@rebasepro/server-postgres 0.24.0 → 0.24.1-canary.gcb918fc

package/dist/schema/doctor-cli.js

@@ -1,11 +1,14 @@
 #!/usr/bin/env node
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { i as diagnoseDbError } from "../cli-errors-DsA-K9uP.js";
-import { c as warnOnAnonymousGrants, s as validatePolicyPgRoles } from "../rls-enforcement-CfXOJJaW.js";
-import { t as chalk } from "../source-Br7L7GOI.js";
-import { n as loadCollections, r as runDoctor } from "../doctor-C-sYWbmt.js";
-import { n as formatPolicyDrift, r as hasDrift, t as checkPolicyDrift } from "../policy-drift-B-J2hhm0.js";
+import { a as buildSearchColumnSpec } from "../search-column-BM-GV6vH.js";
+import { i as diagnoseDbError } from "../cli-errors-CaI4ntyD.js";
+import { l as validatePolicyPgRoles, u as warnOnAnonymousGrants } from "../rls-enforcement-DvzqlaL1.js";
+import { n as describeFailure, t as chalk } from "../source-DBDbBTL4.js";
+import { n as loadCollections, r as runDoctor } from "../doctor-C4WiftHm.js";
+import { n as formatPolicyDrift, r as hasDrift, t as checkPolicyDrift } from "../policy-drift-Dm8i-s1J.js";
+import { isPostgresCollectionConfig } from "@rebasepro/types";
+import { getTableName, relationalCollections } from "@rebasepro/common";
 import path from "path";
 //#region src/schema/doctor-policy-checks.ts
 /**
@@ -80,6 +83,106 @@ async function runPolicyChecks(collectionsPath, databaseUrl) {
 	return problems ? "problems" : "ok";
 }
 //#endregion
+//#region src/schema/doctor-search-scale.ts
+/**
+* `rebase doctor`: collections searched by a full scan of a large table.
+*
+* Without a `search` block, a search — the admin's search box, `?searchString=`,
+* `.search()` — is `ILIKE '%term%'` over every text column. A leading `%`
+* defeats a B-tree, so each one reads the whole table: on 100k posts a search
+* took 326 ms, half for the page and half for its count. Nothing reports it;
+* the box just gets slower as the table grows. This names the collections
+* where that has started to matter, and points at the block that fixes it.
+*
+* A hint, not a failure: it never changes doctor's exit code, and the database
+* is not changed — Rebase does not add a search index on its own.
+*
+* Lives beside `doctor-cli.ts` rather than inside it because that file runs
+* `main()` on import.
+*/
+/** Above this many rows an unindexed search is worth a word. */
+var UNINDEXED_SEARCH_ROWS = 1e4;
+/**
+* The collections a search reaches without an index: no `search` block (or
+* one that does not build), and at least one property the default search
+* reads — a `string`, not an enum, not a uuid key (the rule in
+* `DrizzleConditionBuilder.buildSearchConditions`).
+*/
+function ilikeSearchedCollections(collections) {
+	const found = [];
+	for (const collection of relationalCollections(collections)) {
+		if (!isPostgresCollectionConfig(collection)) continue;
+		let indexed;
+		try {
+			indexed = buildSearchColumnSpec(collection) !== void 0;
+		} catch {
+			indexed = false;
+		}
+		if (indexed) continue;
+		const fields = Object.entries(collection.properties ?? {}).filter(([, property]) => property.type === "string" && !property.enum && property.isId !== "uuid").map(([key]) => key);
+		const table = getTableName(collection);
+		if (fields.length === 0 || !table) continue;
+		found.push({
+			slug: collection.slug,
+			schema: collection.schema ?? "public",
+			table,
+			fields
+		});
+	}
+	return found;
+}
+/** Those of `candidates` whose table holds more than `threshold` rows, by estimate. */
+function unindexedSearchFindings(candidates, rowEstimates, threshold = UNINDEXED_SEARCH_ROWS) {
+	return candidates.map((candidate) => ({
+		...candidate,
+		rows: rowEstimates.get(`${candidate.schema}.${candidate.table}`) ?? 0
+	})).filter((candidate) => candidate.rows > threshold);
+}
+/**
+* Row counts by `schema.table`, estimated — `pg_class.reltuples`, or the
+* statistics collector's live-tuple count when the table was never analysed.
+* Nothing is scanned: counting the tables this is about would be the cost it
+* warns of.
+*/
+async function estimateRowCounts(query, schemas) {
+	const { rows } = await query(`SELECT n.nspname AS schema, c.relname AS table,
+                GREATEST(c.reltuples, COALESCE(s.n_live_tup, 0), 0)::bigint AS rows
+         FROM pg_class c
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+         LEFT JOIN pg_stat_user_tables s ON s.relid = c.oid
+         WHERE c.relkind IN ('r', 'p') AND n.nspname = ANY($1)`, [schemas]);
+	return new Map(rows.map((row) => [`${row.schema}.${row.table}`, Number(row.rows)]));
+}
+/** The report, one warning per collection. */
+function formatUnindexedSearches(findings) {
+	if (findings.length === 0) return [];
+	const lines = ["", chalk.yellow(`  ⚠ ${findings.length} collection(s) searched by reading the whole table:`)];
+	for (const finding of findings) lines.push(chalk.yellow(`     • ${finding.slug} — about ${finding.rows.toLocaleString("en-US")} rows, no \`search\` block: a search is ILIKE '%term%' over ${finding.fields.join(", ")}`));
+	lines.push(chalk.gray("    Each search reads every row, and its count reads them again. A `search` block indexes it\n    (full-text, or `mode: \"hybrid\"` for substrings too): https://rebase.pro/docs/backend/search"));
+	return lines;
+}
+/**
+* Print the warning for the project at `collectionsPath`, against
+* `databaseUrl`. Never throws and never fails the run: it is a hint, and a
+* check that could not run says so in one grey line.
+*/
+async function runSearchScaleCheck(collectionsPath, databaseUrl) {
+	if (!databaseUrl) return;
+	const { Client } = await import("pg");
+	const client = new Client({ connectionString: databaseUrl });
+	try {
+		const candidates = ilikeSearchedCollections(await loadCollections(path.resolve(process.cwd(), collectionsPath)));
+		if (candidates.length === 0) return;
+		await client.connect();
+		const estimates = await estimateRowCounts((text, values) => client.query(text, values), [...new Set(candidates.map((candidate) => candidate.schema))]);
+		for (const line of formatUnindexedSearches(unindexedSearchFindings(candidates, estimates))) console.log(line);
+	} catch (err) {
+		console.log(chalk.gray(`  ⏭ Search on large tables: not checked (${err instanceof Error ? err.message : String(err)})`));
+	} finally {
+		await client.end().catch(() => void 0);
+	}
+}
+//#endregion
 //#region src/schema/doctor-cli.ts
 /**
 * CLI entry point for `rebase doctor`.
@@ -111,6 +214,7 @@ async function main() {
 		databaseUrl: databaseUrl ?? void 0
 	});
 	const policyStatus = await runPolicyChecks(collectionsPath, databaseUrl);
+	await runSearchScaleCheck(collectionsPath, databaseUrl);
 	const blocked = [
 		report.collectionsToSchema,
 		report.schemaToDatabase,
@@ -121,7 +225,7 @@ async function main() {
 main().catch((err) => {
 	const banner = diagnoseDbError(err, process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING);
 	if (banner) console.error(banner);
-	else console.error(chalk.red("  ✗ Doctor failed"), err instanceof Error ? err.stack ?? err.message : String(err));
+	else console.error(chalk.red(`  ✗ Doctor failed: ${describeFailure(err)}`));
 	process.exit(1);
 });
 //#endregion

