@rebasepro/server-postgres 0.12.1-canary.gf5f1d39 → 0.13.0

package/src/utils/connection-string.ts

@@ -0,0 +1,58 @@
+/**
+ * Connection-string rewrites for the tools Rebase shells out to.
+ *
+ * Pure and dependency-free: `pg-tools` builds argument vectors without a live
+ * server, and these have to be usable from there.
+ */
+
+/**
+ * The `sslmode` values libpq accepts. `no-verify` is conspicuously not one.
+ */
+const LIBPQ_SSLMODES = new Set(["disable", "allow", "prefer", "require", "verify-ca", "verify-full"]);
+
+/**
+ * Make a connection string safe to hand to a libpq program.
+ *
+ * `sslmode=no-verify` is a node-postgres convention — encrypt, but do not check
+ * the certificate — and libpq does not have it. It does not degrade or warn:
+ *
+ *     psql: error: invalid sslmode value: "no-verify"
+ *
+ * which means a `DATABASE_URL` that works perfectly for the app makes `psql`,
+ * `pg_dump`, `pg_restore` and Atlas all refuse to start, with an error that
+ * points at the value rather than at the convention it comes from. It has cost
+ * this project time more than once.
+ *
+ * `require` is the honest translation: libpq's `require` encrypts and does not
+ * verify the certificate either, which is exactly what `no-verify` asks for.
+ * Nothing is relaxed by the rewrite — `verify-ca` and `verify-full` are left
+ * alone, so a connection string that asked for verification still gets it.
+ *
+ * Only `sslmode` is touched, and only when it is a value libpq would reject.
+ * Anything unparseable is returned as given: a connection that works
+ * unverified beats one this corrupted.
+ */
+export function forLibpq(connectionString: string): string {
+    let url: URL;
+    try {
+        url = new URL(connectionString);
+    } catch {
+        // Key/value DSNs and anything else we cannot parse. A `sslmode` in one
+        // of those is space-separated rather than a query parameter, and
+        // rewriting it with a regex is how a password containing "sslmode="
+        // gets mangled.
+        return connectionString;
+    }
+    if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return connectionString;
+
+    const sslmode = url.searchParams.get("sslmode");
+    if (sslmode === null || LIBPQ_SSLMODES.has(sslmode)) return connectionString;
+
+    url.searchParams.set("sslmode", "require");
+    // Re-serialize by hand for the reason `pinSearchPath` does: URLSearchParams
+    // writes a space as `+`, which node-postgres decodes and libpq does not.
+    url.search = Array.from(url.searchParams.entries())
+        .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)
+        .join("&");
+    return url.toString();
+}

package/src/utils/drizzle-conditions.ts

@@ -175,10 +175,11 @@ export class DrizzleConditionBuilder {
     static buildRelationScopeCondition(
         relation: ResolvedRelation,
         /**
-         * Lazy: only `via` and `belongsTo` need the parent's own table. A
-         * foreign key on the target and a junction are both expressible from
-         * the parent's *id* alone, and requiring the table for them would make
-         * a child listing fail on a parent whose table isn't registered.
+         * Lazy: `via`, `belongsTo`, and a foreign key that points at a
+         * `sourceKey` need the parent's own table. A junction and a plain
+         * foreign key are expressible from the parent's *id* alone, and
+         * requiring the table for them would make a child listing fail on a
+         * parent whose table isn't registered.
          */
         parent: () => { table: PgTable<any>; idColumn: AnyPgColumn },
         parentId: string | number,
@@ -239,7 +240,16 @@ export class DrizzleConditionBuilder {
                         `relation '${relation.relationName}'.`
                     );
                 }
-                return eq(fkColumn, parentId);
+                if (!relation.sourceKey) return eq(fkColumn, parentId);
+
+                // A link on a natural key: the foreign key holds a column of the
+                // parent row, not its id, so the parent has to be read. As a
+                // subquery rather than a prior SELECT, for the same reason
+                // `belongsTo` below is — one statement sees one snapshot, and a
+                // scope condition that read the key separately could be built
+                // from a value the very next statement no longer agrees with.
+                const { table, idColumn } = parent();
+                return sql`${fkColumn} = (SELECT ${sql.identifier(relation.sourceKey)} FROM ${table} WHERE ${idColumn} = ${parentId})`;
             }
 
