@rebasepro/server-postgres 0.25.1 → 0.26.0

package/dist/rls-enforcement-BOHuHVlc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-enforcement-BOHuHVlc.js","names":[],"sources":["../src/security/rls-enforcement.ts"],"sourcesContent":["import { sql as drizzleSql, SQL } from \"drizzle-orm\";\nimport { ANONYMOUS_USER_ID, PolicyExpression, SecurityRule } from \"@rebasepro/types\";\nimport {\n    AnonymousGrantRisk,\n    findAnonymousGrants,\n    REBASE_INTERNAL_TABLES,\n    REBASE_USER_ROLE,\n    revokeInternalTableAccess,\n    securityRuleToConditions\n} from \"@rebasepro/common\";\nimport { REBASE_SCHEMA, usesLegacyRlsFunctions } from \"@rebasepro/types\";\nimport { logger } from \"@rebasepro/server\";\n\n/**\n * Unified RLS enforcement — the \"user context vs server context\" model.\n *\n * Every operation runs in one of two contexts:\n *\n *  - **User context** — a request authenticated (or anonymous) via\n *    `driver.withAuth(user)`. Runs as the restricted `rebase_user` role: a\n *    non-owner, NOSUPERUSER, NOBYPASSRLS role, so Postgres RLS binds *every*\n *    statement (SELECT, INSERT, UPDATE, DELETE). The collection's\n *    `securityRules` are the whole authorization model; app-layer callbacks\n *    are validation/side-effects, not a security boundary.\n *\n *  - **Server context** — the base (owner) connection: auth flows, migrations,\n *    and raw `rebase.sql`. As table owner it bypasses RLS. This is the trusted\n *    plane, equivalent to Supabase's `service_role`.\n *\n *    `rebase.dataAsAdmin` is **not** in it, despite the name. `init.ts` scopes\n *    that driver with `withAuth(SERVICE_IDENTITY)`, so it arrives as user\n *    context above — `rebase_user`, `app.uid = 'service'`, policies evaluated —\n *    and clears the default policies through their admin arm rather than the\n *    `rebase.uid() IS NULL` one.\n *\n * This module provides the three pieces:\n *\n *  1. {@link detectConnectionPosture} — is the connection subject to RLS at\n *     all? (superuser / BYPASSRLS / table owner ⇒ no)\n *  2. {@link ensureAppRole} — idempotently provision `rebase_user` with\n *     SELECT/INSERT/UPDATE/DELETE grants (+ default privileges so future\n *     tables stay covered).\n *  3. {@link applyAuthContext} — per-transaction: set the `app.*` GUCs the\n *     policies read (`rebase.uid()` etc.) and the transaction-local role\n *     `rebase_user` so RLS binds, in one statement. Transaction-scoped, so it\n *     composes with poolers.\n *\n * Provisioning runs from the framework's own bootstrap/migrate (which already\n * self-creates the `auth` schema and functions) — enforcement is default-on,\n * not an operator opt-in.\n */\n\n/**\n * The restricted role every authenticated (user-context) request runs as.\n *\n * Re-exported, not re-declared: the same name is needed by\n * `@rebasepro/common`'s internal-table revokes, and two spellings of a role name\n * fail as a silent no-op rather than an error.\n */\nexport { REBASE_USER_ROLE };\n\n/** Minimal SQL runner so callers can adapt drizzle or pg.Client. */\nexport type RawSqlRunner = (sqlText: string) => Promise<Record<string, unknown>[]>;\n\n/** Minimal transaction surface needed by {@link applyAuthContext}. */\nexport interface SqlTx {\n    execute(query: SQL): Promise<unknown>;\n}\n\nexport interface ConnectionPosture {\n    /** The connection's `current_user`. */\n    role: string;\n    superuser: boolean;\n    bypassRLS: boolean;\n    /**\n     * Owns at least one user table — owners bypass non-FORCE RLS.\n     *\n     * \"Owns\" in Postgres's sense, not by name: a role that INHERITs the owner is\n     * the owner for every ownership test the planner makes, including the one\n     * that decides whether a policy applies at all.\n     */\n    ownsTables: boolean;\n    /**\n     * May create tables somewhere the server writes — and would then own them.\n     *\n     * The reason this is part of the posture rather than a separate question:\n     * the posture is decided ONCE, at boot, and on a fresh database the\n     * catalogue has nothing to report yet. The process that asks then goes on to\n     * create every table in the schema and owns all of them for the rest of its\n     * life. Asking only what is already there answers about the wrong instant.\n     */\n    canCreateTables: boolean;\n    /** True when RLS would NOT constrain this connection. */\n    privileged: boolean;\n}\n\nexport interface AuthContext {\n    uid: string;\n    /** Raw roles as carried on the user (strings or `{ id }` objects). */\n    roles: unknown[];\n    /**\n     * Whether this session came from anonymous sign-in rather than an account.\n     *\n     * Anonymous sign-in mints a real user row and a real uid, so a guest was\n     * indistinguishable from a registered account inside a policy: same\n     * `rebase.uid()`, same default role. Every rule meaning \"a signed-in\n     * person\" was therefore also a rule about anybody who had called\n     * `POST /auth/anonymous`, which asks for no email, no password and no\n     * agreement to anything.\n     *\n     * Optional, and absent reads as `false`: a caller that predates this — a\n     * realtime subscription, a custom validator — keeps the behaviour it had\n     * rather than having every one of its users reclassified as guests.\n     */\n    isAnonymous?: boolean;\n    /**\n     * The **custom** claims on the caller's token, as `rebase.jwt()` reports\n     * them.\n     *\n     * This is how a policy reaches a fact about the session that is neither the\n     * uid nor the roles — which, before this, it could not: `app.jwt` was built\n     * from three fields the driver already had, so `rebase.jwt()`, documented\n     * as \"full JWT claims as JSONB\", returned a three-key object that never had\n     * a claim in it.\n     *\n     * Multi-tenancy's `claim` form is the first caller — `policy.authClaim(…)`\n     * compiles to `rebase.jwt() ->> '<name>'`. Identity claims are stripped out\n     * before they reach here (`AccessTokenPayload.claims`) and the identity\n     * fields are written *over* them below, so nothing a hook put on a token\n     * can assert a uid, roles or guest status.\n     */\n    claims?: Record<string, unknown>;\n}\n\nconst quoteIdent = (name: string): string => `\"${name.replace(/\"/g, \"\\\"\\\"\")}\"`;\n\n/** DML the user role holds on managed tables (RLS still filters per row). */\nconst USER_TABLE_PRIVILEGES = \"SELECT, INSERT, UPDATE, DELETE\";\n\n/**\n * Take every privilege the user role holds on one table back — what a table\n * gets when RLS cannot be switched on for it, so it is unreachable rather than\n * unprotected. Quoted exactly: a mixed-case adopted table (`\"User\"`) folded to\n * lower case names a table that does not exist.\n */\nexport const revokeUserRoleSql = (schema: string, table: string): string =>\n    `REVOKE ALL PRIVILEGES ON ${quoteIdent(schema)}.${quoteIdent(table)} FROM ${quoteIdent(REBASE_USER_ROLE)}`;\n\n/**\n * Warn when the connection role shares its name with an existing schema.\n *\n * Postgres resolves unqualified names through `search_path`, which defaults to\n * `\"$user\", public` — and `$user` is the connection ROLE. When a schema of that\n * name exists it sits ahead of `public`, so every unqualified statement\n * silently operates on it instead:\n *\n *     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts\n *\n * Nothing errors. You get a second table of the same name in the wrong schema,\n * and reads that pin `public` cannot see it — which reads as \"missing table\" and\n * sends people to re-run a push that creates a *third* copy. The bootstrapper\n * has a whole branch dedicated to recognising the symptom after the fact.\n *\n * Rebase shipped straight into this: it creates a schema named `rebase` while\n * every template named the database role `rebase` too. The scaffold uses\n * `rebase_app` now, and every pool Rebase opens pins `search_path=public`\n * (`pinSearchPath`), which covers the paths the framework controls. This covers\n * the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,\n * a hand-written migration — because the hazard is a property of the two NAMES,\n * not of any one connection.\n *\n * A warning rather than a boot failure: the database works, the framework's own\n * traffic is pinned, and refusing to start over a naming choice a user may have\n * inherited would be worse than the risk.