@polardbx/pxbaas 0.0.0-stage → 0.1.0-beta.10

package/dist/db/apply-schema.d.ts

@@ -0,0 +1,144 @@
+/**
+ * Schema apply engine shared by `pxbaas db push <file>` and `pxbaas app db-init <name>`.
+ *
+ * Two execution identities (chosen by profile.mode via {@link getSchemaSink}):
+ *   - single-tenant → MetaDriver `/pg/query` with the global service_role key
+ *     (that key IS the platform admin, so it can also write the central RLS
+ *     registry `supabase._mysqlrest_rls_*` directly).
+ *   - multi-tenant  → TenantDdlDriver `/api/tenant-ddl/*` with the per-tenant
+ *     service_role key. DDL/DML runs on the tenant's OWN database; RLS goes
+ *     through the structured endpoints (the tenant account has NO grant on the
+ *     shared `supabase` database, so a raw central INSERT would be denied).
+ *
+ * Safety contract (agreed design, unchanged):
+ *   - The plan (every step) is shown BEFORE anything runs.
+ *   - Execution requires explicit authorization: an interactive confirm, or
+ *     `--yes` for non-interactive use. `--dry-run` only previews.
+ *   - Steps run sequentially and STOP ON THE FIRST ERROR.
+ *   - No automatic rollback — already-applied steps stay applied.
+ *
+ * RLS source (see plan §5, decision R-C "hybrid"):
+ *   - a declarative `db/rls.json` is preferred when present;
+ *   - otherwise the `INSERT ... supabase._mysqlrest_rls_*` statements embedded in
+ *     schema.sql are parsed (multi-tenant) or run verbatim (single-tenant).
+ */
+import { MetaDriver, type RlsTableInput, type RlsPolicyInput } from "@polardbx/pxbaas-client";
+import type { ProfileMode } from "../credentials/profile.js";
+import { type RlsJson } from "./sql-file.js";
+export type { RlsJson };
+export interface ApplyOptions {
+    /** Target schema the `__SCHEMA__` placeholder resolves to (single-tenant: public). */
+    schema: string;
+    /** Preview only; never execute. */
+    dryRun: boolean;
+    /** Non-interactive authorization; skips the confirm prompt. */
+    assumeYes: boolean;
+    /** Emit a structured result instead of human text (caller prints JSON). */
+    json: boolean;
+}
+export type StepKind = "sql" | "rls-table" | "rls-policy";
+export interface StatementResult {
+    index: number;
+    /** For sql steps this is the SQL; for RLS steps a human-readable description. */
+    sql: string;
+    kind?: StepKind;
+    status: "pending" | "ok" | "failed" | "skipped";
+    error?: string;
+}
+export interface ApplyResult {
+    source: string;
+    schema: string;
+    total: number;
+    executed: number;
+    failed: number;
+    dryRun: boolean;
+    authorized: boolean;
+    statements: StatementResult[];
+    /** Present when produced by {@link applySchema}. */
+    mode?: ProfileMode;
+    rls?: {
+        tables: number;
+        policies: number;
+        source: "rls.json" | "schema.sql" | "none";
+    };
+}
+/** A minimal SQL executor so this module stays unit-testable without MetaDriver. */
+export type SqlExecutor = (sql: string) => Promise<unknown>;
+/** Per-call context the sink needs to render/apply structured RLS. */
+export interface RlsApplyContext {
+    /** Single-tenant target schema; ignored by the multi-tenant sink (server-bound). */
+    schema: string;
+}
+/**
+ * Execution strategy for a resolved profile. Encapsulates the single- vs
+ * multi-tenant channel difference so {@link applySchema} stays mode-agnostic.
+ */
+export interface SchemaSink {
+    mode: ProfileMode;
+    profileName: string;
+    /** Run one DDL/DML statement on the appropriate channel. */
+    runStatement(sql: string): Promise<unknown>;
+    /** Apply one RLS table toggle. */
+    applyRlsTable(input: RlsTableInput, ctx: RlsApplyContext): Promise<unknown>;
+    /** Apply one RLS policy. */
+    applyRlsPolicy(input: RlsPolicyInput, ctx: RlsApplyContext): Promise<unknown>;
+    /** Human-readable label for the plan preview. */
+    renderRlsTable(input: RlsTableInput, ctx: RlsApplyContext): string;
+    renderRlsPolicy(input: RlsPolicyInput, ctx: RlsApplyContext): string;
+    /** Drop one of the app's tables (used by `app destroy --purge-db`). */
+    dropTable(table: string, ctx: RlsApplyContext): Promise<unknown>;
+    /**
+     * Remove the RLS registry rows for one table. `toggleRemoved` reports whether
+     * the central `_mysqlrest_rls_tables` enable/force row was deleted. In
+     * multi-tenant this uses `DELETE /api/tenant-ddl/rls/tables`; on instances that
+     * predate that endpoint the call fails and we degrade gracefully (the benign
+     * toggle row is left and self-heals on the next db-init upsert).
