@opengeni/db 0.2.0

package/dist/chunk-57MLICFR.js

@@ -0,0 +1,121 @@
+// src/provision-roles.ts
+import postgres from "postgres";
+async function provisionRoles(adminConnection, options = {}) {
+  const schema = validateIdentifier("targetSchema", options.targetSchema ?? "public");
+  const rlsStrategy = options.rlsStrategy ?? "force";
+  const appRole = validateIdentifier("appRole", options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || "opengeni_app"));
+  const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;
+  const temporalRole = validateIdentifier("temporalRole", options.temporalRole ?? (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || "opengeni_temporal"));
+  const temporalPassword = options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;
+  const temporalDatabases = (options.temporalDatabases ?? commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? "temporal,temporal_visibility")).map((name) => validateIdentifier("temporalDatabases", name));
+  const sql = postgres(adminConnection, { max: 1 });
+  try {
+    let provisionedAppRole = null;
+    if (rlsStrategy === "force") {
+      if (!appPassword) {
+        throw new Error("OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'");
+      }
+      await ensureLoginRole(sql, appRole, appPassword);
+      provisionedAppRole = appRole;
+    }
+    if (temporalPassword) {
+      await ensureLoginRole(sql, temporalRole, temporalPassword);
+      for (const database of temporalDatabases) {
+        await ensureDatabase(sql, database, temporalRole);
+        await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);
+      }
+    }
+    if (rlsStrategy === "force") {
+      await grantAppRoleIfSchemaExists(sql, appRole, schema);
+    }
+    return {
+      appRole: provisionedAppRole,
+      temporalRole: temporalPassword ? temporalRole : null,
+      temporalDatabases: temporalPassword ? temporalDatabases : [],
+      schema,
+      rlsStrategy
+    };
+  } finally {
+    await sql.end();
+  }
+}
+async function ensureLoginRole(sql, role, password) {
+  await sql.unsafe(`
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
+    EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
+  ELSE
+    EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
+  END IF;
+END $$;
+`);
+}
+async function ensureDatabase(sql, database, owner) {
+  const existing = await sql`
+    select exists(select 1 from pg_database where datname = ${database}) as exists
+  `;
+  if (!existing[0]?.exists) {
+    await sql.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);
+  }
+  await sql.unsafe(`GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`);
+}
+async function grantTemporalRoleInDatabase(adminConnection, database, role) {
+  const databaseUrl = databaseUrlFor(adminConnection, database);
+  const databaseSql = postgres(databaseUrl, { max: 1 });
+  try {
+    await databaseSql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${identifier(role)}`);
+  } finally {
+    await databaseSql.end();
+  }
+}
+async function grantAppRoleIfSchemaExists(sql, role, schema) {
+  await sql.unsafe(`
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN
+    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
+    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN
+    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});
+    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});
+  END IF;
+END $$;
+`);
+}
+function commaSeparated(value) {
+  return value.split(",").map((item) => item.trim()).filter(Boolean);
+}
+function validateIdentifier(name, value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+    throw new Error(`${name} contains an invalid Postgres identifier: ${value}`);
+  }
+  return value;
+}
+function identifier(value) {
+  return `"${value.replace(/"/g, '""')}"`;
+}
+function literal(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function databaseUrlFor(value, database) {
