@rebasepro/server-postgres 0.13.1-canary.gf57a27e → 0.14.0

package/dist/{rls-bootstrap-sql-Bpv3nUZo.js → rls-bootstrap-sql-69hYT8nr.js}

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
 import { c as __exportAll } from "./connection-BuZ97wsr.js";
-import { n as REBASE_SCHEMA, t as LEGACY_RLS_SCHEMA } from "./src-C_wvdMnl.js";
+import { n as REBASE_SCHEMA, t as LEGACY_RLS_SCHEMA } from "./src-DCdn3Val.js";
 //#region src/schema/rls-bootstrap-sql.ts
 var rls_bootstrap_sql_exports = /* @__PURE__ */ __exportAll({
 	DROP_LEGACY_AUTH_SCHEMA_SQL: () => DROP_LEGACY_AUTH_SCHEMA_SQL,
@@ -241,4 +241,4 @@ async function dropLegacyAuthSchema(run, report) {
 //#endregion
 export { rls_bootstrap_sql_exports as n, RLS_BOOTSTRAP_STATEMENTS as t };
 
-//# sourceMappingURL=rls-bootstrap-sql-Bpv3nUZo.js.map
+//# sourceMappingURL=rls-bootstrap-sql-69hYT8nr.js.map

package/dist/{rls-bootstrap-sql-Bpv3nUZo.js.map → rls-bootstrap-sql-69hYT8nr.js.map}

@@ -1 +1 @@
-{"version":3,"file":"rls-bootstrap-sql-Bpv3nUZo.js","names":[],"sources":["../src/schema/rls-bootstrap-sql.ts"],"sourcesContent":["import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA } from \"@rebasepro/types\";\n\n/**\n * Canonical SQL bootstrap for the RLS helper functions.\n *\n * Generated RLS policies reference `rebase.uid()` / `rebase.roles()` /\n * `rebase.jwt()`, so any SQL stream that can contain policies must be\n * self-contained: it has to (re)create these helpers first. This matters for\n * the migration directory in particular — Atlas replays migrations against a\n * clean dev database where no out-of-band bootstrap has ever run, so a\n * migration carrying policies without this preamble fails with\n * \"function rebase.uid() does not exist\".\n *\n * Idempotent (`IF NOT EXISTS` / `OR REPLACE`) so it can be prepended to every\n * policies block and re-applied freely. The runtime boot path\n * (`auth/ensure-tables.ts`) creates the same functions under an advisory lock\n * for HMR-safety; keep the definitions in sync.\n *\n * ## Creating the `rebase` schema here is now safe, and required\n *\n * It deliberately did not, once. These functions lived in a schema called\n * `auth`, and the note here read: creating `rebase` would leak it into Atlas's\n * replayed migration state, and — absent from the desired `schema.sql` — Atlas\n * would then plan `DROP SCHEMA \"rebase\" CASCADE`, taking the auth tables with\n * it. That reasoning still holds; what changed is the second half of it. The\n * DDL generator now emits `CREATE SCHEMA IF NOT EXISTS \"rebase\"`\n * unconditionally, so the schema is always in the desired state and the diff is\n * empty. (It used to appear only when some collection happened to declare\n * `schema: \"rebase\"` — true for the scaffold's users collection, and not a\n * property anything guaranteed.) `db push` additionally excludes the whole\n * schema from the declarative apply.\n *\n * See `@rebasepro/types`' `rls-functions` for why the functions moved out of\n * `auth` at all: the short version is that the name was Supabase's, and\n * `CREATE OR REPLACE FUNCTION auth.uid() RETURNS text` cannot be applied over\n * Supabase's `RETURNS uuid` — Postgres refuses, and the refusal used to be\n * swallowed.\n */\n/**\n * The bootstrap as individual statements.\n *\n * Kept as an array because the two consumers need different shapes and only one\n * of them can take a multi-command string: the migration preamble is written to\n * a file and replayed by Atlas, but the boot path runs through drizzle, whose\n * node-postgres handle speaks the extended query protocol and rejects more than\n * one command per call. Splitting a joined string back apart on `$$;` would be\n * a parser for a problem that does not need one.\n */\nexport const RLS_BOOTSTRAP_STATEMENTS: readonly string[] = [\n    `CREATE SCHEMA IF NOT EXISTS ${REBASE_SCHEMA}`,\n\n    // Falls back to the pre-rename `app.user_id` so a database that has taken\n    // the new schema but is still served by an older backend keeps resolving\n    // the principal. Drop the COALESCE once no such deployment remains.\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.uid() RETURNS text AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.uid', true), ''),\n        NULLIF(current_setting('app.user_id', true), '')\n    );\n$$ LANGUAGE sql STABLE`,\n\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.jwt() RETURNS jsonb AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.jwt', true), ''),\n        '{}'\n    )::jsonb;\n$$ LANGUAGE sql STABLE`,\n\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.roles() RETURNS text AS $$\n    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');\n$$ LANGUAGE sql STABLE`\n];\n\n/** The same statements as one script, for migration files and raw clients. */\nexport const RLS_BOOTSTRAP_SQL =\n    \"-- Rebase schema + RLS helper functions (required by the policies below)\\n\" +\n    RLS_BOOTSTRAP_STATEMENTS.map(s => `${s};`).join(\"\\n\\n\") + \"\\n\";\n\n/**\n * Removes the pre-1.0 `auth` schema, but only when Rebase is what put it there.\n *\n * ## Why this is safe against a Supabase database\n *\n * Two independent guards, and both have to pass:\n *\n *  1. **Each function is identified before it is dropped.** Ours returns `text`\n *     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads\n *     `request.jwt.claims`. Nothing is dropped on a signature we did not write,\n *     so a Supabase database — where our `CREATE OR REPLACE` could never have\n *     succeeded in the first place, Postgres refusing to change a return type —\n *     matches nothing and this is a no-op.\n *  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still\n *     lives in `auth` (Supabase's `users` table, its other helpers), the drop\n *     fails and the schema stays. CASCADE here would be unrecoverable.\n *\n * ## Why it cannot run too early\n *\n * Postgres records a dependency from every RLS policy to the functions its body\n * calls, so `DROP FUNCTION auth.uid()` fails for as long as a single policy\n * still references it. That is the interlock, and it is load-bearing: the drop\n * can only succeed once every policy has been recompiled to \\`rebase.uid()\\`.\n * Callers therefore run this *after* applying policies, and treat a failure as\n * \"not yet — try again next boot\" rather than as an error.\n */\nexport const DROP_LEGACY_AUTH_SCHEMA_SQL = `\nDO $rebase_drop_legacy$\nDECLARE\n    dropped_any boolean := false;\nBEGIN\n    -- Each function is matched on its own result type and body, so a schema\n    -- that merely shares the name keeps everything it has.\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'uid'\n          AND pg_get_function_result(p.oid) = 'text'\n          AND p.prosrc LIKE '%app.uid%'\n    ) THEN\n        DROP FUNCTION auth.uid();\n        dropped_any := true;\n    END IF;\n\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'jwt'\n          AND pg_get_function_result(p.oid) = 'jsonb'\n          AND p.prosrc LIKE '%app.jwt%'\n    ) THEN\n        DROP FUNCTION auth.jwt();\n        dropped_any := true;\n    END IF;\n\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'roles'\n          AND pg_get_function_result(p.oid) = 'text'\n          AND p.prosrc LIKE '%app.user_roles%'\n    ) THEN\n        DROP FUNCTION auth.roles();\n        dropped_any := true;\n    END IF;\n\n    -- RESTRICT: only an empty schema goes. Anything else in there — including a\n    -- Supabase installation left untouched above — keeps it.\n    IF dropped_any THEN\n        BEGIN\n            EXECUTE 'DROP SCHEMA auth RESTRICT';\n        EXCEPTION WHEN OTHERS THEN\n            NULL;\n        END;\n    END IF;\nEND\n$rebase_drop_legacy$;\n`;\n\n/** Somebody's policy that still calls a pre-1.0 helper. */\nexport interface LegacyRlsDependent {\n    schema: string;\n    table: string;\n    policy: string;\n}\n\n/**\n * Policies whose body still calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.\n *\n * Postgres will not drop a function a policy depends on, so this is exactly the\n * set standing between a database and losing the legacy schema. Rebase's own\n * policies leave the list on the next push or boot, when they are recompiled —\n * anything still here afterwards is hand-written, will never be recompiled by\n * anybody, and is the reason the drop keeps being skipped. Silence there would\n * leave an operator staring at a schema the release notes said would go.\n */\nexport const LEGACY_RLS_DEPENDENTS_SQL = `\n    SELECT n.nspname AS schema, c.relname AS \"table\", p.polname AS policy\n    FROM pg_policy p\n    JOIN pg_class c ON c.oid = p.polrelid\n    JOIN pg_namespace n ON n.oid = c.relnamespace\n    WHERE pg_get_expr(p.polqual, p.polrelid) ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n       OR pg_get_expr(p.polwithcheck, p.polrelid) ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n    ORDER BY 1, 2, 3\n`;\n\n/** Somebody's *function* that still calls a pre-1.0 helper from its own body. */\nexport interface LegacyRlsFunctionDependent {\n    schema: string;\n    function: string;\n}\n\n/**\n * Functions whose body calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.\n *\n * This is the half `DROP FUNCTION ... RESTRICT` cannot see, and the reason it\n * needs its own query. Postgres records a dependency for a *policy* that calls a\n * function, which is why the drop is safe against the policies above — but a\n * `LANGUAGE sql` function whose body is a **string literal** is not parsed when\n * it is created, so nothing is recorded and `RESTRICT` has nothing to refuse on.\n * The drop succeeds and the caller is left pointing at a function that no longer\n * exists, which fails at *query* time rather than at boot.\n *\n * A downstream project building on these helpers is not hypothetical: the Rebase\n * control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`\n * in this very schema, each calling `auth.uid()` in a string body, and eleven of\n * its row-level-security policies go through them. Every one of those would have\n * started failing the first time a recompile left no policy referencing\n * `auth.uid()` directly — the drop's own precondition.\n *\n * Matching on the body text is the only option available, and it is deliberately\n * broad: a false positive costs a schema that stays one release longer and says\n * why, while a false negative costs somebody their policies.\n */\nexport const LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = `\n    SELECT n.nspname AS schema, p.proname AS function\n    FROM pg_proc p\n    JOIN pg_namespace n ON n.oid = p.pronamespace\n    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')\n      AND NOT (n.nspname = '${LEGACY_RLS_SCHEMA}' AND p.proname IN ('uid', 'jwt', 'roles'))\n      AND p.prosrc ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n    ORDER BY 1, 2\n`;\n\n/**\n * Retire the pre-1.0 `auth` schema, reporting what is holding it back.\n *\n * The shared implementation behind the CLI's post-push step and the runtime's\n * post-policy step. Both used to just fire {@link DROP_LEGACY_AUTH_SCHEMA_SQL}\n * and swallow whatever came back, which is right for the ordinary case — a\n * table not recompiled *yet* — and wrong for the one that never resolves: a\n * hand-written policy nothing will ever rewrite. Then the schema stays forever\n * and nothing ever says why.\n */\nexport async function dropLegacyAuthSchema(\n    run: (sql: string) => Promise<Record<string, unknown>[]>,\n    report: { info: (m: string) => void; warn: (m: string) => void }\n): Promise<void> {\n    let blockers: LegacyRlsDependent[];\n    try {\n        blockers = (await run(LEGACY_RLS_DEPENDENTS_SQL)) as unknown as LegacyRlsDependent[];\n    } catch {\n        return; // No catalogue access; nothing here is worth failing a boot for.