package/dist/schema/doctor-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-cli.js","names":[],"sources":["../../src/schema/doctor-policy-checks.ts","../../src/schema/doctor-cli.ts"],"sourcesContent":["/**\n * The RLS half of `rebase doctor`, and the exit code `--policies` gates CI on.\n *\n * Lives beside `doctor-cli.ts` rather than inside it because that file runs\n * `main()` on import: a gate whose failure modes cannot be unit-tested is how\n * this one shipped reporting success for work it never did.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { CollectionConfig } from \"@rebasepro/types\";\nimport { loadCollections } from \"./doctor\";\nimport { checkPolicyDrift, formatPolicyDrift, hasDrift } from \"../security/policy-drift\";\nimport { validatePolicyPgRoles, warnOnAnonymousGrants } from \"../security/rls-enforcement\";\n\n/**\n * What the RLS checks concluded.\n *\n * `unchecked` exists because \"we could not look\" and \"we looked and it is fine\"\n * used to be reported identically: a collections path that did not resolve made\n * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`\n * early-returned an empty diff, and the gate printed\n * `✓ RLS policies match your collections` having compared zero policies against\n * zero collections. Any exception at all — a collection file that throws on\n * import, a `pg_policies` read the CI role is not granted, a connection reset —\n * did the same thing through a `warn`, and exited 0.\n */\nexport type PolicyCheckStatus = \"ok\" | \"problems\" | \"unchecked\";\n\n/**\n * The exit code for `rebase doctor --policies`.\n *\n * A gate that could not run has not passed. Only a completed, clean check\n * exits 0 — anything else, including \"we never opened a connection\", is a\n * failure, or the flag certifies a database nobody looked at.\n */\nexport function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1 {\n    return status === \"ok\" ? 0 : 1;\n}\n\n/**\n * Policies actually deployed vs the ones the collections describe, plus policy\n * roles this server could never satisfy.\n *\n * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.\n */\nexport async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus> {\n    if (!databaseUrl) {\n        console.error(chalk.yellow(\"  ⚠ No DATABASE_URL — RLS policies were NOT checked\"));\n        return \"unchecked\";\n    }\n\n    const resolvedPath = path.resolve(process.cwd(), collectionsPath);\n    let problems = false;\n    const { Pool } = await import(\"pg\");\n    const pool = new Pool({ connectionString: databaseUrl });\n    try {\n        const collections: CollectionConfig[] = await loadCollections(resolvedPath);\n\n        // Zero collections is not \"no drift\", it is nothing to compare. The\n        // loader returns `[]` for a path that does not exist, so the commonest\n        // way to get here is a `--collections` path resolved against the wrong\n        // directory — which used to render as a green tick.\n        if (collections.length === 0) {\n            console.error(chalk.red(`  ✗ No collections found in ${resolvedPath}`));\n            console.error(chalk.gray(\"    RLS policies were NOT checked. Pass --collections=<dir> if your collections live elsewhere.\"));\n            return \"unchecked\";\n        }\n\n        const runSql = async (text: string) => (await pool.query(text)).rows as Record<string, unknown>[];\n\n        // Prove the connection before anything is ticked.\n        //\n        // `validatePolicyPgRoles` returns without a query when no collection\n        // names a `pgRoles` — which is most projects — so it \"passed\" against a\n        // database that was never reached, and the tick printed above an\n        // ECONNREFUSED that only surfaced two checks later. Ten lines up, this\n        // file says that reporting success for work it never did is the reason\n        // it exists. This is the same shape, one function along.\n        try {\n            await runSql(\"SELECT 1\");\n        } catch (err) {\n            console.error(chalk.gray(\"  ⏭ Policy roles: not checked\"));\n            console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n            return \"unchecked\";\n        }\n\n        // A policy naming a role the server never runs as filters every row, so\n        // the collection reads as empty. Report it without booting a server.\n        try {\n            await validatePolicyPgRoles(runSql, collections as never);\n            console.log(chalk.green(\"  ✓ Policy roles are usable by this server\"));\n        } catch (err) {\n            problems = true;\n            console.log(\"\");\n            console.error(chalk.red(err instanceof Error ? err.message : String(err)));\n        }\n\n        // A rule that reads as a lockdown but is true for every caller compiles\n        // to a grant. Report it without booting a server.\n        warnOnAnonymousGrants(collections as never);\n\n        const drift = await checkPolicyDrift(pool as never, collections);\n        console.log(\"\");\n        if (hasDrift(drift)) {\n            problems = true;\n            console.log(chalk.yellow(\"  RLS policies: database does not match your collections\"));\n            console.log(formatPolicyDrift(drift));\n        } else {\n            console.log(chalk.green(`  ✓ RLS policies match your collections (${collections.length} collection(s) checked)`));\n        }\n    } catch (err) {\n        // Fail closed. This catch covers every query and every collection import\n        // above, so returning the pre-catch verdict made the documented CI gate\n        // green on exactly the runs it exists to catch.\n        console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n        return \"unchecked\";\n    } finally {\n        await pool.end();\n    }\n    return problems ? \"problems\" : \"ok\";\n}\n","#!/usr/bin/env node\n/**\n * CLI entry point for `rebase doctor`.\n * Invoked via tsx by the server-postgres CLI plugin.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { runDoctor } from \"./doctor\";\nimport { exitCodeForPolicyGate, runPolicyChecks } from \"./doctor-policy-checks\";\nimport { diagnoseDbError } from \"../cli-errors\";\n\nasync function main() {\n    const collectionsArg = process.argv.find((a) => a.startsWith(\"--collections=\"));\n    const schemaArg = process.argv.find((a) => a.startsWith(\"--schema=\"));\n    const sdkArg = process.argv.find((a) => a.startsWith(\"--sdk=\"));\n    // --policies runs only the RLS checks: no schema diff, no SDK types. Useful\n    // as a CI gate against a deployed database, where the collection files and\n    // generated schema are not what you are asking about.\n    const policiesOnly = process.argv.includes(\"--policies\");\n\n    const collectionsPath = collectionsArg?.split(\"=\")[1] ?? path.join(\"..\", \"config\", \"collections\");\n    const schemaPath = schemaArg?.split(\"=\")[1] ?? path.join(\"src\", \"schema.generated.ts\");\n    const sdkPath = sdkArg?.split(\"=\")[1] ?? path.join(\"..\", \"generated\", \"sdk\", \"database.types.ts\");\n\n    // Load .env\n    try {\n        const dotenv = await import(\"dotenv\");\n        const envPath = process.env.DOTENV_CONFIG_PATH;\n        if (envPath) {\n            dotenv.config({ path: envPath, quiet: true });\n        } else {\n            dotenv.config({ quiet: true });\n        }\n    } catch {\n        // dotenv may not be installed\n    }\n\n    const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;\n\n    if (policiesOnly) {\n        // Non-zero so this can gate CI — the whole point of the flag, and a\n        // check that could not run has not passed. See exitCodeForPolicyGate.\n        process.exit(exitCodeForPolicyGate(await runPolicyChecks(collectionsPath, databaseUrl)));\n    }\n\n    const report = await runDoctor({\n        collectionsPath: path.resolve(process.cwd(), collectionsPath),\n        schemaPath: path.resolve(process.cwd(), schemaPath),\n        sdkPath: path.resolve(process.cwd(), sdkPath),\n        databaseUrl: databaseUrl ?? undefined\n    });\n\n    const policyStatus = await runPolicyChecks(collectionsPath, databaseUrl);\n\n    // Exit non-zero if there are errors. A policy run that could not happen is\n    // reported loudly above but does not fail the interactive command — the\n    // same treatment the *chosen* skip of the database phase gets. `--policies`\n    // is the gate, and that one fails closed.