+     */
+    purgeRlsForTable(table: string, ctx: RlsApplyContext): Promise<{
+        policiesDeleted: number;
+        toggleRemoved: boolean;
+    }>;
+}
+/**
+ * Resolve the active profile into a single-tenant MetaDriver.
+ * @throws when there is no profile, no credentials, or the profile is multi-tenant.
+ * @deprecated prefer {@link getSchemaSink}, which supports both modes. Kept for
+ * single-tenant callers and existing tests.
+ */
+export declare function getSingleTenantMetaDriver(role?: "anon" | "service_role"): Promise<{
+    driver: MetaDriver;
+    useServiceRole: boolean;
+    profileName: string;
+}>;
+/**
+ * Resolve the active profile into a mode-appropriate {@link SchemaSink}.
+ * Unlike {@link getSingleTenantMetaDriver}, a multi-tenant profile is fully
+ * supported: DDL/RLS route through the tenant self-service endpoints using the
+ * per-tenant service_role key (Kong injects the trusted X-Tenant-Id).
+ */
+export declare function getSchemaSink(role?: "anon" | "service_role"): Promise<SchemaSink>;
+/**
+ * Apply a raw SQL script through an injected executor (single-tenant legacy
+ * path). Schema substitution uses the single-tenant rule; RLS statements are
+ * NOT diverted (they run verbatim through the executor). For mode-aware apply
+ * with RLS diversion use {@link applySchema}.
+ */
+export declare function applySqlStatements(rawSql: string, source: string, opts: ApplyOptions, executor: SqlExecutor): Promise<ApplyResult>;
+export interface ApplySchemaParams extends ApplyOptions {
+    rawSql: string;
+    source: string;
+    /** Parsed `db/rls.json` (preferred RLS source); null/absent → fall back to schema.sql. */
+    rls?: RlsJson | null;
+}
+/**
+ * Mode-aware apply used by `db push` and `app db-init`.
+ *
+ * - Splits the script, then (multi-tenant OR when rls.json is present) diverts
+ *   the embedded central-registry RLS INSERTs out of the raw-SQL stream.
+ * - RLS source: `db/rls.json` when present; else parsed from schema.sql
+ *   (multi-tenant) or left embedded (single-tenant legacy).
+ * - `__SCHEMA__`: single-tenant → --schema; multi-tenant → de-qualified.
+ * - Order: DDL/seed first (tables must exist), then RLS tables, then policies.
+ */
+export declare function applySchema(params: ApplySchemaParams, sink: SchemaSink): Promise<ApplyResult>;
+//# sourceMappingURL=apply-schema.d.ts.map

package/dist/db/apply-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-schema.d.ts","sourceRoot":"","sources":["../../src/db/apply-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EACL,UAAU,EAEV,KAAK,aAAa,EAClB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AAQjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAWL,KAAK,OAAO,EACb,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,OAAO,EAAE,CAAC;AAExB,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,WAAW,GAAG,YAAY,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,MAAM,CAAA;KAAE,CAAC;CACxF;AAED,oFAAoF;AACpF,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE5D,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,kCAAkC;IAClC,aAAa,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,4BAA4B;IAC5B,cAAc,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,iDAAiD;IACjD,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACnE,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACrE,uEAAuE;IACvE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACjE;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,GAAE,MAAM,GAAG,cAA+B,GAC7C,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,IAAI,GAAE,MAAM,GAAG,cAA+B,GAC7C,OAAO,CAAC,UAAU,CAAC,CAoGrB;AA8ID;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA0DnG"}

package/dist/db/apply-schema.js

@@ -0,0 +1,359 @@
+/**
+ * Schema apply engine shared by `pxbaas db push <file>` and `pxbaas app db-init <name>`.
