@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g06dbe5b

package/dist/security/rls-enforcement.d.ts

@@ -1,5 +1,6 @@
 import { SQL } from "drizzle-orm";
 import { SecurityRule } from "@rebasepro/types";
+import { REBASE_USER_ROLE } from "@rebasepro/common";
 /**
  * Unified RLS enforcement — the "user context vs server context" model.
  *
@@ -13,9 +14,14 @@ import { SecurityRule } from "@rebasepro/types";
  *    are validation/side-effects, not a security boundary.
  *
  *  - **Server context** — the base (owner) connection: auth flows, migrations,
- *    background jobs, and the explicit `rebase.dataAsAdmin` accessor. As table
- *    owner it bypasses RLS. This is the trusted plane, equivalent to
- *    Supabase's `service_role`.
+ *    and raw `rebase.sql`. As table owner it bypasses RLS. This is the trusted
+ *    plane, equivalent to Supabase's `service_role`.
+ *
+ *    `rebase.dataAsAdmin` is **not** in it, despite the name. `init.ts` scopes
+ *    that driver with `withAuth(SERVICE_IDENTITY)`, so it arrives as user
+ *    context above — `rebase_user`, `app.uid = 'service'`, policies evaluated —
+ *    and clears the default policies through their admin arm rather than the
+ *    `auth.uid() IS NULL` one.
  *
  * This module provides the three pieces:
  *
@@ -32,8 +38,14 @@ import { SecurityRule } from "@rebasepro/types";
  * self-creates the `auth` schema and functions) — enforcement is default-on,
  * not an operator opt-in.
  */
-/** The restricted role every authenticated (user-context) request runs as. */
-export declare const REBASE_USER_ROLE = "rebase_user";
+/**
+ * The restricted role every authenticated (user-context) request runs as.
+ *
+ * Re-exported, not re-declared: the same name is needed by
+ * `@rebasepro/common`'s internal-table revokes, and two spellings of a role name
+ * fail as a silent no-op rather than an error.
+ */
+export { REBASE_USER_ROLE };
 /** Minimal SQL runner so callers can adapt drizzle or pg.Client. */
 export type RawSqlRunner = (sqlText: string) => Promise<Record<string, unknown>[]>;
 /** Minimal transaction surface needed by {@link applyAuthContext}. */
@@ -55,6 +67,34 @@ export interface AuthContext {
     /** Raw roles as carried on the user (strings or `{ id }` objects). */
     roles: unknown[];
 }
+/**
+ * Warn when the connection role shares its name with an existing schema.
+ *
+ * Postgres resolves unqualified names through `search_path`, which defaults to
+ * `"$user", public` — and `$user` is the connection ROLE. When a schema of that
+ * name exists it sits ahead of `public`, so every unqualified statement
+ * silently operates on it instead:
+ *
+ *     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts
+ *
+ * Nothing errors. You get a second table of the same name in the wrong schema,
+ * and reads that pin `public` cannot see it — which reads as "missing table" and
+ * sends people to re-run a push that creates a *third* copy. The bootstrapper
+ * has a whole branch dedicated to recognising the symptom after the fact.
+ *
+ * Rebase shipped straight into this: it creates a schema named `rebase` while
+ * every template named the database role `rebase` too. The scaffold uses
+ * `rebase_app` now, and every pool Rebase opens pins `search_path=public`
+ * (`pinSearchPath`), which covers the paths the framework controls. This covers
+ * the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,
+ * a hand-written migration — because the hazard is a property of the two NAMES,
+ * not of any one connection.
+ *
+ * A warning rather than a boot failure: the database works, the framework's own
+ * traffic is pinned, and refusing to start over a naming choice a user may have
+ * inherited would be worse than the risk.
+ */
+export declare function warnOnRoleSchemaCollision(run: RawSqlRunner): Promise<void>;
 export declare function detectConnectionPosture(run: RawSqlRunner): Promise<ConnectionPosture>;
 /**
  * Human-actionable instructions for when the connection cannot provision the
@@ -123,6 +163,22 @@ export declare function warnOnAnonymousGrants(collections: {
     slug?: string;
     securityRules?: readonly SecurityRule[];
 }[]): void;
+/**
+ * Name the collections whose raw policy SQL still calls the pre-1.0 helpers.
+ *
+ * The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the
+ * database, so nothing is broken and no policy is wrong — which is exactly why
+ * this has to be said out loud. A silent rewrite that works forever is not a
+ * migration, it is a second supported spelling nobody wrote down, and the next
+ * person to read those rules will copy the old one.
+ *
+ * Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,
+ * `policy.rolesOverlap(...)`) compile from the model and were never affected.
+ */
+export declare function warnOnLegacyRlsFunctions(collections: {
+    slug?: string;
+    securityRules?: readonly SecurityRule[];
+}[]): void;
 /**
  * Reject `pgRoles` that this server can never satisfy.
  *

