rastack 0.0.16

package/src/rad-compile.ts

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+
+/**
+ * `rad compile | check | list | urls` — the TypeScript-first replacement for the
+ * old Django `manage.py rastack` command.
+ *
+ *   rad compile [resourcesDir] [outDir]   defs → schema.rad.json + openapi.json
+ *   rad check   [resourcesDir]            validate the resource graph (exit != 0 on error)
+ *   rad list    [resourcesDir]            print every resource + its fields/relations
+ *   rad urls    [resourcesDir]            print the generated /api/{app}/v1/{model}/ routes
+ */
+
+import { analyzeResources, collisions, compile, urlsFor } from "./compile";
+
+const DEFAULT_RESOURCES = "resources";
+const DEFAULT_OUT = ".rad";
+
+function main(argv: string[]): void {
+  const [sub, ...rest] = argv;
+
+  switch (sub) {
+    case "compile": {
+      const resourcesDir = rest[0] || DEFAULT_RESOURCES;
+      const outDir = rest[1] || DEFAULT_OUT;
+      const result = compile(resourcesDir, outDir);
+      console.log(
+        `✓ compiled ${result.manifest.resources.length} resource(s) → ${result.files.join(", ")}`,
+      );
+      break;
+    }
+    case "check": {
+      const resources = analyzeResources(rest[0] || DEFAULT_RESOURCES);
+      const errors = collisions(resources);
+      if (errors.length) {
+        for (const e of errors) console.error(`  ✗ ${e}`);
+        console.error(`${errors.length} error(s) found.`);
+        process.exit(1);
+      }
+      console.log(`✓ ${resources.length} resource(s): no collisions.`);
+      break;
+    }
+    case "list": {
+      const resources = analyzeResources(rest[0] || DEFAULT_RESOURCES);
+      if (!resources.length) {
+        console.log("No resources found.");
+        break;
+      }
+      for (const r of resources) {
+        console.log(`${r.app}.${r.model}`);
+        for (const f of r.fields) {
+          const rel = f.relation ? ` → ${f.relation.app}.${f.relation.model}` : "";
+          console.log(`  ${f.name}: ${f.type}${rel}`);
+        }
+        if (r.sync) {
+          const flags = [
+            r.sync.mode,
+            r.sync.load === "lazy" ? "lazy" : "",
+            r.sync.clientIds ? "client-ids" : "",
+            r.sync.confirmed ? `confirmed: ${r.sync.confirmed.join(",")}` : "",
+          ]
+            .filter(Boolean)
+            .join(", ");
+          console.log(`  sync: ${flags}`);
+        }
+      }
+      break;
+    }
+    case "urls": {
+      const resources = analyzeResources(rest[0] || DEFAULT_RESOURCES);
+      for (const url of urlsFor(resources)) console.log(url);
+      break;
+    }
+    default:
+      console.error(
+        `Unknown compile subcommand: "${sub}"\n\n` +
+          `Usage:\n` +
+          `  rad compile [resourcesDir] [outDir]\n` +
+          `  rad check   [resourcesDir]\n` +
+          `  rad list    [resourcesDir]\n` +
+          `  rad urls    [resourcesDir]\n`,
+      );
+      process.exit(1);
+  }
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2));
+}