+ *
+ * Two execution identities (chosen by profile.mode via {@link getSchemaSink}):
+ *   - single-tenant → MetaDriver `/pg/query` with the global service_role key
+ *     (that key IS the platform admin, so it can also write the central RLS
+ *     registry `supabase._mysqlrest_rls_*` directly).
+ *   - multi-tenant  → TenantDdlDriver `/api/tenant-ddl/*` with the per-tenant
+ *     service_role key. DDL/DML runs on the tenant's OWN database; RLS goes
+ *     through the structured endpoints (the tenant account has NO grant on the
+ *     shared `supabase` database, so a raw central INSERT would be denied).
+ *
+ * Safety contract (agreed design, unchanged):
+ *   - The plan (every step) is shown BEFORE anything runs.
+ *   - Execution requires explicit authorization: an interactive confirm, or
+ *     `--yes` for non-interactive use. `--dry-run` only previews.
+ *   - Steps run sequentially and STOP ON THE FIRST ERROR.
+ *   - No automatic rollback — already-applied steps stay applied.
+ *
+ * RLS source (see plan §5, decision R-C "hybrid"):
+ *   - a declarative `db/rls.json` is preferred when present;
+ *   - otherwise the `INSERT ... supabase._mysqlrest_rls_*` statements embedded in
+ *     schema.sql are parsed (multi-tenant) or run verbatim (single-tenant).
+ */
+import inquirer from "inquirer";
+import { MetaDriver, TenantDdlDriver, } from "@polardbx/pxbaas-client";
+import { CredentialStore, ProfileManager, formatError, formatSuccess, formatWarning, } from "../credentials/index.js";
+import { buildStatementPlan, partitionStatements, parseRlsPolicyInsert, parseRlsTableInsert, renderRlsPolicyInsert, renderRlsTableInsert, splitSqlStatements, substituteSchema, substituteSchemaForTenant, SCHEMA_PLACEHOLDER, } from "./sql-file.js";
+/**
+ * Resolve the active profile into a single-tenant MetaDriver.
+ * @throws when there is no profile, no credentials, or the profile is multi-tenant.
+ * @deprecated prefer {@link getSchemaSink}, which supports both modes. Kept for
+ * single-tenant callers and existing tests.
+ */
+export async function getSingleTenantMetaDriver(role = "service_role") {
+    const profileManager = new ProfileManager();
+    const profile = await profileManager.getCurrentProfile();
+    if (!profile) {
+        throw new Error('No active profile. Use "pxbaas login" to authenticate first.');
+    }
+    if (profile.mode === "multi-tenant") {
+        throw new Error("Multi-tenant DDL is not supported by this command. In multi-tenant mode run DDL " +
+            "via POST {endpoint}/pg/query using the GLOBAL service_role key with fully-qualified " +
+            "tenant_<id>.<table> names (per-tenant keys are rejected 401 on /pg/query).");
+    }
+    const credentials = await new CredentialStore().getCredentials(profile.name);
+    if (!credentials) {
+        throw new Error(`No credentials found for profile: ${profile.name}. Use "pxbaas login" to authenticate.`);
+    }
+    const driver = new MetaDriver({
+        endpoint: profile.endpoint,
+        anonKey: credentials.anonKey,
+        serviceRoleKey: credentials.serviceRoleKey,
+        tenantId: profile.tenantId,
+    });
+    return { driver, useServiceRole: role === "service_role", profileName: profile.name };
+}
+/**
+ * Resolve the active profile into a mode-appropriate {@link SchemaSink}.
+ * Unlike {@link getSingleTenantMetaDriver}, a multi-tenant profile is fully
+ * supported: DDL/RLS route through the tenant self-service endpoints using the
+ * per-tenant service_role key (Kong injects the trusted X-Tenant-Id).
+ */
+export async function getSchemaSink(role = "service_role") {
+    const profileManager = new ProfileManager();
+    const profile = await profileManager.getCurrentProfile();
+    if (!profile) {
+        throw new Error('No active profile. Use "pxbaas login" to authenticate first.');
+    }
+    const credentials = await new CredentialStore().getCredentials(profile.name);
+    if (!credentials) {
+        throw new Error(`No credentials found for profile: ${profile.name}. Use "pxbaas login" to authenticate.`);
+    }
+    if (profile.mode === "multi-tenant") {
+        if (!profile.tenantId) {
+            throw new Error('Multi-tenant profile is missing tenantId; re-run "pxbaas login --tenant-id <id>" ' +
+                "with this tenant's per-tenant anon/service keys.");
+        }
+        // Only the per-tenant service_role key is accepted by /api/tenant-ddl (the
+        // resolver role-gates on service_role). Kong injects X-Tenant-Id from the JWT.
