Fix transpiler: function hoisting + re-export paths + DB seed

Transpiler fixes:
- export function declarations now use hoisted function syntax instead
  of var assignments, fixing modules that reference functions before
  their declaration (e.g., rpc.setCache before export function rpc)
- Re-export paths (export { X } from "./relative") now resolve to
  full module names in require() calls

DB seed fixes:
- Remove SQL comments from multi-value INSERT (pgx doesn't support --)
- Split multi-statement setval into individual Exec calls

Middleware:
- Add /web/database/* to public endpoint whitelist

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pkg/server/middleware.go

@@ -46,10 +46,8 @@ func AuthMiddleware(store *SessionStore, next http.Handler) http.Handler {
 		path := r.URL.Path
 		if path == "/health" ||
 			path == "/web/login" ||
-			path == "/web/setup" ||
-			path == "/web/setup/install" ||
 			path == "/web/session/authenticate" ||
-			path == "/web/database/list" ||
+			strings.HasPrefix(path, "/web/database/") ||
 			path == "/web/webclient/version_info" ||
 			strings.Contains(path, "/static/") {
 			next.ServeHTTP(w, r)

pkg/server/transpiler.go

@@ -68,10 +68,10 @@ func TranspileJS(urlPath, content string) string {
 	deps, requireLines, cleanContent := extractImports(moduleName, content)
 
 	// Transform exports
-	cleanContent = transformExports(cleanContent)
+	cleanContent, exportedFuncs := transformExports(cleanContent)
 
 	// Wrap in odoo.define
-	return wrapWithOdooDefine(moduleName, deps, requireLines, cleanContent)
+	return wrapWithOdooDefine(moduleName, deps, requireLines, cleanContent, exportedFuncs)
 }
 
 // URLToModuleName converts a URL path to an Odoo module name.
@@ -288,8 +288,8 @@ func extractImports(moduleName, content string) (deps []string, requireLines []s
 		m := reExportNamedFrom.FindStringSubmatch(match)
 		if len(m) >= 3 {
 			names := m[1]
-			dep := m[2]
-			addDep(dep)
+			dep := resolve(m[2])
+			addDep(m[2])
 			// Named re-export: export { X } from "dep"
 			// Import the dep (using a temp var to avoid redeclaration with existing imports)
 			// then assign to __exports
@@ -352,8 +352,10 @@ func parseImportSpecifiers(raw string) []importSpecifier {
 }
 
 // transformExports converts export statements to __exports assignments.
+// Returns the transformed content and a list of exported function names
+// (these need deferred __exports assignment to preserve hoisting).
 // Mirrors: odoo/tools/js_transpiler.py (various export transformers)
-func transformExports(content string) string {
+func transformExports(content string) (string, []string) {
 	// export class Foo { ... }  ->  const Foo = __exports.Foo = class Foo { ... }
 	content = reExportClass.ReplaceAllStringFunc(content, func(match string) string {
 		m := reExportClass.FindStringSubmatch(match)
@@ -364,7 +366,13 @@ func transformExports(content string) string {
 		return "const " + name + " = __exports." + name + " = class " + name
 	})
 
-	// export [async] function foo(...) { ... }  ->  __exports.foo = [async] function foo(...) { ... }
+	// export [async] function foo(...) { ... }
+	// Must preserve function declaration hoisting (not var/const) because some
+	// Odoo modules reference the function before its declaration line
+	// (e.g., rpc.setCache assigned before "export function rpc").
+	// Strategy: keep as hoisted function declaration, collect names, append
+	// __exports assignments at the end.
+	var exportedFuncNames []string
 	content = reExportFunction.ReplaceAllStringFunc(content, func(match string) string {
 		m := reExportFunction.FindStringSubmatch(match)
 		if len(m) < 3 {
@@ -372,10 +380,8 @@ func transformExports(content string) string {
 		}
 		async := m[1] // "async " or ""
 		name := m[2]
-		// Use "var name = __exports.name = function name" so the name is available
-		// as a local variable (needed when code references it after declaration,
-		// e.g., uniqueId.nextId = 0)
-		return "var " + name + " = __exports." + name + " = " + async + "function " + name
+		exportedFuncNames = append(exportedFuncNames, name)
+		return async + "function " + name
 	})
 
 	// export const foo = ...  ->  const foo = __exports.foo = ...
@@ -439,7 +445,7 @@ func transformExports(content string) string {
 	// Must come after other export patterns to avoid double-matching
 	content = reExportDefault.ReplaceAllString(content, `__exports[Symbol.for("default")] = `)
 
-	return content
+	return content, exportedFuncNames
 }
 
 // exportSpecifier holds a single export specifier from "export { X, Y as Z }".
@@ -473,7 +479,7 @@ func parseExportSpecifiers(raw string) []exportSpecifier {
 
 // wrapWithOdooDefine wraps the transpiled content in an odoo.define() call.
 // Mirrors: odoo/tools/js_transpiler.py wrap_with_odoo_define()
-func wrapWithOdooDefine(moduleName string, deps []string, requireLines []string, content string) string {
+func wrapWithOdooDefine(moduleName string, deps []string, requireLines []string, content string, exportedFuncs []string) string {
 	var b strings.Builder
 
 	// Module definition header
@@ -508,6 +514,11 @@ func wrapWithOdooDefine(moduleName string, deps []string, requireLines []string,
 		b.WriteString("\n")
 	}
 
+	// Deferred __exports assignments for hoisted function declarations
+	for _, name := range exportedFuncs {
+		b.WriteString("__exports." + name + " = " + name + ";\n")
+	}
+
 	// Return exports
 	b.WriteString("return __exports;\n")
 	b.WriteString("});\n")