@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g06dbe5b

package/src/websocket.ts

@@ -1,7 +1,7 @@
 import { RealtimeService } from "./services/realtimeService";
 import { PostgresBackendDriver } from "./PostgresBackendDriver";
 import type { DataDriver, DeleteProps, FetchCollectionProps, FetchOneProps, SaveProps, TableMetadata, BranchInfo, AuthAdapter } from "@rebasepro/types";
-import { ANONYMOUS_USER_ID, isSQLAdmin, isSchemaAdmin } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, isSQLAdmin, isSchemaAdmin, resolveClientListLimit, ListLimitError } from "@rebasepro/types";
 import type { User } from "@rebasepro/types";
 
 import { WebSocketServer, WebSocket } from "ws";
@@ -39,6 +39,9 @@ interface ClientSession {
     /** Sliding window message counter for rate limiting */
     messageCount: number;
     messageWindowStart: number;
+    /** The same window, counted separately for channel frames. */
+    channelMessageCount: number;
+    channelWindowStart: number;
 }
 
 
@@ -47,6 +50,33 @@ const WS_RATE_LIMIT = 2000;
 /** Rate limit window in milliseconds (60 seconds) */
 const WS_RATE_WINDOW_MS = 60_000;
 
+/**
+ * Channel frames get their own budget, because they are a different workload.
+ *
+ * 2000/minute is 33/second, which is generous for queries and subscriptions and
+ * an order of magnitude below what the documented channel idiom asks for: the
+ * capacity note in `docs/backend/realtime.md` uses 60 fps cursor movement as
+ * its worked example, and the presence idiom re-`track()`s on every move, so
+ * one client sustaining that sends ~120 frames/second — 7200 a minute. Sharing
+ * one counter meant the cursor stream ate the query budget and then froze for
+ * the rest of the window.
+ *
+ * The number is sized to that documented workload and nothing more; it is not
+ * a considered product limit (see `docs/channel-authorization.md`).
+ */
+const WS_CHANNEL_RATE_LIMIT = 7200;
+
+/** Frames counted against the channel budget rather than the general one. */
+const CHANNEL_MESSAGE_TYPES = new Set([
+    "join_channel",
+    "leave_channel",
+    "broadcast",
+    "presence_track",
+    "presence_untrack",
+    "presence_state",
+    "channel_history"
+]);
+
 /** Admin-only WebSocket message types */
 const ADMIN_ONLY_TYPES = new Set([
     "EXECUTE_SQL",
@@ -139,7 +169,9 @@ export function createPostgresWebSocket(
         clientSessions.set(clientId, { ws,
 authenticated: !requireAuth,
 messageCount: 0,
-messageWindowStart: Date.now() });
+messageWindowStart: Date.now(),
+channelMessageCount: 0,
+channelWindowStart: Date.now() });
         realtimeService.addClient(clientId, ws);
 
         ws.on("close", () => {
@@ -247,19 +279,34 @@ roles: verifiedUser.roles }
                     }
                 }
 
-                // Rate limiting: reject if client exceeds message limit
+                // Rate limiting: reject if client exceeds message limit.
+                // Channel frames are counted against their own budget — see
+                // WS_CHANNEL_RATE_LIMIT for why one shared counter starved them.
                 {
                     const session = clientSessions.get(clientId);
                     if (session) {
                         const now = Date.now();
-                        if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {
-                            session.messageCount = 0;
-                            session.messageWindowStart = now;
-                        }
-                        session.messageCount++;
-                        if (session.messageCount > WS_RATE_LIMIT) {
-                            sendError("ERROR", "RATE_LIMITED", "Too many requests. Please slow down.");
-                            return;
+                        const isChannelFrame = CHANNEL_MESSAGE_TYPES.has(type);
+                        if (isChannelFrame) {
+                            if (now - session.channelWindowStart > WS_RATE_WINDOW_MS) {
+                                session.channelMessageCount = 0;
+                                session.channelWindowStart = now;
+                            }
+                            session.channelMessageCount++;
+                            if (session.channelMessageCount > WS_CHANNEL_RATE_LIMIT) {
+                                sendError("ERROR", "RATE_LIMITED", "Too many channel messages. Please slow down.");
+                                return;
+                            }
+                        } else {
+                            if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {
+                                session.messageCount = 0;
+                                session.messageWindowStart = now;
+                            }
+                            session.messageCount++;
+                            if (session.messageCount > WS_RATE_LIMIT) {
+                                sendError("ERROR", "RATE_LIMITED", "Too many requests. Please slow down.");
+                                return;
+                            }
                         }
                     }
                 }
@@ -312,7 +359,19 @@ roles: verifiedUser.roles }
                         wsDebug("📋 [WebSocket Server] Processing FETCH_COLLECTION request");
                         const request: FetchCollectionProps = payload;
                         const delegate = await getScopedDelegate();
-                        const rows = await delegate.fetchCollection(request);
+                        // Bound the client-supplied limit with the SAME guarantee
+                        // the REST ingress and `subscribe_collection` apply
+                        // (`resolveClientListLimit`). Without it an absent limit
+                        // reached the driver as `undefined`, which emits no LIMIT
+                        // clause — one socket frame streamed the whole table, on
+                        // the one transport that skipped the ceiling every other
+                        // read path enforces.
+                        const rows = await delegate.fetchCollection({
+                            ...request,
+                            limit: resolveClientListLimit(request.limit, {
+                                vectorSearch: !!request.vectorSearch
+                            })
+                        });
                         wsDebug("📋 [WebSocket Server] FETCH_COLLECTION result - rows count:", rows.length);
                         const response = {
                             type: "FETCH_COLLECTION_SUCCESS",
@@ -400,6 +459,12 @@ colors: true }));
 
 
                     case "COUNT": {
+                        // Deliberately NOT routed through `resolveClientListLimit`:
+                        // this answers with a scalar, and the driver drops `limit`
+                        // on the way to `SELECT count(*)`. Clamping here could only
+                        // ever make `total` describe fewer rows than the collection
+                        // holds — the page size is the caller's business, the total
+                        // is not.
                         const request: FetchCollectionProps = payload;
                         const delegate = await getScopedDelegate();
                         const count = await delegate.count!(request);
@@ -426,14 +491,29 @@ colors: true }));
                                 wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
                             }
                             const auditSession = clientSessions.get(clientId);
-                            console.log("[SQL Audit] WebSocket SQL execution", JSON.stringify({
-                                sql: typeof sql === "string" ? sql.substring(0, 500) : sql,
-                                options,
+                            // Through `logger`, not `console.log`: this line is
+                            // emitted in production, and a bare console call
+                            // has no severity, no timestamp, no JSON envelope
+                            // and no LOG_LEVEL gate, so it lands in Cloud
+                            // Logging as unstructured text the queries written
+                            // for every other line cannot match.
+                            //
+                            // The bound values are counted, never written — the
+                            // statement is the audit signal, the parameters are
+                            // whatever row the operator was touching. (stdout is
+                            // not an audit sink either; a real trail belongs in
+                            // a table with an actor and a retention policy.)
+                            logger.info("[SQL Audit] WebSocket SQL execution", {
+                                sql: typeof sql === "string" ? sql.substring(0, 500) : String(sql),
+                                database: options?.database,
+                                role: options?.role,
+                                paramCount: Array.isArray(options?.params) ? options.params.length : 0,
                                 resultRows: Array.isArray(result) ? result.length : "unknown",
                                 uid: auditSession?.user?.uid ?? "unknown",
                                 roles: auditSession?.user?.roles ?? [],
                                 isAdmin: auditSession?.user?.isAdmin ?? false,
-                            }));
+                                requestId
+                            });
                             const response = {
                                 type: "EXECUTE_SQL_SUCCESS",
                                 payload: { result },
@@ -644,6 +724,23 @@ roles: ["anon"] };
                         logger.error("❌ [WebSocket Server] Unknown message type", { detail: type });
                 }
             } catch (error: unknown) {
+                // A refused `limit` is the caller's mistake, not a server fault.
+                // Left to the generic branch below it answers INTERNAL_ERROR
+                // with the message suppressed in production — so the one thing
+                // that would tell the caller what to send instead is exactly
+                // what gets dropped. Answered here the way
+                // `subscribe_collection` already answers it: INVALID_LIMIT,
+                // message intact. The text names the ceiling and nothing else.
+                if (error instanceof ListLimitError) {
+                    logger.warn(`[WebSocket Server] Refused a list read: ${error.message}`);
+                    ws.send(JSON.stringify({
+                        type: "ERROR",
+                        requestId,
+                        payload: { error: { message: error.message,
+code: "INVALID_LIMIT" } }
+                    }));
+                    return;
+                }
                 logger.error("💥 [WebSocket Server] Error handling message", { error: error });
                 if (error instanceof Error) {
                     logger.error("Stack trace", { detail: error.stack });

package/dist/ensure-collection-tables-CBQdOETu.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ensure-collection-tables-CBQdOETu.js","names":[],"sources":["../src/schema/generate-postgres-ddl-logic.ts","../src/schema/ensure-collection-tables.ts"],"sourcesContent":["import { CollectionConfig, NumberProperty, Property, ResolvedRelation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty, isManyToMany, type ResolvedManyToMany, type ResolvedBelongsTo } from \"@rebasepro/types\";\nimport { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig, resolveStringColumnLength } from \"@rebasepro/common\";\nimport { toSnakeCase, getPolicyNamesForRule, generateForeignKeyName, legacyForeignKeyName } from \"@rebasepro/utils\";\n\n// --- Helper Functions ---\n\nexport const resolveColumnName = (propName: string, prop?: Property | null): string => {\n    if (prop && \"columnName\" in prop && typeof prop.columnName === \"string\") {\n        return prop.columnName;\n    }\n    return toSnakeCase(propName);\n};\n\nexport const getPrimaryKeyProp = (collection: CollectionConfig): { name: string, type: \"string\" | \"number\", isUuid: boolean } => {\n    if (collection.properties) {\n        const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => \"isId\" in (prop as unknown as object) && Boolean((prop as unknown as Record<string, unknown>).isId));\n        if (idPropEntry) {\n            const prop = idPropEntry[1] as unknown as Property;\n            const isUuid = prop.type === \"string\" && \"isId\" in prop && (prop as unknown as StringProperty).isId === \"uuid\";\n            return { name: idPropEntry[0], type: prop.type === \"number\" ? \"number\" : \"string\", isUuid };\n        }\n    }\n    const idProp = collection.properties?.