\n    //\n    // A phase that was skipped by a fault is different, and `blocked` is what\n    // separates the two: \"no DATABASE_URL\" is a local situation somebody may be\n    // content with, while \"the DATABASE_URL you set refuses connections\" would\n    // otherwise let `rebase doctor` go green in CI against a database it never\n    // reached.\n    const blocked = [report.collectionsToSchema, report.schemaToDatabase, report.collectionsToSdk]\n        .some(phase => phase.blocked);\n    if (report.summary.errors > 0 || policyStatus === \"problems\" || blocked) {\n        process.exit(1);\n    }\n}\n\nmain().catch((err) => {\n    // A known database failure has a diagnosis; a stack trace through pg and\n    // drizzle internals is not it. This is the last resort — `runDoctor`\n    // already catches the connection failure it can name — so it exists for\n    // everything reached after the report, the policy checks in particular.\n    const banner = diagnoseDbError(err, process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING);\n    if (banner) {\n        console.error(banner);\n    } else {\n        console.error(chalk.red(\"  ✗ Doctor failed\"), err instanceof Error ? (err.stack ?? err.message) : String(err));\n    }\n    process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAgB,sBAAsB,QAAkC;CACpE,OAAO,WAAW,OAAO,IAAI;AACjC;;;;;;;AAQA,eAAsB,gBAAgB,iBAAyB,aAAkD;CAC7G,IAAI,CAAC,aAAa;EACd,QAAQ,MAAM,MAAM,OAAO,qDAAqD,CAAC;EACjF,OAAO;CACX;CAEA,MAAM,eAAe,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;CAChE,IAAI,WAAW;CACf,MAAM,EAAE,SAAS,MAAM,OAAO;CAC9B,MAAM,OAAO,IAAI,KAAK,EAAE,kBAAkB,YAAY,CAAC;CACvD,IAAI;EACA,MAAM,cAAkC,MAAM,gBAAgB,YAAY;EAM1E,IAAI,YAAY,WAAW,GAAG;GAC1B,QAAQ,MAAM,MAAM,IAAI,+BAA+B,cAAc,CAAC;GACtE,QAAQ,MAAM,MAAM,KAAK,iGAAiG,CAAC;GAC3H,OAAO;EACX;EAEA,MAAM,SAAS,OAAO,UAAkB,MAAM,KAAK,MAAM,IAAI,EAAA,CAAG;EAUhE,IAAI;GACA,MAAM,OAAO,UAAU;EAC3B,SAAS,KAAK;GACV,QAAQ,MAAM,MAAM,KAAK,+BAA+B,CAAC;GACzD,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC9G,OAAO;EACX;EAIA,IAAI;GACA,MAAM,sBAAsB,QAAQ,WAAoB;GACxD,QAAQ,IAAI,MAAM,MAAM,4CAA4C,CAAC;EACzE,SAAS,KAAK;GACV,WAAW;GACX,QAAQ,IAAI,EAAE;GACd,QAAQ,MAAM,MAAM,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;EAC7E;EAIA,sBAAsB,WAAoB;EAE1C,MAAM,QAAQ,MAAM,iBAAiB,MAAe,WAAW;EAC/D,QAAQ,IAAI,EAAE;EACd,IAAI,SAAS,KAAK,GAAG;GACjB,WAAW;GACX,QAAQ,IAAI,MAAM,OAAO,0DAA0D,CAAC;GACpF,QAAQ,IAAI,kBAAkB,KAAK,CAAC;EACxC,OACI,QAAQ,IAAI,MAAM,MAAM,4CAA4C,YAAY,OAAO,wBAAwB,CAAC;CAExH,SAAS,KAAK;EAIV,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;EAC9G,OAAO;CACX,UAAU;EACN,MAAM,KAAK,IAAI;CACnB;CACA,OAAO,WAAW,aAAa;AACnC;;;;;;;AC7GA,eAAe,OAAO;CAClB,MAAM,iBAAiB,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,gBAAgB,CAAC;CAC9E,MAAM,YAAY,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC;CACpE,MAAM,SAAS,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,QAAQ,CAAC;CAI9D,MAAM,eAAe,QAAQ,KAAK,SAAS,YAAY;CAEvD,MAAM,kBAAkB,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,UAAU,aAAa;CAChG,MAAM,aAAa,WAAW,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,OAAO,qBAAqB;CACrF,MAAM,UAAU,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,aAAa,OAAO,mBAAmB;CAGhG,IAAI;EACA,MAAM,SAAS,MAAM,OAAO;EAC5B,MAAM,UAAU,QAAQ,IAAI;EAC5B,IAAI,SACA,OAAO,OAAO;GAAE,MAAM;GAAS,OAAO;EAAK,CAAC;OAE5C,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CAErC,QAAQ,CAER;CAEA,MAAM,cAAc,QAAQ,IAAI,gBAAgB,QAAQ,IAAI;CAE5D,IAAI,cAGA,QAAQ,KAAK,sBAAsB,MAAM,gBAAgB,iBAAiB,WAAW,CAAC,CAAC;CAG3F,MAAM,SAAS,MAAM,UAAU;EAC3B,iBAAiB,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;EAC5D,YAAY,KAAK,QAAQ,QAAQ,IAAI,GAAG,UAAU;EAClD,SAAS,KAAK,QAAQ,QAAQ,IAAI,GAAG,OAAO;EAC5C,aAAa,eAAe,KAAA;CAChC,CAAC;CAED,MAAM,eAAe,MAAM,gBAAgB,iBAAiB,WAAW;CAYvE,MAAM,UAAU;EAAC,OAAO;EAAqB,OAAO;EAAkB,OAAO;CAAgB,CAAC,CACzF,MAAK,UAAS,MAAM,OAAO;CAChC,IAAI,OAAO,QAAQ,SAAS,KAAK,iBAAiB,cAAc,SAC5D,QAAQ,KAAK,CAAC;AAEtB;AAEA,KAAK,CAAC,CAAC,OAAO,QAAQ;CAKlB,MAAM,SAAS,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,QAAQ,IAAI,uBAAuB;CACnG,IAAI,QACA,QAAQ,MAAM,MAAM;MAEpB,QAAQ,MAAM,MAAM,IAAI,mBAAmB,GAAG,eAAe,QAAS,IAAI,SAAS,IAAI,UAAW,OAAO,GAAG,CAAC;CAEjH,QAAQ,KAAK,CAAC;AAClB,CAAC"}
+{"version":3,"file":"doctor-cli.js","names":[],"sources":["../../src/schema/doctor-policy-checks.ts","../../src/schema/doctor-search-scale.ts","../../src/schema/doctor-cli.ts"],"sourcesContent":["/**\n * The RLS half of `rebase doctor`, and the exit code `--policies` gates CI on.\n *\n * Lives beside `doctor-cli.ts` rather than inside it because that file runs\n * `main()` on import: a gate whose failure modes cannot be unit-tested is how\n * this one shipped reporting success for work it never did.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { CollectionConfig } from \"@rebasepro/types\";\nimport { loadCollections } from \"./doctor\";\nimport { checkPolicyDrift, formatPolicyDrift, hasDrift } from \"../security/policy-drift\";\nimport { validatePolicyPgRoles, warnOnAnonymousGrants } from \"../security/rls-enforcement\";\n\n/**\n * What the RLS checks concluded.\n *\n * `unchecked` exists because \"we could not look\" and \"we looked and it is fine\"\n * used to be reported identically: a collections path that did not resolve made\n * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`\n * early-returned an empty diff, and the gate printed\n * `✓ RLS policies match your collections` having compared zero policies against\n * zero collections. Any exception at all — a collection file that throws on\n * import, a `pg_policies` read the CI role is not granted, a connection reset —\n * did the same thing through a `warn`, and exited 0.\n */\nexport type PolicyCheckStatus = \"ok\" | \"problems\" | \"unchecked\";\n\n/**\n * The exit code for `rebase doctor --policies`.\n *\n * A gate that could not run has not passed. Only a completed, clean check\n * exits 0 — anything else, including \"we never opened a connection\", is a\n * failure, or the flag certifies a database nobody looked at.\n */\nexport function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1 {\n    return status === \"ok\" ? 0 : 1;\n}\n\n/**\n * Policies actually deployed vs the ones the collections describe, plus policy\n * roles this server could never satisfy.\n *\n * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.\n */\nexport async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus> {\n    if (!databaseUrl) {\n        console.error(chalk.yellow(\"  ⚠ No DATABASE_URL — RLS policies were NOT checked\"));\n        return \"unchecked\";\n    }\n\n    const resolvedPath = path.resolve(process.cwd(), collectionsPath);\n    let problems = false;\n    const { Pool } = await import(\"pg\");\n    const pool = new Pool({ connectionString: databaseUrl });\n    try {\n        const collections: CollectionConfig[] = await loadCollections(resolvedPath);\n\n        // Zero collections is not \"no drift\", it is nothing to compare. The\n        // loader returns `[]` for a path that does not exist, so the commonest\n        // way to get here is a `--collections` path resolved against the wrong\n        // directory — which used to render as a green tick.\n        if (collections.length === 0) {\n            console.error(chalk.red(`  ✗ No collections found in ${resolvedPath}`));\n            console.error(chalk.gray(\"    RLS policies were NOT checked. Pass --collections=<dir> if your collections live elsewhere.\"));\n            return \"unchecked\";\n        }\n\n        const runSql = async (text: string) => (await pool.query(text)).rows as Record<string, unknown>[];\n\n        // Prove the connection before anything is ticked.\n        //\n        // `validatePolicyPgRoles` returns without a query when no collection\n        // names a `pgRoles` — which is most projects — so it \"passed\" against a\n        // database that was never reached, and the tick printed above an\n        // ECONNREFUSED that only surfaced two checks later. Ten lines up, this\n        // file says that reporting success for work it never did is the reason\n        // it exists. This is the same shape, one function along.\n        try {\n            await runSql(\"SELECT 1\");\n        } catch (err) {\n            console.error(chalk.gray(\"  ⏭ Policy roles: not checked\"));\n            console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n            return \"unchecked\";\n        }\n\n        // A policy naming a role the server never runs as filters every row, so\n        // the collection reads as empty. Report it without booting a server.