@rebasepro/server-postgres 0.23.0 → 0.24.1-canary.g56af4a4

package/dist/schema/collection-index.d.ts

@@ -71,6 +71,16 @@ export interface CollectionIndexSpec {
     reason: string;
     /** Derived by {@link deriveIndexName}. Frozen — see the module comment. */
     indexName: string;
+    /**
+     * Set when Rebase derived this index for a foreign key rather than anybody
+     * declaring it — see {@link foreignKeyIndexSpec}. Never enters the name, so
+     * the derived index and a declared one over the same column are one object.
+     *
+     * Read by exactly one consumer: boot-ensure, which builds these in the
+     * background on a table that already exists instead of holding the boot
+     * for the build. Every renderer treats them like any other index.
+     */
+    derived?: "foreign-key";
 }
 /**
  * A declaration that cannot become an index.
@@ -189,3 +199,38 @@ export declare const buildCollectionIndexPlan: (collections: readonly Collection
  * is a second order the moment either is edited.
  */
 export declare const sortIndexSpecs: (specs: readonly CollectionIndexSpec[]) => CollectionIndexSpec[];
+/**
+ * The `reason` a derived foreign-key index carries. Never part of the name —
+ * see {@link indexFingerprint} — so rewording it renames nothing.
+ */
+export declare const FOREIGN_KEY_INDEX_REASON = "Derived for a foreign key: Postgres indexes the key a constraint points at, never the column holding it.";
+/**
+ * Whether an index already serves an equality lookup on `column` alone.
+ *
+ * A btree whose *leading* key is the column does, unique or not — that is the
+ * prefix rule, and it is why a composite `(author_id, created_at)` makes a
+ * second index on `author_id` pure write amplification. A partial index does
+ * not: it serves only the rows its predicate admits, and a foreign-key lookup
+ * has to reach every row. Nor does GIN or BRIN, which answer different
+ * questions than "the rows whose key is one of these".
+ */
+export declare const leadsWithColumn: (spec: Pick<CollectionIndexSpec, "method" | "predicate" | "keys">, column: string) => boolean;
+/**
+ * The btree a foreign-key column gets when nothing else already leads with it.
+ *
+ * Postgres creates the index a foreign key *references* (the target's primary
+ * key) and never the one on the column *holding* it. Every read from the other
+ * side of the link filters on that column — a `hasMany`/`hasOne` include, a
+ * nested listing (`/authors/5/posts`, page and count), the reverse side of a
+ * many-to-many — and so does the `ON DELETE` check when a target row goes. With
+ * no index each of those is a sequential scan of the child table: measured at
+ * 13 ms for 25 parents over 100k children, and about 250 ms per nested listing
+ * at a million.
+ *
+ * Named by {@link deriveIndexName} like every other index, so it is a
+ * Rebase-managed name (`_ix_<fingerprint>`), it is in the Atlas diff, and it
+ * is byte-for-byte the name an author's own plain index on the column would
+ * derive. That identity is what makes the derived index and a declared one the
+ * same object rather than two.
+ */
+export declare const foreignKeyIndexSpec: (schema: string, table: string, column: string) => CollectionIndexSpec;

package/dist/schema/column-plan-helpers.d.ts

@@ -16,9 +16,9 @@
  * this is where they belong.
  *
  * Everything here is pure and synchronous, and it throws rather than guesses:
- * an enum with no values, a `cuid` id on Postgres and a second `isId` are all
- * configurations that produce a broken database in silence, so they are refused
- * where every path passes.
+ * an enum with no values, a `cuid` id on Postgres and a foreign key into a
+ * composite key are all configurations that produce a broken database in
+ * silence, so they are refused where every path passes.
  */
 import type { CollectionConfig, Property } from "@rebasepro/types";
 /**
@@ -29,21 +29,14 @@ import type { CollectionConfig, Property } from "@rebasepro/types";
  */
 export declare const resolveColumnName: (propName: string, prop?: Property | null) => string;
 /**
- * Refuse a collection that declares two primary keys.
+ * The properties marked `isId`, in declaration order.
  *
- * Postgres allows a composite primary key; Rebase does not model one, and the
- * three emitters each invented a different wrong answer for it. The Drizzle
- * generator appended `.primaryKey()` to both columns (two primary keys, which
- * drizzle-kit turns into an error at push time), the DDL generator wrote two
- * inline `PRIMARY KEY` clauses in one `CREATE TABLE` (Postgres: "multiple
- * primary keys for table are not allowed"), and boot-ensure created the table
- * with the *first* id column and silently never added the second — so a managed
- * tenant got a table missing a column its own collection reads.
- *
- * None of those is recoverable at runtime, and two of them fail long after the
- * config was written. Refused here instead, where the collection has a name.
+ * Several of them are one composite primary key: the table carries a single
+ * `PRIMARY KEY (a, b)` constraint over their columns, and a row's address lists
+ * the parts in this same order (`buildCompositeId`), which is the order the
+ * admin reads them in too.
  */
-export declare const assertSinglePrimaryKey: (collection: CollectionConfig) => void;
+export declare const primaryKeyPropertyNames: (collection: CollectionConfig) => string[];
 /**
  * A collection's primary key, by both of its names.
  *
@@ -64,11 +57,30 @@ export interface PrimaryKey {
     /** The declaring property; absent for the implicit `id TEXT` of a collection that declares none. */
     prop?: Property;
 }
-export declare const getPrimaryKeyProp: (collection: CollectionConfig) => PrimaryKey;
-/** The primary key's property key. What a Drizzle relation's `references` names. */
-export declare const getPrimaryKeyName: (collection: CollectionConfig) => string;
-/** The primary key's column. What a foreign key's `REFERENCES` names. */
-export declare const getPrimaryKeyColumn: (collection: CollectionConfig) => string;
+/**
+ * The one column a link into this collection points at.
+ *
+ * A foreign key column references a single column, and Postgres only accepts
+ * that column when it is unique on its own — `REFERENCES t (a)` against a
+ * composite key `(a, b)` fails with "there is no unique constraint matching
+ * given keys for referenced table". So a link into a collection whose key
+ * spans several columns has no column to point at, and it is refused here,
+ * naming the link, rather than emitted as a constraint `db push` or boot would
+ * then fail to create.
+ *
+ * @param via the link that needs the column, for the refusal: `relation "posts.author"`.
+ */
+export declare const getPrimaryKeyProp: (collection: CollectionConfig, via: string) => PrimaryKey;
+/**
+ * The primary key's property key. What a Drizzle relation's `references`
+ * names. Refused on the same terms as {@link getPrimaryKeyProp}.
+ */
+export declare const getPrimaryKeyName: (collection: CollectionConfig, via: string) => string;
+/**
+ * The primary key's column. What a foreign key's `REFERENCES` names. Refused
+ * on the same terms as {@link getPrimaryKeyProp}.
+ */
+export declare const getPrimaryKeyColumn: (collection: CollectionConfig, via: string) => string;
 export declare const isIdProperty: (propName: string, prop: Property, collection: CollectionConfig) => boolean;
 /**
  * The labels an `enum` declares, in order, whichever form it was written in.
@@ -142,3 +154,8 @@ export type IdColumnDefault =
  * write itself in one line of SQL.
  */
 export declare const idColumnDefault: (propName: string, prop: Property, collection: CollectionConfig) => IdColumnDefault | undefined;
+/**
+ * The SQL inside a template-form expression (``sql`now()` `` → `now()`); a
+ * bare expression is returned as it is.
+ */
+export declare const sqlExpressionText: (value: string) => string;

package/dist/schema/deferred-index-build.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Building the indexes a live table is missing — or holds INVALID — without
+ * holding anything up: the derived foreign-key indexes, and the declared,
+ * search and vector ones the boot-time ensure finds missing on a table that
+ * already exists.
+ *
+ * ## Why not a boot action like an index on a new table
+ *
+ * A table that already exists may hold millions of rows, and an index over
+ * them takes minutes to build. Boot-ensure's actions run before the server
+ * listens, so an index planned there is minutes of a deployment not serving —
+ * on the first boot after an upgrade that adds one to every `belongsTo` in the
+ * project, that is every large table at once. So these are planned apart
+ * (`DeferredIndexBuild`) and built here, after the boot, one at a time. A
+ * UNIQUE one is the exception: `ensureCollectionTables` builds it here too, but
+ * before it returns.
