@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g06dbe5b

package/dist/rls-bootstrap-sql-Bpv3nUZo.js

@@ -0,0 +1,244 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { c as __exportAll } from "./connection-BuZ97wsr.js";
+import { n as REBASE_SCHEMA, t as LEGACY_RLS_SCHEMA } from "./src-C_wvdMnl.js";
+//#region src/schema/rls-bootstrap-sql.ts
+var rls_bootstrap_sql_exports = /* @__PURE__ */ __exportAll({
+	DROP_LEGACY_AUTH_SCHEMA_SQL: () => DROP_LEGACY_AUTH_SCHEMA_SQL,
+	LEGACY_RLS_DEPENDENTS_SQL: () => LEGACY_RLS_DEPENDENTS_SQL,
+	LEGACY_RLS_FUNCTION_DEPENDENTS_SQL: () => LEGACY_RLS_FUNCTION_DEPENDENTS_SQL,
+	RLS_BOOTSTRAP_STATEMENTS: () => RLS_BOOTSTRAP_STATEMENTS,
+	dropLegacyAuthSchema: () => dropLegacyAuthSchema
+});
+/**
+* Canonical SQL bootstrap for the RLS helper functions.
+*
+* Generated RLS policies reference `rebase.uid()` / `rebase.roles()` /
+* `rebase.jwt()`, so any SQL stream that can contain policies must be
+* self-contained: it has to (re)create these helpers first. This matters for
+* the migration directory in particular — Atlas replays migrations against a
+* clean dev database where no out-of-band bootstrap has ever run, so a
+* migration carrying policies without this preamble fails with
+* "function rebase.uid() does not exist".
+*
+* Idempotent (`IF NOT EXISTS` / `OR REPLACE`) so it can be prepended to every
+* policies block and re-applied freely. The runtime boot path
+* (`auth/ensure-tables.ts`) creates the same functions under an advisory lock
+* for HMR-safety; keep the definitions in sync.
+*
+* ## Creating the `rebase` schema here is now safe, and required
+*
+* It deliberately did not, once. These functions lived in a schema called
+* `auth`, and the note here read: creating `rebase` would leak it into Atlas's
+* replayed migration state, and — absent from the desired `schema.sql` — Atlas
+* would then plan `DROP SCHEMA "rebase" CASCADE`, taking the auth tables with
+* it. That reasoning still holds; what changed is the second half of it. The
+* DDL generator now emits `CREATE SCHEMA IF NOT EXISTS "rebase"`
+* unconditionally, so the schema is always in the desired state and the diff is
+* empty. (It used to appear only when some collection happened to declare
+* `schema: "rebase"` — true for the scaffold's users collection, and not a
+* property anything guaranteed.) `db push` additionally excludes the whole
+* schema from the declarative apply.
+*
+* See `@rebasepro/types`' `rls-functions` for why the functions moved out of
+* `auth` at all: the short version is that the name was Supabase's, and
+* `CREATE OR REPLACE FUNCTION auth.uid() RETURNS text` cannot be applied over
+* Supabase's `RETURNS uuid` — Postgres refuses, and the refusal used to be
+* swallowed.
+*/
+/**
+* The bootstrap as individual statements.
+*
+* Kept as an array because the two consumers need different shapes and only one
+* of them can take a multi-command string: the migration preamble is written to
+* a file and replayed by Atlas, but the boot path runs through drizzle, whose
+* node-postgres handle speaks the extended query protocol and rejects more than
+* one command per call. Splitting a joined string back apart on `$$;` would be
+* a parser for a problem that does not need one.
+*/
+var RLS_BOOTSTRAP_STATEMENTS = [
+	`CREATE SCHEMA IF NOT EXISTS ${REBASE_SCHEMA}`,
+	`CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.uid() RETURNS text AS $$
+    SELECT COALESCE(
+        NULLIF(current_setting('app.uid', true), ''),
+        NULLIF(current_setting('app.user_id', true), '')
+    );
+$$ LANGUAGE sql STABLE`,
+	`CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.jwt() RETURNS jsonb AS $$
+    SELECT COALESCE(
+        NULLIF(current_setting('app.jwt', true), ''),
+        '{}'
+    )::jsonb;
+$$ LANGUAGE sql STABLE`,
+	`CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.roles() RETURNS text AS $$
+    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');
+$$ LANGUAGE sql STABLE`
+];
+"" + RLS_BOOTSTRAP_STATEMENTS.map((s) => `${s};`).join("\n\n");
+/**
+* Removes the pre-1.0 `auth` schema, but only when Rebase is what put it there.
+*
+* ## Why this is safe against a Supabase database
+*
+* Two independent guards, and both have to pass:
+*
+*  1. **Each function is identified before it is dropped.** Ours returns `text`
+*     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads
+*     `request.jwt.claims`. Nothing is dropped on a signature we did not write,
+*     so a Supabase database — where our `CREATE OR REPLACE` could never have
+*     succeeded in the first place, Postgres refusing to change a return type —
+*     matches nothing and this is a no-op.
