dev-booster 1.18.0 → 1.18.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/template/.devbooster/MANIFEST.md +34 -1
- package/template/.devbooster/boosters/advisor.md +5 -0
- package/template/.devbooster/boosters/audit.md +20 -0
- package/template/.devbooster/boosters/auto-triage.md +5 -0
- package/template/.devbooster/boosters/backend.md +12 -0
- package/template/.devbooster/boosters/builder.md +5 -0
- package/template/.devbooster/boosters/code-audit.md +19 -0
- package/template/.devbooster/boosters/coder.md +5 -0
- package/template/.devbooster/boosters/create.md +5 -0
- package/template/.devbooster/boosters/debug.md +19 -0
- package/template/.devbooster/boosters/deploy.md +12 -0
- package/template/.devbooster/boosters/discovery.md +5 -0
- package/template/.devbooster/boosters/frontend.md +12 -0
- package/template/.devbooster/boosters/implementation.md +5 -0
- package/template/.devbooster/boosters/investigation.md +5 -0
- package/template/.devbooster/boosters/performance.md +12 -0
- package/template/.devbooster/boosters/planning.md +5 -0
- package/template/.devbooster/boosters/refactor.md +12 -0
- package/template/.devbooster/boosters/review.md +12 -0
- package/template/.devbooster/boosters/security.md +14 -0
- package/template/.devbooster/boosters/smart-task.md +27 -16
- package/template/.devbooster/boosters/stack-refresh.md +20 -0
- package/template/.devbooster/boosters/testing.md +12 -0
- package/template/.devbooster/hub/knowledge/angular-patterns.md +185 -0
- package/template/.devbooster/hub/knowledge/dependency-guide.md +175 -0
- package/template/.devbooster/hub/knowledge/eslint-migration.md +206 -0
- package/template/.devbooster/hub/knowledge/index.md +91 -0
- package/template/.devbooster/hub/knowledge/migration-guides.md +137 -0
- package/template/.devbooster/hub/knowledge/monorepo-patterns.md +121 -0
- package/template/.devbooster/hub/knowledge/nestjs-patterns.md +185 -0
- package/template/.devbooster/hub/knowledge/nextjs-pitfalls.md +226 -0
- package/template/.devbooster/hub/knowledge/nodejs-patterns.md +148 -0
- package/template/.devbooster/hub/knowledge/package-manager-patterns.md +143 -0
- package/template/.devbooster/hub/knowledge/prisma-postgresql-patterns.md +188 -0
- package/template/.devbooster/hub/knowledge/react-patterns.md +500 -0
- package/template/.devbooster/hub/knowledge/tailwind-shadcn-patterns.md +146 -0
- package/template/.devbooster/hub/knowledge/tanstack-patterns.md +278 -0
- package/template/.devbooster/hub/knowledge/testing-patterns.md +164 -0
- package/template/.devbooster/hub/knowledge/trpc-patterns.md +212 -0
- package/template/.devbooster/hub/knowledge/typescript-patterns.md +219 -0
- package/template/.devbooster/hub/knowledge/upgrade-fallout.md +154 -0
- package/template/.devbooster/hub/knowledge/vite-patterns.md +177 -0
- package/template/.devbooster/rules/GUIDE.md +24 -0
- package/template/.devbooster/rules/PROTOCOL.md +3 -2
- package/template/.devbooster/rules/TRIGGERS.md +14 -0
|
@@ -0,0 +1,148 @@
|
|
|
1
|
+
# Node.js Runtime Patterns
|
|
2
|
+
|
|
3
|
+
> **Purpose:** Diagnose and prevent common Node.js runtime, module, environment, and script failures.
|
|
4
|
+
> **Primary official sources:** [Node.js documentation](https://nodejs.org/docs/latest/api/) · [npm package.json documentation](https://docs.npmjs.com/cli/v11/configuring-npm/package-json) · [npm scripts documentation](https://docs.npmjs.com/cli/v11/using-npm/scripts)
|
|
5
|
+
|
|
6
|
+
## Project Convention Decision Rule
|
|
7
|
+
|
|
8
|
+
Before applying this guidance, verify the installed versions, local rules, existing abstractions, configuration, runtime environment, and tests. Preserve a valid established project convention; do not replace it only because another documented approach is also valid. Use official sources to verify API behavior, compatibility, constraints, and migrations. Recommend a change only when the developer requests it or evidence shows the current approach is incompatible, unsafe, deprecated, broken, or responsible for a verified issue.
