Skip to content

Conversation

@ymc9
Copy link
Member

@ymc9 ymc9 commented Oct 31, 2025

Summary by CodeRabbit

  • New Features

    • Added adapters for Elysia, Fastify, Hono, Next.js, Nuxt, SvelteKit, and TanStack Start.
    • Introduced a full-featured REST API handler with schema-aware CRUD, filtering, pagination, and serialization.
  • Breaking Changes

  • Chores

    • Bumped version to 3.0.0-beta.14.
    • Renamed runtime package to ORM and updated docs/installation guidance.

ymc9 and others added 12 commits October 23, 2025 19:21
* feat(server): migrate next.js server adapter

* address PR comments
Co-authored-by: ymc9 <104139426+ymc9@users.noreply.github.com>
* feat(server): migrate rest api handler

* addressing PR comments

* update lock file

* fix pg string json handling

* update
* feat(server): migrate fastify adapter

* addressing pr comments
* feat(server): migrate elysia adapter

* addressing pr comments
* feat(server): migrate hono adapter

* fix test
* feat(server): migrate nuxt adapter

* addressing PR comments

* addressing PR comments

* fix
* feat(server): migrate tanstack-start adapter

* prettier format
Copilot AI review requested due to automatic review settings October 31, 2025 21:51
@coderabbitai
Copy link

coderabbitai bot commented Oct 31, 2025

Warning

Rate limit exceeded

@ymc9 has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 17 minutes and 1 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 4e8a1f1 and 7826da3.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (28)
  • BREAKINGCHANGES.md (1 hunks)
  • package.json (1 hunks)
  • packages/orm/package.json (2 hunks)
  • packages/orm/src/client/crud/validator/index.ts (8 hunks)
  • packages/orm/src/client/crud/validator/utils.ts (3 hunks)
  • packages/orm/src/utils/zod-utils.ts (1 hunks)
  • packages/server/package.json (3 hunks)
  • packages/testtools/src/vitest-ext.ts (2 hunks)
  • packages/zod/package.json (2 hunks)
  • pnpm-workspace.yaml (1 hunks)
  • tests/e2e/orm/schemas/basic/input.ts (1 hunks)
  • tests/e2e/orm/schemas/basic/models.ts (1 hunks)
  • tests/e2e/orm/schemas/basic/schema.ts (1 hunks)
  • tests/e2e/orm/schemas/delegate/input.ts (1 hunks)
  • tests/e2e/orm/schemas/delegate/models.ts (1 hunks)
  • tests/e2e/orm/schemas/delegate/schema.ts (1 hunks)
  • tests/e2e/orm/schemas/name-mapping/input.ts (1 hunks)
  • tests/e2e/orm/schemas/name-mapping/models.ts (1 hunks)
  • tests/e2e/orm/schemas/name-mapping/schema.ts (1 hunks)
  • tests/e2e/orm/schemas/petstore/input.ts (1 hunks)
  • tests/e2e/orm/schemas/petstore/models.ts (1 hunks)
  • tests/e2e/orm/schemas/petstore/schema.ts (1 hunks)
  • tests/e2e/orm/schemas/todo/input.ts (1 hunks)
  • tests/e2e/orm/schemas/todo/models.ts (1 hunks)
  • tests/e2e/orm/schemas/todo/schema.ts (1 hunks)
  • tests/e2e/orm/schemas/typing/input.ts (1 hunks)
  • tests/e2e/orm/schemas/typing/models.ts (1 hunks)
  • tests/e2e/orm/schemas/typing/schema.ts (1 hunks)

Walkthrough

Renames package imports from @zenstackhq/runtime to @zenstackhq/orm across the repo, bumps package versions to 3.0.0-beta.14, adds a shared common-helpers export surface, introduces many new server framework adapters and exports, and adds a full-featured REST API handler plus extensive adapter tests.

Changes

Cohort / File(s) Summary
Package metadata & versioning
package.json, packages/*/package.json, packages/orm/package.json, samples/*/package.json
Version bumps from 3.0.0-beta.133.0.0-beta.14; packages/orm/package.json renamed metadata from @zenstackhq/runtime@zenstackhq/orm and updated description.
Breaking changes doc
BREAKINGCHANGES.md
Added entry: removal of @omit and @password attributes.
Docs & README
README.md, CLAUDE.md, samples/blog/README.md
Wording updated to reference ORM package; installer instructions switched from @zenstackhq/runtime@next@zenstackhq/orm@next; runtime → ORM phrasing adjustments.
Import path migration (runtime → orm)
many files (CLI, SDK, plugins, server, tests, samples, zod, tanstack-query, testtools, etc.) — e.g. packages/cli/src/*, packages/plugins/policy/src/*, packages/sdk/src/ts-schema-generator.ts, packages/testtools/src/*, packages/zod/src/*, samples/blog/zenstack/*, tests/e2e/**
Replaced imports from @zenstackhq/runtime and @zenstackhq/runtime/schema with @zenstackhq/orm and @zenstackhq/orm/schema across codebase; updated generated import outputs accordingly.
Common helpers consolidation
packages/common-helpers/src/clone.ts, packages/common-helpers/src/index.ts
Switched isPlainObject import to a local relative module; added public re-exports clone and enumerable.
ORM dialect & CRUD tweaks
packages/orm/src/client/crud/dialects/base-dialect.ts, packages/orm/src/client/crud/dialects/postgresql.ts
base-dialect: use enumerate from common-helpers, add index to iteration, introduce dynamic join aliasing for order-by on-to-one relations; postgresql: add JSON normalization mapper (stringify primitives).
Operations imports refactor
packages/orm/src/client/crud/operations/base.ts, packages/orm/src/client/crud/validator/index.ts
Replace local utils imports with @zenstackhq/common-helpers (clone, enumerate, invariant, isPlainObject).
CLI scaffolding & templates
packages/cli/src/actions/init.ts, packages/cli/src/actions/generate.ts, packages/cli/src/actions/templates.ts, packages/cli/src/actions/migrate.ts
Installer and generated templates now reference @zenstackhq/orm; minor formatting tweak in migrate.
Server: common adapter utilities
packages/server/src/adapter/common.ts
Added CommonAdapterOptions<Schema> interface and logInternalError(logger, err) helper.
Express adapter
packages/server/src/adapter/express/middleware.ts, packages/server/src/adapter/express/index.ts, packages/server/src/express/index.ts
Renamed options to ExpressMiddlewareOptions extends CommonAdapterOptions; middleware uses logInternalError and returns sanitized 500 messages; re-export added in adapter index; top-level express index removed prior re-export.
New adapters & re-exports
packages/server/src/adapter/{elysia,fastify,hono,next,nuxt,sveltekit,tanstack-start}/*, packages/server/src/adapter/*/index.ts
Added handlers/plugins and option types for Elysia, Fastify, Hono, Next.js (pages & app), Nuxt, SvelteKit, TanStack Start; each adapter exposes factory/plugin and types via index re-exports.
Fastify plugin
packages/server/src/adapter/fastify/plugin.ts
New Fastify plugin exporting ZenStackFastifyPlugin and FastifyPluginOptions with prefix/getClient and centralized error logging.
Next.js adapters & dispatcher
packages/server/src/adapter/next/{app-route-handler.ts,pages-route-handler.ts,index.ts}
Added AppRoute and PagesRoute handlers, option interfaces, and a polymorphic NextRequestHandler that dispatches based on useAppDir.
REST API handler
packages/server/src/api/rest/index.ts
Introduced RestApiHandler<Schema> implementing full REST CRUD: routing, filtering, sorting, pagination, relationship handling, compound ID support, serialization, validation, and error mapping; adds RestApiHandlerOptions type.
API exports & utilities
packages/server/src/api/index.ts, packages/server/src/api/rpc/index.ts, packages/server/src/api/utils.ts, packages/server/src/types.ts
api/index.ts now exports RestApiHandler + types and RPCApiHandler + types; getZodErrorMessage() added; ApiHandler interface gained `get log(): LogConfig
Server package / build changes
packages/server/package.json, packages/server/tsup.config.ts
Expanded package exports subpaths for each adapter, replaced dependency @zenstackhq/runtime@zenstackhq/orm, added numerous dev/peer deps for frameworks; tsup entries expanded to build all adapters.
Tests: adapter suites & updates
packages/server/test/adapter/*.test.ts, various tests/e2e/**
Added extensive adapter tests for Elysia, Fastify, Hono, Next, SvelteKit, TanStack Start; updated Express tests to use new RestApiHandler flows; many e2e tests updated import paths to ORM.
Misc. packages updated to ORM dep
packages/plugins/policy/package.json, packages/tanstack-query/package.json, packages/testtools/package.json, packages/zod/package.json, etc.
Replaced workspace dependency @zenstackhq/runtime@zenstackhq/orm in multiple package.json files.