+ *
+ * ## The build
+ *
+ * `CREATE INDEX CONCURRENTLY`, outside any transaction (Postgres refuses it
+ * inside one), on a connection of its own with `statement_timeout` lifted: the
+ * pool's 30 s would cancel any build worth deferring. `CONCURRENTLY` takes
+ * `SHARE UPDATE EXCLUSIVE`, which conflicts with no read and no write — only
+ * with other DDL, `VACUUM` and `ANALYZE` — so live traffic never queues behind
+ * it, however long it runs.
+ *
+ * The boot's lock budget still applies, to the one wait that matters: getting
+ * the table at all. A table something else holds — another instance's build,
+ * an `ALTER TABLE`, a `VACUUM FULL` — is probed for `BOOT_LOCK_TIMEOUT_MS` at a
+ * time within the boot's retry budget, and left for the next boot when it
+ * stays held. Once the build has the table, it waits for the transactions
+ * already running against it with no deadline: a timeout there would only turn
+ * a slow build into a failed one.
+ *
+ * ## The husk a failed build leaves
+ *
+ * A cancelled `CONCURRENTLY` — a timeout, a killed process, a deploy that
+ * replaced the pod mid-build, two instances racing on one name — leaves the
+ * index behind marked `indisvalid = false`: maintained on every write, used by
+ * no query. And `IF NOT EXISTS` is a *name* check, so every later attempt
+ * skips it and reports success. This reads `pg_index` instead: an invalid index
+ * under our name is dropped (`DROP INDEX CONCURRENTLY`) and built again, once.
+ * One that another backend is still building (`pg_stat_progress_create_index`)
+ * is left to it.
+ *
+ * Nothing here is fatal. A failure is logged with the index named and the
+ * reason, and the next boot plans the index again.
+ */
+import type { Pool } from "pg";
+import { type DeferredIndexBuild } from "./plan/diff-plan.js";
+import { type BootLockOptions } from "./boot-ddl.js";
+/**
+ * A connection the builder may hold for as long as an index takes.
+ *
+ * `dedicated` says whether consecutive queries reach the same backend. Only
+ * then can a session setting be relied on — and be reset afterwards: on a
+ * pool, `SET statement_timeout = 0` would land on whichever connection served
+ * it and stay there for the next request to inherit.
+ */
+export interface IndexBuildSession {
+    query<T = unknown>(sql: string): Promise<{
+        rows: T[];
+    }>;
+    readonly dedicated: boolean;
+    /** Hand the connection back. Called once, after the last index. */
+    release(): void | Promise<void>;
+}
+export type OpenIndexBuildSession = () => Promise<IndexBuildSession>;
+/** A `pg.Pool` — what `connect()` checks a client out of — and not a `pg.Client`, whose `connect()` opens a socket. */
+export declare const isPgPool: (value: unknown) => value is Pick<Pool, "connect" | "totalCount">;
+/**
+ * Sessions checked out of a `pg.Pool`, one connection each.
+ *
+ * Its own connection rather than the pool's next free one, because a build
+ * has to outlive both of a pool's timeouts: the server-side
+ * `statement_timeout` (30 s on this framework's pools), which the builder
+ * lifts for the session — something it may only do on a connection nobody
+ * else is handed until it is reset — and the client-side read timeout, which
+ * is lifted here per query.
+ */
+export declare const poolIndexBuildSession: (pool: Pick<Pool, "connect">) => OpenIndexBuildSession;
+export interface DeferredIndexOptions extends BootLockOptions {
+    /** Progress, one line per index. Failures are also `logger.warn`ed. */
+    log?: (message: string) => void;
+    /** Checked between indexes; once true, nothing further is started. */
+    cancelled?: () => boolean;
+}
+export interface DeferredIndexOutcome {
+    /** `schema.index` this run built. */
+    built: string[];
+    /** Left alone, and why — already valid, or another instance is on it. */
+    skipped: {
+        index: string;
+        reason: string;
+    }[];
+    /** Not built. Logged; the next boot plans them again. */
+    failed: {
+        index: string;
+        error: string;
+    }[];
+}
+/** Why an index is skipped while a build of another index holds its table. */
+export declare const TABLE_BUSY_REASON = "another index on the table is being built";
+/**
+ * Build every deferred index, one at a time, on one connection.
+ *
+ * Never throws for an index: each failure is recorded and the next one is
+ * attempted. Throws only when no connection can be had at all.
+ */
+export declare function buildDeferredIndexes(openSession: OpenIndexBuildSession, indexes: readonly DeferredIndexBuild[], options?: DeferredIndexOptions): Promise<DeferredIndexOutcome>;
+/**
+ * Start {@link buildDeferredIndexes} later, in the background.
+ *
+ * `start()` begins it after `delayMs`; the fallback timer begins it after
+ * `fallbackMs` if nothing calls `start()` — so a process whose boot never
+ * reaches the step that would have started it still builds. Both timers are
+ * unref'd: a pending build never keeps a process alive, and a process that
+ * exits mid-build leaves a husk the next boot rebuilds.
+ */
+export interface ScheduledIndexBuild {
+    /** Begin after the schedule's `delayMs`, instead of waiting for the fallback timer. */
+    start(): void;
+    /** Start nothing further. An index already building runs to completion. */
+    cancel(): void;
+    /** Settles when the run ends — `undefined` if it never ran or could not open a connection. */
+    done: Promise<DeferredIndexOutcome | undefined>;
+}
+export declare function scheduleDeferredIndexBuild(openSession: OpenIndexBuildSession, indexes: readonly DeferredIndexBuild[], options?: DeferredIndexOptions & {
+    delayMs?: number;
+    fallbackMs?: number;
+}): ScheduledIndexBuild;

package/dist/schema/destructive-sql.d.ts

@@ -9,13 +9,17 @@
  * here, and refuse to auto-approve anything destructive without an explicit
  * opt-in.
  *
- * A type change is the one destructive plan that names no DROP. `ALTER COLUMN
+ * A type change is a destructive plan that names no DROP. `ALTER COLUMN
  * "price" TYPE integer` rounds every 19.99 to 20, and `TYPE date` throws away
  * every timestamp's time of day, in a statement that reads like a routine
  * alter. So a type change is gated too, unless it is a widening every value
  * survives unchanged — which needs the column's current type, read from the
  * catalogue by the caller.
  *
+ * A primary key change names no DROP of data either: `DROP CONSTRAINT
+ * "<table>_pkey", ADD PRIMARY KEY ("id", "locale")` keeps every value and
+ * gives every row a new address. It is gated like a drop.
+ *
  * Everything in this file is side-effect free so it can be unit-tested
  * without Atlas or a database.
  */
@@ -26,6 +30,19 @@
  * plan, so a naive split is safe and keeps this dependency-free.
  */
 export declare function splitSqlStatements(sql: string): string[];
+/**
+ * The statements of an Atlas plan, each exactly once, without Atlas's
+ * rendering and without the trailing `;`. See {@link readPlan} for the shape
+ * it reads; `test/fixtures/atlas-dry-run/` holds real captures of it.
+ */
+export declare function extractPlanStatements(plan: string): string[];
+/**
+ * Whether Atlas answered the dry-run with "Schema is synced" and nothing else.
+ *
+ * Positive evidence only: an empty or unreadable report also yields no
+ * statements, and is not the same answer.
+ */
+export declare function isSyncedPlan(plan: string): boolean;
 export interface DestructiveStatement {
     /** The offending statement (trimmed, without the trailing `;`). */
     statement: string;
@@ -62,6 +79,15 @@ export declare const COLUMN_TYPES_SQL = "\n    SELECT n.nspname AS \"schema\",\n
  * whether the change keeps its values.
  */
 export declare function detectDestructiveStatements(planSql: string, columnTypes?: readonly ExistingColumnType[]): DestructiveStatement[];
+/**
+ * The statement from its `ALTER TABLE` on, wherever on a line that starts.