+*  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still
+*     lives in `auth` (Supabase's `users` table, its other helpers), the drop
+*     fails and the schema stays. CASCADE here would be unrecoverable.
+*
+* ## Why it cannot run too early
+*
+* Postgres records a dependency from every RLS policy to the functions its body
+* calls, so `DROP FUNCTION auth.uid()` fails for as long as a single policy
+* still references it. That is the interlock, and it is load-bearing: the drop
+* can only succeed once every policy has been recompiled to \`rebase.uid()\`.
+* Callers therefore run this *after* applying policies, and treat a failure as
+* "not yet — try again next boot" rather than as an error.
+*/
+var DROP_LEGACY_AUTH_SCHEMA_SQL = `
+DO $rebase_drop_legacy$
+DECLARE
+    dropped_any boolean := false;
+BEGIN
+    -- Each function is matched on its own result type and body, so a schema
+    -- that merely shares the name keeps everything it has.
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'uid'
+          AND pg_get_function_result(p.oid) = 'text'
+          AND p.prosrc LIKE '%app.uid%'
+    ) THEN
+        DROP FUNCTION auth.uid();
+        dropped_any := true;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'jwt'
+          AND pg_get_function_result(p.oid) = 'jsonb'
+          AND p.prosrc LIKE '%app.jwt%'
+    ) THEN
+        DROP FUNCTION auth.jwt();
+        dropped_any := true;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'roles'
+          AND pg_get_function_result(p.oid) = 'text'
+          AND p.prosrc LIKE '%app.user_roles%'
+    ) THEN
+        DROP FUNCTION auth.roles();
+        dropped_any := true;
+    END IF;
+
+    -- RESTRICT: only an empty schema goes. Anything else in there — including a
+    -- Supabase installation left untouched above — keeps it.
+    IF dropped_any THEN
+        BEGIN
+            EXECUTE 'DROP SCHEMA auth RESTRICT';
+        EXCEPTION WHEN OTHERS THEN
+            NULL;
+        END;
+    END IF;
+END
+$rebase_drop_legacy$;
+`;
+/**
+* Policies whose body still calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
+*
+* Postgres will not drop a function a policy depends on, so this is exactly the
+* set standing between a database and losing the legacy schema. Rebase's own
+* policies leave the list on the next push or boot, when they are recompiled —
+* anything still here afterwards is hand-written, will never be recompiled by
+* anybody, and is the reason the drop keeps being skipped. Silence there would
+* leave an operator staring at a schema the release notes said would go.
+*/
+var LEGACY_RLS_DEPENDENTS_SQL = `
+    SELECT n.nspname AS schema, c.relname AS "table", p.polname AS policy
+    FROM pg_policy p
+    JOIN pg_class c ON c.oid = p.polrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE pg_get_expr(p.polqual, p.polrelid) ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+       OR pg_get_expr(p.polwithcheck, p.polrelid) ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+    ORDER BY 1, 2, 3
+`;
+/**
+* Functions whose body calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
+*
+* This is the half `DROP FUNCTION ... RESTRICT` cannot see, and the reason it
+* needs its own query. Postgres records a dependency for a *policy* that calls a
+* function, which is why the drop is safe against the policies above — but a
+* `LANGUAGE sql` function whose body is a **string literal** is not parsed when
+* it is created, so nothing is recorded and `RESTRICT` has nothing to refuse on.
+* The drop succeeds and the caller is left pointing at a function that no longer
+* exists, which fails at *query* time rather than at boot.
+*
+* A downstream project building on these helpers is not hypothetical: the Rebase
+* control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`
+* in this very schema, each calling `auth.uid()` in a string body, and eleven of
+* its row-level-security policies go through them. Every one of those would have
+* started failing the first time a recompile left no policy referencing
+* `auth.uid()` directly — the drop's own precondition.
+*
+* Matching on the body text is the only option available, and it is deliberately
+* broad: a false positive costs a schema that stays one release longer and says
+* why, while a false negative costs somebody their policies.
+*/
+var LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = `
+    SELECT n.nspname AS schema, p.proname AS function
+    FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+      AND NOT (n.nspname = '${LEGACY_RLS_SCHEMA}' AND p.proname IN ('uid', 'jwt', 'roles'))
+      AND p.prosrc ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+    ORDER BY 1, 2
+`;
+/**
+* Retire the pre-1.0 `auth` schema, reporting what is holding it back.
