@rebasepro/server-postgres 0.18.0 → 0.19.0

package/dist/vector-index-DkWxm2de.js

@@ -0,0 +1,309 @@
+import { createRequire as __createRequire } from "module";
+__createRequire(import.meta.url);
+import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
+import { isPostgresCollectionConfig } from "@rebasepro/types";
+import { getTableName } from "@rebasepro/common";
+import { toPostgresIdentifier } from "@rebasepro/utils";
+//#region src/schema/vector-index.ts
+var vector_index_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_VECTOR_DISTANCE: () => DEFAULT_VECTOR_DISTANCE,
+	DEFAULT_VECTOR_INDEX_METHOD: () => DEFAULT_VECTOR_INDEX_METHOD,
+	MAX_INDEXABLE_VECTOR_DIMENSIONS: () => MAX_INDEXABLE_VECTOR_DIMENSIONS,
+	VECTOR_EXTENSION: () => VECTOR_EXTENSION,
+	VECTOR_EXTENSION_OPT_IN: () => VECTOR_EXTENSION_OPT_IN,
+	VECTOR_EXTENSION_SCHEMA: () => VECTOR_EXTENSION_SCHEMA,
+	VectorIndexConfigError: () => VectorIndexConfigError,
+	buildVectorColumnSpecs: () => buildVectorColumnSpecs,
+	buildVectorIndexPlan: () => buildVectorIndexPlan,
+	vectorColumnDefinition: () => vectorColumnDefinition,
+	vectorColumnType: () => vectorColumnType,
+	vectorDimensionGuard: () => vectorDimensionGuard,
+	vectorExtensionDeclared: () => vectorExtensionDeclared,
+	vectorExtensionHint: () => vectorExtensionHint,
+	vectorExtensionStatement: () => vectorExtensionStatement,
+	vectorIndexNames: () => vectorIndexNames,
+	vectorIndexStatement: () => vectorIndexStatement,
+	vectorIndexStatements: () => vectorIndexStatements,
+	vectorObjectNames: () => vectorObjectNames
+});
+/**
+* The widest `vector` pgvector will build an HNSW or IVFFlat index over.
+* Storage and exact search are unaffected by this limit.
+*/
+var MAX_INDEXABLE_VECTOR_DIMENSIONS = 2e3;
+/** The distance indexed when a property does not name one. */
+var DEFAULT_VECTOR_DISTANCE = "cosine";
+/** The index method used when a property does not name one. */
+var DEFAULT_VECTOR_INDEX_METHOD = "hnsw";
+/**
+* Operator class per distance. These strings are part of the database contract:
+* they appear in `CREATE INDEX`, so renaming one renames an index.
+*/
+var OPERATOR_CLASS = {
+	cosine: "vector_cosine_ops",
+	l2: "vector_l2_ops",
+	inner_product: "vector_ip_ops"
+};
+/** Short, stable tag per distance, used to name the index. */
+var DISTANCE_TAG = {
+	cosine: "cosine",
+	l2: "l2",
+	inner_product: "ip"
+};
+var VectorIndexConfigError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "VectorIndexConfigError";
+	}
+};
+var isVectorProperty = (prop) => !!prop && typeof prop === "object" && prop.type === "vector";
+var asDistances = (config, label) => {
+	const raw = config.distance ?? "cosine";
+	const list = Array.isArray(raw) ? raw : [raw];
+	if (list.length === 0) throw new VectorIndexConfigError(`${label}: \`index.distance\` is an empty array. Name at least one distance, or set \`index: false\` to create no index.`);
+	const seen = /* @__PURE__ */ new Set();
+	for (const distance of list) {
+		if (!(distance in OPERATOR_CLASS)) throw new VectorIndexConfigError(`${label}: \`index.distance\` is "${distance}", which is not a pgvector distance. Use ${Object.keys(OPERATOR_CLASS).map((d) => `"${d}"`).join(", ")}.`);
+		if (seen.has(distance)) throw new VectorIndexConfigError(`${label}: \`index.distance\` lists "${distance}" twice.`);
+		seen.add(distance);
+	}
+	return list;
+};
+var assertPositiveInteger = (value, key, label) => {
+	if (value === void 0) return;
+	if (!Number.isInteger(value) || value <= 0) throw new VectorIndexConfigError(`${label}: \`index.${key}\` is ${JSON.stringify(value)}. It must be a positive integer.`);
+};
+/**
+* Index parameters for one method. Parameters belonging to the *other* method
+* are rejected rather than ignored, because a silently dropped `lists` on an
+* HNSW index reads, from the config, exactly like a tuned index.
+*/
+var parametersFor = (method, config, label) => {
+	assertPositiveInteger(config.m, "m", label);
+	assertPositiveInteger(config.efConstruction, "efConstruction", label);
+	assertPositiveInteger(config.lists, "lists", label);
+	if (method === "hnsw") {
+		if (config.lists !== void 0) throw new VectorIndexConfigError(`${label}: \`index.lists\` only applies to \`method: "ivfflat"\`. Remove it, or switch the method.`);
+		const params = [];
+		if (config.m !== void 0) params.push(["m", config.m]);
+		if (config.efConstruction !== void 0) params.push(["ef_construction", config.efConstruction]);
+		return params;
+	}
+	for (const key of ["m", "efConstruction"]) if (config[key] !== void 0) throw new VectorIndexConfigError(`${label}: \`index.${key}\` only applies to \`method: "hnsw"\`. Remove it, or switch the method.`);
+	return config.lists !== void 0 ? [["lists", config.lists]] : [];
+};
+/**
+* Every ANN index a collection's vector properties call for.
+*
+* `resolveColumn` is passed in rather than imported so that this module stays
+* free of the DDL generator, which imports *it*. Both callers hand it the same
+* `resolveColumnName`, and a contract test asserts the names agree.
+*/
+var buildVectorIndexPlan = (collection, resolveColumn) => {
+	const specs = [];
+	const skipped = [];
+	const properties = collection.properties ?? {};
+	const table = getTableName(collection);
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	for (const [propName, prop] of Object.entries(properties)) {
+		if (!isVectorProperty(prop)) continue;
+		if (prop.index === false) continue;
+		const label = `${collection.slug}.${propName}`;
+		const column = resolveColumn(propName, prop);
+		const config = prop.index ?? {};
+		const method = config.method ?? "hnsw";
+		if (method !== "hnsw" && method !== "ivfflat") throw new VectorIndexConfigError(`${label}: \`index.method\` is "${method}". Use "hnsw" or "ivfflat".`);
+		const distances = asDistances(config, label);
+		const parameters = parametersFor(method, config, label);
+		if (!Number.isInteger(prop.dimensions) || prop.dimensions <= 0) throw new VectorIndexConfigError(`${label}: \`dimensions\` is ${JSON.stringify(prop.dimensions)}. It must be a positive integer.`);
+		if (prop.dimensions > 2e3) {
+			skipped.push({
+				schema,
+				table,
+				column,
+				dimensions: prop.dimensions,
+				reason: `pgvector cannot index a vector wider than ${MAX_INDEXABLE_VECTOR_DIMENSIONS} dimensions, and ${label} declares ${prop.dimensions}. The column works and \`vectorSearch\` still answers, as an exact scan. To index it, reduce the dimensions (many embedding models support a shorter output) or set \`index: false\` to state that the scan is intended.`
+			});
+			continue;
+		}
+		for (const distance of distances) specs.push({
+			schema,
+			table,
+			column,
+			indexName: toPostgresIdentifier(`${table}_${column}_${method}_${DISTANCE_TAG[distance]}`),
+			method,
+			distance,
+			operatorClass: OPERATOR_CLASS[distance],
+			parameters
+		});
+	}
+	return {
+		specs,
+		skipped
+	};
+};
+/**
+* The `CREATE INDEX` for one spec.
+*
+* `CONCURRENTLY` is deliberately absent, for the same reason it is absent from
+* `searchIndexStatements`: this form is replayed as part of a migration, where
+* a concurrent build is not allowed. The boot-time ensure rewrites it — see
+* `ensureCollectionTables`.
+*/
+var vectorIndexStatement = (spec) => {
+	const params = spec.parameters.length ? ` WITH (${spec.parameters.map(([key, value]) => `${key} = ${value}`).join(", ")})` : "";
+	return `CREATE INDEX IF NOT EXISTS "${spec.indexName}" ON "${spec.schema}"."${spec.table}" USING ${spec.method} ("${spec.column}" ${spec.operatorClass})${params};`;
+};
+/** Every statement for a plan, in a stable order. */
+var vectorIndexStatements = (plan) => plan.specs.map(vectorIndexStatement);
+/** The index names a plan creates — what the derived-names contract records. */
+var vectorIndexNames = (plan) => plan.specs.map((spec) => spec.indexName);
+var quote = (v) => `'${v.replace(/'/g, "''")}'`;
+/**
+* The schema pgvector's types are installed into.
+*
+* `WITH SCHEMA public` for the same load-bearing reason `searchExtensionStatements`
+* gives: an unqualified `CREATE EXTENSION` lands in the first schema on
+* `search_path`, which is `"$user", public` — and the scaffold's role is named
+* `rebase`, the same as a schema the generator creates. Left to itself the
+* extension would install into `rebase`, and every unqualified `VECTOR(n)`
+* below would fail to resolve.
+*/
+var VECTOR_EXTENSION_SCHEMA = "public";
+/** The extension name a database has to name to let Rebase install pgvector. */
+var VECTOR_EXTENSION = "vector";
+/**
+* How a project says Rebase may install pgvector, quoted into the messages that
+* have to name it. Spelled once so the option and the advice cannot drift.
+*/
+var VECTOR_EXTENSION_OPT_IN = `database({ extensions: ["${VECTOR_EXTENSION}"] })`;
+/** Did the project give Rebase leave to install pgvector? */
+var vectorExtensionDeclared = (extensions) => (extensions ?? []).includes(VECTOR_EXTENSION);
+/**
+* Install pgvector — emitted only when the database asked for it.
+*
+* Opt-in because installing an extension is a decision with a deployment behind
+* it: the image has to ship the library, the role has to be allowed to install
+* it, and a managed provider has to have it on an allow-list. None of that is
+* visible from inside the connection, so Rebase does not decide it. See
+* `DatabaseOptions.extensions`.
+*
+* Withholding the statement is not withholding the *column*: the column is
+* still created, and Postgres refuses it with `type "vector" does not exist`
+* on a database where pgvector was never installed by hand. That error is the
+* one this design accepts, and `vectorExtensionHint` is what makes it name
+* {@link VECTOR_EXTENSION_OPT_IN} rather than nothing.
+*/
+var vectorExtensionStatement = () => `CREATE EXTENSION IF NOT EXISTS ${VECTOR_EXTENSION} WITH SCHEMA ${VECTOR_EXTENSION_SCHEMA};`;
+/**
+* The missing-pgvector explanation, appended to whichever error revealed it.
