turbine-orm 0.48.0 → 0.49.0

package/dist/cjs/cli/mcp.js

@@ -15,6 +15,7 @@ const introspect_js_1 = require("../introspect.js");
 const index_js_1 = require("../query/index.js");
 const schema_js_1 = require("../schema.js");
 const migrate_js_1 = require("./migrate.js");
+const pii_tags_js_1 = require("./pii-tags.js");
 /**
  * Walk up from the running script to find turbine-orm's own package.json.
  * Uses process.argv[1] instead of import.meta.url so the same code compiles
@@ -410,15 +411,27 @@ async function sampleRows(ctx, tableName, limit) {
         const table = requireTable(metadata, tableName);
         const qualifiedTable = `${(0, index_js_1.quoteIdent)(ctx.options.schema)}.${(0, index_js_1.quoteIdent)(table.name)}`;
         const result = await client.query(`SELECT * FROM ${qualifiedTable} LIMIT $1`, [limit]);
+        // Sample rows go straight into an LLM context, so PII-tagged values are
+        // replaced before serialization, the same stance Studio's Data tab takes.
+        const piiColumns = new Set(table.columns.filter((c) => c.pii).map((c) => c.name));
         return {
             table: table.name,
             limit,
+            redactedColumns: [...piiColumns],
             columns: result.fields.map((field) => ({ name: field.name, dataTypeID: field.dataTypeID })),
-            rows: result.rows,
+            rows: piiColumns.size === 0 ? result.rows : result.rows.map((row) => redactRow(row, piiColumns)),
             rowCount: result.rowCount ?? result.rows.length,
         };
     });
 }
+/** Replace PII-tagged cells with a fixed marker (never the value, never null). */
+function redactRow(row, piiColumns) {
+    const out = {};
+    for (const [key, value] of Object.entries(row)) {
+        out[key] = piiColumns.has(key) ? '•• redacted ••' : value;
+    }
+    return out;
+}
 async function withReadOnly(ctx, fn) {
     const client = await ctx.pool.connect();
     try {
@@ -596,7 +609,15 @@ async function loadSchemaMetadata(client, options) {
             indexes: indexesByTable.get(tableName) ?? [],
         };
     }
-    return { tables, enums };
+    const metadata = { tables, enums };
+    // Code-first PII tags, layered onto the live catalog. Without this the
+    // redaction below has nothing to act on (introspection never infers a tag).
+    if (options.metadataDir) {
+        const source = (0, pii_tags_js_1.loadPiiTags)(options.metadataDir);
+        if (source)
+            (0, pii_tags_js_1.applyPiiTags)(metadata, source.tags);
+    }
+    return metadata;
 }
 /**
  * Group raw FK rows into constraint-level entries and delegate relation

package/dist/cjs/cli/migrate.js

@@ -196,7 +196,8 @@ function parseMigrationContent(content) {
  * Split a SQL script into individual statements on top-level semicolons.
  *
  * A correct tokenizer, not a `split(';')`: a semicolon inside a single-quoted
- * string, a double-quoted identifier, a dollar-quoted body, a line comment
+ * string (including a backslash-escaping `E'...'` string), a double-quoted
+ * identifier, a dollar-quoted body, a line comment
  * (`--`), or a block comment (`/* *\/`, which Postgres allows to nest) must NOT
  * split. This is the one production-destroying failure mode of no-transaction
  * migrations (a partial statement executed against production), so the behavior
@@ -247,10 +248,19 @@ function splitSqlStatements(sql) {
             continue;
         }
         // Single-quoted string ('' is an escaped quote, stays inside the string).
+        // An E-prefixed string (E'...') additionally honors backslash escapes, so
+        // `E'p\'q'` is ONE string: treating the `\'` as a terminator would close the
+        // string early and let the next quote swallow a real statement terminator.
         if (ch === "'") {
+            const backslashEscapes = isEscapeStringPrefix(sql, i);
             let j = i + 1;
             current += "'";
             while (j < n) {
+                if (backslashEscapes && sql[j] === '\\' && j + 1 < n) {
+                    current += sql[j] + sql[j + 1];
+                    j += 2;
+                    continue;
+                }
                 if (sql[j] === "'" && sql[j + 1] === "'") {
                     current += "''";
                     j += 2;
@@ -322,6 +332,23 @@ function splitSqlStatements(sql) {
         statements.push(tail);
     return statements.filter((s) => !isCommentOnlyStatement(s));
 }
+/**
+ * True when the quote at `quoteAt` opens a Postgres escape string (`E'...'`),
+ * whose body treats a backslash as an escape character.
+ *
+ * The `E` must be a standalone token: an identifier that merely ends in `e`
+ * (`some_table` cannot be followed by a quote in valid SQL, but the check keeps
+ * the tokenizer honest) does not turn the following literal into an E-string.
+ * Ordinary literals are left alone on purpose: with the modern
+ * `standard_conforming_strings = on` default, `'a\'` IS a complete string.
+ */
+function isEscapeStringPrefix(sql, quoteAt) {
+    const prev = sql[quoteAt - 1];
+    if (prev !== 'E' && prev !== 'e')
+        return false;
+    const before = sql[quoteAt - 2];
+    return before === undefined || !/[A-Za-z0-9_$"]/.test(before);
+}
 /** True when a fragment contains nothing but comments and whitespace. */
 function isCommentOnlyStatement(stmt) {
     const withoutComments = stmt.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/--[^\n]*/g, ' ');

