@rebasepro/server-postgres 0.24.0 → 0.24.1-canary.g19596ef

package/dist/schema/deferred-index-build.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Building the indexes a live table is missing — or holds INVALID — without
+ * holding anything up: the derived foreign-key indexes, and the declared,
+ * search and vector ones the boot-time ensure finds missing on a table that
+ * already exists.
+ *
+ * ## Why not a boot action like an index on a new table
+ *
+ * A table that already exists may hold millions of rows, and an index over
+ * them takes minutes to build. Boot-ensure's actions run before the server
+ * listens, so an index planned there is minutes of a deployment not serving —
+ * on the first boot after an upgrade that adds one to every `belongsTo` in the
+ * project, that is every large table at once. So these are planned apart
+ * (`DeferredIndexBuild`) and built here, after the boot, one at a time. A
+ * UNIQUE one is the exception: `ensureCollectionTables` builds it here too, but
+ * before it returns.
+ *
+ * ## The build
+ *
+ * `CREATE INDEX CONCURRENTLY`, outside any transaction (Postgres refuses it
+ * inside one), on a connection of its own with `statement_timeout` lifted: the
+ * pool's 30 s would cancel any build worth deferring. `CONCURRENTLY` takes
+ * `SHARE UPDATE EXCLUSIVE`, which conflicts with no read and no write — only
+ * with other DDL, `VACUUM` and `ANALYZE` — so live traffic never queues behind
+ * it, however long it runs.
+ *
+ * The boot's lock budget still applies, to the one wait that matters: getting
+ * the table at all. A table something else holds — another instance's build,
+ * an `ALTER TABLE`, a `VACUUM FULL` — is probed for `BOOT_LOCK_TIMEOUT_MS` at a
+ * time within the boot's retry budget, and left for the next boot when it
+ * stays held. Once the build has the table, it waits for the transactions
+ * already running against it with no deadline: a timeout there would only turn
+ * a slow build into a failed one.
+ *
+ * ## The husk a failed build leaves
+ *
+ * A cancelled `CONCURRENTLY` — a timeout, a killed process, a deploy that
+ * replaced the pod mid-build, two instances racing on one name — leaves the
+ * index behind marked `indisvalid = false`: maintained on every write, used by
+ * no query. And `IF NOT EXISTS` is a *name* check, so every later attempt
+ * skips it and reports success. This reads `pg_index` instead: an invalid index
+ * under our name is dropped (`DROP INDEX CONCURRENTLY`) and built again, once.
+ * One that another backend is still building (`pg_stat_progress_create_index`)
+ * is left to it.
+ *
+ * Nothing here is fatal. A failure is logged with the index named and the
+ * reason, and the next boot plans the index again.
+ */
+import type { Pool } from "pg";
+import { type DeferredIndexBuild } from "./plan/diff-plan.js";
+import { type BootLockOptions } from "./boot-ddl.js";
+/**
+ * A connection the builder may hold for as long as an index takes.
+ *
+ * `dedicated` says whether consecutive queries reach the same backend. Only
+ * then can a session setting be relied on — and be reset afterwards: on a
+ * pool, `SET statement_timeout = 0` would land on whichever connection served
+ * it and stay there for the next request to inherit.
+ */
+export interface IndexBuildSession {
+    query<T = unknown>(sql: string): Promise<{
+        rows: T[];
+    }>;
+    readonly dedicated: boolean;
+    /** Hand the connection back. Called once, after the last index. */
+    release(): void | Promise<void>;
+}
+export type OpenIndexBuildSession = () => Promise<IndexBuildSession>;
+/** A `pg.Pool` — what `connect()` checks a client out of — and not a `pg.Client`, whose `connect()` opens a socket. */
+export declare const isPgPool: (value: unknown) => value is Pick<Pool, "connect" | "totalCount">;
+/**
+ * Sessions checked out of a `pg.Pool`, one connection each.
+ *
+ * Its own connection rather than the pool's next free one, because a build
+ * has to outlive both of a pool's timeouts: the server-side
+ * `statement_timeout` (30 s on this framework's pools), which the builder
+ * lifts for the session — something it may only do on a connection nobody
+ * else is handed until it is reset — and the client-side read timeout, which
+ * is lifted here per query.
+ */
+export declare const poolIndexBuildSession: (pool: Pick<Pool, "connect">) => OpenIndexBuildSession;
+export interface DeferredIndexOptions extends BootLockOptions {
+    /** Progress, one line per index. Failures are also `logger.warn`ed. */
+    log?: (message: string) => void;
+    /** Checked between indexes; once true, nothing further is started. */
+    cancelled?: () => boolean;
+}
+export interface DeferredIndexOutcome {
+    /** `schema.index` this run built. */
+    built: string[];
+    /** Left alone, and why — already valid, or another instance is on it. */
+    skipped: {
+        index: string;
+        reason: string;
+    }[];
+    /** Not built. Logged; the next boot plans them again. */
+    failed: {
+        index: string;
+        error: string;
+    }[];
+}
+/** Why an index is skipped while a build of another index holds its table. */
+export declare const TABLE_BUSY_REASON = "another index on the table is being built";
+/**
+ * Build every deferred index, one at a time, on one connection.
+ *
+ * Never throws for an index: each failure is recorded and the next one is
+ * attempted. Throws only when no connection can be had at all.
+ */
+export declare function buildDeferredIndexes(openSession: OpenIndexBuildSession, indexes: readonly DeferredIndexBuild[], options?: DeferredIndexOptions): Promise<DeferredIndexOutcome>;
+/**
+ * Start {@link buildDeferredIndexes} later, in the background.
+ *
+ * `start()` begins it after `delayMs`; the fallback timer begins it after
+ * `fallbackMs` if nothing calls `start()` — so a process whose boot never
+ * reaches the step that would have started it still builds. Both timers are
+ * unref'd: a pending build never keeps a process alive, and a process that
+ * exits mid-build leaves a husk the next boot rebuilds.
+ */
+export interface ScheduledIndexBuild {
+    /** Begin after the schedule's `delayMs`, instead of waiting for the fallback timer. */
+    start(): void;
+    /** Start nothing further. An index already building runs to completion. */
+    cancel(): void;
+    /** Settles when the run ends — `undefined` if it never ran or could not open a connection. */
+    done: Promise<DeferredIndexOutcome | undefined>;
+}
+export declare function scheduleDeferredIndexBuild(openSession: OpenIndexBuildSession, indexes: readonly DeferredIndexBuild[], options?: DeferredIndexOptions & {
+    delayMs?: number;
+    fallbackMs?: number;
+}): ScheduledIndexBuild;

package/dist/schema/destructive-sql.d.ts

@@ -20,9 +20,16 @@
  * "<table>_pkey", ADD PRIMARY KEY ("id", "locale")` keeps every value and
  * gives every row a new address. It is gated like a drop.
  *
+ * So is the drop of a CHECK or EXCLUDE constraint. It keeps every row and
+ * stops refusing the ones the rule was there to refuse. `db push` keeps Atlas
+ * away from those constraints (`schema/undeclarable-constraints.ts`), so a plan
+ * that still drops one is a pattern that missed, and the gate is the second
+ * line. Which constraints those are is read from the catalogue by the caller.
+ *
  * Everything in this file is side-effect free so it can be unit-tested
  * without Atlas or a database.
  */
+import type { ExistingConstraint } from "./undeclarable-constraints.js";
 /**
  * Split a SQL script into individual statements, dropping blank lines and
  * `--` comment lines. Deliberately simple: Atlas emits one plain statement
@@ -36,6 +43,13 @@ export declare function splitSqlStatements(sql: string): string[];
  * it reads; `test/fixtures/atlas-dry-run/` holds real captures of it.
  */
 export declare function extractPlanStatements(plan: string): string[];
+/**
+ * Whether Atlas answered the dry-run with "Schema is synced" and nothing else.
+ *
+ * Positive evidence only: an empty or unreadable report also yields no
+ * statements, and is not the same answer.
+ */
+export declare function isSyncedPlan(plan: string): boolean;
 export interface DestructiveStatement {
     /** The offending statement (trimmed, without the trailing `;`). */
     statement: string;
@@ -70,8 +84,12 @@ export declare const COLUMN_TYPES_SQL = "\n    SELECT n.nspname AS \"schema\",\n
  * `columnTypes` is what the database holds now. A type change to a column it
  * does not list is flagged: not knowing what a column is means not knowing
  * whether the change keeps its values.