+        const driver = new TenantDdlDriver({
+            endpoint: profile.endpoint,
+            serviceRoleKey: credentials.serviceRoleKey,
+        });
+        return {
+            mode: "multi-tenant",
+            profileName: profile.name,
+            runStatement: (sql) => driver.query(sql),
+            applyRlsTable: (input) => driver.upsertRlsTable(input),
+            applyRlsPolicy: (input) => driver.upsertRlsPolicy(input),
+            renderRlsTable: (input) => `RLS ${input.rls_forced ? "FORCE" : "ENABLE"} ${input.table_name}`,
+            renderRlsPolicy: (input) => `RLS POLICY ${input.policy_name} ON ${input.table_name} ` +
+                `[${(input.command ?? "ALL").toString().toUpperCase()} / ${input.role_name ?? "*"}]`,
+            dropTable: (table) => driver.query(`DROP TABLE IF EXISTS ${quoteIdent(table)}`),
+            purgeRlsForTable: async (table) => {
+                assertSafeIdent(table);
+                const policies = await driver.listRlsPolicies(table);
+                for (const p of policies)
+                    await driver.deleteRlsPolicy(table, p.policy_name);
+                // Remove the central toggle row via DELETE /rls/tables. Tolerate instances
+                // that predate the endpoint (it 404/405s): degrade to leaving the benign
+                // row rather than failing the whole purge.
+                let toggleRemoved = false;
+                try {
+                    await driver.deleteRlsTable(table);
+                    toggleRemoved = true;
+                }
+                catch {
+                    toggleRemoved = false;
+                }
+                return { policiesDeleted: policies.length, toggleRemoved };
+            },
+        };
+    }
+    const driver = new MetaDriver({
+        endpoint: profile.endpoint,
+        anonKey: credentials.anonKey,
+        serviceRoleKey: credentials.serviceRoleKey,
+        tenantId: profile.tenantId,
+    });
+    const useServiceRole = role === "service_role";
+    return {
+        mode: "single-tenant",
+        profileName: profile.name,
+        runStatement: (sql) => driver.query(sql, useServiceRole),
+        // Single-tenant: the service_role key is the platform admin, so RLS is
+        // written straight into the central registry via /pg/query.
+        applyRlsTable: (input, ctx) => driver.query(renderRlsTableInsert(ctx.schema, input), useServiceRole),
+        applyRlsPolicy: (input, ctx) => driver.query(renderRlsPolicyInsert(ctx.schema, input), useServiceRole),
+        renderRlsTable: (input, ctx) => renderRlsTableInsert(ctx.schema, input),
+        renderRlsPolicy: (input, ctx) => renderRlsPolicyInsert(ctx.schema, input),
+        dropTable: (table, ctx) => driver.query(`DROP TABLE IF EXISTS ${quoteIdent(ctx.schema)}.${quoteIdent(table)}`, useServiceRole),
+        purgeRlsForTable: async (table, ctx) => {
+            assertSafeIdent(table);
+            const schemaLit = sqlQuote(ctx.schema);
+            const tableLit = sqlQuote(table);
+            const found = await driver.query(`SELECT policy_name FROM supabase._mysqlrest_rls_policies ` +
+                `WHERE table_schema = '${schemaLit}' AND table_name = '${tableLit}'`, useServiceRole);
+            const names = found.rows.map((r) => String(r.policy_name));
+            for (const pn of names) {
+                await driver.query(`DELETE FROM supabase._mysqlrest_rls_policies WHERE table_schema = '${schemaLit}' ` +
+                    `AND table_name = '${tableLit}' AND policy_name = '${sqlQuote(pn)}'`, useServiceRole);
+            }
+            await driver.query(`DELETE FROM supabase._mysqlrest_rls_tables WHERE table_schema = '${schemaLit}' AND table_name = '${tableLit}'`, useServiceRole);
+            return { policiesDeleted: names.length, toggleRemoved: true };
+        },
+    };
+}
+const SAFE_IDENT_RE = /^[A-Za-z0-9_]+$/;
+/** Reject anything but a bare identifier before interpolating into DDL. */
+function assertSafeIdent(name) {
+    if (!SAFE_IDENT_RE.test(name) || name.length > 64) {
+        throw new Error(`Unsafe table identifier refused: '${name}'`);
+    }
+}
+/** Backtick-quote a validated identifier. */
+function quoteIdent(name) {
+    assertSafeIdent(name);
+    return `\`${name}\``;
+}
+/** Escape a single-quoted SQL string literal. */
+function sqlQuote(value) {
+    return String(value).replace(/'/g, "''");
+}
+/**
+ * Shared show-plan → authorize → execute-sequentially (stop on first error) core.
