@rebasepro/server-postgres 0.22.0 → 0.24.0

package/dist/ensure-tables-Cr5B4UmH.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ensure-tables-Cr5B4UmH.js","names":[],"sources":["../src/auth/schema-version.ts","../src/auth/ensure-tables.ts"],"sourcesContent":["import { sql } from \"drizzle-orm\";\nimport { NodePgDatabase } from \"drizzle-orm/node-postgres\";\nimport type { CollectionConfig } from \"@rebasepro/types\";\n\n/**\n * The auth schema version this runtime expects to find in the database.\n *\n * Bump this whenever a migration in `ensureAuthTablesExist` makes the schema\n * unreadable by the runtime that came before it — that is, whenever a *previous*\n * version's auth queries would break against the migrated shape. Additive\n * changes (a new nullable column nobody older references) do not need a bump.\n *\n * History. Note that 1 is a label for an era, not a value any database holds:\n * stamping did not exist then, so an era-1 database reads as unstamped\n * (`null`), and 2 is the first version ever actually written. The numbering\n * starts at 2 only because two schema eras already existed when it was\n * introduced; it could just as well have started at 1. It is not worth\n * renumbering now — deployed databases already carry 2, and lowering the\n * constant would make them look newer than the runtime and refuse the boot.\n *\n *   1 — Device-session refresh tokens. A row *was* a session, identified by\n *       `unique_device_session UNIQUE (uid, user_agent, ip_address)`, and\n *       `createToken` upserted with `ON CONFLICT (uid, user_agent, ip_address)`.\n *   2 — Session-scoped, rotation-safe refresh tokens: `session_id`, `revoked`,\n *       `rotated_at`, `session_started_at`, and `unique_device_session`\n *       dropped because two live tokens of one session share all three columns.\n *\n * The 1 → 2 migration is why this file exists. Dropping the constraint is\n * one-way: a version-1 runtime deployed afterwards boots perfectly, logs\n * `✅ Auth tables ready` (its `CREATE TABLE IF NOT EXISTS` never revisits the\n * existing table, so it cannot re-add the constraint), answers `/health` with\n * 200 — and then fails every single login and refresh with SQLSTATE 42P10,\n * because its `ON CONFLICT` names a constraint that no longer exists. A silent\n * total auth outage behind a green health check. The stamp below turns that\n * into a boot refusal.\n */\nexport const AUTH_SCHEMA_VERSION = 2;\n\n/** Key under which the version is stored in the auth schema's meta table. */\nconst VERSION_KEY = \"auth_schema_version\";\n\n/**\n * Columns `refresh_tokens` must have for the current runtime's auth write path\n * to work. Checked by the health probe so a database that drifted *below* this\n * runtime is reported as unhealthy rather than discovered one failed login at a\n * time. Kept in step with the migration in `ensureAuthTablesExist`.\n */\nconst REQUIRED_REFRESH_TOKEN_COLUMNS = [\"session_id\", \"revoked\", \"rotated_at\", \"session_started_at\"];\n\n/**\n * A constraint whose *presence* means the database is still at version 1, in a\n * shape this runtime's rotation logic cannot write to: it makes two live tokens\n * of one rotating session collide.\n */\nconst RETIRED_REFRESH_TOKEN_CONSTRAINT = \"unique_device_session\";\n\n/**\n * Thrown when the database was migrated by a runtime newer than this one.\n *\n * Distinct class rather than a bare `Error` because `ensureAuthTablesExist`\n * wraps its migrations in a catch that deliberately swallows failures and\n * continues — every other problem there is better survived than crashed on.\n * This one is not, so the catch rethrows on this type specifically.\n */\nexport class AuthSchemaVersionError extends Error {\n    readonly databaseVersion: number;\n    readonly runtimeVersion: number;\n\n    constructor(databaseVersion: number, runtimeVersion: number) {\n        super(\n            `Auth schema version mismatch: the database is at version ${databaseVersion}, ` +\n            `but this runtime understands version ${runtimeVersion}.\\n\\n` +\n            \"A newer version of the framework has already migrated this database. Running this \" +\n            \"older runtime against it would boot cleanly and then fail every login and token \" +\n            \"refresh, because the auth schema it expects no longer exists.\\n\\n\" +\n            \"Refusing to start. Deploy a framework version at or above the one that migrated \" +\n            \"this database, or restore the database from a backup taken before the upgrade.\"\n        );\n        this.name = \"AuthSchemaVersionError\";\n        this.databaseVersion = databaseVersion;\n        this.runtimeVersion = runtimeVersion;\n    }\n}\n\n/**\n * The schema the auth tables live in, derived exactly as `ensureAuthTablesExist`\n * derives it. Shared so the two cannot drift: a stamp written to one schema and\n * read from another would read as \"never stamped\" forever.\n */\nexport function resolveAuthSchema(collection?: CollectionConfig): string {\n    if (!collection) return \"rebase\";\n    const usersSchema = (\"schema\" in collection && typeof collection.schema === \"string\")\n        ? collection.schema\n        : \"public\";\n    return usersSchema === \"public\" ? \"rebase\" : usersSchema;\n}\n\n/**\n * Read the stamped version, or `null` when the database has never been stamped.\n *\n * `null` is not an error and must not be treated as one: every database\n * provisioned before this file existed is unstamped, and so is every fresh one.\n * Uses `to_regclass` rather than selecting straight from the table so a missing\n * schema or table is a `null` rather than a thrown 42P01.\n */\nexport async function readAuthSchemaVersion(\n    db: NodePgDatabase,\n    authSchema: string\n): Promise<number | null> {\n    const qualified = `\"${authSchema}\".\"schema_meta\"`;\n    const exists = await db.execute(sql`SELECT to_regclass(${qualified}) IS NOT NULL AS present`);\n    if (!(exists.rows[0] as { present: boolean } | undefined)?.present) return null;\n\n    const result = await db.execute(sql`\n        SELECT value FROM ${sql.raw(qualified)} WHERE key = ${VERSION_KEY}\n    `);\n    const raw = (result.rows[0] as { value: string } | undefined)?.value;\n    if (raw === undefined) return null;\n\n    const parsed = Number.parseInt(raw, 10);\n    // A meta row we cannot parse is treated as unstamped rather than as version\n    // 0: refusing to boot over a garbled string would be a worse failure than\n    // the drift it is meant to catch.\n    return Number.isFinite(parsed) ? parsed : null;\n}\n\n/**\n * Refuse to run against a database a newer runtime has already migrated.\n *\n * Deliberately one-directional. A database *older* than this runtime is the\n * normal upgrade path — the migrations in `ensureAuthTablesExist` are about to\n * bring it forward, so it is not an error. Only the reverse is unrecoverable.\n */\nexport async function assertAuthSchemaCompatible(\n    db: NodePgDatabase,\n    authSchema: string\n): Promise<void> {\n    const databaseVersion = await readAuthSchemaVersion(db, authSchema);\n    if (databaseVersion !== null && databaseVersion > AUTH_SCHEMA_VERSION) {\n        throw new AuthSchemaVersionError(databaseVersion, AUTH_SCHEMA_VERSION);\n    }\n}\n\n/**\n * Record that this runtime's migrations have been applied.\n *\n * Called at the end of `ensureAuthTablesExist`, so a boot that failed partway\n * through leaves the older stamp in place and the next boot migrates again.\n */\nexport async function stampAuthSchemaVersion(\n    db: NodePgDatabase,\n    authSchema: string\n): Promise<void> {\n    const qualified = `\"${authSchema}\".\"schema_meta\"`;\n    await db.execute(sql`\n        CREATE TABLE IF NOT EXISTS ${sql.raw(qualified)} (\n            key TEXT PRIMARY KEY,\n            value TEXT NOT NULL,\n            updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL\n        )\n    `);\n    await db.execute(sql`\n        INSERT INTO ${sql.raw(qualified)} (key, value)\n        VALUES (${VERSION_KEY}, ${String(AUTH_SCHEMA_VERSION)})\n        ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()\n    `);\n}\n\n/** What {@link probeAuthSchema} found. */\nexport interface AuthSchemaProbeResult {\n    /** False when this runtime cannot be trusted to serve auth against this database. */\n    healthy: boolean;\n    /** The stamped version, or `null` on a database that predates stamping. */\n    databaseVersion: number | null;\n    /** {@link AUTH_SCHEMA_VERSION}. */\n    runtimeVersion: number;\n    /** Human-readable descriptions of each mismatch found. Empty when healthy. */\n    problems: string[];\n}\n\n/**\n * Check that the auth schema is one this runtime can actually write to.\n *\n * Two independent checks, because either alone has a blind spot:\n *\n *  - The **stamp** catches a runtime older than the database. It is the precise\n *    signal, but it is blind on every database provisioned before stamping\n *    existed — which today is all of them.\n *  - The **structure** catches a database older than the runtime, and works on\n *    unstamped databases. It is what makes this useful immediately rather than\n *    one upgrade cycle from now.\n *\n * Never throws: a probe that fails to run reports unhealthy with the reason, so\n * a broken check surfaces as a degraded health response rather than a 500 from\n * the health endpoint itself.\n */\nexport async function probeAuthSchema(\n    db: NodePgDatabase,\n    authSchema: string\n): Promise<AuthSchemaProbeResult> {\n    const problems: string[] = [];\n    let databaseVersion: number | null = null;\n\n    try {\n        databaseVersion = await readAuthSchemaVersion(db, authSchema);\n        if (databaseVersion !== null && databaseVersion > AUTH_SCHEMA_VERSION) {\n            problems.push(\n                `database is at auth schema version ${databaseVersion}, this runtime understands ` +\n                `${AUTH_SCHEMA_VERSION} — it was migrated by a newer framework version`\n            );\n        }\n\n        const refreshTokens = `\"${authSchema}\".\"refresh_tokens\"`;\n        const present = await db.execute(sql`SELECT to_regclass(${refreshTokens}) IS NOT NULL AS present`);\n        if (!(present.rows[0] as { present: boolean } | undefined)?.present) {\n            // Not a problem in itself: auth may simply not be configured on this\n            // deployment, and the table is created on demand at boot when it is.\n            return { healthy: problems.length === 0, databaseVersion, runtimeVersion: AUTH_SCHEMA_VERSION, problems };\n        }\n\n        const columns = await db.execute(sql`\n            SELECT column_name FROM information_schema.columns\n            WHERE table_schema = ${authSchema} AND table_name = 'refresh_tokens'\n        `);\n        const found = new Set((columns.rows as { column_name: string }[]).map(row => row.column_name));\n        const missing = REQUIRED_REFRESH_TOKEN_COLUMNS.filter(column => !found.has(column));\n        if (missing.length > 0) {\n            problems.push(\n                `refresh_tokens is missing ${missing.join(\", \")} — the auth migrations have not been ` +\n                \"applied to this database, so token rotation will fail\"\n            );\n        }\n\n        const retired = await db.execute(sql`\n            SELECT 1 FROM pg_constraint c\n            JOIN pg_class t ON t.oid = c.conrelid\n            JOIN pg_namespace n ON n.oid = t.relnamespace\n            WHERE n.nspname = ${authSchema}\n              AND t.relname = 'refresh_tokens'\n              AND c.conname = ${RETIRED_REFRESH_TOKEN_CONSTRAINT}\n        `);\n        if (retired.rows.length > 0) {\n            problems.push(\n                `refresh_tokens still carries ${RETIRED_REFRESH_TOKEN_CONSTRAINT} — concurrent token ` +\n                \"rotation for one session will fail on it\"\n            );\n        }\n    } catch (error: unknown) {\n        problems.push(\n            `auth schema probe failed: ${error instanceof Error ? error.message : String(error)}`\n        );\n    }\n\n    return {\n        healthy: problems.length === 0,\n        databaseVersion,\n        runtimeVersion: AUTH_SCHEMA_VERSION,\n        problems\n    };\n}\n","import { sql } from \"drizzle-orm\";\nimport { NodePgDatabase } from \"drizzle-orm/node-postgres\";\nimport { logger } from \"@rebasepro/server\";\nimport { revokeInternalTableAccess } from \"@rebasepro/common\";\nimport type { CollectionConfig } from \"@rebasepro/types\";\nimport { AUTH_USERS_COLUMNS, authUsersColumnSql } from \"../schema/auth-users-columns\";\nimport { RLS_BOOTSTRAP_STATEMENTS } from \"../schema/rls-bootstrap-sql\";\nimport {\n    AuthSchemaVersionError,\n    assertAuthSchemaCompatible,\n    resolveAuthSchema,\n    stampAuthSchemaVersion\n} from \"./schema-version\";\n\n\n/**\n * Auto-create auth tables if they don't exist.\n *\n * @param db         — Drizzle database instance\n * @param collection — The collection that represents auth users.\n *                     When omitted, a default `rebase.users` table is created.\n */\nexport async function ensureAuthTablesExist(db: NodePgDatabase, collection?: CollectionConfig): Promise<void> {\n    logger.debug(\"🔍 Checking auth tables...\");\n\n    // Before anything else, and deliberately outside the catch below: refuse to\n    // run against a database that a newer framework version has already\n    // migrated. Everything past this point is best-effort by design, which is\n    // exactly the wrong posture for an incompatibility that would otherwise\n    // surface as a fully booted server failing every login.\n    await assertAuthSchemaCompatible(db, resolveAuthSchema(collection));\n\n    try {\n        // Resolve dynamic user table name and ID type from the collection\n        let usersTableName = '\"rebase\".\"users\"';\n        let userIdType = \"TEXT\";\n        let usersSchema = \"rebase\";\n        let resolvedTable = \"users\";\n        if (collection) {\n            resolvedTable = (\"table\" in collection && typeof collection.table === \"string\")\n                ? collection.table\n                : collection.slug;\n            usersSchema = (\"schema\" in collection && typeof collection.schema === \"string\")\n                ? collection.schema\n                : \"public\";\n            usersTableName = usersSchema === \"public\"\n                ? `\"${resolvedTable}\"`\n                : `\"${usersSchema}\".\"${resolvedTable}\"`;\n\n            // Derive ID column type from collection properties.\n            //\n            // `\"increment\"`, not `\"autoincrement\"`. The latter was tested for\n            // here and exists nowhere in the type system — the union is\n            // `boolean | \"manual\" | \"increment\" | string` — so the INTEGER branch\n            // was unreachable and an integer-keyed auth collection fell through\n            // to TEXT. Introspection below hid it whenever the table already\n            // existed; on a database where it did not, this created\n            // `id TEXT DEFAULT gen_random_uuid()::text` for a collection that\n            // declares a number, and every `uid` foreign key was typed to match\n            // the wrong thing.\n            const idProp = collection.properties?.id;\n            if (idProp) {\n                const isId = (\"isId\" in idProp) ? (idProp as Record<string, unknown>).isId : undefined;\n                if (isId === \"uuid\") {\n                    userIdType = \"UUID\";\n                } else if (isId === \"increment\") {\n                    userIdType = \"INTEGER\";\n                }\n                // Otherwise keep TEXT as default\n            }\n        }\n\n        // Introspect the database to find the actual type of usersTableName's ID column if the table exists\n        try {\n            const result = await db.execute(sql`\n                SELECT data_type \n                FROM information_schema.columns \n                WHERE table_schema = ${usersSchema} \n                  AND table_name = ${resolvedTable} \n                  AND column_name = 'id'\n            `);\n            if (result && result.rows && result.rows.length > 0) {\n                const dbType = String((result.rows[0] as { data_type: string }).data_type).toUpperCase();\n                if (dbType === \"UUID\") {\n                    userIdType = \"UUID\";\n                } else if (dbType === \"INTEGER\" || dbType === \"SMALLINT\" || dbType === \"BIGINT\") {\n                    userIdType = \"INTEGER\";\n                } else {\n                    userIdType = \"TEXT\";\n                }\n                logger.debug(`✨ Detected ${usersTableName}.id type from database: ${dbType}. Using user_id type: ${userIdType}`);\n            }\n        } catch (err) {\n            // Ignore introspection errors, fallback to derived/default type\n            logger.warn(`⚠️ Failed to introspect ${usersTableName}.id type from database, falling back to config type: ${userIdType}`, { error: err });\n        }\n\n\n        // ── Create schemas (idempotent) ──────────────────────────────────\n        if (usersSchema !== \"public\") {\n            await db.execute(sql`CREATE SCHEMA IF NOT EXISTS ${sql.raw(usersSchema)}`);\n        }\n        await db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);\n\n        const authSchema = usersSchema === \"public\" ? \"rebase\" : usersSchema;\n        const userIdentitiesTable = `\"${authSchema}\".\"user_identities\"`;\n        const refreshTokensTableName = `\"${authSchema}\".\"refresh_tokens\"`;\n        const passwordResetTokensTableName = `\"${authSchema}\".\"password_reset_tokens\"`;\n        const appConfigTableName = `\"${authSchema}\".\"app_config\"`;\n\n        // ── Create users table (idempotent) ─────────────────────────────\n        // The users table MUST be created before any dependent auth tables\n        // (user_identities, refresh_tokens, etc.) because they all hold\n        // foreign keys referencing users(id).  When a developer runs\n        // `pnpm dev` for the first time without `db:migrate`, this ensures\n        // the server can self-bootstrap.\n        const idDefault = userIdType === \"UUID\"\n            ? \"DEFAULT gen_random_uuid()\"\n            : userIdType === \"INTEGER\"\n                ? \"GENERATED ALWAYS AS IDENTITY\"\n                : \"DEFAULT gen_random_uuid()::text\";\n\n        // Identifiers for the constraint and indexes reconciled further down.\n        // Derived from the resolved table name so two auth tables in different\n        // schemas cannot collide, and truncated to Postgres's 63-byte identifier\n        // limit here rather than letting the server truncate silently — the\n        // `IF NOT EXISTS` guards below have to compare against the same name\n        // Postgres actually stored, or they re-run forever.