|
|
9
|
+
|
|
10
|
+
---
|
|
11
|
+
|
|
12
|
+
## Table of Contents
|
|
13
|
+
|
|
14
|
+
1. [Runtime and Engines Misalignment](#runtime-and-engines-misalignment)
|
|
15
|
+
2. [ESM and CommonJS Interoperability](#esm-and-commonjs-interoperability)
|
|
16
|
+
3. [Environment Loading and Validation](#environment-loading-and-validation)
|
|
17
|
+
4. [Unhandled Async Failures](#unhandled-async-failures)
|
|
18
|
+
5. [Portable npm Scripts and Lifecycle Hooks](#portable-npm-scripts-and-lifecycle-hooks)
|
|
19
|
+
6. [Version Manager, CI, and Container Alignment](#version-manager-ci-and-container-alignment)
|
|
20
|
+
|
|
21
|
+
---
|
|
22
|
+
|
|
23
|
+
## Runtime and Engines Misalignment
|
|
24
|
+
|
|
25
|
+
### Symptom
|
|
26
|
+
A command works on one machine but fails in CI or production with syntax errors, unsupported APIs, native-module errors, or an `EBADENGINE` warning/error.
|
|
27
|
+
|
|
28
|
+
### Verify first
|
|
29
|
+
```sh
|
|
30
|
+
node --version
|
|
31
|
+
npm --version
|
|
32
|
+
node -p "process.version"
|
|
33
|
+
```
|
|
34
|
+
Compare those values with the root `package.json` `engines`, the CI runtime setup, container base image, and any version-manager file. `engines` expresses compatibility metadata; enforcement depends on the package manager and its configuration. See [npm `engines`](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#engines).
|
|
35
|
+
|
|
36
|
+
### Fix
|
|
37
|
+
- Define a tested Node range in `engines`; use an exact version only when reproducibility requires it.
|
|
38
|
+
- Select a Node version explicitly in CI and containers rather than relying on a runner or image default.
|
|
39
|
+
- Rebuild native dependencies after changing Node versions; do not reuse artifacts built against an incompatible ABI.
|
|
40
|
+
- Keep local version-manager configuration aligned with the supported range.
|
|
41
|
+
|
|
42
|
+
---
|
|
43
|
+
|
|
44
|
+
## ESM and CommonJS Interoperability
|
|
45
|
+
|
|
46
|
+
### Symptom
|
|
47
|
+
`require is not defined`, `ERR_REQUIRE_ESM`, missing named exports, or different behavior between development and production builds.
|
|
48
|
+
|
|
49
|
+
### Verify first
|
|
50
|
+
Inspect the closest `package.json` for `"type"`, the file extension (`.mjs`, `.cjs`, `.js`), and the dependency's documented exports. Node determines module interpretation from these inputs. See [Node.js modules: packages](https://nodejs.org/docs/latest/api/packages.html) and [ECMAScript modules](https://nodejs.org/docs/latest/api/esm.html).
|
|
51
|
+
|
|
52
|
+
### Fix
|
|
53
|
+
- Choose one module system for new application code and declare it deliberately with `type` or explicit extensions.
|
|
54
|
+
- In ESM, import CommonJS through its default export when necessary, then read properties from that value.
|
|
55
|
+
- In CommonJS, use `import()` for an ESM-only dependency because synchronous `require()` has compatibility limits.
|
|
56
|
+
- Do not depend on undocumented deep imports or inferred named exports; use the dependency's public export map.
|
|
57
|
+
|
|
58
|
+
```js
|
|
59
|
+
// CommonJS loading an ESM package
|
|
60
|
+
const loadTool = () => import('an-esm-only-package')
|
|
61
|
+
|
|
62
|
+
// ESM consuming CommonJS
|
|
63
|
+
import legacyPackage from 'legacy-package'
|
|
64
|
+
const { createClient } = legacyPackage
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
---
|
|
68
|
+
|
|
69
|
+
## Environment Loading and Validation
|
|
70
|
+
|
|
71
|
+
### Symptom
|
|
72
|
+
A service starts with `undefined` configuration, uses development credentials in another environment, or fails only after handling traffic.
|
|
73
|
+
|
|
74
|
+
### Verify first
|
|
75
|
+
Identify where configuration is loaded, which process owns it, and whether the expected variables are present without printing secrets:
|
|
76
|
+
|
|
77
|
+
```sh
|
|
78
|
+
node -e "console.log(Boolean(process.env.REQUIRED_SETTING))"
|
|
79
|
+
```
|
|
80
|
+
Node exposes the process environment through [`process.env`](https://nodejs.org/docs/latest/api/process.html#processenv). Recent Node releases also document loading `.env` files with [`--env-file`](https://nodejs.org/docs/latest/api/cli.html#--env-fileconfig); verify availability in the exact Node version in use before relying on it.
|
|
81
|
+
|
|
82
|
+
### Fix
|
|
83
|
+
- Load configuration before importing or initializing code that reads it.
|
|
84
|
+
- Validate required variables, types, allowed values, and cross-field constraints at process startup; fail with variable names, never secret values.
|
|
85
|
+
- Treat environment values as strings until parsed and validated.
|
|
86
|
+
- Keep secrets out of source control and inject them through the deployment environment or an approved secret mechanism.
