supabase-strict-check 0.1.0

package/dist/lib/checker.js

@@ -0,0 +1,791 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Checker = void 0;
+exports.flushUnhitAnyPayloads = flushUnhitAnyPayloads;
+const typescript_1 = __importDefault(require("typescript"));
+const ast_1 = require("../utils/ast");
+const files_1 = require("../utils/files");
+const clients_1 = require("../utils/clients");
+const paths_1 = require("../utils/paths");
+const catalog_1 = require("./catalog");
+const program_1 = require("./program");
+const select_1 = require("./select");
+const scope_1 = require("./scope");
+const types_1 = require("./types");
+class Checker {
+    errors;
+    warnings;
+    catalog;
+    sf;
+    consts;
+    tsChecker;
+    clientNames;
+    subst;
+    instantiated;
+    pendingAny;
+    resolvingPending = false;
+    constructor(opts) {
+        this.catalog = opts.catalog;
+        this.sf = opts.sf;
+        this.consts = opts.consts;
+        this.tsChecker = opts.tsChecker;
+        this.clientNames = opts.clientNames ?? new Set();
+        this.subst = opts.subst ?? new Map();
+        this.instantiated = opts.instantiated ?? new Set();
+        this.pendingAny = opts.pendingAny ?? [];
+        this.errors = opts.errors ?? [];
+        this.warnings = opts.warnings ?? [];
+    }
+    evalOpts() {
+        return { checker: this.tsChecker, subst: this.subst };
+    }
+    str(expr) {
+        return (0, ast_1.evalString)(expr, this.consts, this.evalOpts());
+    }
+    fail(node, message) {
+        const { line, column } = (0, ast_1.loc)(this.sf, node);
+        this.errors.push({ file: (0, files_1.relPath)(this.sf.fileName), line, column, message });
+    }
+    warn(node, message) {
+        const { line, column } = (0, ast_1.loc)(this.sf, node);
+        this.warnings.push({ file: (0, files_1.relPath)(this.sf.fileName), line, column, message });
+    }
+    checkFile() {
+        this.resolvingPending = false;
+        this.visit(this.sf, new scope_1.Scope());
+    }
+    followAnyPayloads() {
+        this.resolvingPending = true;
+        this.visit(this.sf, new scope_1.Scope());
+    }
+    spawn(sf, subst) {
+        return new Checker({
+            catalog: this.catalog,
+            sf,
+            consts: this.consts,
+            tsChecker: this.tsChecker,
+            clientNames: this.clientNames,
+            subst,
+            instantiated: this.instantiated,
+            pendingAny: this.pendingAny,
+            errors: this.errors,
+            warnings: this.warnings,
+        });
+    }
+    visit(node, scope) {
+        const next = typescript_1.default.isFunctionLike(node) || typescript_1.default.isBlock(node) ? scope.child() : scope;
+        if (typescript_1.default.isCallExpression(node)) {
+            if (this.resolvingPending) {
+                this.applyPendingAtCall(node, next);
+            }
+            else {
+                this.maybeInstantiate(node);
+                if ((0, ast_1.isChainTail)(node))
+                    this.checkTail(node, next);
+            }
+        }
+        if (typescript_1.default.isVariableDeclaration(node) && typescript_1.default.isIdentifier(node.name) && node.initializer) {
+            const init = (0, ast_1.unwrapExpr)(node.initializer);
+            if (typescript_1.default.isObjectLiteralExpression(init) || typescript_1.default.isArrayLiteralExpression(init)) {
+                next.setObject(node.name.text, init);
+            }
+        }
+        typescript_1.default.forEachChild(node, (child) => this.visit(child, next));
+    }
+    maybeInstantiate(call) {
+        if (!this.tsChecker)
+            return;
+        if (typescript_1.default.isPropertyAccessExpression(call.expression)) {
+            const method = call.expression.name.text;
+            if (paths_1.QUERY_METHODS.has(method) || paths_1.SKIP_CHAIN_PROPS.has(method))
+                return;
+        }
+        const fn = (0, program_1.calleeFunction)(call, this.tsChecker);
+        if (!fn)
+            return;
+        const file = fn.getSourceFile().fileName;
+        if (file.includes("node_modules") || file.endsWith(".d.ts"))
+            return;
+        const subst = this.substFromCall(fn, call);
+        if (!subst)
+            return;