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Areas needing extra attention:

  • packages/server/src/api/rest/index.ts — very large, high-density logic: filtering, sorting, pagination, relationship wiring, ID coercion, and serializers.
  • New adapter implementations (seven distinct frameworks) — verify correct request/response shapes, client acquisition, basePath/prefix handling and consistent error handling via logInternalError.
  • Broad import migration (runtime → orm) — ensure types and runtime exports align; watch for missed or broken re-exports.
  • packages/orm dialect changes — verify join aliasing and PostgreSQL JSON normalization correctness.
  • package.json exports and tsup changes — confirm build outputs and subpath mappings for each adapter.

Possibly related PRs

Poem

🐇 I hopped through code with a twitch of my nose,

Runtime became ORM — that's how progress goes.
Adapters galore from Next to Fastify,
REST blooms in handlers beneath the blue sky.
A carrot for tests, and a tunnel of cheer!

Pre-merge checks and finishing touches

❌ Failed checks (1 warning, 1 inconclusive)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 32.26% which is insufficient. The required threshold is 80.00%. You can run @coderabbitai generate docstrings to improve docstring coverage.
Title Check ❓ Inconclusive The title "merge dev to main (v3.0.0-beta.14)" is a procedural description of a git operation rather than a meaningful summary of the changeset's substantive changes. While the PR does contain version 3.0.0-beta.14 changes, the title uses generic phrasing that fails to communicate what is actually changing in the codebase. The changeset includes significant modifications such as renaming the runtime package to orm, removing @omit and @password attributes as breaking changes, expanding server adapters, and introducing a REST API handler, none of which are conveyed by the title. A teammate scanning git history would not understand the primary changes from this title alone. Consider revising the title to reflect the main substantive change, such as "Rename @zenstackhq/runtime to @zenstackhq/orm and release v3.0.0-beta.14" or "Consolidate runtime into ORM package (v3.0.0-beta.14)" to provide meaningful context about what is changing in the codebase rather than describing a git merge operation.
✅ Passed checks (1 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@claude
Copy link

claude bot commented Oct 31, 2025

Claude finished @ymc9's task —— View job


Code Review for ZenStack v3.0.0-beta.14

Completed comprehensive review of this substantial PR that merges dev to main for v3.0.0-beta.14 (18,563 additions, 3,736 deletions across 100 files).

Review Checklist

  • Analyze overall architecture and package restructuring changes
  • Review new server adapter implementations (Elysia, Hono, SvelteKit, TanStack Start, Nuxt)
  • Examine ORM core changes and potential breaking changes
  • Check security implications of new server integrations
  • Assess performance considerations
  • Review test coverage for new functionality
  • Analyze breaking changes documentation
  • Evaluate code quality and best practices

Review Summary

This is a well-structured release with significant new functionality. The code quality is high, following TypeScript best practices and maintaining consistency across the codebase.

✅ Strengths

Architecture & Design

  • Consistent server adapter pattern: All new adapters follow a common interface via CommonAdapterOptions, promoting maintainability
  • Strong separation of concerns: Clear division between API handlers, adapters, and core ORM functionality
  • Comprehensive TypeScript support: Excellent type safety throughout with proper generic constraints

New Server Adapters

  • Wide framework coverage: New support for Elysia, Hono, SvelteKit, TanStack Start, and Nuxt
  • Proper error handling: Consistent error handling across all adapters with standardized internal error logging
  • Flexible configuration: Optional peer dependencies properly configured to avoid bloat

ORM Enhancements

  • Improved policy handling: Enhanced post-update policy validation with before/after state comparison
  • Better SQL dialect support: Enhanced base dialect with improved query building and filtering
  • Performance optimizations: Smart query optimization in policy handler with constant policy evaluation

Package Management

  • Clean dependency management: Proper workspace dependencies and optional peer dependencies
  • Export structure: Well-organized package exports supporting both CJS and ESM

⚠️ Areas for Attention

Security Considerations

  1. Input validation in server adapters (packages/server/src/adapter/*/handler.ts):

    • Path traversal protection via basePath handling is good
    • Consider adding rate limiting guidance in documentation
    • URL parameter parsing is handled securely
  2. Policy enforcement (packages/plugins/policy/src/policy-handler.ts:76-84):

    • Non-CRUD queries are properly rejected
    • Policy bypass protection is robust

Performance Concerns

  1. Complex policy evaluation (packages/plugins/policy/src/policy-handler.ts:242-264):

    • Before-update entity loading could be expensive for large datasets
    • Consider documenting performance implications of post-update policies
  2. Query optimization (packages/orm/src/client/crud/dialects/base-dialect.ts:102-105):

    • Cursor-based pagination implementation looks efficient
    • Complex filter building might benefit from query plan analysis

Code Quality Issues

  1. Magic strings (packages/server/src/adapter/express/middleware.ts:48-50):

    const url = request.protocol + '://' + request.get('host') + request.originalUrl;

    Consider using URL constructor consistently

  2. Error handling consistency (packages/server/src/adapter/elysia/handler.ts:66-72):

    • Good error boundary implementation
    • Consider standardizing error response formats across adapters

Breaking Changes

The documented breaking changes in BREAKINGCHANGES.md are well-documented:

  • Policy rejection behavior changes
  • Removal of deprecated APIs (check(), @omit, @password)
  • Relation filtering behavior changes

🔍 Test Coverage Assessment

Positive Coverage

  • Server adapters: Comprehensive integration tests for Express, including both RPC and REST handlers
  • Multiple scenarios: Tests cover CRUD operations, filtering, aggregation, and error cases
  • Real-world usage: E2E tests validate compatibility with actual projects

Gaps to Consider

  • Error boundary testing: While adapters handle errors well, more edge case testing would be beneficial
  • Performance testing: Large dataset scenarios for policy evaluation
  • Concurrent request handling: Multi-user scenarios for server adapters

📝 Recommendations

Immediate Actions

  1. Documentation: Update migration guide for breaking changes
  2. Performance monitoring: Add metrics for policy evaluation performance
  3. Security review: Consider security audit for new server integrations

Future Considerations

  1. Caching layer: Consider query result caching for policy evaluations
  2. Monitoring: Add structured logging for production debugging
  3. Rate limiting: Built-in rate limiting for server adapters

🎯 Overall Assessment

APPROVED - This is a high-quality release that significantly expands ZenStack's server integration capabilities while maintaining code quality and security standards. The architecture is sound, the implementation is thorough, and the breaking changes are well-documented.

