postgresdk 0.16.7 → 0.16.9

package/dist/cli.js

@@ -1805,6 +1805,15 @@ function extractConfigFields(configContent) {
       isCommented: pullBlock.isCommented
     });
   }
+  const pullTokenMatch = configContent.match(/^\s*(\/\/)?\s*pullToken:\s*(.+),?$/m);
+  if (pullTokenMatch) {
+    fields.push({
+      key: "pullToken",
+      value: pullTokenMatch[2]?.trim().replace(/,$/, ""),
+      description: "Token for protecting /_psdk/* endpoints",
+      isCommented: !!pullTokenMatch[1]
+    });
+  }
   return fields;
 }
 function extractComplexBlock(configContent, blockName) {
@@ -1947,21 +1956,36 @@ export default {
   ${getComplexBlockLine("tests", existingFields, mergeStrategy, userChoices)}
   
   // ========== AUTHENTICATION ==========
-  
+
   /**
    * Authentication configuration for your API
-   * 
+   *
    * Simple syntax examples:
    *   auth: { apiKey: process.env.API_KEY }
    *   auth: { jwt: process.env.JWT_SECRET }
-   * 
+   *
    * Multiple API keys:
    *   auth: { apiKeys: [process.env.KEY1, process.env.KEY2] }
-   * 
+   *
    * Full syntax for advanced options:
    */
   ${getComplexBlockLine("auth", existingFields, mergeStrategy, userChoices)}
-  
+
+  // ========== SDK ENDPOINT PROTECTION ==========
+
+  /**
+   * Token for protecting /_psdk/* endpoints (SDK distribution and contract endpoints)
+   *
+   * When set, clients must provide this token via Authorization header when pulling SDK.
+   * If not set, /_psdk/* endpoints are publicly accessible.
+   *
+   * This is separate from the main auth strategy (JWT/API key) used for CRUD operations.
+   *
+   * Use "env:" prefix to read from environment variables:
+   *   pullToken: "env:POSTGRESDK_PULL_TOKEN"
+   */
+  ${getFieldLine("pullToken", existingFields, mergeStrategy, '"env:POSTGRESDK_PULL_TOKEN"', userChoices)}
+
   // ========== SDK DISTRIBUTION (Pull Configuration) ==========
   
   /**
@@ -2050,9 +2074,9 @@ function getDefaultComplexBlock(key) {
   // },`;
     case "pull":
       return `// pull: {
-  //   from: "https://api.myapp.com",     // API URL to pull SDK from
-  //   output: "./src/sdk",                // Local directory for pulled SDK
-  //   token: process.env.API_TOKEN,       // Optional authentication token
+  //   from: "https://api.myapp.com",        // API URL to pull SDK from
+  //   output: "./src/sdk",                   // Local directory for pulled SDK
+  //   pullToken: "env:POSTGRESDK_PULL_TOKEN",  // Optional: if server has pullToken set
   // },`;
     default:
       return `// ${key}: {},`;
@@ -2154,6 +2178,7 @@ async function initCommand(args) {
       const newOptions = [
         { key: "tests", description: "Enable test generation" },
         { key: "auth", description: "Add authentication" },
+        { key: "pullToken", description: "Add SDK endpoint protection" },
         { key: "pull", description: "Configure SDK distribution" }
       ];
       const existingKeys = new Set(existingFields.map((f) => f.key));
@@ -2518,7 +2543,14 @@ Options:`);
     const headers = resolvedToken ? { Authorization: `Bearer ${resolvedToken}` } : {};
     const manifestRes = await fetch(`${config.from}/_psdk/sdk/manifest`, { headers });
     if (!manifestRes.ok) {
-      throw new Error(`Failed to fetch SDK manifest: ${manifestRes.status} ${manifestRes.statusText}`);
+      let errorMsg = `${manifestRes.status} ${manifestRes.statusText}`;
+      try {
+        const errorBody = await manifestRes.json();
+        if (errorBody.error) {
+          errorMsg = errorBody.error;
+        }
+      } catch {}
+      throw new Error(`Failed to fetch SDK manifest: ${errorMsg}`);
     }
     const manifest = await manifestRes.json();
     console.log(`\uD83D\uDCE6 SDK version: ${manifest.version}`);
@@ -2526,7 +2558,14 @@ Options:`);
     console.log(`\uD83D\uDCC4 Files: ${manifest.files.length}`);
     const sdkRes = await fetch(`${config.from}/_psdk/sdk/download`, { headers });
     if (!sdkRes.ok) {
-      throw new Error(`Failed to download SDK: ${sdkRes.status} ${sdkRes.statusText}`);
+      let errorMsg = `${sdkRes.status} ${sdkRes.statusText}`;
+      try {
+        const errorBody = await sdkRes.json();
+        if (errorBody.error) {
+          errorMsg = errorBody.error;
+        }
+      } catch {}
+      throw new Error(`Failed to download SDK: ${errorMsg}`);
     }
     const sdk = await sdkRes.json();
     for (const [path, content] of Object.entries(sdk.files)) {
@@ -4481,10 +4520,12 @@ function emitHonoRouter(tables, hasAuth, useJsExtensions, pullToken) {
   const tableNames = tables.map((t) => t.name).sort();
   const ext = useJsExtensions ? ".js" : "";
   let resolvedPullToken;
+  let pullTokenEnvVar;
   if (pullToken) {
     if (pullToken.startsWith("env:")) {
       const envVarName = pullToken.slice(4);
       resolvedPullToken = `process.env.${envVarName}`;
+      pullTokenEnvVar = envVarName;
     } else {
       resolvedPullToken = JSON.stringify(pullToken);
     }
@@ -4586,7 +4627,9 @@ ${pullToken ? `
 