[\"id\"] as unknown as Property | undefined;\n    if (idProp?.type === \"number\") {\n        return { name: \"id\", type: \"number\", isUuid: false };\n    }\n    const isUuid = idProp?.type === \"string\" && \"isId\" in idProp && (idProp as unknown as StringProperty).isId === \"uuid\";\n    return { name: \"id\", type: \"string\", isUuid: isUuid ?? false };\n};\n\nexport const isNumericId = (collection: CollectionConfig): boolean => {\n    return getPrimaryKeyProp(collection).type === \"number\";\n};\n\nexport const getPrimaryKeyName = (collection: CollectionConfig): string => {\n    return getPrimaryKeyProp(collection).name;\n};\n\n/** The column type a junction holds for one endpoint's primary key. */\nconst junctionKeyType = (collection: CollectionConfig): string =>\n    isNumericId(collection) ? \"INTEGER\" : (getPrimaryKeyProp(collection).isUuid ? \"UUID\" : \"TEXT\");\n\nexport const isIdProperty = (propName: string, prop: Property, collection: CollectionConfig): boolean => {\n    if (\"isId\" in prop && Boolean(prop.isId)) return true;\n    const hasExplicitId = Object.values(collection.properties ?? {}).some(p => \"isId\" in (p as unknown as object) && Boolean((p as unknown as Record<string, unknown>).isId));\n    return !hasExplicitId && propName === \"id\";\n};\n\n\ntype ResolveCollection = (slug: string) => CollectionConfig | undefined;\n\n/**\n * Render statements produced by {@link generatePolicyStatements} back into the\n * exact string the DDL/policies files have always carried: each statement on\n * its own line, terminated by a newline. Keeping the string form derived from\n * the statement array means the two can never drift — the boot-time applier and\n * the generated `policies.sql` emit the same SQL, from the same source.\n */\nconst statementsToDdl = (statements: string[]): string => statements.map(s => `${s}\\n`).join(\"\");\n\nconst generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection): string =>\n    statementsToDdl(generatePolicyStatements(collection, rule, resolveCollection));\n\n/**\n * The individual SQL statements a single security rule compiles to: a\n * `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete\n * statement (terminated by `;`, no trailing newline).\n *\n * This is the primitive the boot-time RLS applier runs one statement at a time\n * (the runtime's DB handle speaks the extended query protocol, which forbids\n * multiple commands in one execute), while `db push` writes the joined string.\n */\nexport const generatePolicyStatements = (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection): string[] => {\n    const tableName = getTableName(collection);\n    const ops: readonly SecurityOperation[] = rule.operations && rule.operations.length > 0\n        ? rule.operations\n        : [rule.operation ?? \"all\"];\n\n    const policyNames = getPolicyNamesForRule(rule, tableName);\n\n    return ops.flatMap((op, opIdx) => {\n        return generateSinglePolicyStatements(collection, rule, op, policyNames[opIdx], resolveCollection);\n    });\n};\n\nconst generateSinglePolicyStatements = (collection: CollectionConfig, rule: SecurityRule, operation: SecurityOperation, policyName: string, resolveCollection: ResolveCollection): string[] => {\n    const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n    const tableName = getTableName(collection);\n    const mode = (rule.mode ?? \"permissive\").toUpperCase();\n    const operationUpper = operation.toUpperCase();\n    const pgRoles = rule.pgRoles ? [...rule.pgRoles].sort() : [\"public\"];\n\n    const needsUsing = operation !== \"insert\";\n    const needsWithCheck = operation !== \"select\" && operation !== \"delete\";\n\n    // Desugar the rule (access / ownerField / roles / structured condition / raw\n    // SQL) into the shared PolicyExpression model, then compile to SQL. This is\n    // the same normalization the client-side evaluator uses, so DDL and UI agree.\n    const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);\n\n    let usingClause = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection, { resolveCollection }) : null;\n    let withCheckClause = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection, { resolveCollection }) : null;\n\n    if (!usingClause && needsUsing) {\n        usingClause = \"false\";\n    }\n    if (!withCheckClause && needsWithCheck) {\n        withCheckClause = \"false\";\n    }\n\n    const drop = `DROP POLICY IF EXISTS \"${policyName}\" ON \"${schema}\".\"${tableName}\";`;\n    let create = `CREATE POLICY \"${policyName}\" ON \"${schema}\".\"${tableName}\" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map(r => `\"${r}\"`).join(\", \")}`;\n    if (usingClause) create += ` USING (${usingClause})`;\n    if (withCheckClause) create += ` WITH CHECK (${withCheckClause})`;\n    create += \";\";\n    return [drop, create];\n};\n\n/**\n * Single-quote escaping for a SQL string literal (PostgreSQL doubles the\n * quote). Enum labels come straight from user-authored collection config, so a\n * label like `it's` closes the literal early and the whole generated file stops\n * parsing at the `CREATE TYPE`. Lives here rather than next to its other caller\n * because ensure-collection-tables already imports from this module — the\n * reverse would be a cycle.\n */\nexport const quoteSqlLiteral = (value: string): string => `'${value.replace(/'/g, \"''\")}'`;\n\nexport const getSqlColumnType = (propName: string, prop: Property, collection: CollectionConfig, collections: CollectionConfig[]): string => {\n    switch (prop.type) {\n        case \"string\": {\n            const stringProp = prop as StringProperty;\n            if (stringProp.enum) {\n                const tableName = getTableName(collection);\n                const colName = resolveColumnName(propName, prop);\n                const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n                return `\"${schema}\".\"${tableName}_${colName}\"`;\n            }\n            if (stringProp.isId === \"uuid\" || stringProp.columnType === \"uuid\") {\n                return \"UUID\";\n            }\n            // Width comes from `validation.max` when the property states one.\n            // It used to be a hardcoded 255 here and *absent* on the Drizzle\n            // path, so the same property produced a bounded column down one\n            // generator and an unbounded one down the other.\n            if (stringProp.columnType === \"char\") {\n                return `CHAR(${resolveStringColumnLength(stringProp)})`;\n            }\n            if (stringProp.columnType === \"varchar\") {\n                return `VARCHAR(${resolveStringColumnLength(stringProp)})`;\n            }\n            // `text` is the default. The two generators disagreed here before:\n            // this one emitted VARCHAR(255) while the drizzle path emitted a bare\n            // `varchar()`, which Postgres treats as unbounded — so the same\n            // property produced a capped column down one path and an uncapped one\n            // down the other.\n            return \"TEXT\";\n        }\n        case \"number\": {\n            const numProp = prop as NumberProperty;\n            const isId = isIdProperty(propName, prop, collection);\n            if (\"isId\" in numProp && numProp.isId === \"increment\") {\n                return \"INTEGER GENERATED BY DEFAULT AS IDENTITY\";\n            }\n            if (numProp.columnType) {\n                if (numProp.columnType === \"double precision\") return \"DOUBLE PRECISION\";\n                return numProp.columnType.toUpperCase();\n            }\n            return (numProp.validation?.integer || isId) ? \"INTEGER\" : \"NUMERIC\";\n        }\n        case \"boolean\":\n            return \"BOOLEAN\";\n        case \"date\": {\n            const dateProp = prop as DateProperty;\n            if (dateProp.columnType === \"date\") return \"DATE\";\n            if (dateProp.columnType === \"time\") return \"TIME\";\n            return \"TIMESTAMP WITH TIME ZONE\";\n        }\n        case \"map\": {\n            const mapProp = prop as MapProperty;\n            return mapProp.columnType === \"json\" ? \"JSON\" : \"JSONB\";\n        }\n        case \"array\": {\n            const arrayProp = prop as ArrayProperty;\n            let colType = arrayProp.columnType;\n            if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {\n                const ofProp = arrayProp.of as Property;\n                if (ofProp.type === \"string\") {\n                    colType = \"text[]\";\n                } else if (ofProp.type === \"number\") {\n                    colType = ofProp.validation?.integer ? \"integer[]\" : \"numeric[]\";\n                } else if (ofProp.type === \"boolean\") {\n                    colType = \"boolean[]\";\n                }\n            }\n            if (colType === \"json\") return \"JSON\";\n            if (colType === \"text[]\") return \"TEXT[]\";\n            if (colType === \"integer[]\") return \"INTEGER[]\";\n            if (colType === \"boolean[]\") return \"BOOLEAN[]\";\n            if (colType === \"numeric[]\") return \"NUMERIC[]\";\n            return \"JSONB\";\n        }\n        case \"vector\": {\n            const vp = prop as VectorProperty;\n            return `VECTOR(${vp.dimensions})`;\n        }\n        case \"binary\": {\n            return \"BYTEA\";\n        }\n        case \"relation\": {\n            const refProp = prop as RelationProperty;\n            const resolvedRelations = resolveCollectionRelations(collection);\n            const relation = findRelation(resolvedRelations, refProp.relation?.relationName ?? propName);\n            if (relation?.kind !== \"belongsTo\") {\n                throw new Error(`Relation ${propName} does not put a column on this table (only \\`belongsTo\\` does)`);\n            }\n            let targetCollection: CollectionConfig;\n            try {\n                targetCollection = relation.target();\n            } catch {\n                return \"TEXT\";\n            }\n            const pkProp = getPrimaryKeyProp(targetCollection);\n            return pkProp.type === \"number\" ? \"INTEGER\" : (pkProp.isUuid ? \"UUID\" : \"TEXT\");\n        }\n        case \"reference\": {\n            const refProp = prop as ReferenceProperty;\n            const targetCollection = collections.find(c => c.slug === refProp.path || getTableName(c) === refProp.path);\n            if (!targetCollection) return \"TEXT\";\n            const pkProp = getPrimaryKeyProp(targetCollection);\n            return pkProp.type === \"number\" ? \"INTEGER\" : (pkProp.isUuid ? \"UUID\" : \"TEXT\");\n        }\n        default:\n            return \"TEXT\";\n    }\n};\n\nexport const generatePostgresDdl = async (\n    collections: CollectionConfig[],\n    options: { includePolicies?: boolean } = { includePolicies: true }\n): Promise<string> => {\n    let ddl = \"-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\\n\\n\";\n\n    // 1. Create custom schemas\n    const uniqueSchemas = Array.from(new Set([\n        \"auth\",\n        ...collections.map(c => isPostgresCollectionConfig(c) ? c.schema : undefined).filter(Boolean)\n    ]));\n    uniqueSchemas.forEach(schema => {\n        if (schema) ddl += `CREATE SCHEMA IF NOT EXISTS \"${schema}\";\\n`;\n    });\n    if (uniqueSchemas.length > 0) ddl += \"\\n\";\n\n    // 2. Generate Enums\n    //\n    // The enum type name is derived from table + column, so two collections\n    // mapped onto the same table — or two properties whose `columnName`\n    // resolves to the same column — land on the same name. `CREATE TYPE` has no\n    // IF NOT EXISTS, so emitting it twice aborts the whole file on the second\n    // statement. Dedupe by name, matching planCollectionSchemaEnsure.\n    const emittedEnums = new Set<string>();\n    collections.forEach(collection => {\n        const collectionTable = getTableName(collection);\n        const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n        Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {\n            if ((\"enum\" in prop) && (prop.type === \"string\" || prop.type === \"number\") && prop.enum) {\n                const enumDbName = `${collectionTable}_${resolveColumnName(propName, prop)}`;\n                const values = Array.isArray(prop.enum)\n                    ? (prop.enum as (string | number | { id: string | number })[]).map((v: string | number | { id: string | number }) =>\n                        String(typeof v === \"object\" && v !== null && \"id\" in v ? v.id : v)\n                    )\n                    : Object.keys(prop.enum);\n                if (values.length > 0 && !emittedEnums.has(`${schema}.${enumDbName}`)) {\n                    emittedEnums.add(`${schema}.${enumDbName}`);\n                    ddl += `CREATE TYPE \"${schema}\".\"${enumDbName}\" AS ENUM (${values.map(quoteSqlLiteral).join(\", \")});\\n`;\n                }\n            }\n        });\n    });\n    if (ddl.endsWith(\";\\n\")) ddl += \"\\n\";\n\n    // Junction policy derivation needs every declaring side of each junction,\n    // not just the first relation that reached it in the walk below.