+  const url = new URL(value);
+  url.pathname = `/${database}`;
+  return url.toString();
+}
+if (import.meta.main) {
+  const adminUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ?? process.env.OPENGENI_DATABASE_ADMIN_URL ?? process.env.OPENGENI_DATABASE_URL;
+  if (!adminUrl) {
+    throw new Error("OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required");
+  }
+  const result = await provisionRoles(adminUrl, {
+    ...process.env.OPENGENI_DB_SCHEMA?.trim() ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() } : {}
+  });
+  console.log(JSON.stringify(result, null, 2));
+}
+
+export {
+  provisionRoles
+};
+//# sourceMappingURL=chunk-57MLICFR.js.map

package/dist/chunk-57MLICFR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/provision-roles.ts"],"sourcesContent":["import postgres from \"postgres\";\nimport type { RlsStrategy } from \"./index\";\n\nexport type ProvisionResult = {\n  appRole: string | null;\n  temporalRole: string | null;\n  temporalDatabases: string[];\n  schema: string;\n  rlsStrategy: RlsStrategy;\n};\n\nexport type ProvisionRolesOptions = {\n  /**\n   * The schema OpenGeni's tables live in. The app-role GRANTs target this\n   * schema + `opengeni_private`. Defaults to `public` (standalone).\n   */\n  targetSchema?: string;\n  /**\n   * RLS posture (Step I). `\"force\"` (default) provisions the non-owner\n   * `opengeni_app` login role and GRANTs it table DML in the target schema —\n   * the role OpenGeni connects as under FORCE-RLS. `\"scoped\"` SKIPS the app-role\n   * provisioning entirely: the embedded host runs OpenGeni's queries over a role\n   * IT owns/manages (typically the schema owner), so OpenGeni neither creates\n   * nor grants the `opengeni_app` role. Temporal-role provisioning is unaffected\n   * by strategy.\n   */\n  rlsStrategy?: RlsStrategy;\n  appRole?: string;\n  appPassword?: string;\n  temporalRole?: string;\n  temporalPassword?: string;\n  temporalDatabases?: string[];\n};\n\n/**\n * SDK entry point (Step I): provision the OpenGeni database roles + grants over\n * a host-supplied admin connection. This is the named, parameterized form of the\n * historical env-driven `provision-roles` script (which still works as a CLI via\n * the `import.meta.main` block at the bottom — it just reads env into these\n * options).\n *\n * STANDALONE (default): `provisionRoles(adminConnection)` with no options →\n * `targetSchema: \"public\"`, `rlsStrategy: \"force\"`, reads `opengeni_app` creds\n * from env. Byte-for-byte the historical script behavior.\n *\n * EMBEDDED: `provisionRoles(adminConnection, { targetSchema, rlsStrategy })` lets\n * a host provision the app role over a dedicated schema (force) OR skip the\n * app role entirely and own the connection role itself (scoped).\n */\nexport async function provisionRoles(\n  adminConnection: string,\n  options: ProvisionRolesOptions = {},\n): Promise<ProvisionResult> {\n  const schema = validateIdentifier(\"targetSchema\", options.targetSchema ?? \"public\");\n  const rlsStrategy: RlsStrategy = options.rlsStrategy ?? \"force\";\n\n  const appRole = validateIdentifier(\"appRole\", options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || \"opengeni_app\"));\n  const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;\n  const temporalRole = validateIdentifier(\"temporalRole\", options.temporalRole ?? (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || \"opengeni_temporal\"));\n  const temporalPassword = options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;\n  const temporalDatabases = (options.temporalDatabases\n    ?? commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? \"temporal,temporal_visibility\"))\n    .map((name) => validateIdentifier(\"temporalDatabases\", name));\n\n  const sql = postgres(adminConnection, { max: 1 });\n  try {\n    // FORCE strategy provisions the non-owner app role OpenGeni connects as.