+ *
+ * {@link readPlan} hands over clean statements. This is the second line of
+ * defence for text it could not clean — a rendering it does not know yet —
+ * where a line of prose above the statement must not hide the statement, which
+ * is exactly how an anchored match once read Atlas's whole plan as safe.
+ */
+export declare function fromAlterTable(statement: string): string;
 /**
  * Is `ALTER COLUMN … TYPE to` a widening, one that keeps every value exactly
  * as it was?

package/dist/schema/doctor-cli.js

@@ -1,11 +1,14 @@
 #!/usr/bin/env node
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { i as diagnoseDbError } from "../cli-errors-B8qHg02P.js";
-import { o as validatePolicyPgRoles, s as warnOnAnonymousGrants } from "../rls-enforcement-C6Xk0lA6.js";
-import { t as chalk } from "../source-Br7L7GOI.js";
-import { n as loadCollections, r as runDoctor } from "../doctor-Cb2thZ8s.js";
-import { n as formatPolicyDrift, r as hasDrift, t as checkPolicyDrift } from "../policy-drift-DljYdrpW.js";
+import { a as buildSearchColumnSpec } from "../search-column-BM-GV6vH.js";
+import { i as diagnoseDbError } from "../cli-errors-CaI4ntyD.js";
+import { l as validatePolicyPgRoles, u as warnOnAnonymousGrants } from "../rls-enforcement-DvzqlaL1.js";
+import { n as describeFailure, t as chalk } from "../source-DBDbBTL4.js";
+import { n as loadCollections, r as runDoctor } from "../doctor-C4WiftHm.js";
+import { n as formatPolicyDrift, r as hasDrift, t as checkPolicyDrift } from "../policy-drift-Dm8i-s1J.js";
+import { isPostgresCollectionConfig } from "@rebasepro/types";
+import { getTableName, relationalCollections } from "@rebasepro/common";
 import path from "path";
 //#region src/schema/doctor-policy-checks.ts
 /**
@@ -80,6 +83,106 @@ async function runPolicyChecks(collectionsPath, databaseUrl) {
 	return problems ? "problems" : "ok";
 }
 //#endregion
+//#region src/schema/doctor-search-scale.ts
+/**
+* `rebase doctor`: collections searched by a full scan of a large table.
+*
+* Without a `search` block, a search — the admin's search box, `?searchString=`,
+* `.search()` — is `ILIKE '%term%'` over every text column. A leading `%`
+* defeats a B-tree, so each one reads the whole table: on 100k posts a search
+* took 326 ms, half for the page and half for its count. Nothing reports it;
+* the box just gets slower as the table grows. This names the collections
+* where that has started to matter, and points at the block that fixes it.
+*
+* A hint, not a failure: it never changes doctor's exit code, and the database
+* is not changed — Rebase does not add a search index on its own.
+*
+* Lives beside `doctor-cli.ts` rather than inside it because that file runs
+* `main()` on import.
+*/
+/** Above this many rows an unindexed search is worth a word. */
+var UNINDEXED_SEARCH_ROWS = 1e4;
+/**
+* The collections a search reaches without an index: no `search` block (or
+* one that does not build), and at least one property the default search
+* reads — a `string`, not an enum, not a uuid key (the rule in
+* `DrizzleConditionBuilder.buildSearchConditions`).
+*/
+function ilikeSearchedCollections(collections) {
+	const found = [];
+	for (const collection of relationalCollections(collections)) {
+		if (!isPostgresCollectionConfig(collection)) continue;
+		let indexed;
+		try {
+			indexed = buildSearchColumnSpec(collection) !== void 0;
+		} catch {
+			indexed = false;
+		}
+		if (indexed) continue;
+		const fields = Object.entries(collection.properties ?? {}).filter(([, property]) => property.type === "string" && !property.enum && property.isId !== "uuid").map(([key]) => key);
+		const table = getTableName(collection);
+		if (fields.length === 0 || !table) continue;
+		found.push({
+			slug: collection.slug,
+			schema: collection.schema ?? "public",
+			table,
+			fields
+		});
+	}
+	return found;
+}
+/** Those of `candidates` whose table holds more than `threshold` rows, by estimate. */
+function unindexedSearchFindings(candidates, rowEstimates, threshold = UNINDEXED_SEARCH_ROWS) {
+	return candidates.map((candidate) => ({
+		...candidate,
+		rows: rowEstimates.get(`${candidate.schema}.${candidate.table}`) ?? 0
+	})).filter((candidate) => candidate.rows > threshold);
+}
+/**
+* Row counts by `schema.table`, estimated — `pg_class.reltuples`, or the
+* statistics collector's live-tuple count when the table was never analysed.
+* Nothing is scanned: counting the tables this is about would be the cost it
+* warns of.
+*/
+async function estimateRowCounts(query, schemas) {
+	const { rows } = await query(`SELECT n.nspname AS schema, c.relname AS table,
+                GREATEST(c.reltuples, COALESCE(s.n_live_tup, 0), 0)::bigint AS rows
+         FROM pg_class c
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+         LEFT JOIN pg_stat_user_tables s ON s.relid = c.oid
+         WHERE c.relkind IN ('r', 'p') AND n.nspname = ANY($1)`, [schemas]);
+	return new Map(rows.map((row) => [`${row.schema}.${row.table}`, Number(row.rows)]));
+}
+/** The report, one warning per collection. */
+function formatUnindexedSearches(findings) {
+	if (findings.length === 0) return [];
+	const lines = ["", chalk.yellow(`  ⚠ ${findings.length} collection(s) searched by reading the whole table:`)];
+	for (const finding of findings) lines.push(chalk.yellow(`     • ${finding.slug} — about ${finding.rows.toLocaleString("en-US")} rows, no \`search\` block: a search is ILIKE '%term%' over ${finding.fields.join(", ")}`));
+	lines.push(chalk.gray("    Each search reads every row, and its count reads them again. A `search` block indexes it\n    (full-text, or `mode: \"hybrid\"` for substrings too): https://rebase.pro/docs/backend/search"));
+	return lines;
+}
+/**
+* Print the warning for the project at `collectionsPath`, against
+* `databaseUrl`. Never throws and never fails the run: it is a hint, and a
+* check that could not run says so in one grey line.
+*/
+async function runSearchScaleCheck(collectionsPath, databaseUrl) {
+	if (!databaseUrl) return;
+	const { Client } = await import("pg");
+	const client = new Client({ connectionString: databaseUrl });
+	try {
+		const candidates = ilikeSearchedCollections(await loadCollections(path.resolve(process.cwd(), collectionsPath)));
+		if (candidates.length === 0) return;
+		await client.connect();
+		const estimates = await estimateRowCounts((text, values) => client.query(text, values), [...new Set(candidates.map((candidate) => candidate.schema))]);
+		for (const line of formatUnindexedSearches(unindexedSearchFindings(candidates, estimates))) console.log(line);
+	} catch (err) {
+		console.log(chalk.gray(`  ⏭ Search on large tables: not checked (${err instanceof Error ? err.message : String(err)})`));
+	} finally {
+		await client.end().catch(() => void 0);
+	}
+}
+//#endregion
 //#region src/schema/doctor-cli.ts
 /**
 * CLI entry point for `rebase doctor`.