|
|
87
|
+
|
|
88
|
+
---
|
|
89
|
+
|
|
90
|
+
## Unhandled Async Failures
|
|
91
|
+
|
|
92
|
+
### Symptom
|
|
93
|
+
A request hangs, an error appears as an unhandled rejection, or the process exits unexpectedly after an async operation fails.
|
|
94
|
+
|
|
95
|
+
### Verify first
|
|
96
|
+
Trace every promise-returning call to an `await`/`return`/`.catch()`. Review the runtime's unhandled-rejection behavior for the deployed Node version: [Node.js `unhandledRejection`](https://nodejs.org/docs/latest/api/process.html#event-unhandledrejection).
|
|
97
|
+
|
|
98
|
+
### Fix
|
|
99
|
+
- Await promises inside `try`/`catch` where recovery or translation is needed.
|
|
100
|
+
- Return promises from wrapper functions so callers can observe failures.
|
|
101
|
+
- At process boundaries, log actionable context, release resources, and exit or restart according to the service's supervision model.
|
|
102
|
+
- Do not use a global rejection handler as a substitute for local error handling; it is an observability and last-resort shutdown boundary.
|
|
103
|
+
|
|
104
|
+
```js
|
|
105
|
+
async function readConfiguration() {
|
|
106
|
+
try {
|
|
107
|
+
return await fetchConfiguration()
|
|
108
|
+
} catch (error) {
|
|
109
|
+
throw new Error('Configuration could not be loaded', { cause: error })
|
|
110
|
+
}
|
|
111
|
+
}
|
|
112
|
+
```
|
|
113
|
+
|
|
114
|
+
---
|
|
115
|
+
|
|
116
|
+
## Portable npm Scripts and Lifecycle Hooks
|
|
117
|
+
|
|
118
|
+
### Symptom
|
|
119
|
+
A script passes on one operating system but fails in CI, or an install unexpectedly runs build, download, or publish-related code.
|
|
120
|
+
|
|
121
|
+
### Verify first
|
|
122
|
+
Review `scripts` and lifecycle names in `package.json`, then run the exact package-manager command used by CI. npm exposes lifecycle context through environment variables and has command-specific lifecycle behavior; see [npm scripts](https://docs.npmjs.com/cli/v11/using-npm/scripts) and [lifecycle scripts](https://docs.npmjs.com/cli/v11/using-npm/scripts#life-cycle-operation-order).
|
|
123
|
+
|
|
124
|
+
### Fix
|
|
125
|
+
- Prefer Node-based scripts or cross-platform tooling over shell-specific syntax, utilities, and environment assignments.
|
|
126
|
+
- Make each script's inputs and outputs explicit; use package binaries through the package manager rather than assuming global installations.
|
|
127
|
+
- Keep `prepare`, `prepack`, `prepublishOnly`, and install hooks small and intentional. Verify which commands trigger each hook before placing builds or side effects there.
|
|
128
|
+
- Run install commands with lifecycle scripts disabled only as a diagnostic or controlled security measure, not as a permanent workaround for an unknown hook.
|
|
129
|
+
|
|
130
|
+
---
|
|
131
|
+
|
|
132
|
+
## Version Manager, CI, and Container Alignment
|
|
133
|
+
|
|
134
|
+
### Problem
|
|
135
|
+
Node is pinned locally but not in CI or the deployment image, creating a runtime matrix that is neither tested nor supported.
|
|
136
|
+
|
|
137
|
+
### Fix
|
|
138
|
+
Use one documented source of truth for the supported Node range, and make every execution environment select a compatible runtime:
|
|
139
|
+
|
|
140
|
+
| Environment | Check |
|
|
141
|
+
| --- | --- |
|
|
142
|
+
| Local development | Version-manager configuration and `node --version` |
|
|
143
|
+
| CI | Explicit setup action/task and cache key including Node and lockfile |
|
|
144
|
+
| Container | Explicit base-image tag and rebuild after runtime changes |
|
|
145
|
+
| Deployment | Platform runtime setting or image runtime |
|
|
146
|
+
|
|
147
|
+
### Verify first
|
|
148
|
+
Print `node --version` at the start of CI and from the built container. Install from the committed lockfile, then run the same test/build commands that validate local development. For supported release lines and schedules, use the [Node.js release page](https://nodejs.org/en/about/previous-releases).
|
|
@@ -0,0 +1,143 @@
|
|
|
1
|
+
# Package Manager Patterns
|
|
2
|
+
|
|
3
|
+
> **Purpose:** Resolve reproducibility, dependency-resolution, workspace-scope, and security-report issues across npm, Yarn, and pnpm.
|
|
4
|
+
> **Primary official sources:** [npm CLI documentation](https://docs.npmjs.com/cli/) · [Yarn documentation](https://yarnpkg.com/configuration/manifest) · [pnpm documentation](https://pnpm.io/)
|
|
5
|
+
|
|
6
|
+
## Project Convention Decision Rule
|
|
7
|
+
|
|
8
|
+
Before applying this guidance, verify the installed versions, local rules, package manager, lockfile, workspace layout, configuration, and tests. Preserve a valid established project convention; do not replace it only because another documented approach is also valid. Use official sources to verify API behavior, compatibility, constraints, and migrations. Recommend a change only when the developer requests it or evidence shows the current approach is incompatible, unsafe, deprecated, broken, or responsible for a verified issue.