+ *
+ * `constraints` are the CHECK and EXCLUDE constraints the database holds now.
+ * A `DROP CONSTRAINT` of one of them is flagged; of any other constraint (a
+ * foreign key, a `UNIQUE`) it is not, as before.
  */
-export declare function detectDestructiveStatements(planSql: string, columnTypes?: readonly ExistingColumnType[]): DestructiveStatement[];
+export declare function detectDestructiveStatements(planSql: string, columnTypes?: readonly ExistingColumnType[], constraints?: readonly ExistingConstraint[]): DestructiveStatement[];
 /**
  * The statement from its `ALTER TABLE` on, wherever on a line that starts.
  *
@@ -102,6 +120,17 @@ export declare function fromAlterTable(statement: string): string;
  */
 export declare function isLosslessTypeChange(from: string, to: string): boolean;
 export type PushDecision = "apply" | "confirm" | "refuse";
+/**
+ * The flag that opted a push into destructive changes, as it was given —
+ * `--allow-destructive`, or its alias `--yes` / `-y` — or `undefined` for
+ * none. The line that says why a destructive push went ahead names the one
+ * the user typed: "because --allow-destructive was passed" to someone who
+ * typed `--yes` reads like a flag they never set.
+ */
+export declare function destructiveOptInFlag(args: {
+    "--allow-destructive"?: boolean;
+    "--yes"?: boolean;
+}): "--allow-destructive" | "--yes" | undefined;
 /**
  * Decide how `db push` should proceed given the plan's destructiveness and
  * the invocation context.

package/dist/schema/doctor-cli.js

@@ -1,11 +1,14 @@
 #!/usr/bin/env node
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { i as diagnoseDbError } from "../cli-errors-DsA-K9uP.js";
-import { c as warnOnAnonymousGrants, s as validatePolicyPgRoles } from "../rls-enforcement-CfXOJJaW.js";
-import { t as chalk } from "../source-Br7L7GOI.js";
-import { n as loadCollections, r as runDoctor } from "../doctor-C-sYWbmt.js";
-import { n as formatPolicyDrift, r as hasDrift, t as checkPolicyDrift } from "../policy-drift-B-J2hhm0.js";
+import { a as buildSearchColumnSpec } from "../search-column-BM-GV6vH.js";
+import { i as diagnoseDbError } from "../cli-errors-oVUuD8k0.js";
+import { l as validatePolicyPgRoles, u as warnOnAnonymousGrants } from "../rls-enforcement-D7P4-ZYX.js";
+import { n as describeFailure, t as chalk } from "../source-DB6xJv3p.js";
+import { n as loadCollections, r as runDoctor } from "../doctor-CUAAOFZm.js";
+import { n as formatPolicyDrift, r as hasDrift, t as checkPolicyDrift } from "../policy-drift-BKC50y2p.js";
+import { isPostgresCollectionConfig } from "@rebasepro/types";
+import { getTableName, relationalCollections } from "@rebasepro/common";
 import path from "path";
 //#region src/schema/doctor-policy-checks.ts
 /**
@@ -80,6 +83,106 @@ async function runPolicyChecks(collectionsPath, databaseUrl) {
 	return problems ? "problems" : "ok";
 }
 //#endregion
+//#region src/schema/doctor-search-scale.ts
+/**
+* `rebase doctor`: collections searched by a full scan of a large table.
+*
+* Without a `search` block, a search — the admin's search box, `?searchString=`,
+* `.search()` — is `ILIKE '%term%'` over every text column. A leading `%`
+* defeats a B-tree, so each one reads the whole table: on 100k posts a search
+* took 326 ms, half for the page and half for its count. Nothing reports it;
+* the box just gets slower as the table grows. This names the collections
+* where that has started to matter, and points at the block that fixes it.
+*
+* A hint, not a failure: it never changes doctor's exit code, and the database
+* is not changed — Rebase does not add a search index on its own.
+*
+* Lives beside `doctor-cli.ts` rather than inside it because that file runs
+* `main()` on import.
+*/
+/** Above this many rows an unindexed search is worth a word. */
+var UNINDEXED_SEARCH_ROWS = 1e4;
+/**
+* The collections a search reaches without an index: no `search` block (or
+* one that does not build), and at least one property the default search
+* reads — a `string`, not an enum, not a uuid key (the rule in
+* `DrizzleConditionBuilder.buildSearchConditions`).
+*/
+function ilikeSearchedCollections(collections) {
+	const found = [];
+	for (const collection of relationalCollections(collections)) {
+		if (!isPostgresCollectionConfig(collection)) continue;
+		let indexed;
+		try {
+			indexed = buildSearchColumnSpec(collection) !== void 0;
+		} catch {
+			indexed = false;
+		}
+		if (indexed) continue;
+		const fields = Object.entries(collection.properties ?? {}).filter(([, property]) => property.type === "string" && !property.enum && property.isId !== "uuid").map(([key]) => key);
+		const table = getTableName(collection);
+		if (fields.length === 0 || !table) continue;
+		found.push({
+			slug: collection.slug,
+			schema: collection.schema ?? "public",
+			table,
+			fields
+		});
+	}
+	return found;
+}
+/** Those of `candidates` whose table holds more than `threshold` rows, by estimate. */
+function unindexedSearchFindings(candidates, rowEstimates, threshold = UNINDEXED_SEARCH_ROWS) {
+	return candidates.map((candidate) => ({
+		...candidate,
+		rows: rowEstimates.get(`${candidate.schema}.${candidate.table}`) ?? 0
+	})).filter((candidate) => candidate.rows > threshold);
+}
+/**
+* Row counts by `schema.table`, estimated — `pg_class.reltuples`, or the
+* statistics collector's live-tuple count when the table was never analysed.
+* Nothing is scanned: counting the tables this is about would be the cost it
+* warns of.
+*/
+async function estimateRowCounts(query, schemas) {
+	const { rows } = await query(`SELECT n.nspname AS schema, c.relname AS table,
+                GREATEST(c.reltuples, COALESCE(s.n_live_tup, 0), 0)::bigint AS rows
+         FROM pg_class c
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+         LEFT JOIN pg_stat_user_tables s ON s.relid = c.oid
+         WHERE c.relkind IN ('r', 'p') AND n.nspname = ANY($1)`, [schemas]);
+	return new Map(rows.map((row) => [`${row.schema}.${row.table}`, Number(row.rows)]));
+}
+/** The report, one warning per collection. */
+function formatUnindexedSearches(findings) {
+	if (findings.length === 0) return [];
+	const lines = ["", chalk.yellow(`  ⚠ ${findings.length} collection(s) searched by reading the whole table:`)];
+	for (const finding of findings) lines.push(chalk.yellow(`     • ${finding.slug} — about ${finding.rows.toLocaleString("en-US")} rows, no \`search\` block: a search is ILIKE '%term%' over ${finding.fields.join(", ")}`));
+	lines.push(chalk.gray("    Each search reads every row, and its count reads them again. A `search` block indexes it\n    (full-text, or `mode: \"hybrid\"` for substrings too): https://rebase.pro/docs/backend/search"));
+	return lines;
+}
+/**
+* Print the warning for the project at `collectionsPath`, against
+* `databaseUrl`. Never throws and never fails the run: it is a hint, and a
+* check that could not run says so in one grey line.
+*/
+async function runSearchScaleCheck(collectionsPath, databaseUrl) {
+	if (!databaseUrl) return;
+	const { Client } = await import("pg");
+	const client = new Client({ connectionString: databaseUrl });
+	try {
+		const candidates = ilikeSearchedCollections(await loadCollections(path.resolve(process.cwd(), collectionsPath)));
+		if (candidates.length === 0) return;
+		await client.connect();
+		const estimates = await estimateRowCounts((text, values) => client.query(text, values), [...new Set(candidates.map((candidate) => candidate.schema))]);
+		for (const line of formatUnindexedSearches(unindexedSearchFindings(candidates, estimates))) console.log(line);
+	} catch (err) {
+		console.log(chalk.gray(`  ⏭ Search on large tables: not checked (${err instanceof Error ? err.message : String(err)})`));
+	} finally {
+		await client.end().catch(() => void 0);
+	}
+}
+//#endregion
 //#region src/schema/doctor-cli.ts
 /**
 * CLI entry point for `rebase doctor`.