+ * Used by both {@link applySqlStatements} and {@link applySchema} so the safety
+ * contract lives in exactly one place.
+ */
+async function executePlan(params) {
+    const { items, opts, source } = params;
+    const skippedAll = () => items.map((it, i) => ({ index: i + 1, sql: it.label, kind: it.kind, status: "skipped" }));
+    const envelope = (partial, statements) => ({
+        source,
+        schema: opts.schema,
+        total: partial.total,
+        executed: partial.executed,
+        failed: partial.failed,
+        dryRun: partial.dryRun,
+        authorized: partial.authorized,
+        statements,
+        ...(params.mode ? { mode: params.mode } : {}),
+        ...(params.rls ? { rls: params.rls } : {}),
+    });
+    if (items.length === 0) {
+        if (!opts.json) {
+            console.log(formatWarning(`No executable statements found in ${source}.`));
+        }
+        return envelope({ total: 0, executed: 0, failed: 0, dryRun: opts.dryRun, authorized: false }, []);
+    }
+    // 1) Show the plan (text mode). JSON callers receive the structured result.
+    if (!opts.json) {
+        console.log(formatSuccess(`Plan for ${source} (schema: ${opts.schema})`));
+        for (const w of params.preWarnings ?? [])
+            console.log(formatWarning(w));
+        items.forEach((it, i) => {
+            console.log(`\n[${i + 1}/${items.length}] ${it.label}`);
+        });
+        console.log("");
+    }
+    // 2) Dry run: preview only.
+    if (opts.dryRun) {
+        if (!opts.json) {
+            console.log(formatWarning(`Dry run: 0 of ${items.length} statement(s) executed.`));
+        }
+        return envelope({ total: items.length, executed: 0, failed: 0, dryRun: true, authorized: false }, skippedAll());
+    }
+    // 3) Authorization gate.
+    const authorized = await authorize(items.length, opts);
+    if (!authorized) {
+        if (!opts.json) {
+            console.log(formatWarning("Aborted by operator; nothing was executed."));
+        }
+        return envelope({ total: items.length, executed: 0, failed: 0, dryRun: false, authorized: false }, skippedAll());
+    }
+    // 4) Execute sequentially; stop on the first error; no rollback.
+    const results = [];
+    let executed = 0;
+    let failed = 0;
+    for (let i = 0; i < items.length; i++) {
+        const item = items[i];
+        const r = { index: i + 1, sql: item.label, kind: item.kind, status: "pending" };
+        results.push(r);
+        try {
+            await item.exec();
+            r.status = "ok";
+            executed++;
+            if (!opts.json)
+                console.log(formatSuccess(`[${i + 1}/${items.length}] ok`));
+        }
+        catch (e) {
+            r.status = "failed";
+            r.error = e instanceof Error ? e.message : String(e);
+            failed++;
+            if (!opts.json) {
+                console.error(formatError(`[${i + 1}/${items.length}] failed: ${r.error}`));
+            }
+            for (let j = i + 1; j < items.length; j++) {
+                results.push({ index: j + 1, sql: items[j].label, kind: items[j].kind, status: "skipped" });
+            }
+            break;
+        }
+    }
+    if (!opts.json) {
+        console.log("");
+        if (failed === 0) {
+            console.log(formatSuccess(`Applied ${executed}/${items.length} statement(s) to schema '${opts.schema}'.`));
+        }
+        else {
+            console.log(formatError(`Stopped after failure: ${executed} ok, ${failed} failed, ` +
+                `${items.length - executed - failed} skipped. No rollback performed.`));
+        }
+    }
+    return envelope({ total: items.length, executed, failed, dryRun: false, authorized: true }, results);
+}
+/**
+ * Apply a raw SQL script through an injected executor (single-tenant legacy
+ * path). Schema substitution uses the single-tenant rule; RLS statements are
+ * NOT diverted (they run verbatim through the executor). For mode-aware apply
+ * with RLS diversion use {@link applySchema}.
