@rebasepro/server-postgres 0.25.1 → 0.26.0

package/dist/{db-subcommands-BPoHCxJR.js → migrate-baseline-B-2Ef4Mv.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { a as __require, i as __exportAll, n as require_arg, o as __toESM, r as __commonJSMin } from "./cli-prompt-DXG0yk-h.js";
-import { et as redactConnectionPasswords } from "./cli-errors-DiA0XFIS.js";
+import { B as withAppClient, tt as redactConnectionPasswords } from "./cli-errors-DsYyNYzd.js";
 import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA } from "@rebasepro/types";
 import { sqlRows } from "@rebasepro/common";
 import { suggestNearMiss } from "@rebasepro/utils";
@@ -6194,6 +6194,7 @@ var { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExpo
 //#region src/schema/rls-bootstrap-sql.ts
 var rls_bootstrap_sql_exports = /* @__PURE__ */ __exportAll({
 	DROP_LEGACY_AUTH_SCHEMA_SQL: () => DROP_LEGACY_AUTH_SCHEMA_SQL,
+	LEGACY_AUTH_SCHEMA_CONTENTS_SQL: () => LEGACY_AUTH_SCHEMA_CONTENTS_SQL,
 	LEGACY_RLS_DEPENDENTS_SQL: () => LEGACY_RLS_DEPENDENTS_SQL,
 	LEGACY_RLS_FUNCTION_DEPENDENTS_SQL: () => LEGACY_RLS_FUNCTION_DEPENDENTS_SQL,
 	RLS_BOOTSTRAP_SQL: () => RLS_BOOTSTRAP_SQL,
@@ -6358,6 +6359,60 @@ async function rlsRuntimeIsCurrent(run) {
 /** The same statements as one script, for migration files and raw clients. */
 var RLS_BOOTSTRAP_SQL = "-- Rebase schema + RLS helper functions (required by the policies below)\n" + RLS_BOOTSTRAP_STATEMENTS.map((s) => `${s};`).join("\n\n") + "\n";
 /**
+* The three functions every pre-1.0 release put in `auth`. (The auth tables
+* lived in `rebase`, or wherever the users collection was declared.)
+*
+* `uid()` is matched on either spelling of the principal because Rebase wrote
+* both. Until v0.10.0 its body was
+* `SELECT NULLIF(current_setting('app.user_id', true), '')`; v0.10.0 renamed
+* the GUC to `app.uid` and kept `app.user_id` as a fallback; v0.14.0 moved the
+* helpers to `rebase`. A database last booted before v0.10.0 therefore holds an
+* `auth.uid()` that reads `app.user_id` alone — as does anything that copied
+* that body, the Rebase control plane included — and matching `app.uid` only
+* left every one of them in place, with the schema around it.
+*
+* This is the one place either spelling is listed: the drop and the report of
+* what it left are both generated from it, so they cannot disagree about which
+* functions are Rebase's.
+*/
+var LEGACY_AUTH_HELPERS = [
+	{
+		name: "uid",
+		returns: "text",
+		reads: ["app.uid", "app.user_id"]
+	},
+	{
+		name: "jwt",
+		returns: "jsonb",
+		reads: ["app.jwt"]
+	},
+	{
+		name: "roles",
+		returns: "text",
+		reads: ["app.user_roles"]
+	}
+];
+/**
+* `pg_proc p` has a Rebase helper's name, arity and result type: what
+* `CREATE OR REPLACE` would have left, whatever the body.
+*
+* Two things that share that shape are excluded outright: a body reading
+* `request.jwt` (Supabase's helpers and anything modelled on them) and a
+* function an extension installed (`pg_session_jwt` puts an `auth.jwt()
+* RETURNS jsonb` in the same schema).
