@rebasepro/server-postgres 0.23.0 → 0.24.0

package/dist/cli.js

@@ -1,9 +1,9 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
-import { a as formatForeignGeneratedColumnBanner, c as reportCommandFailure, i as diagnoseDbError, r as diagnoseAtlasFailure, t as checkDatabaseConnectivity } from "./cli-errors-B8qHg02P.js";
+import { a as formatForeignGeneratedColumnBanner, c as reportCommandFailure, i as diagnoseDbError, r as diagnoseAtlasFailure, t as checkDatabaseConnectivity } from "./cli-errors-DsA-K9uP.js";
 import { n as outError, r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
-import { A as resolveLocalBin, C as loadCollectionsForCli, D as readSearchDdl, E as queryGeneratedColumnDependencies, F as forLibpq, M as detectDestructiveStatements, N as splitSqlStatements, O as readTriggersDdl, P as execa, S as getVectorExcludes, T as queryColumnTypes, _ as getDevDatabaseUrl, a as ExcludeIntrospectionError, b as getTableExcludes, c as applyVectorDdl, d as describeReinstallCommand, f as detectProjectPackageManager, g as ensureDevDatabaseExists, h as dropGeneratedColumns, j as decidePushSafety, k as readVectorDdl, l as describeBuildScriptRemedy, m as dropDevDatabase, o as applySearchDdl, p as diagnoseMissingBin, r as dropLegacyAuthSchema, s as applyTriggersDdl, t as RLS_BOOTSTRAP_SQL, u as describeDevAddCommand, v as getForeignIndexExcludes, w as promptConfirm, x as getTriggerExcludes, y as getSearchExcludes } from "./rls-bootstrap-sql-B8EclDyM.js";
+import { A as resolveLocalBin, B as forLibpq, C as loadCollectionsForCli, D as readSearchDdl, E as queryGeneratedColumnDependencies, F as decidePushSafety, I as detectDestructiveStatements, L as extractPlanStatements, M as GENERATED_SQL_DIR, N as generatedSqlDir, O as readTriggersDdl, P as prepareGeneratedSqlDir, R as fromAlterTable, S as getVectorExcludes, T as queryColumnTypes, _ as getDevDatabaseUrl, a as ExcludeIntrospectionError, b as getTableExcludes, c as applyVectorDdl, d as describeReinstallCommand, f as detectProjectPackageManager, g as ensureDevDatabaseExists, h as dropGeneratedColumns, j as DESIRED_STATE_URL, k as readVectorDdl, l as describeBuildScriptRemedy, m as dropDevDatabase, o as applySearchDdl, p as diagnoseMissingBin, r as dropLegacyAuthSchema, s as applyTriggersDdl, t as RLS_BOOTSTRAP_SQL, u as describeDevAddCommand, v as getForeignIndexExcludes, w as promptConfirm, x as getTriggerExcludes, y as getSearchExcludes, z as execa } from "./rls-bootstrap-sql-_KNnjanK.js";
 import { t as chalk } from "./source-Br7L7GOI.js";
 import { t as require_arg } from "./arg-Dni7MzLB.js";
 import { n as collectionsPathIn, r as parseDriverLine, t as assertKnownFlags } from "./cli-flags-BglvpjHv.js";
@@ -51,16 +51,6 @@ var ALTER_COLUMN_RE = new RegExp(String.raw`\bALTER\s+(?:COLUMN\s+)?(${IDENT$1})
 var DROP_COLUMN_RE$1 = new RegExp(String.raw`\bDROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?(${IDENT$1})`, "gi");
 var unquote = (ident) => ident.startsWith("\"") ? ident.slice(1, -1) : ident;
 /**
-* Strip Atlas's plan rendering from a statement.
-*
-* What `schema apply --dry-run` prints is not a SQL file: each statement is
-* indented under a `-- modify "posts" table` heading and prefixed with `-> `,
-* with an `-- ok (12µs)` line after it. `splitSqlStatements` drops the comment
-* lines, and this drops the arrow — without it an anchored `^ALTER TABLE`
-* matches nothing at all, which is a silent no-op rather than an error.