\n        const authIdentifier = (suffix: string) => `${resolvedTable}_${suffix}`.slice(0, 63);\n        const emailLengthConstraint = `\"${authIdentifier(\"email_length_check\")}\"`;\n        const emailLowerUniqueIndex = authIdentifier(\"email_lower_key\");\n        const verificationTokenIndex = authIdentifier(\"email_verification_token_idx\");\n\n        // Every string column here is TEXT, deliberately. In Postgres VARCHAR(n)\n        // and TEXT are the same type with the same storage and the same\n        // performance; the only difference is a length check, and none of these\n        // columns wants one. The widths this table used to carry were inherited\n        // MySQL habit (255) and they were all wrong in the same direction —\n        // `password_hash VARCHAR(255)` against a 193-char scrypt string left 62\n        // characters of headroom in front of a KEY_LENGTH constant living in\n        // another package, and `photo_url VARCHAR(500)` rejected the `data:` URIs\n        // and long signed URLs that OAuth providers hand back. A limit worth\n        // having is a CHECK — alterable without a table rewrite, unlike a type\n        // modifier — which is why `email` has one and nothing else does.\n        //\n        // The column list comes from AUTH_USERS_COLUMNS rather than being spelled\n        // out here, because this is not the only place that creates this table:\n        // `db push` and the boot-time collection ensure do too, and when the\n        // three lists were maintained separately they disagreed and boot order\n        // silently decided which shape the database got. The `email` CHECK is\n        // appended rather than listed there — it is a named constraint the\n        // migration below has to be able to add separately, `NOT VALID`, to a\n        // table that already holds rows.\n        const usersColumnDdl = AUTH_USERS_COLUMNS\n            .map((spec) => spec.column === \"email\"\n                ? `${spec.column} ${authUsersColumnSql(spec)} CONSTRAINT ${emailLengthConstraint} CHECK (length(email) <= 320)`\n                : `${spec.column} ${authUsersColumnSql(spec)}`)\n            .join(\",\\n                \");\n        await db.execute(sql`\n            CREATE TABLE IF NOT EXISTS ${sql.raw(usersTableName)} (\n                id ${sql.raw(userIdType)} PRIMARY KEY ${sql.raw(idDefault)},\n                ${sql.raw(usersColumnDdl)}\n            )\n        `);\n\n        // ── Migration: auth FK column user_id → uid, phase 1 (expand) ───────\n        // Must run BEFORE the dependent tables below: CREATE TABLE IF NOT\n        // EXISTS never revisits an existing table, so a database provisioned\n        // before this migration still lacks `uid` — and the\n        // CREATE INDEX ... (uid) statements that follow would fail on it.\n        //\n        // Deliberately NOT a plain RENAME. Both Cloud Run and Kubernetes roll\n        // deploys, so old and new pods serve the same database at the same time,\n        // and a rollback puts old code back in front of a migrated database. A\n        // rename breaks every auth query on whichever side is out of step.\n        // Instead: add `uid`, backfill it, drop the NOT NULL on `user_id`, and\n        // keep the two in sync with a trigger, so a backend of either era can\n        // read and write. `scripts/drop-legacy-auth-user-id.sql` removes the\n        // column once no old backend remains (phase 2, contract).\n        //\n        // Idempotent throughout: every step is guarded on catalogue state.\n        const legacyFkTables = [\n            \"user_identities\",\n            \"refresh_tokens\",\n            \"password_reset_tokens\",\n            \"magic_link_tokens\",\n            \"mfa_factors\",\n            \"recovery_codes\"\n        ];\n\n        // Only on a database that actually carries the legacy column. This whole\n        // block is a 0.x compatibility shim, and it used to run unconditionally —\n        // so every brand-new database was provisioned with a trigger function\n        // written to reconcile a column it can never have, permanently, as part\n        // of its first boot. A fresh install should not ship someone else's\n        // migration history.\n        // The table list is inlined rather than bound: drizzle expands a JS\n        // array into a parameter TUPLE — `ANY(($2, $3, …))` — which Postgres\n        // rejects, and the thrown error is swallowed by the catch around this\n        // whole function, so auth would silently stop provisioning. These are\n        // module-level constants, not input.\n        const legacyFkTableList = legacyFkTables.map(t => `'${t}'`).join(\", \");\n        const legacyUserIdPresent = await db.execute(sql`\n            SELECT 1\n            FROM information_schema.columns\n            WHERE table_schema = ${authSchema}\n              AND table_name IN (${sql.raw(legacyFkTableList)})\n              AND column_name = 'user_id'\n            LIMIT 1\n        `);\n\n        if (legacyUserIdPresent.rows.length > 0) {\n            await db.execute(sql`\n                CREATE OR REPLACE FUNCTION ${sql.raw(`\"${authSchema}\"`)}.sync_uid_user_id() RETURNS trigger AS $$\n                BEGIN\n                    IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN\n                        NEW.uid := NEW.user_id;\n                    ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN\n                        NEW.user_id := NEW.uid;\n                    END IF;\n                    RETURN NEW;\n                END $$ LANGUAGE plpgsql\n            `);\n        }\n\n        for (const authTable of legacyUserIdPresent.rows.length > 0 ? legacyFkTables : []) {\n            const qualified = `\"${authSchema}\".\"${authTable}\"`;\n            await db.execute(sql`\n                DO $$\n                DECLARE\n                    has_legacy boolean;\n                    has_uid    boolean;\n                BEGIN\n                    SELECT\n                        bool_or(column_name = 'user_id'),\n                        bool_or(column_name = 'uid')\n                    INTO has_legacy, has_uid\n                    FROM information_schema.columns\n                    WHERE table_schema = ${sql.raw(`'${authSchema}'`)}\n                      AND table_name = ${sql.raw(`'${authTable}'`)};\n\n                    -- Table absent, or already uid-only (a fresh install, or\n                    -- phase 2 already run): nothing to do.\n                    IF has_legacy IS NOT TRUE THEN\n                        RETURN;\n                    END IF;\n\n                    IF has_uid IS NOT TRUE THEN\n                        EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ADD COLUMN uid ${userIdType} REFERENCES ${usersTableName}(id) ON DELETE CASCADE'`)};\n                        EXECUTE ${sql.raw(`'UPDATE ${qualified} SET uid = user_id WHERE uid IS NULL'`)};\n                        EXECUTE ${sql.raw(`'CREATE INDEX IF NOT EXISTS idx_${authTable}_uid ON ${qualified}(uid)'`)};\n                    END IF;\n\n                    -- New code inserts uid and never user_id, so the legacy\n                    -- column can no longer be NOT NULL. The trigger below\n                    -- backfills it, but the constraint is checked first.\n                    EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ALTER COLUMN user_id DROP NOT NULL'`)};\n\n                    EXECUTE ${sql.raw(`'DROP TRIGGER IF EXISTS sync_uid_user_id ON ${qualified}'`)};\n                    EXECUTE ${sql.raw(`'CREATE TRIGGER sync_uid_user_id BEFORE INSERT OR UPDATE ON ${qualified} FOR EACH ROW EXECUTE FUNCTION \"${authSchema}\".sync_uid_user_id()'`)};\n                END $$\n            `);\n        }\n\n        // ── Create dependent auth tables (idempotent) ───────────────────\n\n        // Create user_identities table\n        await db.execute(sql`\n            CREATE TABLE IF NOT EXISTS ${sql.raw(userIdentitiesTable)} (\n                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,\n                provider TEXT NOT NULL,\n                provider_id TEXT NOT NULL,\n                profile_data JSONB,\n                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),\n                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),\n                UNIQUE(provider, provider_id)\n            )\n        `);\n\n        // Create indexes on user_identities\n        await db.execute(sql`\n            CREATE INDEX IF NOT EXISTS idx_user_identities_user \n            ON ${sql.raw(userIdentitiesTable)}(uid)\n        `);\n\n\n        // Create refresh tokens table. One row per TOKEN, grouped into a\n        // sign-in by session_id — deliberately without a uniqueness rule on\n        // (uid, user_agent, ip_address); see the schema module for why that\n        // constraint had to go.\n        await db.execute(sql`\n            CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (\n                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,\n                session_id TEXT NOT NULL DEFAULT gen_random_uuid()::text,\n                token_hash TEXT NOT NULL UNIQUE,\n                expires_at TIMESTAMP WITH TIME ZONE NOT NULL,\n                revoked BOOLEAN DEFAULT FALSE NOT NULL,\n                rotated_at TIMESTAMP WITH TIME ZONE,\n                session_started_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,\n                user_agent TEXT,\n                ip_address TEXT,\n                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()\n            )\n        `);\n\n        // Create index on token_hash for faster lookups\n        await db.execute(sql`\n            CREATE INDEX IF NOT EXISTS idx_refresh_tokens_hash \n            ON ${sql.raw(refreshTokensTableName)}(token_hash)\n        `);\n\n        // Create index on uid for cleanup operations\n        await db.execute(sql`\n            CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user \n            ON ${sql.raw(refreshTokensTableName)}(uid)\n        `);\n\n        // Create password reset tokens table\n        await db.execute(sql`\n            CREATE TABLE IF NOT EXISTS ${sql.raw(passwordResetTokensTableName)} (\n                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,\n                token_hash TEXT NOT NULL UNIQUE,\n                expires_at TIMESTAMP WITH TIME ZONE NOT NULL,\n                used_at TIMESTAMP WITH TIME ZONE,\n                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()\n            )\n        `);\n\n        // Create index on token_hash for password reset lookups\n        await db.execute(sql`\n            CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_hash \n            ON ${sql.raw(passwordResetTokensTableName)}(token_hash)\n        `);\n\n        // Create index on uid for password reset cleanup\n        await db.execute(sql`\n            CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user \n            ON ${sql.raw(passwordResetTokensTableName)}(uid)\n        `);\n\n        // Create magic link tokens table\n        const magicLinkTokensTableName = `\"${authSchema}\".\"magic_link_tokens\"`;\n        await db.execute(sql`\n            CREATE TABLE IF NOT EXISTS ${sql.raw(magicLinkTokensTableName)} (\n                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,\n                token_hash TEXT NOT NULL UNIQUE,\n                expires_at TIMESTAMP WITH TIME ZONE NOT NULL,\n                used_at TIMESTAMP WITH TIME ZONE,\n                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()\n            )\n        `);\n\n        // Create index on token_hash for magic link lookups\n        await db.execute(sql`\n            CREATE INDEX IF NOT EXISTS idx_magic_link_tokens_hash \n            ON ${sql.raw(magicLinkTokensTableName)}(token_hash)\n        `);\n\n        // Create index on uid for magic link cleanup\n        await db.execute(sql`\n            CREATE INDEX IF NOT EXISTS idx_magic_link_tokens_user \n            ON ${sql.raw(magicLinkTokensTableName)}(uid)\n        `);\n\n        // Create app config table\n        await db.execute(sql`\n            CREATE TABLE IF NOT EXISTS ${sql.raw(appConfigTableName)} (\n                key TEXT PRIMARY KEY,\n                value JSONB NOT NULL,\n                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()\n            )\n        `);\n\n        // The RLS helper functions every generated policy calls. They live in\n        // `rebase`, alongside the tables above — Rebase creates exactly one\n        // schema in a user's database. Advisory-locked so concurrent HMR\n        // reloads cannot race on `CREATE OR REPLACE`.\n        //\n        // The same statements the migration preamble carries, from the same\n        // constant — these definitions being identical across the boot path and\n        // the migration stream is the whole point of having them in one place.\n        // One call per statement: this handle speaks the extended query\n        // protocol, which rejects multi-command strings.\n        await db.transaction(async (tx) => {\n            await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);\n            for (const statement of RLS_BOOTSTRAP_STATEMENTS) {\n                await tx.execute(sql.raw(statement));\n            }\n        });\n\n        // Seed default roles if none exist\n        // (no-op: roles are now stored inline on the users table)\n\n        // ── Migration: reconcile the full users column set (safe for existing tables) ──\n        // CREATE TABLE IF NOT EXISTS never revisits an existing table, so a\n        // database provisioned by an older framework era is missing every\n        // column added since. Each column the auth services read or write must\n        // be back-filled here, or upgraded deployments break on the first\n        // statement that references it.\n        //\n        // `email` is skipped: it has existed since the first era, so it is never\n        // the missing one, and `ADD COLUMN … NOT NULL` with no default fails on\n        // a table with rows.\n        for (const spec of AUTH_USERS_COLUMNS) {\n            if (spec.column === \"email\") continue;\n            await db.execute(sql`\n                ALTER TABLE ${sql.raw(usersTableName)}\n                ADD COLUMN IF NOT EXISTS ${sql.raw(`${spec.column} ${authUsersColumnSql(spec)}`)}\n            `);\n        }\n\n        // Which of the columns below the table actually has. An adopted table —\n        // one this framework did not create, which the column-name resolution in\n        // `services.ts` exists to support — may be missing any of them, and every\n        // statement past this point has to tolerate that rather than abort the\n        // whole migration block.\n        const usersColumns = await db.execute(sql`\n            SELECT column_name, data_type, is_nullable, column_default\n            FROM information_schema.columns\n            WHERE table_schema = ${usersSchema} AND table_name = ${resolvedTable}\n        `);\n        type UsersColumnRow = {\n            column_name: string;\n            data_type: string;\n            is_nullable: \"YES\" | \"NO\";\n            column_default: string | null;\n        };\n        const usersColumnRows = usersColumns.rows as UsersColumnRow[];\n        const usersColumnTypes = new Map(usersColumnRows.map(row => [row.column_name, row.data_type]));\n        const usersColumnState = new Map(usersColumnRows.map(row => [row.column_name, row]));\n\n        // ── Migration: restore defaults and NOT NULL that another creator dropped ──\n        // `ADD COLUMN IF NOT EXISTS` above only creates what is MISSING. A column\n        // that exists with the wrong shape stays wrong forever — and until\n        // AUTH_USERS_COLUMNS became the single source, that was the normal\n        // outcome rather than an edge case: whichever of `db push`, boot-ensure\n        // and this function reached the table first decided its constraints, so\n        // a managed deploy ended up with a nullable `email`, a `roles` with no\n        // `'{}'` default, and an `email_verified` that could be NULL.\n        //\n        // Ordered DEFAULT → back-fill → SET NOT NULL, because SET NOT NULL is\n        // checked against existing rows: without the back-fill it throws on the\n        // very databases that need it. `email` can carry no default, so a NULL\n        // there is not repairable automatically — say so and leave the column\n        // alone rather than inventing an address.\n        for (const spec of AUTH_USERS_COLUMNS) {\n            const state = usersColumnState.get(spec.column);\n            if (!state) continue;\n\n            if (spec.default !== undefined && state.column_default === null) {\n                await db.execute(sql`\n                    ALTER TABLE ${sql.raw(usersTableName)}\n                    ALTER COLUMN ${sql.raw(`\"${spec.column}\"`)} SET DEFAULT ${sql.raw(spec.default)}\n                `);\n                logger.info(`🔧 Restored the default on ${usersTableName}.${spec.column}`);\n            }\n\n            if (!spec.notNull || state.is_nullable !== \"YES\") continue;\n\n            if (spec.default !== undefined) {\n                await db.execute(sql`\n                    UPDATE ${sql.raw(usersTableName)}\n                    SET ${sql.raw(`\"${spec.column}\"`)} = ${sql.raw(spec.default)}\n                    WHERE ${sql.raw(`\"${spec.column}\"`)} IS NULL\n                `);\n            }\n            try {\n                await db.execute(sql`\n                    ALTER TABLE ${sql.raw(usersTableName)}\n                    ALTER COLUMN ${sql.raw(`\"${spec.column}\"`)} SET NOT NULL\n                `);\n                logger.info(`🔧 Restored NOT NULL on ${usersTableName}.${spec.column}`);\n            } catch (err) {\n                logger.warn(\n                    `⚠️ ${usersTableName}.${spec.column} should be NOT NULL but still holds NULLs, so the ` +\n                    \"constraint was not applied. Fill or remove those rows and restart: \" +\n                    (err instanceof Error ? err.message : String(err))\n                );\n            }\n        }\n\n        // ── Migration: VARCHAR(n) → TEXT on the users string columns ────────\n        // Tables created before the widths came off still carry them. Postgres\n        // treats varchar(n) → text as binary-coercible with no stricter\n        // constraint, so this is a catalogue-only change: no table rewrite, no\n        // index rebuild, just a brief ACCESS EXCLUSIVE lock. Guarded on the\n        // current type so it runs once and is a pure catalogue read thereafter.