@polardbx/pxbaas 0.1.0-beta.1 → 0.1.0-beta.2

package/dist/db/apply-schema.js

@@ -1,23 +1,36 @@
 /**
- * Single-tenant schema apply engine shared by `pxbaas db push <file>` and
- * `pxbaas app db-init <name>`.
+ * Schema apply engine shared by `pxbaas db push <file>` and `pxbaas app db-init <name>`.
  *
- * Safety contract (agreed design):
- *   - The plan (every statement) is shown BEFORE anything runs.
+ * Two execution identities (chosen by profile.mode via {@link getSchemaSink}):
+ *   - single-tenant → MetaDriver `/pg/query` with the global service_role key
+ *     (that key IS the platform admin, so it can also write the central RLS
+ *     registry `supabase._mysqlrest_rls_*` directly).
+ *   - multi-tenant  → TenantDdlDriver `/api/tenant-ddl/*` with the per-tenant
+ *     service_role key. DDL/DML runs on the tenant's OWN database; RLS goes
+ *     through the structured endpoints (the tenant account has NO grant on the
+ *     shared `supabase` database, so a raw central INSERT would be denied).
+ *
+ * Safety contract (agreed design, unchanged):
+ *   - The plan (every step) is shown BEFORE anything runs.
  *   - Execution requires explicit authorization: an interactive confirm, or
  *     `--yes` for non-interactive use. `--dry-run` only previews.
- *   - Statements run sequentially and STOP ON THE FIRST ERROR.
- *   - No automatic rollback — already-applied statements stay applied.
- *   - Multi-tenant profiles are rejected: tenant DDL is out of scope (it needs
- *     the global service_role key via POST /pg/query with tenant_<id>.<table>).
+ *   - Steps run sequentially and STOP ON THE FIRST ERROR.
+ *   - No automatic rollback — already-applied steps stay applied.
+ *
+ * RLS source (see plan §5, decision R-C "hybrid"):
+ *   - a declarative `db/rls.json` is preferred when present;
+ *   - otherwise the `INSERT ... supabase._mysqlrest_rls_*` statements embedded in
+ *     schema.sql are parsed (multi-tenant) or run verbatim (single-tenant).
  */
 import inquirer from "inquirer";
-import { MetaDriver } from "@polardbx/pxbaas-client";
+import { MetaDriver, TenantDdlDriver, } from "@polardbx/pxbaas-client";
 import { CredentialStore, ProfileManager, formatError, formatSuccess, formatWarning, } from "../credentials/index.js";
-import { buildStatementPlan, SCHEMA_PLACEHOLDER } from "./sql-file.js";
+import { buildStatementPlan, partitionStatements, parseRlsPolicyInsert, parseRlsTableInsert, renderRlsPolicyInsert, renderRlsTableInsert, splitSqlStatements, substituteSchema, substituteSchemaForTenant, SCHEMA_PLACEHOLDER, } from "./sql-file.js";
 /**
  * Resolve the active profile into a single-tenant MetaDriver.
  * @throws when there is no profile, no credentials, or the profile is multi-tenant.
+ * @deprecated prefer {@link getSchemaSink}, which supports both modes. Kept for
+ * single-tenant callers and existing tests.
  */
 export async function getSingleTenantMetaDriver(role = "service_role") {
     const profileManager = new ProfileManager();
@@ -43,102 +56,187 @@ export async function getSingleTenantMetaDriver(role = "service_role") {
     return { driver, useServiceRole: role === "service_role", profileName: profile.name };
 }
 /**
- * Show the plan, obtain authorization, then apply statements sequentially with
- * stop-on-first-error semantics. Never rolls back.
+ * Resolve the active profile into a mode-appropriate {@link SchemaSink}.
+ * Unlike {@link getSingleTenantMetaDriver}, a multi-tenant profile is fully
+ * supported: DDL/RLS route through the tenant self-service endpoints using the
+ * per-tenant service_role key (Kong injects the trusted X-Tenant-Id).