@@ -111,6 +214,7 @@ async function main() {
 		databaseUrl: databaseUrl ?? void 0
 	});
 	const policyStatus = await runPolicyChecks(collectionsPath, databaseUrl);
+	await runSearchScaleCheck(collectionsPath, databaseUrl);
 	const blocked = [
 		report.collectionsToSchema,
 		report.schemaToDatabase,
@@ -121,7 +225,7 @@ async function main() {
 main().catch((err) => {
 	const banner = diagnoseDbError(err, process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING);
 	if (banner) console.error(banner);
-	else console.error(chalk.red("  ✗ Doctor failed"), err instanceof Error ? err.stack ?? err.message : String(err));
+	else console.error(chalk.red(`  ✗ Doctor failed: ${describeFailure(err)}`));
 	process.exit(1);
 });
 //#endregion

package/dist/schema/doctor-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-cli.js","names":[],"sources":["../../src/schema/doctor-policy-checks.ts","../../src/schema/doctor-cli.ts"],"sourcesContent":["/**\n * The RLS half of `rebase doctor`, and the exit code `--policies` gates CI on.\n *\n * Lives beside `doctor-cli.ts` rather than inside it because that file runs\n * `main()` on import: a gate whose failure modes cannot be unit-tested is how\n * this one shipped reporting success for work it never did.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { CollectionConfig } from \"@rebasepro/types\";\nimport { loadCollections } from \"./doctor\";\nimport { checkPolicyDrift, formatPolicyDrift, hasDrift } from \"../security/policy-drift\";\nimport { validatePolicyPgRoles, warnOnAnonymousGrants } from \"../security/rls-enforcement\";\n\n/**\n * What the RLS checks concluded.\n *\n * `unchecked` exists because \"we could not look\" and \"we looked and it is fine\"\n * used to be reported identically: a collections path that did not resolve made\n * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`\n * early-returned an empty diff, and the gate printed\n * `✓ RLS policies match your collections` having compared zero policies against\n * zero collections. Any exception at all — a collection file that throws on\n * import, a `pg_policies` read the CI role is not granted, a connection reset —\n * did the same thing through a `warn`, and exited 0.\n */\nexport type PolicyCheckStatus = \"ok\" | \"problems\" | \"unchecked\";\n\n/**\n * The exit code for `rebase doctor --policies`.\n *\n * A gate that could not run has not passed. Only a completed, clean check\n * exits 0 — anything else, including \"we never opened a connection\", is a\n * failure, or the flag certifies a database nobody looked at.\n */\nexport function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1 {\n    return status === \"ok\" ? 0 : 1;\n}\n\n/**\n * Policies actually deployed vs the ones the collections describe, plus policy\n * roles this server could never satisfy.\n *\n * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.\n */\nexport async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus> {\n    if (!databaseUrl) {\n        console.error(chalk.yellow(\"  ⚠ No DATABASE_URL — RLS policies were NOT checked\"));\n        return \"unchecked\";\n    }\n\n    const resolvedPath = path.resolve(process.cwd(), collectionsPath);\n    let problems = false;\n    const { Pool } = await import(\"pg\");\n    const pool = new Pool({ connectionString: databaseUrl });\n    try {\n        const collections: CollectionConfig[] = await loadCollections(resolvedPath);\n\n        // Zero collections is not \"no drift\", it is nothing to compare. The\n        // loader returns `[]` for a path that does not exist, so the commonest\n        // way to get here is a `--collections` path resolved against the wrong\n        // directory — which used to render as a green tick.\n        if (collections.length === 0) {\n            console.error(chalk.red(`  ✗ No collections found in ${resolvedPath}`));\n            console.error(chalk.gray(\"    RLS policies were NOT checked. Pass --collections=<dir> if your collections live elsewhere.\"));\n            return \"unchecked\";\n        }\n\n        const runSql = async (text: string) => (await pool.query(text)).rows as Record<string, unknown>[];\n\n        // Prove the connection before anything is ticked.\n        //\n        // `validatePolicyPgRoles` returns without a query when no collection\n        // names a `pgRoles` — which is most projects — so it \"passed\" against a\n        // database that was never reached, and the tick printed above an\n        // ECONNREFUSED that only surfaced two checks later. Ten lines up, this\n        // file says that reporting success for work it never did is the reason\n        // it exists. This is the same shape, one function along.\n        try {\n            await runSql(\"SELECT 1\");\n        } catch (err) {\n            console.error(chalk.gray(\"  ⏭ Policy roles: not checked\"));\n            console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n            return \"unchecked\";\n        }\n\n        // A policy naming a role the server never runs as filters every row, so\n        // the collection reads as empty. Report it without booting a server.\n        try {\n            await validatePolicyPgRoles(runSql, collections as never);\n            console.log(chalk.green(\"  ✓ Policy roles are usable by this server\"));\n        } catch (err) {\n            problems = true;\n            console.log(\"\");\n            console.error(chalk.red(err instanceof Error ? err.message : String(err)));\n        }\n\n        // A rule that reads as a lockdown but is true for every caller compiles\n        // to a grant. Report it without booting a server.\n        warnOnAnonymousGrants(collections as never);\n\n        const drift = await checkPolicyDrift(pool as never, collections);\n        console.log(\"\");\n        if (hasDrift(drift)) {\n            problems = true;\n            console.log(chalk.yellow(\"  RLS policies: database does not match your collections\"));\n            console.log(formatPolicyDrift(drift));\n        } else {\n            console.log(chalk.green(`  ✓ RLS policies match your collections (${collections.length} collection(s) checked)`));\n        }\n    } catch (err) {\n        // Fail closed. This catch covers every query and every collection import\n        // above, so returning the pre-catch verdict made the documented CI gate\n        // green on exactly the runs it exists to catch.\n        console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n        return \"unchecked\";\n    } finally {\n        await pool.end();\n    }\n    return problems ? \"problems\" : \"ok\";\n}\n","#!/usr/bin/env node\n/**\n * CLI entry point for `rebase doctor`.\n * Invoked via tsx by the server-postgres CLI plugin.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { runDoctor } from \"./doctor\";\nimport { exitCodeForPolicyGate, runPolicyChecks } from \"./doctor-policy-checks\";\nimport { diagnoseDbError } from \"../cli-errors\";\n\nasync function main() {\n    const collectionsArg = process.argv.find((a) => a.startsWith(\"--collections=\"));\n    const schemaArg = process.argv.find((a) => a.startsWith(\"--schema=\"));\n    const sdkArg = process.argv.find((a) => a.startsWith(\"--sdk=\"));\n    // --policies runs only the RLS checks: no schema diff, no SDK types. Useful\n    // as a CI gate against a deployed database, where the collection files and\n    // generated schema are not what you are asking about.