\n        for (const column of [\"email\", \"display_name\", \"photo_url\", \"password_hash\", \"email_verification_token\"]) {\n            if (usersColumnTypes.get(column) !== \"character varying\") continue;\n            await db.execute(sql`\n                ALTER TABLE ${sql.raw(usersTableName)}\n                ALTER COLUMN ${sql.raw(`\"${column}\"`)} TYPE TEXT\n            `);\n            logger.info(`🔧 Widened ${usersTableName}.${column} from VARCHAR(n) to TEXT`);\n        }\n\n        // ── Migration: case-insensitive email identity ──────────────────────\n        // `getUserByEmail` has always searched `email.toLowerCase()` while the\n        // write path stored whatever it was handed, leaving normalisation to a\n        // convention every caller had to remember. A row that reached the table\n        // with mixed case is then invisible to every lookup — the account exists,\n        // login reports no such user, and the plain UNIQUE on `email` does not\n        // stop a second row differing only in case, because it compares bytes.\n        //\n        // Fixed on both sides: `mapPayload` now folds on write, and this index\n        // makes the database agree. A unique index on lower(email) is strictly\n        // stronger than the byte-exact UNIQUE that older tables carry, so the\n        // old constraint is left alone — it can no longer fire on anything the\n        // new one would allow.\n        //\n        // Deliberately no AUTH_SCHEMA_VERSION bump: a runtime that predates this\n        // migration keeps working against the migrated table (all of its own\n        // write paths already lower-cased), which is exactly the additive case\n        // the version stamp is documented not to cover.\n        if (usersColumnTypes.has(\"email\")) {\n            const indexPresent = await db.execute(sql`\n                SELECT 1 FROM pg_class c\n                JOIN pg_namespace n ON n.oid = c.relnamespace\n                WHERE n.nspname = ${usersSchema} AND c.relname = ${emailLowerUniqueIndex} AND c.relkind = 'i'\n            `);\n            if (indexPresent.rows.length === 0) {\n                // Case-collisions already in the table would make the unique\n                // index impossible to build. Report them and leave the table\n                // alone: the next boot retries, so fixing the rows is all the\n                // operator has to do. Failing loudly beats folding the emails\n                // and letting CREATE INDEX pick which account survives.\n                const collisions = await db.execute(sql`\n                    SELECT lower(email) AS normalized, count(*)::int AS occurrences\n                    FROM ${sql.raw(usersTableName)}\n                    WHERE email IS NOT NULL\n                    GROUP BY lower(email)\n                    HAVING count(*) > 1\n                    LIMIT 10\n                `);\n                if (collisions.rows.length > 0) {\n                    const sample = (collisions.rows as { normalized: string; occurrences: number }[])\n                        .map(row => `${row.normalized} (×${row.occurrences})`)\n                        .join(\", \");\n                    logger.error(\n                        `❌ Cannot enforce case-insensitive email uniqueness on ${usersTableName}: ` +\n                        `these addresses already exist more than once, differing only in case — ${sample}. ` +\n                        \"Merge or delete the duplicates and restart; until then two accounts can share \" +\n                        \"one address and only the lower-cased one is reachable by login.\"\n                    );\n                } else {\n                    const folded = await db.execute(sql`\n                        UPDATE ${sql.raw(usersTableName)}\n                        SET email = lower(email)\n                        WHERE email IS NOT NULL AND email <> lower(email)\n                    `);\n                    if (folded.rowCount) {\n                        logger.info(`🔧 Lower-cased ${folded.rowCount} email address(es) in ${usersTableName}`);\n                    }\n                    await db.execute(sql`\n                        CREATE UNIQUE INDEX IF NOT EXISTS ${sql.raw(`\"${emailLowerUniqueIndex}\"`)}\n                        ON ${sql.raw(usersTableName)} (lower(email))\n                    `);\n                    logger.info(`✅ Email uniqueness on ${usersTableName} is now case-insensitive`);\n                }\n            }\n        }\n\n        // ── Migration: bound the email column's length ──────────────────────\n        // The only length limit on this table worth keeping. 320 is the RFC 5321\n        // maximum (64-char local part + @ + 255-char domain), and it matters here\n        // beyond tidiness: `email` carries a btree index, and a sufficiently long\n        // value fails index insertion with an error that says nothing about\n        // email. NOT VALID so an adopted table with a long row still migrates —\n        // it binds all new writes, which is the part that matters.\n        if (usersColumnTypes.has(\"email\")) {\n            const checkPresent = await db.execute(sql`\n                SELECT 1 FROM pg_constraint c\n                JOIN pg_class t ON t.oid = c.conrelid\n                JOIN pg_namespace n ON n.oid = t.relnamespace\n                WHERE n.nspname = ${usersSchema}\n                  AND t.relname = ${resolvedTable}\n                  AND c.conname = ${authIdentifier(\"email_length_check\")}\n            `);\n            if (checkPresent.rows.length === 0) {\n                await db.execute(sql`\n                    ALTER TABLE ${sql.raw(usersTableName)}\n                    ADD CONSTRAINT ${sql.raw(emailLengthConstraint)} CHECK (length(email) <= 320) NOT VALID\n                `);\n            }\n        }\n\n        // ── Index: email verification token lookups ─────────────────────────\n        // `getUserByVerificationToken` filters on this column, which had no\n        // index — every click of a verification link was a sequential scan of\n        // the whole users table. Partial, because the column is NULL for every\n        // user who is not mid-verification, which is nearly all of them.\n        if (usersColumnTypes.has(\"email_verification_token\")) {\n            await db.execute(sql`\n                CREATE INDEX IF NOT EXISTS ${sql.raw(`\"${verificationTokenIndex}\"`)}\n                ON ${sql.raw(usersTableName)} (email_verification_token)\n                WHERE email_verification_token IS NOT NULL\n            `);\n        }\n\n        // ── Migration: refresh_tokens become session-scoped, rotation-safe ──\n        // Two shapes are reconciled here, on EVERY table named refresh_tokens\n        // in whatever schema it lives (a database provisioned by an older era\n        // can carry the table in a different schema than the one this run\n        // derives, and auth would then read a table nobody migrated):\n        //\n        //   1. The new columns. A token is now a member of a session\n        //      (`session_id`) and is retained after rotation (`revoked`,\n        //      `rotated_at`) so a replayed token can be recognised instead of\n        //      looking like a forgery. `session_started_at` is carried across\n        //      rotations so `users.tokens_valid_after` cannot be outrun.\n        //   2. The removal of `unique_device_session`. It made (uid,\n        //      user_agent, ip_address) the identity of a session, which evicted\n        //      a second browser profile behind one NAT and churned rows as\n        //      phones changed networks. UA and IP are metadata now.\n        //\n        // Every existing row is adopted rather than dropped: it keeps its\n        // token_hash, gets a session of its own, and stays unrevoked — so the\n        // sessions live in browsers right now survive the upgrade rather than\n        // everyone being signed out by the fix for being signed out.\n        try {\n            const rtTables = await db.execute(sql`\n                SELECT table_schema, table_name\n                FROM information_schema.tables\n                WHERE table_name = 'refresh_tokens'\n            `);\n            const found = (rtTables.rows as { table_schema: string; table_name: string }[]);\n            logger.debug(`🔍 refresh_tokens reconcile: found ${found.length} table(s): ${found.map(r => `\"${r.table_schema}\".\"${r.table_name}\"`).join(\", \") || \"(none)\"}`);\n            for (const { table_schema } of found) {\n                const qualified = `\"${table_schema}\".\"refresh_tokens\"`;\n                try {\n                    // Added nullable, then back-filled, then constrained: adding\n                    // `session_id NOT NULL DEFAULT gen_random_uuid()` in one step\n                    // would stamp every existing row with the SAME uuid on some\n                    // Postgres versions, silently merging every live session into\n                    // one that a single logout would then wipe.\n                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_id TEXT`);\n                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);\n                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);\n                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);\n                    // Nullable with no default and no back-fill: a row written\n                    // before this column existed says nothing about whether a\n                    // second factor was presented, and the reader treats \"says\n                    // nothing\" as `aal1` — the restrictive answer. Stamping\n                    // every existing row would be inventing evidence.\n                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS aal TEXT`);\n\n                    // One session per pre-existing row: under the old model a row\n                    // WAS a device session, and there is no record of which rows\n                    // descended from the same sign-in.\n                    await db.execute(sql`\n                        UPDATE ${sql.raw(qualified)}\n                        SET session_id = gen_random_uuid()::text\n                        WHERE session_id IS NULL\n                    `);\n                    await db.execute(sql`\n                        UPDATE ${sql.raw(qualified)}\n                        SET session_started_at = COALESCE(created_at, NOW())\n                        WHERE session_started_at IS NULL\n                    `);\n                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET DEFAULT gen_random_uuid()::text`);\n                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET DEFAULT NOW()`);\n                    // SET NOT NULL only once the back-fill above has definitely\n                    // run; on a table that somehow still holds a NULL this throws\n                    // and is caught below rather than failing the boot.\n                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET NOT NULL`);\n                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET NOT NULL`);\n\n                    await db.execute(sql`\n                        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_session\n                        ON ${sql.raw(qualified)}(session_id)\n                    `);\n\n                    // The device-session constraint is now actively harmful: two\n                    // live tokens of one session (a rotation in flight) share a\n                    // uid, and usually a user agent and IP too.\n                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);\n                    logger.debug(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);\n                } catch (perTableError: unknown) {\n                    logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);\n                }\n            }\n        } catch (migrationError: unknown) {\n            logger.warn(`⚠️  refresh_tokens session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);\n        }\n\n        // ── Migration: Copy roles from legacy junction table to inline column ──\n        // If the old rebase.user_roles and rebase.roles tables exist, migrate\n        // the data into the new TEXT[] column then drop the legacy tables.\n        try {\n            const legacyCheck = await db.execute(sql`\n                SELECT EXISTS (\n                    SELECT 1 FROM information_schema.tables\n                    WHERE table_schema = 'rebase' AND table_name = 'user_roles'\n                ) AS has_user_roles\n            `);\n            const hasLegacyTables = (legacyCheck.rows[0] as { has_user_roles: boolean }).has_user_roles;\n\n            if (hasLegacyTables) {\n                logger.info(\"🔄 Migrating roles from legacy user_roles table...\");\n                // Update users' roles column from the junction table\n                await db.execute(sql`\n                    UPDATE ${sql.raw(usersTableName)} u\n                    SET roles = COALESCE((\n                        SELECT array_agg(ur.role_id)\n                        FROM \"rebase\".\"user_roles\" ur\n                        WHERE ur.user_id = u.id\n                    ), '{}')\n                    WHERE u.roles = '{}' OR u.roles IS NULL\n                `);\n\n                // Drop legacy tables (junction first due to FK)\n                await db.execute(sql`DROP TABLE IF EXISTS \"rebase\".\"user_roles\" CASCADE`);\n                await db.execute(sql`DROP TABLE IF EXISTS \"rebase\".\"roles\" CASCADE`);\n                logger.info(\"✅ Legacy roles tables migrated and dropped\");\n            }\n        } catch (migrationError: unknown) {\n            // Non-fatal: log and continue — the column exists and will work\n            logger.warn(`⚠️  Legacy roles migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);\n        }\n\n        // ── MFA tables ──────────────────────────────────────────────────────\n        const mfaFactorsTableName = `\"${authSchema}\".\"mfa_factors\"`;\n        const mfaChallengesTableName = `\"${authSchema}\".\"mfa_challenges\"`;\n        const recoveryCodesTableName = `\"${authSchema}\".\"recovery_codes\"`;\n\n        // Create mfa_factors table\n        await db.execute(sql`\n            CREATE TABLE IF NOT EXISTS ${sql.raw(mfaFactorsTableName)} (\n                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,\n                factor_type TEXT NOT NULL DEFAULT 'totp',\n                secret_encrypted TEXT NOT NULL,\n                friendly_name TEXT,\n                verified BOOLEAN DEFAULT FALSE,\n                last_used_counter BIGINT,\n                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),\n                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()\n            )\n        `);\n\n        // Create indexes on mfa_factors\n        await db.execute(sql`\n            CREATE INDEX IF NOT EXISTS idx_mfa_factors_user\n            ON ${sql.raw(mfaFactorsTableName)}(uid)\n        `);\n\n        // Create mfa_challenges table\n        await db.execute(sql`\n            CREATE TABLE IF NOT EXISTS ${sql.raw(mfaChallengesTableName)} (\n                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                factor_id TEXT NOT NULL REFERENCES ${sql.raw(mfaFactorsTableName)}(id) ON DELETE CASCADE,\n                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),\n                verified_at TIMESTAMP WITH TIME ZONE,\n                ip_address TEXT,\n                attempts INTEGER NOT NULL DEFAULT 0,\n                expires_at TIMESTAMP WITH TIME ZONE NOT NULL\n            )\n        `);\n\n        // Create indexes on mfa_challenges\n        await db.execute(sql`\n            CREATE INDEX IF NOT EXISTS idx_mfa_challenges_factor\n            ON ${sql.raw(mfaChallengesTableName)}(factor_id)\n        `);\n\n        // ── Migration: replay and brute-force state on the MFA tables ───────\n        // Both are additive and nullable-or-defaulted, so a runtime that\n        // predates them reads the tables unchanged. `last_used_counter` records\n        // the TOTP step a factor has already spent (RFC 6238 §5.2); `attempts`\n        // bounds how many guesses one challenge will take before it is dead.\n        // Without them the code paths degrade to \"no replay protection, rate\n        // limiters only\" rather than failing, which is why this is a warn.\n        try {\n            await db.execute(sql`ALTER TABLE ${sql.raw(mfaFactorsTableName)} ADD COLUMN IF NOT EXISTS last_used_counter BIGINT`);\n            await db.execute(sql`ALTER TABLE ${sql.raw(mfaChallengesTableName)} ADD COLUMN IF NOT EXISTS attempts INTEGER NOT NULL DEFAULT 0`);\n        } catch (mfaMigrationError: unknown) {\n            logger.warn(`⚠️  MFA hardening columns skipped: ${mfaMigrationError instanceof Error ? mfaMigrationError.message : String(mfaMigrationError)}`);\n        }\n\n        // Create recovery_codes table\n        await db.execute(sql`\n            CREATE TABLE IF NOT EXISTS ${sql.raw(recoveryCodesTableName)} (\n                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,\n                code_hash TEXT NOT NULL,\n                used_at TIMESTAMP WITH TIME ZONE,\n                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()\n            )\n        `);\n\n        // Create indexes on recovery_codes\n        await db.execute(sql`\n            CREATE INDEX IF NOT EXISTS idx_recovery_codes_user\n            ON ${sql.raw(recoveryCodesTableName)}(uid)\n        `);\n\n        // ── Migration: clear stale FORCE ROW LEVEL SECURITY (older RLS model) ──\n        // The current model never emits FORCE: privileged auth writes run as\n        // the table owner and rely on the owner bypassing plain ENABLE RLS\n        // (see generate-postgres-ddl-logic). A table still carrying FORCE from\n        // an older framework era binds the owner too, so the first user\n        // registration after an upgrade fails with SQLSTATE 42501. Reconcile\n        // on boot; only tables actually flagged get the ALTER (and its lock).\n        try {\n            // Every table this function creates, not a subset. `magic_link_tokens`\n            // and `schema_meta` were missing here while their six siblings were\n            // listed — so on a database carrying FORCE from the older RLS model,\n            // magic-link sign-in kept failing 42501 after the upgrade that was\n            // supposed to fix exactly that, and only for the one auth method.