dzql 0.6.37 → 0.7.0

package/src/cli/codegen/sql/utils.ts

@@ -1,4 +1,4 @@
-import type { ColumnInfo } from "./types.js";
+import type { ColumnInfo, EntityIR } from "./types.js";
 
 /**
  * Generate a jsonb_build_object expression that excludes hidden fields.
@@ -17,6 +17,21 @@ export function buildVisibleJsonb(alias: string, columns: ColumnInfo[], hidden:
   return `jsonb_build_object(${pairs})`;
 }
 
+/**
+ * Project a RELATED entity (FK/M2M expansion target) through its own visible
+ * columns, so a related object never leaks the target's hidden fields (e.g. a
+ * post's `author` must not expose users.password_hash). Falls back to
+ * to_jsonb(alias.*) only when the target entity is unknown to the generator.
+ * @param alias - Table alias the related row is selected under (e.g. 't', 'target')
+ * @param targetEntity - IR of the related entity, if available
+ */
+export function buildVisibleJsonbForEntity(alias: string, targetEntity?: EntityIR): string {
+  if (!targetEntity) {
+    return `to_jsonb(${alias}.*)`;
+  }
+  return buildVisibleJsonb(alias, targetEntity.columns, targetEntity.hidden || []);
+}
+
 /**
  * Get the SQL cast for a column type
  */

package/src/cli/codegen/subscribable_sql.ts

@@ -9,7 +9,8 @@
  */
 
 import type { SubscribableIR, IncludeIR, EntityIR } from "../../shared/ir.js";
-import { parsePath } from "../compiler/paths.js";
+import { parsePath, PathCompileError } from "../compiler/paths.js";
+import { compileRuleList } from "../compiler/permissions.js";
 
 export function generateSubscribableSQL(name: string, sub: SubscribableIR, entities: Record<string, EntityIR> = {}): string {
   // Validate: if root.key is set, it must exist in params or start with '@'
@@ -28,6 +29,7 @@ export function generateSubscribableSQL(name: string, sub: SubscribableIR, entit
   sections.push(generateHeader(name, sub));
   sections.push(generateCanSubscribeFunction(name, sub));
   sections.push(generateGetFunction(name, sub, entities));
+  sections.push(generateCanReceiveFunction(name, sub, entities));
   sections.push(generateAffectedKeysFunction(name, sub));
 
   return sections.join('\n\n');
@@ -43,13 +45,11 @@ function generateHeader(name: string, sub: SubscribableIR): string {
 }
 
 function generateCanSubscribeFunction(name: string, sub: SubscribableIR): string {
-  const subscribePaths = sub.canSubscribe || [];
+  const rules = sub.canSubscribe || [];
   const rootKey = sub.root.key;
   const isList = !rootKey; // No key means it's a list subscribable
 
-  // If no paths, it's public
-  if (subscribePaths.length === 0) {
-    return `CREATE OR REPLACE FUNCTION dzql_v2.${name}_can_subscribe(
+  const header = `CREATE OR REPLACE FUNCTION dzql_v2.${name}_can_subscribe(
   p_user_id INT,
   p_params JSONB
 ) RETURNS BOOLEAN
@@ -57,45 +57,40 @@ LANGUAGE plpgsql
 STABLE
 SECURITY DEFINER
 SET search_path = dzql_v2, public
-AS $$
+AS $$`;
+
+  // No rules: nobody may subscribe. Use TRUE for public, AUTHENTICATED for any signed-in user.
+  if (rules.length === 0) {
+    return `${header}
 BEGIN
-  RETURN TRUE; -- Public access
+  RETURN FALSE; -- canSubscribe is empty: nobody may subscribe
 END;
 $$;`;
   }
 
-  // List subscribables with permission paths: check authentication only
-  // (Row-level filtering happens in the query, not the permission check)
+  // A list subscribable has no root row for a path to start from, so only
+  // literal rules (TRUE, FALSE, AUTHENTICATED) can be enforced. Anything else is
+  // a build error rather than a silent fallback.
   if (isList) {
-    return `CREATE OR REPLACE FUNCTION dzql_v2.${name}_can_subscribe(
-  p_user_id INT,
-  p_params JSONB
-) RETURNS BOOLEAN
-LANGUAGE plpgsql
-STABLE
-SECURITY DEFINER
-SET search_path = dzql_v2, public
-AS $$
+    for (const rule of rules) {
+      if (!parsePath(rule).literal) {
+        throw new PathCompileError(
+          `${name}.canSubscribe: a list subscribable has no root row to follow a path from; use TRUE, FALSE or AUTHENTICATED`,
+          rule
+        );
+      }
+    }
+    return `${header}
 BEGIN
-  -- List subscribable: user must be authenticated
-  -- Row-level access is filtered in the get function
-  RETURN p_user_id IS NOT NULL;
+  RETURN (${compileRuleList(name, rules)});
 END;
 $$;`;
   }
 