\n        try {\n            await validatePolicyPgRoles(runSql, collections as never);\n            console.log(chalk.green(\"  ✓ Policy roles are usable by this server\"));\n        } catch (err) {\n            problems = true;\n            console.log(\"\");\n            console.error(chalk.red(err instanceof Error ? err.message : String(err)));\n        }\n\n        // A rule that reads as a lockdown but is true for every caller compiles\n        // to a grant. Report it without booting a server.\n        warnOnAnonymousGrants(collections as never);\n\n        const drift = await checkPolicyDrift(pool as never, collections);\n        console.log(\"\");\n        if (hasDrift(drift)) {\n            problems = true;\n            console.log(chalk.yellow(\"  RLS policies: database does not match your collections\"));\n            console.log(formatPolicyDrift(drift));\n        } else {\n            console.log(chalk.green(`  ✓ RLS policies match your collections (${collections.length} collection(s) checked)`));\n        }\n    } catch (err) {\n        // Fail closed. This catch covers every query and every collection import\n        // above, so returning the pre-catch verdict made the documented CI gate\n        // green on exactly the runs it exists to catch.\n        console.error(chalk.red(\"  ✗ Could not check RLS policies:\"), err instanceof Error ? err.message : String(err));\n        return \"unchecked\";\n    } finally {\n        await pool.end();\n    }\n    return problems ? \"problems\" : \"ok\";\n}\n","/**\n * `rebase doctor`: collections searched by a full scan of a large table.\n *\n * Without a `search` block, a search — the admin's search box, `?searchString=`,\n * `.search()` — is `ILIKE '%term%'` over every text column. A leading `%`\n * defeats a B-tree, so each one reads the whole table: on 100k posts a search\n * took 326 ms, half for the page and half for its count. Nothing reports it;\n * the box just gets slower as the table grows. This names the collections\n * where that has started to matter, and points at the block that fixes it.\n *\n * A hint, not a failure: it never changes doctor's exit code, and the database\n * is not changed — Rebase does not add a search index on its own.\n *\n * Lives beside `doctor-cli.ts` rather than inside it because that file runs\n * `main()` on import.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { getTableName, relationalCollections } from \"@rebasepro/common\";\nimport { isPostgresCollectionConfig, type CollectionConfig } from \"@rebasepro/types\";\nimport { loadCollections } from \"./doctor\";\nimport { buildSearchColumnSpec } from \"./search-column\";\n\n/** Above this many rows an unindexed search is worth a word. */\nexport const UNINDEXED_SEARCH_ROWS = 10_000;\n\n/** A collection whose search would be `ILIKE` over these fields. */\nexport interface IlikeSearchedCollection {\n    slug: string;\n    schema: string;\n    table: string;\n    /** The string properties the search reads. */\n    fields: string[];\n}\n\n/**\n * The collections a search reaches without an index: no `search` block (or\n * one that does not build), and at least one property the default search\n * reads — a `string`, not an enum, not a uuid key (the rule in\n * `DrizzleConditionBuilder.buildSearchConditions`).\n */\nexport function ilikeSearchedCollections(collections: CollectionConfig[]): IlikeSearchedCollection[] {\n    const found: IlikeSearchedCollection[] = [];\n    for (const collection of relationalCollections(collections)) {\n        if (!isPostgresCollectionConfig(collection)) continue;\n        let indexed: boolean;\n        try {\n            indexed = buildSearchColumnSpec(collection) !== undefined;\n        } catch {\n            // A block that does not build is reported by the boot; the search\n            // falls back to ILIKE meanwhile, so it counts as none here.\n            indexed = false;\n        }\n        if (indexed) continue;\n        const fields = Object.entries(collection.properties ?? {})\n            .filter(([, property]) => property.type === \"string\" && !property.enum && property.isId !== \"uuid\")\n            .map(([key]) => key);\n        const table = getTableName(collection);\n        if (fields.length === 0 || !table) continue;\n        found.push({ slug: collection.slug, schema: collection.schema ?? \"public\", table, fields });\n    }\n    return found;\n}\n\n/** Those of `candidates` whose table holds more than `threshold` rows, by estimate. */\nexport function unindexedSearchFindings(\n    candidates: IlikeSearchedCollection[],\n    rowEstimates: ReadonlyMap<string, number>,\n    threshold: number = UNINDEXED_SEARCH_ROWS\n): (IlikeSearchedCollection & { rows: number })[] {\n    return candidates\n        .map(candidate => ({ ...candidate, rows: rowEstimates.get(`${candidate.schema}.${candidate.table}`) ?? 0 }))\n        .filter(candidate => candidate.rows > threshold);\n}\n\n/**\n * Row counts by `schema.table`, estimated — `pg_class.reltuples`, or the\n * statistics collector's live-tuple count when the table was never analysed.\n * Nothing is scanned: counting the tables this is about would be the cost it\n * warns of.\n */\nexport async function estimateRowCounts(\n    query: (text: string, values: unknown[]) => Promise<{ rows: { schema: string; table: string; rows: string | number }[] }>,\n    schemas: string[]\n): Promise<Map<string, number>> {\n    const { rows } = await query(\n        `SELECT n.nspname AS schema, c.relname AS table,\n                GREATEST(c.reltuples, COALESCE(s.n_live_tup, 0), 0)::bigint AS rows\n         FROM pg_class c\n         JOIN pg_namespace n ON n.oid = c.relnamespace\n         LEFT JOIN pg_stat_user_tables s ON s.relid = c.oid\n         WHERE c.relkind IN ('r', 'p') AND n.nspname = ANY($1)`,\n        [schemas]\n    );\n    return new Map(rows.map(row => [`${row.schema}.${row.table}`, Number(row.rows)]));\n}\n\n/** The report, one warning per collection. */\nexport function formatUnindexedSearches(findings: (IlikeSearchedCollection & { rows: number })[]): string[] {\n    if (findings.length === 0) return [];\n    const lines = [\"\", chalk.yellow(`  ⚠ ${findings.length} collection(s) searched by reading the whole table:`)];\n    for (const finding of findings) {\n        lines.push(chalk.yellow(\n            `     • ${finding.slug} — about ${finding.rows.toLocaleString(\"en-US\")} rows, no \\`search\\` block: a search is ` +\n            `ILIKE '%term%' over ${finding.fields.join(\", \")}`\n        ));\n    }\n    lines.push(chalk.gray(\n        \"    Each search reads every row, and its count reads them again. A `search` block indexes it\\n\" +\n        \"    (full-text, or `mode: \\\"hybrid\\\"` for substrings too): https://rebase.pro/docs/backend/search\"\n    ));\n    return lines;\n}\n\n/**\n * Print the warning for the project at `collectionsPath`, against\n * `databaseUrl`. Never throws and never fails the run: it is a hint, and a\n * check that could not run says so in one grey line.\n */\nexport async function runSearchScaleCheck(collectionsPath: string, databaseUrl?: string): Promise<void> {\n    if (!databaseUrl) return;\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString: databaseUrl });\n    try {\n        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));\n        const candidates = ilikeSearchedCollections(collections);\n        if (candidates.length === 0) return;\n        await client.connect();\n        const estimates = await estimateRowCounts(\n            (text, values) => client.query(text, values),\n            [...new Set(candidates.map(candidate => candidate.schema))]\n        );\n        for (const line of formatUnindexedSearches(unindexedSearchFindings(candidates, estimates))) console.log(line);\n    } catch (err) {\n        console.log(chalk.gray(`  ⏭ Search on large tables: not checked (${err instanceof Error ? err.message : String(err)})`));\n    } finally {\n        await client.end().catch(() => undefined);\n    }\n}\n","#!/usr/bin/env node\n/**\n * CLI entry point for `rebase doctor`.\n * Invoked via tsx by the server-postgres CLI plugin.