fix(migrate,runtime,tanstack): six bugs found by a downstream D1/uuid adopter

All six reported against 0.15.20 and confirmed on main; failing tests written
first for each. Three turned out worse than reported.

migrate-ts — data integrity (the dangerous ones):

1. uuid-identity PK's synthesized DEFAULT was diffed as an ordinary default, so
   EVERY uuid-PK table drifted on EVERY run with zero metadata changes. The
   emitter synthesizes the DEFAULT at DDL time (sqlite/d1
   `lower(hex(randomblob(16)))`; postgres `gen_random_uuid()`) and expected-schema
   deliberately never records it (uuid generation is modeled as `identity`), but
   introspection reads it back as a real expr default — so the two always
   disagreed. On SQLite/D1 that false positive is DESTRUCTIVE, not just noisy:
   with no ALTER COLUMN, the recreate-and-copy path rebuilt the whole table
   (CREATE __new_x / INSERT SELECT / DROP / RENAME) for every already-migrated
   uuid-PK table, on every incremental migrate. NOT SQLITE-ONLY as reported:
   postgres emits a bogus ALTER every run too — the guard is dialect-agnostic.

2. D1 introspection didn't exclude Cloudflare/wrangler infrastructure tables.
   `_cf_METADATA` appears the moment any write touches a local D1, and D1's
   authorizer then denies even pragma_table_info against it (SQLITE_AUTH) — since
   readTableInfo runs per enumerated table, this ABORTED every second-and-later
   `meta migrate --dialect d1` (invisible until the first incremental run, because
   the first migration is the write that creates it). `d1_migrations` is
   queryable, so it merely read as an undeclared "extra" table — and the diff
   proposed DROP TABLE on wrangler's own bookkeeping. Filter in the query, so
   `_cf_METADATA` is never even fetched.

3. SQLite quoted every literal default regardless of column type, so
   `field.boolean @default false` emitted `DEFAULT 'false'` on a NUMERIC-affinity
   column. SQLite cannot coerce that, stores TEXT, and `col = 0` then silently
   misses the row (verified against real sqlite3). Numeric defaults hit the same
   path but were merely invisible — affinity coerces a numeric-looking '0', which
   is exactly why this sat unnoticed. Defaults are now rendered per the column's
   SQL type (boolean -> unquoted 1/0; numerics unquoted; text still quoted and
   escaped; non-numeric junk on a numeric column falls back to quoting).
   An existing golden had PINNED the buggy shape; updated with the reason, after
   proving the new output correct in real SQLite. Postgres is left as-is
   deliberately: it casts a quoted literal at DDL-parse time, so it is not
   producing wrong data, and churning its DDL output would be risk for no gain.

runtime-ts — a server-side runtime bug:

4. The read-only (projection) mounts coerced the GET-by-id path param through
   `Number(id)` unconditionally, so any uuid/text PK 404'd for every id that
   actually exists — the row is right there in the same projection's list
   response, but its own detail route can never find it (with libsql it throws
   outright). AFFECTED BOTH MOUNTS, hono and drizzle-fastify, not just hono.
   Root cause is tidy: runtime-ts already has `parseId`, used by every WRITABLE
   mount; only the read-only ones bypassed it. Added a column-aware
   `coerceIdForColumn` (reads the PK's real `dataType` off the Drizzle column, so
   existing generated code is fixed with no regen and no option change) plus
   `rawIdLiteral` for the raw-SQL view path, which previously 400'd a perfectly
   valid uuid.

codegen-ts-tanstack — wrong generated types:

5. The hooks template hardcoded `id: number` at every emission site, so a uuid PK
   generated hooks typing the key as a number while the row's real id is a string
   — a genuine tsc error at every consumer call site. `getPkInfo(entity, ctx)`
   already existed and is used correctly by the queries template; the hooks
   template just never called it. Threaded through all three render paths
   (read-only, writable, TPH) — more sites than reported, including the bare
   `number` delete-mutation variable types.

6. The grid-hook template's `sorting[0].id` failed `noUncheckedIndexedAccess`
   (a `.length > 0` guard doesn't narrow an index access). Fixed with real
   narrowing rather than a non-null assertion; goldens regenerated after
   confirming the diff is exactly that and semantically identical.

