@rebasepro/server-postgres 0.12.1-canary.g5f403cf → 0.12.1-canary.g68f9a47

package/dist/ensure-collection-policies-CT-zIUWA.js

@@ -0,0 +1,57 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { readExistingSchema, t as planCollectionPolicies } from "./ensure-collection-tables-Vu-GRELM.js";
+//#region src/schema/ensure-collection-policies.ts
+var isCreatePolicy = (statement) => /^\s*CREATE POLICY/i.test(statement);
+/**
+* Bring the declared collections' RLS policies up to date. Returns what it did.
+*
+* Only tables that already exist are touched: the boot-time table creator runs
+* first, so anything still missing is a table this additive path is not allowed
+* to create (a junction, or a relation left to a migration). Enabling RLS on a
+* non-existent table would error, so those are recorded as skipped, not failed.
+*/
+async function ensureCollectionPolicies(client, collections, log) {
+	const result = {
+		policiesApplied: 0,
+		tablesSecured: 0,
+		skipped: [],
+		failures: []
+	};
+	const plans = planCollectionPolicies(collections);
+	if (plans.length === 0) return result;
+	const existing = await readExistingSchema(client, Array.from(new Set(plans.map((p) => p.schema))));
+	for (const plan of plans) {
+		if (!existing.tables.has(plan.qualified)) {
+			result.skipped.push({
+				table: plan.qualified,
+				reason: "table is not present in the database; create it with `rebase db push` / `rebase db migrate`"
+			});
+			continue;
+		}
+		try {
+			await client.query(plan.enableRls);
+			result.tablesSecured++;
+			let created = 0;
+			for (const statement of plan.policyStatements) {
+				await client.query(statement);
+				if (isCreatePolicy(statement)) {
+					result.policiesApplied++;
+					created++;
+				}
+			}
+			log?.(`${plan.qualified}: RLS enabled, ${created} policy(ies) applied`);
+		} catch (err) {
+			result.failures.push({
+				table: plan.qualified,
+				error: err instanceof Error ? err.message : String(err)
+			});
+		}
+	}
+	return result;
+}
+//#endregion
+export { ensureCollectionPolicies };
+
+//# sourceMappingURL=ensure-collection-policies-CT-zIUWA.js.map

package/dist/ensure-collection-policies-CT-zIUWA.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-collection-policies-CT-zIUWA.js","names":[],"sources":["../src/schema/ensure-collection-policies.ts"],"sourcesContent":["/**\n * Applying a bundle's RLS policies to a database at boot, idempotently.\n *\n * ## Why this exists\n *\n * {@link ensureCollectionTables} creates the collection *tables* a managed\n * runtime boots against, but a table with row-level security disabled and no\n * policies is not servable: authenticated requests run as the restricted\n * `rebase_user` role, so a read with no `SELECT` policy returns nothing (a\n * public collection answered 401) and a write with no `INSERT`/`UPDATE` policy\n * is denied. The policies live in the collections' `securityRules`; nothing at\n * boot applied them. `rebase db push` does — but it drives Atlas against a\n * local `DATABASE_URL`, and a managed tenant's database is reachable only from\n * inside the cluster, by the runtime that is already connected to it. So the\n * runtime is the only thing that *can* apply them, and this is where it does.\n *\n * ## Why this is safe to run on every boot\n *\n * Every statement is idempotent: `ENABLE ROW LEVEL SECURITY` is a no-op once\n * enabled, and each policy is a `DROP POLICY IF EXISTS` immediately followed by\n * a `CREATE POLICY`, so re-applying asserts exactly the declared state. It adds\n * and replaces; it never drops data. (It does not *reconcile* — a policy a\n * previous push left behind under an old name is not removed here; that stays a\n * `db push` / `db migrate` concern, alongside destructive schema changes.)\n *\n * Unlike table creation, a failure here is not fatal: RLS stays enabled, so a\n * table whose policies could not be applied fails **closed** (denies) rather\n * than leaking rows. One collection's policy failing (e.g. a rule that\n * references a table a real migration has not created yet) must not crash-loop\n * the whole deployment and take the other collections' working routes down with\n * it. Failures are reported loudly and per-table so the operator can see\n * exactly which collection is not yet servable and why.\n */\nimport { type CollectionConfig } from \"@rebasepro/types\";\nimport { planCollectionPolicies } from \"./generate-postgres-ddl-logic\";\nimport { readExistingSchema, type Queryable } from \"./ensure-collection-tables\";\n\nexport interface PolicyEnsureResult {\n    /** `CREATE POLICY` statements that ran successfully. */\n    policiesApplied: number;\n    /** Tables that had RLS enabled. */\n    tablesSecured: number;\n    /** Declared tables absent from the database — left to a real migration. */\n    skipped: { table: string; reason: string }[];\n    /** Tables whose RLS could not be fully applied (fail closed). */\n    failures: { table: string; error: string }[];\n}\n\nconst isCreatePolicy = (statement: string): boolean => /^\\s*CREATE POLICY/i.test(statement);\n\n/**\n * Bring the declared collections' RLS policies up to date. Returns what it did.\n *\n * Only tables that already exist are touched: the boot-time table creator runs\n * first, so anything still missing is a table this additive path is not allowed\n * to create (a junction, or a relation left to a migration). Enabling RLS on a\n * non-existent table would error, so those are recorded as skipped, not failed.\n */\nexport async function ensureCollectionPolicies(\n    client: Queryable,\n    collections: CollectionConfig[],\n    log?: (message: string) => void\n): Promise<PolicyEnsureResult> {\n    const result: PolicyEnsureResult = { policiesApplied: 0, tablesSecured: 0, skipped: [], failures: [] };\n\n    const plans = planCollectionPolicies(collections);\n    if (plans.length === 0) return result;\n\n    const schemas = Array.from(new Set(plans.map(p => p.schema)));\n    const existing = await readExistingSchema(client, schemas);\n\n    for (const plan of plans) {\n        if (!existing.tables.has(plan.qualified)) {\n            result.skipped.push({\n                table: plan.qualified,\n                reason: \"table is not present in the database; create it with `rebase db push` / `rebase db migrate`\"\n            });\n            continue;\n        }\n\n        try {\n            // Enable first: if a later policy statement fails, the table is left\n            // locked (deny-all for the user role) rather than open.\n            await client.query(plan.enableRls);\n            result.tablesSecured++;\n\n            let created = 0;\n            for (const statement of plan.policyStatements) {\n                await client.query(statement);\n                if (isCreatePolicy(statement)) {\n                    result.policiesApplied++;\n                    created++;\n                }\n            }\n            log?.(`${plan.qualified}: RLS enabled, ${created} policy(ies) applied`);\n        } catch (err) {\n            result.failures.push({\n                table: plan.qualified,\n                error: err instanceof Error ? err.message : String(err)\n            });\n        }\n    }\n\n    return result;\n}\n"],"mappings":";;;;;AAgDA,IAAM,kBAAkB,cAA+B,qBAAqB,KAAK,SAAS;;;;;;;;;AAU1F,eAAsB,yBAClB,QACA,aACA,KAC2B;CAC3B,MAAM,SAA6B;EAAE,iBAAiB;EAAG,eAAe;EAAG,SAAS,CAAC;EAAG,UAAU,CAAC;CAAE;CAErG,MAAM,QAAQ,uBAAuB,WAAW;CAChD,IAAI,MAAM,WAAW,GAAG,OAAO;CAG/B,MAAM,WAAW,MAAM,mBAAmB,QAD1B,MAAM,KAAK,IAAI,IAAI,MAAM,KAAI,MAAK,EAAE,MAAM,CAAC,CACT,CAAO;CAEzD,KAAK,MAAM,QAAQ,OAAO;EACtB,IAAI,CAAC,SAAS,OAAO,IAAI,KAAK,SAAS,GAAG;GACtC,OAAO,QAAQ,KAAK;IAChB,OAAO,KAAK;IACZ,QAAQ;GACZ,CAAC;GACD;EACJ;EAEA,IAAI;GAGA,MAAM,OAAO,MAAM,KAAK,SAAS;GACjC,OAAO;GAEP,IAAI,UAAU;GACd,KAAK,MAAM,aAAa,KAAK,kBAAkB;IAC3C,MAAM,OAAO,MAAM,SAAS;IAC5B,IAAI,eAAe,SAAS,GAAG;KAC3B,OAAO;KACP;IACJ;GACJ;GACA,MAAM,GAAG,KAAK,UAAU,iBAAiB,QAAQ,qBAAqB;EAC1E,SAAS,KAAK;GACV,OAAO,SAAS,KAAK;IACjB,OAAO,KAAK;IACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC1D,CAAC;EACL;CACJ;CAEA,OAAO;AACX"}

package/dist/{ensure-collection-tables-CIHSH962.js → ensure-collection-tables-Vu-GRELM.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
-import { O as toSnakeCase, d as findRelation, g as resolveCollectionRelations, m as getTableName, r as resolveStringColumnLength } from "./src-DihrDFuP.js";
+import { O as toSnakeCase, T as getPolicyNamesForRule, c as policyToPostgres, d as findRelation, g as resolveCollectionRelations, l as securityRuleToConditions, m as getTableName, r as resolveStringColumnLength, s as getEffectiveSecurityRules } from "./src-DihrDFuP.js";
 import { n as isPostgresCollectionConfig } from "./src-DoU9yPqq.js";
 //#region src/schema/generate-postgres-ddl-logic.ts
 var resolveColumnName = (propName, prop) => {
@@ -37,6 +37,43 @@ var isIdProperty = (propName, prop, collection) => {
 	if ("isId" in prop && Boolean(prop.isId)) return true;
 	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
 };
+/**
+* The individual SQL statements a single security rule compiles to: a
+* `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete
+* statement (terminated by `;`, no trailing newline).
+*
+* This is the primitive the boot-time RLS applier runs one statement at a time
+* (the runtime's DB handle speaks the extended query protocol, which forbids
+* multiple commands in one execute), while `db push` writes the joined string.
