@rebasepro/server-postgres 0.13.1-canary.gef9608c → 0.14.0

package/dist/rls-bootstrap-sql-69hYT8nr.js

@@ -0,0 +1,244 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { c as __exportAll } from "./connection-BuZ97wsr.js";
+import { n as REBASE_SCHEMA, t as LEGACY_RLS_SCHEMA } from "./src-DCdn3Val.js";
+//#region src/schema/rls-bootstrap-sql.ts
+var rls_bootstrap_sql_exports = /* @__PURE__ */ __exportAll({
+	DROP_LEGACY_AUTH_SCHEMA_SQL: () => DROP_LEGACY_AUTH_SCHEMA_SQL,
+	LEGACY_RLS_DEPENDENTS_SQL: () => LEGACY_RLS_DEPENDENTS_SQL,
+	LEGACY_RLS_FUNCTION_DEPENDENTS_SQL: () => LEGACY_RLS_FUNCTION_DEPENDENTS_SQL,
+	RLS_BOOTSTRAP_STATEMENTS: () => RLS_BOOTSTRAP_STATEMENTS,
+	dropLegacyAuthSchema: () => dropLegacyAuthSchema
+});
+/**
+* Canonical SQL bootstrap for the RLS helper functions.
+*
+* Generated RLS policies reference `rebase.uid()` / `rebase.roles()` /
+* `rebase.jwt()`, so any SQL stream that can contain policies must be
+* self-contained: it has to (re)create these helpers first. This matters for
+* the migration directory in particular — Atlas replays migrations against a
+* clean dev database where no out-of-band bootstrap has ever run, so a
+* migration carrying policies without this preamble fails with
+* "function rebase.uid() does not exist".
+*
+* Idempotent (`IF NOT EXISTS` / `OR REPLACE`) so it can be prepended to every
+* policies block and re-applied freely. The runtime boot path
+* (`auth/ensure-tables.ts`) creates the same functions under an advisory lock
+* for HMR-safety; keep the definitions in sync.
+*
+* ## Creating the `rebase` schema here is now safe, and required
+*
+* It deliberately did not, once. These functions lived in a schema called
+* `auth`, and the note here read: creating `rebase` would leak it into Atlas's
+* replayed migration state, and — absent from the desired `schema.sql` — Atlas
+* would then plan `DROP SCHEMA "rebase" CASCADE`, taking the auth tables with
+* it. That reasoning still holds; what changed is the second half of it. The
+* DDL generator now emits `CREATE SCHEMA IF NOT EXISTS "rebase"`
+* unconditionally, so the schema is always in the desired state and the diff is
+* empty. (It used to appear only when some collection happened to declare
+* `schema: "rebase"` — true for the scaffold's users collection, and not a
+* property anything guaranteed.) `db push` additionally excludes the whole
+* schema from the declarative apply.
+*
+* See `@rebasepro/types`' `rls-functions` for why the functions moved out of
+* `auth` at all: the short version is that the name was Supabase's, and
+* `CREATE OR REPLACE FUNCTION auth.uid() RETURNS text` cannot be applied over
+* Supabase's `RETURNS uuid` — Postgres refuses, and the refusal used to be
+* swallowed.
+*/
+/**
+* The bootstrap as individual statements.
+*
+* Kept as an array because the two consumers need different shapes and only one
+* of them can take a multi-command string: the migration preamble is written to
+* a file and replayed by Atlas, but the boot path runs through drizzle, whose
+* node-postgres handle speaks the extended query protocol and rejects more than
+* one command per call. Splitting a joined string back apart on `$$;` would be
+* a parser for a problem that does not need one.