\n    // SCOPED strategy: the host owns the connection role; OpenGeni provisions no\n    // app role (skipped here), only the optional Temporal role.\n    let provisionedAppRole: string | null = null;\n    if (rlsStrategy === \"force\") {\n      if (!appPassword) {\n        throw new Error(\"OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'\");\n      }\n      await ensureLoginRole(sql, appRole, appPassword);\n      provisionedAppRole = appRole;\n    }\n\n    if (temporalPassword) {\n      await ensureLoginRole(sql, temporalRole, temporalPassword);\n      for (const database of temporalDatabases) {\n        await ensureDatabase(sql, database, temporalRole);\n        await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);\n      }\n    }\n\n    if (rlsStrategy === \"force\") {\n      await grantAppRoleIfSchemaExists(sql, appRole, schema);\n    }\n\n    return {\n      appRole: provisionedAppRole,\n      temporalRole: temporalPassword ? temporalRole : null,\n      temporalDatabases: temporalPassword ? temporalDatabases : [],\n      schema,\n      rlsStrategy,\n    };\n  } finally {\n    await sql.end();\n  }\n}\n\nasync function ensureLoginRole(sql: postgres.Sql, role: string, password: string): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN\n    EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  ELSE\n    EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  END IF;\nEND $$;\n`);\n}\n\nasync function ensureDatabase(sql: postgres.Sql, database: string, owner: string): Promise<void> {\n  const existing = await sql<{ exists: boolean }[]>`\n    select exists(select 1 from pg_database where datname = ${database}) as exists\n  `;\n  if (!existing[0]?.exists) {\n    await sql.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);\n  }\n  await sql.unsafe(`GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`);\n}\n\nasync function grantTemporalRoleInDatabase(adminConnection: string, database: string, role: string): Promise<void> {\n  const databaseUrl = databaseUrlFor(adminConnection, database);\n  const databaseSql = postgres(databaseUrl, { max: 1 });\n  try {\n    await databaseSql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${identifier(role)}`);\n  } finally {\n    await databaseSql.end();\n  }\n}\n\n/**\n * Grant the app role table DML in the OpenGeni data schema + EXECUTE on the\n * `opengeni_private` helper functions. Schema-parameterized (Step I): standalone\n * passes `public`; embedded passes the dedicated schema. The grants are guarded\n * on schema existence so provisioning before migrate is a safe no-op.\n */\nasync function grantAppRoleIfSchemaExists(sql: postgres.Sql, role: string, schema: string): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n  END IF;\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});\n    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});\n  END IF;\nEND $$;\n`);\n}\n\nfunction commaSeparated(value: string): string[] {\n  return value.split(\",\").map((item) => item.trim()).filter(Boolean);\n}\n\nfunction validateIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} contains an invalid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\nfunction identifier(value: string): string {\n  return `\"${value.replace(/\"/g, \"\\\"\\\"\")}\"`;\n}\n\nfunction literal(value: string): string {\n  return `'${value.replace(/'/g, \"''\")}'`;\n}\n\nfunction databaseUrlFor(value: string, database: string): string {\n  const url = new URL(value);\n  url.pathname = `/${database}`;\n  return url.toString();\n}\n\n// CLI form (unchanged behavior): read env into the SDK options and run. This is\n// what `bun src/provision-roles.ts` / the `provision-roles` package script\n// invokes — standalone byte-for-byte the historical script (public schema,\n// force strategy, env-driven creds).