+*/
+var generatePolicyStatements = (collection, rule, resolveCollection) => {
+	const tableName = getTableName(collection);
+	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+	const policyNames = getPolicyNamesForRule(rule, tableName);
+	return ops.flatMap((op, opIdx) => {
+		return generateSinglePolicyStatements(collection, rule, op, policyNames[opIdx], resolveCollection);
+	});
+};
+var generateSinglePolicyStatements = (collection, rule, operation, policyName, resolveCollection) => {
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	const tableName = getTableName(collection);
+	const mode = (rule.mode ?? "permissive").toUpperCase();
+	const operationUpper = operation.toUpperCase();
+	const pgRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
+	const needsUsing = operation !== "insert";
+	const needsWithCheck = operation !== "select" && operation !== "delete";
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	let usingClause = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection, { resolveCollection }) : null;
+	let withCheckClause = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection, { resolveCollection }) : null;
+	if (!usingClause && needsUsing) usingClause = "false";
+	if (!withCheckClause && needsWithCheck) withCheckClause = "false";
+	const drop = `DROP POLICY IF EXISTS "${policyName}" ON "${schema}"."${tableName}";`;
+	let create = `CREATE POLICY "${policyName}" ON "${schema}"."${tableName}" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map((r) => `"${r}"`).join(", ")}`;
+	if (usingClause) create += ` USING (${usingClause})`;
+	if (withCheckClause) create += ` WITH CHECK (${withCheckClause})`;
+	create += ";";
+	return [drop, create];
+};
 var getSqlColumnType = (propName, prop, collection, collections) => {
 	switch (prop.type) {
 		case "string": {
@@ -110,6 +147,46 @@ var getSqlColumnType = (propName, prop, collection, collections) => {
 		default: return "TEXT";
 	}
 };
+/**
+* The per-table RLS plan for the *declared* collections, as executable
+* statements — what the managed runtime applies at boot so a freshly
+* provisioned tenant database serves data instead of 401ing every read.
+*
+* Mirrors the non-junction half of {@link generatePostgresPoliciesDdl} exactly
+* (same `generatePolicyStatements`, same enable-RLS, same effective rules), so
+* boot and `db push` produce identical policies from identical collections.
+*
+* Junction tables are deliberately excluded: they are derived from `through`
+* relations, not declared collections, and the boot-time *table* creator
+* (`ensureCollectionTables`) does not create them either — enabling RLS on a
+* table that boot never created would fail. Their RLS stays a `db push` /
+* `db migrate` concern, which is where those tables get created in the first
+* place. `db push` still applies junction policies via the string generator.
+*/
+var planCollectionPolicies = (collections) => {
+	const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+	const plans = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (!tableName) continue;
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+		const qualified = `${schema}.${baseTableName}`;
+		if (seen.has(qualified)) continue;
+		seen.add(qualified);
+		const policyStatements = [];
+		for (const rule of getEffectiveSecurityRules(collection)) policyStatements.push(...generatePolicyStatements(collection, rule, resolveCollection));
+		plans.push({
+			schema,
+			table: baseTableName,
+			qualified,
+			enableRls: `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;`,
+			policyStatements
+		});
+	}
+	return plans;
+};
 //#endregion
 //#region src/schema/ensure-collection-tables.ts
 /**
@@ -299,6 +376,6 @@ async function ensureCollectionTables(client, collections, log) {
 	return plan;
 }
 //#endregion
-export { ensureCollectionTables };
+export { ensureCollectionTables, readExistingSchema, planCollectionPolicies as t };
 
-//# sourceMappingURL=ensure-collection-tables-CIHSH962.js.map
+//# sourceMappingURL=ensure-collection-tables-Vu-GRELM.js.map

package/dist/ensure-collection-tables-Vu-GRELM.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-collection-tables-Vu-GRELM.js","names":[],"sources":["../src/schema/generate-postgres-ddl-logic.ts","../src/schema/ensure-collection-tables.ts"],"sourcesContent":["import { CollectionConfig, NumberProperty, Property, ResolvedRelation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty, isManyToMany, type ResolvedManyToMany, type ResolvedBelongsTo } from \"@rebasepro/types\";\nimport { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig, resolveStringColumnLength } from \"@rebasepro/common\";\nimport { toSnakeCase, getPolicyNamesForRule } from \"@rebasepro/utils\";\n\n// --- Helper Functions ---\n\nexport const resolveColumnName = (propName: string, prop?: Property | null): string => {\n    if (prop && \"columnName\" in prop && typeof prop.columnName === \"string\") {\n        return prop.columnName;\n    }\n    return toSnakeCase(propName);\n};\n\nconst getPrimaryKeyProp = (collection: CollectionConfig): { name: string, type: \"string\" | \"number\", isUuid: boolean } => {\n    if (collection.properties) {\n        const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => \"isId\" in (prop as unknown as object) && Boolean((prop as unknown as Record<string, unknown>).isId));\n        if (idPropEntry) {\n            const prop = idPropEntry[1] as unknown as Property;\n            const isUuid = prop.type === \"string\" && \"isId\" in prop && (prop as unknown as StringProperty).isId === \"uuid\";\n            return { name: idPropEntry[0], type: prop.type === \"number\" ? \"number\" : \"string\", isUuid };\n        }\n    }\n    const idProp = collection.properties?.[\"id\"] as unknown as Property | undefined;\n    if (idProp?.type === \"number\") {\n        return { name: \"id\", type: \"number\", isUuid: false };\n    }\n    const isUuid = idProp?.type === \"string\" && \"isId\" in idProp && (idProp as unknown as StringProperty).isId === \"uuid\";\n    return { name: \"id\", type: \"string\", isUuid: isUuid ?? false };\n};\n\nconst isNumericId = (collection: CollectionConfig): boolean => {\n    return getPrimaryKeyProp(collection).type === \"number\";\n};\n\nconst getPrimaryKeyName = (collection: CollectionConfig): string => {\n    return getPrimaryKeyProp(collection).name;\n};\n\nexport const isIdProperty = (propName: string, prop: Property, collection: CollectionConfig): boolean => {\n    if (\"isId\" in prop && Boolean(prop.isId)) return true;\n    const hasExplicitId = Object.values(collection.properties ?? {}).some(p => \"isId\" in (p as unknown as object) && Boolean((p as unknown as Record<string, unknown>).isId));\n    return !hasExplicitId && propName === \"id\";\n};\n\n\ntype ResolveCollection = (slug: string) => CollectionConfig | undefined;\n\n/**\n * Render statements produced by {@link generatePolicyStatements} back into the\n * exact string the DDL/policies files have always carried: each statement on\n * its own line, terminated by a newline. Keeping the string form derived from\n * the statement array means the two can never drift — the boot-time applier and\n * the generated `policies.sql` emit the same SQL, from the same source.\n */\nconst statementsToDdl = (statements: string[]): string => statements.map(s => `${s}\\n`).join(\"\");\n\nconst generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection): string =>\n    statementsToDdl(generatePolicyStatements(collection, rule, resolveCollection));\n\n/**\n * The individual SQL statements a single security rule compiles to: a\n * `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete\n * statement (terminated by `;`, no trailing newline).\n *\n * This is the primitive the boot-time RLS applier runs one statement at a time\n * (the runtime's DB handle speaks the extended query protocol, which forbids\n * multiple commands in one execute), while `db push` writes the joined string.\n */\nexport const generatePolicyStatements = (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection): string[] => {\n    const tableName = getTableName(collection);\n    const ops: readonly SecurityOperation[] = rule.operations && rule.operations.length > 0\n        ? rule.operations\n        : [rule.operation ?? \"all\"];\n\n    const policyNames = getPolicyNamesForRule(rule, tableName);\n\n    return ops.flatMap((op, opIdx) => {\n        return generateSinglePolicyStatements(collection, rule, op, policyNames[opIdx], resolveCollection);\n    });\n};\n\nconst generateSinglePolicyStatements = (collection: CollectionConfig, rule: SecurityRule, operation: SecurityOperation, policyName: string, resolveCollection: ResolveCollection): string[] => {\n    const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n    const tableName = getTableName(collection);\n    const mode = (rule.mode ?? \"permissive\").toUpperCase();\n    const operationUpper = operation.toUpperCase();\n    const pgRoles = rule.pgRoles ? [...rule.pgRoles].sort() : [\"public\"];\n\n    const needsUsing = operation !== \"insert\";\n    const needsWithCheck = operation !== \"select\" && operation !== \"delete\";\n\n    // Desugar the rule (access / ownerField / roles / structured condition / raw\n    // SQL) into the shared PolicyExpression model, then compile to SQL. This is\n    // the same normalization the client-side evaluator uses, so DDL and UI agree.