\n            const authTablePairs: [string, string][] = [\n                [usersSchema, resolvedTable],\n                [authSchema, \"user_identities\"],\n                [authSchema, \"refresh_tokens\"],\n                [authSchema, \"password_reset_tokens\"],\n                [authSchema, \"magic_link_tokens\"],\n                [authSchema, \"app_config\"],\n                [authSchema, \"mfa_factors\"],\n                [authSchema, \"mfa_challenges\"],\n                [authSchema, \"recovery_codes\"],\n                [authSchema, \"schema_meta\"]\n            ];\n            for (const [schemaName, tableName] of authTablePairs) {\n                const forced = await db.execute(sql`\n                    SELECT 1\n                    FROM pg_class c\n                    JOIN pg_namespace n ON n.oid = c.relnamespace\n                    WHERE n.nspname = ${schemaName}\n                      AND c.relname = ${tableName}\n                      AND c.relforcerowsecurity\n                `);\n                if (forced.rows.length > 0) {\n                    await db.execute(sql`\n                        ALTER TABLE ${sql.raw(`\"${schemaName}\".\"${tableName}\"`)}\n                        NO FORCE ROW LEVEL SECURITY\n                    `);\n                    logger.warn(\n                        `🔧 Cleared stale FORCE ROW LEVEL SECURITY on \"${schemaName}\".\"${tableName}\" ` +\n                        \"(legacy RLS model — it binds the owner connection and breaks privileged auth writes)\"\n                    );\n                }\n            }\n        } catch (rlsReconcileError: unknown) {\n            // Non-fatal: the connection may lack ownership on a pre-provisioned\n            // table; registration will still fail loudly (42501) if FORCE remains.\n            logger.warn(\n                `⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ` +\n                `${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`\n            );\n        }\n\n        // Stamped last of the MIGRATIONS, so a boot that died partway through\n        // the ones above leaves the older stamp in place and the next boot runs\n        // them again.\n        await stampAuthSchemaVersion(db, authSchema);\n\n        // ── Keep the end-user role out of auth's tables ─────────────────────\n        // These carry session token hashes, TOTP secrets and recovery codes, and\n        // none of them has RLS — they are not collections, so nothing ever\n        // compiled a policy for them. Meanwhile the role provisioning grants\n        // `rebase_user` DML on every table in this schema, and its\n        // ALTER DEFAULT PRIVILEGES reaches the ones created right here, after it\n        // ran. So the grant has to come back off; see `revokeInternalTableSql`\n        // for why a revoke rather than an empty RLS policy set.\n        //\n        // After the stamp deliberately: `schema_meta` is created BY the stamp,\n        // so revoking first would leave the one table holding this database's\n        // schema version writable by every signed-in user until the next boot.\n        // Nothing below re-runs the migrations, so the stamp's guarantee holds.\n        await revokeInternalTableAccess(\n            async (text) => { await db.execute(sql.raw(text)); },\n            authSchema,\n            {\n                onError: (table, err) => logger.warn(\n                    `🔐 Could not revoke authenticated-role access to \"${authSchema}\".\"${table}\": ` +\n                    (err instanceof Error ? err.message : String(err))\n                )\n            }\n        );\n\n        logger.debug(\"✅ Auth tables ready\");\n    } catch (error) {\n        // The one failure that must not be survived. Continuing here is what\n        // produced a server that answered /health with 200 while every login\n        // returned 500 — the incompatibility is total, so crashing is the\n        // kinder outcome: an orchestrator will not route traffic to a pod that\n        // never came up.\n        if (error instanceof AuthSchemaVersionError) throw error;\n        logger.error(\"❌ Failed to create auth tables\", { error });\n        logger.warn(\"⚠️ Continuing without creating auth tables.\");\n    }\n}\n\n"],"mappings":";;;;;;;;;AAuCA,IAAM,cAAc;;;;;;;AAQpB,IAAM,iCAAiC;CAAC;CAAc;CAAW;CAAc;AAAoB;;;;;;AAOnG,IAAM,mCAAmC;;;;;;;;;AAUzC,IAAa,yBAAb,cAA4C,MAAM;CAC9C;CACA;CAEA,YAAY,iBAAyB,gBAAwB;EACzD,MACI,4DAA4D,gBAAgB,yCACpC,eAAe;;+JAM3D;EACA,KAAK,OAAO;EACZ,KAAK,kBAAkB;EACvB,KAAK,iBAAiB;CAC1B;AACJ;;;;;;AAOA,SAAgB,kBAAkB,YAAuC;CACrE,IAAI,CAAC,YAAY,OAAO;CACxB,MAAM,cAAe,YAAY,cAAc,OAAO,WAAW,WAAW,WACtE,WAAW,SACX;CACN,OAAO,gBAAgB,WAAW,WAAW;AACjD;;;;;;;;;AAUA,eAAsB,sBAClB,IACA,YACsB;CACtB,MAAM,YAAY,IAAI,WAAW;CAEjC,IAAI,EAAE,MADe,GAAG,QAAQ,GAAG,sBAAsB,UAAU,yBAAyB,EAAA,CAC/E,KAAK,EAAE,EAAuC,SAAS,OAAO;CAK3E,MAAM,OAAO,MAHQ,GAAG,QAAQ,GAAG;4BACX,IAAI,IAAI,SAAS,EAAE,eAAe,YAAY;KACrE,EAAA,CACmB,KAAK,EAAE,EAAoC;CAC/D,IAAI,QAAQ,KAAA,GAAW,OAAO;CAE9B,MAAM,SAAS,OAAO,SAAS,KAAK,EAAE;CAItC,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC9C;;;;;;;;AASA,eAAsB,2BAClB,IACA,YACa;CACb,MAAM,kBAAkB,MAAM,sBAAsB,IAAI,UAAU;CAClE,IAAI,oBAAoB,QAAQ,kBAAA,GAC5B,MAAM,IAAI,uBAAuB,iBAAA,CAAoC;AAE7E;;;;;;;AAQA,eAAsB,uBAClB,IACA,YACa;CACb,MAAM,YAAY,IAAI,WAAW;CACjC,MAAM,GAAG,QAAQ,GAAG;qCACa,IAAI,IAAI,SAAS,EAAE;;;;;KAKnD;CACD,MAAM,GAAG,QAAQ,GAAG;sBACF,IAAI,IAAI,SAAS,EAAE;kBACvB,YAAY,IAAI,OAAA,CAA0B,EAAE;;KAEzD;AACL;;;;;;;;;;;;;;;;;AA8BA,eAAsB,gBAClB,IACA,YAC8B;CAC9B,MAAM,WAAqB,CAAC;CAC5B,IAAI,kBAAiC;CAErC,IAAI;EACA,kBAAkB,MAAM,sBAAsB,IAAI,UAAU;EAC5D,IAAI,oBAAoB,QAAQ,kBAAA,GAC5B,SAAS,KACL,sCAAsC,gBAAgB,4EAE1D;EAGJ,MAAM,gBAAgB,IAAI,WAAW;EAErC,IAAI,EAAE,MADgB,GAAG,QAAQ,GAAG,sBAAsB,cAAc,yBAAyB,EAAA,CACnF,KAAK,EAAE,EAAuC,SAGxD,OAAO;GAAE,SAAS,SAAS,WAAW;GAAG;GAAiB,gBAAA;GAAqC;EAAS;EAG5G,MAAM,UAAU,MAAM,GAAG,QAAQ,GAAG;;mCAET,WAAW;SACrC;EACD,MAAM,QAAQ,IAAI,IAAK,QAAQ,KAAmC,KAAI,QAAO,IAAI,WAAW,CAAC;EAC7F,MAAM,UAAU,+BAA+B,QAAO,WAAU,CAAC,MAAM,IAAI,MAAM,CAAC;EAClF,IAAI,QAAQ,SAAS,GACjB,SAAS,KACL,6BAA6B,QAAQ,KAAK,IAAI,EAAE,2FAEpD;EAWJ,KAAI,MARkB,GAAG,QAAQ,GAAG;;;;gCAIZ,WAAW;;gCAEX,iCAAiC;SACxD,EAAA,CACW,KAAK,SAAS,GACtB,SAAS,KACL,gCAAgC,iCAAiC,6DAErE;CAER,SAAS,OAAgB;EACrB,SAAS,KACL,6BAA6B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACtF;CACJ;CAEA,OAAO;EACH,SAAS,SAAS,WAAW;EAC7B;EACA,gBAAA;EACA;CACJ;AACJ;;;;;;;;;;;AC7OA,eAAsB,sBAAsB,IAAoB,YAA8C;CAC1G,OAAO,MAAM,4BAA4B;CAOzC,MAAM,2BAA2B,IAAI,kBAAkB,UAAU,CAAC;CAElE,IAAI;EAEA,IAAI,iBAAiB;EACrB,IAAI,aAAa;EACjB,IAAI,cAAc;EAClB,IAAI,gBAAgB;EACpB,IAAI,YAAY;GACZ,gBAAiB,WAAW,cAAc,OAAO,WAAW,UAAU,WAChE,WAAW,QACX,WAAW;GACjB,cAAe,YAAY,cAAc,OAAO,WAAW,WAAW,WAChE,WAAW,SACX;GACN,iBAAiB,gBAAgB,WAC3B,IAAI,cAAc,KAClB,IAAI,YAAY,KAAK,cAAc;GAazC,MAAM,SAAS,WAAW,YAAY;GACtC,IAAI,QAAQ;IACR,MAAM,OAAQ,UAAU,SAAW,OAAmC,OAAO,KAAA;IAC7E,IAAI,SAAS,QACT,aAAa;SACV,IAAI,SAAS,aAChB,aAAa;GAGrB;EACJ;EAGA,IAAI;GACA,MAAM,SAAS,MAAM,GAAG,QAAQ,GAAG;;;uCAGR,YAAY;qCACd,cAAc;;aAEtC;GACD,IAAI,UAAU,OAAO,QAAQ,OAAO,KAAK,SAAS,GAAG;IACjD,MAAM,SAAS,OAAQ,OAAO,KAAK,EAAE,CAA2B,SAAS,CAAC,CAAC,YAAY;IACvF,IAAI,WAAW,QACX,aAAa;SACV,IAAI,WAAW,aAAa,WAAW,cAAc,WAAW,UACnE,aAAa;SAEb,aAAa;IAEjB,OAAO,MAAM,cAAc,eAAe,0BAA0B,OAAO,wBAAwB,YAAY;GACnH;EACJ,SAAS,KAAK;GAEV,OAAO,KAAK,2BAA2B,eAAe,uDAAuD,cAAc,EAAE,OAAO,IAAI,CAAC;EAC7I;EAIA,IAAI,gBAAgB,UAChB,MAAM,GAAG,QAAQ,GAAG,+BAA+B,IAAI,IAAI,WAAW,GAAG;EAE7E,MAAM,GAAG,QAAQ,GAAG,oCAAoC;EAExD,MAAM,aAAa,gBAAgB,WAAW,WAAW;EACzD,MAAM,sBAAsB,IAAI,WAAW;EAC3C,MAAM,yBAAyB,IAAI,WAAW;EAC9C,MAAM,+BAA+B,IAAI,WAAW;EACpD,MAAM,qBAAqB,IAAI,WAAW;EAQ1C,MAAM,YAAY,eAAe,SAC3B,8BACA,eAAe,YACX,iCACA;EAQV,MAAM,kBAAkB,WAAmB,GAAG,cAAc,GAAG,SAAS,MAAM,GAAG,EAAE;EACnF,MAAM,wBAAwB,IAAI,eAAe,oBAAoB,EAAE;EACvE,MAAM,wBAAwB,eAAe,iBAAiB;EAC9D,MAAM,yBAAyB,eAAe,8BAA8B;EAsB5E,MAAM,iBAAiB,mBAClB,KAAK,SAAS,KAAK,WAAW,UACzB,GAAG,KAAK,OAAO,GAAG,mBAAmB,IAAI,EAAE,cAAc,sBAAsB,iCAC/E,GAAG,KAAK,OAAO,GAAG,mBAAmB,IAAI,GAAG,CAAC,CAClD,KAAK,qBAAqB;EAC/B,MAAM,GAAG,QAAQ,GAAG;yCACa,IAAI,IAAI,cAAc,EAAE;qBAC5C,IAAI,IAAI,UAAU,EAAE,eAAe,IAAI,IAAI,SAAS,EAAE;kBACzD,IAAI,IAAI,cAAc,EAAE;;SAEjC;EAkBD,MAAM,iBAAiB;GACnB;GACA;GACA;GACA;GACA;GACA;EACJ;EAaA,MAAM,oBAAoB,eAAe,KAAI,MAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACrE,MAAM,sBAAsB,MAAM,GAAG,QAAQ,GAAG;;;mCAGrB,WAAW;mCACX,IAAI,IAAI,iBAAiB,EAAE;;;SAGrD;EAED,IAAI,oBAAoB,KAAK,SAAS,GAClC,MAAM,GAAG,QAAQ,GAAG;6CACa,IAAI,IAAI,IAAI,WAAW,EAAE,EAAE;;;;;;;;;aAS3D;EAGL,KAAK,MAAM,aAAa,oBAAoB,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG;GAC/E,MAAM,YAAY,IAAI,WAAW,KAAK,UAAU;GAChD,MAAM,GAAG,QAAQ,GAAG;;;;;;;;;;;2CAWW,IAAI,IAAI,IAAI,WAAW,EAAE,EAAE;yCAC7B,IAAI,IAAI,IAAI,UAAU,EAAE,EAAE;;;;;;;;;kCASjC,IAAI,IAAI,gBAAgB,UAAU,kBAAkB,WAAW,cAAc,eAAe,wBAAwB,EAAE;kCACtH,IAAI,IAAI,WAAW,UAAU,sCAAsC,EAAE;kCACrE,IAAI,IAAI,mCAAmC,UAAU,UAAU,UAAU,OAAO,EAAE;;;;;;8BAMtF,IAAI,IAAI,gBAAgB,UAAU,qCAAqC,EAAE;;8BAEzE,IAAI,IAAI,+CAA+C,UAAU,EAAE,EAAE;8BACrE,IAAI,IAAI,+DAA+D,UAAU,kCAAkC,WAAW,sBAAsB,EAAE;;aAEvK;EACL;EAKA,MAAM,GAAG,QAAQ,GAAG;yCACa,IAAI,IAAI,mBAAmB,EAAE;;sBAEhD,IAAI,IAAI,UAAU,EAAE,uBAAuB,IAAI,IAAI,cAAc,EAAE;;;;;;;;SAQhF;EAGD,MAAM,GAAG,QAAQ,GAAG;;iBAEX,IAAI,IAAI,mBAAmB,EAAE;SACrC;EAOD,MAAM,GAAG,QAAQ,GAAG;yCACa,IAAI,IAAI,sBAAsB,EAAE;;sBAEnD,IAAI,IAAI,UAAU,EAAE,uBAAuB,IAAI,IAAI,cAAc,EAAE;;;;;;;;;;;SAWhF;EAGD,MAAM,GAAG,QAAQ,GAAG;;iBAEX,IAAI,IAAI,sBAAsB,EAAE;SACxC;EAGD,MAAM,GAAG,QAAQ,GAAG;;iBAEX,IAAI,IAAI,sBAAsB,EAAE;SACxC;EAGD,MAAM,GAAG,QAAQ,GAAG;yCACa,IAAI,IAAI,4BAA4B,EAAE;;sBAEzD,IAAI,IAAI,UAAU,EAAE,uBAAuB,IAAI,IAAI,cAAc,EAAE;;;;;;SAMhF;EAGD,MAAM,GAAG,QAAQ,GAAG;;iBAEX,IAAI,IAAI,4BAA4B,EAAE;SAC9C;EAGD,MAAM,GAAG,QAAQ,GAAG;;iBAEX,IAAI,IAAI,4BAA4B,EAAE;SAC9C;EAGD,MAAM,2BAA2B,IAAI,WAAW;EAChD,MAAM,GAAG,QAAQ,GAAG;yCACa,IAAI,IAAI,wBAAwB,EAAE;;sBAErD,IAAI,IAAI,UAAU,EAAE,uBAAuB,IAAI,IAAI,cAAc,EAAE;;;;;;SAMhF;EAGD,MAAM,GAAG,QAAQ,GAAG;;iBAEX,IAAI,IAAI,wBAAwB,EAAE;SAC1C;EAGD,MAAM,GAAG,QAAQ,GAAG;;iBAEX,IAAI,IAAI,wBAAwB,EAAE;SAC1C;EAGD,MAAM,GAAG,QAAQ,GAAG;yCACa,IAAI,IAAI,kBAAkB,EAAE;;;;;SAK5D;EAYD,MAAM,GAAG,YAAY,OAAO,OAAO;GAC/B,MAAM,GAAG,QAAQ,GAAG,sEAAsE;GAC1F,KAAK,MAAM,aAAa,0BACpB,MAAM,GAAG,QAAQ,IAAI,IAAI,SAAS,CAAC;EAE3C,CAAC;EAeD,KAAK,MAAM,QAAQ,oBAAoB;GACnC,IAAI,KAAK,WAAW,SAAS;GAC7B,MAAM,GAAG,QAAQ,GAAG;8BACF,IAAI,IAAI,cAAc,EAAE;2CACX,IAAI,IAAI,GAAG,KAAK,OAAO,GAAG,mBAAmB,IAAI,GAAG,EAAE;aACpF;EACL;EAkBA,MAAM,mBAAkB,MAXG,GAAG,QAAQ,GAAG;;;mCAGd,YAAY,oBAAoB,cAAc;SACxE,EAAA,CAOoC;EACrC,MAAM,mBAAmB,IAAI,IAAI,gBAAgB,KAAI,QAAO,CAAC,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC;EAC7F,MAAM,mBAAmB,IAAI,IAAI,gBAAgB,KAAI,QAAO,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC;EAgBnF,KAAK,MAAM,QAAQ,oBAAoB;GACnC,MAAM,QAAQ,iBAAiB,IAAI,KAAK,MAAM;GAC9C,IAAI,CAAC,OAAO;GAEZ,IAAI,KAAK,YAAY,KAAA,KAAa,MAAM,mBAAmB,MAAM;IAC7D,MAAM,GAAG,QAAQ,GAAG;kCACF,IAAI,IAAI,cAAc,EAAE;mCACvB,IAAI,IAAI,IAAI,KAAK,OAAO,EAAE,EAAE,eAAe,IAAI,IAAI,KAAK,OAAO,EAAE;iBACnF;IACD,OAAO,KAAK,8BAA8B,eAAe,GAAG,KAAK,QAAQ;GAC7E;GAEA,IAAI,CAAC,KAAK,WAAW,MAAM,gBAAgB,OAAO;GAElD,IAAI,KAAK,YAAY,KAAA,GACjB,MAAM,GAAG,QAAQ,GAAG;6BACP,IAAI,IAAI,cAAc,EAAE;0BAC3B,IAAI,IAAI,IAAI,KAAK,OAAO,EAAE,EAAE,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE;4BACrD,IAAI,IAAI,IAAI,KAAK,OAAO,EAAE,EAAE;iBACvC;GAEL,IAAI;IACA,MAAM,GAAG,QAAQ,GAAG;kCACF,IAAI,IAAI,cAAc,EAAE;mCACvB,IAAI,IAAI,IAAI,KAAK,OAAO,EAAE,EAAE;iBAC9C;IACD,OAAO,KAAK,2BAA2B,eAAe,GAAG,KAAK,QAAQ;GAC1E,SAAS,KAAK;IACV,OAAO,KACH,MAAM,eAAe,GAAG,KAAK,OAAO,0HAEnC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACpD;GACJ;EACJ;EAQA,KAAK,MAAM,UAAU;GAAC;GAAS;GAAgB;GAAa;GAAiB;EAA0B,GAAG;GACtG,IAAI,iBAAiB,IAAI,MAAM,MAAM,qBAAqB;GAC1D,MAAM,GAAG,QAAQ,GAAG;8BACF,IAAI,IAAI,cAAc,EAAE;+BACvB,IAAI,IAAI,IAAI,OAAO,EAAE,EAAE;aACzC;GACD,OAAO,KAAK,cAAc,eAAe,GAAG,OAAO,yBAAyB;EAChF;EAoBA,IAAI,iBAAiB,IAAI,OAAO;QAMxB,MALuB,GAAG,QAAQ,GAAG;;;oCAGjB,YAAY,mBAAmB,sBAAsB;aAC5E,EAAA,CACgB,KAAK,WAAW,GAAG;IAMhC,MAAM,aAAa,MAAM,GAAG,QAAQ,GAAG;;2BAE5B,IAAI,IAAI,cAAc,EAAE;;;;;iBAKlC;IACD,IAAI,WAAW,KAAK,SAAS,GAAG;KAC5B,MAAM,SAAU,WAAW,KACtB,KAAI,QAAO,GAAG,IAAI,WAAW,KAAK,IAAI,YAAY,EAAE,CAAC,CACrD,KAAK,IAAI;KACd,OAAO,MACH,yDAAyD,eAAe,2EACE,OAAO,gJAGrF;IACJ,OAAO;KACH,MAAM,SAAS,MAAM,GAAG,QAAQ,GAAG;iCACtB,IAAI,IAAI,cAAc,EAAE;;;qBAGpC;KACD,IAAI,OAAO,UACP,OAAO,KAAK,kBAAkB,OAAO,SAAS,wBAAwB,gBAAgB;KAE1F,MAAM,GAAG,QAAQ,GAAG;4DACoB,IAAI,IAAI,IAAI,sBAAsB,EAAE,EAAE;6BACrE,IAAI,IAAI,cAAc,EAAE;qBAChC;KACD,OAAO,KAAK,yBAAyB,eAAe,yBAAyB;IACjF;GACJ;;EAUJ,IAAI,iBAAiB,IAAI,OAAO;QASxB,MARuB,GAAG,QAAQ,GAAG;;;;oCAIjB,YAAY;oCACZ,cAAc;oCACd,eAAe,oBAAoB,EAAE;aAC5D,EAAA,CACgB,KAAK,WAAW,GAC7B,MAAM,GAAG,QAAQ,GAAG;kCACF,IAAI,IAAI,cAAc,EAAE;qCACrB,IAAI,IAAI,qBAAqB,EAAE;iBACnD;EAAA;EAST,IAAI,iBAAiB,IAAI,0BAA0B,GAC/C,MAAM,GAAG,QAAQ,GAAG;6CACa,IAAI,IAAI,IAAI,uBAAuB,EAAE,EAAE;qBAC/D,IAAI,IAAI,cAAc,EAAE;;aAEhC;EAuBL,IAAI;GAMA,MAAM,SAAS,MALQ,GAAG,QAAQ,GAAG;;;;aAIpC,EAAA,CACuB;GACxB,OAAO,MAAM,sCAAsC,MAAM,OAAO,aAAa,MAAM,KAAI,MAAK,IAAI,EAAE,aAAa,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK,UAAU;GAC7J,KAAK,MAAM,EAAE,kBAAkB,OAAO;IAClC,MAAM,YAAY,IAAI,aAAa;IACnC,IAAI;KAMA,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,SAAS,EAAE,0CAA0C;KAChG,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,SAAS,EAAE,iEAAiE;KACvH,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,SAAS,EAAE,8DAA8D;KACpH,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,SAAS,EAAE,sEAAsE;KAM5H,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,SAAS,EAAE,mCAAmC;KAKzF,MAAM,GAAG,QAAQ,GAAG;iCACP,IAAI,IAAI,SAAS,EAAE;;;qBAG/B;KACD,MAAM,GAAG,QAAQ,GAAG;iCACP,IAAI,IAAI,SAAS,EAAE;;;qBAG/B;KACD,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,SAAS,EAAE,6DAA6D;KACnH,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,SAAS,EAAE,mDAAmD;KAIzG,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,SAAS,EAAE,sCAAsC;KAC5F,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,SAAS,EAAE,8CAA8C;KAEpG,MAAM,GAAG,QAAQ,GAAG;;6BAEX,IAAI,IAAI,SAAS,EAAE;qBAC3B;KAKD,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,SAAS,EAAE,iDAAiD;KACvG,OAAO,MAAM,4DAA4D,WAAW;IACxF,SAAS,eAAwB;KAC7B,OAAO,KAAK,2CAA2C,UAAU,IAAI,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,GAAG;IACzJ;GACJ;EACJ,SAAS,gBAAyB;GAC9B,OAAO,KAAK,iDAAiD,0BAA0B,QAAQ,eAAe,UAAU,OAAO,cAAc,GAAG;EACpJ;EAKA,IAAI;GASA,KAFyB,MANC,GAAG,QAAQ,GAAG;;;;;aAKvC,EAAA,CACoC,KAAK,EAAE,CAAiC,gBAExD;IACjB,OAAO,KAAK,oDAAoD;IAEhE,MAAM,GAAG,QAAQ,GAAG;6BACP,IAAI,IAAI,cAAc,EAAE;;;;;;;iBAOpC;IAGD,MAAM,GAAG,QAAQ,GAAG,oDAAoD;IACxE,MAAM,GAAG,QAAQ,GAAG,+CAA+C;IACnE,OAAO,KAAK,4CAA4C;GAC5D;EACJ,SAAS,gBAAyB;GAE9B,OAAO,KAAK,uCAAuC,0BAA0B,QAAQ,eAAe,UAAU,OAAO,cAAc,GAAG;EAC1I;EAGA,MAAM,sBAAsB,IAAI,WAAW;EAC3C,MAAM,yBAAyB,IAAI,WAAW;EAC9C,MAAM,yBAAyB,IAAI,WAAW;EAG9C,MAAM,GAAG,QAAQ,GAAG;yCACa,IAAI,IAAI,mBAAmB,EAAE;;sBAEhD,IAAI,IAAI,UAAU,EAAE,uBAAuB,IAAI,IAAI,cAAc,EAAE;;;;;;;;;SAShF;EAGD,MAAM,GAAG,QAAQ,GAAG;;iBAEX,IAAI,IAAI,mBAAmB,EAAE;SACrC;EAGD,MAAM,GAAG,QAAQ,GAAG;yCACa,IAAI,IAAI,sBAAsB,EAAE;;qDAEpB,IAAI,IAAI,mBAAmB,EAAE;;;;;;;SAOzE;EAGD,MAAM,GAAG,QAAQ,GAAG;;iBAEX,IAAI,IAAI,sBAAsB,EAAE;SACxC;EASD,IAAI;GACA,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,mBAAmB,EAAE,mDAAmD;GACnH,MAAM,GAAG,QAAQ,GAAG,eAAe,IAAI,IAAI,sBAAsB,EAAE,8DAA8D;EACrI,SAAS,mBAA4B;GACjC,OAAO,KAAK,sCAAsC,6BAA6B,QAAQ,kBAAkB,UAAU,OAAO,iBAAiB,GAAG;EAClJ;EAGA,MAAM,GAAG,QAAQ,GAAG;yCACa,IAAI,IAAI,sBAAsB,EAAE;;sBAEnD,IAAI,IAAI,UAAU,EAAE,uBAAuB,IAAI,IAAI,cAAc,EAAE;;;;;SAKhF;EAGD,MAAM,GAAG,QAAQ,GAAG;;iBAEX,IAAI,IAAI,sBAAsB,EAAE;SACxC;EASD,IAAI;GAMA,MAAM,iBAAqC;IACvC,CAAC,aAAa,aAAa;IAC3B,CAAC,YAAY,iBAAiB;IAC9B,CAAC,YAAY,gBAAgB;IAC7B,CAAC,YAAY,uBAAuB;IACpC,CAAC,YAAY,mBAAmB;IAChC,CAAC,YAAY,YAAY;IACzB,CAAC,YAAY,aAAa;IAC1B,CAAC,YAAY,gBAAgB;IAC7B,CAAC,YAAY,gBAAgB;IAC7B,CAAC,YAAY,aAAa;GAC9B;GACA,KAAK,MAAM,CAAC,YAAY,cAAc,gBASlC,KAAI,MARiB,GAAG,QAAQ,GAAG;;;;wCAIX,WAAW;wCACX,UAAU;;iBAEjC,EAAA,CACU,KAAK,SAAS,GAAG;IACxB,MAAM,GAAG,QAAQ,GAAG;sCACF,IAAI,IAAI,IAAI,WAAW,KAAK,UAAU,EAAE,EAAE;;qBAE3D;IACD,OAAO,KACH,iDAAiD,WAAW,KAAK,UAAU,uFAE/E;GACJ;EAER,SAAS,mBAA4B;GAGjC,OAAO,KACH,oEACG,6BAA6B,QAAQ,kBAAkB,UAAU,OAAO,iBAAiB,GAChG;EACJ;EAKA,MAAM,uBAAuB,IAAI,UAAU;EAe3C,MAAM,0BACF,OAAO,SAAS;GAAE,MAAM,GAAG,QAAQ,IAAI,IAAI,IAAI,CAAC;EAAG,GACnD,YACA,EACI,UAAU,OAAO,QAAQ,OAAO,KAC5B,qDAAqD,WAAW,KAAK,MAAM,QAC1E,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACpD,EACJ,CACJ;EAEA,OAAO,MAAM,qBAAqB;CACtC,SAAS,OAAO;EAMZ,IAAI,iBAAiB,wBAAwB,MAAM;EACnD,OAAO,MAAM,kCAAkC,EAAE,MAAM,CAAC;EACxD,OAAO,KAAK,6CAA6C;CAC7D;AACJ"}