+*
+* Two readers, needing opposite things, which is why the branch is on the error
+* text rather than on the configuration:
+*
+*  - **`type "vector" does not exist`** — nobody opted in and the database has
+*    no pgvector. The fix is one line of config they cannot guess, so naming
+*    the option *is* the hint.
+*  - **the install itself failed** — the config is already right, and repeating
+*    the option would send them to edit a correct line. What is missing is the
+*    library on the server, or the grant.
+*
+* Lives here rather than beside either caller because both need it: the boot
+* ensure raises the first through its action applier, and `rebase db push`
+* raises it out of `applyVectorDdl`. A hint on only one path is how a bare
+* `type "vector" does not exist` reaches somebody — which is the thing this
+* exists to prevent.
+*/
+var vectorExtensionHint = (message) => {
+	if (/extension "vector" is not available/i.test(message) || /(permission denied to create extension|must be (superuser|owner).{0,40}extension)/i.test(message)) return "\n  pgvector was declared and could not be installed. It is a server extension, so it needs an image that ships the library (the scaffold's `pgvector/pgvector:pg18` does; a stock `postgres:18` does not) and a role allowed to run `CREATE EXTENSION vector;`. Managed Postgres usually allows it once the extension is on the provider's allow-list.";
+	if (!/type "(vector|halfvec|sparsevec)" does not exist/i.test(message)) return "";
+	return `
+  pgvector is not installed on this database, and Rebase installs it only where a database says it may: add \`${VECTOR_EXTENSION_OPT_IN}\` in config/resources.ts, or install it once by hand with \`CREATE EXTENSION vector;\`. Either way the server needs an image that ships the library — the scaffold's \`pgvector/pgvector:pg18\` does, a stock \`postgres:18\` does not. Rebase then creates the column and its ANN index automatically — see the \`index\` option on the property.`;
+};
+/**
+* Every vector column a collection declares.
+*
+* Wider than {@link buildVectorIndexPlan} on purpose: that one answers "what
+* gets an ANN index", and skips both a property with `index: false` and one too
+* wide to index. Either still needs its column.
+*/
+var buildVectorColumnSpecs = (collection, resolveColumn) => {
+	const table = getTableName(collection);
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	const specs = [];
+	for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
+		if (!isVectorProperty(prop)) continue;
+		const validation = prop.validation;
+		let modifiers = "";
+		if (validation?.unique) modifiers += " UNIQUE";
+		if (validation?.required) modifiers += " NOT NULL";
+		specs.push({
+			schema,
+			table,
+			column: resolveColumn(propName, prop),
+			dimensions: prop.dimensions,
+			modifiers
+		});
+	}
+	return specs;
+};
+/** The column type — the one place `VECTOR(n)` is spelled. */
+var vectorColumnType = (spec) => `VECTOR(${spec.dimensions})`;
+/** The column definition as it appears inside `CREATE TABLE`. */
+var vectorColumnDefinition = (spec) => `"${spec.column}" ${vectorColumnType(spec)}${spec.modifiers}`;
+/**
+* Refuse — or perform — a `dimensions` change that `ADD COLUMN IF NOT EXISTS`
+* would otherwise swallow.
+*
+* Without this the file *launders* the change: the ADD is a no-op against a
+* column that exists, so a project that went from 384 to 768 dimensions would
+* push clean, keep a 384-wide column, and fail on the next insert with a
+* message about the row rather than about the config. Atlas used to catch this
+* — it owned the column and planned the `ALTER … TYPE` — and taking the column
+* out of its sight is exactly what makes the guard necessary.
+*
+* The widening is performed when the column holds no values, because that is
+* the case Atlas handled and it is the common one: a developer changing
+* embedding models before there are any embeddings. With values present the
+* conversion is pgvector's to reject — every stored vector is the old width —
+* so this refuses first and names the statement to run afterwards.
+*
+* `atttypmod` on a `vector` column *is* the dimension count: pgvector stores it
+* directly rather than offsetting it the way `varchar` does. `-1` means the
+* column was declared as a bare `vector`, which is drift in the same sense.
+*/
+var vectorDimensionGuard = (spec) => {
+	const relation = `"${spec.schema}"."${spec.table}"`;
+	return `DO $rebase_vector$
+DECLARE actual int;
+BEGIN
+    SELECT a.atttypmod INTO actual
+    FROM pg_attribute a
+    JOIN pg_type t ON t.oid = a.atttypid
+    WHERE a.attrelid = ${quote(relation)}::regclass
+      AND a.attname = ${quote(spec.column)}
+      AND NOT a.attisdropped
+      AND t.typname = 'vector';
+    IF actual IS NOT NULL AND actual <> ${spec.dimensions} THEN
+        IF EXISTS (SELECT 1 FROM ${relation} WHERE "${spec.column}" IS NOT NULL) THEN
+            RAISE EXCEPTION 'Rebase: ${spec.schema}.${spec.table}."${spec.column}" declares ${spec.dimensions} dimensions but the column is vector(%), and it already holds values of the old width. pgvector cannot convert them. Re-embed the rows at ${spec.dimensions} dimensions (or clear the column), then re-apply: ALTER TABLE ${relation} ALTER COLUMN "${spec.column}" TYPE ${vectorColumnType(spec)};', actual;
+        END IF;
+        ALTER TABLE ${relation} ALTER COLUMN "${spec.column}" TYPE ${vectorColumnType(spec)};
+    END IF;
+END
+$rebase_vector$;`;
+};
+/**
+* The object names a collection's vector properties own, unqualified.
+*
+* What Atlas has to be told to exclude. Only the column and the ANN indexes: a
+* `UNIQUE` or `NOT NULL` on the column is a property *of* the column, and
+* excluding the column takes them with it — measured against Atlas 1.2.3 and
+* 1.3.2, where a target carrying `vector(3) NOT NULL UNIQUE` and a `schema.sql`
+* carrying neither reported "Schema is synced, no changes to be made".
+*/
+var vectorObjectNames = (collection, resolveColumn) => [...buildVectorColumnSpecs(collection, resolveColumn).map((spec) => spec.column), ...vectorIndexNames(buildVectorIndexPlan(collection, resolveColumn))];
+//#endregion
+export { vectorDimensionGuard as a, vectorExtensionStatement as c, vectorObjectNames as d, vector_index_exports as f, vectorColumnDefinition as i, vectorIndexStatement as l, buildVectorColumnSpecs as n, vectorExtensionDeclared as o, buildVectorIndexPlan as r, vectorExtensionHint as s, VECTOR_EXTENSION_OPT_IN as t, vectorIndexStatements as u };
+
+//# sourceMappingURL=vector-index-DkWxm2de.js.map

package/dist/vector-index-DkWxm2de.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vector-index-DkWxm2de.js","names":[],"sources":["../src/schema/vector-index.ts"],"sourcesContent":["/**\n * The one place a `{ type: \"vector\" }` property becomes an ANN index.\n *\n * Without an index, pgvector answers `ORDER BY embedding <=> $1` by computing\n * the distance to every row and sorting — exact, and linear. That is the right\n * answer at ten thousand rows and the wrong one at a million, which is why the\n * default here is to build an index rather than to leave the column bare.\n *\n * ## The operator class is not a detail\n *\n * An index is built for exactly one operator class, and the planner uses it\n * only for the operator that class implements. `vector_cosine_ops` answers\n * `<=>` and nothing else; a query asking for `<->` against a cosine index gets\n * a sequential scan and no error. So the default indexed distance here is\n * `cosine`, because `cosine` is what `vectorSearch` measures with when the\n * caller does not say — see `DrizzleConditionBuilder.buildVectorSearch`. The\n * two defaults have to agree, and this comment is the reason they do.\n *\n * ## Why 2000 dimensions is a ceiling and not an error\n *\n * pgvector cannot index a `vector` wider than 2000 dimensions with either\n * method. A 3072-dimension embedding (`text-embedding-3-large`) is therefore\n * storable and searchable but not indexable. Refusing the boot over that would\n * make a working configuration unbootable; silently indexing it is impossible.\n * So the column is created, the index is skipped, and the reason is reported.\n *\n * Like `search-column.ts`, this module exists so that the DDL generator and the\n * boot-time ensure render the *same* specification rather than describing the\n * same index twice, differently. `contracts/derived-names.txt` records the\n * names both produce, and CI fails if they diverge.\n *\n * ## And why the column itself is described here too\n *\n * `VECTOR(n)` is a type Atlas cannot be shown. It has to materialise the\n * desired state in a dev database to diff against, that database is created\n * empty and *emptied again* by Atlas at the start of every run, and nothing in\n * the free tier can put `CREATE EXTENSION vector` back — so a `schema.sql`\n * mentioning the type fails with `type \"vector\" does not exist` on every push,\n * for good. Search hit the same wall for its own reasons and took the same way\n * out: the objects leave `schema.sql`, Atlas is told to exclude them, and\n * Rebase applies them itself. See `generatePostgresVectorDdl`.\n */\nimport type { CollectionConfig, Property, VectorDistance, VectorIndexConfig } from \"@rebasepro/types\";\nimport { isPostgresCollectionConfig } from \"@rebasepro/types\";\nimport { getTableName } from \"@rebasepro/common\";\nimport { toPostgresIdentifier } from \"@rebasepro/utils\";\n\n/**\n * The widest `vector` pgvector will build an HNSW or IVFFlat index over.\n * Storage and exact search are unaffected by this limit.\n */\nexport const MAX_INDEXABLE_VECTOR_DIMENSIONS = 2000;\n\n/** The distance indexed when a property does not name one. */\nexport const DEFAULT_VECTOR_DISTANCE: VectorDistance = \"cosine\";\n\n/** The index method used when a property does not name one. */\nexport const DEFAULT_VECTOR_INDEX_METHOD = \"hnsw\" as const;\n\n/**\n * Operator class per distance. These strings are part of the database contract:\n * they appear in `CREATE INDEX`, so renaming one renames an index.