-  // Single-entity subscribable: check permissions against specific root entity
-  // Generate permission checks using RECORD dot notation
-  // Pass the root key so we can map param references to root entity's id
-  const compiledChecks = subscribePaths.map(path =>
-    compileSubscribePermission(sub.root.entity, path, rootKey)
-  );
-
-  // If all checks compile to FALSE (unsupported paths), fall back to authenticated users
-  const allFalse = compiledChecks.every(c => c === 'FALSE');
-  const checks = allFalse
-    ? 'p_user_id IS NOT NULL -- Fallback: multi-level paths not yet supported'
-    : compiledChecks.join(' OR\n    ');
+  // Single-entity subscribable: rules are checked against the root row (v_root).
+  // A rule's reference to the key param means the root's id.
+  const fieldMap: Record<string, string> = rootKey.startsWith('@') ? {} : { [rootKey]: 'id' };
+  const checks = compileRuleList(name, rules, { kind: 'row', name: 'v_root', fieldMap });
 
   // Extract params
   const paramNames = Object.keys(sub.params);
@@ -109,15 +104,7 @@ $$;`;
     ? `p_${rootKey.slice(1)}`  // @user_id -> p_user_id
     : `v_${rootKey}`;          // venue_id -> v_venue_id
 
-  return `CREATE OR REPLACE FUNCTION dzql_v2.${name}_can_subscribe(
-  p_user_id INT,
-  p_params JSONB
-) RETURNS BOOLEAN
-LANGUAGE plpgsql
-STABLE
-SECURITY DEFINER
-SET search_path = dzql_v2, public
-AS $$
+  return `${header}
 DECLARE
 ${paramDecls}
   v_root RECORD;
@@ -143,94 +130,91 @@ $$;`;
 }
 