\n    const policiesOnly = process.argv.includes(\"--policies\");\n\n    const collectionsPath = collectionsArg?.split(\"=\")[1] ?? path.join(\"..\", \"config\", \"collections\");\n    const schemaPath = schemaArg?.split(\"=\")[1] ?? path.join(\"src\", \"schema.generated.ts\");\n    const sdkPath = sdkArg?.split(\"=\")[1] ?? path.join(\"..\", \"generated\", \"sdk\", \"database.types.ts\");\n\n    // Load .env\n    try {\n        const dotenv = await import(\"dotenv\");\n        const envPath = process.env.DOTENV_CONFIG_PATH;\n        if (envPath) {\n            dotenv.config({ path: envPath, quiet: true });\n        } else {\n            dotenv.config({ quiet: true });\n        }\n    } catch {\n        // dotenv may not be installed\n    }\n\n    const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;\n\n    if (policiesOnly) {\n        // Non-zero so this can gate CI — the whole point of the flag, and a\n        // check that could not run has not passed. See exitCodeForPolicyGate.\n        process.exit(exitCodeForPolicyGate(await runPolicyChecks(collectionsPath, databaseUrl)));\n    }\n\n    const report = await runDoctor({\n        collectionsPath: path.resolve(process.cwd(), collectionsPath),\n        schemaPath: path.resolve(process.cwd(), schemaPath),\n        sdkPath: path.resolve(process.cwd(), sdkPath),\n        databaseUrl: databaseUrl ?? undefined\n    });\n\n    const policyStatus = await runPolicyChecks(collectionsPath, databaseUrl);\n\n    // Exit non-zero if there are errors. A policy run that could not happen is\n    // reported loudly above but does not fail the interactive command — the\n    // same treatment the *chosen* skip of the database phase gets. `--policies`\n    // is the gate, and that one fails closed.\n    //\n    // A phase that was skipped by a fault is different, and `blocked` is what\n    // separates the two: \"no DATABASE_URL\" is a local situation somebody may be\n    // content with, while \"the DATABASE_URL you set refuses connections\" would\n    // otherwise let `rebase doctor` go green in CI against a database it never\n    // reached.\n    const blocked = [report.collectionsToSchema, report.schemaToDatabase, report.collectionsToSdk]\n        .some(phase => phase.blocked);\n    if (report.summary.errors > 0 || policyStatus === \"problems\" || blocked) {\n        process.exit(1);\n    }\n}\n\nmain().catch((err) => {\n    // A known database failure has a diagnosis; a stack trace through pg and\n    // drizzle internals is not it. This is the last resort — `runDoctor`\n    // already catches the connection failure it can name — so it exists for\n    // everything reached after the report, the policy checks in particular.\n    const banner = diagnoseDbError(err, process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING);\n    if (banner) {\n        console.error(banner);\n    } else {\n        console.error(chalk.red(\"  ✗ Doctor failed\"), err instanceof Error ? (err.stack ?? err.message) : String(err));\n    }\n    process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAgB,sBAAsB,QAAkC;CACpE,OAAO,WAAW,OAAO,IAAI;AACjC;;;;;;;AAQA,eAAsB,gBAAgB,iBAAyB,aAAkD;CAC7G,IAAI,CAAC,aAAa;EACd,QAAQ,MAAM,MAAM,OAAO,qDAAqD,CAAC;EACjF,OAAO;CACX;CAEA,MAAM,eAAe,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;CAChE,IAAI,WAAW;CACf,MAAM,EAAE,SAAS,MAAM,OAAO;CAC9B,MAAM,OAAO,IAAI,KAAK,EAAE,kBAAkB,YAAY,CAAC;CACvD,IAAI;EACA,MAAM,cAAkC,MAAM,gBAAgB,YAAY;EAM1E,IAAI,YAAY,WAAW,GAAG;GAC1B,QAAQ,MAAM,MAAM,IAAI,+BAA+B,cAAc,CAAC;GACtE,QAAQ,MAAM,MAAM,KAAK,iGAAiG,CAAC;GAC3H,OAAO;EACX;EAEA,MAAM,SAAS,OAAO,UAAkB,MAAM,KAAK,MAAM,IAAI,EAAA,CAAG;EAUhE,IAAI;GACA,MAAM,OAAO,UAAU;EAC3B,SAAS,KAAK;GACV,QAAQ,MAAM,MAAM,KAAK,+BAA+B,CAAC;GACzD,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC9G,OAAO;EACX;EAIA,IAAI;GACA,MAAM,sBAAsB,QAAQ,WAAoB;GACxD,QAAQ,IAAI,MAAM,MAAM,4CAA4C,CAAC;EACzE,SAAS,KAAK;GACV,WAAW;GACX,QAAQ,IAAI,EAAE;GACd,QAAQ,MAAM,MAAM,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;EAC7E;EAIA,sBAAsB,WAAoB;EAE1C,MAAM,QAAQ,MAAM,iBAAiB,MAAe,WAAW;EAC/D,QAAQ,IAAI,EAAE;EACd,IAAI,SAAS,KAAK,GAAG;GACjB,WAAW;GACX,QAAQ,IAAI,MAAM,OAAO,0DAA0D,CAAC;GACpF,QAAQ,IAAI,kBAAkB,KAAK,CAAC;EACxC,OACI,QAAQ,IAAI,MAAM,MAAM,4CAA4C,YAAY,OAAO,wBAAwB,CAAC;CAExH,SAAS,KAAK;EAIV,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;EAC9G,OAAO;CACX,UAAU;EACN,MAAM,KAAK,IAAI;CACnB;CACA,OAAO,WAAW,aAAa;AACnC;;;;;;;AC7GA,eAAe,OAAO;CAClB,MAAM,iBAAiB,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,gBAAgB,CAAC;CAC9E,MAAM,YAAY,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC;CACpE,MAAM,SAAS,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,QAAQ,CAAC;CAI9D,MAAM,eAAe,QAAQ,KAAK,SAAS,YAAY;CAEvD,MAAM,kBAAkB,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,UAAU,aAAa;CAChG,MAAM,aAAa,WAAW,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,OAAO,qBAAqB;CACrF,MAAM,UAAU,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,aAAa,OAAO,mBAAmB;CAGhG,IAAI;EACA,MAAM,SAAS,MAAM,OAAO;EAC5B,MAAM,UAAU,QAAQ,IAAI;EAC5B,IAAI,SACA,OAAO,OAAO;GAAE,MAAM;GAAS,OAAO;EAAK,CAAC;OAE5C,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CAErC,QAAQ,CAER;CAEA,MAAM,cAAc,QAAQ,IAAI,gBAAgB,QAAQ,IAAI;CAE5D,IAAI,cAGA,QAAQ,KAAK,sBAAsB,MAAM,gBAAgB,iBAAiB,WAAW,CAAC,CAAC;CAG3F,MAAM,SAAS,MAAM,UAAU;EAC3B,iBAAiB,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;EAC5D,YAAY,KAAK,QAAQ,QAAQ,IAAI,GAAG,UAAU;EAClD,SAAS,KAAK,QAAQ,QAAQ,IAAI,GAAG,OAAO;EAC5C,aAAa,eAAe,KAAA;CAChC,CAAC;CAED,MAAM,eAAe,MAAM,gBAAgB,iBAAiB,WAAW;CAYvE,MAAM,UAAU;EAAC,OAAO;EAAqB,OAAO;EAAkB,OAAO;CAAgB,CAAC,CACzF,MAAK,UAAS,MAAM,OAAO;CAChC,IAAI,OAAO,QAAQ,SAAS,KAAK,iBAAiB,cAAc,SAC5D,QAAQ,KAAK,CAAC;AAEtB;AAEA,KAAK,CAAC,CAAC,OAAO,QAAQ;CAKlB,MAAM,SAAS,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,QAAQ,IAAI,uBAAuB;CACnG,IAAI,QACA,QAAQ,MAAM,MAAM;MAEpB,QAAQ,MAAM,MAAM,IAAI,mBAAmB,GAAG,eAAe,QAAS,IAAI,SAAS,IAAI,UAAW,OAAO,GAAG,CAAC;CAEjH,QAAQ,KAAK,CAAC;AAClB,CAAC"}
+{"version":3,"file":"doctor-cli.js","names":[],"sources":["../../src/schema/doctor-policy-checks.ts","../../src/schema/doctor-search-scale.ts","../../src/schema/doctor-cli.ts"],"sourcesContent":["/**\n * The RLS half of `rebase doctor`, and the exit code `--policies` gates CI on.\n *\n * Lives beside `doctor-cli.ts` rather than inside it because that file runs\n * `main()` on import: a gate whose failure modes cannot be unit-tested is how\n * this one shipped reporting success for work it never did.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { CollectionConfig } from \"@rebasepro/types\";\nimport { loadCollections } from \"./doctor\";\nimport { checkPolicyDrift, formatPolicyDrift, hasDrift } from \"../security/policy-drift\";\nimport { validatePolicyPgRoles, warnOnAnonymousGrants } from \"../security/rls-enforcement\";\n\n/**\n * What the RLS checks concluded.\n *\n * `unchecked` exists because \"we could not look\" and \"we looked and it is fine\"\n * used to be reported identically: a collections path that did not resolve made\n * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`\n * early-returned an empty diff, and the gate printed\n * `✓ RLS policies match your collections` having compared zero policies against\n * zero collections. Any exception at all — a collection file that throws on\n * import, a `pg_policies` read the CI role is not granted, a connection reset —\n * did the same thing through a `warn`, and exited 0.