\n    const junctionSpecs = resolveJunctionSpecs(collections);\n\n    const allTablesToGenerate = new Map<string, {\n        collection: CollectionConfig,\n        isJunction?: boolean,\n        relation?: ResolvedRelation,\n        sourceCollection?: CollectionConfig\n    }>();\n\n    // Identify all tables\n    for (const collection of collections) {\n        const tableName = getTableName(collection);\n        if (tableName) {\n            allTablesToGenerate.set(tableName, { collection });\n        }\n\n        const resolvedRelations = resolveCollectionRelations(collection);\n        for (const relation of Object.values(resolvedRelations)) {\n            if (isManyToMany(relation)) {\n                const junctionTableName = relation.through.table;\n                if (!allTablesToGenerate.has(junctionTableName)) {\n                    allTablesToGenerate.set(junctionTableName, {\n                        collection: {\n                            table: junctionTableName,\n                            properties: {}\n                        } as CollectionConfig,\n                        isJunction: true,\n                        relation: relation,\n                        sourceCollection: collection\n                    });\n                }\n            }\n        }\n    }\n\n    // 3. Generate tables\n    const fkStatements: string[] = [];\n    // Policies are emitted after every CREATE TABLE, like the FK constraints:\n    // a policy may reference other tables (a junction's derived policies always\n    // reference both endpoints; `policy.existsIn` references a join table), and\n    // CREATE POLICY validates those relations at creation time.\n    const policyStatements: string[] = [];\n    for (const [tableName, {\n        collection,\n        isJunction,\n        relation,\n        sourceCollection\n    }] of allTablesToGenerate.entries()) {\n        const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n        const baseTableName = tableName.includes(\".\") ? tableName.split(\".\").pop()! : tableName;\n\n        if (isJunction && relation && sourceCollection && isManyToMany(relation)) {\n            const targetCollection = relation.target();\n            const sourceTable = getTableName(sourceCollection);\n            const targetTable = getTableName(targetCollection);\n            const sourceSchema = isPostgresCollectionConfig(sourceCollection) && sourceCollection.schema ? sourceCollection.schema : \"public\";\n            const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : \"public\";\n            const { sourceColumn, targetColumn } = relation.through;\n\n            // TEXT, matching the string default: a junction column has to have the\n            // same type as the primary key it references.\n            const sourceColType = isNumericId(sourceCollection) ? \"INTEGER\" : (getPrimaryKeyProp(sourceCollection).isUuid ? \"UUID\" : \"TEXT\");\n            const targetColType = isNumericId(targetCollection) ? \"INTEGER\" : (getPrimaryKeyProp(targetCollection).isUuid ? \"UUID\" : \"TEXT\");\n            const sourceId = getPrimaryKeyName(sourceCollection);\n            const targetId = getPrimaryKeyName(targetCollection);\n\n            const onDelete = relation.onDelete ?? \"CASCADE\";\n\n            ddl += `CREATE TABLE \"${schema}\".\"${baseTableName}\" (\\n`;\n            ddl += `  \"${sourceColumn}\" ${sourceColType} NOT NULL,\\n`;\n            ddl += `  \"${targetColumn}\" ${targetColType} NOT NULL,\\n`;\n            ddl += `  PRIMARY KEY (\"${sourceColumn}\", \"${targetColumn}\")\\n`;\n            ddl += `);\\n\\n`;\n\n            fkStatements.push(`ALTER TABLE \"${schema}\".\"${baseTableName}\" ADD CONSTRAINT \"${baseTableName}_${sourceColumn}_fkey\" FOREIGN KEY (\"${sourceColumn}\") REFERENCES \"${sourceSchema}\".\"${sourceTable}\" (\"${sourceId}\") ON DELETE ${onDelete.toUpperCase()};`);\n            fkStatements.push(`ALTER TABLE \"${schema}\".\"${baseTableName}\" ADD CONSTRAINT \"${baseTableName}_${targetColumn}_fkey\" FOREIGN KEY (\"${targetColumn}\") REFERENCES \"${targetSchema}\".\"${targetTable}\" (\"${targetId}\") ON DELETE ${onDelete.toUpperCase()};`);\n\n            if (options.includePolicies) {\n                // Junction tables are generated tables like any other: locked by\n                // default, with derived policies — reads follow the endpoints'\n                // visibility, writes follow the declaring side's update rules.\n                // Without this they were the one kind of generated table with no\n                // RLS at all, readable and writable by every signed-in user.\n                ddl += `ALTER TABLE \"${schema}\".\"${baseTableName}\" ENABLE ROW LEVEL SECURITY;\\n`;\n                ddl += `\\n`;\n\n                const spec = junctionSpecs.get(baseTableName);\n                if (spec) {\n                    const junctionCollection = getJunctionCollectionConfig(spec);\n                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);\n                    getJunctionSecurityRules(spec).forEach((rule: SecurityRule) => {\n                        policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));\n                    });\n                }\n            }\n        } else if (!isJunction) {\n            ddl += `CREATE TABLE \"${schema}\".\"${baseTableName}\" (\\n`;\n            const columns: string[] = [];\n\n            Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {\n                if (prop.type === \"relation\") {\n                    const refProp = prop as RelationProperty;\n                    const resolvedRelations = resolveCollectionRelations(collection);\n                    const relInfo = findRelation(resolvedRelations, refProp.relation?.relationName ?? propName);\n\n                    if (relInfo?.kind !== \"belongsTo\") {\n                        return;\n                    }\n\n                    if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) {\n                        return;\n                    }\n\n                    let targetCollection: CollectionConfig;\n                    try {\n                        targetCollection = relInfo.target();\n                    } catch {\n                        return;\n                    }\n\n                    const targetTable = getTableName(targetCollection);\n                    const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : \"public\";\n                    const targetId = getPrimaryKeyName(targetCollection);\n                    const fkColType = getSqlColumnType(propName, prop, collection, collections);\n                    \n                    const onUpdate = relInfo.onUpdate ? ` ON UPDATE ${relInfo.onUpdate.toUpperCase()}` : \"\";\n                    const required = prop.validation?.required;\n                    const onDeleteVal = relInfo.onDelete ?? (required ? \"CASCADE\" : \"SET NULL\");\n                    \n                    let colDef = `  \"${relInfo.localKey}\" ${fkColType}`;\n                    if (required) colDef += \" NOT NULL\";\n                    columns.push(colDef);\n\n                    fkStatements.push(`ALTER TABLE \"${schema}\".\"${baseTableName}\" ADD CONSTRAINT \"${baseTableName}_${relInfo.localKey}_fkey\" FOREIGN KEY (\"${relInfo.localKey}\") REFERENCES \"${targetSchema}\".\"${targetTable}\" (\"${targetId}\") ON DELETE ${onDeleteVal.toUpperCase()}${onUpdate};`);\n                } else if (prop.type === \"reference\") {\n                    const refProp = prop as ReferenceProperty;\n                    const targetCollection = collections.find(c => c.slug === refProp.path || getTableName(c) === refProp.path);\n                    const colName = resolveColumnName(propName, prop);\n                    const colType = getSqlColumnType(propName, prop, collection, collections);\n                    const required = prop.validation?.required;\n\n                    if (!targetCollection) {\n                        let colDef = `  \"${colName}\" ${colType}`;\n                        if (required) colDef += \" NOT NULL\";\n                        columns.push(colDef);\n                    } else {\n                        const targetTable = getTableName(targetCollection);\n                        const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : \"public\";\n                        const targetId = getPrimaryKeyName(targetCollection);\n                        const onDelete = required ? \"CASCADE\" : \"SET NULL\";\n\n                        let colDef = `  \"${colName}\" ${colType}`;\n                        if (required) colDef += \" NOT NULL\";\n                        columns.push(colDef);\n\n                        fkStatements.push(`ALTER TABLE \"${schema}\".\"${baseTableName}\" ADD CONSTRAINT \"${baseTableName}_${colName}_fkey\" FOREIGN KEY (\"${colName}\") REFERENCES \"${targetSchema}\".\"${targetTable}\" (\"${targetId}\") ON DELETE ${onDelete.toUpperCase()};`);\n                    }\n                } else {\n                    const colName = resolveColumnName(propName, prop);\n                    const colType = getSqlColumnType(propName, prop, collection, collections);\n                    let colDef = `  \"${colName}\" ${colType}`;\n\n                    if (isIdProperty(propName, prop, collection)) {\n                        colDef += \" PRIMARY KEY\";\n                    }\n\n                    if (\"isId\" in prop && prop.isId !== \"manual\" && prop.isId !== true && prop.isId !== \"increment\") {\n                        if (prop.isId === \"uuid\") {\n                            colDef += \" DEFAULT gen_random_uuid()\";\n                        } else if (prop.isId === \"cuid\") {\n                            colDef += \" DEFAULT cuid()\";\n                        } else if (typeof prop.isId === \"string\") {\n                            colDef += ` DEFAULT ${prop.isId}`;\n                        }\n                    }\n\n                    if (!isIdProperty(propName, prop, collection) && prop.validation?.unique) {\n                        colDef += \" UNIQUE\";\n                    }\n\n                    if (prop.type === \"date\") {\n                        const dateProp = prop as DateProperty;\n                        if (dateProp.autoValue === \"on_create\" || dateProp.autoValue === \"on_update\") {\n                            colDef += \" DEFAULT now()\";\n                        }\n                    }\n\n                    if (prop.validation?.required && !colDef.includes(\"PRIMARY KEY\")) {\n                        colDef += \" NOT NULL\";\n                    }\n\n                    columns.push(colDef);\n                }\n            });\n\n            // Backwards compatibility: add default id primary key if missing\n            const hasPk = columns.some(c => c.includes(\"PRIMARY KEY\"));\n            if (!hasPk) {\n                columns.unshift('  \"id\" TEXT PRIMARY KEY');\n            }\n\n            ddl += columns.join(\",\\n\");\n            ddl += `\\n);\\n\\n`;\n\n            if (options.includePolicies) {\n                // Enable RLS and add Policies. No FORCE: authenticated requests\n                // run as the non-owner `rebase_user` role, which plain ENABLE\n                // already binds. The owner (server context) must bypass — it is\n                // the trusted plane (auth flows, dataAsAdmin).\n                ddl += `ALTER TABLE \"${schema}\".\"${baseTableName}\" ENABLE ROW LEVEL SECURITY;\\n`;\n                ddl += `\\n`;\n\n                const securityRules = getEffectiveSecurityRules(collection);\n                if (securityRules.length > 0) {\n                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);\n                    securityRules.forEach((rule: SecurityRule) => {\n                        policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));\n                    });\n                }\n            }\n        }\n    }\n\n    if (fkStatements.length > 0) {\n        ddl += \"-- Foreign Key Constraints\\n\";\n        ddl += fkStatements.join(\"\\n\") + \"\\n\\n\";\n    }\n\n    if (policyStatements.length > 0) {\n        ddl += \"-- Row Level Security Policies\\n\";\n        ddl += policyStatements.join(\"\");\n        ddl += \"\\n\";\n    }\n\n    return ddl;\n};\n\n/** The RLS statements one declared collection's table needs, ready to run. */\n/**\n * A foreign key, as both its parts and the statement that creates it.\n *\n * `ALTER TABLE … ADD CONSTRAINT` has no `IF NOT EXISTS`, so a caller applying\n * these has to skip by name — hence the name is a field and not only a substring\n * of the SQL.\n */\nexport interface ForeignKeyPlan {\n    constraintName: string;\n    schema: string;\n    /** Bare table name, no schema prefix. */\n    table: string;\n    column: string;\n    targetSchema: string;\n    targetTable: string;\n    targetColumn: string;\n    sql: string;\n}\n\n/** A column a `relation` or `reference` property owns on its own table. */\nexport interface RelationalColumnPlan {\n    schema: string;\n    /** Bare table name, no schema prefix. */\n    table: string;\n    column: string;\n    /** Postgres type, exactly as the DDL generator declares it. */\n    type: string;\n    /** Absent when the target collection is not part of this bundle. */\n    foreignKey?: ForeignKeyPlan;\n    /**\n     * What this column would have been called before `generateForeignKeyName`\n     * learned to singularize — set only when the two differ and the column name\n     * is the derived default rather than one the author wrote.\n     *\n     * Carried so the boot-time ensure can notice a database provisioned under\n     * the old rule. It is never used to name anything.\n     */\n    legacyColumn?: string;\n}\n\n/** The table behind a many-to-many `through` relation. */\nexport interface JunctionTablePlan {\n    schema: string;\n    /** Bare table name, no schema prefix. */\n    table: string;\n    columns: { name: string; type: string; legacyName?: string }[];\n    /** Both endpoint columns plus the composite primary key. */\n    createTable: string;\n    foreignKeys: ForeignKeyPlan[];\n}\n\nconst schemaOfCollection = (collection: CollectionConfig): string =>\n    isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n\nconst bareTableName = (name: string): string => (name.includes(\".