+*/
+var isLegacyHelperShaped = (helper) => `(
+          p.proname = '${helper.name}' AND p.pronargs = 0
+          AND pg_get_function_result(p.oid) = '${helper.returns}'
+          AND strpos(p.prosrc, 'request.jwt') = 0
+          AND NOT EXISTS (
+              SELECT 1 FROM pg_depend e
+              WHERE e.classid = 'pg_proc'::regclass AND e.objid = p.oid AND e.deptype = 'e'
+          ))`;
+/** `pg_proc p` is a helper Rebase wrote: its shape, and a body reading one of its GUCs. */
+var isLegacyHelper = (helper) => `${isLegacyHelperShaped(helper)}
+          AND (${helper.reads.map((guc) => `strpos(p.prosrc, '${guc}') > 0`).join(" OR ")})`;
+/**
 * Removes the pre-1.0 `auth` schema, but only when Rebase is what put it there.
 *
 * ## Why this is safe against a Supabase database
@@ -6365,11 +6420,12 @@ var RLS_BOOTSTRAP_SQL = "-- Rebase schema + RLS helper functions (required by th
 * Two independent guards, and both have to pass:
 *
 *  1. **Each function is identified before it is dropped.** Ours returns `text`
-*     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads
-*     `request.jwt.claims`. Nothing is dropped on a signature we did not write,
-*     so a Supabase database — where our `CREATE OR REPLACE` could never have
-*     succeeded in the first place, Postgres refusing to change a return type —
-*     matches nothing and this is a no-op.
+*     and reads the `app.uid` or `app.user_id` GUC; Supabase's returns `uuid`
+*     and reads `request.jwt.claims`. Nothing is dropped on a signature we did
+*     not write, so a Supabase database — where our `CREATE OR REPLACE` could
+*     never have succeeded in the first place, Postgres refusing to change a
+*     return type — matches nothing and this is a no-op. See
+*     {@link LEGACY_AUTH_HELPERS} for exactly what is matched.
 *  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still
 *     lives in `auth` (Supabase's `users` table, its other helpers), the drop
 *     fails and the schema stays. CASCADE here would be unrecoverable.
@@ -6390,41 +6446,21 @@ DECLARE
 BEGIN
     -- Each function is matched on its own result type and body, so a schema
     -- that merely shares the name keeps everything it has.
-    IF EXISTS (
+${LEGACY_AUTH_HELPERS.map((helper) => `    IF EXISTS (
         SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-        WHERE n.nspname = 'auth' AND p.proname = 'uid'
-          AND pg_get_function_result(p.oid) = 'text'
-          AND p.prosrc LIKE '%app.uid%'
+        WHERE n.nspname = '${LEGACY_RLS_SCHEMA}' AND ${isLegacyHelper(helper)}
     ) THEN
-        DROP FUNCTION auth.uid();
+        DROP FUNCTION ${LEGACY_RLS_SCHEMA}.${helper.name}();
         dropped_any := true;
-    END IF;
-
-    IF EXISTS (
-        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-        WHERE n.nspname = 'auth' AND p.proname = 'jwt'
-          AND pg_get_function_result(p.oid) = 'jsonb'
-          AND p.prosrc LIKE '%app.jwt%'
-    ) THEN
-        DROP FUNCTION auth.jwt();
-        dropped_any := true;
-    END IF;
-
-    IF EXISTS (
-        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-        WHERE n.nspname = 'auth' AND p.proname = 'roles'
-          AND pg_get_function_result(p.oid) = 'text'
-          AND p.prosrc LIKE '%app.user_roles%'
-    ) THEN
-        DROP FUNCTION auth.roles();
-        dropped_any := true;
-    END IF;
+    END IF;`).join("\n\n")}
 
     -- RESTRICT: only an empty schema goes. Anything else in there — including a
-    -- Supabase installation left untouched above — keeps it.
+    -- Supabase installation left untouched above — keeps it. Swallowed so the
+    -- helpers dropped above stay dropped; dropLegacyAuthSchema looks afterwards
+    -- and says what is left.