+ */
+export async function applySqlStatements(rawSql, source, opts, executor) {
+    const { statements, substituted } = buildStatementPlan(rawSql, opts.schema);
+    const items = statements.map((sql) => ({
+        label: sql,
+        kind: "sql",
+        exec: () => executor(sql),
+    }));
+    const preWarnings = substituted
+        ? []
+        : [`Script contains no ${SCHEMA_PLACEHOLDER} placeholder; --schema has no effect.`];
+    return executePlan({ items, opts, source, preWarnings });
+}
+/**
+ * Mode-aware apply used by `db push` and `app db-init`.
+ *
+ * - Splits the script, then (multi-tenant OR when rls.json is present) diverts
+ *   the embedded central-registry RLS INSERTs out of the raw-SQL stream.
+ * - RLS source: `db/rls.json` when present; else parsed from schema.sql
+ *   (multi-tenant) or left embedded (single-tenant legacy).
+ * - `__SCHEMA__`: single-tenant → --schema; multi-tenant → de-qualified.
+ * - Order: DDL/seed first (tables must exist), then RLS tables, then policies.
+ */
+export async function applySchema(params, sink) {
+    const statements = splitSqlStatements(params.rawSql);
+    const { rlsTableInserts, rlsPolicyInserts, plain } = partitionStatements(statements);
+    const embeddedRlsCount = rlsTableInserts.length + rlsPolicyInserts.length;
+    const rls = params.rls;
+    const hasRlsJson = Boolean(rls && (rls.tables.length > 0 || rls.policies.length > 0));
+    // Single-tenant without rls.json keeps the legacy behavior: run schema.sql
+    // verbatim (embedded RLS INSERTs work through the admin /pg/query channel).
+    const divertEmbedded = sink.mode === "multi-tenant" || hasRlsJson;
+    const rawRun = divertEmbedded ? plain : statements;
+    const preWarnings = [];
+    let tables = [];
+    let policies = [];
+    let rlsSource = "none";
+    if (hasRlsJson) {
+        tables = rls.tables;
+        policies = rls.policies;
+        rlsSource = "rls.json";
+        if (embeddedRlsCount > 0) {
+            preWarnings.push(`db/rls.json is present — ignoring ${embeddedRlsCount} RLS INSERT statement(s) embedded ` +
+                `in ${params.source} to keep a single source of truth.`);
+        }
+    }
+    else if (sink.mode === "multi-tenant") {
+        tables = rlsTableInserts.flatMap(parseRlsTableInsert);
+        policies = rlsPolicyInserts.flatMap(parseRlsPolicyInsert);
+        rlsSource = tables.length || policies.length ? "schema.sql" : "none";
+    }
+    const substitute = (sql) => sink.mode === "multi-tenant" ? substituteSchemaForTenant(sql) : substituteSchema(sql, params.schema);
+    const ctx = { schema: params.schema };
+    const items = [];
+    for (const sql of rawRun) {
+        const rendered = substitute(sql);
+        items.push({ label: rendered, kind: "sql", exec: () => sink.runStatement(rendered) });
+    }
+    for (const t of tables) {
+        items.push({ label: sink.renderRlsTable(t, ctx), kind: "rls-table", exec: () => sink.applyRlsTable(t, ctx) });
+    }
+    for (const p of policies) {
+        items.push({ label: sink.renderRlsPolicy(p, ctx), kind: "rls-policy", exec: () => sink.applyRlsPolicy(p, ctx) });
+    }
+    return executePlan({
+        items,
+        opts: params,
+        source: params.source,
+        preWarnings,
+        mode: sink.mode,
+        rls: { tables: tables.length, policies: policies.length, source: rlsSource },
+    });
+}
+/**
+ * Decide whether execution is authorized. `--yes` authorizes outright; JSON mode
+ * and non-TTY sessions cannot prompt, so they require `--yes` explicitly.
