@rebasepro/server-postgres 0.12.1-canary.g5f403cf → 0.12.1-canary.g7f1150f

package/dist/ensure-collection-policies-t875gSJF.js

@@ -0,0 +1,57 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { readExistingSchema, t as planCollectionPolicies } from "./ensure-collection-tables-DmOzh_G6.js";
+//#region src/schema/ensure-collection-policies.ts
+var isCreatePolicy = (statement) => /^\s*CREATE POLICY/i.test(statement);
+/**
+* Bring the declared collections' RLS policies up to date. Returns what it did.
+*
+* Only tables that already exist are touched: the boot-time table creator runs
+* first, so anything still missing is a table this additive path is not allowed
+* to create (a junction, or a relation left to a migration). Enabling RLS on a
+* non-existent table would error, so those are recorded as skipped, not failed.
+*/
+async function ensureCollectionPolicies(client, collections, log) {
+	const result = {
+		policiesApplied: 0,
+		tablesSecured: 0,
+		skipped: [],
+		failures: []
+	};
+	const plans = planCollectionPolicies(collections);
+	if (plans.length === 0) return result;
+	const existing = await readExistingSchema(client, Array.from(new Set(plans.map((p) => p.schema))));
+	for (const plan of plans) {
+		if (!existing.tables.has(plan.qualified)) {
+			result.skipped.push({
+				table: plan.qualified,
+				reason: "table is not present in the database; create it with `rebase db push` / `rebase db migrate`"
+			});
+			continue;
+		}
+		try {
+			await client.query(plan.enableRls);
+			result.tablesSecured++;
+			let created = 0;
+			for (const statement of plan.policyStatements) {
+				await client.query(statement);
+				if (isCreatePolicy(statement)) {
+					result.policiesApplied++;
+					created++;
+				}
+			}
+			log?.(`${plan.qualified}: RLS enabled, ${created} policy(ies) applied`);
+		} catch (err) {
+			result.failures.push({
+				table: plan.qualified,
+				error: err instanceof Error ? err.message : String(err)
+			});
+		}
+	}
+	return result;
+}
+//#endregion
+export { ensureCollectionPolicies };
+
+//# sourceMappingURL=ensure-collection-policies-t875gSJF.js.map

package/dist/ensure-collection-policies-t875gSJF.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-collection-policies-t875gSJF.js","names":[],"sources":["../src/schema/ensure-collection-policies.ts"],"sourcesContent":["/**\n * Applying a bundle's RLS policies to a database at boot, idempotently.\n *\n * ## Why this exists\n *\n * {@link ensureCollectionTables} creates the collection *tables* a managed\n * runtime boots against, but a table with row-level security disabled and no\n * policies is not servable: authenticated requests run as the restricted\n * `rebase_user` role, so a read with no `SELECT` policy returns nothing (a\n * public collection answered 401) and a write with no `INSERT`/`UPDATE` policy\n * is denied. The policies live in the collections' `securityRules`; nothing at\n * boot applied them. `rebase db push` does — but it drives Atlas against a\n * local `DATABASE_URL`, and a managed tenant's database is reachable only from\n * inside the cluster, by the runtime that is already connected to it. So the\n * runtime is the only thing that *can* apply them, and this is where it does.\n *\n * ## Why this is safe to run on every boot\n *\n * Every statement is idempotent: `ENABLE ROW LEVEL SECURITY` is a no-op once\n * enabled, and each policy is a `DROP POLICY IF EXISTS` immediately followed by\n * a `CREATE POLICY`, so re-applying asserts exactly the declared state. It adds\n * and replaces; it never drops data. (It does not *reconcile* — a policy a\n * previous push left behind under an old name is not removed here; that stays a\n * `db push` / `db migrate` concern, alongside destructive schema changes.)