@@ -111,6 +214,7 @@ async function main() {
 		databaseUrl: databaseUrl ?? void 0
 	});
 	const policyStatus = await runPolicyChecks(collectionsPath, databaseUrl);
+	await runSearchScaleCheck(collectionsPath, databaseUrl);
 	const blocked = [
 		report.collectionsToSchema,
 		report.schemaToDatabase,
@@ -121,7 +225,7 @@ async function main() {
 main().catch((err) => {
 	const banner = diagnoseDbError(err, process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING);
 	if (banner) console.error(banner);
-	else console.error(chalk.red("  ✗ Doctor failed"), err instanceof Error ? err.stack ?? err.message : String(err));
+	else console.error(chalk.red(`  ✗ Doctor failed: ${describeFailure(err)}`));
 	process.exit(1);
 });
 //#endregion

package/dist/schema/doctor-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-cli.js","names":[],"sources":["../../src/schema/doctor-policy-checks.ts","../../src/schema/doctor-cli.ts"],"sourcesContent":["/**\n * The RLS half of `rebase doctor`, and the exit code `--policies` gates CI on.\n *\n * Lives beside `doctor-cli.ts` rather than inside it because that file runs\n * `main()` on import: a gate whose failure modes cannot be unit-tested is how\n * this one shipped reporting success for work it never did.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { CollectionConfig } from \"@rebasepro/types\";\nimport { loadCollections } from \"./doctor\";\nimport { checkPolicyDrift, formatPolicyDrift, hasDrift } from \"../security/policy-drift\";\nimport { validatePolicyPgRoles, warnOnAnonymousGrants } from \"../security/rls-enforcement\";\n\n/**\n * What the RLS checks concluded.\n *\n * `unchecked` exists because \"we could not look\" and \"we looked and it is fine\"\n * used to be reported identically: a collections path that did not resolve made\n * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`\n * early-returned an empty diff, and the gate printed\n * `✓ RLS policies match your collections` having compared zero policies against\n * zero collections. Any exception at all — a collection file that throws on\n * import, a `pg_policies` read the CI role is not granted, a connection reset —\n * did the same thing through a `warn`, and exited 0.\n */\nexport type PolicyCheckStatus = \"ok\" | \"problems\" | \"unchecked\";\n\n/**\n * The exit code for `rebase doctor --policies`.\n *\n * A gate that could not run has not passed. Only a completed, clean check\n * exits 0 — anything else, including \"we never opened a connection\", is a\n * failure, or the flag certifies a database nobody looked at.\n */\nexport function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1 {\n    return status === \"ok\" ? 0 : 1;\n}\n\n/**\n * Policies actually deployed vs the ones the collections describe, plus policy\n * roles this server could never satisfy.\n *\n * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.\n */\nexport async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus> {\n    if (!databaseUrl) {\n        console.error(chalk.yellow(\"  ⚠ No DATABASE_URL — RLS policies were NOT checked\"));\n        return \"unchecked\";\n    }\n\n    const resolvedPath = path.resolve(process.cwd(), collectionsPath);\n    let problems = false;\n    const { Pool } = await import(\"pg\");\n    const pool = new Pool({ connectionString: databaseUrl });\n    try {\n        const collections: CollectionConfig[] = await loadCollections(resolvedPath);\n\n        // Zero collections is not \"no drift\", it is nothing to compare. The\n        // loader returns `[]` for a path that does not exist, so the commonest\n        // way to get here is a `--collections` path resolved against the wrong\n        // directory — which used to render as a green tick.\n        if (collections.length === 0) {\n            console.error(chalk.red(`  ✗ No collections found in ${resolvedPath}`));\n            console.error(chalk.gray(\"    RLS policies were NOT checked. Pass --collections=<dir> if your collections live elsewhere.\"));\n            return \"unchecked\";\n        }\n\n        const runSql = async (text: string) => (await pool.query(text)).rows as Record<string, unknown>[];\n\n        // Prove the connection before anything is ticked.\n        //\n        // `validatePolicyPgRoles` returns without a query when no collection\n        // names a `pgRoles` — which is most projects — so it \"passed\" against a\n        // database that was never reached, and the tick printed above an\n        // ECONNREFUSED that only surfaced two checks later. Ten lines up, this\n        // file says that reporting success for work it never did is the reason\n        // it exists. This is the same shape, one function along.\n        try {\n            await runSql(\"SELECT 1\");\n        } catch (err) {\n            console.error(chalk.gray(\"  ⏭ Policy roles: not checked\"));\n            console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n            return \"unchecked\";\n        }\n\n        // A policy naming a role the server never runs as filters every row, so\n        // the collection reads as empty. Report it without booting a server.\n        try {\n            await validatePolicyPgRoles(runSql, collections as never);\n            console.log(chalk.green(\"  ✓ Policy roles are usable by this server\"));\n        } catch (err) {\n            problems = true;\n            console.log(\"\");\n            console.error(chalk.red(err instanceof Error ? err.message : String(err)));\n        }\n\n        // A rule that reads as a lockdown but is true for every caller compiles\n        // to a grant. Report it without booting a server.\n        warnOnAnonymousGrants(collections as never);\n\n        const drift = await checkPolicyDrift(pool as never, collections);\n        console.log(\"\");\n        if (hasDrift(drift)) {\n            problems = true;\n            console.log(chalk.yellow(\"  RLS policies: database does not match your collections\"));\n            console.log(formatPolicyDrift(drift));\n        } else {\n            console.log(chalk.green(`  ✓ RLS policies match your collections (${collections.length} collection(s) checked)`));\n        }\n    } catch (err) {\n        // Fail closed. This catch covers every query and every collection import\n        // above, so returning the pre-catch verdict made the documented CI gate\n        // green on exactly the runs it exists to catch.\n        console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n        return \"unchecked\";\n    } finally {\n        await pool.end();\n    }\n    return problems ? \"problems\" : \"ok\";\n}\n","#!/usr/bin/env node\n/**\n * CLI entry point for `rebase doctor`.\n * Invoked via tsx by the server-postgres CLI plugin.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { runDoctor } from \"./doctor\";\nimport { exitCodeForPolicyGate, runPolicyChecks } from \"./doctor-policy-checks\";\nimport { diagnoseDbError } from \"../cli-errors\";\n\nasync function main() {\n    const collectionsArg = process.argv.find((a) => a.startsWith(\"--collections=\"));\n    const schemaArg = process.argv.find((a) => a.startsWith(\"--schema=\"));\n    const sdkArg = process.argv.find((a) => a.startsWith(\"--sdk=\"));\n    // --policies runs only the RLS checks: no schema diff, no SDK types. Useful\n    // as a CI gate against a deployed database, where the collection files and\n    // generated schema are not what you are asking about.