\n */\nexport async function warnOnRoleSchemaCollision(run: RawSqlRunner): Promise<void> {\n    try {\n        const rows = await run(`\n            SELECT current_user AS role,\n                   EXISTS (\n                       SELECT 1 FROM pg_namespace n WHERE n.nspname = current_user\n                   ) AS collides\n        `);\n        if (rows[0]?.collides !== true) return;\n        const role = String(rows[0]?.role ?? \"the connection role\");\n        logger.warn(\n            `⚠️  The database role \"${role}\" has the same name as a schema. Postgres resolves unqualified ` +\n            `names through \\`search_path\\`, which defaults to \\`\"$user\", public\\` — so \"${role}\" is searched ` +\n            `BEFORE public, and any unqualified \\`CREATE TABLE\\`/\\`SELECT\\` from a tool that does not pin the ` +\n            `path (psql, pg_dump, drizzle-kit, a hand-written migration) silently lands in \"${role}\" instead. ` +\n            `Rebase's own connections pin \\`search_path=public\\`, so the server is unaffected. To remove the ` +\n            `hazard entirely, connect as a role whose name is not also a schema — the scaffold uses ` +\n            `\"rebase_app\".`\n        );\n    } catch {\n        // A diagnostic must never be the reason a boot fails.\n    }\n}\n\n/**\n * Would RLS actually constrain this connection?\n *\n * Four ways the answer is no, and only two of them are obvious. Superuser and\n * BYPASSRLS announce themselves in `pg_roles`. The other two are about\n * ownership, and both used to read as \"no bypass here\":\n *\n * - **Ownership through membership.** The old query compared\n *   `pg_tables.tableowner` to `current_user` as a string. Postgres does not: a\n *   role that INHERITs the owner passes every ownership test the planner makes,\n *   including the one that decides whether a policy applies. So a perfectly\n *   ordinary \"app role that is a member of the owner role\" setup reported\n *   unprivileged and bypassed every policy — permanently, since no restart\n *   changes a string comparison's answer.\n *\n * - **Ownership that has not happened yet.** The posture is decided once, at\n *   boot, and on a fresh database there is nothing in the catalogue to find. The\n *   same process then creates every table and owns all of them. The first boot\n *   of a new deployment therefore served every request unconstrained, the log\n *   said RLS was fine, and the SECOND boot silently fixed it — which is the\n *   worst possible shape for a security check, because the state that reproduces\n *   it is gone by the time anyone looks. Asking \"may this role create tables\n *   where the server provisions?\" answers about the process's whole life rather\n *   than about one instant of it.\n *\n * `schemas` narrows the CREATE question to where the server actually writes.\n * Omitted, it asks about every schema the role can see, which is the safe\n * direction: over-reporting costs a role switch that was not strictly needed,\n * under-reporting costs the entire authorization model.\n */\nexport async function detectConnectionPosture(\n    run: RawSqlRunner,\n    schemas?: string[]\n): Promise<ConnectionPosture> {\n    // Identifiers, and they reach SQL as literals in a catalogue comparison —\n    // but they arrive from collection configs, so they are quoted as string\n    // literals rather than interpolated as names, and a quote inside one is\n    // escaped rather than trusted.\n    const schemaFilter = schemas?.length\n        ? `AND n.nspname IN (${Array.from(new Set(schemas))\n            .map((s) => `'${s.replace(/'/g, \"''\")}'`)\n            .join(\", \")})`\n        : \"\";\n\n    const rows = await run(`\n        SELECT current_user            AS role,\n               r.rolsuper              AS superuser,\n               r.rolbypassrls          AS bypassrls,\n               EXISTS (\n                   SELECT 1 FROM pg_tables t\n                   WHERE pg_has_role(current_user, t.tableowner, 'USAGE')\n                     AND t.schemaname NOT IN ('pg_catalog', 'information_schema')\n               )                       AS owns_tables,\n               EXISTS (\n                   SELECT 1 FROM pg_namespace n\n                   WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')\n                     AND n.nspname NOT LIKE 'pg\\\\_toast%'\n                     AND n.nspname NOT LIKE 'pg\\\\_temp%'\n                     ${schemaFilter}\n                     AND has_schema_privilege(current_user, n.oid, 'CREATE')\n               )                       AS can_create\n        FROM pg_roles r\n        WHERE r.rolname = current_user\n    `);\n    const row = rows[0] ?? {};\n    const superuser = row.superuser === true;\n    const bypassRLS = row.bypassrls === true;\n    const ownsTables = row.owns_tables === true;\n    const canCreateTables = row.can_create === true;\n    return {\n        role: String(row.role ?? \"unknown\"),\n        superuser,\n        bypassRLS,\n        ownsTables,\n        canCreateTables,\n        privileged: superuser || bypassRLS || ownsTables || canCreateTables\n    };\n}\n\n/**\n * Human-actionable instructions for when the connection cannot provision the\n * user role itself (no CREATEROLE and role not pre-created by the platform).\n */\nexport function appRoleSetupInstructions(connectionRole: string, schemas: string[]): string {\n    const grants = schemas.map((s) =>\n        `GRANT USAGE ON SCHEMA ${quoteIdent(s)} TO ${REBASE_USER_ROLE};\\n` +\n        `GRANT ${USER_TABLE_PRIVILEGES} ON ALL TABLES IN SCHEMA ${quoteIdent(s)} TO ${REBASE_USER_ROLE};\\n` +\n        `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${quoteIdent(s)} TO ${REBASE_USER_ROLE};`\n    ).join(\"\\n\");\n    return (\n        `Rebase enforces row-level security by running authenticated requests as ` +\n        `the restricted role \"${REBASE_USER_ROLE}\", but the connection role ` +\n        `\"${connectionRole}\" bypasses RLS and cannot create that role itself.\\n` +\n        `Run the following as a database administrator, then restart:\\n\\n` +\n        `CREATE ROLE ${REBASE_USER_ROLE} NOLOGIN NOSUPERUSER NOBYPASSRLS NOINHERIT;\\n` +\n        `GRANT ${REBASE_USER_ROLE} TO ${quoteIdent(connectionRole)};\\n` +\n        grants\n    );\n}\n\n/**\n * Idempotently provision the `rebase_user` role, membership for the current\n * connection role, and DML grants (+ default privileges for future tables)\n * on every existing schema in `schemas`.\n *\n * Split into privilege tiers so it works both when the connection is a\n * superuser (creates everything) and when the platform pre-created the role\n * and membership (e.g. CNPG `postInitApplicationSQL`) and the connection is\n * merely the table owner — owners can always run the grant tier themselves.\n *\n * RLS still filters every row: these grants only make the tables *reachable*\n * by the role; the policies decide which rows/commands actually pass.\n *\n * Throws with precise setup instructions when the role is missing and the\n * connection cannot create it.\n */\nexport async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promise<void> {\n    const uniqueSchemas = Array.from(new Set(schemas.filter(Boolean)));\n\n    // Tier 1 — role existence.\n    const roleRows = await run(`SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}'`);\n    if (roleRows.length === 0) {\n        try {\n            // Guarded in the statement as well as by the probe above. A role\n            // belongs to the cluster, not the database, so a recorded\n            // provisioning run (REBASE_PROVISION_SQL_OUT) replayed into another\n            // database on a cluster that already has the role must find this a\n            // no-op rather than its first error.\n            await run(`\n                DO $rebase_role$\n                BEGIN\n                    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}') THEN\n                        CREATE ROLE ${REBASE_USER_ROLE} NOLOGIN NOSUPERUSER NOBYPASSRLS NOINHERIT;\n                    END IF;\n                END\n                $rebase_role$\n            `);\n        } catch (err) {\n            throw new Error(\n                `Failed to create the \"${REBASE_USER_ROLE}\" role: ${err instanceof Error ? err.message : String(err)}\\n\\n` +\n                appRoleSetupInstructions(\"current connection role\", uniqueSchemas)\n            );\n        }\n    }\n\n    // Tier 2 — membership, so a non-superuser connection may SET ROLE to it.