\n    }\n\n    if (blockers.length > 0) {\n        report.warn(\n            `The pre-1.0 \\`${LEGACY_RLS_SCHEMA}\\` schema cannot be removed yet: ${blockers.length} ` +\n            `${blockers.length === 1 ? \"policy still calls\" : \"policies still call\"} ` +\n            `\\`${LEGACY_RLS_SCHEMA}.uid()\\` and friends, and Postgres will not drop a function a policy ` +\n            `depends on. Rebase's own policies are ` +\n            `rewritten automatically — anything listed here is hand-written SQL that has to be updated to ` +\n            `\\`${REBASE_SCHEMA}.uid()\\` by hand, after which the schema goes on its own:\\n` +\n            blockers.map(b => `  • ${b.schema}.${b.table} → \"${b.policy}\"`).join(\"\\n\")\n        );\n        return;\n    }\n\n    // The half Postgres will not refuse on. See LEGACY_RLS_FUNCTION_DEPENDENTS_SQL:\n    // a string-literal SQL body records no dependency, so `DROP FUNCTION` drops\n    // out from under a caller that is still using it and nothing complains until\n    // a query runs.\n    let borrowers: LegacyRlsFunctionDependent[];\n    try {\n        borrowers = (await run(LEGACY_RLS_FUNCTION_DEPENDENTS_SQL)) as unknown as LegacyRlsFunctionDependent[];\n    } catch {\n        return;\n    }\n\n    if (borrowers.length > 0) {\n        report.warn(\n            `The pre-1.0 \\`${LEGACY_RLS_SCHEMA}\\` schema cannot be removed yet: ${borrowers.length} ` +\n            `${borrowers.length === 1 ? \"function calls\" : \"functions call\"} ` +\n            `\\`${LEGACY_RLS_SCHEMA}.uid()\\` and friends from its own body. Postgres records no dependency ` +\n            `for that — a SQL body written as a string literal is never parsed — so dropping the helpers ` +\n            `would leave these pointing at nothing, and they would fail when a query reached them rather ` +\n            `than now. Repoint them at \\`${REBASE_SCHEMA}.uid()\\`, after which the schema goes on its own:\\n` +\n            borrowers.map(b => `  • ${b.schema}.${b.function}()`).join(\"\\n\")\n        );\n        return;\n    }\n\n    try {\n        await run(DROP_LEGACY_AUTH_SCHEMA_SQL);\n    } catch (err) {\n        // Something else depends on it, or the connection does not own it.\n        // Not fatal: the schema is inert either way now that no policy calls it.\n        report.info(\n            `Left the \\`${LEGACY_RLS_SCHEMA}\\` schema in place: ` +\n            (err instanceof Error ? err.message : String(err))\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,IAAa,2BAA8C;CACvD,+BAA+B;CAK/B,8BAA8B,cAAc;;;;;;CAO5C,8BAA8B,cAAc;;;;;;CAO5C,8BAA8B,cAAc;;;AAGhD;AAII,KACA,yBAAyB,KAAI,MAAK,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4B1D,IAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmE3C,IAAa,4BAA4B;;;;;sDAKa,kBAAkB;2DACb,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;AAgC7E,IAAa,qCAAqC;;;;;8BAKpB,kBAAkB;4BACpB,kBAAkB;;;;;;;;;;;;;AAc9C,eAAsB,qBAClB,KACA,QACa;CACb,IAAI;CACJ,IAAI;EACA,WAAY,MAAM,IAAI,yBAAyB;CACnD,QAAQ;EACJ;CACJ;CAEA,IAAI,SAAS,SAAS,GAAG;EACrB,OAAO,KACH,iBAAiB,kBAAkB,mCAAmC,SAAS,OAAO,GACnF,SAAS,WAAW,IAAI,uBAAuB,sBAAsB,KACnE,kBAAkB,4MAGlB,cAAc,+DACnB,SAAS,KAAI,MAAK,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,IAAI,CAC7E;EACA;CACJ;CAMA,IAAI;CACJ,IAAI;EACA,YAAa,MAAM,IAAI,kCAAkC;CAC7D,QAAQ;EACJ;CACJ;CAEA,IAAI,UAAU,SAAS,GAAG;EACtB,OAAO,KACH,iBAAiB,kBAAkB,mCAAmC,UAAU,OAAO,GACpF,UAAU,WAAW,IAAI,mBAAmB,iBAAiB,KAC3D,kBAAkB,6RAGQ,cAAc,uDAC7C,UAAU,KAAI,MAAK,OAAO,EAAE,OAAO,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,IAAI,CACnE;EACA;CACJ;CAEA,IAAI;EACA,MAAM,IAAI,2BAA2B;CACzC,SAAS,KAAK;EAGV,OAAO,KACH,cAAc,kBAAkB,yBAC/B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACpD;CACJ;AACJ"}
+{"version":3,"file":"rls-bootstrap-sql-69hYT8nr.js","names":[],"sources":["../src/schema/rls-bootstrap-sql.ts"],"sourcesContent":["import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA } from \"@rebasepro/types\";\n\n/**\n * Canonical SQL bootstrap for the RLS helper functions.\n *\n * Generated RLS policies reference `rebase.uid()` / `rebase.roles()` /\n * `rebase.jwt()`, so any SQL stream that can contain policies must be\n * self-contained: it has to (re)create these helpers first. This matters for\n * the migration directory in particular — Atlas replays migrations against a\n * clean dev database where no out-of-band bootstrap has ever run, so a\n * migration carrying policies without this preamble fails with\n * \"function rebase.uid() does not exist\".\n *\n * Idempotent (`IF NOT EXISTS` / `OR REPLACE`) so it can be prepended to every\n * policies block and re-applied freely. The runtime boot path\n * (`auth/ensure-tables.ts`) creates the same functions under an advisory lock\n * for HMR-safety; keep the definitions in sync.\n *\n * ## Creating the `rebase` schema here is now safe, and required\n *\n * It deliberately did not, once. These functions lived in a schema called\n * `auth`, and the note here read: creating `rebase` would leak it into Atlas's\n * replayed migration state, and — absent from the desired `schema.sql` — Atlas\n * would then plan `DROP SCHEMA \"rebase\" CASCADE`, taking the auth tables with\n * it. That reasoning still holds; what changed is the second half of it. The\n * DDL generator now emits `CREATE SCHEMA IF NOT EXISTS \"rebase\"`\n * unconditionally, so the schema is always in the desired state and the diff is\n * empty. (It used to appear only when some collection happened to declare\n * `schema: \"rebase\"` — true for the scaffold's users collection, and not a\n * property anything guaranteed.) `db push` additionally excludes the whole\n * schema from the declarative apply.\n *\n * See `@rebasepro/types`' `rls-functions` for why the functions moved out of\n * `auth` at all: the short version is that the name was Supabase's, and\n * `CREATE OR REPLACE FUNCTION auth.uid() RETURNS text` cannot be applied over\n * Supabase's `RETURNS uuid` — Postgres refuses, and the refusal used to be\n * swallowed.\n */\n/**\n * The bootstrap as individual statements.\n *\n * Kept as an array because the two consumers need different shapes and only one\n * of them can take a multi-command string: the migration preamble is written to\n * a file and replayed by Atlas, but the boot path runs through drizzle, whose\n * node-postgres handle speaks the extended query protocol and rejects more than\n * one command per call. Splitting a joined string back apart on `$$;` would be\n * a parser for a problem that does not need one.\n */\nexport const RLS_BOOTSTRAP_STATEMENTS: readonly string[] = [\n    `CREATE SCHEMA IF NOT EXISTS ${REBASE_SCHEMA}`,\n\n    // Falls back to the pre-rename `app.user_id` so a database that has taken\n    // the new schema but is still served by an older backend keeps resolving\n    // the principal. Drop the COALESCE once no such deployment remains.\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.uid() RETURNS text AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.uid', true), ''),\n        NULLIF(current_setting('app.user_id', true), '')\n    );\n$$ LANGUAGE sql STABLE`,\n\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.jwt() RETURNS jsonb AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.jwt', true), ''),\n        '{}'\n    )::jsonb;\n$$ LANGUAGE sql STABLE`,\n\n    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.roles() RETURNS text AS $$\n    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');\n$$ LANGUAGE sql STABLE`\n];\n\n/** The same statements as one script, for migration files and raw clients. */\nexport const RLS_BOOTSTRAP_SQL =\n    \"-- Rebase schema + RLS helper functions (required by the policies below)\\n\" +\n    RLS_BOOTSTRAP_STATEMENTS.map(s => `${s};`).join(\"\\n\\n\") + \"\\n\";\n\n/**\n * Removes the pre-1.0 `auth` schema, but only when Rebase is what put it there.\n *\n * ## Why this is safe against a Supabase database\n *\n * Two independent guards, and both have to pass:\n *\n *  1. **Each function is identified before it is dropped.** Ours returns `text`\n *     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads\n *     `request.jwt.claims`. Nothing is dropped on a signature we did not write,\n *     so a Supabase database — where our `CREATE OR REPLACE` could never have\n *     succeeded in the first place, Postgres refusing to change a return type —\n *     matches nothing and this is a no-op.\n *  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still\n *     lives in `auth` (Supabase's `users` table, its other helpers), the drop\n *     fails and the schema stays. CASCADE here would be unrecoverable.\n *\n * ## Why it cannot run too early\n *\n * Postgres records a dependency from every RLS policy to the functions its body\n * calls, so `DROP FUNCTION auth.uid()` fails for as long as a single policy\n * still references it. That is the interlock, and it is load-bearing: the drop\n * can only succeed once every policy has been recompiled to \\`rebase.uid()\\`.\n * Callers therefore run this *after* applying policies, and treat a failure as\n * \"not yet — try again next boot\" rather than as an error.\n */\nexport const DROP_LEGACY_AUTH_SCHEMA_SQL = `\nDO $rebase_drop_legacy$\nDECLARE\n    dropped_any boolean := false;\nBEGIN\n    -- Each function is matched on its own result type and body, so a schema\n    -- that merely shares the name keeps everything it has.\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'uid'\n          AND pg_get_function_result(p.oid) = 'text'\n          AND p.prosrc LIKE '%app.uid%'\n    ) THEN\n        DROP FUNCTION auth.uid();\n        dropped_any := true;\n    END IF;\n\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'jwt'\n          AND pg_get_function_result(p.oid) = 'jsonb'\n          AND p.prosrc LIKE '%app.jwt%'\n    ) THEN\n        DROP FUNCTION auth.jwt();\n        dropped_any := true;\n    END IF;\n\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'roles'\n          AND pg_get_function_result(p.oid) = 'text'\n          AND p.prosrc LIKE '%app.user_roles%'\n    ) THEN\n        DROP FUNCTION auth.roles();\n        dropped_any := true;\n    END IF;\n\n    -- RESTRICT: only an empty schema goes. Anything else in there — including a\n    -- Supabase installation left untouched above — keeps it.\n    IF dropped_any THEN\n        BEGIN\n            EXECUTE 'DROP SCHEMA auth RESTRICT';\n        EXCEPTION WHEN OTHERS THEN\n            NULL;\n        END;\n    END IF;\nEND\n$rebase_drop_legacy$;\n`;\n\n/** Somebody's policy that still calls a pre-1.0 helper. */\nexport interface LegacyRlsDependent {\n    schema: string;\n    table: string;\n    policy: string;\n}\n\n/**\n * Policies whose body still calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.\n *\n * Postgres will not drop a function a policy depends on, so this is exactly the\n * set standing between a database and losing the legacy schema. Rebase's own\n * policies leave the list on the next push or boot, when they are recompiled —\n * anything still here afterwards is hand-written, will never be recompiled by\n * anybody, and is the reason the drop keeps being skipped. Silence there would\n * leave an operator staring at a schema the release notes said would go.