ugly-app 0.1.758 → 0.1.759

package/dist/cli/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.1.758";
+export declare const CLI_VERSION = "0.1.759";
 //# sourceMappingURL=version.d.ts.map

package/dist/cli/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.758";
+export const CLI_VERSION = "0.1.759";
 //# sourceMappingURL=version.js.map

package/dist/server/schemaIndexes.d.ts

@@ -1,6 +1,6 @@
 /**
  * Single source of truth for the btree expression indexes a collection declares
- * via `indexes: [{ fields: { <field>: 1 } }]`.
+ * via `indexes: [{ fields: { <field>: 1 | -1, ... } }]`.
  *
  * The default `idx_<c>_data` GIN index covers JSONB containment (`data @> …`),
  * but it CANNOT serve the scalar lookups the query layer actually emits
@@ -9,12 +9,22 @@
  * sequential-scans — invisible on a small table, a hang once it grows past the
  * 30s statement_timeout.
  *
+ * Single-field AND composite (multi-field) indexes are emitted. A composite
+ * `{ fields: { a: 1, b: -1 } }` produces ONE btree over
+ * `((data->>'a'), (data->>'b') DESC)` — which serves a multi-field equality
+ * filter AND a matching `ORDER BY` in a single index seek. (A bitmap-AND of
+ * single-field indexes can satisfy the filter, but never the ordering.) Field
+ * order and per-field direction (1 = ASC, -1 = DESC) are preserved from the
+ * declaration; the `PostgresIndexes` coverage checker already credits every
+ * field of a composite expression index, so declaring one silences the
+ * per-field unindexed warning for all of its fields.
+ *
  * Pure string-builder (no pg/pool imports) so it's safe to share across the Node
  * schema sync (`PostgresSchema.ensureTable`), the Workers `/_init` route, and the
  * migration generator (`schemaGen`). Statements are idempotent (IF NOT EXISTS) so
  * every call site can run them on every deploy.
  */
 import type { IndexDef } from '../shared/DB.js';
-/** Raw `CREATE [UNIQUE] INDEX` SQL for each declared single-field index. */
+/** Raw `CREATE [UNIQUE] INDEX` SQL for each declared (single- or multi-field) index. */
 export declare function fieldIndexStatements(collection: string, indexes?: IndexDef[]): string[];
 //# sourceMappingURL=schemaIndexes.d.ts.map

package/dist/server/schemaIndexes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemaIndexes.d.ts","sourceRoot":"","sources":["../../src/server/schemaIndexes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,QAAQ,EAAE,GACnB,MAAM,EAAE,CAmBV"}
+{"version":3,"file":"schemaIndexes.d.ts","sourceRoot":"","sources":["../../src/server/schemaIndexes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD,wFAAwF;AACxF,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,QAAQ,EAAE,GACnB,MAAM,EAAE,CAwBV"}

package/dist/server/schemaIndexes.js

@@ -1,23 +1,28 @@
 const VALID_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
-/** Raw `CREATE [UNIQUE] INDEX` SQL for each declared single-field index. */
+/** Raw `CREATE [UNIQUE] INDEX` SQL for each declared (single- or multi-field) index. */
 export function fieldIndexStatements(collection, indexes) {
     if (!VALID_NAME.test(collection))
         return [];
     const out = [];
     for (const idx of indexes ?? []) {
-        const fields = Object.keys(idx.fields);
-        // Single-field expression indexes only — matches the query layer, which
-        // filters one JSONB field at a time. (Composite indexes aren't emitted.)
-        if (fields.length !== 1)
+        const entries = Object.entries(idx.fields);
+        if (entries.length === 0)
             continue;
-        const field = fields[0];
-        if (!VALID_NAME.test(field))
+        // Reject the WHOLE index if any field name is unsafe — the names are
+        // interpolated straight into DDL, so there must be no injection surface.
+        if (!entries.every(([field]) => VALID_NAME.test(field)))
             continue;
         const unique = idx.unique ? 'UNIQUE ' : '';
-        const name = idx.unique
-            ? `idx_${collection}_${field}_unique`
-            : `idx_${collection}_${field}`;
-        out.push(`CREATE ${unique}INDEX IF NOT EXISTS "${name}" ON "${collection}" ((data->>'${field}'))`);
+        // `idx_<collection>_<f1>_<f2>_…` (+ `_unique`). Field order is significant —
+        // it matches the composite btree's leading-column order.
+        const base = `idx_${collection}_${entries.map(([field]) => field).join('_')}`;
+        const name = idx.unique ? `${base}_unique` : base;
+        // Each field is its own parenthesised expression; `-1` appends DESC so a
+        // filter+ORDER BY read is served entirely by the index.
+        const cols = entries
+            .map(([field, dir]) => `(data->>'${field}')${dir === -1 ? ' DESC' : ''}`)
+            .join(', ');
+        out.push(`CREATE ${unique}INDEX IF NOT EXISTS "${name}" ON "${collection}" (${cols})`);
     }
     return out;
 }