\n    const memberRows = await run(`\n        SELECT (pg_has_role(current_user, '${REBASE_USER_ROLE}', 'MEMBER')\n                OR (SELECT rolsuper FROM pg_roles WHERE rolname = current_user)) AS can_set,\n               current_user AS role\n    `);\n    if (memberRows[0]?.can_set !== true) {\n        try {\n            await run(`GRANT ${REBASE_USER_ROLE} TO CURRENT_USER`);\n        } catch (err) {\n            throw new Error(\n                `The connection role is not a member of \"${REBASE_USER_ROLE}\" and cannot grant itself membership: ` +\n                `${err instanceof Error ? err.message : String(err)}\\n\\n` +\n                appRoleSetupInstructions(String(memberRows[0]?.role ?? \"current connection role\"), uniqueSchemas)\n            );\n        }\n    }\n\n    // Tier 3 — grants.\n    await ensureAppRoleGrants(run, uniqueSchemas);\n\n    logger.debug(`🔐 [rls] User role \"${REBASE_USER_ROLE}\" provisioned (schemas: ${uniqueSchemas.join(\", \")})`);\n}\n\n/** A string literal for a catalogue read. Names come from config and constants, never from a request. */\nconst sqlLiteral = (value: string): string => `'${value.replace(/'/g, \"''\")}'`;\nconst textArray = (values: readonly string[]): string =>\n    values.length === 0 ? \"ARRAY[]::text[]\" : `ARRAY[${values.map(sqlLiteral).join(\", \")}]::text[]`;\n\n/**\n * The framework's internal tables in `schemas` that the request role can\n * reach — `schema.table`, sorted — when nothing is left to take it back off.\n *\n * Every provisioning boot repairs this: each store revokes on its own table\n * and {@link ensureAppRole}'s sweep revokes on the rest, because the grant\n * tier hands the request role DML on whole schemas. A backend that changes\n * nothing in its database runs neither, so a database whose `rebase_user` can\n * read `refresh_tokens` or `api_keys` would stay that way for as long as it\n * served. This is the question the sweep would have answered, asked instead.\n *\n * \"Can reach\" is what the role can actually do — through a grant to it, to a\n * role it inherits, or to PUBLIC, on the table or on any of its columns —\n * because that, not how the ACL is spelled, is what a request running as it\n * gets. A table with RLS on is somebody's collection by that same rule as the\n * sweep's, and is left out.\n */\nexport async function findExposedInternalTables(run: RawSqlRunner, schemas: string[]): Promise<string[]> {\n    const rows = await run(`\n        SELECT n.nspname || '.' || c.relname AS name\n        FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace\n        WHERE n.nspname = ANY(${textArray(Array.from(new Set(schemas)))})\n          AND c.relname = ANY(${textArray(REBASE_INTERNAL_TABLES)})\n          AND c.relkind IN ('r', 'p')\n          AND NOT c.relrowsecurity\n          AND (has_table_privilege(${sqlLiteral(REBASE_USER_ROLE)}, c.oid, 'SELECT, INSERT, UPDATE, DELETE')\n               OR has_any_column_privilege(${sqlLiteral(REBASE_USER_ROLE)}, c.oid, 'SELECT, INSERT, UPDATE'))\n        ORDER BY 1\n    `);\n    return rows.map(row => String(row.name));\n}\n\n/** What the grant tier would find already in place in one schema. */\ninterface SchemaGrants {\n    /** `USAGE` on the schema, granted by its owner. */\n    usage: boolean;\n    /**\n     * Every relation `GRANT … ON ALL TABLES` reaches already has all four DML\n     * privileges from its owner — Rebase's own RLS-off tables aside, which the\n     * sweep takes back right after and so never keep them.\n     */\n    tables: boolean;\n    /** Every sequence already has `USAGE, SELECT` from its owner. */\n    sequences: boolean;\n    /** This role's default privileges in the schema already grant the table DML. */\n    defaultTables: boolean;\n    /** …and the sequence `USAGE, SELECT`. */\n    defaultSequences: boolean;\n    /**\n     * Rebase's own RLS-off tables a `REVOKE` would still change: the user role\n     * holds a privilege on them, or the table has never had an ACL written —\n     * `NULL`, which a `REVOKE` (like the grant-and-revoke it replaces) turns\n     * into the owner's explicit default. Same access either way; the same\n     * catalogue only this way.\n     */\n    internalGranted: string[];\n}\n\n/**\n * The grant tier's state for every existing schema in `schemas`, in one read.\n *\n * A grant counts as present only as the statement this tier runs would record\n * it — grantor the object's owner, which is what a GRANT by the owner, a member\n * of the owning role or a superuser records — so skipping it leaves the ACL\n * exactly as running it would. Anything else reads as missing, and the\n * statement runs as it always did.\n */\nasync function readSchemaGrants(run: RawSqlRunner, schemas: string[]): Promise<Map<string, SchemaGrants>> {\n    const internal = textArray(REBASE_INTERNAL_TABLES);\n    const target = `(SELECT oid FROM pg_roles WHERE rolname = ${sqlLiteral(REBASE_USER_ROLE)})`;\n    /** Distinct privileges `acl` gives the user role (from `grantor`, when given) out of `privileges`. */\n    const held = (acl: string, privileges: string[], grantor?: string): string =>\n        `(SELECT count(DISTINCT a.privilege_type) FROM aclexplode(${acl}) a WHERE a.grantee = ${target}` +\n        `${grantor ? ` AND a.grantor = ${grantor}` : \"\"} AND a.privilege_type IN (${privileges.map(sqlLiteral).join(\", \")}))`;\n    const DML = [\"SELECT\", \"INSERT\", \"UPDATE\", \"DELETE\"];\n    const SEQ = [\"USAGE\", \"SELECT\"];\n    const rows = await run(`\n        SELECT n.nspname AS schema,\n               ${held(\"n.nspacl\", [\"USAGE\"], \"n.nspowner\")} = 1 AS usage,\n               NOT EXISTS (\n                   SELECT 1 FROM pg_class c\n                   WHERE c.relnamespace = n.oid AND c.relkind IN ('r', 'v', 'm', 'f', 'p')\n                     AND NOT (c.relname = ANY(${internal}) AND NOT c.relrowsecurity)\n                     AND ${held(\"c.relacl\", DML, \"c.relowner\")} < ${DML.length}\n               ) AS tables,\n               NOT EXISTS (\n                   SELECT 1 FROM pg_class c\n                   WHERE c.relnamespace = n.oid AND c.relkind = 'S'\n                     AND ${held(\"c.relacl\", SEQ, \"c.relowner\")} < ${SEQ.length}\n               ) AS sequences,\n               EXISTS (\n                   SELECT 1 FROM pg_default_acl d\n                   WHERE d.defaclrole = (SELECT oid FROM pg_roles WHERE rolname = current_user)\n                     AND d.defaclnamespace = n.oid AND d.defaclobjtype = 'r'\n                     AND ${held(\"d.defaclacl\", DML)} = ${DML.length}\n               ) AS default_tables,\n               EXISTS (\n                   SELECT 1 FROM pg_default_acl d\n                   WHERE d.defaclrole = (SELECT oid FROM pg_roles WHERE rolname = current_user)\n                     AND d.defaclnamespace = n.oid AND d.defaclobjtype = 'S'\n                     AND ${held(\"d.defaclacl\", SEQ)} = ${SEQ.length}\n               ) AS default_sequences,\n               ARRAY(\n                   SELECT c.relname::text FROM pg_class c\n                   WHERE c.relnamespace = n.oid AND c.relname = ANY(${internal}) AND NOT c.relrowsecurity\n                     AND (c.relacl IS NULL OR EXISTS (SELECT 1 FROM aclexplode(c.relacl) a WHERE a.grantee = ${target}))\n                   ORDER BY 1\n               ) AS internal_granted\n        FROM pg_namespace n\n        WHERE n.nspname = ANY(${textArray(schemas)})\n    `);\n    const grants = new Map<string, SchemaGrants>();\n    for (const row of rows) {\n        const internalGranted = row.internal_granted;\n        grants.set(String(row.schema), {\n            usage: row.usage === true,\n            tables: row.tables === true,\n            sequences: row.sequences === true,\n            defaultTables: row.default_tables === true,\n            defaultSequences: row.default_sequences === true,\n            internalGranted: Array.isArray(internalGranted)\n                ? internalGranted.map(String)\n                // A driver that hands arrays back as text: `{a,b}`.