\n */\nconst OPERATOR_CLASS: Record<VectorDistance, string> = {\n    cosine: \"vector_cosine_ops\",\n    l2: \"vector_l2_ops\",\n    inner_product: \"vector_ip_ops\"\n};\n\n/** Short, stable tag per distance, used to name the index. */\nconst DISTANCE_TAG: Record<VectorDistance, string> = {\n    cosine: \"cosine\",\n    l2: \"l2\",\n    inner_product: \"ip\"\n};\n\nexport interface VectorIndexSpec {\n    schema: string;\n    table: string;\n    column: string;\n    indexName: string;\n    method: \"hnsw\" | \"ivfflat\";\n    distance: VectorDistance;\n    operatorClass: string;\n    /** Rendered into `WITH (...)`; empty when every parameter is defaulted. */\n    parameters: Array<[string, number]>;\n}\n\n/** A vector column that will not be indexed, and why. */\nexport interface SkippedVectorIndex {\n    schema: string;\n    table: string;\n    column: string;\n    dimensions: number;\n    reason: string;\n}\n\nexport interface VectorIndexPlan {\n    specs: VectorIndexSpec[];\n    skipped: SkippedVectorIndex[];\n}\n\nexport class VectorIndexConfigError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"VectorIndexConfigError\";\n    }\n}\n\nconst isVectorProperty = (prop: unknown): prop is Property & {\n    type: \"vector\";\n    dimensions: number;\n    index?: VectorIndexConfig | false;\n} => !!prop && typeof prop === \"object\" && (prop as { type?: string }).type === \"vector\";\n\nconst asDistances = (config: VectorIndexConfig, label: string): VectorDistance[] => {\n    const raw = config.distance ?? DEFAULT_VECTOR_DISTANCE;\n    const list = Array.isArray(raw) ? raw : [raw];\n    if (list.length === 0) {\n        throw new VectorIndexConfigError(\n            `${label}: \\`index.distance\\` is an empty array. Name at least one distance, or set \\`index: false\\` to create no index.`\n        );\n    }\n    const seen = new Set<VectorDistance>();\n    for (const distance of list) {\n        if (!(distance in OPERATOR_CLASS)) {\n            throw new VectorIndexConfigError(\n                `${label}: \\`index.distance\\` is \"${distance}\", which is not a pgvector distance. Use ${Object.keys(OPERATOR_CLASS).map(d => `\"${d}\"`).join(\", \")}.`\n            );\n        }\n        if (seen.has(distance)) {\n            throw new VectorIndexConfigError(`${label}: \\`index.distance\\` lists \"${distance}\" twice.`);\n        }\n        seen.add(distance);\n    }\n    return list;\n};\n\nconst assertPositiveInteger = (value: number | undefined, key: string, label: string): void => {\n    if (value === undefined) return;\n    if (!Number.isInteger(value) || value <= 0) {\n        throw new VectorIndexConfigError(\n            `${label}: \\`index.${key}\\` is ${JSON.stringify(value)}. It must be a positive integer.`\n        );\n    }\n};\n\n/**\n * Index parameters for one method. Parameters belonging to the *other* method\n * are rejected rather than ignored, because a silently dropped `lists` on an\n * HNSW index reads, from the config, exactly like a tuned index.\n */\nconst parametersFor = (\n    method: \"hnsw\" | \"ivfflat\",\n    config: VectorIndexConfig,\n    label: string\n): Array<[string, number]> => {\n    assertPositiveInteger(config.m, \"m\", label);\n    assertPositiveInteger(config.efConstruction, \"efConstruction\", label);\n    assertPositiveInteger(config.lists, \"lists\", label);\n\n    if (method === \"hnsw\") {\n        if (config.lists !== undefined) {\n            throw new VectorIndexConfigError(\n                `${label}: \\`index.lists\\` only applies to \\`method: \"ivfflat\"\\`. Remove it, or switch the method.`\n            );\n        }\n        const params: Array<[string, number]> = [];\n        if (config.m !== undefined) params.push([\"m\", config.m]);\n        if (config.efConstruction !== undefined) params.push([\"ef_construction\", config.efConstruction]);\n        return params;\n    }\n\n    for (const key of [\"m\", \"efConstruction\"] as const) {\n        if (config[key] !== undefined) {\n            throw new VectorIndexConfigError(\n                `${label}: \\`index.${key}\\` only applies to \\`method: \"hnsw\"\\`. Remove it, or switch the method.`\n            );\n        }\n    }\n    return config.lists !== undefined ? [[\"lists\", config.lists]] : [];\n};\n\n/**\n * Every ANN index a collection's vector properties call for.\n *\n * `resolveColumn` is passed in rather than imported so that this module stays\n * free of the DDL generator, which imports *it*. Both callers hand it the same\n * `resolveColumnName`, and a contract test asserts the names agree.\n */\nexport const buildVectorIndexPlan = (\n    collection: CollectionConfig,\n    resolveColumn: (propName: string, prop?: Property | null) => string\n): VectorIndexPlan => {\n    const specs: VectorIndexSpec[] = [];\n    const skipped: SkippedVectorIndex[] = [];\n    const properties = collection.properties ?? {};\n\n    const table = getTableName(collection);\n    const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n\n    for (const [propName, prop] of Object.entries(properties)) {\n        if (!isVectorProperty(prop)) continue;\n        if (prop.index === false) continue;\n\n        const label = `${collection.slug}.${propName}`;\n        const column = resolveColumn(propName, prop as Property);\n        const config: VectorIndexConfig = prop.index ?? {};\n        const method = config.method ?? DEFAULT_VECTOR_INDEX_METHOD;\n\n        if (method !== \"hnsw\" && method !== \"ivfflat\") {\n            throw new VectorIndexConfigError(\n                `${label}: \\`index.method\\` is \"${method}\". Use \"hnsw\" or \"ivfflat\".`\n            );\n        }\n\n        // Read before the dimension gate so a malformed block is reported even\n        // on a column too wide to index — the config is wrong either way.\n        const distances = asDistances(config, label);\n        const parameters = parametersFor(method, config, label);\n\n        if (!Number.isInteger(prop.dimensions) || prop.dimensions <= 0) {\n            throw new VectorIndexConfigError(\n                `${label}: \\`dimensions\\` is ${JSON.stringify(prop.dimensions)}. It must be a positive integer.`\n            );\n        }\n\n        if (prop.dimensions > MAX_INDEXABLE_VECTOR_DIMENSIONS) {\n            skipped.push({\n                schema,\n                table,\n                column,\n                dimensions: prop.dimensions,\n                reason:\n                    `pgvector cannot index a vector wider than ${MAX_INDEXABLE_VECTOR_DIMENSIONS} dimensions, and ` +\n                    `${label} declares ${prop.dimensions}. The column works and \\`vectorSearch\\` still answers, as an ` +\n                    `exact scan. To index it, reduce the dimensions (many embedding models support a shorter output) ` +\n                    `or set \\`index: false\\` to state that the scan is intended.`\n            });\n            continue;\n        }\n\n        for (const distance of distances) {\n            specs.push({\n                schema,\n                table,\n                column,\n                // Distance is in the name because one column may carry an index\n                // per distance, and two indexes cannot share a name. The method\n                // is in it because switching methods is a different index, not\n                // a redefinition of the same one — `CREATE INDEX IF NOT EXISTS`\n                // would otherwise keep the old one and report success.\n                indexName: toPostgresIdentifier(`${table}_${column}_${method}_${DISTANCE_TAG[distance]}`),\n                method,\n                distance,\n                operatorClass: OPERATOR_CLASS[distance],\n                parameters\n            });\n        }\n    }\n\n    return { specs, skipped };\n};\n\n/**\n * The `CREATE INDEX` for one spec.\n *\n * `CONCURRENTLY` is deliberately absent, for the same reason it is absent from\n * `searchIndexStatements`: this form is replayed as part of a migration, where\n * a concurrent build is not allowed. The boot-time ensure rewrites it — see\n * `ensureCollectionTables`.\n */\nexport const vectorIndexStatement = (spec: VectorIndexSpec): string => {\n    const params = spec.parameters.length\n        ? ` WITH (${spec.parameters.map(([key, value]) => `${key} = ${value}`).join(\", \")})`\n        : \"\";\n    return (\n        `CREATE INDEX IF NOT EXISTS \"${spec.indexName}\" ON \"${spec.schema}\".\"${spec.table}\" ` +\n        `USING ${spec.method} (\"${spec.column}\" ${spec.operatorClass})${params};`\n    );\n};\n\n/** Every statement for a plan, in a stable order. */\nexport const vectorIndexStatements = (plan: VectorIndexPlan): string[] =>\n    plan.specs.map(vectorIndexStatement);\n\n/** The index names a plan creates — what the derived-names contract records. */\nexport const vectorIndexNames = (plan: VectorIndexPlan): string[] =>\n    plan.specs.map(spec => spec.indexName);\n\n// ── The column, for the file Rebase applies itself ──────────────────────────\n\nconst quote = (v: string): string => `'${v.replace(/'/g, \"''\")}'`;\n\n/**\n * The schema pgvector's types are installed into.\n *\n * `WITH SCHEMA public` for the same load-bearing reason `searchExtensionStatements`\n * gives: an unqualified `CREATE EXTENSION` lands in the first schema on\n * `search_path`, which is `\"$user\", public` — and the scaffold's role is named\n * `rebase`, the same as a schema the generator creates. Left to itself the\n * extension would install into `rebase`, and every unqualified `VECTOR(n)`\n * below would fail to resolve.