package/dist/server/schemaIndexes.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemaIndexes.js","sourceRoot":"","sources":["../../src/server/schemaIndexes.ts"],"names":[],"mappings":"AAkBA,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAE9C,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,OAAoB;IAEpB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM;YACrB,CAAC,CAAC,OAAO,UAAU,IAAI,KAAK,SAAS;YACrC,CAAC,CAAC,OAAO,UAAU,IAAI,KAAK,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CACN,UAAU,MAAM,wBAAwB,IAAI,SAAS,UAAU,eAAe,KAAK,KAAK,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"schemaIndexes.js","sourceRoot":"","sources":["../../src/server/schemaIndexes.ts"],"names":[],"mappings":"AA4BA,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAE9C,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,OAAoB;IAEpB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,qEAAqE;QACrE,yEAAyE;QACzE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,6EAA6E;QAC7E,yDAAyD;QACzD,MAAM,IAAI,GAAG,OAAO,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,IAAI,GAAG,OAAO;aACjB,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,YAAY,KAAK,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;aACxE,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CACN,UAAU,MAAM,wBAAwB,IAAI,SAAS,UAAU,MAAM,IAAI,GAAG,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ugly-app",
-  "version": "0.1.758",
+  "version": "0.1.759",
   "type": "module",
   "comment:files": "Allowlist what ships to npm. dist = runtime; src = sourcemap targets (dist/*.js.map reference ../../src/); templates = CLI scaffold. Everything else at repo root (.pgdata local Postgres, coverage, assets/icons sources, test/, test-results/) is excluded by omission. The !negations strip the scaffold's installed deps + cruft (templates/node_modules is 200MB+ and must never ship). package.json/README/LICENSE ship automatically.",
   "files": [

package/src/cli/version.ts

@@ -1,2 +1,2 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.758";
+export const CLI_VERSION = "0.1.759";

package/src/server/schemaIndexes.test.ts

@@ -28,17 +28,46 @@ describe('fieldIndexStatements', () => {
     expect(sql[1]).toContain(`((data->>'provider'))`);
   });
 
-  it('skips composite (multi-field) indexes — single-field only', () => {
-    expect(fieldIndexStatements('x', [{ fields: { a: 1, b: 1 } }])).toEqual([]);
+  it('emits ONE composite btree over all fields (order preserved)', () => {
+    const sql = fieldIndexStatements('codingSession', [
+      { fields: { userId: 1, projectId: 1, kind: 1 } },
+    ]);
+    expect(sql).toEqual([
+      `CREATE INDEX IF NOT EXISTS "idx_codingSession_userId_projectId_kind" ` +
+        `ON "codingSession" ((data->>'userId'), (data->>'projectId'), (data->>'kind'))`,
+    ]);
+  });
+
+  it('appends DESC for a -1 field so filter+ORDER BY is index-served', () => {
+    const sql = fieldIndexStatements('codingSession', [
+      { fields: { userId: 1, updated: -1 } },
+    ]);
+    expect(sql).toEqual([
+      `CREATE INDEX IF NOT EXISTS "idx_codingSession_userId_updated" ` +
+        `ON "codingSession" ((data->>'userId'), (data->>'updated') DESC)`,
+    ]);
+  });
+
+  it('emits a UNIQUE composite index (with _unique suffix)', () => {
+    const sql = fieldIndexStatements('member', [
+      { fields: { orgId: 1, userId: 1 }, unique: true },
+    ]);
+    expect(sql).toEqual([
+      `CREATE UNIQUE INDEX IF NOT EXISTS "idx_member_orgId_userId_unique" ` +
+        `ON "member" ((data->>'orgId'), (data->>'userId'))`,
+    ]);
   });
 
   it('returns [] for no/empty indexes', () => {
     expect(fieldIndexStatements('x')).toEqual([]);
     expect(fieldIndexStatements('x', [])).toEqual([]);
+    expect(fieldIndexStatements('x', [{ fields: {} }])).toEqual([]);
   });
 