package/src/rad-wasm-build.ts

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+
+/**
+ * `rad wasm` — compile the Rust API to WebAssembly for in-browser local dev.
+ *
+ * Pipeline:
+ *   1. cargo build -p rad-wasm --release --target wasm32-unknown-unknown
+ *   2. wasm-bindgen --target web  → stack/wasm/rad_wasm.js + rad_wasm_bg.wasm
+ *   3. wasm-opt -Oz (if available) to shrink the binary
+ *
+ * The generated bundle is what `<RAStackProvider mode="local">` loads. Prereqs:
+ *   rustup target add wasm32-unknown-unknown
+ *   cargo install wasm-bindgen-cli   (version must match the wasm-bindgen crate)
+ */
+
+import { spawnSync } from "child_process";
+import fs from "fs";
+import path from "path";
+
+const repoRoot = path.resolve(__dirname, "..", "..");
+const rustDir = path.join(repoRoot, "rust");
+const outDir = path.join(repoRoot, "tools", "wasm");
+const wasmPath = path.join(
+  rustDir,
+  "target",
+  "wasm32-unknown-unknown",
+  "release",
+  "rad_wasm.wasm",
+);
+
+function run(cmd: string, args: string[], cwd = repoRoot): void {
+  // Local build tool: `cmd`/`args` are the fixed toolchain invocations below
+  // (cargo, wasm-bindgen, wasm-opt), not untrusted input — no injection surface.
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+  const result = spawnSync(cmd, args, {
+    stdio: "inherit",
+    cwd,
+    env: process.env,
+  });
+  if (result.error) {
+    console.error(`\nCould not run \`${cmd}\`. Is it installed and on PATH?`);
+    if (cmd === "wasm-bindgen") {
+      console.error("  cargo install wasm-bindgen-cli");
+    }
+    process.exit(1);
+  }
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+
+function has(cmd: string): boolean {
+  // Probes a fixed toolchain name (e.g. "wasm-opt") for availability; not
+  // untrusted input.
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+  return spawnSync(cmd, ["--version"], { stdio: "ignore" }).status === 0;
+}
+
+console.log("→ cargo build -p rad-wasm --release (wasm32-unknown-unknown)");
+run(
+  "cargo",
+  [
+    "build",
+    "-p",
+    "rad-wasm",
+    "--release",
+    "--target",
+    "wasm32-unknown-unknown",
+  ],
+  rustDir,
+);
+
+console.log("→ wasm-bindgen → stack/wasm/");
+run("wasm-bindgen", [
+  "--target",
+  "web",
+  "--out-dir",
+  outDir,
+  "--out-name",
+  "rad_wasm",
+  wasmPath,
+]);
+
+// Mark the emitted bundle as ESM so Node and bundlers treat it correctly
+// without forcing the parent rastack package to be a module.
+fs.writeFileSync(
+  path.join(outDir, "package.json"),
+  JSON.stringify({ type: "module", sideEffects: false }, null, 2) + "\n",
+);
+
+if (has("wasm-opt")) {
+  console.log("→ wasm-opt -Oz");
+  const bg = path.join(outDir, "rad_wasm_bg.wasm");
+  run("wasm-opt", ["-Oz", "-o", bg, bg]);
+} else {
+  console.log("· wasm-opt not found — skipping size optimisation (optional)");
+}
+
+const size = fs.statSync(path.join(outDir, "rad_wasm_bg.wasm")).size;
+console.log(
+  `✓ wasm engine built: stack/wasm/ (${(size / 1024).toFixed(0)} KB)`,
+);

package/src/rad.ts

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+
+/**
+ * rad — unified CLI for React API Stack
+ *
+ * Commands:
+ *   rad compile [resourcesDir] [outDir]     TypeScript resources → schema.rad.json + openapi.json
+ *   rad check   [resourcesDir]              Validate the resource graph
+ *   rad list    [resourcesDir]              Print resources, fields and relations
+ *   rad urls    [resourcesDir]              Print the generated /api/{app}/v1/{model}/ routes
+ *   rad generate [--schema-only]            Generate typed hooks from OpenAPI
+ *   rad serve   [--warehouse dir]           Run the Rust API over an Iceberg warehouse
+ *   rad admin   [--warehouse dir]           Run the Rust admin (Django-admin-style DB browser)
+ *   rad wasm                                Compile the API to WebAssembly (in-browser local dev)
+ *   rad scan   [files...] [--fail-on-pii]   Scan CSVs for PII and schema info
+ *   rad seed   [--env dev] [--source gs://] Load CSVs into Iceberg namespace
+ */
+
+import { execSync, spawnSync } from "child_process";
+import path from "path";
+
+const [command, ...rest] = process.argv.slice(2);
+
+function run(script: string, args: string[] = rest) {
+  // `rad` is a local developer CLI: `script` is a fixed internal dist filename
+  // and `args` come from the developer's own shell (process.argv), not from an
+  // untrusted network request — there is no command-injection surface here.
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+  execSync(`node ${path.join(__dirname, script)} ${args.join(" ")}`, {
+    stdio: "inherit",
+    env: process.env,
+  });
+}
+
+/** Invoke the compiled Rust server binary (built by `cargo build` in rust/). */
+function runRust(subcommand: string) {
+  const repoRoot = path.resolve(__dirname, "..", "..");
+  const binary =
+    process.env.RAD_SERVER_BIN ||
+    path.join(repoRoot, "rust", "target", "release", "rad-server");
+  // Runs the locally-built Rust server binary with a fixed internal subcommand
+  // ("serve"/"admin"); `rest` is the developer's own CLI args, not untrusted
+  // input — no command-injection surface.
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+  const result = spawnSync(binary, [subcommand, ...rest], {
+    stdio: "inherit",
+    env: process.env,
+  });
+  if (result.error) {
+    console.error(
+      `Could not run the Rust server (${binary}). Build it first:\n` +
+        `  cd rust && cargo build --release\n`,
+    );
+    process.exit(1);
+  }
+  process.exit(result.status ?? 0);
+}
+
+switch (command) {
+  case "compile":
+  case "check":
+  case "list":
+  case "urls":
+    // rad-compile dispatches on its own first argument, so pass the command.
+    run("rad-compile.js", [command, ...rest]);
+    break;
+  case "serve":
+    runRust("serve");
+    break;
+  case "admin":
+    runRust("admin");
+    break;
+  case "wasm":
+    // Compile the API to WebAssembly for in-browser local dev.
+    run("rad-wasm-build.js", rest);
+    break;
+  case "scan":
+    run("scan.js");
+    break;
+  case "seed":
+    run("seed.js");
+    break;
+  case "generate":
+  case "gen":
+    // Proxy to existing rastack codegen pipeline
+    run("index.js");
+    break;
+  default:
+    console.error(
+      `Unknown command: "${command}"\n\n` +
+        `Usage:\n` +
+        `  rad compile [resourcesDir] [outDir]\n` +
+        `  rad check | list | urls [resourcesDir]\n` +
+        `  rad generate [--schema-only]\n` +
+        `  rad serve | admin [--warehouse dir]\n` +
+        `  rad wasm                                Compile the API to WebAssembly (browser local dev)\n` +
+        `  rad scan   [files...] [--fail-on-pii]\n` +
+        `  rad seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]\n`,
+    );
+    process.exit(1);
+}