\n                : String(internalGranted ?? \"\").replace(/^\\{|\\}$/g, \"\").split(\",\").filter(Boolean)\n        });\n    }\n    return grants;\n}\n\n/**\n * The grant tier of {@link ensureAppRole} on its own: `USAGE` on each existing\n * schema in `schemas`, DML on its tables and `USAGE, SELECT` on its\n * sequences, the default privileges that cover what this role creates later,\n * and Rebase's own tables taken back — for a role and membership already\n * provisioned.\n *\n * Every statement is issued only when the catalogue says it would change\n * something. They used to run unconditionally, twice per boot (at connect, and\n * again in the final posture check): a `GRANT … ON ALL TABLES` rewrites every\n * table's `pg_class` row whether or not the ACL changes, which invalidates\n * every table's cached plans on every connection, and the internal-table sweep\n * ran 23 `REVOKE`s per schema. A boot against a database whose grants already\n * hold now reads one catalogue query and writes nothing; one that is missing\n * any of them runs exactly the statements it always ran.\n *\n * Table owners (the expected non-superuser posture) can always grant on their\n * own objects, so this needs no extra privilege.\n */\nexport async function ensureAppRoleGrants(run: RawSqlRunner, schemas: string[]): Promise<void> {\n    const uniqueSchemas = Array.from(new Set(schemas.filter(Boolean)));\n    const grants = await readSchemaGrants(run, uniqueSchemas);\n    for (const schema of uniqueSchemas) {\n        const state = grants.get(schema);\n        // Not there (yet): a later call, once provisioning has created it, grants it.\n        if (!state) continue;\n        const s = quoteIdent(schema);\n        if (!state.usage) await run(`GRANT USAGE ON SCHEMA ${s} TO ${REBASE_USER_ROLE}`);\n        if (!state.tables) await run(`GRANT ${USER_TABLE_PRIVILEGES} ON ALL TABLES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);\n        if (!state.sequences) await run(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);\n        // Cover objects created later by the CURRENT role (the role that runs\n        // migrations), so a migrate can never strand the user role.\n        if (!state.defaultTables) {\n            await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);\n        }\n        if (!state.defaultSequences) {\n            await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);\n        }\n\n        // The grants above are deliberately schema-wide — a project's own\n        // collections may live in `rebase`, and future tables must be reachable\n        // or a migration strands the role. Rebase's OWN tables are the exception:\n        // refresh tokens, MFA secrets, API keys and the rest carry no RLS and no\n        // row an end user should ever address. Taking the privilege back here\n        // covers every table that already exists; each creator revokes on the\n        // table it just made, for the boot that creates them for the first time.\n        //\n        // All of them right after the schema-wide grant, which has just handed\n        // them out; otherwise only the ones the catalogue says still hold one.\n        const tables = state.tables ? state.internalGranted : undefined;\n        if (tables && tables.length === 0) continue;\n        await revokeInternalTableAccess(async (text) => { await run(text); }, schema, {\n            tables,\n            onError: (table, error) => logger.warn(\n                `🔐 [rls] Could not revoke \"${REBASE_USER_ROLE}\" access to \"${schema}\".\"${table}\" — ` +\n                \"it stays reachable by authenticated requests: \" +\n                (error instanceof Error ? error.message : String(error))\n            )\n        });\n    }\n}\n\n/**\n * Rebase's own RLS-off tables in `schema` that a `revokeInternalTableAccess`\n * sweep would change — the user role holds a privilege on them, or their ACL\n * has never been written. One read; the sweep it narrows is one `DO` per\n * table name.\n */\nexport async function internalTablesGrantedToUserRole(run: RawSqlRunner, schema: string): Promise<string[]> {\n    return (await readSchemaGrants(run, [schema])).get(schema)?.internalGranted ?? [];\n}\n\n/**\n * Apply the authenticated context to a transaction: the `app.*` GUCs that RLS\n * policies read via `rebase.uid()` / `rebase.roles()` / `rebase.jwt()`, and — when\n * `userRole` is set — the `LOCAL` role switch, in the same statement, so RLS\n * binds every statement in this transaction (reads *and* writes).\n *\n * GUCs are set with `is_local = true` and the role switch is `LOCAL`: both\n * reset at commit/rollback, so pooled connections are never polluted.\n *\n * Fails closed by construction: if the role switch errors, the transaction\n * aborts instead of proceeding privileged.\n *\n * SECURITY: this function is only ever called on the **user** path (the server\n * context uses the base/owner driver and never calls it). The default policies\n * treat `rebase.uid() IS NULL` as the trusted server context, and `rebase.uid()`\n * is `NULLIF(current_setting('app.uid'), '')` — so an EMPTY user id would\n * be read as NULL and silently escalate a user request to server privileges.\n * Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,\n * rather than trusting every caller (e.g. realtime subscription auth) to do it.\n * That sentinel is exported from `@rebasepro/types` because it leaks into rule\n * semantics: it is why `rebase.uid() IS NOT NULL` is true for anonymous requests.\n */\nexport async function applyAuthContext(tx: SqlTx, auth: AuthContext, userRole?: string): Promise<void> {\n    const uid = typeof auth.uid === \"string\" && auth.uid.trim() !== \"\" ? auth.uid : ANONYMOUS_USER_ID;\n    const normalizedRoles = auth.roles.map((r: unknown) =>\n        typeof r === \"string\" ? r : (r as Record<string, unknown>)?.id ?? String(r)\n    );\n    // `app.user_id` is the pre-rename spelling, still written because policies\n    // are data: a database provisioned before the rename holds rules compiled\n    // to `current_setting('app.user_id')`, and those predicates would evaluate\n    // to NULL — failing open or locking out — if we stopped setting it. Drop\n    // the alias only once no live database carries a legacy policy.\n    // A guest is a signed-in caller with no account behind them, and until this\n    // the database could not tell the difference — see `rebase.is_anonymous()`.\n    // Written as a string because that is what `set_config` takes.\n    const isAnonymous = auth.isAnonymous === true ? \"true\" : \"false\";\n\n    await tx.execute(drizzleSql`\n        SELECT\n            set_config('app.uid', ${uid}, true),\n            set_config('app.user_id', ${uid}, true),\n            set_config('app.user_roles', ${normalizedRoles.join(\",\")}, true),\n            set_config('app.is_anonymous', ${isAnonymous}, true),\n            set_config('app.jwt', ${JSON.stringify({\n        // The caller's custom claims, FIRST, so the identity keys below\n        // overwrite them rather than the other way round. Same ordering, and\n        // the same reason, as `generateAccessToken`: a claims hook is a place\n        // to add facts about a session, not the place its subject is decided.\n        // `verifyAccessToken` already strips the identity claims out of this\n        // object; the ordering is the second lock on the same door.\n        ...(auth.claims ?? {}),\n        sub: uid,\n        roles: auth.roles,\n        // In the claims too, so a policy reading `rebase.jwt()` — which is\n        // how a rule reaches anything that is not uid or roles — sees the\n        // same fact as `rebase.is_anonymous()`. Two sources that could\n        // disagree would be worse than one.\n        is_anonymous: auth.isAnonymous === true\n    })}, true)${userRole\n        // The role switch, in the same statement rather than a `SET LOCAL ROLE`\n        // round trip of its own on every transaction. Postgres implements\n        // `SET ROLE` as the `role` setting: `set_config('role', name, true)`\n        // runs the same membership check, fails with the same SQLSTATE and\n        // message (42501 \"permission denied to set role\", 22023 for an unknown\n        // role — `isRoleSwitchingPermissionError` still reads it), takes the\n        // name verbatim as the quoted identifier did, and resets at COMMIT and\n        // ROLLBACK like `LOCAL`. Last in the list, after the GUCs; a refusal\n        // fails the whole statement, so the transaction aborts rather than\n        // running on as the connection owner. auth-context-one-statement.test.ts.