\") ? name.split(\".\").pop()! : name);\n\nconst foreignKeyPlan = (\n    args: Omit<ForeignKeyPlan, \"constraintName\" | \"sql\"> & { onDelete: string; onUpdate?: string }\n): ForeignKeyPlan => {\n    const constraintName = `${args.table}_${args.column}_fkey`;\n    const onUpdate = args.onUpdate ? ` ON UPDATE ${args.onUpdate.toUpperCase()}` : \"\";\n    return {\n        constraintName,\n        schema: args.schema,\n        table: args.table,\n        column: args.column,\n        targetSchema: args.targetSchema,\n        targetTable: args.targetTable,\n        targetColumn: args.targetColumn,\n        sql:\n            `ALTER TABLE \"${args.schema}\".\"${args.table}\" ADD CONSTRAINT \"${constraintName}\" ` +\n            `FOREIGN KEY (\"${args.column}\") REFERENCES \"${args.targetSchema}\".\"${args.targetTable}\" ` +\n            `(\"${args.targetColumn}\") ON DELETE ${args.onDelete.toUpperCase()}${onUpdate};`\n    };\n};\n\n/**\n * The FK columns the declared collections own — one entry per `relation`\n * (`belongsTo` side) or `reference` property.\n *\n * Split out of {@link generatePostgresDdl} so the boot-time schema ensure can\n * create the same columns with the same names, types and constraints. Before\n * this it skipped them outright, which was survivable only because `db push`\n * always followed; on a managed tenant nothing follows, so a table arrived\n * without the column its own collection reads and wrote 400 on every insert.\n *\n * A relation whose target is not in the bundle yields no column at all (the\n * generator returns early on an unresolvable target); a `reference` whose target\n * is unknown yields the column without a constraint. Both mirror the generator\n * exactly — a divergence here is a schema fork between boot and `db push`.\n */\nexport const planRelationalColumns = (collections: CollectionConfig[]): RelationalColumnPlan[] => {\n    const plans: RelationalColumnPlan[] = [];\n\n    for (const collection of collections) {\n        const tableName = getTableName(collection);\n        if (!tableName) continue;\n        const schema = schemaOfCollection(collection);\n        const table = bareTableName(tableName);\n\n        for (const [propName, rawProp] of Object.entries(collection.properties ?? {})) {\n            const prop = rawProp as Property;\n\n            if (prop.type === \"relation\") {\n                const refProp = prop as RelationProperty;\n                const resolvedRelations = resolveCollectionRelations(collection);\n                const relInfo = findRelation(resolvedRelations, refProp.relation?.relationName ?? propName);\n                if (relInfo?.kind !== \"belongsTo\") continue;\n                // The relation and an explicit FK property can both be declared;\n                // the explicit one owns the column.\n                if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) continue;\n\n                let targetCollection: CollectionConfig;\n                try {\n                    targetCollection = relInfo.target();\n                } catch {\n                    continue;\n                }\n                if (!targetCollection) continue;\n\n                const required = prop.validation?.required;\n                // Only a *derived* column name can be affected by the change to\n                // `generateForeignKeyName`; one the author wrote is theirs.\n                const relationName = refProp.relation?.relationName ?? propName;\n                const legacyKey = legacyForeignKeyName(relationName);\n                const derived = relInfo.localKey === generateForeignKeyName(relationName);\n                plans.push({\n                    schema,\n                    table,\n                    column: relInfo.localKey,\n                    legacyColumn: derived && legacyKey !== relInfo.localKey ? legacyKey : undefined,\n                    type: getSqlColumnType(propName, prop, collection, collections),\n                    foreignKey: foreignKeyPlan({\n                        schema,\n                        table,\n                        column: relInfo.localKey,\n                        targetSchema: schemaOfCollection(targetCollection),\n                        targetTable: bareTableName(getTableName(targetCollection)),\n                        targetColumn: getPrimaryKeyName(targetCollection),\n                        onDelete: relInfo.onDelete ?? (required ? \"CASCADE\" : \"SET NULL\"),\n                        onUpdate: relInfo.onUpdate\n                    })\n                });\n            } else if (prop.type === \"reference\") {\n                const refProp = prop as ReferenceProperty;\n                const targetCollection = collections.find(\n                    c => c.slug === refProp.path || getTableName(c) === refProp.path\n                );\n                const column = resolveColumnName(propName, prop);\n                const type = getSqlColumnType(propName, prop, collection, collections);\n                const required = prop.validation?.required;\n\n                plans.push({\n                    schema,\n                    table,\n                    column,\n                    type,\n                    foreignKey: targetCollection\n                        ? foreignKeyPlan({\n                            schema,\n                            table,\n                            column,\n                            targetSchema: schemaOfCollection(targetCollection),\n                            targetTable: bareTableName(getTableName(targetCollection)),\n                            targetColumn: getPrimaryKeyName(targetCollection),\n                            onDelete: required ? \"CASCADE\" : \"SET NULL\"\n                        })\n                        : undefined\n                });\n            }\n        }\n    }\n\n    return plans;\n};\n\n/**\n * The junction tables a bundle's many-to-many relations imply.\n *\n * Derived from {@link resolveJunctionSpecs}, the same source the junction RLS\n * comes from, so a table created here always has policies planned for it — a\n * junction with row-level security left off is readable and writable by every\n * signed-in user, which is why the two must ship together.\n */\nexport const planJunctionTables = (collections: CollectionConfig[]): JunctionTablePlan[] => {\n    const plans: JunctionTablePlan[] = [];\n\n    for (const spec of resolveJunctionSpecs(collections).values()) {\n        const [source, target] = spec.endpoints;\n        // A junction column's default name is derived from the endpoint\n        // collection's slug — which is normally plural, so this is where the\n        // singularization change actually lands: a `categories` endpoint used\n        // to give `categorie_id` and now gives `category_id`. Recorded, not\n        // used, so boot-ensure can recognise a table built under the old rule.\n        const legacyFor = (endpoint: typeof source): string | undefined => {\n            const slug = toSnakeCase(endpoint.collection.slug ?? endpoint.collection.name ?? \"\");\n            const legacy = legacyForeignKeyName(slug);\n            const derived = endpoint.junctionColumn === generateForeignKeyName(slug);\n            return derived && legacy !== endpoint.junctionColumn ? legacy : undefined;\n        };\n        const columns = [\n            { name: source.junctionColumn, type: junctionKeyType(source.collection), legacyName: legacyFor(source) },\n            { name: target.junctionColumn, type: junctionKeyType(target.collection), legacyName: legacyFor(target) }\n        ];\n        // Every declaring side agrees on the edge's lifetime; the first one wins,\n        // as it does in the generator's walk.\n        const onDelete = spec.declaringSides[0]?.relation.onDelete ?? \"CASCADE\";\n\n        plans.push({\n            schema: spec.schema,\n            table: spec.table,\n            columns,\n            createTable:\n                `CREATE TABLE IF NOT EXISTS \"${spec.schema}\".\"${spec.table}\" (` +\n                columns.map(c => `\"${c.name}\" ${c.type} NOT NULL`).join(\", \") +\n                `, PRIMARY KEY (${columns.map(c => `\"${c.name}\"`).join(\", \")}));`,\n            foreignKeys: [source, target].map((endpoint, i) =>\n                foreignKeyPlan({\n                    schema: spec.schema,\n                    table: spec.table,\n                    column: columns[i].name,\n                    targetSchema: schemaOfCollection(endpoint.collection),\n                    targetTable: bareTableName(getTableName(endpoint.collection)),\n                    targetColumn: getPrimaryKeyName(endpoint.collection),\n                    onDelete\n                })\n            )\n        });\n    }\n\n    return plans;\n};\n\nexport interface CollectionPolicyPlan {\n    /** The table's schema (e.g. `public`, `rebase`). */\n    schema: string;\n    /** The bare table name, no schema prefix. */\n    table: string;\n    /** `schema.table` — matches the keys `readExistingSchema` returns. */\n    qualified: string;\n    /** `ALTER TABLE … ENABLE ROW LEVEL SECURITY;` — locked by default. */\n    enableRls: string;\n    /** `DROP POLICY IF EXISTS` / `CREATE POLICY` statements, in order. */\n    policyStatements: string[];\n}\n\n/**\n * The per-table RLS plan for the *declared* collections, as executable\n * statements — what the managed runtime applies at boot so a freshly\n * provisioned tenant database serves data instead of 401ing every read.\n *\n * Mirrors {@link generatePostgresPoliciesDdl} exactly (same\n * `generatePolicyStatements`, same enable-RLS, same effective rules, same\n * derived junction rules), so boot and `db push` produce identical policies from\n * identical collections.\n *\n * Junction tables are included, and have to be: boot creates them now\n * ({@link planJunctionTables}), and a junction with RLS left off is readable and\n * writable by every signed-in user. A junction whose table is still absent is\n * skipped by the applier, not planned away here.\n */\nexport const planCollectionPolicies = (collections: CollectionConfig[]): CollectionPolicyPlan[] => {\n    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);\n    const plans: CollectionPolicyPlan[] = [];\n    const seen = new Set<string>();\n\n    for (const collection of collections) {\n        const tableName = getTableName(collection);\n        if (!tableName) continue;\n        const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n        const baseTableName = tableName.includes(\".\") ? tableName.split(\".\").pop()! : tableName;\n        const qualified = `${schema}.${baseTableName}`;\n        if (seen.has(qualified)) continue;\n        seen.add(qualified);\n\n        const policyStatements: string[] = [];\n        for (const rule of getEffectiveSecurityRules(collection)) {\n            policyStatements.push(...generatePolicyStatements(collection, rule, resolveCollection));\n        }\n\n        plans.push({\n            schema,\n            table: baseTableName,\n            qualified,\n            enableRls: `ALTER TABLE \"${schema}\".\"${baseTableName}\" ENABLE ROW LEVEL SECURITY;`,\n            policyStatements\n        });\n    }\n\n    // Junctions are derived from `through` relations rather than declared, so\n    // the walk above never sees them.\n    for (const spec of resolveJunctionSpecs(collections).values()) {\n        const qualified = `${spec.schema}.${spec.table}`;\n        if (seen.has(qualified)) continue;\n        seen.add(qualified);\n\n        const junctionCollection = getJunctionCollectionConfig(spec);\n        const policyStatements: string[] = [];\n        for (const rule of getJunctionSecurityRules(spec)) {\n            policyStatements.push(...generatePolicyStatements(junctionCollection, rule, resolveCollection));\n        }\n\n        plans.push({\n            schema: spec.schema,\n            table: spec.table,\n            qualified,\n            enableRls: `ALTER TABLE \"${spec.schema}\".\"${spec.table}\" ENABLE ROW LEVEL SECURITY;`,\n            policyStatements\n        });\n    }\n\n    return plans;\n};\n\nexport const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): string => {\n    let ddl = \"-- This file contains RLS policies generated by Rebase. Applied separately from migrations.\\n\\n\";\n\n    const allTablesToGenerate = new Map<string, {\n        collection: CollectionConfig\n    }>();\n\n    for (const collection of collections) {\n        const tableName = getTableName(collection);\n        if (tableName) {\n            allTablesToGenerate.set(tableName, { collection });\n        }\n    }\n\n    for (const [tableName, { collection }] of allTablesToGenerate.entries()) {\n        const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n        const baseTableName = tableName.includes(\".\") ? tableName.split(\".\").pop()! : tableName;\n\n        // No FORCE: user requests run as the non-owner `rebase_user` role\n        // (plain ENABLE binds them); the owner is the trusted server context.\n        ddl += `ALTER TABLE \"${schema}\".