-x-icu`), `ucs_basic`,
+ * `pg_c_utf8` or user-created collations. A portable schema that carries a
+ * MySQL collation for its MySQL target therefore stays valid on PostgreSQL,
+ * and a PostgreSQL schema's collation reaches PostgreSQL DDL.
+ */
+import type { Dialect, FieldIR } from "./ir.ts";
+/** Whether a collation name is a MySQL collation: `binary`, or `<MySQL character set>_<suffix>` (case-insensitive, as MySQL reads it). */
+export declare function isMysqlCollationName(params: {
+    name: string;
+}): boolean;
+/**
+ * The collation `dialect` renders for `field`, or `undefined` where the
+ * declaration is inert: MySQL renders every `@collation`, PostgreSQL every one
+ * that is not a MySQL collation name ({@link isMysqlCollationName}), SQLite none.
+ */
+export declare function dialectCollation(params: {
+    field: Pick<FieldIR, "collation">;
+    dialect: Dialect;
+}): string | undefined;
+//# sourceMappingURL=collation.d.ts.map

package/dist/errors.d.ts

@@ -194,7 +194,11 @@ export declare const SCOPED_REFUSAL_REASONS: readonly [
 /** A create leaves out a column a list scope restricts — the handle never picks a value from the list. */
 "scope_value_required", 
 /** `$scoped({ scopes: {} })` — the named form binds at least one scope. */
-"no_scope_bound"];
+"no_scope_bound", 
+/** A { through } relation's effective onDelete/onUpdate is SetDefault, or SetNull on an all-nullable key: the database could detach the row from its parent. */
+"through_detachable", 
+/** A { column } entry's column is part of a foreign key declaring SetDefault: the database could write another tenant's value into it. */
+"column_set_default"];
 export type ScopedRefusalReason = (typeof SCOPED_REFUSAL_REASONS)[number];
 /**
  * A refusal from a tenant-scoped handle (`$scoped`). Carries the model, the

package/dist/index.d.ts

@@ -21,7 +21,7 @@ export { PREDICATE_COMPARISON_OPS, assertPredicateCapabilities, inspectPredicate
 export type { PredicateBooleanUsage, PredicateCapabilityInput, PredicateCapabilityIssue, PredicateCapabilityTable, PredicateComparisonOp, PredicateExpression, PredicateFieldRef, PredicateInspection, PredicateIR, PredicateNodeKind, PredicateNumericType, PredicateOperand, PredicateResultType, PredicateUsage, PredicateValue } from "./predicate.ts";
 export { CHECK_RULE_GROUP_MAX, checkRulePredicate } from "./check-rules.ts";
 export type { CheckRule, CheckRuleGroupKind, CheckRuleLiteral } from "./check-rules.ts";
-export { resolveOnDelete, resolveOnUpdate, resolveReferentialActions } from "./referential-actions.ts";
+export { resolveOnDelete, resolveOnUpdate, resolveReferentialActions, setDefaultRelationOf } from "./referential-actions.ts";
 export { assertMigrationObjects, isSqlObjectDefinition, isSqlObjectIdentity, sqlObjectKey, sqlObjectNamespace } from "./migration-objects.ts";
 export type { MigrationObjectIR, QualifiedSqlName, SqlObjectDefinition, SqlObjectDefinitionFormat, SqlObjectFacts, SqlObjectIdentity } from "./migration-objects.ts";
 export type { AdvisoryLockMode, DialectCapabilities, FullTextEngine, RowLockStrength, RowLockWaitPolicy, TimeOfDayType, } from "./capabilities.ts";
@@ -29,6 +29,7 @@ export { timeOfDayType } from "./time-of-day.ts";
 export { DATE_TRUNCATION_UNITS, dateTruncationStorage } from "./date-truncation.ts";
 export type { DateTruncationStorage, DateTruncationUnit } from "./date-truncation.ts";
 export { isLocalDateField, isCanonicalLocalDate, localDateCheckName } from "./local-date.ts";
+export { dialectCollation, isMysqlCollationName } from "./collation.ts";
 export { READ_ONLY_REFUSAL_REASONS, ReadOnlyClientError, SCOPED_REFUSAL_REASONS, ScopedQueryError, VIBE_ERROR_CODES, VibeError, internalError, invalidStoredData, unsupportedCapability, } from "./errors.ts";
 export type { ReadOnlyRefusalReason, ScopedRefusalReason, VibeErrorCode } from "./errors.ts";
 export { decodePrismaString, encodePrismaString, exactDecimalLiteral, exactIntegerLiteral } from "./prisma-literal.ts";