package/dist/services/FetchService.d.ts

@@ -64,6 +64,18 @@ export declare class FetchService {
      * and skips rows rather than erroring. The guesses stay, last, for a
      * caller that hands over no collection to resolve against.
      */
+    /**
+     * The ORDER BY target, which may be relevance rather than a column.
+     *
+     * `_score` is only meaningful for a collection that declared a `search`
+     * block *and* for a request that carried a search string — ranking rows
+     * against no query ranks them all at zero. Outside those two conditions it
+     * is an unknown field and gets the same 400 as any other typo, which is the
+     * behaviour that matters: a sort that is silently dropped returns 200 with
+     * rows in arbitrary order, and paging over that repeats and skips rows.
+     */
+    static readonly SCORE_FIELD = "_score";
+    private resolveOrderTarget;
     private resolveOrderByField;
     /**
      * Build the `with` config for Drizzle's relational query API.
@@ -132,6 +144,7 @@ export declare class FetchService {
         offset?: number;
         startAfter?: Record<string, unknown>;
         searchString?: string;
+        searchExplain?: boolean;
         databaseId?: string;
         vectorSearch?: VectorSearchParams;
         logical?: LogicalCondition;
@@ -153,6 +166,16 @@ export declare class FetchService {
      */
     fetchCollection<M extends Record<string, unknown>>(collectionPath: string, options?: {
         filter?: FilterValues<Extract<keyof M, string>>;
+        /**
+         * An `or(...)`/`and(...)` group, applied alongside `filter`.
+         *
+         * `fetchRowsWithConditions` below has always applied this; it was
+         * simply absent from this signature, so the only callers that could
+         * pass one were the ones that went around this method. Realtime
+         * came through here, which is why a subscription filtered by a
+         * logical group was pushed every row in the table.
+         */
+        logical?: LogicalCondition;
         orderBy?: string;
         order?: "desc" | "asc";
         limit?: number;
@@ -167,10 +190,21 @@ export declare class FetchService {
      */
     searchRows<M extends Record<string, unknown>>(collectionPath: string, searchString: string, options?: {
         filter?: FilterValues<Extract<keyof M, string>>;
+        /**
+         * An `or(...)`/`and(...)` group, applied alongside `filter`.
+         *
+         * `fetchRowsWithConditions` has always applied one; it was missing
+         * from this signature, so a realtime search subscription carrying a
+         * group could not pass it on and served every row matching the text
+         * that RLS allowed.
+         */
+        logical?: LogicalCondition;
         orderBy?: string;
         order?: "desc" | "asc";
         limit?: number;
         databaseId?: string;
+        /** Ask each row which declared search field matched. */
+        searchExplain?: boolean;
     }): Promise<Record<string, unknown>[]>;
     /**
      * Count rows in a collection
@@ -226,13 +260,6 @@ export declare class FetchService {
      * Note: Primary path now uses inline `getQueryBuilder()` checks.
      */
     private hasDrizzleQueryAPI;
-    /**
-     * Attempt to use Drizzle's relational query API (db.query.<table>.findMany)
-     * for efficient JOIN-based relation loading.
-     * Returns null if the API is not available or the query fails.
-     * Note: Primary path now uses `buildWithConfig` + `buildDrizzleQueryOptions`.
-     */
-    private fetchWithDrizzleQuery;
     /**
      * Fallback path used when db.query is unavailable.
      * The primary path uses db.query.findMany with `with` config, which