 /**
- * Compile permission for subscribable can_subscribe function.
- * Uses RECORD dot notation since v_root is a RECORD, not JSONB.
- * Supports unlimited traversal depth using the shared path parser.
+ * <name>_can_receive(p_user_id, p_params, p_table, p_op, p_data): may this
+ * subscriber be pushed this change? The runtime calls it before every push.
+ * Returns 'row' (send the change), 'pk' (send only its key: a delete), or
+ * NULL (send nothing).
  *
- * @param entityName - The root entity name
- * @param rule - The permission rule (e.g., "@org_id->acts_for[org_id=$]{active}.user_id")
- * @param rootKey - The param key used to look up the root entity (e.g., "org_id")
- *                  When @field matches rootKey, it maps to v_root.id (the root entity's PK)
+ * - Nobody who fails can_subscribe receives anything.
+ * - A single-document subscription: canSubscribe is the whole gate.
+ * - A list: canSubscribe can only be a literal, so rows are filtered here, the
+ *   same way the list query filters them. A root row needs the root's view
+ *   rules; an included row must appear in one of the subscriber's documents.
+ *   An included row that was deleted is in no document any more, so its
+ *   delete goes to every subscriber as its key alone, which is all a client
+ *   uses to remove it.
  */
-function compileSubscribePermission(entityName: string, rule: string, rootKey: string = ''): string {
-  // Helper to resolve field reference - if field matches rootKey param, use 'id' instead
-  const resolveField = (field: string): string => {
-    return field === rootKey ? 'id' : field;
-  };
-
-  // Parse the path using the shared parser
-  const parsed = parsePath(rule);
-
-  if (!parsed.isValid) {
-    console.warn(`[Compiler] Warning: Invalid permission path '${rule}': ${parsed.error}`);
-    return 'FALSE';
-  }
-
-  // TRUE/FALSE literals
-  if (parsed.hops.length === 0) {
-    return rule === 'TRUE' || rule === 'true' ? 'TRUE' : 'FALSE';
-  }
-
-  // Simple field reference: @org_id implies checking acts_for membership
-  if (parsed.hops.length === 1 && parsed.hops[0].type === 'field') {
-    const field = parsed.hops[0].field!;
-    const rootField = resolveField(field);
-    return `EXISTS (SELECT 1 FROM acts_for WHERE acts_for.${field} = v_root.${rootField} AND acts_for.user_id = p_user_id AND acts_for.active)`;
-  }
-
-  // Traversal path - build EXISTS with nested subqueries for unlimited hops
-  // Start with the field from v_root
-  const startField = parsed.startField!;
-  const rootField = resolveField(startField);
-
-  // Build value expression starting from v_root
-  let valueExpr = `v_root.${rootField}`;
-
-  // Process intermediate hops (all but first field and last final)
-  for (let i = 1; i < parsed.hops.length - 1; i++) {
-    const hop = parsed.hops[i];
-    if (hop.type === 'table' && hop.table && hop.outputField) {
-      valueExpr = `(SELECT ${hop.outputField} FROM ${hop.table} WHERE id = ${valueExpr})`;
-    }
-  }
-
-  // Final hop - build EXISTS check
-  const finalHop = parsed.hops[parsed.hops.length - 1];
-  if (finalHop.type !== 'final' || !finalHop.table) {
-    return 'FALSE';
-  }
-
-  const conditions: string[] = [];
+function generateCanReceiveFunction(name: string, sub: SubscribableIR, entities: Record<string, EntityIR>): string {
+  const isList = !sub.root.key;
+  const header = `CREATE OR REPLACE FUNCTION dzql_v2.${name}_can_receive(
+  p_user_id INT,
+  p_params JSONB,
+  p_table TEXT,
+  p_op TEXT,
+  p_data JSONB
+) RETURNS TEXT
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = dzql_v2, public
+AS $$
+BEGIN
+  IF NOT dzql_v2.${name}_can_subscribe(p_user_id, p_params) THEN
+    RETURN NULL;
+  END IF;
+`;
+  const kind = `CASE WHEN p_op = 'delete' THEN 'pk' ELSE 'row' END`;
 
-  // Join condition
-  if (finalHop.filter && finalHop.filter.value === '$') {
-    conditions.push(`${finalHop.table}.${finalHop.filter.field} = ${valueExpr}`);
-  } else {
-    conditions.push(`${finalHop.table}.id = ${valueExpr}`);
+  if (!isList) {
+    return `${header}
+  RETURN ${kind};
+END;
+$$;`;
   }
 
-  // User check
-  if (finalHop.outputField === 'user_id') {
-    conditions.push(`${finalHop.table}.user_id = p_user_id`);
-  } else if (finalHop.outputField) {
-    conditions.push(`${finalHop.table}.${finalHop.outputField} = p_user_id`);
-  }
+  const root = sub.root.entity;
+  const viewRules = compileRuleList(root, entities[root]?.permissions?.view, { kind: 'jsonb', name: 'p_data' });
 
-  // Additional conditions from {active} or {role=admin}
-  for (const cond of finalHop.conditions || []) {
-    if (cond.type === 'boolean') {
-      conditions.push(`${finalHop.table}.${cond.field} = true`);
-    } else if (cond.type === 'equality') {
-      if (cond.value === 'NULL') {
-        conditions.push(`${finalHop.table}.${cond.field} IS NULL`);
-      } else {
-        const value = cond.value!.match(/^\d+$/) ? cond.value : `'${cond.value}'`;
-        conditions.push(`${finalHop.table}.${cond.field} = ${value}`);
-      }
+  // Where each included table sits in a list document: root columns || { rel: ... }
+  const pathsByTable: Record<string, string[]> = {};
+  const collect = (incl: Record<string, IncludeIR>, prefix: string) => {
+    for (const [rel, cfg] of Object.entries(incl || {})) {
+      const path = `${prefix}."${rel}"`;
+      (pathsByTable[cfg.entity] ??= []).push(path);
+      if (cfg.includes) collect(cfg.includes, path);
     }
-  }
+  };
+  collect(sub.includes, '$');
+  delete pathsByTable[root];
+
+  const includeCases = Object.entries(pathsByTable).map(([table, paths]) => {
+    const shown = paths
+      .map(path => `jsonb_path_exists(d, '${path} ? (@.id == $id)', jsonb_build_object('id', p_data->'id'))`)
+      .join(' OR ');
+    return `  IF p_table = '${table}' THEN
+    IF p_op = 'delete' THEN
+      RETURN 'pk';
+    END IF;
+    IF EXISTS (SELECT 1 FROM dzql_v2.get_${name}(p_params, p_user_id) d WHERE ${shown}) THEN
+      RETURN 'row';
+    END IF;
+    RETURN NULL;
+  END IF;
+`;
+  }).join('\n');
+
+  return `${header}
+  IF p_table = '${root}' THEN
+    IF ${viewRules} THEN
+      RETURN ${kind};
+    END IF;
+    RETURN NULL;
+  END IF;
 