\nif (import.meta.main) {\n  const adminUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL\n    ?? process.env.OPENGENI_DATABASE_ADMIN_URL\n    ?? process.env.OPENGENI_DATABASE_URL;\n  if (!adminUrl) {\n    throw new Error(\"OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required\");\n  }\n  const result = await provisionRoles(adminUrl, {\n    ...(process.env.OPENGENI_DB_SCHEMA?.trim() ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() } : {}),\n  });\n  console.log(JSON.stringify(result, null, 2));\n}\n"],"mappings":";AAAA,OAAO,cAAc;AAiDrB,eAAsB,eACpB,iBACA,UAAiC,CAAC,GACR;AAC1B,QAAM,SAAS,mBAAmB,gBAAgB,QAAQ,gBAAgB,QAAQ;AAClF,QAAM,cAA2B,QAAQ,eAAe;AAExD,QAAM,UAAU,mBAAmB,WAAW,QAAQ,YAAY,QAAQ,IAAI,4BAA4B,KAAK,KAAK,eAAe;AACnI,QAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;AACvD,QAAM,eAAe,mBAAmB,gBAAgB,QAAQ,iBAAiB,QAAQ,IAAI,iCAAiC,KAAK,KAAK,oBAAoB;AAC5J,QAAM,mBAAmB,QAAQ,oBAAoB,QAAQ,IAAI;AACjE,QAAM,qBAAqB,QAAQ,qBAC9B,eAAe,QAAQ,IAAI,+BAA+B,8BAA8B,GAC1F,IAAI,CAAC,SAAS,mBAAmB,qBAAqB,IAAI,CAAC;AAE9D,QAAM,MAAM,SAAS,iBAAiB,EAAE,KAAK,EAAE,CAAC;AAChD,MAAI;AAIF,QAAI,qBAAoC;AACxC,QAAI,gBAAgB,SAAS;AAC3B,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,MAAM,qFAAqF;AAAA,MACvG;AACA,YAAM,gBAAgB,KAAK,SAAS,WAAW;AAC/C,2BAAqB;AAAA,IACvB;AAEA,QAAI,kBAAkB;AACpB,YAAM,gBAAgB,KAAK,cAAc,gBAAgB;AACzD,iBAAW,YAAY,mBAAmB;AACxC,cAAM,eAAe,KAAK,UAAU,YAAY;AAChD,cAAM,4BAA4B,iBAAiB,UAAU,YAAY;AAAA,MAC3E;AAAA,IACF;AAEA,QAAI,gBAAgB,SAAS;AAC3B,YAAM,2BAA2B,KAAK,SAAS,MAAM;AAAA,IACvD;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,cAAc,mBAAmB,eAAe;AAAA,MAChD,mBAAmB,mBAAmB,oBAAoB,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AACF;AAEA,eAAe,gBAAgB,KAAmB,MAAc,UAAiC;AAC/F,QAAM,IAAI,OAAO;AAAA;AAAA;AAAA,0DAGuC,QAAQ,IAAI,CAAC;AAAA,yDACd,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA,wDAEpC,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA,CAG1F;AACD;AAEA,eAAe,eAAe,KAAmB,UAAkB,OAA8B;AAC/F,QAAM,WAAW,MAAM;AAAA,8DACqC,QAAQ;AAAA;AAEpE,MAAI,CAAC,SAAS,CAAC,GAAG,QAAQ;AACxB,UAAM,IAAI,OAAO,mBAAmB,WAAW,QAAQ,CAAC,UAAU,WAAW,KAAK,CAAC,EAAE;AAAA,EACvF;AACA,QAAM,IAAI,OAAO,oCAAoC,WAAW,QAAQ,CAAC,OAAO,WAAW,KAAK,CAAC,EAAE;AACrG;AAEA,eAAe,4BAA4B,iBAAyB,UAAkB,MAA6B;AACjH,QAAM,cAAc,eAAe,iBAAiB,QAAQ;AAC5D,QAAM,cAAc,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC;AACpD,MAAI;AACF,UAAM,YAAY,OAAO,2CAA2C,WAAW,IAAI,CAAC,EAAE;AAAA,EACxF,UAAE;AACA,UAAM,YAAY,IAAI;AAAA,EACxB;AACF;AAQA,eAAe,2BAA2B,KAAmB,MAAc,QAA+B;AACxG,QAAM,IAAI,OAAO;AAAA;AAAA;AAAA,0DAGuC,QAAQ,MAAM,CAAC;AAAA,uDAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,8FACM,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,qEAG1D,QAAQ,IAAI,CAAC;AAAA,wFACM,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,CAGpG;AACD;AAEA,SAAS,eAAe,OAAyB;AAC/C,SAAO,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,OAAO;AACnE;AAEA,SAAS,mBAAmB,MAAc,OAAuB;AAC/D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,6CAA6C,KAAK,EAAE;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAM,CAAC;AACxC;AAEA,SAAS,QAAQ,OAAuB;AACtC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;AACtC;AAEA,SAAS,eAAe,OAAe,UAA0B;AAC/D,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,WAAW,IAAI,QAAQ;AAC3B,SAAO,IAAI,SAAS;AACtB;AAMA,IAAI,YAAY,MAAM;AACpB,QAAM,WAAW,QAAQ,IAAI,oCACxB,QAAQ,IAAI,+BACZ,QAAQ,IAAI;AACjB,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,qGAAqG;AAAA,EACvH;AACA,QAAM,SAAS,MAAM,eAAe,UAAU;AAAA,IAC5C,GAAI,QAAQ,IAAI,oBAAoB,KAAK,IAAI,EAAE,cAAc,QAAQ,IAAI,mBAAmB,KAAK,EAAE,IAAI,CAAC;AAAA,EAC1G,CAAC;AACD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;","names":[]}

package/dist/chunk-OGCE6O2X.js

@@ -0,0 +1,52 @@
+// src/migrate.ts
+import { readdir, readFile } from "fs/promises";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import postgres from "postgres";
+var DEFAULT_DATABASE_URL = "postgres://opengeni:opengeni@127.0.0.1:5432/opengeni";
+function assertIdentifier(name, value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+    throw new Error(`${name} is not a valid Postgres identifier: ${value}`);
+  }
+  return value;
+}