\n *\n * Unlike table creation, a failure here is not fatal: RLS stays enabled, so a\n * table whose policies could not be applied fails **closed** (denies) rather\n * than leaking rows. One collection's policy failing (e.g. a rule that\n * references a table a real migration has not created yet) must not crash-loop\n * the whole deployment and take the other collections' working routes down with\n * it. Failures are reported loudly and per-table so the operator can see\n * exactly which collection is not yet servable and why.\n */\nimport { type CollectionConfig } from \"@rebasepro/types\";\nimport { planCollectionPolicies } from \"./generate-postgres-ddl-logic\";\nimport { readExistingSchema, type Queryable } from \"./ensure-collection-tables\";\n\nexport interface PolicyEnsureResult {\n    /** `CREATE POLICY` statements that ran successfully. */\n    policiesApplied: number;\n    /** Tables that had RLS enabled. */\n    tablesSecured: number;\n    /** Declared tables absent from the database — left to a real migration. */\n    skipped: { table: string; reason: string }[];\n    /** Tables whose RLS could not be fully applied (fail closed). */\n    failures: { table: string; error: string }[];\n}\n\nconst isCreatePolicy = (statement: string): boolean => /^\\s*CREATE POLICY/i.test(statement);\n\n/**\n * Bring the declared collections' RLS policies up to date. Returns what it did.\n *\n * Only tables that already exist are touched: the boot-time table creator runs\n * first, so anything still missing is a table this additive path is not allowed\n * to create (a junction, or a relation left to a migration). Enabling RLS on a\n * non-existent table would error, so those are recorded as skipped, not failed.\n */\nexport async function ensureCollectionPolicies(\n    client: Queryable,\n    collections: CollectionConfig[],\n    log?: (message: string) => void\n): Promise<PolicyEnsureResult> {\n    const result: PolicyEnsureResult = { policiesApplied: 0, tablesSecured: 0, skipped: [], failures: [] };\n\n    const plans = planCollectionPolicies(collections);\n    if (plans.length === 0) return result;\n\n    const schemas = Array.from(new Set(plans.map(p => p.schema)));\n    const existing = await readExistingSchema(client, schemas);\n\n    for (const plan of plans) {\n        if (!existing.tables.has(plan.qualified)) {\n            result.skipped.push({\n                table: plan.qualified,\n                reason: \"table is not present in the database; create it with `rebase db push` / `rebase db migrate`\"\n            });\n            continue;\n        }\n\n        try {\n            // Enable first: if a later policy statement fails, the table is left\n            // locked (deny-all for the user role) rather than open.\n            await client.query(plan.enableRls);\n            result.tablesSecured++;\n\n            let created = 0;\n            for (const statement of plan.policyStatements) {\n                await client.query(statement);\n                if (isCreatePolicy(statement)) {\n                    result.policiesApplied++;\n                    created++;\n                }\n            }\n            log?.(`${plan.qualified}: RLS enabled, ${created} policy(ies) applied`);\n        } catch (err) {\n            result.failures.push({\n                table: plan.qualified,\n                error: err instanceof Error ? err.message : String(err)\n            });\n        }\n    }\n\n    return result;\n}\n"],"mappings":";;;;;AAgDA,IAAM,kBAAkB,cAA+B,qBAAqB,KAAK,SAAS;;;;;;;;;AAU1F,eAAsB,yBAClB,QACA,aACA,KAC2B;CAC3B,MAAM,SAA6B;EAAE,iBAAiB;EAAG,eAAe;EAAG,SAAS,CAAC;EAAG,UAAU,CAAC;CAAE;CAErG,MAAM,QAAQ,uBAAuB,WAAW;CAChD,IAAI,MAAM,WAAW,GAAG,OAAO;CAG/B,MAAM,WAAW,MAAM,mBAAmB,QAD1B,MAAM,KAAK,IAAI,IAAI,MAAM,KAAI,MAAK,EAAE,MAAM,CAAC,CACT,CAAO;CAEzD,KAAK,MAAM,QAAQ,OAAO;EACtB,IAAI,CAAC,SAAS,OAAO,IAAI,KAAK,SAAS,GAAG;GACtC,OAAO,QAAQ,KAAK;IAChB,OAAO,KAAK;IACZ,QAAQ;GACZ,CAAC;GACD;EACJ;EAEA,IAAI;GAGA,MAAM,OAAO,MAAM,KAAK,SAAS;GACjC,OAAO;GAEP,IAAI,UAAU;GACd,KAAK,MAAM,aAAa,KAAK,kBAAkB;IAC3C,MAAM,OAAO,MAAM,SAAS;IAC5B,IAAI,eAAe,SAAS,GAAG;KAC3B,OAAO;KACP;IACJ;GACJ;GACA,MAAM,GAAG,KAAK,UAAU,iBAAiB,QAAQ,qBAAqB;EAC1E,SAAS,KAAK;GACV,OAAO,SAAS,KAAK;IACjB,OAAO,KAAK;IACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC1D,CAAC;EACL;CACJ;CAEA,OAAO;AACX"}

