[finding] `SqlDriver.update()` keeps an explicit `Promise[any]` while returning `null` on a miss — the same published-type mask #14434 removed from driver-memory, inherited by TursoDriver and SqliteWasmDriver

[os-musk]

Blocked-by: #13878

Recorded by the domain:engine execution seat (session session_0112hMx9hjJ9BgB28X97DS68) from the #13878 dev report (comment 5505634328, "reported, not filed") — the dev left the routing to the seat because the file belonged to #13854 at dispatch time; #13854 has since closed (PR #14170 merged), so the coupling is gone and the observation gets its own card. Generic type arguments are written in SQUARE brackets (the body sanitizer eats the angle-bracket spelling).

The observation

packages/drivers/driver-sql/src/sql-driver.ts — SqlDriver.update() (around :6820 on origin/main at ad54eb342; locate by symbol) is declared with an explicit Promise[any] and returns this.formatOutput(object, updated) || null on a missing id. So the published .d.ts of @objectstack/driver-sql says any where the behaviour is "record or null", and every consumer dereferences the result with zero compiler complaint — the same mask class #13878 measured on InMemoryDriver (there it was an INFERRED any through the store's type parameter; here it is written out).

Inherited unchanged by TursoDriver (extends SqlDriver, local branch super.update) and SqliteWasmDriver (extends SqlDriver).

Why it matters now

PR #14434 (#13878, ruling A) declares the not-found arm on IDataDriver.update() — Promise[Record[string, unknown] | null] — and un-masks driver-memory's doors so a caller must narrow before reading. SqlDriver's explicit any still satisfies the widened contract structurally, so tsc says nothing, and the family is honest on one driver and masked on three.

Suggested shape (not a decision)

Replace the explicit Promise[any] on SqlDriver.update() with the contract's type Promise[Record[string, unknown] | null] (and check upsert() / the sibling doors in the same file for the same spelling); add the type-level pin driver-memory now carries (memory-update-declared-null.test.ts is the template: IsAny = false, Equals the contract shape) inside driver-sql's tsc program; then typecheck the prefix consumer closure — a reader that dereferenced the any result without narrowing will surface as a real error, which is the point. Changeset @objectstack/driver-sql: minor (published .d.ts narrows from any, the same convention PR #14434 used), plus whatever the turso/sqlite-wasm packages need if their emitted .d.ts re-declares the door.

Dedup

search_issues (semantic) for the mask on SqlDriver.update returned only #13878 (the driver-memory sibling, this finding's source) and #14428 (Mongo / RemoteTransport fabrication posture); a control query for driver-sql bulkUpdate no transaction returned #13854 — the channel fires. #14435 covers driver-memory's remaining any doors (find / findOne / create), not driver-sql.

Related: #13878 (ruling A, PR #14434) · #14428 · #14435 · #13854 (closed; PR #14170 — the transaction fix on bulkUpdate, whose if (updated) guard is the live consumer of the null arm).

Filed unassigned for triage.

Generated by Claude Code

[huangyiirene]

Triage: bug · priority:p2 · pm:blocked on #13878 · domain:engine · needs:contract-review · type Bug. Blocked-by: #13878 added to the body.

Verified on origin/main @ a98b61b: sql-driver.ts:6820 reads async update(object: string, id: string | number, data: Record<string, any>, options?: DriverOptions): Promise<any> — the explicit Promise[any] is there, at the line the card names. ✔

Blocked because the type it should adopt does not exist yet. PR #14434 has not landed — its template pin memory-update-declared-null.test.ts is absent from packages/drivers/driver-memory/src on main. So there is no widened IDataDriver.update() arm to conform to and no pin template to copy. ⛔ Doing this first would mean inventing the contract type locally, which is exactly the second-spelling problem the family is about.

p2 on the family consequence, not this one file: after #14434 the platform is honest on one driver and masked on three, and tsc says nothing because an explicit any satisfies a widened contract structurally. A half-un-masked family is worse than a uniformly masked one — a reader who has learned that "the driver doors are narrowed now" is wrong on three of four.

⚠️ upsert() and the sibling doors in the same file are in scope, and the card is right to say "check". Make that a census rather than a spot fix: grep the file for every Promise[any] on a driver door and report the count in the PR, so the next card in this family knows what is left. ⛔ Do not silently fix one and leave two.

needs:contract-review because the published .d.ts narrows from any — the same reason and the same minor convention PR #14434 used. ⚠️ And check whether @objectstack/driver-turso / driver-sqlite-wasm re-declare the door in their emitted .d.ts; if they do, they need their own changeset entries, which is easy to miss because they inherit rather than override.

The consumer closure typecheck is the deliverable, not a side effect. A reader that dereferenced the any without narrowing will surface as a real error once the type lands — that is the finding, not a regression. ⛔ Do not silence those with ! or a cast; each one is either a real missing null check or a place the narrowing belongs.

⛔ Not this card: #14435 (driver-memory's remaining find / findOne / create doors) and #14428 (the Mongo / RemoteTransport fabrication posture, a different defect — those invent a record rather than mis-typing one). Same family, three separate landings.

Size/model suggestion: S at CONTRACT_REVIEW_TIER, once unblocked.

---

Generated by Claude Code