\n */\nexport const LEGACY_RLS_DEPENDENTS_SQL = `\n    SELECT n.nspname AS schema, c.relname AS \"table\", p.polname AS policy\n    FROM pg_policy p\n    JOIN pg_class c ON c.oid = p.polrelid\n    JOIN pg_namespace n ON n.oid = c.relnamespace\n    WHERE pg_get_expr(p.polqual, p.polrelid) ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n       OR pg_get_expr(p.polwithcheck, p.polrelid) ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n    ORDER BY 1, 2, 3\n`;\n\n/** Somebody's *function* that still calls a pre-1.0 helper from its own body. */\nexport interface LegacyRlsFunctionDependent {\n    schema: string;\n    function: string;\n}\n\n/**\n * Functions whose body calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.\n *\n * This is the half `DROP FUNCTION ... RESTRICT` cannot see, and the reason it\n * needs its own query. Postgres records a dependency for a *policy* that calls a\n * function, which is why the drop is safe against the policies above — but a\n * `LANGUAGE sql` function whose body is a **string literal** is not parsed when\n * it is created, so nothing is recorded and `RESTRICT` has nothing to refuse on.\n * The drop succeeds and the caller is left pointing at a function that no longer\n * exists, which fails at *query* time rather than at boot.\n *\n * A downstream project building on these helpers is not hypothetical: the Rebase\n * control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`\n * in this very schema, each calling `auth.uid()` in a string body, and eleven of\n * its row-level-security policies go through them. Every one of those would have\n * started failing the first time a recompile left no policy referencing\n * `auth.uid()` directly — the drop's own precondition.\n *\n * Matching on the body text is the only option available, and it is deliberately\n * broad: a false positive costs a schema that stays one release longer and says\n * why, while a false negative costs somebody their policies.\n */\nexport const LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = `\n    SELECT n.nspname AS schema, p.proname AS function\n    FROM pg_proc p\n    JOIN pg_namespace n ON n.oid = p.pronamespace\n    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')\n      AND NOT (n.nspname = '${LEGACY_RLS_SCHEMA}' AND p.proname IN ('uid', 'jwt', 'roles'))\n      AND p.prosrc ~* '\\\\m${LEGACY_RLS_SCHEMA}\\\\.(uid|jwt|roles)\\\\s*\\\\('\n    ORDER BY 1, 2\n`;\n\n/**\n * Retire the pre-1.0 `auth` schema, reporting what is holding it back.\n *\n * The shared implementation behind the CLI's post-push step and the runtime's\n * post-policy step. Both used to just fire {@link DROP_LEGACY_AUTH_SCHEMA_SQL}\n * and swallow whatever came back, which is right for the ordinary case — a\n * table not recompiled *yet* — and wrong for the one that never resolves: a\n * hand-written policy nothing will ever rewrite. Then the schema stays forever\n * and nothing ever says why.\n */\nexport async function dropLegacyAuthSchema(\n    run: (sql: string) => Promise<Record<string, unknown>[]>,\n    report: { info: (m: string) => void; warn: (m: string) => void }\n): Promise<void> {\n    let blockers: LegacyRlsDependent[];\n    try {\n        blockers = (await run(LEGACY_RLS_DEPENDENTS_SQL)) as unknown as LegacyRlsDependent[];\n    } catch {\n        return; // No catalogue access; nothing here is worth failing a boot for.\n    }\n\n    if (blockers.length > 0) {\n        report.warn(\n            `The pre-1.0 \\`${LEGACY_RLS_SCHEMA}\\` schema cannot be removed yet: ${blockers.length} ` +\n            `${blockers.length === 1 ? \"policy still calls\" : \"policies still call\"} ` +\n            `\\`${LEGACY_RLS_SCHEMA}.uid()\\` and friends, and Postgres will not drop a function a policy ` +\n            `depends on. Rebase's own policies are ` +\n            `rewritten automatically — anything listed here is hand-written SQL that has to be updated to ` +\n            `\\`${REBASE_SCHEMA}.uid()\\` by hand, after which the schema goes on its own:\\n` +\n            blockers.map(b => `  • ${b.schema}.${b.table} → \"${b.policy}\"`).join(\"\\n\")\n        );\n        return;\n    }\n\n    // The half Postgres will not refuse on. See LEGACY_RLS_FUNCTION_DEPENDENTS_SQL:\n    // a string-literal SQL body records no dependency, so `DROP FUNCTION` drops\n    // out from under a caller that is still using it and nothing complains until\n    // a query runs.\n    let borrowers: LegacyRlsFunctionDependent[];\n    try {\n        borrowers = (await run(LEGACY_RLS_FUNCTION_DEPENDENTS_SQL)) as unknown as LegacyRlsFunctionDependent[];\n    } catch {\n        return;\n    }\n\n    if (borrowers.length > 0) {\n        report.warn(\n            `The pre-1.0 \\`${LEGACY_RLS_SCHEMA}\\` schema cannot be removed yet: ${borrowers.length} ` +\n            `${borrowers.length === 1 ? \"function calls\" : \"functions call\"} ` +\n            `\\`${LEGACY_RLS_SCHEMA}.uid()\\` and friends from its own body. Postgres records no dependency ` +\n            `for that — a SQL body written as a string literal is never parsed — so dropping the helpers ` +\n            `would leave these pointing at nothing, and they would fail when a query reached them rather ` +\n            `than now. Repoint them at \\`${REBASE_SCHEMA}.uid()\\`, after which the schema goes on its own:\\n` +\n            borrowers.map(b => `  • ${b.schema}.${b.function}()`).join(\"\\n\")\n        );\n        return;\n    }\n\n    try {\n        await run(DROP_LEGACY_AUTH_SCHEMA_SQL);\n    } catch (err) {\n        // Something else depends on it, or the connection does not own it.\n        // Not fatal: the schema is inert either way now that no policy calls it.\n        report.info(\n            `Left the \\`${LEGACY_RLS_SCHEMA}\\` schema in place: ` +\n            (err instanceof Error ? err.message : String(err))\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,IAAa,2BAA8C;CACvD,+BAA+B;CAK/B,8BAA8B,cAAc;;;;;;CAO5C,8BAA8B,cAAc;;;;;;CAO5C,8BAA8B,cAAc;;;AAGhD;AAII,KACA,yBAAyB,KAAI,MAAK,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4B1D,IAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmE3C,IAAa,4BAA4B;;;;;sDAKa,kBAAkB;2DACb,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;AAgC7E,IAAa,qCAAqC;;;;;8BAKpB,kBAAkB;4BACpB,kBAAkB;;;;;;;;;;;;;AAc9C,eAAsB,qBAClB,KACA,QACa;CACb,IAAI;CACJ,IAAI;EACA,WAAY,MAAM,IAAI,yBAAyB;CACnD,QAAQ;EACJ;CACJ;CAEA,IAAI,SAAS,SAAS,GAAG;EACrB,OAAO,KACH,iBAAiB,kBAAkB,mCAAmC,SAAS,OAAO,GACnF,SAAS,WAAW,IAAI,uBAAuB,sBAAsB,KACnE,kBAAkB,4MAGlB,cAAc,+DACnB,SAAS,KAAI,MAAK,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,IAAI,CAC7E;EACA;CACJ;CAMA,IAAI;CACJ,IAAI;EACA,YAAa,MAAM,IAAI,kCAAkC;CAC7D,QAAQ;EACJ;CACJ;CAEA,IAAI,UAAU,SAAS,GAAG;EACtB,OAAO,KACH,iBAAiB,kBAAkB,mCAAmC,UAAU,OAAO,GACpF,UAAU,WAAW,IAAI,mBAAmB,iBAAiB,KAC3D,kBAAkB,6RAGQ,cAAc,uDAC7C,UAAU,KAAI,MAAK,OAAO,EAAE,OAAO,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,IAAI,CACnE;EACA;CACJ;CAEA,IAAI;EACA,MAAM,IAAI,2BAA2B;CACzC,SAAS,KAAK;EAGV,OAAO,KACH,cAAc,kBAAkB,yBAC/B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACpD;CACJ;AACJ"}

package/dist/rls-enforcement-BJ_3wxwg.js

@@ -0,0 +1,425 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { r as ANONYMOUS_USER_ID } from "./data_driver-ULAyJEi9.js";
+import { E as findAnonymousGrants, T as securityRuleToConditions } from "./auth-users-columns-BfQHf9JE.js";
+import { n as REBASE_SCHEMA, o as usesLegacyRlsFunctions } from "./src-DCdn3Val.js";
+import { logger } from "@rebasepro/server";
+import { sql } from "drizzle-orm";
+//#region ../common/src/util/internal-tables.ts
+/**
+* The tables Rebase creates for its own bookkeeping, and the SQL that keeps the
+* end-user role away from them.
+*
+* ## Why this exists
+*
+* Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role
+* provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table
+* in the schemas a project uses — including `rebase`, because a project's own
+* collections are allowed to live there (the scaffold puts `users` there). It
+* also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the
+* migrating role inherits the same grant.
+*
+* Every framework-internal table is created later: auth's tables come up during
+* `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first
+* job registers, `idempotency_keys` on the first request that carries a key. So
+* they all inherited full DML for the end-user role — and none of them enables
+* row-level security, because none of them is a collection with
+* `securityRules`. Measured on a freshly provisioned database, `SET ROLE
+* rebase_user` could read `rebase.refresh_tokens` (session token hashes),
+* `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and
+* `rebase.api_keys` (including its `admin` flag), and insert into
+* `rebase.app_config`.
+*
+* Nothing routes a user-context query at those tables today, so this was not
+* reachable over the API. That is the wrong thing to depend on: the documented
+* model is that RLS is the authorization boundary, and these tables sat outside
+* it. The boundary is now a privilege boundary instead — the role simply cannot
+* address them.
+*
+* ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY
+*
+* RLS with no policy denies every row, which is the same outcome, but it is the
+* *weaker* statement: it leaves the grant in place, so a later policy — or a
+* `FORCE` flag cleared by some future migration — reopens the table. There is no
+* row of `refresh_tokens` any end user should ever reach, so the honest encoding
+* is "this role has no privilege here at all". It also keeps the owner
+* connection (which auth actually runs on) completely unaffected.
+*
+* ## Keeping it true
+*
+* `packages/rls-check` scans the `rebase` schema — it used to skip it as a
+* "platform" schema — and its `rls-disabled` check fires on exactly the
+* condition this module removes: RLS off *and* a DML grant to a reachable role.
+* So a table added here without a revoke is caught by `pnpm rls:check`, not by
+* someone re-reading this file.
+*/
+/**
+* The Postgres role authenticated requests run as.
+*
+* Defined here rather than in the Postgres driver because both the driver (which
+* provisions the role) and this module (which revokes on its behalf) need it,
+* and a second spelling of a role name is a silent no-op waiting to happen.
+*/
+var REBASE_USER_ROLE = "rebase_user";
+/**
+* Framework-internal table names, unqualified.
+*
+* Deliberately NOT including `users`: the auth user table is also a collection,
+* with `securityRules`, RLS enabled and policies applied. Users read their own
+* row through it — revoking there would break sign-in.
+*
+* `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`
+* because `db migrate apply` passes `--revisions-schema rebase`.
+*/
+var REBASE_INTERNAL_TABLES = [
+	"user_identities",
+	"refresh_tokens",
+	"password_reset_tokens",
+	"magic_link_tokens",
+	"mfa_factors",
+	"mfa_challenges",
+	"recovery_codes",
+	"app_config",
+	"schema_meta",
+	"api_keys",
+	"cron_logs",
+	"cron_claims",
+	"idempotency_keys",
+	"entity_history",
+	"branches",
+	"channel_messages",
+	"channel_cursors",
+	"channel_presence",
+	"atlas_schema_revisions"
+];
+/** Postgres identifiers this module is willing to interpolate. */
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+/**
+* A single statement that takes every privilege on `schema.table` away from the
+* end-user role.
+*
+* Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which
+* happen in practice:
+*
+*  - the role does not exist when the connection is unprivileged (Rebase then
+*    relies on native RLS rather than a role switch), and a bare `REVOKE` on a
+*    missing role is an error, not a no-op;
+*  - the table may not exist yet — `cron_logs` never appears in a project with
+*    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.
+*
+* One command, so it is safe on handles that speak the extended query protocol
+* and reject multi-statement strings.