\n        ? drizzleSql`,\n            set_config('role', ${userRole}, true)`\n        : drizzleSql``}\n    `);\n}\n\n/** Role names from other BaaS platforms that people reach for out of habit. */\nconst FOREIGN_CONVENTION_ROLES: Record<string, string> = {\n    authenticated: \"Supabase\",\n    anon: \"Supabase\",\n    service_role: \"Supabase\"\n};\n\n/**\n * Warn about rules that read as \"signed-in users only\" but admit anonymous\n * callers — `rebase.uid() IS NOT NULL`, or a comparison against another\n * platform's magic user id such as `'anon'`.\n *\n * The sibling of {@link validatePolicyPgRoles}, for the more dangerous spelling\n * of the same habit. A foreign `pgRoles` value makes a policy unreachable and\n * the table reads empty — loud, and that guard throws. These do the opposite:\n * the rule compiles to a grant, and nothing looks wrong until the data is\n * already public.\n *\n * Warns rather than throws. Unlike an unreachable `pgRoles`, these rules are\n * serving traffic today: refusing to boot would take an app offline to report a\n * problem it already has, and on the read path it would take it offline\n * *because* its data was exposed. Rewriting the author's SQL is not an option\n * either — this is the escape hatch whose whole promise is that it means what it\n * says. So: say so, loudly, and leave the rule alone.\n */\nexport function warnOnAnonymousGrants(\n    collections: { slug?: string; securityRules?: readonly SecurityRule[] }[]\n): void {\n    // Grouped by the mistake, not by the rule: one habit typically repeats\n    // across every collection an author wrote, and a per-rule list would repeat\n    // the same paragraph dozens of times and get skimmed.\n    const byRisk = new Map<string, { risk: AnonymousGrantRisk; sites: string[] }>();\n\n    for (const collection of collections) {\n        for (const rule of collection.securityRules ?? []) {\n            const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);\n            const risks = [usingExpr, withCheckExpr]\n                .filter((e): e is PolicyExpression => e !== null)\n                .flatMap(findAnonymousGrants);\n\n            for (const risk of risks) {\n                const key = `${risk.pattern}:${risk.detail}`;\n                const site = `${collection.slug ?? \"(unnamed)\"} → \"${rule.name ?? \"(unnamed rule)\"}\"`;\n                const entry = byRisk.get(key) ?? { risk, sites: [] };\n                if (!entry.sites.includes(site)) entry.sites.push(site);\n                byRisk.set(key, entry);\n            }\n        }\n    }\n\n    if (byRisk.size === 0) return;\n\n    const problems = [...byRisk.values()].map(({ risk, sites }) =>\n        `  • ${risk.explanation}\\n    ${sites.length} rule(s): ${sites.join(\", \")}`\n    );\n\n    logger.warn(\n        `Security rules that read as a lockdown but grant access to anonymous requests. Every caller from a ` +\n        `client carries a user id ('${ANONYMOUS_USER_ID}' when nobody is signed in), so these clauses are ` +\n        `true for everyone:\\n\\n` +\n        problems.join(\"\\n\\n\") + \"\\n\"\n    );\n}\n\n/**\n * Name the collections whose raw policy SQL still calls the pre-1.0 helpers.\n *\n * The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the\n * database, so nothing is broken and no policy is wrong — which is exactly why\n * this has to be said out loud. A silent rewrite that works forever is not a\n * migration, it is a second supported spelling nobody wrote down, and the next\n * person to read those rules will copy the old one.\n *\n * Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,\n * `policy.rolesOverlap(...)`) compile from the model and were never affected.\n */\nexport function warnOnLegacyRlsFunctions(\n    collections: { slug?: string; securityRules?: readonly SecurityRule[] }[]\n): void {\n    const sites: string[] = [];\n\n    for (const collection of collections) {\n        for (const rule of collection.securityRules ?? []) {\n            const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);\n            const carriesLegacy = [usingExpr, withCheckExpr]\n                .filter((e): e is PolicyExpression => e !== null)\n                .some(containsLegacyRlsCall);\n            if (!carriesLegacy) continue;\n\n            const site = `${collection.slug ?? \"(unnamed)\"} → \"${rule.name ?? \"(unnamed rule)\"}\"`;\n            if (!sites.includes(site)) sites.push(site);\n        }\n    }\n\n    if (sites.length === 0) return;\n\n    logger.warn(\n        `These security rules call the pre-1.0 RLS helpers (\\`auth.uid()\\`, \\`auth.roles()\\`, \\`auth.jwt()\\`). ` +\n        `They still work — the compiler rewrites them — but the functions now live in the \\`rebase\\` schema, ` +\n        `and the \\`auth\\` one is Supabase's. Update the raw SQL in these rules to \\`${REBASE_SCHEMA}.uid()\\` ` +\n        `and friends, or switch them to the structured helpers (\\`policy.authUid()\\`, \\`policy.rolesOverlap()\\`), ` +\n        `which never had to be spelled by hand:\\n\\n` +\n        sites.map(s => `  • ${s}`).join(\"\\n\") + \"\\n\"\n    );\n}\n\n/** Whether any `raw` expression in the tree calls a pre-1.0 helper. */\nfunction containsLegacyRlsCall(expr: PolicyExpression): boolean {\n    switch (expr.kind) {\n        case \"raw\":\n            return usesLegacyRlsFunctions(expr.sql);\n        case \"and\":\n        case \"or\":\n            return expr.operands.some(containsLegacyRlsCall);\n        case \"not\":\n            return containsLegacyRlsCall(expr.operand);\n        case \"existsIn\":\n            return containsLegacyRlsCall(expr.where);\n        default:\n            return false;\n    }\n}\n\n/**\n * Reject `pgRoles` that this server can never satisfy.\n *\n * `pgRoles` sets the `TO` clause of a generated policy, so a policy naming a\n * role the request never runs as simply never applies — and RLS then filters\n * every row. The table reads as empty, which is indistinguishable from having\n * no data, so the mistake survives review and ships.\n *\n * Requests run as `rebase_user`, so a policy is only reachable if it targets\n * `public` or a role `rebase_user` holds. Anything else is a configuration\n * error worth failing the boot for.\n */\nexport async function validatePolicyPgRoles(\n    run: RawSqlRunner,\n    collections: { slug?: string; securityRules?: readonly { name?: string; pgRoles?: readonly string[] }[] }[],\n    /** The role requests actually run as: `rebase_user` when the connection is\n     *  privileged enough to switch, otherwise the connection role itself. */\n    requestRole: string = REBASE_USER_ROLE\n): Promise<void> {\n    const wanted = new Map<string, string[]>();\n    for (const collection of collections) {\n        for (const rule of collection.securityRules ?? []) {\n            for (const role of rule.pgRoles ?? []) {\n                if (role === \"public\") continue;\n                wanted.set(role, [...(wanted.get(role) ?? []), collection.slug ?? \"(unnamed)\"]);\n            }\n        }\n    }\n    if (wanted.size === 0) return;\n\n    const names = [...wanted.keys()].map((r) => `'${r.replace(/'/g, \"''\")}'`).join(\",\");\n    const escapedRequestRole = requestRole.replace(/'/g, \"''\");\n    const rows = await run(`\n        SELECT r.rolname AS role,\n               COALESCE(pg_has_role(to_regrole('${escapedRequestRole}'), r.oid, 'MEMBER'), false) AS reachable\n        FROM pg_roles r\n        WHERE r.rolname IN (${names})\n    `);\n\n    const reachable = new Map(rows.map((row) => [String(row.role), row.reachable === true]));\n    const problems: string[] = [];\n\n    for (const [role, slugs] of wanted) {\n        if (reachable.get(role) === true) continue;\n\n        const why = reachable.has(role)\n            ? `\"${requestRole}\" is not a member of it`\n            : \"no such role exists in this database\";\n        const platform = FOREIGN_CONVENTION_ROLES[role];\n        const hint = platform\n            ? `\"${role}\" is a ${platform} convention, not a PostgreSQL role. Application roles belong in \\`roles: [\"${role === \"service_role\" ? \"admin\" : role}\"]\\`, which is checked inside the policy via rebase.roles().`\n            : `Either grant it (GRANT ${role} TO ${requestRole}) or drop \\`pgRoles\\` so the policy targets \\`public\\`.