  */
-export async function applySqlStatements(rawSql, source, opts, executor) {
-    const { statements, substituted } = buildStatementPlan(rawSql, opts.schema);
-    if (statements.length === 0) {
-        if (!opts.json) {
-            console.log(formatWarning(`No executable statements found in ${source}.`));
+export async function getSchemaSink(role = "service_role") {
+    const profileManager = new ProfileManager();
+    const profile = await profileManager.getCurrentProfile();
+    if (!profile) {
+        throw new Error('No active profile. Use "pxbaas login" to authenticate first.');
+    }
+    const credentials = await new CredentialStore().getCredentials(profile.name);
+    if (!credentials) {
+        throw new Error(`No credentials found for profile: ${profile.name}. Use "pxbaas login" to authenticate.`);
+    }
+    if (profile.mode === "multi-tenant") {
+        if (!profile.tenantId) {
+            throw new Error('Multi-tenant profile is missing tenantId; re-run "pxbaas login --tenant-id <id>" ' +
+                "with this tenant's per-tenant anon/service keys.");
         }
+        // Only the per-tenant service_role key is accepted by /api/tenant-ddl (the
+        // resolver role-gates on service_role). Kong injects X-Tenant-Id from the JWT.
+        const driver = new TenantDdlDriver({
+            endpoint: profile.endpoint,
+            serviceRoleKey: credentials.serviceRoleKey,
+        });
         return {
-            source,
-            schema: opts.schema,
-            total: 0,
-            executed: 0,
-            failed: 0,
-            dryRun: opts.dryRun,
-            authorized: false,
-            statements: [],
+            mode: "multi-tenant",
+            profileName: profile.name,
+            runStatement: (sql) => driver.query(sql),
+            applyRlsTable: (input) => driver.upsertRlsTable(input),
+            applyRlsPolicy: (input) => driver.upsertRlsPolicy(input),
+            renderRlsTable: (input) => `RLS ${input.rls_forced ? "FORCE" : "ENABLE"} ${input.table_name}`,
+            renderRlsPolicy: (input) => `RLS POLICY ${input.policy_name} ON ${input.table_name} ` +
+                `[${(input.command ?? "ALL").toString().toUpperCase()} / ${input.role_name ?? "*"}]`,
+            dropTable: (table) => driver.query(`DROP TABLE IF EXISTS ${quoteIdent(table)}`),
+            purgeRlsForTable: async (table) => {
+                assertSafeIdent(table);
+                const policies = await driver.listRlsPolicies(table);
+                for (const p of policies)
+                    await driver.deleteRlsPolicy(table, p.policy_name);
+                // Remove the central toggle row via DELETE /rls/tables. Tolerate instances
+                // that predate the endpoint (it 404/405s): degrade to leaving the benign
+                // row rather than failing the whole purge.
+                let toggleRemoved = false;
+                try {
+                    await driver.deleteRlsTable(table);
+                    toggleRemoved = true;
+                }
+                catch {
+                    toggleRemoved = false;
+                }
+                return { policiesDeleted: policies.length, toggleRemoved };
+            },
         };
     }
+    const driver = new MetaDriver({
+        endpoint: profile.endpoint,
+        anonKey: credentials.anonKey,
+        serviceRoleKey: credentials.serviceRoleKey,
+        tenantId: profile.tenantId,
+    });
+    const useServiceRole = role === "service_role";
+    return {
+        mode: "single-tenant",
+        profileName: profile.name,
+        runStatement: (sql) => driver.query(sql, useServiceRole),
+        // Single-tenant: the service_role key is the platform admin, so RLS is
+        // written straight into the central registry via /pg/query.