\n */\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { runDoctor } from \"./doctor\";\nimport { exitCodeForPolicyGate, runPolicyChecks } from \"./doctor-policy-checks\";\nimport { runSearchScaleCheck } from \"./doctor-search-scale\";\nimport { diagnoseDbError } from \"../cli-errors\";\nimport { describeFailure } from \"../cli-output\";\n\nasync function main() {\n    const collectionsArg = process.argv.find((a) => a.startsWith(\"--collections=\"));\n    const schemaArg = process.argv.find((a) => a.startsWith(\"--schema=\"));\n    const sdkArg = process.argv.find((a) => a.startsWith(\"--sdk=\"));\n    // --policies runs only the RLS checks: no schema diff, no SDK types. Useful\n    // as a CI gate against a deployed database, where the collection files and\n    // generated schema are not what you are asking about.\n    const policiesOnly = process.argv.includes(\"--policies\");\n\n    const collectionsPath = collectionsArg?.split(\"=\")[1] ?? path.join(\"..\", \"config\", \"collections\");\n    const schemaPath = schemaArg?.split(\"=\")[1] ?? path.join(\"src\", \"schema.generated.ts\");\n    const sdkPath = sdkArg?.split(\"=\")[1] ?? path.join(\"..\", \"generated\", \"sdk\", \"database.types.ts\");\n\n    // Load .env\n    try {\n        const dotenv = await import(\"dotenv\");\n        const envPath = process.env.DOTENV_CONFIG_PATH;\n        if (envPath) {\n            dotenv.config({ path: envPath, quiet: true });\n        } else {\n            dotenv.config({ quiet: true });\n        }\n    } catch {\n        // dotenv may not be installed\n    }\n\n    const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;\n\n    if (policiesOnly) {\n        // Non-zero so this can gate CI — the whole point of the flag, and a\n        // check that could not run has not passed. See exitCodeForPolicyGate.\n        process.exit(exitCodeForPolicyGate(await runPolicyChecks(collectionsPath, databaseUrl)));\n    }\n\n    const report = await runDoctor({\n        collectionsPath: path.resolve(process.cwd(), collectionsPath),\n        schemaPath: path.resolve(process.cwd(), schemaPath),\n        sdkPath: path.resolve(process.cwd(), sdkPath),\n        databaseUrl: databaseUrl ?? undefined\n    });\n\n    const policyStatus = await runPolicyChecks(collectionsPath, databaseUrl);\n\n    // A hint about speed, not drift: it never changes the exit code.\n    await runSearchScaleCheck(collectionsPath, databaseUrl);\n\n    // Exit non-zero if there are errors. A policy run that could not happen is\n    // reported loudly above but does not fail the interactive command — the\n    // same treatment the *chosen* skip of the database phase gets. `--policies`\n    // is the gate, and that one fails closed.\n    //\n    // A phase that was skipped by a fault is different, and `blocked` is what\n    // separates the two: \"no DATABASE_URL\" is a local situation somebody may be\n    // content with, while \"the DATABASE_URL you set refuses connections\" would\n    // otherwise let `rebase doctor` go green in CI against a database it never\n    // reached.\n    const blocked = [report.collectionsToSchema, report.schemaToDatabase, report.collectionsToSdk]\n        .some(phase => phase.blocked);\n    if (report.summary.errors > 0 || policyStatus === \"problems\" || blocked) {\n        process.exit(1);\n    }\n}\n\nmain().catch((err) => {\n    // A known database failure has a diagnosis; a stack trace through pg and\n    // drizzle internals is not it. This is the last resort — `runDoctor`\n    // already catches the connection failure it can name — so it exists for\n    // everything reached after the report, the policy checks in particular.\n    const banner = diagnoseDbError(err, process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING);\n    if (banner) {\n        console.error(banner);\n    } else {\n        console.error(chalk.red(`  ✗ Doctor failed: ${describeFailure(err)}`));\n    }\n    process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAgB,sBAAsB,QAAkC;CACpE,OAAO,WAAW,OAAO,IAAI;AACjC;;;;;;;AAQA,eAAsB,gBAAgB,iBAAyB,aAAkD;CAC7G,IAAI,CAAC,aAAa;EACd,QAAQ,MAAM,MAAM,OAAO,qDAAqD,CAAC;EACjF,OAAO;CACX;CAEA,MAAM,eAAe,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;CAChE,IAAI,WAAW;CACf,MAAM,EAAE,SAAS,MAAM,OAAO;CAC9B,MAAM,OAAO,IAAI,KAAK,EAAE,kBAAkB,YAAY,CAAC;CACvD,IAAI;EACA,MAAM,cAAkC,MAAM,gBAAgB,YAAY;EAM1E,IAAI,YAAY,WAAW,GAAG;GAC1B,QAAQ,MAAM,MAAM,IAAI,+BAA+B,cAAc,CAAC;GACtE,QAAQ,MAAM,MAAM,KAAK,iGAAiG,CAAC;GAC3H,OAAO;EACX;EAEA,MAAM,SAAS,OAAO,UAAkB,MAAM,KAAK,MAAM,IAAI,EAAA,CAAG;EAUhE,IAAI;GACA,MAAM,OAAO,UAAU;EAC3B,SAAS,KAAK;GACV,QAAQ,MAAM,MAAM,KAAK,+BAA+B,CAAC;GACzD,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC9G,OAAO;EACX;EAIA,IAAI;GACA,MAAM,sBAAsB,QAAQ,WAAoB;GACxD,QAAQ,IAAI,MAAM,MAAM,4CAA4C,CAAC;EACzE,SAAS,KAAK;GACV,WAAW;GACX,QAAQ,IAAI,EAAE;GACd,QAAQ,MAAM,MAAM,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;EAC7E;EAIA,sBAAsB,WAAoB;EAE1C,MAAM,QAAQ,MAAM,iBAAiB,MAAe,WAAW;EAC/D,QAAQ,IAAI,EAAE;EACd,IAAI,SAAS,KAAK,GAAG;GACjB,WAAW;GACX,QAAQ,IAAI,MAAM,OAAO,0DAA0D,CAAC;GACpF,QAAQ,IAAI,kBAAkB,KAAK,CAAC;EACxC,OACI,QAAQ,IAAI,MAAM,MAAM,4CAA4C,YAAY,OAAO,wBAAwB,CAAC;CAExH,SAAS,KAAK;EAIV,QAAQ,MAAM,MAAM,IAAI,mCAAmC,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;EAC9G,OAAO;CACX,UAAU;EACN,MAAM,KAAK,IAAI;CACnB;CACA,OAAO,WAAW,aAAa;AACnC;;;;;;;;;;;;;;;;;;;;AChGA,IAAa,wBAAwB;;;;;;;AAiBrC,SAAgB,yBAAyB,aAA4D;CACjG,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,cAAc,sBAAsB,WAAW,GAAG;EACzD,IAAI,CAAC,2BAA2B,UAAU,GAAG;EAC7C,IAAI;EACJ,IAAI;GACA,UAAU,sBAAsB,UAAU,MAAM,KAAA;EACpD,QAAQ;GAGJ,UAAU;EACd;EACA,IAAI,SAAS;EACb,MAAM,SAAS,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,CAAC,CACrD,QAAQ,GAAG,cAAc,SAAS,SAAS,YAAY,CAAC,SAAS,QAAQ,SAAS,SAAS,MAAM,CAAC,CAClG,KAAK,CAAC,SAAS,GAAG;EACvB,MAAM,QAAQ,aAAa,UAAU;EACrC,IAAI,OAAO,WAAW,KAAK,CAAC,OAAO;EACnC,MAAM,KAAK;GAAE,MAAM,WAAW;GAAM,QAAQ,WAAW,UAAU;GAAU;GAAO;EAAO,CAAC;CAC9F;CACA,OAAO;AACX;;AAGA,SAAgB,wBACZ,YACA,cACA,YAAoB,uBAC0B;CAC9C,OAAO,WACF,KAAI,eAAc;EAAE,GAAG;EAAW,MAAM,aAAa,IAAI,GAAG,UAAU,OAAO,GAAG,UAAU,OAAO,KAAK;CAAE,EAAE,CAAC,CAC3G,QAAO,cAAa,UAAU,OAAO,SAAS;AACvD;;;;;;;AAQA,eAAsB,kBAClB,OACA,SAC4B;CAC5B,MAAM,EAAE,SAAS,MAAM,MACnB;;;;;iEAMA,CAAC,OAAO,CACZ;CACA,OAAO,IAAI,IAAI,KAAK,KAAI,QAAO,CAAC,GAAG,IAAI,OAAO,GAAG,IAAI,SAAS,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;AACpF;;AAGA,SAAgB,wBAAwB,UAAoE;CACxG,IAAI,SAAS,WAAW,GAAG,OAAO,CAAC;CACnC,MAAM,QAAQ,CAAC,IAAI,MAAM,OAAO,OAAO,SAAS,OAAO,oDAAoD,CAAC;CAC5G,KAAK,MAAM,WAAW,UAClB,MAAM,KAAK,MAAM,OACb,UAAU,QAAQ,KAAK,WAAW,QAAQ,KAAK,eAAe,OAAO,EAAE,8DAChD,QAAQ,OAAO,KAAK,IAAI,GACnD,CAAC;CAEL,MAAM,KAAK,MAAM,KACb,iMAEJ,CAAC;CACD,OAAO;AACX;;;;;;AAOA,eAAsB,oBAAoB,iBAAyB,aAAqC;CACpG,IAAI,CAAC,aAAa;CAClB,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,YAAY,CAAC;CAC3D,IAAI;EAEA,MAAM,aAAa,yBAAyB,MADlB,gBAAgB,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe,CAAC,CAC/B;EACvD,IAAI,WAAW,WAAW,GAAG;EAC7B,MAAM,OAAO,QAAQ;EACrB,MAAM,YAAY,MAAM,mBACnB,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM,GAC3C,CAAC,GAAG,IAAI,IAAI,WAAW,KAAI,cAAa,UAAU,MAAM,CAAC,CAAC,CAC9D;EACA,KAAK,MAAM,QAAQ,wBAAwB,wBAAwB,YAAY,SAAS,CAAC,GAAG,QAAQ,IAAI,IAAI;CAChH,SAAS,KAAK;EACV,QAAQ,IAAI,MAAM,KAAK,4CAA4C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,EAAE,CAAC;CAC3H,UAAU;EACN,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5C;AACJ;;;;;;;AC7HA,eAAe,OAAO;CAClB,MAAM,iBAAiB,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,gBAAgB,CAAC;CAC9E,MAAM,YAAY,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC;CACpE,MAAM,SAAS,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,QAAQ,CAAC;CAI9D,MAAM,eAAe,QAAQ,KAAK,SAAS,YAAY;CAEvD,MAAM,kBAAkB,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,UAAU,aAAa;CAChG,MAAM,aAAa,WAAW,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,OAAO,qBAAqB;CACrF,MAAM,UAAU,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,KAAK,MAAM,aAAa,OAAO,mBAAmB;CAGhG,IAAI;EACA,MAAM,SAAS,MAAM,OAAO;EAC5B,MAAM,UAAU,QAAQ,IAAI;EAC5B,IAAI,SACA,OAAO,OAAO;GAAE,MAAM;GAAS,OAAO;EAAK,CAAC;OAE5C,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CAErC,QAAQ,CAER;CAEA,MAAM,cAAc,QAAQ,IAAI,gBAAgB,QAAQ,IAAI;CAE5D,IAAI,cAGA,QAAQ,KAAK,sBAAsB,MAAM,gBAAgB,iBAAiB,WAAW,CAAC,CAAC;CAG3F,MAAM,SAAS,MAAM,UAAU;EAC3B,iBAAiB,KAAK,QAAQ,QAAQ,IAAI,GAAG,eAAe;EAC5D,YAAY,KAAK,QAAQ,QAAQ,IAAI,GAAG,UAAU;EAClD,SAAS,KAAK,QAAQ,QAAQ,IAAI,GAAG,OAAO;EAC5C,aAAa,eAAe,KAAA;CAChC,CAAC;CAED,MAAM,eAAe,MAAM,gBAAgB,iBAAiB,WAAW;CAGvE,MAAM,oBAAoB,iBAAiB,WAAW;CAYtD,MAAM,UAAU;EAAC,OAAO;EAAqB,OAAO;EAAkB,OAAO;CAAgB,CAAC,CACzF,MAAK,UAAS,MAAM,OAAO;CAChC,IAAI,OAAO,QAAQ,SAAS,KAAK,iBAAiB,cAAc,SAC5D,QAAQ,KAAK,CAAC;AAEtB;AAEA,KAAK,CAAC,CAAC,OAAO,QAAQ;CAKlB,MAAM,SAAS,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,QAAQ,IAAI,uBAAuB;CACnG,IAAI,QACA,QAAQ,MAAM,MAAM;MAEpB,QAAQ,MAAM,MAAM,IAAI,sBAAsB,gBAAgB,GAAG,GAAG,CAAC;CAEzE,QAAQ,KAAK,CAAC;AAClB,CAAC"}