|
|
9
|
+
|
|
10
|
+
---
|
|
11
|
+
|
|
12
|
+
## Table of Contents
|
|
13
|
+
|
|
14
|
+
1. [Detect the Manager and Lockfile](#detect-the-manager-and-lockfile)
|
|
15
|
+
2. [Override and Resolution Semantics](#override-and-resolution-semantics)
|
|
16
|
+
3. [Peer Dependency Conflicts](#peer-dependency-conflicts)
|
|
17
|
+
4. [Serialized Installs](#serialized-installs)
|
|
18
|
+
5. [Audit Findings](#audit-findings)
|
|
19
|
+
6. [Workspace Root Versus Package Scope](#workspace-root-versus-package-scope)
|
|
20
|
+
7. [Frozen Lockfile Validation](#frozen-lockfile-validation)
|
|
21
|
+
|
|
22
|
+
---
|
|
23
|
+
|
|
24
|
+
## Detect the Manager and Lockfile
|
|
25
|
+
|
|
26
|
+
### Symptom
|
|
27
|
+
An install rewrites the lockfile, resolves a different tree, or fails because a command was run with the wrong manager.
|
|
28
|
+
|
|
29
|
+
### Verify first
|
|
30
|
+
Inspect the repository root for `packageManager` in `package.json`, manager configuration files, and lockfiles such as `package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml`. The Corepack documentation explains the `packageManager` field and shims: [Node.js Corepack](https://nodejs.org/docs/latest/api/corepack.html).
|
|
31
|
+
|
|
32
|
+
### Fix
|
|
33
|
+
- Use the manager declared by the repository; do not introduce or regenerate another manager's lockfile.
|
|
34
|
+
- Treat one committed lockfile as the install-resolution authority for a repository.
|
|
35
|
+
- When the intended manager is ambiguous, inspect CI and contributor documentation before changing dependencies.
|
|
36
|
+
- Pin the manager release through the repository's supported mechanism, then ensure CI uses the same release family.
|
|
37
|
+
|
|
38
|
+
---
|
|
39
|
+
|
|
40
|
+
## Override and Resolution Semantics
|
|
41
|
+
|
|
42
|
+
### Problem
|
|
43
|
+
A transitive dependency needs a security or compatibility fix, but editing a lockfile directly is fragile and will be overwritten.
|
|
44
|
+
|
|
45
|
+
### Verify first
|
|
46
|
+
Identify the full dependency path and confirm the replacement version is compatible. Then use the manager's native manifest field:
|
|
47
|
+
|
|
48
|
+
| Manager | Manifest mechanism | Official reference |
|
|
49
|
+
| --- | --- | --- |
|
|
50
|
+
| npm | `overrides` | [npm `overrides`](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#overrides) |
|
|
51
|
+
| Yarn | `resolutions` | [Yarn manifest `resolutions`](https://yarnpkg.com/configuration/manifest#resolutions) |
|
|
52
|
+
| pnpm | `pnpm.overrides` | [pnpm overrides](https://pnpm.io/package_json#pnpmoverrides) |
|
|
53
|
+
|
|
54
|
+
### Fix
|
|
55
|
+
- Put the override where that manager resolves dependencies, normally the root manifest for a workspace repository.
|
|
56
|
+
- Scope it as narrowly as the manager supports; document the reason and remove it when upstream constraints no longer require it.
|
|
57
|
+
- Reinstall with the declared manager, review the lockfile diff, and test the affected dependency path.
|
|
58
|
+
- Do not assume the fields are interchangeable: selector syntax, allowed locations, and direct-dependency rules differ by manager.
|
|
59
|
+
|
|
60
|
+
---
|
|
61
|
+
|
|
62
|
+
## Peer Dependency Conflicts
|
|
63
|
+
|
|
64
|
+
### Symptom
|
|
65
|
+
Installation reports incompatible peers, installs multiple host versions, or runtime plugins fail because they are connected to an unexpected host package.
|
|
66
|
+
|
|
67
|
+
### Verify first
|
|
68
|
+
Read the peer range from the package reporting the conflict and identify the actual host version selected by the lockfile. A peer dependency expresses compatibility with a package supplied by the consumer; see [npm peer dependencies](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependencies) and [pnpm peer dependencies](https://pnpm.io/npmrc#strict-peer-dependencies).
|
|
69
|
+
|
|
70
|
+
### Fix
|
|
71
|
+
1. Prefer versions whose peer ranges overlap.
|
|
72
|
+
2. Upgrade or replace the dependent package if it does not support the selected host.
|
|
73
|
+
3. Use a documented compatibility bridge only after testing the integration.
|
|
74
|
+
4. Avoid permanently suppressing peer checks. A flag can unblock diagnosis, but it does not make an unsupported runtime combination safe.