+        applyRlsTable: (input, ctx) => driver.query(renderRlsTableInsert(ctx.schema, input), useServiceRole),
+        applyRlsPolicy: (input, ctx) => driver.query(renderRlsPolicyInsert(ctx.schema, input), useServiceRole),
+        renderRlsTable: (input, ctx) => renderRlsTableInsert(ctx.schema, input),
+        renderRlsPolicy: (input, ctx) => renderRlsPolicyInsert(ctx.schema, input),
+        dropTable: (table, ctx) => driver.query(`DROP TABLE IF EXISTS ${quoteIdent(ctx.schema)}.${quoteIdent(table)}`, useServiceRole),
+        purgeRlsForTable: async (table, ctx) => {
+            assertSafeIdent(table);
+            const schemaLit = sqlQuote(ctx.schema);
+            const tableLit = sqlQuote(table);
+            const found = await driver.query(`SELECT policy_name FROM supabase._mysqlrest_rls_policies ` +
+                `WHERE table_schema = '${schemaLit}' AND table_name = '${tableLit}'`, useServiceRole);
+            const names = found.rows.map((r) => String(r.policy_name));
+            for (const pn of names) {
+                await driver.query(`DELETE FROM supabase._mysqlrest_rls_policies WHERE table_schema = '${schemaLit}' ` +
+                    `AND table_name = '${tableLit}' AND policy_name = '${sqlQuote(pn)}'`, useServiceRole);
+            }
+            await driver.query(`DELETE FROM supabase._mysqlrest_rls_tables WHERE table_schema = '${schemaLit}' AND table_name = '${tableLit}'`, useServiceRole);
+            return { policiesDeleted: names.length, toggleRemoved: true };
+        },
+    };
+}
+const SAFE_IDENT_RE = /^[A-Za-z0-9_]+$/;
+/** Reject anything but a bare identifier before interpolating into DDL. */
+function assertSafeIdent(name) {
+    if (!SAFE_IDENT_RE.test(name) || name.length > 64) {
+        throw new Error(`Unsafe table identifier refused: '${name}'`);
+    }
+}
+/** Backtick-quote a validated identifier. */
+function quoteIdent(name) {
+    assertSafeIdent(name);
+    return `\`${name}\``;
+}
+/** Escape a single-quoted SQL string literal. */
+function sqlQuote(value) {
+    return String(value).replace(/'/g, "''");
+}
+/**
+ * Shared show-plan → authorize → execute-sequentially (stop on first error) core.
+ * Used by both {@link applySqlStatements} and {@link applySchema} so the safety
+ * contract lives in exactly one place.
+ */
+async function executePlan(params) {
+    const { items, opts, source } = params;
+    const skippedAll = () => items.map((it, i) => ({ index: i + 1, sql: it.label, kind: it.kind, status: "skipped" }));
+    const envelope = (partial, statements) => ({
+        source,
+        schema: opts.schema,
+        total: partial.total,
+        executed: partial.executed,
+        failed: partial.failed,
+        dryRun: partial.dryRun,
+        authorized: partial.authorized,
+        statements,
+        ...(params.mode ? { mode: params.mode } : {}),
+        ...(params.rls ? { rls: params.rls } : {}),
+    });
+    if (items.length === 0) {
+        if (!opts.json) {
+            console.log(formatWarning(`No executable statements found in ${source}.`));
+        }
+        return envelope({ total: 0, executed: 0, failed: 0, dryRun: opts.dryRun, authorized: false }, []);
+    }
     // 1) Show the plan (text mode). JSON callers receive the structured result.
     if (!opts.json) {
         console.log(formatSuccess(`Plan for ${source} (schema: ${opts.schema})`));
-        if (!substituted) {
-            console.log(formatWarning(`Script contains no ${SCHEMA_PLACEHOLDER} placeholder; --schema has no effect.`));
-        }
-        statements.forEach((sql, i) => {
-            console.log(`\n[${i + 1}/${statements.length}] ${sql}`);
+        for (const w of params.preWarnings ?? [])
+            console.log(formatWarning(w));
+        items.forEach((it, i) => {
+            console.log(`\n[${i + 1}/${items.length}] ${it.label}`);
         });
         console.log("");
     }
     // 2) Dry run: preview only.