+*/
+function revokeInternalTableSql(schema, table) {
+	if (!SAFE_IDENTIFIER.test(schema)) throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);
+	if (!SAFE_IDENTIFIER.test(table)) throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);
+	const qualified = `"${schema}"."${table}"`;
+	return `
+        DO $rebase_revoke$
+        BEGIN
+            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')
+               AND to_regclass('${qualified}') IS NOT NULL THEN
+                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';
+            END IF;
+        END
+        $rebase_revoke$;
+    `.trim();
+}
+/**
+* Revoke on every internal table in `schema`, one statement at a time.
+*
+* Best-effort per table: a connection that does not own one of them (a
+* pre-provisioned database, a platform-managed ledger) cannot revoke on it, and
+* that must not take down a boot. The caller decides how loud to be — `onError`
+* exists so the driver can warn without this module importing a logger.
+*/
+async function revokeInternalTableAccess(execute, schema, options) {
+	for (const table of options?.tables ?? REBASE_INTERNAL_TABLES) try {
+		await execute(revokeInternalTableSql(schema, table));
+	} catch (error) {
+		options?.onError?.(table, error);
+	}
+}
+//#endregion
+//#region src/security/rls-enforcement.ts
+var quoteIdent = (name) => `"${name.replace(/"/g, "\"\"")}"`;
+/** DML the user role holds on managed tables (RLS still filters per row). */
+var USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
+/**
+* Warn when the connection role shares its name with an existing schema.
+*
+* Postgres resolves unqualified names through `search_path`, which defaults to
+* `"$user", public` — and `$user` is the connection ROLE. When a schema of that
+* name exists it sits ahead of `public`, so every unqualified statement
+* silently operates on it instead:
+*
+*     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts
+*
+* Nothing errors. You get a second table of the same name in the wrong schema,
+* and reads that pin `public` cannot see it — which reads as "missing table" and
+* sends people to re-run a push that creates a *third* copy. The bootstrapper
+* has a whole branch dedicated to recognising the symptom after the fact.
+*
+* Rebase shipped straight into this: it creates a schema named `rebase` while
+* every template named the database role `rebase` too. The scaffold uses
+* `rebase_app` now, and every pool Rebase opens pins `search_path=public`
+* (`pinSearchPath`), which covers the paths the framework controls. This covers
+* the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,
+* a hand-written migration — because the hazard is a property of the two NAMES,
+* not of any one connection.
+*
+* A warning rather than a boot failure: the database works, the framework's own
+* traffic is pinned, and refusing to start over a naming choice a user may have
+* inherited would be worse than the risk.
+*/
+async function warnOnRoleSchemaCollision(run) {
+	try {
+		const rows = await run(`
+            SELECT current_user AS role,
+                   EXISTS (
+                       SELECT 1 FROM pg_namespace n WHERE n.nspname = current_user
+                   ) AS collides
+        `);
+		if (rows[0]?.collides !== true) return;
+		const role = String(rows[0]?.role ?? "the connection role");
+		logger.warn(`⚠️  The database role "${role}" has the same name as a schema. Postgres resolves unqualified names through \`search_path\`, which defaults to \`"$user", public\` — so "${role}" is searched BEFORE public, and any unqualified \`CREATE TABLE\`/\`SELECT\` from a tool that does not pin the path (psql, pg_dump, drizzle-kit, a hand-written migration) silently lands in "${role}" instead. Rebase's own connections pin \`search_path=public\`, so the server is unaffected. To remove the hazard entirely, connect as a role whose name is not also a schema — the scaffold uses "rebase_app".`);
+	} catch {}
+}
+async function detectConnectionPosture(run) {
+	const row = (await run(`
+        SELECT current_user            AS role,
+               r.rolsuper              AS superuser,
+               r.rolbypassrls          AS bypassrls,
+               EXISTS (
+                   SELECT 1 FROM pg_tables t
+                   WHERE t.tableowner = current_user
+                     AND t.schemaname NOT IN ('pg_catalog', 'information_schema')
+               )                       AS owns_tables
+        FROM pg_roles r
+        WHERE r.rolname = current_user
+    `))[0] ?? {};
+	const superuser = row.superuser === true;
+	const bypassRLS = row.bypassrls === true;
+	const ownsTables = row.owns_tables === true;
+	return {
+		role: String(row.role ?? "unknown"),
+		superuser,
+		bypassRLS,
+		ownsTables,
+		privileged: superuser || bypassRLS || ownsTables
+	};
+}
+/**
+* Human-actionable instructions for when the connection cannot provision the
+* user role itself (no CREATEROLE and role not pre-created by the platform).
+*/
+function appRoleSetupInstructions(connectionRole, schemas) {
+	const grants = schemas.map((s) => `GRANT USAGE ON SCHEMA ${quoteIdent(s)} TO ${REBASE_USER_ROLE};\nGRANT ${USER_TABLE_PRIVILEGES} ON ALL TABLES IN SCHEMA ${quoteIdent(s)} TO ${REBASE_USER_ROLE};\nGRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${quoteIdent(s)} TO ${REBASE_USER_ROLE};`).join("\n");
+	return `Rebase enforces row-level security by running authenticated requests as the restricted role "${REBASE_USER_ROLE}", but the connection role "${connectionRole}" bypasses RLS and cannot create that role itself.\nRun the following as a database administrator, then restart:\n\nCREATE ROLE ${REBASE_USER_ROLE} NOLOGIN NOSUPERUSER NOBYPASSRLS NOINHERIT;\nGRANT ${REBASE_USER_ROLE} TO ${quoteIdent(connectionRole)};\n` + grants;
+}
+/**
+* Idempotently provision the `rebase_user` role, membership for the current
+* connection role, and DML grants (+ default privileges for future tables)
+* on every existing schema in `schemas`.
+*
+* Split into privilege tiers so it works both when the connection is a
+* superuser (creates everything) and when the platform pre-created the role
+* and membership (e.g. CNPG `postInitApplicationSQL`) and the connection is
+* merely the table owner — owners can always run the grant tier themselves.
+*
+* RLS still filters every row: these grants only make the tables *reachable*
+* by the role; the policies decide which rows/commands actually pass.
+*
+* Throws with precise setup instructions when the role is missing and the
+* connection cannot create it.
+*/
+async function ensureAppRole(run, schemas) {
+	const uniqueSchemas = Array.from(new Set(schemas.filter(Boolean)));
+	if ((await run(`SELECT 1 FROM pg_roles WHERE rolname = 'rebase_user'`)).length === 0) try {
+		await run(`CREATE ROLE ${REBASE_USER_ROLE} NOLOGIN NOSUPERUSER NOBYPASSRLS NOINHERIT`);
+	} catch (err) {
+		throw new Error(`Failed to create the "${REBASE_USER_ROLE}" role: ${err instanceof Error ? err.message : String(err)}\n\n` + appRoleSetupInstructions("current connection role", uniqueSchemas));
+	}
+	const memberRows = await run(`
+        SELECT (pg_has_role(current_user, '${REBASE_USER_ROLE}', 'MEMBER')
+                OR (SELECT rolsuper FROM pg_roles WHERE rolname = current_user)) AS can_set,
+               current_user AS role
+    `);
+	if (memberRows[0]?.can_set !== true) try {
+		await run(`GRANT ${REBASE_USER_ROLE} TO CURRENT_USER`);
+	} catch (err) {
+		throw new Error(`The connection role is not a member of "${REBASE_USER_ROLE}" and cannot grant itself membership: ${err instanceof Error ? err.message : String(err)}\n\n` + appRoleSetupInstructions(String(memberRows[0]?.role ?? "current connection role"), uniqueSchemas));
+	}
+	const nspRows = await run("SELECT nspname FROM pg_namespace");
+	const existing = new Set(nspRows.map((r) => String(r.nspname)));
+	for (const schema of uniqueSchemas) {
+		if (!existing.has(schema)) continue;
+		const s = quoteIdent(schema);
+		await run(`GRANT USAGE ON SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
+		await run(`GRANT ${USER_TABLE_PRIVILEGES} ON ALL TABLES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
+		await run(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
+		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);
+		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);
+		await revokeInternalTableAccess(async (text) => {
+			await run(text);
+		}, schema, { onError: (table, error) => logger.warn(`🔐 [rls] Could not revoke "${REBASE_USER_ROLE}" access to "${schema}"."${table}" — it stays reachable by authenticated requests: ` + (error instanceof Error ? error.message : String(error))) });
+	}
+	logger.debug(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
+}
+/**
+* Apply the authenticated context to a transaction: the `app.*` GUCs that RLS
+* policies read via `auth.uid()` / `auth.roles()` / `auth.jwt()`, and — when
+* `userRole` is set — `SET LOCAL ROLE` so RLS binds every statement in this
+* transaction (reads *and* writes).
+*
+* GUCs are set with `is_local = true` and the role switch is `LOCAL`: both
+* reset at commit/rollback, so pooled connections are never polluted.
+*
+* Fails closed by construction: if the role switch errors, the transaction
+* aborts instead of proceeding privileged.
+*
+* SECURITY: this function is only ever called on the **user** path (the server
+* context uses the base/owner driver and never calls it). The default policies
+* treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`
+* is `NULLIF(current_setting('app.uid'), '')` — so an EMPTY user id would
+* be read as NULL and silently escalate a user request to server privileges.
+* Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,
+* rather than trusting every caller (e.g. realtime subscription auth) to do it.
+* That sentinel is exported from `@rebasepro/types` because it leaks into rule
+* semantics: it is why `auth.uid() IS NOT NULL` is true for anonymous requests.
+*/
+async function applyAuthContext(tx, auth, userRole) {
+	const uid = typeof auth.uid === "string" && auth.uid.trim() !== "" ? auth.uid : ANONYMOUS_USER_ID;
+	const normalizedRoles = auth.roles.map((r) => typeof r === "string" ? r : r?.id ?? String(r));
+	await tx.execute(sql`
+        SELECT
+            set_config('app.uid', ${uid}, true),
+            set_config('app.user_id', ${uid}, true),
+            set_config('app.user_roles', ${normalizedRoles.join(",")}, true),
+            set_config('app.jwt', ${JSON.stringify({
+		sub: uid,
+		roles: auth.roles
+	})}, true)
+    `);
+	if (userRole) await tx.execute(sql.raw(`SET LOCAL ROLE ${quoteIdent(userRole)}`));
+}
+/** Role names from other BaaS platforms that people reach for out of habit. */
+var FOREIGN_CONVENTION_ROLES = {
+	authenticated: "Supabase",
+	anon: "Supabase",
+	service_role: "Supabase"
+};
+/**
+* Warn about rules that read as "signed-in users only" but admit anonymous
+* callers — `auth.uid() IS NOT NULL`, or a comparison against another
+* platform's magic user id such as `'anon'`.
+*
+* The sibling of {@link validatePolicyPgRoles}, for the more dangerous spelling
+* of the same habit. A foreign `pgRoles` value makes a policy unreachable and
+* the table reads empty — loud, and that guard throws. These do the opposite:
+* the rule compiles to a grant, and nothing looks wrong until the data is
+* already public.
+*
+* Warns rather than throws. Unlike an unreachable `pgRoles`, these rules are
+* serving traffic today: refusing to boot would take an app offline to report a
+* problem it already has, and on the read path it would take it offline
+* *because* its data was exposed. Rewriting the author's SQL is not an option
+* either — this is the escape hatch whose whole promise is that it means what it
+* says. So: say so, loudly, and leave the rule alone.
+*/
+function warnOnAnonymousGrants(collections) {
+	const byRisk = /* @__PURE__ */ new Map();
+	for (const collection of collections) for (const rule of collection.securityRules ?? []) {
+		const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+		const risks = [usingExpr, withCheckExpr].filter((e) => e !== null).flatMap(findAnonymousGrants);
+		for (const risk of risks) {
+			const key = `${risk.pattern}:${risk.detail}`;
+			const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
+			const entry = byRisk.get(key) ?? {
+				risk,
+				sites: []
+			};
+			if (!entry.sites.includes(site)) entry.sites.push(site);
+			byRisk.set(key, entry);
+		}
+	}
+	if (byRisk.size === 0) return;
+	const problems = [...byRisk.values()].map(({ risk, sites }) => `  • ${risk.explanation}\n    ${sites.length} rule(s): ${sites.join(", ")}`);
+	logger.warn(`Security rules that read as a lockdown but grant access to anonymous requests. Every caller from a client carries a user id ('${ANONYMOUS_USER_ID}' when nobody is signed in), so these clauses are true for everyone:\n\n` + problems.join("\n\n") + "\n");
+}
+/**
+* Name the collections whose raw policy SQL still calls the pre-1.0 helpers.