package/dist/services/RelationService.d.ts

@@ -149,6 +149,36 @@ export declare class RelationService {
      * Uses a single SQL query with IN clause to avoid N+1.
      */
     batchFetchRelatedEntitiesMany(parentCollectionPath: string, parentIds: (string | number)[], _relationKey: string, relation: ResolvedRelation): Promise<Map<string, RelatedRow<Record<string, unknown>>[]>>;
+    /**
+     * Bring one row's junction links in line with the ids a save carried,
+     * by diffing against what is stored rather than replacing the lot.
+     *
+     * The old shape was `DELETE every link for this parent` followed by
+     * `INSERT what the client sent`, which makes a save of the parent a full
+     * replacement of the membership set from a list the browser assembled out
+     * of a read it did earlier. Three things follow from that, and the diff
+     * closes all three:
+     *
+     *  - **Lost update.** Two editors with post 7 open: A adds tag X and saves;
+     *    B saves any field and the whole set is rewritten from B's older list,
+     *    dropping X with nothing to show for it. A diff only names the ids that
+     *    actually changed, so edits to disjoint tags no longer collide.
+     *  - **Partial read, partial delete.** The read that fills the form runs
+     *    under RLS, so a user who may edit the parent but cannot *see* some of
+     *    the linked rows gets a shorter list — and writing it back deleted the
+     *    links they were never shown. The DELETE now names ids instead of
+     *    "everything for this parent", and the select that produces them runs
+     *    in this same transaction under the same policies, so a link the caller
+     *    cannot read is in neither list and survives the save.
+     *  - **Junction payload columns.** A junction carrying its own columns
+     *    (`position`, `role`, `created_at`) lost them on every save, because
+     *    every row was re-inserted with only the two keys. Untouched links are
+     *    now left alone.
+     *
+     * The insert is `ON CONFLICT DO NOTHING` so that two sessions adding the
+     * same link concurrently is a no-op rather than a unique violation.
+     */
+    private syncJunctionLinks;
     /**
      * Update many-to-many and junction relations
      */

package/dist/services/collection-helpers.d.ts

@@ -34,6 +34,32 @@ export declare function getColumnMeta(col: AnyPgColumn): DrizzleColumnMeta;
  */
 export declare function idCanAddressTable(id: string | number, table: PgTable, idInfoArray: PrimaryKeyInfo[]): boolean;
 export declare function getCollectionByPath(collectionPath: string, registry: PostgresCollectionRegistry): CollectionConfig;
+/**
+ * Reject a write naming something that is not a column of the table.
+ *
+ * Drizzle builds INSERT from `Object.entries(table[Symbol.Columns])` and UPDATE
+ * from `Object.keys(tableColumns)`, so a key the table does not carry is not
+ * rejected by anything — it is *left out of the statement*. The insert answers
+ * 201 having stored nothing under that name; the update, if the key was the
+ * only one, builds `update "posts" set  where …` and Postgres raises a syntax
+ * error (SQLSTATE 42601), which is neither class 22 nor 23 and so surfaces as a
+ * 500 for what is a caller's typo.
+ *
+ * That makes this the last honest place to check, and the only one every write
+ * passes through. `assertKnownWriteFields` in the REST layer checks the same
+ * thing against the *config* and is skipped on four paths — `strictWrites:
+ * false`, a collection declaring no properties, an auth adapter that owns the
+ * body's shape, and a nested route whose target cannot be walked — and it never
+ * sees an in-process `rebase.data` write at all.
+ *
+ * It also gives `strictWrites: false` a truthful implementation. The flag is
+ * documented for "a column that really does exist which the config never
+ * declared", and skipping the config check alone could not deliver that: the
+ * value was dropped a layer later regardless. Skipping the config check and
+ * keeping this one does exactly what the flag says — the column must exist,
+ * the property need not.
+ */
+export declare function assertWritableColumns(values: Record<string, unknown>, table: PgTable, collectionPath: string): void;
 export declare function getTableForCollection(collection: CollectionConfig, registry: PostgresCollectionRegistry): PgTable<any>;
 /**
  * The key columns a collection's rows are addressed by.