`;\n\n        problems.push(\n            `  • pgRoles: [\"${role}\"] on ${slugs.join(\", \")} — ${why}.\\n    ${hint}`\n        );\n    }\n\n    if (problems.length > 0) {\n        throw new Error(\n            `Security rules target PostgreSQL roles this server cannot use. Requests run as ` +\n            `\"${requestRole}\", so these policies would never apply and every row would be ` +\n            `filtered out — the collections would look empty rather than error.\\n\\n` +\n            problems.join(\"\\n\\n\") + \"\\n\"\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsIA,IAAM,cAAc,SAAyB,IAAI,KAAK,QAAQ,MAAM,MAAM,EAAE;;AAG5E,IAAM,wBAAwB;;;;;;;AAQ9B,IAAa,qBAAqB,QAAgB,UAC9C,4BAA4B,WAAW,MAAM,EAAE,GAAG,WAAW,KAAK,EAAE,QAAQ,WAAW,kBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6B3G,eAAsB,0BAA0B,KAAkC;CAC9E,IAAI;EACA,MAAM,OAAO,MAAM,IAAI;;;;;SAKtB;EACD,IAAI,KAAK,EAAE,EAAE,aAAa,MAAM;EAChC,MAAM,OAAO,OAAO,KAAK,EAAE,EAAE,QAAQ,qBAAqB;EAC1D,OAAO,KACH,0BAA0B,KAAK,4IAC+C,KAAK,gMAED,KAAK,gNAI3F;CACJ,QAAQ,CAER;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,eAAsB,wBAClB,KACA,SAC0B;CA+B1B,MAAM,OAAM,MApBO,IAAI;;;;;;;;;;;;;;uBANF,SAAS,SACxB,qBAAqB,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAC9C,KAAK,MAAM,IAAI,EAAE,QAAQ,MAAM,IAAI,EAAE,EAAE,CAAC,CACxC,KAAK,IAAI,EAAE,KACd,GAgB0B;;;;;KAK/B,EAAA,CACgB,MAAM,CAAC;CACxB,MAAM,YAAY,IAAI,cAAc;CACpC,MAAM,YAAY,IAAI,cAAc;CACpC,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,kBAAkB,IAAI,eAAe;CAC3C,OAAO;EACH,MAAM,OAAO,IAAI,QAAQ,SAAS;EAClC;EACA;EACA;EACA;EACA,YAAY,aAAa,aAAa,cAAc;CACxD;AACJ;;;;;AAMA,SAAgB,yBAAyB,gBAAwB,SAA2B;CACxF,MAAM,SAAS,QAAQ,KAAK,MACxB,yBAAyB,WAAW,CAAC,EAAE,MAAM,mBAAiB,WACrD,sBAAsB,2BAA2B,WAAW,CAAC,EAAE,MAAM,mBAAiB,oDAC7C,WAAW,CAAC,EAAE,MAAM,mBAAiB,EAC3F,CAAC,CAAC,KAAK,IAAI;CACX,OACI,gGACwB,mBAAiB,8BACrC,eAAe,kIAEJ,mBAAiB,qDACvB,mBAAiB,MAAM,WAAW,cAAc,EAAE,OAC3D;AAER;;;;;;;;;;;;;;;;;AAkBA,eAAsB,cAAc,KAAmB,SAAkC;CACrF,MAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,QAAQ,OAAO,OAAO,CAAC,CAAC;CAIjE,KAAI,MADmB,IAAI,2CAA2C,mBAAiB,EAAE,EAAA,CAC5E,WAAW,GACpB,IAAI;EAMA,MAAM,IAAI;;;6EAGuD,mBAAiB;sCACxD,mBAAiB;;;;aAI1C;CACL,SAAS,KAAK;EACV,MAAM,IAAI,MACN,yBAAyB,mBAAiB,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,QACrG,yBAAyB,2BAA2B,aAAa,CACrE;CACJ;CAIJ,MAAM,aAAa,MAAM,IAAI;6CACY,mBAAiB;;;KAGzD;CACD,IAAI,WAAW,EAAE,EAAE,YAAY,MAC3B,IAAI;EACA,MAAM,IAAI,SAAS,mBAAiB,iBAAiB;CACzD,SAAS,KAAK;EACV,MAAM,IAAI,MACN,2CAA2C,mBAAiB,wCACzD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,QACpD,yBAAyB,OAAO,WAAW,EAAE,EAAE,QAAQ,yBAAyB,GAAG,aAAa,CACpG;CACJ;CAIJ,MAAM,oBAAoB,KAAK,aAAa;CAE5C,OAAO,MAAM,uBAAuB,mBAAiB,0BAA0B,cAAc,KAAK,IAAI,EAAE,EAAE;AAC9G;;AAGA,IAAM,cAAc,UAA0B,IAAI,MAAM,QAAQ,MAAM,IAAI,EAAE;AAC5E,IAAM,aAAa,WACf,OAAO,WAAW,IAAI,oBAAoB,SAAS,OAAO,IAAI,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE;;;;;;;;;;;;;;;;;;AAmBzF,eAAsB,0BAA0B,KAAmB,SAAsC;CAYrG,QAAO,MAXY,IAAI;;;gCAGK,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE;gCACxC,UAAU,sBAAsB,EAAE;;;qCAG7B,WAAW,kBAAgB,EAAE;6CACrB,WAAW,kBAAgB,EAAE;;KAErE,EAAA,CACW,KAAI,QAAO,OAAO,IAAI,IAAI,CAAC;AAC3C;;;;;;;;;;AAqCA,eAAe,iBAAiB,KAAmB,SAAuD;CACtG,MAAM,WAAW,UAAU,sBAAsB;CACjD,MAAM,SAAS,6CAA6C,WAAW,kBAAgB,EAAE;;CAEzF,MAAM,QAAQ,KAAa,YAAsB,YAC7C,4DAA4D,IAAI,wBAAwB,SACrF,UAAU,oBAAoB,YAAY,GAAG,4BAA4B,WAAW,IAAI,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE;CACtH,MAAM,MAAM;EAAC;EAAU;EAAU;EAAU;CAAQ;CACnD,MAAM,MAAM,CAAC,SAAS,QAAQ;CAC9B,MAAM,OAAO,MAAM,IAAI;;iBAEV,KAAK,YAAY,CAAC,OAAO,GAAG,YAAY,EAAE;;;;gDAIX,SAAS;2BAC9B,KAAK,YAAY,KAAK,YAAY,EAAE,KAAK,IAAI,OAAO;;;;;2BAKpD,KAAK,YAAY,KAAK,YAAY,EAAE,KAAK,IAAI,OAAO;;;;;;2BAMpD,KAAK,eAAe,GAAG,EAAE,KAAK,IAAI,OAAO;;;;;;2BAMzC,KAAK,eAAe,GAAG,EAAE,KAAK,IAAI,OAAO;;;;sEAIE,SAAS;+GACgC,OAAO;;;;gCAItF,UAAU,OAAO,EAAE;KAC9C;CACD,MAAM,yBAAS,IAAI,IAA0B;CAC7C,KAAK,MAAM,OAAO,MAAM;EACpB,MAAM,kBAAkB,IAAI;EAC5B,OAAO,IAAI,OAAO,IAAI,MAAM,GAAG;GAC3B,OAAO,IAAI,UAAU;GACrB,QAAQ,IAAI,WAAW;GACvB,WAAW,IAAI,cAAc;GAC7B,eAAe,IAAI,mBAAmB;GACtC,kBAAkB,IAAI,sBAAsB;GAC5C,iBAAiB,MAAM,QAAQ,eAAe,IACxC,gBAAgB,IAAI,MAAM,IAE1B,OAAO,mBAAmB,EAAE,CAAC,CAAC,QAAQ,YAAY,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EACzF,CAAC;CACL;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;AAqBA,eAAsB,oBAAoB,KAAmB,SAAkC;CAC3F,MAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,QAAQ,OAAO,OAAO,CAAC,CAAC;CACjE,MAAM,SAAS,MAAM,iBAAiB,KAAK,aAAa;CACxD,KAAK,MAAM,UAAU,eAAe;EAChC,MAAM,QAAQ,OAAO,IAAI,MAAM;EAE/B,IAAI,CAAC,OAAO;EACZ,MAAM,IAAI,WAAW,MAAM;EAC3B,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,yBAAyB,EAAE,MAAM,oBAAkB;EAC/E,IAAI,CAAC,MAAM,QAAQ,MAAM,IAAI,SAAS,sBAAsB,2BAA2B,EAAE,MAAM,oBAAkB;EACjH,IAAI,CAAC,MAAM,WAAW,MAAM,IAAI,kDAAkD,EAAE,MAAM,oBAAkB;EAG5G,IAAI,CAAC,MAAM,eACP,MAAM,IAAI,sCAAsC,EAAE,SAAS,sBAAsB,gBAAgB,oBAAkB;EAEvH,IAAI,CAAC,MAAM,kBACP,MAAM,IAAI,sCAAsC,EAAE,uCAAuC,oBAAkB;EAa/G,MAAM,SAAS,MAAM,SAAS,MAAM,kBAAkB,KAAA;EACtD,IAAI,UAAU,OAAO,WAAW,GAAG;EACnC,MAAM,0BAA0B,OAAO,SAAS;GAAE,MAAM,IAAI,IAAI;EAAG,GAAG,QAAQ;GAC1E;GACA,UAAU,OAAO,UAAU,OAAO,KAC9B,8BAA8B,mBAAiB,eAAe,OAAO,KAAK,MAAM,uDAE/E,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC1D;EACJ,CAAC;CACL;AACJ;;;;;;;AAQA,eAAsB,gCAAgC,KAAmB,QAAmC;CACxG,QAAQ,MAAM,iBAAiB,KAAK,CAAC,MAAM,CAAC,EAAA,CAAG,IAAI,MAAM,CAAC,EAAE,mBAAmB,CAAC;AACpF;;;;;;;;;;;;;;;;;;;;;;;AAwBA,eAAsB,iBAAiB,IAAW,MAAmB,UAAkC;CACnG,MAAM,MAAM,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,MAAM,KAAK,KAAK,MAAM;CAChF,MAAM,kBAAkB,KAAK,MAAM,KAAK,MACpC,OAAO,MAAM,WAAW,IAAK,GAA+B,MAAM,OAAO,CAAC,CAC9E;CASA,MAAM,cAAc,KAAK,gBAAgB,OAAO,SAAS;CAEzD,MAAM,GAAG,QAAQ,GAAU;;oCAEK,IAAI;wCACA,IAAI;2CACD,gBAAgB,KAAK,GAAG,EAAE;6CACxB,YAAY;oCACrB,KAAK,UAAU;EAO3C,GAAI,KAAK,UAAU,CAAC;EACpB,KAAK;EACL,OAAO,KAAK;EAKZ,cAAc,KAAK,gBAAgB;CACvC,CAAC,EAAE,SAAS,WAWN,GAAU;iCACa,SAAS,WAChC,GAAU,GAAG;KAClB;AACL;;AAGA,IAAM,2BAAmD;CACrD,eAAe;CACf,MAAM;CACN,cAAc;AAClB;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,sBACZ,aACI;CAIJ,MAAM,yBAAS,IAAI,IAA2D;CAE9E,KAAK,MAAM,cAAc,aACrB,KAAK,MAAM,QAAQ,WAAW,iBAAiB,CAAC,GAAG;EAC/C,MAAM,EAAE,WAAW,kBAAkB,yBAAyB,IAAI;EAClE,MAAM,QAAQ,CAAC,WAAW,aAAa,CAAC,CACnC,QAAQ,MAA6B,MAAM,IAAI,CAAC,CAChD,QAAQ,mBAAmB;EAEhC,KAAK,MAAM,QAAQ,OAAO;GACtB,MAAM,MAAM,GAAG,KAAK,QAAQ,GAAG,KAAK;GACpC,MAAM,OAAO,GAAG,WAAW,QAAQ,YAAY,MAAM,KAAK,QAAQ,iBAAiB;GACnF,MAAM,QAAQ,OAAO,IAAI,GAAG,KAAK;IAAE;IAAM,OAAO,CAAC;GAAE;GACnD,IAAI,CAAC,MAAM,MAAM,SAAS,IAAI,GAAG,MAAM,MAAM,KAAK,IAAI;GACtD,OAAO,IAAI,KAAK,KAAK;EACzB;CACJ;CAGJ,IAAI,OAAO,SAAS,GAAG;CAEvB,MAAM,WAAW,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,YAC/C,OAAO,KAAK,YAAY,QAAQ,MAAM,OAAO,YAAY,MAAM,KAAK,IAAI,GAC5E;CAEA,OAAO,KACH,iIAC8B,kBAAkB,4EAEhD,SAAS,KAAK,MAAM,IAAI,IAC5B;AACJ;;;;;;;;;;;;;AAcA,SAAgB,yBACZ,aACI;CACJ,MAAM,QAAkB,CAAC;CAEzB,KAAK,MAAM,cAAc,aACrB,KAAK,MAAM,QAAQ,WAAW,iBAAiB,CAAC,GAAG;EAC/C,MAAM,EAAE,WAAW,kBAAkB,yBAAyB,IAAI;EAIlE,IAAI,CAHkB,CAAC,WAAW,aAAa,CAAC,CAC3C,QAAQ,MAA6B,MAAM,IAAI,CAAC,CAChD,KAAK,qBACL,GAAe;EAEpB,MAAM,OAAO,GAAG,WAAW,QAAQ,YAAY,MAAM,KAAK,QAAQ,iBAAiB;EACnF,IAAI,CAAC,MAAM,SAAS,IAAI,GAAG,MAAM,KAAK,IAAI;CAC9C;CAGJ,IAAI,MAAM,WAAW,GAAG;CAExB,OAAO,KACH,wRAE8E,cAAc,gKAG5F,MAAM,KAAI,MAAK,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,IAC5C;AACJ;;AAGA,SAAS,sBAAsB,MAAiC;CAC5D,QAAQ,KAAK,MAAb;EACI,KAAK,OACD,OAAO,uBAAuB,KAAK,GAAG;EAC1C,KAAK;EACL,KAAK,MACD,OAAO,KAAK,SAAS,KAAK,qBAAqB;EACnD,KAAK,OACD,OAAO,sBAAsB,KAAK,OAAO;EAC7C,KAAK,YACD,OAAO,sBAAsB,KAAK,KAAK;EAC3C,SACI,OAAO;CACf;AACJ;;;;;;;;;;;;;AAcA,eAAsB,sBAClB,KACA,aAGA,cAAsB,oBACT;CACb,MAAM,yBAAS,IAAI,IAAsB;CACzC,KAAK,MAAM,cAAc,aACrB,KAAK,MAAM,QAAQ,WAAW,iBAAiB,CAAC,GAC5C,KAAK,MAAM,QAAQ,KAAK,WAAW,CAAC,GAAG;EACnC,IAAI,SAAS,UAAU;EACvB,OAAO,IAAI,MAAM,CAAC,GAAI,OAAO,IAAI,IAAI,KAAK,CAAC,GAAI,WAAW,QAAQ,WAAW,CAAC;CAClF;CAGR,IAAI,OAAO,SAAS,GAAG;CAEvB,MAAM,QAAQ,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,EAAE,QAAQ,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG;CAElF,MAAM,OAAO,MAAM,IAAI;;kDADI,YAAY,QAAQ,MAAM,IAGP,EAAmB;;8BAEvC,MAAM;KAC/B;CAED,MAAM,YAAY,IAAI,IAAI,KAAK,KAAK,QAAQ,CAAC,OAAO,IAAI,IAAI,GAAG,IAAI,cAAc,IAAI,CAAC,CAAC;CACvF,MAAM,WAAqB,CAAC;CAE5B,KAAK,MAAM,CAAC,MAAM,UAAU,QAAQ;EAChC,IAAI,UAAU,IAAI,IAAI,MAAM,MAAM;EAElC,MAAM,MAAM,UAAU,IAAI,IAAI,IACxB,IAAI,YAAY,2BAChB;EACN,MAAM,WAAW,yBAAyB;EAC1C,MAAM,OAAO,WACP,IAAI,KAAK,SAAS,SAAS,6EAA6E,SAAS,iBAAiB,UAAU,KAAK,gEACjJ,0BAA0B,KAAK,MAAM,YAAY;EAEvD,SAAS,KACL,kBAAkB,KAAK,QAAQ,MAAM,KAAK,IAAI,EAAE,KAAK,IAAI,SAAS,MACtE;CACJ;CAEA,IAAI,SAAS,SAAS,GAClB,MAAM,IAAI,MACN,mFACI,YAAY,wIAEhB,SAAS,KAAK,MAAM,IAAI,IAC5B;AAER"}