package/dist/ensure-collection-tables-DmOzh_G6.js

@@ -0,0 +1,589 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { O as toSnakeCase, T as getPolicyNamesForRule, a as getJunctionSecurityRules, c as policyToPostgres, d as findRelation, g as resolveCollectionRelations, i as getJunctionCollectionConfig, l as securityRuleToConditions, m as getTableName, o as resolveJunctionSpecs, r as resolveStringColumnLength, s as getEffectiveSecurityRules } from "./src-DihrDFuP.js";
+import { n as isPostgresCollectionConfig } from "./src-DoU9yPqq.js";
+//#region src/schema/generate-postgres-ddl-logic.ts
+var resolveColumnName = (propName, prop) => {
+	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+	return toSnakeCase(propName);
+};
+var getPrimaryKeyProp = (collection) => {
+	if (collection.properties) {
+		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
+		if (idPropEntry) {
+			const prop = idPropEntry[1];
+			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
+			return {
+				name: idPropEntry[0],
+				type: prop.type === "number" ? "number" : "string",
+				isUuid
+			};
+		}
+	}
+	const idProp = collection.properties?.["id"];
+	if (idProp?.type === "number") return {
+		name: "id",
+		type: "number",
+		isUuid: false
+	};
+	return {
+		name: "id",
+		type: "string",
+		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
+	};
+};
+var isNumericId = (collection) => {
+	return getPrimaryKeyProp(collection).type === "number";
+};
+var getPrimaryKeyName = (collection) => {
+	return getPrimaryKeyProp(collection).name;
+};
+/** The column type a junction holds for one endpoint's primary key. */
+var junctionKeyType = (collection) => isNumericId(collection) ? "INTEGER" : getPrimaryKeyProp(collection).isUuid ? "UUID" : "TEXT";
+var isIdProperty = (propName, prop, collection) => {
+	if ("isId" in prop && Boolean(prop.isId)) return true;
+	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
+};
+/**
+* The individual SQL statements a single security rule compiles to: a
+* `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete
+* statement (terminated by `;`, no trailing newline).
+*
+* This is the primitive the boot-time RLS applier runs one statement at a time
+* (the runtime's DB handle speaks the extended query protocol, which forbids
+* multiple commands in one execute), while `db push` writes the joined string.
+*/
+var generatePolicyStatements = (collection, rule, resolveCollection) => {
+	const tableName = getTableName(collection);
+	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+	const policyNames = getPolicyNamesForRule(rule, tableName);
+	return ops.flatMap((op, opIdx) => {
+		return generateSinglePolicyStatements(collection, rule, op, policyNames[opIdx], resolveCollection);
+	});
+};
+var generateSinglePolicyStatements = (collection, rule, operation, policyName, resolveCollection) => {
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	const tableName = getTableName(collection);
+	const mode = (rule.mode ?? "permissive").toUpperCase();
+	const operationUpper = operation.toUpperCase();
+	const pgRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
+	const needsUsing = operation !== "insert";
+	const needsWithCheck = operation !== "select" && operation !== "delete";
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	let usingClause = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection, { resolveCollection }) : null;
+	let withCheckClause = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection, { resolveCollection }) : null;
+	if (!usingClause && needsUsing) usingClause = "false";
+	if (!withCheckClause && needsWithCheck) withCheckClause = "false";
+	const drop = `DROP POLICY IF EXISTS "${policyName}" ON "${schema}"."${tableName}";`;
+	let create = `CREATE POLICY "${policyName}" ON "${schema}"."${tableName}" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map((r) => `"${r}"`).join(", ")}`;