+*/
+var RLS_BOOTSTRAP_STATEMENTS = [
+	`CREATE SCHEMA IF NOT EXISTS ${REBASE_SCHEMA}`,
+	`CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.uid() RETURNS text AS $$
+    SELECT COALESCE(
+        NULLIF(current_setting('app.uid', true), ''),
+        NULLIF(current_setting('app.user_id', true), '')
+    );
+$$ LANGUAGE sql STABLE`,
+	`CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.jwt() RETURNS jsonb AS $$
+    SELECT COALESCE(
+        NULLIF(current_setting('app.jwt', true), ''),
+        '{}'
+    )::jsonb;
+$$ LANGUAGE sql STABLE`,
+	`CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.roles() RETURNS text AS $$
+    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');
+$$ LANGUAGE sql STABLE`
+];
+"" + RLS_BOOTSTRAP_STATEMENTS.map((s) => `${s};`).join("\n\n");
+/**
+* Removes the pre-1.0 `auth` schema, but only when Rebase is what put it there.
+*
+* ## Why this is safe against a Supabase database
+*
+* Two independent guards, and both have to pass:
+*
+*  1. **Each function is identified before it is dropped.** Ours returns `text`
+*     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads
+*     `request.jwt.claims`. Nothing is dropped on a signature we did not write,
+*     so a Supabase database — where our `CREATE OR REPLACE` could never have
+*     succeeded in the first place, Postgres refusing to change a return type —
+*     matches nothing and this is a no-op.
+*  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still
+*     lives in `auth` (Supabase's `users` table, its other helpers), the drop
+*     fails and the schema stays. CASCADE here would be unrecoverable.
+*
+* ## Why it cannot run too early
+*
+* Postgres records a dependency from every RLS policy to the functions its body
+* calls, so `DROP FUNCTION auth.uid()` fails for as long as a single policy
+* still references it. That is the interlock, and it is load-bearing: the drop
+* can only succeed once every policy has been recompiled to \`rebase.uid()\`.
+* Callers therefore run this *after* applying policies, and treat a failure as
+* "not yet — try again next boot" rather than as an error.
+*/
+var DROP_LEGACY_AUTH_SCHEMA_SQL = `
+DO $rebase_drop_legacy$
+DECLARE
+    dropped_any boolean := false;
+BEGIN
+    -- Each function is matched on its own result type and body, so a schema
+    -- that merely shares the name keeps everything it has.
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'uid'
+          AND pg_get_function_result(p.oid) = 'text'
+          AND p.prosrc LIKE '%app.uid%'
+    ) THEN
+        DROP FUNCTION auth.uid();
+        dropped_any := true;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'jwt'
+          AND pg_get_function_result(p.oid) = 'jsonb'
+          AND p.prosrc LIKE '%app.jwt%'
+    ) THEN
+        DROP FUNCTION auth.jwt();
+        dropped_any := true;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'roles'
+          AND pg_get_function_result(p.oid) = 'text'
+          AND p.prosrc LIKE '%app.user_roles%'
+    ) THEN
+        DROP FUNCTION auth.roles();
+        dropped_any := true;
+    END IF;
+
+    -- RESTRICT: only an empty schema goes. Anything else in there — including a
+    -- Supabase installation left untouched above — keeps it.
+    IF dropped_any THEN
+        BEGIN
+            EXECUTE 'DROP SCHEMA auth RESTRICT';
+        EXCEPTION WHEN OTHERS THEN
+            NULL;
+        END;
+    END IF;
+END
+$rebase_drop_legacy$;
+`;
+/**
+* Policies whose body still calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
+*
+* Postgres will not drop a function a policy depends on, so this is exactly the
+* set standing between a database and losing the legacy schema. Rebase's own
+* policies leave the list on the next push or boot, when they are recompiled —
+* anything still here afterwards is hand-written, will never be recompiled by
+* anybody, and is the reason the drop keeps being skipped. Silence there would
+* leave an operator staring at a schema the release notes said would go.