+        if (sameSubst(subst, this.subst))
+            return;
+        const key = `${file}:${fn.getStart()}:${stringifySubst(subst)}`;
+        if (this.instantiated.has(key))
+            return;
+        this.instantiated.add(key);
+        const body = fn.body;
+        if (!body)
+            return;
+        this.spawn(fn.getSourceFile(), subst).visit(body, new scope_1.Scope());
+    }
+    applyPendingAtCall(call, scope) {
+        if (!this.tsChecker || this.pendingAny.length === 0)
+            return;
+        const fn = (0, program_1.calleeFunction)(call, this.tsChecker);
+        if (!fn)
+            return;
+        for (const pending of this.pendingAny) {
+            if (!sameFunction(pending.fn, fn))
+                continue;
+            const callId = `${call.getSourceFile().fileName}:${call.getStart()}`;
+            if (pending.seenCalls.has(callId))
+                continue;
+            pending.seenCalls.add(callId);
+            const arg = call.arguments[pending.paramIndex];
+            if (!arg) {
+                pending.hits++;
+                this.fail(call, `${pending.kind} on ${(0, types_1.relKey)(pending.relation.schema, pending.relation.name)}: missing payload argument`);
+                continue;
+            }
+            const ident = (0, ast_1.unwrapExpr)(arg);
+            if (typescript_1.default.isIdentifier(ident)) {
+                const wrapper = (0, ast_1.enclosingParam)(ident);
+                if (wrapper && !sameFunction(wrapper.fn, pending.fn)) {
+                    this.queuePending({
+                        fn: wrapper.fn,
+                        paramIndex: wrapper.index,
+                        relation: pending.relation,
+                        kind: pending.kind,
+                        allowed: pending.allowed,
+                        checkRequired: pending.checkRequired,
+                        origin: pending.origin,
+                        hits: 0,
+                        seenCalls: new Set(),
+                    });
+                    pending.hits++;
+                    continue;
+                }
+            }
+            pending.hits++;
+            this.checkPayload(pending.relation, arg, pending.kind, pending.allowed, scope, pending.checkRequired, arg, "callsite");
+        }
+    }
+    queuePending(item) {
+        const exists = this.pendingAny.some((p) => sameFunction(p.fn, item.fn) && p.paramIndex === item.paramIndex && p.relation === item.relation && p.kind === item.kind);
+        if (!exists)
+            this.pendingAny.push(item);
+    }
+    substFromCall(fn, call) {
+        const subst = new Map(this.subst);
+        let bound = false;
+        fn.parameters.forEach((param, i) => {
+            const arg = call.arguments[i];
+            if (!arg)
+                return;
+            if (typescript_1.default.isIdentifier(param.name)) {
+                const value = this.str(arg);
+                if (value != null) {
+                    subst.set(param.name.text, value);
+                    bound = true;
+                }
+                return;
+            }
+            if (typescript_1.default.isObjectBindingPattern(param.name)) {
+                const obj = (0, ast_1.unwrapExpr)(arg);
+                if (!typescript_1.default.isObjectLiteralExpression(obj))
+                    return;
+                for (const el of param.name.elements) {
+                    if (!typescript_1.default.isBindingElement(el) || !typescript_1.default.isIdentifier(el.name))
+                        continue;
+                    const prop = el.propertyName && typescript_1.default.isIdentifier(el.propertyName)
+                        ? el.propertyName.text
+                        : el.name.text;
+                    for (const p of obj.properties) {
+                        if (!typescript_1.default.isPropertyAssignment(p))
+                            continue;
+                        if ((0, ast_1.propName)(p.name) !== prop)
+                            continue;
+                        const value = this.str(p.initializer);
+                        if (value != null) {
+                            subst.set(el.name.text, value);
+                            bound = true;
+                        }
+                    }