package/src/scan.ts

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+
+/**
+ * rad scan
+ *
+ * Scans CSV files in myapp-dev/ for PII column patterns and schema issues.
+ * Exits non-zero if violations are found and --fail-on-pii is passed.
+ *
+ * Usage:
+ *   rad scan [files...] [--fail-on-pii]
+ *   rad scan myapp-dev/passengers.csv myapp-dev/flights.csv --fail-on-pii
+ */
+
+import path from "path";
+import { discoverCsvFiles, inferSchema } from "./csv-schema";
+
+const args = process.argv.slice(2);
+const failOnPii = args.includes("--fail-on-pii");
+const fileArgs = args.filter((a) => !a.startsWith("--") && a.endsWith(".csv"));
+
+const repoRoot = process.cwd();
+const devDir = path.join(repoRoot, "myapp-dev");
+
+const files = fileArgs.length > 0 ? fileArgs : discoverCsvFiles(devDir);
+
+if (files.length === 0) {
+  console.log("No CSV files found to scan.");
+  process.exit(0);
+}
+
+let totalViolations = 0;
+let hasErrors = false;
+
+for (const csvPath of files) {
+  const rel = path.relative(repoRoot, csvPath);
+
+  let result;
+  try {
+    result = inferSchema(csvPath, repoRoot);
+  } catch (err) {
+    console.error(`ERROR  ${rel}: ${(err as Error).message}`);
+    hasErrors = true;
+    continue;
+  }
+
+  const { schema, piiViolations } = result;
+
+  const colSummary = schema.columns
+    .map((c) => {
+      const tags: string[] = [c.type];
+      if (c.primaryKey) tags.push("PK");
+      if (c.nullable) tags.push("nullable");
+      if (c.pii) tags.push("PII");
+      return `  ${c.name.padEnd(24)} ${tags.join(", ")}`;
+    })
+    .join("\n");
+
+  console.log(`\n${rel}  [${schema.rowCount} rows, fingerprint: ${schema.fingerprint}]`);
+  console.log(colSummary);
+
+  if (piiViolations.length > 0) {
+    totalViolations += piiViolations.length;
+    console.log(`\n  ⚠  PII violations (${piiViolations.length}):`);
+    for (const v of piiViolations) {
+      console.log(`     ${v.column}: ${v.reason}`);
+    }
+  }
+}
+
+console.log("");
+
+if (hasErrors) {
+  console.error("Scan completed with errors.");
+  process.exit(1);
+}
+
+if (totalViolations > 0) {
+  console.warn(
+    `Scan found ${totalViolations} PII violation(s) across ${files.length} file(s).`,
+  );
+  if (failOnPii) {
+    console.error(
+      "Failing because --fail-on-pii is set. Remove PII data or add access policies in .rad/policies/.",
+    );
+    process.exit(1);
+  }
+} else {
+  console.log(`Scan passed. ${files.length} file(s) checked, no PII violations.`);
+}

package/src/schema/camel-to-pastel.ts

@@ -0,0 +1,3 @@
+export function camelToPastel(str: string): string {
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}

package/src/schema/capitalise-first-letter.ts

@@ -0,0 +1,3 @@
+export function capitaliseFirstLetter(str: string): string {
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}