\n */\nexport const VECTOR_EXTENSION_SCHEMA = \"public\";\n\n/** The extension name a database has to name to let Rebase install pgvector. */\nexport const VECTOR_EXTENSION = \"vector\";\n\n/**\n * How a project says Rebase may install pgvector, quoted into the messages that\n * have to name it. Spelled once so the option and the advice cannot drift.\n */\nexport const VECTOR_EXTENSION_OPT_IN = `database({ extensions: [\"${VECTOR_EXTENSION}\"] })`;\n\n/** Did the project give Rebase leave to install pgvector? */\nexport const vectorExtensionDeclared = (extensions: readonly string[] | undefined): boolean =>\n    (extensions ?? []).includes(VECTOR_EXTENSION);\n\n/**\n * Install pgvector — emitted only when the database asked for it.\n *\n * Opt-in because installing an extension is a decision with a deployment behind\n * it: the image has to ship the library, the role has to be allowed to install\n * it, and a managed provider has to have it on an allow-list. None of that is\n * visible from inside the connection, so Rebase does not decide it. See\n * `DatabaseOptions.extensions`.\n *\n * Withholding the statement is not withholding the *column*: the column is\n * still created, and Postgres refuses it with `type \"vector\" does not exist`\n * on a database where pgvector was never installed by hand. That error is the\n * one this design accepts, and `vectorExtensionHint` is what makes it name\n * {@link VECTOR_EXTENSION_OPT_IN} rather than nothing.\n */\nexport const vectorExtensionStatement = (): string =>\n    `CREATE EXTENSION IF NOT EXISTS ${VECTOR_EXTENSION} WITH SCHEMA ${VECTOR_EXTENSION_SCHEMA};`;\n\n/**\n * The missing-pgvector explanation, appended to whichever error revealed it.\n *\n * Two readers, needing opposite things, which is why the branch is on the error\n * text rather than on the configuration:\n *\n *  - **`type \"vector\" does not exist`** — nobody opted in and the database has\n *    no pgvector. The fix is one line of config they cannot guess, so naming\n *    the option *is* the hint.\n *  - **the install itself failed** — the config is already right, and repeating\n *    the option would send them to edit a correct line. What is missing is the\n *    library on the server, or the grant.\n *\n * Lives here rather than beside either caller because both need it: the boot\n * ensure raises the first through its action applier, and `rebase db push`\n * raises it out of `applyVectorDdl`. A hint on only one path is how a bare\n * `type \"vector\" does not exist` reaches somebody — which is the thing this\n * exists to prevent.\n */\nexport const vectorExtensionHint = (message: string): string => {\n    const installRefused = /extension \"vector\" is not available/i.test(message)\n        || /(permission denied to create extension|must be (superuser|owner).{0,40}extension)/i.test(message);\n    if (installRefused) {\n        return (\n            \"\\n  pgvector was declared and could not be installed. It is a server extension, so it needs an image \" +\n            \"that ships the library (the scaffold's `pgvector/pgvector:pg18` does; a stock `postgres:18` does not) \" +\n            \"and a role allowed to run `CREATE EXTENSION vector;`. Managed Postgres usually allows it once the \" +\n            \"extension is on the provider's allow-list.\"\n        );\n    }\n    if (!/type \"(vector|halfvec|sparsevec)\" does not exist/i.test(message)) return \"\";\n    return (\n        \"\\n  pgvector is not installed on this database, and Rebase installs it only where a database says it may: \" +\n        `add \\`${VECTOR_EXTENSION_OPT_IN}\\` in config/resources.ts, or install it once by hand with ` +\n        \"`CREATE EXTENSION vector;`. Either way the server needs an image that ships the library — the scaffold's \" +\n        \"`pgvector/pgvector:pg18` does, a stock `postgres:18` does not. Rebase then creates the column and its ANN \" +\n        \"index automatically — see the `index` option on the property.\"\n    );\n};\n\n/** One `{ type: \"vector\" }` property, as a column. */\nexport interface VectorColumnSpec {\n    schema: string;\n    table: string;\n    column: string;\n    dimensions: number;\n    /** Rendered after the type, in the generator's order: UNIQUE then NOT NULL. */\n    modifiers: string;\n}\n\n/**\n * Every vector column a collection declares.\n *\n * Wider than {@link buildVectorIndexPlan} on purpose: that one answers \"what\n * gets an ANN index\", and skips both a property with `index: false` and one too\n * wide to index. Either still needs its column.\n */\nexport const buildVectorColumnSpecs = (\n    collection: CollectionConfig,\n    resolveColumn: (propName: string, prop?: Property | null) => string\n): VectorColumnSpec[] => {\n    const table = getTableName(collection);\n    const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\";\n    const specs: VectorColumnSpec[] = [];\n\n    for (const [propName, prop] of Object.entries(collection.properties ?? {})) {\n        if (!isVectorProperty(prop)) continue;\n        // Assembled in the CREATE TABLE generator's order, so the column this\n        // file adds and the column `schema.sql` used to declare are the same\n        // column. A vector property is never a primary key and carries no\n        // SQL-level default, which is what leaves only these two.\n        const validation = (prop as { validation?: { required?: boolean; unique?: boolean } }).validation;\n        let modifiers = \"\";\n        if (validation?.unique) modifiers += \" UNIQUE\";\n        if (validation?.required) modifiers += \" NOT NULL\";\n        specs.push({\n            schema,\n            table,\n            column: resolveColumn(propName, prop as Property),\n            dimensions: prop.dimensions,\n            modifiers\n        });\n    }\n\n    return specs;\n};\n\n/** The column type — the one place `VECTOR(n)` is spelled. */\nexport const vectorColumnType = (spec: Pick<VectorColumnSpec, \"dimensions\">): string =>\n    `VECTOR(${spec.dimensions})`;\n\n/** The column definition as it appears inside `CREATE TABLE`. */\nexport const vectorColumnDefinition = (spec: VectorColumnSpec): string =>\n    `\"${spec.column}\" ${vectorColumnType(spec)}${spec.modifiers}`;\n\n/**\n * Refuse — or perform — a `dimensions` change that `ADD COLUMN IF NOT EXISTS`\n * would otherwise swallow.\n *\n * Without this the file *launders* the change: the ADD is a no-op against a\n * column that exists, so a project that went from 384 to 768 dimensions would\n * push clean, keep a 384-wide column, and fail on the next insert with a\n * message about the row rather than about the config. Atlas used to catch this\n * — it owned the column and planned the `ALTER … TYPE` — and taking the column\n * out of its sight is exactly what makes the guard necessary.\n *\n * The widening is performed when the column holds no values, because that is\n * the case Atlas handled and it is the common one: a developer changing\n * embedding models before there are any embeddings. With values present the\n * conversion is pgvector's to reject — every stored vector is the old width —\n * so this refuses first and names the statement to run afterwards.\n *\n * `atttypmod` on a `vector` column *is* the dimension count: pgvector stores it\n * directly rather than offsetting it the way `varchar` does. `-1` means the\n * column was declared as a bare `vector`, which is drift in the same sense.\n */\nexport const vectorDimensionGuard = (spec: VectorColumnSpec): string => {\n    const relation = `\"${spec.schema}\".\"${spec.table}\"`;\n    return `DO $rebase_vector$\nDECLARE actual int;\nBEGIN\n    SELECT a.atttypmod INTO actual\n    FROM pg_attribute a\n    JOIN pg_type t ON t.oid = a.atttypid\n    WHERE a.attrelid = ${quote(relation)}::regclass\n      AND a.attname = ${quote(spec.column)}\n      AND NOT a.attisdropped\n      AND t.typname = 'vector';\n    IF actual IS NOT NULL AND actual <> ${spec.dimensions} THEN\n        IF EXISTS (SELECT 1 FROM ${relation} WHERE \"${spec.column}\" IS NOT NULL) THEN\n            RAISE EXCEPTION 'Rebase: ${spec.schema}.${spec.table}.\"${spec.column}\" declares ${spec.dimensions} dimensions but the column is vector(%), and it already holds values of the old width. pgvector cannot convert them. Re-embed the rows at ${spec.dimensions} dimensions (or clear the column), then re-apply: ALTER TABLE ${relation} ALTER COLUMN \"${spec.column}\" TYPE ${vectorColumnType(spec)};', actual;\n        END IF;\n        ALTER TABLE ${relation} ALTER COLUMN \"${spec.column}\" TYPE ${vectorColumnType(spec)};\n    END IF;\nEND\n$rebase_vector$;`;\n};\n\n/**\n * The object names a collection's vector properties own, unqualified.\n *\n * What Atlas has to be told to exclude. Only the column and the ANN indexes: a\n * `UNIQUE` or `NOT NULL` on the column is a property *of* the column, and\n * excluding the column takes them with it — measured against Atlas 1.2.3 and\n * 1.3.2, where a target carrying `vector(3) NOT NULL UNIQUE` and a `schema.sql`\n * carrying neither reported \"Schema is synced, no changes to be made\".