+*
+* The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the
+* database, so nothing is broken and no policy is wrong — which is exactly why
+* this has to be said out loud. A silent rewrite that works forever is not a
+* migration, it is a second supported spelling nobody wrote down, and the next
+* person to read those rules will copy the old one.
+*
+* Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,
+* `policy.rolesOverlap(...)`) compile from the model and were never affected.
+*/
+function warnOnLegacyRlsFunctions(collections) {
+	const sites = [];
+	for (const collection of collections) for (const rule of collection.securityRules ?? []) {
+		const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+		if (![usingExpr, withCheckExpr].filter((e) => e !== null).some(containsLegacyRlsCall)) continue;
+		const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
+		if (!sites.includes(site)) sites.push(site);
+	}
+	if (sites.length === 0) return;
+	logger.warn(`These security rules call the pre-1.0 RLS helpers (\`auth.uid()\`, \`auth.roles()\`, \`auth.jwt()\`). They still work — the compiler rewrites them — but the functions now live in the \`rebase\` schema, and the \`auth\` one is Supabase's. Update the raw SQL in these rules to \`${REBASE_SCHEMA}.uid()\` and friends, or switch them to the structured helpers (\`policy.authUid()\`, \`policy.rolesOverlap()\`), which never had to be spelled by hand:\n\n` + sites.map((s) => `  • ${s}`).join("\n") + "\n");
+}
+/** Whether any `raw` expression in the tree calls a pre-1.0 helper. */
+function containsLegacyRlsCall(expr) {
+	switch (expr.kind) {
+		case "raw": return usesLegacyRlsFunctions(expr.sql);
+		case "and":
+		case "or": return expr.operands.some(containsLegacyRlsCall);
+		case "not": return containsLegacyRlsCall(expr.operand);
+		case "existsIn": return containsLegacyRlsCall(expr.where);
+		default: return false;
+	}
+}
+/**
+* Reject `pgRoles` that this server can never satisfy.
+*
+* `pgRoles` sets the `TO` clause of a generated policy, so a policy naming a
+* role the request never runs as simply never applies — and RLS then filters
+* every row. The table reads as empty, which is indistinguishable from having
+* no data, so the mistake survives review and ships.
+*
+* Requests run as `rebase_user`, so a policy is only reachable if it targets
+* `public` or a role `rebase_user` holds. Anything else is a configuration
+* error worth failing the boot for.
+*/
+async function validatePolicyPgRoles(run, collections, requestRole = REBASE_USER_ROLE) {
+	const wanted = /* @__PURE__ */ new Map();
+	for (const collection of collections) for (const rule of collection.securityRules ?? []) for (const role of rule.pgRoles ?? []) {
+		if (role === "public") continue;
+		wanted.set(role, [...wanted.get(role) ?? [], collection.slug ?? "(unnamed)"]);
+	}
+	if (wanted.size === 0) return;
+	const names = [...wanted.keys()].map((r) => `'${r.replace(/'/g, "''")}'`).join(",");
+	const rows = await run(`
+        SELECT r.rolname AS role,
+               COALESCE(pg_has_role(to_regrole('${requestRole.replace(/'/g, "''")}'), r.oid, 'MEMBER'), false) AS reachable
+        FROM pg_roles r
+        WHERE r.rolname IN (${names})
+    `);
+	const reachable = new Map(rows.map((row) => [String(row.role), row.reachable === true]));
+	const problems = [];
+	for (const [role, slugs] of wanted) {
+		if (reachable.get(role) === true) continue;
+		const why = reachable.has(role) ? `"${requestRole}" is not a member of it` : "no such role exists in this database";
+		const platform = FOREIGN_CONVENTION_ROLES[role];
+		const hint = platform ? `"${role}" is a ${platform} convention, not a PostgreSQL role. Application roles belong in \`roles: ["${role === "service_role" ? "admin" : role}"]\`, which is checked inside the policy via auth.roles().` : `Either grant it (GRANT ${role} TO ${requestRole}) or drop \`pgRoles\` so the policy targets \`public\`.`;
+		problems.push(`  • pgRoles: ["${role}"] on ${slugs.join(", ")} — ${why}.\n    ${hint}`);
+	}
+	if (problems.length > 0) throw new Error(`Security rules target PostgreSQL roles this server cannot use. Requests run as "${requestRole}", so these policies would never apply and every row would be filtered out — the collections would look empty rather than error.\n\n` + problems.join("\n\n") + "\n");
+}
+//#endregion
+export { warnOnAnonymousGrants as a, REBASE_USER_ROLE as c, validatePolicyPgRoles as i, revokeInternalTableAccess as l, detectConnectionPosture as n, warnOnLegacyRlsFunctions as o, ensureAppRole as r, warnOnRoleSchemaCollision as s, applyAuthContext as t, revokeInternalTableSql as u };
+
+//# sourceMappingURL=rls-enforcement-BJ_3wxwg.js.map

package/dist/rls-enforcement-BJ_3wxwg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-enforcement-BJ_3wxwg.js","names":[],"sources":["../../common/src/util/internal-tables.ts","../src/security/rls-enforcement.ts"],"sourcesContent":["/**\n * The tables Rebase creates for its own bookkeeping, and the SQL that keeps the\n * end-user role away from them.\n *\n * ## Why this exists\n *\n * Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role\n * provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table\n * in the schemas a project uses — including `rebase`, because a project's own\n * collections are allowed to live there (the scaffold puts `users` there). It\n * also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the\n * migrating role inherits the same grant.\n *\n * Every framework-internal table is created later: auth's tables come up during\n * `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first\n * job registers, `idempotency_keys` on the first request that carries a key. So\n * they all inherited full DML for the end-user role — and none of them enables\n * row-level security, because none of them is a collection with\n * `securityRules`. Measured on a freshly provisioned database, `SET ROLE\n * rebase_user` could read `rebase.refresh_tokens` (session token hashes),\n * `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and\n * `rebase.api_keys` (including its `admin` flag), and insert into\n * `rebase.app_config`.\n *\n * Nothing routes a user-context query at those tables today, so this was not\n * reachable over the API. That is the wrong thing to depend on: the documented\n * model is that RLS is the authorization boundary, and these tables sat outside\n * it. The boundary is now a privilege boundary instead — the role simply cannot\n * address them.\n *\n * ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY\n *\n * RLS with no policy denies every row, which is the same outcome, but it is the\n * *weaker* statement: it leaves the grant in place, so a later policy — or a\n * `FORCE` flag cleared by some future migration — reopens the table. There is no\n * row of `refresh_tokens` any end user should ever reach, so the honest encoding\n * is \"this role has no privilege here at all\". It also keeps the owner\n * connection (which auth actually runs on) completely unaffected.\n *\n * ## Keeping it true\n *\n * `packages/rls-check` scans the `rebase` schema — it used to skip it as a\n * \"platform\" schema — and its `rls-disabled` check fires on exactly the\n * condition this module removes: RLS off *and* a DML grant to a reachable role.\n * So a table added here without a revoke is caught by `pnpm rls:check`, not by\n * someone re-reading this file.\n */\n\n/**\n * The Postgres role authenticated requests run as.\n *\n * Defined here rather than in the Postgres driver because both the driver (which\n * provisions the role) and this module (which revokes on its behalf) need it,\n * and a second spelling of a role name is a silent no-op waiting to happen.\n */\nexport const REBASE_USER_ROLE = \"rebase_user\";\n\n/**\n * Framework-internal table names, unqualified.\n *\n * Deliberately NOT including `users`: the auth user table is also a collection,\n * with `securityRules`, RLS enabled and policies applied. Users read their own\n * row through it — revoking there would break sign-in.\n *\n * `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`\n * because `db migrate apply` passes `--revisions-schema rebase`.\n */\nexport const REBASE_INTERNAL_TABLES: readonly string[] = [\n    // auth\n    \"user_identities\",\n    \"refresh_tokens\",\n    \"password_reset_tokens\",\n    \"magic_link_tokens\",\n    \"mfa_factors\",\n    \"mfa_challenges\",\n    \"recovery_codes\",\n    \"app_config\",\n    \"schema_meta\",\n    // platform services\n    \"api_keys\",\n    \"cron_logs\",\n    \"cron_claims\",\n    \"idempotency_keys\",\n    \"entity_history\",\n    \"branches\",\n    // realtime channels — authorization for these lives in the channel rules the\n    // server evaluates before it reads or writes, never in a row policy\n    \"channel_messages\",\n    \"channel_cursors\",\n    \"channel_presence\",\n    // migration bookkeeping\n    \"atlas_schema_revisions\"\n];\n\n/** Postgres identifiers this module is willing to interpolate. */\nconst SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;\n\n/**\n * A single statement that takes every privilege on `schema.table` away from the\n * end-user role.\n *\n * Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which\n * happen in practice:\n *\n *  - the role does not exist when the connection is unprivileged (Rebase then\n *    relies on native RLS rather than a role switch), and a bare `REVOKE` on a\n *    missing role is an error, not a no-op;\n *  - the table may not exist yet — `cron_logs` never appears in a project with\n *    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.\n *\n * One command, so it is safe on handles that speak the extended query protocol\n * and reject multi-statement strings.\n */\nexport function revokeInternalTableSql(schema: string, table: string): string {\n    if (!SAFE_IDENTIFIER.test(schema)) {\n        throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);\n    }\n    if (!SAFE_IDENTIFIER.test(table)) {\n        throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);\n    }\n    const qualified = `\"${schema}\".\"${table}\"`;\n    return `\n        DO $rebase_revoke$\n        BEGIN\n            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')\n               AND to_regclass('${qualified}') IS NOT NULL THEN\n                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';\n            END IF;\n        END\n        $rebase_revoke$;\n    `.trim();\n}\n\n/**\n * Revoke on every internal table in `schema`, one statement at a time.