+	if (usingClause) create += ` USING (${usingClause})`;
+	if (withCheckClause) create += ` WITH CHECK (${withCheckClause})`;
+	create += ";";
+	return [drop, create];
+};
+var getSqlColumnType = (propName, prop, collection, collections) => {
+	switch (prop.type) {
+		case "string": {
+			const stringProp = prop;
+			if (stringProp.enum) {
+				const tableName = getTableName(collection);
+				const colName = resolveColumnName(propName, prop);
+				return `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${tableName}_${colName}"`;
+			}
+			if (stringProp.isId === "uuid" || stringProp.columnType === "uuid") return "UUID";
+			if (stringProp.columnType === "char") return `CHAR(${resolveStringColumnLength(stringProp)})`;
+			if (stringProp.columnType === "varchar") return `VARCHAR(${resolveStringColumnLength(stringProp)})`;
+			return "TEXT";
+		}
+		case "number": {
+			const numProp = prop;
+			const isId = isIdProperty(propName, prop, collection);
+			if ("isId" in numProp && numProp.isId === "increment") return "INTEGER GENERATED BY DEFAULT AS IDENTITY";
+			if (numProp.columnType) {
+				if (numProp.columnType === "double precision") return "DOUBLE PRECISION";
+				return numProp.columnType.toUpperCase();
+			}
+			return numProp.validation?.integer || isId ? "INTEGER" : "NUMERIC";
+		}
+		case "boolean": return "BOOLEAN";
+		case "date": {
+			const dateProp = prop;
+			if (dateProp.columnType === "date") return "DATE";
+			if (dateProp.columnType === "time") return "TIME";
+			return "TIMESTAMP WITH TIME ZONE";
+		}
+		case "map": return prop.columnType === "json" ? "JSON" : "JSONB";
+		case "array": {
+			const arrayProp = prop;
+			let colType = arrayProp.columnType;
+			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
+				const ofProp = arrayProp.of;
+				if (ofProp.type === "string") colType = "text[]";
+				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
+				else if (ofProp.type === "boolean") colType = "boolean[]";
+			}
+			if (colType === "json") return "JSON";
+			if (colType === "text[]") return "TEXT[]";
+			if (colType === "integer[]") return "INTEGER[]";
+			if (colType === "boolean[]") return "BOOLEAN[]";
+			if (colType === "numeric[]") return "NUMERIC[]";
+			return "JSONB";
+		}
+		case "vector": return `VECTOR(${prop.dimensions})`;
+		case "binary": return "BYTEA";
+		case "relation": {
+			const refProp = prop;
+			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+			if (relation?.kind !== "belongsTo") throw new Error(`Relation ${propName} does not put a column on this table (only \`belongsTo\` does)`);
+			let targetCollection;
+			try {
+				targetCollection = relation.target();
+			} catch {
+				return "TEXT";
+			}
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
+		}
+		case "reference": {
+			const refProp = prop;
+			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
+			if (!targetCollection) return "TEXT";
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
+		}
+		default: return "TEXT";
+	}
+};
+var schemaOfCollection = (collection) => isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+var bareTableName = (name) => name.includes(".") ? name.split(".").pop() : name;
+var foreignKeyPlan = (args) => {
+	const constraintName = `${args.table}_${args.column}_fkey`;
+	const onUpdate = args.onUpdate ? ` ON UPDATE ${args.onUpdate.toUpperCase()}` : "";
+	return {
+		constraintName,
+		schema: args.schema,
+		table: args.table,
+		column: args.column,
+		targetSchema: args.targetSchema,
+		targetTable: args.targetTable,
+		targetColumn: args.targetColumn,
+		sql: `ALTER TABLE "${args.schema}"."${args.table}" ADD CONSTRAINT "${constraintName}" FOREIGN KEY ("${args.column}") REFERENCES "${args.targetSchema}"."${args.targetTable}" ("${args.targetColumn}") ON DELETE ${args.onDelete.toUpperCase()}${onUpdate};`
+	};
+};
+/**
+* The FK columns the declared collections own — one entry per `relation`
+* (`belongsTo` side) or `reference` property.