\n */\nexport const vectorObjectNames = (\n    collection: CollectionConfig,\n    resolveColumn: (propName: string, prop?: Property | null) => string\n): string[] => [\n    ...buildVectorColumnSpecs(collection, resolveColumn).map(spec => spec.column),\n    ...vectorIndexNames(buildVectorIndexPlan(collection, resolveColumn))\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,IAAa,kCAAkC;;AAG/C,IAAa,0BAA0C;;AAGvD,IAAa,8BAA8B;;;;;AAM3C,IAAM,iBAAiD;CACnD,QAAQ;CACR,IAAI;CACJ,eAAe;AACnB;;AAGA,IAAM,eAA+C;CACjD,QAAQ;CACR,IAAI;CACJ,eAAe;AACnB;AA4BA,IAAa,yBAAb,cAA4C,MAAM;CAC9C,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;AAEA,IAAM,oBAAoB,SAIrB,CAAC,CAAC,QAAQ,OAAO,SAAS,YAAa,KAA2B,SAAS;AAEhF,IAAM,eAAe,QAA2B,UAAoC;CAChF,MAAM,MAAM,OAAO,YAAA;CACnB,MAAM,OAAO,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG;CAC5C,IAAI,KAAK,WAAW,GAChB,MAAM,IAAI,uBACN,GAAG,MAAM,gHACb;CAEJ,MAAM,uBAAO,IAAI,IAAoB;CACrC,KAAK,MAAM,YAAY,MAAM;EACzB,IAAI,EAAE,YAAY,iBACd,MAAM,IAAI,uBACN,GAAG,MAAM,2BAA2B,SAAS,2CAA2C,OAAO,KAAK,cAAc,CAAC,CAAC,KAAI,MAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EACtJ;EAEJ,IAAI,KAAK,IAAI,QAAQ,GACjB,MAAM,IAAI,uBAAuB,GAAG,MAAM,8BAA8B,SAAS,SAAS;EAE9F,KAAK,IAAI,QAAQ;CACrB;CACA,OAAO;AACX;AAEA,IAAM,yBAAyB,OAA2B,KAAa,UAAwB;CAC3F,IAAI,UAAU,KAAA,GAAW;CACzB,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GACrC,MAAM,IAAI,uBACN,GAAG,MAAM,YAAY,IAAI,QAAQ,KAAK,UAAU,KAAK,EAAE,iCAC3D;AAER;;;;;;AAOA,IAAM,iBACF,QACA,QACA,UAC0B;CAC1B,sBAAsB,OAAO,GAAG,KAAK,KAAK;CAC1C,sBAAsB,OAAO,gBAAgB,kBAAkB,KAAK;CACpE,sBAAsB,OAAO,OAAO,SAAS,KAAK;CAElD,IAAI,WAAW,QAAQ;EACnB,IAAI,OAAO,UAAU,KAAA,GACjB,MAAM,IAAI,uBACN,GAAG,MAAM,0FACb;EAEJ,MAAM,SAAkC,CAAC;EACzC,IAAI,OAAO,MAAM,KAAA,GAAW,OAAO,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC;EACvD,IAAI,OAAO,mBAAmB,KAAA,GAAW,OAAO,KAAK,CAAC,mBAAmB,OAAO,cAAc,CAAC;EAC/F,OAAO;CACX;CAEA,KAAK,MAAM,OAAO,CAAC,KAAK,gBAAgB,GACpC,IAAI,OAAO,SAAS,KAAA,GAChB,MAAM,IAAI,uBACN,GAAG,MAAM,YAAY,IAAI,wEAC7B;CAGR,OAAO,OAAO,UAAU,KAAA,IAAY,CAAC,CAAC,SAAS,OAAO,KAAK,CAAC,IAAI,CAAC;AACrE;;;;;;;;AASA,IAAa,wBACT,YACA,kBACkB;CAClB,MAAM,QAA2B,CAAC;CAClC,MAAM,UAAgC,CAAC;CACvC,MAAM,aAAa,WAAW,cAAc,CAAC;CAE7C,MAAM,QAAQ,aAAa,UAAU;CACrC,MAAM,SAAS,2BAA2B,UAAU,KAAK,WAAW,SAAS,WAAW,SAAS;CAEjG,KAAK,MAAM,CAAC,UAAU,SAAS,OAAO,QAAQ,UAAU,GAAG;EACvD,IAAI,CAAC,iBAAiB,IAAI,GAAG;EAC7B,IAAI,KAAK,UAAU,OAAO;EAE1B,MAAM,QAAQ,GAAG,WAAW,KAAK,GAAG;EACpC,MAAM,SAAS,cAAc,UAAU,IAAgB;EACvD,MAAM,SAA4B,KAAK,SAAS,CAAC;EACjD,MAAM,SAAS,OAAO,UAAA;EAEtB,IAAI,WAAW,UAAU,WAAW,WAChC,MAAM,IAAI,uBACN,GAAG,MAAM,yBAAyB,OAAO,4BAC7C;EAKJ,MAAM,YAAY,YAAY,QAAQ,KAAK;EAC3C,MAAM,aAAa,cAAc,QAAQ,QAAQ,KAAK;EAEtD,IAAI,CAAC,OAAO,UAAU,KAAK,UAAU,KAAK,KAAK,cAAc,GACzD,MAAM,IAAI,uBACN,GAAG,MAAM,sBAAsB,KAAK,UAAU,KAAK,UAAU,EAAE,iCACnE;EAGJ,IAAI,KAAK,aAAA,KAA8C;GACnD,QAAQ,KAAK;IACT;IACA;IACA;IACA,YAAY,KAAK;IACjB,QACI,6CAA6C,gCAAgC,mBAC1E,MAAM,YAAY,KAAK,WAAW;GAG7C,CAAC;GACD;EACJ;EAEA,KAAK,MAAM,YAAY,WACnB,MAAM,KAAK;GACP;GACA;GACA;GAMA,WAAW,qBAAqB,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,WAAW;GACxF;GACA;GACA,eAAe,eAAe;GAC9B;EACJ,CAAC;CAET;CAEA,OAAO;EAAE;EAAO;CAAQ;AAC5B;;;;;;;;;AAUA,IAAa,wBAAwB,SAAkC;CACnE,MAAM,SAAS,KAAK,WAAW,SACzB,UAAU,KAAK,WAAW,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,KAChF;CACN,OACI,+BAA+B,KAAK,UAAU,QAAQ,KAAK,OAAO,KAAK,KAAK,MAAM,UACzE,KAAK,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,cAAc,GAAG,OAAO;AAE/E;;AAGA,IAAa,yBAAyB,SAClC,KAAK,MAAM,IAAI,oBAAoB;;AAGvC,IAAa,oBAAoB,SAC7B,KAAK,MAAM,KAAI,SAAQ,KAAK,SAAS;AAIzC,IAAM,SAAS,MAAsB,IAAI,EAAE,QAAQ,MAAM,IAAI,EAAE;;;;;;;;;;;AAY/D,IAAa,0BAA0B;;AAGvC,IAAa,mBAAmB;;;;;AAMhC,IAAa,0BAA0B,4BAA4B,iBAAiB;;AAGpF,IAAa,2BAA2B,gBACnC,cAAc,CAAC,EAAA,CAAG,SAAS,gBAAgB;;;;;;;;;;;;;;;;AAiBhD,IAAa,iCACT,kCAAkC,iBAAiB,eAAe,wBAAwB;;;;;;;;;;;;;;;;;;;;AAqB9F,IAAa,uBAAuB,YAA4B;CAG5D,IAFuB,uCAAuC,KAAK,OAAO,KACnE,qFAAqF,KAAK,OAAO,GAEpG,OACI;CAMR,IAAI,CAAC,oDAAoD,KAAK,OAAO,GAAG,OAAO;CAC/E,OACI;gHACS,wBAAwB;AAKzC;;;;;;;;AAmBA,IAAa,0BACT,YACA,kBACqB;CACrB,MAAM,QAAQ,aAAa,UAAU;CACrC,MAAM,SAAS,2BAA2B,UAAU,KAAK,WAAW,SAAS,WAAW,SAAS;CACjG,MAAM,QAA4B,CAAC;CAEnC,KAAK,MAAM,CAAC,UAAU,SAAS,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,GAAG;EACxE,IAAI,CAAC,iBAAiB,IAAI,GAAG;EAK7B,MAAM,aAAc,KAAmE;EACvF,IAAI,YAAY;EAChB,IAAI,YAAY,QAAQ,aAAa;EACrC,IAAI,YAAY,UAAU,aAAa;EACvC,MAAM,KAAK;GACP;GACA;GACA,QAAQ,cAAc,UAAU,IAAgB;GAChD,YAAY,KAAK;GACjB;EACJ,CAAC;CACL;CAEA,OAAO;AACX;;AAGA,IAAa,oBAAoB,SAC7B,UAAU,KAAK,WAAW;;AAG9B,IAAa,0BAA0B,SACnC,IAAI,KAAK,OAAO,IAAI,iBAAiB,IAAI,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;AAuBtD,IAAa,wBAAwB,SAAmC;CACpE,MAAM,WAAW,IAAI,KAAK,OAAO,KAAK,KAAK,MAAM;CACjD,OAAO;;;;;;yBAMc,MAAM,QAAQ,EAAE;wBACjB,MAAM,KAAK,MAAM,EAAE;;;0CAGD,KAAK,WAAW;mCACvB,SAAS,UAAU,KAAK,OAAO;uCAC3B,KAAK,OAAO,GAAG,KAAK,MAAM,IAAI,KAAK,OAAO,aAAa,KAAK,WAAW,4IAA4I,KAAK,WAAW,gEAAgE,SAAS,iBAAiB,KAAK,OAAO,SAAS,iBAAiB,IAAI,EAAE;;sBAE1X,SAAS,iBAAiB,KAAK,OAAO,SAAS,iBAAiB,IAAI,EAAE;;;;AAI5F;;;;;;;;;;AAWA,IAAa,qBACT,YACA,kBACW,CACX,GAAG,uBAAuB,YAAY,aAAa,CAAC,CAAC,KAAI,SAAQ,KAAK,MAAM,GAC5E,GAAG,iBAAiB,qBAAqB,YAAY,aAAa,CAAC,CACvE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/server-postgres",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "keywords": [
     "cms",
@@ -51,11 +51,11 @@
     "execa": "^9.6.1",
     "pg": "^8.22.0",
     "ws": "^8.21.1",
-    "@rebasepro/codegen": "0.18.0",
-    "@rebasepro/common": "0.18.0",
-    "@rebasepro/server": "0.18.0",
-    "@rebasepro/types": "0.18.0",
-    "@rebasepro/utils": "0.18.0"
+    "@rebasepro/codegen": "0.19.0",
+    "@rebasepro/common": "0.19.0",
+    "@rebasepro/server": "0.19.0",
+    "@rebasepro/types": "0.19.0",
+    "@rebasepro/utils": "0.19.0"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.12",
@@ -70,7 +70,7 @@
     "typescript": "^6.0.3",
     "vite": "^8.1.5",
     "vitest": "^4.1.10",
-    "@rebasepro/client": "0.18.0"
+    "@rebasepro/client": "0.19.0"
   },
   "gitHead": "d935eefa5aa8d1009a2398cfac2c1e4ee9aeb6b6",
   "publishConfig": {

package/dist/ensure-collection-policies-CagOzEPS.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ensure-collection-policies-CagOzEPS.js","names":[],"sources":["../src/security/policy-drift.ts","../src/schema/ensure-collection-policies.ts"],"sourcesContent":["/**\n * Compare the RLS policies a database actually has against the ones the\n * collections describe.\n *\n * Policies live in Postgres; the collection config is only their *source*.\n * Nothing reconciled the two, which is how the demo database served empty\n * collections indefinitely: its policies granted `TO authenticated` (a Supabase\n * role name) while requests run as `rebase_user`, so RLS filtered every row.\n * The config was later corrected and the database never noticed — an empty\n * table is indistinguishable from a table with no data.\n *\n * Expected policies are parsed from `generatePostgresPoliciesDdl`, the same\n * function `db push` uses to write `drizzle/policies.sql`, so this compares\n * against exactly what would be applied rather than a reimplementation.\n */\nimport { RLS_UID_SQL, type CollectionConfig } from \"@rebasepro/types\";\n\nimport { generatePostgresPoliciesDdl } from \"../schema/generate-postgres-ddl-logic\";\n\nexport interface PolicyRef {\n    schema: string;\n    table: string;\n    name: string;\n    /** Roles in the TO clause. */\n    roles: string[];\n    /** SELECT / INSERT / UPDATE / DELETE / ALL. */\n    command: string;\n    /** Whether a USING clause is present at all (not what it says). */\n    hasUsing: boolean;\n    /** Whether a WITH CHECK clause is present at all (not what it says). */\n    hasWithCheck: boolean;\n    /**\n     * PERMISSIVE or RESTRICTIVE — the `AS` clause.\n     *\n     * An exact catalogue value on both sides, so it belongs with roles and\n     * command rather than with the expression text. It matters more than either:\n     * permissive policies are ORed together and restrictive ones ANDed, so a rule\n     * declared `mode: \"restrictive\"` whose live policy is PERMISSIVE has had its\n     * gate turned from a requirement into an alternative — the maximally\n     * permissive way for this to be wrong.\n     *\n     * The DDL regex captured this from the start and the destructuring threw it\n     * away; `pg_policies.permissive` was never selected.\n     */\n    mode?: \"PERMISSIVE\" | \"RESTRICTIVE\";\n    /**\n     * The live clause text, when read from `pg_policies`. Present only for live\n     * policies (the expected side is parsed from DDL and does not carry it).\n     * Used solely for the insecure-tautology scan, not for divergence — Postgres\n     * rewrites this text, so it is not safe to diff against expected.\n     */\n    qual?: string | null;\n    withCheck?: string | null;\n}\n\nexport interface PolicyDrift {\n    /** Described by the collections, absent from the database. */\n    missing: PolicyRef[];\n    /** In the database, described by no collection — stale pushes live here. */\n    orphaned: PolicyRef[];\n    /** Same policy name, different roles or command. */\n    diverged: { expected: PolicyRef; actual: PolicyRef; differences: string[] }[];\n    /**\n     * A live policy whose expression is the known-permissive tautology\n     * `rebase.uid() IS NOT NULL` — true for anonymous visitors too, because the\n     * user path coerces a blank id to the `'anonymous'` sentinel. This is what\n     * `policy.authenticated()` used to compile to, so a database pushed before\n     * that fix carries it, and neither the name, roles, command nor clause\n     * *presence* differs from the corrected policy — the only thing that changed\n     * is the expression text, which this checker otherwise (correctly) ignores.\n     * So it is the one drift that hides from every other check here.\n     *\n     * @see reason  a sentence naming the clause and what to do.\n     */\n    insecure: { policy: PolicyRef; reason: string }[];\n    /**\n     * A table the collections describe whose RLS switch is off.\n     *\n     * `ALTER TABLE posts DISABLE ROW LEVEL SECURITY` leaves every row in\n     * `pg_policies` untouched, so before this category every expected policy\n     * still matched on name, roles, command and clause presence and the checker\n     * reported clean — on a table Postgres was applying no filter to at all.\n     * Requests run as `rebase_user`, which holds full DML, so the table is wide\n     * open while `doctor` certifies it.\n     *\n     * `forced` reports `relforcerowsecurity`, which is what also subjects the\n     * table's *owner* to its policies. Its absence is not drift on its own —\n     * Rebase does not connect as the owner in the request path — so it is\n     * reported for context rather than raised as a failure.