\n *\n * Best-effort per table: a connection that does not own one of them (a\n * pre-provisioned database, a platform-managed ledger) cannot revoke on it, and\n * that must not take down a boot. The caller decides how loud to be — `onError`\n * exists so the driver can warn without this module importing a logger.\n */\nexport async function revokeInternalTableAccess(\n    execute: (sql: string) => Promise<unknown>,\n    schema: string,\n    options?: { tables?: readonly string[]; onError?: (table: string, error: unknown) => void }\n): Promise<void> {\n    for (const table of options?.tables ?? REBASE_INTERNAL_TABLES) {\n        try {\n            await execute(revokeInternalTableSql(schema, table));\n        } catch (error) {\n            options?.onError?.(table, error);\n        }\n    }\n}\n","import { sql as drizzleSql, SQL } from \"drizzle-orm\";\nimport { ANONYMOUS_USER_ID, PolicyExpression, SecurityRule } from \"@rebasepro/types\";\nimport {\n    AnonymousGrantRisk,\n    findAnonymousGrants,\n    REBASE_USER_ROLE,\n    revokeInternalTableAccess,\n    securityRuleToConditions\n} from \"@rebasepro/common\";\nimport { REBASE_SCHEMA, usesLegacyRlsFunctions } from \"@rebasepro/types\";\nimport { logger } from \"@rebasepro/server\";\n\n/**\n * Unified RLS enforcement — the \"user context vs server context\" model.\n *\n * Every operation runs in one of two contexts:\n *\n *  - **User context** — a request authenticated (or anonymous) via\n *    `driver.withAuth(user)`. Runs as the restricted `rebase_user` role: a\n *    non-owner, NOSUPERUSER, NOBYPASSRLS role, so Postgres RLS binds *every*\n *    statement (SELECT, INSERT, UPDATE, DELETE). The collection's\n *    `securityRules` are the whole authorization model; app-layer callbacks\n *    are validation/side-effects, not a security boundary.\n *\n *  - **Server context** — the base (owner) connection: auth flows, migrations,\n *    and raw `rebase.sql`. As table owner it bypasses RLS. This is the trusted\n *    plane, equivalent to Supabase's `service_role`.\n *\n *    `rebase.dataAsAdmin` is **not** in it, despite the name. `init.ts` scopes\n *    that driver with `withAuth(SERVICE_IDENTITY)`, so it arrives as user\n *    context above — `rebase_user`, `app.uid = 'service'`, policies evaluated —\n *    and clears the default policies through their admin arm rather than the\n *    `auth.uid() IS NULL` one.\n *\n * This module provides the three pieces:\n *\n *  1. {@link detectConnectionPosture} — is the connection subject to RLS at\n *     all? (superuser / BYPASSRLS / table owner ⇒ no)\n *  2. {@link ensureAppRole} — idempotently provision `rebase_user` with\n *     SELECT/INSERT/UPDATE/DELETE grants (+ default privileges so future\n *     tables stay covered).\n *  3. {@link applyAuthContext} — per-transaction: set the `app.*` GUCs the\n *     policies read (`auth.uid()` etc.) and `SET LOCAL ROLE rebase_user` so\n *     RLS binds. Transaction-scoped, so it composes with poolers.\n *\n * Provisioning runs from the framework's own bootstrap/migrate (which already\n * self-creates the `auth` schema and functions) — enforcement is default-on,\n * not an operator opt-in.\n */\n\n/**\n * The restricted role every authenticated (user-context) request runs as.\n *\n * Re-exported, not re-declared: the same name is needed by\n * `@rebasepro/common`'s internal-table revokes, and two spellings of a role name\n * fail as a silent no-op rather than an error.\n */\nexport { REBASE_USER_ROLE };\n\n/** Minimal SQL runner so callers can adapt drizzle or pg.Client. */\nexport type RawSqlRunner = (sqlText: string) => Promise<Record<string, unknown>[]>;\n\n/** Minimal transaction surface needed by {@link applyAuthContext}. */\nexport interface SqlTx {\n    execute(query: SQL): Promise<unknown>;\n}\n\nexport interface ConnectionPosture {\n    /** The connection's `current_user`. */\n    role: string;\n    superuser: boolean;\n    bypassRLS: boolean;\n    /** Owns at least one user table — owners bypass non-FORCE RLS. */\n    ownsTables: boolean;\n    /** True when RLS would NOT constrain this connection. */\n    privileged: boolean;\n}\n\nexport interface AuthContext {\n    uid: string;\n    /** Raw roles as carried on the user (strings or `{ id }` objects). */\n    roles: unknown[];\n}\n\nconst quoteIdent = (name: string): string => `\"${name.replace(/\"/g, \"\\\"\\\"\")}\"`;\n\n/** DML the user role holds on managed tables (RLS still filters per row). */\nconst USER_TABLE_PRIVILEGES = \"SELECT, INSERT, UPDATE, DELETE\";\n\n/**\n * Warn when the connection role shares its name with an existing schema.\n *\n * Postgres resolves unqualified names through `search_path`, which defaults to\n * `\"$user\", public` — and `$user` is the connection ROLE. When a schema of that\n * name exists it sits ahead of `public`, so every unqualified statement\n * silently operates on it instead:\n *\n *     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts\n *\n * Nothing errors. You get a second table of the same name in the wrong schema,\n * and reads that pin `public` cannot see it — which reads as \"missing table\" and\n * sends people to re-run a push that creates a *third* copy. The bootstrapper\n * has a whole branch dedicated to recognising the symptom after the fact.\n *\n * Rebase shipped straight into this: it creates a schema named `rebase` while\n * every template named the database role `rebase` too. The scaffold uses\n * `rebase_app` now, and every pool Rebase opens pins `search_path=public`\n * (`pinSearchPath`), which covers the paths the framework controls. This covers\n * the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,\n * a hand-written migration — because the hazard is a property of the two NAMES,\n * not of any one connection.\n *\n * A warning rather than a boot failure: the database works, the framework's own\n * traffic is pinned, and refusing to start over a naming choice a user may have\n * inherited would be worse than the risk.\n */\nexport async function warnOnRoleSchemaCollision(run: RawSqlRunner): Promise<void> {\n    try {\n        const rows = await run(`\n            SELECT current_user AS role,\n                   EXISTS (\n                       SELECT 1 FROM pg_namespace n WHERE n.nspname = current_user\n                   ) AS collides\n        `);\n        if (rows[0]?.collides !== true) return;\n        const role = String(rows[0]?.role ?? \"the connection role\");\n        logger.warn(\n            `⚠️  The database role \"${role}\" has the same name as a schema. Postgres resolves unqualified ` +\n            `names through \\`search_path\\`, which defaults to \\`\"$user\", public\\` — so \"${role}\" is searched ` +\n            `BEFORE public, and any unqualified \\`CREATE TABLE\\`/\\`SELECT\\` from a tool that does not pin the ` +\n            `path (psql, pg_dump, drizzle-kit, a hand-written migration) silently lands in \"${role}\" instead. ` +\n            `Rebase's own connections pin \\`search_path=public\\`, so the server is unaffected. To remove the ` +\n            `hazard entirely, connect as a role whose name is not also a schema — the scaffold uses ` +\n            `\"rebase_app\".`\n        );\n    } catch {\n        // A diagnostic must never be the reason a boot fails.\n    }\n}\n\nexport async function detectConnectionPosture(run: RawSqlRunner): Promise<ConnectionPosture> {\n    const rows = await run(`\n        SELECT current_user            AS role,\n               r.rolsuper              AS superuser,\n               r.rolbypassrls          AS bypassrls,\n               EXISTS (\n                   SELECT 1 FROM pg_tables t\n                   WHERE t.tableowner = current_user\n                     AND t.schemaname NOT IN ('pg_catalog', 'information_schema')\n               )                       AS owns_tables\n        FROM pg_roles r\n        WHERE r.rolname = current_user\n    `);\n    const row = rows[0] ?? {};\n    const superuser = row.superuser === true;\n    const bypassRLS = row.bypassrls === true;\n    const ownsTables = row.owns_tables === true;\n    return {\n        role: String(row.role ?? \"unknown\"),\n        superuser,\n        bypassRLS,\n        ownsTables,\n        privileged: superuser || bypassRLS || ownsTables\n    };\n}\n\n/**\n * Human-actionable instructions for when the connection cannot provision the\n * user role itself (no CREATEROLE and role not pre-created by the platform).\n */\nexport function appRoleSetupInstructions(connectionRole: string, schemas: string[]): string {\n    const grants = schemas.map((s) =>\n        `GRANT USAGE ON SCHEMA ${quoteIdent(s)} TO ${REBASE_USER_ROLE};\\n` +\n        `GRANT ${USER_TABLE_PRIVILEGES} ON ALL TABLES IN SCHEMA ${quoteIdent(s)} TO ${REBASE_USER_ROLE};\\n` +\n        `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${quoteIdent(s)} TO ${REBASE_USER_ROLE};`\n    ).join(\"\\n\");\n    return (\n        `Rebase enforces row-level security by running authenticated requests as ` +\n        `the restricted role \"${REBASE_USER_ROLE}\", but the connection role ` +\n        `\"${connectionRole}\" bypasses RLS and cannot create that role itself.\\n` +\n        `Run the following as a database administrator, then restart:\\n\\n` +\n        `CREATE ROLE ${REBASE_USER_ROLE} NOLOGIN NOSUPERUSER NOBYPASSRLS NOINHERIT;\\n` +\n        `GRANT ${REBASE_USER_ROLE} TO ${quoteIdent(connectionRole)};\\n` +\n        grants\n    );\n}\n\n/**\n * Idempotently provision the `rebase_user` role, membership for the current\n * connection role, and DML grants (+ default privileges for future tables)\n * on every existing schema in `schemas`.\n *\n * Split into privilege tiers so it works both when the connection is a\n * superuser (creates everything) and when the platform pre-created the role\n * and membership (e.g. CNPG `postInitApplicationSQL`) and the connection is\n * merely the table owner — owners can always run the grant tier themselves.\n *\n * RLS still filters every row: these grants only make the tables *reachable*\n * by the role; the policies decide which rows/commands actually pass.\n *\n * Throws with precise setup instructions when the role is missing and the\n * connection cannot create it.