+                }
+            }
+        });
+        return bound ? subst : null;
+    }
+    checkTail(tail, scope) {
+        if ((0, ast_1.chainProps)(tail.expression).some((n) => paths_1.SKIP_CHAIN_PROPS.has(n)))
+            return;
+        const methods = (0, ast_1.collectChain)(tail);
+        if (methods.length === 0)
+            return;
+        const fromCall = methods.find((m) => m.name === "from");
+        const rpcCall = methods.find((m) => m.name === "rpc");
+        const schemaCall = methods.find((m) => m.name === "schema");
+        if (fromCall?.name === "from" && (0, ast_1.isArrayFrom)(fromCall))
+            return;
+        const root = (0, ast_1.chainRoot)(tail);
+        const rootIdent = root && typescript_1.default.isIdentifier(root) ? root.text : null;
+        const continued = rootIdent ? scope.getQuery(rootIdent) : undefined;
+        if (!fromCall && !rpcCall && !continued)
+            return;
+        if (fromCall && !continued && !rpcCall && !schemaCall && fromCall.name === "from") {
+            const mutating = methods.some((m) => ["select", "insert", "update", "upsert", "delete"].includes(m.name));
+            if (!mutating && !(0, clients_1.looksLikeClient)(tail, { checker: this.tsChecker, names: this.clientNames }))
+                return;
+        }
+        let schema = continued?.relation.schema ?? paths_1.DEFAULT_SCHEMA;
+        let relation = continued?.relation;
+        const embedAliases = new Map(continued?.embeds ?? []);
+        if (schemaCall) {
+            if (!schemaCall.args[0]) {
+                this.fail(schemaCall.node, "dynamic .schema(...)");
+                return;
+            }
+            const schemaName = this.str(schemaCall.args[0]);
+            if (!schemaName) {
+                if (this.skipGenericParam(schemaCall.args[0]))
+                    return;
+                this.fail(schemaCall.args[0], "dynamic .schema(...)");
+                return;
+            }
+            if (!this.catalog.schemas.has(schemaName)) {
+                this.fail(schemaCall.args[0], `unknown schema "${schemaName}"`);
+                return;
+            }
+            schema = schemaName;
+        }
+        if (rpcCall)
+            this.checkRpc(schema, rpcCall, scope);
+        if (fromCall) {
+            if (fromCall.args.length === 0) {
+                this.fail(fromCall.node, "dynamic .from(...)");
+                return;
+            }
+            const tableExpr = fromCall.args[0];
+            const tableName = this.str(tableExpr);
+            if (!tableName) {
+                if (this.skipGenericParam(tableExpr))
+                    return;
+                this.fail(tableExpr, "dynamic .from(...)");
+                return;
+            }
+            relation = this.catalog.relations.get((0, types_1.relKey)(schema, tableName));
+            if (!relation) {
+                const elsewhere = this.catalog.byName.get(tableName);
+                const hint = elsewhere?.length
+                    ? ` (exists in ${elsewhere.map((r) => r.schema).join(", ")})`
+                    : "";
+                this.fail(tableExpr, `unknown relation "${tableName}" in schema "${schema}"${hint}`);
+                return;
+            }
+            embedAliases.clear();
+        }
+        if (!relation)
+            return;
+        for (const method of methods) {
+            this.checkMethod(relation, method, embedAliases, scope);
+        }
+        const name = (0, ast_1.assignedName)(tail);
+        if (name)
+            scope.setQuery(name, { relation, embeds: embedAliases });
+    }
+    skipGenericParam(expr) {
+        const ident = (0, ast_1.unwrapExpr)(expr);
+        if (!typescript_1.default.isIdentifier(ident))
+            return false;
+        if (this.subst.has(ident.text))
+            return false;
+        return (0, ast_1.isParameterIdentifier)(ident);
+    }
+    resolvePayload(expr, scope) {
+        if (!expr)
+            return undefined;
+        const node = (0, ast_1.unwrapExpr)(expr);
+        if (typescript_1.default.isIdentifier(node))
+            return scope.getObject(node.text) ?? expr;
+        return expr;
+    }
+    collectKeys(expr, scope, depth = 0) {
+        if (!expr || depth > 6)
+            return null;