     IF dropped_any THEN
         BEGIN
-            EXECUTE 'DROP SCHEMA auth RESTRICT';
+            EXECUTE 'DROP SCHEMA ${LEGACY_RLS_SCHEMA} RESTRICT';
         EXCEPTION WHEN OTHERS THEN
             NULL;
         END;
@@ -6433,6 +6469,40 @@ END
 $rebase_drop_legacy$;
 `;
 /**
+* What the `auth` schema holds, one row per object keeping it alive.
+*
+* No rows: the schema does not exist. A single row with a `null` object: it
+* exists and is empty. Read from the namespace entries in `pg_depend`, which
+* are what `DROP SCHEMA … RESTRICT` itself consults — minus whatever goes with
+* its owner (a serial's sequence, an identity column's), which Postgres does not
+* name either.
+*/
+var LEGACY_AUTH_SCHEMA_CONTENTS_SQL = `
+    SELECT pg_describe_object(d.classid, d.objid, d.objsubid) AS object,
+           CASE
+               WHEN d.classid <> 'pg_proc'::regclass THEN NULL
+               WHEN EXISTS (
+                   SELECT 1 FROM pg_proc p
+                   WHERE p.oid = d.objid
+                     AND (${LEGACY_AUTH_HELPERS.map((helper) => `(${isLegacyHelper(helper)})`).join(" OR ")})
+               ) THEN 'ours'
+               WHEN EXISTS (
+                   SELECT 1 FROM pg_proc p
+                   WHERE p.oid = d.objid
+                     AND (${LEGACY_AUTH_HELPERS.map(isLegacyHelperShaped).join(" OR ")})
+               ) THEN 'lookalike'
+           END AS helper
+    FROM pg_namespace n
+    LEFT JOIN pg_depend d
+           ON d.refclassid = 'pg_namespace'::regclass AND d.refobjid = n.oid AND d.deptype = 'n'
+          AND NOT EXISTS (
+              SELECT 1 FROM pg_depend o
+              WHERE o.classid = d.classid AND o.objid = d.objid AND o.deptype IN ('a', 'i')
+          )
+    WHERE n.nspname = '${LEGACY_RLS_SCHEMA}'
+    ORDER BY helper NULLS LAST, object
+`;
+/**
 * Policies whose body still calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
 *
 * Postgres will not drop a function a policy depends on, so this is exactly the
@@ -6463,11 +6533,12 @@ var LEGACY_RLS_DEPENDENTS_SQL = `
 * exists, which fails at *query* time rather than at boot.
 *
 * A downstream project building on these helpers is not hypothetical: the Rebase
-* control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`
+* control plane defined `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`
 * in this very schema, each calling `auth.uid()` in a string body, and eleven of
-* its row-level-security policies go through them. Every one of those would have
-* started failing the first time a recompile left no policy referencing
-* `auth.uid()` directly — the drop's own precondition.
+* its row-level-security policies went through them. Every one of those would
+* have started failing the first time a recompile left no policy referencing
+* `auth.uid()` directly — the drop's own precondition. (Its migration 0065 has
+* since moved both to `public`, calling `rebase.uid()`.)
 *
 * Matching on the body text is the only option available, and it is deliberately
 * broad: a false positive costs a schema that stays one release longer and says
@@ -6491,8 +6562,30 @@ var LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = `
 * table not recompiled *yet* — and wrong for the one that never resolves: a
 * hand-written policy nothing will ever rewrite. Then the schema stays forever
 * and nothing ever says why.
+*
+* The drop itself had the same blind spot. A helper it did not recognise as
+* Rebase's stayed, and so did anything else in the schema, behind a
+* `DROP SCHEMA … RESTRICT` whose failure is swallowed so the helpers it did
+* drop stay dropped. The control plane's `auth.uid()` was one such: it read
+* `app.user_id` alone, the drop looked for `app.uid`, and the schema stayed
+* with no word said. So the schema is read twice. Before, so that one with no
+* Rebase helper in it is left alone: one already gone, as on every boot after
+* the drop, or one that was never Rebase's, like Supabase's — whose own
+* policies the checks below would otherwise report as blockers. After, to name
+* whatever is still there.