\n    const policiesOnly = process.argv.includes(\"--policies\");\n\n    const collectionsPath = collectionsArg?.split(\"=\")[1] ?? path.join(\"..\", \"config\", \"collections\");\n    const schemaPath = schemaArg?.split(\"=\")[1] ?? path.join(\"src\", \"schema.generated.ts\");\n    const sdkPath = sdkArg?.split(\"=\")[1] ?? path.join(\"..\", \"generated\", \"sdk\", \"database.types.ts\");\n\n    // Load .env\n    try {\n        const dotenv = await import(\"dotenv\");\n        const envPath = process.env.DOTENV_CONFIG_PATH;\n        if (envPath) {\n            dotenv.config({ path: envPath, quiet: true });\n        } else {\n            dotenv.config({ quiet: true });\n        }\n    } catch {\n        // dotenv may not be installed\n    }\n\n    const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;\n\n    if (policiesOnly) {\n        // Non-zero so this can gate CI — the whole point of the flag, and a\n        // check that could not run has not passed. See exitCodeForPolicyGate.\n        process.exit(exitCodeForPolicyGate(await runPolicyChecks(collectionsPath, databaseUrl)));\n    }\n\n    const report = await runDoctor({\n        collectionsPath: path.resolve(process.cwd(), collectionsPath),\n        schemaPath: path.resolve(process.cwd(), schemaPath),\n        sdkPath: path.resolve(process.cwd(), sdkPath),\n        databaseUrl: databaseUrl ?? undefined\n    });\n\n    const policyStatus = await runPolicyChecks(collectionsPath, databaseUrl);\n\n    // Exit non-zero if there are errors. A policy run that could not happen is\n    // reported loudly above but does not fail the interactive command — the\n    // same treatment the *chosen* skip of the database phase gets. `--policies`\n    // is the gate, and that one fails closed.\n    //\n    // A phase that was skipped by a fault is different, and `blocked` is what\n    // separates the two: \"no DATABASE_URL\" is a local situation somebody may be\n    // content with, while \"the DATABASE_URL you set refuses connections\" would\n    // otherwise let `rebase doctor` go green in CI against a database it never\n    // reached.\n    const blocked = [report.collectionsToSchema, report.schemaToDatabase, report.collectionsToSdk]\n        .some(phase => phase.blocked);\n    if (report.summary.errors > 0 || policyStatus === \"problems\" || blocked) {\n        process.exit(1);\n    }\n}\n\nmain().catch((err) => {\n    // A known database failure has a diagnosis; a stack trace through pg and\n    // drizzle internals is not it. This is the last resort — `runDoctor`\n    // already catches the connection failure it can name — so it exists for\n    // everything reached after the report, the policy checks in particular.\n    const banner = diagnoseDbError(err, process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING);\n    if (banner) {\n        console.error(banner);\n    } else {\n        console.error(chalk.red(\"  ✗ Doctor failed\"), err instanceof Error ? (err.stack ?? err.message) : String(err));\n    }\n    process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAgB,sBAAsB,QAAkC;CACpE,OAAO,WAAW,OAAO,IAAI;AACjC;;;;;;;AAQA,eAAsB,gBAAgB,iBAAyB,aAAkD;CAC7G,IAAI,CAAC,aAAa;EACd,QAAQ,MAAM,MAAM,OAAO,qDAAqD,CAAC;EACjF,OAAO;CACX;CAEA,MAAM,eAAe,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;CAChE,IAAI,WAAW;CACf,MAAM,EAAE,SAAS,MAAM,OAAO;CAC9B,MAAM,OAAO,IAAI,KAAK,EAAE,kBAAkB,YAAY,CAAC;CACvD,IAAI;EACA,MAAM,cAAkC,MAAM,gBAAgB,YAAY;EAM1E,IAAI,YAAY,WAAW,GAAG;GAC1B,QAAQ,MAAM,MAAM,IAAI,+BAA+B,cAAc,CAAC;GACtE,QAAQ,MAAM,MAAM,KAAK,iGAAiG,CAAC;GAC3H,OAAO;EACX;EAEA,MAAM,SAAS,OAAO,UAAkB,MAAM,KAAK,MAAM,IAAI,EAAA,CAAG;EAUhE,IAAI;GACA,MAAM,OAAO,UAAU;EAC3B,SAAS,KAAK;GACV,QAAQ,MAAM,MAAM,KAAK,+BAA+B,CAAC;GACzD,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC9G,OAAO;EACX;EAIA,IAAI;GACA,MAAM,sBAAsB,QAAQ,WAAoB;GACxD,QAAQ,IAAI,MAAM,MAAM,4CAA4C,CAAC;EACzE,SAAS,KAAK;GACV,WAAW;GACX,QAAQ,IAAI,EAAE;GACd,QAAQ,MAAM,MAAM,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;EAC7E;EAIA,sBAAsB,WAAoB;EAE1C,MAAM,QAAQ,MAAM,iBAAiB,MAAe,WAAW;EAC/D,QAAQ,IAAI,EAAE;EACd,IAAI,SAAS,KAAK,GAAG;GACjB,WAAW;GACX,QAAQ,IAAI,MAAM,OAAO,0DAA0D,CAAC;GACpF,QAAQ,IAAI,kBAAkB,KAAK,CAAC;EACxC,OACI,QAAQ,IAAI,MAAM,MAAM,4CAA4C,YAAY,OAAO,wBAAwB,CAAC;CAExH,SAAS,KAAK;EAIV,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;EAC9G,OAAO;CACX,UAAU;EACN,MAAM,KAAK,IAAI;CACnB;CACA,OAAO,WAAW,aAAa;AACnC;;;;;;;AC7GA,eAAe,OAAO;CAClB,MAAM,iBAAiB,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,gBAAgB,CAAC;CAC9E,MAAM,YAAY,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC;CACpE,MAAM,SAAS,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,QAAQ,CAAC;CAI9D,MAAM,eAAe,QAAQ,KAAK,SAAS,YAAY;CAEvD,MAAM,kBAAkB,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,UAAU,aAAa;CAChG,MAAM,aAAa,WAAW,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,OAAO,qBAAqB;CACrF,MAAM,UAAU,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,aAAa,OAAO,mBAAmB;CAGhG,IAAI;EACA,MAAM,SAAS,MAAM,OAAO;EAC5B,MAAM,UAAU,QAAQ,IAAI;EAC5B,IAAI,SACA,OAAO,OAAO;GAAE,MAAM;GAAS,OAAO;EAAK,CAAC;OAE5C,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CAErC,QAAQ,CAER;CAEA,MAAM,cAAc,QAAQ,IAAI,gBAAgB,QAAQ,IAAI;CAE5D,IAAI,cAGA,QAAQ,KAAK,sBAAsB,MAAM,gBAAgB,iBAAiB,WAAW,CAAC,CAAC;CAG3F,MAAM,SAAS,MAAM,UAAU;EAC3B,iBAAiB,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;EAC5D,YAAY,KAAK,QAAQ,QAAQ,IAAI,GAAG,UAAU;EAClD,SAAS,KAAK,QAAQ,QAAQ,IAAI,GAAG,OAAO;EAC5C,aAAa,eAAe,KAAA;CAChC,CAAC;CAED,MAAM,eAAe,MAAM,gBAAgB,iBAAiB,WAAW;CAYvE,MAAM,UAAU;EAAC,OAAO;EAAqB,OAAO;EAAkB,OAAO;CAAgB,CAAC,CACzF,MAAK,UAAS,MAAM,OAAO;CAChC,IAAI,OAAO,QAAQ,SAAS,KAAK,iBAAiB,cAAc,SAC5D,QAAQ,KAAK,CAAC;AAEtB;AAEA,KAAK,CAAC,CAAC,OAAO,QAAQ;CAKlB,MAAM,SAAS,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,QAAQ,IAAI,uBAAuB;CACnG,IAAI,QACA,QAAQ,MAAM,MAAM;MAEpB,QAAQ,MAAM,MAAM,IAAI,mBAAmB,GAAG,eAAe,QAAS,IAAI,SAAS,IAAI,UAAW,OAAO,GAAG,CAAC;CAEjH,QAAQ,KAAK,CAAC;AAClB,CAAC"}
+{"version":3,"file":"doctor-cli.js","names":[],"sources":["../../src/schema/doctor-policy-checks.ts","../../src/schema/doctor-search-scale.ts","../../src/schema/doctor-cli.ts"],"sourcesContent":["/**\n * The RLS half of `rebase doctor`, and the exit code `--policies` gates CI on.\n *\n * Lives beside `doctor-cli.ts` rather than inside it because that file runs\n * `main()` on import: a gate whose failure modes cannot be unit-tested is how\n * this one shipped reporting success for work it never did.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { CollectionConfig } from \"@rebasepro/types\";\nimport { loadCollections } from \"./doctor\";\nimport { checkPolicyDrift, formatPolicyDrift, hasDrift } from \"../security/policy-drift\";\nimport { validatePolicyPgRoles, warnOnAnonymousGrants } from \"../security/rls-enforcement\";\n\n/**\n * What the RLS checks concluded.\n *\n * `unchecked` exists because \"we could not look\" and \"we looked and it is fine\"\n * used to be reported identically: a collections path that did not resolve made\n * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`\n * early-returned an empty diff, and the gate printed\n * `✓ RLS policies match your collections` having compared zero policies against\n * zero collections. Any exception at all — a collection file that throws on\n * import, a `pg_policies` read the CI role is not granted, a connection reset —\n * did the same thing through a `warn`, and exited 0.