\n     */\n    rlsDisabled: { schema: string; table: string; forced: boolean }[];\n}\n\nexport interface Queryable {\n    query<R>(text: string, values?: unknown[]): Promise<{ rows: R[] }>;\n}\n\n// The trailing group captures whichever clause follows the TO list, which is\n// what tells us the clause is present.\nconst CREATE_POLICY = /CREATE POLICY \"([^\"]+)\" ON \"([^\"]+)\"\\.\"([^\"]+)\"\\s+AS (\\w+)\\s+FOR (\\w+)\\s+TO ([^\\n]+?)(\\s+USING\\s*\\(|\\s+WITH CHECK\\s*\\(|;)/gi;\n\nconst WITH_CHECK_NEXT = /^\\s+WITH CHECK\\s*\\(/i;\n\n/**\n * Index just past the `)` closing a clause whose `(` ends at `open`.\n *\n * Needed because a policy expression nests parens and can contain a quoted\n * literal holding either character, so \"find the next `)`\" would stop early and\n * miss the `WITH CHECK` that follows.\n */\nfunction clauseEnd(ddl: string, open: number): number {\n    let depth = 1;\n    let inQuote = false;\n    for (let i = open; i < ddl.length; i++) {\n        const c = ddl[i];\n        if (inQuote) {\n            // '' is an escaped quote inside a string, not a close.\n            if (c === \"'\") {\n                if (ddl[i + 1] === \"'\") i++;\n                else inQuote = false;\n            }\n            continue;\n        }\n        if (c === \"'\") inQuote = true;\n        else if (c === \"(\") depth++;\n        else if (c === \")\" && --depth === 0) return i + 1;\n    }\n    return ddl.length;\n}\n\n/**\n * `AS PERMISSIVE` / `AS RESTRICTIVE` from either side, or undefined.\n *\n * The DDL spells it as a bare word; `pg_policies.permissive` is the string\n * `\"PERMISSIVE\"`/`\"RESTRICTIVE\"` on modern Postgres but a boolean on some\n * drivers and older servers, so both are accepted. Anything unrecognised\n * becomes `undefined` and the comparison below skips it rather than inventing\n * drift from a shape we did not anticipate.\n */\nfunction normalizeMode(raw: unknown): \"PERMISSIVE\" | \"RESTRICTIVE\" | undefined {\n    if (typeof raw === \"boolean\") return raw ? \"PERMISSIVE\" : \"RESTRICTIVE\";\n    if (typeof raw !== \"string\") return undefined;\n    const upper = raw.trim().toUpperCase();\n    if (upper === \"PERMISSIVE\" || upper === \"TRUE\" || upper === \"T\") return \"PERMISSIVE\";\n    if (upper === \"RESTRICTIVE\" || upper === \"FALSE\" || upper === \"F\") return \"RESTRICTIVE\";\n    return undefined;\n}\n\n/** Parse the generated DDL rather than rebuilding the shape by hand. */\nexport function parseExpectedPolicies(ddl: string): PolicyRef[] {\n    const found: PolicyRef[] = [];\n    for (const m of ddl.matchAll(CREATE_POLICY)) {\n        const [, name, schema, table, modeRaw, command, rolesRaw, clause] = m;\n        const roles = rolesRaw\n            .split(\",\")\n            .map((r) => r.trim().replace(/^\"|\"$/g, \"\"))\n            .filter(Boolean);\n\n        // The generator emits USING before WITH CHECK, so what follows the TO\n        // list settles USING; WITH CHECK is then whatever follows that clause.\n        const hasUsing = /USING/i.test(clause);\n        const hasWithCheck = hasUsing\n            ? WITH_CHECK_NEXT.test(ddl.slice(clauseEnd(ddl, m.index + m[0].length)))\n            : /WITH CHECK/i.test(clause);\n\n        found.push({\n            schema, table, name, roles,\n            command: command.toUpperCase(),\n            hasUsing, hasWithCheck,\n            mode: normalizeMode(modeRaw)\n        });\n    }\n    return found;\n}\n\nasync function readLivePolicies(client: Queryable, schemas: string[]): Promise<PolicyRef[]> {\n    const { rows } = await client.query<{\n        schemaname: string; tablename: string; policyname: string; roles: string[] | string; cmd: string;\n        qual: string | null; with_check: string | null; permissive: string | boolean | null;\n    }>(\n        `SELECT schemaname, tablename, policyname, roles, cmd, qual, with_check, permissive\n         FROM pg_policies\n         WHERE schemaname = ANY($1)`,\n        [schemas]\n    );\n\n    return rows.map((r) => ({\n        schema: r.schemaname,\n        table: r.tablename,\n        name: r.policyname,\n        // node-postgres yields text[] as an array; some drivers hand back \"{a,b}\".\n        roles: Array.isArray(r.roles)\n            ? r.roles\n            : String(r.roles ?? \"\").replace(/^\\{|\\}$/g, \"\").split(\",\").filter(Boolean),\n        command: (r.cmd ?? \"ALL\").toUpperCase(),\n        // Presence only. Postgres rewrites the text, but it does not invent or\n        // drop a clause: NULL here means the policy genuinely has none.\n        hasUsing: r.qual != null,\n        hasWithCheck: r.with_check != null,\n        mode: normalizeMode(r.permissive),\n        qual: r.qual,\n        withCheck: r.with_check\n    }));\n}\n\n/**\n * Tables the collections describe whose RLS switch is off.\n *\n * Read from `pg_class` because `pg_policies` cannot answer it: disabling RLS\n * leaves the policy rows in place, so every other comparison in this file keeps\n * matching while Postgres applies none of them.\n *\n * Only tables that expect at least one policy are considered. A table with no\n * declared rules is not asserting anything about RLS, and reporting it would\n * make the check noisy on exactly the projects least able to judge the noise.\n */\nasync function readTablesWithRlsOff(\n    client: Queryable,\n    tables: { schema: string; table: string }[]\n): Promise<{ schema: string; table: string; forced: boolean }[]> {\n    if (tables.length === 0) return [];\n    const { rows } = await client.query<{\n        schemaname: string; tablename: string; relrowsecurity: boolean; relforcerowsecurity: boolean;\n    }>(\n        `SELECT n.nspname AS schemaname,\n                c.relname AS tablename,\n                c.relrowsecurity,\n                c.relforcerowsecurity\n           FROM pg_class c\n           JOIN pg_namespace n ON n.oid = c.relnamespace\n          WHERE c.relkind = 'r'\n            AND (n.nspname || '.' || c.relname) = ANY($1)`,\n        [tables.map((t) => `${t.schema}.${t.table}`)]\n    );\n\n    return rows\n        .filter((r) => !r.relrowsecurity)\n        .map((r) => ({\n            schema: r.schemaname,\n            table: r.tablename,\n            forced: !!r.relforcerowsecurity\n        }));\n}\n\n/**\n * The permissive tautology `rebase.uid() IS NOT NULL`, without the\n * `<> 'anonymous'` guard that makes it mean \"signed in\".\n *\n * Whitespace varies with Postgres's rewrite, so match on a collapsed form. The\n * guard clause (`<> 'anonymous'`, in any spelling) is what distinguishes the\n * corrected policy from the stale one, so its presence clears the text.\n *\n * Both schema spellings are matched. The helpers moved from `auth` to `rebase`\n * in 1.0, and this check reads policies *as the database stored them*: a\n * database pushed before the move still holds `auth.uid()` until it is\n * recompiled, while everything written since — including raw `securityRules`\n * SQL, which the compiler rewrites on the way in — stores `rebase.uid()`.\n * Matching only the pre-1.0 name made the check blind to every policy a current\n * release could write, which is precisely the set still worth scanning.\n */\nfunction isPermissiveAuthTautology(clause: string | null | undefined): boolean {\n    if (!clause) return false;\n    const flat = clause.toLowerCase().replace(/\\s+/g, \" \");\n    if (!/\\b(?:rebase|auth)\\.uid\\s*\\(\\s*\\)\\s*is not null/.test(flat)) return false;\n    // The fix appends `AND rebase.uid() <> 'anonymous'`; Postgres may store the\n    // literal as `'anonymous'::text`. Either spelling means it is the corrected\n    // policy, not the tautology.\n    return !/<>\\s*'anonymous'/.test(flat) && !/!=\\s*'anonymous'/.test(flat);\n}\n\nconst keyOf = (p: PolicyRef) => `${p.schema}.${p.table}.${p.name}`;\nconst sameRoles = (a: string[], b: string[]) =>\n    a.length === b.length && [...a].sort().join(\",\") === [...b].sort().join(\",\");\n\n/**\n * Diff expected against live.\n *\n * Compares names, roles, command, and whether each clause exists — all exact\n * values. Policy expression *text* is deliberately not compared: Postgres\n * rewrites `qual`/`with_check` when storing them (parenthesising, casting,\n * schema-qualifying), so text comparison reports drift that does not exist, and\n * a check that cries wolf gets ignored.\n *\n * Presence is not text, though. A NULL `qual` is not a rewrite of an\n * expression, it is the absence of one, and absence has no false-positive risk:\n * either the generator emitted a clause or it did not. That distinction is worth\n * the extra comparison — a production database was found with a SELECT policy\n * whose `qual` was NULL, matching on every field this checked and denying 100%\n * of reads. The same blindness would hide a policy that fails open.\n */\nexport async function checkPolicyDrift(\n    client: Queryable,\n    collections: CollectionConfig[]\n): Promise<PolicyDrift> {\n    const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(collections));\n    const schemas = [...new Set(expected.map((p) => p.schema))];\n    // Nothing expected means nothing to reconcile against; scanning every\n    // schema would report the whole database as orphaned.\n    if (schemas.length === 0) return { missing: [], orphaned: [], diverged: [], insecure: [], rlsDisabled: [] };\n\n    const live = await readLivePolicies(client, schemas);\n    const liveByKey = new Map(live.map((p) => [keyOf(p), p]));\n    const expectedByKey = new Map(expected.map((p) => [keyOf(p), p]));\n\n    const drift: PolicyDrift = { missing: [], orphaned: [], diverged: [], insecure: [], rlsDisabled: [] };\n\n    // Before comparing policy against policy: is the switch even on? A table\n    // with RLS disabled matches every expected policy on every field compared\n    // below, so this has to be asked separately or it cannot be asked at all.\n    const expectedTables = [...new Map(\n        expected.map((p) => [`${p.schema}.