\n    const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);\n\n    let usingClause = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection, { resolveCollection }) : null;\n    let withCheckClause = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection, { resolveCollection }) : null;\n\n    if (!usingClause && needsUsing) {\n        usingClause = \"false\";\n    }\n    if (!withCheckClause && needsWithCheck) {\n        withCheckClause = \"false\";\n    }\n\n    const drop = `DROP POLICY IF EXISTS \"${policyName}\" ON \"${schema}\".\"${tableName}\";`;\n    let create = `CREATE POLICY \"${policyName}\" ON \"${schema}\".\"${tableName}\" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map(r => `\"${r}\"`).join(\", \")}`;\n    if (usingClause) create += ` USING (${usingClause})`;\n    if (withCheckClause) create += ` WITH CHECK (${withCheckClause})`;\n    create += \";\";\n    return [drop, create];\n};\n\nexport const getSqlColumnType = (propName: string, prop: Property, collection: CollectionConfig, collections: CollectionConfig[]): string => {\n    switch (prop.type) {\n        case \"string\": {\n            const stringProp = prop as StringProperty;\n            if (stringProp.enum) {\n                const tableName = getTableName(collection);\n                const colName = resolveColumnName(propName, prop);\n                const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n                return `\"${schema}\".\"${tableName}_${colName}\"`;\n            }\n            if (stringProp.isId === \"uuid\" || stringProp.columnType === \"uuid\") {\n                return \"UUID\";\n            }\n            // Width comes from `validation.max` when the property states one.\n            // It used to be a hardcoded 255 here and *absent* on the Drizzle\n            // path, so the same property produced a bounded column down one\n            // generator and an unbounded one down the other.\n            if (stringProp.columnType === \"char\") {\n                return `CHAR(${resolveStringColumnLength(stringProp)})`;\n            }\n            if (stringProp.columnType === \"varchar\") {\n                return `VARCHAR(${resolveStringColumnLength(stringProp)})`;\n            }\n            // `text` is the default. The two generators disagreed here before:\n            // this one emitted VARCHAR(255) while the drizzle path emitted a bare\n            // `varchar()`, which Postgres treats as unbounded — so the same\n            // property produced a capped column down one path and an uncapped one\n            // down the other.\n            return \"TEXT\";\n        }\n        case \"number\": {\n            const numProp = prop as NumberProperty;\n            const isId = isIdProperty(propName, prop, collection);\n            if (\"isId\" in numProp && numProp.isId === \"increment\") {\n                return \"INTEGER GENERATED BY DEFAULT AS IDENTITY\";\n            }\n            if (numProp.columnType) {\n                if (numProp.columnType === \"double precision\") return \"DOUBLE PRECISION\";\n                return numProp.columnType.toUpperCase();\n            }\n            return (numProp.validation?.integer || isId) ? \"INTEGER\" : \"NUMERIC\";\n        }\n        case \"boolean\":\n            return \"BOOLEAN\";\n        case \"date\": {\n            const dateProp = prop as DateProperty;\n            if (dateProp.columnType === \"date\") return \"DATE\";\n            if (dateProp.columnType === \"time\") return \"TIME\";\n            return \"TIMESTAMP WITH TIME ZONE\";\n        }\n        case \"map\": {\n            const mapProp = prop as MapProperty;\n            return mapProp.columnType === \"json\" ? \"JSON\" : \"JSONB\";\n        }\n        case \"array\": {\n            const arrayProp = prop as ArrayProperty;\n            let colType = arrayProp.columnType;\n            if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {\n                const ofProp = arrayProp.of as Property;\n                if (ofProp.type === \"string\") {\n                    colType = \"text[]\";\n                } else if (ofProp.type === \"number\") {\n                    colType = ofProp.validation?.integer ? \"integer[]\" : \"numeric[]\";\n                } else if (ofProp.type === \"boolean\") {\n                    colType = \"boolean[]\";\n                }\n            }\n            if (colType === \"json\") return \"JSON\";\n            if (colType === \"text[]\") return \"TEXT[]\";\n            if (colType === \"integer[]\") return \"INTEGER[]\";\n            if (colType === \"boolean[]\") return \"BOOLEAN[]\";\n            if (colType === \"numeric[]\") return \"NUMERIC[]\";\n            return \"JSONB\";\n        }\n        case \"vector\": {\n            const vp = prop as VectorProperty;\n            return `VECTOR(${vp.dimensions})`;\n        }\n        case \"binary\": {\n            return \"BYTEA\";\n        }\n        case \"relation\": {\n            const refProp = prop as RelationProperty;\n            const resolvedRelations = resolveCollectionRelations(collection);\n            const relation = findRelation(resolvedRelations, refProp.relation?.relationName ?? propName);\n            if (relation?.kind !== \"belongsTo\") {\n                throw new Error(`Relation ${propName} does not put a column on this table (only \\`belongsTo\\` does)`);\n            }\n            let targetCollection: CollectionConfig;\n            try {\n                targetCollection = relation.target();\n            } catch {\n                return \"TEXT\";\n            }\n            const pkProp = getPrimaryKeyProp(targetCollection);\n            return pkProp.type === \"number\" ? \"INTEGER\" : (pkProp.isUuid ? \"UUID\" : \"TEXT\");\n        }\n        case \"reference\": {\n            const refProp = prop as ReferenceProperty;\n            const targetCollection = collections.find(c => c.slug === refProp.path || getTableName(c) === refProp.path);\n            if (!targetCollection) return \"TEXT\";\n            const pkProp = getPrimaryKeyProp(targetCollection);\n            return pkProp.type === \"number\" ? \"INTEGER\" : (pkProp.isUuid ? \"UUID\" : \"TEXT\");\n        }\n        default:\n            return \"TEXT\";\n    }\n};\n\nexport const generatePostgresDdl = async (\n    collections: CollectionConfig[],\n    options: { includePolicies?: boolean } = { includePolicies: true }\n): Promise<string> => {\n    let ddl = \"-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\\n\\n\";\n\n    // 1. Create custom schemas\n    const uniqueSchemas = Array.from(new Set([\n        \"auth\",\n        ...collections.map(c => isPostgresCollectionConfig(c) ? c.schema : undefined).filter(Boolean)\n    ]));\n    uniqueSchemas.forEach(schema => {\n        if (schema) ddl += `CREATE SCHEMA IF NOT EXISTS \"${schema}\";\\n`;\n    });\n    if (uniqueSchemas.length > 0) ddl += \"\\n\";\n\n    // 2. Generate Enums\n    collections.forEach(collection => {\n        const collectionTable = getTableName(collection);\n        const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n        Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {\n            if ((\"enum\" in prop) && (prop.type === \"string\" || prop.type === \"number\") && prop.enum) {\n                const enumDbName = `${collectionTable}_${resolveColumnName(propName, prop)}`;\n                const values = Array.isArray(prop.enum)\n                    ? (prop.enum as (string | number | { id: string | number })[]).map((v: string | number | { id: string | number }) =>\n                        String(typeof v === \"object\" && v !== null && \"id\" in v ? v.id : v)\n                    )\n                    : Object.keys(prop.enum);\n                if (values.length > 0) {\n                    ddl += `CREATE TYPE \"${schema}\".\"${enumDbName}\" AS ENUM (${values.map(v => `'${v}'`).join(\", \")});\\n`;\n                }\n            }\n        });\n    });\n    if (ddl.endsWith(\";\\n\")) ddl += \"\\n\";\n\n    // Junction policy derivation needs every declaring side of each junction,\n    // not just the first relation that reached it in the walk below.\n    const junctionSpecs = resolveJunctionSpecs(collections);\n\n    const allTablesToGenerate = new Map<string, {\n        collection: CollectionConfig,\n        isJunction?: boolean,\n        relation?: ResolvedRelation,\n        sourceCollection?: CollectionConfig\n    }>();\n\n    // Identify all tables\n    for (const collection of collections) {\n        const tableName = getTableName(collection);\n        if (tableName) {\n            allTablesToGenerate.set(tableName, { collection });\n        }\n\n        const resolvedRelations = resolveCollectionRelations(collection);\n        for (const relation of Object.values(resolvedRelations)) {\n            if (isManyToMany(relation)) {\n                const junctionTableName = relation.through.table;\n                if (!allTablesToGenerate.has(junctionTableName)) {\n                    allTablesToGenerate.set(junctionTableName, {\n                        collection: {\n                            table: junctionTableName,\n                            properties: {}\n                        } as CollectionConfig,\n                        isJunction: true,\n                        relation: relation,\n                        sourceCollection: collection\n                    });\n                }\n            }\n        }\n    }\n\n    // 3. Generate tables\n    const fkStatements: string[] = [];\n    // Policies are emitted after every CREATE TABLE, like the FK constraints:\n    // a policy may reference other tables (a junction's derived policies always\n    // reference both endpoints; `policy.existsIn` references a join table), and\n    // CREATE POLICY validates those relations at creation time.