+*/
+var LEGACY_RLS_DEPENDENTS_SQL = `
+    SELECT n.nspname AS schema, c.relname AS "table", p.polname AS policy
+    FROM pg_policy p
+    JOIN pg_class c ON c.oid = p.polrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE pg_get_expr(p.polqual, p.polrelid) ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+       OR pg_get_expr(p.polwithcheck, p.polrelid) ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+    ORDER BY 1, 2, 3
+`;
+/**
+* Functions whose body calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
+*
+* This is the half `DROP FUNCTION ... RESTRICT` cannot see, and the reason it
+* needs its own query. Postgres records a dependency for a *policy* that calls a
+* function, which is why the drop is safe against the policies above — but a
+* `LANGUAGE sql` function whose body is a **string literal** is not parsed when
+* it is created, so nothing is recorded and `RESTRICT` has nothing to refuse on.
+* The drop succeeds and the caller is left pointing at a function that no longer
+* exists, which fails at *query* time rather than at boot.
+*
+* A downstream project building on these helpers is not hypothetical: the Rebase
+* control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`
+* in this very schema, each calling `auth.uid()` in a string body, and eleven of
+* its row-level-security policies go through them. Every one of those would have
+* started failing the first time a recompile left no policy referencing
+* `auth.uid()` directly — the drop's own precondition.
+*
+* Matching on the body text is the only option available, and it is deliberately
+* broad: a false positive costs a schema that stays one release longer and says
+* why, while a false negative costs somebody their policies.
+*/
+var LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = `
+    SELECT n.nspname AS schema, p.proname AS function
+    FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+      AND NOT (n.nspname = '${LEGACY_RLS_SCHEMA}' AND p.proname IN ('uid', 'jwt', 'roles'))
+      AND p.prosrc ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+    ORDER BY 1, 2
+`;
+/**
+* Retire the pre-1.0 `auth` schema, reporting what is holding it back.
+*
+* The shared implementation behind the CLI's post-push step and the runtime's
+* post-policy step. Both used to just fire {@link DROP_LEGACY_AUTH_SCHEMA_SQL}
+* and swallow whatever came back, which is right for the ordinary case — a
+* table not recompiled *yet* — and wrong for the one that never resolves: a
+* hand-written policy nothing will ever rewrite. Then the schema stays forever
+* and nothing ever says why.
+*/
+async function dropLegacyAuthSchema(run, report) {
+	let blockers;
+	try {
+		blockers = await run(LEGACY_RLS_DEPENDENTS_SQL);
+	} catch {
+		return;
+	}
+	if (blockers.length > 0) {
+		report.warn(`The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${blockers.length} ${blockers.length === 1 ? "policy still calls" : "policies still call"} \`${LEGACY_RLS_SCHEMA}.uid()\` and friends, and Postgres will not drop a function a policy depends on. Rebase's own policies are rewritten automatically — anything listed here is hand-written SQL that has to be updated to \`${REBASE_SCHEMA}.uid()\` by hand, after which the schema goes on its own:\n` + blockers.map((b) => `  • ${b.schema}.${b.table} → "${b.policy}"`).join("\n"));
+		return;
+	}
+	let borrowers;
+	try {
+		borrowers = await run(LEGACY_RLS_FUNCTION_DEPENDENTS_SQL);
+	} catch {
+		return;
+	}
+	if (borrowers.length > 0) {
+		report.warn(`The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${borrowers.length} ${borrowers.length === 1 ? "function calls" : "functions call"} \`${LEGACY_RLS_SCHEMA}.uid()\` and friends from its own body. Postgres records no dependency for that — a SQL body written as a string literal is never parsed — so dropping the helpers would leave these pointing at nothing, and they would fail when a query reached them rather than now. Repoint them at \`${REBASE_SCHEMA}.uid()\`, after which the schema goes on its own:\n` + borrowers.map((b) => `  • ${b.schema}.${b.function}()`).join("\n"));