The new server adapters follow consistent patterns and provide excellent developer experience. The ORM improvements enhance both functionality and performance. Test coverage is comprehensive for the new features.

The codebase demonstrates excellent TypeScript practices, proper error handling, and security-conscious design. This release represents a significant step forward for the ZenStack ecosystem.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This pull request renames the @zenstackhq/runtime package to @zenstackhq/orm across the codebase. This appears to be part of version 3.0.0-beta.14 release and includes:

  • Package rename from @zenstackhq/runtime to @zenstackhq/orm
  • Import path updates across all test files, samples, and package dependencies
  • Version bump from 3.0.0-beta.13 to 3.0.0-beta.14
  • Some additional test cases added (duplicate sort fields handling)
  • New adapter implementations for various frameworks (TanStack Start, SvelteKit, Hono, Fastify, Next.js)
  • Refactoring of server adapter structure

Reviewed Changes

Copilot reviewed 145 out of 189 changed files in this pull request and generated no comments.

Show a summary per file
File Description
tests/regression/package.json Updated dependency from @zenstackhq/runtime to @zenstackhq/orm
tests/e2e/package.json Updated dependency from @zenstackhq/runtime to @zenstackhq/orm
Multiple test files Updated import statements from @zenstackhq/runtime to @zenstackhq/orm
Generated schema files Updated import paths from @zenstackhq/runtime/schema to @zenstackhq/orm/schema
Package files Updated dependencies and version numbers
Server adapter files New adapter implementations and refactoring
tests/e2e/orm/client-api/find.test.ts Added test cases for duplicate sort fields

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 6

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)
packages/tanstack-query/src/react.ts (2)

45-45: Replace any return type with proper typing.

The function returns any, which defeats TypeScript's type safety. This should return ToModelHooks<Schema, Model> to ensure type correctness.

Apply this diff:

-function toModelHooks<Schema extends SchemaDef, Model extends GetModels<Schema>>(schema: Schema, model: Model): any {
+function toModelHooks<Schema extends SchemaDef, Model extends GetModels<Schema>>(schema: Schema, model: Model): ToModelHooks<Schema, Model> {

51-77: Stub implementations lack TanStack Query integration.

The hook implementations return hardcoded mock data instead of using actual TanStack Query hooks (useQuery, useMutation). This means the hooks won't provide real query/mutation functionality, caching, or state management.

For a beta release being merged to main, consider:

  • Implementing actual TanStack Query integration using useQuery and useMutation from @tanstack/react-query
  • Or clearly documenting that this is placeholder code if the functionality is intentionally deferred

Would you like me to generate a proper implementation using TanStack Query hooks, or should this be tracked as a follow-up issue?

🧹 Nitpick comments (1)
packages/server/src/adapter/next/pages-route-handler.ts (1)

36-36: Consider using res.json() for consistency.

Lines 36 and 39 use res.send(), while line 18 uses res.json(). For consistency and to ensure proper Content-Type headers, consider using res.json() throughout.

-            res.status(r.status).send(r.body);
+            res.status(r.status).json(r.body);
        } catch (err) {
            logInternalError(options.apiHandler.log, err);
-            res.status(500).send({ message: 'An internal server error occurred' });
+            res.status(500).json({ message: 'An internal server error occurred' });
        }