-  return `EXISTS (SELECT 1 FROM ${finalHop.table} WHERE ${conditions.join(' AND ')})`;
+${includeCases}
+  RETURN NULL;
+END;
+$$;`;
 }
 
 /** Column info from EntityIR */
@@ -307,6 +291,13 @@ function generateGetFunction(name: string, sub: SubscribableIR, entities: Record
       }
     }
   }
+  if (isList) {
+    // canSubscribe on a list can only be a literal, so it can't tell rows apart.
+    // Return just the rows the subscriber may view: the root's view rules,
+    // checked against each root row ([] shows nobody any row).
+    const viewRules = entities[sub.root.entity]?.permissions?.view;
+    whereConditions.push(`(${compileRuleList(sub.root.entity, viewRules, { kind: 'row', name: 'root' })})`);
+  }
   const whereClause = whereConditions.length > 0
     ? `WHERE ${whereConditions.join(' AND ')}`
     : '';
@@ -334,9 +325,10 @@ ${paramExtracts}
     RAISE EXCEPTION 'permission_denied';
   END IF;
 
-  -- Return stream of documents
+  -- Return stream of documents (root projected to visible columns; ::jsonb so
+  -- the || merge works even when the projection is row_to_json)
   RETURN QUERY
-  SELECT to_jsonb(root.*) || jsonb_build_object(${relationSelects ? relationSelects.slice(1) : ''})
+  SELECT (${rootSelectExpr})::jsonb || jsonb_build_object(${relationSelects ? relationSelects.slice(1) : ''})
   FROM ${sub.root.entity} root
   ${whereClause};
 END;