+*
+* The shared implementation behind the CLI's post-push step and the runtime's
+* post-policy step. Both used to just fire {@link DROP_LEGACY_AUTH_SCHEMA_SQL}
+* and swallow whatever came back, which is right for the ordinary case — a
+* table not recompiled *yet* — and wrong for the one that never resolves: a
+* hand-written policy nothing will ever rewrite. Then the schema stays forever
+* and nothing ever says why.
+*/
+async function dropLegacyAuthSchema(run, report) {
+	let blockers;
+	try {
+		blockers = await run(LEGACY_RLS_DEPENDENTS_SQL);
+	} catch {
+		return;
+	}
+	if (blockers.length > 0) {
+		report.warn(`The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${blockers.length} ${blockers.length === 1 ? "policy still calls" : "policies still call"} \`${LEGACY_RLS_SCHEMA}.uid()\` and friends, and Postgres will not drop a function a policy depends on. Rebase's own policies are rewritten automatically — anything listed here is hand-written SQL that has to be updated to \`${REBASE_SCHEMA}.uid()\` by hand, after which the schema goes on its own:\n` + blockers.map((b) => `  • ${b.schema}.${b.table} → "${b.policy}"`).join("\n"));
+		return;
+	}
+	let borrowers;
+	try {
+		borrowers = await run(LEGACY_RLS_FUNCTION_DEPENDENTS_SQL);
+	} catch {
+		return;
+	}
+	if (borrowers.length > 0) {
+		report.warn(`The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${borrowers.length} ${borrowers.length === 1 ? "function calls" : "functions call"} \`${LEGACY_RLS_SCHEMA}.uid()\` and friends from its own body. Postgres records no dependency for that — a SQL body written as a string literal is never parsed — so dropping the helpers would leave these pointing at nothing, and they would fail when a query reached them rather than now. Repoint them at \`${REBASE_SCHEMA}.uid()\`, after which the schema goes on its own:\n` + borrowers.map((b) => `  • ${b.schema}.${b.function}()`).join("\n"));
+		return;
+	}
+	try {
+		await run(DROP_LEGACY_AUTH_SCHEMA_SQL);
+	} catch (err) {
+		report.info(`Left the \`${LEGACY_RLS_SCHEMA}\` schema in place: ` + (err instanceof Error ? err.message : String(err)));
+	}
+}
+//#endregion
+export { rls_bootstrap_sql_exports as n, RLS_BOOTSTRAP_STATEMENTS as t };
+
+//# sourceMappingURL=rls-bootstrap-sql-Bpv3nUZo.js.map

package/dist/rls-bootstrap-sql-Bpv3nUZo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-bootstrap-sql-Bpv3nUZo.js","names":[],"sources":["../src/schema/rls-bootstrap-sql.ts"],"sourcesContent":["import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA } from \"@rebasepro/types\";\n\n/**\n * Canonical SQL bootstrap for the RLS helper functions.\n *\n * Generated RLS policies reference `rebase.uid()` / `rebase.roles()` /\n * `rebase.jwt()`, so any SQL stream that can contain policies must be\n * self-contained: it has to (re)create these helpers first. This matters for\n * the migration directory in particular — Atlas replays migrations against a\n * clean dev database where no out-of-band bootstrap has ever run, so a\n * migration carrying policies without this preamble fails with\n * \"function rebase.uid() does not exist\".\n *\n * Idempotent (`IF NOT EXISTS` / `OR REPLACE`) so it can be prepended to every\n * policies block and re-applied freely. The runtime boot path\n * (`auth/ensure-tables.ts`) creates the same functions under an advisory lock\n * for HMR-safety; keep the definitions in sync.\n *\n * ## Creating the `rebase` schema here is now safe, and required\n *\n * It deliberately did not, once. These functions lived in a schema called\n * `auth`, and the note here read: creating `rebase` would leak it into Atlas's\n * replayed migration state, and — absent from the desired `schema.sql` — Atlas\n * would then plan `DROP SCHEMA \"rebase\" CASCADE`, taking the auth tables with\n * it. That reasoning still holds; what changed is the second half of it. The\n * DDL generator now emits `CREATE SCHEMA IF NOT EXISTS \"rebase\"`\n * unconditionally, so the schema is always in the desired state and the diff is\n * empty. (It used to appear only when some collection happened to declare\n * `schema: \"rebase\"` — true for the scaffold's users collection, and not a\n * property anything guaranteed.) `db push` additionally excludes the whole\n * schema from the declarative apply.\n *\n * See `@rebasepro/types`' `rls-functions` for why the functions moved out of\n * `auth` at all: the short version is that the name was Supabase's, and\n * `CREATE OR REPLACE FUNCTION auth.uid() RETURNS text` cannot be applied over\n * Supabase's `RETURNS uuid` — Postgres refuses, and the refusal used to be\n * swallowed.\n */\n/**\n * The bootstrap as individual statements.\n *\n * Kept as an array because the two consumers need different shapes and only one\n * of them can take a multi-command string: the migration preamble is written to\n * a file and replayed by Atlas, but the boot path runs through drizzle, whose\n * node-postgres handle speaks the extended query protocol and rejects more than\n * one command per call. Splitting a joined string back apart on `$$;` would be\n * a parser for a problem that does not need one.