package/src/schema/extract-response.ts

@@ -0,0 +1,38 @@
+import {
+  MediaTypeObject,
+  OperationObject,
+  ReferenceObject,
+} from "@ts-stack/openapi-spec";
+
+export function extractResponseBodySchema(
+  methodInformation: OperationObject,
+): [string | undefined, boolean] {
+  let responseBodySchema: string | undefined;
+  let isList = false;
+
+  if (!methodInformation.responses) return [undefined, false];
+
+  Object.keys(methodInformation.responses).forEach((responseKey) => {
+    // @ts-ignore
+    const responseData = methodInformation.responses[responseKey];
+    if (responseData?.content) {
+      const mediaType = responseData.content[
+        "application/json"
+      ] as MediaTypeObject;
+      if (mediaType?.schema) {
+        const refSchema = (mediaType.schema as ReferenceObject).$ref;
+        if (refSchema) {
+          responseBodySchema = refSchema.replace("#/components/schemas/", "");
+          if (responseBodySchema.startsWith("Paginated")) {
+            isList = true;
+            responseBodySchema = responseBodySchema
+              .replace("Paginated", "")
+              .slice(0, -4);
+          }
+        }
+      }
+    }
+  });
+
+  return [responseBodySchema, isList];
+}

package/src/schema/fetch-schema.ts

@@ -0,0 +1,12 @@
+import { ComponentsObject, PathsObject } from "@ts-stack/openapi-spec";
+import axios from "axios";
+
+interface OpenAPISchema {
+  paths: PathsObject;
+  components: ComponentsObject;
+}
+
+export async function fetchSchema(url: string): Promise<OpenAPISchema> {
+  const response = await axios.get<OpenAPISchema>(url);
+  return response.data;
+}

package/src/schema/remove-non-model-paths.ts

@@ -0,0 +1,13 @@
+import { PathsObject } from "@ts-stack/openapi-spec";
+
+export function removeNonModelPaths(paths: PathsObject): PathsObject {
+  const filteredPaths: PathsObject = {};
+  Object.keys(paths).forEach((key) => {
+    const appName = key.split("/")[2];
+    const modelName = key.split("/")[4];
+    if (appName && modelName) {
+      filteredPaths[key] = paths[key];
+    }
+  });
+  return filteredPaths;
+}

package/src/schema/to-camel-case.ts

@@ -0,0 +1,7 @@
+export function toCamelCase(str: string): string {
+  const pastel = str
+    .split("-")
+    .map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase())
+    .join("");
+  return pastel.charAt(0).toLowerCase() + pastel.slice(1);
+}

package/src/schema/to-pastel-case.ts

@@ -0,0 +1,6 @@
+export function toPascalCase(str: string): string {
+  return str
+    .split("-")
+    .map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase())
+    .join("");
+}

package/src/schema-convert.ts

@@ -0,0 +1,61 @@
+import { readdirSync, writeFileSync } from "fs";
+import { join } from "path";
+import { compileFromFile } from "json-schema-to-typescript";
+
+function removeUnknownIndexSignature(code: string): string {
+  return code
+    .split("\n")
+    .filter((line) => !line.includes("[k: string]: unknown;"))
+    .join("\n");
+}
+
+function removeDuplicates(code: string): string {
+  const lines = code.split("\n");
+  const uniqueExports = new Set();
+  let filteredCode = "";
+
+  lines.forEach((line) => {
+    if (line.includes("export type ") && !uniqueExports.has(line)) {
+      uniqueExports.add(line);
+      filteredCode += line + "\n";
+    } else if (!line.includes("export type ")) {
+      filteredCode += line + "\n";
+    }
+  });
+
+  return filteredCode;
+}
+
+async function main() {
+  console.log("Converting Schema");
+  const args: string[] = process.argv.slice(2);
+  const basePath = args[0];
+  const schemaFolderPath = join(basePath, "api-schema");
+
+  let interfaceFileData = "";
+
+  const schemaFiles = readdirSync(schemaFolderPath);
+
+  let compilePromises = schemaFiles.map((schemaFile) => {
+    const schemaFilePath = join(schemaFolderPath, schemaFile);
+
+    return compileFromFile(schemaFilePath, {
+      bannerComment: "",
+      style: { useTabs: false, tabWidth: 2 },
+      ignoreMinAndMaxItems: true,
+      strictIndexSignatures: false,
+    }).then((result) => {
+      const removedSignature = removeUnknownIndexSignature(result);
+      return removedSignature + "\n";
+    });
+  });
+
+  let results = await Promise.all(compilePromises);
+  interfaceFileData = results.join("\n");
+  interfaceFileData = removeDuplicates(interfaceFileData);
+
+  const outputFile = join(basePath, "interface.ts");
+  writeFileSync(outputFile, interfaceFileData);
+}
+
+main().catch((error) => console.error(error));