package/dist/index.js

@@ -109,7 +109,9 @@ var SCOPED_REFUSAL_REASONS = [
   "conflict_target_unscoped",
   "model_denied",
   "scope_value_required",
-  "no_scope_bound"
+  "no_scope_bound",
+  "through_detachable",
+  "column_set_default"
 ];
 
 class ScopedQueryError extends VibeError {
@@ -1596,6 +1598,9 @@ function resolveReferentialActions(params) {
   const required = (relation.fields ?? []).every((name) => params.field(name)?.isOptional !== true);
   return { onDelete: resolveOnDelete({ explicit: relation.onDelete, required }), onUpdate: resolveOnUpdate({ explicit: relation.onUpdate }) };
 }
+function setDefaultRelationOf(params) {
+  return params.relations.find((relation) => !relation.isList && (relation.fields ?? []).includes(params.field) && (relation.onDelete === "SetDefault" || relation.onUpdate === "SetDefault"));
+}
 
 // packages/schema/src/generated-columns.ts
 function declarationIssue(params) {
@@ -2463,6 +2468,71 @@ function dateTruncationStorage(params) {
     return "timestamp";
   return;
 }
+// packages/schema/src/collation.ts
+var MYSQL_CHARACTER_SETS = new Set([
+  "armscii8",
+  "ascii",
+  "big5",
+  "binary",
+  "cp1250",
+  "cp1251",
+  "cp1256",
+  "cp1257",
+  "cp850",
+  "cp852",
+  "cp866",
+  "cp932",
+  "dec8",
+  "eucjpms",
+  "euckr",
+  "gb18030",
+  "gb2312",
+  "gbk",
+  "geostd8",
+  "greek",
+  "hebrew",
+  "hp8",
+  "keybcs2",
+  "koi8r",
+  "koi8u",
+  "latin1",
+  "latin2",
+  "latin5",
+  "latin7",
+  "macce",
+  "macroman",
+  "sjis",
+  "swe7",
+  "tis620",
+  "ucs2",
+  "ujis",
+  "utf16",
+  "utf16le",
+  "utf32",
+  "utf8",
+  "utf8mb3",
+  "utf8mb4"
+]);
+function isMysqlCollationName(params) {
+  const name = params.name.toLowerCase();
+  if (name === "binary")
+    return true;
+  const separator = name.indexOf("_");
+  return separator > 0 && separator < name.length - 1 && MYSQL_CHARACTER_SETS.has(name.slice(0, separator));
+}
+function dialectCollation(params) {
+  const { collation } = params.field;
+  if (collation === undefined)
+    return;
+  switch (params.dialect) {
+    case "mysql":
+      return collation;
+    case "postgres":
+      return isMysqlCollationName({ name: collation }) ? undefined : collation;
+    case "sqlite":
+      return;
+  }
+}
 // packages/schema/src/computed.ts
 function buildComputedManifest(params) {
   const { computed } = params;
@@ -2854,6 +2924,9 @@ var RESERVED_ENUM_NAMES = [
   "createClient",
   "DatabaseAdapter",
   "DbNow",
+  "JoinedField",
+  "TransactionLocalSettings",
+  "VibeUpdateManySources",
   "ClientContext",
   "QueryOperation",
   "QueryEvent",
@@ -2917,6 +2990,8 @@ var GENERATED_TYPE_NAMES = {
     "UpdateInput",
     "UncheckedUpdateInput",
     "UpdateManyInput",
+    "UpdateManyJoinedInput",
+    "UpdateManyFrom",
     "CountAggregateInput",
     "AvgAggregateInput",
     "SumAggregateInput",
@@ -3885,6 +3960,16 @@ function validateModel(params) {
         model: model.name,
         field: policyField.name
       });
+    } else {
+      const repointing = setDefaultRelationOf({ relations: model.relations, field: policyField.name });
+      if (repointing !== undefined) {
+        issues.push({
+          rule: "policy-set-default",