package/dist/generate-drizzle-schema-logic-BcMl7VSy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"generate-drizzle-schema-logic-BcMl7VSy.js","names":[],"sources":["../src/schema/plan/render-drizzle.ts","../src/schema/generate-drizzle-schema-logic.ts"],"sourcesContent":["/**\n * `schema.generated.ts`, rendered from a {@link SchemaPlan}.\n *\n * This file is what a developer running drizzle-kit themselves diffs against,\n * and what the runtime's query builder is typed by. It has to *compile*, which\n * nothing in this repo checked until `generated-schema-compiles.test.ts`: six\n * ordinary inputs used to produce a file TypeScript rejects, and the class the\n * bigint incident already taught is that a file which will not build gets\n * hand-patched and then sits stale until a security fix misses production.\n *\n * Two structural rules keep that from coming back:\n *\n * - **The import list is derived from what was emitted.** Every builder is\n *   recorded as it is used ({@link BuilderUses}), and the header is written\n *   last, from that set. It used to be a fixed roster plus three\n *   property-scanning heuristics, so `columnType: \"uuid\"` on a plain string\n *   emitted `uuid(…)` and imported nothing.\n * - **Nothing here reads a `Property`.** Types, defaults, keys and constraints\n *   all arrive decided. The Drizzle generator disagreeing with the DDL one is\n *   what left `geopoint` with a database column and no Drizzle key.\n */\nimport type { ColumnPlan, ForeignKeyPlan, PgType, PolicyPlan, RelationPlan, SchemaPlan, TablePlan } from \"./types\";\nimport { renderPredicate } from \"../collection-index\";\n\n/** What the generated file may leave out. */\nexport interface DrizzleRenderOptions {\n    /**\n     * `false` strips the `pgPolicy(...)` calls. RLS is still enabled on every\n     * table regardless — a bare table must default-deny, not fail open.\n     */\n    policies?: boolean;\n}\n\nconst JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\n\n/**\n * A string literal for the generated file.\n *\n * Column names, table names and enum values are all written in as literals and\n * none of them is constrained to be quote-free: a Postgres identifier only has\n * to be quoted, and `O'Brien` is an ordinary enum value. Interpolating them raw\n * ended the literal early.\n */\nconst quote = (value: string): string => JSON.stringify(value);\n\n/** An object key: verbatim when it is an identifier, quoted otherwise. */\nconst propKey = (name: string): string => (JS_IDENTIFIER.test(name) ? name : quote(name));\n\n/**\n * A property access on a generated table variable.\n *\n * `users.full name` is not an expression; `users[\"full name\"]` is, and Drizzle\n * treats the two identically.\n */\nconst member = (object: string, key: string): string =>\n    (JS_IDENTIFIER.test(key) ? `${object}.${key}` : `${object}[${quote(key)}]`);\n\n/**\n * The drizzle-orm builders this file emitted, collected as they are written.\n * The only way to use a builder is to record it here.\n */\ntype BuilderUses = Set<string>;\n\n/** Record a builder and hand back its name, so a call site cannot use one silently. */\nconst needs = (uses: BuilderUses, builder: string): string => {\n    uses.add(builder);\n    return builder;\n};\n\n/**\n * Wraps a compiled SQL clause in a Drizzle `sql\\`...\\`` template literal.\n *\n * The clause is SQL being written into a TypeScript file, so it has to survive\n * being read back as a template literal. Three characters do not:\n *\n * - `` ` `` closes the template early, and the rest of the clause becomes code.\n * - `${` opens an interpolation — the file stops compiling, or worse, compiles\n *   against whatever identifier happens to be in scope.\n * - `\\` is an escape, and Drizzle's `sql` tag reads the *cooked* strings, not\n *   `.raw`. So a policy written as `email ~ '^admin\\.user@corp\\.com$'` reached\n *   the database as `^admin.user@corp.com$`, where every `\\.` now matches any\n *   character. A `USING` clause is a security boundary and that one silently\n *   widened it.\n */\nconst wrapSql = (clause: string): string =>\n    `sql\\`${clause.replace(/\\\\/g, \"\\\\\\\\\").replace(/`/g, \"\\\\`\").replace(/\\$\\{/g, \"\\\\${\")}\\``;\n\n/** The pg-core builder call for a tagged type, minus the column name. */\nconst builderFor = (type: PgType, column: string, uses: BuilderUses): string => {\n    const name = quote(column);\n    switch (type.kind) {\n        case \"text\": return `${needs(uses, \"text\")}(${name})`;\n        case \"varchar\": return `${needs(uses, \"varchar\")}(${name}, { length: ${type.length} })`;\n        case \"char\": return `${needs(uses, \"char\")}(${name}, { length: ${type.length} })`;\n        case \"uuid\": return `${needs(uses, \"uuid\")}(${name})`;\n        // The enum variable is declared at the top of the same file; it is not\n        // a pg-core import.\n        case \"enum\": return `${type.varName}(${name})`;\n        case \"smallint\": return `${needs(uses, \"smallint\")}(${name})`;\n        case \"integer\": return `${needs(uses, \"integer\")}(${name})`;\n        // `bigint` and `bigserial` are the only pg-core builders that *require*\n        // a config argument: without `mode`, drizzle cannot know whether to hand\n        // back a `number` or a `bigint`, and the emitted call does not\n        // typecheck. This is why `schema.generated.ts` drifted — regenerating it\n        // produced a file that would not compile, so the bigint lines were\n        // hand-patched, and every regeneration after that looked like a large,\n        // alarming diff nobody wanted to ship.\n        //\n        // `number` rather than `bigint`: these are counters and byte totals that\n        // every caller already treats as numbers.\n        case \"bigint\": return `${needs(uses, \"bigint\")}(${name}, { mode: \"number\" })`;\n        case \"bigserial\": return `${needs(uses, \"bigserial\")}(${name}, { mode: \"number\" })`;\n        case \"smallserial\": return `${needs(uses, \"smallserial\")}(${name})`;\n        case \"serial\": return `${needs(uses, \"serial\")}(${name})`;\n        case \"real\": return `${needs(uses, \"real\")}(${name})`;\n        case \"doublePrecision\": return `${needs(uses, \"doublePrecision\")}(${name})`;\n        case \"numeric\":\n            if (type.precision === undefined) return `${needs(uses, \"numeric\")}(${name})`;\n            return type.scale === undefined\n                ? `${needs(uses, \"numeric\")}(${name}, { precision: ${type.precision} })`\n                : `${needs(uses, \"numeric\")}(${name}, { precision: ${type.precision}, scale: ${type.scale} })`;\n        case \"boolean\": return `${needs(uses, \"boolean\")}(${name})`;\n        case \"timestamptz\": return `${needs(uses, \"timestamp\")}(${name}, { withTimezone: true, mode: 'string' })`;\n        case \"date\": return `${needs(uses, \"date\")}(${name}, { mode: 'string' })`;\n        case \"time\": return `${needs(uses, \"time\")}(${name})`;\n        case \"json\": return `${needs(uses, \"json\")}(${name})`;\n        case \"jsonb\": return `${needs(uses, \"jsonb\")}(${name})`;\n        case \"vector\": return `${needs(uses, \"vector\")}(${name}, { dimensions: ${type.dimensions} })`;\n        case \"bytea\": return `${needs(uses, \"customType\")}({ dataType() { return 'bytea'; } })(${name})`;\n        case \"tsvector\": return `${needs(uses, \"customType\")}({ dataType() { return 'tsvector'; } })(${name})`;\n        // pg-core has no array *type*; `.array()` is a modifier on the element.\n        case \"array\": return `${builderFor(type.of, column, uses)}.array()`;\n    }\n};\n\n/**\n * The `.references(...)` clause a foreign key column carries.\n *\n * The `(): AnyPgColumn =>` annotation is not optional decoration and it is\n * emitted on every reference rather than only the self-referential ones. A\n * `belongsTo` pointing at its own table — a comment thread, a category tree —\n * produces `.references(() => posts.id)` inside the initializer of `posts`, and\n * TypeScript cannot infer a type for a `const` that appears in its own\n * initializer (TS7022). Drizzle documents the annotation as the fix; applying\n * it everywhere means the generated line does not depend on whether the author\n * happened to point the relation at another table.\n */\nconst referencesClause = (\n    fk: ForeignKeyPlan,\n    targetVar: string,\n    targetKey: string,\n    uses: BuilderUses\n): string => {\n    needs(uses, \"type AnyPgColumn\");\n    const parts = [\n        fk.onUpdate ? `onUpdate: \"${fk.onUpdate.toLowerCase()}\"` : \"\",\n        `onDelete: \"${fk.onDelete.toLowerCase()}\"`\n    ].filter(Boolean);\n    return `.references((): AnyPgColumn => ${member(targetVar, targetKey)}, { ${parts.join(\", \")} })`;\n};\n\n/** The declaration a column compiles to, without its object key. */\nconst renderColumn = (column: ColumnPlan, table: TablePlan, plan: SchemaPlan, uses: BuilderUses): string => {\n    let out = builderFor(column.type, column.column, uses);\n\n    if (column.generated) {\n        return `${out}.generatedAlwaysAs(${wrapSql(column.generated.expression)})`;\n    }\n\n    // A junction endpoint spells `.notNull()` before its reference; every other\n    // column spells it last. Both are the same constraint — this keeps the\n    // generated file byte-stable across the move to one planner.\n    const junctionKey = column.source.kind === \"junction-key\";\n    if (junctionKey) out += \".notNull()\";\n\n    if (column.default?.kind === \"identity\") out += \".generatedByDefaultAsIdentity()\";\n    if (column.primaryKey) out += \".primaryKey()\";\n    if (column.default && column.default.kind !== \"identity\") {\n        const expression = column.default.kind === \"sql\" ? column.default.expression : column.default.sql;\n        // `.defaultRandom()` is drizzle's own spelling of `gen_random_uuid()`,\n        // and it exists **only on the uuid builder** — a `text` id whose\n        // strategy happens to be spelled ``isId: \"sql`gen_random_uuid()`\"`` has\n        // to take the generic form, which is what the file has always emitted\n        // for it.\n        out += column.type.kind === \"uuid\" && expression === \"gen_random_uuid()\"\n            ? \".defaultRandom()\"\n            : `.default(${wrapSql(expression)})`;\n    }\n    // A plain property that carries a relation's foreign key column gets the\n    // constraint the relation would have emitted. `postId: { columnName:\n    // \"post_id\" }` beside a `belongsTo` on `post_id` used to emit an integer\n    // with no `.references()` at all, so that project got no foreign key on the\n    // Drizzle side while `db push` created one.\n    const foreignKey = column.foreignKey\n        ?? table.columns.find(c => c.columnOwnedByProperty && c.column === column.column)?.foreignKey;\n    if (foreignKey) {\n        const target = plan.tables.find(t =>\n            t.schema === foreignKey.targetSchema && t.table === foreignKey.targetTable);\n        if (target) {\n            const targetColumn = target.columns.find(c => c.column === foreignKey.targetColumn);\n            out += referencesClause(foreignKey, target.varName, targetColumn?.key ?? foreignKey.targetColumn, uses);\n        }\n    }\n    if (column.unique) out += \".unique()\";\n    if (!column.nullable && !column.primaryKey && !junctionKey) out += \".notNull()\";\n    return out;\n};\n\n/** The declared `indexes:` block, as Drizzle table extras. */\nconst indexExtras = (table: TablePlan, uses: BuilderUses): string[] =>\n    table.indexes.map(spec => {\n        const builder = spec.unique ? needs(uses, \"uniqueIndex\") : needs(uses, \"index\");\n        // The spec holds COLUMN names; the generated table is keyed by field\n        // name (`authorId` for `author_id`).\n        const column = (name: string): string =>\n            member(\"table\", table.columns.find(c => c.column === name)?.key ?? name);\n        const keys = spec.keys.map(key => {\n            if (spec.method !== \"btree\") return column(key.column);\n            const direction = key.direction === \"desc\" ? \".desc()\" : \".asc()\";\n            const nulls = key.nulls === \"first\" ? \".nullsFirst()\" : \".nullsLast()\";\n            return `${column(key.column)}${direction}${nulls}`;\n        });\n        const on = spec.method === \"btree\"\n            ? `.on(${keys.join(\", \")})`\n            : `.using(${quote(spec.method)}, ${keys.join(\", \")})`;\n        const where = spec.predicate ? `.where(sql\\`${renderPredicate(spec.predicate)}\\`)` : \"\";\n        // drizzle-orm has no INCLUDE in its index builder (0.45), so a covering\n        // index is emitted here as its key columns alone. The database still\n        // gets the INCLUDE — `schema.sql` and boot-ensure both emit it.\n        const covering = spec.include.length > 0\n            ? ` // INCLUDE (${spec.include.join(\", \")}) — drizzle cannot express it; schema.sql does`\n            : \"\";\n        return `    ${builder}(${quote(spec.indexName)})${on}${where},${covering}`;\n    });\n\nconst policyExtra = (policy: PolicyPlan, uses: BuilderUses): string => {\n    needs(uses, \"pgPolicy\");\n    const parts = [\n        `as: \"${policy.mode}\"`,\n        `for: \"${policy.operation}\"`,\n        `to: [${policy.roles.map(r => `\"${r}\"`).join(\", \")}]`\n    ];\n    if (policy.using) parts.push(`using: ${wrapSql(policy.using)}`);\n    if (policy.withCheck) parts.push(`withCheck: ${wrapSql(policy.withCheck)}`);\n    return `    pgPolicy(${quote(policy.name)}, { ${parts.join(\", \")} }),`;\n};\n\nexport function renderDrizzleSchema(plan: SchemaPlan, options: DrizzleRenderOptions = {}): string {\n    const withPolicies = options.policies !== false;\n    const uses: BuilderUses = new Set();\n    // The body is assembled first and the header composed around it, because\n    // the header cannot be written until the body has said what it needs.\n    let body = \"\";\n\n    let schemaDeclarations = \"\";\n    if (plan.declaredSchemas.length > 0) {\n        needs(uses, \"pgSchema\");\n        plan.declaredSchemas.forEach(schema => {\n            schemaDeclarations += `export const ${schema}Schema = pgSchema(\"${schema}\");\\n`;\n        });\n        schemaDeclarations += \"\\n\";\n    }\n\n    const enumVars: string[] = [];\n    for (const enumPlan of plan.enums) {\n        // A collection with `schema: \"app\"` gets `CREATE TYPE \"app\".\"…\"` from\n        // the DDL renderer, so the type has to be declared in the same schema\n        // here — `pgEnum` is `public` and nothing else. Unqualified, the runtime\n        // and drizzle-kit looked for a type that does not exist in `public`.\n        const labels = enumPlan.labels.map(quote).join(\", \");\n        const declaration = enumPlan.declaredSchema\n            ? `${enumPlan.declaredSchema}Schema.enum(${quote(enumPlan.name)}, [${labels}])`\n            : `${needs(uses, \"pgEnum\")}(${quote(enumPlan.name)}, [${labels}])`;\n        body += `export const ${enumPlan.varName} = ${declaration};\\n`;\n        if (!enumVars.includes(enumPlan.varName)) enumVars.push(enumPlan.varName);\n    }\n    body += \"\\n\";\n\n    const tableVars: string[] = [];\n    for (const table of plan.tables) {\n        const creator = table.declaredSchema\n            ? `${table.declaredSchema}Schema.table`\n            : needs(uses, \"pgTable\");\n        body += `export const ${table.varName} = ${creator}(\"${table.table}\", {\\n`;\n\n        // The implicit `id` goes last here and first in the SQL file: the DDL\n        // generator unshifts it so the key leads the `CREATE TABLE`, and this\n        // one appends it after the generated search columns. Both describe the\n        // same table; only the reading order differs.\n        const ordered = [\n            ...table.columns.filter(c => c.source.kind !== \"implicit-id\"),\n            ...table.columns.filter(c => c.source.kind === \"implicit-id\")\n        ].filter(c =>\n            !c.columnOwnedByProperty\n            // The auth columns a users collection does not itself declare —\n            // `is_anonymous`, `tokens_valid_after`. `db push` emits them because\n            // Atlas diffs the database against exactly what it is shown and\n            // would otherwise plan a DROP; drizzle-kit creates no auth table, so\n            // this file describes the collection as written and leaves auth's\n            // own contract to the SQL side that owns it.\n            && c.source.kind !== \"auth\");\n\n        const lines = ordered.map(column => `    ${propKey(column.key)}: ${renderColumn(column, table, plan, uses)}`);\n        // A junction's column list carries a trailing comma; a collection's does\n        // not. Kept as the two files have always spelled them.\n        body += table.kind === \"junction\"\n            ? `${lines.join(\",\\n\")},\\n`\n            : `${lines.join(\",\\n\")}\\n`;\n\n        const extras: string[] = [];\n        if (table.kind === \"junction\") {\n            extras.push(`    ${needs(uses, \"primaryKey\")}({ columns: [${table.primaryKey.map(c => member(\"table\", c)).join(\", \")}] }),`);\n        } else {\n            extras.push(...indexExtras(table, uses));\n        }\n        if (withPolicies) {\n            extras.push(...table.policies.map(policy => policyExtra(policy, uses)));\n        }\n\n        if (extras.length > 0) {\n            body += \"}, (table) => ([\\n\";\n            body += `${extras.join(\"\\n\")}\\n`;\n            body += \"])).enableRLS();\\n\\n\";\n        } else {\n            // No explicit policies and no declared indexes — RLS enabled with a\n            // deny-all default (Postgres denies everything when RLS is on and no\n            // permissive policies exist).\n            body += \"}).enableRLS();\\n\\n\";\n        }\n        if (!tableVars.includes(table.varName)) tableVars.push(table.varName);\n    }\n\n    const relationVars: string[] = [];\n    for (const table of plan.tables) {\n        const entries = plan.relations.filter(r => r.tableVar === table.varName);\n        if (entries.length === 0) continue;\n        const rendered = entries.map(relation => renderRelation(table, relation));\n        const varName = `${table.varName}Relations`;\n        body += `export const ${varName} = drizzleRelations(${table.varName}, ({ one, many }) => ({\\n${rendered.join(\",\\n\")}\\n}));\\n\\n`;\n        if (!relationVars.includes(varName)) relationVars.push(varName);\n    }\n\n    // ── The header, written last because the body decides what is in it ──────\n    const imports = Array.from(uses).sort((a, b) =>\n        a.replace(/^type /, \"\").localeCompare(b.replace(/^type /, \"\")));\n\n    let out = \"// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\\n\\n\";\n    out += `import { ${imports.join(\", \")} } from 'drizzle-orm/pg-core';\\n`;\n    out += \"import { relations as drizzleRelations, sql } from 'drizzle-orm';\\n\\n\";\n    out += schemaDeclarations;\n    out += body;\n    out += `export const tables = { ${tableVars.join(\", \")} };\\n`;\n    out += `export const enums = { ${enumVars.join(\", \")} };\\n`;\n    out += `export const relations = { ${relationVars.join(\", \")} };\\n\\n`;\n    return out;\n}\n\nconst renderRelation = (table: TablePlan, relation: RelationPlan): string => {\n    if (relation.kind === \"many\") {\n        return `    ${quote(relation.key)}: many(${relation.targetVar}, { relationName: ${quote(relation.relationName!)} })`;\n    }\n    // A `hasOne` inverse has no `fields`/`references` to give: the foreign key\n    // lives on the target. `one(target, { relationName })` is not a\n    // `RelationConfig` (TS2345) *and* not something the runtime survives —\n    // `createOne` reads `config.fields.reduce(...)` unconditionally — so a bare\n    // `one(target)` is the documented FK-less form.\n    if (!relation.fields) return `    ${quote(relation.key)}: one(${relation.targetVar})`;\n    return `    ${quote(relation.key)}: one(${relation.targetVar}, {\\n` +\n        `        fields: [${relation.fields.map(f => member(table.varName, f)).join(\", \")}],\\n` +\n        `        references: [${relation.references!.map(r => member(relation.targetVar, r)).join(\", \")}],\\n` +\n        `        relationName: ${quote(relation.relationName!)}\\n` +\n        \"    })\";\n};\n","/**\n * `schema.generated.ts`, the Drizzle half of `rebase db generate`.\n *\n * There is no interpretation left in this file. `schema/plan/plan-schema.ts`\n * reads the collections into a {@link SchemaPlan} and\n * `schema/plan/render-drizzle.ts` writes the TypeScript; this is the entry\n * point they are reached through.\n *\n * It used to hold `getDrizzleColumn` — one of three `switch (prop.type)`\n * statements, each with its own reading of relations, enums, search and\n * `validation.unique`, and each disagreeing with the other two about something.\n * See `schema/plan/types.ts`.\n */\nimport type { CollectionConfig } from \"@rebasepro/types\";\nimport { relationalCollections, sortCollectionsBySlug } from \"@rebasepro/common\";\nimport { planSchema } from \"./plan/plan-schema\";\nimport { renderDrizzleSchema, type DrizzleRenderOptions } from \"./plan/render-drizzle\";\n\n/**\n * The generated Drizzle schema for a set of collections.\n *\n * Synchronous, and takes an options object. It was `async` with nothing to\n * await and a positional `stripPolicies` boolean — `generateSchema(c, true)`,\n * which reads as neither \"with policies\" nor \"without\".