+		return;
+	}
+	try {
+		await run(DROP_LEGACY_AUTH_SCHEMA_SQL);
+	} catch (err) {
+		report.info(`Left the \`${LEGACY_RLS_SCHEMA}\` schema in place: ` + (err instanceof Error ? err.message : String(err)));
+	}
+}
+//#endregion
+export { rls_bootstrap_sql_exports as n, RLS_BOOTSTRAP_STATEMENTS as t };
+
+//# sourceMappingURL=rls-bootstrap-sql-69hYT8nr.js.map

package/dist/rls-bootstrap-sql-69hYT8nr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-bootstrap-sql-69hYT8nr.js","names":[],"sources":["../src/schema/rls-bootstrap-sql.ts"],"sourcesContent":["import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA } from \"@rebasepro/types\";\n\n/**\n * Canonical SQL bootstrap for the RLS helper functions.\n *\n * Generated RLS policies reference `rebase.uid()` / `rebase.roles()` /\n * `rebase.jwt()`, so any SQL stream that can contain policies must be\n * self-contained: it has to (re)create these helpers first. This matters for\n * the migration directory in particular — Atlas replays migrations against a\n * clean dev database where no out-of-band bootstrap has ever run, so a\n * migration carrying policies without this preamble fails with\n * \"function rebase.uid() does not exist\".\n *\n * Idempotent (`IF NOT EXISTS` / `OR REPLACE`) so it can be prepended to every\n * policies block and re-applied freely. The runtime boot path\n * (`auth/ensure-tables.ts`) creates the same functions under an advisory lock\n * for HMR-safety; keep the definitions in sync.\n *\n * ## Creating the `rebase` schema here is now safe, and required\n *\n * It deliberately did not, once. These functions lived in a schema called\n * `auth`, and the note here read: creating `rebase` would leak it into Atlas's\n * replayed migration state, and — absent from the desired `schema.sql` — Atlas\n * would then plan `DROP SCHEMA \"rebase\" CASCADE`, taking the auth tables with\n * it. That reasoning still holds; what changed is the second half of it. The\n * DDL generator now emits `CREATE SCHEMA IF NOT EXISTS \"rebase\"`\n * unconditionally, so the schema is always in the desired state and the diff is\n * empty. (It used to appear only when some collection happened to declare\n * `schema: \"rebase\"` — true for the scaffold's users collection, and not a\n * property anything guaranteed.) `db push` additionally excludes the whole\n * schema from the declarative apply.\n *\n * See `@rebasepro/types`' `rls-functions` for why the functions moved out of\n * `auth` at all: the short version is that the name was Supabase's, and\n * `CREATE OR REPLACE FUNCTION auth.uid() RETURNS text` cannot be applied over\n * Supabase's `RETURNS uuid` — Postgres refuses, and the refusal used to be\n * swallowed.\n */\n/**\n * The bootstrap as individual statements.\n *\n * Kept as an array because the two consumers need different shapes and only one\n * of them can take a multi-command string: the migration preamble is written to\n * a file and replayed by Atlas, but the boot path runs through drizzle, whose\n * node-postgres handle speaks the extended query protocol and rejects more than\n * one command per call. Splitting a joined string back apart on `$$;` would be\n * a parser for a problem that does not need one.\n */\nexport const RLS_BOOTSTRAP_STATEMENTS: readonly string[] = [\n    `CREATE SCHEMA IF NOT EXISTS ${REBASE_SCHEMA}`,\n\n    // Falls back to the pre-rename `app.user_id` so a database that has taken\n    // the new schema but is still served by an older backend keeps resolving\n    // the principal. Drop the COALESCE once no such deployment remains.