\n */\nexport type PolicyCheckStatus = \"ok\" | \"problems\" | \"unchecked\";\n\n/**\n * The exit code for `rebase doctor --policies`.\n *\n * A gate that could not run has not passed. Only a completed, clean check\n * exits 0 — anything else, including \"we never opened a connection\", is a\n * failure, or the flag certifies a database nobody looked at.\n */\nexport function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1 {\n    return status === \"ok\" ? 0 : 1;\n}\n\n/**\n * Policies actually deployed vs the ones the collections describe, plus policy\n * roles this server could never satisfy.\n *\n * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.\n */\nexport async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus> {\n    if (!databaseUrl) {\n        console.error(chalk.yellow(\"  ⚠ No DATABASE_URL — RLS policies were NOT checked\"));\n        return \"unchecked\";\n    }\n\n    const resolvedPath = path.resolve(process.cwd(), collectionsPath);\n    let problems = false;\n    const { Pool } = await import(\"pg\");\n    const pool = new Pool({ connectionString: databaseUrl });\n    try {\n        const collections: CollectionConfig[] = await loadCollections(resolvedPath);\n\n        // Zero collections is not \"no drift\", it is nothing to compare. The\n        // loader returns `[]` for a path that does not exist, so the commonest\n        // way to get here is a `--collections` path resolved against the wrong\n        // directory — which used to render as a green tick.\n        if (collections.length === 0) {\n            console.error(chalk.red(`  ✗ No collections found in ${resolvedPath}`));\n            console.error(chalk.gray(\"    RLS policies were NOT checked. Pass --collections=<dir> if your collections live elsewhere.\"));\n            return \"unchecked\";\n        }\n\n        const runSql = async (text: string) => (await pool.query(text)).rows as Record<string, unknown>[];\n\n        // Prove the connection before anything is ticked.\n        //\n        // `validatePolicyPgRoles` returns without a query when no collection\n        // names a `pgRoles` — which is most projects — so it \"passed\" against a\n        // database that was never reached, and the tick printed above an\n        // ECONNREFUSED that only surfaced two checks later. Ten lines up, this\n        // file says that reporting success for work it never did is the reason\n        // it exists. This is the same shape, one function along.\n        try {\n            await runSql(\"SELECT 1\");\n        } catch (err) {\n            console.error(chalk.gray(\"  ⏭ Policy roles: not checked\"));\n            console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n            return \"unchecked\";\n        }\n\n        // A policy naming a role the server never runs as filters every row, so\n        // the collection reads as empty. Report it without booting a server.\n        try {\n            await validatePolicyPgRoles(runSql, collections as never);\n            console.log(chalk.green(\"  ✓ Policy roles are usable by this server\"));\n        } catch (err) {\n            problems = true;\n            console.log(\"\");\n            console.error(chalk.red(err instanceof Error ? err.message : String(err)));\n        }\n\n        // A rule that reads as a lockdown but is true for every caller compiles\n        // to a grant. Report it without booting a server.\n        warnOnAnonymousGrants(collections as never);\n\n        const drift = await checkPolicyDrift(pool as never, collections);\n        console.log(\"\");\n        if (hasDrift(drift)) {\n            problems = true;\n            console.log(chalk.yellow(\"  RLS policies: database does not match your collections\"));\n            console.log(formatPolicyDrift(drift));\n        } else {\n            console.log(chalk.green(`  ✓ RLS policies match your collections (${collections.length} collection(s) checked)`));\n        }\n    } catch (err) {\n        // Fail closed. This catch covers every query and every collection import\n        // above, so returning the pre-catch verdict made the documented CI gate\n        // green on exactly the runs it exists to catch.\n        console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n        return \"unchecked\";\n    } finally {\n        await pool.end();\n    }\n    return problems ? \"problems\" : \"ok\";\n}\n","/**\n * `rebase doctor`: collections searched by a full scan of a large table.\n *\n * Without a `search` block, a search — the admin's search box, `?searchString=`,\n * `.search()` — is `ILIKE '%term%'` over every text column. A leading `%`\n * defeats a B-tree, so each one reads the whole table: on 100k posts a search\n * took 326 ms, half for the page and half for its count. Nothing reports it;\n * the box just gets slower as the table grows. This names the collections\n * where that has started to matter, and points at the block that fixes it.\n *\n * A hint, not a failure: it never changes doctor's exit code, and the database\n * is not changed — Rebase does not add a search index on its own.\n *\n * Lives beside `doctor-cli.ts` rather than inside it because that file runs\n * `main()` on import.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { getTableName, relationalCollections } from \"@rebasepro/common\";\nimport { isPostgresCollectionConfig, type CollectionConfig } from \"@rebasepro/types\";\nimport { loadCollections } from \"./doctor\";\nimport { buildSearchColumnSpec } from \"./search-column\";\n\n/** Above this many rows an unindexed search is worth a word. */\nexport const UNINDEXED_SEARCH_ROWS = 10_000;\n\n/** A collection whose search would be `ILIKE` over these fields. */\nexport interface IlikeSearchedCollection {\n    slug: string;\n    schema: string;\n    table: string;\n    /** The string properties the search reads. */\n    fields: string[];\n}\n\n/**\n * The collections a search reaches without an index: no `search` block (or\n * one that does not build), and at least one property the default search\n * reads — a `string`, not an enum, not a uuid key (the rule in\n * `DrizzleConditionBuilder.buildSearchConditions`).\n */\nexport function ilikeSearchedCollections(collections: CollectionConfig[]): IlikeSearchedCollection[] {\n    const found: IlikeSearchedCollection[] = [];\n    for (const collection of relationalCollections(collections)) {\n        if (!isPostgresCollectionConfig(collection)) continue;\n        let indexed: boolean;\n        try {\n            indexed = buildSearchColumnSpec(collection) !== undefined;\n        } catch {\n            // A block that does not build is reported by the boot; the search\n            // falls back to ILIKE meanwhile, so it counts as none here.\n            indexed = false;\n        }\n        if (indexed) continue;\n        const fields = Object.entries(collection.properties ?? {})\n            .filter(([, property]) => property.type === \"string\" && !property.enum && property.isId !