+        const node = (0, ast_1.unwrapExpr)(expr);
+        if (typescript_1.default.isBinaryExpression(node) && node.operatorToken.kind === typescript_1.default.SyntaxKind.AmpersandAmpersandToken) {
+            return this.collectKeys(node.right, scope, depth + 1);
+        }
+        if (typescript_1.default.isConditionalExpression(node)) {
+            const left = this.collectKeys(node.whenTrue, scope, depth + 1) ?? { keys: [], unresolved: false };
+            const right = this.collectKeys(node.whenFalse, scope, depth + 1) ?? { keys: [], unresolved: false };
+            return {
+                keys: [...new Set([...left.keys, ...right.keys])],
+                unresolved: left.unresolved || right.unresolved,
+            };
+        }
+        if (typescript_1.default.isIdentifier(node)) {
+            const obj = scope.getObject(node.text);
+            if (obj)
+                return this.collectKeys(obj, scope, depth + 1);
+            if (this.tsChecker) {
+                const names = (0, program_1.propertyNamesFromType)(this.tsChecker, node);
+                if (names)
+                    return { keys: names, unresolved: false };
+            }
+            return { keys: [], unresolved: true };
+        }
+        if (typescript_1.default.isCallExpression(node)) {
+            if (this.tsChecker) {
+                const names = (0, program_1.propertyNamesFromType)(this.tsChecker, node);
+                if (names)
+                    return { keys: names, unresolved: false };
+            }
+            return { keys: [], unresolved: true };
+        }
+        if (typescript_1.default.isArrayLiteralExpression(node)) {
+            const keys = new Set();
+            let unresolved = false;
+            let any = false;
+            for (const el of node.elements) {
+                const inner = this.collectKeys(el, scope, depth + 1);
+                if (!inner)
+                    continue;
+                any = true;
+                inner.keys.forEach((k) => keys.add(k));
+                unresolved = unresolved || inner.unresolved;
+            }
+            return any ? { keys: [...keys], unresolved } : null;
+        }
+        if (!typescript_1.default.isObjectLiteralExpression(node)) {
+            if (this.tsChecker) {
+                const names = (0, program_1.propertyNamesFromType)(this.tsChecker, node);
+                if (names)
+                    return { keys: names, unresolved: false };
+            }
+            return { keys: [], unresolved: true };
+        }
+        const keys = new Set();
+        let unresolved = false;
+        for (const prop of node.properties) {
+            if (typescript_1.default.isSpreadAssignment(prop)) {
+                const inner = this.collectKeys(prop.expression, scope, depth + 1);
+                if (!inner || inner.unresolved)
+                    unresolved = true;
+                inner?.keys.forEach((k) => keys.add(k));
+                continue;
+            }
+            if (typescript_1.default.isPropertyAssignment(prop) || typescript_1.default.isShorthandPropertyAssignment(prop)) {
+                const name = (0, ast_1.propName)(prop.name);
+                if (name)
+                    keys.add(name);
+            }
+        }
+        return { keys: [...keys], unresolved };
+    }
+    checkRpc(schema, rpcCall, scope) {
+        if (rpcCall.args.length === 0) {
+            this.fail(rpcCall.node, "dynamic .rpc(...)");
+            return;
+        }
+        const fn = this.str(rpcCall.args[0]);
+        if (!fn) {
+            if (this.skipGenericParam(rpcCall.args[0]))
+                return;
+            this.fail(rpcCall.args[0], "dynamic .rpc(...)");
+            return;
+        }
+        const rpc = this.catalog.functions.get(schema)?.get(fn);
+        if (!rpc) {
+            const found = [...this.catalog.functions.entries()]
+                .filter(([, map]) => map.has(fn))
+                .map(([s]) => s);
+            const hint = found.length ? ` (exists in ${found.join(", ")})` : "";
+            this.fail(rpcCall.args[0], `unknown rpc "${fn}" in schema "${schema}"${hint}`);
+            return;
+        }
+        if (rpc.argsNever) {
+            if (rpcCall.args[1])