Also applies to: 39-39

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1b95b16 and f9cbedc.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (107)
  • BREAKINGCHANGES.md (1 hunks)
  • CLAUDE.md (2 hunks)
  • README.md (2 hunks)
  • package.json (1 hunks)
  • packages/cli/package.json (2 hunks)
  • packages/cli/src/actions/generate.ts (1 hunks)
  • packages/cli/src/actions/init.ts (1 hunks)
  • packages/cli/src/actions/migrate.ts (1 hunks)
  • packages/cli/src/actions/templates.ts (1 hunks)
  • packages/cli/test/ts-schema-gen.test.ts (1 hunks)
  • packages/common-helpers/package.json (1 hunks)
  • packages/common-helpers/src/clone.ts (1 hunks)
  • packages/common-helpers/src/index.ts (1 hunks)
  • packages/config/eslint-config/package.json (1 hunks)
  • packages/config/typescript-config/package.json (1 hunks)
  • packages/config/vitest-config/package.json (1 hunks)
  • packages/create-zenstack/package.json (1 hunks)
  • packages/create-zenstack/src/index.ts (1 hunks)
  • packages/dialects/sql.js/package.json (1 hunks)
  • packages/language/package.json (1 hunks)
  • packages/orm/package.json (1 hunks)
  • packages/orm/src/client/crud/dialects/base-dialect.ts (3 hunks)
  • packages/orm/src/client/crud/dialects/postgresql.ts (1 hunks)
  • packages/orm/src/client/crud/operations/base.ts (1 hunks)
  • packages/orm/src/client/crud/validator/index.ts (1 hunks)
  • packages/plugins/policy/package.json (2 hunks)
  • packages/plugins/policy/src/column-collector.ts (1 hunks)
  • packages/plugins/policy/src/expression-evaluator.ts (1 hunks)
  • packages/plugins/policy/src/expression-transformer.ts (2 hunks)
  • packages/plugins/policy/src/functions.ts (1 hunks)
  • packages/plugins/policy/src/plugin.ts (1 hunks)
  • packages/plugins/policy/src/policy-handler.ts (2 hunks)
  • packages/plugins/policy/src/types.ts (1 hunks)
  • packages/plugins/policy/src/utils.ts (1 hunks)
  • packages/sdk/package.json (1 hunks)
  • packages/sdk/src/ts-schema-generator.ts (7 hunks)
  • packages/server/package.json (3 hunks)
  • packages/server/src/adapter/common.ts (1 hunks)
  • packages/server/src/adapter/elysia/handler.ts (1 hunks)
  • packages/server/src/adapter/elysia/index.ts (1 hunks)
  • packages/server/src/adapter/express/index.ts (1 hunks)
  • packages/server/src/adapter/express/middleware.ts (3 hunks)
  • packages/server/src/adapter/fastify/index.ts (1 hunks)
  • packages/server/src/adapter/fastify/plugin.ts (1 hunks)
  • packages/server/src/adapter/hono/handler.ts (1 hunks)
  • packages/server/src/adapter/hono/index.ts (1 hunks)
  • packages/server/src/adapter/next/app-route-handler.ts (1 hunks)
  • packages/server/src/adapter/next/index.ts (1 hunks)
  • packages/server/src/adapter/next/pages-route-handler.ts (1 hunks)
  • packages/server/src/adapter/nuxt/handler.ts (1 hunks)
  • packages/server/src/adapter/nuxt/index.ts (1 hunks)
  • packages/server/src/adapter/sveltekit/handler.ts (1 hunks)
  • packages/server/src/adapter/sveltekit/index.ts (1 hunks)
  • packages/server/src/adapter/tanstack-start/handler.ts (1 hunks)
  • packages/server/src/adapter/tanstack-start/index.ts (1 hunks)
  • packages/server/src/api/index.ts (1 hunks)
  • packages/server/src/api/rest/index.ts (1 hunks)
  • packages/server/src/api/rpc/index.ts (4 hunks)
  • packages/server/src/api/utils.ts (2 hunks)
  • packages/server/src/express/index.ts (0 hunks)
  • packages/server/src/types.ts (2 hunks)
  • packages/server/test/adapter/elysia.test.ts (1 hunks)
  • packages/server/test/adapter/express.test.ts (2 hunks)
  • packages/server/test/adapter/fastify.test.ts (1 hunks)
  • packages/server/test/adapter/hono.test.ts (1 hunks)
  • packages/server/test/adapter/next.test.ts (1 hunks)
  • packages/server/test/adapter/sveltekit.test.ts (1 hunks)
  • packages/server/test/adapter/tanstack-start.test.ts (1 hunks)
  • packages/server/test/api/rpc.test.ts (1 hunks)
  • packages/server/tsup.config.ts (1 hunks)
  • packages/tanstack-query/package.json (2 hunks)
  • packages/tanstack-query/src/react.ts (1 hunks)
  • packages/testtools/package.json (2 hunks)
  • packages/testtools/src/client.ts (1 hunks)
  • packages/testtools/src/project.ts (1 hunks)
  • packages/testtools/src/vitest-ext.ts (1 hunks)
  • packages/zod/package.json (2 hunks)
  • packages/zod/src/index.ts (1 hunks)
  • packages/zod/src/types.ts (1 hunks)
  • samples/blog/README.md (2 hunks)
  • samples/blog/main.ts (1 hunks)
  • samples/blog/package.json (2 hunks)
  • samples/blog/zenstack/input.ts (1 hunks)
  • samples/blog/zenstack/models.ts (1 hunks)
  • samples/blog/zenstack/schema.ts (1 hunks)
  • tests/e2e/orm/client-api/aggregate.test.ts (1 hunks)
  • tests/e2e/orm/client-api/computed-fields.test.ts (2 hunks)
  • tests/e2e/orm/client-api/count.test.ts (1 hunks)
  • tests/e2e/orm/client-api/create-many-and-return.test.ts (1 hunks)
  • tests/e2e/orm/client-api/create-many.test.ts (1 hunks)
  • tests/e2e/orm/client-api/create.test.ts (1 hunks)
  • tests/e2e/orm/client-api/default-values.test.ts (1 hunks)
  • tests/e2e/orm/client-api/delegate.test.ts (1 hunks)
  • tests/e2e/orm/client-api/delete-many.test.ts (1 hunks)
  • tests/e2e/orm/client-api/delete.test.ts (1 hunks)
  • tests/e2e/orm/client-api/filter.test.ts (1 hunks)
  • tests/e2e/orm/client-api/find.test.ts (4 hunks)
  • tests/e2e/orm/client-api/group-by.test.ts (1 hunks)
  • tests/e2e/orm/client-api/name-mapping.test.ts (1 hunks)
  • tests/e2e/orm/client-api/raw-query.test.ts (1 hunks)
  • tests/e2e/orm/client-api/transaction.test.ts (1 hunks)
  • tests/e2e/orm/client-api/undefined-values.test.ts (1 hunks)
  • tests/e2e/orm/client-api/update-many.test.ts (1 hunks)
  • tests/e2e/orm/client-api/update.test.ts (1 hunks)
  • tests/e2e/orm/client-api/upsert.test.ts (1 hunks)
  • tests/e2e/orm/client-api/utils.ts (1 hunks)
  • tests/e2e/orm/plugin-infra/entity-mutation-hooks.test.ts (1 hunks)
⛔ Files not processed due to max files limit (38)
  • tests/e2e/orm/plugin-infra/on-kysely-query.test.ts
  • tests/e2e/orm/plugin-infra/on-query-hooks.test.ts
  • tests/e2e/orm/policy/basic-schema-read.test.ts
  • tests/e2e/orm/policy/crud/create.test.ts
  • tests/e2e/orm/policy/migrated/client-extensions.test.ts
  • tests/e2e/orm/policy/migrated/multi-field-unique.test.ts
  • tests/e2e/orm/policy/migrated/todo-sample.test.ts
  • tests/e2e/orm/schemas/basic/input.ts
  • tests/e2e/orm/schemas/basic/models.ts
  • tests/e2e/orm/schemas/basic/schema.ts
  • tests/e2e/orm/schemas/delegate/input.ts
  • tests/e2e/orm/schemas/delegate/models.ts
  • tests/e2e/orm/schemas/delegate/schema.ts
  • tests/e2e/orm/schemas/delegate/typecheck.ts
  • tests/e2e/orm/schemas/name-mapping/input.ts
  • tests/e2e/orm/schemas/name-mapping/models.ts
  • tests/e2e/orm/schemas/name-mapping/schema.ts
  • tests/e2e/orm/schemas/petstore/input.ts
  • tests/e2e/orm/schemas/petstore/models.ts
  • tests/e2e/orm/schemas/petstore/schema.ts
  • tests/e2e/orm/schemas/todo/input.ts
  • tests/e2e/orm/schemas/todo/models.ts
  • tests/e2e/orm/schemas/todo/schema.ts
  • tests/e2e/orm/schemas/typing/input.ts
  • tests/e2e/orm/schemas/typing/models.ts
  • tests/e2e/orm/schemas/typing/schema.ts
  • tests/e2e/orm/schemas/typing/typecheck.ts
  • tests/e2e/package.json
  • tests/regression/package.json
  • tests/regression/test/issue-204/input.ts
  • tests/regression/test/issue-204/models.ts
  • tests/regression/test/issue-204/schema.ts
  • tests/regression/test/v2-migrated/issue-1135.test.ts
  • tests/regression/test/v2-migrated/issue-1763.test.ts
  • tests/regression/test/v2-migrated/issue-1857.test.ts
  • tests/regression/test/v2-migrated/issue-1894.test.ts
  • tests/regression/test/v2-migrated/issue-1991.test.ts
  • tests/regression/test/v2-migrated/issue-1994.test.ts
💤 Files with no reviewable changes (1)
  • packages/server/src/express/index.ts
🧰 Additional context used
📓 Path-based instructions (4)
{packages,samples,tests}/**

📄 CodeRabbit inference engine (CLAUDE.md)

Place packages only under packages/, samples/, or tests/

Files:

  • packages/cli/src/actions/migrate.ts
  • tests/e2e/orm/client-api/create-many-and-return.test.ts
  • packages/language/package.json
  • packages/testtools/src/vitest-ext.ts
  • tests/e2e/orm/client-api/upsert.test.ts
  • packages/server/tsup.config.ts
  • tests/e2e/orm/client-api/delete.test.ts
  • packages/orm/src/client/crud/validator/index.ts
  • tests/e2e/orm/client-api/update-many.test.ts
  • packages/server/test/api/rpc.test.ts
  • packages/config/typescript-config/package.json
  • tests/e2e/orm/client-api/delete-many.test.ts
  • tests/e2e/orm/client-api/create-many.test.ts
  • packages/plugins/policy/package.json
  • packages/testtools/src/project.ts
  • packages/server/src/adapter/hono/index.ts
  • packages/sdk/package.json
  • packages/tanstack-query/package.json
  • samples/blog/zenstack/models.ts
  • packages/plugins/policy/src/policy-handler.ts
  • tests/e2e/orm/client-api/raw-query.test.ts
  • samples/blog/main.ts
  • packages/server/src/adapter/next/pages-route-handler.ts
  • packages/plugins/policy/src/expression-transformer.ts
  • packages/tanstack-query/src/react.ts
  • packages/plugins/policy/src/plugin.ts
  • packages/common-helpers/src/clone.ts
  • samples/blog/package.json
  • tests/e2e/orm/client-api/utils.ts
  • tests/e2e/orm/client-api/undefined-values.test.ts
  • packages/plugins/policy/src/column-collector.ts
  • packages/server/src/adapter/tanstack-start/index.ts
  • packages/server/src/adapter/hono/handler.ts
  • tests/e2e/orm/client-api/filter.test.ts
  • tests/e2e/orm/client-api/count.test.ts
  • packages/sdk/src/ts-schema-generator.ts
  • packages/server/test/adapter/next.test.ts
  • packages/cli/test/ts-schema-gen.test.ts
  • packages/zod/package.json
  • packages/server/src/adapter/nuxt/index.ts
  • packages/plugins/policy/src/types.ts
  • samples/blog/README.md
  • packages/server/src/types.ts
  • tests/e2e/orm/client-api/update.test.ts
  • packages/testtools/package.json
  • packages/server/src/adapter/next/index.ts
  • packages/create-zenstack/package.json
  • packages/zod/src/types.ts
  • packages/orm/src/client/crud/dialects/postgresql.ts
  • packages/orm/package.json
  • tests/e2e/orm/client-api/delegate.test.ts
  • packages/config/eslint-config/package.json
  • packages/orm/src/client/crud/operations/base.ts
  • packages/server/src/api/rpc/index.ts
  • packages/server/src/adapter/elysia/handler.ts
  • packages/server/src/adapter/next/app-route-handler.ts
  • tests/e2e/orm/client-api/aggregate.test.ts
  • packages/plugins/policy/src/expression-evaluator.ts
  • packages/server/test/adapter/fastify.test.ts
  • packages/server/src/adapter/nuxt/handler.ts
  • packages/server/src/adapter/common.ts
  • tests/e2e/orm/client-api/default-values.test.ts
  • packages/zod/src/index.ts
  • packages/server/test/adapter/elysia.test.ts
  • packages/cli/src/actions/generate.ts
  • packages/server/test/adapter/hono.test.ts
  • tests/e2e/orm/client-api/name-mapping.test.ts
  • packages/server/src/adapter/express/middleware.ts
  • packages/server/src/adapter/sveltekit/index.ts
  • packages/common-helpers/src/index.ts
  • packages/config/vitest-config/package.json
  • packages/server/test/adapter/express.test.ts
  • packages/server/package.json
  • tests/e2e/orm/client-api/computed-fields.test.ts
  • packages/server/src/adapter/fastify/index.ts
  • tests/e2e/orm/plugin-infra/entity-mutation-hooks.test.ts
  • tests/e2e/orm/client-api/group-by.test.ts
  • tests/e2e/orm/client-api/create.test.ts
  • packages/dialects/sql.js/package.json
  • packages/testtools/src/client.ts
  • packages/plugins/policy/src/utils.ts
  • packages/server/test/adapter/sveltekit.test.ts
  • tests/e2e/orm/client-api/find.test.ts
  • tests/e2e/orm/client-api/transaction.test.ts
  • samples/blog/zenstack/schema.ts
  • packages/common-helpers/package.json
  • packages/server/src/adapter/elysia/index.ts
  • packages/server/src/api/rest/index.ts
  • packages/server/src/api/index.ts
  • packages/server/src/adapter/tanstack-start/handler.ts
  • packages/server/src/adapter/express/index.ts
  • packages/plugins/policy/src/functions.ts
  • packages/server/test/adapter/tanstack-start.test.ts
  • samples/blog/zenstack/input.ts
  • packages/server/src/adapter/fastify/plugin.ts
  • packages/cli/src/actions/init.ts
  • packages/create-zenstack/src/index.ts
  • packages/cli/package.json
  • packages/orm/src/client/crud/dialects/base-dialect.ts
  • packages/server/src/adapter/sveltekit/handler.ts
  • packages/server/src/api/utils.ts
  • packages/cli/src/actions/templates.ts
tests/e2e/**

📄 CodeRabbit inference engine (CLAUDE.md)

End-to-end tests must live under tests/e2e/

Files:

  • tests/e2e/orm/client-api/create-many-and-return.test.ts
  • tests/e2e/orm/client-api/upsert.test.ts
  • tests/e2e/orm/client-api/delete.test.ts
  • tests/e2e/orm/client-api/update-many.test.ts
  • tests/e2e/orm/client-api/delete-many.test.ts
  • tests/e2e/orm/client-api/create-many.test.ts
  • tests/e2e/orm/client-api/raw-query.test.ts
  • tests/e2e/orm/client-api/utils.ts
  • tests/e2e/orm/client-api/undefined-values.test.ts
  • tests/e2e/orm/client-api/filter.test.ts
  • tests/e2e/orm/client-api/count.test.ts
  • tests/e2e/orm/client-api/update.test.ts
  • tests/e2e/orm/client-api/delegate.test.ts
  • tests/e2e/orm/client-api/aggregate.test.ts
  • tests/e2e/orm/client-api/default-values.test.ts
  • tests/e2e/orm/client-api/name-mapping.test.ts
  • tests/e2e/orm/client-api/computed-fields.test.ts
  • tests/e2e/orm/plugin-infra/entity-mutation-hooks.test.ts
  • tests/e2e/orm/client-api/group-by.test.ts
  • tests/e2e/orm/client-api/create.test.ts
  • tests/e2e/orm/client-api/find.test.ts
  • tests/e2e/orm/client-api/transaction.test.ts
package.json

📄 CodeRabbit inference engine (CLAUDE.md)

Pin the repository package manager to pnpm@10.12.1 via the packageManager field

Files:

  • package.json
**/schema.ts

📄 CodeRabbit inference engine (CLAUDE.md)

The generated TypeScript schema should be named schema.ts

Files:

  • samples/blog/zenstack/schema.ts
🧠 Learnings (9)
📚 Learning: 2025-09-04T12:38:14.150Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-09-04T12:38:14.150Z
Learning: Database migrations use Prisma CLI under the hood

Applied to files:

  • packages/cli/src/actions/migrate.ts
  • README.md
📚 Learning: 2025-09-04T12:38:14.150Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-09-04T12:38:14.150Z
Learning: Applies to **/schema.zmodel : Name ZModel schema files `schema.zmodel`

Applied to files:

  • packages/language/package.json
  • packages/orm/src/client/crud/validator/index.ts
  • packages/zod/src/types.ts
  • packages/zod/src/index.ts
📚 Learning: 2025-10-21T16:09:31.218Z
Learnt from: ymc9
Repo: zenstackhq/zenstack-v3 PR: 319
File: packages/runtime/src/client/executor/zenstack-query-executor.ts:63-72
Timestamp: 2025-10-21T16:09:31.218Z
Learning: In ZenStack, TypeDefs can be inherited by models. When a TypeDef contains fields with `map` attributes, those mapped field names need to be processed by the QueryNameMapper since they become part of the inheriting model's schema. Therefore, when checking if a schema has mapped names (e.g., in `schemaHasMappedNames`), both `schema.models` and `schema.typeDefs` must be inspected for `@map` and `map` attributes.