\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.uid() RETURNS text AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.uid', true), ''),\n        NULLIF(current_setting('app.user_id', true), '')\n    );\n$$ LANGUAGE sql STABLE`,\n\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.jwt() RETURNS jsonb AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.jwt', true), ''),\n        '{}'\n    )::jsonb;\n$$ LANGUAGE sql STABLE`,\n\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.roles() RETURNS text AS $$\n    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');\n$$ LANGUAGE sql STABLE`\n];\n\n/** The same statements as one script, for migration files and raw clients. */\nexport const RLS_BOOTSTRAP_SQL =\n    \"-- Rebase schema + RLS helper functions (required by the policies below)\\n\" +\n    RLS_BOOTSTRAP_STATEMENTS.map(s => `${s};`).join(\"\\n\\n\") + \"\\n\";\n\n/**\n * Removes the pre-1.0 `auth` schema, but only when Rebase is what put it there.\n *\n * ## Why this is safe against a Supabase database\n *\n * Two independent guards, and both have to pass:\n *\n *  1. **Each function is identified before it is dropped.** Ours returns `text`\n *     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads\n *     `request.jwt.claims`. Nothing is dropped on a signature we did not write,\n *     so a Supabase database — where our `CREATE OR REPLACE` could never have\n *     succeeded in the first place, Postgres refusing to change a return type —\n *     matches nothing and this is a no-op.\n *  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still\n *     lives in `auth` (Supabase's `users` table, its other helpers), the drop\n *     fails and the schema stays. CASCADE here would be unrecoverable.\n *\n * ## Why it cannot run too early\n *\n * Postgres records a dependency from every RLS policy to the functions its body\n * calls, so `DROP FUNCTION auth.uid()` fails for as long as a single policy\n * still references it. That is the interlock, and it is load-bearing: the drop\n * can only succeed once every policy has been recompiled to \\`rebase.uid()\\`.\n * Callers therefore run this *after* applying policies, and treat a failure as\n * \"not yet — try again next boot\" rather than as an error.\n */\nexport const DROP_LEGACY_AUTH_SCHEMA_SQL = `\nDO $rebase_drop_legacy$\nDECLARE\n    dropped_any boolean := false;\nBEGIN\n    -- Each function is matched on its own result type and body, so a schema\n    -- that merely shares the name keeps everything it has.\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'uid'\n          AND pg_get_function_result(p.oid) = 'text'\n          AND p.prosrc LIKE '%app.uid%'\n    ) THEN\n        DROP FUNCTION auth.uid();\n        dropped_any := true;\n    END IF;\n\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'jwt'\n          AND pg_get_function_result(p.oid) = 'jsonb'\n          AND p.prosrc LIKE '%app.jwt%'\n    ) THEN\n        DROP FUNCTION auth.jwt();\n        dropped_any := true;\n    END IF;\n\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'roles'\n          AND pg_get_function_result(p.oid) = 'text'\n          AND p.prosrc LIKE '%app.user_roles%'\n    ) THEN\n        DROP FUNCTION auth.roles();\n        dropped_any := true;\n    END IF;\n\n    -- RESTRICT: only an empty schema goes. Anything else in there — including a\n    -- Supabase installation left untouched above — keeps it.\n    IF dropped_any THEN\n        BEGIN\n            EXECUTE 'DROP SCHEMA auth RESTRICT';\n        EXCEPTION WHEN OTHERS THEN\n            NULL;\n        END;\n    END IF;\nEND\n$rebase_drop_legacy$;\n`;\n\n/** Somebody's policy that still calls a pre-1.0 helper. */\nexport interface LegacyRlsDependent {\n    schema: string;\n    table: string;\n    policy: string;\n}\n\n/**\n * Policies whose body still calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.