package/src/cli/compile.ts

@@ -0,0 +1,263 @@
+/**
+ * Domain -> SQL compilation pipeline.
+ *
+ * The CLI writes these strings to migration files; tests load the same strings
+ * into Postgres, so they exercise exactly the SQL the compiler produces.
+ */
+import type { DomainConfig } from "../shared/ir.js";
+import { analyzeDomain } from "./compiler/analyzer.js";
+import { generateIR } from "./compiler/ir.js";
+import { validateDomainPaths } from "./compiler/path-validator.js";
+import { generateCoreSQL, generateAuthSQL, generateEntitySQL, generateSchemaSQL } from "./codegen/sql.js";
+import { generateSubscribableSQL, generateComputeAffectedKeysFunction } from "./codegen/subscribable_sql.js";
+
+export interface CompiledDomain {
+  ir: any;
+  coreSQL: string;
+  /** Tables, CRUD functions, auth functions and custom functions */
+  schemaSQL: string;
+  /** Subscribable functions plus compute_affected_keys */
+  subscribableSQL: string;
+  customFunctionCount: number;
+}
+
+export class DomainValidationError extends Error {
+  constructor(public errors: string[]) {
+    super(`Domain validation failed:\n${errors.map(e => `  - ${e}`).join('\n')}`);
+    this.name = 'DomainValidationError';
+  }
+}
+
+export function compileDomain(domain: DomainConfig): CompiledDomain {
+  const errors = analyzeDomain(domain);
+  if (errors.length > 0) {
+    throw new DomainValidationError(errors);
+  }
+
+  const ir = generateIR(domain);
+
+  // Every permission, notification and canSubscribe path must compile against
+  // this domain. A path that can't is a build error, never FALSE or a fallback.
+  const pathErrors = validateDomainPaths(ir);
+  if (pathErrors.length > 0) {
+    throw new DomainValidationError(pathErrors);
+  }
+
+  const coreSQL = generateCoreSQL();
+
+  // Topologically sort entities by FK dependencies
+  // Entities must be created before entities that reference them
+  // Also detects circular FKs that need deferred constraint creation
+  const { sorted: sortedEntityNames, circularFKs } = topologicalSortEntities(ir.entities);
+
+  // Build set of circular FK columns for stripping during schema generation
+  const circularFKSet = new Set(circularFKs.map(fk => `${fk.table}.${fk.column}`));
+
+  const entitySQL: string[] = [];
+  for (const name of sortedEntityNames) {
+    const entityIR = ir.entities[name];
+    // Pass circular FK info so schema generation can strip those constraints
+    entitySQL.push(generateSchemaSQL(name, entityIR, circularFKSet));
+    // Skip CRUD generation for unmanaged entities (e.g., junction tables)
+    if (entityIR.managed !== false) {
+      entitySQL.push(generateEntitySQL(name, entityIR, ir.entities));
+    } else {
+      console.log(`[Compiler] Skipping CRUD for unmanaged entity: ${name}`);
+    }
+  }
+
+  // Add deferred FK constraints at the end (for circular dependencies)
+  if (circularFKs.length > 0) {
+    entitySQL.push(generateDeferredFKConstraints(circularFKs));
+  }
+
+  // Generate subscribable SQL functions
+  const subscribableSQL: string[] = [];
+  const subscribableNames = Object.keys(ir.subscribables);
+  for (const [name, subIR] of Object.entries(ir.subscribables)) {
+    console.log(`[Compiler] Generating SQL for subscribable: ${name}`);
+    subscribableSQL.push(generateSubscribableSQL(name, subIR as any, ir.entities));
+  }
+  // Generate central compute_affected_keys function that aggregates all subscribables
+  subscribableSQL.push(generateComputeAffectedKeysFunction(subscribableNames));
+
+  // Collect custom functions SQL
+  const customFunctionSQL: string[] = [];
+  for (const fn of ir.customFunctions) {
+    console.log(`[Compiler] Adding custom function: ${fn.name}`);
+    customFunctionSQL.push(fn.sql);
+  }
+
+  // Combine entity SQL with auth functions and custom functions
+  // Auth functions must come after schema (they depend on users table)
+  // Columns a client may set at registration: those declared in
+  // auth.registerParams (beyond the built-in email/password/options), else
+  // just the users label field. Everything else is rejected at sign-up.
+  const usersEntity = ir.entities.users;
+  const declaredRegisterable = Object.keys(ir.auth?.registerParams || {})
+    .filter((k) => !["email", "password", "options"].includes(k));
+  const registerableColumns = declaredRegisterable.length > 0
+    ? declaredRegisterable
+    : (usersEntity && usersEntity.labelField && usersEntity.labelField !== "id"
+        ? [usersEntity.labelField]
+        : []);
+  const authSQL = generateAuthSQL(registerableColumns);
+  let schemaSQL = entitySQL.join('\n');
+  schemaSQL += '\n\n-- Auth Functions\n' + authSQL;
+  if (customFunctionSQL.length > 0) {
+    schemaSQL += '\n\n-- Custom Functions\n' + customFunctionSQL.join('\n\n');
+  }
+
+  return {
+    ir,
+    coreSQL,
+    schemaSQL,
+    subscribableSQL: subscribableSQL.join('\n\n'),