             case "belongsTo": {
@@ -385,7 +395,22 @@ export class DrizzleConditionBuilder {
             // inverse, so reversing it into a filter is a different problem
             // from the two shapes below rather than a third case of them.
             if (relation && (hasForeignKeyOnTarget(relation) || isManyToMany(relation)) && registry && sourceIdColumn) {
-                return { kind: "relation", relation, registry, sourceIdColumn };
+                // The `EXISTS` correlates the target's foreign key with a column
+                // on *this* table, and that is the primary key only when the
+                // link joins on it. A `sourceKey` names a different one, and
+                // correlating on the id anyway silently matches nothing —
+                // "filter by this relation" would quietly return zero rows.
+                const correlationColumn = hasForeignKeyOnTarget(relation) && relation.sourceKey
+                    ? columnAt(relation.sourceKey)
+                    : sourceIdColumn;
+                if (!correlationColumn) {
+                    throw new Error(
+                        `\`sourceKey: "${(relation as ResolvedForeignKeyOnTarget).sourceKey}"\` on relation ` +
+                        `'${relation.relationName}' is not a column on '${collectionPath}', so a filter on ` +
+                        "that relation has nothing to correlate against."
+                    );
+                }
+                return { kind: "relation", relation, registry, sourceIdColumn: correlationColumn };
             }
         }
 

package/src/utils/pg-error-utils.ts

@@ -79,6 +79,25 @@ export function extractPgError(error: unknown): PostgresError | null {
     return null;
 }
 
+/**
+ * Whether the failure came back from Postgres rather than from building the
+ * query — which decides whether a fallback query is worth issuing.
+ *
+ * Reads here run inside a transaction (that is where `SET LOCAL ROLE` binds
+ * RLS). Once a statement raises, that transaction is aborted, and every later
+ * statement on it returns `25P02` — "current transaction is aborted, commands
+ * ignored until end of transaction block". So a retry after a database error
+ * cannot succeed, and it replaces a precise diagnosis ("invalid input syntax
+ * for type uuid") with a generic one. Rethrow instead.
+ *
+ * A query the driver could not even build — a missing reciprocal relation, say
+ * — never reached Postgres, leaves the transaction usable, and is exactly what
+ * the fallback paths exist for.
+ */
+export function reachedDatabase(error: unknown): boolean {
+    return extractPgError(error) !== null;
+}
+
 /**
  * Walk the error cause chain and return the deepest meaningful message.
  */
@@ -97,6 +116,52 @@ export function extractCauseMessage(error: unknown): string | null {
     return null;
 }
 
+/**
+ * Codes that mean "this connection will never work as configured".
+ *
+ * A wrong password or a database that does not exist is a settled fact about
+ * the connection string, not a transient fault — retrying produces the same
+ * answer forever.
+ */
+const UNRECOVERABLE_CONNECT_CODES = new Set([
+    "28P01", // invalid_password
+    "28000", // invalid_authorization_specification
+    "3D000", // invalid_catalog_name — the database does not exist
+    "42501"  // insufficient_privilege
+]);
+
+export interface ConnectFailure {
+    /** True when retrying cannot help: the connection string itself is wrong. */
+    fatal: boolean;
+    /** The deepest message available — the Postgres one where there is one. */
+    reason: string;
+    /** The `SQLSTATE`, when the failure came from Postgres rather than the socket. */
+    code?: string;
+}
+
+/**
+ * Describe a failed connection attempt in terms a developer can act on.
+ *
+ * The error a caller catches is Drizzle's wrapper: its message is
+ * `Failed query: SELECT 1` and its stack runs through drizzle internals, while
+ * the sentence that says what is actually wrong — "password authentication
+ * failed for user …", "database … does not exist" — sits in `.cause`. Logging
+ * the wrapper, as the bootstrapper used to, tells a developer with a typo in
+ * their `DATABASE_URL` nothing at all.
+ */
+export function classifyConnectFailure(error: unknown): ConnectFailure {
+    const pgError = extractPgError(error);
+    const reason =
+        pgError?.message ??
+        extractCauseMessage(error) ??
+        (error instanceof Error ? error.message : String(error));
+    return {
+        fatal: Boolean(pgError?.code && UNRECOVERABLE_CONNECT_CODES.has(pgError.code)),
+        reason,
+        code: pgError?.code
+    };
+}
+
 /**
  * Detect whether an error is specifically a role-switching permission failure
  * (e.g. "permission denied to set role" or "must be member of role"),