-*/
-var stripPlanMarker = (statement) => statement.replace(/^\s*->\s*/, "").trim();
-/**
 * Every column an Atlas plan retypes or drops, with the table it belongs to.
 *
 * One statement carries many clauses — Atlas emits `ALTER TABLE "public"."posts"
@@ -69,8 +59,8 @@ var stripPlanMarker = (statement) => statement.replace(/^\s*->\s*/, "").trim();
 */
 function parseColumnMutations(planSql) {
 	const mutations = [];
-	for (const raw of splitSqlStatements(planSql)) {
-		const statement = stripPlanMarker(raw);
+	for (const raw of extractPlanStatements(planSql)) {
+		const statement = fromAlterTable(raw);
 		const table = TABLE_RE.exec(statement);
 		if (!table) continue;
 		const [schema, name] = table[2] ? [unquote(table[1]), unquote(table[2])] : [void 0, unquote(table[1])];
@@ -705,8 +695,8 @@ var TAKES_A_VALUE = /* @__PURE__ */ new Set([
 * `schemaCommand`, `generatePostgresDdlCommand` and the Atlas argv assembly
 * each re-enter the loader with the same line — and then both generators wrote
 * an *empty* schema: `drizzle/schema.sql` truncated to `CREATE SCHEMA IF NOT
-* EXISTS "rebase";`, `src/schema.generated.ts` to ten lines. Both are committed
-* artifacts. The push that followed planned a `DROP TABLE` for every table in
+* EXISTS "rebase";`, `src/schema.generated.ts` to ten lines. Both were committed
+* artifacts then. The push that followed planned a `DROP TABLE` for every table in
 * the database, and the only thing between a typo and that was the destructive
 * gate.
 *
@@ -1021,7 +1011,7 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	if (subcommand === "backup" || subcommand === "restore" || subcommand === "backups") {
-		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-24v4OlSp.js");
+		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-DW5p9_zv.js");
 		if (subcommand === "backup" && backupActionOf(rawArgs) === "list") await backupsCommand(rawArgs);
 		else if (subcommand === "backup") await backupCommand(rawArgs);
 		else if (subcommand === "restore") await restoreCommand(rawArgs);
@@ -1048,7 +1038,7 @@ async function dbCommand(subcommand, rawArgs) {
 			"--dir",
 			"file://drizzle/migrations",
 			"--to",
-			"file://drizzle/schema.sql"
+			DESIRED_STATE_URL
 		], collectionsPath);
 		let wroteNewMigration = listMigrationFiles().length > migrationsBefore.length;
 		if (wroteNewMigration) wroteNewMigration = await stripCarvedOutFromNewestMigration(collectionsPath);
@@ -1067,7 +1057,7 @@ async function dbCommand(subcommand, rawArgs) {
 					}
 					const searchContent = readSearchDdl();
 					if (searchContent) {
-						const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
+						const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-BJsLaVNX.js").then((n) => n.o);
 						const migrationConflicts = findGeneratedColumnConflicts(parseColumnMutations(migrationContent), searchColumnDependencies(await loadCollectionsForCli(collectionsPath)));
 						const preamble = migrationDropPreamble(migrationConflicts);
 						if (preamble) {
@@ -1083,7 +1073,7 @@ async function dbCommand(subcommand, rawArgs) {
 						out(chalk.gray("  ✓ Appended `updated_at` triggers to the migration"));
 					}
 					fs.writeFileSync(newestMigrationFile, migrationContent, "utf-8");
-					const policiesFile = path.resolve(process.cwd(), "drizzle", "policies.sql");
+					const policiesFile = path.join(generatedSqlDir(), "policies.sql");
 					if (fs.existsSync(policiesFile)) {
 						const policiesContent = fs.readFileSync(policiesFile, "utf-8");
 						fs.appendFileSync(newestMigrationFile, "\n\n" + RLS_BOOTSTRAP_SQL + "\n" + policiesContent);
@@ -1101,7 +1091,10 @@ async function dbCommand(subcommand, rawArgs) {
 		} catch (err) {
 			outWarn(chalk.yellow(`  ⚠️  Failed to append policies or re-hash migration: ${err instanceof Error ? err.message : String(err)}`));
 		}
-		if (!wroteNewMigration) out(chalk.gray("  ℹ No migration written — nothing in this change is visible to Atlas.\n    Search, vector, trigger and RLS DDL are applied by `rebase db push`, and at\n    boot by the schema ensure. For a migration-only deployment, add\n    drizzle/search.sql, drizzle/vector.sql, drizzle/triggers.sql and\n    drizzle/policies.sql to a migration by hand."));
+		if (!wroteNewMigration) out(chalk.gray(`  ℹ No migration written — nothing in this change is visible to Atlas.