package/dist/cjs/cli/pii-tags.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * PII tags for tools that build their schema from live introspection.
+ *
+ * `ColumnMetadata.pii` is a CODE-FIRST declaration: it comes from
+ * `defineSchema({ pii: true })` or the fluent `.pii()`, and `introspect.ts`
+ * never sets it (there is no reliable way to infer "this column holds personal
+ * data" from a Postgres catalog, and guessing would be worse than not trying).
+ *
+ * Studio and the MCP server introspect a live database, so on their own they
+ * see NO tags at all and their redaction is inert. This module closes that gap
+ * by reading the tags out of the generated `metadata.ts` that `turbine
+ * generate` writes, and handing back a table → column-name map the caller
+ * layers onto its introspected metadata.
+ *
+ * The generated file is TypeScript in the user's project, so it cannot simply
+ * be imported by a compiled CLI. It is read as TEXT and scanned for the exact
+ * shapes `generate.ts` emits (`serializeColumn`: one column object per line,
+ * `pii: true` only when tagged). Nothing is executed. A file that does not
+ * parse yields no tags, and the caller decides what to say about that.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePiiTags = parsePiiTags;
+exports.loadPiiTags = loadPiiTags;
+exports.applyPiiTags = applyPiiTags;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/** `    <table>: {` at the table-entry indentation `generateMetadata` emits. */
+const TABLE_HEAD = /^ {4}(?:'([^']+)'|([A-Za-z_$][\w$]*)): \{$/;
+/** A serialized column object; `pii: true` is emitted only when tagged. */
+const COLUMN_LINE = /^ {8}\{ name: '([^']+)'.*\bpii: true\b/;
+/** `      columns: [` opens the column list; `      ],` closes it. */
+const COLUMNS_OPEN = /^ {6}columns: \[$/;
+const COLUMNS_CLOSE = /^ {6}\],$/;
+/**
+ * Scan generated-metadata source text for PII-tagged columns.
+ *
+ * Exported for testing; callers normally use {@link loadPiiTags}.
+ */
+function parsePiiTags(source) {
+    const tags = {};
+    let table = null;
+    let inColumns = false;
+    for (const line of source.split('\n')) {
+        const head = TABLE_HEAD.exec(line);
+        if (head) {
+            table = head[1] ?? head[2] ?? null;
+            inColumns = false;
+            continue;
+        }
+        if (!table)
+            continue;
+        if (COLUMNS_OPEN.test(line)) {
+            inColumns = true;
+            continue;
+        }
+        if (inColumns && COLUMNS_CLOSE.test(line)) {
+            inColumns = false;
+            continue;
+        }
+        if (!inColumns)
+            continue;
+        const col = COLUMN_LINE.exec(line);
+        if (col?.[1]) {
+            const list = tags[table] ?? [];
+            list.push(col[1]);
+            tags[table] = list;
+        }
+    }
+    return tags;
+}
+/**
+ * Read PII tags from the generated metadata in `outDir`, or return `null` when
+ * there is no readable generated metadata there. Never throws.
+ */
+function loadPiiTags(outDir) {
+    for (const file of ['metadata.ts', 'metadata.js']) {
+        const path = (0, node_path_1.join)(outDir, file);
+        let source;
+        try {
+            source = (0, node_fs_1.readFileSync)(path, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const tags = parsePiiTags(source);
+        const count = Object.values(tags).reduce((n, cols) => n + cols.length, 0);
+        return { path, tags, count };
+    }
+    return null;
+}
+/**
+ * Apply `tags` to introspected metadata, in place. Only columns that exist in
+ * the live schema are tagged, so a stale generated file can never invent one.
+ * Returns the number of columns actually tagged.
+ */
+function applyPiiTags(metadata, tags) {
+    let applied = 0;
+    for (const [tableName, columns] of Object.entries(tags)) {
+        const table = Object.hasOwn(metadata.tables, tableName) ? metadata.tables[tableName] : undefined;
+        if (!table)
+            continue;
+        for (const col of table.columns) {
+            if (columns.includes(col.name)) {
+                col.pii = true;
+                applied++;
+            }
+        }
+    }
+    return applied;
+}