\n */\nexport async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promise<void> {\n    const uniqueSchemas = Array.from(new Set(schemas.filter(Boolean)));\n\n    // Tier 1 — role existence.\n    const roleRows = await run(`SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}'`);\n    if (roleRows.length === 0) {\n        try {\n            await run(`CREATE ROLE ${REBASE_USER_ROLE} NOLOGIN NOSUPERUSER NOBYPASSRLS NOINHERIT`);\n        } catch (err) {\n            throw new Error(\n                `Failed to create the \"${REBASE_USER_ROLE}\" role: ${err instanceof Error ? err.message : String(err)}\\n\\n` +\n                appRoleSetupInstructions(\"current connection role\", uniqueSchemas)\n            );\n        }\n    }\n\n    // Tier 2 — membership, so a non-superuser connection may SET ROLE to it.\n    const memberRows = await run(`\n        SELECT (pg_has_role(current_user, '${REBASE_USER_ROLE}', 'MEMBER')\n                OR (SELECT rolsuper FROM pg_roles WHERE rolname = current_user)) AS can_set,\n               current_user AS role\n    `);\n    if (memberRows[0]?.can_set !== true) {\n        try {\n            await run(`GRANT ${REBASE_USER_ROLE} TO CURRENT_USER`);\n        } catch (err) {\n            throw new Error(\n                `The connection role is not a member of \"${REBASE_USER_ROLE}\" and cannot grant itself membership: ` +\n                `${err instanceof Error ? err.message : String(err)}\\n\\n` +\n                appRoleSetupInstructions(String(memberRows[0]?.role ?? \"current connection role\"), uniqueSchemas)\n            );\n        }\n    }\n\n    // Tier 3 — grants. Table owners (the expected non-superuser posture) can\n    // always grant on their own objects, so this tier needs no extra privilege.\n    const nspRows = await run(\"SELECT nspname FROM pg_namespace\");\n    const existing = new Set(nspRows.map((r) => String(r.nspname)));\n    for (const schema of uniqueSchemas) {\n        if (!existing.has(schema)) continue;\n        const s = quoteIdent(schema);\n        await run(`GRANT USAGE ON SCHEMA ${s} TO ${REBASE_USER_ROLE}`);\n        await run(`GRANT ${USER_TABLE_PRIVILEGES} ON ALL TABLES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);\n        await run(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);\n        // Cover objects created later by the CURRENT role (the role that runs\n        // migrations), so a migrate can never strand the user role.\n        await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);\n        await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);\n\n        // The grants above are deliberately schema-wide — a project's own\n        // collections may live in `rebase`, and future tables must be reachable\n        // or a migration strands the role. Rebase's OWN tables are the exception:\n        // refresh tokens, MFA secrets, API keys and the rest carry no RLS and no\n        // row an end user should ever address. Taking the privilege back here\n        // covers every table that already exists; each creator revokes on the\n        // table it just made, for the boot that creates them for the first time.\n        await revokeInternalTableAccess(async (text) => { await run(text); }, schema, {\n            onError: (table, error) => logger.warn(\n                `🔐 [rls] Could not revoke \"${REBASE_USER_ROLE}\" access to \"${schema}\".\"${table}\" — ` +\n                \"it stays reachable by authenticated requests: \" +\n                (error instanceof Error ? error.message : String(error))\n            )\n        });\n    }\n\n    logger.debug(`🔐 [rls] User role \"${REBASE_USER_ROLE}\" provisioned (schemas: ${uniqueSchemas.join(\", \")})`);\n}\n\n/**\n * Apply the authenticated context to a transaction: the `app.*` GUCs that RLS\n * policies read via `auth.uid()` / `auth.roles()` / `auth.jwt()`, and — when\n * `userRole` is set — `SET LOCAL ROLE` so RLS binds every statement in this\n * transaction (reads *and* writes).\n *\n * GUCs are set with `is_local = true` and the role switch is `LOCAL`: both\n * reset at commit/rollback, so pooled connections are never polluted.\n *\n * Fails closed by construction: if the role switch errors, the transaction\n * aborts instead of proceeding privileged.\n *\n * SECURITY: this function is only ever called on the **user** path (the server\n * context uses the base/owner driver and never calls it). The default policies\n * treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`\n * is `NULLIF(current_setting('app.uid'), '')` — so an EMPTY user id would\n * be read as NULL and silently escalate a user request to server privileges.\n * Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,\n * rather than trusting every caller (e.g. realtime subscription auth) to do it.\n * That sentinel is exported from `@rebasepro/types` because it leaks into rule\n * semantics: it is why `auth.uid() IS NOT NULL` is true for anonymous requests.\n */\nexport async function applyAuthContext(tx: SqlTx, auth: AuthContext, userRole?: string): Promise<void> {\n    const uid = typeof auth.uid === \"string\" && auth.uid.trim() !== \"\" ? auth.uid : ANONYMOUS_USER_ID;\n    const normalizedRoles = auth.roles.map((r: unknown) =>\n        typeof r === \"string\" ? r : (r as Record<string, unknown>)?.id ?? String(r)\n    );\n    // `app.user_id` is the pre-rename spelling, still written because policies\n    // are data: a database provisioned before the rename holds rules compiled\n    // to `current_setting('app.user_id')`, and those predicates would evaluate\n    // to NULL — failing open or locking out — if we stopped setting it. Drop\n    // the alias only once no live database carries a legacy policy.\n    await tx.execute(drizzleSql`\n        SELECT\n            set_config('app.uid', ${uid}, true),\n            set_config('app.user_id', ${uid}, true),\n            set_config('app.user_roles', ${normalizedRoles.join(\",\")}, true),\n            set_config('app.jwt', ${JSON.stringify({ sub: uid, roles: auth.roles })}, true)\n    `);\n    if (userRole) {\n        await tx.execute(drizzleSql.raw(`SET LOCAL ROLE ${quoteIdent(userRole)}`));\n    }\n}\n\n/** Role names from other BaaS platforms that people reach for out of habit. */\nconst FOREIGN_CONVENTION_ROLES: Record<string, string> = {\n    authenticated: \"Supabase\",\n    anon: \"Supabase\",\n    service_role: \"Supabase\"\n};\n\n/**\n * Warn about rules that read as \"signed-in users only\" but admit anonymous\n * callers — `auth.uid() IS NOT NULL`, or a comparison against another\n * platform's magic user id such as `'anon'`.\n *\n * The sibling of {@link validatePolicyPgRoles}, for the more dangerous spelling\n * of the same habit. A foreign `pgRoles` value makes a policy unreachable and\n * the table reads empty — loud, and that guard throws. These do the opposite:\n * the rule compiles to a grant, and nothing looks wrong until the data is\n * already public.\n *\n * Warns rather than throws. Unlike an unreachable `pgRoles`, these rules are\n * serving traffic today: refusing to boot would take an app offline to report a\n * problem it already has, and on the read path it would take it offline\n * *because* its data was exposed. Rewriting the author's SQL is not an option\n * either — this is the escape hatch whose whole promise is that it means what it\n * says. So: say so, loudly, and leave the rule alone.\n */\nexport function warnOnAnonymousGrants(\n    collections: { slug?: string; securityRules?: readonly SecurityRule[] }[]\n): void {\n    // Grouped by the mistake, not by the rule: one habit typically repeats\n    // across every collection an author wrote, and a per-rule list would repeat\n    // the same paragraph dozens of times and get skimmed.\n    const byRisk = new Map<string, { risk: AnonymousGrantRisk; sites: string[] }>();\n\n    for (const collection of collections) {\n        for (const rule of collection.securityRules ?? []) {\n            const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);\n            const risks = [usingExpr, withCheckExpr]\n                .filter((e): e is PolicyExpression => e !== null)\n                .flatMap(findAnonymousGrants);\n\n            for (const risk of risks) {\n                const key = `${risk.pattern}:${risk.detail}`;\n                const site = `${collection.slug ?? \"(unnamed)\"} → \"${rule.name ?? \"(unnamed rule)\"}\"`;\n                const entry = byRisk.get(key) ?? { risk, sites: [] };\n                if (!entry.sites.includes(site)) entry.sites.push(site);\n                byRisk.set(key, entry);\n            }\n        }\n    }\n\n    if (byRisk.size === 0) return;\n\n    const problems = [...byRisk.values()].map(({ risk, sites }) =>\n        `  • ${risk.explanation}\\n    ${sites.length} rule(s): ${sites.join(\", \")}`\n    );\n\n    logger.warn(\n        `Security rules that read as a lockdown but grant access to anonymous requests. Every caller from a ` +\n        `client carries a user id ('${ANONYMOUS_USER_ID}' when nobody is signed in), so these clauses are ` +\n        `true for everyone:\\n\\n` +\n        problems.join(\"\\n\\n\") + \"\\n\"\n    );\n}\n\n/**\n * Name the collections whose raw policy SQL still calls the pre-1.0 helpers.\n *\n * The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the\n * database, so nothing is broken and no policy is wrong — which is exactly why\n * this has to be said out loud. A silent rewrite that works forever is not a\n * migration, it is a second supported spelling nobody wrote down, and the next\n * person to read those rules will copy the old one.\n *\n * Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,\n * `policy.rolesOverlap(...)`) compile from the model and were never affected.\n */\nexport function warnOnLegacyRlsFunctions(\n    collections: { slug?: string; securityRules?: readonly SecurityRule[] }[]\n): void {\n    const sites: string[] = [];\n\n    for (const collection of collections) {\n        for (const rule of collection.securityRules ?? []) {\n            const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);\n            const carriesLegacy = [usingExpr, withCheckExpr]\n                .filter((e): e is PolicyExpression => e !