package/dist/schema/doctor-search-scale.d.ts

@@ -0,0 +1,45 @@
+import { type CollectionConfig } from "@rebasepro/types";
+/** Above this many rows an unindexed search is worth a word. */
+export declare const UNINDEXED_SEARCH_ROWS = 10000;
+/** A collection whose search would be `ILIKE` over these fields. */
+export interface IlikeSearchedCollection {
+    slug: string;
+    schema: string;
+    table: string;
+    /** The string properties the search reads. */
+    fields: string[];
+}
+/**
+ * The collections a search reaches without an index: no `search` block (or
+ * one that does not build), and at least one property the default search
+ * reads — a `string`, not an enum, not a uuid key (the rule in
+ * `DrizzleConditionBuilder.buildSearchConditions`).
+ */
+export declare function ilikeSearchedCollections(collections: CollectionConfig[]): IlikeSearchedCollection[];
+/** Those of `candidates` whose table holds more than `threshold` rows, by estimate. */
+export declare function unindexedSearchFindings(candidates: IlikeSearchedCollection[], rowEstimates: ReadonlyMap<string, number>, threshold?: number): (IlikeSearchedCollection & {
+    rows: number;
+})[];
+/**
+ * Row counts by `schema.table`, estimated — `pg_class.reltuples`, or the
+ * statistics collector's live-tuple count when the table was never analysed.
+ * Nothing is scanned: counting the tables this is about would be the cost it
+ * warns of.
+ */
+export declare function estimateRowCounts(query: (text: string, values: unknown[]) => Promise<{
+    rows: {
+        schema: string;
+        table: string;
+        rows: string | number;
+    }[];
+}>, schemas: string[]): Promise<Map<string, number>>;
+/** The report, one warning per collection. */
+export declare function formatUnindexedSearches(findings: (IlikeSearchedCollection & {
+    rows: number;
+})[]): string[];
+/**
+ * Print the warning for the project at `collectionsPath`, against
+ * `databaseUrl`. Never throws and never fails the run: it is a hint, and a
+ * check that could not run says so in one grey line.
+ */
+export declare function runSearchScaleCheck(collectionsPath: string, databaseUrl?: string): Promise<void>;

package/dist/schema/doctor.d.ts

@@ -1,5 +1,5 @@
 import { CollectionConfig, Property } from "@rebasepro/types";
-import type { PgType, TablePlan } from "./plan/types.js";
+import type { PgType, SchemaPlan, TablePlan } from "./plan/types.js";
 export type IssueSeverity = "error" | "warning" | "info";
 export interface DoctorIssue {
     severity: IssueSeverity;
@@ -148,6 +148,25 @@ export declare function primaryKeyIssues(tablePlan: TablePlan, dbPk: string[], d
  */
 export declare function junctionKeyIssues(junctionPlan: TablePlan, dbColumns: DbColumn[], dbPk: string[], displayName: string): DoctorIssue[];
 export declare function checkCollectionsVsDatabase(collections: CollectionConfig[], databaseUrl: string): Promise<DoctorPhase>;
+/**
+ * A `public` table in the junction shape that no collection declares.
+ *
+ * The shape is the planner's: exactly two columns, together the primary key,
+ * each a single-column foreign key to a collection's table. Renaming or
+ * removing a many-to-many leaves such a table behind — push and boot only
+ * create — with every link row still in it and nothing reading it.
+ *
+ * Info, never more: the table may be data somebody still wants. The remedy is
+ * shown, never run.
+ */
+export declare function orphanedJunctionIssues(plan: SchemaPlan, columnsByTable: Map<string, {
+    column_name: string;
+}[]>, pksByTable: Map<string, string[]>, fksByTable: Map<string, {
+    constraint_name: string;
+    column_name: string;
+    foreign_table_schema: string;
+    foreign_table_name: string;
+}[]>): DoctorIssue[];
 export declare function renderReport(report: DoctorReport): void;
 export declare function runDoctor(options: {
     collectionsPath: string;