+          message: `@@policy field "${model.name}.${policyField.name}" is a foreign key the database can re-point: relation "${repointing.name}" declares SetDefault, so deleting or re-keying its ${repointing.targetModel} writes the column's default, which can be another tenant's value. Declare onDelete and onUpdate as Cascade, Restrict or NoAction`,
+          model: model.name,
+          field: policyField.name
+        });
+      }
     }
   }
   const checkNames = new Set;
@@ -4378,6 +4463,10 @@ function validateNativeRls(params) {
           else if (slot.type !== field.type)
             add({ rule: "rls-context-type-mismatch", message: `Context ${ref.context} does not match ${model.name}.${field.name}`, field: field.name });
         }
+        const repointing = field === undefined ? undefined : setDefaultRelationOf({ relations: model.relations, field: field.name });
+        if (repointing !== undefined) {
+          add({ rule: "rls-where-set-default", message: `Native RLS ownership column ${model.name}.${String(fieldName)} is a foreign key the database can re-point: relation "${repointing.name}" declares SetDefault, and referential actions bypass row security, so deleting or re-keying its ${repointing.targetModel} writes the column's default, which can be another tenant's value. Declare onDelete and onUpdate as Cascade, Restrict, NoAction or SetNull`, field: String(fieldName) });
+        }
       }
       continue;
     }
@@ -4392,6 +4481,11 @@ function validateNativeRls(params) {
         add({ rule: "rls-nullable-through", message: "Native RLS through requires a non-nullable parent relation and foreign key; NULL parent links cannot satisfy WITH CHECK. Make the link required or use a direct ownership rule", field: relation.name });
         continue;
       }
+      const actions = resolveReferentialActions({ relation, field: (name) => model.fields.find((field) => field.name === name) });
+      if (actions.onDelete === "SetDefault" || actions.onUpdate === "SetDefault") {
+        add({ rule: "rls-through-set-default", message: `Native RLS through requires a foreign key the database cannot re-point: ON ${actions.onDelete === "SetDefault" ? "DELETE" : "UPDATE"} SET DEFAULT moves the row to its key's default parent, which can belong to another tenant, and referential actions bypass row security. Declare onDelete and onUpdate as Cascade, Restrict or NoAction`, field: relation.name });
+        continue;
+      }
       if (table === "parent")
         add({ rule: "rls-through-alias-conflict", message: "A through table mapped to parent would shadow the fixed policy parent alias; use another table name" });
       throughTargets.set(model.name, target.name);
@@ -4487,6 +4581,7 @@ export {
   defaultPrimaryKeyName,
   defaultRowRuleName,
   defineExtension,
+  dialectCollation,
   encodePrismaString,
   enumStorageOf,
   exactDecimalLiteral,
@@ -4517,6 +4612,7 @@ export {
   isExpressionIndex,
   isImplicitManyToManyRelation,
   isLocalDateField,
+  isMysqlCollationName,
   isPredicateFieldRef,
   isReservedClientName,
   isReservedDelegateName,
@@ -4555,6 +4651,7 @@ export {
   scalarListDefault,
   schemaRowRuleIdentities,
   serializeJsonDefault,
+  setDefaultRelationOf,
   sqlNamespaceIssue,
   sqlObjectKey,
   sqlObjectNamespace,
@@ -4570,4 +4667,4 @@ export {
   validatorRefIssue
 };
 
-//# debugId=143878A615D384D864756E2164756E21
+//# debugId=8784FDF6327C16F164756E2164756E21