+    Search, vector, trigger and RLS DDL are applied by \`rebase db push\`, and at
+    boot by the schema ensure. For a migration-only deployment, add
+    ${GENERATED_SQL_DIR}/search.sql, vector.sql, triggers.sql and\n    policies.sql to a migration by hand.`));
 		out("");
 		out(`  You can now run ${chalk.bold.green("rebase db migrate")} to apply the migrations to your database.`);
 		out("");
@@ -1123,17 +1116,20 @@ async function dbCommand(subcommand, rawArgs) {
 			const plan = await runAtlas("schema", [
 				"apply",
 				"--to",
-				"file://drizzle/schema.sql",
+				DESIRED_STATE_URL,
 				"--dry-run"
 			], collectionsPath, { captureStdout: true });
 			const destructive = detectDestructiveStatements(plan, databaseUrl ? await queryColumnTypes(databaseUrl) : []);
+			const unreadable = destructive.some((d) => d.kind === "UNREADABLE PLAN");
+			const planStatements = extractPlanStatements(plan);
+			const planListing = unreadable ? plan.trim() : planStatements.map((statement) => `${statement};`).join("\n");
 			const { managed: rebuildable, foreign: unowned } = partitionByOwnership(databaseUrl ? findGeneratedColumnConflicts(parseColumnMutations(plan), await queryGeneratedColumnDependencies(databaseUrl)) : [], collectionsPath ? await getSearchExcludes(collectionsPath) : []);
 			if (dryRun) {
 				out(chalk.gray("  Step 3/3: --dry-run — nothing was applied."));
 				out("");
-				if (plan.trim()) {
+				if (planStatements.length > 0 || unreadable) {
 					out(chalk.bold("  Planned changes:"));
-					out(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+					out(chalk.gray(planListing.split("\n").map((l) => `       ${l}`).join("\n")));
 				} else out(chalk.green("  ✓ No changes: the database already matches these collections."));
 				out("");
 				if (rebuildable.length > 0) {
@@ -1171,7 +1167,7 @@ async function dbCommand(subcommand, rawArgs) {
 				for (const d of destructive) outWarn(chalk.red(`       ${d.kind}${d.detail ? ` (${d.detail})` : ""}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
 				outWarn("");
 				outWarn(chalk.yellow("  Full planned changes:"));
-				outWarn(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+				outWarn(chalk.gray(planListing.split("\n").map((l) => `       ${l}`).join("\n")));
 				outWarn("");
 				if (decision === "refuse") {
 					outError(chalk.red("  ✗ Aborting: destructive changes require confirmation."));
@@ -1193,9 +1189,9 @@ async function dbCommand(subcommand, rawArgs) {
 				await runAtlas("schema", [
 					"apply",
 					"--to",
-					"file://drizzle/schema.sql",
+					DESIRED_STATE_URL,
 					"--auto-approve"
-				], collectionsPath);
+				], collectionsPath, { throwOnFailure: true });
 			} catch (err) {
 				if (rebuildable.length > 0 && databaseUrl) {
 					out(chalk.gray("  The apply failed — rebuilding the generated columns it needed out of the way."));
@@ -1205,6 +1201,7 @@ async function dbCommand(subcommand, rawArgs) {
 			}
 			out("");
 			if (databaseUrl) {
+				await lockManagedTables(databaseUrl, collectionsPath);
 				await ensureAuthTables(databaseUrl, collectionsPath);
 				await applyVectorDdl(databaseUrl);
 				await applySearchDdl(databaseUrl);
@@ -1248,6 +1245,58 @@ async function ensureAuthSchemaAndFunctions(databaseUrl) {
 	}
 }
 /**
+* Switch row-level security on for every table the collections declare, right
+* after Atlas has applied the schema.