package/dist/schema/ensure-collection-policies.d.ts

@@ -1,43 +1,17 @@
-/**
- * Applying a bundle's RLS policies to a database at boot, idempotently.
- *
- * ## Why this exists
- *
- * {@link ensureCollectionTables} creates the collection *tables* a managed
- * runtime boots against, but a table with row-level security disabled and no
- * policies is not servable: authenticated requests run as the restricted
- * `rebase_user` role, so a read with no `SELECT` policy returns nothing (a
- * public collection answered 401) and a write with no `INSERT`/`UPDATE` policy
- * is denied. The policies live in the collections' `securityRules`; nothing at
- * boot applied them. `rebase db push` does — but it drives Atlas against a
- * local `DATABASE_URL`, and a managed tenant's database is reachable only from
- * inside the cluster, by the runtime that is already connected to it. So the
- * runtime is the only thing that *can* apply them, and this is where it does.
- *
- * ## Why this is safe to run on every boot
- *
- * Every statement is idempotent: `ENABLE ROW LEVEL SECURITY` is a no-op once
- * enabled, and each policy is a `DROP POLICY IF EXISTS` immediately followed by
- * a `CREATE POLICY`, so re-applying asserts exactly the declared state. It adds
- * and replaces; it never drops data. (It does not *reconcile* — a policy a
- * previous push left behind under an old name is not removed here; that stays a
- * `db push` / `db migrate` concern, alongside destructive schema changes.)
- *
- * Unlike table creation, a failure here is not fatal: RLS stays enabled, so a
- * table whose policies could not be applied fails **closed** (denies) rather
- * than leaking rows. One collection's policy failing (e.g. a rule that
- * references a table a real migration has not created yet) must not crash-loop
- * the whole deployment and take the other collections' working routes down with
- * it. Failures are reported loudly and per-table so the operator can see
- * exactly which collection is not yet servable and why.
- */
 import { type CollectionConfig } from "@rebasepro/types";
+import { type CollectionPolicyPlan } from "./generate-postgres-ddl-logic.js";
 import { type Queryable } from "./ensure-collection-tables.js";
+import { type BootLockOptions } from "./boot-ddl.js";
 export interface PolicyEnsureResult {
     /** `CREATE POLICY` statements that ran successfully. */
     policiesApplied: number;
-    /** Tables that had RLS enabled. */
+    /** Tables that had RLS enabled — including the {@link unchanged} ones, which already had it. */
     tablesSecured: number;
+    /**
+     * Tables whose policies were already exactly the declared ones, RLS on, by
+     * the stamp each policy carries — left alone: no statement, no lock.
+     */
+    unchanged: number;
     /** Declared tables absent from the database — left to a real migration. */
     skipped: {
         table: string;
@@ -80,7 +54,34 @@ export interface PolicyEnsureResult {
      * database — which is the reason this module exists. So boot has to do it.
      */
     orphansDropped: number;
+    /**
+     * Tables whose policies were not re-applied because another session held
+     * the table's lock for every attempt — a long transaction, a report, a
+     * dump. Each table's policy statements run in one transaction, so a table
+     * here was left exactly as it was: RLS on, its existing policies in force.
+     * `rulesChanged` says whether those differ from the declared ones by name
+     * (a rule whose policy is missing, or an orphan still granting), in which
+     * case the new rules are not in force on this table until a later boot.
+     */
+    deferred: {
+        table: string;
+        error: string;
+        rulesChanged: boolean;
+    }[];
 }
+/** What every policy stamp starts with. See {@link policyStampSql}. */
+export declare const POLICY_STAMP_PREFIX = "rebase:";
+/**
+ * One statement that stamps every policy the plan just created on its table:
+ * `COMMENT ON POLICY … IS 'rebase:<hash>'`, the hash taken over the rendered
+ * statement's hash and the definition Postgres stored — read back here, after
+ * the `CREATE`s, in the same transaction. A `DO` block because the stored
+ * definition is only known once the policy exists, and a `COMMENT` takes a
+ * literal. One line, and it names only this table.
+ *
+ * `undefined` for a table the plan gives no policies.
+ */
+export declare function policyStampSql(plan: CollectionPolicyPlan): string | undefined;
 export interface TableLockResult {
     /** Tables RLS is now on for. */
     locked: number;
@@ -103,4 +104,41 @@ export interface TableLockResult {
  * a table that does not exist, and the step that creates it locks it.
  */
 export declare function lockCollectionTables(client: Queryable, collections: CollectionConfig[]): Promise<TableLockResult>;
-export declare function ensureCollectionPolicies(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void): Promise<PolicyEnsureResult>;
+/**
+ * Bring the declared collections' RLS policies up to date. Returns what it did.
+ *
+ * Only tables that already exist are touched: the boot-time table creator runs
+ * first, so anything still missing is a table this additive path did not
+ * create (it creates junctions too) — one a failed boot DDL left out, or a
+ * project whose schema a migration owns. Enabling RLS on a
+ * non-existent table would error, so those are recorded as skipped, not failed.
+ *
+ * ## One transaction per table
+ *
+ * Each table's statements — `ENABLE` when RLS is off, every `DROP POLICY IF
+ * EXISTS` / `CREATE POLICY` pair, the orphan drops — go to Postgres as one
+ * string, which it runs as one transaction (see `boot-ddl`). Before, each was
+ * its own autocommit: at 240 tables, 4,080 commits and 4,080 ACCESS EXCLUSIVE
+ * lock acquisitions per boot, 6–22 s on a disk that really flushes. And between
+ * a policy's DROP and its CREATE, every other replica evaluated the table with
+ * that policy missing — a user's continuous reads of their own row came back
+ * empty once per boot (measured, Postgres 18). Now a concurrent request sees the
+ * old policies or the new ones, never neither.
+ *
+ * If the transaction fails for any reason but a lock timeout, the table is
+ * applied again one statement at a time, exactly as before — so a rule that
+ * cannot be created (a function a migration has not added yet) leaves the
+ * table in the same deny-leaning partial state it always did, rather than
+ * rolling back to the old, possibly looser, policies.
+ *
+ * ## Lock budget
+ *
+ * The transaction runs under `lock_timeout` (`boot-ddl`), so a table that a
+ * long transaction, a report or a dump is holding costs live traffic one
+ * second, not the statement timeout. A contended table is retried after the
+ * others, with backoff, within a retry budget for the whole step; one still
+ * held after that is reported in `deferred` — its transaction rolled back, so
+ * it is exactly as it was before this boot — or, if RLS was off on it, closed
+ * by revoking the user role's grant, as any table RLS cannot be enabled on is.
+ */
+export declare function ensureCollectionPolicies(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void, options?: BootLockOptions): Promise<PolicyEnsureResult>;