\n */\nexport type PolicyCheckStatus = \"ok\" | \"problems\" | \"unchecked\";\n\n/**\n * The exit code for `rebase doctor --policies`.\n *\n * A gate that could not run has not passed. Only a completed, clean check\n * exits 0 — anything else, including \"we never opened a connection\", is a\n * failure, or the flag certifies a database nobody looked at.\n */\nexport function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1 {\n    return status === \"ok\" ? 0 : 1;\n}\n\n/**\n * Policies actually deployed vs the ones the collections describe, plus policy\n * roles this server could never satisfy.\n *\n * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.\n */\nexport async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus> {\n    if (!databaseUrl) {\n        console.error(chalk.yellow(\"  ⚠ No DATABASE_URL — RLS policies were NOT checked\"));\n        return \"unchecked\";\n    }\n\n    const resolvedPath = path.resolve(process.cwd(), collectionsPath);\n    let problems = false;\n    const { Pool } = await import(\"pg\");\n    const pool = new Pool({ connectionString: databaseUrl });\n    try {\n        const collections: CollectionConfig[] = await loadCollections(resolvedPath);\n\n        // Zero collections is not \"no drift\", it is nothing to compare. The\n        // loader returns `[]` for a path that does not exist, so the commonest\n        // way to get here is a `--collections` path resolved against the wrong\n        // directory — which used to render as a green tick.\n        if (collections.length === 0) {\n            console.error(chalk.red(`  ✗ No collections found in ${resolvedPath}`));\n            console.error(chalk.gray(\"    RLS policies were NOT checked. Pass --collections=<dir> if your collections live elsewhere.\"));\n            return \"unchecked\";\n        }\n\n        const runSql = async (text: string) => (await pool.query(text)).rows as Record<string, unknown>[];\n\n        // Prove the connection before anything is ticked.\n        //\n        // `validatePolicyPgRoles` returns without a query when no collection\n        // names a `pgRoles` — which is most projects — so it \"passed\" against a\n        // database that was never reached, and the tick printed above an\n        // ECONNREFUSED that only surfaced two checks later. Ten lines up, this\n        // file says that reporting success for work it never did is the reason\n        // it exists. This is the same shape, one function along.\n        try {\n            await runSql(\"SELECT 1\");\n        } catch (err) {\n            console.error(chalk.gray(\"  ⏭ Policy roles: not checked\"));\n            console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n            return \"unchecked\";\n        }\n\n        // A policy naming a role the server never runs as filters every row, so\n        // the collection reads as empty. Report it without booting a server.\n        try {\n            await validatePolicyPgRoles(runSql, collections as never);\n            console.log(chalk.green(\"  ✓ Policy roles are usable by this server\"));\n        } catch (err) {\n            problems = true;\n            console.log(\"\");\n            console.error(chalk.red(err instanceof Error ? err.message : String(err)));\n        }\n\n        // A rule that reads as a lockdown but is true for every caller compiles\n        // to a grant. Report it without booting a server.\n        warnOnAnonymousGrants(collections as never);\n\n        const drift = await checkPolicyDrift(pool as never, collections);\n        console.log(\"\");\n        if (hasDrift(drift)) {\n            problems = true;\n            console.log(chalk.yellow(\"  RLS policies: database does not match your collections\"));\n            console.log(formatPolicyDrift(drift));\n        } else {\n            console.log(chalk.green(`  ✓ RLS policies match your collections (${collections.length} collection(s) checked)`));\n        }\n    } catch (err) {\n        // Fail closed. This catch covers every query and every collection import\n        // above, so returning the pre-catch verdict made the documented CI gate\n        // green on exactly the runs it exists to catch.\n        console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n        return \"unchecked\";\n    } finally {\n        await pool.end();\n    }\n    return problems ? \"problems\" : \"ok\";\n}\n","/**\n * `rebase doctor`: collections searched by a full scan of a large table.\n *\n * Without a `search` block, a search — the admin's search box, `?searchString=`,\n * `.search()` — is `ILIKE '%term%'` over every text column. A leading `%`\n * defeats a B-tree, so each one reads the whole table: on 100k posts a search\n * took 326 ms, half for the page and half for its count. Nothing reports it;\n * the box just gets slower as the table grows. This names the collections\n * where that has started to matter, and points at the block that fixes it.\n *\n * A hint, not a failure: it never changes doctor's exit code, and the database\n * is not changed — Rebase does not add a search index on its own.\n *\n * Lives beside `doctor-cli.ts` rather than inside it because that file runs\n * `main()` on import.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { getTableName, relationalCollections } from \"@rebasepro/common\";\nimport { isPostgresCollectionConfig, type CollectionConfig } from \"@rebasepro/types\";\nimport { loadCollections } from \"./doctor\";\nimport { buildSearchColumnSpec } from \"./search-column\";\n\n/** Above this many rows an unindexed search is worth a word. */\nexport const UNINDEXED_SEARCH_ROWS = 10_000;\n\n/** A collection whose search would be `ILIKE` over these fields. */\nexport interface IlikeSearchedCollection {\n    slug: string;\n    schema: string;\n    table: string;\n    /** The string properties the search reads. */\n    fields: string[];\n}\n\n/**\n * The collections a search reaches without an index: no `search` block (or\n * one that does not build), and at least one property the default search\n * reads — a `string`, not an enum, not a uuid key (the rule in\n * `DrizzleConditionBuilder.buildSearchConditions`).\n */\nexport function ilikeSearchedCollections(collections: CollectionConfig[]): IlikeSearchedCollection[] {\n    const found: IlikeSearchedCollection[] = [];\n    for (const collection of relationalCollections(collections)) {\n        if (!isPostgresCollectionConfig(collection)) continue;\n        let indexed: boolean;\n        try {\n            indexed = buildSearchColumnSpec(collection) !== undefined;\n        } catch {\n            // A block that does not build is reported by the boot; the search\n            // falls back to ILIKE meanwhile, so it counts as none here.\n            indexed = false;\n        }\n        if (indexed) continue;\n        const fields = Object.entries(collection.properties ?? {})\n            .filter(([, property]) => property.type === \"string\" && !property.enum && property.isId !