package/dist/services/dataService.d.ts

@@ -36,6 +36,8 @@ export declare class DataService implements DataRepository {
      */
     fetchCollection<M extends Record<string, unknown>>(collectionPath: string, options?: {
         filter?: FilterValues<Extract<keyof M, string>>;
+        /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+        logical?: LogicalCondition;
         orderBy?: string;
         order?: "desc" | "asc";
         limit?: number;
@@ -50,10 +52,13 @@ export declare class DataService implements DataRepository {
      */
     searchRows<M extends Record<string, unknown>>(collectionPath: string, searchString: string, options?: {
         filter?: FilterValues<Extract<keyof M, string>>;
+        /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+        logical?: LogicalCondition;
         orderBy?: string;
         order?: "desc" | "asc";
         limit?: number;
         databaseId?: string;
+        searchExplain?: boolean;
     }): Promise<Record<string, unknown>[]>;
     /**
      * Count rows in a collection

package/dist/services/realtimeService.d.ts

@@ -1,6 +1,6 @@
 import { WebSocket } from "ws";
 import { EventEmitter } from "events";
-import { DataDriver, WebSocketMessage } from "@rebasepro/types";
+import { DataDriver, WebSocketMessage, LogicalCondition } from "@rebasepro/types";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { RealtimeProvider, CollectionSubscriptionConfig, SingleSubscriptionConfig } from "../interfaces";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
@@ -14,6 +14,57 @@ export interface SubscriptionAuthContext {
     uid: string;
     roles: string[];
 }
+/** What a channel frame is asking to do. */
+export type ChannelAction = "join" | "broadcast" | "presence" | "history";
+/** Everything an authorizer is told about the frame it is asked to allow. */
+export interface ChannelAuthorizationRequest {
+    /** The channel the frame names, exactly as the client wrote it. */
+    channel: string;
+    action: ChannelAction;
+    /** The socket, not the principal — one user may hold several. */
+    clientId: string;
+    /** The socket's authenticated principal, or the anonymous one. */
+    user?: SubscriptionAuthContext;
+}
+/**
+ * The extension point for channel access rules.
+ *
+ * **This is deliberately not a product API yet.** The rule *language* — a
+ * config key, a per-pattern DSL, how it composes with `securityRules` — is an
+ * open design question (see `docs/channel-authorization.md`), and
+ * inventing one here would be inventing the answer. What exists is the single
+ * place every channel frame passes through, so that whatever shape the rules
+ * eventually take has exactly one seam to plug into and no arm of the switch
+ * can be forgotten.
+ *
+ * Returning `false` — or throwing — refuses the frame. It is consulted *after*
+ * the membership floor below, so an authorizer can only ever narrow access,
+ * never widen it.
+ */
+export type ChannelAuthorizer = (request: ChannelAuthorizationRequest) => boolean | Promise<boolean>;
+/**
+ * The narrowing a collection subscription was created with, kept so that every
+ * refetch answers the same query the initial fetch did.
+ *
+ * Named once because it used to be written out inline in five places, and a
+ * field missing from one of them is accepted over the wire and then silently
+ * ignored: `offset` was declared on the incoming props and never stored, so a
+ * live list on page three served page one, and `logical` was never stored
+ * either, so an `or(...)` subscription was pushed every row in the table.
+ */
+type StoredCollectionRequest = {
+    filter?: Record<string, unknown>;
+    logical?: LogicalCondition;
+    orderBy?: string;
+    order?: "desc" | "asc";
+    limit?: number;
+    offset?: number;
+    startAfter?: Record<string, unknown>;
+    databaseId?: string;
+    searchString?: string;
+    /** Ask each row which declared search field matched — populates `_matches`. */
+    searchExplain?: boolean;
+};
 /**
  * PostgreSQL-specific realtime service.
  * Handles WebSocket connections and subscriptions for real-time row updates.
@@ -23,6 +74,12 @@ export interface SubscriptionAuthContext {
 export declare class RealtimeService extends EventEmitter implements RealtimeProvider {
     private db;
     private registry;
+    /**
+     * Declares to the multi-engine router that channel frames can be handled
+     * here. Read by `createRoutedRealtimeService`, which otherwise would have to
+     * guess — and guessed "the default provider", whichever engine that is.
+     */
+    readonly supportsChannels = true;
     private clients;
     private channels;
     private presence;
@@ -69,6 +126,23 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
      * so a hot channel logs the problem once rather than once per message.
      */
     private oversizedBroadcastWarned;
+    /**
+     * Optional narrowing on top of the membership floor — see
+     * {@link ChannelAuthorizer}. Unset by default, which leaves membership as
+     * the whole of the rule.
+     */
+    private channelAuthorizer?;
+    /**
+     * Whether a notification from another instance has ever arrived.
+     *
+     * The entity LISTEN handler sees a foreign `sid` on every cross-instance
+     * change, which is proof that this deployment runs more than one pod — the