Full suite 5056 pass / 0 fail; typecheck clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hd5NWZ1rKau63vJzrBSpLb

Author: dmealing

server/typescript/packages/codegen-ts-tanstack/src/templates/grid-hook-file.ts

@@ -110,8 +110,9 @@ export function ${hookName}() {
     for (const f of columnFilters) {
       filterObj[f.id] = f.value as unknown;
     }
-    const sort = sorting.length > 0
-      ? \`\${sorting[0].id}:\${sorting[0].desc ? "desc" : "asc"}\`
+    const sortEntry = sorting[0];
+    const sort = sortEntry
+      ? \`\${sortEntry.id}:\${sortEntry.desc ? "desc" : "asc"}\`
       : undefined;
     return ${buildFilterQsSym}({
       ...filterObj,

server/typescript/packages/codegen-ts-tanstack/src/templates/hooks-file.ts

@@ -8,6 +8,7 @@ import {
   entityModuleSpecifier,
   isTphDiscriminatorBase,
   tphPlan,
+  getPkInfo,
 } from "@metaobjectsdev/codegen-ts";
 
 /**
@@ -150,6 +151,9 @@ function capitalize(s: string): string {
 
 function renderReadOnlyHooksFile(entity: MetaObject, entityModule: string, ctx: RenderContext): string {
   const entityName = entity.name;
+  // The id parameter must follow the entity's DECLARED primary-key type — a uuid/string
+  // PK typed as `number` is simply wrong for the data (and a tsc error at every call site).
+  const pkType = getPkInfo(entity, ctx).tsType;
   const entityNamePlural = pluralize(entityName);
   const lcEntity = entityName.charAt(0).toLowerCase() + entityName.slice(1);
   const keysVar = `${lcEntity}Keys`;
@@ -176,13 +180,13 @@ export const ${keysVar} = {
   lists:   () => [...${keysVar}.all(), "list"] as const,
   list:    (filter?: ${entityName}Filter) => [...${keysVar}.lists(), filter ?? {}] as const,
   details: () => [...${keysVar}.all(), "detail"] as const,
-  detail:  (id: number) => [...${keysVar}.details(), id] as const,${relationKeyLine}
+  detail:  (id: ${pkType}) => [...${keysVar}.details(), id] as const,${relationKeyLine}
 };
 `;
 
   const queries: Code = code`
 export function use${entityName}(
-  id: number,
+  id: ${pkType},
   opts?: Omit<${useQueryOptionsSym}<${entityName}Row>, "queryKey" | "queryFn">,
 ): ${useQueryResultSym}<${entityName}Row> {
   const fetcher = ${useEntityFetcherSym}();
@@ -222,6 +226,9 @@ export function use${entityNamePlural}(
 
 function renderFullHooksFile(entity: MetaObject, entityModule: string, ctx: RenderContext): string {
   const entityName = entity.name;
+  // The id parameter must follow the entity's DECLARED primary-key type — a uuid/string
+  // PK typed as `number` is simply wrong for the data (and a tsc error at every call site).
+  const pkType = getPkInfo(entity, ctx).tsType;
   const entityNamePlural = pluralize(entityName);
   const lcEntity = entityName.charAt(0).toLowerCase() + entityName.slice(1);
   const keysVar = `${lcEntity}Keys`;
@@ -254,13 +261,13 @@ export const ${keysVar} = {
   lists:   () => [...${keysVar}.all(), "list"] as const,
   list:    (filter?: ${entityName}Filter) => [...${keysVar}.lists(), filter ?? {}] as const,
   details: () => [...${keysVar}.all(), "detail"] as const,
-  detail:  (id: number) => [...${keysVar}.details(), id] as const,${relationKeyLine}
+  detail:  (id: ${pkType}) => [...${keysVar}.details(), id] as const,${relationKeyLine}
 };
 `;
 
   const queries: Code = code`
 export function use${entityName}(
-  id: number,
+  id: ${pkType},
   opts?: Omit<${useQueryOptionsSym}<${entityName}Row>, "queryKey" | "queryFn">,
 ): ${useQueryResultSym}<${entityName}Row> {
   const fetcher = ${useEntityFetcherSym}();
@@ -308,8 +315,8 @@ export function useCreate${entityName}(
 }
 
 export function useUpdate${entityName}(
-  opts?: Omit<${useMutationOptionsSym}<${entityName}Row, Error, { id: number; input: ${entityName}Update }>, "mutationFn">,
-): ${useMutationResultSym}<${entityName}Row, Error, { id: number; input: ${entityName}Update }> {
+  opts?: Omit<${useMutationOptionsSym}<${entityName}Row, Error, { id: ${pkType}; input: ${entityName}Update }>, "mutationFn">,
+): ${useMutationResultSym}<${entityName}Row, Error, { id: ${pkType}; input: ${entityName}Update }> {
   const fetcher = ${useEntityFetcherSym}();
   const qc = ${useQueryClientSym}();
   return ${useMutationSym}({
@@ -327,8 +334,8 @@ export function useUpdate${entityName}(
 }
 