+    customFunctionCount: customFunctionSQL.length,
+  };
+}
+
+/** FK info for dependency analysis */
+interface FKInfo {
+  table: string;
+  column: string;
+  referencedTable: string;
+  fullConstraint: string; // e.g., "int NOT NULL REFERENCES users(id)"
+}
+
+/** Result of topological sort with cycle detection */
+interface SortResult {
+  sorted: string[];
+  circularFKs: FKInfo[];
+}
+
+/**
+ * Topologically sort entities based on FK dependencies.
+ * Entities that are referenced by others come first.
+ * Uses Kahn's algorithm for topological sorting.
+ * Returns both sorted order and any circular FK constraints that need deferred creation.
+ */
+function topologicalSortEntities(entities: Record<string, any>): SortResult {
+  const entityNames = Object.keys(entities);
+
+  // Build dependency graph: entity -> entities it depends on (references)
+  const dependencies: Record<string, Set<string>> = {};
+  const dependents: Record<string, Set<string>> = {};
+
+  // Track all FK info for cycle detection
+  const allFKs: FKInfo[] = [];
+
+  for (const name of entityNames) {
+    dependencies[name] = new Set();
+    dependents[name] = new Set();
+  }
+
+  // Parse REFERENCES from column types
+  for (const name of entityNames) {
+    const entity = entities[name];
+    for (const col of entity.columns || []) {
+      const match = col.type?.match(/REFERENCES\s+(\w+)/i);
+      if (match) {
+        const referencedEntity = match[1];
+        // Only track dependencies to entities we're managing
+        if (entityNames.includes(referencedEntity)) {
+          dependencies[name].add(referencedEntity);
+          dependents[referencedEntity].add(name);
+          allFKs.push({
+            table: name,
+            column: col.name,
+            referencedTable: referencedEntity,
+            fullConstraint: col.type
+          });
+        }
+      }
+    }
+  }
+
+  // Kahn's algorithm
+  const result: string[] = [];
+  const noIncoming: string[] = [];
+  const remainingDeps: Record<string, Set<string>> = {};
+
+  // Copy dependencies for mutation
+  for (const name of entityNames) {
+    remainingDeps[name] = new Set(dependencies[name]);
+  }
+
+  // Find entities with no dependencies (no incoming edges)
+  for (const name of entityNames) {
+    if (remainingDeps[name].size === 0) {
+      noIncoming.push(name);
+    }
+  }
+
+  while (noIncoming.length > 0) {
+    const node = noIncoming.shift()!;
+    result.push(node);
+
+    // Remove this node from the graph
+    for (const dependent of dependents[node]) {
+      remainingDeps[dependent].delete(node);
+      if (remainingDeps[dependent].size === 0) {
+        noIncoming.push(dependent);
+      }
+    }
+  }
+
+  // Detect circular FKs
+  const circularFKs: FKInfo[] = [];
+  if (result.length !== entityNames.length) {
+    const cycleEntities = new Set(entityNames.filter(n => !result.includes(n)));
+    console.warn(`[Compiler] Warning: Circular FK dependencies detected among: ${[...cycleEntities].join(', ')}`);
+
+    // Find FKs that are part of the cycle - these need deferred creation
+    for (const fk of allFKs) {
+      if (cycleEntities.has(fk.table) && cycleEntities.has(fk.referencedTable)) {
+        circularFKs.push(fk);
+        console.log(`[Compiler] Deferring circular FK: ${fk.table}.${fk.column} -> ${fk.referencedTable}`);
+      }
+    }
+
+    // Add remaining entities (cycle members) to result
+    result.push(...cycleEntities);
+  }
+
+  return { sorted: result, circularFKs };
+}
+
+/**
+ * Generate ALTER TABLE statements for deferred circular FK constraints.
+ */
+function generateDeferredFKConstraints(circularFKs: FKInfo[]): string {
+  if (circularFKs.length === 0) return '';
+
+  const statements: string[] = [
+    '\n-- === DEFERRED FK CONSTRAINTS (for circular dependencies) ===\n'
+  ];
+
+  for (const fk of circularFKs) {
+    // Extract the REFERENCES part from the full constraint
+    const refMatch = fk.fullConstraint.match(/REFERENCES\s+(\w+)(\([^)]+\))?(\s+ON\s+.+)?/i);
+    if (refMatch) {
+      const targetTable = refMatch[1];
+      const targetCol = refMatch[2] || '(id)';
+      const cascadeClause = refMatch[3] || '';
+      const constraintName = `fk_${fk.table}_${fk.column}`;
+
+      statements.push(`ALTER TABLE ${fk.table} ADD CONSTRAINT ${constraintName} FOREIGN KEY (${fk.column}) REFERENCES ${targetTable}${targetCol}${cascadeClause};`);
+    }
+  }
+
+  return statements.join('\n');
+}
+
+/**
+ * Remove REFERENCES clause from a column type for deferred FK creation.
+ * Preserves NOT NULL and other modifiers.
+ */
+function stripReferences(columnType: string): string {
+  // Remove REFERENCES clause and any ON DELETE/UPDATE clauses
+  return columnType
+    .replace(/\s*REFERENCES\s+\w+(\([^)]+\))?(\s+ON\s+(DELETE|UPDATE)\s+(CASCADE|SET NULL|SET DEFAULT|RESTRICT|NO ACTION))*\s*/gi, ' ')
+    .trim();
+}