+                this.fail(rpcCall.args[1], `rpc "${fn}" takes no args`);
+            return;
+        }
+        if (!rpcCall.args[1]) {
+            this.fail(rpcCall.node, `rpc "${fn}": missing args object`);
+            return;
+        }
+        const collected = this.collectKeys(this.resolvePayload(rpcCall.args[1], scope), scope);
+        if (!collected) {
+            this.fail(rpcCall.args[1], `rpc "${fn}": dynamic args`);
+            return;
+        }
+        if (collected.unresolved) {
+            this.fail(rpcCall.args[1], `rpc "${fn}": unresolved spread/dynamic args`);
+            return;
+        }
+        for (const key of collected.keys) {
+            if (!rpc.argNames.has(key)) {
+                this.fail(rpcCall.args[1], `rpc "${fn}": unknown arg "${key}"`);
+            }
+        }
+        for (const req of rpc.argNames) {
+            if (!collected.keys.includes(req)) {
+                this.fail(rpcCall.args[1], `rpc "${fn}": missing arg "${req}"`);
+            }
+        }
+    }
+    checkMethod(relation, method, embedAliases, scope) {
+        switch (method.name) {
+            case "select":
+                this.checkSelect(relation, method, embedAliases);
+                break;
+            case "insert":
+                this.checkPayload(relation, method.args[0], "insert", relation.insertColumns, scope, true, method.node);
+                break;
+            case "update":
+                this.checkPayload(relation, method.args[0], "update", relation.updateColumns, scope, false, method.node);
+                break;
+            case "upsert":
+                this.checkPayload(relation, method.args[0], "upsert", relation.insertColumns, scope, false, method.node);
+                this.checkOnConflict(relation, method);
+                break;
+            case "match":
+                this.checkMatch(relation, method, embedAliases, scope);
+                break;
+            case "or":
+                this.checkOr(relation, method, embedAliases);
+                break;
+            default:
+                if (paths_1.FILTER_COLUMN_METHODS.has(method.name) && method.args[0]) {
+                    this.checkFilterColumn(relation, method, embedAliases);
+                }
+        }
+    }
+    checkPayload(relation, expr, kind, allowed, scope, checkRequired, at, mode = "direct") {
+        if (!expr) {
+            this.fail(at, `${kind} on ${(0, types_1.relKey)(relation.schema, relation.name)}: missing payload`);
+            return;
+        }
+        if (this.subst.size > 0) {
+            const node = (0, ast_1.unwrapExpr)(expr);
+            if (typescript_1.default.isIdentifier(node) && (0, ast_1.isParameterIdentifier)(node))
+                return;
+        }
+        const collected = this.collectKeys(this.resolvePayload(expr, scope), scope);
+        if (collected) {
+            const keys = collected.keys;
+            for (const key of keys) {
+                if (!allowed.has(key)) {
+                    this.fail(expr, `${kind} on ${(0, types_1.relKey)(relation.schema, relation.name)}: unknown column "${key}"`);
+                }
+            }
+            if (checkRequired && !collected.unresolved) {
+                for (const req of relation.insertRequired) {
+                    if (!keys.includes(req)) {
+                        this.fail(expr, `insert on ${(0, types_1.relKey)(relation.schema, relation.name)}: missing required column "${req}"`);
+                    }
+                }
+            }
+            const parsed = (0, ast_1.objectKeys)(this.resolvePayload(expr, scope));
+            if (parsed) {
+                for (const key of parsed.keys) {
+                    this.checkLiteralDomain(relation, key, this.payloadValue(this.resolvePayload(expr, scope), key), expr, kind);
+                }
+            }
+            if (!collected.unresolved)
+                return;
+        }
+        const ident = (0, ast_1.unwrapExpr)(expr);
+        if (typescript_1.default.isIdentifier(ident) && mode !== "callsite") {
+            const param = (0, ast_1.enclosingParam)(ident);
+            if (param) {
+                this.queuePending({
+                    fn: param.fn,
+                    paramIndex: param.index,
+                    relation,