\n *\n * Sorted by slug here rather than in the writer script: the output is\n * order-dependent and `rebase doctor` regenerates it in memory to compare\n * against the file on disk, so with the sort in the writer only, a project\n * whose file order differed from its slug order was reported stale forever.\n */\nexport const generateSchema = (\n    allCollections: CollectionConfig[],\n    options: DrizzleRenderOptions = {}\n): string => {\n    // A Firestore or MongoDB collection has no table to generate, and\n    // generating one for it is not merely wasted output: `db push` would create\n    // it, and `rebase doctor` would then report the store the collection\n    // actually reads from as drift.\n    const collections = sortCollectionsBySlug(relationalCollections(allCollections));\n    return renderDrizzleSchema(planSchema(collections), options);\n};\n"],"mappings":";;;;;;;AAiCA,IAAM,gBAAgB;;;;;;;;;AAUtB,IAAM,SAAS,UAA0B,KAAK,UAAU,KAAK;;AAG7D,IAAM,WAAW,SAA0B,cAAc,KAAK,IAAI,IAAI,OAAO,MAAM,IAAI;;;;;;;AAQvF,IAAM,UAAU,QAAgB,QAC3B,cAAc,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,EAAE;;AAS5E,IAAM,SAAS,MAAmB,YAA4B;CAC1D,KAAK,IAAI,OAAO;CAChB,OAAO;AACX;;;;;;;;;;;;;;;;AAiBA,IAAM,WAAW,WACb,QAAQ,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,QAAQ,MAAM,KAAK,CAAC,CAAC,QAAQ,SAAS,MAAM,EAAE;;AAGxF,IAAM,cAAc,MAAc,QAAgB,SAA8B;CAC5E,MAAM,OAAO,MAAM,MAAM;CACzB,QAAQ,KAAK,MAAb;EACI,KAAK,QAAQ,OAAO,GAAG,MAAM,MAAM,MAAM,EAAE,GAAG,KAAK;EACnD,KAAK,WAAW,OAAO,GAAG,MAAM,MAAM,SAAS,EAAE,GAAG,KAAK,cAAc,KAAK,OAAO;EACnF,KAAK,QAAQ,OAAO,GAAG,MAAM,MAAM,MAAM,EAAE,GAAG,KAAK,cAAc,KAAK,OAAO;EAC7E,KAAK,QAAQ,OAAO,GAAG,MAAM,MAAM,MAAM,EAAE,GAAG,KAAK;EAGnD,KAAK,QAAQ,OAAO,GAAG,KAAK,QAAQ,GAAG,KAAK;EAC5C,KAAK,YAAY,OAAO,GAAG,MAAM,MAAM,UAAU,EAAE,GAAG,KAAK;EAC3D,KAAK,WAAW,OAAO,GAAG,MAAM,MAAM,SAAS,EAAE,GAAG,KAAK;EAWzD,KAAK,UAAU,OAAO,GAAG,MAAM,MAAM,QAAQ,EAAE,GAAG,KAAK;EACvD,KAAK,aAAa,OAAO,GAAG,MAAM,MAAM,WAAW,EAAE,GAAG,KAAK;EAC7D,KAAK,eAAe,OAAO,GAAG,MAAM,MAAM,aAAa,EAAE,GAAG,KAAK;EACjE,KAAK,UAAU,OAAO,GAAG,MAAM,MAAM,QAAQ,EAAE,GAAG,KAAK;EACvD,KAAK,QAAQ,OAAO,GAAG,MAAM,MAAM,MAAM,EAAE,GAAG,KAAK;EACnD,KAAK,mBAAmB,OAAO,GAAG,MAAM,MAAM,iBAAiB,EAAE,GAAG,KAAK;EACzE,KAAK;GACD,IAAI,KAAK,cAAc,KAAA,GAAW,OAAO,GAAG,MAAM,MAAM,SAAS,EAAE,GAAG,KAAK;GAC3E,OAAO,KAAK,UAAU,KAAA,IAChB,GAAG,MAAM,MAAM,SAAS,EAAE,GAAG,KAAK,iBAAiB,KAAK,UAAU,OAClE,GAAG,MAAM,MAAM,SAAS,EAAE,GAAG,KAAK,iBAAiB,KAAK,UAAU,WAAW,KAAK,MAAM;EAClG,KAAK,WAAW,OAAO,GAAG,MAAM,MAAM,SAAS,EAAE,GAAG,KAAK;EACzD,KAAK,eAAe,OAAO,GAAG,MAAM,MAAM,WAAW,EAAE,GAAG,KAAK;EAC/D,KAAK,QAAQ,OAAO,GAAG,MAAM,MAAM,MAAM,EAAE,GAAG,KAAK;EACnD,KAAK,QAAQ,OAAO,GAAG,MAAM,MAAM,MAAM,EAAE,GAAG,KAAK;EACnD,KAAK,QAAQ,OAAO,GAAG,MAAM,MAAM,MAAM,EAAE,GAAG,KAAK;EACnD,KAAK,SAAS,OAAO,GAAG,MAAM,MAAM,OAAO,EAAE,GAAG,KAAK;EACrD,KAAK,UAAU,OAAO,GAAG,MAAM,MAAM,QAAQ,EAAE,GAAG,KAAK,kBAAkB,KAAK,WAAW;EACzF,KAAK,SAAS,OAAO,GAAG,MAAM,MAAM,YAAY,EAAE,uCAAuC,KAAK;EAC9F,KAAK,YAAY,OAAO,GAAG,MAAM,MAAM,YAAY,EAAE,0CAA0C,KAAK;EAEpG,KAAK,SAAS,OAAO,GAAG,WAAW,KAAK,IAAI,QAAQ,IAAI,EAAE;CAC9D;AACJ;;;;;;;;;;;;;AAcA,IAAM,oBACF,IACA,WACA,WACA,SACS;CACT,MAAM,MAAM,kBAAkB;CAC9B,MAAM,QAAQ,CACV,GAAG,WAAW,cAAc,GAAG,SAAS,YAAY,EAAE,KAAK,IAC3D,cAAc,GAAG,SAAS,YAAY,EAAE,EAC5C,CAAC,CAAC,OAAO,OAAO;CAChB,OAAO,kCAAkC,OAAO,WAAW,SAAS,EAAE,MAAM,MAAM,KAAK,IAAI,EAAE;AACjG;;AAGA,IAAM,gBAAgB,QAAoB,OAAkB,MAAkB,SAA8B;CACxG,IAAI,MAAM,WAAW,OAAO,MAAM,OAAO,QAAQ,IAAI;CAErD,IAAI,OAAO,WACP,OAAO,GAAG,IAAI,qBAAqB,QAAQ,OAAO,UAAU,UAAU,EAAE;CAM5E,MAAM,cAAc,OAAO,OAAO,SAAS;CAC3C,IAAI,aAAa,OAAO;CAExB,IAAI,OAAO,SAAS,SAAS,YAAY,OAAO;CAChD,IAAI,OAAO,YAAY,OAAO;CAC9B,IAAI,OAAO,WAAW,OAAO,QAAQ,SAAS,YAAY;EACtD,MAAM,aAAa,OAAO,QAAQ,SAAS,QAAQ,OAAO,QAAQ,aAAa,OAAO,QAAQ;EAM9F,OAAO,OAAO,KAAK,SAAS,UAAU,eAAe,sBAC/C,qBACA,YAAY,QAAQ,UAAU,EAAE;CAC1C;CAMA,MAAM,aAAa,OAAO,cACnB,MAAM,QAAQ,MAAK,MAAK,EAAE,yBAAyB,EAAE,WAAW,OAAO,MAAM,CAAC,EAAE;CACvF,IAAI,YAAY;EACZ,MAAM,SAAS,KAAK,OAAO,MAAK,MAC5B,EAAE,WAAW,WAAW,gBAAgB,EAAE,UAAU,WAAW,WAAW;EAC9E,IAAI,QAAQ;GACR,MAAM,eAAe,OAAO,QAAQ,MAAK,MAAK,EAAE,WAAW,WAAW,YAAY;GAClF,OAAO,iBAAiB,YAAY,OAAO,SAAS,cAAc,OAAO,WAAW,cAAc,IAAI;EAC1G;CACJ;CACA,IAAI,OAAO,QAAQ,OAAO;CAC1B,IAAI,CAAC,OAAO,YAAY,CAAC,OAAO,cAAc,CAAC,aAAa,OAAO;CACnE,OAAO;AACX;;AAGA,IAAM,eAAe,OAAkB,SACnC,MAAM,QAAQ,KAAI,SAAQ;CACtB,MAAM,UAAU,KAAK,SAAS,MAAM,MAAM,aAAa,IAAI,MAAM,MAAM,OAAO;CAG9E,MAAM,UAAU,SACZ,OAAO,SAAS,MAAM,QAAQ,MAAK,MAAK,EAAE,WAAW,IAAI,CAAC,EAAE,OAAO,IAAI;CAC3E,MAAM,OAAO,KAAK,KAAK,KAAI,QAAO;EAC9B,IAAI,KAAK,WAAW,SAAS,OAAO,OAAO,IAAI,MAAM;EACrD,MAAM,YAAY,IAAI,cAAc,SAAS,YAAY;EACzD,MAAM,QAAQ,IAAI,UAAU,UAAU,kBAAkB;EACxD,OAAO,GAAG,OAAO,IAAI,MAAM,IAAI,YAAY;CAC/C,CAAC;CACD,MAAM,KAAK,KAAK,WAAW,UACrB,OAAO,KAAK,KAAK,IAAI,EAAE,KACvB,UAAU,MAAM,KAAK,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,EAAE;CACvD,MAAM,QAAQ,KAAK,YAAY,eAAe,gBAAgB,KAAK,SAAS,EAAE,OAAO;CAIrF,MAAM,WAAW,KAAK,QAAQ,SAAS,IACjC,gBAAgB,KAAK,QAAQ,KAAK,IAAI,EAAE,kDACxC;CACN,OAAO,OAAO,QAAQ,GAAG,MAAM,KAAK,SAAS,EAAE,GAAG,KAAK,MAAM,GAAG;AACpE,CAAC;AAEL,IAAM,eAAe,QAAoB,SAA8B;CACnE,MAAM,MAAM,UAAU;CACtB,MAAM,QAAQ;EACV,QAAQ,OAAO,KAAK;EACpB,SAAS,OAAO,UAAU;EAC1B,QAAQ,OAAO,MAAM,KAAI,MAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;CACvD;CACA,IAAI,OAAO,OAAO,MAAM,KAAK,UAAU,QAAQ,OAAO,KAAK,GAAG;CAC9D,IAAI,OAAO,WAAW,MAAM,KAAK,cAAc,QAAQ,OAAO,SAAS,GAAG;CAC1E,OAAO,gBAAgB,MAAM,OAAO,IAAI,EAAE,MAAM,MAAM,KAAK,IAAI,EAAE;AACrE;AAEA,SAAgB,oBAAoB,MAAkB,UAAgC,CAAC,GAAW;CAC9F,MAAM,eAAe,QAAQ,aAAa;CAC1C,MAAM,uBAAoB,IAAI,IAAI;CAGlC,IAAI,OAAO;CAEX,IAAI,qBAAqB;CACzB,IAAI,KAAK,gBAAgB,SAAS,GAAG;EACjC,MAAM,MAAM,UAAU;EACtB,KAAK,gBAAgB,SAAQ,WAAU;GACnC,sBAAsB,gBAAgB,OAAO,qBAAqB,OAAO;EAC7E,CAAC;EACD,sBAAsB;CAC1B;CAEA,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,YAAY,KAAK,OAAO;EAK/B,MAAM,SAAS,SAAS,OAAO,IAAI,KAAK,CAAC,CAAC,KAAK,IAAI;EACnD,MAAM,cAAc,SAAS,iBACvB,GAAG,SAAS,eAAe,cAAc,MAAM,SAAS,IAAI,EAAE,KAAK,OAAO,MAC1E,GAAG,MAAM,MAAM,QAAQ,EAAE,GAAG,MAAM,SAAS,IAAI,EAAE,KAAK,OAAO;EACnE,QAAQ,gBAAgB,SAAS,QAAQ,KAAK,YAAY;EAC1D,IAAI,CAAC,SAAS,SAAS,SAAS,OAAO,GAAG,SAAS,KAAK,SAAS,OAAO;CAC5E;CACA,QAAQ;CAER,MAAM,YAAsB,CAAC;CAC7B,KAAK,MAAM,SAAS,KAAK,QAAQ;EAC7B,MAAM,UAAU,MAAM,iBAChB,GAAG,MAAM,eAAe,gBACxB,MAAM,MAAM,SAAS;EAC3B,QAAQ,gBAAgB,MAAM,QAAQ,KAAK,QAAQ,IAAI,MAAM,MAAM;EAmBnE,MAAM,QAbU,CACZ,GAAG,MAAM,QAAQ,QAAO,MAAK,EAAE,OAAO,SAAS,aAAa,GAC5D,GAAG,MAAM,QAAQ,QAAO,MAAK,EAAE,OAAO,SAAS,aAAa,CAChE,CAAC,CAAC,QAAO,MACL,CAAC,EAAE,yBAOA,EAAE,OAAO,SAAS,MAEX,CAAA,CAAQ,KAAI,WAAU,OAAO,QAAQ,OAAO,GAAG,EAAE,IAAI,aAAa,QAAQ,OAAO,MAAM,IAAI,GAAG;EAG5G,QAAQ,MAAM,SAAS,aACjB,GAAG,MAAM,KAAK,KAAK,EAAE,OACrB,GAAG,MAAM,KAAK,KAAK,EAAE;EAE3B,MAAM,SAAmB,CAAC;EAC1B,IAAI,MAAM,SAAS,YACf,OAAO,KAAK,OAAO,MAAM,MAAM,YAAY,EAAE,eAAe,MAAM,WAAW,KAAI,MAAK,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,MAAM;OAE3H,OAAO,KAAK,GAAG,YAAY,OAAO,IAAI,CAAC;EAE3C,IAAI,cACA,OAAO,KAAK,GAAG,MAAM,SAAS,KAAI,WAAU,YAAY,QAAQ,IAAI,CAAC,CAAC;EAG1E,IAAI,OAAO,SAAS,GAAG;GACnB,QAAQ;GACR,QAAQ,GAAG,OAAO,KAAK,IAAI,EAAE;GAC7B,QAAQ;EACZ,OAII,QAAQ;EAEZ,IAAI,CAAC,UAAU,SAAS,MAAM,OAAO,GAAG,UAAU,KAAK,MAAM,OAAO;CACxE;CAEA,MAAM,eAAyB,CAAC;CAChC,KAAK,MAAM,SAAS,KAAK,QAAQ;EAC7B,MAAM,UAAU,KAAK,UAAU,QAAO,MAAK,EAAE,aAAa,MAAM,OAAO;EACvE,IAAI,QAAQ,WAAW,GAAG;EAC1B,MAAM,WAAW,QAAQ,KAAI,aAAY,eAAe,OAAO,QAAQ,CAAC;EACxE,MAAM,UAAU,GAAG,MAAM,QAAQ;EACjC,QAAQ,gBAAgB,QAAQ,sBAAsB,MAAM,QAAQ,2BAA2B,SAAS,KAAK,KAAK,EAAE;EACpH,IAAI,CAAC,aAAa,SAAS,OAAO,GAAG,aAAa,KAAK,OAAO;CAClE;CAGA,MAAM,UAAU,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,MACtC,EAAE,QAAQ,UAAU,EAAE,CAAC,CAAC,cAAc,EAAE,QAAQ,UAAU,EAAE,CAAC,CAAC;CAElE,IAAI,MAAM;CACV,OAAO,YAAY,QAAQ,KAAK,IAAI,EAAE;CACtC,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO,2BAA2B,UAAU,KAAK,IAAI,EAAE;CACvD,OAAO,0BAA0B,SAAS,KAAK,IAAI,EAAE;CACrD,OAAO,8BAA8B,aAAa,KAAK,IAAI,EAAE;CAC7D,OAAO;AACX;AAEA,IAAM,kBAAkB,OAAkB,aAAmC;CACzE,IAAI,SAAS,SAAS,QAClB,OAAO,OAAO,MAAM,SAAS,GAAG,EAAE,SAAS,SAAS,UAAU,oBAAoB,MAAM,SAAS,YAAa,EAAE;CAOpH,IAAI,CAAC,SAAS,QAAQ,OAAO,OAAO,MAAM,SAAS,GAAG,EAAE,QAAQ,SAAS,UAAU;CACnF,OAAO,OAAO,MAAM,SAAS,GAAG,EAAE,QAAQ,SAAS,UAAU,wBACrC,SAAS,OAAO,KAAI,MAAK,OAAO,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,2BAC1D,SAAS,WAAY,KAAI,MAAK,OAAO,SAAS,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,4BACvE,MAAM,SAAS,YAAa,EAAE;AAE/D;;;;;;;;;;;;;;;;ACtVA,IAAa,kBACT,gBACA,UAAgC,CAAC,MACxB;CAMT,OAAO,oBAAoB,WADP,sBAAsB,sBAAsB,cAAc,CACxC,CAAW,GAAG,OAAO;AAC/D"}

package/dist/generate-postgres-ddl-logic-D7imhYV8.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"generate-postgres-ddl-logic-D7imhYV8.js","names":[],"sources":["../src/schema/plan/render-ddl.ts","../src/schema/generate-postgres-ddl-logic.ts"],"sourcesContent":["/**\n * The SQL files, rendered from a {@link SchemaPlan}.\n *\n * Four files, because Atlas owns exactly one of them:\n *\n * - `schema.sql` — the desired state Atlas diffs the database against.\n * - `policies.sql` — the RLS policies. Atlas has no model for a policy.\n * - `search.sql` — the generated `tsvector` column, its GIN index and the\n *   IMMUTABLE helpers its expression calls. Atlas's free tier refuses to\n *   *parse* a file containing a function, and it wipes the dev database it\n *   diffs against, so a helper seeded there is gone by the time the plan runs.\n * - `vector.sql` — the `vector` columns and their ANN indexes. Atlas cannot\n *   *execute* these: it materialises `schema.sql` in a dev database that is\n *   created empty and emptied again on every run, so `VECTOR(384)` resolves\n *   against a database that structurally cannot have pgvector.\n * - `triggers.sql` — `autoValue: \"on_update\"`, which is a function plus a\n *   binding, so it is out for the same reason search is.\n *\n * Everything not in `schema.sql` is excluded from Atlas's view by pattern\n * (`…ExcludePatterns` below) and applied by Rebase — at push time by the CLI,\n * at boot by the schema ensure. Without the excludes a desired state that omits\n * an object reads to Atlas as an instruction to drop it.\n */\nimport {\n    fuzzyColumnDefinition,\n    searchColumnDefinition,\n    searchColumnStamps,\n    searchExtensionStatements,\n    searchHelperFunctions,\n    searchIndexNames,\n    searchIndexStatements,\n    searchStampGuards\n} from \"../search-column\";\nimport {\n    VECTOR_EXTENSION_OPT_IN,\n    vectorColumnDefinition,\n    vectorDimensionGuard,\n    vectorExtensionDeclared,\n    vectorExtensionStatement,\n    vectorIndexNames,\n    vectorIndexStatements\n} from \"../vector-index\";\nimport { collectionIndexStatements } from \"../collection-index\";\nimport { quoteSqlLiteral } from \"./plan-schema\";\nimport { triggerStatements } from \"./updated-at-trigger\";\nimport type { ColumnPlan, PgType, PolicyPlan, SchemaPlan, TablePlan } from \"./types\";\n\n/** What `schema.sql` may leave out, because another file owns it. */\nexport interface DdlRenderOptions {\n    /** RLS policies. `false` puts them in `policies.sql` alone. */\n    includePolicies?: boolean;\n    /** The search column, its helpers and its index. See `search.sql`. */\n    includeSearch?: boolean;\n    /** The vector columns and their ANN indexes. See `vector.sql`. */\n    includeVector?: boolean;\n}\n\n/**\n * A {@link PgType} as Postgres spells it.\n *\n * The one place. `getSqlColumnType` and `getDrizzleColumn` each carried their\n * own ladder and disagreed about `VARCHAR` widths, about `geopoint`, and about\n * whether an `increment` id honours `columnType`.\n */\nexport const renderPgType = (type: PgType): string => {\n    switch (type.kind) {\n        case \"text\": return \"TEXT\";\n        case \"varchar\": return `VARCHAR(${type.length})`;\n        case \"char\": return `CHAR(${type.length})`;\n        case \"uuid\": return \"UUID\";\n        case \"enum\": return `\"${type.schema}\".\"${type.name}\"`;\n        case \"smallint\": return \"SMALLINT\";\n        case \"integer\": return \"INTEGER\";\n        case \"bigint\": return \"BIGINT\";\n        case \"smallserial\": return \"SMALLSERIAL\";\n        case \"serial\": return \"SERIAL\";\n        case \"bigserial\": return \"BIGSERIAL\";\n        case \"real\": return \"REAL\";\n        case \"doublePrecision\": return \"DOUBLE PRECISION\";\n        case \"numeric\":\n            if (type.precision === undefined) return \"NUMERIC\";\n            return type.scale === undefined\n                ? `NUMERIC(${type.precision})`\n                : `NUMERIC(${type.precision}, ${type.scale})`;\n        case \"boolean\": return \"BOOLEAN\";\n        case \"timestamptz\": return \"TIMESTAMP WITH TIME ZONE\";\n        case \"date\": return \"DATE\";\n        case \"time\": return \"TIME\";\n        case \"json\": return \"JSON\";\n        case \"jsonb\": return \"JSONB\";\n        case \"vector\": return `VECTOR(${type.dimensions})`;\n        case \"bytea\": return \"BYTEA\";\n        case \"tsvector\": return \"tsvector\";\n        case \"array\": return `${renderPgType(type.of)}[]`;\n    }\n};\n\n/**\n * Everything after the column name, in one order for every SQL emitter.\n *\n * `CREATE TABLE` and `ADD COLUMN` used to assemble this separately, which is\n * how a required relation column came out `NOT NULL` after `db push` and\n * nullable after a boot-ensure. `identity` is part of the type rather than a\n * DEFAULT, which is why it is rendered here and not in the DEFAULT slot.\n */\nexport const renderColumnDefinition = (column: ColumnPlan): string => {\n    // `auth-users-columns` is the single description of what an auth user\n    // table's columns must be, and it hands over a rendered definition.\n    if (column.sqlDefinition) return column.sqlDefinition;\n\n    if (column.generated) {\n        return `${renderPgType(column.type)} GENERATED ALWAYS AS (${column.generated.expression}) STORED`;\n    }\n\n    let definition = renderPgType(column.type);\n    if (column.default?.kind === \"identity\") definition += \" GENERATED BY DEFAULT AS IDENTITY\";\n    if (column.primaryKey) definition += \" PRIMARY KEY\";\n    if (column.unique) definition += \" UNIQUE\";\n    if (column.default && column.default.kind !== \"identity\") {\n        definition += ` DEFAULT ${column.default.kind === \"sql\" ? column.default.expression : column.default.sql}`;\n    }\n    if (!column.nullable && !column.primaryKey) definition += \" NOT NULL\";\n    return definition;\n};\n\n/** `\"col\" TYPE …`, as it appears inside a `CREATE TABLE`. */\nconst renderColumn = (column: ColumnPlan): string =>\n    `\"${column.column}\" ${renderColumnDefinition(column)}`;\n\n// ── Policies ─────────────────────────────────────────────────────────────────\n\n/**\n * One policy as its `DROP` / `CREATE` pair — each a complete statement.\n *\n * This is the primitive the boot-time RLS applier runs one statement at a time\n * (the runtime's DB handle speaks the extended query protocol, which forbids\n * multiple commands in one execute), while `db push` writes the joined string.\n */\nexport const renderPolicyStatements = (\n    table: Pick<TablePlan, \"schema\" | \"table\">,\n    policy: PolicyPlan\n): string[] => {\n    const target = `\"${table.schema}\".\"${table.table}\"`;\n    let create = `CREATE POLICY \"${policy.name}\" ON ${target} AS ${policy.mode.toUpperCase()} ` +\n        `FOR ${policy.operation.toUpperCase()} TO ${policy.roles.map(r => `\"${r}\"`).join(\", \")}`;\n    if (policy.using) create += ` USING (${policy.using})`;\n    if (policy.withCheck) create += ` WITH CHECK (${policy.withCheck})`;\n    return [`DROP POLICY IF EXISTS \"${policy.name}\" ON ${target};`, `${create};`];\n};\n\n/** `ALTER TABLE … ENABLE ROW LEVEL SECURITY;` — every generated table is locked. */\nexport const renderEnableRls = (table: Pick<TablePlan, \"schema\" | \"table\">): string =>\n    `ALTER TABLE \"${table.schema}\".\"${table.table}\" ENABLE ROW LEVEL SECURITY;`;\n\nconst statementsToDdl = (statements: string[]): string => statements.map(s => `${s}\\n`).join(\"\");\n\n// ── schema.sql ───────────────────────────────────────────────────────────────\n\nexport function renderPostgresDdl(plan: SchemaPlan, options: DdlRenderOptions = {}): string {\n    const includePolicies = options.includePolicies !== false;\n    const includeSearch = options.includeSearch !== false;\n    const includeVector = options.includeVector !== false;\n\n    let ddl = \"-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\\n\\n\";\n\n    // 1. Custom schemas.\n    //\n    // `rebase` is unconditional and load-bearing. The RLS helper functions live\n    // in it, so the migration preamble creates it — which puts it in Atlas's\n    // replayed state, and anything in that state but absent from this desired\n    // schema gets a `DROP SCHEMA … CASCADE` planned against it. That would take\n    // the auth tables.\n    plan.schemas.forEach(schema => { ddl += `CREATE SCHEMA IF NOT EXISTS \"${schema}\";\\n`; });\n    if (plan.schemas.length > 0) ddl += \"\\n\";\n\n    // 1b. Search support, for collections that opted in.\n    //\n    // Extensions and helper functions come before every CREATE TABLE because a\n    // generated column's expression is resolved at creation time: a table whose\n    // search column calls `rebase_search_text` cannot be created before that\n    // function exists. Both are `IF NOT EXISTS` / `OR REPLACE`, so a file\n    // replayed against a live database is a no-op here.\n    const searchTables = plan.tables.filter(t => t.search);\n    if (searchTables.length > 0) {\n        if (!includeSearch) {\n            ddl += \"-- Full-text search support lives in `search.sql`, applied separately.\\n\\n\";\n        } else {\n            const extensions = Array.from(new Set(searchTables.flatMap(t => searchExtensionStatements(t.search!))));\n            const helpers = Array.from(new Set(searchTables.flatMap(t => searchHelperFunctions(t.search!))));\n            ddl += \"-- Full-text search support (collections declaring a `search` block)\\n\";\n            extensions.forEach(s => { ddl += `${s}\\n`; });\n            if (extensions.length > 0) ddl += \"\\n\";\n            helpers.forEach(s => { ddl += `${s}\\n\\n`; });\n        }\n    }\n\n    // 1c. Vector support. Only ever a note, never a statement — unlike 1b.\n    // `CREATE EXTENSION vector` is the one thing this file must never carry\n    // whichever way the flag goes: Atlas rejects an extension in a desired\n    // state as a paid feature.\n    if (!includeVector && plan.tables.some(t => t.vectorColumns.length > 0)) {\n        ddl += \"-- Vector columns and their ANN indexes live in `vector.sql`, applied separately.\\n\\n\";\n    }\n\n    // 1d. `autoValue: \"on_update\"`. A trigger is a function plus a binding, so\n    // it is out of Atlas's sight for the reason search is — and out\n    // unconditionally, because `schema.sql` has no flag that would make Atlas\n    // able to read one.\n    if (plan.tables.some(t => t.triggers.length > 0)) {\n        ddl += \"-- `autoValue: \\\"on_update\\\"` triggers live in `triggers.sql`, applied separately.