\"${baseTableName}\" ENABLE ROW LEVEL SECURITY;\\n`;\n        ddl += `\\n`;\n\n        const securityRules = getEffectiveSecurityRules(collection);\n        if (securityRules.length > 0) {\n            const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);\n            const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));\n\n            securityRules.forEach((rule: SecurityRule) => {\n                // Say which policies the author did not write. They are permissive,\n                // so they OR with the declared rules and widen the final ACL beyond\n                // what `securityRules` reads like — and re-appear after any manual\n                // DROP, because a push asserts the declared state.\n                if (rule.name && injectedNames.has(rule.name)) {\n                    ddl += `-- Injected by Rebase (not from this collection's securityRules).\\n`;\n                    ddl += `-- Set \\`disableDefaultPolicies: true\\` on \"${collection.slug}\" to drop these and own its RLS outright.\\n`;\n                }\n                ddl += generatePolicyDdl(collection, rule, resolveCollection);\n            });\n            ddl += \"\\n\";\n        }\n    }\n\n    // Junction tables are generated from `through` relations, not declared as\n    // collections, so the walk above never sees them. They get the same\n    // treatment as any generated table: locked by default, with derived\n    // policies — reads follow the endpoints, writes follow the declaring\n    // side's update rules.\n    const junctionSpecs = resolveJunctionSpecs(collections);\n    for (const spec of junctionSpecs.values()) {\n        ddl += `ALTER TABLE \"${spec.schema}\".\"${spec.table}\" ENABLE ROW LEVEL SECURITY;\\n`;\n        ddl += `\\n`;\n\n        const junctionRules = getJunctionSecurityRules(spec);\n        if (junctionRules.length === 0) continue;\n\n        const junctionCollection = getJunctionCollectionConfig(spec);\n        const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);\n        const declaringSlugs = spec.declaringSides.map(s => s.collection.slug).join('\", \"');\n\n        ddl += `-- Derived by Rebase for the junction \"${spec.table}\" (no collection declares it).\\n`;\n        ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\\n`;\n        ddl += `-- rules of \"${declaringSlugs}\". Set \\`disableDefaultPolicies: true\\` on the\\n`;\n        ddl += `-- declaring collection(s) to drop these and police the junction yourself.\\n`;\n        junctionRules.forEach((rule: SecurityRule) => {\n            ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);\n        });\n        ddl += \"\\n\";\n    }\n\n    return ddl;\n};\n\n","/**\n * Bringing a database up to date with a bundle's collections, additively.\n *\n * ## Why this exists\n *\n * A managed runtime boots someone else's compiled project against a database it\n * has never seen. Auth tables are ensured at boot already, but collection tables\n * were not created by anything: the platform ran the app and every `/api/data/*`\n * request answered 500 on a missing relation. `rebase db push` cannot help — it\n * is an Atlas-driven CLI command, and the runtime image ships no CLI.\n *\n * ## Why additive-only, forever\n *\n * This runs unattended, against a database with customers' data in it, with no\n * human reading a diff. So it may only ever do things that cannot lose data:\n * create a missing table, add a missing column, create a missing enum type.\n *\n * It will **never** drop a table or a column, narrow a type, or alter a\n * constraint. A removed field leaves its column behind; a renamed field looks\n * like an addition and the old column stays. That is the correct trade for an\n * automated path — the alternative is an unattended process that can silently\n * destroy a column, which is precisely the failure `db push` was hardened\n * against. Destructive changes stay a deliberate, human-reviewed migration.\n *\n * Because of that, this is safe to run on every boot, and re-running it is a\n * no-op.\n */\nimport { type CollectionConfig, type Property, isPostgresCollectionConfig } from \"@rebasepro/types\";\nimport { getTableName } from \"@rebasepro/common\";\nimport { logger } from \"@rebasepro/server\";\nimport {\n    getSqlColumnType,\n    resolveColumnName,\n    isIdProperty,\n    planRelationalColumns,\n    planJunctionTables,\n    quoteSqlLiteral\n} from \"./generate-postgres-ddl-logic\";\n\n/**\n * The subset of a database handle this needs: run a statement, get rows back.\n *\n * Deliberately parameterless. Everything here is DDL or catalogue reads keyed by\n * schema name, and schema names are identifiers — they cannot be bound as\n * parameters anyway. They are validated against {@link SAFE_IDENTIFIER} before\n * they reach a statement, so a config that somehow carried a quote is refused\n * rather than concatenated.\n */\nexport interface Queryable {\n    query<T = unknown>(sql: string): Promise<{ rows: T[] }>;\n}\n\n/** Postgres identifiers this module is willing to interpolate. */\nconst SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;\n\nfunction assertSafeIdentifier(value: string, what: string): string {\n    if (!SAFE_IDENTIFIER.test(value)) {\n        throw new Error(`Refusing to build SQL with an unsafe ${what}: ${JSON.stringify(value)}`);\n    }\n    return value;\n}\n\n/** What the database currently has, as the planner needs it. */\nexport interface ExistingSchema {\n    /** `schema.table` → set of column names. */\n    tables: Map<string, Set<string>>;\n    /** `schema.typename` of every enum type that already exists. */\n    enums: Set<string>;\n    /**\n     * `schema.table.constraint` of every constraint that already exists.\n     *\n     * Optional so a caller that only cares about tables can still build one by\n     * hand; absent is read as \"none known\", which at worst re-attempts a\n     * constraint that then fails harmlessly as a duplicate.\n     */\n    constraints?: Set<string>;\n}\n\nexport interface EnsureAction {\n    kind: \"create-enum\" | \"create-table\" | \"add-column\" | \"add-constraint\" | \"rename-column\";\n    /** Qualified target, for logging: `public.posts` or `public.posts.title`. */\n    target: string;\n    sql: string;\n}\n\nexport interface EnsurePlan {\n    actions: EnsureAction[];\n    /** Every statement, in dependency order. Empty when the schema is current. */\n    statements: string[];\n    /**\n     * Relation columns this plan is about to create where the table already\n     * carries the same column under its pre-singularization name.\n     *\n     * The reason this is reported rather than silently handled: the ensure is\n     * additive, so it would add `category_id` beside a populated\n     * `categorie_id` and the relation would then read the new, empty one. No\n     * statement fails, no table is missing, and the only symptom is relations\n     * resolving to nothing — which is indistinguishable from having no data.\n     */\n    legacyForeignKeys: LegacyForeignKey[];\n}\n\n/** A relation column whose old and new spellings both plausibly apply. */\nexport interface LegacyForeignKey {\n    /** `schema.table`. */\n    table: string;\n    /** The name the current rule derives, and what this plan would create. */\n    expected: string;\n    /** The name the old rule derived, which the table already has. */\n    legacy: string;\n}\n\nexport interface EnsureOutcome extends EnsurePlan {\n    /**\n     * Constraints that could not be added — always non-fatal.\n     *\n     * A foreign key can only fail on data that already violates it, and the\n     * column it would police exists either way, so the collection still serves.\n     * Refusing to boot over one would turn a pre-existing data problem into an\n     * outage. Reported loudly instead.\n     */\n    failures: { target: string; error: string }[];\n}\n\nfunction schemaOf(collection: CollectionConfig): string {\n    return isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n}\n\nfunction qualified(collection: CollectionConfig): string {\n    return `${schemaOf(collection)}.${getTableName(collection)}`;\n}\n\n/**\n * Enum types a collection's properties require, as `schema.typename`.\n *\n * Named exactly as the DDL generator names them (`<table>_<column>`), because\n * a column added here has to reference the same type the generator would have\n * created — a second, differently-named type for the same field would be a\n * silent schema fork.\n */\nfunction requiredEnums(collection: CollectionConfig): { name: string; values: string[] }[] {\n    const table = getTableName(collection);\n    const schema = schemaOf(collection);\n    const out: { name: string; values: string[] }[] = [];\n    for (const [propName, prop] of Object.entries(collection.properties ?? {})) {\n        const p = prop as Property;\n        if (!(\"enum\" in p) || !p.enum) continue;\n        if (p.type !== \"string\" && p.type !== \"number\") continue;\n        const values = (p.enum as unknown[])\n            .map(entry =>\n                entry && typeof entry === \"object\" && \"id\" in (entry as Record<string, unknown>)\n                    ? String((entry as Record<string, unknown>).id)\n                    : String(entry)\n            )\n            .filter(v => v.length > 0);\n        if (values.length === 0) continue;\n        out.push({ name: `${schema}.${table}_${resolveColumnName(propName, p)}`, values });\n    }\n    return out;\n}\n\n/**\n * Decide what to add. Pure — the caller supplies what exists and runs the result.\n *\n * Ordering matters and is deliberate: enum types before the tables and columns\n * that reference them, tables before the columns added to other tables (a new\n * table may be the target of a relation), and nothing is emitted twice.\n */\nexport function planCollectionSchemaEnsure(\n    collections: CollectionConfig[],\n    existing: ExistingSchema\n): EnsurePlan {\n    const actions: EnsureAction[] = [];\n    const plannedEnums = new Set<string>();\n\n    // 1. Enum types. `CREATE TYPE` has no IF NOT EXISTS, so an existing type is\n    //    skipped by name rather than guarded in SQL.\n    for (const collection of collections) {\n        for (const { name, values } of requiredEnums(collection)) {\n            if (existing.enums.has(name) || plannedEnums.has(name)) continue;\n            plannedEnums.add(name);\n            const [schema, typeName] = name.split(\".\");\n            actions.push({\n                kind: \"create-enum\",\n                target: name,\n                sql: `CREATE TYPE \"${schema}\".\"${typeName}\" AS ENUM (${values.map(quoteSqlLiteral).join(\", \")});`\n            });\n        }\n    }\n\n    // 2. Missing tables. Only the identity column is created here; every other\n    //    column is added by step 3, so a new table and an existing table that\n    //    gained a field travel the exact same code path. One way to build a\n    //    column means one way for it to be wrong.\n    const created = new Set<string>();\n    for (const collection of collections) {\n        const key = qualified(collection);\n        if (existing.tables.has(key) || created.has(key)) continue;\n        created.add(key);\n        const schema = schemaOf(collection);\n        const table = getTableName(collection);\n        const idEntry = Object.entries(collection.properties ?? {}).find(([n, p]) =>\n            isIdProperty(n, p as Property, collection)\n        );\n        const idName = idEntry ? resolveColumnName(idEntry[0], idEntry[1] as Property) : \"id\";\n        const idProp = idEntry?.[1] as Property | undefined;\n        let idDef: string;\n        if (idProp?.type === \"number\") {\n            idDef = `\"${idName}\" BIGSERIAL PRIMARY KEY`;\n        } else if (\n            idProp &&\n            idProp.type === \"string\" &&\n            (idProp as { isId?: unknown }).isId === \"uuid\"\n        ) {\n            idDef = `\"${idName}\" UUID PRIMARY KEY DEFAULT gen_random_uuid()`;\n        } else {\n            idDef = `\"${idName}\" TEXT PRIMARY KEY`;\n        }\n        actions.push({\n            kind: \"create-table\",\n            target: key,\n            sql: `CREATE TABLE IF NOT EXISTS \"${schema}\".\"${table}\" (${idDef});`\n        });\n    }\n\n    // 2b. Junction tables behind many-to-many relations. No collection declares\n    //     them, so the walk above never sees them — and until they existed, an\n    //     m2m write had nowhere to land and the junction's derived RLS had\n    //     nothing to attach to.\n    const junctions = planJunctionTables(collections);\n    for (const junction of junctions) {\n        const key = `${junction.schema}.${junction.table}`;\n        if (existing.tables.has(key) || created.has(key)) continue;\n        created.add(key);\n        actions.push({ kind: \"create-table\", target: key, sql: junction.createTable });\n    }\n\n    // 3. Missing columns, on both brand-new and pre-existing tables.\n    const legacyForeignKeys: LegacyForeignKey[] = [];\n\n    /**\n     * Move a relation column that is only missing because it was renamed.\n     *\n     * Returns true when it handled the column, so the caller skips the ordinary\n     * ADD. Adding here would be the wrong move and a quiet one: the data is in\n     * the old column, `ADD COLUMN` creates the new one empty beside it, every\n     * statement succeeds, and the relation reads the empty one. A rename is\n     * metadata-only in Postgres, keeps the values, and carries the column's\n     * indexes and constraints with it.