\n    const policyStatements: string[] = [];\n    for (const [tableName, {\n        collection,\n        isJunction,\n        relation,\n        sourceCollection\n    }] of allTablesToGenerate.entries()) {\n        const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n        const baseTableName = tableName.includes(\".\") ? tableName.split(\".\").pop()! : tableName;\n\n        if (isJunction && relation && sourceCollection && isManyToMany(relation)) {\n            const targetCollection = relation.target();\n            const sourceTable = getTableName(sourceCollection);\n            const targetTable = getTableName(targetCollection);\n            const sourceSchema = isPostgresCollectionConfig(sourceCollection) && sourceCollection.schema ? sourceCollection.schema : \"public\";\n            const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : \"public\";\n            const { sourceColumn, targetColumn } = relation.through;\n\n            // TEXT, matching the string default: a junction column has to have the\n            // same type as the primary key it references.\n            const sourceColType = isNumericId(sourceCollection) ? \"INTEGER\" : (getPrimaryKeyProp(sourceCollection).isUuid ? \"UUID\" : \"TEXT\");\n            const targetColType = isNumericId(targetCollection) ? \"INTEGER\" : (getPrimaryKeyProp(targetCollection).isUuid ? \"UUID\" : \"TEXT\");\n            const sourceId = getPrimaryKeyName(sourceCollection);\n            const targetId = getPrimaryKeyName(targetCollection);\n\n            const onDelete = relation.onDelete ?? \"CASCADE\";\n\n            ddl += `CREATE TABLE \"${schema}\".\"${baseTableName}\" (\\n`;\n            ddl += `  \"${sourceColumn}\" ${sourceColType} NOT NULL,\\n`;\n            ddl += `  \"${targetColumn}\" ${targetColType} NOT NULL,\\n`;\n            ddl += `  PRIMARY KEY (\"${sourceColumn}\", \"${targetColumn}\")\\n`;\n            ddl += `);\\n\\n`;\n\n            fkStatements.push(`ALTER TABLE \"${schema}\".\"${baseTableName}\" ADD CONSTRAINT \"${baseTableName}_${sourceColumn}_fkey\" FOREIGN KEY (\"${sourceColumn}\") REFERENCES \"${sourceSchema}\".\"${sourceTable}\" (\"${sourceId}\") ON DELETE ${onDelete.toUpperCase()};`);\n            fkStatements.push(`ALTER TABLE \"${schema}\".\"${baseTableName}\" ADD CONSTRAINT \"${baseTableName}_${targetColumn}_fkey\" FOREIGN KEY (\"${targetColumn}\") REFERENCES \"${targetSchema}\".\"${targetTable}\" (\"${targetId}\") ON DELETE ${onDelete.toUpperCase()};`);\n\n            if (options.includePolicies) {\n                // Junction tables are generated tables like any other: locked by\n                // default, with derived policies — reads follow the endpoints'\n                // visibility, writes follow the declaring side's update rules.\n                // Without this they were the one kind of generated table with no\n                // RLS at all, readable and writable by every signed-in user.\n                ddl += `ALTER TABLE \"${schema}\".\"${baseTableName}\" ENABLE ROW LEVEL SECURITY;\\n`;\n                ddl += `\\n`;\n\n                const spec = junctionSpecs.get(baseTableName);\n                if (spec) {\n                    const junctionCollection = getJunctionCollectionConfig(spec);\n                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);\n                    getJunctionSecurityRules(spec).forEach((rule: SecurityRule) => {\n                        policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));\n                    });\n                }\n            }\n        } else if (!isJunction) {\n            ddl += `CREATE TABLE \"${schema}\".\"${baseTableName}\" (\\n`;\n            const columns: string[] = [];\n\n            Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {\n                if (prop.type === \"relation\") {\n                    const refProp = prop as RelationProperty;\n                    const resolvedRelations = resolveCollectionRelations(collection);\n                    const relInfo = findRelation(resolvedRelations, refProp.relation?.relationName ?? propName);\n\n                    if (relInfo?.kind !== \"belongsTo\") {\n                        return;\n                    }\n\n                    if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) {\n                        return;\n                    }\n\n                    let targetCollection: CollectionConfig;\n                    try {\n                        targetCollection = relInfo.target();\n                    } catch {\n                        return;\n                    }\n\n                    const targetTable = getTableName(targetCollection);\n                    const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : \"public\";\n                    const targetId = getPrimaryKeyName(targetCollection);\n                    const fkColType = getSqlColumnType(propName, prop, collection, collections);\n                    \n                    const onUpdate = relInfo.onUpdate ? ` ON UPDATE ${relInfo.onUpdate.toUpperCase()}` : \"\";\n                    const required = prop.validation?.required;\n                    const onDeleteVal = relInfo.onDelete ?? (required ? \"CASCADE\" : \"SET NULL\");\n                    \n                    let colDef = `  \"${relInfo.localKey}\" ${fkColType}`;\n                    if (required) colDef += \" NOT NULL\";\n                    columns.push(colDef);\n\n                    fkStatements.push(`ALTER TABLE \"${schema}\".\"${baseTableName}\" ADD CONSTRAINT \"${baseTableName}_${relInfo.localKey}_fkey\" FOREIGN KEY (\"${relInfo.localKey}\") REFERENCES \"${targetSchema}\".\"${targetTable}\" (\"${targetId}\") ON DELETE ${onDeleteVal.toUpperCase()}${onUpdate};`);\n                } else if (prop.type === \"reference\") {\n                    const refProp = prop as ReferenceProperty;\n                    const targetCollection = collections.find(c => c.slug === refProp.path || getTableName(c) === refProp.path);\n                    const colName = resolveColumnName(propName, prop);\n                    const colType = getSqlColumnType(propName, prop, collection, collections);\n                    const required = prop.validation?.required;\n\n                    if (!targetCollection) {\n                        let colDef = `  \"${colName}\" ${colType}`;\n                        if (required) colDef += \" NOT NULL\";\n                        columns.push(colDef);\n                    } else {\n                        const targetTable = getTableName(targetCollection);\n                        const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : \"public\";\n                        const targetId = getPrimaryKeyName(targetCollection);\n                        const onDelete = required ? \"CASCADE\" : \"SET NULL\";\n\n                        let colDef = `  \"${colName}\" ${colType}`;\n                        if (required) colDef += \" NOT NULL\";\n                        columns.push(colDef);\n\n                        fkStatements.push(`ALTER TABLE \"${schema}\".\"${baseTableName}\" ADD CONSTRAINT \"${baseTableName}_${colName}_fkey\" FOREIGN KEY (\"${colName}\") REFERENCES \"${targetSchema}\".\"${targetTable}\" (\"${targetId}\") ON DELETE ${onDelete.toUpperCase()};`);\n                    }\n                } else {\n                    const colName = resolveColumnName(propName, prop);\n                    const colType = getSqlColumnType(propName, prop, collection, collections);\n                    let colDef = `  \"${colName}\" ${colType}`;\n\n                    if (isIdProperty(propName, prop, collection)) {\n                        colDef += \" PRIMARY KEY\";\n                    }\n\n                    if (\"isId\" in prop && prop.isId !== \"manual\" && prop.isId !== true && prop.isId !== \"increment\") {\n                        if (prop.isId === \"uuid\") {\n                            colDef += \" DEFAULT gen_random_uuid()\";\n                        } else if (prop.isId === \"cuid\") {\n                            colDef += \" DEFAULT cuid()\";\n                        } else if (typeof prop.isId === \"string\") {\n                            colDef += ` DEFAULT ${prop.isId}`;\n                        }\n                    }\n\n                    if (!isIdProperty(propName, prop, collection) && prop.validation?.unique) {\n                        colDef += \" UNIQUE\";\n                    }\n\n                    if (prop.type === \"date\") {\n                        const dateProp = prop as DateProperty;\n                        if (dateProp.autoValue === \"on_create\" || dateProp.autoValue === \"on_update\") {\n                            colDef += \" DEFAULT now()\";\n                        }\n                    }\n\n                    if (prop.validation?.required && !colDef.includes(\"PRIMARY KEY\")) {\n                        colDef += \" NOT NULL\";\n                    }\n\n                    columns.push(colDef);\n                }\n            });\n\n            // Backwards compatibility: add default id primary key if missing\n            const hasPk = columns.some(c => c.includes(\"PRIMARY KEY\"));\n            if (!hasPk) {\n                columns.unshift('  \"id\" TEXT PRIMARY KEY');\n            }\n\n            ddl += columns.join(\",\\n\");\n            ddl += `\\n);\\n\\n`;\n\n            if (options.includePolicies) {\n                // Enable RLS and add Policies. No FORCE: authenticated requests\n                // run as the non-owner `rebase_user` role, which plain ENABLE\n                // already binds. The owner (server context) must bypass — it is\n                // the trusted plane (auth flows, dataAsAdmin).