+                    kind,
+                    allowed,
+                    checkRequired,
+                    origin: expr,
+                    hits: 0,
+                    seenCalls: new Set(),
+                });
+                return;
+            }
+        }
+        this.fail(expr, `${kind} on ${(0, types_1.relKey)(relation.schema, relation.name)}: ${collected?.unresolved ? "unresolved spread in payload" : "dynamic payload"}`);
+    }
+    payloadValue(expr, key) {
+        if (!expr)
+            return undefined;
+        const node = (0, ast_1.unwrapExpr)(expr);
+        const objs = typescript_1.default.isArrayLiteralExpression(node)
+            ? node.elements.map((el) => (0, ast_1.unwrapExpr)(el)).filter(typescript_1.default.isObjectLiteralExpression)
+            : typescript_1.default.isObjectLiteralExpression(node)
+                ? [node]
+                : [];
+        for (const obj of objs) {
+            for (const prop of obj.properties) {
+                if (!typescript_1.default.isPropertyAssignment(prop) && !typescript_1.default.isShorthandPropertyAssignment(prop))
+                    continue;
+                const name = typescript_1.default.isIdentifier(prop.name) || typescript_1.default.isStringLiteral(prop.name) ? prop.name.text : null;
+                if (name !== key)
+                    continue;
+                if (typescript_1.default.isPropertyAssignment(prop))
+                    return prop.initializer;
+            }
+        }
+        return undefined;
+    }
+    checkLiteralDomain(relation, column, valueExpr, node, via) {
+        if (!valueExpr)
+            return;
+        const domain = relation.valueDomain.get(column);
+        if (!domain)
+            return;
+        const value = (0, ast_1.literalValue)(valueExpr, this.consts, this.evalOpts());
+        if (typeof value !== "string")
+            return;
+        if (!domain.includes(value)) {
+            this.fail(node, `${via} on ${(0, types_1.relKey)(relation.schema, relation.name)}: "${column}" value "${value}" is not ${domain.join(" | ")}`);
+        }
+    }
+    checkOnConflict(relation, method) {
+        const onConflict = (0, ast_1.optionString)(method.args, ["onConflict"], this.consts, this.evalOpts());
+        if (onConflict) {
+            for (const col of onConflict.split(",").map((c) => c.trim()).filter(Boolean)) {
+                if (!relation.columns.has(col)) {
+                    this.fail(method.args[1] ?? method.node, `upsert onConflict column "${col}" is not on ${(0, types_1.relKey)(relation.schema, relation.name)}`);
+                }
+            }
+            return;
+        }
+        const obj = method.args[1] ? (0, ast_1.unwrapExpr)(method.args[1]) : undefined;
+        if (!obj || !typescript_1.default.isObjectLiteralExpression(obj))
+            return;
+        for (const prop of obj.properties) {
+            if (!typescript_1.default.isPropertyAssignment(prop) && !typescript_1.default.isShorthandPropertyAssignment(prop))
+                continue;
+            if ((0, ast_1.propName)(prop.name) !== "onConflict")
+                continue;
+            const value = typescript_1.default.isPropertyAssignment(prop) ? prop.initializer : prop.name;
+            if (this.skipGenericParam(value))
+                return;
+            this.fail(prop, `upsert on ${(0, types_1.relKey)(relation.schema, relation.name)}: dynamic onConflict`);
+        }
+    }
+    checkMatch(relation, method, embedAliases, scope) {
+        const collected = this.collectKeys(this.resolvePayload(method.args[0], scope), scope);
+        if (!collected || collected.unresolved) {
+            this.fail(method.args[0] ?? method.node, `match on ${(0, types_1.relKey)(relation.schema, relation.name)}: dynamic payload`);
+            return;
+        }
+        for (const key of collected.keys) {
+            this.assertColumnOrPath(relation, method.args[0], key, embedAliases, "match");
+        }
+    }
+    checkOr(relation, method, embedAliases) {
+        if (!method.args[0])
+            return;
+        const extracted = (0, ast_1.stringish)(method.args[0], this.consts, this.evalOpts());
+        if (!extracted)
+            return;