== \"uuid\")\n            .map(([key]) => key);\n        const table = getTableName(collection);\n        if (fields.length === 0 || !table) continue;\n        found.push({ slug: collection.slug, schema: collection.schema ?? \"public\", table, fields });\n    }\n    return found;\n}\n\n/** Those of `candidates` whose table holds more than `threshold` rows, by estimate. */\nexport function unindexedSearchFindings(\n    candidates: IlikeSearchedCollection[],\n    rowEstimates: ReadonlyMap<string, number>,\n    threshold: number = UNINDEXED_SEARCH_ROWS\n): (IlikeSearchedCollection & { rows: number })[] {\n    return candidates\n        .map(candidate => ({ ...candidate, rows: rowEstimates.get(`${candidate.schema}.${candidate.table}`) ?? 0 }))\n        .filter(candidate => candidate.rows > threshold);\n}\n\n/**\n * Row counts by `schema.table`, estimated — `pg_class.reltuples`, or the\n * statistics collector's live-tuple count when the table was never analysed.\n * Nothing is scanned: counting the tables this is about would be the cost it\n * warns of.\n */\nexport async function estimateRowCounts(\n    query: (text: string, values: unknown[]) => Promise<{ rows: { schema: string; table: string; rows: string | number }[] }>,\n    schemas: string[]\n): Promise<Map<string, number>> {\n    const { rows } = await query(\n        `SELECT n.nspname AS schema, c.relname AS table,\n                GREATEST(c.reltuples, COALESCE(s.n_live_tup, 0), 0)::bigint AS rows\n         FROM pg_class c\n         JOIN pg_namespace n ON n.oid = c.relnamespace\n         LEFT JOIN pg_stat_user_tables s ON s.relid = c.oid\n         WHERE c.relkind IN ('r', 'p') AND n.nspname = ANY($1)`,\n        [schemas]\n    );\n    return new Map(rows.map(row => [`${row.schema}.${row.table}`, Number(row.rows)]));\n}\n\n/** The report, one warning per collection. */\nexport function formatUnindexedSearches(findings: (IlikeSearchedCollection & { rows: number })[]): string[] {\n    if (findings.length === 0) return [];\n    const lines = [\"\", chalk.yellow(`  ⚠ ${findings.length} collection(s) searched by reading the whole table:`)];\n    for (const finding of findings) {\n        lines.push(chalk.yellow(\n            `     • ${finding.slug} — about ${finding.rows.toLocaleString(\"en-US\")} rows, no \\`search\\` block: a search is ` +\n            `ILIKE '%term%' over ${finding.fields.join(\", \")}`\n        ));\n    }\n    lines.push(chalk.gray(\n        \"    Each search reads every row, and its count reads them again. A `search` block indexes it\\n\" +\n        \"    (full-text, or `mode: \\\"hybrid\\\"` for substrings too): https://rebase.pro/docs/backend/search\"\n    ));\n    return lines;\n}\n\n/**\n * Print the warning for the project at `collectionsPath`, against\n * `databaseUrl`. Never throws and never fails the run: it is a hint, and a\n * check that could not run says so in one grey line.\n */\nexport async function runSearchScaleCheck(collectionsPath: string, databaseUrl?: string): Promise<void> {\n    if (!databaseUrl) return;\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString: databaseUrl });\n    try {\n        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));\n        const candidates = ilikeSearchedCollections(collections);\n        if (candidates.length === 0) return;\n        await client.connect();\n        const estimates = await estimateRowCounts(\n            (text, values) => client.query(text, values),\n            [...new Set(candidates.map(candidate => candidate.schema))]\n        );\n        for (const line of formatUnindexedSearches(unindexedSearchFindings(candidates, estimates))) console.log(line);\n    } catch (err) {\n        console.log(chalk.gray(`  ⏭ Search on large tables: not checked (${err instanceof Error ? err.message : String(err)})`));\n    } finally {\n        await client.end().catch(() => undefined);\n    }\n}\n","#!/usr/bin/env node\n/**\n * CLI entry point for `rebase doctor`.\n * Invoked via tsx by the server-postgres CLI plugin.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { runDoctor } from \"./doctor\";\nimport { exitCodeForPolicyGate, runPolicyChecks } from \"./doctor-policy-checks\";\nimport { runSearchScaleCheck } from \"./doctor-search-scale\";\nimport { diagnoseDbError } from \"../cli-errors\";\nimport { describeFailure } from \"../cli-output\";\n\nasync function main() {\n    const collectionsArg = process.argv.find((a) => a.startsWith(\"--collections=\"));\n    const schemaArg = process.argv.find((a) => a.startsWith(\"--schema=\"));\n    const sdkArg = process.argv.find((a) => a.startsWith(\"--sdk=\"));\n    // --policies runs only the RLS checks: no schema diff, no SDK types. Useful\n    // as a CI gate against a deployed database, where the collection files and\n    // generated schema are not what you are asking about.\n    const policiesOnly = process.argv.includes(\"--policies\");\n\n    const collectionsPath = collectionsArg?.split(\"=\")[1] ?? path.join(\"..\", \"config\", \"collections\");\n    const schemaPath = schemaArg?.split(\"=\")[1] ?? path.join(\"src\", \"schema.generated.ts\");\n    const sdkPath = sdkArg?.split(\"=\")[1] ?? path.join(\"..\", \"generated\", \"sdk\", \"database.types.ts\");\n\n    // Load .env\n    try {\n        const dotenv = await import(\"dotenv\");\n        const envPath = process.env.DOTENV_CONFIG_PATH;\n        if (envPath) {\n            dotenv.config({ path: envPath, quiet: true });\n        } else {\n            dotenv.config({ quiet: true });\n        }\n    } catch {\n        // dotenv may not be installed\n    }\n\n    const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;\n\n    if (policiesOnly) {\n        // Non-zero so this can gate CI — the whole point of the flag, and a\n        // check that could not run has not passed. See exitCodeForPolicyGate.\n        process.exit(exitCodeForPolicyGate(await runPolicyChecks(collectionsPath, databaseUrl)));\n    }\n\n    const report = await runDoctor({\n        collectionsPath: path.resolve(process.cwd(), collectionsPath),\n        schemaPath: path.resolve(process.cwd(), schemaPath),\n        sdkPath: path.resolve(process.cwd(), sdkPath),\n        databaseUrl: databaseUrl ?? undefined\n    });\n\n    const policyStatus = await runPolicyChecks(collectionsPath, databaseUrl);\n\n    // A hint about speed, not drift: it never changes the exit code.\n    await runSearchScaleCheck(collectionsPath, databaseUrl);\n\n    // Exit non-zero if there are errors. A policy run that could not happen is\n    // reported loudly above but does not fail the interactive command — the\n    // same treatment the *chosen* skip of the database phase gets. `--policies`\n    // is the gate, and that one fails closed.\n    //\n    // A phase that was skipped by a fault is different, and `blocked` is what\n    // separates the two: \"no DATABASE_URL\" is a local situation somebody may be\n    // content with, while \"the DATABASE_URL you set refuses connections\" would\n    // otherwise let `rebase doctor` go green in CI against a database it never\n    // reached.\n    const blocked = [report.collectionsToSchema, report.schemaToDatabase, report.collectionsToSdk]\n        .some(phase => phase.blocked);\n    if (report.summary.errors > 0 || policyStatus === \"problems\" || blocked) {\n        process.exit(1);\n    }\n}\n\nmain().catch((err) => {\n    // A known database failure has a diagnosis; a stack trace through pg and\n    // drizzle internals is not it. This is the last resort — `runDoctor`\n    // already catches the connection failure it can name — so it exists for\n    // everything reached after the report, the policy checks in particular.