\n                ddl += `ALTER TABLE \"${schema}\".\"${baseTableName}\" ENABLE ROW LEVEL SECURITY;\\n`;\n                ddl += `\\n`;\n\n                const securityRules = getEffectiveSecurityRules(collection);\n                if (securityRules.length > 0) {\n                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);\n                    securityRules.forEach((rule: SecurityRule) => {\n                        policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));\n                    });\n                }\n            }\n        }\n    }\n\n    if (fkStatements.length > 0) {\n        ddl += \"-- Foreign Key Constraints\\n\";\n        ddl += fkStatements.join(\"\\n\") + \"\\n\\n\";\n    }\n\n    if (policyStatements.length > 0) {\n        ddl += \"-- Row Level Security Policies\\n\";\n        ddl += policyStatements.join(\"\");\n        ddl += \"\\n\";\n    }\n\n    return ddl;\n};\n\n/** The RLS statements one declared collection's table needs, ready to run. */\nexport interface CollectionPolicyPlan {\n    /** The table's schema (e.g. `public`, `rebase`). */\n    schema: string;\n    /** The bare table name, no schema prefix. */\n    table: string;\n    /** `schema.table` — matches the keys `readExistingSchema` returns. */\n    qualified: string;\n    /** `ALTER TABLE … ENABLE ROW LEVEL SECURITY;` — locked by default. */\n    enableRls: string;\n    /** `DROP POLICY IF EXISTS` / `CREATE POLICY` statements, in order. */\n    policyStatements: string[];\n}\n\n/**\n * The per-table RLS plan for the *declared* collections, as executable\n * statements — what the managed runtime applies at boot so a freshly\n * provisioned tenant database serves data instead of 401ing every read.\n *\n * Mirrors the non-junction half of {@link generatePostgresPoliciesDdl} exactly\n * (same `generatePolicyStatements`, same enable-RLS, same effective rules), so\n * boot and `db push` produce identical policies from identical collections.\n *\n * Junction tables are deliberately excluded: they are derived from `through`\n * relations, not declared collections, and the boot-time *table* creator\n * (`ensureCollectionTables`) does not create them either — enabling RLS on a\n * table that boot never created would fail. Their RLS stays a `db push` /\n * `db migrate` concern, which is where those tables get created in the first\n * place. `db push` still applies junction policies via the string generator.\n */\nexport const planCollectionPolicies = (collections: CollectionConfig[]): CollectionPolicyPlan[] => {\n    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);\n    const plans: CollectionPolicyPlan[] = [];\n    const seen = new Set<string>();\n\n    for (const collection of collections) {\n        const tableName = getTableName(collection);\n        if (!tableName) continue;\n        const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n        const baseTableName = tableName.includes(\".\") ? tableName.split(\".\").pop()! : tableName;\n        const qualified = `${schema}.${baseTableName}`;\n        if (seen.has(qualified)) continue;\n        seen.add(qualified);\n\n        const policyStatements: string[] = [];\n        for (const rule of getEffectiveSecurityRules(collection)) {\n            policyStatements.push(...generatePolicyStatements(collection, rule, resolveCollection));\n        }\n\n        plans.push({\n            schema,\n            table: baseTableName,\n            qualified,\n            enableRls: `ALTER TABLE \"${schema}\".\"${baseTableName}\" ENABLE ROW LEVEL SECURITY;`,\n            policyStatements\n        });\n    }\n\n    return plans;\n};\n\nexport const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): string => {\n    let ddl = \"-- This file contains RLS policies generated by Rebase. Applied separately from migrations.\\n\\n\";\n\n    const allTablesToGenerate = new Map<string, {\n        collection: CollectionConfig\n    }>();\n\n    for (const collection of collections) {\n        const tableName = getTableName(collection);\n        if (tableName) {\n            allTablesToGenerate.set(tableName, { collection });\n        }\n    }\n\n    for (const [tableName, { collection }] of allTablesToGenerate.entries()) {\n        const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n        const baseTableName = tableName.includes(\".\") ? tableName.split(\".\").pop()! : tableName;\n\n        // No FORCE: user requests run as the non-owner `rebase_user` role\n        // (plain ENABLE binds them); the owner is the trusted server context.\n        ddl += `ALTER TABLE \"${schema}\".\"${baseTableName}\" ENABLE ROW LEVEL SECURITY;\\n`;\n        ddl += `\\n`;\n\n        const securityRules = getEffectiveSecurityRules(collection);\n        if (securityRules.length > 0) {\n            const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);\n            const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));\n\n            securityRules.forEach((rule: SecurityRule) => {\n                // Say which policies the author did not write. They are permissive,\n                // so they OR with the declared rules and widen the final ACL beyond\n                // what `securityRules` reads like — and re-appear after any manual\n                // DROP, because a push asserts the declared state.\n                if (rule.name && injectedNames.has(rule.name)) {\n                    ddl += `-- Injected by Rebase (not from this collection's securityRules).\\n`;\n                    ddl += `-- Set \\`disableDefaultPolicies: true\\` on \"${collection.slug}\" to drop these and own its RLS outright.\\n`;\n                }\n                ddl += generatePolicyDdl(collection, rule, resolveCollection);\n            });\n            ddl += \"\\n\";\n        }\n    }\n\n    // Junction tables are generated from `through` relations, not declared as\n    // collections, so the walk above never sees them. They get the same\n    // treatment as any generated table: locked by default, with derived\n    // policies — reads follow the endpoints, writes follow the declaring\n    // side's update rules.\n    const junctionSpecs = resolveJunctionSpecs(collections);\n    for (const spec of junctionSpecs.values()) {\n        ddl += `ALTER TABLE \"${spec.schema}\".\"${spec.table}\" ENABLE ROW LEVEL SECURITY;\\n`;\n        ddl += `\\n`;\n\n        const junctionRules = getJunctionSecurityRules(spec);\n        if (junctionRules.length === 0) continue;\n\n        const junctionCollection = getJunctionCollectionConfig(spec);\n        const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);\n        const declaringSlugs = spec.declaringSides.map(s => s.collection.slug).join('\", \"');\n\n        ddl += `-- Derived by Rebase for the junction \"${spec.table}\" (no collection declares it).\\n`;\n        ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\\n`;\n        ddl += `-- rules of \"${declaringSlugs}\". Set \\`disableDefaultPolicies: true\\` on the\\n`;\n        ddl += `-- declaring collection(s) to drop these and police the junction yourself.\\n`;\n        junctionRules.forEach((rule: SecurityRule) => {\n            ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);\n        });\n        ddl += \"\\n\";\n    }\n\n    return ddl;\n};\n\n","/**\n * Bringing a database up to date with a bundle's collections, additively.\n *\n * ## Why this exists\n *\n * A managed runtime boots someone else's compiled project against a database it\n * has never seen. Auth tables are ensured at boot already, but collection tables\n * were not created by anything: the platform ran the app and every `/api/data/*`\n * request answered 500 on a missing relation. `rebase db push` cannot help — it\n * is an Atlas-driven CLI command, and the runtime image ships no CLI.\n *\n * ## Why additive-only, forever\n *\n * This runs unattended, against a database with customers' data in it, with no\n * human reading a diff. So it may only ever do things that cannot lose data:\n * create a missing table, add a missing column, create a missing enum type.\n *\n * It will **never** drop a table or a column, narrow a type, or alter a\n * constraint. A removed field leaves its column behind; a renamed field looks\n * like an addition and the old column stays. That is the correct trade for an\n * automated path — the alternative is an unattended process that can silently\n * destroy a column, which is precisely the failure `db push` was hardened\n * against. Destructive changes stay a deliberate, human-reviewed migration.\n *\n * Because of that, this is safe to run on every boot, and re-running it is a\n * no-op.\n */\nimport { type CollectionConfig, type Property, isPostgresCollectionConfig } from \"@rebasepro/types\";\nimport { getTableName } from \"@rebasepro/common\";\nimport {\n    getSqlColumnType,\n    resolveColumnName,\n    isIdProperty\n} from \"./generate-postgres-ddl-logic\";\n\n/**\n * The subset of a database handle this needs: run a statement, get rows back.\n *\n * Deliberately parameterless. Everything here is DDL or catalogue reads keyed by\n * schema name, and schema names are identifiers — they cannot be bound as\n * parameters anyway. They are validated against {@link SAFE_IDENTIFIER} before\n * they reach a statement, so a config that somehow carried a quote is refused\n * rather than concatenated.