\\n\\n\";\n    }\n\n    // 2. Enum types.\n    plan.enums.forEach(enumPlan => {\n        ddl += `CREATE TYPE \"${enumPlan.schema}\".\"${enumPlan.name}\" AS ENUM (${enumPlan.labels.map(quoteSqlLiteral).join(\", \")});\\n`;\n    });\n    if (ddl.endsWith(\";\\n\")) ddl += \"\\n\";\n\n    // 3. Tables, in the plan's order — each collection, then any junction its\n    //    relations imply.\n    const fkStatements: string[] = [];\n    // Indexes follow the tables for the same reason the FK constraints do: the\n    // table has to exist first.\n    const indexStatements: string[] = [];\n    // Policies are emitted after every CREATE TABLE, like the FK constraints: a\n    // policy may reference other tables (a junction's derived policies always\n    // reference both endpoints; `policy.existsIn` references a join table), and\n    // CREATE POLICY validates those relations at creation time.\n    const policyStatements: string[] = [];\n\n    for (const table of plan.tables) {\n        const emitted = table.columns.filter(column => {\n            // A vector column is not Atlas's — `vector.sql` adds it. Filtered\n            // here rather than upstream so the column keeps its place in the\n            // generator's order when it *is* included, which is what the\n            // derived-names contract renders.\n            if (!includeVector && column.type.kind === \"vector\") return false;\n            if (!includeSearch && column.source.kind === \"search\") return false;\n            // A declared property already emits this column (an explicit\n            // `postId` beside the `belongsTo` that uses it); the relation\n            // contributes only the constraint.\n            if (column.columnOwnedByProperty) return false;\n            return true;\n        });\n\n        ddl += `CREATE TABLE \"${table.schema}\".\"${table.table}\" (\\n`;\n        const lines = emitted.map(column => `  ${renderColumn(column)}`);\n        if (table.kind === \"junction\") {\n            lines.push(`  PRIMARY KEY (${table.primaryKey.map(c => `\"${c}\"`).join(\", \")})`);\n        }\n        ddl += lines.join(\",\\n\");\n        ddl += \"\\n);\\n\\n\";\n\n        for (const column of table.columns) {\n            if (column.foreignKey) fkStatements.push(`${column.foreignKey.sql};`);\n        }\n\n        if (includeSearch && table.search) {\n            indexStatements.push(...searchIndexStatements(table.search));\n        }\n        // ANN indexes are emitted with the other indexes rather than inline,\n        // because `CREATE INDEX` is a statement and a column definition is not\n        // — and because a column too wide for pgvector to index still needs its\n        // column. Absent alongside their column when vector is carved out.\n        if (includeVector && table.vector) {\n            indexStatements.push(...vectorIndexStatements(table.vector));\n            for (const skip of table.vector.skipped) {\n                indexStatements.push(`-- No ANN index on \"${skip.schema}\".\"${skip.table}\".\"${skip.column}\": ${skip.reason}`);\n            }\n        }\n        // The collection's own `indexes:` block. Last of the three index\n        // producers, and the only one the developer wrote deliberately rather\n        // than getting as a side effect of another feature.\n        indexStatements.push(...collectionIndexStatements(table.indexes));\n\n        if (includePolicies) {\n            // No FORCE: authenticated requests run as the non-owner\n            // `rebase_user` role, which plain ENABLE already binds. The owner\n            // (server context) must bypass — it is the trusted plane.\n            ddl += `${renderEnableRls(table)}\\n`;\n            ddl += \"\\n\";\n            for (const policy of table.policies) {\n                policyStatements.push(statementsToDdl(renderPolicyStatements(table, policy)));\n            }\n        }\n    }\n\n    // Indexes before foreign keys. Today every FK targets a primary key created\n    // inline, so the order is safe by accident; the moment a declared\n    // `unique: true` index can back an FK target, a constraint emitted first\n    // would reference an index that does not exist yet.\n    if (indexStatements.length > 0) {\n        ddl += \"-- Indexes\\n\";\n        ddl += indexStatements.join(\"\\n\") + \"\\n\\n\";\n    }\n\n    if (fkStatements.length > 0) {\n        ddl += \"-- Foreign Key Constraints\\n\";\n        ddl += fkStatements.join(\"\\n\") + \"\\n\\n\";\n    }\n\n    if (policyStatements.length > 0) {\n        ddl += \"-- Row Level Security Policies\\n\";\n        ddl += policyStatements.join(\"\");\n        ddl += \"\\n\";\n    }\n\n    return ddl;\n}\n\n// ── policies.sql ─────────────────────────────────────────────────────────────\n\nexport function renderPoliciesDdl(plan: SchemaPlan): string {\n    let ddl = \"-- This file contains RLS policies generated by Rebase. Applied separately from migrations.\\n\\n\";\n\n    // Collections first, then the junctions no collection declares — the order\n    // the boot-time applier plans them in.\n    for (const table of plan.tables.filter(t => t.kind === \"collection\")) {\n        ddl += `${renderEnableRls(table)}\\n`;\n        ddl += \"\\n\";\n        if (table.policies.length === 0) continue;\n        let announced: string | undefined;\n        for (const policy of table.policies) {\n            // Say which policies the author did not write. They are permissive,\n            // so they OR with the declared rules and widen the final ACL beyond\n            // what `securityRules` reads like — and re-appear after any manual\n            // DROP, because a push asserts the declared state. Once per *rule*:\n            // one rule with four operations is one thing the author did not\n            // write, not four.\n            if (policy.injected && policy.ruleKey !== announced) {\n                ddl += \"-- Injected by Rebase (not from this collection's securityRules).\\n\";\n                ddl += `-- Set \\`disableDefaultPolicies: true\\` on \"${table.slug}\" to drop these and own its RLS outright.\\n`;\n            }\n            announced = policy.ruleKey;\n            ddl += statementsToDdl(renderPolicyStatements(table, policy));\n        }\n        ddl += \"\\n\";\n    }\n\n    for (const table of plan.tables.filter(t => t.kind === \"junction\")) {\n        ddl += `${renderEnableRls(table)}\\n`;\n        ddl += \"\\n\";\n        if (table.policies.length === 0) continue;\n        const declaringSlugs = (table.declaringSlugs ?? []).join('\", \"');\n        ddl += `-- Derived by Rebase for the junction \"${table.table}\" (no collection declares it).\\n`;\n        ddl += \"-- Reads require both endpoint rows to be visible; writes follow the update\\n\";\n        ddl += `-- rules of \"${declaringSlugs}\". Set \\`disableDefaultPolicies: true\\` on the\\n`;\n        ddl += \"-- declaring collection(s) to drop these and police the junction yourself.\\n\";\n        for (const policy of table.policies) {\n            ddl += statementsToDdl(renderPolicyStatements(table, policy));\n        }\n        ddl += \"\\n\";\n    }\n\n    return ddl;\n}\n\n// ── search.sql ───────────────────────────────────────────────────────────────\n\nexport function renderSearchDdl(plan: SchemaPlan): string {\n    const tables = plan.tables.filter(t => t.search);\n    if (tables.length === 0) return \"\";\n\n    const extensions = Array.from(new Set(tables.flatMap(t => searchExtensionStatements(t.search!))));\n    const helpers = Array.from(new Set(tables.flatMap(t => searchHelperFunctions(t.search!))));\n\n    let ddl = \"-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\\n\";\n    ddl += \"--\\n\";\n    ddl += \"-- Full-text search for the collections declaring a `search` block.\\n\";\n    ddl += \"-- Applied by Rebase, not by Atlas — see generatePostgresSearchDdl.\\n\\n\";\n\n    extensions.forEach(s => { ddl += `${s}\\n`; });\n    if (extensions.length > 0) ddl += \"\\n\";\n    helpers.forEach(s => { ddl += `${s}\\n\\n`; });\n\n    for (const table of tables) {\n        const spec = table.search!;\n        const target = `\"${table.schema}\".\"${table.table}\"`;\n        // ADD COLUMN IF NOT EXISTS rather than the inline definition the\n        // CREATE TABLE would use: by the time this runs the table exists,\n        // whether Atlas just created it or it has been live for a year. The\n        // guard first, because `ADD COLUMN IF NOT EXISTS` is a no-op against an\n        // existing column — without it the file would report success, leave the\n        // old expression in place, and then stamp it as current.\n        searchStampGuards(spec).forEach(s => { ddl += `${s}\\n`; });\n        ddl += `ALTER TABLE ${target} ADD COLUMN IF NOT EXISTS ${searchColumnDefinition(spec)};\\n`;\n        const fuzzy = fuzzyColumnDefinition(spec);\n        if (fuzzy) ddl += `ALTER TABLE ${target} ADD COLUMN IF NOT EXISTS ${fuzzy};\\n`;\n        searchColumnStamps(spec).forEach(s => { ddl += `${s.sql}\\n`; });\n        searchIndexStatements(spec).forEach(s => { ddl += `${s}\\n`; });\n        ddl += \"\\n\";\n    }\n\n    return ddl;\n}\n\n/**\n * Glob patterns telling Atlas to leave an object alone.\n *\n * Fully qualified, `schema.table.object`, matching the include list. The\n * two-part form is what Atlas wants when the connection URL scopes it to one\n * schema and is *silently ignored* otherwise: it reads `posts.search_vector` as\n * a table named `search_vector` in a schema named `posts`, matches nothing, and\n * reports no error for the pattern that never fired.\n */\nexport const searchExcludePatternsOf = (plan: SchemaPlan): string[] => {\n    const patterns: string[] = [];\n    for (const table of plan.tables) {\n        if (!table.search) continue;\n        for (const column of table.columns) {\n            if (column.source.kind !== \"search\") continue;\n            patterns.push(`${table.schema}.${table.table}.${column.column}`);\n        }\n        for (const index of searchIndexNames(table.search)) {\n            patterns.push(`${table.schema}.${table.table}.${index}`);\n        }\n    }\n    return patterns;\n};\n\n// ── vector.sql ───────────────────────────────────────────────────────────────\n\nexport function renderVectorDdl(plan: SchemaPlan): string {\n    const tables = plan.tables.filter(t => t.vectorColumns.length > 0);\n    if (tables.length === 0) return \"\";\n\n    let ddl = \"-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\\n\";\n    ddl += \"--\\n\";\n    ddl += \"-- Vector columns and their ANN indexes, for the collections declaring a\\n\";\n    ddl += \"-- `vector` property. Applied by Rebase, not by Atlas — see\\n\";\n    ddl += \"-- generatePostgresVectorDdl.\\n\\n\";\n    // The note is not decoration. Someone reading this file after a failed push\n    // is looking for the reason the type does not exist, and \"no CREATE\n    // EXTENSION here\" is invisible unless it is written down.\n    ddl += vectorExtensionDeclared(plan.options.databaseExtensions)\n        ? `${vectorExtensionStatement()}\\n\\n`\n        : \"-- pgvector is not installed from here: no database declared it. To let Rebase\\n\" +\n          `-- install it, add ${VECTOR_EXTENSION_OPT_IN} in config/resources.ts.\\n` +\n          \"-- Otherwise install it once by hand; the column below needs the type either way.\\n\\n\";\n\n    for (const table of tables) {\n        const target = `\"${table.schema}\".\"${table.table}\"`;\n        for (const spec of table.vectorColumns) {\n            // Guard before the ADD, so a changed `dimensions` is reported\n            // rather than skipped over — see `vectorDimensionGuard`.\n            ddl += `${vectorDimensionGuard(spec)}\\n`;\n            ddl += `ALTER TABLE ${target} ADD COLUMN IF NOT EXISTS ${vectorColumnDefinition(spec)};\\n`;\n        }\n        if (table.vector) {\n            vectorIndexStatements(table.vector).forEach(s => { ddl += `${s}\\n`; });\n            for (const skip of table.vector.skipped) {\n                ddl += `-- No ANN index on \"${skip.schema}\".\"${skip.table}\".\"${skip.column}\": ${skip.reason}\\n`;\n            }\n        }\n        ddl += \"\\n\";\n    }\n\n    return ddl;\n}\n\n/** @see searchExcludePatternsOf */\nexport const vectorExcludePatternsOf = (plan: SchemaPlan): string[] => {\n    const patterns: string[] = [];\n    for (const table of plan.tables) {\n        const names = [\n            ...table.vectorColumns.map(spec => spec.column),\n            ...(table.vector ? vectorIndexNames(table.vector) : [])\n        ];\n        for (const name of names) patterns.push(`${table.schema}.${table.table}.${name}`);\n    }\n    return patterns;\n};\n\n// ── triggers.sql ─────────────────────────────────────────────────────────────\n\n/**\n * `autoValue: \"on_update\"`, as the file Rebase applies itself.\n *\n * Empty when nothing declares one — the caller writes no file then, and removes\n * a stale one.\n */\nexport function renderTriggersDdl(plan: SchemaPlan): string {\n    const tables = plan.tables.filter(t => t.triggers.length > 0);\n    if (tables.length === 0) return \"\";\n\n    let ddl = \"-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\\n\";\n    ddl += \"--\\n\";\n    ddl += \"-- `updated_at` triggers, for the properties declaring `autoValue: \\\"on_update\\\"`.\\n\";\n    ddl += \"-- Applied by Rebase, not by Atlas — a trigger is a function plus a binding,\\n\";\n    ddl += \"-- and Atlas's free tier refuses to parse a desired state containing one.\\n\\n\";\n\n    for (const statement of plan.functions.filter(isTriggerFunction)) {\n        ddl += `${statement}\\n\\n`;\n    }\n    for (const table of tables) {\n        for (const trigger of table.triggers) {\n            triggerStatements(trigger).forEach(s => { ddl += `${s}\\n`; });\n        }\n        ddl += \"\\n\";\n    }\n    return ddl;\n}\n\nconst isTriggerFunction = (statement: string): boolean => statement.includes(\"RETURNS trigger\");\n\n/** @see searchExcludePatternsOf */\nexport const triggerExcludePatternsOf = (plan: SchemaPlan): string[] =>\n    plan.tables.flatMap(table => table.triggers.map(t => `${table.schema}.${table.table}.${t.name}`));\n","/**\n * The SQL half of `rebase db generate`, as a plan and a renderer.\n *\n * There is no interpretation left in this file. `schema/plan/plan-schema.ts`\n * reads the collections into a {@link SchemaPlan} and `schema/plan/render-ddl.ts`\n * writes the files; what remains here is the public entry points those two are\n * reached through, plus the smaller plans (`planRelationalColumns`,\n * `planJunctionTables`, `planCollectionPolicies`) that other modules ask for as\n * slices of the same plan.\n *\n * It used to hold `getSqlColumnType` and a `CREATE TABLE` walk with its own\n * reading of relations, junctions, enums and search — one of three such\n * readings. See `schema/plan/types.ts` for what that cost.\n */\nimport { CollectionConfig, SecurityRule, isPostgresCollectionConfig } from \"@rebasepro/types\";\nimport { getTableName } from \"@rebasepro/common\";\nimport { planSchema, compileSecurityRule, quoteSqlLiteral, defaultBelongsToOnDelete } from \"./plan/plan-schema\";\nimport {\n    renderPgType,\n    renderPoliciesDdl,\n    renderPolicyStatements,\n    renderPostgresDdl,\n    renderSearchDdl,\n    renderTriggersDdl,\n    renderVectorDdl,\n    searchExcludePatternsOf,\n    triggerExcludePatternsOf,\n    vectorExcludePatternsOf,\n    type DdlRenderOptions\n} from \"./plan/render-ddl\";\nimport type { ForeignKeyPlan, SchemaPlan } from \"./plan/types\";\nimport type { GeneratedColumnDependency } from \"./generated-column-conflicts\";\n\nexport { quoteSqlLiteral, defaultBelongsToOnDelete };\nexport type { ForeignKeyPlan };\n\ntype ResolveCollection = (slug: string) => CollectionConfig | undefined;\n\n/**\n * The individual SQL statements a single security rule compiles to: a\n * `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete\n * statement (terminated by `;`, no trailing newline).\n *\n * This is the primitive the boot-time RLS applier runs one statement at a time\n * (the runtime's DB handle speaks the extended query protocol, which forbids\n * multiple commands in one execute), while `db push` writes the joined string.\n */\nexport const generatePolicyStatements = (\n    collection: CollectionConfig,\n    rule: SecurityRule,\n    resolveCollection: ResolveCollection\n): string[] => {\n    const table = {\n        schema: isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : \"public\",\n        table: getTableName(collection)\n    };\n    return compileSecurityRule(collection, rule, resolveCollection, false)\n        .flatMap(policy => renderPolicyStatements(table, policy));\n};\n\n/**\n * `drizzle/schema.sql` — the desired state Atlas diffs the database against.\n *\n * Synchronous. It was `async` with nothing to await, which made every caller\n * (the writer script, the doctor, the live editor, two gates) carry a promise\n * for no reason and made the one place that forgot to await it silently compare\n * `[object Promise]`.\n */\nexport const generatePostgresDdl = (\n    allCollections: CollectionConfig[],\n    options: DdlRenderOptions = {}\n): string => renderPostgresDdl(planSchema(allCollections), options);\n\n/** `drizzle/policies.sql` — the RLS policies. Atlas has no model for a policy. */\nexport const generatePostgresPoliciesDdl = (allCollections: CollectionConfig[]): string =>\n    renderPoliciesDdl(planSchema(allCollections));\n\n/**\n * `drizzle/search.sql` — everything a `search` block needs, as a file Rebase\n * applies itself.\n *\n * Search is one of the parts of the schema Atlas does not own, for two\n * independent reasons and either alone would be enough:\n *\n * 1. Its free tier refuses to *parse* a desired-state file that so much as\n *    contains a function — \"functions and procedures are available to\n *    logged-in users only\". A generated `tsvector` column cannot avoid one:\n *    `unaccent` is STABLE and jsonb flattening needs a set-returning function,\n *    so both have to be wrapped in an IMMUTABLE helper to be legal in a\n *    generated column at all.\n * 2. Even with the file accepted, Atlas *wipes* the dev database it diffs\n *    against, so a helper seeded there beforehand is gone by the time the plan\n *    is analysed. There is no hook to reinstate it.\n *\n * Empty when nothing opted in — the caller writes no file then.\n */\nexport const generatePostgresSearchDdl = (allCollections: CollectionConfig[]): string =>\n    renderSearchDdl(planSchema(allCollections));\n\n/**\n * Glob patterns telling Atlas to leave the search column and its index alone.