\n */\nexport const RLS_BOOTSTRAP_STATEMENTS: readonly string[] = [\n    `CREATE SCHEMA IF NOT EXISTS ${REBASE_SCHEMA}`,\n\n    // Falls back to the pre-rename `app.user_id` so a database that has taken\n    // the new schema but is still served by an older backend keeps resolving\n    // the principal. Drop the COALESCE once no such deployment remains.\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.uid() RETURNS text AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.uid', true), ''),\n        NULLIF(current_setting('app.user_id', true), '')\n    );\n$$ LANGUAGE sql STABLE`,\n\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.jwt() RETURNS jsonb AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.jwt', true), ''),\n        '{}'\n    )::jsonb;\n$$ LANGUAGE sql STABLE`,\n\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.roles() RETURNS text AS $$\n    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');\n$$ LANGUAGE sql STABLE`\n];\n\n/** The same statements as one script, for migration files and raw clients. */\nexport const RLS_BOOTSTRAP_SQL =\n    \"-- Rebase schema + RLS helper functions (required by the policies below)\\n\" +\n    RLS_BOOTSTRAP_STATEMENTS.map(s => `${s};`).join(\"\\n\\n\") + \"\\n\";\n\n/**\n * Removes the pre-1.0 `auth` schema, but only when Rebase is what put it there.\n *\n * ## Why this is safe against a Supabase database\n *\n * Two independent guards, and both have to pass:\n *\n *  1. **Each function is identified before it is dropped.** Ours returns `text`\n *     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads\n *     `request.jwt.claims`. Nothing is dropped on a signature we did not write,\n *     so a Supabase database — where our `CREATE OR REPLACE` could never have\n *     succeeded in the first place, Postgres refusing to change a return type —\n *     matches nothing and this is a no-op.\n *  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still\n *     lives in `auth` (Supabase's `users` table, its other helpers), the drop\n *     fails and the schema stays. CASCADE here would be unrecoverable.\n *\n * ## Why it cannot run too early\n *\n * Postgres records a dependency from every RLS policy to the functions its body\n * calls, so `DROP FUNCTION auth.uid()` fails for as long as a single policy\n * still references it. That is the interlock, and it is load-bearing: the drop\n * can only succeed once every policy has been recompiled to \\`rebase.uid()\\`.\n * Callers therefore run this *after* applying policies, and treat a failure as\n * \"not yet — try again next boot\" rather than as an error.\n */\nexport const DROP_LEGACY_AUTH_SCHEMA_SQL = `\nDO $rebase_drop_legacy$\nDECLARE\n    dropped_any boolean := false;\nBEGIN\n    -- Each function is matched on its own result type and body, so a schema\n    -- that merely shares the name keeps everything it has.\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'uid'\n          AND pg_get_function_result(p.oid) = 'text'\n          AND p.prosrc LIKE '%app.uid%'\n    ) THEN\n        DROP FUNCTION auth.uid();\n        dropped_any := true;\n    END IF;\n\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'jwt'\n          AND pg_get_function_result(p.oid) = 'jsonb'\n          AND p.prosrc LIKE '%app.jwt%'\n    ) THEN\n        DROP FUNCTION auth.jwt();\n        dropped_any := true;\n    END IF;\n\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'roles'\n          AND pg_get_function_result(p.oid) = 'text'\n          AND p.prosrc LIKE '%app.user_roles%'\n    ) THEN\n        DROP FUNCTION auth.roles();\n        dropped_any := true;\n    END IF;\n\n    -- RESTRICT: only an empty schema goes. Anything else in there — including a\n    -- Supabase installation left untouched above — keeps it.\n    IF dropped_any THEN\n        BEGIN\n            EXECUTE 'DROP SCHEMA auth RESTRICT';\n        EXCEPTION WHEN OTHERS THEN\n            NULL;\n        END;\n    END IF;\nEND\n$rebase_drop_legacy$;\n`;\n\n/** Somebody's policy that still calls a pre-1.0 helper. */\nexport interface LegacyRlsDependent {\n    schema: string;\n    table: string;\n    policy: string;\n}\n\n/**\n * Policies whose body still calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.\n *\n * Postgres will not drop a function a policy depends on, so this is exactly the\n * set standing between a database and losing the legacy schema. Rebase's own\n * policies leave the list on the next push or boot, when they are recompiled —\n * anything still here afterwards is hand-written, will never be recompiled by\n * anybody, and is the reason the drop keeps being skipped. Silence there would\n * leave an operator staring at a schema the release notes said would go.