package/dist/schema/ensure-collection-tables.d.ts

@@ -22,8 +22,9 @@
  * See `diff-plan.ts` for the whole of that argument.
  */
 import { type CollectionConfig } from "@rebasepro/types";
-import { type ConstraintPolicy, type DiffOptions, type EnsureAction, type EnsurePlan, type ExistingSchema, type LegacyForeignKey, type OrphanedRequiredColumn, type SearchColumnDrift, type WithheldConstraint } from "./plan/diff-plan.js";
-export type { ConstraintPolicy, EnsureAction, EnsurePlan, ExistingSchema, LegacyForeignKey, OrphanedRequiredColumn, SearchColumnDrift, WithheldConstraint };
+import { type ConstraintPolicy, type DeferredIndexBuild, type DiffOptions, type EnsureAction, type EnsurePlan, type ExistingSchema, type LegacyForeignKey, type OrphanedRequiredColumn, type SearchColumnDrift, type WithheldConstraint } from "./plan/diff-plan.js";
+import { type DeferredIndexOutcome, type OpenIndexBuildSession } from "./deferred-index-build.js";
+export type { ConstraintPolicy, DeferredIndexBuild, EnsureAction, EnsurePlan, ExistingSchema, LegacyForeignKey, OrphanedRequiredColumn, SearchColumnDrift, WithheldConstraint };
 /**
  * The subset of a database handle this needs: run a statement, get rows back.
  *
@@ -51,6 +52,36 @@ export interface EnsureOptions extends DiffOptions {
      * reads the world.
      */
     databaseExtensions?: readonly string[];
+    /**
+     * Run each statement that changes an existing table under this
+     * `lock_timeout` (ms), retrying a timeout with backoff — see
+     * `schema/boot-ddl`. The boot sets it; absent, statements wait on locks for
+     * as long as the connection's `statement_timeout` allows, as the live schema
+     * editor's confirmed changes do.
+     */
+    lockTimeoutMs?: number;
+    /**
+     * Apply the statements that build tables this run creates — and the enum
+     * types they use — in transactions of up to {@link NEW_TABLE_BATCH}
+     * statements instead of one autocommit each. The boot sets it; see
+     * `ensureCollectionTables`.
+     */
+    batchNewTables?: boolean;
+    /**
+     * Leave the indexes a live table is missing (or holds INVALID) to the
+     * caller, in {@link EnsureOutcome.deferredIndexes}, instead of building
+     * them before returning. The boot sets it and builds them in the
+     * background once it serves — see `deferred-index-build`. A UNIQUE one is
+     * built before returning either way: see {@link DeferredIndexBuild.unique}.
+     */
+    deferIndexBuilds?: boolean;
+    /**
+     * The connection those builds run on when they are not deferred. Absent,
+     * they share `client` — fine for a small table, and cut short by the
+     * pool's `statement_timeout` on a large one, which is why the boot hands
+     * over a dedicated connection.
+     */
+    openIndexBuildSession?: OpenIndexBuildSession;
 }
 export interface EnsureOutcome extends EnsurePlan {
     /**
@@ -68,6 +99,14 @@ export interface EnsureOutcome extends EnsurePlan {
         target: string;
         error: string;
     }[];
+    /**
+     * What happened to the indexes built here rather than left to the caller —
+     * every one of {@link EnsurePlan.deferredIndexes}, or under
+     * `deferIndexBuilds` the UNIQUE ones only; absent when there were none.
+     * An index on a table that already exists reports here, not in
+     * {@link failures}.
+     */
+    indexBuilds?: DeferredIndexOutcome;
 }
 /**
  * Decide what to add. Pure — the caller supplies what exists and runs the
@@ -82,8 +121,22 @@ export interface EnsureOutcome extends EnsurePlan {
  * with no developer in the loop.
  */
 export declare function planCollectionSchemaEnsure(allCollections: CollectionConfig[], existing: ExistingSchema, options?: EnsureOptions): EnsurePlan;
+export interface ReadSchemaOptions {
+    /**
+     * The existing tables worth probing for rows, given every table's columns.
+     *
+     * Whether a table holds rows decides one thing: whether a NOT NULL or a
+     * UNIQUE can be added with a column *being added* to it. So the boot asks
+     * only about tables gaining a column — none at all on a boot that changes
+     * nothing — rather than probing every table in the schema, adopted and
+     * unmanaged ones included, on every boot. A table that is not probed is
+     * reported as holding rows: the answer that never plans a constraint that
+     * could fail against data. Absent, every table is probed.
+     */
+    probeTables?: (tables: ReadonlyMap<string, ReadonlySet<string>>) => Iterable<string>;
+}
 /** Read what the database has, for the schemas the collections live in. */
-export declare function readExistingSchema(client: Queryable, schemas: string[]): Promise<ExistingSchema>;
+export declare function readExistingSchema(client: Queryable, schemas: string[], options?: ReadSchemaOptions): Promise<ExistingSchema>;
 /**
  * Read what the database looks like, for the schemas a set of collections
  * lives in.

package/dist/schema/enum-labels-kept.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Enum labels the database holds and the collections no longer declare.
+ *
+ * PostgreSQL has no `ALTER TYPE … DROP VALUE`, and Atlas plans nothing for a
+ * removed label — `db push` reported success while the database kept the old
+ * label, so writes of it (by SQL, or an older client) went on succeeding, and
+ * `rebase doctor` sent the developer back to the same push. Boot behaves the
+ * same way by design: it adds labels and never removes one. So this is not a
+ * refusal — the push stays what boot would do — but the push says it, with the
+ * real way to retire a label.
+ */
+import { type CollectionConfig } from "@rebasepro/types";
+import type { EnumPlan } from "./plan/types.js";
+import { type Queryable } from "./ensure-collection-tables.js";
+export interface KeptEnumLabels {
+    /** `schema.type`, as the catalogue names it. */
+    type: string;
+    /** Labels in the database that no collection declares, in the type's order. */
+    labels: string[];
+}
+/** Pure: the declared enums against the catalogue's labels, keyed `schema.type`. */
+export declare function findKeptEnumLabels(declared: Pick<EnumPlan, "qualified" | "labels">[], existing: ReadonlyMap<string, string[]>): KeptEnumLabels[];
+/** Plans the collections and reads the catalogue's enum labels. */
+export declare function keptEnumLabels(client: Queryable, collections: CollectionConfig[]): Promise<KeptEnumLabels[]>;
+/** What the push prints: which labels stay, and how one is actually retired. */
+export declare function formatKeptEnumLabelsNotice(kept: KeptEnumLabels[]): string;

package/dist/schema/generate-drizzle-schema.js

@@ -1,6 +1,6 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { t as main } from "../generate-drizzle-schema-93M0lUxK.js";
+import { t as main } from "../generate-drizzle-schema-Bz52jH2h.js";
 //#region src/schema/bin/generate-drizzle-schema.ts
 /**
 * The built entry point for `generate-drizzle-schema`.

package/dist/schema/generate-files.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The two generators `rebase db push` runs as its step 1, as functions.
+ *
+ * They used to exist only as scripts, each its own `tsx` process: the driver
+ * (itself a `tsx` process) spawned one for the Drizzle schema and then one for
+ * the DDL, and each paid a Node start, tsx's loader and an import of the whole
+ * server package before reading a single collection — about 0.5 s apiece, a
+ * second per push. The driver process is one-shot, so a fresh module graph per
+ * generation bought nothing: the collections cannot change under it.
+ *
+ * The scripts remain (`generate-drizzle-schema.ts`, `generate-postgres-ddl.ts`)
+ * for `--watch`, which re-imports the collections on every save and does need a
+ * process of its own — Node's module cache would serve it the first version
+ * forever.
+ *
+ * Both functions print their own success lines and their own error, exactly as
+ * the scripts did, and throw {@link GenerationFailed} after printing — so a
+ * caller can tell "the generator said why" from "the generator never ran".
+ */
+/** Thrown once the generator has printed why it failed. */
+export declare class GenerationFailed extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+export interface GenerateFileOptions {
+    /** The collections directory (or single module), resolved against the cwd. */
+    collectionsPath: string;
+    /** Where to write. Absent: print to stdout instead. */
+    outputPath?: string;
+    /**
+     * End on the line that says what to run next. Only `rebase schema
+     * generate` itself wants it: inside `db push` it told the push to run
+     * `db generate`, and inside `db generate` to run itself.
+     */
+    nextStep?: boolean;
+}
+/** `src/schema.generated.ts`, from the collections. */
+export declare function writeDrizzleSchema(options: GenerateFileOptions): Promise<void>;
+/**
+ * `schema.sql` (Atlas's desired state) and, beside it, `policies.sql`,
+ * `search.sql`, `vector.sql` and `triggers.sql` — the parts Atlas does not own.
+ */
+export declare function writePostgresDdl(options: GenerateFileOptions): Promise<void>;

package/dist/schema/generate-next-step.d.ts

@@ -1,16 +1,3 @@
-/**
- * The line `rebase schema generate` ends on.
- *
- * Its own module because `generate-drizzle-schema.ts` uses `import.meta` to
- * decide whether it was executed directly, which the driver's jest suite cannot
- * load at all — so the one sentence in that file with a decision in it had no
- * test and could not have one where it stood.
- */
-export declare const formatTerminalText: (text: string, options?: {
-    bold?: boolean;
-    backgroundColor?: "blue" | "green" | "red" | "yellow" | "cyan" | "magenta";
-    textColor?: "white" | "black" | "red" | "green" | "yellow" | "blue" | "magenta" | "cyan";
-}) => string;
 /**
  * What to do with the file that was just generated.
  *