Applied to files:

  • packages/orm/src/client/crud/validator/index.ts
  • samples/blog/zenstack/models.ts
  • packages/plugins/policy/src/policy-handler.ts
  • packages/tanstack-query/src/react.ts
  • packages/zod/src/types.ts
  • packages/zod/src/index.ts
  • samples/blog/zenstack/schema.ts
📚 Learning: 2025-09-04T12:38:14.150Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-09-04T12:38:14.150Z
Learning: Always run `zenstack generate` after modifying ZModel schemas

Applied to files:

  • README.md
  • samples/blog/zenstack/models.ts
  • packages/sdk/src/ts-schema-generator.ts
  • packages/cli/src/actions/generate.ts
📚 Learning: 2025-09-04T12:38:14.150Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-09-04T12:38:14.150Z
Learning: Applies to **/schema.ts : The generated TypeScript schema should be named `schema.ts`

Applied to files:

  • packages/sdk/src/ts-schema-generator.ts
  • packages/cli/test/ts-schema-gen.test.ts
  • packages/zod/src/types.ts
  • packages/zod/src/index.ts
  • samples/blog/zenstack/schema.ts
📚 Learning: 2025-09-04T12:38:14.150Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-09-04T12:38:14.150Z
Learning: Applies to tests/e2e/** : End-to-end tests must live under `tests/e2e/`

Applied to files:

  • CLAUDE.md
📚 Learning: 2025-09-04T12:38:14.150Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-09-04T12:38:14.150Z
Learning: Applies to package.json : Pin the repository package manager to `pnpm10.12.1` via the `packageManager` field

Applied to files:

  • package.json
📚 Learning: 2025-09-04T12:38:14.150Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-09-04T12:38:14.150Z
Learning: Applies to pnpm-workspace.yaml : Use pnpm workspaces for the monorepo

Applied to files:

  • packages/cli/package.json
📚 Learning: 2025-10-21T16:04:56.292Z
Learnt from: ymc9
Repo: zenstackhq/zenstack-v3 PR: 319
File: packages/runtime/src/client/crud/dialects/base-dialect.ts:745-747
Timestamp: 2025-10-21T16:04:56.292Z
Learning: In packages/runtime/src/client/crud/dialects/base-dialect.ts, it's intentional that buildCursorFilter applies default ordering (via makeDefaultOrderBy fallback) while buildOrderBy does not. This ensures cursor-based pagination always has stable ordering for correctness, while regular queries remain unordered unless explicitly specified. This design is to be consistent with Prisma's pagination requirements.

Applied to files:

  • packages/orm/src/client/crud/dialects/base-dialect.ts
🧬 Code graph analysis (24)
packages/server/src/adapter/next/pages-route-handler.ts (4)
packages/server/src/adapter/next/app-route-handler.ts (1)
  • factory (14-66)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/adapter/next/index.ts (1)
  • PageRouteRequestHandlerOptions (12-22)
packages/server/src/adapter/common.ts (1)
  • logInternalError (15-21)
packages/server/src/adapter/tanstack-start/index.ts (3)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/adapter/common.ts (1)
  • CommonAdapterOptions (8-13)
packages/orm/src/client/contract.ts (1)
  • ClientContract (50-170)
packages/server/src/adapter/hono/handler.ts (3)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/adapter/common.ts (2)
  • CommonAdapterOptions (8-13)
  • logInternalError (15-21)
packages/orm/src/client/contract.ts (1)
  • ClientContract (50-170)
packages/server/test/adapter/next.test.ts (4)
packages/server/src/adapter/next/index.ts (2)
  • PageRouteRequestHandlerOptions (12-22)
  • NextRequestHandler (48-56)
packages/testtools/src/client.ts (2)
  • createTestClient (52-169)
  • createPolicyTestClient (179-190)
packages/server/src/api/rpc/index.ts (1)
  • RPCApiHandler (34-259)
packages/server/src/api/rest/index.ts (1)
  • RestApiHandler (125-2079)
packages/server/src/adapter/next/index.ts (3)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/adapter/common.ts (1)
  • CommonAdapterOptions (8-13)
packages/orm/src/client/contract.ts (1)
  • ClientContract (50-170)
packages/server/src/api/rpc/index.ts (4)
packages/server/src/types.ts (1)
  • LogConfig (17-17)
packages/server/src/api/rest/index.ts (1)
  • log (288-290)
packages/server/src/api/utils.ts (1)
  • log (9-27)
packages/common-helpers/src/safe-json-stringify.ts (1)
  • safeJSONStringify (4-12)
packages/server/src/adapter/elysia/handler.ts (3)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/adapter/common.ts (2)
  • CommonAdapterOptions (8-13)
  • logInternalError (15-21)
packages/orm/src/client/contract.ts (1)
  • ClientContract (50-170)
packages/server/src/adapter/next/app-route-handler.ts (4)
packages/server/src/adapter/next/pages-route-handler.ts (1)
  • factory (12-42)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/adapter/next/index.ts (1)
  • AppRouteRequestHandlerOptions (27-37)
packages/server/src/adapter/common.ts (1)
  • logInternalError (15-21)
packages/server/test/adapter/fastify.test.ts (2)
packages/testtools/src/client.ts (1)
  • createTestClient (52-169)
packages/server/test/utils.ts (1)
  • makeUrl (31-33)
packages/server/src/adapter/nuxt/handler.ts (3)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/adapter/common.ts (2)
  • CommonAdapterOptions (8-13)
  • logInternalError (15-21)
packages/orm/src/client/contract.ts (1)
  • ClientContract (50-170)
packages/server/src/adapter/common.ts (2)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/types.ts (2)
  • ApiHandler (67-82)
  • LogConfig (17-17)
packages/server/test/adapter/elysia.test.ts (6)
packages/testtools/src/client.ts (1)
  • createTestClient (52-169)
packages/server/src/api/rest/index.ts (1)
  • schema (284-286)
packages/server/src/api/rpc/index.ts (1)
  • schema (37-39)
packages/server/src/adapter/elysia/handler.ts (1)
  • createElysiaHandler (25-77)
packages/server/test/utils.ts (1)
  • makeUrl (31-33)
packages/server/src/types.ts (1)
  • Response (52-62)
packages/server/test/adapter/hono.test.ts (4)
packages/testtools/src/client.ts (1)
  • createTestClient (52-169)
packages/server/src/adapter/hono/handler.ts (1)
  • createHonoHandler (17-55)
packages/server/test/utils.ts (1)
  • makeUrl (31-33)
packages/server/src/types.ts (1)
  • Response (52-62)
packages/server/src/adapter/express/middleware.ts (4)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/adapter/common.ts (2)
  • CommonAdapterOptions (8-13)
  • logInternalError (15-21)
packages/server/src/adapter/next/app-route-handler.ts (1)
  • factory (14-66)
packages/server/src/adapter/next/pages-route-handler.ts (1)
  • factory (12-42)
packages/server/test/adapter/express.test.ts (3)
packages/testtools/src/client.ts (1)
  • createPolicyTestClient (179-190)
packages/server/src/api/rest/index.ts (2)
  • schema (284-286)
  • RestApiHandler (125-2079)
packages/server/test/utils.ts (2)
  • schema (3-29)
  • makeUrl (31-33)
packages/server/test/adapter/sveltekit.test.ts (2)
packages/testtools/src/client.ts (1)
  • createTestClient (52-169)
packages/server/test/utils.ts (1)
  • makeUrl (31-33)
packages/server/src/api/rest/index.ts (9)
packages/sdk/src/schema/schema.ts (3)
  • SchemaDef (10-18)
  • FieldDef (60-75)
  • ModelDef (20-37)
packages/server/src/types.ts (4)
  • LogConfig (17-17)
  • ApiHandler (67-82)
  • RequestContext (22-47)
  • Response (52-62)
packages/server/src/api/utils.ts (3)
  • registerCustomSerializers (32-53)
  • getZodErrorMessage (58-64)
  • log (9-27)
packages/common-helpers/src/lower-case-first.ts (1)
  • lowerCaseFirst (1-3)
packages/orm/src/client/errors.ts (5)
  • ZenStackError (4-4)
  • InputValidationError (9-17)
  • RejectedByPolicyError (68-76)
  • NotFoundError (36-43)
  • QueryError (22-26)
packages/orm/src/client/contract.ts (1)
  • ClientContract (50-170)
packages/common-helpers/src/enumerable.ts (1)
  • enumerate (9-17)
packages/common-helpers/src/clone.ts (1)
  • clone (6-24)
packages/common-helpers/src/param-case.ts (1)
  • paramCase (5-22)
packages/server/src/adapter/tanstack-start/handler.ts (4)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/adapter/tanstack-start/index.ts (1)
  • TanStackStartOptions (9-17)
packages/server/src/types.ts (1)
  • Response (52-62)
packages/server/src/adapter/common.ts (1)
  • logInternalError (15-21)
packages/server/test/adapter/tanstack-start.test.ts (3)
packages/server/src/adapter/tanstack-start/index.ts (2)
  • TanStackStartOptions (9-17)
  • TanStackStartHandler (23-27)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/testtools/src/client.ts (2)
  • createTestClient (52-169)
  • createPolicyTestClient (179-190)
packages/server/src/adapter/fastify/plugin.ts (3)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/adapter/common.ts (2)
  • CommonAdapterOptions (8-13)
  • logInternalError (15-21)
packages/orm/src/client/contract.ts (1)
  • ClientContract (50-170)
packages/orm/src/client/crud/dialects/base-dialect.ts (2)
packages/common-helpers/src/enumerable.ts (1)
  • enumerate (9-17)
packages/orm/src/client/query-utils.ts (1)
  • buildJoinPairs (193-211)
packages/server/src/adapter/sveltekit/handler.ts (4)
packages/sdk/src/schema/schema.ts (1)
  • SchemaDef (10-18)
packages/server/src/adapter/common.ts (2)
  • CommonAdapterOptions (8-13)
  • logInternalError (15-21)
packages/orm/src/client/contract.ts (1)
  • ClientContract (50-170)
packages/server/src/types.ts (1)
  • Response (52-62)
packages/server/src/api/utils.ts (1)
packages/orm/src/client/executor/zenstack-driver.ts (1)
  • error (172-179)
packages/cli/src/actions/templates.ts (1)
packages/create-zenstack/src/templates.ts (1)
  • STARTER_MAIN_TS (29-58)
🪛 GitHub Check: CodeQL
packages/server/test/adapter/express.test.ts

[failure] 103-106: Missing rate limiting
This route handler performs authorization, but is not rate-limited.


[failure] 158-162: Missing rate limiting
This route handler performs authorization, but is not rate-limited.

packages/server/src/adapter/fastify/plugin.ts

[failure] 31-53: Missing rate limiting
This route handler performs authorization, but is not rate-limited.

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
  • GitHub Check: Upload results
  • GitHub Check: GitGuardian Security Checks
  • GitHub Check: build-test (20.x, sqlite)
  • GitHub Check: build-test (20.x, postgresql)
  • GitHub Check: claude-review

* chore: several server adapter improvements

* update
@claude
Copy link

claude bot commented Oct 31, 2025

Claude finished @ymc9's task —— View job


Code Review for ZenStack v3.0.0-beta.14

Completed comprehensive review of this substantial PR that merges dev to main for v3.0.0-beta.14 (18,563 additions, 3,736 deletions across 100 files).

Review Checklist

  • Analyze overall architecture and package restructuring changes
  • Review new server adapter implementations (Elysia, Hono, SvelteKit, TanStack Start, Nuxt)
  • Examine ORM core changes and potential breaking changes
  • Check security implications of new server integrations
  • Assess performance considerations
  • Review test coverage for new functionality
  • Analyze breaking changes documentation
  • Evaluate code quality and best practices

Review Summary

This is a well-structured release with significant new functionality. The code quality is high, following TypeScript best practices and maintaining consistency across the codebase.

✅ Strengths

Architecture & Design

  • Consistent server adapter pattern: All new adapters follow a common interface via CommonAdapterOptions, promoting maintainability
  • Strong separation of concerns: Clear division between API handlers, adapters, and core ORM functionality
  • Comprehensive TypeScript support: Excellent type safety throughout with proper generic constraints

New Server Adapters

  • Wide framework coverage: New support for Elysia, Hono, SvelteKit, TanStack Start, and Nuxt
  • Proper error handling: Consistent error handling across all adapters with standardized internal error logging
  • Flexible configuration: Optional peer dependencies properly configured to avoid bloat

ORM Enhancements

  • Improved policy handling: Enhanced post-update policy validation with before/after state comparison
  • Better SQL dialect support: Enhanced base dialect with improved query building and filtering
  • Performance optimizations: Smart query optimization in policy handler with constant policy evaluation

Package Management

  • Clean dependency management: Proper workspace dependencies and optional peer dependencies
  • Export structure: Well-organized package exports supporting both CJS and ESM

⚠️ Areas for Attention

Security Considerations

  1. Input validation in server adapters (packages/server/src/adapter/*/handler.ts):

    • Path traversal protection via basePath handling is good
    • Consider adding rate limiting guidance in documentation
    • URL parameter parsing is handled securely
  2. Policy enforcement (packages/plugins/policy/src/policy-handler.ts:76-84):

    • Non-CRUD queries are properly rejected
    • Policy bypass protection is robust

Performance Concerns

  1. Complex policy evaluation (packages/plugins/policy/src/policy-handler.ts:242-264):

    • Before-update entity loading could be expensive for large datasets
    • Consider documenting performance implications of post-update policies
  2. Query optimization (packages/orm/src/client/crud/dialects/base-dialect.ts:102-105):