+*
+* Atlas cannot carry `ENABLE ROW LEVEL SECURITY` in `schema.sql`: its free tier
+* neither plans it nor reads it back, so a table it creates is born with RLS
+* off — and `rebase_user`, the role every authenticated request runs as, holds
+* DML on it from that moment through the schema's default privileges. RLS used
+* to arrive with the policies, the last step of the push; a refusal from the
+* vector, search or trigger step in between left the new table readable and
+* writable by every caller, with no policy, until a later push or boot fixed
+* it — and a deployment with `REBASE_MIGRATE_ON_BOOT=none` never did. Locked
+* first, a failure later leaves a table that denies, not one that is open.
+*
+* Fatal when a table cannot be locked, and before the steps that follow: the
+* role provisioning at the end re-grants on every table in the schema, which
+* would undo the revoke that is the fallback here.
+*/
+async function lockManagedTables(databaseUrl, collectionsPath) {
+	let unsecured;
+	let userRole;
+	try {
+		const { lockCollectionTables } = await import("./ensure-collection-policies-B1ureSIV.js");
+		const { loadCollections } = await import("./doctor-C-sYWbmt.js").then((n) => n.t);
+		userRole = (await import("./rls-enforcement-CfXOJJaW.js").then((n) => n.o)).REBASE_USER_ROLE;
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		const { Client } = await import("pg");
+		const client = new Client({ connectionString: databaseUrl });
+		await client.connect();
+		try {
+			({unsecured} = await lockCollectionTables({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		outError(chalk.red(`\n  ✗ The schema was applied, but row-level security could not be switched on for its tables: ${err instanceof Error ? err.message : String(err)}`));
+		outError(chalk.gray("    A table this push created may be readable and writable by every authenticated request\n    until it is. Re-run `rebase db push` — it locks every collection table before anything else."));
+		process.exit(1);
+	}
+	if (unsecured.length === 0) return;
+	outError(chalk.red("\n  ✗ The schema was applied, but row-level security could not be switched on for:"));
+	for (const u of unsecured) {
+		outError(chalk.red(`      ${u.table}: ${u.error}`));
+		outError(chalk.gray(u.grantWithdrawn ? `        Its privileges were taken back from ${userRole}, so it is unreachable rather than unprotected.` : `        ${userRole} still holds its privileges: every authenticated request can read and write every row.`));
+	}
+	outError(chalk.gray("    Nothing after the schema apply ran. Fix the cause — the connection role must own these\n    tables, or be able to ALTER them — and run `rebase db push` again, or as their owner:"));
+	for (const u of unsecured) {
+		const [schema, ...table] = u.table.split(".");
+		outError(chalk.bold(`      ALTER TABLE "${schema}"."${table.join(".")}" ENABLE ROW LEVEL SECURITY;`));
+	}
+	process.exit(1);
+}
+/**
 * Create the framework auth tables (e.g. `rebase.users`) that the generated RLS
 * policies reference, before `applyPolicies` runs. Mirrors what the server does
 * at boot (`PostgresBootstrapper.initializeAuth` → `ensureAuthTablesExist`).