${p.table}`, { schema: p.schema, table: p.table }])\n    ).values()];\n    drift.rlsDisabled = await readTablesWithRlsOff(client, expectedTables);\n\n    // Scan every live policy for the permissive tautology. This is deliberately\n    // independent of the name-keyed diff below: a database pushed before the\n    // `authenticated()` fix matches its expected policy on name, roles, command\n    // and clause presence, so nothing else here would flag it.\n    for (const p of live) {\n        const clause = isPermissiveAuthTautology(p.qual)\n            ? \"USING\"\n            : isPermissiveAuthTautology(p.withCheck) ? \"WITH CHECK\" : null;\n        if (clause) {\n            drift.insecure.push({\n                policy: p,\n                reason: `${clause} is \\`${RLS_UID_SQL} IS NOT NULL\\`, which is true for anonymous ` +\n                    `visitors too — this grants access to signed-out requests. It predates the ` +\n                    `\\`policy.authenticated()\\` fix; re-run \\`rebase db push\\` to tighten it.`\n            });\n        }\n    }\n\n    for (const [key, want] of expectedByKey) {\n        const got = liveByKey.get(key);\n        if (!got) {\n            drift.missing.push(want);\n            continue;\n        }\n        const differences: string[] = [];\n        if (!sameRoles(want.roles, got.roles)) {\n            differences.push(`roles: expected [${want.roles.join(\", \")}], database has [${got.roles.join(\", \")}]`);\n        }\n        if (want.command !== got.command) {\n            differences.push(`command: expected ${want.command}, database has ${got.command}`);\n        }\n        // Skipped when either side is unknown: an unrecognised catalogue shape\n        // should not manufacture drift. See `normalizeMode`.\n        if (want.mode && got.mode && want.mode !== got.mode) {\n            differences.push(\n                `mode: expected ${want.mode}, database has ${got.mode}` +\n                (got.mode === \"PERMISSIVE\"\n                    ? \" — a RESTRICTIVE rule is ANDed with the others, a PERMISSIVE one is ORed, so this policy now widens access instead of narrowing it\"\n                    : \" — a PERMISSIVE rule is ORed with the others, a RESTRICTIVE one is ANDed, so this policy now narrows access instead of widening it\")\n            );\n        }\n        for (const clause of [\"USING\", \"WITH CHECK\"] as const) {\n            const key = clause === \"USING\" ? \"hasUsing\" : \"hasWithCheck\";\n            if (want[key] === got[key]) continue;\n            differences.push(want[key]\n                ? `${clause}: expected an expression, database has none — this policy matches no rows`\n                : `${clause}: expected none, database has an expression`);\n        }\n        if (differences.length > 0) drift.diverged.push({ expected: want, actual: got, differences });\n    }\n\n    for (const [key, got] of liveByKey) {\n        if (!expectedByKey.has(key)) drift.orphaned.push(got);\n    }\n\n    return drift;\n}\n\n/**\n * Does this name look like one the generator produced for this table?\n *\n * Unnamed rules compile to `<table>_<op>_<sha1[0:7]>` (plus `_<idx>` when one\n * rule spans several operations), and the hash covers the rule's semantics — so\n * *editing* a rule renames its policy. The policy under the old name is left\n * behind by `db push`, which only DROPs the names it is about to CREATE, and\n * Postgres ORs PERMISSIVE policies together: a superseded `USING (true)` keeps\n * granting everything no matter how tight its replacement is.\n *\n * Matching the shape is what makes dropping them safe. A hand-written policy\n * would have to collide with a 7-hex digest to be mistaken for generated one;\n * a policy named anything else is left alone and merely reported, because a\n * custom name is indistinguishable from one someone wrote in SQL on purpose.\n */\nexport function isGeneratedPolicyName(name: string, table: string): boolean {\n    return new RegExp(`^${table.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}_(select|insert|update|delete|all)_[0-9a-f]{7}(_\\\\d+)?$`)\n        .test(name);\n}\n\nexport interface OrphanCleanup {\n    /** Superseded generated policies that were dropped. */\n    dropped: PolicyRef[];\n    /** Orphans left in place because their names are not generator-shaped. */\n    kept: PolicyRef[];\n}\n\n/**\n * Drop the policies an earlier push superseded but never removed.\n *\n * Only touches tables the collections describe — a table with no expected\n * policy is not ours to reconcile, and scanning by schema alone would sweep up\n * policies belonging to something else sharing the database.\n */\nexport async function dropOrphanedPolicies(\n    client: Queryable,\n    drift: PolicyDrift,\n    collections: CollectionConfig[]\n): Promise<OrphanCleanup> {\n    const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(collections));\n    const managed = new Set(expected.map((p) => `${p.schema}.${p.table}`));\n\n    const cleanup: OrphanCleanup = { dropped: [], kept: [] };\n    for (const p of drift.orphaned) {\n        if (!managed.has(`${p.schema}.${p.table}`) || !isGeneratedPolicyName(p.name, p.table)) {\n            cleanup.kept.push(p);\n            continue;\n        }\n        // Identifiers are quoted, and the name came from pg_policies rather than\n        // from user input, so it is already a valid identifier.\n        await client.query(`DROP POLICY IF EXISTS \"${p.name}\" ON \"${p.schema}\".\"${p.table}\"`);\n        cleanup.dropped.push(p);\n    }\n    return cleanup;\n}\n\nexport const hasDrift = (d: PolicyDrift): boolean =>\n    d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0 || d.insecure.length > 0\n    || d.rlsDisabled.length > 0;\n\n/** Human-readable report; empty string when the database matches the config. */\nexport function formatPolicyDrift(drift: PolicyDrift): string {\n    if (!hasDrift(drift)) return \"\";\n    const lines: string[] = [];\n\n    // First, because it subsumes every other finding on the same table: if RLS\n    // is off, the policies listed below are not being applied at all.\n    if (drift.rlsDisabled.length > 0) {\n        lines.push(\"  RLS DISABLED — the table has policies, and Postgres is applying none of them:\");\n        for (const t of drift.rlsDisabled) {\n            lines.push(`    • ${t.schema}.${t.table}${t.forced ? \"\" : \" (and FORCE is off)\"}`);\n        }\n        lines.push(\"    Every row is readable and writable by any request that reaches the table.\");\n        lines.push(`    Fix: ALTER TABLE \"<schema>\".\"<table>\" ENABLE ROW LEVEL SECURITY; or re-run \\`rebase db push\\`.`);\n    }\n    if (drift.missing.length > 0) {\n        lines.push(\"  Missing — described by your collections, absent from the database:\");\n        for (const p of drift.missing) lines.push(`    • ${p.schema}.${p.table} → \"${p.name}\" (${p.command} TO ${p.roles.join(\", \")})`);\n        lines.push(\"    Run `rebase db push` to apply them.\");\n    }\n    if (drift.orphaned.length > 0) {\n        lines.push(\"  Orphaned — in the database, described by no collection:\");\n        for (const p of drift.orphaned) lines.push(`    • ${p.schema}.${p.table} → \"${p.name}\" (${p.command} TO ${p.roles.join(\", \")})`);\n        lines.push(\"    Left behind by an earlier push. These still filter rows.\");\n    }\n    if (drift.diverged.length > 0) {\n        lines.push(\"  Diverged — same policy, different definition:\");\n        for (const d of drift.diverged) {\n            lines.push(`    • ${d.expected.schema}.${d.expected.table} → \"${d.expected.name}\"`);\n            for (const diff of d.differences) lines.push(`        ${diff}`);\n        }\n    }\n    if (drift.insecure.length > 0) {\n        lines.push(\"  Insecure — a live policy grants access it should not:\");\n        for (const i of drift.insecure) {\n            lines.push(`    • ${i.policy.schema}.${i.policy.table} → \"${i.policy.name}\"`);\n            lines.push(`        ${i.reason}`);\n        }\n    }\n    return lines.join(\"\\n\");\n}\n","/**\n * Applying a bundle's RLS policies to a database at boot, idempotently.\n *\n * ## Why this exists\n *\n * {@link ensureCollectionTables} creates the collection *tables* a managed\n * runtime boots against, but a table with row-level security disabled and no\n * policies is not servable: authenticated requests run as the restricted\n * `rebase_user` role, so a read with no `SELECT` policy returns nothing (a\n * public collection answered 401) and a write with no `INSERT`/`UPDATE` policy\n * is denied. The policies live in the collections' `securityRules`; nothing at\n * boot applied them. `rebase db push` does — but it drives Atlas against a\n * local `DATABASE_URL`, and a managed tenant's database is reachable only from\n * inside the cluster, by the runtime that is already connected to it. So the\n * runtime is the only thing that *can* apply them, and this is where it does.\n *\n * ## Why this is safe to run on every boot\n *\n * Every statement is idempotent: `ENABLE ROW LEVEL SECURITY` is a no-op once\n * enabled, and each policy is a `DROP POLICY IF EXISTS` immediately followed by\n * a `CREATE POLICY`, so re-applying asserts exactly the declared state. It adds\n * and replaces; it never drops data. (It does not *reconcile* — a policy a\n * previous push left behind under an old name is not removed here; that stays a\n * `db push` / `db migrate` concern, alongside destructive schema changes.)\n *\n * Unlike table creation, a failure here is not fatal: RLS stays enabled, so a\n * table whose policies could not be applied fails **closed** (denies) rather\n * than leaking rows. One collection's policy failing (e.g. a rule that\n * references a table a real migration has not created yet) must not crash-loop\n * the whole deployment and take the other collections' working routes down with\n * it. Failures are reported loudly and per-table so the operator can see\n * exactly which collection is not yet servable and why.