     if (opts.dryRun) {
         if (!opts.json) {
-            console.log(formatWarning(`Dry run: 0 of ${statements.length} statement(s) executed.`));
+            console.log(formatWarning(`Dry run: 0 of ${items.length} statement(s) executed.`));
         }
-        return {
-            source,
-            schema: opts.schema,
-            total: statements.length,
-            executed: 0,
-            failed: 0,
-            dryRun: true,
-            authorized: false,
-            statements: statements.map((sql, i) => ({
-                index: i + 1,
-                sql,
-                status: "skipped",
-            })),
-        };
+        return envelope({ total: items.length, executed: 0, failed: 0, dryRun: true, authorized: false }, skippedAll());
     }
     // 3) Authorization gate.
-    const authorized = await authorize(statements.length, opts);
+    const authorized = await authorize(items.length, opts);
     if (!authorized) {
         if (!opts.json) {
             console.log(formatWarning("Aborted by operator; nothing was executed."));
         }
-        return {
-            source,
-            schema: opts.schema,
-            total: statements.length,
-            executed: 0,
-            failed: 0,
-            dryRun: false,
-            authorized: false,
-            statements: statements.map((sql, i) => ({
-                index: i + 1,
-                sql,
-                status: "skipped",
-            })),
-        };
+        return envelope({ total: items.length, executed: 0, failed: 0, dryRun: false, authorized: false }, skippedAll());
     }
     // 4) Execute sequentially; stop on the first error; no rollback.
     const results = [];
     let executed = 0;
     let failed = 0;
-    for (let i = 0; i < statements.length; i++) {
-        const sql = statements[i];
-        const r = { index: i + 1, sql, status: "pending" };
+    for (let i = 0; i < items.length; i++) {
+        const item = items[i];
+        const r = { index: i + 1, sql: item.label, kind: item.kind, status: "pending" };
         results.push(r);
         try {
-            await executor(sql);
+            await item.exec();
             r.status = "ok";
             executed++;
             if (!opts.json)
-                console.log(formatSuccess(`[${i + 1}/${statements.length}] ok`));
+                console.log(formatSuccess(`[${i + 1}/${items.length}] ok`));
         }
         catch (e) {
             r.status = "failed";
             r.error = e instanceof Error ? e.message : String(e);
             failed++;
             if (!opts.json) {
-                console.error(formatError(`[${i + 1}/${statements.length}] failed: ${r.error}`));
+                console.error(formatError(`[${i + 1}/${items.length}] failed: ${r.error}`));
             }
-            for (let j = i + 1; j < statements.length; j++) {
-                results.push({ index: j + 1, sql: statements[j], status: "skipped" });
+            for (let j = i + 1; j < items.length; j++) {
+                results.push({ index: j + 1, sql: items[j].label, kind: items[j].kind, status: "skipped" });
             }
             break;
         }
@@ -146,23 +244,92 @@ export async function applySqlStatements(rawSql, source, opts, executor) {
     if (!opts.json) {
         console.log("");
         if (failed === 0) {
-            console.log(formatSuccess(`Applied ${executed}/${statements.length} statement(s) to schema '${opts.schema}'.`));
+            console.log(formatSuccess(`Applied ${executed}/${items.length} statement(s) to schema '${opts.schema}'.`));
         }
         else {
             console.log(formatError(`Stopped after failure: ${executed} ok, ${failed} failed, ` +
-                `${statements.length - executed - failed} skipped. No rollback performed.`));
+                `${items.length - executed - failed} skipped. No rollback performed.`));
         }
     }
-    return {
-        source,
-        schema: opts.schema,
-        total: statements.length,
-        executed,
-        failed,
-        dryRun: false,
-        authorized: true,
-        statements: results,
-    };
+    return envelope({ total: items.length, executed, failed, dryRun: false, authorized: true }, results);
+}
+/**
+ * Apply a raw SQL script through an injected executor (single-tenant legacy
+ * path). Schema substitution uses the single-tenant rule; RLS statements are
+ * NOT diverted (they run verbatim through the executor). For mode-aware apply
+ * with RLS diversion use {@link applySchema}.