+     * one fact needed to tell "the memory bus is fine here" from "broadcast and
+     * presence silently reach a fraction of your users".
+     */
+    private foreignInstanceSeen;
+    /** So the multi-pod memory-bus warning is emitted once, not once per join. */
+    private memoryBusWarned;
     private presenceInterval?;
     private static readonly PRESENCE_TIMEOUT_MS;
     /** How often stale roster rows from other instances are reaped. */
@@ -128,16 +202,7 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
         type: "collection" | "single";
         path: string;
         id?: string | number;
-        collectionRequest?: {
-            filter?: Record<string, unknown>;
-            orderBy?: string;
-            order?: "desc" | "asc";
-            limit?: number;
-            offset?: number;
-            startAfter?: Record<string, unknown>;
-            databaseId?: string;
-            searchString?: string;
-        };
+        collectionRequest?: StoredCollectionRequest;
         authContext?: SubscriptionAuthContext;
     }>;
     registerDataDriverSubscription(subscriptionId: string, subscription: {
@@ -145,16 +210,7 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
         type: "collection" | "single";
         path: string;
         id?: string | number;
-        collectionRequest?: {
-            filter?: Record<string, unknown>;
-            orderBy?: string;
-            order?: "desc" | "asc";
-            limit?: number;
-            offset?: number;
-            startAfter?: Record<string, unknown>;
-            databaseId?: string;
-            searchString?: string;
-        };
+        collectionRequest?: StoredCollectionRequest;
         authContext?: SubscriptionAuthContext;
     }): void;
     addSubscriptionCallback(subscriptionId: string, callback: (data: Record<string, unknown>[] | Record<string, unknown> | null) => void): void;
@@ -242,8 +298,61 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
      * Returns ["posts", "posts/70"] for the example above
      */
     private getParentPaths;
+    /**
+     * Install a channel authorizer — see {@link ChannelAuthorizer}.
+     *
+     * Nothing in the framework calls this yet: it is the seam a rules API will
+     * be built on, kept deliberately separate from the membership floor so the
+     * floor holds whether or not anyone uses it.
+     */
+    setChannelAuthorizer(authorizer: ChannelAuthorizer | undefined): void;
+    /** Which action each channel frame is asking to perform. */
+    private static readonly CHANNEL_ACTIONS;
+    /**
+     * The one door every channel frame comes through.
+     *
+     * Returns synchronously — and so dispatches synchronously — unless an
+     * authorizer is installed. That matters: a client sends `join_channel`,
+     * `presence_state` and `channel_history` back to back on connect, and the
+     * socket's message handler processes each frame up to its first `await`,
+     * so a gate that always yielded would let the reads overtake the join that
+     * is about to authorize them.
+     */
+    private handleChannelMessage;
+    /** Perform an already-authorized channel frame. */
+    private dispatchChannelMessage;
+    /**
+     * Decide whether a client may perform an action on a channel.
+     *
+     * **Membership is the floor.** Reading a channel's presence roster, replaying
+     * its retained history and broadcasting into it all require that this client
+     * has joined it. That is a low bar — joining is open to anyone who can name
+     * the channel — but it is not the bar that was there before, which was none
+     * at all: `channel_history` and `presence_state` answered any socket about
+     * any channel, and a broadcast fanned out to members the sender had never
+     * joined. Two internal tables (`rebase.channel_presence`,
+     * `rebase.channel_messages`) are held outside RLS on the strength of this
+     * check, so it fails closed: an authorizer that throws refuses the frame.
+     *
+     * Anything richer than membership belongs in a {@link ChannelAuthorizer};
+     * this method is where it is consulted, and the only place.
+     */
+    private authorizeChannelAction;
+    /** Tell the client why its channel frame went nowhere, and say so in the log. */
+    private denyChannelAction;
     /** Join a broadcast channel */
     joinChannel(clientId: string, channel: string): void;
+    /**
+     * Say something the first time channels are used on a deployment that is
+     * demonstrably multi-pod while the bus is still the in-memory default.
+     *
+     * Every other warning in this subsystem covers a *configured* bus failing —
+     * the case where the operator already knew a bus mattered. The common
+     * misconfiguration is the opposite one: scaled to two replicas, never
+     * touched `realtime.bus`, and broadcast and presence quietly serve a
+     * fraction of the room. The evidence is already in the process, so use it.
+     */
+    private warnIfMemoryBusOnMultiplePods;
     /** Leave a broadcast channel */
     leaveChannel(clientId: string, channel: string): void;
     /**
@@ -497,3 +606,4 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
  * This allows code to use PostgresRealtimeProvider alongside future MongoRealtimeProvider, etc.
  */
 export declare const PostgresRealtimeProvider: typeof RealtimeService;
+export {};