 export function useDelete${entityName}(
-  opts?: Omit<${useMutationOptionsSym}<void, Error, number>, "mutationFn">,
-): ${useMutationResultSym}<void, Error, number> {
+  opts?: Omit<${useMutationOptionsSym}<void, Error, ${pkType}>, "mutationFn">,
+): ${useMutationResultSym}<void, Error, ${pkType}> {
   const fetcher = ${useEntityFetcherSym}();
   const qc = ${useQueryClientSym}();
   return ${useMutationSym}({
@@ -359,6 +366,9 @@ export function useDelete${entityName}(
 
 function renderTphHooksFile(base: MetaObject, ctx: RenderContext, baseModule: string): string {
   const baseName = base.name;
+  // The id parameter must follow the entity's DECLARED primary-key type — a uuid/string
+  // PK typed as `number` is simply wrong for the data (and a tsc error at every call site).
+  const pkType = getPkInfo(base, ctx).tsType;
   const lcBase = baseName.charAt(0).toLowerCase() + baseName.slice(1);
   const keysVar = `${lcBase}Keys`;
   // Single source of truth for discriminator field + subtypes + route segments.
@@ -399,20 +409,20 @@ export const ${keysVar} = {
   lists:         () => [...${keysVar}.all(), "list"] as const,
   list:          (filter?: ${baseName}Filter) => [...${keysVar}.lists(), filter ?? {}] as const,
   details:       () => [...${keysVar}.all(), "detail"] as const,
-  detail:        (id: number) => [...${keysVar}.details(), id] as const,
+  detail:        (id: ${pkType}) => [...${keysVar}.details(), id] as const,
   subtypeLists:  (sub: string) => [...${keysVar}.all(), sub, "list"] as const,
   // filter is loosely typed here (cache-key identity only); the per-subtype
   // hooks below type it precisely as <Sub>Filter.
   subtypeList:   (sub: string, filter?: unknown) => [...${keysVar}.subtypeLists(sub), filter ?? {}] as const,
   subtypeDetails:(sub: string) => [...${keysVar}.all(), sub, "detail"] as const,
-  subtypeDetail: (sub: string, id: number) => [...${keysVar}.subtypeDetails(sub), id] as const,
+  subtypeDetail: (sub: string, id: ${pkType}) => [...${keysVar}.subtypeDetails(sub), id] as const,
 };
 `;
 
   // Polymorphic reads — return the discriminated union.
   const polymorphic: Code = code`
 export function use${baseName}(
-  id: number,
+  id: ${pkType},
   opts?: Omit<${useQueryOptionsSym}<${baseName}>, "queryKey" | "queryFn">,
 ): ${useQueryResultSym}<${baseName}> {
   const fetcher = ${useEntityFetcherSym}();
@@ -459,7 +469,7 @@ export function use${pluralize(subName)}(
 }
 
 export function use${subName}(
-  id: number,
+  id: ${pkType},
   opts?: Omit<${useQueryOptionsSym}<${subName}>, "queryKey" | "queryFn">,
 ): ${useQueryResultSym}<${subName}> {
   const fetcher = ${useEntityFetcherSym}();
@@ -490,8 +500,8 @@ export function useCreate${subName}(
 }
 
 export function useUpdate${subName}(
-  opts?: Omit<${useMutationOptionsSym}<${subName}, Error, { id: number; input: ${updateInput} }>, "mutationFn">,
-): ${useMutationResultSym}<${subName}, Error, { id: number; input: ${updateInput} }> {
+  opts?: Omit<${useMutationOptionsSym}<${subName}, Error, { id: ${pkType}; input: ${updateInput} }>, "mutationFn">,
+): ${useMutationResultSym}<${subName}, Error, { id: ${pkType}; input: ${updateInput} }> {
   const fetcher = ${useEntityFetcherSym}();
   const qc = ${useQueryClientSym}();
   return ${useMutationSym}({
@@ -509,8 +519,8 @@ export function useUpdate${subName}(
 }
 
 export function useDelete${subName}(
-  opts?: Omit<${useMutationOptionsSym}<void, Error, number>, "mutationFn">,
-): ${useMutationResultSym}<void, Error, number> {
+  opts?: Omit<${useMutationOptionsSym}<void, Error, ${pkType}>, "mutationFn">,
+): ${useMutationResultSym}<void, Error, ${pkType}> {
   const fetcher = ${useEntityFetcherSym}();
   const qc = ${useQueryClientSym}();
   return ${useMutationSym}({