\n     *\n     * Only ever reached when the new name is absent and the old name is\n     * present, so there is nothing to overwrite and nothing to choose between.\n     */\n    const renameLegacyColumn = (\n        key: string,\n        schema: string,\n        table: string,\n        column: string,\n        legacyName: string | undefined\n    ): boolean => {\n        const present = existing.tables.get(key);\n        if (!legacyName || !present) return false;\n        if (present.has(column) || !present.has(legacyName)) return false;\n\n        legacyForeignKeys.push({ table: key, expected: column, legacy: legacyName });\n        actions.push({\n            kind: \"rename-column\",\n            target: `${key}.${column}`,\n            sql: `ALTER TABLE \"${schema}\".\"${table}\" RENAME COLUMN \"${legacyName}\" TO \"${column}\";`\n        });\n        return true;\n    };\n\n    const addColumn = (\n        key: string,\n        schema: string,\n        table: string,\n        column: string,\n        type: string\n    ): void => {\n        const present = existing.tables.get(key);\n        if (present?.has(column)) return;\n        actions.push({\n            kind: \"add-column\",\n            target: `${key}.${column}`,\n            // Never NOT NULL: an existing table with rows cannot take a\n            // non-null column without a default, and inventing one would be\n            // guessing at the customer's data.\n            sql: `ALTER TABLE \"${schema}\".\"${table}\" ADD COLUMN IF NOT EXISTS \"${column}\" ${type};`\n        });\n    };\n\n    for (const collection of collections) {\n        const key = qualified(collection);\n        const schema = schemaOf(collection);\n        const table = getTableName(collection);\n        for (const [propName, prop] of Object.entries(collection.properties ?? {})) {\n            const p = prop as Property;\n            if (isIdProperty(propName, p, collection)) continue;\n            // Relation and reference columns are planned from the shared\n            // relational planner below, which derives the column name, type and\n            // foreign key the same way `db push` does. Deriving them here as\n            // plain columns is what once produced a column with no constraint.\n            if (p.type === \"reference\" || p.type === \"relation\") continue;\n            addColumn(key, schema, table, resolveColumnName(propName, p), getSqlColumnType(propName, p, collection, collections));\n        }\n    }\n\n    // 3b. A junction that already existed, but is short a column. One created\n    //     above already carries both — unlike a collection table, whose CREATE\n    //     declares only the identity column — so re-listing them would log two\n    //     no-op statements and inflate the count of changes applied.\n    for (const junction of junctions) {\n        const key = `${junction.schema}.${junction.table}`;\n        if (created.has(key)) continue;\n        for (const column of junction.columns) {\n            if (renameLegacyColumn(key, junction.schema, junction.table, column.name, column.legacyName)) continue;\n            addColumn(key, junction.schema, junction.table, column.name, column.type);\n        }\n    }\n\n    // 3c. The columns relation and reference properties own.\n    for (const relational of planRelationalColumns(collections)) {\n        const relKey = `${relational.schema}.${relational.table}`;\n        if (renameLegacyColumn(relKey, relational.schema, relational.table, relational.column, relational.legacyColumn)) continue;\n        addColumn(\n            relKey,\n            relational.schema,\n            relational.table,\n            relational.column,\n            relational.type\n        );\n    }\n\n    // 4. Foreign keys, last: the tables and columns on both ends have to exist\n    //    first, and a constraint is the one thing here that can fail on data\n    //    rather than on schema, so nothing else depends on it.\n    const knownConstraints = existing.constraints ?? new Set<string>();\n    const plannedConstraints = new Set<string>();\n    const foreignKeys = [\n        ...planRelationalColumns(collections).map(r => r.foreignKey),\n        ...junctions.flatMap(j => j.foreignKeys)\n    ];\n    for (const fk of foreignKeys) {\n        if (!fk) continue;\n        const name = `${fk.schema}.${fk.table}.${fk.constraintName}`;\n        if (knownConstraints.has(name) || plannedConstraints.has(name)) continue;\n        plannedConstraints.add(name);\n        actions.push({\n            kind: \"add-constraint\",\n            target: `${fk.schema}.${fk.table}.${fk.constraintName}`,\n            sql: fk.sql\n        });\n    }\n\n    return { actions, statements: actions.map(a => a.sql), legacyForeignKeys };\n}\n\n/** Read what the database has, for the schemas the collections live in. */\nexport async function readExistingSchema(\n    client: Queryable,\n    schemas: string[]\n): Promise<ExistingSchema> {\n    const tables = new Map<string, Set<string>>();\n    const enums = new Set<string>();\n    if (schemas.length === 0) return { tables, enums };\n\n    const inList = schemas\n        .map(schema => `'${assertSafeIdentifier(schema, \"schema name\")}'`)\n        .join(\", \");\n\n    const { rows: columns } = await client.query<{\n        table_schema: string;\n        table_name: string;\n        column_name: string;\n    }>(\n        `SELECT table_schema, table_name, column_name\n         FROM information_schema.columns\n         WHERE table_schema IN (${inList})`\n    );\n    for (const row of columns) {\n        const key = `${row.table_schema}.${row.table_name}`;\n        if (!tables.has(key)) tables.set(key, new Set());\n        tables.get(key)!.add(row.column_name);\n    }\n\n    const { rows: enumRows } = await client.query<{ schema: string; name: string }>(\n        `SELECT n.nspname AS schema, t.typname AS name\n         FROM pg_type t\n         JOIN pg_namespace n ON t.typnamespace = n.oid\n         WHERE t.typtype = 'e' AND n.nspname IN (${inList})`\n    );\n    for (const row of enumRows) enums.add(`${row.schema}.${row.name}`);\n\n    // `ADD CONSTRAINT` has no IF NOT EXISTS, so an existing foreign key is\n    // skipped by name rather than guarded in SQL.\n    const constraints = new Set<string>();\n    const { rows: constraintRows } = await client.query<{\n        schema: string;\n        table: string;\n        name: string;\n    }>(\n        `SELECT n.nspname AS schema, c.relname AS table, con.conname AS name\n         FROM pg_constraint con\n         JOIN pg_class c ON con.conrelid = c.oid\n         JOIN pg_namespace n ON c.relnamespace = n.oid\n         WHERE n.nspname IN (${inList})`\n    );\n    for (const row of constraintRows) constraints.add(`${row.schema}.${row.table}.${row.name}`);\n\n    return { tables, enums, constraints };\n}\n\n/**\n * Bring the database up to date. Returns what it did.\n *\n * Each statement runs on its own rather than in one transaction: they are all\n * independently safe and idempotent, and a single failure (an enum label that\n * cannot be added, say) should not roll back the tables that were created fine.\n * The error is surfaced with the statement that caused it.\n */\nexport async function ensureCollectionTables(\n    client: Queryable,\n    collections: CollectionConfig[],\n    log?: (message: string) => void\n): Promise<EnsureOutcome> {\n    // Junctions live alongside the collections that declare them, so their\n    // schema has to be read too — otherwise an existing junction reads as\n    // missing and its constraints as unplanned.\n    const schemas = Array.from(new Set([\n        ...collections.map(schemaOf),\n        ...planJunctionTables(collections).map(j => j.schema)\n    ]));\n    for (const schema of schemas) {\n        assertSafeIdentifier(schema, \"schema name\");\n        if (schema !== \"public\") {\n            await client.query(`CREATE SCHEMA IF NOT EXISTS \"${schema}\";`);\n        }\n    }\n\n    const existing = await readExistingSchema(client, schemas);\n    const plan = planCollectionSchemaEnsure(collections, existing);\n    const failures: { target: string; error: string }[] = [];\n\n    // Reported, not warned: this is a rename the ensure is about to perform, and\n    // the operator should be able to see in the log why a column changed name.\n    // The interesting case is the one that no longer happens — before this,\n    // ensure added the new column empty beside the populated old one, every\n    // statement succeeded, and the relation read the empty one.\n    for (const legacy of plan.legacyForeignKeys) {\n        const message =\n            `Renaming \"${legacy.table}\".\"${legacy.legacy}\" to \"${legacy.expected}\". The old name is ` +\n            \"the one Rebase derived for this relation before it singularized properly; the column \" +\n            \"keeps its data, indexes and constraints. To keep the old name instead, set \" +\n            `\\`localKey: \"${legacy.legacy}\"\\` on the relation and this will stop.`;\n        logger.info(`[schema] ${message}`);\n        log?.(message);\n    }\n\n    if (plan.actions.length === 0) {\n        log?.(\"Schema is up to date; nothing to create.\");\n        return { ...plan, failures };\n    }\n\n    for (const action of plan.actions) {\n        try {\n            await client.query(action.sql);\n            log?.(`${action.kind}: ${action.target}`);\n        } catch (err) {\n            const message = err instanceof Error ? err.message : String(err);\n            // A foreign key is the only action that can fail on the customer's\n            // data rather than on the schema. The column it polices is already\n            // there, so the collection serves either way — record it and carry\n            // on rather than crash-looping the deployment.\n            if (action.kind === \"add-constraint\") {\n                failures.push({ target: action.target, error: message });\n                continue;\n            }\n            throw new Error(\n                `Failed to ${action.kind} ${action.target}: ${message}\\n  ${action.sql}`\n            );\n        }\n    }\n    return { ...plan, failures };\n}\n"],"mappings":";;;;;;;AAMA,IAAa,qBAAqB,UAAkB,SAAmC;CACnF,IAAI,QAAQ,gBAAgB,QAAQ,OAAO,KAAK,eAAe,UAC3D,OAAO,KAAK;CAEhB,OAAO,YAAY,QAAQ;AAC/B;AAEA,IAAa,qBAAqB,eAA+F;CAC7H,IAAI,WAAW,YAAY;EACvB,MAAM,cAAc,OAAO,QAAQ,WAAW,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,UAAU,UAAW,QAA8B,QAAS,KAA4C,IAAI,CAAC;EACjL,IAAI,aAAa;GACb,MAAM,OAAO,YAAY;GACzB,MAAM,SAAS,KAAK,SAAS,YAAY,UAAU,QAAS,KAAmC,SAAS;GACxG,OAAO;IAAE,MAAM,YAAY;IAAI,MAAM,KAAK,SAAS,WAAW,WAAW;IAAU;GAAO;EAC9F;CACJ;CACA,MAAM,SAAS,WAAW,aAAa;CACvC,IAAI,QAAQ,SAAS,UACjB,OAAO;EAAE,MAAM;EAAM,MAAM;EAAU,QAAQ;CAAM;CAGvD,OAAO;EAAE,MAAM;EAAM,MAAM;EAAU,QADtB,QAAQ,SAAS,YAAY,UAAU,UAAW,OAAqC,SAAS;CAClD;AACjE;AAEA,IAAa,eAAe,eAA0C;CAClE,OAAO,kBAAkB,UAAU,CAAC,CAAC,SAAS;AAClD;AAEA,IAAa,qBAAqB,eAAyC;CACvE,OAAO,kBAAkB,UAAU,CAAC,CAAC;AACzC;;AAGA,IAAM,mBAAmB,eACrB,YAAY,UAAU,IAAI,YAAa,kBAAkB,UAAU,CAAC,CAAC,SAAS,SAAS;AAE3F,IAAa,gBAAgB,UAAkB,MAAgB,eAA0C;CACrG,IAAI,UAAU,QAAQ,QAAQ,KAAK,IAAI,GAAG,OAAO;CAEjD,OAAO,CADe,OAAO,OAAO,WAAW,cAAc,CAAC,CAAC,CAAC,CAAC,MAAK,MAAK,UAAW,KAA2B,QAAS,EAAyC,IAAI,CAC/J,KAAiB,aAAa;AAC1C;;;;;;;;;;AA0BA,IAAa,4BAA4B,YAA8B,MAAoB,sBAAmD;CAC1I,MAAM,YAAY,aAAa,UAAU;CACzC,MAAM,MAAoC,KAAK,cAAc,KAAK,WAAW,SAAS,IAChF,KAAK,aACL,CAAC,KAAK,aAAa,KAAK;CAE9B,MAAM,cAAc,sBAAsB,MAAM,SAAS;CAEzD,OAAO,IAAI,SAAS,IAAI,UAAU;EAC9B,OAAO,+BAA+B,YAAY,MAAM,IAAI,YAAY,QAAQ,iBAAiB;CACrG,CAAC;AACL;AAEA,IAAM,kCAAkC,YAA8B,MAAoB,WAA8B,YAAoB,sBAAmD;CAC3L,MAAM,SAAS,2BAA2B,UAAU,KAAK,WAAW,SAAS,WAAW,SAAS;CACjG,MAAM,YAAY,aAAa,UAAU;CACzC,MAAM,QAAQ,KAAK,QAAQ,aAAA,CAAc,YAAY;CACrD,MAAM,iBAAiB,UAAU,YAAY;CAC7C,MAAM,UAAU,KAAK,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ;CAEnE,MAAM,aAAa,cAAc;CACjC,MAAM,iBAAiB,cAAc,YAAY,cAAc;CAK/D,MAAM,EAAE,WAAW,kBAAkB,yBAAyB,IAAI;CAElE,IAAI,cAAc,cAAc,YAAY,iBAAiB,WAAW,YAAY,EAAE,kBAAkB,CAAC,IAAI;CAC7G,IAAI,kBAAkB,kBAAkB,gBAAgB,iBAAiB,eAAe,YAAY,EAAE,kBAAkB,CAAC,IAAI;CAE7H,IAAI,CAAC,eAAe,YAChB,cAAc;CAElB,IAAI,CAAC,mBAAmB,gBACpB,kBAAkB;CAGtB,MAAM,OAAO,0BAA0B,WAAW,QAAQ,OAAO,KAAK,UAAU;CAChF,IAAI,SAAS,kBAAkB,WAAW,QAAQ,OAAO,KAAK,UAAU,OAAO,KAAK,OAAO,eAAe,MAAM,QAAQ,KAAI,MAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;CACpJ,IAAI,aAAa,UAAU,WAAW,YAAY;CAClD,IAAI,iBAAiB,UAAU,gBAAgB,gBAAgB;CAC/D,UAAU;CACV,OAAO,CAAC,MAAM,MAAM;AACxB;;;;;;;;;AAUA,IAAa,mBAAmB,UAA0B,IAAI,MAAM,QAAQ,MAAM,IAAI,EAAE;AAExF,IAAa,oBAAoB,UAAkB,MAAgB,YAA8B,gBAA4C;CACzI,QAAQ,KAAK,MAAb;EACI,KAAK,UAAU;GACX,MAAM,aAAa;GACnB,IAAI,WAAW,MAAM;IACjB,MAAM,YAAY,aAAa,UAAU;IACzC,MAAM,UAAU,kBAAkB,UAAU,IAAI;IAEhD,OAAO,IADQ,2BAA2B,UAAU,KAAK,WAAW,SAAS,WAAW,SAAS,SAC/E,KAAK,UAAU,GAAG,QAAQ;GAChD;GACA,IAAI,WAAW,SAAS,UAAU,WAAW,eAAe,QACxD,OAAO;GAMX,IAAI,WAAW,eAAe,QAC1B,OAAO,QAAQ,0BAA0B,UAAU,EAAE;GAEzD,IAAI,WAAW,eAAe,WAC1B,OAAO,WAAW,0BAA0B,UAAU,EAAE;GAO5D,OAAO;EACX;EACA,KAAK,UAAU;GACX,MAAM,UAAU;GAChB,MAAM,OAAO,aAAa,UAAU,MAAM,UAAU;GACpD,IAAI,UAAU,WAAW,QAAQ,SAAS,aACtC,OAAO;GAEX,IAAI,QAAQ,YAAY;IACpB,IAAI,QAAQ,eAAe,oBAAoB,OAAO;IACtD,OAAO,QAAQ,WAAW,YAAY;GAC1C;GACA,OAAQ,QAAQ,YAAY,WAAW,OAAQ,YAAY;EAC/D;EACA,KAAK,WACD,OAAO;EACX,KAAK,QAAQ;GACT,MAAM,WAAW;