|
|
75
|
+
|
|
76
|
+
---
|
|
77
|
+
|
|
78
|
+
## Serialized Installs
|
|
79
|
+
|
|
80
|
+
### Symptom
|
|
81
|
+
Concurrent jobs or processes corrupt a lockfile, contend for package-manager state, or publish nondeterministic dependency changes.
|
|
82
|
+
|
|
83
|
+
### Fix
|
|
84
|
+
- Make dependency updates a serialized workflow: one writer updates the manifest and lockfile, then commits both together.
|
|
85
|
+
- Keep CI installs read-only with respect to the lockfile.
|
|
86
|
+
- Avoid sharing mutable package-manager caches or store directories across concurrent jobs unless the tool and cache backend support it safely.
|
|
87
|
+
- Separate dependency-update automation from build/test jobs that only consume the committed resolution.
|
|
88
|
+
|
|
89
|
+
### Verify first
|
|
90
|
+
Run a clean install twice in separate workspaces, then confirm the lockfile and dependency tree do not change. Use the manager's own listing/why command to verify the selected version.
|
|
91
|
+
|
|
92
|
+
---
|
|
93
|
+
|
|
94
|
+
## Audit Findings
|
|
95
|
+
|
|
96
|
+
### Symptom
|
|
97
|
+
An audit reports vulnerabilities and a bulk auto-fix proposes major upgrades, lockfile churn, or removal of required packages.
|
|
98
|
+
|
|
99
|
+
### Verify first
|
|
100
|
+
For each finding, determine whether the vulnerable package is reachable in the shipped runtime, which version introduces the fix, and whether the advisory applies to the supported deployment path. npm documents its audit command and report format in [npm audit](https://docs.npmjs.com/auditing-package-dependencies-for-security-vulnerabilities).
|
|
101
|
+
|
|
102
|
+
### Fix
|
|
103
|
+
- Prioritize direct, runtime-reachable, exploitable dependencies.
|
|
104
|
+
- Upgrade the owning direct dependency when possible; use a narrowly scoped override only when necessary.
|
|
105
|
+
- Review major-version changes and test behavior instead of blindly accepting forceful remediation.
|
|
106
|
+
- Record accepted risk with scope and review conditions when no compatible fix exists.
|
|
107
|
+
|
|
108
|
+
An audit is an input to risk assessment, not proof that an application is exploitable or safe.
|
|
109
|
+
|
|
110
|
+
---
|
|
111
|
+
|
|
112
|
+
## Workspace Root Versus Package Scope
|
|
113
|
+
|
|
114
|
+
### Problem
|
|
115
|
+
A command runs against the wrong package, configuration appears ignored, or a dependency is added to the root when it belongs to an application/library package.
|
|
116
|
+
|
|
117
|
+
### Verify first
|
|
118
|
+
Confirm the current directory, workspace declaration, and package target. npm documents workspace targeting in [npm workspaces](https://docs.npmjs.com/cli/v11/using-npm/workspaces); Yarn and pnpm have equivalent workspace-aware command support.
|
|
119
|
+
|
|
120
|
+
### Fix
|
|
121
|
+
- Put runtime and library dependencies in the package that imports them.
|
|
122
|
+
- Keep root tooling dependencies at the root only when the root owns the command or configuration.
|
|
123
|
+
- Use explicit workspace selectors for install, run, test, and publish operations.
|
|
124
|
+
- Avoid assuming a command's default scope; root and workspace behavior is manager- and command-specific.
|
|
125
|
+
|
|
126
|
+
---
|
|
127
|
+
|
|
128
|
+
## Frozen Lockfile Validation
|
|
129
|
+
|
|
130
|
+
### Symptom
|
|
131
|
+
CI succeeds after silently modifying a lockfile, or a clean checkout cannot reproduce the committed dependency tree.
|
|
132
|
+
|
|
133
|
+
### Fix
|
|
134
|
+
Use the manager's immutable/frozen validation mode in CI:
|
|
135
|
+
|
|
136
|
+
| Manager | Typical validation command | Reference |
|
|
137
|
+
| --- | --- | --- |
|
|
138
|
+
| npm | `npm ci` | [npm ci](https://docs.npmjs.com/cli/v11/commands/npm-ci) |
|
|
139
|
+
| Yarn | `yarn install --immutable` | [Yarn install](https://yarnpkg.com/cli/install) |
|
|
140
|
+
| pnpm | `pnpm install --frozen-lockfile` | [pnpm install](https://pnpm.io/cli/install) |
|
|
141
|
+
|
|
142
|
+
### Verify first
|
|
143
|
+
Start from a clean checkout, run the applicable command, then confirm no manifest or lockfile changes are produced. Use the exact manager release declared by the repository.