\n *\n * Postgres will not drop a function a policy depends on, so this is exactly the\n * set standing between a database and losing the legacy schema. Rebase's own\n * policies leave the list on the next push or boot, when they are recompiled —\n * anything still here afterwards is hand-written, will never be recompiled by\n * anybody, and is the reason the drop keeps being skipped. Silence there would\n * leave an operator staring at a schema the release notes said would go.\n */\nexport const LEGACY_RLS_DEPENDENTS_SQL = `\n    SELECT n.nspname AS schema, c.relname AS \"table\", p.polname AS policy\n    FROM pg_policy p\n    JOIN pg_class c ON c.oid = p.polrelid\n    JOIN pg_namespace n ON n.oid = c.relnamespace\n    WHERE pg_get_expr(p.polqual, p.polrelid) ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n       OR pg_get_expr(p.polwithcheck, p.polrelid) ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n    ORDER BY 1, 2, 3\n`;\n\n/** Somebody's *function* that still calls a pre-1.0 helper from its own body. */\nexport interface LegacyRlsFunctionDependent {\n    schema: string;\n    function: string;\n}\n\n/**\n * Functions whose body calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.\n *\n * This is the half `DROP FUNCTION ... RESTRICT` cannot see, and the reason it\n * needs its own query. Postgres records a dependency for a *policy* that calls a\n * function, which is why the drop is safe against the policies above — but a\n * `LANGUAGE sql` function whose body is a **string literal** is not parsed when\n * it is created, so nothing is recorded and `RESTRICT` has nothing to refuse on.\n * The drop succeeds and the caller is left pointing at a function that no longer\n * exists, which fails at *query* time rather than at boot.\n *\n * A downstream project building on these helpers is not hypothetical: the Rebase\n * control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`\n * in this very schema, each calling `auth.uid()` in a string body, and eleven of\n * its row-level-security policies go through them. Every one of those would have\n * started failing the first time a recompile left no policy referencing\n * `auth.uid()` directly — the drop's own precondition.\n *\n * Matching on the body text is the only option available, and it is deliberately\n * broad: a false positive costs a schema that stays one release longer and says\n * why, while a false negative costs somebody their policies.\n */\nexport const LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = `\n    SELECT n.nspname AS schema, p.proname AS function\n    FROM pg_proc p\n    JOIN pg_namespace n ON n.oid = p.pronamespace\n    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')\n      AND NOT (n.nspname = '${LEGACY_RLS_SCHEMA}' AND p.proname IN ('uid', 'jwt', 'roles'))\n      AND p.prosrc ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n    ORDER BY 1, 2\n`;\n\n/**\n * Retire the pre-1.0 `auth` schema, reporting what is holding it back.\n *\n * The shared implementation behind the CLI's post-push step and the runtime's\n * post-policy step. Both used to just fire {@link DROP_LEGACY_AUTH_SCHEMA_SQL}\n * and swallow whatever came back, which is right for the ordinary case — a\n * table not recompiled *yet* — and wrong for the one that never resolves: a\n * hand-written policy nothing will ever rewrite. Then the schema stays forever\n * and nothing ever says why.\n */\nexport async function dropLegacyAuthSchema(\n    run: (sql: string) => Promise<Record<string, unknown>[]>,\n    report: { info: (m: string) => void; warn: (m: string) => void }\n): Promise<void> {\n    let blockers: LegacyRlsDependent[];\n    try {\n        blockers = (await run(LEGACY_RLS_DEPENDENTS_SQL)) as unknown as LegacyRlsDependent[];\n    } catch {\n        return; // No catalogue access; nothing here is worth failing a boot for.