package/dist/{src-DoU9yPqq.js → src-C_wvdMnl.js}

@@ -231,6 +231,95 @@ function getDeclaredSubcollections(collection) {
 	return collection.subcollections;
 }
 //#endregion
-export { getDataSourceCapabilities as a, toCanonicalOp as c, DEFAULT_DATA_SOURCE_KEY as i, isPostgresCollectionConfig as n, NULL_OPS as o, isRelationalCollectionConfig as r, REST_TO_CANONICAL as s, getDeclaredSubcollections as t };
+//#region ../types/src/types/rls-functions.ts
+/**
+* The SQL helper functions RLS policies call, and the schema they live in.
+*
+* ## One schema, and it is ours
+*
+* Rebase creates exactly one schema in a project's database: `rebase`. These
+* three functions live in it alongside the framework's own tables, and that is
+* the whole contract — a reader can look at a database and know precisely which
+* namespace belongs to the framework and that nothing else was touched.
+*
+* It used to be two. `uid()`, `jwt()` and `roles()` sat in a schema called
+* `auth`, which is Supabase's name, chosen so that a developer who had written
+* Supabase RLS would recognise `auth.uid()`. The familiarity was real but the
+* name was not Rebase's to take, and taking it had a concrete cost: pointing
+* Rebase at a database that already had a Supabase `auth` schema meant
+* `CREATE OR REPLACE FUNCTION auth.uid() RETURNS text` against Supabase's
+* `RETURNS uuid`, which Postgres rejects outright —
+*
+*     ERROR:  cannot change return type of existing function
+*     HINT:   Use DROP FUNCTION auth.uid() first.
+*
+* — and the failure landed inside a catch-all that logged a warning and carried
+* on, leaving a database with auth tables, no helper functions, and policies
+* calling functions that did not exist. Under `rebase db migrate` the same
+* statements aborted the migration instead.
+*
+* `rebase.uid()` collides with nobody. A Supabase database keeps its `auth`
+* schema untouched and gains a `rebase` one, which is what a gradual migration
+* needs.
+*
+* ## Why functions at all, rather than inlining `current_setting`
+*
+* Because the indirection has already been spent once. `uid()` resolves
+* `app.uid` and falls back to the pre-rename `app.user_id`, so that during a
+* rolling deploy — old and new pods serving one database — both eras resolve
+* the principal. That was a single `CREATE OR REPLACE`. Inlined into policy
+* bodies it would have been a rewrite of every policy on every table.
+*
+* ## Why the name is not configurable
+*
+* A policy body is stored SQL: Postgres parses `USING (…)` once and keeps it, so