 */
 async function dropLegacyAuthSchema(run, report) {
+	let before;
+	try {
+		before = sqlRows(await run(LEGACY_AUTH_SCHEMA_CONTENTS_SQL));
+	} catch {
+		return;
+	}
+	if (!before.some((o) => o.helper !== null)) return;
+	if (!before.some((o) => o.helper === "ours")) {
+		report.warn(describeLegacyAuthLeftovers(before, void 0));
+		return;
+	}
 	let blockers;
 	try {
 		blockers = sqlRows(await run(LEGACY_RLS_DEPENDENTS_SQL));
@@ -6513,11 +6606,42 @@ async function dropLegacyAuthSchema(run, report) {
 		report.warn(`The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${borrowers.length} ${borrowers.length === 1 ? "function calls" : "functions call"} \`${LEGACY_RLS_SCHEMA}.uid()\` and friends from its own body. Postgres records no dependency for that — a SQL body written as a string literal is never parsed — so dropping the helpers would leave these pointing at nothing, and they would fail when a query reached them rather than now. Repoint them at \`${REBASE_SCHEMA}.uid()\`, after which the schema goes on its own:\n` + borrowers.map((b) => `  • ${b.schema}.${b.function}()`).join("\n"));
 		return;
 	}
+	let failure;
 	try {
 		await run(DROP_LEGACY_AUTH_SCHEMA_SQL);
 	} catch (err) {
-		report.info(`Left the \`${LEGACY_RLS_SCHEMA}\` schema in place: ` + (err instanceof Error ? err.message : String(err)));
+		const detail = err instanceof Error && "detail" in err && typeof err.detail === "string" ? err.detail : "";
+		failure = (err instanceof Error ? err.message : String(err)) + (detail ? ` (${detail.replace(/\n/g, "; ")})` : "");
 	}
+	let left;
+	try {
+		left = sqlRows(await run(LEGACY_AUTH_SCHEMA_CONTENTS_SQL));
+	} catch {
+		if (failure) report.info(`Left the \`${LEGACY_RLS_SCHEMA}\` schema in place: ${failure}`);
+		return;
+	}
+	if (left.length === 0) return;
+	report.warn(describeLegacyAuthLeftovers(left, failure));
+}
+/** At most this many objects are named; a schema this full is plainly in use. */
+var MAX_LEFTOVERS_NAMED = 20;
+/**
+* The warning for an `auth` schema the drop left standing.
+*
+* Said once for objects that are not Rebase's: on the next boot the schema holds
+* no helper, so {@link dropLegacyAuthSchema} leaves it alone — it is somebody
+* else's schema by then. A helper that is still there, Rebase's or a lookalike,
+* keeps it said on every boot until it goes.