+ */
+export async function applySqlStatements(rawSql, source, opts, executor) {
+    const { statements, substituted } = buildStatementPlan(rawSql, opts.schema);
+    const items = statements.map((sql) => ({
+        label: sql,
+        kind: "sql",
+        exec: () => executor(sql),
+    }));
+    const preWarnings = substituted
+        ? []
+        : [`Script contains no ${SCHEMA_PLACEHOLDER} placeholder; --schema has no effect.`];
+    return executePlan({ items, opts, source, preWarnings });
+}
+/**
+ * Mode-aware apply used by `db push` and `app db-init`.
+ *
+ * - Splits the script, then (multi-tenant OR when rls.json is present) diverts
+ *   the embedded central-registry RLS INSERTs out of the raw-SQL stream.
+ * - RLS source: `db/rls.json` when present; else parsed from schema.sql
+ *   (multi-tenant) or left embedded (single-tenant legacy).
+ * - `__SCHEMA__`: single-tenant → --schema; multi-tenant → de-qualified.
+ * - Order: DDL/seed first (tables must exist), then RLS tables, then policies.
+ */
+export async function applySchema(params, sink) {
+    const statements = splitSqlStatements(params.rawSql);
+    const { rlsTableInserts, rlsPolicyInserts, plain } = partitionStatements(statements);
+    const embeddedRlsCount = rlsTableInserts.length + rlsPolicyInserts.length;
+    const rls = params.rls;
+    const hasRlsJson = Boolean(rls && (rls.tables.length > 0 || rls.policies.length > 0));
+    // Single-tenant without rls.json keeps the legacy behavior: run schema.sql
+    // verbatim (embedded RLS INSERTs work through the admin /pg/query channel).
+    const divertEmbedded = sink.mode === "multi-tenant" || hasRlsJson;
+    const rawRun = divertEmbedded ? plain : statements;
+    const preWarnings = [];
+    let tables = [];
+    let policies = [];
+    let rlsSource = "none";
+    if (hasRlsJson) {
+        tables = rls.tables;
+        policies = rls.policies;
+        rlsSource = "rls.json";
+        if (embeddedRlsCount > 0) {
+            preWarnings.push(`db/rls.json is present — ignoring ${embeddedRlsCount} RLS INSERT statement(s) embedded ` +
+                `in ${params.source} to keep a single source of truth.`);
+        }
+    }
+    else if (sink.mode === "multi-tenant") {
+        tables = rlsTableInserts.flatMap(parseRlsTableInsert);
+        policies = rlsPolicyInserts.flatMap(parseRlsPolicyInsert);
+        rlsSource = tables.length || policies.length ? "schema.sql" : "none";
+    }
+    const substitute = (sql) => sink.mode === "multi-tenant" ? substituteSchemaForTenant(sql) : substituteSchema(sql, params.schema);
+    const ctx = { schema: params.schema };
+    const items = [];
+    for (const sql of rawRun) {
+        const rendered = substitute(sql);
+        items.push({ label: rendered, kind: "sql", exec: () => sink.runStatement(rendered) });
+    }
+    for (const t of tables) {
+        items.push({ label: sink.renderRlsTable(t, ctx), kind: "rls-table", exec: () => sink.applyRlsTable(t, ctx) });
+    }
+    for (const p of policies) {
+        items.push({ label: sink.renderRlsPolicy(p, ctx), kind: "rls-policy", exec: () => sink.applyRlsPolicy(p, ctx) });
+    }
+    return executePlan({
+        items,
+        opts: params,
+        source: params.source,
+        preWarnings,
+        mode: sink.mode,
+        rls: { tables: tables.length, policies: policies.length, source: rlsSource },
+    });
 }
 /**
  * Decide whether execution is authorized. `--yes` authorizes outright; JSON mode

package/dist/db/apply-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"apply-schema.js","sourceRoot":"","sources":["../../src/db/apply-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAkCvE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgC,cAAc;IAE9C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,sFAAsF;YACtF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,CAAC,IAAI,uCAAuC,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,MAAc,EACd,IAAkB,EAClB,QAAqB;IAErB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE5E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,qCAAqC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO;YACL,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,CAAC;YACR,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,EAAE;SACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,MAAM,