+* these strings are written into every policy in every database Rebase has
+* provisioned. Everything that reads policies back — the SQL-to-policy parser
+* behind the admin UI, the drift checker, `rls-check` — would have to know the
+* configured value to recognise its own output. One frozen name is the feature.
+*/
+/** The schema Rebase owns. The only schema Rebase creates. */
+var REBASE_SCHEMA = "rebase";
+/**
+* The principal of the current request, as text, or NULL in the server context.
+*
+* Never NULL for a user request — an anonymous one carries
+* {@link ANONYMOUS_USER_ID} — which is what makes `IS NULL` a reliable test for
+* the trusted server plane and `IS NOT NULL` a tautology.
+*/
+var RLS_UID_SQL = `${REBASE_SCHEMA}.uid()`;
+/** The request's roles as a comma-separated string, for `string_to_array`. */
+var RLS_ROLES_SQL = `${REBASE_SCHEMA}.roles()`;
+`${REBASE_SCHEMA}`;
+/**
+* The pre-1.0 spellings, for recognising policies and hand-written SQL that
+* predate the move.
+*
+* Kept because policies outlive the server that wrote them: a database migrated
+* by an older release still holds `auth.uid()` in its policy bodies until the
+* next push or boot recompiles them, and anything that reads policies back has
+* to recognise both eras or report the framework's own output as foreign drift.
+* Also used to give a project whose `securityRules` contain raw `auth.uid()` a
+* message naming the replacement, instead of a parse failure.
+*/
+var LEGACY_RLS_SCHEMA = "auth";
+`${LEGACY_RLS_SCHEMA}`;
+`${LEGACY_RLS_SCHEMA}`;
+`${LEGACY_RLS_SCHEMA}`;
+/**
+* Rewrites the pre-1.0 function calls in a fragment of policy SQL.
+*
+* Deliberately anchored on a word boundary and the schema qualifier, so a column
+* called `auth_uid` or a table named `auth` is left alone.
+*/
+function rewriteLegacyRlsFunctions(sql) {
+	return sql.replace(/\bauth\.(uid|jwt|roles)\s*\(\s*\)/gi, (_match, fn) => `${REBASE_SCHEMA}.${fn.toLowerCase()}()`);
+}
+/** Whether a fragment of SQL still calls the pre-1.0 functions. */
+function usesLegacyRlsFunctions(sql) {
+	return /\bauth\.(uid|jwt|roles)\s*\(\s*\)/i.test(sql);
+}
+//#endregion
+export { rewriteLegacyRlsFunctions as a, isPostgresCollectionConfig as c, getDataSourceCapabilities as d, NULL_OPS as f, RLS_UID_SQL as i, isRelationalCollectionConfig as l, toCanonicalOp as m, REBASE_SCHEMA as n, usesLegacyRlsFunctions as o, REST_TO_CANONICAL as p, RLS_ROLES_SQL as r, getDeclaredSubcollections as s, LEGACY_RLS_SCHEMA as t, DEFAULT_DATA_SOURCE_KEY as u };
 
-//# sourceMappingURL=src-DoU9yPqq.js.map
+//# sourceMappingURL=src-C_wvdMnl.js.map