\n    const banner = diagnoseDbError(err, process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING);\n    if (banner) {\n        console.error(banner);\n    } else {\n        console.error(chalk.red(`  ✗ Doctor failed: ${describeFailure(err)}`));\n    }\n    process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAgB,sBAAsB,QAAkC;CACpE,OAAO,WAAW,OAAO,IAAI;AACjC;;;;;;;AAQA,eAAsB,gBAAgB,iBAAyB,aAAkD;CAC7G,IAAI,CAAC,aAAa;EACd,QAAQ,MAAM,MAAM,OAAO,qDAAqD,CAAC;EACjF,OAAO;CACX;CAEA,MAAM,eAAe,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;CAChE,IAAI,WAAW;CACf,MAAM,EAAE,SAAS,MAAM,OAAO;CAC9B,MAAM,OAAO,IAAI,KAAK,EAAE,kBAAkB,YAAY,CAAC;CACvD,IAAI;EACA,MAAM,cAAkC,MAAM,gBAAgB,YAAY;EAM1E,IAAI,YAAY,WAAW,GAAG;GAC1B,QAAQ,MAAM,MAAM,IAAI,+BAA+B,cAAc,CAAC;GACtE,QAAQ,MAAM,MAAM,KAAK,iGAAiG,CAAC;GAC3H,OAAO;EACX;EAEA,MAAM,SAAS,OAAO,UAAkB,MAAM,KAAK,MAAM,IAAI,EAAA,CAAG;EAUhE,IAAI;GACA,MAAM,OAAO,UAAU;EAC3B,SAAS,KAAK;GACV,QAAQ,MAAM,MAAM,KAAK,+BAA+B,CAAC;GACzD,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC9G,OAAO;EACX;EAIA,IAAI;GACA,MAAM,sBAAsB,QAAQ,WAAoB;GACxD,QAAQ,IAAI,MAAM,MAAM,4CAA4C,CAAC;EACzE,SAAS,KAAK;GACV,WAAW;GACX,QAAQ,IAAI,EAAE;GACd,QAAQ,MAAM,MAAM,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;EAC7E;EAIA,sBAAsB,WAAoB;EAE1C,MAAM,QAAQ,MAAM,iBAAiB,MAAe,WAAW;EAC/D,QAAQ,IAAI,EAAE;EACd,IAAI,SAAS,KAAK,GAAG;GACjB,WAAW;GACX,QAAQ,IAAI,MAAM,OAAO,0DAA0D,CAAC;GACpF,QAAQ,IAAI,kBAAkB,KAAK,CAAC;EACxC,OACI,QAAQ,IAAI,MAAM,MAAM,4CAA4C,YAAY,OAAO,wBAAwB,CAAC;CAExH,SAAS,KAAK;EAIV,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;EAC9G,OAAO;CACX,UAAU;EACN,MAAM,KAAK,IAAI;CACnB;CACA,OAAO,WAAW,aAAa;AACnC;;;;;;;;;;;;;;;;;;;;AChGA,IAAa,wBAAwB;;;;;;;AAiBrC,SAAgB,yBAAyB,aAA4D;CACjG,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,cAAc,sBAAsB,WAAW,GAAG;EACzD,IAAI,CAAC,2BAA2B,UAAU,GAAG;EAC7C,IAAI;EACJ,IAAI;GACA,UAAU,sBAAsB,UAAU,MAAM,KAAA;EACpD,QAAQ;GAGJ,UAAU;EACd;EACA,IAAI,SAAS;EACb,MAAM,SAAS,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,CAAC,CACrD,QAAQ,GAAG,cAAc,SAAS,SAAS,YAAY,CAAC,SAAS,QAAQ,SAAS,SAAS,MAAM,CAAC,CAClG,KAAK,CAAC,SAAS,GAAG;EACvB,MAAM,QAAQ,aAAa,UAAU;EACrC,IAAI,OAAO,WAAW,KAAK,CAAC,OAAO;EACnC,MAAM,KAAK;GAAE,MAAM,WAAW;GAAM,QAAQ,WAAW,UAAU;GAAU;GAAO;EAAO,CAAC;CAC9F;CACA,OAAO;AACX;;AAGA,SAAgB,wBACZ,YACA,cACA,YAAoB,uBAC0B;CAC9C,OAAO,WACF,KAAI,eAAc;EAAE,GAAG;EAAW,MAAM,aAAa,IAAI,GAAG,UAAU,OAAO,GAAG,UAAU,OAAO,KAAK;CAAE,EAAE,CAAC,CAC3G,QAAO,cAAa,UAAU,OAAO,SAAS;AACvD;;;;;;;AAQA,eAAsB,kBAClB,OACA,SAC4B;CAC5B,MAAM,EAAE,SAAS,MAAM,MACnB;;;;;iEAMA,CAAC,OAAO,CACZ;CACA,OAAO,IAAI,IAAI,KAAK,KAAI,QAAO,CAAC,GAAG,IAAI,OAAO,GAAG,IAAI,SAAS,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;AACpF;;AAGA,SAAgB,wBAAwB,UAAoE;CACxG,IAAI,SAAS,WAAW,GAAG,OAAO,CAAC;CACnC,MAAM,QAAQ,CAAC,IAAI,MAAM,OAAO,OAAO,SAAS,OAAO,oDAAoD,CAAC;CAC5G,KAAK,MAAM,WAAW,UAClB,MAAM,KAAK,MAAM,OACb,UAAU,QAAQ,KAAK,WAAW,QAAQ,KAAK,eAAe,OAAO,EAAE,8DAChD,QAAQ,OAAO,KAAK,IAAI,GACnD,CAAC;CAEL,MAAM,KAAK,MAAM,KACb,iMAEJ,CAAC;CACD,OAAO;AACX;;;;;;AAOA,eAAsB,oBAAoB,iBAAyB,aAAqC;CACpG,IAAI,CAAC,aAAa;CAClB,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,YAAY,CAAC;CAC3D,IAAI;EAEA,MAAM,aAAa,yBAAyB,MADlB,gBAAgB,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe,CAAC,CAC/B;EACvD,IAAI,WAAW,WAAW,GAAG;EAC7B,MAAM,OAAO,QAAQ;EACrB,MAAM,YAAY,MAAM,mBACnB,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM,GAC3C,CAAC,GAAG,IAAI,IAAI,WAAW,KAAI,cAAa,UAAU,MAAM,CAAC,CAAC,CAC9D;EACA,KAAK,MAAM,QAAQ,wBAAwB,wBAAwB,YAAY,SAAS,CAAC,GAAG,QAAQ,IAAI,IAAI;CAChH,SAAS,KAAK;EACV,QAAQ,IAAI,MAAM,KAAK,4CAA4C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,EAAE,CAAC;CAC3H,UAAU;EACN,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5C;AACJ;;;;;;;AC7HA,eAAe,OAAO;CAClB,MAAM,iBAAiB,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,gBAAgB,CAAC;CAC9E,MAAM,YAAY,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC;CACpE,MAAM,SAAS,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,QAAQ,CAAC;CAI9D,MAAM,eAAe,QAAQ,KAAK,SAAS,YAAY;CAEvD,MAAM,kBAAkB,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,UAAU,aAAa;CAChG,MAAM,aAAa,WAAW,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,OAAO,qBAAqB;CACrF,MAAM,UAAU,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,aAAa,OAAO,mBAAmB;CAGhG,IAAI;EACA,MAAM,SAAS,MAAM,OAAO;EAC5B,MAAM,UAAU,QAAQ,IAAI;EAC5B,IAAI,SACA,OAAO,OAAO;GAAE,MAAM;GAAS,OAAO;EAAK,CAAC;OAE5C,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CAErC,QAAQ,CAER;CAEA,MAAM,cAAc,QAAQ,IAAI,gBAAgB,QAAQ,IAAI;CAE5D,IAAI,cAGA,QAAQ,KAAK,sBAAsB,MAAM,gBAAgB,iBAAiB,WAAW,CAAC,CAAC;CAG3F,MAAM,SAAS,MAAM,UAAU;EAC3B,iBAAiB,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;EAC5D,YAAY,KAAK,QAAQ,QAAQ,IAAI,GAAG,UAAU;EAClD,SAAS,KAAK,QAAQ,QAAQ,IAAI,GAAG,OAAO;EAC5C,aAAa,eAAe,KAAA;CAChC,CAAC;CAED,MAAM,eAAe,MAAM,gBAAgB,iBAAiB,WAAW;CAGvE,MAAM,oBAAoB,iBAAiB,WAAW;CAYtD,MAAM,UAAU;EAAC,OAAO;EAAqB,OAAO;EAAkB,OAAO;CAAgB,CAAC,CACzF,MAAK,UAAS,MAAM,OAAO;CAChC,IAAI,OAAO,QAAQ,SAAS,KAAK,iBAAiB,cAAc,SAC5D,QAAQ,KAAK,CAAC;AAEtB;AAEA,KAAK,CAAC,CAAC,OAAO,QAAQ;CAKlB,MAAM,SAAS,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,QAAQ,IAAI,uBAAuB;CACnG,IAAI,QACA,QAAQ,MAAM,MAAM;MAEpB,QAAQ,MAAM,MAAM,IAAI,sBAAsB,gBAAgB,GAAG,GAAG,CAAC;CAEzE,QAAQ,KAAK,CAAC;AAClB,CAAC"}

package/dist/schema/doctor-search-scale.d.ts

@@ -0,0 +1,45 @@
+import { type CollectionConfig } from "@rebasepro/types";
+/** Above this many rows an unindexed search is worth a word. */
+export declare const UNINDEXED_SEARCH_ROWS = 10000;
+/** A collection whose search would be `ILIKE` over these fields. */
+export interface IlikeSearchedCollection {
+    slug: string;
+    schema: string;
+    table: string;
+    /** The string properties the search reads. */
+    fields: string[];
+}
+/**
+ * The collections a search reaches without an index: no `search` block (or
+ * one that does not build), and at least one property the default search
+ * reads — a `string`, not an enum, not a uuid key (the rule in
+ * `DrizzleConditionBuilder.buildSearchConditions`).
+ */
+export declare function ilikeSearchedCollections(collections: CollectionConfig[]): IlikeSearchedCollection[];
+/** Those of `candidates` whose table holds more than `threshold` rows, by estimate. */
+export declare function unindexedSearchFindings(candidates: IlikeSearchedCollection[], rowEstimates: ReadonlyMap<string, number>, threshold?: number): (IlikeSearchedCollection & {
+    rows: number;
+})[];
+/**
+ * Row counts by `schema.table`, estimated — `pg_class.reltuples`, or the
+ * statistics collector's live-tuple count when the table was never analysed.
+ * Nothing is scanned: counting the tables this is about would be the cost it
+ * warns of.
+ */
+export declare function estimateRowCounts(query: (text: string, values: unknown[]) => Promise<{
+    rows: {
+        schema: string;
+        table: string;
+        rows: string | number;
+    }[];
+}>, schemas: string[]): Promise<Map<string, number>>;
+/** The report, one warning per collection. */
+export declare function formatUnindexedSearches(findings: (IlikeSearchedCollection & {
+    rows: number;
+})[]): string[];
+/**
+ * Print the warning for the project at `collectionsPath`, against
+ * `databaseUrl`. Never throws and never fails the run: it is a hint, and a
+ * check that could not run says so in one grey line.
+ */
+export declare function runSearchScaleCheck(collectionsPath: string, databaseUrl?: string): Promise<void>;