\n */\nexport const LEGACY_RLS_DEPENDENTS_SQL = `\n    SELECT n.nspname AS schema, c.relname AS \"table\", p.polname AS policy\n    FROM pg_policy p\n    JOIN pg_class c ON c.oid = p.polrelid\n    JOIN pg_namespace n ON n.oid = c.relnamespace\n    WHERE pg_get_expr(p.polqual, p.polrelid) ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n       OR pg_get_expr(p.polwithcheck, p.polrelid) ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n    ORDER BY 1, 2, 3\n`;\n\n/** Somebody's *function* that still calls a pre-1.0 helper from its own body. */\nexport interface LegacyRlsFunctionDependent {\n    schema: string;\n    function: string;\n}\n\n/**\n * Functions whose body calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.\n *\n * This is the half `DROP FUNCTION ... RESTRICT` cannot see, and the reason it\n * needs its own query. Postgres records a dependency for a *policy* that calls a\n * function, which is why the drop is safe against the policies above — but a\n * `LANGUAGE sql` function whose body is a **string literal** is not parsed when\n * it is created, so nothing is recorded and `RESTRICT` has nothing to refuse on.\n * The drop succeeds and the caller is left pointing at a function that no longer\n * exists, which fails at *query* time rather than at boot.\n *\n * A downstream project building on these helpers is not hypothetical: the Rebase\n * control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`\n * in this very schema, each calling `auth.uid()` in a string body, and eleven of\n * its row-level-security policies go through them. Every one of those would have\n * started failing the first time a recompile left no policy referencing\n * `auth.uid()` directly — the drop's own precondition.\n *\n * Matching on the body text is the only option available, and it is deliberately\n * broad: a false positive costs a schema that stays one release longer and says\n * why, while a false negative costs somebody their policies.\n */\nexport const LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = `\n    SELECT n.nspname AS schema, p.proname AS function\n    FROM pg_proc p\n    JOIN pg_namespace n ON n.oid = p.pronamespace\n    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')\n      AND NOT (n.nspname = '${LEGACY_RLS_SCHEMA}' AND p.proname IN ('uid', 'jwt', 'roles'))\n      AND p.prosrc ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n    ORDER BY 1, 2\n`;\n\n/**\n * Retire the pre-1.0 `auth` schema, reporting what is holding it back.\n *\n * The shared implementation behind the CLI's post-push step and the runtime's\n * post-policy step. Both used to just fire {@link DROP_LEGACY_AUTH_SCHEMA_SQL}\n * and swallow whatever came back, which is right for the ordinary case — a\n * table not recompiled *yet* — and wrong for the one that never resolves: a\n * hand-written policy nothing will ever rewrite. Then the schema stays forever\n * and nothing ever says why.\n */\nexport async function dropLegacyAuthSchema(\n    run: (sql: string) => Promise<Record<string, unknown>[]>,\n    report: { info: (m: string) => void; warn: (m: string) => void }\n): Promise<void> {\n    let blockers: LegacyRlsDependent[];\n    try {\n        blockers = (await run(LEGACY_RLS_DEPENDENTS_SQL)) as unknown as LegacyRlsDependent[];\n    } catch {\n        return; // No catalogue access; nothing here is worth failing a boot for.\n    }\n\n    if (blockers.length > 0) {\n        report.warn(\n            `The pre-1.0 \\`${LEGACY_RLS_SCHEMA}\\` schema cannot be removed yet: ${blockers.length} ` +\n            `${blockers.length === 1 ? \"policy still calls\" : \"policies still call\"} ` +\n            `\\`${LEGACY_RLS_SCHEMA}.uid()\\` and friends, and Postgres will not drop a function a policy ` +\n            `depends on. Rebase's own policies are ` +\n            `rewritten automatically — anything listed here is hand-written SQL that has to be updated to ` +\n            `\\`${REBASE_SCHEMA}.uid()\\` by hand, after which the schema goes on its own:\\n` +\n            blockers.map(b => `  • ${b.schema}.${b.table} → \"${b.policy}\"`).join(\"\\n\")\n        );\n        return;\n    }\n\n    // The half Postgres will not refuse on. See LEGACY_RLS_FUNCTION_DEPENDENTS_SQL:\n    // a string-literal SQL body records no dependency, so `DROP FUNCTION` drops\n    // out from under a caller that is still using it and nothing complains until\n    // a query runs.\n    let borrowers: LegacyRlsFunctionDependent[];\n    try {\n        borrowers = (await run(LEGACY_RLS_FUNCTION_DEPENDENTS_SQL)) as unknown as LegacyRlsFunctionDependent[];\n    } catch {\n        return;\n    }\n\n    if (borrowers.length > 0) {\n        report.warn(\n            `The pre-1.0 \\`${LEGACY_RLS_SCHEMA}\\` schema cannot be removed yet: ${borrowers.length} ` +\n            `${borrowers.length === 1 ? \"function calls\" : \"functions call\"} ` +\n            `\\`${LEGACY_RLS_SCHEMA}.uid()\\` and friends from its own body. Postgres records no dependency ` +\n            `for that — a SQL body written as a string literal is never parsed — so dropping the helpers ` +\n            `would leave these pointing at nothing, and they would fail when a query reached them rather ` +\n            `than now. Repoint them at \\`${REBASE_SCHEMA}.uid()\\`, after which the schema goes on its own:\\n` +\n            borrowers.map(b => `  • ${b.schema}.