package/dist/schema/destructive-sql.d.ts

@@ -131,6 +131,22 @@ export declare function destructiveOptInFlag(args: {
     "--allow-destructive"?: boolean;
     "--yes"?: boolean;
 }): "--allow-destructive" | "--yes" | undefined;
+/**
+ * What a destructive push approved by `--yes` says, once per process.
+ *
+ * `--yes` is an alias of `--allow-destructive` on `db push`, and nothing else
+ * spells it that way: on `rebase init` it means "take the defaults", and an
+ * agent passes it by reflex to get past prompts — so one habitual flag
+ * dropped a column ("Proceeding because --yes was passed" → DROP COLUMN). It
+ * keeps working for one release, as the deprecate-before-removing rule asks,
+ * and says what changes next.
+ */
+export declare const YES_APPROVES_DESTRUCTIVE_DEPRECATION: string;
+/**
+ * Warn — once per process, through `warnDeprecated` — when it was `--yes`, not
+ * `--allow-destructive`, that let destructive statements through.
+ */
+export declare function warnIfYesApprovedDestructive(optIn: "--allow-destructive" | "--yes" | undefined, destructiveCount: number): void;
 /**
  * Decide how `db push` should proceed given the plan's destructiveness and
  * the invocation context.

package/dist/schema/doctor-cli.js

@@ -2,11 +2,11 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { a as buildSearchColumnSpec } from "../search-column-BM-GV6vH.js";
-import { a as diagnoseDbError } from "../cli-errors-DiA0XFIS.js";
-import { l as validatePolicyPgRoles, u as warnOnAnonymousGrants } from "../rls-enforcement-DDyNoOSy.js";
+import { a as diagnoseDbError } from "../cli-errors-DsYyNYzd.js";
+import { d as warnOnAnonymousGrants, u as validatePolicyPgRoles } from "../rls-enforcement-BOHuHVlc.js";
 import { n as describeFailure, t as chalk } from "../source-fZb92pN8.js";
-import { n as loadCollections, r as runDoctor } from "../doctor-BT--1kq3.js";
 import { n as formatPolicyDrift, r as hasDrift, t as checkPolicyDrift } from "../policy-drift-X4A-xAzv.js";
+import { n as loadCollections, r as runDoctor } from "../doctor-DW_mlTzz.js";
 import { isPostgresCollectionConfig } from "@rebasepro/types";
 import { getTableName, relationalCollections } from "@rebasepro/common";
 import path from "path";

package/dist/schema/introspect-db.js

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { n as require_arg, o as __toESM, t as promptConfirm } from "../cli-prompt-DXG0yk-h.js";
 import { c as pinSearchPath } from "../connection-czvI7TZL.js";
-import { a as diagnoseDbError } from "../cli-errors-DiA0XFIS.js";
+import { a as diagnoseDbError } from "../cli-errors-DsYyNYzd.js";
 import { a as outWarn, i as outError, r as out, t as chalk } from "../source-fZb92pN8.js";
 import { i as readSchemaMetadata, n as isUsableFileName, r as quoteRelation, t as countRowsUpTo } from "../introspect-db-queries-DevUrzll.js";
 import { a as compositeKeySkipReason, c as generateIndexContent, d as mergeIndexContent, f as safeHostFromUrl, h as lookupCandidates, i as buildTablesMap, m as classifyTables, o as describeRlsOffTables, r as buildEnumMap, s as generateCollectionFile } from "../introspect-db-logic-DgQVzccW.js";

package/dist/schema/migration-freshness.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Do the migration files still describe the collections?
+ *
+ * `rebase db generate` asks Atlas, which needs a dev database to replay the
+ * migrations into — seconds of Docker, or the managed PGlite, before it can say
+ * a word. `rebase verify` runs after every edit an agent makes to a collection
+ * file and in CI, where neither is acceptable, so this answers the narrower
+ * question offline: replay the `CREATE TABLE` / `ALTER TABLE` / `DROP TABLE`
+ * statements the migrations contain, and compare the tables and columns that
+ * leaves with the ones the schema plan derives from the collections.
+ *
+ * Deliberately tables and columns only. A changed type or default is a real
+ * drift too, but reading it back out of Atlas's SQL means parsing every type
+ * spelling Postgres accepts, and a check that misreads `character varying(255)`
+ * as a change cries wolf on every run. A missing table or column is the drift
+ * that breaks a deploy — the runtime queries a column the migrated database
+ * does not have — and it is unambiguous in the text.
+ *
+ * Policies are not compared: the runtime applies a collection's policies at
+ * boot whether or not a migration carries them.
+ */
+import type { CollectionConfig } from "@rebasepro/types";
+/** One difference between the collections and what the migrations build. */
+export interface UnmigratedChange {
+    /**
+     * - `missing-table` / `missing-column` — the collections declare it and no
+     *   migration creates it.
+     * - `removed-column` — a migration creates it, the collection no longer
+     *   declares it, and no later migration drops it.
+     */
+    kind: "missing-table" | "missing-column" | "removed-column";
+    /** `schema.table`. */
+    table: string;
+    column?: string;
+    /** The collection that declares the table, when one does (a junction has none). */
+    slug?: string;
+}
+/** A table as the migrations leave it. */
+interface MigratedTable {
+    /** Every column, however it was added. */
+    columns: Set<string>;
+    /**
+     * The columns Atlas wrote: from a `CREATE TABLE` or an `ADD COLUMN` without
+     * `IF NOT EXISTS`. The search, vector and trigger DDL `db generate` appends
+     * after Atlas's half always says `IF NOT EXISTS`, and the planner keeps
+     * those columns out of `TablePlan.columns` — so only these are candidates
+     * for "removed from the collection".
+     */
+    managed: Set<string>;
+}
+/**
+ * The tables and columns the migrations leave behind, replayed in order.
+ *
+ * Exported for its tests.
+ */
+export declare function replayMigrationTables(migrations: readonly string[]): Map<string, MigratedTable>;
+/**
+ * What the collections declare that the migrations do not build, and what the
+ * migrations still build that the collections dropped.
+ *
+ * `migrations` are the contents of every `.sql` file in the migrations
+ * directory, in file-name order — Atlas's order. An empty list is a project
+ * with no migrations at all, for which everything is missing; whether that is a
+ * problem (a project on `db push` has none by design) is the caller's call.
+ *
+ * Throws what {@link planSchema} throws for a configuration it cannot plan.
+ */
+export declare function findUnmigratedSchema(collections: CollectionConfig[], migrations: readonly string[]): UnmigratedChange[];
+export {};

package/dist/schema/push-kept-defaults.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The DEFAULTs `db push` keeps because a property says the database owns them.
+ *
+ * `databaseDefault: true` declares a DEFAULT somebody else wrote: a DBA's
+ * `now()`, a migration's `'X-' || gen_random_uuid()`. The planner writes no
+ * DEFAULT for it, since it has no expression to write, so `schema.sql` holds
+ * the column without one. Atlas reads that file as the whole desired state and
+ * planned `ALTER COLUMN … DROP DEFAULT`. The API kept letting creates through
+ * without the field, and the database then refused them on NOT NULL.
+ *
+ * Atlas has no way to leave one column's DEFAULT alone: `--exclude` names
+ * objects, and a DEFAULT is not one. So the desired state is made to agree with
+ * the database instead. Before Atlas plans, the live DEFAULT of each such
+ * column is read and appended to `schema.sql` as `ALTER TABLE … SET DEFAULT`,
+ * and Atlas finds nothing to change.
+ *
+ * Two kinds are left out, because Atlas already does something else with them:
+ *
+ * - a DEFAULT reading a sequence (`nextval(…)`). Atlas does not manage
+ *   sequences and leaves those DEFAULTs alone, and the sequence does not exist
+ *   in the scratch database Atlas loads `schema.sql` into.
+ * - a DEFAULT calling a function or operator the database defines (an
+ *   extension's `uuid_generate_v4()`, a project's own function). The scratch
+ *   database has none of them, and Atlas refuses such a column whether or not
+ *   it is in `schema.sql`; adding it would only change the error.
+ */
+import { type CollectionConfig } from "@rebasepro/types";
+import type { Queryable } from "./ensure-collection-tables.js";
+/** A column whose DEFAULT the collections leave to the database. */
+export interface DatabaseOwnedDefaultColumn {
+    schema: string;
+    table: string;
+    column: string;
+}
+/** A DEFAULT the database holds for one of those columns, as SQL. */
+export interface KeptDefault extends DatabaseOwnedDefaultColumn {
+    expression: string;
+}
+/**
+ * Every column declared `databaseDefault: true` that the planner writes no
+ * DEFAULT for. An id strategy or `autoValue` writes one of its own, and that
+ * one is the planner's to keep.
+ */
+export declare function databaseOwnedDefaultColumns(collections: CollectionConfig[]): DatabaseOwnedDefaultColumn[];
+/**
+ * The live DEFAULTs of `columns` that the desired state must carry so Atlas
+ * plans no `DROP DEFAULT`. A column with no DEFAULT, or one Atlas cannot carry,
+ * is not listed.
+ *
+ * Read in a transaction of its own, so the search path it narrows goes back
+ * when it ends.
+ */
+export declare function readKeptDefaults(client: Queryable, columns: DatabaseOwnedDefaultColumn[]): Promise<KeptDefault[]>;
+/** What is appended to `schema.sql`: one `SET DEFAULT` per kept DEFAULT. */
+export declare function keptDefaultStatements(kept: KeptDefault[]): string[];
+/** `schema.sql` with the kept DEFAULTs appended, under a comment saying why. */
+export declare function withKeptDefaults(desiredSql: string, kept: KeptDefault[]): string;