   it('refuses unsafe collection/field names (no SQL injection surface)', () => {
     expect(fieldIndexStatements('bad-name', [{ fields: { userId: 1 } }])).toEqual([]);
     expect(fieldIndexStatements('ok', [{ fields: { 'a; DROP TABLE x': 1 } }])).toEqual([]);
+    // one bad field poisons the whole composite index (no partial emit)
+    expect(fieldIndexStatements('ok', [{ fields: { userId: 1, 'a; DROP': 1 } }])).toEqual([]);
   });
 });

package/src/server/schemaIndexes.ts

@@ -1,6 +1,6 @@
 /**
  * Single source of truth for the btree expression indexes a collection declares
- * via `indexes: [{ fields: { <field>: 1 } }]`.
+ * via `indexes: [{ fields: { <field>: 1 | -1, ... } }]`.
  *
  * The default `idx_<c>_data` GIN index covers JSONB containment (`data @> …`),
  * but it CANNOT serve the scalar lookups the query layer actually emits
@@ -9,6 +9,16 @@
  * sequential-scans — invisible on a small table, a hang once it grows past the
  * 30s statement_timeout.
  *
+ * Single-field AND composite (multi-field) indexes are emitted. A composite
+ * `{ fields: { a: 1, b: -1 } }` produces ONE btree over
+ * `((data->>'a'), (data->>'b') DESC)` — which serves a multi-field equality
+ * filter AND a matching `ORDER BY` in a single index seek. (A bitmap-AND of
+ * single-field indexes can satisfy the filter, but never the ordering.) Field
+ * order and per-field direction (1 = ASC, -1 = DESC) are preserved from the
+ * declaration; the `PostgresIndexes` coverage checker already credits every
+ * field of a composite expression index, so declaring one silences the
+ * per-field unindexed warning for all of its fields.
+ *
  * Pure string-builder (no pg/pool imports) so it's safe to share across the Node
  * schema sync (`PostgresSchema.ensureTable`), the Workers `/_init` route, and the
  * migration generator (`schemaGen`). Statements are idempotent (IF NOT EXISTS) so
@@ -18,7 +28,7 @@ import type { IndexDef } from '../shared/DB.js';
 
 const VALID_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-/** Raw `CREATE [UNIQUE] INDEX` SQL for each declared single-field index. */
+/** Raw `CREATE [UNIQUE] INDEX` SQL for each declared (single- or multi-field) index. */
 export function fieldIndexStatements(
   collection: string,
   indexes?: IndexDef[],
@@ -26,18 +36,23 @@ export function fieldIndexStatements(
   if (!VALID_NAME.test(collection)) return [];
   const out: string[] = [];
   for (const idx of indexes ?? []) {
-    const fields = Object.keys(idx.fields);
-    // Single-field expression indexes only — matches the query layer, which
-    // filters one JSONB field at a time. (Composite indexes aren't emitted.)
-    if (fields.length !== 1) continue;
-    const field = fields[0];
-    if (!VALID_NAME.test(field)) continue;
+    const entries = Object.entries(idx.fields);
+    if (entries.length === 0) continue;
+    // Reject the WHOLE index if any field name is unsafe — the names are
+    // interpolated straight into DDL, so there must be no injection surface.
+    if (!entries.every(([field]) => VALID_NAME.test(field))) continue;
     const unique = idx.unique ? 'UNIQUE ' : '';
-    const name = idx.unique
-      ? `idx_${collection}_${field}_unique`
-      : `idx_${collection}_${field}`;
+    // `idx_<collection>_<f1>_<f2>_…` (+ `_unique`). Field order is significant —
+    // it matches the composite btree's leading-column order.
+    const base = `idx_${collection}_${entries.map(([field]) => field).join('_')}`;
+    const name = idx.unique ? `${base}_unique` : base;
+    // Each field is its own parenthesised expression; `-1` appends DESC so a
+    // filter+ORDER BY read is served entirely by the index.
+    const cols = entries
+      .map(([field, dir]) => `(data->>'${field}')${dir === -1 ? ' DESC' : ''}`)
+      .join(', ');
     out.push(
-      `CREATE ${unique}INDEX IF NOT EXISTS "${name}" ON "${collection}" ((data->>'${field}'))`,
+      `CREATE ${unique}INDEX IF NOT EXISTS "${name}" ON "${collection}" (${cols})`,
     );
   }
   return out;