\n */\nimport { type CollectionConfig } from \"@rebasepro/types\";\nimport { planCollectionPolicies, type CollectionPolicyPlan } from \"./generate-postgres-ddl-logic\";\nimport { isGeneratedPolicyName } from \"../security/policy-drift\";\nimport { describeDriverError, readExistingSchema, type Queryable } from \"./ensure-collection-tables\";\nimport { REBASE_USER_ROLE } from \"../security/rls-enforcement\";\n\nexport interface PolicyEnsureResult {\n    /** `CREATE POLICY` statements that ran successfully. */\n    policiesApplied: number;\n    /** Tables that had RLS enabled. */\n    tablesSecured: number;\n    /** Declared tables absent from the database — left to a real migration. */\n    skipped: { table: string; reason: string }[];\n    /**\n     * Tables that have RLS on but did not get every policy. They deny — RLS\n     * with no matching policy is deny-all — so they are safe but not servable.\n     */\n    failures: { table: string; error: string }[];\n    /**\n     * Tables RLS could not be enabled on, whose DML grant was withdrawn instead.\n     *\n     * This state had no name, and that was the bug: `ENABLE ROW LEVEL SECURITY`\n     * failing was recorded as a `failure` and reported with the same \"it stays\n     * locked (denies)\" wording as a failed policy — but the two are opposites.\n     * A policy statement failing leaves RLS on and the table denying. `enableRls`\n     * failing leaves RLS *off*, and the schema-wide grant to the user role has\n     * already been made by `ensureRlsEnforcement`, so the table is readable and\n     * writable by every authenticated request with no row filtering at all.\n     */\n    unsecured: { table: string; error: string; grantWithdrawn: boolean }[];\n    /**\n     * Generated policies removed because no current rule produces them.\n     *\n     * A policy's name embeds a hash of the rule's semantics, so editing a rule\n     * does not update a policy — it creates a new one and abandons the old.\n     * Postgres ORs permissive policies, so the abandoned one keeps granting:\n     * a `USING (true)` tightened to an owner check went on admitting everyone,\n     * forever, while the deploy logged success.\n     *\n     * `db push` reconciles this, and cannot reach a managed tenant's in-cluster\n     * database — which is the reason this module exists. So boot has to do it.\n     */\n    orphansDropped: number;\n}\n\nconst isCreatePolicy = (statement: string): boolean => /^\\s*CREATE POLICY/i.test(statement);\n\n/**\n * Bring the declared collections' RLS policies up to date. Returns what it did.\n *\n * Only tables that already exist are touched: the boot-time table creator runs\n * first, so anything still missing is a table this additive path is not allowed\n * to create (a junction, or a relation left to a migration). Enabling RLS on a\n * non-existent table would error, so those are recorded as skipped, not failed.\n */\n\n/**\n * Remove generated policies on this table that the current plan does not\n * produce.\n *\n * Scoped hard, because dropping a policy is destructive: only this one table,\n * only names matching the generated `<table>_<op>_<sha1>` shape, and only names\n * absent from the statements just applied. A hand-written policy, or one\n * belonging to another table, is never touched — `isGeneratedPolicyName` is the\n * same predicate `db push` uses to draw that line.\n */\nasync function dropOrphanedPoliciesOn(client: Queryable, plan: CollectionPolicyPlan): Promise<number> {\n    const expected = new Set<string>();\n    for (const statement of plan.policyStatements) {\n        const match = /^\\s*CREATE POLICY\\s+\"([^\"]+)\"/i.exec(statement);\n        if (match) expected.add(match[1]);\n    }\n\n    const existing = await client.query<{ policyname: string }>(\n        `SELECT policyname FROM pg_policies WHERE schemaname = '${plan.schema.replace(/'/g, \"''\")}' ` +\n        `AND tablename = '${plan.table.replace(/'/g, \"''\")}'`\n    );\n\n    let dropped = 0;\n    for (const row of existing.rows) {\n        const name = row.policyname;\n        if (expected.has(name)) continue;\n        if (!isGeneratedPolicyName(name, plan.table)) continue;\n        await client.query(`DROP POLICY IF EXISTS \"${name}\" ON \"${plan.schema}\".\"${plan.table}\"`);\n        dropped++;\n    }\n    return dropped;\n}\n\nexport async function ensureCollectionPolicies(\n    client: Queryable,\n    collections: CollectionConfig[],\n    log?: (message: string) => void\n): Promise<PolicyEnsureResult> {\n    const result: PolicyEnsureResult = { policiesApplied: 0, tablesSecured: 0, skipped: [], failures: [], unsecured: [], orphansDropped: 0 };\n\n    const plans = planCollectionPolicies(collections);\n    if (plans.length === 0) return result;\n\n    const schemas = Array.from(new Set(plans.map(p => p.schema)));\n    const existing = await readExistingSchema(client, schemas);\n\n    for (const plan of plans) {\n        if (!existing.tables.has(plan.qualified)) {\n            result.skipped.push({\n                table: plan.qualified,\n                reason: \"table is not present in the database; create it with `rebase db push` / `rebase db migrate`\"\n            });\n            continue;\n        }\n\n        // Enabling RLS is its own step, because its failure is the opposite of\n        // every other failure here. Once RLS is on, anything that goes wrong\n        // afterwards leaves the table denying; while it is off, the grant made\n        // earlier in boot leaves the table wide open. Sharing one `try` meant\n        // the dangerous case was reported in the safe case's words.\n        try {\n            await client.query(plan.enableRls);\n            result.tablesSecured++;\n        } catch (err) {\n            // The database's own answer, not the ORM's wrapper — see\n            // `describeDriverError`. This is the most consequential message in\n            // the file: it is what the operator reads about a table that is now\n            // denying every request, and `Failed query: <the statement>` told\n            // them nothing they did not already have.\n            const error = describeDriverError(err);\n            // Take the privilege back rather than serve an unprotected table.\n            // This is the fail-closed step the old code assumed it already had:\n            // per-table, so one collection cannot take the rest of the\n            // deployment down, but leaving nothing readable without RLS.\n            let grantWithdrawn = false;\n            try {\n                await client.query(`REVOKE ALL PRIVILEGES ON ${plan.qualified} FROM ${REBASE_USER_ROLE}`);\n                grantWithdrawn = true;\n            } catch {\n                // Fall through: reported below with `grantWithdrawn: false`,\n                // which the caller escalates. There is nothing else this\n                // function can do to make the table safe.\n            }\n            result.unsecured.push({ table: plan.qualified,\nerror,\ngrantWithdrawn });\n            continue;\n        }\n\n        try {\n            let created = 0;\n            for (const statement of plan.policyStatements) {\n                await client.query(statement);\n                if (isCreatePolicy(statement)) {\n                    result.policiesApplied++;\n                    created++;\n                }\n            }\n\n            const orphans = await dropOrphanedPoliciesOn(client, plan);\n            result.orphansDropped += orphans;\n\n            log?.(`${plan.qualified}: RLS enabled, ${created} policy(ies) applied` +\n                (orphans > 0 ? `, ${orphans} orphan(s) dropped` : \"\"));\n        } catch (err) {\n            result.failures.push({\n                table: plan.qualified,\n                error: describeDriverError(err)\n            });\n        }\n    }\n\n    return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmYA,SAAgB,sBAAsB,MAAc,OAAwB;CACxE,OAAO,IAAI,OAAO,IAAI,MAAM,QAAQ,uBAAuB,MAAM,EAAE,wDAAwD,CAAC,CACvH,KAAK,IAAI;AAClB;;;ACxTA,IAAM,kBAAkB,cAA+B,qBAAqB,KAAK,SAAS;;;;;;;;;;;;;;;;;;;AAqB1F,eAAe,uBAAuB,QAAmB,MAA6C;CAClG,MAAM,2BAAW,IAAI,IAAY;CACjC,KAAK,MAAM,aAAa,KAAK,kBAAkB;EAC3C,MAAM,QAAQ,iCAAiC,KAAK,SAAS;EAC7D,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE;CACpC;CAEA,MAAM,WAAW,MAAM,OAAO,MAC1B,0DAA0D,KAAK,OAAO,QAAQ,MAAM,IAAI,EAAE,qBACtE,KAAK,MAAM,QAAQ,MAAM,IAAI,EAAE,EACvD;CAEA,IAAI,UAAU;CACd,KAAK,MAAM,OAAO,SAAS,MAAM;EAC7B,MAAM,OAAO,IAAI;EACjB,IAAI,SAAS,IAAI,IAAI,GAAG;EACxB,IAAI,CAAC,sBAAsB,MAAM,KAAK,KAAK,GAAG;EAC9C,MAAM,OAAO,MAAM,0BAA0B,KAAK,QAAQ,KAAK,OAAO,KAAK,KAAK,MAAM,EAAE;EACxF;CACJ;CACA,OAAO;AACX;AAEA,eAAsB,yBAClB,QACA,aACA,KAC2B;CAC3B,MAAM,SAA6B;EAAE,iBAAiB;EAAG,eAAe;EAAG,SAAS,CAAC;EAAG,UAAU,CAAC;EAAG,WAAW,CAAC;EAAG,gBAAgB;CAAE;CAEvI,MAAM,QAAQ,uBAAuB,WAAW;CAChD,IAAI,MAAM,WAAW,GAAG,OAAO;CAG/B,MAAM,WAAW,MAAM,mBAAmB,QAD1B,MAAM,KAAK,IAAI,IAAI,MAAM,KAAI,MAAK,EAAE,MAAM,CAAC,CACT,CAAO;CAEzD,KAAK,MAAM,QAAQ,OAAO;EACtB,IAAI,CAAC,SAAS,OAAO,IAAI,KAAK,SAAS,GAAG;GACtC,OAAO,QAAQ,KAAK;IAChB,OAAO,KAAK;IACZ,QAAQ;GACZ,CAAC;GACD;EACJ;EAOA,IAAI;GACA,MAAM,OAAO,MAAM,KAAK,SAAS;GACjC,OAAO;EACX,SAAS,KAAK;GAMV,MAAM,QAAQ,oBAAoB,GAAG;GAKrC,IAAI,iBAAiB;GACrB,IAAI;IACA,MAAM,OAAO,MAAM,4BAA4B,KAAK,UAAU,QAAQ,kBAAkB;IACxF,iBAAiB;GACrB,QAAQ,CAIR;GACA,OAAO,UAAU,KAAK;IAAE,OAAO,KAAK;IAChD;IACA;GAAe,CAAC;GACJ;EACJ;EAEA,IAAI;GACA,IAAI,UAAU;GACd,KAAK,MAAM,aAAa,KAAK,kBAAkB;IAC3C,MAAM,OAAO,MAAM,SAAS;IAC5B,IAAI,eAAe,SAAS,GAAG;KAC3B,OAAO;KACP;IACJ;GACJ;GAEA,MAAM,UAAU,MAAM,uBAAuB,QAAQ,IAAI;GACzD,OAAO,kBAAkB;GAEzB,MAAM,GAAG,KAAK,UAAU,iBAAiB,QAAQ,yBAC5C,UAAU,IAAI,KAAK,QAAQ,sBAAsB,GAAG;EAC7D,SAAS,KAAK;GACV,OAAO,SAAS,KAAK;IACjB,OAAO,KAAK;IACZ,OAAO,oBAAoB,GAAG;GAClC,CAAC;EACL;CACJ;CAEA,OAAO;AACX"}