     if (!expectedToken) {
       // Token not configured in environment - reject request
-      return c.json({ error: "SDK endpoints are protected but token not configured" }, 500);
+      return c.json({
+        error: "SDK endpoints are protected but pullToken environment variable not set. ${pullTokenEnvVar ? `Set ${pullTokenEnvVar} in your environment or remove pullToken from config.` : "Set the pullToken environment variable or remove pullToken from config."}"
+      }, 500);
     }
 
     if (!authHeader || !authHeader.startsWith("Bearer ")) {
@@ -4936,17 +4979,27 @@ function buildWhereClause(
             paramIndex++;
             break;
           case '$in':
-            if (Array.isArray(opValue) && opValue.length > 0) {
-              whereParts.push(\`"\${key}" = ANY($\${paramIndex})\`);
-              whereParams.push(opValue);
-              paramIndex++;
+            if (Array.isArray(opValue)) {
+              if (opValue.length > 0) {
+                whereParts.push(\`"\${key}" = ANY($\${paramIndex})\`);
+                whereParams.push(opValue);
+                paramIndex++;
+              } else {
+                // Empty $in is logically FALSE - matches nothing
+                whereParts.push('FALSE');
+              }
             }
             break;
           case '$nin':
-            if (Array.isArray(opValue) && opValue.length > 0) {
-              whereParts.push(\`"\${key}" != ALL($\${paramIndex})\`);
-              whereParams.push(opValue);
-              paramIndex++;
+            if (Array.isArray(opValue)) {
+              if (opValue.length > 0) {
+                whereParts.push(\`"\${key}" != ALL($\${paramIndex})\`);
+                whereParams.push(opValue);
+                paramIndex++;
+              } else {
+                // Empty $nin is logically TRUE - matches everything (but we still need a condition)
+                // This is handled by simply not adding a condition
+              }
             }
             break;
           case '$like':
@@ -5241,14 +5294,14 @@ export async function listRecords(
     // Get total count for pagination
     const countText = \`SELECT COUNT(*) FROM "\${ctx.table}" \${countWhereSQL}\`;
     log.debug(\`LIST \${ctx.table} COUNT SQL:\`, countText, "params:", countParams);
-    const countResult = await ctx.pg.query(countText, prepareParams(countParams));
+    const countResult = await ctx.pg.query(countText, countParams);
     const total = parseInt(countResult.rows[0].count, 10);
 
     // Get paginated data
     const text = \`SELECT \${selectClause} FROM "\${ctx.table}" \${whereSQL} \${orderBySQL} LIMIT \${limitParam} OFFSET \${offsetParam}\`;
     log.debug(\`LIST \${ctx.table} SQL:\`, text, "params:", allParams);
 