== \"uuid\")\n            .map(([key]) => key);\n        const table = getTableName(collection);\n        if (fields.length === 0 || !table) continue;\n        found.push({ slug: collection.slug, schema: collection.schema ?? \"public\", table, fields });\n    }\n    return found;\n}\n\n/** Those of `candidates` whose table holds more than `threshold` rows, by estimate. */\nexport function unindexedSearchFindings(\n    candidates: IlikeSearchedCollection[],\n    rowEstimates: ReadonlyMap<string, number>,\n    threshold: number = UNINDEXED_SEARCH_ROWS\n): (IlikeSearchedCollection & { rows: number })[] {\n    return candidates\n        .map(candidate => ({ ...candidate, rows: rowEstimates.get(`${candidate.schema}.${candidate.table}`) ?? 0 }))\n        .filter(candidate => candidate.rows > threshold);\n}\n\n/**\n * Row counts by `schema.table`, estimated — `pg_class.reltuples`, or the\n * statistics collector's live-tuple count when the table was never analysed.\n * Nothing is scanned: counting the tables this is about would be the cost it\n * warns of.\n */\nexport async function estimateRowCounts(\n    query: (text: string, values: unknown[]) => Promise<{ rows: { schema: string; table: string; rows: string | number }[] }>,\n    schemas: string[]\n): Promise<Map<string, number>> {\n    const { rows } = await query(\n        `SELECT n.nspname AS schema, c.relname AS table,\n                GREATEST(c.reltuples, COALESCE(s.n_live_tup, 0), 0)::bigint AS rows\n         FROM pg_class c\n         JOIN pg_namespace n ON n.oid = c.relnamespace\n         LEFT JOIN pg_stat_user_tables s ON s.relid = c.oid\n         WHERE c.relkind IN ('r', 'p') AND n.nspname = ANY($1)`,\n        [schemas]\n    );\n    return new Map(rows.map(row => [`${row.schema}.${row.table}`, Number(row.rows)]));\n}\n\n/** The report, one warning per collection. */\nexport function formatUnindexedSearches(findings: (IlikeSearchedCollection & { rows: number })[]): string[] {\n    if (findings.length === 0) return [];\n    const lines = [\"\", chalk.yellow(`  ⚠ ${findings.length} collection(s) searched by reading the whole table:`)];\n    for (const finding of findings) {\n        lines.push(chalk.yellow(\n            `     • ${finding.slug} — about ${finding.rows.toLocaleString(\"en-US\")} rows, no \\`search\\` block: a search is ` +\n            `ILIKE '%term%' over ${finding.fields.join(\", \")}`\n        ));\n    }\n    lines.push(chalk.gray(\n        \"    Each search reads every row, and its count reads them again. A `search` block indexes it\\n\" +\n        \"    (full-text, or `mode: \\\"hybrid\\\"` for substrings too): https://rebase.pro/docs/backend/search\"\n    ));\n    return lines;\n}\n\n/**\n * Print the warning for the project at `collectionsPath`, against\n * `databaseUrl`. Never throws and never fails the run: it is a hint, and a\n * check that could not run says so in one grey line.\n */\nexport async function runSearchScaleCheck(collectionsPath: string, databaseUrl?: string): Promise<void> {\n    if (!databaseUrl) return;\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString: databaseUrl });\n    try {\n        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));\n        const candidates = ilikeSearchedCollections(collections);\n        if (candidates.length === 0) return;\n        await client.connect();\n        const estimates = await estimateRowCounts(\n            (text, values) => client.query(text, values),\n            [...new Set(candidates.map(candidate => candidate.schema))]\n        );\n        for (const line of formatUnindexedSearches(unindexedSearchFindings(candidates, estimates))) console.log(line);\n    } catch (err) {\n        console.log(chalk.gray(`  ⏭ Search on large tables: not checked (${err instanceof Error ? err.message : String(err)})`));\n    } finally {\n        await client.end().catch(() => undefined);\n    }\n}\n","#!/usr/bin/env node\n/**\n * CLI entry point for `rebase doctor`.\n * Invoked via tsx by the server-postgres CLI plugin.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { runDoctor } from \"./doctor\";\nimport { exitCodeForPolicyGate, runPolicyChecks } from \"./doctor-policy-checks\";\nimport { runSearchScaleCheck } from \"./doctor-search-scale\";\nimport { diagnoseDbError } from \"../cli-errors\";\nimport { describeFailure } from \"../cli-output\";\n\nasync function main() {\n    const collectionsArg = process.argv.find((a) => a.startsWith(\"--collections=\"));\n    const schemaArg = process.argv.find((a) => a.startsWith(\"--schema=\"));\n    const sdkArg = process.argv.find((a) => a.startsWith(\"--sdk=\"));\n    // --policies runs only the RLS checks: no schema diff, no SDK types. Useful\n    // as a CI gate against a deployed database, where the collection files and\n    // generated schema are not what you are asking about.\n    const policiesOnly = process.argv.includes(\"--policies\");\n\n    const collectionsPath = collectionsArg?.split(\"=\")[1] ?? path.join(\"..\", \"config\", \"collections\");\n    const schemaPath = schemaArg?.split(\"=\")[1] ?? path.join(\"src\", \"schema.generated.ts\");\n    const sdkPath = sdkArg?.split(\"=\")[1] ?? path.join(\"..\", \"generated\", \"sdk\", \"database.types.ts\");\n\n    // Load .env\n    try {\n        const dotenv = await import(\"dotenv\");\n        const envPath = process.env.DOTENV_CONFIG_PATH;\n        if (envPath) {\n            dotenv.config({ path: envPath, quiet: true });\n        } else {\n            dotenv.config({ quiet: true });\n        }\n    } catch {\n        // dotenv may not be installed\n    }\n\n    const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;\n\n    if (policiesOnly) {\n        // Non-zero so this can gate CI — the whole point of the flag, and a\n        // check that could not run has not passed. See exitCodeForPolicyGate.\n        process.exit(exitCodeForPolicyGate(await runPolicyChecks(collectionsPath, databaseUrl)));\n    }\n\n    const report = await runDoctor({\n        collectionsPath: path.resolve(process.cwd(), collectionsPath),\n        schemaPath: path.resolve(process.cwd(), schemaPath),\n        sdkPath: path.resolve(process.cwd(), sdkPath),\n        databaseUrl: databaseUrl ?? undefined\n    });\n\n    const policyStatus = await runPolicyChecks(collectionsPath, databaseUrl);\n\n    // A hint about speed, not drift: it never changes the exit code.\n    await runSearchScaleCheck(collectionsPath, databaseUrl);\n\n    // Exit non-zero if there are errors. A policy run that could not happen is\n    // reported loudly above but does not fail the interactive command — the\n    // same treatment the *chosen* skip of the database phase gets. `--policies`\n    // is the gate, and that one fails closed.\n    //\n    // A phase that was skipped by a fault is different, and `blocked` is what\n    // separates the two: \"no DATABASE_URL\" is a local situation somebody may be\n    // content with, while \"the DATABASE_URL you set refuses connections\" would\n    // otherwise let `rebase doctor` go green in CI against a database it never\n    // reached.\n    const blocked = [report.collectionsToSchema, report.schemaToDatabase, report.collectionsToSdk]\n        .some(phase => phase.blocked);\n    if (report.summary.errors > 0 || policyStatus === \"problems\" || blocked) {\n        process.exit(1);\n    }\n}\n\nmain().catch((err) => {\n    // A known database failure has a diagnosis; a stack trace through pg and\n    // drizzle internals is not it. This is the last resort — `runDoctor`\n    // already catches the connection failure it can name — so it exists for\n    // everything reached after the report, the policy checks in particular.