\n */\nexport interface Queryable {\n    query<T = unknown>(sql: string): Promise<{ rows: T[] }>;\n}\n\n/** Postgres identifiers this module is willing to interpolate. */\nconst SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;\n\nfunction assertSafeIdentifier(value: string, what: string): string {\n    if (!SAFE_IDENTIFIER.test(value)) {\n        throw new Error(`Refusing to build SQL with an unsafe ${what}: ${JSON.stringify(value)}`);\n    }\n    return value;\n}\n\n/** What the database currently has, as the planner needs it. */\nexport interface ExistingSchema {\n    /** `schema.table` → set of column names. */\n    tables: Map<string, Set<string>>;\n    /** `schema.typename` of every enum type that already exists. */\n    enums: Set<string>;\n}\n\nexport interface EnsureAction {\n    kind: \"create-enum\" | \"create-table\" | \"add-column\";\n    /** Qualified target, for logging: `public.posts` or `public.posts.title`. */\n    target: string;\n    sql: string;\n}\n\nexport interface EnsurePlan {\n    actions: EnsureAction[];\n    /** Every statement, in dependency order. Empty when the schema is current. */\n    statements: string[];\n}\n\nfunction schemaOf(collection: CollectionConfig): string {\n    return isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n}\n\nfunction qualified(collection: CollectionConfig): string {\n    return `${schemaOf(collection)}.${getTableName(collection)}`;\n}\n\n/**\n * Enum types a collection's properties require, as `schema.typename`.\n *\n * Named exactly as the DDL generator names them (`<table>_<column>`), because\n * a column added here has to reference the same type the generator would have\n * created — a second, differently-named type for the same field would be a\n * silent schema fork.\n */\nfunction requiredEnums(collection: CollectionConfig): { name: string; values: string[] }[] {\n    const table = getTableName(collection);\n    const schema = schemaOf(collection);\n    const out: { name: string; values: string[] }[] = [];\n    for (const [propName, prop] of Object.entries(collection.properties ?? {})) {\n        const p = prop as Property;\n        if (!(\"enum\" in p) || !p.enum) continue;\n        if (p.type !== \"string\" && p.type !== \"number\") continue;\n        const values = (p.enum as unknown[])\n            .map(entry =>\n                entry && typeof entry === \"object\" && \"id\" in (entry as Record<string, unknown>)\n                    ? String((entry as Record<string, unknown>).id)\n                    : String(entry)\n            )\n            .filter(v => v.length > 0);\n        if (values.length === 0) continue;\n        out.push({ name: `${schema}.${table}_${resolveColumnName(propName, p)}`, values });\n    }\n    return out;\n}\n\n/** Single-quote escaping for an enum label. */\nfunction quoteLiteral(value: string): string {\n    return `'${value.replace(/'/g, \"''\")}'`;\n}\n\n/**\n * Decide what to add. Pure — the caller supplies what exists and runs the result.\n *\n * Ordering matters and is deliberate: enum types before the tables and columns\n * that reference them, tables before the columns added to other tables (a new\n * table may be the target of a relation), and nothing is emitted twice.\n */\nexport function planCollectionSchemaEnsure(\n    collections: CollectionConfig[],\n    existing: ExistingSchema\n): EnsurePlan {\n    const actions: EnsureAction[] = [];\n    const plannedEnums = new Set<string>();\n\n    // 1. Enum types. `CREATE TYPE` has no IF NOT EXISTS, so an existing type is\n    //    skipped by name rather than guarded in SQL.\n    for (const collection of collections) {\n        for (const { name, values } of requiredEnums(collection)) {\n            if (existing.enums.has(name) || plannedEnums.has(name)) continue;\n            plannedEnums.add(name);\n            const [schema, typeName] = name.split(\".\");\n            actions.push({\n                kind: \"create-enum\",\n                target: name,\n                sql: `CREATE TYPE \"${schema}\".\"${typeName}\" AS ENUM (${values.map(quoteLiteral).join(\", \")});`\n            });\n        }\n    }\n\n    // 2. Missing tables. Only the identity column is created here; every other\n    //    column is added by step 3, so a new table and an existing table that\n    //    gained a field travel the exact same code path. One way to build a\n    //    column means one way for it to be wrong.\n    const created = new Set<string>();\n    for (const collection of collections) {\n        const key = qualified(collection);\n        if (existing.tables.has(key) || created.has(key)) continue;\n        created.add(key);\n        const schema = schemaOf(collection);\n        const table = getTableName(collection);\n        const idEntry = Object.entries(collection.properties ?? {}).find(([n, p]) =>\n            isIdProperty(n, p as Property, collection)\n        );\n        const idName = idEntry ? resolveColumnName(idEntry[0], idEntry[1] as Property) : \"id\";\n        const idProp = idEntry?.[1] as Property | undefined;\n        let idDef: string;\n        if (idProp?.type === \"number\") {\n            idDef = `\"${idName}\" BIGSERIAL PRIMARY KEY`;\n        } else if (\n            idProp &&\n            idProp.type === \"string\" &&\n            (idProp as { isId?: unknown }).isId === \"uuid\"\n        ) {\n            idDef = `\"${idName}\" UUID PRIMARY KEY DEFAULT gen_random_uuid()`;\n        } else {\n            idDef = `\"${idName}\" TEXT PRIMARY KEY`;\n        }\n        actions.push({\n            kind: \"create-table\",\n            target: key,\n            sql: `CREATE TABLE IF NOT EXISTS \"${schema}\".\"${table}\" (${idDef});`\n        });\n    }\n\n    // 3. Missing columns, on both brand-new and pre-existing tables.\n    for (const collection of collections) {\n        const key = qualified(collection);\n        const schema = schemaOf(collection);\n        const table = getTableName(collection);\n        const present = existing.tables.get(key) ?? new Set<string>();\n        for (const [propName, prop] of Object.entries(collection.properties ?? {})) {\n            const p = prop as Property;\n            if (isIdProperty(propName, p, collection)) continue;\n            // A relation's own column is emitted by the DDL generator with a\n            // foreign key; adding a bare column here would create the column\n            // without the constraint and make the generator's later output\n            // disagree with the database. Left to a real migration.\n            if (p.type === \"reference\" || p.type === \"relation\") continue;\n            const column = resolveColumnName(propName, p);\n            if (present.has(column)) continue;\n            const type = getSqlColumnType(propName, p, collection, collections);\n            actions.push({\n                kind: \"add-column\",\n                target: `${key}.${column}`,\n                // Never NOT NULL: an existing table with rows cannot take a\n                // non-null column without a default, and inventing one would be\n                // guessing at the customer's data.\n                sql: `ALTER TABLE \"${schema}\".\"${table}\" ADD COLUMN IF NOT EXISTS \"${column}\" ${type};`\n            });\n        }\n    }\n\n    return { actions, statements: actions.map(a => a.sql) };\n}\n\n/** Read what the database has, for the schemas the collections live in. */\nexport async function readExistingSchema(\n    client: Queryable,\n    schemas: string[]\n): Promise<ExistingSchema> {\n    const tables = new Map<string, Set<string>>();\n    const enums = new Set<string>();\n    if (schemas.length === 0) return { tables, enums };\n\n    const inList = schemas\n        .map(schema => `'${assertSafeIdentifier(schema, \"schema name\")}'`)\n        .join(\", \");\n\n    const { rows: columns } = await client.query<{\n        table_schema: string;\n        table_name: string;\n        column_name: string;\n    }>(\n        `SELECT table_schema, table_name, column_name\n         FROM information_schema.columns\n         WHERE table_schema IN (${inList})`\n    );\n    for (const row of columns) {\n        const key = `${row.table_schema}.${row.table_name}`;\n        if (!tables.has(key)) tables.set(key, new Set());\n        tables.get(key)!.add(row.column_name);\n    }\n\n    const { rows: enumRows } = await client.query<{ schema: string; name: string }>(\n        `SELECT n.nspname AS schema, t.typname AS name\n         FROM pg_type t\n         JOIN pg_namespace n ON t.typnamespace = n.oid\n         WHERE t.typtype = 'e' AND n.nspname IN (${inList})`\n    );\n    for (const row of enumRows) enums.add(`${row.schema}.${row.name}`);\n\n    return { tables, enums };\n}\n\n/**\n * Bring the database up to date. Returns what it did.\n *\n * Each statement runs on its own rather than in one transaction: they are all\n * independently safe and idempotent, and a single failure (an enum label that\n * cannot be added, say) should not roll back the tables that were created fine.\n * The error is surfaced with the statement that caused it.\n */\nexport async function ensureCollectionTables(\n    client: Queryable,\n    collections: CollectionConfig[],\n    log?: (message: string) => void\n): Promise<EnsurePlan> {\n    const schemas = Array.from(new Set(collections.map(schemaOf)));\n    for (const schema of schemas) {\n        assertSafeIdentifier(schema, \"schema name\");\n        if (schema !