aAAa,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,aAAa,CACX,sBAAsB,kBAAkB,uCAAuC,CAChF,CACF,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,4BAA4B;IAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,iBAAiB,UAAU,CAAC,MAAM,yBAAyB,CAAC,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,UAAU,CAAC,MAAM;YACxB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,KAAK,EAAE,CAAC,GAAG,CAAC;gBACZ,GAAG;gBACH,MAAM,EAAE,SAAkB;aAC3B,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,4CAA4C,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO;YACL,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,UAAU,CAAC,MAAM;YACxB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,KAAK,EAAE,CAAC,GAAG,CAAC;gBACZ,GAAG;gBACH,MAAM,EAAE,SAAkB;aAC3B,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAoB,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;YAChB,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC,CAAC,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CACX,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,aAAa,CACX,WAAW,QAAQ,IAAI,UAAU,CAAC,MAAM,4BAA4B,IAAI,CAAC,MAAM,IAAI,CACpF,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,WAAW,CACT,0BAA0B,QAAQ,QAAQ,MAAM,WAAW;gBACzD,GAAG,UAAU,CAAC,MAAM,GAAG,QAAQ,GAAG,MAAM,kCAAkC,CAC7E,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,UAAU,CAAC,MAAM;QACxB,QAAQ;QACR,MAAM;QACN,MAAM,EAAE,KAAK;QACb,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,OAAO;KACpB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,IAAkB;IACxD,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAkB;QACpD;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,WAAW,KAAK,iCAAiC,IAAI,CAAC,MAAM,4BAA4B;YACjG,OAAO,EAAE,KAAK;SACf;KACF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"apply-schema.js","sourceRoot":"","sources":["../../src/db/apply-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,UAAU,EACV,eAAe,GAGhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AAgFvB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgC,cAAc;IAE9C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,sFAAsF;YACtF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,CAAC,IAAI,uCAAuC,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgC,cAAc;IAE9C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,CAAC,IAAI,uCAAuC,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,mFAAmF;gBACjF,kDAAkD,CACrD,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,+EAA+E;QAC/E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,cAAc,EAAE,WAAW,CAAC,cAAc;SAC3C,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;YACxC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC;YACtD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC;YACxD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CACxB,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE;YACpE,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CACzB,cAAc,KAAK,CAAC,WAAW,OAAO,KAAK,CAAC,UAAU,GAAG;gBACzD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG;YACtF,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/E,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBAChC,eAAe,CAAC,KAAK,CAAC,CAAC;gBACvB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBACrD,KAAK,MAAM,CAAC,IAAI,QAAQ;oBAAE,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC7E,2EAA2E;gBAC3E,yEAAyE;gBACzE,2CAA2C;gBAC3C,IAAI,aAAa,GAAG,KAAK,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;oBACnC,aAAa,GAAG,IAAI,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa,GAAG,KAAK,CAAC;gBACxB,CAAC;gBACD,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;YAC7D,CAAC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,KAAK,cAAc,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;QACxD,uEAAuE;QACvE,4DAA4D;QAC5D,aAAa,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC;QACpG,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC;QACtG,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QACvE,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QACzE,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,MAAM,CAAC,KAAK,CAAC,wBAAwB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC;QACrG,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B,2DAA2D;gBACzD,yBAAyB,SAAS,uBAAuB,QAAQ,GAAG,EACtE,cAAc,CACf,CAAC;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,MAAM,CAAC,KAAK,CAChB,sEAAsE,SAAS,IAAI;oBACjF,qBAAqB,QAAQ,wBAAwB,QAAQ,CAAC,EAAE,CAAC,GAAG,EACtE,cAAc,CACf,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAChB,oEAAoE,SAAS,uBAAuB,QAAQ,GAAG,EAC/G,cAAc,CACf,CAAC;YACF,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,2EAA2E;AAC3E,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,6CAA6C;AAC7C,SAAS,UAAU,CAAC,IAAY;IAC9B,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,iDAAiD;AACjD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAiBD;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,MAAyB;IAClD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACvC,MAAM,UAAU,GAAG,GAAsB,EAAE,CACzC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,CACf,OAAqF,EACrF,UAA6B,EAChB,EAAE,CAAC,CAAC;QACjB,MAAM;QACN,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU;QACV,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,qCAAqC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,MAAM,aAAa,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,4BAA4B;IAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,iBAAiB,KAAK,CAAC,MAAM,yBAAyB,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,4CAA4C,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,iEAAiE;IACjE,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,CAAC,GAAoB,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;YAChB,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC,CAAC,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC9E,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,QAAQ,IAAI,KAAK,CAAC,MAAM,4BAA4B,IAAI,CAAC,MAAM,IAAI,CAAC,CAC9F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,WAAW,CACT,0BAA0B,QAAQ,QAAQ,MAAM,WAAW;gBACzD,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,GAAG,MAAM,kCAAkC,CACxE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;AACvG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,MAAc,EACd,IAAkB,EAClB,QAAqB;IAErB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAe,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACjD,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,KAAc;QACpB,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;KAC1B,CAAC,CAAC,CAAC;IACJ,MAAM,WAAW,GAAG,WAAW;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,sBAAsB,kBAAkB,uCAAuC,CAAC,CAAC;IACtF,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAC3D,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB,EAAE,IAAgB;IAC3E,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACrF,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAE1E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAEtF,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,UAAU,CAAC;IAClE,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAEnD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,MAAM,GAAoB,EAAE,CAAC;IACjC,IAAI,QAAQ,GAAqB,EAAE,CAAC;IACpC,IAAI,SAAS,GAAuC,MAAM,CAAC;IAE3D,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAI,CAAC,MAAM,CAAC;QACrB,QAAQ,GAAG,GAAI,CAAC,QAAQ,CAAC;QACzB,SAAS,GAAG,UAAU,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CACd,qCAAqC,gBAAgB,oCAAoC;gBACvF,MAAM,MAAM,CAAC,MAAM,oCAAoC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACtD,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC1D,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CACjC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACvG,MAAM,GAAG,GAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,OAAO,WAAW,CAAC;QACjB,KAAK;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,IAAkB;IACxD,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAkB;QACpD;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,WAAW,KAAK,iCAAiC,IAAI,CAAC,MAAM,4BAA4B;YACjG,OAAO,EAAE,KAAK;SACf;KACF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/db/sql-file.d.ts

@@ -9,6 +9,7 @@
  *     `;`, correctly ignoring separators that appear inside strings, quoted
  *     identifiers, or comments.
  */
+import type { RlsTableInput, RlsPolicyInput } from "@polardbx/pxbaas-client";
 /** Placeholder that every webapp template's db/schema.sql uses for the target schema. */
 export declare const SCHEMA_PLACEHOLDER = "__SCHEMA__";
 /** True when the script still contains the `__SCHEMA__` placeholder. */
@@ -46,4 +47,58 @@ export declare function buildStatementPlan(rawSql: string, schema: string): {
     statements: string[];
     substituted: boolean;
 };
+/**
+ * Multi-tenant variant of {@link substituteSchema}: DROP the `__SCHEMA__`.