\n    const banner = diagnoseDbError(err, process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING);\n    if (banner) {\n        console.error(banner);\n    } else {\n        console.error(chalk.red(`  ✗ Doctor failed: ${describeFailure(err)}`));\n    }\n    process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAgB,sBAAsB,QAAkC;CACpE,OAAO,WAAW,OAAO,IAAI;AACjC;;;;;;;AAQA,eAAsB,gBAAgB,iBAAyB,aAAkD;CAC7G,IAAI,CAAC,aAAa;EACd,QAAQ,MAAM,MAAM,OAAO,qDAAqD,CAAC;EACjF,OAAO;CACX;CAEA,MAAM,eAAe,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;CAChE,IAAI,WAAW;CACf,MAAM,EAAE,SAAS,MAAM,OAAO;CAC9B,MAAM,OAAO,IAAI,KAAK,EAAE,kBAAkB,YAAY,CAAC;CACvD,IAAI;EACA,MAAM,cAAkC,MAAM,gBAAgB,YAAY;EAM1E,IAAI,YAAY,WAAW,GAAG;GAC1B,QAAQ,MAAM,MAAM,IAAI,+BAA+B,cAAc,CAAC;GACtE,QAAQ,MAAM,MAAM,KAAK,iGAAiG,CAAC;GAC3H,OAAO;EACX;EAEA,MAAM,SAAS,OAAO,UAAkB,MAAM,KAAK,MAAM,IAAI,EAAA,CAAG;EAUhE,IAAI;GACA,MAAM,OAAO,UAAU;EAC3B,SAAS,KAAK;GACV,QAAQ,MAAM,MAAM,KAAK,+BAA+B,CAAC;GACzD,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC9G,OAAO;EACX;EAIA,IAAI;GACA,MAAM,sBAAsB,QAAQ,WAAoB;GACxD,QAAQ,IAAI,MAAM,MAAM,4CAA4C,CAAC;EACzE,SAAS,KAAK;GACV,WAAW;GACX,QAAQ,IAAI,EAAE;GACd,QAAQ,MAAM,MAAM,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;EAC7E;EAIA,sBAAsB,WAAoB;EAE1C,MAAM,QAAQ,MAAM,iBAAiB,MAAe,WAAW;EAC/D,QAAQ,IAAI,EAAE;EACd,IAAI,SAAS,KAAK,GAAG;GACjB,WAAW;GACX,QAAQ,IAAI,MAAM,OAAO,0DAA0D,CAAC;GACpF,QAAQ,IAAI,kBAAkB,KAAK,CAAC;EACxC,OACI,QAAQ,IAAI,MAAM,MAAM,4CAA4C,YAAY,OAAO,wBAAwB,CAAC;CAExH,SAAS,KAAK;EAIV,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;EAC9G,OAAO;CACX,UAAU;EACN,MAAM,KAAK,IAAI;CACnB;CACA,OAAO,WAAW,aAAa;AACnC;;;;;;;;;;;;;;;;;;;;AChGA,IAAa,wBAAwB;;;;;;;AAiBrC,SAAgB,yBAAyB,aAA4D;CACjG,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,cAAc,sBAAsB,WAAW,GAAG;EACzD,IAAI,CAAC,2BAA2B,UAAU,GAAG;EAC7C,IAAI;EACJ,IAAI;GACA,UAAU,sBAAsB,UAAU,MAAM,KAAA;EACpD,QAAQ;GAGJ,UAAU;EACd;EACA,IAAI,SAAS;EACb,MAAM,SAAS,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,CAAC,CACrD,QAAQ,GAAG,cAAc,SAAS,SAAS,YAAY,CAAC,SAAS,QAAQ,SAAS,SAAS,MAAM,CAAC,CAClG,KAAK,CAAC,SAAS,GAAG;EACvB,MAAM,QAAQ,aAAa,UAAU;EACrC,IAAI,OAAO,WAAW,KAAK,CAAC,OAAO;EACnC,MAAM,KAAK;GAAE,MAAM,WAAW;GAAM,QAAQ,WAAW,UAAU;GAAU;GAAO;EAAO,CAAC;CAC9F;CACA,OAAO;AACX;;AAGA,SAAgB,wBACZ,YACA,cACA,YAAoB,uBAC0B;CAC9C,OAAO,WACF,KAAI,eAAc;EAAE,GAAG;EAAW,MAAM,aAAa,IAAI,GAAG,UAAU,OAAO,GAAG,UAAU,OAAO,KAAK;CAAE,EAAE,CAAC,CAC3G,QAAO,cAAa,UAAU,OAAO,SAAS;AACvD;;;;;;;AAQA,eAAsB,kBAClB,OACA,SAC4B;CAC5B,MAAM,EAAE,SAAS,MAAM,MACnB;;;;;iEAMA,CAAC,OAAO,CACZ;CACA,OAAO,IAAI,IAAI,KAAK,KAAI,QAAO,CAAC,GAAG,IAAI,OAAO,GAAG,IAAI,SAAS,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;AACpF;;AAGA,SAAgB,wBAAwB,UAAoE;CACxG,IAAI,SAAS,WAAW,GAAG,OAAO,CAAC;CACnC,MAAM,QAAQ,CAAC,IAAI,MAAM,OAAO,OAAO,SAAS,OAAO,oDAAoD,CAAC;CAC5G,KAAK,MAAM,WAAW,UAClB,MAAM,KAAK,MAAM,OACb,UAAU,QAAQ,KAAK,WAAW,QAAQ,KAAK,eAAe,OAAO,EAAE,8DAChD,QAAQ,OAAO,KAAK,IAAI,GACnD,CAAC;CAEL,MAAM,KAAK,MAAM,KACb,iMAEJ,CAAC;CACD,OAAO;AACX;;;;;;AAOA,eAAsB,oBAAoB,iBAAyB,aAAqC;CACpG,IAAI,CAAC,aAAa;CAClB,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,YAAY,CAAC;CAC3D,IAAI;EAEA,MAAM,aAAa,yBAAyB,MADlB,gBAAgB,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe,CAAC,CAC/B;EACvD,IAAI,WAAW,WAAW,GAAG;EAC7B,MAAM,OAAO,QAAQ;EACrB,MAAM,YAAY,MAAM,mBACnB,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM,GAC3C,CAAC,GAAG,IAAI,IAAI,WAAW,KAAI,cAAa,UAAU,MAAM,CAAC,CAAC,CAC9D;EACA,KAAK,MAAM,QAAQ,wBAAwB,wBAAwB,YAAY,SAAS,CAAC,GAAG,QAAQ,IAAI,IAAI;CAChH,SAAS,KAAK;EACV,QAAQ,IAAI,MAAM,KAAK,4CAA4C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,EAAE,CAAC;CAC3H,UAAU;EACN,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5C;AACJ;;;;;;;AC7HA,eAAe,OAAO;CAClB,MAAM,iBAAiB,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,gBAAgB,CAAC;CAC9E,MAAM,YAAY,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC;CACpE,MAAM,SAAS,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,QAAQ,CAAC;CAI9D,MAAM,eAAe,QAAQ,KAAK,SAAS,YAAY;CAEvD,MAAM,kBAAkB,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,UAAU,aAAa;CAChG,MAAM,aAAa,WAAW,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,OAAO,qBAAqB;CACrF,MAAM,UAAU,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,aAAa,OAAO,mBAAmB;CAGhG,IAAI;EACA,MAAM,SAAS,MAAM,OAAO;EAC5B,MAAM,UAAU,QAAQ,IAAI;EAC5B,IAAI,SACA,OAAO,OAAO;GAAE,MAAM;GAAS,OAAO;EAAK,CAAC;OAE5C,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CAErC,QAAQ,CAER;CAEA,MAAM,cAAc,QAAQ,IAAI,gBAAgB,QAAQ,IAAI;CAE5D,IAAI,cAGA,QAAQ,KAAK,sBAAsB,MAAM,gBAAgB,iBAAiB,WAAW,CAAC,CAAC;CAG3F,MAAM,SAAS,MAAM,UAAU;EAC3B,iBAAiB,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;EAC5D,YAAY,KAAK,QAAQ,QAAQ,IAAI,GAAG,UAAU;EAClD,SAAS,KAAK,QAAQ,QAAQ,IAAI,GAAG,OAAO;EAC5C,aAAa,eAAe,KAAA;CAChC,CAAC;CAED,MAAM,eAAe,MAAM,gBAAgB,iBAAiB,WAAW;CAGvE,MAAM,oBAAoB,iBAAiB,WAAW;CAYtD,MAAM,UAAU;EAAC,OAAO;EAAqB,OAAO;EAAkB,OAAO;CAAgB,CAAC,CACzF,MAAK,UAAS,MAAM,OAAO;CAChC,IAAI,OAAO,QAAQ,SAAS,KAAK,iBAAiB,cAAc,SAC5D,QAAQ,KAAK,CAAC;AAEtB;AAEA,KAAK,CAAC,CAAC,OAAO,QAAQ;CAKlB,MAAM,SAAS,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,QAAQ,IAAI,uBAAuB;CACnG,IAAI,QACA,QAAQ,MAAM,MAAM;MAEpB,QAAQ,MAAM,MAAM,IAAI,sBAAsB,gBAAgB,GAAG,GAAG,CAAC;CAEzE,QAAQ,KAAK,CAAC;AAClB,CAAC"}

package/dist/schema/doctor-search-scale.d.ts

@@ -0,0 +1,45 @@
+import { type CollectionConfig } from "@rebasepro/types";
+/** Above this many rows an unindexed search is worth a word. */
+export declare const UNINDEXED_SEARCH_ROWS = 10000;
+/** A collection whose search would be `ILIKE` over these fields. */
+export interface IlikeSearchedCollection {
+    slug: string;
+    schema: string;
+    table: string;
+    /** The string properties the search reads. */
+    fields: string[];
+}
+/**
+ * The collections a search reaches without an index: no `search` block (or
+ * one that does not build), and at least one property the default search
+ * reads — a `string`, not an enum, not a uuid key (the rule in
+ * `DrizzleConditionBuilder.buildSearchConditions`).
+ */
+export declare function ilikeSearchedCollections(collections: CollectionConfig[]): IlikeSearchedCollection[];
+/** Those of `candidates` whose table holds more than `threshold` rows, by estimate. */
+export declare function unindexedSearchFindings(candidates: IlikeSearchedCollection[], rowEstimates: ReadonlyMap<string, number>, threshold?: number): (IlikeSearchedCollection & {
+    rows: number;
+})[];
+/**
+ * Row counts by `schema.table`, estimated — `pg_class.reltuples`, or the
+ * statistics collector's live-tuple count when the table was never analysed.
+ * Nothing is scanned: counting the tables this is about would be the cost it
+ * warns of.
+ */
+export declare function estimateRowCounts(query: (text: string, values: unknown[]) => Promise<{
+    rows: {
+        schema: string;
+        table: string;
+        rows: string | number;
+    }[];
+}>, schemas: string[]): Promise<Map<string, number>>;
+/** The report, one warning per collection. */
+export declare function formatUnindexedSearches(findings: (IlikeSearchedCollection & {
+    rows: number;
+})[]): string[];
+/**
+ * Print the warning for the project at `collectionsPath`, against
+ * `databaseUrl`. Never throws and never fails the run: it is a hint, and a
+ * check that could not run says so in one grey line.