== \"public\") {\n            await client.query(`CREATE SCHEMA IF NOT EXISTS \"${schema}\";`);\n        }\n    }\n\n    const existing = await readExistingSchema(client, schemas);\n    const plan = planCollectionSchemaEnsure(collections, existing);\n\n    if (plan.actions.length === 0) {\n        log?.(\"Schema is up to date; nothing to create.\");\n        return plan;\n    }\n\n    for (const action of plan.actions) {\n        try {\n            await client.query(action.sql);\n            log?.(`${action.kind}: ${action.target}`);\n        } catch (err) {\n            throw new Error(\n                `Failed to ${action.kind} ${action.target}: ` +\n                `${err instanceof Error ? err.message : String(err)}\\n  ${action.sql}`\n            );\n        }\n    }\n    return plan;\n}\n"],"mappings":";;;;;;AAMA,IAAa,qBAAqB,UAAkB,SAAmC;CACnF,IAAI,QAAQ,gBAAgB,QAAQ,OAAO,KAAK,eAAe,UAC3D,OAAO,KAAK;CAEhB,OAAO,YAAY,QAAQ;AAC/B;AAEA,IAAM,qBAAqB,eAA+F;CACtH,IAAI,WAAW,YAAY;EACvB,MAAM,cAAc,OAAO,QAAQ,WAAW,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,UAAU,UAAW,QAA8B,QAAS,KAA4C,IAAI,CAAC;EACjL,IAAI,aAAa;GACb,MAAM,OAAO,YAAY;GACzB,MAAM,SAAS,KAAK,SAAS,YAAY,UAAU,QAAS,KAAmC,SAAS;GACxG,OAAO;IAAE,MAAM,YAAY;IAAI,MAAM,KAAK,SAAS,WAAW,WAAW;IAAU;GAAO;EAC9F;CACJ;CACA,MAAM,SAAS,WAAW,aAAa;CACvC,IAAI,QAAQ,SAAS,UACjB,OAAO;EAAE,MAAM;EAAM,MAAM;EAAU,QAAQ;CAAM;CAGvD,OAAO;EAAE,MAAM;EAAM,MAAM;EAAU,QADtB,QAAQ,SAAS,YAAY,UAAU,UAAW,OAAqC,SAAS;CAClD;AACjE;AAUA,IAAa,gBAAgB,UAAkB,MAAgB,eAA0C;CACrG,IAAI,UAAU,QAAQ,QAAQ,KAAK,IAAI,GAAG,OAAO;CAEjD,OAAO,CADe,OAAO,OAAO,WAAW,cAAc,CAAC,CAAC,CAAC,CAAC,MAAK,MAAK,UAAW,KAA2B,QAAS,EAAyC,IAAI,CAC/J,KAAiB,aAAa;AAC1C;;;;;;;;;;AA0BA,IAAa,4BAA4B,YAA8B,MAAoB,sBAAmD;CAC1I,MAAM,YAAY,aAAa,UAAU;CACzC,MAAM,MAAoC,KAAK,cAAc,KAAK,WAAW,SAAS,IAChF,KAAK,aACL,CAAC,KAAK,aAAa,KAAK;CAE9B,MAAM,cAAc,sBAAsB,MAAM,SAAS;CAEzD,OAAO,IAAI,SAAS,IAAI,UAAU;EAC9B,OAAO,+BAA+B,YAAY,MAAM,IAAI,YAAY,QAAQ,iBAAiB;CACrG,CAAC;AACL;AAEA,IAAM,kCAAkC,YAA8B,MAAoB,WAA8B,YAAoB,sBAAmD;CAC3L,MAAM,SAAS,2BAA2B,UAAU,KAAK,WAAW,SAAS,WAAW,SAAS;CACjG,MAAM,YAAY,aAAa,UAAU;CACzC,MAAM,QAAQ,KAAK,QAAQ,aAAA,CAAc,YAAY;CACrD,MAAM,iBAAiB,UAAU,YAAY;CAC7C,MAAM,UAAU,KAAK,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ;CAEnE,MAAM,aAAa,cAAc;CACjC,MAAM,iBAAiB,cAAc,YAAY,cAAc;CAK/D,MAAM,EAAE,WAAW,kBAAkB,yBAAyB,IAAI;CAElE,IAAI,cAAc,cAAc,YAAY,iBAAiB,WAAW,YAAY,EAAE,kBAAkB,CAAC,IAAI;CAC7G,IAAI,kBAAkB,kBAAkB,gBAAgB,iBAAiB,eAAe,YAAY,EAAE,kBAAkB,CAAC,IAAI;CAE7H,IAAI,CAAC,eAAe,YAChB,cAAc;CAElB,IAAI,CAAC,mBAAmB,gBACpB,kBAAkB;CAGtB,MAAM,OAAO,0BAA0B,WAAW,QAAQ,OAAO,KAAK,UAAU;CAChF,IAAI,SAAS,kBAAkB,WAAW,QAAQ,OAAO,KAAK,UAAU,OAAO,KAAK,OAAO,eAAe,MAAM,QAAQ,KAAI,MAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;CACpJ,IAAI,aAAa,UAAU,WAAW,YAAY;CAClD,IAAI,iBAAiB,UAAU,gBAAgB,gBAAgB;CAC/D,UAAU;CACV,OAAO,CAAC,MAAM,MAAM;AACxB;AAEA,IAAa,oBAAoB,UAAkB,MAAgB,YAA8B,gBAA4C;CACzI,QAAQ,KAAK,MAAb;EACI,KAAK,UAAU;GACX,MAAM,aAAa;GACnB,IAAI,WAAW,MAAM;IACjB,MAAM,YAAY,aAAa,UAAU;IACzC,MAAM,UAAU,kBAAkB,UAAU,IAAI;IAEhD,OAAO,IADQ,2BAA2B,UAAU,KAAK,WAAW,SAAS,WAAW,SAAS,SAC/E,KAAK,UAAU,GAAG,QAAQ;GAChD;GACA,IAAI,WAAW,SAAS,UAAU,WAAW,eAAe,QACxD,OAAO;GAMX,IAAI,WAAW,eAAe,QAC1B,OAAO,QAAQ,0BAA0B,UAAU,EAAE;GAEzD,IAAI,WAAW,eAAe,WAC1B,OAAO,WAAW,0BAA0B,UAAU,EAAE;GAO5D,OAAO;EACX;EACA,KAAK,UAAU;GACX,MAAM,UAAU;GAChB,MAAM,OAAO,aAAa,UAAU,MAAM,UAAU;GACpD,IAAI,UAAU,WAAW,QAAQ,SAAS,aACtC,OAAO;GAEX,IAAI,QAAQ,YAAY;IACpB,IAAI,QAAQ,eAAe,oBAAoB,OAAO;IACtD,OAAO,QAAQ,WAAW,YAAY;GAC1C;GACA,OAAQ,QAAQ,YAAY,WAAW,OAAQ,YAAY;EAC/D;EACA,KAAK,WACD,OAAO;EACX,KAAK,QAAQ;GACT,MAAM,WAAW;GACjB,IAAI,SAAS,eAAe,QAAQ,OAAO;GAC3C,IAAI,SAAS,eAAe,QAAQ,OAAO;GAC3C,OAAO;EACX;EACA,KAAK,OAED,OAAO,KAAQ,eAAe,SAAS,SAAS;EAEpD,KAAK,SAAS;GACV,MAAM,YAAY;GAClB,IAAI,UAAU,UAAU;GACxB,IAAI,CAAC,WAAW,UAAU,MAAM,CAAC,MAAM,QAAQ,UAAU,EAAE,GAAG;IAC1D,MAAM,SAAS,UAAU;IACzB,IAAI,OAAO,SAAS,UAChB,UAAU;SACP,IAAI,OAAO,SAAS,UACvB,UAAU,OAAO,YAAY,UAAU,cAAc;SAClD,IAAI,OAAO,SAAS,WACvB,UAAU;GAElB;GACA,IAAI,YAAY,QAAQ,OAAO;GAC/B,IAAI,YAAY,UAAU,OAAO;GACjC,IAAI,YAAY,aAAa,OAAO;GACpC,IAAI,YAAY,aAAa,OAAO;GACpC,IAAI,YAAY,aAAa,OAAO;GACpC,OAAO;EACX;EACA,KAAK,UAED,OAAO,UAAU,KAAG,WAAW;EAEnC,KAAK,UACD,OAAO;EAEX,KAAK,YAAY;GACb,MAAM,UAAU;GAEhB,MAAM,WAAW,aADS,2BAA2B,UACvB,GAAmB,QAAQ,UAAU,gBAAgB,QAAQ;GAC3F,IAAI,UAAU,SAAS,aACnB,MAAM,IAAI,MAAM,YAAY,SAAS,+DAA+D;GAExG,IAAI;GACJ,IAAI;IACA,mBAAmB,SAAS,OAAO;GACvC,QAAQ;IACJ,OAAO;GACX;GACA,MAAM,SAAS,kBAAkB,gBAAgB;GACjD,OAAO,OAAO,SAAS,WAAW,YAAa,OAAO,SAAS,SAAS;EAC5E;EACA,KAAK,aAAa;GACd,MAAM,UAAU;GAChB,MAAM,mBAAmB,YAAY,MAAK,MAAK,EAAE,SAAS,QAAQ,QAAQ,aAAa,CAAC,MAAM,QAAQ,IAAI;GAC1G,IAAI,CAAC,kBAAkB,OAAO;GAC9B,MAAM,SAAS,kBAAkB,gBAAgB;GACjD,OAAO,OAAO,SAAS,WAAW,YAAa,OAAO,SAAS,SAAS;EAC5E;EACA,SACI,OAAO;CACf;AACJ;;;;;;;;;;;;;;;;;AAmTA,IAAa,0BAA0B,gBAA4D;CAC/F,MAAM,qBAAwC,SAAS,YAAY,MAAK,MAAK,EAAE,SAAS,QAAQ,aAAa,CAAC,MAAM,IAAI;CACxH,MAAM,QAAgC,CAAC;CACvC,MAAM,uBAAO,IAAI,IAAY;CAE7B,KAAK,MAAM,cAAc,aAAa;EAClC,MAAM,YAAY,aAAa,UAAU;EACzC,IAAI,CAAC,WAAW;EAChB,MAAM,SAAS,2BAA2B,UAAU,KAAK,WAAW,SAAS,WAAW,SAAS;EACjG,MAAM,gBAAgB,UAAU,SAAS,GAAG,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,IAAI,IAAK;EAC9E,MAAM,YAAY,GAAG,OAAO,GAAG;EAC/B,IAAI,KAAK,IAAI,SAAS,GAAG;EACzB,KAAK,IAAI,SAAS;EAElB,MAAM,mBAA6B,CAAC;EACpC,KAAK,MAAM,QAAQ,0BAA0B,UAAU,GACnD,iBAAiB,KAAK,GAAG,yBAAyB,YAAY,MAAM,iBAAiB,CAAC;EAG1F,MAAM,KAAK;GACP;GACA,OAAO;GACP;GACA,WAAW,gBAAgB,OAAO,KAAK,cAAc;GACrD;EACJ,CAAC;CACL;CAEA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC5fA,IAAM,kBAAkB;AAExB,SAAS,qBAAqB,OAAe,MAAsB;CAC/D,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAC3B,MAAM,IAAI,MAAM,wCAAwC,KAAK,IAAI,KAAK,UAAU,KAAK,GAAG;CAE5F,OAAO;AACX;AAuBA,SAAS,SAAS,YAAsC;CACpD,OAAO,2BAA2B,UAAU,KAAK,WAAW,SAAS,WAAW,SAAS;AAC7F;AAEA,SAAS,UAAU,YAAsC;CACrD,OAAO,GAAG,SAAS,UAAU,EAAE,GAAG,aAAa,UAAU;AAC7D;;;;;;;;;AAUA,SAAS,cAAc,YAAoE;CACvF,MAAM,QAAQ,aAAa,UAAU;CACrC,MAAM,SAAS,SAAS,UAAU;CAClC,MAAM,MAA4C,CAAC;CACnD,KAAK,MAAM,CAAC,UAAU,SAAS,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,GAAG;EACxE,MAAM,IAAI;EACV,IAAI,EAAE,UAAU,MAAM,CAAC,EAAE,MAAM;EAC/B,IAAI,EAAE,SAAS,YAAY,EAAE,SAAS,UAAU;EAChD,MAAM,SAAU,EAAE,KACb,KAAI,UACD,SAAS,OAAO,UAAU,YAAY,QAAS,QACzC,OAAQ,MAAkC,EAAE,IAC5C,OAAO,KAAK,CACtB,CAAC,CACA,QAAO,MAAK,EAAE,SAAS,CAAC;EAC7B,IAAI,OAAO,WAAW,GAAG;EACzB,IAAI,KAAK;GAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,kBAAkB,UAAU,CAAC;GAAK;EAAO,CAAC;CACrF;CACA,OAAO;AACX;;AAGA,SAAS,aAAa,OAAuB;CACzC,OAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,EAAE;AACzC;;;;;;;;AASA,SAAgB,2BACZ,aACA,UACU;CACV,MAAM,UAA0B,CAAC;CACjC,MAAM,+BAAe,IAAI,IAAY;CAIrC,KAAK,MAAM,cAAc,aACrB,KAAK,MAAM,EAAE,MAAM,YAAY,cAAc,UAAU,GAAG;EACtD,IAAI,SAAS,MAAM,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,GAAG;EACxD,aAAa,IAAI,IAAI;EACrB,MAAM,CAAC,QAAQ,YAAY,KAAK,MAAM,GAAG;EACzC,QAAQ,KAAK;GACT,MAAM;GACN,QAAQ;GACR,KAAK,gBAAgB,OAAO,KAAK,SAAS,aAAa,OAAO,IAAI,YAAY,CAAC,CAAC,KAAK,IAAI,EAAE;EAC/F,CAAC;CACL;CAOJ,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,cAAc,aAAa;EAClC,MAAM,MAAM,UAAU,UAAU;EAChC,IAAI,SAAS,OAAO,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG;EAClD,QAAQ,IAAI,GAAG;EACf,MAAM,SAAS,SAAS,UAAU;EAClC,MAAM,QAAQ,aAAa,UAAU;EACrC,MAAM,UAAU,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,OAClE,aAAa,GAAG,GAAe,UAAU,CAC7C;EACA,MAAM,SAAS,UAAU,kBAAkB,QAAQ,IAAI,QAAQ,EAAc,IAAI;EACjF,MAAM,SAAS,UAAU;EACzB,IAAI;EACJ,IAAI,QAAQ,SAAS,UACjB,QAAQ,IAAI,OAAO;OAChB,IACH,UACA,OAAO,SAAS,YACf,OAA8B,SAAS,QAExC,QAAQ,IAAI,OAAO;OAEnB,QAAQ,IAAI,OAAO;EAEvB,QAAQ,KAAK;GACT,MAAM;GACN,QAAQ;GACR,KAAK,+BAA+B,OAAO,KAAK,MAAM,KAAK,MAAM;EACrE,CAAC;CACL;CAGA,KAAK,MAAM,cAAc,aAAa;EAClC,MAAM,MAAM,UAAU,UAAU;EAChC,MAAM,SAAS,SAAS,UAAU;EAClC,MAAM,QAAQ,aAAa,UAAU;EACrC,MAAM,UAAU,SAAS,OAAO,IAAI,GAAG,qBAAK,IAAI,IAAY;EAC5D,KAAK,MAAM,CAAC,UAAU,SAAS,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,GAAG;GACxE,MAAM,IAAI;GACV,IAAI,aAAa,UAAU,GAAG,UAAU,GAAG;GAK3C,IAAI,EAAE,SAAS,eAAe,EAAE,SAAS,YAAY;GACrD,MAAM,SAAS,kBAAkB,UAAU,CAAC;GAC5C,IAAI,QAAQ,IAAI,MAAM,GAAG;GACzB,MAAM,OAAO,iBAAiB,UAAU,GAAG,YAAY,WAAW;GAClE,QAAQ,KAAK;IACT,MAAM;IACN,QAAQ,GAAG,IAAI,GAAG;IAIlB,KAAK,gBAAgB,OAAO,KAAK,MAAM,8BAA8B,OAAO,IAAI,KAAK;GACzF,CAAC;EACL;CACJ;CAEA,OAAO;EAAE;EAAS,YAAY,QAAQ,KAAI,MAAK,EAAE,GAAG;CAAE;AAC1D;;AAGA,eAAsB,mBAClB,QACA,SACuB;CACvB,MAAM,yBAAS,IAAI,IAAyB;CAC5C,MAAM,wBAAQ,IAAI,IAAY;CAC9B,IAAI,QAAQ,WAAW,GAAG,OAAO;EAAE;EAAQ;CAAM;CAEjD,MAAM,SAAS,QACV,KAAI,WAAU,IAAI,qBAAqB,QAAQ,aAAa,EAAE,EAAE,CAAC,CACjE,KAAK,IAAI;CAEd,MAAM,EAAE,MAAM,YAAY,MAAM,OAAO,MAKnC;;kCAE0B,OAAO,EACrC;CACA,KAAK,MAAM,OAAO,SAAS;EACvB,MAAM,MAAM,GAAG,IAAI,aAAa,GAAG,IAAI;EACvC,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,OAAO,IAAI,qBAAK,IAAI,IAAI,CAAC;EAC/C,OAAO,IAAI,GAAG,CAAC,CAAE,IAAI,IAAI,WAAW;CACxC;CAEA,MAAM,EAAE,MAAM,aAAa,MAAM,OAAO,MACpC;;;mDAG2C,OAAO,EACtD;CACA,KAAK,MAAM,OAAO,UAAU,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,IAAI,MAAM;CAEjE,OAAO;EAAE;EAAQ;CAAM;AAC3B;;;;;;;;;AAUA,eAAsB,uBAClB,QACA,aACA,KACmB;CACnB,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,QAAQ,CAAC,CAAC;CAC7D,KAAK,MAAM,UAAU,SAAS;EAC1B,qBAAqB,QAAQ,aAAa;EAC1C,IAAI,WAAW,UACX,MAAM,OAAO,MAAM,gCAAgC,OAAO,GAAG;CAErE;CAGA,MAAM,OAAO,2BAA2B,aAAa,MAD9B,mBAAmB,QAAQ,OAAO,CACI;CAE7D,IAAI,KAAK,QAAQ,WAAW,GAAG;EAC3B,MAAM,0CAA0C;EAChD,OAAO;CACX;CAEA,KAAK,MAAM,UAAU,KAAK,SACtB,IAAI;EACA,MAAM,OAAO,MAAM,OAAO,GAAG;EAC7B,MAAM,GAAG,OAAO,KAAK,IAAI,OAAO,QAAQ;CAC5C,SAAS,KAAK;EACV,MAAM,IAAI,MACN,aAAa,OAAO,KAAK,GAAG,OAAO,OAAO,IACvC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,MAAM,OAAO,KACrE;CACJ;CAEJ,OAAO;AACX"}

package/dist/index.es.js

@@ -3453,6 +3453,38 @@ function extractCauseMessage(error) {
 	return null;
 }
 /**
+* Codes that mean "this connection will never work as configured".