\n    }\n\n    if (blockers.length > 0) {\n        report.warn(\n            `The pre-1.0 \\`${LEGACY_RLS_SCHEMA}\\` schema cannot be removed yet: ${blockers.length} ` +\n            `${blockers.length === 1 ? \"policy still calls\" : \"policies still call\"} ` +\n            `\\`${LEGACY_RLS_SCHEMA}.uid()\\` and friends, and Postgres will not drop a function a policy ` +\n            `depends on. Rebase's own policies are ` +\n            `rewritten automatically — anything listed here is hand-written SQL that has to be updated to ` +\n            `\\`${REBASE_SCHEMA}.uid()\\` by hand, after which the schema goes on its own:\\n` +\n            blockers.map(b => `  • ${b.schema}.${b.table} → \"${b.policy}\"`).join(\"\\n\")\n        );\n        return;\n    }\n\n    // The half Postgres will not refuse on. See LEGACY_RLS_FUNCTION_DEPENDENTS_SQL:\n    // a string-literal SQL body records no dependency, so `DROP FUNCTION` drops\n    // out from under a caller that is still using it and nothing complains until\n    // a query runs.\n    let borrowers: LegacyRlsFunctionDependent[];\n    try {\n        borrowers = (await run(LEGACY_RLS_FUNCTION_DEPENDENTS_SQL)) as unknown as LegacyRlsFunctionDependent[];\n    } catch {\n        return;\n    }\n\n    if (borrowers.length > 0) {\n        report.warn(\n            `The pre-1.0 \\`${LEGACY_RLS_SCHEMA}\\` schema cannot be removed yet: ${borrowers.length} ` +\n            `${borrowers.length === 1 ? \"function calls\" : \"functions call\"} ` +\n            `\\`${LEGACY_RLS_SCHEMA}.uid()\\` and friends from its own body. Postgres records no dependency ` +\n            `for that — a SQL body written as a string literal is never parsed — so dropping the helpers ` +\n            `would leave these pointing at nothing, and they would fail when a query reached them rather ` +\n            `than now. Repoint them at \\`${REBASE_SCHEMA}.uid()\\`, after which the schema goes on its own:\\n` +\n            borrowers.map(b => `  • ${b.schema}.${b.function}()`).join(\"\\n\")\n        );\n        return;\n    }\n\n    try {\n        await run(DROP_LEGACY_AUTH_SCHEMA_SQL);\n    } catch (err) {\n        // Something else depends on it, or the connection does not own it.\n        // Not fatal: the schema is inert either way now that no policy calls it.\n        report.info(\n            `Left the \\`${LEGACY_RLS_SCHEMA}\\` schema in place: ` +\n            (err instanceof Error ? err.message : String(err))\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,IAAa,2BAA8C;CACvD,+BAA+B;CAK/B,8BAA8B,cAAc;;;;;;CAO5C,8BAA8B,cAAc;;;;;;CAO5C,8BAA8B,cAAc;;;AAGhD;AAII,KACA,yBAAyB,KAAI,MAAK,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4B1D,IAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmE3C,IAAa,4BAA4B;;;;;sDAKa,kBAAkB;2DACb,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;AAgC7E,IAAa,qCAAqC;;;;;8BAKpB,kBAAkB;4BACpB,kBAAkB;;;;;;;;;;;;;AAc9C,eAAsB,qBAClB,KACA,QACa;CACb,IAAI;CACJ,IAAI;EACA,WAAY,MAAM,IAAI,yBAAyB;CACnD,QAAQ;EACJ;CACJ;CAEA,IAAI,SAAS,SAAS,GAAG;EACrB,OAAO,KACH,iBAAiB,kBAAkB,mCAAmC,SAAS,OAAO,GACnF,SAAS,WAAW,IAAI,uBAAuB,sBAAsB,KACnE,kBAAkB,4MAGlB,cAAc,+DACnB,SAAS,KAAI,MAAK,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,IAAI,CAC7E;EACA;CACJ;CAMA,IAAI;CACJ,IAAI;EACA,YAAa,MAAM,IAAI,kCAAkC;CAC7D,QAAQ;EACJ;CACJ;CAEA,IAAI,UAAU,SAAS,GAAG;EACtB,OAAO,KACH,iBAAiB,kBAAkB,mCAAmC,UAAU,OAAO,GACpF,UAAU,WAAW,IAAI,mBAAmB,iBAAiB,KAC3D,kBAAkB,6RAGQ,cAAc,uDAC7C,UAAU,KAAI,MAAK,OAAO,EAAE,OAAO,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,IAAI,CACnE;EACA;CACJ;CAEA,IAAI;EACA,MAAM,IAAI,2BAA2B;CACzC,SAAS,KAAK;EAGV,OAAO,KACH,cAAc,kBAAkB,yBAC/B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACpD;CACJ;AACJ"}