GACjB,IAAI,SAAS,eAAe,QAAQ,OAAO;GAC3C,IAAI,SAAS,eAAe,QAAQ,OAAO;GAC3C,OAAO;EACX;EACA,KAAK,OAED,OAAO,KAAQ,eAAe,SAAS,SAAS;EAEpD,KAAK,SAAS;GACV,MAAM,YAAY;GAClB,IAAI,UAAU,UAAU;GACxB,IAAI,CAAC,WAAW,UAAU,MAAM,CAAC,MAAM,QAAQ,UAAU,EAAE,GAAG;IAC1D,MAAM,SAAS,UAAU;IACzB,IAAI,OAAO,SAAS,UAChB,UAAU;SACP,IAAI,OAAO,SAAS,UACvB,UAAU,OAAO,YAAY,UAAU,cAAc;SAClD,IAAI,OAAO,SAAS,WACvB,UAAU;GAElB;GACA,IAAI,YAAY,QAAQ,OAAO;GAC/B,IAAI,YAAY,UAAU,OAAO;GACjC,IAAI,YAAY,aAAa,OAAO;GACpC,IAAI,YAAY,aAAa,OAAO;GACpC,IAAI,YAAY,aAAa,OAAO;GACpC,OAAO;EACX;EACA,KAAK,UAED,OAAO,UAAU,KAAG,WAAW;EAEnC,KAAK,UACD,OAAO;EAEX,KAAK,YAAY;GACb,MAAM,UAAU;GAEhB,MAAM,WAAW,aADS,2BAA2B,UACvB,GAAmB,QAAQ,UAAU,gBAAgB,QAAQ;GAC3F,IAAI,UAAU,SAAS,aACnB,MAAM,IAAI,MAAM,YAAY,SAAS,+DAA+D;GAExG,IAAI;GACJ,IAAI;IACA,mBAAmB,SAAS,OAAO;GACvC,QAAQ;IACJ,OAAO;GACX;GACA,MAAM,SAAS,kBAAkB,gBAAgB;GACjD,OAAO,OAAO,SAAS,WAAW,YAAa,OAAO,SAAS,SAAS;EAC5E;EACA,KAAK,aAAa;GACd,MAAM,UAAU;GAChB,MAAM,mBAAmB,YAAY,MAAK,MAAK,EAAE,SAAS,QAAQ,QAAQ,aAAa,CAAC,MAAM,QAAQ,IAAI;GAC1G,IAAI,CAAC,kBAAkB,OAAO;GAC9B,MAAM,SAAS,kBAAkB,gBAAgB;GACjD,OAAO,OAAO,SAAS,WAAW,YAAa,OAAO,SAAS,SAAS;EAC5E;EACA,SACI,OAAO;CACf;AACJ;AAiVA,IAAM,sBAAsB,eACxB,2BAA2B,UAAU,KAAK,WAAW,SAAS,WAAW,SAAS;AAEtF,IAAM,iBAAiB,SAA0B,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,IAAK;AAE/F,IAAM,kBACF,SACiB;CACjB,MAAM,iBAAiB,GAAG,KAAK,MAAM,GAAG,KAAK,OAAO;CACpD,MAAM,WAAW,KAAK,WAAW,cAAc,KAAK,SAAS,YAAY,MAAM;CAC/E,OAAO;EACH;EACA,QAAQ,KAAK;EACb,OAAO,KAAK;EACZ,QAAQ,KAAK;EACb,cAAc,KAAK;EACnB,aAAa,KAAK;EAClB,cAAc,KAAK;EACnB,KACI,gBAAgB,KAAK,OAAO,KAAK,KAAK,MAAM,oBAAoB,eAAe,kBAC9D,KAAK,OAAO,iBAAiB,KAAK,aAAa,KAAK,KAAK,YAAY,MACjF,KAAK,aAAa,eAAe,KAAK,SAAS,YAAY,IAAI,SAAS;CACrF;AACJ;;;;;;;;;;;;;;;;AAiBA,IAAa,yBAAyB,gBAA4D;CAC9F,MAAM,QAAgC,CAAC;CAEvC,KAAK,MAAM,cAAc,aAAa;EAClC,MAAM,YAAY,aAAa,UAAU;EACzC,IAAI,CAAC,WAAW;EAChB,MAAM,SAAS,mBAAmB,UAAU;EAC5C,MAAM,QAAQ,cAAc,SAAS;EAErC,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,GAAG;GAC3E,MAAM,OAAO;GAEb,IAAI,KAAK,SAAS,YAAY;IAC1B,MAAM,UAAU;IAEhB,MAAM,UAAU,aADU,2BAA2B,UACxB,GAAmB,QAAQ,UAAU,gBAAgB,QAAQ;IAC1F,IAAI,SAAS,SAAS,aAAa;IAGnC,IAAI,WAAW,WAAW,QAAQ,aAAa,aAAa,QAAQ,UAAU;IAE9E,IAAI;IACJ,IAAI;KACA,mBAAmB,QAAQ,OAAO;IACtC,QAAQ;KACJ;IACJ;IACA,IAAI,CAAC,kBAAkB;IAEvB,MAAM,WAAW,KAAK,YAAY;IAGlC,MAAM,eAAe,QAAQ,UAAU,gBAAgB;IACvD,MAAM,YAAY,qBAAqB,YAAY;IACnD,MAAM,UAAU,QAAQ,aAAa,uBAAuB,YAAY;IACxE,MAAM,KAAK;KACP;KACA;KACA,QAAQ,QAAQ;KAChB,cAAc,WAAW,cAAc,QAAQ,WAAW,YAAY,KAAA;KACtE,MAAM,iBAAiB,UAAU,MAAM,YAAY,WAAW;KAC9D,YAAY,eAAe;MACvB;MACA;MACA,QAAQ,QAAQ;MAChB,cAAc,mBAAmB,gBAAgB;MACjD,aAAa,cAAc,aAAa,gBAAgB,CAAC;MACzD,cAAc,kBAAkB,gBAAgB;MAChD,UAAU,QAAQ,aAAa,WAAW,YAAY;MACtD,UAAU,QAAQ;KACtB,CAAC;IACL,CAAC;GACL,OAAO,IAAI,KAAK,SAAS,aAAa;IAClC,MAAM,UAAU;IAChB,MAAM,mBAAmB,YAAY,MACjC,MAAK,EAAE,SAAS,QAAQ,QAAQ,aAAa,CAAC,MAAM,QAAQ,IAChE;IACA,MAAM,SAAS,kBAAkB,UAAU,IAAI;IAC/C,MAAM,OAAO,iBAAiB,UAAU,MAAM,YAAY,WAAW;IACrE,MAAM,WAAW,KAAK,YAAY;IAElC,MAAM,KAAK;KACP;KACA;KACA;KACA;KACA,YAAY,mBACN,eAAe;MACb;MACA;MACA;MACA,cAAc,mBAAmB,gBAAgB;MACjD,aAAa,cAAc,aAAa,gBAAgB,CAAC;MACzD,cAAc,kBAAkB,gBAAgB;MAChD,UAAU,WAAW,YAAY;KACrC,CAAC,IACC,KAAA;IACV,CAAC;GACL;EACJ;CACJ;CAEA,OAAO;AACX;;;;;;;;;AAUA,IAAa,sBAAsB,gBAAyD;CACxF,MAAM,QAA6B,CAAC;CAEpC,KAAK,MAAM,QAAQ,qBAAqB,WAAW,CAAC,CAAC,OAAO,GAAG;EAC3D,MAAM,CAAC,QAAQ,UAAU,KAAK;EAM9B,MAAM,aAAa,aAAgD;GAC/D,MAAM,OAAO,YAAY,SAAS,WAAW,QAAQ,SAAS,WAAW,QAAQ,EAAE;GACnF,MAAM,SAAS,qBAAqB,IAAI;GAExC,OADgB,SAAS,mBAAmB,uBAAuB,IAAI,KACrD,WAAW,SAAS,iBAAiB,SAAS,KAAA;EACpE;EACA,MAAM,UAAU,CACZ;GAAE,MAAM,OAAO;GAAgB,MAAM,gBAAgB,OAAO,UAAU;GAAG,YAAY,UAAU,MAAM;EAAE,GACvG;GAAE,MAAM,OAAO;GAAgB,MAAM,gBAAgB,OAAO,UAAU;GAAG,YAAY,UAAU,MAAM;EAAE,CAC3G;EAGA,MAAM,WAAW,KAAK,eAAe,EAAE,EAAE,SAAS,YAAY;EAE9D,MAAM,KAAK;GACP,QAAQ,KAAK;GACb,OAAO,KAAK;GACZ;GACA,aACI,+BAA+B,KAAK,OAAO,KAAK,KAAK,MAAM,OAC3D,QAAQ,KAAI,MAAK,IAAI,EAAE,KAAK,IAAI,EAAE,KAAK,UAAU,CAAC,CAAC,KAAK,IAAI,IAC5D,kBAAkB,QAAQ,KAAI,MAAK,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;GACjE,aAAa,CAAC,QAAQ,MAAM,CAAC,CAAC,KAAK,UAAU,MACzC,eAAe;IACX,QAAQ,KAAK;IACb,OAAO,KAAK;IACZ,QAAQ,QAAQ,EAAE,CAAC;IACnB,cAAc,mBAAmB,SAAS,UAAU;IACpD,aAAa,cAAc,aAAa,SAAS,UAAU,CAAC;IAC5D,cAAc,kBAAkB,SAAS,UAAU;IACnD;GACJ,CAAC,CACL;EACJ,CAAC;CACL;CAEA,OAAO;AACX;;;;;;;;;;;;;;;;AA8BA,IAAa,0BAA0B,gBAA4D;CAC/F,MAAM,qBAAwC,SAAS,YAAY,MAAK,MAAK,EAAE,SAAS,QAAQ,aAAa,CAAC,MAAM,IAAI;CACxH,MAAM,QAAgC,CAAC;CACvC,MAAM,uBAAO,IAAI,IAAY;CAE7B,KAAK,MAAM,cAAc,aAAa;EAClC,MAAM,YAAY,aAAa,UAAU;EACzC,IAAI,CAAC,WAAW;EAChB,MAAM,SAAS,2BAA2B,UAAU,KAAK,WAAW,SAAS,WAAW,SAAS;EACjG,MAAM,gBAAgB,UAAU,SAAS,GAAG,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,IAAI,IAAK;EAC9E,MAAM,YAAY,GAAG,OAAO,GAAG;EAC/B,IAAI,KAAK,IAAI,SAAS,GAAG;EACzB,KAAK,IAAI,SAAS;EAElB,MAAM,mBAA6B,CAAC;EACpC,KAAK,MAAM,QAAQ,0BAA0B,UAAU,GACnD,iBAAiB,KAAK,GAAG,yBAAyB,YAAY,MAAM,iBAAiB,CAAC;EAG1F,MAAM,KAAK;GACP;GACA,OAAO;GACP;GACA,WAAW,gBAAgB,OAAO,KAAK,cAAc;GACrD;EACJ,CAAC;CACL;CAIA,KAAK,MAAM,QAAQ,qBAAqB,WAAW,CAAC,CAAC,OAAO,GAAG;EAC3D,MAAM,YAAY,GAAG,KAAK,OAAO,GAAG,KAAK;EACzC,IAAI,KAAK,IAAI,SAAS,GAAG;EACzB,KAAK,IAAI,SAAS;EAElB,MAAM,qBAAqB,4BAA4B,IAAI;EAC3D,MAAM,mBAA6B,CAAC;EACpC,KAAK,MAAM,QAAQ,yBAAyB,IAAI,GAC5C,iBAAiB,KAAK,GAAG,yBAAyB,oBAAoB,MAAM,iBAAiB,CAAC;EAGlG,MAAM,KAAK;GACP,QAAQ,KAAK;GACb,OAAO,KAAK;GACZ;GACA,WAAW,gBAAgB,KAAK,OAAO,KAAK,KAAK,MAAM;GACvD;EACJ,CAAC;CACL;CAEA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC5wBA,IAAM,kBAAkB;AAExB,SAAS,qBAAqB,OAAe,MAAsB;CAC/D,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAC3B,MAAM,IAAI,MAAM,wCAAwC,KAAK,IAAI,KAAK,UAAU,KAAK,GAAG;CAE5F,OAAO;AACX;AAgEA,SAAS,SAAS,YAAsC;CACpD,OAAO,2BAA2B,UAAU,KAAK,WAAW,SAAS,WAAW,SAAS;AAC7F;AAEA,SAAS,UAAU,YAAsC;CACrD,OAAO,GAAG,SAAS,UAAU,EAAE,GAAG,aAAa,UAAU;AAC7D;;;;;;;;;AAUA,SAAS,cAAc,YAAoE;CACvF,MAAM,QAAQ,aAAa,UAAU;CACrC,MAAM,SAAS,SAAS,UAAU;CAClC,MAAM,MAA4C,CAAC;CACnD,KAAK,MAAM,CAAC,UAAU,SAAS,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,GAAG;EACxE,MAAM,IAAI;EACV,IAAI,EAAE,UAAU,MAAM,CAAC,EAAE,MAAM;EAC/B,IAAI,EAAE,SAAS,YAAY,EAAE,SAAS,UAAU;EAChD,MAAM,SAAU,EAAE,KACb,KAAI,UACD,SAAS,OAAO,UAAU,YAAY,QAAS,QACzC,OAAQ,MAAkC,EAAE,IAC5C,OAAO,KAAK,CACtB,CAAC,CACA,QAAO,MAAK,EAAE,SAAS,CAAC;EAC7B,IAAI,OAAO,WAAW,GAAG;EACzB,IAAI,KAAK;GAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,kBAAkB,UAAU,CAAC;GAAK;EAAO,CAAC;CACrF;CACA,OAAO;AACX;;;;;;;;AASA,SAAgB,2BACZ,aACA,UACU;CACV,MAAM,UAA0B,CAAC;CACjC,MAAM,+BAAe,IAAI,IAAY;CAIrC,KAAK,MAAM,cAAc,aACrB,KAAK,MAAM,EAAE,MAAM,YAAY,cAAc,UAAU,GAAG;EACtD,IAAI,SAAS,MAAM,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,GAAG;EACxD,aAAa,IAAI,IAAI;EACrB,MAAM,CAAC,QAAQ,YAAY,KAAK,MAAM,GAAG;EACzC,QAAQ,KAAK;GACT,MAAM;GACN,QAAQ;GACR,KAAK,gBAAgB,OAAO,KAAK,SAAS,aAAa,OAAO,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,EAAE;EAClG,CAAC;CACL;CAOJ,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,cAAc,aAAa;EAClC,MAAM,MAAM,UAAU,UAAU;EAChC,IAAI,SAAS,OAAO,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG;EAClD,QAAQ,IAAI,GAAG;EACf,MAAM,SAAS,SAAS,UAAU;EAClC,MAAM,QAAQ,aAAa,UAAU;EACrC,MAAM,UAAU,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,OAClE,aAAa,GAAG,GAAe,UAAU,CAC7C;EACA,MAAM,SAAS,UAAU,kBAAkB,QAAQ,IAAI,QAAQ,EAAc,IAAI;EACjF,MAAM,SAAS,UAAU;EACzB,IAAI;EACJ,IAAI,QAAQ,SAAS,UACjB,QAAQ,IAAI,OAAO;OAChB,IACH,UACA,OAAO,SAAS,YACf,OAA8B,SAAS,QAExC,QAAQ,IAAI,OAAO;OAEnB,QAAQ,IAAI,OAAO;EAEvB,QAAQ,KAAK;GACT,MAAM;GACN,QAAQ;GACR,KAAK,+BAA+B,OAAO,KAAK,MAAM,KAAK,MAAM;EACrE,CAAC;CACL;CAMA,MAAM,YAAY,mBAAmB,WAAW;CAChD,KAAK,MAAM,YAAY,WAAW;EAC9B,MAAM,MAAM,GAAG,SAAS,OAAO,GAAG,SAAS;EAC3C,IAAI,SAAS,OAAO,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG;EAClD,QAAQ,IAAI,GAAG;EACf,QAAQ,KAAK;GAAE,MAAM;GAAgB,QAAQ;GAAK,KAAK,SAAS;EAAY,CAAC;CACjF;CAGA,MAAM,oBAAwC,CAAC;;;;;;;;;;;;;;CAe/C,MAAM,sBACF,KACA,QACA,OACA,QACA,eACU;EACV,MAAM,UAAU,SAAS,OAAO,IAAI,GAAG;EACvC,IAAI,CAAC,cAAc,CAAC,SAAS,OAAO;EACpC,IAAI,QAAQ,IAAI,MAAM,KAAK,CAAC,QAAQ,IAAI,UAAU,GAAG,OAAO;EAE5D,kBAAkB,KAAK;GAAE,OAAO;GAAK,UAAU;GAAQ,QAAQ;EAAW,CAAC;EAC3E,QAAQ,KAAK;GACT,MAAM;GACN,QAAQ,GAAG,IAAI,GAAG;GAClB,KAAK,gBAAgB,OAAO,KAAK,MAAM,mBAAmB,WAAW,QAAQ,OAAO;EACxF,CAAC;EACD,OAAO;CACX;CAEA,MAAM,aACF,KACA,QACA,OACA,QACA,SACO;EAEP,IADgB,SAAS,OAAO,IAAI,GAChC,CAAA,EAAS,IAAI,MAAM,GAAG;EAC1B,QAAQ,KAAK;GACT,MAAM;GACN,QAAQ,GAAG,IAAI,GAAG;GAIlB,KAAK,gBAAgB,OAAO,KAAK,MAAM,8BAA8B,OAAO,IAAI,KAAK;EACzF,CAAC;CACL;CAEA,KAAK,MAAM,cAAc,aAAa;EAClC,MAAM,MAAM,UAAU,UAAU;EAChC,MAAM,SAAS,SAAS,UAAU;EAClC,MAAM,QAAQ,aAAa,UAAU;EACrC,KAAK,MAAM,CAAC,UAAU,SAAS,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,GAAG;GACxE,MAAM,IAAI;GACV,IAAI,aAAa,UAAU,GAAG,UAAU,GAAG;GAK3C,IAAI,EAAE,SAAS,eAAe,EAAE,SAAS,YAAY;GACrD,UAAU,KAAK,QAAQ,OAAO,kBAAkB,UAAU,CAAC,GAAG,iBAAiB,UAAU,GAAG,YAAY,WAAW,CAAC;EACxH;CACJ;CAMA,KAAK,MAAM,YAAY,WAAW;EAC9B,MAAM,MAAM,GAAG,SAAS,OAAO,GAAG,SAAS;EAC3C,IAAI,QAAQ,IAAI,GAAG,GAAG;EACtB,KAAK,MAAM,UAAU,SAAS,SAAS;GACnC,IAAI,mBAAmB,KAAK,SAAS,QAAQ,SAAS,OAAO,OAAO,MAAM,OAAO,UAAU,GAAG;GAC9F,UAAU,KAAK,SAAS,QAAQ,SAAS,OAAO,OAAO,MAAM,OAAO,IAAI;EAC5E;CACJ;CAGA,KAAK,MAAM,cAAc,sBAAsB,WAAW,GAAG;EACzD,MAAM,SAAS,GAAG,WAAW,OAAO,GAAG,WAAW;EAClD,IAAI,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,OAAO,WAAW,QAAQ,WAAW,YAAY,GAAG;EACjH,UACI,QACA,WAAW,QACX,WAAW,OACX,WAAW,QACX,WAAW,IACf;CACJ;CAKA,MAAM,mBAAmB,SAAS,+BAAe,IAAI,IAAY;CACjE,MAAM,qCAAqB,IAAI,IAAY;CAC3C,MAAM,cAAc,CAChB,GAAG,sBAAsB,WAAW,CAAC,CAAC,KAAI,MAAK,EAAE,UAAU,GAC3D,GAAG,UAAU,SAAQ,MAAK,EAAE,WAAW,CAC3C;CACA,KAAK,MAAM,MAAM,aAAa;EAC1B,IAAI,CAAC,IAAI;EACT,MAAM,OAAO,GAAG,GAAG,OAAO,GAAG,GAAG,MAAM,GAAG,GAAG;EAC5C,IAAI,iBAAiB,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,GAAG;EAChE,mBAAmB,IAAI,IAAI;EAC3B,QAAQ,KAAK;GACT,MAAM;GACN,QAAQ,GAAG,GAAG,OAAO,GAAG,GAAG,MAAM,GAAG,GAAG;GACvC,KAAK,GAAG;EACZ,CAAC;CACL;CAEA,OAAO;EAAE;EAAS,YAAY,QAAQ,KAAI,MAAK,EAAE,GAAG;EAAG;CAAkB;AAC7E;;AAGA,eAAsB,mBAClB,QACA,SACuB;CACvB,MAAM,yBAAS,IAAI,IAAyB;CAC5C,MAAM,wBAAQ,IAAI,IAAY;CAC9B,IAAI,QAAQ,WAAW,GAAG,OAAO;EAAE;EAAQ;CAAM;CAEjD,MAAM,SAAS,QACV,KAAI,WAAU,IAAI,qBAAqB,QAAQ,aAAa,EAAE,EAAE,CAAC,CACjE,KAAK,IAAI;CAEd,MAAM,EAAE,MAAM,YAAY,MAAM,OAAO,MAKnC;;kCAE0B,OAAO,EACrC;CACA,KAAK,MAAM,OAAO,SAAS;EACvB,MAAM,MAAM,GAAG,IAAI,aAAa,GAAG,IAAI;EACvC,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,OAAO,IAAI,qBAAK,IAAI,IAAI,CAAC;EAC/C,OAAO,IAAI,GAAG,CAAC,CAAE,IAAI,IAAI,WAAW;CACxC;CAEA,MAAM,EAAE,MAAM,aAAa,MAAM,OAAO,MACpC;;;mDAG2C,OAAO,EACtD;CACA,KAAK,MAAM,OAAO,UAAU,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,IAAI,MAAM;CAIjE,MAAM,8BAAc,IAAI,IAAY;CACpC,MAAM,EAAE,MAAM,mBAAmB,MAAM,OAAO,MAK1C;;;;+BAIuB,OAAO,EAClC;CACA,KAAK,MAAM,OAAO,gBAAgB,YAAY,IAAI,GAAG,IAAI,OAAO,GAAG,IAAI,MAAM,GAAG,IAAI,MAAM;CAE1F,OAAO;EAAE;EAAQ;EAAO;CAAY;AACxC;;;;;;;;;AAUA,eAAsB,uBAClB,QACA,aACA,KACsB;CAItB,MAAM,UAAU,MAAM,qBAAK,IAAI,IAAI,CAC/B,GAAG,YAAY,IAAI,QAAQ,GAC3B,GAAG,mBAAmB,WAAW,CAAC,CAAC,KAAI,MAAK,EAAE,MAAM,CACxD,CAAC,CAAC;CACF,KAAK,MAAM,UAAU,SAAS;EAC1B,qBAAqB,QAAQ,aAAa;EAC1C,IAAI,WAAW,UACX,MAAM,OAAO,MAAM,gCAAgC,OAAO,GAAG;CAErE;CAGA,MAAM,OAAO,2BAA2B,aAAa,MAD9B,mBAAmB,QAAQ,OAAO,CACI;CAC7D,MAAM,WAAgD,CAAC;CAOvD,KAAK,MAAM,UAAU,KAAK,mBAAmB;EACzC,MAAM,UACF,aAAa,OAAO,MAAM,KAAK,OAAO,OAAO,QAAQ,OAAO,SAAS,kMAGrD,OAAO,OAAO;EAClC,OAAO,KAAK,YAAY,SAAS;EACjC,MAAM,OAAO;CACjB;CAEA,IAAI,KAAK,QAAQ,WAAW,GAAG;EAC3B,MAAM,0CAA0C;EAChD,OAAO;GAAE,GAAG;GAAM;EAAS;CAC/B;CAEA,KAAK,MAAM,UAAU,KAAK,SACtB,IAAI;EACA,MAAM,OAAO,MAAM,OAAO,GAAG;EAC7B,MAAM,GAAG,OAAO,KAAK,IAAI,OAAO,QAAQ;CAC5C,SAAS,KAAK;EACV,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EAK/D,IAAI,OAAO,SAAS,kBAAkB;GAClC,SAAS,KAAK;IAAE,QAAQ,OAAO;IAAQ,OAAO;GAAQ,CAAC;GACvD;EACJ;EACA,MAAM,IAAI,MACN,aAAa,OAAO,KAAK,GAAG,OAAO,OAAO,IAAI,QAAQ,MAAM,OAAO,KACvE;CACJ;CAEJ,OAAO;EAAE,GAAG;EAAM;CAAS;AAC/B"}

package/dist/policy-CeA1JcxP.js

@@ -1,105 +0,0 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-__createRequire(import.meta.url);
-//#region ../types/src/types/policy.ts
-/**
-* The id a request without a logged-in user reports as `auth.uid()`.
-*
-* A user-context request always sets `app.uid`: blank would read back as
-* `NULL`, and `NULL` is how the trusted server context is recognised, so an
-* anonymous visitor would be promoted to server privileges. The driver
-* therefore substitutes this sentinel at the single chokepoint where the GUC
-* is set.
-*
-* The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
-* tautology on the user path** — it is true for anonymous visitors too. Use
-* {@link policy.authenticated} to mean "signed in", and
-* {@link policy.serverContext} to mean "the trusted server context". Do not
-* hand-write the comparison: see {@link ANONYMOUS_USER_IDS} for why one
-* literal is not enough.
-*
-* @group Models
-*/
-var ANONYMOUS_USER_ID = "anonymous";
-/**
-* Every uid that has ever meant "nobody is signed in" — newest first.
-*
-* There are two because there were two. The types, the policy compiler, the
-* JavaScript evaluator and the linter were all built on
-* {@link ANONYMOUS_USER_ID}, while the request path scoped unauthenticated
-* callers as `'anon'` — so `policy.authenticated()`, which compiled to
-* `auth.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The
-* sanctioned way to write "signed in" granted to everyone, and the linter
-* flagged the spelling that actually worked as a foreign convention.
-*
-* The request path now reports {@link ANONYMOUS_USER_ID}. `'anon'` stays here
-* because policies outlive the server that generated them: a database still
-* holding policies from before the fix, or a project whose server has not been
-* upgraded yet, must not become a grant in either direction. Compile against
-* this list, not against a single literal.
-*
-* No real user id is ever one of these, so a match is always "not signed in".