+*
+* Split out of {@link generatePostgresDdl} so the boot-time schema ensure can
+* create the same columns with the same names, types and constraints. Before
+* this it skipped them outright, which was survivable only because `db push`
+* always followed; on a managed tenant nothing follows, so a table arrived
+* without the column its own collection reads and wrote 400 on every insert.
+*
+* A relation whose target is not in the bundle yields no column at all (the
+* generator returns early on an unresolvable target); a `reference` whose target
+* is unknown yields the column without a constraint. Both mirror the generator
+* exactly — a divergence here is a schema fork between boot and `db push`.
+*/
+var planRelationalColumns = (collections) => {
+	const plans = [];
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (!tableName) continue;
+		const schema = schemaOfCollection(collection);
+		const table = bareTableName(tableName);
+		for (const [propName, rawProp] of Object.entries(collection.properties ?? {})) {
+			const prop = rawProp;
+			if (prop.type === "relation") {
+				const refProp = prop;
+				const relInfo = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+				if (relInfo?.kind !== "belongsTo") continue;
+				if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) continue;
+				let targetCollection;
+				try {
+					targetCollection = relInfo.target();
+				} catch {
+					continue;
+				}
+				if (!targetCollection) continue;
+				const required = prop.validation?.required;
+				plans.push({
+					schema,
+					table,
+					column: relInfo.localKey,
+					type: getSqlColumnType(propName, prop, collection, collections),
+					foreignKey: foreignKeyPlan({
+						schema,
+						table,
+						column: relInfo.localKey,
+						targetSchema: schemaOfCollection(targetCollection),
+						targetTable: bareTableName(getTableName(targetCollection)),
+						targetColumn: getPrimaryKeyName(targetCollection),
+						onDelete: relInfo.onDelete ?? (required ? "CASCADE" : "SET NULL"),
+						onUpdate: relInfo.onUpdate
+					})
+				});
+			} else if (prop.type === "reference") {
+				const refProp = prop;
+				const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
+				const column = resolveColumnName(propName, prop);
+				const type = getSqlColumnType(propName, prop, collection, collections);
+				const required = prop.validation?.required;
+				plans.push({
+					schema,
+					table,
+					column,
+					type,
+					foreignKey: targetCollection ? foreignKeyPlan({
+						schema,
+						table,
+						column,
+						targetSchema: schemaOfCollection(targetCollection),
+						targetTable: bareTableName(getTableName(targetCollection)),
+						targetColumn: getPrimaryKeyName(targetCollection),
+						onDelete: required ? "CASCADE" : "SET NULL"
+					}) : void 0
+				});
+			}
+		}
+	}
+	return plans;
+};
+/**
+* The junction tables a bundle's many-to-many relations imply.
+*
+* Derived from {@link resolveJunctionSpecs}, the same source the junction RLS
+* comes from, so a table created here always has policies planned for it — a
+* junction with row-level security left off is readable and writable by every
+* signed-in user, which is why the two must ship together.
+*/
+var planJunctionTables = (collections) => {
+	const plans = [];
+	for (const spec of resolveJunctionSpecs(collections).values()) {
+		const [source, target] = spec.endpoints;
+		const columns = [{
+			name: source.junctionColumn,
+			type: junctionKeyType(source.collection)
+		}, {
+			name: target.junctionColumn,
+			type: junctionKeyType(target.collection)
+		}];
+		const onDelete = spec.declaringSides[0]?.relation.onDelete ?? "CASCADE";
+		plans.push({
+			schema: spec.schema,
+			table: spec.table,
+			columns,
+			createTable: `CREATE TABLE IF NOT EXISTS "${spec.schema}"."${spec.table}" (` + columns.map((c) => `"${c.name}" ${c.type} NOT NULL`).join(", ") + `, PRIMARY KEY (${columns.map((c) => `"${c.name}"`).join(", ")}));`,
+			foreignKeys: [source, target].map((endpoint, i) => foreignKeyPlan({
+				schema: spec.schema,
+				table: spec.table,
+				column: columns[i].name,
+				targetSchema: schemaOfCollection(endpoint.collection),
+				targetTable: bareTableName(getTableName(endpoint.collection)),
+				targetColumn: getPrimaryKeyName(endpoint.collection),
+				onDelete
+			}))
+		});
+	}
+	return plans;
+};
+/**
+* The per-table RLS plan for the *declared* collections, as executable
+* statements — what the managed runtime applies at boot so a freshly
+* provisioned tenant database serves data instead of 401ing every read.
+*
+* Mirrors {@link generatePostgresPoliciesDdl} exactly (same
+* `generatePolicyStatements`, same enable-RLS, same effective rules, same
+* derived junction rules), so boot and `db push` produce identical policies from
+* identical collections.
+*
+* Junction tables are included, and have to be: boot creates them now
+* ({@link planJunctionTables}), and a junction with RLS left off is readable and
+* writable by every signed-in user. A junction whose table is still absent is
+* skipped by the applier, not planned away here.
+*/
+var planCollectionPolicies = (collections) => {
+	const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+	const plans = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (!tableName) continue;
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+		const qualified = `${schema}.${baseTableName}`;
+		if (seen.has(qualified)) continue;
+		seen.add(qualified);
+		const policyStatements = [];
+		for (const rule of getEffectiveSecurityRules(collection)) policyStatements.push(...generatePolicyStatements(collection, rule, resolveCollection));
+		plans.push({
+			schema,
+			table: baseTableName,
+			qualified,
+			enableRls: `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;`,
+			policyStatements
+		});
+	}
+	for (const spec of resolveJunctionSpecs(collections).values()) {
+		const qualified = `${spec.schema}.${spec.table}`;
+		if (seen.has(qualified)) continue;
+		seen.add(qualified);
+		const junctionCollection = getJunctionCollectionConfig(spec);
+		const policyStatements = [];
+		for (const rule of getJunctionSecurityRules(spec)) policyStatements.push(...generatePolicyStatements(junctionCollection, rule, resolveCollection));
+		plans.push({
+			schema: spec.schema,
+			table: spec.table,
+			qualified,
+			enableRls: `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;`,
+			policyStatements
+		});
+	}
+	return plans;
+};
+//#endregion
+//#region src/schema/ensure-collection-tables.ts
+/**
+* Bringing a database up to date with a bundle's collections, additively.
+*
+* ## Why this exists
+*
+* A managed runtime boots someone else's compiled project against a database it
+* has never seen. Auth tables are ensured at boot already, but collection tables
+* were not created by anything: the platform ran the app and every `/api/data/*`
+* request answered 500 on a missing relation. `rebase db push` cannot help — it
+* is an Atlas-driven CLI command, and the runtime image ships no CLI.
+*
+* ## Why additive-only, forever
+*
+* This runs unattended, against a database with customers' data in it, with no
+* human reading a diff. So it may only ever do things that cannot lose data:
+* create a missing table, add a missing column, create a missing enum type.
+*
+* It will **never** drop a table or a column, narrow a type, or alter a
+* constraint. A removed field leaves its column behind; a renamed field looks
+* like an addition and the old column stays. That is the correct trade for an
+* automated path — the alternative is an unattended process that can silently
+* destroy a column, which is precisely the failure `db push` was hardened
+* against. Destructive changes stay a deliberate, human-reviewed migration.
+*
+* Because of that, this is safe to run on every boot, and re-running it is a
+* no-op.
+*/
+/** Postgres identifiers this module is willing to interpolate. */
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+function assertSafeIdentifier(value, what) {
+	if (!SAFE_IDENTIFIER.test(value)) throw new Error(`Refusing to build SQL with an unsafe ${what}: ${JSON.stringify(value)}`);
+	return value;
+}
+function schemaOf(collection) {
+	return isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+}
+function qualified(collection) {
+	return `${schemaOf(collection)}.${getTableName(collection)}`;
+}
+/**
+* Enum types a collection's properties require, as `schema.typename`.
+*
+* Named exactly as the DDL generator names them (`<table>_<column>`), because
+* a column added here has to reference the same type the generator would have
+* created — a second, differently-named type for the same field would be a
+* silent schema fork.
+*/
+function requiredEnums(collection) {
+	const table = getTableName(collection);
+	const schema = schemaOf(collection);
+	const out = [];
+	for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
+		const p = prop;
+		if (!("enum" in p) || !p.enum) continue;
+		if (p.type !== "string" && p.type !== "number") continue;
+		const values = p.enum.map((entry) => entry && typeof entry === "object" && "id" in entry ? String(entry.id) : String(entry)).filter((v) => v.length > 0);
+		if (values.length === 0) continue;
+		out.push({
+			name: `${schema}.${table}_${resolveColumnName(propName, p)}`,
+			values
+		});
+	}
+	return out;
+}
+/** Single-quote escaping for an enum label. */
+function quoteLiteral(value) {
+	return `'${value.replace(/'/g, "''")}'`;
+}
+/**
+* Decide what to add. Pure — the caller supplies what exists and runs the result.
+*
+* Ordering matters and is deliberate: enum types before the tables and columns
+* that reference them, tables before the columns added to other tables (a new
+* table may be the target of a relation), and nothing is emitted twice.
+*/
+function planCollectionSchemaEnsure(collections, existing) {
+	const actions = [];
+	const plannedEnums = /* @__PURE__ */ new Set();
+	for (const collection of collections) for (const { name, values } of requiredEnums(collection)) {
+		if (existing.enums.has(name) || plannedEnums.has(name)) continue;
+		plannedEnums.add(name);
+		const [schema, typeName] = name.split(".");
+		actions.push({
+			kind: "create-enum",
+			target: name,
+			sql: `CREATE TYPE "${schema}"."${typeName}" AS ENUM (${values.map(quoteLiteral).join(", ")});`
+		});
+	}
+	const created = /* @__PURE__ */ new Set();
+	for (const collection of collections) {
+		const key = qualified(collection);
+		if (existing.tables.has(key) || created.has(key)) continue;
+		created.add(key);
+		const schema = schemaOf(collection);
+		const table = getTableName(collection);
+		const idEntry = Object.entries(collection.properties ?? {}).find(([n, p]) => isIdProperty(n, p, collection));
+		const idName = idEntry ? resolveColumnName(idEntry[0], idEntry[1]) : "id";
+		const idProp = idEntry?.[1];
+		let idDef;
+		if (idProp?.type === "number") idDef = `"${idName}" BIGSERIAL PRIMARY KEY`;
+		else if (idProp && idProp.type === "string" && idProp.isId === "uuid") idDef = `"${idName}" UUID PRIMARY KEY DEFAULT gen_random_uuid()`;
+		else idDef = `"${idName}" TEXT PRIMARY KEY`;
+		actions.push({
+			kind: "create-table",
+			target: key,
+			sql: `CREATE TABLE IF NOT EXISTS "${schema}"."${table}" (${idDef});`
+		});
+	}
+	const junctions = planJunctionTables(collections);
+	for (const junction of junctions) {
+		const key = `${junction.schema}.${junction.table}`;
+		if (existing.tables.has(key) || created.has(key)) continue;
+		created.add(key);
+		actions.push({
+			kind: "create-table",
+			target: key,
+			sql: junction.createTable
+		});
+	}
+	const addColumn = (key, schema, table, column, type) => {
+		if (existing.tables.get(key)?.has(column)) return;
+		actions.push({
+			kind: "add-column",
+			target: `${key}.${column}`,
+			sql: `ALTER TABLE "${schema}"."${table}" ADD COLUMN IF NOT EXISTS "${column}" ${type};`
+		});
+	};
+	for (const collection of collections) {
+		const key = qualified(collection);
+		const schema = schemaOf(collection);
+		const table = getTableName(collection);
+		for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
+			const p = prop;
+			if (isIdProperty(propName, p, collection)) continue;
+			if (p.type === "reference" || p.type === "relation") continue;
+			addColumn(key, schema, table, resolveColumnName(propName, p), getSqlColumnType(propName, p, collection, collections));
+		}
+	}
+	for (const junction of junctions) {
+		const key = `${junction.schema}.${junction.table}`;
+		for (const column of junction.columns) addColumn(key, junction.schema, junction.table, column.name, column.type);
+	}
+	for (const relational of planRelationalColumns(collections)) addColumn(`${relational.schema}.${relational.table}`, relational.schema, relational.table, relational.column, relational.type);
+	const knownConstraints = existing.constraints ?? /* @__PURE__ */ new Set();
+	const plannedConstraints = /* @__PURE__ */ new Set();
+	const foreignKeys = [...planRelationalColumns(collections).map((r) => r.foreignKey), ...junctions.flatMap((j) => j.foreignKeys)];
+	for (const fk of foreignKeys) {
+		if (!fk) continue;
+		const name = `${fk.schema}.${fk.table}.${fk.constraintName}`;
+		if (knownConstraints.has(name) || plannedConstraints.has(name)) continue;
+		plannedConstraints.add(name);
+		actions.push({
+			kind: "add-constraint",
+			target: `${fk.schema}.${fk.table}.${fk.constraintName}`,
+			sql: fk.sql
+		});
+	}
+	return {
+		actions,
+		statements: actions.map((a) => a.sql)
+	};
+}
+/** Read what the database has, for the schemas the collections live in. */
+async function readExistingSchema(client, schemas) {
+	const tables = /* @__PURE__ */ new Map();
+	const enums = /* @__PURE__ */ new Set();
+	if (schemas.length === 0) return {
+		tables,
+		enums
+	};
+	const inList = schemas.map((schema) => `'${assertSafeIdentifier(schema, "schema name")}'`).join(", ");
+	const { rows: columns } = await client.query(`SELECT table_schema, table_name, column_name
+         FROM information_schema.columns
+         WHERE table_schema IN (${inList})`);
+	for (const row of columns) {
+		const key = `${row.table_schema}.${row.table_name}`;
+		if (!tables.has(key)) tables.set(key, /* @__PURE__ */ new Set());
+		tables.get(key).add(row.column_name);
+	}
+	const { rows: enumRows } = await client.query(`SELECT n.nspname AS schema, t.typname AS name
+         FROM pg_type t
+         JOIN pg_namespace n ON t.typnamespace = n.oid
+         WHERE t.typtype = 'e' AND n.nspname IN (${inList})`);
+	for (const row of enumRows) enums.add(`${row.schema}.${row.name}`);
+	const constraints = /* @__PURE__ */ new Set();
+	const { rows: constraintRows } = await client.query(`SELECT n.nspname AS schema, c.relname AS table, con.conname AS name
+         FROM pg_constraint con
+         JOIN pg_class c ON con.conrelid = c.oid
+         JOIN pg_namespace n ON c.relnamespace = n.oid
+         WHERE n.nspname IN (${inList})`);
+	for (const row of constraintRows) constraints.add(`${row.schema}.${row.table}.${row.name}`);
+	return {
+		tables,
+		enums,
+		constraints
+	};
+}
+/**
+* Bring the database up to date. Returns what it did.
+*
+* Each statement runs on its own rather than in one transaction: they are all
+* independently safe and idempotent, and a single failure (an enum label that
+* cannot be added, say) should not roll back the tables that were created fine.
+* The error is surfaced with the statement that caused it.
+*/
+async function ensureCollectionTables(client, collections, log) {
+	const schemas = Array.from(/* @__PURE__ */ new Set([...collections.map(schemaOf), ...planJunctionTables(collections).map((j) => j.schema)]));
+	for (const schema of schemas) {
+		assertSafeIdentifier(schema, "schema name");
+		if (schema !== "public") await client.query(`CREATE SCHEMA IF NOT EXISTS "${schema}";`);
+	}
+	const plan = planCollectionSchemaEnsure(collections, await readExistingSchema(client, schemas));
+	const failures = [];
+	if (plan.actions.length === 0) {
+		log?.("Schema is up to date; nothing to create.");
+		return {
+			...plan,
+			failures
+		};
+	}
+	for (const action of plan.actions) try {
+		await client.query(action.sql);
+		log?.(`${action.kind}: ${action.target}`);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (action.kind === "add-constraint") {
+			failures.push({
+				target: action.target,
+				error: message
+			});
+			continue;
+		}
+		throw new Error(`Failed to ${action.kind} ${action.target}: ${message}\n  ${action.sql}`);
+	}
+	return {
+		...plan,
+		failures
+	};
+}
+//#endregion
+export { ensureCollectionTables, readExistingSchema, planCollectionPolicies as t };
+
+//# sourceMappingURL=ensure-collection-tables-DmOzh_G6.js.map