|
|
@@ -0,0 +1,188 @@
|
|
|
1
|
+
# Prisma + PostgreSQL Patterns
|
|
2
|
+
|
|
3
|
+
> **Purpose:** Practical guidance for safe Prisma and PostgreSQL changes.
|
|
4
|
+
> **Primary official sources:** [Prisma schema reference](https://www.prisma.io/docs/orm/reference/prisma-schema-reference) · [Prisma Migrate](https://www.prisma.io/docs/orm/prisma-migrate) · [Prisma transactions](https://www.prisma.io/docs/orm/prisma-client/queries/transactions) · [PostgreSQL EXPLAIN](https://www.postgresql.org/docs/current/using-explain.html) · [PostgreSQL indexes](https://www.postgresql.org/docs/current/indexes.html)
|
|
5
|
+
|
|
6
|
+
## Project Convention Decision Rule
|
|
7
|
+
|
|
8
|
+
Before applying this guidance, verify the installed versions, local rules, existing data-access abstractions, schema, migration history, configuration, and tests. Preserve a valid established project convention; do not replace it only because another documented approach is also valid. Use official sources to verify API behavior, compatibility, constraints, and migrations. Recommend a change only when the developer requests it or evidence shows the current approach is incompatible, unsafe, deprecated, broken, or responsible for a verified issue.
|
|
9
|
+
|
|
10
|
+
---
|
|
11
|
+
|
|
12
|
+
## Table of Contents
|
|
13
|
+
|
|
14
|
+
1. [Schema–Client Generation Drift](#schemaclient-generation-drift)
|
|
15
|
+
2. [Safe Migration Workflow](#safe-migration-workflow)
|
|
16
|
+
3. [Expand–Contract Changes](#expandcontract-changes)
|
|
17
|
+
4. [Relations, Selection, and N+1](#relations-selection-and-n1)
|
|
18
|
+
5. [Transaction Boundaries](#transaction-boundaries)
|
|
19
|
+
6. [Indexes and Query Plans](#indexes-and-query-plans)
|
|
20
|
+
7. [Connection Pooling and Runtime Constraints](#connection-pooling-and-runtime-constraints)
|
|
21
|
+
|
|
22
|
+
---
|
|
23
|
+
|
|
24
|
+
## Schema–Client Generation Drift
|
|
25
|
+
|
|
26
|
+
### Problem
|
|
27
|
+
The Prisma schema, generated client, migration history, and deployed database describe different states. Typical symptoms are missing client properties, runtime errors for a new column, or a client that compiles locally but fails after deployment.
|
|
28
|
+
|
|
29
|
+
### Verify first
|
|
30
|
+
- Confirm the database URL and schema used by the failing runtime.
|
|
31
|
+
- Compare the checked-in `prisma/schema.prisma`, committed migrations, and generated-client version.
|
|
32
|
+
- Determine whether the change is intentional schema drift, a missed migration, or a stale generated artifact. Do not use `db push` to repair a production migration history without understanding the consequence.
|
|
33
|
+
|
|
34
|
+
### Fix
|
|
35
|
+
- Treat the Prisma schema and migration files as reviewed source of truth.
|
|
36
|
+
- After changing the schema, create or update the migration in development, then run `prisma generate` where the client is built.
|
|
37
|
+
- Deploy reviewed migrations with `prisma migrate deploy`; keep runtime images/functions responsible for generating or containing the matching client.
|
|
38
|
+
- Use [`prisma migrate diff`](https://www.prisma.io/docs/orm/prisma-migrate/workflows/troubleshooting#using-prisma-migrate-diff) to inspect a suspected difference before resolving drift.
|
|
39
|
+
|
|
40
|
+
### Verify
|
|
41
|
+
- Run type checking and a narrow query that reads/writes the changed model against a representative database.
|
|
42
|
+
- In the deployment artifact, confirm the generated client version matches the installed `prisma` package and schema.
|
|
43
|
+
|
|
44
|
+
---
|
|
45
|
+
|
|
46
|
+
## Safe Migration Workflow
|
|
47
|
+
|
|
48
|
+
### Problem
|
|
49
|
+
A migration succeeds on an empty development database but risks data loss, locking, or incompatible application behavior on a populated database.
|
|
50
|
+
|
|
51
|
+
### Verify first
|
|
52
|
+
- Inspect the generated SQL before it reaches a shared environment.
|
|
53
|
+
- Estimate table size, write volume, existing nulls/duplicates, and lock sensitivity.
|
|
54
|
+
- Identify PostgreSQL version and whether the operation can run inside a transaction; some operations, such as `CREATE INDEX CONCURRENTLY`, cannot.
|
|
55
|
+
|
|
56
|
+
### Fix
|
|
57
|
+
- Create migrations from the schema in development and commit both schema and migration SQL.
|
|
58
|
+
- Make destructive or data-dependent changes explicit. Backfill data deliberately rather than relying on a nullable-to-required change to succeed by chance.
|
|
59
|
+
- Test the actual migration against a production-like copy or representative dataset, including rollback or recovery procedures.