-*
-* @group Models
-*/
-var ANONYMOUS_USER_IDS = [ANONYMOUS_USER_ID, "anon"];
-/** @group Models */
-var policy = {
-	true: () => ({ kind: "true" }),
-	false: () => ({ kind: "false" }),
-	and: (...operands) => ({
-		kind: "and",
-		operands
-	}),
-	or: (...operands) => ({
-		kind: "or",
-		operands
-	}),
-	not: (operand) => ({
-		kind: "not",
-		operand
-	}),
-	compare: (left, op, right) => ({
-		kind: "compare",
-		op,
-		left,
-		right
-	}),
-	rolesOverlap: (roles) => ({
-		kind: "rolesOverlap",
-		roles
-	}),
-	rolesContain: (roles) => ({
-		kind: "rolesContain",
-		roles
-	}),
-	authenticated: () => ({ kind: "authenticated" }),
-	serverContext: () => ({ kind: "serverContext" }),
-	existsIn: (args) => ({
-		kind: "existsIn",
-		collection: args.collection,
-		where: args.where
-	}),
-	raw: (sql) => ({
-		kind: "raw",
-		sql
-	}),
-	field: (name) => ({
-		kind: "field",
-		name
-	}),
-	outerField: (name) => ({
-		kind: "outerField",
-		name
-	}),
-	literal: (value) => ({
-		kind: "literal",
-		value
-	}),
-	authUid: () => ({ kind: "authUid" }),
-	authRoles: () => ({ kind: "authRoles" })
-};
-//#endregion
-export { ANONYMOUS_USER_IDS as n, policy as r, ANONYMOUS_USER_ID as t };
-
-//# sourceMappingURL=policy-CeA1JcxP.js.map

package/dist/policy-CeA1JcxP.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-CeA1JcxP.js","names":[],"sources":["../../types/src/types/policy.ts"],"sourcesContent":["/**\n * Structured, engine-agnostic policy expressions.\n *\n * A {@link PolicyExpression} is the single source of truth for a row-level\n * security condition. It is compiled to Postgres `USING`/`WITH CHECK` SQL\n * (authoritative enforcement) and independently evaluated in JavaScript (to\n * drive the admin UI, and — in future — to enforce on engines without native\n * RLS such as MongoDB). Because both the SQL and the JS decision derive from\n * the *same* expression, the UI matches database enforcement by construction —\n * no drift between two hand-written implementations.\n *\n * The only escape hatch that cannot be evaluated client-side is the\n * {@link RawPolicyExpression} node (`{ kind: \"raw\" }`): it preserves full\n * PostgreSQL power but, being arbitrary SQL, is treated as *unknown* by the\n * JavaScript evaluator (never silently allowed) and reflected exactly in the UI\n * via server-computed capability flags.\n *\n * @group Models\n */\nexport type PolicyExpression =\n    | TruePolicyExpression\n    | FalsePolicyExpression\n    | AndPolicyExpression\n    | OrPolicyExpression\n    | NotPolicyExpression\n    | ComparePolicyExpression\n    | RolesOverlapPolicyExpression\n    | RolesContainPolicyExpression\n    | AuthenticatedPolicyExpression\n    | ServerContextPolicyExpression\n    | ExistsInPolicyExpression\n    | RawPolicyExpression;\n\n/**\n * The id a request without a logged-in user reports as `auth.uid()`.\n *\n * A user-context request always sets `app.uid`: blank would read back as\n * `NULL`, and `NULL` is how the trusted server context is recognised, so an\n * anonymous visitor would be promoted to server privileges. The driver\n * therefore substitutes this sentinel at the single chokepoint where the GUC\n * is set.\n *\n * The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a\n * tautology on the user path** — it is true for anonymous visitors too. Use\n * {@link policy.authenticated} to mean \"signed in\", and\n * {@link policy.serverContext} to mean \"the trusted server context\". Do not\n * hand-write the comparison: see {@link ANONYMOUS_USER_IDS} for why one\n * literal is not enough.\n *\n * @group Models\n */\nexport const ANONYMOUS_USER_ID = \"anonymous\";\n\n/**\n * Every uid that has ever meant \"nobody is signed in\" — newest first.\n *\n * There are two because there were two. The types, the policy compiler, the\n * JavaScript evaluator and the linter were all built on\n * {@link ANONYMOUS_USER_ID}, while the request path scoped unauthenticated\n * callers as `'anon'` — so `policy.authenticated()`, which compiled to\n * `auth.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The\n * sanctioned way to write \"signed in\" granted to everyone, and the linter\n * flagged the spelling that actually worked as a foreign convention.\n *\n * The request path now reports {@link ANONYMOUS_USER_ID}. `'anon'` stays here\n * because policies outlive the server that generated them: a database still\n * holding policies from before the fix, or a project whose server has not been\n * upgraded yet, must not become a grant in either direction. Compile against\n * this list, not against a single literal.\n *\n * No real user id is ever one of these, so a match is always \"not signed in\".\n *\n * @group Models\n */\nexport const ANONYMOUS_USER_IDS: readonly string[] = [ANONYMOUS_USER_ID, \"anon\"];\n\n/**\n * Whether a uid stands for \"no one is signed in\", in any spelling rebase has\n * used. `null`/`undefined` is the trusted server context, not an anonymous\n * caller, and is therefore **not** anonymous — see {@link ANONYMOUS_USER_ID}.\n *\n * @group Models\n */\nexport function isAnonymousUid(uid: string | null | undefined): boolean {\n    return typeof uid === \"string\" && ANONYMOUS_USER_IDS.includes(uid);\n}\n\n/** Always allows. Compiles to `true`. @group Models */\nexport interface TruePolicyExpression {\n    kind: \"true\";\n}\n\n/** Always denies. Compiles to `false`. @group Models */\nexport interface FalsePolicyExpression {\n    kind: \"false\";\n}\n\n/** Logical AND — every operand must pass. @group Models */\nexport interface AndPolicyExpression {\n    kind: \"and\";\n    operands: readonly PolicyExpression[];\n}\n\n/** Logical OR — at least one operand must pass. @group Models */\nexport interface OrPolicyExpression {\n    kind: \"or\";\n    operands: readonly PolicyExpression[];\n}\n\n/** Logical negation. @group Models */\nexport interface NotPolicyExpression {\n    kind: \"not\";\n    operand: PolicyExpression;\n}\n\n/** Comparison operators available to {@link ComparePolicyExpression}. @group Models */\nexport type PolicyCompareOperator = \"eq\" | \"neq\" | \"lt\" | \"lte\" | \"gt\" | \"gte\";\n\n/**\n * Compares two operands, e.g. `owner_id = auth.uid()`.\n * @group Models\n */\nexport interface ComparePolicyExpression {\n    kind: \"compare\";\n    op: PolicyCompareOperator;\n    left: PolicyOperand;\n    right: PolicyOperand;\n}\n\n/**\n * True when the user holds *at least one* of the given application roles.\n * Compiles to `string_to_array(auth.roles(), ',') && ARRAY[...]`.\n * @group Models\n */\nexport interface RolesOverlapPolicyExpression {\n    kind: \"rolesOverlap\";\n    roles: readonly string[];\n}\n\n/**\n * True when the user holds *all* of the given application roles.\n * Compiles to `string_to_array(auth.roles(), ',') @> ARRAY[...]`.\n * @group Models\n */\nexport interface RolesContainPolicyExpression {\n    kind: \"rolesContain\";\n    roles: readonly string[];\n}\n\n/**\n * True when a signed-in user is making the request. Compiles to\n * `auth.uid() IS NOT NULL AND auth.uid() <> 'anonymous'`.\n *\n * Both halves are load-bearing. `IS NOT NULL` excludes the server context;\n * the {@link ANONYMOUS_USER_ID} comparison excludes anonymous visitors, who\n * *do* carry a non-null `auth.uid()`. Checking only `IS NOT NULL` grants to\n * everyone — see {@link ANONYMOUS_USER_ID}.\n *\n * `policy.not(policy.authenticated())` therefore means \"anonymous visitor or\n * the server context\". To single out the server context, use\n * {@link ServerContextPolicyExpression}.\n * @group Models\n */\nexport interface AuthenticatedPolicyExpression {\n    kind: \"authenticated\";\n}\n\n/**\n * True only in the trusted **server context** — the built-in flows that run\n * without a user (signup, migrations, `dataAsAdmin`) set no user GUC, so\n * `auth.uid()` is `NULL` for them and only for them. Compiles to\n * `auth.uid() IS NULL`.\n *\n * This is what lets the owner connection satisfy a policy even under FORCE RLS.\n * It is deliberately a primitive rather than `not(authenticated())`: the two\n * meant the same thing while `authenticated` ignored {@link ANONYMOUS_USER_ID},\n * and conflating them is what turns a server-only grant into an anonymous one.\n *\n * The JavaScript evaluator always returns `false` for this node — a client is\n * never the server context.\n * @group Models\n */\nexport interface ServerContextPolicyExpression {\n    kind: \"serverContext\";\n}\n\n/**\n * Membership / relational access: true when at least one row exists in another\n * collection (a join/membership table) matching `where`. This is what lets you\n * scope reads to \"rows whose team the caller belongs to\" without an N+1\n * per-row lookup — it compiles to a single correlated `EXISTS` subquery.\n *\n * Inside `where`, {@link FieldPolicyOperand} (`policy.field`) references a column\n * of the joined collection, while {@link OuterFieldPolicyOperand}\n * (`policy.outerField`) references a column of the row being checked (the outer\n * table under RLS). Combine with {@link AuthUidPolicyOperand} to correlate to\n * the caller.\n *\n * @example\n * ```ts\n * // documents visible only to members of the document's team:\n * policy.existsIn({\n *   collection: \"team_members\",\n *   where: policy.and(\n *     policy.compare(policy.field(\"team_id\"), \"eq\", policy.outerField(\"team_id\")),\n *     policy.compare(policy.field(\"user_id\"), \"eq\", policy.authUid()),\n *   ),\n * })\n * // → EXISTS (SELECT 1 FROM team_members _ex0\n * //           WHERE _ex0.team_id = documents.team_id AND _ex0.user_id = auth.uid())\n * ```\n *\n * Postgres-authoritative: like {@link RawPolicyExpression}, the JavaScript\n * evaluator treats it as *unknown* (it cannot run a subquery client-side), so\n * enforcement is always the database's.\n * @group Models\n */\nexport interface ExistsInPolicyExpression {\n    kind: \"existsIn\";\n    /** Slug of the collection to search (the join / membership table). */\n    collection: string;\n    /** Condition evaluated against the joined collection's rows. */\n    where: PolicyExpression;\n}\n\n/**\n * A raw PostgreSQL boolean expression — the full-power escape hatch.\n *\n * Columns can be referenced as `{column_name}`. This is Postgres-only and\n * **server-authoritative**: the JavaScript evaluator cannot evaluate arbitrary\n * SQL, so it treats this node as *unknown* rather than guessing.\n * @group Models\n */\nexport interface RawPolicyExpression {\n    kind: \"raw\";\n    sql: string;\n}\n\n/**\n * An operand referenced by a {@link ComparePolicyExpression}.\n * @group Models\n */\nexport type PolicyOperand =\n    | FieldPolicyOperand\n    | OuterFieldPolicyOperand\n    | LiteralPolicyOperand\n    | AuthUidPolicyOperand\n    | AuthRolesPolicyOperand;\n\n/** A column value on the row being evaluated. @group Models */\nexport interface FieldPolicyOperand {\n    kind: \"field\";\n    /** The property/column name (resolved to its DB column when compiled). */\n    name: string;\n}\n\n/**\n * A column value on the *outer* row when used inside {@link ExistsInPolicyExpression}\n * — i.e. the row the RLS policy is being evaluated for, referenced from within the\n * subquery. Outside an `existsIn` it is equivalent to {@link FieldPolicyOperand}.\n * @group Models\n */\nexport interface OuterFieldPolicyOperand {\n    kind: \"outerField\";\n    /** The property/column name on the outer collection. */\n    name: string;\n}\n\n/** A constant value. @group Models */\nexport interface LiteralPolicyOperand {\n    kind: \"literal\";\n    value: string | number | boolean | null;\n}\n\n/** The current user's id — compiles to `auth.uid()`. @group Models */\nexport interface AuthUidPolicyOperand {\n    kind: \"authUid\";\n}\n\n/**\n * The current user's roles as an array — compiles to\n * `string_to_array(auth.roles(), ',')`.\n * @group Models\n */\nexport interface AuthRolesPolicyOperand {\n    kind: \"authRoles\";\n}\n\n// ── Constructor helpers ──────────────────────────────────────────────\n// Small, dependency-free builders so callers (and the desugaring in\n// `@rebasepro/common`) can assemble expressions without object-literal noise.\n\n/** @group Models */\nexport const policy = {\n    true: (): TruePolicyExpression => ({ kind: \"true\" }),\n    false: (): FalsePolicyExpression => ({ kind: \"false\" }),\n    and: (...operands: readonly PolicyExpression[]): AndPolicyExpression => ({ kind: \"and\",\noperands: operands as PolicyExpression[] }),\n    or: (...operands: readonly PolicyExpression[]): OrPolicyExpression => ({ kind: \"or\",\noperands: operands as PolicyExpression[] }),\n    not: (operand: PolicyExpression): NotPolicyExpression => ({ kind: \"not\",\noperand }),\n    compare: (left: PolicyOperand, op: PolicyCompareOperator, right: PolicyOperand): ComparePolicyExpression =>\n        ({ kind: \"compare\",\nop,\nleft,\nright }),\n    rolesOverlap: (roles: readonly string[]): RolesOverlapPolicyExpression => ({ kind: \"rolesOverlap\",\nroles: roles as string[] }),\n    rolesContain: (roles: readonly string[]): RolesContainPolicyExpression => ({ kind: \"rolesContain\",\nroles: roles as string[] }),\n    authenticated: (): AuthenticatedPolicyExpression => ({ kind: \"authenticated\" }),\n    serverContext: (): ServerContextPolicyExpression => ({ kind: \"serverContext\" }),\n    existsIn: (args: { collection: string; where: PolicyExpression }): ExistsInPolicyExpression =>\n        ({ kind: \"existsIn\",\ncollection: args.collection,\nwhere: args.where }),\n    raw: (sql: string): RawPolicyExpression => ({ kind: \"raw\",\nsql }),\n    field: (name: string): FieldPolicyOperand => ({ kind: \"field\",\nname }),\n    outerField: (name: string): OuterFieldPolicyOperand => ({ kind: \"outerField\",\nname }),\n    literal: (value: string | number | boolean | null): LiteralPolicyOperand => ({ kind: \"literal\",\nvalue }),\n    authUid: (): AuthUidPolicyOperand => ({ kind: \"authUid\" }),\n    authRoles: (): AuthRolesPolicyOperand => ({ kind: \"authRoles\" })\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmDA,IAAa,oBAAoB;;;;;;;;;;;;;;;;;;;;;;AAuBjC,IAAa,qBAAwC,CAAC,mBAAmB,MAAM;;AA2N/E,IAAa,SAAS;CAClB,aAAmC,EAAE,MAAM,OAAO;CAClD,cAAqC,EAAE,MAAM,QAAQ;CACrD,MAAM,GAAG,cAAgE;EAAE,MAAM;EAC3E;CAA+B;CACrC,KAAK,GAAG,cAA+D;EAAE,MAAM;EACzE;CAA+B;CACrC,MAAM,aAAoD;EAAE,MAAM;EACtE;CAAQ;CACJ,UAAU,MAAqB,IAA2B,WACrD;EAAE,MAAM;EACjB;EACA;EACA;CAAM;CACF,eAAe,WAA4D;EAAE,MAAM;EAChF;CAAkB;CACrB,eAAe,WAA4D;EAAE,MAAM;EAChF;CAAkB;CACrB,sBAAqD,EAAE,MAAM,gBAAgB;CAC7E,sBAAqD,EAAE,MAAM,gBAAgB;CAC7E,WAAW,UACN;EAAE,MAAM;EACjB,YAAY,KAAK;EACjB,OAAO,KAAK;CAAM;CACd,MAAM,SAAsC;EAAE,MAAM;EACxD;CAAI;CACA,QAAQ,UAAsC;EAAE,MAAM;EAC1D;CAAK;CACD,aAAa,UAA2C;EAAE,MAAM;EACpE;CAAK;CACD,UAAU,WAAmE;EAAE,MAAM;EACzF;CAAM;CACF,gBAAsC,EAAE,MAAM,UAAU;CACxD,kBAA0C,EAAE,MAAM,YAAY;AAClE"}

package/dist/schema/auth-bootstrap-sql.d.ts

@@ -1,24 +0,0 @@
-/**
- * Canonical SQL bootstrap for the `auth` schema and its RLS helper functions.
- *
- * Generated RLS policies reference `auth.uid()` / `auth.roles()` /
- * `auth.jwt()`, so any SQL stream that can contain policies must be
- * self-contained: it has to (re)create these helpers first. This matters for
- * the migration directory in particular — Atlas replays migrations against a
- * clean dev database where no out-of-band bootstrap has ever run, so a
- * migration carrying policies without this preamble fails with
- * "function auth.uid() does not exist".
- *
- * Idempotent (`IF NOT EXISTS` / `OR REPLACE`) so it can be prepended to every
- * policies block and re-applied freely. The runtime boot path
- * (`auth/ensure-tables.ts`) creates the same functions under an advisory lock
- * for HMR-safety; keep the definitions in sync.
- *
- * Deliberately does NOT create the `rebase` schema: that is runtime plumbing
- * (Atlas revision table, auth tables) created directly against the target
- * database. Creating it here would leak it into Atlas's replayed migration
- * state — absent from the desired `schema.sql`, Atlas would then plan
- * `DROP SCHEMA "rebase" CASCADE` on the next diff. The `auth` schema is safe
- * because the generated schema.sql declares it.
- */
-export declare const AUTH_BOOTSTRAP_SQL = "-- Auth schema + RLS helper functions (required by the policies below)\nCREATE SCHEMA IF NOT EXISTS auth;\n\n-- Falls back to the pre-rename `app.user_id` so a database that has taken the\n-- new schema but is still served by an older backend keeps resolving the\n-- principal. Drop the COALESCE once no such deployment remains.\nCREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.uid', true), ''),\n        NULLIF(current_setting('app.user_id', true), '')\n    );\n$$ LANGUAGE sql STABLE;\n\nCREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.jwt', true), ''),\n        '{}'\n    )::jsonb;\n$$ LANGUAGE sql STABLE;\n\nCREATE OR REPLACE FUNCTION auth.roles() RETURNS text AS $$\n    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');\n$$ LANGUAGE sql STABLE;\n";