+ * qualifier entirely instead of filling it in. The tenant-ddl connection is
+ * already bound to the tenant's own database, and cross-schema fully-qualified
+ * names are denied by GRANT / the server pre-check — so `__SCHEMA__`.`t` must
+ * become just `t`. The CLI never knows the tenant's real db_name (the resolver
+ * does not expose it), so de-qualifying is the only safe substitution.
+ */
+export declare function substituteSchemaForTenant(sql: string): string;
+export interface StatementPartition {
+    /** `INSERT ... supabase._mysqlrest_rls_tables` statements. */
+    rlsTableInserts: string[];
+    /** `INSERT ... supabase._mysqlrest_rls_policies` statements. */
+    rlsPolicyInserts: string[];
+    /** Everything else (DDL, seed DML) — runs verbatim through the query channel. */
+    plain: string[];
+}
+/**
+ * Split statements into central-registry RLS INSERTs vs. plain DDL/DML. In
+ * multi-tenant mode the RLS INSERTs MUST be diverted to the structured
+ * `/api/tenant-ddl/rls/*` endpoints (the tenant account has no GRANT on the
+ * shared `supabase` database, so a raw INSERT would be denied).
+ */
+export declare function partitionStatements(statements: string[]): StatementPartition;
+/** Thrown when an RLS INSERT does not match the constrained shape we can parse. */
+export declare class SqlParseError extends Error {
+    constructor(message: string);
+}
+/** Parse one `_mysqlrest_rls_tables` INSERT into structured inputs (schema dropped). */
+export declare function parseRlsTableInsert(stmt: string): RlsTableInput[];
+/** Parse one `_mysqlrest_rls_policies` INSERT into structured inputs (schema dropped). */
+export declare function parseRlsPolicyInsert(stmt: string): RlsPolicyInput[];
+/** Render an idempotent central-registry INSERT for one RLS table toggle. */
+export declare function renderRlsTableInsert(schema: string, input: RlsTableInput): string;
+/** Render an idempotent central-registry INSERT for one RLS policy. */
+export declare function renderRlsPolicyInsert(schema: string, input: RlsPolicyInput): string;
+/**
+ * Extract the table names created by a schema.sql script (for `--purge-db`).
+ * Handles `CREATE TABLE [IF NOT EXISTS] [`__SCHEMA__`.]<name>` with optional
+ * backticks. Names are returned de-qualified and de-duplicated, in first-seen order.
+ */
+export declare function extractCreateTableNames(sql: string): string[];
+export interface RlsJson {
+    tables: RlsTableInput[];
+    policies: RlsPolicyInput[];
+}
+/**
+ * Parse + validate a declarative `db/rls.json`. Accepts the documented friendly
+ * keys (table/name/role/using/check/rlsEnabled/...) and their snake_case aliases,
+ * mapping them onto the driver's structured inputs. `table_schema` is NEVER read
+ * here — the execution layer decides it (single-tenant = --schema; multi-tenant =
+ * server-bound).
+ */
+export declare function parseRlsJson(text: string): RlsJson;
 //# sourceMappingURL=sql-file.d.ts.map

package/dist/db/sql-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-file.d.ts","sourceRoot":"","sources":["../../src/db/sql-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAmHxD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAIhD"}
+{"version":3,"file":"sql-file.d.ts","sourceRoot":"","sources":["../../src/db/sql-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE7E,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAmHxD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAIhD;AAMD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAQD,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAU5E;AAED,mFAAmF;AACnF,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B;AA2ID,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAiBjE;AAED,0FAA0F;AAC1F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CA2BnE;AAaD,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,MAAM,CAOjF;AAED,uEAAuE;AACvE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CAYnF;AAGD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAU7D;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAgBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAoDlD"}