== null)\n                .some(containsLegacyRlsCall);\n            if (!carriesLegacy) continue;\n\n            const site = `${collection.slug ?? \"(unnamed)\"} → \"${rule.name ?? \"(unnamed rule)\"}\"`;\n            if (!sites.includes(site)) sites.push(site);\n        }\n    }\n\n    if (sites.length === 0) return;\n\n    logger.warn(\n        `These security rules call the pre-1.0 RLS helpers (\\`auth.uid()\\`, \\`auth.roles()\\`, \\`auth.jwt()\\`). ` +\n        `They still work — the compiler rewrites them — but the functions now live in the \\`rebase\\` schema, ` +\n        `and the \\`auth\\` one is Supabase's. Update the raw SQL in these rules to \\`${REBASE_SCHEMA}.uid()\\` ` +\n        `and friends, or switch them to the structured helpers (\\`policy.authUid()\\`, \\`policy.rolesOverlap()\\`), ` +\n        `which never had to be spelled by hand:\\n\\n` +\n        sites.map(s => `  • ${s}`).join(\"\\n\") + \"\\n\"\n    );\n}\n\n/** Whether any `raw` expression in the tree calls a pre-1.0 helper. */\nfunction containsLegacyRlsCall(expr: PolicyExpression): boolean {\n    switch (expr.kind) {\n        case \"raw\":\n            return usesLegacyRlsFunctions(expr.sql);\n        case \"and\":\n        case \"or\":\n            return expr.operands.some(containsLegacyRlsCall);\n        case \"not\":\n            return containsLegacyRlsCall(expr.operand);\n        case \"existsIn\":\n            return containsLegacyRlsCall(expr.where);\n        default:\n            return false;\n    }\n}\n\n/**\n * Reject `pgRoles` that this server can never satisfy.\n *\n * `pgRoles` sets the `TO` clause of a generated policy, so a policy naming a\n * role the request never runs as simply never applies — and RLS then filters\n * every row. The table reads as empty, which is indistinguishable from having\n * no data, so the mistake survives review and ships.\n *\n * Requests run as `rebase_user`, so a policy is only reachable if it targets\n * `public` or a role `rebase_user` holds. Anything else is a configuration\n * error worth failing the boot for.\n */\nexport async function validatePolicyPgRoles(\n    run: RawSqlRunner,\n    collections: { slug?: string; securityRules?: readonly { name?: string; pgRoles?: readonly string[] }[] }[],\n    /** The role requests actually run as: `rebase_user` when the connection is\n     *  privileged enough to switch, otherwise the connection role itself. */\n    requestRole: string = REBASE_USER_ROLE\n): Promise<void> {\n    const wanted = new Map<string, string[]>();\n    for (const collection of collections) {\n        for (const rule of collection.securityRules ?? []) {\n            for (const role of rule.pgRoles ?? []) {\n                if (role === \"public\") continue;\n                wanted.set(role, [...(wanted.get(role) ?? []), collection.slug ?? \"(unnamed)\"]);\n            }\n        }\n    }\n    if (wanted.size === 0) return;\n\n    const names = [...wanted.keys()].map((r) => `'${r.replace(/'/g, \"''\")}'`).join(\",\");\n    const escapedRequestRole = requestRole.replace(/'/g, \"''\");\n    const rows = await run(`\n        SELECT r.rolname AS role,\n               COALESCE(pg_has_role(to_regrole('${escapedRequestRole}'), r.oid, 'MEMBER'), false) AS reachable\n        FROM pg_roles r\n        WHERE r.rolname IN (${names})\n    `);\n\n    const reachable = new Map(rows.map((row) => [String(row.role), row.reachable === true]));\n    const problems: string[] = [];\n\n    for (const [role, slugs] of wanted) {\n        if (reachable.get(role) === true) continue;\n\n        const why = reachable.has(role)\n            ? `\"${requestRole}\" is not a member of it`\n            : \"no such role exists in this database\";\n        const platform = FOREIGN_CONVENTION_ROLES[role];\n        const hint = platform\n            ? `\"${role}\" is a ${platform} convention, not a PostgreSQL role. Application roles belong in \\`roles: [\"${role === \"service_role\" ? \"admin\" : role}\"]\\`, which is checked inside the policy via auth.roles().`\n            : `Either grant it (GRANT ${role} TO ${requestRole}) or drop \\`pgRoles\\` so the policy targets \\`public\\`.`;\n\n        problems.push(\n            `  • pgRoles: [\"${role}\"] on ${slugs.join(\", \")} — ${why}.\\n    ${hint}`\n        );\n    }\n\n    if (problems.length > 0) {\n        throw new Error(\n            `Security rules target PostgreSQL roles this server cannot use. Requests run as ` +\n            `\"${requestRole}\", so these policies would never apply and every row would be ` +\n            `filtered out — the collections would look empty rather than error.\\n\\n` +\n            problems.join(\"\\n\\n\") + \"\\n\"\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,IAAa,mBAAmB;;;;;;;;;;;AAYhC,IAAa,yBAA4C;CAErD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CAEA;AACJ;;AAGA,IAAM,kBAAkB;;;;;;;;;;;;;;;;;AAkBxB,SAAgB,uBAAuB,QAAgB,OAAuB;CAC1E,IAAI,CAAC,gBAAgB,KAAK,MAAM,GAC5B,MAAM,IAAI,MAAM,qDAAqD,KAAK,UAAU,MAAM,GAAG;CAEjG,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAC3B,MAAM,IAAI,MAAM,oDAAoD,KAAK,UAAU,KAAK,GAAG;CAE/F,MAAM,YAAY,IAAI,OAAO,KAAK,MAAM;CACxC,OAAO;;;iEAGsD,iBAAiB;kCAChD,UAAU;yCACH,UAAU,QAAQ,iBAAiB;;;;MAItE,KAAK;AACX;;;;;;;;;AAUA,eAAsB,0BAClB,SACA,QACA,SACa;CACb,KAAK,MAAM,SAAS,SAAS,UAAU,wBACnC,IAAI;EACA,MAAM,QAAQ,uBAAuB,QAAQ,KAAK,CAAC;CACvD,SAAS,OAAO;EACZ,SAAS,UAAU,OAAO,KAAK;CACnC;AAER;;;ACrEA,IAAM,cAAc,SAAyB,IAAI,KAAK,QAAQ,MAAM,MAAM,EAAE;;AAG5E,IAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6B9B,eAAsB,0BAA0B,KAAkC;CAC9E,IAAI;EACA,MAAM,OAAO,MAAM,IAAI;;;;;SAKtB;EACD,IAAI,KAAK,EAAE,EAAE,aAAa,MAAM;EAChC,MAAM,OAAO,OAAO,KAAK,EAAE,EAAE,QAAQ,qBAAqB;EAC1D,OAAO,KACH,0BAA0B,KAAK,4IAC+C,KAAK,gMAED,KAAK,gNAI3F;CACJ,QAAQ,CAER;AACJ;AAEA,eAAsB,wBAAwB,KAA+C;CAazF,MAAM,OAAM,MAZO,IAAI;;;;;;;;;;;KAWtB,EAAA,CACgB,MAAM,CAAC;CACxB,MAAM,YAAY,IAAI,cAAc;CACpC,MAAM,YAAY,IAAI,cAAc;CACpC,MAAM,aAAa,IAAI,gBAAgB;CACvC,OAAO;EACH,MAAM,OAAO,IAAI,QAAQ,SAAS;EAClC;EACA;EACA;EACA,YAAY,aAAa,aAAa;CAC1C;AACJ;;;;;AAMA,SAAgB,yBAAyB,gBAAwB,SAA2B;CACxF,MAAM,SAAS,QAAQ,KAAK,MACxB,yBAAyB,WAAW,CAAC,EAAE,MAAM,iBAAiB,WACrD,sBAAsB,2BAA2B,WAAW,CAAC,EAAE,MAAM,iBAAiB,oDAC7C,WAAW,CAAC,EAAE,MAAM,iBAAiB,EAC3F,CAAC,CAAC,KAAK,IAAI;CACX,OACI,gGACwB,iBAAiB,8BACrC,eAAe,kIAEJ,iBAAiB,qDACvB,iBAAiB,MAAM,WAAW,cAAc,EAAE,OAC3D;AAER;;;;;;;;;;;;;;;;;AAkBA,eAAsB,cAAc,KAAmB,SAAkC;CACrF,MAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,QAAQ,OAAO,OAAO,CAAC,CAAC;CAIjE,KAAI,MADmB,IAAI,sDAA8D,EAAA,CAC5E,WAAW,GACpB,IAAI;EACA,MAAM,IAAI,eAAe,iBAAiB,2CAA2C;CACzF,SAAS,KAAK;EACV,MAAM,IAAI,MACN,yBAAyB,iBAAiB,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,QACrG,yBAAyB,2BAA2B,aAAa,CACrE;CACJ;CAIJ,MAAM,aAAa,MAAM,IAAI;6CACY,iBAAiB;;;KAGzD;CACD,IAAI,WAAW,EAAE,EAAE,YAAY,MAC3B,IAAI;EACA,MAAM,IAAI,SAAS,iBAAiB,iBAAiB;CACzD,SAAS,KAAK;EACV,MAAM,IAAI,MACN,2CAA2C,iBAAiB,wCACzD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,QACpD,yBAAyB,OAAO,WAAW,EAAE,EAAE,QAAQ,yBAAyB,GAAG,aAAa,CACpG;CACJ;CAKJ,MAAM,UAAU,MAAM,IAAI,kCAAkC;CAC5D,MAAM,WAAW,IAAI,IAAI,QAAQ,KAAK,MAAM,OAAO,EAAE,OAAO,CAAC,CAAC;CAC9D,KAAK,MAAM,UAAU,eAAe;EAChC,IAAI,CAAC,SAAS,IAAI,MAAM,GAAG;EAC3B,MAAM,IAAI,WAAW,MAAM;EAC3B,MAAM,IAAI,yBAAyB,EAAE,MAAM,kBAAkB;EAC7D,MAAM,IAAI,SAAS,sBAAsB,2BAA2B,EAAE,MAAM,kBAAkB;EAC9F,MAAM,IAAI,kDAAkD,EAAE,MAAM,kBAAkB;EAGtF,MAAM,IAAI,sCAAsC,EAAE,SAAS,sBAAsB,gBAAgB,kBAAkB;EACnH,MAAM,IAAI,sCAAsC,EAAE,uCAAuC,kBAAkB;EAS3G,MAAM,0BAA0B,OAAO,SAAS;GAAE,MAAM,IAAI,IAAI;EAAG,GAAG,QAAQ,EAC1E,UAAU,OAAO,UAAU,OAAO,KAC9B,8BAA8B,iBAAiB,eAAe,OAAO,KAAK,MAAM,uDAE/E,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC1D,EACJ,CAAC;CACL;CAEA,OAAO,MAAM,uBAAuB,iBAAiB,0BAA0B,cAAc,KAAK,IAAI,EAAE,EAAE;AAC9G;;;;;;;;;;;;;;;;;;;;;;;AAwBA,eAAsB,iBAAiB,IAAW,MAAmB,UAAkC;CACnG,MAAM,MAAM,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,MAAM,KAAK,KAAK,MAAM;CAChF,MAAM,kBAAkB,KAAK,MAAM,KAAK,MACpC,OAAO,MAAM,WAAW,IAAK,GAA+B,MAAM,OAAO,CAAC,CAC9E;CAMA,MAAM,GAAG,QAAQ,GAAU;;oCAEK,IAAI;wCACA,IAAI;2CACD,gBAAgB,KAAK,GAAG,EAAE;oCACjC,KAAK,UAAU;EAAE,KAAK;EAAK,OAAO,KAAK;CAAM,CAAC,EAAE;KAC/E;CACD,IAAI,UACA,MAAM,GAAG,QAAQ,IAAW,IAAI,kBAAkB,WAAW,QAAQ,GAAG,CAAC;AAEjF;;AAGA,IAAM,2BAAmD;CACrD,eAAe;CACf,MAAM;CACN,cAAc;AAClB;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,sBACZ,aACI;CAIJ,MAAM,yBAAS,IAAI,IAA2D;CAE9E,KAAK,MAAM,cAAc,aACrB,KAAK,MAAM,QAAQ,WAAW,iBAAiB,CAAC,GAAG;EAC/C,MAAM,EAAE,WAAW,kBAAkB,yBAAyB,IAAI;EAClE,MAAM,QAAQ,CAAC,WAAW,aAAa,CAAC,CACnC,QAAQ,MAA6B,MAAM,IAAI,CAAC,CAChD,QAAQ,mBAAmB;EAEhC,KAAK,MAAM,QAAQ,OAAO;GACtB,MAAM,MAAM,GAAG,KAAK,QAAQ,GAAG,KAAK;GACpC,MAAM,OAAO,GAAG,WAAW,QAAQ,YAAY,MAAM,KAAK,QAAQ,iBAAiB;GACnF,MAAM,QAAQ,OAAO,IAAI,GAAG,KAAK;IAAE;IAAM,OAAO,CAAC;GAAE;GACnD,IAAI,CAAC,MAAM,MAAM,SAAS,IAAI,GAAG,MAAM,MAAM,KAAK,IAAI;GACtD,OAAO,IAAI,KAAK,KAAK;EACzB;CACJ;CAGJ,IAAI,OAAO,SAAS,GAAG;CAEvB,MAAM,WAAW,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,YAC/C,OAAO,KAAK,YAAY,QAAQ,MAAM,OAAO,YAAY,MAAM,KAAK,IAAI,GAC5E;CAEA,OAAO,KACH,iIAC8B,kBAAkB,4EAEhD,SAAS,KAAK,MAAM,IAAI,IAC5B;AACJ;;;;;;;;;;;;;AAcA,SAAgB,yBACZ,aACI;CACJ,MAAM,QAAkB,CAAC;CAEzB,KAAK,MAAM,cAAc,aACrB,KAAK,MAAM,QAAQ,WAAW,iBAAiB,CAAC,GAAG;EAC/C,MAAM,EAAE,WAAW,kBAAkB,yBAAyB,IAAI;EAIlE,IAAI,CAHkB,CAAC,WAAW,aAAa,CAAC,CAC3C,QAAQ,MAA6B,MAAM,IAAI,CAAC,CAChD,KAAK,qBACL,GAAe;EAEpB,MAAM,OAAO,GAAG,WAAW,QAAQ,YAAY,MAAM,KAAK,QAAQ,iBAAiB;EACnF,IAAI,CAAC,MAAM,SAAS,IAAI,GAAG,MAAM,KAAK,IAAI;CAC9C;CAGJ,IAAI,MAAM,WAAW,GAAG;CAExB,OAAO,KACH,wRAE8E,cAAc,gKAG5F,MAAM,KAAI,MAAK,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,IAC5C;AACJ;;AAGA,SAAS,sBAAsB,MAAiC;CAC5D,QAAQ,KAAK,MAAb;EACI,KAAK,OACD,OAAO,uBAAuB,KAAK,GAAG;EAC1C,KAAK;EACL,KAAK,MACD,OAAO,KAAK,SAAS,KAAK,qBAAqB;EACnD,KAAK,OACD,OAAO,sBAAsB,KAAK,OAAO;EAC7C,KAAK,YACD,OAAO,sBAAsB,KAAK,KAAK;EAC3C,SACI,OAAO;CACf;AACJ;;;;;;;;;;;;;AAcA,eAAsB,sBAClB,KACA,aAGA,cAAsB,kBACT;CACb,MAAM,yBAAS,IAAI,IAAsB;CACzC,KAAK,MAAM,cAAc,aACrB,KAAK,MAAM,QAAQ,WAAW,iBAAiB,CAAC,GAC5C,KAAK,MAAM,QAAQ,KAAK,WAAW,CAAC,GAAG;EACnC,IAAI,SAAS,UAAU;EACvB,OAAO,IAAI,MAAM,CAAC,GAAI,OAAO,IAAI,IAAI,KAAK,CAAC,GAAI,WAAW,QAAQ,WAAW,CAAC;CAClF;CAGR,IAAI,OAAO,SAAS,GAAG;CAEvB,MAAM,QAAQ,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,EAAE,QAAQ,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG;CAElF,MAAM,OAAO,MAAM,IAAI;;kDADI,YAAY,QAAQ,MAAM,IAGP,EAAmB;;8BAEvC,MAAM;KAC/B;CAED,MAAM,YAAY,IAAI,IAAI,KAAK,KAAK,QAAQ,CAAC,OAAO,IAAI,IAAI,GAAG,IAAI,cAAc,IAAI,CAAC,CAAC;CACvF,MAAM,WAAqB,CAAC;CAE5B,KAAK,MAAM,CAAC,MAAM,UAAU,QAAQ;EAChC,IAAI,UAAU,IAAI,IAAI,MAAM,MAAM;EAElC,MAAM,MAAM,UAAU,IAAI,IAAI,IACxB,IAAI,YAAY,2BAChB;EACN,MAAM,WAAW,yBAAyB;EAC1C,MAAM,OAAO,WACP,IAAI,KAAK,SAAS,SAAS,6EAA6E,SAAS,iBAAiB,UAAU,KAAK,8DACjJ,0BAA0B,KAAK,MAAM,YAAY;EAEvD,SAAS,KACL,kBAAkB,KAAK,QAAQ,MAAM,KAAK,IAAI,EAAE,KAAK,IAAI,SAAS,MACtE;CACJ;CAEA,IAAI,SAAS,SAAS,GAClB,MAAM,IAAI,MACN,mFACI,YAAY,wIAEhB,SAAS,KAAK,MAAM,IAAI,IAC5B;AAER"}