+async function migrate(databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ?? process.env.OPENGENI_DATABASE_URL ?? DEFAULT_DATABASE_URL, schema = process.env.OPENGENI_DB_SCHEMA?.trim() || void 0) {
+  const migrationsDir = join(dirname(fileURLToPath(import.meta.url)), "../drizzle");
+  const files = (await readdir(migrationsDir)).filter((file) => file.endsWith(".sql")).sort();
+  const sql = postgres(databaseUrl, { max: 1 });
+  try {
+    await sql`SELECT pg_advisory_lock(727458)`;
+    if (schema) {
+      assertIdentifier("OPENGENI_DB_SCHEMA", schema);
+      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS "${schema}"`);
+      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS "opengeni_private"`);
+      await sql.unsafe(`SET search_path = "${schema}", "opengeni_private", "public"`);
+    }
+    await sql.unsafe(`CREATE TABLE IF NOT EXISTS "schema_migrations" ("name" text PRIMARY KEY, "applied_at" timestamptz NOT NULL DEFAULT now())`);
+    const appliedRows = await sql`SELECT "name" FROM "schema_migrations"`;
+    const applied = new Set(appliedRows.map((row) => row.name));
+    for (const file of files) {
+      if (applied.has(file)) {
+        continue;
+      }
+      const sqlText = await readFile(join(migrationsDir, file), "utf8");
+      await sql.unsafe(sqlText);
+      await sql`INSERT INTO "schema_migrations" ("name") VALUES (${file}) ON CONFLICT DO NOTHING`;
+    }
+  } finally {
+    await sql.end();
+  }
+}
+async function runMigrations(adminConnection, targetSchema) {
+  await migrate(adminConnection, targetSchema);
+}
+if (import.meta.main) {
+  await migrate();
+  console.log("Applied Drizzle SQL migrations.");
+}
+
+export {
+  migrate,
+  runMigrations
+};
+//# sourceMappingURL=chunk-OGCE6O2X.js.map

package/dist/chunk-OGCE6O2X.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/migrate.ts"],"sourcesContent":["import { readdir, readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport postgres from \"postgres\";\n\nconst DEFAULT_DATABASE_URL = \"postgres://opengeni:opengeni@127.0.0.1:5432/opengeni\";\n\n/** A bare Postgres identifier (schema/role name) safe to interpolate into DDL. */\nfunction assertIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} is not a valid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\n/**\n * Apply the OpenGeni SQL migration chain.\n *\n * STANDALONE (default, unchanged): `migrate()` / `migrate(databaseUrl)` runs the\n * whole chain with NO search_path manipulation, so every unqualified\n * table/index/policy lands in the server default schema (`public`). This is the\n * byte-for-byte historical behavior — the migration test suite calls\n * `migrate(DB_URL)` and is unaffected.\n *\n * EMBEDDED (Step I, §7.8 runtime/SDK half): pass a `schema` (or set\n * `OPENGENI_DB_SCHEMA`). The migrate session then `CREATE SCHEMA IF NOT EXISTS`\n * for both `<schema>` and `opengeni_private`, and sets\n * `search_path = \"<schema>\", \"opengeni_private\", \"public\"`, so EVERY unqualified\n * DDL statement lands in the dedicated schema with NO per-statement SQL rewrite\n * (the SPIKE-1 F1 result). Two things make this work and stay idempotent:\n *   1. The policy-existence guards in the migration SQL use `current_schema()`\n *      (not a hardcoded `'public'`) — so a re-run finds the policy it already\n *      created in `<schema>` and DROP/CREATEs idempotently instead of failing\n *      with \"policy already exists\". (This guard substitution is the migrate-\n *      time enabler for the runtime search_path approach; without it the SDK\n *      entry point silently fails on re-run — the Fork-6 hazard.)\n *   2. `public` stays LAST on the path so `gen_random_uuid()` (pgcrypto) and the\n *      `vector` type — both installed into `public` by 0000 — still resolve. The\n *      `opengeni_private.*` helpers are always called with an absolute prefix.\n *\n * `OPENGENI_DB_SCHEMA` defaults UNSET → `public` → standalone, so the default\n * binding never regresses.