|
|
60
|
+
- Use `migrate deploy` for controlled environments; do not use development reset workflows against data that must be retained.
|
|
61
|
+
|
|
62
|
+
### Verify
|
|
63
|
+
- Check the migration table and application health after deployment.
|
|
64
|
+
- Confirm expected row counts, constraints, and query behavior rather than treating a zero exit status as sufficient.
|
|
65
|
+
|
|
66
|
+
*Sources: [Prisma production and testing environments](https://www.prisma.io/docs/orm/prisma-migrate/workflows/development-and-production), [PostgreSQL ALTER TABLE](https://www.postgresql.org/docs/current/sql-altertable.html).*
|
|
67
|
+
|
|
68
|
+
---
|
|
69
|
+
|
|
70
|
+
## Expand–Contract Changes
|
|
71
|
+
|
|
72
|
+
### Problem
|
|
73
|
+
A single migration removes or renames a column while older application instances, queued jobs, or rollback images still use it.
|
|
74
|
+
|
|
75
|
+
### Verify first
|
|
76
|
+
- Identify every deployed version, asynchronous consumer, reporting query, and external integration that reads or writes the affected field.
|
|
77
|
+
- Confirm how long old instances can remain alive and whether a rollback would require the old schema.
|
|
78
|
+
|
|
79
|
+
### Fix
|
|
80
|
+
1. **Expand:** Add the new nullable column/table/index without removing the old interface.
|
|
81
|
+
2. Deploy code that can read the old representation and write the new one (or dual-read/dual-write when necessary).
|
|
82
|
+
3. Backfill in observable, bounded batches; validate completeness.
|
|
83
|
+
4. Switch reads to the new representation after all active writers are compatible.
|
|
84
|
+
5. **Contract:** Remove the old column, constraint, or code only in a later release.
|
|
85
|
+
|
|
86
|
+
Avoid dual writes when a database trigger, one-way compatibility read, or short maintenance window provides a simpler and safer invariant. The correct approach depends on consistency requirements and deployment overlap.
|
|
87
|
+
|
|
88
|
+
### Verify
|
|
89
|
+
- Measure records remaining to backfill and compare old/new values where both exist.
|
|
90
|
+
- Before contraction, prove that no supported application version issues queries using the old schema.
|
|
91
|
+
|
|
92
|
+
*Source: [Prisma custom migration SQL](https://www.prisma.io/docs/orm/prisma-migrate/workflows/customizing-migrations).*
|
|
93
|
+
|
|
94
|
+
---
|
|
95
|
+
|
|
96
|
+
## Relations, Selection, and N+1
|
|
97
|
+
|
|
98
|
+
### Symptom
|
|
99
|
+
An endpoint becomes slow as result count grows, emits one query per parent row, or transfers much more data than its response needs.
|
|
100
|
+
|
|
101
|
+
### Verify first
|
|
102
|
+
- Enable query logging or inspect database activity to count queries for one request.
|
|
103
|
+
- Measure the response shape and identify exactly which scalar fields and relations are needed.
|
|
104
|
+
- Check cardinality: a broad `include` across multiple to-many relations can create large result sets even without a classic N+1 loop.
|
|
105
|
+
|
|
106
|
+
### Fix
|
|
107
|
+
- Use `select` to request only needed scalar fields; use relation `select`/`include` deliberately.
|
|
108
|
+
- Fetch relation data in a bounded query rather than awaiting `findUnique` inside an application loop.
|
|
109
|
+
- Consider Prisma's relation load strategy only after measuring. `join` and `query` have different database and application trade-offs; availability depends on the provider and Prisma version.
|
|
110
|
+
- Paginate parent and child collections with stable ordering. Do not solve unbounded response size solely by adding eager loading.
|
|
111
|
+
|
|
112
|
+
### Verify
|
|
113
|
+
- Assert query count and payload shape in an integration test or trace.
|
|
114
|
+
- Recheck latency and database load with representative cardinality.
|
|
115
|
+
|
|
116
|
+
*Source: [Prisma relation queries](https://www.prisma.io/docs/orm/prisma-client/queries/relation-queries).*
|
|
117
|
+
|
|
118
|
+
---
|
|
119
|
+
|
|
120
|
+
## Transaction Boundaries
|
|
121
|
+
|
|
122
|
+
### Problem
|
|
123
|
+
A workflow leaves partial state after a failure, or a transaction holds locks/connections while it performs network I/O or slow computation.
|
|
124
|
+
|
|
125
|
+
### Verify first
|
|
126
|
+
- Define the invariant that must be atomic and the acceptable behavior for retries.
|
|
127
|
+
- Identify external side effects (email, HTTP calls, queues, files): they cannot be atomically committed with a PostgreSQL transaction.
|
|
128
|
+
- Check contention, isolation requirements, and transaction duration under realistic concurrency.
|
|
129
|
+
|
|
130
|
+
### Fix
|
|
131
|
+
- Use nested writes or `$transaction([])` for independent Prisma operations that must commit together.