\n *\n * Without these, a desired state that omits search reads to Atlas as an\n * instruction to drop the column — taking the index and the whole search\n * feature with it on the next push.\n */\nexport const searchExcludePatterns = (allCollections: CollectionConfig[]): string[] =>\n    searchExcludePatternsOf(planSchema(allCollections));\n\n/**\n * `drizzle/vector.sql` — the `vector` columns, their ANN indexes and, when a\n * database declared it, the extension.\n *\n * Vector is out of Atlas's hands for a narrower reason than search: not that\n * Atlas refuses to parse the file, but that it cannot *execute* it. To compute\n * a desired state Atlas materialises `schema.sql` in a dev database, that\n * database is created empty, and Atlas empties it again at the start of every\n * run — so `VECTOR(384)` resolves against a database that structurally cannot\n * have pgvector, and every push dies with `type \"vector\" does not exist`.\n */\nexport const generatePostgresVectorDdl = (\n    allCollections: CollectionConfig[],\n    options: { extensions?: readonly string[] } = {}\n): string => renderVectorDdl(planSchema(allCollections, { databaseExtensions: options.extensions }));\n\n/** @see searchExcludePatterns */\nexport const vectorExcludePatterns = (allCollections: CollectionConfig[]): string[] =>\n    vectorExcludePatternsOf(planSchema(allCollections));\n\n/**\n * `drizzle/triggers.sql` — the `BEFORE UPDATE` triggers behind\n * `autoValue: \"on_update\"`, and the one function they share.\n *\n * A trigger is a function plus a binding, so it is carved out of Atlas's view\n * for the first of the two reasons search is. Empty when no property declares\n * `on_update` — the caller writes no file then, and removes a stale one.\n */\nexport const generatePostgresTriggersDdl = (allCollections: CollectionConfig[]): string =>\n    renderTriggersDdl(planSchema(allCollections));\n\n/** @see searchExcludePatterns */\nexport const triggerExcludePatterns = (allCollections: CollectionConfig[]): string[] =>\n    triggerExcludePatternsOf(planSchema(allCollections));\n\n// ── Slices of the plan other modules ask for ─────────────────────────────────\n\n/** A column a `relation` or `reference` property owns on its own table. */\nexport interface RelationalColumnPlan {\n    schema: string;\n    /** Bare table name, no schema prefix. */\n    table: string;\n    column: string;\n    /** Postgres type, exactly as the DDL renderer declares it. */\n    type: string;\n    /** `validation.required` on the property that owns the link. */\n    required: boolean;\n    /**\n     * True when a declared property emits this column and the relation\n     * contributes only the constraint — `postId` with `columnName: \"post_id\"`\n     * beside a `belongsTo` on `post_id`.\n     */\n    columnOwnedByProperty?: boolean;\n    /** Absent when the target collection is not part of this bundle. */\n    foreignKey?: ForeignKeyPlan;\n    /**\n     * What this column would have been called before `generateForeignKeyName`\n     * learned to singularize. Carried so the boot-time ensure can notice a\n     * database provisioned under the old rule; never used to name anything.\n     */\n    legacyColumn?: string;\n}\n\n/** The table behind a many-to-many `through` relation. */\nexport interface JunctionTablePlan {\n    schema: string;\n    /** Bare table name, no schema prefix. */\n    table: string;\n    columns: { name: string; type: string; legacyName?: string }[];\n    /** Both endpoint columns plus the composite primary key. */\n    createTable: string;\n    foreignKeys: ForeignKeyPlan[];\n}\n\nconst planOf = (collections: CollectionConfig[]): SchemaPlan => planSchema(collections);\n\n/**\n * The FK columns the declared collections own — one entry per `relation`\n * (`belongsTo` side) or `reference` property.\n *\n * A view over the schema plan. It was a second walk of the collections beside\n * the `CREATE TABLE` one, which is how boot-ensure came to add every relation\n * column bare while `db push` made the same column `NOT NULL`.\n */\nexport const planRelationalColumns = (allCollections: CollectionConfig[]): RelationalColumnPlan[] => {\n    const plan = planOf(allCollections);\n    const out: RelationalColumnPlan[] = [];\n    for (const table of plan.tables) {\n        if (table.kind !== \"collection\") continue;\n        for (const column of table.columns) {\n            if (column.source.kind !== \"relation\" && column.source.kind !== \"reference\") continue;\n            out.push({\n                schema: table.schema,\n                table: table.table,\n                column: column.column,\n                type: renderPgType(column.type),\n                required: !column.nullable,\n                columnOwnedByProperty: column.columnOwnedByProperty,\n                legacyColumn: column.legacyColumn,\n                foreignKey: column.foreignKey\n            });\n        }\n    }\n    return out;\n};\n\n/**\n * The junction tables a bundle's many-to-many relations imply.\n *\n * Derived from the same plan the derived RLS comes from, so a table created\n * here always has policies planned for it — a junction with row-level security\n * left off is readable and writable by every signed-in user.\n */\nexport const planJunctionTables = (allCollections: CollectionConfig[]): JunctionTablePlan[] =>\n    planOf(allCollections).tables\n        .filter(table => table.kind === \"junction\")\n        .map(table => ({\n            schema: table.schema,\n            table: table.table,\n            columns: table.columns.map(c => ({\n                name: c.column,\n                type: renderPgType(c.type),\n                legacyName: c.legacyColumn\n            })),\n            createTable:\n                `CREATE TABLE IF NOT EXISTS \"${table.schema}\".\"${table.table}\" (` +\n                table.columns.map(c => `\"${c.column}\" ${renderPgType(c.type)} NOT NULL`).join(\", \") +\n                `, PRIMARY KEY (${table.primaryKey.map(c => `\"${c}\"`).join(\", \")}));`,\n            foreignKeys: table.columns.map(c => c.foreignKey).filter((fk): fk is ForeignKeyPlan => fk !== undefined)\n        }));\n\nexport interface CollectionPolicyPlan {\n    /** The table's schema (e.g. `public`, `rebase`). */\n    schema: string;\n    /** The bare table name, no schema prefix. */\n    table: string;\n    /** `schema.table` — matches the keys `readExistingSchema` returns. */\n    qualified: string;\n    /** `ALTER TABLE … ENABLE ROW LEVEL SECURITY;` — locked by default. */\n    enableRls: string;\n    /** `DROP POLICY IF EXISTS` / `CREATE POLICY` statements, in order. */\n    policyStatements: string[];\n}\n\n/**\n * The per-table RLS plan for the declared collections and their junctions, as\n * executable statements — what the managed runtime applies at boot so a freshly\n * provisioned tenant database serves data instead of 401ing every read.\n *\n * The same policies `policies.sql` carries, from the same plan, so boot and\n * `db push` produce identical RLS from identical collections.\n */\nexport const planCollectionPolicies = (allCollections: CollectionConfig[]): CollectionPolicyPlan[] => {\n    const plan = planOf(allCollections);\n    // Collections first, then the junctions no collection declares.\n    const ordered = [\n        ...plan.tables.filter(t => t.kind === \"collection\"),\n        ...plan.tables.filter(t => t.kind === \"junction\")\n    ];\n    return ordered.map(table => ({\n        schema: table.schema,\n        table: table.table,\n        qualified: table.qualified,\n        enableRls: `ALTER TABLE \"${table.schema}\".\"${table.table}\" ENABLE ROW LEVEL SECURITY;`,\n        policyStatements: table.policies.flatMap(policy => renderPolicyStatements(table, policy))\n    }));\n};\n\n/**\n * The `generated column → column it reads` edges a project's `search` blocks\n * imply, derived from the collections alone.\n *\n * The same edges `queryGeneratedColumnDependencies` reads out of `pg_depend`,\n * but available where no database is: `rebase db generate` writes a migration\n * that will run somewhere else, later, against a database it cannot inspect.\n * A spec's `fields[].column` is the physical column each search field starts\n * at, which is exactly what the generated expression depends on.\n */\nexport const searchColumnDependencies = (\n    allCollections: CollectionConfig[]\n): GeneratedColumnDependency[] => {\n    const dependencies: GeneratedColumnDependency[] = [];\n    for (const table of planOf(allCollections).tables) {\n        const spec = table.search;\n        if (!spec) continue;\n        const generated = [spec.column, ...(spec.fuzzy ? [spec.fuzzy.column] : [])];\n        const sources = new Set(spec.fields.map(field => field.column));\n        for (const column of generated) {\n            for (const dependsOn of sources) {\n                dependencies.push({ schema: table.schema, table: table.table, column, dependsOn });\n            }\n        }\n    }\n    return dependencies;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgEA,IAAa,gBAAgB,SAAyB;CAClD,QAAQ,KAAK,MAAb;EACI,KAAK,QAAQ,OAAO;EACpB,KAAK,WAAW,OAAO,WAAW,KAAK,OAAO;EAC9C,KAAK,QAAQ,OAAO,QAAQ,KAAK,OAAO;EACxC,KAAK,QAAQ,OAAO;EACpB,KAAK,QAAQ,OAAO,IAAI,KAAK,OAAO,KAAK,KAAK,KAAK;EACnD,KAAK,YAAY,OAAO;EACxB,KAAK,WAAW,OAAO;EACvB,KAAK,UAAU,OAAO;EACtB,KAAK,eAAe,OAAO;EAC3B,KAAK,UAAU,OAAO;EACtB,KAAK,aAAa,OAAO;EACzB,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO;EAC/B,KAAK;GACD,IAAI,KAAK,cAAc,KAAA,GAAW,OAAO;GACzC,OAAO,KAAK,UAAU,KAAA,IAChB,WAAW,KAAK,UAAU,KAC1B,WAAW,KAAK,UAAU,IAAI,KAAK,MAAM;EACnD,KAAK,WAAW,OAAO;EACvB,KAAK,eAAe,OAAO;EAC3B,KAAK,QAAQ,OAAO;EACpB,KAAK,QAAQ,OAAO;EACpB,KAAK,QAAQ,OAAO;EACpB,KAAK,SAAS,OAAO;EACrB,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW;EAChD,KAAK,SAAS,OAAO;EACrB,KAAK,YAAY,OAAO;EACxB,KAAK,SAAS,OAAO,GAAG,aAAa,KAAK,EAAE,EAAE;CAClD;AACJ;;;;;;;;;AAUA,IAAa,0BAA0B,WAA+B;CAGlE,IAAI,OAAO,eAAe,OAAO,OAAO;CAExC,IAAI,OAAO,WACP,OAAO,GAAG,aAAa,OAAO,IAAI,EAAE,wBAAwB,OAAO,UAAU,WAAW;CAG5F,IAAI,aAAa,aAAa,OAAO,IAAI;CACzC,IAAI,OAAO,SAAS,SAAS,YAAY,cAAc;CACvD,IAAI,OAAO,YAAY,cAAc;CACrC,IAAI,OAAO,QAAQ,cAAc;CACjC,IAAI,OAAO,WAAW,OAAO,QAAQ,SAAS,YAC1C,cAAc,YAAY,OAAO,QAAQ,SAAS,QAAQ,OAAO,QAAQ,aAAa,OAAO,QAAQ;CAEzG,IAAI,CAAC,OAAO,YAAY,CAAC,OAAO,YAAY,cAAc;CAC1D,OAAO;AACX;;AAGA,IAAM,gBAAgB,WAClB,IAAI,OAAO,OAAO,IAAI,uBAAuB,MAAM;;;;;;;;AAWvD,IAAa,0BACT,OACA,WACW;CACX,MAAM,SAAS,IAAI,MAAM,OAAO,KAAK,MAAM,MAAM;CACjD,IAAI,SAAS,kBAAkB,OAAO,KAAK,OAAO,OAAO,MAAM,OAAO,KAAK,YAAY,EAAE,OAC9E,OAAO,UAAU,YAAY,EAAE,MAAM,OAAO,MAAM,KAAI,MAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;CACzF,IAAI,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM;CACpD,IAAI,OAAO,WAAW,UAAU,gBAAgB,OAAO,UAAU;CACjE,OAAO,CAAC,0BAA0B,OAAO,KAAK,OAAO,OAAO,IAAI,GAAG,OAAO,EAAE;AAChF;;AAGA,IAAa,mBAAmB,UAC5B,gBAAgB,MAAM,OAAO,KAAK,MAAM,MAAM;AAElD,IAAM,mBAAmB,eAAiC,WAAW,KAAI,MAAK,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE;AAI/F,SAAgB,kBAAkB,MAAkB,UAA4B,CAAC,GAAW;CACxF,MAAM,kBAAkB,QAAQ,oBAAoB;CACpD,MAAM,gBAAgB,QAAQ,kBAAkB;CAChD,MAAM,gBAAgB,QAAQ,kBAAkB;CAEhD,IAAI,MAAM;CASV,KAAK,QAAQ,SAAQ,WAAU;EAAE,OAAO,gCAAgC,OAAO;CAAO,CAAC;CACvF,IAAI,KAAK,QAAQ,SAAS,GAAG,OAAO;CASpC,MAAM,eAAe,KAAK,OAAO,QAAO,MAAK,EAAE,MAAM;CACrD,IAAI,aAAa,SAAS,GACtB,IAAI,CAAC,eACD,OAAO;MACJ;EACH,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,aAAa,SAAQ,MAAK,0BAA0B,EAAE,MAAO,CAAC,CAAC,CAAC;EACtG,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,aAAa,SAAQ,MAAK,sBAAsB,EAAE,MAAO,CAAC,CAAC,CAAC;EAC/F,OAAO;EACP,WAAW,SAAQ,MAAK;GAAE,OAAO,GAAG,EAAE;EAAK,CAAC;EAC5C,IAAI,WAAW,SAAS,GAAG,OAAO;EAClC,QAAQ,SAAQ,MAAK;GAAE,OAAO,GAAG,EAAE;EAAO,CAAC;CAC/C;CAOJ,IAAI,CAAC,iBAAiB,KAAK,OAAO,MAAK,MAAK,EAAE,cAAc,SAAS,CAAC,GAClE,OAAO;CAOX,IAAI,KAAK,OAAO,MAAK,MAAK,EAAE,SAAS,SAAS,CAAC,GAC3C,OAAO;CAIX,KAAK,MAAM,SAAQ,aAAY;EAC3B,OAAO,gBAAgB,SAAS,OAAO,KAAK,SAAS,KAAK,aAAa,SAAS,OAAO,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,EAAE;CAC3H,CAAC;CACD,IAAI,IAAI,SAAS,KAAK,GAAG,OAAO;CAIhC,MAAM,eAAyB,CAAC;CAGhC,MAAM,kBAA4B,CAAC;CAKnC,MAAM,mBAA6B,CAAC;CAEpC,KAAK,MAAM,SAAS,KAAK,QAAQ;EAC7B,MAAM,UAAU,MAAM,QAAQ,QAAO,WAAU;GAK3C,IAAI,CAAC,iBAAiB,OAAO,KAAK,SAAS,UAAU,OAAO;GAC5D,IAAI,CAAC,iBAAiB,OAAO,OAAO,SAAS,UAAU,OAAO;GAI9D,IAAI,OAAO,uBAAuB,OAAO;GACzC,OAAO;EACX,CAAC;EAED,OAAO,iBAAiB,MAAM,OAAO,KAAK,MAAM,MAAM;EACtD,MAAM,QAAQ,QAAQ,KAAI,WAAU,KAAK,aAAa,MAAM,GAAG;EAC/D,IAAI,MAAM,SAAS,YACf,MAAM,KAAK,kBAAkB,MAAM,WAAW,KAAI,MAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE;EAElF,OAAO,MAAM,KAAK,KAAK;EACvB,OAAO;EAEP,KAAK,MAAM,UAAU,MAAM,SACvB,IAAI,OAAO,YAAY,aAAa,KAAK,GAAG,OAAO,WAAW,IAAI,EAAE;EAGxE,IAAI,iBAAiB,MAAM,QACvB,gBAAgB,KAAK,GAAG,sBAAsB,MAAM,MAAM,CAAC;EAM/D,IAAI,iBAAiB,MAAM,QAAQ;GAC/B,gBAAgB,KAAK,GAAG,sBAAsB,MAAM,MAAM,CAAC;GAC3D,KAAK,MAAM,QAAQ,MAAM,OAAO,SAC5B,gBAAgB,KAAK,uBAAuB,KAAK,OAAO,KAAK,KAAK,MAAM,KAAK,KAAK,OAAO,KAAK,KAAK,QAAQ;EAEnH;EAIA,gBAAgB,KAAK,GAAG,0BAA0B,MAAM,OAAO,CAAC;EAEhE,IAAI,iBAAiB;GAIjB,OAAO,GAAG,gBAAgB,KAAK,EAAE;GACjC,OAAO;GACP,KAAK,MAAM,UAAU,MAAM,UACvB,iBAAiB,KAAK,gBAAgB,uBAAuB,OAAO,MAAM,CAAC,CAAC;EAEpF;CACJ;CAMA,IAAI,gBAAgB,SAAS,GAAG;EAC5B,OAAO;EACP,OAAO,gBAAgB,KAAK,IAAI,IAAI;CACxC;CAEA,IAAI,aAAa,SAAS,GAAG;EACzB,OAAO;EACP,OAAO,aAAa,KAAK,IAAI,IAAI;CACrC;CAEA,IAAI,iBAAiB,SAAS,GAAG;EAC7B,OAAO;EACP,OAAO,iBAAiB,KAAK,EAAE;EAC/B,OAAO;CACX;CAEA,OAAO;AACX;AAIA,SAAgB,kBAAkB,MAA0B;CACxD,IAAI,MAAM;CAIV,KAAK,MAAM,SAAS,KAAK,OAAO,QAAO,MAAK,EAAE,SAAS,YAAY,GAAG;EAClE,OAAO,GAAG,gBAAgB,KAAK,EAAE;EACjC,OAAO;EACP,IAAI,MAAM,SAAS,WAAW,GAAG;EACjC,IAAI;EACJ,KAAK,MAAM,UAAU,MAAM,UAAU;GAOjC,IAAI,OAAO,YAAY,OAAO,YAAY,WAAW;IACjD,OAAO;IACP,OAAO,+CAA+C,MAAM,KAAK;GACrE;GACA,YAAY,OAAO;GACnB,OAAO,gBAAgB,uBAAuB,OAAO,MAAM,CAAC;EAChE;EACA,OAAO;CACX;CAEA,KAAK,MAAM,SAAS,KAAK,OAAO,QAAO,MAAK,EAAE,SAAS,UAAU,GAAG;EAChE,OAAO,GAAG,gBAAgB,KAAK,EAAE;EACjC,OAAO;EACP,IAAI,MAAM,SAAS,WAAW,GAAG;EACjC,MAAM,kBAAkB,MAAM,kBAAkB,CAAC,EAAA,CAAG,KAAK,QAAM;EAC/D,OAAO,0CAA0C,MAAM,MAAM;EAC7D,OAAO;EACP,OAAO,gBAAgB,eAAe;EACtC,OAAO;EACP,KAAK,MAAM,UAAU,MAAM,UACvB,OAAO,gBAAgB,uBAAuB,OAAO,MAAM,CAAC;EAEhE,OAAO;CACX;CAEA,OAAO;AACX;AAIA,SAAgB,gBAAgB,MAA0B;CACtD,MAAM,SAAS,KAAK,OAAO,QAAO,MAAK,EAAE,MAAM;CAC/C,IAAI,OAAO,WAAW,GAAG,OAAO;CAEhC,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,SAAQ,MAAK,0BAA0B,EAAE,MAAO,CAAC,CAAC,CAAC;CAChG,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,SAAQ,MAAK,sBAAsB,EAAE,MAAO,CAAC,CAAC,CAAC;CAEzF,IAAI,MAAM;CACV,OAAO;CACP,OAAO;CACP,OAAO;CAEP,WAAW,SAAQ,MAAK;EAAE,OAAO,GAAG,EAAE;CAAK,CAAC;CAC5C,IAAI,WAAW,SAAS,GAAG,OAAO;CAClC,QAAQ,SAAQ,MAAK;EAAE,OAAO,GAAG,EAAE;CAAO,CAAC;CAE3C,KAAK,MAAM,SAAS,QAAQ;EACxB,MAAM,OAAO,MAAM;EACnB,MAAM,SAAS,IAAI,MAAM,OAAO,KAAK,MAAM,MAAM;EAOjD,kBAAkB,IAAI,CAAC,CAAC,SAAQ,MAAK;GAAE,OAAO,GAAG,EAAE;EAAK,CAAC;EACzD,OAAO,eAAe,OAAO,4BAA4B,uBAAuB,IAAI,EAAE;EACtF,MAAM,QAAQ,sBAAsB,IAAI;EACxC,IAAI,OAAO,OAAO,eAAe,OAAO,4BAA4B,MAAM;EAC1E,mBAAmB,IAAI,CAAC,CAAC,SAAQ,MAAK;GAAE,OAAO,GAAG,EAAE,IAAI;EAAK,CAAC;EAC9D,sBAAsB,IAAI,CAAC,CAAC,SAAQ,MAAK;GAAE,OAAO,GAAG,EAAE;EAAK,CAAC;EAC7D,OAAO;CACX;CAEA,OAAO;AACX;;;;;;;;;;AAWA,IAAa,2BAA2B,SAA+B;CACnE,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,SAAS,KAAK,QAAQ;EAC7B,IAAI,CAAC,MAAM,QAAQ;EACnB,KAAK,MAAM,UAAU,MAAM,SAAS;GAChC,IAAI,OAAO,OAAO,SAAS,UAAU;GACrC,SAAS,KAAK,GAAG,MAAM,OAAO,GAAG,MAAM,MAAM,GAAG,OAAO,QAAQ;EACnE;EACA,KAAK,MAAM,SAAS,iBAAiB,MAAM,MAAM,GAC7C,SAAS,KAAK,GAAG,MAAM,OAAO,GAAG,MAAM,MAAM,GAAG,OAAO;CAE/D;CACA,OAAO;AACX;AAIA,SAAgB,gBAAgB,MAA0B;CACtD,MAAM,SAAS,KAAK,OAAO,QAAO,MAAK,EAAE,cAAc,SAAS,CAAC;CACjE,IAAI,OAAO,WAAW,GAAG,OAAO;CAEhC,IAAI,MAAM;CACV,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO;CAIP,OAAO,wBAAwB,KAAK,QAAQ,kBAAkB,IACxD,GAAG,yBAAyB,EAAE,QAC9B;qBACsB,wBAAwB;;;CAGpD,KAAK,MAAM,SAAS,QAAQ;EACxB,MAAM,SAAS,IAAI,MAAM,OAAO,KAAK,MAAM,MAAM;EACjD,KAAK,MAAM,QAAQ,MAAM,eAAe;GAGpC,OAAO,GAAG,qBAAqB,IAAI,EAAE;GACrC,OAAO,eAAe,OAAO,4BAA4B,uBAAuB,IAAI,EAAE;EAC1F;EACA,IAAI,MAAM,QAAQ;GACd,sBAAsB,MAAM,MAAM,CAAC,CAAC,SAAQ,MAAK;IAAE,OAAO,GAAG,EAAE;GAAK,CAAC;GACrE,KAAK,MAAM,QAAQ,MAAM,OAAO,SAC5B,OAAO,uBAAuB,KAAK,OAAO,KAAK,KAAK,MAAM,KAAK,KAAK,OAAO,KAAK,KAAK,OAAO;EAEpG;EACA,OAAO;CACX;CAEA,OAAO;AACX;;AAGA,IAAa,2BAA2B,SAA+B;CACnE,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,SAAS,KAAK,QAAQ;EAC7B,MAAM,QAAQ,CACV,GAAG,MAAM,cAAc,KAAI,SAAQ,KAAK,MAAM,GAC9C,GAAI,MAAM,SAAS,iBAAiB,MAAM,MAAM,IAAI,CAAC,CACzD;EACA,KAAK,MAAM,QAAQ,OAAO,SAAS,KAAK,GAAG,MAAM,OAAO,GAAG,MAAM,MAAM,GAAG,MAAM;CACpF;CACA,OAAO;AACX;;;;;;;AAUA,SAAgB,kBAAkB,MAA0B;CACxD,MAAM,SAAS,KAAK,OAAO,QAAO,MAAK,EAAE,SAAS,SAAS,CAAC;CAC5D,IAAI,OAAO,WAAW,GAAG,OAAO;CAEhC,IAAI,MAAM;CACV,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO;CAEP,KAAK,MAAM,aAAa,KAAK,UAAU,OAAO,iBAAiB,GAC3D,OAAO,GAAG,UAAU;CAExB,KAAK,MAAM,SAAS,QAAQ;EACxB,KAAK,MAAM,WAAW,MAAM,UACxB,kBAAkB,OAAO,CAAC,CAAC,SAAQ,MAAK;GAAE,OAAO,GAAG,EAAE;EAAK,CAAC;EAEhE,OAAO;CACX;CACA,OAAO;AACX;AAEA,IAAM,qBAAqB,cAA+B,UAAU,SAAS,iBAAiB;;AAG9F,IAAa,4BAA4B,SACrC,KAAK,OAAO,SAAQ,UAAS,MAAM,SAAS,KAAI,MAAK,GAAG,MAAM,OAAO,GAAG,MAAM,MAAM,GAAG,EAAE,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;ACvbpG,IAAa,uBACT,gBACA,UAA4B,CAAC,MACpB,kBAAkB,WAAW,cAAc,GAAG,OAAO;;AAGlE,IAAa,+BAA+B,mBACxC,kBAAkB,WAAW,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;AAqBhD,IAAa,6BAA6B,mBACtC,gBAAgB,WAAW,cAAc,CAAC;;;;;;;;AAS9C,IAAa,yBAAyB,mBAClC,wBAAwB,WAAW,cAAc,CAAC;;;;;;;;;;;;AAatD,IAAa,6BACT,gBACA,UAA8C,CAAC,MACtC,gBAAgB,WAAW,gBAAgB,EAAE,oBAAoB,QAAQ,WAAW,CAAC,CAAC;;AAGnG,IAAa,yBAAyB,mBAClC,wBAAwB,WAAW,cAAc,CAAC;;;;;;;;;AAUtD,IAAa,+BAA+B,mBACxC,kBAAkB,WAAW,cAAc,CAAC;;AAGhD,IAAa,0BAA0B,mBACnC,yBAAyB,WAAW,cAAc,CAAC;AAyCvD,IAAM,UAAU,gBAAgD,WAAW,WAAW;;;;;;;;AAuCtF,IAAa,sBAAsB,mBAC/B,OAAO,cAAc,CAAC,CAAC,OAClB,QAAO,UAAS,MAAM,SAAS,UAAU,CAAC,CAC1C,KAAI,WAAU;CACX,QAAQ,MAAM;CACd,OAAO,MAAM;CACb,SAAS,MAAM,QAAQ,KAAI,OAAM;EAC7B,MAAM,EAAE;EACR,MAAM,aAAa,EAAE,IAAI;EACzB,YAAY,EAAE;CAClB,EAAE;CACF,aACI,+BAA+B,MAAM,OAAO,KAAK,MAAM,MAAM,OAC7D,MAAM,QAAQ,KAAI,MAAK,IAAI,EAAE,OAAO,IAAI,aAAa,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,KAAK,IAAI,IAClF,kBAAkB,MAAM,WAAW,KAAI,MAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;CACrE,aAAa,MAAM,QAAQ,KAAI,MAAK,EAAE,UAAU,CAAC,CAAC,QAAQ,OAA6B,OAAO,KAAA,CAAS;AAC3G,EAAE;;;;;;;;;AAuBV,IAAa,0BAA0B,mBAA+D;CAClG,MAAM,OAAO,OAAO,cAAc;CAMlC,OAAO,CAHH,GAAG,KAAK,OAAO,QAAO,MAAK,EAAE,SAAS,YAAY,GAClD,GAAG,KAAK,OAAO,QAAO,MAAK,EAAE,SAAS,UAAU,CAE7C,CAAA,CAAQ,KAAI,WAAU;EACzB,QAAQ,MAAM;EACd,OAAO,MAAM;EACb,WAAW,MAAM;EACjB,WAAW,gBAAgB,MAAM,OAAO,KAAK,MAAM,MAAM;EACzD,kBAAkB,MAAM,SAAS,SAAQ,WAAU,uBAAuB,OAAO,MAAM,CAAC;CAC5F,EAAE;AACN;;;;;;;;;;;AAYA,IAAa,4BACT,mBAC8B;CAC9B,MAAM,eAA4C,CAAC;CACnD,KAAK,MAAM,SAAS,OAAO,cAAc,CAAC,CAAC,QAAQ;EAC/C,MAAM,OAAO,MAAM;EACnB,IAAI,CAAC,MAAM;EACX,MAAM,YAAY,CAAC,KAAK,QAAQ,GAAI,KAAK,QAAQ,CAAC,KAAK,MAAM,MAAM,IAAI,CAAC,CAAE;EAC1E,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,KAAI,UAAS,MAAM,MAAM,CAAC;EAC9D,KAAK,MAAM,UAAU,WACjB,KAAK,MAAM,aAAa,SACpB,aAAa,KAAK;GAAE,QAAQ,MAAM;GAAQ,OAAO,MAAM;GAAO;GAAQ;EAAU,CAAC;CAG7F;CACA,OAAO;AACX"}