+ */
+export declare function runSearchScaleCheck(collectionsPath: string, databaseUrl?: string): Promise<void>;

package/dist/schema/doctor.d.ts

@@ -1,5 +1,5 @@
 import { CollectionConfig, Property } from "@rebasepro/types";
-import type { PgType, TablePlan } from "./plan/types.js";
+import type { PgType, SchemaPlan, TablePlan } from "./plan/types.js";
 export type IssueSeverity = "error" | "warning" | "info";
 export interface DoctorIssue {
     severity: IssueSeverity;
@@ -148,6 +148,25 @@ export declare function primaryKeyIssues(tablePlan: TablePlan, dbPk: string[], d
  */
 export declare function junctionKeyIssues(junctionPlan: TablePlan, dbColumns: DbColumn[], dbPk: string[], displayName: string): DoctorIssue[];
 export declare function checkCollectionsVsDatabase(collections: CollectionConfig[], databaseUrl: string): Promise<DoctorPhase>;
+/**
+ * A `public` table in the junction shape that no collection declares.
+ *
+ * The shape is the planner's: exactly two columns, together the primary key,
+ * each a single-column foreign key to a collection's table. Renaming or
+ * removing a many-to-many leaves such a table behind — push and boot only
+ * create — with every link row still in it and nothing reading it.
+ *
+ * Info, never more: the table may be data somebody still wants. The remedy is
+ * shown, never run.
+ */
+export declare function orphanedJunctionIssues(plan: SchemaPlan, columnsByTable: Map<string, {
+    column_name: string;
+}[]>, pksByTable: Map<string, string[]>, fksByTable: Map<string, {
+    constraint_name: string;
+    column_name: string;
+    foreign_table_schema: string;
+    foreign_table_name: string;
+}[]>): DoctorIssue[];
 export declare function renderReport(report: DoctorReport): void;
 export declare function runDoctor(options: {
     collectionsPath: string;

package/dist/schema/ensure-collection-policies.d.ts

@@ -1,43 +1,17 @@
-/**
- * Applying a bundle's RLS policies to a database at boot, idempotently.
- *
- * ## Why this exists
- *
- * {@link ensureCollectionTables} creates the collection *tables* a managed
- * runtime boots against, but a table with row-level security disabled and no
- * policies is not servable: authenticated requests run as the restricted
- * `rebase_user` role, so a read with no `SELECT` policy returns nothing (a
- * public collection answered 401) and a write with no `INSERT`/`UPDATE` policy
- * is denied. The policies live in the collections' `securityRules`; nothing at
- * boot applied them. `rebase db push` does — but it drives Atlas against a
- * local `DATABASE_URL`, and a managed tenant's database is reachable only from
- * inside the cluster, by the runtime that is already connected to it. So the
- * runtime is the only thing that *can* apply them, and this is where it does.
- *
- * ## Why this is safe to run on every boot
- *
- * Every statement is idempotent: `ENABLE ROW LEVEL SECURITY` is a no-op once
- * enabled, and each policy is a `DROP POLICY IF EXISTS` immediately followed by
- * a `CREATE POLICY`, so re-applying asserts exactly the declared state. It adds
- * and replaces; it never drops data. (It does not *reconcile* — a policy a
- * previous push left behind under an old name is not removed here; that stays a
- * `db push` / `db migrate` concern, alongside destructive schema changes.)
- *
- * Unlike table creation, a failure here is not fatal: RLS stays enabled, so a
- * table whose policies could not be applied fails **closed** (denies) rather
- * than leaking rows. One collection's policy failing (e.g. a rule that
- * references a table a real migration has not created yet) must not crash-loop
- * the whole deployment and take the other collections' working routes down with
- * it. Failures are reported loudly and per-table so the operator can see
- * exactly which collection is not yet servable and why.
- */
 import { type CollectionConfig } from "@rebasepro/types";
+import { type CollectionPolicyPlan } from "./generate-postgres-ddl-logic.js";
 import { type Queryable } from "./ensure-collection-tables.js";
+import { type BootLockOptions } from "./boot-ddl.js";
 export interface PolicyEnsureResult {
     /** `CREATE POLICY` statements that ran successfully. */
     policiesApplied: number;
-    /** Tables that had RLS enabled. */
+    /** Tables that had RLS enabled — including the {@link unchanged} ones, which already had it. */
     tablesSecured: number;
+    /**
+     * Tables whose policies were already exactly the declared ones, RLS on, by
+     * the stamp each policy carries — left alone: no statement, no lock.
+     */
+    unchanged: number;
     /** Declared tables absent from the database — left to a real migration. */
     skipped: {
         table: string;
@@ -80,7 +54,34 @@ export interface PolicyEnsureResult {
      * database — which is the reason this module exists. So boot has to do it.
      */
     orphansDropped: number;
+    /**
+     * Tables whose policies were not re-applied because another session held
+     * the table's lock for every attempt — a long transaction, a report, a
+     * dump. Each table's policy statements run in one transaction, so a table
+     * here was left exactly as it was: RLS on, its existing policies in force.
+     * `rulesChanged` says whether those differ from the declared ones by name
+     * (a rule whose policy is missing, or an orphan still granting), in which
+     * case the new rules are not in force on this table until a later boot.
+     */
+    deferred: {
+        table: string;
+        error: string;
+        rulesChanged: boolean;
+    }[];
 }
+/** What every policy stamp starts with. See {@link policyStampSql}. */
+export declare const POLICY_STAMP_PREFIX = "rebase:";
+/**
+ * One statement that stamps every policy the plan just created on its table:
+ * `COMMENT ON POLICY … IS 'rebase:<hash>'`, the hash taken over the rendered
+ * statement's hash and the definition Postgres stored — read back here, after
+ * the `CREATE`s, in the same transaction. A `DO` block because the stored
+ * definition is only known once the policy exists, and a `COMMENT` takes a
+ * literal. One line, and it names only this table.
+ *
+ * `undefined` for a table the plan gives no policies.
+ */
+export declare function policyStampSql(plan: CollectionPolicyPlan): string | undefined;
 export interface TableLockResult {
     /** Tables RLS is now on for. */
     locked: number;
@@ -103,4 +104,41 @@ export interface TableLockResult {
  * a table that does not exist, and the step that creates it locks it.
  */
 export declare function lockCollectionTables(client: Queryable, collections: CollectionConfig[]): Promise<TableLockResult>;
-export declare function ensureCollectionPolicies(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void): Promise<PolicyEnsureResult>;
+/**
+ * Bring the declared collections' RLS policies up to date. Returns what it did.
+ *
+ * Only tables that already exist are touched: the boot-time table creator runs
+ * first, so anything still missing is a table this additive path did not
+ * create (it creates junctions too) — one a failed boot DDL left out, or a
+ * project whose schema a migration owns. Enabling RLS on a
+ * non-existent table would error, so those are recorded as skipped, not failed.
+ *
+ * ## One transaction per table
+ *
+ * Each table's statements — `ENABLE` when RLS is off, every `DROP POLICY IF
+ * EXISTS` / `CREATE POLICY` pair, the orphan drops — go to Postgres as one
+ * string, which it runs as one transaction (see `boot-ddl`). Before, each was
+ * its own autocommit: at 240 tables, 4,080 commits and 4,080 ACCESS EXCLUSIVE
+ * lock acquisitions per boot, 6–22 s on a disk that really flushes. And between
+ * a policy's DROP and its CREATE, every other replica evaluated the table with
+ * that policy missing — a user's continuous reads of their own row came back
+ * empty once per boot (measured, Postgres 18). Now a concurrent request sees the
+ * old policies or the new ones, never neither.
+ *
+ * If the transaction fails for any reason but a lock timeout, the table is
+ * applied again one statement at a time, exactly as before — so a rule that
+ * cannot be created (a function a migration has not added yet) leaves the
+ * table in the same deny-leaning partial state it always did, rather than
+ * rolling back to the old, possibly looser, policies.
+ *
+ * ## Lock budget
+ *
+ * The transaction runs under `lock_timeout` (`boot-ddl`), so a table that a
+ * long transaction, a report or a dump is holding costs live traffic one
+ * second, not the statement timeout. A contended table is retried after the
+ * others, with backoff, within a retry budget for the whole step; one still
+ * held after that is reported in `deferred` — its transaction rolled back, so
+ * it is exactly as it was before this boot — or, if RLS was off on it, closed
+ * by revoking the user role's grant, as any table RLS cannot be enabled on is.
+ */
+export declare function ensureCollectionPolicies(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void, options?: BootLockOptions): Promise<PolicyEnsureResult>;