\n */\nexport async function migrate(\n  databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ?? process.env.OPENGENI_DATABASE_URL ?? DEFAULT_DATABASE_URL,\n  schema: string | undefined = process.env.OPENGENI_DB_SCHEMA?.trim() || undefined,\n): Promise<void> {\n  const migrationsDir = join(dirname(fileURLToPath(import.meta.url)), \"../drizzle\");\n  const files = (await readdir(migrationsDir)).filter((file) => file.endsWith(\".sql\")).sort();\n  const sql = postgres(databaseUrl, { max: 1 });\n  try {\n    // Serialize concurrent migrate() runs; the session-level lock is released\n    // when the connection closes.\n    await sql`SELECT pg_advisory_lock(727458)`;\n    if (schema) {\n      assertIdentifier(\"OPENGENI_DB_SCHEMA\", schema);\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"${schema}\"`);\n      // opengeni_private is also created by 0001 with an absolute prefix, but the\n      // session search_path must already resolve it for the policy predicates\n      // and the SECURITY DEFINER functions that inherit the caller's path.\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"opengeni_private\"`);\n      await sql.unsafe(`SET search_path = \"${schema}\", \"opengeni_private\", \"public\"`);\n    }\n    await sql.unsafe(`CREATE TABLE IF NOT EXISTS \"schema_migrations\" (\"name\" text PRIMARY KEY, \"applied_at\" timestamptz NOT NULL DEFAULT now())`);\n    const appliedRows = await sql`SELECT \"name\" FROM \"schema_migrations\"`;\n    const applied = new Set(appliedRows.map((row) => row.name as string));\n    for (const file of files) {\n      if (applied.has(file)) {\n        continue;\n      }\n      const sqlText = await readFile(join(migrationsDir, file), \"utf8\");\n      await sql.unsafe(sqlText);\n      await sql`INSERT INTO \"schema_migrations\" (\"name\") VALUES (${file}) ON CONFLICT DO NOTHING`;\n    }\n  } finally {\n    await sql.end();\n  }\n}\n\n/**\n * SDK entry point (Step I): run the migration chain over a host-supplied admin\n * connection string against an explicit target schema. This is the embedded\n * topology's named entry — a host calls `runMigrations(adminConnection,\n * targetSchema)` from its own provisioning code instead of relying on env vars.\n * `targetSchema` undefined → `public` → standalone behavior. Thin wrapper over\n * `migrate` so there is one migration engine.\n */\nexport async function runMigrations(adminConnection: string, targetSchema?: string): Promise<void> {\n  await migrate(adminConnection, targetSchema);\n}\n\nif (import.meta.main) {\n  await migrate();\n  console.log(\"Applied Drizzle SQL migrations.\");\n}\n"],"mappings":";AAAA,SAAS,SAAS,gBAAgB;AAClC,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAC9B,OAAO,cAAc;AAErB,IAAM,uBAAuB;AAG7B,SAAS,iBAAiB,MAAc,OAAuB;AAC7D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,wCAAwC,KAAK,EAAE;AAAA,EACxE;AACA,SAAO;AACT;AA8BA,eAAsB,QACpB,cAAc,QAAQ,IAAI,oCAAoC,QAAQ,IAAI,yBAAyB,sBACnG,SAA6B,QAAQ,IAAI,oBAAoB,KAAK,KAAK,QACxD;AACf,QAAM,gBAAgB,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,YAAY;AAChF,QAAM,SAAS,MAAM,QAAQ,aAAa,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,CAAC,EAAE,KAAK;AAC1F,QAAM,MAAM,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC;AAC5C,MAAI;AAGF,UAAM;AACN,QAAI,QAAQ;AACV,uBAAiB,sBAAsB,MAAM;AAC7C,YAAM,IAAI,OAAO,gCAAgC,MAAM,GAAG;AAI1D,YAAM,IAAI,OAAO,gDAAgD;AACjE,YAAM,IAAI,OAAO,sBAAsB,MAAM,iCAAiC;AAAA,IAChF;AACA,UAAM,IAAI,OAAO,2HAA2H;AAC5I,UAAM,cAAc,MAAM;AAC1B,UAAM,UAAU,IAAI,IAAI,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAc,CAAC;AACpE,eAAW,QAAQ,OAAO;AACxB,UAAI,QAAQ,IAAI,IAAI,GAAG;AACrB;AAAA,MACF;AACA,YAAM,UAAU,MAAM,SAAS,KAAK,eAAe,IAAI,GAAG,MAAM;AAChE,YAAM,IAAI,OAAO,OAAO;AACxB,YAAM,uDAAuD,IAAI;AAAA,IACnE;AAAA,EACF,UAAE;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AACF;AAUA,eAAsB,cAAc,iBAAyB,cAAsC;AACjG,QAAM,QAAQ,iBAAiB,YAAY;AAC7C;AAEA,IAAI,YAAY,MAAM;AACpB,QAAM,QAAQ;AACd,UAAQ,IAAI,iCAAiC;AAC/C;","names":[]}