package/src/websocket.ts

@@ -1,13 +1,13 @@
 import { RealtimeService } from "./services/realtimeService";
 import { PostgresBackendDriver } from "./PostgresBackendDriver";
 import type { DataDriver, DeleteProps, FetchCollectionProps, FetchOneProps, SaveProps, TableMetadata, BranchInfo, AuthAdapter } from "@rebasepro/types";
-import { isSQLAdmin, isSchemaAdmin } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, isSQLAdmin, isSchemaAdmin } from "@rebasepro/types";
 import type { User } from "@rebasepro/types";
 
 import { WebSocketServer, WebSocket } from "ws";
 import { Server } from "http";
 import { inspect } from "util";
-import { extractUserFromToken, AccessTokenPayload, safeCompare } from "@rebasepro/server";
+import { extractUserFromToken, AccessTokenPayload, safeCompare, resolveRequireAuth } from "@rebasepro/server";
 import { logger } from "@rebasepro/server";
 
 /** Minimal subset of RebaseAuthConfig used by the WebSocket layer. */
@@ -116,11 +116,20 @@ export function createPostgresWebSocket(
         logger.error("❌ [WebSocket Server] Error", { error: err });
     });
 
-    // Auth is required when either: an adapter is present (secure by default),
-    // OR the config has a jwtSecret and requireAuth !== false.
-    const requireAuth = authAdapter
-        ? true
-        : (authConfig?.requireAuth !== false && !!authConfig?.jwtSecret);
+    // The same predicate the HTTP data routes use, from the same function —
+    // this socket is the other enforcement point for one product decision, and
+    // while it computed the answer itself it computed a different one. See
+    // `resolveRequireAuth` for what its local copy got wrong and why a `false`
+    // here grants access rather than skipping a check.
+    const requireAuth = !!authAdapter || resolveRequireAuth(authConfig as never);
+
+    if (requireAuth && !authAdapter && !authConfig?.jwtSecret && !authConfig?.serviceKey) {
+        logger.warn(
+            "🔐 [WebSocket Server] Authentication is required but no adapter, jwtSecret or " +
+            "serviceKey is configured — no client can complete AUTH, so every realtime " +
+            "message will be refused with UNAUTHORIZED."
+        );
+    }
 
     wss.on("connection", (ws) => {
         const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
@@ -281,7 +290,7 @@ roles: verifiedUser.roles }
                                     roles: session.user.roles ?? []
                                 }
                                 : {
-                                    uid: "anon",
+                                    uid: ANONYMOUS_USER_ID,
                                     displayName: null,
                                     email: null,
                                     photoURL: null,
@@ -620,7 +629,7 @@ colors: true }));
                         const authContext = session?.user
                             ? { uid: session.user.uid,
 roles: session.user.roles ?? [] }
-                            : { uid: "anon",
+                            : { uid: ANONYMOUS_USER_ID,
 roles: ["anon"] };
                         // Let RealtimeService handle these messages
                         await realtimeService.handleClientMessage(clientId, {

package/dist/chunk-DSJWtz9O.js

@@ -1,40 +0,0 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-const require = __createRequire(import.meta.url);
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, { get: (a, b) => (typeof require !== "undefined" ? require : a)[b] }) : x)(function(x) {
-	if (typeof require !== "undefined") return require.apply(this, arguments);
-	throw Error("Calling `require` for \"" + x + "\" in an environment that doesn't expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.");
-});
-//#endregion
-export { __toESM as i, __exportAll as n, __require as r, __commonJSMin as t };

package/dist/ensure-collection-tables-CNTcZGvn.js

@@ -1,304 +0,0 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-__createRequire(import.meta.url);
-import { l as isPostgresCollectionConfig } from "./src-Zqwaw3P5.js";
-import { A as toSnakeCase, g as getTableName, p as findRelation, v as resolveCollectionRelations } from "./src-BbFOPJ1S.js";
-//#region src/schema/generate-postgres-ddl-logic.ts
-var resolveColumnName = (propName, prop) => {
-	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
-	return toSnakeCase(propName);
-};
-var getPrimaryKeyProp = (collection) => {
-	if (collection.properties) {
-		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
-		if (idPropEntry) {
-			const prop = idPropEntry[1];
-			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
-			return {
-				name: idPropEntry[0],
-				type: prop.type === "number" ? "number" : "string",
-				isUuid
-			};
-		}
-	}
-	const idProp = collection.properties?.["id"];
-	if (idProp?.type === "number") return {
-		name: "id",
-		type: "number",
-		isUuid: false
-	};
-	return {
-		name: "id",
-		type: "string",
-		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
-	};
-};
-var isIdProperty = (propName, prop, collection) => {
-	if ("isId" in prop && Boolean(prop.isId)) return true;
-	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
-};
-var getSqlColumnType = (propName, prop, collection, collections) => {
-	switch (prop.type) {
-		case "string": {
-			const stringProp = prop;
-			if (stringProp.enum) {
-				const tableName = getTableName(collection);
-				const colName = resolveColumnName(propName, prop);
-				return `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${tableName}_${colName}"`;
-			}
-			if (stringProp.isId === "uuid" || stringProp.columnType === "uuid") return "UUID";
-			if (stringProp.columnType === "char") return "CHAR(255)";
-			if (stringProp.columnType === "varchar") return "VARCHAR(255)";
-			return "TEXT";
-		}
-		case "number": {
-			const numProp = prop;
-			const isId = isIdProperty(propName, prop, collection);
-			if ("isId" in numProp && numProp.isId === "increment") return "INTEGER GENERATED BY DEFAULT AS IDENTITY";
-			if (numProp.columnType) {
-				if (numProp.columnType === "double precision") return "DOUBLE PRECISION";
-				return numProp.columnType.toUpperCase();
-			}
-			return numProp.validation?.integer || isId ? "INTEGER" : "NUMERIC";
-		}
-		case "boolean": return "BOOLEAN";
-		case "date": {
-			const dateProp = prop;
-			if (dateProp.columnType === "date") return "DATE";
-			if (dateProp.columnType === "time") return "TIME";
-			return "TIMESTAMP WITH TIME ZONE";
-		}
-		case "map": return prop.columnType === "json" ? "JSON" : "JSONB";
-		case "array": {
-			const arrayProp = prop;
-			let colType = arrayProp.columnType;
-			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
-				const ofProp = arrayProp.of;
-				if (ofProp.type === "string") colType = "text[]";
-				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
-				else if (ofProp.type === "boolean") colType = "boolean[]";
-			}
-			if (colType === "json") return "JSON";
-			if (colType === "text[]") return "TEXT[]";
-			if (colType === "integer[]") return "INTEGER[]";
-			if (colType === "boolean[]") return "BOOLEAN[]";
-			if (colType === "numeric[]") return "NUMERIC[]";
-			return "JSONB";
-		}
-		case "vector": return `VECTOR(${prop.dimensions})`;
-		case "binary": return "BYTEA";
-		case "relation": {
-			const refProp = prop;
-			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
-			if (relation?.kind !== "belongsTo") throw new Error(`Relation ${propName} does not put a column on this table (only \`belongsTo\` does)`);
-			let targetCollection;
-			try {
-				targetCollection = relation.target();
-			} catch {
-				return "TEXT";
-			}
-			const pkProp = getPrimaryKeyProp(targetCollection);
-			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
-		}
-		case "reference": {
-			const refProp = prop;
-			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
-			if (!targetCollection) return "TEXT";
-			const pkProp = getPrimaryKeyProp(targetCollection);
-			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
-		}
-		default: return "TEXT";
-	}
-};
-//#endregion
-//#region src/schema/ensure-collection-tables.ts
-/**
-* Bringing a database up to date with a bundle's collections, additively.
-*
-* ## Why this exists
-*
-* A managed runtime boots someone else's compiled project against a database it
-* has never seen. Auth tables are ensured at boot already, but collection tables
-* were not created by anything: the platform ran the app and every `/api/data/*`
-* request answered 500 on a missing relation. `rebase db push` cannot help — it
-* is an Atlas-driven CLI command, and the runtime image ships no CLI.
-*
-* ## Why additive-only, forever
-*
-* This runs unattended, against a database with customers' data in it, with no
-* human reading a diff. So it may only ever do things that cannot lose data:
-* create a missing table, add a missing column, create a missing enum type.
-*
-* It will **never** drop a table or a column, narrow a type, or alter a
-* constraint. A removed field leaves its column behind; a renamed field looks
-* like an addition and the old column stays. That is the correct trade for an
-* automated path — the alternative is an unattended process that can silently
-* destroy a column, which is precisely the failure `db push` was hardened
-* against. Destructive changes stay a deliberate, human-reviewed migration.
-*
-* Because of that, this is safe to run on every boot, and re-running it is a
-* no-op.
-*/
-/** Postgres identifiers this module is willing to interpolate. */
-var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-function assertSafeIdentifier(value, what) {
-	if (!SAFE_IDENTIFIER.test(value)) throw new Error(`Refusing to build SQL with an unsafe ${what}: ${JSON.stringify(value)}`);
-	return value;
-}
-function schemaOf(collection) {
-	return isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-}
-function qualified(collection) {
-	return `${schemaOf(collection)}.${getTableName(collection)}`;
-}
-/**
-* Enum types a collection's properties require, as `schema.typename`.
-*
-* Named exactly as the DDL generator names them (`<table>_<column>`), because
-* a column added here has to reference the same type the generator would have
-* created — a second, differently-named type for the same field would be a
-* silent schema fork.
-*/
-function requiredEnums(collection) {
-	const table = getTableName(collection);
-	const schema = schemaOf(collection);
-	const out = [];
-	for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
-		const p = prop;
-		if (!("enum" in p) || !p.enum) continue;
-		if (p.type !== "string" && p.type !== "number") continue;
-		const values = p.enum.map((entry) => entry && typeof entry === "object" && "id" in entry ? String(entry.id) : String(entry)).filter((v) => v.length > 0);
-		if (values.length === 0) continue;
-		out.push({
-			name: `${schema}.${table}_${resolveColumnName(propName, p)}`,
-			values
-		});
-	}
-	return out;
-}
-/** Single-quote escaping for an enum label. */
-function quoteLiteral(value) {
-	return `'${value.replace(/'/g, "''")}'`;
-}
-/**
-* Decide what to add. Pure — the caller supplies what exists and runs the result.
-*
-* Ordering matters and is deliberate: enum types before the tables and columns
-* that reference them, tables before the columns added to other tables (a new
-* table may be the target of a relation), and nothing is emitted twice.
-*/
-function planCollectionSchemaEnsure(collections, existing) {
-	const actions = [];
-	const plannedEnums = /* @__PURE__ */ new Set();
-	for (const collection of collections) for (const { name, values } of requiredEnums(collection)) {
-		if (existing.enums.has(name) || plannedEnums.has(name)) continue;
-		plannedEnums.add(name);
-		const [schema, typeName] = name.split(".");
-		actions.push({
-			kind: "create-enum",
-			target: name,
-			sql: `CREATE TYPE "${schema}"."${typeName}" AS ENUM (${values.map(quoteLiteral).join(", ")});`
-		});
-	}
-	const created = /* @__PURE__ */ new Set();
-	for (const collection of collections) {
-		const key = qualified(collection);
-		if (existing.tables.has(key) || created.has(key)) continue;
-		created.add(key);
-		const schema = schemaOf(collection);
-		const table = getTableName(collection);
-		const idEntry = Object.entries(collection.properties ?? {}).find(([n, p]) => isIdProperty(n, p, collection));
-		const idName = idEntry ? resolveColumnName(idEntry[0], idEntry[1]) : "id";
-		const idProp = idEntry?.[1];
-		let idDef;
-		if (idProp?.type === "number") idDef = `"${idName}" BIGSERIAL PRIMARY KEY`;
-		else if (idProp && idProp.type === "string" && idProp.isId === "uuid") idDef = `"${idName}" UUID PRIMARY KEY DEFAULT gen_random_uuid()`;
-		else idDef = `"${idName}" TEXT PRIMARY KEY`;
-		actions.push({
-			kind: "create-table",
-			target: key,
-			sql: `CREATE TABLE IF NOT EXISTS "${schema}"."${table}" (${idDef});`
-		});
-	}
-	for (const collection of collections) {
-		const key = qualified(collection);
-		const schema = schemaOf(collection);
-		const table = getTableName(collection);
-		const present = existing.tables.get(key) ?? /* @__PURE__ */ new Set();
-		for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
-			const p = prop;
-			if (isIdProperty(propName, p, collection)) continue;
-			if (p.type === "reference" || p.type === "relation") continue;
-			const column = resolveColumnName(propName, p);
-			if (present.has(column)) continue;
-			const type = getSqlColumnType(propName, p, collection, collections);
-			actions.push({
-				kind: "add-column",
-				target: `${key}.${column}`,
-				sql: `ALTER TABLE "${schema}"."${table}" ADD COLUMN IF NOT EXISTS "${column}" ${type};`
-			});
-		}
-	}
-	return {
-		actions,
-		statements: actions.map((a) => a.sql)
-	};
-}
-/** Read what the database has, for the schemas the collections live in. */
-async function readExistingSchema(client, schemas) {
-	const tables = /* @__PURE__ */ new Map();
-	const enums = /* @__PURE__ */ new Set();
-	if (schemas.length === 0) return {
-		tables,
-		enums
-	};
-	const inList = schemas.map((schema) => `'${assertSafeIdentifier(schema, "schema name")}'`).join(", ");
-	const { rows: columns } = await client.query(`SELECT table_schema, table_name, column_name
-         FROM information_schema.columns
-         WHERE table_schema IN (${inList})`);
-	for (const row of columns) {
-		const key = `${row.table_schema}.${row.table_name}`;
-		if (!tables.has(key)) tables.set(key, /* @__PURE__ */ new Set());
-		tables.get(key).add(row.column_name);
-	}
-	const { rows: enumRows } = await client.query(`SELECT n.nspname AS schema, t.typname AS name
-         FROM pg_type t
-         JOIN pg_namespace n ON t.typnamespace = n.oid
-         WHERE t.typtype = 'e' AND n.nspname IN (${inList})`);
-	for (const row of enumRows) enums.add(`${row.schema}.${row.name}`);
-	return {
-		tables,
-		enums
-	};
-}
-/**
-* Bring the database up to date. Returns what it did.
-*
-* Each statement runs on its own rather than in one transaction: they are all
-* independently safe and idempotent, and a single failure (an enum label that
-* cannot be added, say) should not roll back the tables that were created fine.
-* The error is surfaced with the statement that caused it.
-*/
-async function ensureCollectionTables(client, collections, log) {
-	const schemas = Array.from(new Set(collections.map(schemaOf)));
-	for (const schema of schemas) {
-		assertSafeIdentifier(schema, "schema name");
-		if (schema !== "public") await client.query(`CREATE SCHEMA IF NOT EXISTS "${schema}";`);
-	}
-	const plan = planCollectionSchemaEnsure(collections, await readExistingSchema(client, schemas));
-	if (plan.actions.length === 0) {
-		log?.("Schema is up to date; nothing to create.");
-		return plan;
-	}
-	for (const action of plan.actions) try {
-		await client.query(action.sql);
-		log?.(`${action.kind}: ${action.target}`);
-	} catch (err) {
-		throw new Error(`Failed to ${action.kind} ${action.target}: ${err instanceof Error ? err.message : String(err)}\n  ${action.sql}`);
-	}
-	return plan;
-}
-//#endregion
-export { ensureCollectionTables };
-
-//# sourceMappingURL=ensure-collection-tables-CNTcZGvn.js.map