${b.function}()`).join(\"\\n\")\n        );\n        return;\n    }\n\n    try {\n        await run(DROP_LEGACY_AUTH_SCHEMA_SQL);\n    } catch (err) {\n        // Something else depends on it, or the connection does not own it.\n        // Not fatal: the schema is inert either way now that no policy calls it.\n        report.info(\n            `Left the \\`${LEGACY_RLS_SCHEMA}\\` schema in place: ` +\n            (err instanceof Error ? err.message : String(err))\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,IAAa,2BAA8C;CACvD,+BAA+B;CAK/B,8BAA8B,cAAc;;;;;;CAO5C,8BAA8B,cAAc;;;;;;CAO5C,8BAA8B,cAAc;;;AAGhD;AAII,KACA,yBAAyB,KAAI,MAAK,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4B1D,IAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmE3C,IAAa,4BAA4B;;;;;sDAKa,kBAAkB;2DACb,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;AAgC7E,IAAa,qCAAqC;;;;;8BAKpB,kBAAkB;4BACpB,kBAAkB;;;;;;;;;;;;;AAc9C,eAAsB,qBAClB,KACA,QACa;CACb,IAAI;CACJ,IAAI;EACA,WAAY,MAAM,IAAI,yBAAyB;CACnD,QAAQ;EACJ;CACJ;CAEA,IAAI,SAAS,SAAS,GAAG;EACrB,OAAO,KACH,iBAAiB,kBAAkB,mCAAmC,SAAS,OAAO,GACnF,SAAS,WAAW,IAAI,uBAAuB,sBAAsB,KACnE,kBAAkB,4MAGlB,cAAc,+DACnB,SAAS,KAAI,MAAK,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,IAAI,CAC7E;EACA;CACJ;CAMA,IAAI;CACJ,IAAI;EACA,YAAa,MAAM,IAAI,kCAAkC;CAC7D,QAAQ;EACJ;CACJ;CAEA,IAAI,UAAU,SAAS,GAAG;EACtB,OAAO,KACH,iBAAiB,kBAAkB,mCAAmC,UAAU,OAAO,GACpF,UAAU,WAAW,IAAI,mBAAmB,iBAAiB,KAC3D,kBAAkB,6RAGQ,cAAc,uDAC7C,UAAU,KAAI,MAAK,OAAO,EAAE,OAAO,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,IAAI,CACnE;EACA;CACJ;CAEA,IAAI;EACA,MAAM,IAAI,2BAA2B;CACzC,SAAS,KAAK;EAGV,OAAO,KACH,cAAc,kBAAkB,yBAC/B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACpD;CACJ;AACJ"}

package/dist/schema/auth-schema.d.ts

@@ -427,6 +427,23 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            aal: import("drizzle-orm/pg-core").PgColumn<{
+                name: "aal";
+                tableName: "refresh_tokens";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             userAgent: import("drizzle-orm/pg-core").PgColumn<{
                 name: "user_agent";
                 tableName: "refresh_tokens";
@@ -880,6 +897,23 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            lastUsedCounter: import("drizzle-orm/pg-core").PgColumn<{
+                name: "last_used_counter";
+                tableName: "mfa_factors";
+                dataType: "number";
+                columnType: "PgBigInt53";
+                data: number;
+                driverParam: string | number;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             createdAt: import("drizzle-orm/pg-core").PgColumn<{
                 name: "created_at";
                 tableName: "mfa_factors";
@@ -1006,6 +1040,23 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            attempts: import("drizzle-orm/pg-core").PgColumn<{
+                name: "attempts";
+                tableName: "mfa_challenges";
+                dataType: "number";
+                columnType: "PgInteger";
+                data: number;
+                driverParam: string | number;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             expiresAt: import("drizzle-orm/pg-core").PgColumn<{
                 name: "expires_at";
                 tableName: "mfa_challenges";
@@ -1642,6 +1693,23 @@ export declare const refreshTokens: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        aal: import("drizzle-orm/pg-core").PgColumn<{
+            name: "aal";
+            tableName: "refresh_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         userAgent: import("drizzle-orm/pg-core").PgColumn<{
             name: "user_agent";
             tableName: "refresh_tokens";
@@ -2095,6 +2163,23 @@ export declare const mfaFactors: import("drizzle-orm/pg-core").PgTableWithColumn
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        lastUsedCounter: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_used_counter";
+            tableName: "mfa_factors";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
             tableName: "mfa_factors";
@@ -2221,6 +2306,23 @@ export declare const mfaChallenges: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        attempts: import("drizzle-orm/pg-core").PgColumn<{
+            name: "attempts";
+            tableName: "mfa_challenges";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         expiresAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "expires_at";
             tableName: "mfa_challenges";

package/dist/schema/auth-users-columns.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The one description of what an auth user table's columns must be.