package/dist/schema/rls-bootstrap-sql.d.ts

@@ -70,11 +70,12 @@ export declare const RLS_BOOTSTRAP_SQL: string;
  * Two independent guards, and both have to pass:
  *
  *  1. **Each function is identified before it is dropped.** Ours returns `text`
- *     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads
- *     `request.jwt.claims`. Nothing is dropped on a signature we did not write,
- *     so a Supabase database — where our `CREATE OR REPLACE` could never have
- *     succeeded in the first place, Postgres refusing to change a return type —
- *     matches nothing and this is a no-op.
+ *     and reads the `app.uid` or `app.user_id` GUC; Supabase's returns `uuid`
+ *     and reads `request.jwt.claims`. Nothing is dropped on a signature we did
+ *     not write, so a Supabase database — where our `CREATE OR REPLACE` could
+ *     never have succeeded in the first place, Postgres refusing to change a
+ *     return type — matches nothing and this is a no-op. See
+ *     {@link LEGACY_AUTH_HELPERS} for exactly what is matched.
  *  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still
  *     lives in `auth` (Supabase's `users` table, its other helpers), the drop
  *     fails and the schema stays. CASCADE here would be unrecoverable.
@@ -88,7 +89,31 @@ export declare const RLS_BOOTSTRAP_SQL: string;
  * Callers therefore run this *after* applying policies, and treat a failure as
  * "not yet — try again next boot" rather than as an error.
  */
-export declare const DROP_LEGACY_AUTH_SCHEMA_SQL = "\nDO $rebase_drop_legacy$\nDECLARE\n    dropped_any boolean := false;\nBEGIN\n    -- Each function is matched on its own result type and body, so a schema\n    -- that merely shares the name keeps everything it has.\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'uid'\n          AND pg_get_function_result(p.oid) = 'text'\n          AND p.prosrc LIKE '%app.uid%'\n    ) THEN\n        DROP FUNCTION auth.uid();\n        dropped_any := true;\n    END IF;\n\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'jwt'\n          AND pg_get_function_result(p.oid) = 'jsonb'\n          AND p.prosrc LIKE '%app.jwt%'\n    ) THEN\n        DROP FUNCTION auth.jwt();\n        dropped_any := true;\n    END IF;\n\n    IF EXISTS (\n        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n        WHERE n.nspname = 'auth' AND p.proname = 'roles'\n          AND pg_get_function_result(p.oid) = 'text'\n          AND p.prosrc LIKE '%app.user_roles%'\n    ) THEN\n        DROP FUNCTION auth.roles();\n        dropped_any := true;\n    END IF;\n\n    -- RESTRICT: only an empty schema goes. Anything else in there \u2014 including a\n    -- Supabase installation left untouched above \u2014 keeps it.\n    IF dropped_any THEN\n        BEGIN\n            EXECUTE 'DROP SCHEMA auth RESTRICT';\n        EXCEPTION WHEN OTHERS THEN\n            NULL;\n        END;\n    END IF;\nEND\n$rebase_drop_legacy$;\n";
+export declare const DROP_LEGACY_AUTH_SCHEMA_SQL: string;
+/** One object in the `auth` schema that `DROP SCHEMA … RESTRICT` refuses on. */
+export interface LegacyAuthSchemaObject {
+    /**
+     * As Postgres names it: `function auth.uid()`, `table auth.sessions`.
+     * `null` on the one row an empty schema answers with.
+     */
+    object: string | null;
+    /**
+     * `ours` is a helper Rebase wrote, which the drop removes. `lookalike` has a
+     * helper's name and result type but a body no release wrote, so the drop
+     * leaves it alone. `null` for everything else.
+     */
+    helper: "ours" | "lookalike" | null;
+}
+/**
+ * What the `auth` schema holds, one row per object keeping it alive.
+ *
+ * No rows: the schema does not exist. A single row with a `null` object: it
+ * exists and is empty. Read from the namespace entries in `pg_depend`, which
+ * are what `DROP SCHEMA … RESTRICT` itself consults — minus whatever goes with
+ * its owner (a serial's sequence, an identity column's), which Postgres does not
+ * name either.
+ */
+export declare const LEGACY_AUTH_SCHEMA_CONTENTS_SQL: string;
 /** Somebody's policy that still calls a pre-1.0 helper. */
 export interface LegacyRlsDependent {
     schema: string;
@@ -123,11 +148,12 @@ export interface LegacyRlsFunctionDependent {
  * exists, which fails at *query* time rather than at boot.
  *
  * A downstream project building on these helpers is not hypothetical: the Rebase
- * control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`
+ * control plane defined `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`
  * in this very schema, each calling `auth.uid()` in a string body, and eleven of
- * its row-level-security policies go through them. Every one of those would have
- * started failing the first time a recompile left no policy referencing
- * `auth.uid()` directly — the drop's own precondition.
+ * its row-level-security policies went through them. Every one of those would
+ * have started failing the first time a recompile left no policy referencing
+ * `auth.uid()` directly — the drop's own precondition. (Its migration 0065 has
+ * since moved both to `public`, calling `rebase.uid()`.)
  *
  * Matching on the body text is the only option available, and it is deliberately
  * broad: a false positive costs a schema that stays one release longer and says
@@ -143,6 +169,17 @@ export declare const LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = "\n    SELECT n.nspnam
  * table not recompiled *yet* — and wrong for the one that never resolves: a
  * hand-written policy nothing will ever rewrite. Then the schema stays forever
  * and nothing ever says why.
+ *
+ * The drop itself had the same blind spot. A helper it did not recognise as
+ * Rebase's stayed, and so did anything else in the schema, behind a
+ * `DROP SCHEMA … RESTRICT` whose failure is swallowed so the helpers it did
+ * drop stay dropped. The control plane's `auth.uid()` was one such: it read
+ * `app.user_id` alone, the drop looked for `app.uid`, and the schema stayed
+ * with no word said. So the schema is read twice. Before, so that one with no
+ * Rebase helper in it is left alone: one already gone, as on every boot after
+ * the drop, or one that was never Rebase's, like Supabase's — whose own
+ * policies the checks below would otherwise report as blockers. After, to name
+ * whatever is still there.
  */
 export declare function dropLegacyAuthSchema(run: (sql: string) => Promise<Record<string, unknown>[]>, report: {
     info: (m: string) => void;

package/dist/security/rls-enforcement.d.ts

@@ -204,6 +204,24 @@ export declare function appRoleSetupInstructions(connectionRole: string, schemas
  * connection cannot create it.
  */
 export declare function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promise<void>;
+/**
+ * The framework's internal tables in `schemas` that the request role can
+ * reach — `schema.table`, sorted — when nothing is left to take it back off.
+ *
+ * Every provisioning boot repairs this: each store revokes on its own table
+ * and {@link ensureAppRole}'s sweep revokes on the rest, because the grant
+ * tier hands the request role DML on whole schemas. A backend that changes
+ * nothing in its database runs neither, so a database whose `rebase_user` can
+ * read `refresh_tokens` or `api_keys` would stay that way for as long as it
+ * served. This is the question the sweep would have answered, asked instead.
+ *
+ * "Can reach" is what the role can actually do — through a grant to it, to a
+ * role it inherits, or to PUBLIC, on the table or on any of its columns —
+ * because that, not how the ACL is spelled, is what a request running as it
+ * gets. A table with RLS on is somebody's collection by that same rule as the
+ * sweep's, and is left out.
+ */
+export declare function findExposedInternalTables(run: RawSqlRunner, schemas: string[]): Promise<string[]>;
 /**
  * The grant tier of {@link ensureAppRole} on its own: `USAGE` on each existing
  * schema in `schemas`, DML on its tables and `USAGE, SELECT` on its

package/dist/services/FetchService.d.ts

@@ -461,6 +461,18 @@ export declare class FetchService {
      * Process raw database results into flat rows with relations.
      */
     private processRowResults;
+    /**
+     * Every row of a collection's table, as stored, a page at a time, in key
+     * order — the driver's `scanStoredRows`.
+     *
+     * Deliberately none of the read pipeline: no `beforeQuery` (a sweep has no
+     * caller to scope to, and the documented hook narrows a caller-less read to
+     * the rows owned by nobody), no soft-delete filter, no `afterRead`, no
+     * field stripping. The columns come back under their table names; a sweep
+     * reads values, not keys. Paged by the key rather than an offset, so a row
+     * deleted during the scan never shifts another past the next page.
+     */
+    scanStoredRows(collectionPath: string, pageSize?: number): AsyncGenerator<Record<string, unknown>[]>;
     /**
      * Fetch a collection of rows
      */

package/dist/services/channel-presence.d.ts

@@ -53,7 +53,9 @@ export declare class ChannelPresenceStore {
      * `tablesReady` is now set from a probe of what exists, not from having been
      * the instance that created it.
      */
-    ensureTables(): Promise<void>;
+    ensureTables(options?: {
+        provision?: boolean;
+    }): Promise<boolean>;
     /** Record (or refresh) a client's presence. */
     track(channel: string, clientId: string, state: Record<string, unknown>): Promise<void>;
     /** Drop one client's presence in one channel. */

package/dist/services/nested-path.d.ts

@@ -46,6 +46,22 @@ export declare function resolveNestedPath(path: string, registry: PostgresCollec
  * such a path addresses the *link*, not the row.
  */
 export declare function isJunctionBackedRelation(relation: ResolvedRelation): boolean;
+/**
+ * Reject a create or update whose body names a relation Rebase does not write
+ * — a multi-hop `via` (`writable: false`) — before anything is read or written.
+ *
+ * A single-hop `via` is written through this door as it shipped (to-one: the
+ * target's key; to-many: one junction's rows). A longer chain used to get as
+ * far as the writer: a to-many one failed inside the transaction as a 500
+ * RELATION_MISCONFIGURED telling the caller to regenerate a schema that was
+ * fine, and a to-one one re-pointed the target at the first step's column.
+ *
+ * Matched the way the write path matches: a key that is a relation's own name
+ * (the to-many split), or a `relation` property that resolves to one (the
+ * to-one transformer). An `undefined` value is no value — the transformer skips
+ * it — so it is not a write; `null` is, since it would unlink.
+ */
+export declare function assertNoReadOnlyRelationValues(values: Record<string, unknown>, collection: CollectionConfig): void;
 /**
  * Reject a nested write whose final segment is a to-one relation.
  *

package/dist/services/realtimeService.d.ts

@@ -367,6 +367,14 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
     private refetchQueue;
     /** Group refetches running now — at most {@link maxConcurrentRefetches}. */
     private refetchesRunning;
+    /**
+     * What a group refetch runs inside — see {@link setScopeRunner}. A refetch
+     * runs on a timer armed by whatever announced the change; one armed by a
+     * change-capture notification inherits the LISTEN connection's context,
+     * which is no backend's, so a hook the read reached saw the process
+     * default as `rebase`.
+     */
+    private runInScope;
     /** See {@link refetchConcurrencyFor}. */
     maxConcurrentRefetches: number;
     /**
@@ -758,6 +766,11 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
      * transaction of its own — see {@link collectionMeta}.
      */
     private fetchCollectionWithAuth;
+    /**
+     * Refetch `group` — and so count it again — at `at`, when the total its
+     * last frame reused expires. One pending at a time per group.
+     */
+    private scheduleRecount;
     /**
      * The `meta` a `collection_update` frame carries beside its rows, counted
      * through `service` — the subscriber's own transaction, read only, with
@@ -988,7 +1001,9 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
      * what it was before this existed, whereas refusing to boot takes the whole
      * backend down for it.
      */
-    configureChannelBus(bus: ChannelBus): Promise<void>;
+    configureChannelBus(bus: ChannelBus, options?: {
+        provision?: boolean;
+    }): Promise<void>;
     /** Which transport is in use — `"memory"` means per-instance only. */
     getChannelBusKind(): ChannelBus["kind"];
     /**
@@ -1116,6 +1131,8 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
      * down and being replaced.
      */
     isCdcActive(): boolean;
+    /** See `RealtimeProvider.setScopeRunner`. */
+    setScopeRunner(run: <T>(fn: () => T) => T): void;
     /** The LISTEN connections this service depends on — see `RealtimeProvider.health`. */
     health(): RealtimeListenerHealth[];
     /**