    • Cursor-based pagination implementation looks efficient
    • Complex filter building might benefit from query plan analysis

Code Quality Issues

  1. Magic strings (packages/server/src/adapter/express/middleware.ts:48-50):

    const url = request.protocol + '://' + request.get('host') + request.originalUrl;

    Consider using URL constructor consistently

  2. Error handling consistency (packages/server/src/adapter/elysia/handler.ts:66-72):

    • Good error boundary implementation
    • Consider standardizing error response formats across adapters

Breaking Changes

The documented breaking changes in BREAKINGCHANGES.md are well-documented:

  • Policy rejection behavior changes
  • Removal of deprecated APIs (check(), @omit, @password)
  • Relation filtering behavior changes

🔍 Test Coverage Assessment

Positive Coverage

  • Server adapters: Comprehensive integration tests for Express, including both RPC and REST handlers
  • Multiple scenarios: Tests cover CRUD operations, filtering, aggregation, and error cases
  • Real-world usage: E2E tests validate compatibility with actual projects

Gaps to Consider

  • Error boundary testing: While adapters handle errors well, more edge case testing would be beneficial
  • Performance testing: Large dataset scenarios for policy evaluation
  • Concurrent request handling: Multi-user scenarios for server adapters

📝 Recommendations

Immediate Actions

  1. Documentation: Update migration guide for breaking changes
  2. Performance monitoring: Add metrics for policy evaluation performance
  3. Security review: Consider security audit for new server integrations

Future Considerations

  1. Caching layer: Consider query result caching for policy evaluations
  2. Monitoring: Add structured logging for production debugging
  3. Rate limiting: Built-in rate limiting for server adapters

🎯 Overall Assessment

APPROVED - This is a high-quality release that significantly expands ZenStack's server integration capabilities while maintaining code quality and security standards. The architecture is sound, the implementation is thorough, and the breaking changes are well-documented.

The new server adapters follow consistent patterns and provide excellent developer experience. The ORM improvements enhance both functionality and performance. Test coverage is comprehensive for the new features.

The codebase demonstrates excellent TypeScript practices, proper error handling, and security-conscious design. This release represents a significant step forward for the ZenStack ecosystem.


* chore: require zod4 or above

* update

* update
@claude
Copy link

claude bot commented Oct 31, 2025

Claude finished @ymc9's task —— View job


Code Review for ZenStack v3.0.0-beta.14

Completed comprehensive review of this substantial PR that merges dev to main for v3.0.0-beta.14 (18,563 additions, 3,736 deletions across 100 files).

Review Checklist

  • Analyze overall architecture and package restructuring changes
  • Review new server adapter implementations (Elysia, Hono, SvelteKit, TanStack Start, Nuxt)
  • Examine ORM core changes and potential breaking changes
  • Check security implications of new server integrations
  • Assess performance considerations
  • Review test coverage for new functionality
  • Analyze breaking changes documentation
  • Evaluate code quality and best practices

Review Summary

This is a well-structured release with significant new functionality. The code quality is high, following TypeScript best practices and maintaining consistency across the codebase.

✅ Strengths

Architecture & Design

  • Consistent server adapter pattern: All new adapters follow a common interface via CommonAdapterOptions, promoting maintainability
  • Strong separation of concerns: Clear division between API handlers, adapters, and core ORM functionality
  • Comprehensive TypeScript support: Excellent type safety throughout with proper generic constraints

New Server Adapters

  • Wide framework coverage: New support for Elysia, Hono, SvelteKit, TanStack Start, and Nuxt
  • Proper error handling: Consistent error handling across all adapters with standardized internal error logging
  • Flexible configuration: Optional peer dependencies properly configured to avoid bloat

ORM Enhancements

  • Improved policy handling: Enhanced post-update policy validation with before/after state comparison
  • Better SQL dialect support: Enhanced base dialect with improved query building and filtering
  • Performance optimizations: Smart query optimization in policy handler with constant policy evaluation

Package Management

  • Clean dependency management: Proper workspace dependencies and optional peer dependencies
  • Export structure: Well-organized package exports supporting both CJS and ESM

⚠️ Areas for Attention

Security Considerations

  1. Input validation in server adapters (packages/server/src/adapter/*/handler.ts):

    • Path traversal protection via basePath handling is good
    • Consider adding rate limiting guidance in documentation
    • URL parameter parsing is handled securely
  2. Policy enforcement (packages/plugins/policy/src/policy-handler.ts:76-84):

    • Non-CRUD queries are properly rejected
    • Policy bypass protection is robust

Performance Concerns

  1. Complex policy evaluation (packages/plugins/policy/src/policy-handler.ts:242-264):

    • Before-update entity loading could be expensive for large datasets
    • Consider documenting performance implications of post-update policies
  2. Query optimization (packages/orm/src/client/crud/dialects/base-dialect.ts:102-105):

    • Cursor-based pagination implementation looks efficient
    • Complex filter building might benefit from query plan analysis

Code Quality Issues

  1. Magic strings (packages/server/src/adapter/express/middleware.ts:48-50):

    const url = request.protocol + '://' + request.get('host') + request.originalUrl;

    Consider using URL constructor consistently

  2. Error handling consistency (packages/server/src/adapter/elysia/handler.ts:66-72):

    • Good error boundary implementation
    • Consider standardizing error response formats across adapters

Breaking Changes

The documented breaking changes in BREAKINGCHANGES.md are well-documented:

  • Policy rejection behavior changes
  • Removal of deprecated APIs (check(), @omit, @password)
  • Relation filtering behavior changes

🔍 Test Coverage Assessment

Positive Coverage

  • Server adapters: Comprehensive integration tests for Express, including both RPC and REST handlers
  • Multiple scenarios: Tests cover CRUD operations, filtering, aggregation, and error cases
  • Real-world usage: E2E tests validate compatibility with actual projects

Gaps to Consider

  • Error boundary testing: While adapters handle errors well, more edge case testing would be beneficial
  • Performance testing: Large dataset scenarios for policy evaluation
  • Concurrent request handling: Multi-user scenarios for server adapters

📝 Recommendations

Immediate Actions

  1. Documentation: Update migration guide for breaking changes
  2. Performance monitoring: Add metrics for policy evaluation performance
  3. Security review: Consider security audit for new server integrations

Future Considerations

  1. Caching layer: Consider query result caching for policy evaluations
  2. Monitoring: Add structured logging for production debugging
  3. Rate limiting: Built-in rate limiting for server adapters

🎯 Overall Assessment

APPROVED - This is a high-quality release that significantly expands ZenStack's server integration capabilities while maintaining code quality and security standards. The architecture is sound, the implementation is thorough, and the breaking changes are well-documented.

The new server adapters follow consistent patterns and provide excellent developer experience. The ORM improvements enhance both functionality and performance. Test coverage is comprehensive for the new features.

The codebase demonstrates excellent TypeScript practices, proper error handling, and security-conscious design. This release represents a significant step forward for the ZenStack ecosystem.


@ymc9 ymc9 added this pull request to the merge queue Oct 31, 2025
Merged via the queue into main with commit 7706cc3 Oct 31, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants