@polardbx/pxbaas 0.1.0-beta.1 → 0.1.0-beta.3

package/dist/db/introspect.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Schema introspection shared by `db tables`, `db schema`, and `gen types`.
+ *
+ * Why this exists (fixes defect C1): those three commands used the Meta API
+ * (`MetaDriver` -> `/pg/*`) unconditionally. In multi-tenant mode `/pg/*` only
+ * accepts the platform/global service_role key, so a per-tenant key is rejected
+ * with 401 (`Authentication failed`) — even though the same credentials work for
+ * `db query` (which already routes through tenant-ddl), `data *` (REST), and
+ * `storage`. See `db/apply-schema.ts` ("per-tenant keys are rejected 401 on
+ * /pg/query").
+ *
+ * The fix keeps single-tenant behavior EXACTLY as before (Meta API) and adds a
+ * multi-tenant path that runs the same portable `information_schema` queries
+ * through `TenantDdlDriver` (which the tenant key CAN call). The introspection
+ * SQL is backend-agnostic, so it is factored into pure functions that take an
+ * injectable `SqlRunner` — trivial to unit-test without a network.
+ */
+import { type TableInfo, type TableColumn, type TableIndex } from '@polardbx/pxbaas-client';
+/** Runs a SELECT and returns bare rows. Backed by MetaDriver (single-tenant
+ *  `/pg/query`) or TenantDdlDriver (multi-tenant `/api/tenant-ddl/query`). */
+export type SqlRunner = (sql: string) => Promise<Record<string, unknown>[]>;
+/** List tables/views via information_schema (portable across both drivers). */
+export declare function listTablesViaSql(run: SqlRunner, schema?: string): Promise<TableInfo[]>;
+/** List a table's columns via information_schema (mirrors MetaDriver SQL). */
+export declare function getTableColumnsViaSql(run: SqlRunner, table: string, schema?: string): Promise<TableColumn[]>;
+/** List a table's indexes via information_schema (mirrors MetaDriver SQL). */
+export declare function getTableIndexesViaSql(run: SqlRunner, table: string, schema?: string): Promise<TableIndex[]>;
+/** A schema introspector bound to the correct backend for the profile's mode. */
+export interface SchemaIntrospector {
+    /** Human label for the schema being introspected (tenant db in multi-tenant). */
+    currentSchema(): Promise<string>;
+    listTables(): Promise<TableInfo[]>;
+    getColumns(table: string): Promise<TableColumn[]>;
+    getIndexes(table: string): Promise<TableIndex[]>;
+}
+export interface MakeIntrospectorOptions {
+    /** Profile mode; 'multi-tenant' routes through tenant-ddl, else Meta API. */
+    mode?: string;
+    endpoint: string;
+    anonKey: string;
+    serviceRoleKey?: string;
+    tenantId?: string;
+    /** Single-tenant explicit schema (default 'public'). Ignored in multi-tenant. */
+    schema?: string;
+    /** Single-tenant: use the service_role key for Meta API reads (default true). */
+    useServiceRole?: boolean;
+}
+/**
+ * Build the mode-appropriate introspector.
+ * - multi-tenant: TenantDdlDriver + information_schema scoped to DATABASE().
+ * - single-tenant: the existing MetaDriver behavior, unchanged.
+ */
+export declare function makeIntrospector(opts: MakeIntrospectorOptions): SchemaIntrospector;
+//# sourceMappingURL=introspect.d.ts.map

package/dist/db/introspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect.d.ts","sourceRoot":"","sources":["../../src/db/introspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AAEjC;8EAC8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;AAuB5E,+EAA+E;AAC/E,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,SAAS,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,EAAE,CAAC,CAetB;AAED,8EAA8E;AAC9E,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,WAAW,EAAE,CAAC,CAmBxB;AAED,8EAA8E;AAC9E,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,EAAE,CAAC,CAiBvB;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,kBAAkB,CA+ClF"}

package/dist/db/introspect.js

@@ -0,0 +1,140 @@
+/**
+ * Schema introspection shared by `db tables`, `db schema`, and `gen types`.
+ *
+ * Why this exists (fixes defect C1): those three commands used the Meta API
+ * (`MetaDriver` -> `/pg/*`) unconditionally. In multi-tenant mode `/pg/*` only
+ * accepts the platform/global service_role key, so a per-tenant key is rejected
+ * with 401 (`Authentication failed`) — even though the same credentials work for
+ * `db query` (which already routes through tenant-ddl), `data *` (REST), and
+ * `storage`. See `db/apply-schema.ts` ("per-tenant keys are rejected 401 on
+ * /pg/query").
+ *
+ * The fix keeps single-tenant behavior EXACTLY as before (Meta API) and adds a
+ * multi-tenant path that runs the same portable `information_schema` queries
+ * through `TenantDdlDriver` (which the tenant key CAN call). The introspection
+ * SQL is backend-agnostic, so it is factored into pure functions that take an
+ * injectable `SqlRunner` — trivial to unit-test without a network.
+ */
+import { MetaDriver, TenantDdlDriver, } from '@polardbx/pxbaas-client';
+/** Escape a single-quoted SQL string literal. */
+function esc(value) {
+    return value.replace(/'/g, "''");
+}
+/**
+ * Schema predicate for information_schema filters. An explicit schema filters by
+ * name; otherwise scope to the connection's current database via DATABASE() —
+ * correct for multi-tenant, where the tenant-ddl connection is bound to the
+ * tenant's own database (tenant_<id>), not a Postgres-style `public`.
+ */
+function schemaPredicate(schema) {
+    return schema && schema !== ''
+        ? `table_schema = '${esc(schema)}'`
+        : 'table_schema = DATABASE()';
+}
+function toBool(v) {
+    return v === 1 || v === true || v === '1';
+}
+/** List tables/views via information_schema (portable across both drivers). */
+export async function listTablesViaSql(run, schema) {
+    const sql = `SELECT table_schema AS \`schema\`, table_name AS \`name\`, table_type AS \`type\`, ` +
+        `table_rows AS \`rowCount\`, table_comment AS \`comment\` ` +
+        `FROM information_schema.tables ` +
+        `WHERE ${schemaPredicate(schema)} AND table_type IN ('BASE TABLE','VIEW') ` +
+        `ORDER BY table_name`;
+    const rows = await run(sql);
+    return rows.map((t) => ({
+        schema: String(t.schema ?? ''),
+        name: String(t.name ?? ''),
+        type: String(t.type ?? '').toUpperCase() === 'VIEW' ? 'view' : 'table',
+        rowCount: t.rowCount != null ? Number(t.rowCount) : undefined,
+        comment: t.comment != null && t.comment !== '' ? String(t.comment) : undefined,
+    }));
+}
+/** List a table's columns via information_schema (mirrors MetaDriver SQL). */
+export async function getTableColumnsViaSql(run, table, schema) {
+    const sql = `SELECT column_name AS \`name\`, data_type AS \`dataType\`, ` +
+        `CASE WHEN is_nullable='YES' THEN 1 ELSE 0 END AS \`isNullable\`, ` +
+        `column_default AS \`defaultValue\`, ` +
+        `CASE WHEN column_key='PRI' THEN 1 ELSE 0 END AS \`isPrimaryKey\`, ` +
+        `column_comment AS \`comment\` ` +
+        `FROM information_schema.columns ` +
+        `WHERE ${schemaPredicate(schema)} AND table_name='${esc(table)}' ` +
+        `ORDER BY ordinal_position`;
+    const rows = await run(sql);
+    return rows.map((row) => ({
+        name: String(row.name),
+        dataType: String(row.dataType),
+        isNullable: toBool(row.isNullable),
+        defaultValue: row.defaultValue == null ? null : String(row.defaultValue),
+        isPrimaryKey: toBool(row.isPrimaryKey),
+        comment: row.comment != null && row.comment !== '' ? String(row.comment) : undefined,
+    }));
+}
+/** List a table's indexes via information_schema (mirrors MetaDriver SQL). */
+export async function getTableIndexesViaSql(run, table, schema) {
+    const sql = `SELECT index_name AS \`name\`, ` +
+        `GROUP_CONCAT(column_name ORDER BY seq_in_index) AS \`cols\`, ` +
+        `CASE WHEN MIN(non_unique)=0 THEN 1 ELSE 0 END AS \`isUnique\`, ` +
+        `CASE WHEN index_name='PRIMARY' THEN 1 ELSE 0 END AS \`isPrimary\` ` +
+        `FROM information_schema.statistics ` +
+        `WHERE ${schemaPredicate(schema)} AND table_name='${esc(table)}' ` +
+        `GROUP BY index_name`;
+    const rows = await run(sql);
+    return rows.map((row) => ({
+        name: String(row.name),
+        columns: row.cols != null && row.cols !== '' ? String(row.cols).split(',') : [],
+        isUnique: toBool(row.isUnique),
+        isPrimary: toBool(row.isPrimary),
+        type: 'BTREE',
+    }));
+}
+/**
+ * Build the mode-appropriate introspector.
+ * - multi-tenant: TenantDdlDriver + information_schema scoped to DATABASE().
+ * - single-tenant: the existing MetaDriver behavior, unchanged.
+ */
+export function makeIntrospector(opts) {
+    if (opts.mode === 'multi-tenant') {
+        if (!opts.tenantId) {
+            throw new Error('Multi-tenant profile is missing tenantId; re-run "pxbaas login --tenant-id <id>" with per-tenant keys.');
+        }
+        const tenantDriver = new TenantDdlDriver({
+            endpoint: opts.endpoint,
+            serviceRoleKey: opts.serviceRoleKey,
+        });
+        const run = async (sql) => (await tenantDriver.query(sql));
+        let cachedSchema = null;
+        return {
+            async currentSchema() {
+                if (cachedSchema == null) {
+                    const rows = await run('SELECT DATABASE() AS db');
+                    cachedSchema = rows.length > 0 ? String(rows[0].db ?? '') : '';
+                }
+                return cachedSchema;
+            },
+            listTables: () => listTablesViaSql(run),
+            getColumns: (table) => getTableColumnsViaSql(run, table),
+            getIndexes: (table) => getTableIndexesViaSql(run, table),
+        };
+    }
+    const metaDriver = new MetaDriver({
+        endpoint: opts.endpoint,
+        anonKey: opts.anonKey,
+        serviceRoleKey: opts.serviceRoleKey,
+        tenantId: opts.tenantId,
+    });
+    const schema = opts.schema ?? 'public';
+    const useServiceRole = opts.useServiceRole ?? true;
+    return {
+        async currentSchema() {
+            return schema;
+        },
+        async listTables() {
+            const all = await metaDriver.listTables(useServiceRole);
+            return all.filter((t) => t.schema === schema);
+        },
+        getColumns: (table) => metaDriver.getTableColumns(table, schema, useServiceRole),
+        getIndexes: (table) => metaDriver.getTableIndexes(table, schema, useServiceRole),
+    };
+}
+//# sourceMappingURL=introspect.js.map

package/dist/db/introspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect.js","sourceRoot":"","sources":["../../src/db/introspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,UAAU,EACV,eAAe,GAIhB,MAAM,yBAAyB,CAAC;AAMjC,iDAAiD;AACjD,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAe;IACtC,OAAO,MAAM,IAAI,MAAM,KAAK,EAAE;QAC5B,CAAC,CAAC,mBAAmB,GAAG,CAAC,MAAM,CAAC,GAAG;QACnC,CAAC,CAAC,2BAA2B,CAAC;AAClC,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAc,EACd,MAAe;IAEf,MAAM,GAAG,GACP,qFAAqF;QACrF,2DAA2D;QAC3D,iCAAiC;QACjC,SAAS,eAAe,CAAC,MAAM,CAAC,2CAA2C;QAC3E,qBAAqB,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACtE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAc,EACd,KAAa,EACb,MAAe;IAEf,MAAM,GAAG,GACP,6DAA6D;QAC7D,mEAAmE;QACnE,sCAAsC;QACtC,oEAAoE;QACpE,gCAAgC;QAChC,kCAAkC;QAClC,SAAS,eAAe,CAAC,MAAM,CAAC,oBAAoB,GAAG,CAAC,KAAK,CAAC,IAAI;QAClE,2BAA2B,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QAClC,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACxE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACtC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAc,EACd,KAAa,EACb,MAAe;IAEf,MAAM,GAAG,GACP,iCAAiC;QACjC,+DAA+D;QAC/D,iEAAiE;QACjE,oEAAoE;QACpE,qCAAqC;QACrC,SAAS,eAAe,CAAC,MAAM,CAAC,oBAAoB,GAAG,CAAC,KAAK,CAAC,IAAI;QAClE,qBAAqB,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/E,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,IAAI,EAAE,OAAO;KACd,CAAC,CAAC,CAAC;AACN,CAAC;AAwBD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA6B;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAwB;SAC9C,CAAC,CAAC;QACH,MAAM,GAAG,GAAc,KAAK,EAAE,GAAG,EAAE,EAAE,CACnC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAA8B,CAAC;QAC/D,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,OAAO;YACL,KAAK,CAAC,aAAa;gBACjB,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,yBAAyB,CAAC,CAAC;oBAClD,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC;YACvC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC;YACxD,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;IACnD,OAAO;QACL,KAAK,CAAC,aAAa;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,UAAU;YACd,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YACxD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC;QAChF,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC;KACjF,CAAC;AACJ,CAAC"}

package/dist/db/sql-file.d.ts

@@ -9,6 +9,7 @@
  *     `;`, correctly ignoring separators that appear inside strings, quoted
  *     identifiers, or comments.
  */
+import type { RlsTableInput, RlsPolicyInput } from "@polardbx/pxbaas-client";
 /** Placeholder that every webapp template's db/schema.sql uses for the target schema. */
 export declare const SCHEMA_PLACEHOLDER = "__SCHEMA__";
 /** True when the script still contains the `__SCHEMA__` placeholder. */
@@ -46,4 +47,58 @@ export declare function buildStatementPlan(rawSql: string, schema: string): {
     statements: string[];
     substituted: boolean;
 };
+/**
+ * Multi-tenant variant of {@link substituteSchema}: DROP the `__SCHEMA__`.
+ * qualifier entirely instead of filling it in. The tenant-ddl connection is
+ * already bound to the tenant's own database, and cross-schema fully-qualified
+ * names are denied by GRANT / the server pre-check — so `__SCHEMA__`.`t` must
+ * become just `t`. The CLI never knows the tenant's real db_name (the resolver
+ * does not expose it), so de-qualifying is the only safe substitution.
+ */
+export declare function substituteSchemaForTenant(sql: string): string;
+export interface StatementPartition {
+    /** `INSERT ... supabase._mysqlrest_rls_tables` statements. */
+    rlsTableInserts: string[];
+    /** `INSERT ... supabase._mysqlrest_rls_policies` statements. */
+    rlsPolicyInserts: string[];
+    /** Everything else (DDL, seed DML) — runs verbatim through the query channel. */
+    plain: string[];
+}
+/**
+ * Split statements into central-registry RLS INSERTs vs. plain DDL/DML. In
+ * multi-tenant mode the RLS INSERTs MUST be diverted to the structured
+ * `/api/tenant-ddl/rls/*` endpoints (the tenant account has no GRANT on the
+ * shared `supabase` database, so a raw INSERT would be denied).
+ */
+export declare function partitionStatements(statements: string[]): StatementPartition;
+/** Thrown when an RLS INSERT does not match the constrained shape we can parse. */
+export declare class SqlParseError extends Error {
+    constructor(message: string);
+}
+/** Parse one `_mysqlrest_rls_tables` INSERT into structured inputs (schema dropped). */
+export declare function parseRlsTableInsert(stmt: string): RlsTableInput[];
+/** Parse one `_mysqlrest_rls_policies` INSERT into structured inputs (schema dropped). */
+export declare function parseRlsPolicyInsert(stmt: string): RlsPolicyInput[];
+/** Render an idempotent central-registry INSERT for one RLS table toggle. */
+export declare function renderRlsTableInsert(schema: string, input: RlsTableInput): string;
+/** Render an idempotent central-registry INSERT for one RLS policy. */
+export declare function renderRlsPolicyInsert(schema: string, input: RlsPolicyInput): string;
+/**
+ * Extract the table names created by a schema.sql script (for `--purge-db`).
+ * Handles `CREATE TABLE [IF NOT EXISTS] [`__SCHEMA__`.]<name>` with optional
+ * backticks. Names are returned de-qualified and de-duplicated, in first-seen order.
+ */
+export declare function extractCreateTableNames(sql: string): string[];
+export interface RlsJson {
+    tables: RlsTableInput[];
+    policies: RlsPolicyInput[];
+}
+/**
+ * Parse + validate a declarative `db/rls.json`. Accepts the documented friendly
+ * keys (table/name/role/using/check/rlsEnabled/...) and their snake_case aliases,
+ * mapping them onto the driver's structured inputs. `table_schema` is NEVER read
+ * here — the execution layer decides it (single-tenant = --schema; multi-tenant =
+ * server-bound).
+ */
+export declare function parseRlsJson(text: string): RlsJson;
 //# sourceMappingURL=sql-file.d.ts.map

package/dist/db/sql-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-file.d.ts","sourceRoot":"","sources":["../../src/db/sql-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAmHxD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAIhD"}
+{"version":3,"file":"sql-file.d.ts","sourceRoot":"","sources":["../../src/db/sql-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE7E,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAmHxD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAIhD;AAMD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAQD,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAU5E;AAED,mFAAmF;AACnF,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B;AA2ID,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAiBjE;AAED,0FAA0F;AAC1F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CA2BnE;AAaD,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,MAAM,CAOjF;AAED,uEAAuE;AACvE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CAYnF;AAGD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAU7D;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAgBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAoDlD"}