+*/
+function describeLegacyAuthLeftovers(left, failure) {
+	const schema = LEGACY_RLS_SCHEMA;
+	const objects = left.filter((o) => o.object !== null);
+	if (objects.length === 0) return `The pre-1.0 \`${schema}\` schema is empty, but this connection could not drop it — most likely because it does not own the schema. Run \`DROP SCHEMA ${schema};\` as its owner.`;
+	const why = failure ? `dropping Rebase's old helpers from it failed: ${failure}.` : "`DROP SCHEMA … RESTRICT` refuses a schema that is not empty, and Rebase drops only the helpers it can tell are its own.";
+	const lines = objects.slice(0, MAX_LEFTOVERS_NAMED).map((o) => o.helper === "ours" ? `  • ${o.object} — Rebase's old helper, which could not be dropped` : o.helper === "lookalike" ? `  • ${o.object} — named and typed like Rebase's old helper, but no release wrote this body, so it was left alone; drop it by hand if nothing of yours calls it` : `  • ${o.object}`);
+	if (objects.length > MAX_LEFTOVERS_NAMED) lines.push(`  • …and ${objects.length - MAX_LEFTOVERS_NAMED} more`);
+	return `The pre-1.0 \`${schema}\` schema is still here: ${why} Still in it:\n` + lines.join("\n") + `
+Anything of yours can stay where it is — Rebase no longer uses this schema — or move out with \`ALTER … SET SCHEMA\`. Once the schema is empty, \`DROP SCHEMA ${schema};\` removes it.`;
 }
 //#endregion
 //#region src/cli-flags.ts
@@ -6836,6 +6960,10 @@ var BRANCH_ACTION_FLAGS = {
 	},
 	list: {},
 	info: {},
+	diff: {
+		"--json": Boolean,
+		"--sample-limit": Number
+	},
 	delete: {
 		"--force": Boolean,
 		"--yes": Boolean,
@@ -6937,6 +7065,7 @@ function unexpectedBranchArgs(words) {
 var TAKES_A_VALUE = /* @__PURE__ */ new Set([
 	"--from",
 	"--older-than",
+	"--sample-limit",
 	"--database-url"
 ]);
 //#endregion
@@ -6970,6 +7099,102 @@ function isDriverDbSubcommand(word) {
 	return DRIVER_DB_SUBCOMMANDS.some((subcommand) => subcommand === word);
 }
 //#endregion
-export { rlsRuntimeIsCurrent as _, resolveBranchSwitches as a, assertKnownFlags as c, parseCommandFlags as d, parseDriverLine as f, dropLegacyAuthSchema as g, RLS_BOOTSTRAP_STATEMENTS as h, assertKnownBranchFlags as i, closestWord as l, RLS_BOOTSTRAP_SQL as m, isDriverDbSubcommand as n, unexpectedBranchArgs as o, resolveDriverSwitches as p, backupActionOf as r, RELAYED_FLAGS as s, DRIVER_DB_SUBCOMMANDS as t, collectionsPathIn as u, rls_bootstrap_sql_exports as v, execa as y };
+//#region src/schema/migrate-baseline.ts
+/**
+* What `rebase db migrate --baseline <version>` does, given the history the
+* database already has.
+*
+* The flag promises to record `<version>` as applied and migrate from the next
+* one. Atlas's own `migrate apply --baseline` keeps that promise only on a
+* database with no revision history: once one row exists it ignores the flag
+* without a word, applies the migration anyway, and the CLI had already printed
+* "Recording … as already applied". That is the normal second time: a project
+* baselines once, then `rebase dev` adds a column at boot, `db generate` writes
+* the migration for it, and `db migrate` fails on `column … already exists
+* (42701)` however the baseline is spelled.
+*
+* So the history is read first. With none, Atlas's baseline does the work.
+* Behind `<version>`, `atlas migrate set` marks every migration up to it as
+* applied, which is what a baseline means. At or past it, there is nothing to
+* record, and the command says so instead of claiming it recorded something.
+*/
+/**
+* Atlas's version order for the versions Rebase writes: numeric timestamps,
+* compared as numbers so a shorter one is not read as later; anything else as
+* text.
+*/
+function compareMigrationVersions(a, b) {
+	if (/^\d+$/.test(a) && /^\d+$/.test(b)) {
+		const x = BigInt(a);
+		const y = BigInt(b);
+		return x === y ? 0 : x < y ? -1 : 1;
+	}
+	return a.localeCompare(b);
+}
+/**
+* The version Atlas records for a migration file: its numeric prefix
+* (`20260906101530_init.sql` → `20260906101530`), or the name without `.sql`.
+*/
+function migrationVersionOf(file) {
+	return /^(\d+)/.exec(file)?.[1] ?? file.replace(/\.sql$/, "");
+}
+/** How many versions a refused baseline names, newest last. */
+var VERSIONS_NAMED = 5;
+/**
+* Why `--baseline <version>` cannot run, or `null` when it names a migration
+* file in `drizzle/migrations`.