+*
+* A wrong password or a database that does not exist is a settled fact about
+* the connection string, not a transient fault — retrying produces the same
+* answer forever.
+*/
+var UNRECOVERABLE_CONNECT_CODES = /* @__PURE__ */ new Set([
+	"28P01",
+	"28000",
+	"3D000",
+	"42501"
+]);
+/**
+* Describe a failed connection attempt in terms a developer can act on.
+*
+* The error a caller catches is Drizzle's wrapper: its message is
+* `Failed query: SELECT 1` and its stack runs through drizzle internals, while
+* the sentence that says what is actually wrong — "password authentication
+* failed for user …", "database … does not exist" — sits in `.cause`. Logging
+* the wrapper, as the bootstrapper used to, tells a developer with a typo in
+* their `DATABASE_URL` nothing at all.
+*/
+function classifyConnectFailure(error) {
+	const pgError = extractPgError(error);
+	const reason = pgError?.message ?? extractCauseMessage(error) ?? (error instanceof Error ? error.message : String(error));
+	return {
+		fatal: Boolean(pgError?.code && UNRECOVERABLE_CONNECT_CODES.has(pgError.code)),
+		reason,
+		code: pgError?.code
+	};
+}
+/**
 * Detect whether an error is specifically a role-switching permission failure
 * (e.g. "permission denied to set role" or "must be member of role"),
 * as opposed to a table-level permission denial.
@@ -11332,11 +11364,27 @@ function buildProperties(meta, enumMap) {
 	return properties;
 }
 /**
-* Owning relations, derived from this table's foreign keys. Mirrors the shape
-* `generateCollectionFile` emits, except `target` uses the slug string form
-* rather than a thunk to a module import.
-*/
-function buildRelations(meta, slugByTable) {
+* Owning relations, derived from this table's foreign keys — the same shape
+* `generateCollectionFile` writes into a collection file: a `relation` property
+* whose nested descriptor carries `kind`, a `target` thunk and the `localKey`.
+*
+* The shape is load-bearing, not cosmetic. `resolveCollectionRelations` reads
+* relations from `property.relation` and `resolveRelation` requires `target` to
+* be a thunk; this used to emit `target`/`cardinality`/`localKey` flat on the
+* property with the slug as a bare string, which satisfies neither. Nothing
+* threw — the resolver simply skipped every such property and reported that the
+* collection had no relations. So an introspected BaaS collection had its FK
+* columns removed from `properties` (they "surface as relations") and then no
+* resolvable relation to surface as, which is why writing the FK column
+* directly came back as `has no field 'product_id'`: `assertKnownWriteFields`
+* learns that column from the resolved relation's `localKey`.
+*
+* The thunk closes over the collections being built in this same pass rather
+* than importing a module, which is what a runtime introspection has instead of
+* generated files. It is called lazily, after the map is fully populated, so a
+* table may reference one introspected later.
+*/
+function buildRelations(meta, slugByTable, collectionBySlug) {
 	const relations = {};
 	for (const fk of meta.fks) {
 		const targetSlug = slugByTable.get(fk.foreign_table_name);
@@ -11346,10 +11394,11 @@ function buildRelations(meta, slugByTable) {
 		relations[key] = {
 			name: humanize(key),
 			type: "relation",
-			target: targetSlug,
-			cardinality: "one",
-			direction: "owning",
-			localKey: fk.column_name
+			relation: {
+				kind: "belongsTo",
+				target: () => collectionBySlug.get(targetSlug),
+				localKey: fk.column_name
+			}
 		};
 	}
 	return relations;
@@ -11364,6 +11413,7 @@ function buildCollectionsFromSchema({ tablesMap, enumMap, joinTables }, pgSchema
 	const slugByTable = /* @__PURE__ */ new Map();
 	for (const tableName of tablesMap.keys()) if (!joinTables.has(tableName)) slugByTable.set(tableName, tableName);
 	const collections = [];
+	const collectionBySlug = /* @__PURE__ */ new Map();
 	for (const [tableName, meta] of tablesMap) {
 		if (joinTables.has(tableName)) continue;
 		const collectionName = humanize(tableName);
@@ -11376,10 +11426,11 @@ function buildCollectionsFromSchema({ tablesMap, enumMap, joinTables }, pgSchema
 			icon: getIconForTable(tableName),
 			properties: {
 				...buildProperties(meta, enumMap),
-				...buildRelations(meta, slugByTable)
+				...buildRelations(meta, slugByTable, collectionBySlug)
 			}
 		};
 		collections.push(collection);
+		collectionBySlug.set(tableName, collection);
 	}
 	return collections;
 }
@@ -11639,7 +11690,18 @@ function createPostgresBootstrapper(pgConfig) {
 					logger.error(message);
 					throw new Error(`Cannot connect to PostgreSQL at ${hostInfo}: connection refused. Is the database running?`);
 				}
-				logger.error("❌ Failed to connect to PostgreSQL", { error: err });
+				const { fatal, reason, code } = classifyConnectFailure(err);
+				const detail = code ? ` [${code}]` : "";
+				if (fatal) {
+					logger.error(`
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ❌  PostgreSQL refused the connection
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  ${reason}${detail}\n\n  The server is reachable, so this is the credentials or the\n  database name in DATABASE_URL — check them in your .env.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`);
+					throw new Error(`PostgreSQL refused the connection: ${reason}${detail}`);
+				}
+				logger.error(`❌ Failed to connect to PostgreSQL: ${reason}${detail}`, { error: err });
 				logger.warn("⚠️ Continuing without initial database verification. Drizzle/PG will attempt to connect on subsequent queries.");
 			}
 			const realtimeService = new RealtimeService(schemaAwareDb, registry);
@@ -11773,15 +11835,16 @@ function createPostgresBootstrapper(pgConfig) {
 						const lines = missing.map((m) => `    • collection "${m.slug}" → table "${m.table}"`);
 						logger.warn([
 							"",
-							"┌──────────────────────────────────────────────────────────────┐",
-							"│  ⚠️  SCHEMA DRIFT — Missing tables in database               │",
-							"├──────────────────────────────────────────────────────────────┤",
-							...lines.map((l) => `│ ${l.padEnd(60)}│`),
-							"├──────────────────────────────────────────────────────────────┤",
-							"│  Run one of:                                                 │",
-							"│    pnpm db:push      (dev — fast, no migration files)        │",
-							"│    pnpm db:migrate   (prod — creates migration files)        │",
-							"└──────────────────────────────────────────────────────────────┘",
+							"⚠️  SCHEMA DRIFT — the database is missing tables this backend serves:",
+							...lines,
+							"",
+							"  This runtime applies the collection schema at boot unless",
+							"  REBASE_MIGRATE_ON_BOOT=none. Check the \"Collection schema\" / \"policies\"",
+							"  log lines above — this drift means that step was off, skipped, or failed.",
+							"    • Managed cloud: redeploy (or restart) with REBASE_MIGRATE_ON_BOOT",
+							"      unset or \"ensure\"; the runtime applies the schema to the tenant DB.",
+							"    • Self-host: run `rebase db push` (dev) or `rebase db migrate` (prod)",
+							"      against DATABASE_URL.",
 							""
 						].join("\n"));
 					}
@@ -11868,12 +11931,38 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CIHSH962.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-Vu-GRELM.js");
 			return { applied: (await ensureCollectionTables({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
 			} }, collections, log)).actions.length };
 		},
+		/**
+		* Apply the collections' RLS policies — ENABLE ROW LEVEL SECURITY and the
+		* `securityRules` compiled to `CREATE POLICY` — so a freshly provisioned
+		* database serves data instead of denying every user-context read.
+		*
+		* The companion to {@link ensureCollectionSchema}: that creates the
+		* tables, this makes them servable. Boot runs it *after* auth
+		* initialization, because the generated policies call `auth.uid()` /
+		* `auth.roles()`, and `CREATE POLICY` validates those functions exist.
+		*
+		* Runs through the same drizzle handle, one statement at a time (that
+		* handle speaks the extended query protocol, which rejects multi-command
+		* strings). Failures are per-table and non-fatal: a table left un-policed
+		* stays RLS-enabled, so it denies rather than leaks.
+		*/
+		async ensureCollectionPolicies(collections, driverResult, log) {
+			const internals = driverResult.internals;
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-CT-zIUWA.js");
+			const outcome = await ensureCollectionPolicies({ async query(text) {
+				const result = await internals.db.execute(sql.raw(text));
+				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
+			} }, collections, log);
+			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
+			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — it stays locked (denies) until this is resolved: ${failure.error}`);
+			return { applied: outcome.policiesApplied };
+		},
 		getAdmin(driverResult) {
 			return driverResult.internals.driver.admin;
 		},
@@ -11908,6 +11997,8 @@ function createPostgresAdapter(pgConfig) {
 		initializeWebsockets(server, realtimeService, driver, config) {
 			if (bootstrapper.initializeWebsockets) return bootstrapper.initializeWebsockets(server, realtimeService, driver, config);
 		},
+		ensureCollectionSchema: bootstrapper.ensureCollectionSchema ? (collections, driverResult, log) => bootstrapper.ensureCollectionSchema(collections, driverResult, log) : void 0,
+		ensureCollectionPolicies: bootstrapper.ensureCollectionPolicies ? (collections, driverResult, log) => bootstrapper.ensureCollectionPolicies(collections, driverResult, log) : void 0,
 		getAdmin(driverResult) {
 			if (bootstrapper.getAdmin) return bootstrapper.getAdmin(driverResult);
 		},