+ *
+ * ## Why this exists
+ *
+ * Three different code paths create `rebase.users`, and before this module they
+ * disagreed about it:
+ *
+ * | column           | `db push` (generator) | `ensureAuthTablesExist` | `ensureCollectionTables` |
+ * |------------------|-----------------------|-------------------------|--------------------------|
+ * | `email`          | `TEXT UNIQUE NOT NULL`| `TEXT NOT NULL` + CHECK | `TEXT` (nullable)        |
+ * | `roles`          | `TEXT[]`              | `NOT NULL DEFAULT '{}'` | nullable, no default     |
+ * | `email_verified` | `BOOLEAN`             | `NOT NULL DEFAULT FALSE`| nullable                 |
+ * | `created_at`     | `DEFAULT now()`       | `NOT NULL DEFAULT NOW()`| no default               |
+ *
+ * They are all `CREATE TABLE IF NOT EXISTS` / `ADD COLUMN IF NOT EXISTS`, so
+ * whichever ran first decided the table and the other two silently no-op'd.
+ * Boot order therefore chose the constraints: a managed deploy (collection
+ * tables first) got a users table whose `email` was nullable and whose
+ * `email_verified` had no default, while the same project pushed from a
+ * checkout got the strict one. In the same table, `is_anonymous` came out
+ * `NOT NULL DEFAULT false` — because *that* column existed in only one of the
+ * three lists, so its owner's definition won by default.
+ *
+ * A second consequence was drift in the other direction. The scaffold's
+ * `users.ts` describes 12 columns; auth needs 14. `db push` is declarative and
+ * builds its desired state from the collection alone, so the two columns only
+ * auth knows about (`is_anonymous`, `tokens_valid_after`) read as unmanaged
+ * drift, and a push run after the server had booted once planned to DROP them.
+ *
+ * Both problems are the same problem: no single place said what this table is.
+ * This is that place. Every creator asks here first and only then falls back to
+ * the collection's own property definitions, so a column auth owns has one
+ * definition regardless of who gets there first, and a column the developer
+ * added to their users collection still behaves like any other field.
+ *
+ * ## What belongs here
+ *
+ * Only columns the auth services read or write. A developer's own additions to
+ * their users collection (`bio`, `stripe_customer_id`) are ordinary columns and
+ * must NOT be listed — they are generated from the collection like every other
+ * field, and listing them here would freeze a user's schema.
+ *
+ * `id` is deliberately absent: its type comes from the collection's id property
+ * (uuid / increment / text) and each creator already derives it.
+ *
+ * Keep in step with {@link AUTH_SCHEMA_VERSION} when a change here makes an
+ * older runtime unable to work against a migrated table.
+ */
+/**
+ * A column auth owns.
+ *
+ * Structured rather than one SQL string because the same facts are needed in
+ * three grammars — a `CREATE TABLE` column list, an `ADD COLUMN IF NOT EXISTS`,
+ * and a pair of `ALTER COLUMN … SET DEFAULT` / `SET NOT NULL` reconciles for a
+ * table that already exists with the wrong shape. Parsing a string back apart
+ * for the third of those is how the copies drifted in the first place.
+ */
+export interface AuthUsersColumn {
+    /** Physical column name. */
+    column: string;
+    /** Postgres type. */
+    type: string;
+    /** Default expression, verbatim, or absent for no default. */
+    default?: string;
+    /** Whether the column is NOT NULL. */
+    notNull?: boolean;
+}
+/**
+ * `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it
+ * — it synthesizes `anon_<32 hex>@anonymous.local` rather than inserting NULL.
+ * The 320-char bound (RFC 5321) is a CHECK rather than a `VARCHAR(n)`, added
+ * separately by `ensureAuthTablesExist` so it can be `NOT VALID` on an adopted
+ * table that already holds a longer row.
+ */
+export declare const AUTH_USERS_COLUMNS: readonly AuthUsersColumn[];
+/** Type + inline constraints, as they appear after the column name. */
+export declare function authUsersColumnSql(spec: AuthUsersColumn): string;
+/**
+ * The auth-owned definition for a physical column name, or `undefined` when
+ * auth does not own it.