+*
+* Asked before anything else, the database included. A version no file has
+* was refused only by Atlas, after the command had said "Marking every
+* migration up to abc as applied…"; and one older than every file read
+* "Nothing to record" and migrated on, though it named nothing to baseline.
+*
+* @param files the migration files, sorted oldest first.
+* @returns the refusal, its first line the error and the rest the detail.
+*/
+function baselineVersionProblem(version, files) {
+	const versions = files.map(migrationVersionOf);
+	if (versions.length === 0) return `--baseline ${version}: There are no migrations in drizzle/migrations to baseline. Nothing was run.\nRun \`rebase db generate\` to write the first one.`;
+	if (versions.includes(version)) return null;
+	const named = versions.slice(-5).join(", ");
+	return `--baseline ${version} names no migration in drizzle/migrations. Nothing was run.\n${versions.length > VERSIONS_NAMED ? `The newest ${VERSIONS_NAMED} of the ${versions.length} versions there` : "The versions there"}: ${named}. A baseline is one of them: the newest migration the database already holds.`;
+}
+/** How to keep `--baseline <version>`'s promise, given the newest recorded version. */
+function planBaseline(version, latestRecorded) {
+	if (latestRecorded === null) return { kind: "atlas-baseline" };
+	if (compareMigrationVersions(version, latestRecorded) > 0) return {
+		kind: "set",
+		latest: latestRecorded
+	};
+	return {
+		kind: "already-recorded",
+		latest: latestRecorded
+	};
+}
+/** What the command says before it migrates, for each plan. */
+function describeBaselinePlan(version, plan) {
+	switch (plan.kind) {
+		case "atlas-baseline": return `Recording ${version} as already applied, then migrating from the next one.`;
+		case "set": return `This database already records migrations up to ${plan.latest}, and Atlas applies --baseline only to a database with none.\n  Marking every migration up to ${version} as applied with \`atlas migrate set\`, then migrating from the next one.`;
+		case "already-recorded": return `Nothing to record: this database already records migrations up to ${plan.latest}, which includes ${version}.\n  Migrating from the next one.`;
+	}
+}
+/**
+* The newest version Atlas has recorded on this database, or `null` when it
+* has recorded none (no revisions table yet included).
+*
+* The table is `rebase.atlas_schema_revisions`: the CLI passes
+* `--revisions-schema rebase` to every `migrate apply`.
+*/
+async function latestRecordedMigration(databaseUrl) {
+	return withAppClient(databaseUrl, async (client) => {
+		if (!(await client.query("SELECT to_regclass('rebase.atlas_schema_revisions') IS NOT NULL AS present")).rows[0]?.present) return null;
+		const versions = (await client.query("SELECT version FROM rebase.atlas_schema_revisions WHERE version NOT LIKE '.%'")).rows.map((row) => row.version);
+		if (versions.length === 0) return null;
+		return versions.reduce((latest, version) => compareMigrationVersions(version, latest) > 0 ? version : latest);
+	});
+}
+//#endregion
+export { rlsRuntimeIsCurrent as C, dropLegacyAuthSchema as S, execa as T, parseCommandFlags as _, migrationVersionOf as a, RLS_BOOTSTRAP_SQL as b, isDriverDbSubcommand as c, resolveBranchSwitches as d, unexpectedBranchArgs as f, collectionsPathIn as g, closestWord as h, latestRecordedMigration as i, backupActionOf as l, assertKnownFlags as m, compareMigrationVersions as n, planBaseline as o, RELAYED_FLAGS as p, describeBaselinePlan as r, DRIVER_DB_SUBCOMMANDS as s, baselineVersionProblem as t, assertKnownBranchFlags as u, parseDriverLine as v, rls_bootstrap_sql_exports as w, RLS_BOOTSTRAP_STATEMENTS as x, resolveDriverSwitches as y };
 
-//# sourceMappingURL=db-subcommands-BPoHCxJR.js.map
+//# sourceMappingURL=migrate-baseline-B-2Ef4Mv.js.map