@@ -1261,8 +1310,8 @@ async function ensureAuthSchemaAndFunctions(databaseUrl) {
 async function ensureAuthTables(databaseUrl, collectionsPath) {
 	try {
 		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const { ensureAuthTablesExist } = await import("./ensure-tables-Dhn9KM3B.js").then((n) => n.n);
-		const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
+		const { ensureAuthTablesExist } = await import("./ensure-tables-BmI_tRxc.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-C-sYWbmt.js").then((n) => n.t);
 		const { Client } = await import("pg");
 		const authCollection = (await loadCollections(path.resolve(process.cwd(), collectionsPath))).find((c) => {
 			const a = c.auth;
@@ -1289,7 +1338,7 @@ async function ensureRlsUserRole(databaseUrl) {
 	const schemas = ["public", "rebase"];
 	let rls;
 	try {
-		rls = await import("./rls-enforcement-C6Xk0lA6.js").then((n) => n.a);
+		rls = await import("./rls-enforcement-CfXOJJaW.js").then((n) => n.o);
 	} catch (err) {
 		outError(chalk.red(`\n  ✗ Could not load the RLS provisioning module: ${err instanceof Error ? err.message : String(err)}`));
 		return;
@@ -1338,7 +1387,7 @@ async function retireLegacyAuthSchema(databaseUrl) {
 }
 async function applyPolicies(databaseUrl) {
 	try {
-		const policiesPath = path.resolve(process.cwd(), "drizzle", "policies.sql");
+		const policiesPath = path.join(generatedSqlDir(), "policies.sql");
 		if (!fs.existsSync(policiesPath)) return;
 		out(chalk.gray("  Step 3/3: Applying RLS policies to database..."));
 		out("");
@@ -1374,8 +1423,8 @@ async function applyPolicies(databaseUrl) {
 */
 async function reconcilePolicies(databaseUrl, collectionsPath) {
 	try {
-		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-DljYdrpW.js").then((n) => n.a);
-		const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
+		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-B-J2hhm0.js").then((n) => n.a);
+		const { loadCollections } = await import("./doctor-C-sYWbmt.js").then((n) => n.t);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		const { Client } = await import("pg");
 		const client = new Client({ connectionString: databaseUrl });
@@ -1457,7 +1506,7 @@ async function branchCommand(rawArgs) {
 		process.exit(1);
 	}
 	const { DatabasePoolManager } = await import("./databasePoolManager-Bj5FbeAs.js").then((n) => n.n);
-	const { BranchService } = await import("./BranchService-DGPL6G_C.js").then((n) => n.n);
+	const { BranchService } = await import("./BranchService-BRt78gfa.js").then((n) => n.n);
 	const { drizzle } = await import("drizzle-orm/node-postgres");
 	const { Pool } = await import("pg");
 	const pool = new Pool({
@@ -1816,6 +1865,7 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 			latestMigrationVersion: latestMigrationVersion()
 		}) ?? diagnoseDbError({ message: stderrText }, databaseUrl);
 		if (hint) outError(hint);
+		if (opts.throwOnFailure) throw Object.assign(/* @__PURE__ */ new Error(`atlas ${domain} ${args.join(" ")} failed`), { alreadyReported: true });
 		process.exit(1);
 	}
 	if (opts.captureStdout) return stdoutText.trim().length > 0 ? stdoutText : stderrText;
@@ -1837,7 +1887,11 @@ async function generatePostgresDdlCommand(rawArgs) {
 		process.exit(1);
 	}
 	const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
-	const outputPath = argsList["--output"] || path.join("drizzle", "schema.sql");
+	const outputPath = argsList["--output"] || path.join(".rebase/sql", "schema.sql");
+	if (!argsList["--output"]) {
+		const retired = prepareGeneratedSqlDir();
+		if (retired.length > 0) out(chalk.gray(`  Generated SQL is written to ${GENERATED_SQL_DIR}/ now, which is not committed. Removed the old copies — commit the deletion:\n    ${retired.join(", ")}`));
+	}
 	const cmdParts = [
 		ddl.bin,
 		ddl.script,
@@ -1889,9 +1943,9 @@ async function schemaStaleCommand(rawArgs) {
 	const schemaFile = path.resolve(process.cwd(), outputPath);
 	const fix = Boolean(argsList["--fix"]);
 	const generatedExists = fs.existsSync(schemaFile);
-	const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
+	const { loadCollections } = await import("./doctor-C-sYWbmt.js").then((n) => n.t);
 	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-Di9c4ZxN.js").then((n) => n.r);
-	const { generateSchema } = await import("./generate-drizzle-schema-logic-BfzK7UQd.js").then((n) => n.n);
+	const { generateSchema } = await import("./generate-drizzle-schema-logic-sSFDp6LR.js").then((n) => n.n);
 	const { relationalCollections } = await import("@rebasepro/common");
 	let stale = [];
 	let differences = [];