+ */
+async function authorize(count, opts) {
+    if (opts.assumeYes)
+        return true;
+    if (opts.json) {
+        throw new Error("Refusing to run DDL in --json mode without explicit authorization. " +
+            "Re-run with --yes to apply, or --dry-run to preview only.");
+    }
+    if (!process.stdin.isTTY) {
+        throw new Error("Refusing to run DDL without explicit authorization: pass --yes for " +
+            "non-interactive use, or run in a TTY to confirm.");
+    }
+    const { ok } = await inquirer.prompt([
+        {
+            type: "confirm",
+            name: "ok",
+            message: `Execute ${count} statement(s) against schema '${opts.schema}'? (no automatic rollback)`,
+            default: false,
+        },
+    ]);
+    return ok;
+}
+//# sourceMappingURL=apply-schema.js.map

package/dist/db/apply-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-schema.js","sourceRoot":"","sources":["../../src/db/apply-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,UAAU,EACV,eAAe,GAGhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AAgFvB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgC,cAAc;IAE9C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,sFAAsF;YACtF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,CAAC,IAAI,uCAAuC,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgC,cAAc;IAE9C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,CAAC,IAAI,uCAAuC,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,mFAAmF;gBACjF,kDAAkD,CACrD,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,+EAA+E;QAC/E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,cAAc,EAAE,WAAW,CAAC,cAAc;SAC3C,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;YACxC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC;YACtD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC;YACxD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CACxB,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE;YACpE,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CACzB,cAAc,KAAK,CAAC,WAAW,OAAO,KAAK,CAAC,UAAU,GAAG;gBACzD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG;YACtF,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/E,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBAChC,eAAe,CAAC,KAAK,CAAC,CAAC;gBACvB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBACrD,KAAK,MAAM,CAAC,IAAI,QAAQ;oBAAE,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC7E,2EAA2E;gBAC3E,yEAAyE;gBACzE,2CAA2C;gBAC3C,IAAI,aAAa,GAAG,KAAK,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;oBACnC,aAAa,GAAG,IAAI,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa,GAAG,KAAK,CAAC;gBACxB,CAAC;gBACD,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;YAC7D,CAAC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,KAAK,cAAc,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;QACxD,uEAAuE;QACvE,4DAA4D;QAC5D,aAAa,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC;QACpG,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC;QACtG,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QACvE,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QACzE,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,MAAM,CAAC,KAAK,CAAC,wBAAwB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC;QACrG,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B,2DAA2D;gBACzD,yBAAyB,SAAS,uBAAuB,QAAQ,GAAG,EACtE,cAAc,CACf,CAAC;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,MAAM,CAAC,KAAK,CAChB,sEAAsE,SAAS,IAAI;oBACjF,qBAAqB,QAAQ,wBAAwB,QAAQ,CAAC,EAAE,CAAC,GAAG,EACtE,cAAc,CACf,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAChB,oEAAoE,SAAS,uBAAuB,QAAQ,GAAG,EAC/G,cAAc,CACf,CAAC;YACF,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,2EAA2E;AAC3E,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,6CAA6C;AAC7C,SAAS,UAAU,CAAC,IAAY;IAC9B,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,iDAAiD;AACjD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAiBD;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,MAAyB;IAClD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACvC,MAAM,UAAU,GAAG,GAAsB,EAAE,CACzC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,CACf,OAAqF,EACrF,UAA6B,EAChB,EAAE,CAAC,CAAC;QACjB,MAAM;QACN,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU;QACV,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,qCAAqC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,MAAM,aAAa,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,4BAA4B;IAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,iBAAiB,KAAK,CAAC,MAAM,yBAAyB,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,4CAA4C,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,iEAAiE;IACjE,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,CAAC,GAAoB,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;YAChB,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC,CAAC,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC9E,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,QAAQ,IAAI,KAAK,CAAC,MAAM,4BAA4B,IAAI,CAAC,MAAM,IAAI,CAAC,CAC9F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,WAAW,CACT,0BAA0B,QAAQ,QAAQ,MAAM,WAAW;gBACzD,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,GAAG,MAAM,kCAAkC,CACxE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;AACvG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,MAAc,EACd,IAAkB,EAClB,QAAqB;IAErB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAe,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACjD,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,KAAc;QACpB,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;KAC1B,CAAC,CAAC,CAAC;IACJ,MAAM,WAAW,GAAG,WAAW;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,sBAAsB,kBAAkB,uCAAuC,CAAC,CAAC;IACtF,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAC3D,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB,EAAE,IAAgB;IAC3E,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACrF,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAE1E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAEtF,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,UAAU,CAAC;IAClE,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAEnD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,MAAM,GAAoB,EAAE,CAAC;IACjC,IAAI,QAAQ,GAAqB,EAAE,CAAC;IACpC,IAAI,SAAS,GAAuC,MAAM,CAAC;IAE3D,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAI,CAAC,MAAM,CAAC;QACrB,QAAQ,GAAG,GAAI,CAAC,QAAQ,CAAC;QACzB,SAAS,GAAG,UAAU,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CACd,qCAAqC,gBAAgB,oCAAoC;gBACvF,MAAM,MAAM,CAAC,MAAM,oCAAoC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACtD,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC1D,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CACjC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACvG,MAAM,GAAG,GAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,OAAO,WAAW,CAAC;QACjB,KAAK;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,IAAkB;IACxD,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAkB;QACpD;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,WAAW,KAAK,iCAAiC,IAAI,CAAC,MAAM,4BAA4B;YACjG,OAAO,EAAE,KAAK;SACf;KACF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/db/introspect.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Schema introspection shared by `db tables`, `db schema`, and `gen types`.