-    const { rows } = await ctx.pg.query(text, prepareParams(allParams));
+    const { rows } = await ctx.pg.query(text, allParams);
     const parsedRows = parseVectorColumns(rows, ctx.vectorColumns);
 
     // Calculate hasMore

package/dist/index.js

@@ -3619,10 +3619,12 @@ function emitHonoRouter(tables, hasAuth, useJsExtensions, pullToken) {
   const tableNames = tables.map((t) => t.name).sort();
   const ext = useJsExtensions ? ".js" : "";
   let resolvedPullToken;
+  let pullTokenEnvVar;
   if (pullToken) {
     if (pullToken.startsWith("env:")) {
       const envVarName = pullToken.slice(4);
       resolvedPullToken = `process.env.${envVarName}`;
+      pullTokenEnvVar = envVarName;
     } else {
       resolvedPullToken = JSON.stringify(pullToken);
     }
@@ -3724,7 +3726,9 @@ ${pullToken ? `
 
     if (!expectedToken) {
       // Token not configured in environment - reject request
-      return c.json({ error: "SDK endpoints are protected but token not configured" }, 500);
+      return c.json({
+        error: "SDK endpoints are protected but pullToken environment variable not set. ${pullTokenEnvVar ? `Set ${pullTokenEnvVar} in your environment or remove pullToken from config.` : "Set the pullToken environment variable or remove pullToken from config."}"
+      }, 500);
     }
 
     if (!authHeader || !authHeader.startsWith("Bearer ")) {
@@ -4074,17 +4078,27 @@ function buildWhereClause(
             paramIndex++;
             break;
           case '$in':
-            if (Array.isArray(opValue) && opValue.length > 0) {
-              whereParts.push(\`"\${key}" = ANY($\${paramIndex})\`);
-              whereParams.push(opValue);
-              paramIndex++;
+            if (Array.isArray(opValue)) {
+              if (opValue.length > 0) {
+                whereParts.push(\`"\${key}" = ANY($\${paramIndex})\`);
+                whereParams.push(opValue);
+                paramIndex++;
+              } else {
+                // Empty $in is logically FALSE - matches nothing
+                whereParts.push('FALSE');
+              }
             }
             break;
           case '$nin':
-            if (Array.isArray(opValue) && opValue.length > 0) {
-              whereParts.push(\`"\${key}" != ALL($\${paramIndex})\`);
-              whereParams.push(opValue);
-              paramIndex++;
+            if (Array.isArray(opValue)) {
+              if (opValue.length > 0) {
+                whereParts.push(\`"\${key}" != ALL($\${paramIndex})\`);
+                whereParams.push(opValue);
+                paramIndex++;
+              } else {
+                // Empty $nin is logically TRUE - matches everything (but we still need a condition)
+                // This is handled by simply not adding a condition
+              }
             }
             break;
           case '$like':
@@ -4379,14 +4393,14 @@ export async function listRecords(
     // Get total count for pagination
     const countText = \`SELECT COUNT(*) FROM "\${ctx.table}" \${countWhereSQL}\`;
     log.debug(\`LIST \${ctx.table} COUNT SQL:\`, countText, "params:", countParams);
-    const countResult = await ctx.pg.query(countText, prepareParams(countParams));
+    const countResult = await ctx.pg.query(countText, countParams);
     const total = parseInt(countResult.rows[0].count, 10);
 
     // Get paginated data
     const text = \`SELECT \${selectClause} FROM "\${ctx.table}" \${whereSQL} \${orderBySQL} LIMIT \${limitParam} OFFSET \${offsetParam}\`;
     log.debug(\`LIST \${ctx.table} SQL:\`, text, "params:", allParams);
 
-    const { rows } = await ctx.pg.query(text, prepareParams(allParams));
+    const { rows } = await ctx.pg.query(text, allParams);
     const parsedRows = parseVectorColumns(rows, ctx.vectorColumns);
 
     // Calculate hasMore

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postgresdk",
-  "version": "0.16.7",
+  "version": "0.16.9",
   "description": "Generate a typed server/client SDK from a Postgres schema (includes, Zod, Hono).",
   "type": "module",
   "bin": {