|
|
132
|
+
- Use an interactive transaction only when later decisions depend on earlier reads, and keep its callback short.
|
|
133
|
+
- Perform external effects after commit, or record an outbox event transactionally and deliver it separately.
|
|
134
|
+
- Use database constraints and idempotency keys where possible; application-level check-then-insert logic alone races under concurrency.
|
|
135
|
+
|
|
136
|
+
### Verify
|
|
137
|
+
- Force a failure at each write boundary and confirm the invariant remains true.
|
|
138
|
+
- Load-test conflicting operations and inspect retry/unique-constraint behavior.
|
|
139
|
+
|
|
140
|
+
*Sources: [Prisma transaction guidance](https://www.prisma.io/docs/orm/prisma-client/queries/transactions#transaction-options), [PostgreSQL transaction isolation](https://www.postgresql.org/docs/current/transaction-iso.html).*
|
|
141
|
+
|
|
142
|
+
---
|
|
143
|
+
|
|
144
|
+
## Indexes and Query Plans
|
|
145
|
+
|
|
146
|
+
### Symptom
|
|
147
|
+
A correct query has rising latency, high I/O, sequential scans on a large table, or slow sorts after data growth.
|
|
148
|
+
|
|
149
|
+
### Verify first
|
|
150
|
+
- Capture the actual SQL and bind values for the slow query.
|
|
151
|
+
- Run `EXPLAIN (ANALYZE, BUFFERS)` in a safe representative environment; it executes the statement, so do not use it casually on writes.
|
|
152
|
+
- Check table statistics, row estimates, predicate selectivity, ordering, joins, and the write cost of a proposed index.
|
|
153
|
+
|
|
154
|
+
### Fix
|
|
155
|
+
- Add an index that matches the real filter, join, and ordering pattern. Composite index column order matters.
|
|
156
|
+
- Use a partial index only when its predicate consistently matches the query and remains selective.
|
|
157
|
+
- Prefer a separately managed migration for operationally sensitive indexes. PostgreSQL supports `CREATE INDEX CONCURRENTLY`, but it has transaction and failure-handling constraints.
|
|
158
|
+
- Do not add indexes based only on model fields or a plan from a tiny local dataset.
|
|
159
|
+
|
|
160
|
+
### Verify
|
|
161
|
+
- Compare before/after plans, execution time, buffer reads, and write impact.
|
|
162
|
+
- Confirm the planner uses the index for representative parameters, not just one favorable value.
|
|
163
|
+
|
|
164
|
+
*Sources: [PostgreSQL EXPLAIN](https://www.postgresql.org/docs/current/using-explain.html), [multicolumn indexes](https://www.postgresql.org/docs/current/indexes-multicolumn.html), [CREATE INDEX](https://www.postgresql.org/docs/current/sql-createindex.html).*
|
|
165
|
+
|
|
166
|
+
---
|
|
167
|
+
|
|
168
|
+
## Connection Pooling and Runtime Constraints
|
|
169
|
+
|
|
170
|
+
### Problem
|
|
171
|
+
Deployments intermittently exhaust database connections, work locally but fail under serverless concurrency, or create a Prisma client per request.
|
|
172
|
+
|
|
173
|
+
### Verify first
|
|
174
|
+
- Determine the runtime model: long-lived process, containers with autoscaling, short-lived functions, edge runtime, or worker fleet.
|
|
175
|
+
- Calculate worst-case connections across all instances and pools against PostgreSQL `max_connections`, reserving capacity for administration and other services.
|
|
176
|
+
- Confirm whether the runtime supports the Prisma engine/client configuration in use; edge and serverless environments have specific constraints.
|
|
177
|
+
|
|
178
|
+
### Fix
|
|
179
|
+
- Reuse one `PrismaClient` per long-lived process rather than constructing it for every request.
|
|
180
|
+
- Set pool limits based on total deployment concurrency, not a single instance. Use an external pooler where the platform topology requires it, and validate its compatibility with transaction/session behavior.
|
|
181
|
+
- Bound serverless concurrency when needed; connection pooling cannot make unlimited concurrent database work safe.
|
|
182
|
+
- Keep transactions short, because each active transaction consumes a connection.
|
|
183
|
+
|
|
184
|
+
### Verify
|
|
185
|
+
- Observe active, waiting, and idle connections during a concurrency test.
|
|
186
|
+
- Test cold starts, scale-out, and failure recovery against the intended deployment topology.
|
|
187
|
+
|
|
188
|
+
*Sources: [Prisma connection management](https://www.prisma.io/docs/orm/prisma-client/setup-and-configuration/databases-connections/connection-management), [Prisma serverless guidance](https://www.prisma.io/docs/orm/prisma-client/setup-and-configuration/databases-connections#serverless-environments), [PostgreSQL connection settings](https://www.postgresql.org/docs/current/runtime-config-connection.html).*
|