+ *
+ * Why this exists (fixes defect C1): those three commands used the Meta API
+ * (`MetaDriver` -> `/pg/*`) unconditionally. In multi-tenant mode `/pg/*` only
+ * accepts the platform/global service_role key, so a per-tenant key is rejected
+ * with 401 (`Authentication failed`) — even though the same credentials work for
+ * `db query` (which already routes through tenant-ddl), `data *` (REST), and
+ * `storage`. See `db/apply-schema.ts` ("per-tenant keys are rejected 401 on
+ * /pg/query").
+ *
+ * The fix keeps single-tenant behavior EXACTLY as before (Meta API) and adds a
+ * multi-tenant path that runs the same portable `information_schema` queries
+ * through `TenantDdlDriver` (which the tenant key CAN call). The introspection
+ * SQL is backend-agnostic, so it is factored into pure functions that take an
+ * injectable `SqlRunner` — trivial to unit-test without a network.
+ */
+import { type TableInfo, type TableColumn, type TableIndex } from '@polardbx/pxbaas-client';
+/** Runs a SELECT and returns bare rows. Backed by MetaDriver (single-tenant
+ *  `/pg/query`) or TenantDdlDriver (multi-tenant `/api/tenant-ddl/query`). */
+export type SqlRunner = (sql: string) => Promise<Record<string, unknown>[]>;
+/** List tables/views via information_schema (portable across both drivers). */
+export declare function listTablesViaSql(run: SqlRunner, schema?: string): Promise<TableInfo[]>;
+/** List a table's columns via information_schema (mirrors MetaDriver SQL). */
+export declare function getTableColumnsViaSql(run: SqlRunner, table: string, schema?: string): Promise<TableColumn[]>;
+/** List a table's indexes via information_schema (mirrors MetaDriver SQL). */
+export declare function getTableIndexesViaSql(run: SqlRunner, table: string, schema?: string): Promise<TableIndex[]>;
+/** A schema introspector bound to the correct backend for the profile's mode. */
+export interface SchemaIntrospector {
+    /** Human label for the schema being introspected (tenant db in multi-tenant). */
+    currentSchema(): Promise<string>;
+    listTables(): Promise<TableInfo[]>;
+    getColumns(table: string): Promise<TableColumn[]>;
+    getIndexes(table: string): Promise<TableIndex[]>;
+}
+export interface MakeIntrospectorOptions {
+    /** Profile mode; 'multi-tenant' routes through tenant-ddl, else Meta API. */
+    mode?: string;
+    endpoint: string;
+    anonKey: string;
+    serviceRoleKey?: string;
+    tenantId?: string;
+    /** Single-tenant explicit schema (default 'public'). Ignored in multi-tenant. */
+    schema?: string;
+    /** Single-tenant: use the service_role key for Meta API reads (default true). */
+    useServiceRole?: boolean;
+}
+/**
+ * Build the mode-appropriate introspector.
+ * - multi-tenant: TenantDdlDriver + information_schema scoped to DATABASE().
+ * - single-tenant: the existing MetaDriver behavior, unchanged.
+ */
+export declare function makeIntrospector(opts: MakeIntrospectorOptions): SchemaIntrospector;
+//# sourceMappingURL=introspect.d.ts.map

package/dist/db/introspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect.d.ts","sourceRoot":"","sources":["../../src/db/introspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AAEjC;8EAC8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;AAuB5E,+EAA+E;AAC/E,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,SAAS,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,EAAE,CAAC,CAetB;AAED,8EAA8E;AAC9E,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,WAAW,EAAE,CAAC,CAmBxB;AAED,8EAA8E;AAC9E,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,EAAE,CAAC,CAiBvB;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,kBAAkB,CA+ClF"}