server/typescript/packages/codegen-ts-tanstack/test/fixtures/pk-types.json

@@ -0,0 +1,43 @@
+{
+  "metadata.root": {
+    "package": "acme",
+    "children": [
+      {
+        "object.entity": {
+          "name": "Member",
+          "children": [
+            { "field.uuid": { "name": "id" } },
+            { "field.string": { "name": "email", "children": [{ "view.text": {} }] } },
+            { "identity.primary": { "name": "id", "@fields": ["id"], "@generation": "uuid" } },
+            {
+              "layout.dataGrid": {
+                "name": "default",
+                "@pageSize": 25,
+                "@filterable": true,
+                "@columns": ["email"]
+              }
+            }
+          ]
+        }
+      },
+      {
+        "object.entity": {
+          "name": "Subscriber",
+          "children": [
+            { "field.long": { "name": "id" } },
+            { "field.string": { "name": "email", "children": [{ "view.text": {} }] } },
+            { "identity.primary": { "name": "id", "@fields": ["id"], "@generation": "increment" } },
+            {
+              "layout.dataGrid": {
+                "name": "default",
+                "@pageSize": 25,
+                "@filterable": true,
+                "@columns": ["email"]
+              }
+            }
+          ]
+        }
+      }
+    ]
+  }
+}

server/typescript/packages/codegen-ts-tanstack/test/golden/__snapshots__/grid-filter/Subscriber.grid.ts

@@ -29,10 +29,10 @@ export function useSubscriberActiveGrid() {
     for (const f of columnFilters) {
       filterObj[f.id] = f.value as unknown;
     }
-    const sort =
-      sorting.length > 0
-        ? `${sorting[0].id}:${sorting[0].desc ? "desc" : "asc"}`
-        : undefined;
+    const sortEntry = sorting[0];
+    const sort = sortEntry
+      ? `${sortEntry.id}:${sortEntry.desc ? "desc" : "asc"}`
+      : undefined;
     return buildFilterQs({
       ...filterObj,
       ...(sort !== undefined ? { sort } : {}),

server/typescript/packages/codegen-ts-tanstack/test/golden/__snapshots__/multi-grid/Program.grid.ts

@@ -28,10 +28,10 @@ export function useProgramDefaultGrid() {
     for (const f of columnFilters) {
       filterObj[f.id] = f.value as unknown;
     }
-    const sort =
-      sorting.length > 0
-        ? `${sorting[0].id}:${sorting[0].desc ? "desc" : "asc"}`
-        : undefined;
+    const sortEntry = sorting[0];
+    const sort = sortEntry
+      ? `${sortEntry.id}:${sortEntry.desc ? "desc" : "asc"}`
+      : undefined;
     return buildFilterQs({
       ...filterObj,
       ...(sort !== undefined ? { sort } : {}),
@@ -79,10 +79,10 @@ export function useProgramCompactGrid() {
     for (const f of columnFilters) {
       filterObj[f.id] = f.value as unknown;
     }
-    const sort =
-      sorting.length > 0
-        ? `${sorting[0].id}:${sorting[0].desc ? "desc" : "asc"}`
-        : undefined;
+    const sortEntry = sorting[0];
+    const sort = sortEntry
+      ? `${sortEntry.id}:${sortEntry.desc ? "desc" : "asc"}`
+      : undefined;
     return buildFilterQs({
       ...filterObj,
       ...(sort !== undefined ? { sort } : {}),

server/typescript/packages/codegen-ts-tanstack/test/golden/__snapshots__/single-entity/Subscriber.grid.ts

@@ -30,10 +30,10 @@ export function useSubscriberDefaultGrid() {
     for (const f of columnFilters) {
       filterObj[f.id] = f.value as unknown;
     }
-    const sort =
-      sorting.length > 0
-        ? `${sorting[0].id}:${sorting[0].desc ? "desc" : "asc"}`
-        : undefined;
+    const sortEntry = sorting[0];
+    const sort = sortEntry
+      ? `${sortEntry.id}:${sortEntry.desc ? "desc" : "asc"}`
+      : undefined;
     return buildFilterQs({
       ...filterObj,
       ...(sort !== undefined ? { sort } : {}),