+        const foreignTable = (0, ast_1.optionString)(method.args, ["foreignTable", "referencedTable"], this.consts, this.evalOpts());
+        let target = relation;
+        if (foreignTable) {
+            const resolved = this.resolveEmbed(relation, {
+                alias: null,
+                name: foreignTable,
+                hints: [],
+                children: [],
+            }, method.node);
+            if (!resolved)
+                return;
+            target = resolved;
+            embedAliases.set(foreignTable, resolved);
+        }
+        for (const col of (0, select_1.filterColumns)(extracted.text)) {
+            this.assertColumnOrPath(target, method.args[0], col, embedAliases, "or");
+        }
+    }
+    checkFilterColumn(relation, method, embedAliases) {
+        const cols = (0, ast_1.evalStrings)(method.args[0], this.consts, this.evalOpts());
+        if (!cols) {
+            if (this.skipGenericParam(method.args[0]))
+                return;
+            this.fail(method.args[0], `${method.name} on ${(0, types_1.relKey)(relation.schema, relation.name)}: dynamic column`);
+            return;
+        }
+        const foreignTable = (0, ast_1.optionString)(method.args, ["foreignTable", "referencedTable"], this.consts, this.evalOpts());
+        let target = relation;
+        if (foreignTable) {
+            const resolved = this.resolveEmbed(relation, {
+                alias: null,
+                name: foreignTable,
+                hints: [],
+                children: [],
+            }, method.node);
+            if (!resolved)
+                return;
+            target = resolved;
+        }
+        for (const extracted of cols) {
+            this.assertColumnOrPath(target, method.args[0], extracted, embedAliases, method.name);
+            if (method.args[1] && ["eq", "neq"].includes(method.name) && cols.length === 1) {
+                this.checkLiteralDomain(target, extracted, method.args[1], method.args[1], method.name);
+            }
+        }
+    }
+    checkSelect(relation, method, embedAliases) {
+        if (method.args.length === 0)
+            return;
+        const extracted = (0, ast_1.stringish)(method.args[0], this.consts, this.evalOpts());
+        if (!extracted?.complete) {
+            if (this.skipGenericParam(method.args[0]))
+                return;
+            this.fail(method.args[0], `dynamic .select(...) on ${(0, types_1.relKey)(relation.schema, relation.name)}`);
+            return;
+        }
+        this.walkSelect(relation, (0, select_1.parseSelectList)(extracted.text), method.args[0], embedAliases);
+    }
+    walkSelect(relation, items, node, embedAliases) {
+        for (const item of items) {
+            if (item.name === "*")
+                continue;
+            if (item.children) {
+                const target = this.resolveEmbed(relation, item, node);
+                if (!target)
+                    continue;
+                const alias = item.alias ?? item.name;
+                embedAliases.set(alias, target);
+                embedAliases.set(item.name, target);
+                this.walkSelect(target, item.children, node, embedAliases);
+                continue;
+            }
+            if (paths_1.AGGREGATES.has(item.name))
+                continue;
+            if (!relation.columns.has(item.name)) {
+                this.fail(node, `select on ${(0, types_1.relKey)(relation.schema, relation.name)}: unknown column "${item.name}"`);
+            }
+        }
+    }
+    assertColumnOrPath(relation, node, column, embedAliases, via) {
+        if (relation.columns.has(column))
+            return;
+        if (embedAliases.has(column) && (via === "is" || via === "not"))
+            return;
+        if (column.includes(".")) {
+            const parts = column.split(".");
+            let current = relation;
+            for (let i = 0; i < parts.length; i++) {
+                const part = parts[i];
+                if (!current)
+                    break;
+                if (i === parts.length - 1 && current.columns.has(part))
+                    return;
+                const aliased = embedAliases.get(part);
+                if (aliased) {
+                    current = aliased;
+                    continue;
+                }
+                const next = this.resolveEmbed(current, {
+                    alias: null,
+                    name: part,
+                    hints: [],
+                    children: [],
+                }, node, true);
+                if (!next) {
+                    this.fail(node, `${via} on ${(0, types_1.relKey)(relation.schema, relation.name)}: cannot resolve path "${column}" at "${part}"`);
+                    return;
+                }
+                current = next;
+            }
+            return;
+        }
+        this.fail(node, `${via} on ${(0, types_1.relKey)(relation.schema, relation.name)}: unknown column "${column}"`);
+    }
+    resolveEmbed(from, item, node, silent = false) {
+        const hints = item.hints.filter((h) => !paths_1.JOIN_HINTS.has(h));
+        const matches = this.embedCandidates(from, item.name, hints);
+        if (matches.length === 1)
+            return matches[0].target;
+        if (matches.length > 1) {
+            if (!silent) {
+                const fks = matches.map((m) => m.via).join(", ");
+                this.fail(node, `ambiguous embed "${item.name}" on ${(0, types_1.relKey)(from.schema, from.name)} — hint with !fk (${fks})`);
+            }
+            return undefined;
+        }
+        if (!silent) {
+            const hint = hints.length ? ` with hint !${hints.join("!")}` : "";
+            this.fail(node, `no foreign key for embed "${item.name}"${hint} on ${(0, types_1.relKey)(from.schema, from.name)}`);
+        }
+        return undefined;
+    }
+    embedCandidates(from, name, hints) {
+        const out = [];
+        const seen = new Set();
+        const add = (target, via) => {
+            if (!target)
+                return;
+            const key = `${(0, types_1.relKey)(target.schema, target.name)}|${via}`;
+            if (seen.has(key))
+                return;
+            seen.add(key);
+            out.push({ target, via });
+        };
+        const hintOk = (rel) => {
+            if (hints.length === 0)
+                return true;
+            return hints.every((h) => rel.foreignKeyName === h || rel.columns.includes(h) || rel.referencedColumns.includes(h));
+        };
+        for (const rel of from.relationships) {
+            const target = (0, catalog_1.lookupTarget)(this.catalog, from.schema, rel.referencedRelation);
+            const nameMatches = rel.referencedRelation === name
+                || rel.foreignKeyName === name
+                || rel.columns.includes(name)
+                || target?.name === name;
+            if (!nameMatches || !hintOk(rel))
+                continue;
+            add(target, rel.foreignKeyName);
+        }
+        for (const other of this.catalog.relations.values()) {
+            for (const rel of other.relationships) {
+                if (!(0, catalog_1.pointsTo)(this.catalog, rel, other.schema, from))
+                    continue;
+                const nameMatches = other.name === name
+                    || rel.foreignKeyName === name
+                    || rel.columns.includes(name);
+                if (!nameMatches || !hintOk(rel))
+                    continue;
+                add(other, rel.foreignKeyName);
+            }
+        }
+        return out;
+    }
+}
+exports.Checker = Checker;
+function sameFunction(a, b) {
+    return a === b
+        || (a.getSourceFile().fileName === b.getSourceFile().fileName && a.getStart() === b.getStart());
+}
+function flushUnhitAnyPayloads(pending, errors) {
+    for (const item of pending) {
+        if (item.hits > 0)
+            continue;
+        const sf = item.origin.getSourceFile();
+        const { line, column } = (0, ast_1.loc)(sf, item.origin);
+        errors.push({
+            file: (0, files_1.relPath)(sf.fileName),
+            line,
+            column,
+            message: `${item.kind} on ${(0, types_1.relKey)(item.relation.schema, item.relation.name)}: dynamic payload`,
+        });
+    }
+}
+function stringifySubst(subst) {
+    return [...subst.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}=${v}`).join(",");
+}
+function sameSubst(a, b) {
+    if (a.size !== b.size)
+        return false;
+    for (const [k, v] of a) {
+        if (b.get(k) !== v)
+            return false;
+    }
+    return true;
+}