+ *
+ * Callers pass the RESOLVED column name (after `columnName` mapping), because
+ * that is the only name the three creators agree on: the scaffold's users
+ * collection spells the property `displayName` and the column `display_name`.
+ */
+export declare function authUsersColumnDefinition(column: string): string | undefined;
+/**
+ * Whether a collection is an auth collection, i.e. whether the definitions in
+ * this module apply to its table at all.
+ *
+ * Duplicated in shape from `@rebasepro/common`'s policy defaults on purpose:
+ * that one takes a `CollectionConfig`, this one is called from DDL code paths
+ * that hold looser objects, and both spellings must accept `auth: true` as well
+ * as `auth: { enabled: true }`.
+ */
+export declare function isAuthCollection(collection: unknown): boolean;

package/dist/schema/doctor-policy-checks.d.ts

@@ -0,0 +1,28 @@
+/**
+ * What the RLS checks concluded.
+ *
+ * `unchecked` exists because "we could not look" and "we looked and it is fine"
+ * used to be reported identically: a collections path that did not resolve made
+ * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`
+ * early-returned an empty diff, and the gate printed
+ * `✓ RLS policies match your collections` having compared zero policies against
+ * zero collections. Any exception at all — a collection file that throws on
+ * import, a `pg_policies` read the CI role is not granted, a connection reset —
+ * did the same thing through a `warn`, and exited 0.
+ */
+export type PolicyCheckStatus = "ok" | "problems" | "unchecked";
+/**
+ * The exit code for `rebase doctor --policies`.
+ *
+ * A gate that could not run has not passed. Only a completed, clean check
+ * exits 0 — anything else, including "we never opened a connection", is a
+ * failure, or the flag certifies a database nobody looked at.
+ */
+export declare function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1;
+/**
+ * Policies actually deployed vs the ones the collections describe, plus policy
+ * roles this server could never satisfy.
+ *
+ * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.
+ */
+export declare function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus>;

package/dist/schema/doctor.d.ts

@@ -2,7 +2,7 @@ import { CollectionConfig, Property } from "@rebasepro/types";
 export type IssueSeverity = "error" | "warning" | "info";
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated" | "sdk_ungeneratable";
     table?: string;
     column?: string;
     expected?: string;
@@ -10,21 +10,28 @@ export interface DoctorIssue {
     message: string;
     fix: string;
 }
+export interface DoctorPhase {
+    passed: boolean;
+    issues: DoctorIssue[];
+    /**
+     * Why this phase never ran, when it did not.
+     *
+     * A check that did not happen is a third state, not a passing one. While a
+     * skipped phase initialised to `{ passed: true, issues: [] }` it rendered as
+     * `✅ Collections → Database: In sync` and counted towards
+     * `✓ All schemas are in sync!` — so a project whose connection string was
+     * spelled `POSTGRES_URL`, or a CI job that never exported one, got two green
+     * ticks and exit 0 against a database with no tables in it.
+     */
+    skipped?: string;
+}
 export interface DoctorReport {
-    collectionsToSchema: {
-        passed: boolean;
-        issues: DoctorIssue[];
-    };
-    collectionsToSdk: {
-        passed: boolean;
-        issues: DoctorIssue[];
-    };
-    schemaToDatabase: {
-        passed: boolean;
-        issues: DoctorIssue[];
-    };
+    collectionsToSchema: DoctorPhase;
+    collectionsToSdk: DoctorPhase;
+    schemaToDatabase: DoctorPhase;
     summary: {
         passed: number;
+        skipped: number;
         warnings: number;
         errors: number;
     };
@@ -37,18 +44,9 @@ export declare function getExpectedColumnType(prop: Property): string | null;
  * wrong thing.
  */
 export declare function loadCollections(collectionsPath: string): Promise<CollectionConfig[]>;
-export declare function checkCollectionsVsSchema(collections: CollectionConfig[], schemaFilePath: string): Promise<{
-    passed: boolean;
-    issues: DoctorIssue[];
-}>;
-export declare function checkCollectionsVsSdk(collections: CollectionConfig[], sdkFilePath: string): Promise<{
-    passed: boolean;
-    issues: DoctorIssue[];
-}>;
-export declare function checkCollectionsVsDatabase(collections: CollectionConfig[], databaseUrl: string): Promise<{
-    passed: boolean;
-    issues: DoctorIssue[];
-}>;
+export declare function checkCollectionsVsSchema(collections: CollectionConfig[], schemaFilePath: string): Promise<DoctorPhase>;
+export declare function checkCollectionsVsSdk(collections: CollectionConfig[], sdkFilePath: string): Promise<DoctorPhase>;
+export declare function checkCollectionsVsDatabase(collections: CollectionConfig[], databaseUrl: string): Promise<DoctorPhase>;
 export declare function renderReport(report: DoctorReport): void;
 export declare function runDoctor(options: {
     collectionsPath: string;