server/typescript/packages/codegen-ts-tanstack/test/hooks-pk-type.test.ts

@@ -0,0 +1,72 @@
+/**
+ * The TanStack hooks template hardcoded `id: number` at every emission site — the
+ * query-key `detail(id)` factory, `use<Entity>(id)`, and the update/delete mutation
+ * variables — with nothing reading the entity's declared primary-key type.
+ *
+ * For a uuid/string PK (the normal case whenever `identity: "uuid"` is the project's
+ * standard) the generated hooks therefore describe an `id: number` while the row's real
+ * `<Entity>Row["id"]` is `string`. Application code calling
+ * `useUpdate<Entity>().mutate({ id: someRealStringId, … })` is then a genuine `tsc` error
+ * — the generated type is simply wrong for the data it describes, forcing consumers to
+ * cast at every call site.
+ *
+ * codegen-ts already exports `getPkInfo(entity, ctx)` (the queries template uses it
+ * correctly); the hooks template just never called it.
+ *
+ * Reported by a downstream consumer against 0.15.20.
+ */
+import { describe, test, expect } from "bun:test";
+import { resolve } from "node:path";
+import { tanstackQuery } from "../src/tanstack-query.js";
+import { makeRenderContext, buildPkMap, buildRelationMap } from "@metaobjectsdev/codegen-ts";
+import type { GenContext } from "@metaobjectsdev/codegen-ts";
+import { MetaDataLoader } from "@metaobjectsdev/metadata";
+import { FileSource } from "@metaobjectsdev/metadata/core";
+
+/** Generate the hooks files for the fixture; returns path → content. */
+async function generate(): Promise<Map<string, string>> {
+  const loader = new MetaDataLoader();
+  const { root } = await loader.load([
+    new FileSource(resolve(import.meta.dir, "fixtures", "pk-types.json")),
+  ]);
+  const renderContext = makeRenderContext({
+    dialect: "sqlite", loadedRoot: root, outDir: "/tmp",
+    dbImport: "../db", extStyle: "none",
+    pkMap: buildPkMap(root), relationMap: buildRelationMap(root),
+  });
+  const ctx: GenContext = {
+    entities: root.objects(), loadedRoot: root,
+    matches: () => true,
+    config: { outDir: "/tmp", extStyle: "none", dbImport: "../db", dialect: "sqlite" },
+    renderContext,
+    warn: () => {},
+  };
+  const files = await tanstackQuery().generate(ctx);
+  return new Map(files.map((f) => [f.path, f.content]));
+}
+
+describe("tanstack hooks — the id parameter follows the entity's real PK type", () => {
+  test("uuid PK emits `id: string`, never `id: number`", async () => {
+    const member = (await generate()).get("Member.hooks.ts")!;
+    expect(member).toContain("id: string");
+    expect(member).not.toContain("id: number");
+  });
+
+  test("uuid PK: the delete mutation's variable type is string, not number", async () => {
+    const member = (await generate()).get("Member.hooks.ts")!;
+    // useDeleteMember previously produced UseMutationResult<void, Error, number>
+    expect(member).not.toMatch(/UseMutationResult<\s*void,\s*Error,\s*number\s*>/);
+    expect(member).toMatch(/UseMutationResult<\s*void,\s*Error,\s*string\s*>/);
+  });
+
+  test("uuid PK: the update mutation's variables carry a string id", async () => {
+    const member = (await generate()).get("Member.hooks.ts")!;
+    expect(member).toContain("{ id: string; input: MemberUpdate }");
+  });
+
+  test("regression guard: an increment/long PK still emits `id: number`", async () => {
+    const subscriber = (await generate()).get("Subscriber.hooks.ts")!;
+    expect(subscriber).toContain("id: number");
+    expect(subscriber).not.toContain("id: string");
+  });
+});

server/typescript/packages/migrate-ts/src/diff/index.ts

@@ -265,7 +265,17 @@ function diffTableColumns(
         from: ac.nullable, to: ec.nullable, status: ALLOWED,
       });
     }
-    if (!columnDefaultsEqual(ec.default, ac.default)) {
+    // An `identity: "uuid"` PK's physical DEFAULT is synthesized purely at DDL-emit
+    // time (sqlite/d1: `(lower(hex(randomblob(16))))`; postgres: `gen_random_uuid()`)
+    // and is deliberately never recorded as a ColumnDefault on the expected side —
+    // uuid generation is modeled as `identity`, not `default`. Introspection, however,
+    // reads that DEFAULT back off the live table as a real `expr` default, so comparing
+    // the two always disagrees — for every uuid-PK table, on every run, with zero
+    // metadata changes. On SQLite/D1 the false positive is destructive rather than
+    // merely noisy: there is no ALTER COLUMN, so the recreate-and-copy path rebuilds
+    // the WHOLE table. Identity-driven values are not ordinary defaults — don't diff
+    // them (`increment` gets this implicitly: an AUTOINCREMENT column has no DEFAULT).
+    if (ec.identity !== "uuid" && !columnDefaultsEqual(ec.default, ac.default)) {
       const change: Change = {
         kind: "change-column-default", table, ...sx, column: name,
         status: ALLOWED,