@supatype/cli 0.1.5 → 0.1.7

package/dist/config.js

@@ -3,6 +3,7 @@ import { resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { evalTsSnippet } from "./tsx-runner.js";
+import { readEnvFile } from "./env-file.js";
 import { mergeProjectConfig, validateProjectConfig, } from "./project-config.js";
 import { extractSchemaAstFromTypes } from "./type-extractor.js";
 /** Identity helper — provides type inference for config files. */
@@ -58,7 +59,21 @@ export function loadConfig(cwd = process.cwd()) {
     if (localRaw === null)
         return base;
     const localNorm = normalizeProjectJson(localRaw);
-    return mergeProjectConfig(base, localNorm);
+    // Re-validated after merging: the local override can reintroduce a combination the base file was
+    // rejected for — `database.provider` beside an inherited `database.external`, say — and merging
+    // has no opinion about that.
+    return validateProjectConfig(mergeProjectConfig(base, localNorm), "supatype.local.config.ts (merged with supatype.config.ts)");
+}
+/**
+ * Environment for the child process that imports the config module.
+ *
+ * `supatype.config.ts` is TypeScript, so the natural way to keep a database password out of version
+ * control is `process.env.DATABASE_URL` — which only works if the project's `.env` is visible to the
+ * process doing the import. A real environment variable still wins over the file, matching how every
+ * other dotenv reader behaves and how Compose itself resolves the same names.
+ */
+function configLoadEnv(cwd) {
+    return { ...readEnvFile(cwd), ...process.env };
 }
 function loadFirstTsConfig(cwd, candidates) {
     for (const candidate of candidates) {
@@ -71,7 +86,7 @@ const mod = await import(${JSON.stringify(urlPath)})
 const config = mod.default ?? mod
 process.stdout.write(JSON.stringify(config))
 `;
-        const result = evalTsSnippet(snippet, { cwd });
+        const result = evalTsSnippet(snippet, { cwd, env: configLoadEnv(cwd) });
         if (result.exitCode === 0) {
             return JSON.parse(result.stdout);
         }
@@ -115,7 +130,7 @@ const mod = await import(${JSON.stringify(urlPath)})
 const config = mod.default ?? mod
 process.stdout.write(JSON.stringify(config))
 `;
-        const result = evalTsSnippet(snippet, { cwd });
+        const result = evalTsSnippet(snippet, { cwd, env: configLoadEnv(cwd) });
         if (result.exitCode !== 0)
             return null;
         return JSON.parse(result.stdout);

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AA+D/D,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,MAA6B;IACxD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,WAAW,GAAG,sBAAsB,CAAA;AAE1C,MAAM,sBAAsB,GAAG;IAC7B,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;CACtB,CAAA;AAED,MAAM,uBAAuB,GAAG;IAC9B,0BAA0B;IAC1B,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAA;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAA;IACvD,MAAM,CAAC,GAAG,EAAE,GAAI,GAA+B,EAAE,CAAA;IACjD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,QAAQ,CAAC,GAAG;YACZ,IAAI,EAAE,GAAG;YACT,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ;SAC1E,CAAA;QACD,OAAO,CAAC,CAAC,WAAW,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACpD,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,SAAS,WAAW,mCAAmC;YACrD,2GAA2G;YAC3G,2DAA2D,CAC9D,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC9D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,oBAAoB,CACvB,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IAElE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;IAChE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAElC,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAmC,CAAA;IAClF,OAAO,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAW,EACX,UAAoB;IAEpB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC1C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAQ;QAErC,MAAM,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG;2BACO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;;;CAGjD,CAAA;QACG,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAA4B,CAAA;QAC7D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAA;QAC9C,IAAI,CAAC,iCAAiC,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,MAAM,OAAO,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,QAAQ,GAAG,4BAA4B,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAC9D,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAA;QACtC,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,MAAM,OAAO,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+FAA+F;AAC/F,SAAS,iCAAiC,CAAC,OAAe;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAAE,OAAO,IAAI,CAAA;IAClE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAA;IACpD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QACtD,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAC1D,CAAA;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,UAAkB,EAClB,GAAW;IAEX,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,QAAQ;SACrB,OAAO,CAAC,oEAAoE,EAAE,EAAE,CAAC;SACjF,OAAO,CAAC,8EAA8E,EAAE,EAAE,CAAC,CAAA;IAE9F,0EAA0E;IAC1E,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAErC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC5E,MAAM,OAAO,GAAG,4CAA4C,OAAO,EAAE,CAAA;IACrE,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG;2BACO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;;;CAGjD,CAAA;QACG,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAA4B,CAAA;IAC7D,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,UAAU,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAC5D,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAExC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IACxC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oDAAoD;QAClD,6CAA6C,OAAO,IAAI;QACxD,+FAA+F,CAClG,CAAA;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AA+D/D,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,MAA6B;IACxD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,WAAW,GAAG,sBAAsB,CAAA;AAE1C,MAAM,sBAAsB,GAAG;IAC7B,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;CACtB,CAAA;AAED,MAAM,uBAAuB,GAAG;IAC9B,0BAA0B;IAC1B,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAA;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAA;IACvD,MAAM,CAAC,GAAG,EAAE,GAAI,GAA+B,EAAE,CAAA;IACjD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,QAAQ,CAAC,GAAG;YACZ,IAAI,EAAE,GAAG;YACT,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ;SAC1E,CAAA;QACD,OAAO,CAAC,CAAC,WAAW,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACpD,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,SAAS,WAAW,mCAAmC;YACrD,2GAA2G;YAC3G,2DAA2D,CAC9D,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC9D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,oBAAoB,CACvB,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IAElE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;IAChE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAElC,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAmC,CAAA;IAClF,iGAAiG;IACjG,gGAAgG;IAChG,6BAA6B;IAC7B,OAAO,qBAAqB,CAC1B,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,EACnC,2DAA2D,CAC5D,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;AAChD,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAW,EACX,UAAoB;IAEpB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC1C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAQ;QAErC,MAAM,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG;2BACO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;;;CAGjD,CAAA;QACG,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACvE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAA4B,CAAA;QAC7D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAA;QAC9C,IAAI,CAAC,iCAAiC,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,MAAM,OAAO,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,QAAQ,GAAG,4BAA4B,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAC9D,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAA;QACtC,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,MAAM,OAAO,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+FAA+F;AAC/F,SAAS,iCAAiC,CAAC,OAAe;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAAE,OAAO,IAAI,CAAA;IAClE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAA;IACpD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QACtD,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAC1D,CAAA;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,UAAkB,EAClB,GAAW;IAEX,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,QAAQ;SACrB,OAAO,CAAC,oEAAoE,EAAE,EAAE,CAAC;SACjF,OAAO,CAAC,8EAA8E,EAAE,EAAE,CAAC,CAAA;IAE9F,0EAA0E;IAC1E,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAErC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC5E,MAAM,OAAO,GAAG,4CAA4C,OAAO,EAAE,CAAA;IACrE,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG;2BACO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;;;CAGjD,CAAA;QACG,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACvE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAA4B,CAAA;IAC7D,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,UAAU,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAC5D,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAExC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IACxC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oDAAoD;QAClD,6CAA6C,OAAO,IAAI;QACxD,+FAA+F,CAClG,CAAA;AACH,CAAC"}

package/dist/db-preflight.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Does this database meet what Supatype needs of it?
+ *
+ * Written for the bring-your-own-Postgres case: an external database will not look like
+ * `supatype/postgres`, and the failures it produces are mostly indirect. The four API roles are
+ * the sharpest example — every `GRANT` the engine emits is guarded with
+ * `IF EXISTS (SELECT 1 FROM pg_roles …)`, so a missing role is skipped in silence and the symptom
+ * is an API that cannot switch roles at all, days later.
+ *
+ * So each check states the requirement, what depends on it, and the SQL that fixes it. One module
+ * holds both the probe and the remedy on purpose: `--emit` and `--fix` cannot then disagree with
+ * what `check` reported.
+ *
+ * **Severity is about consequence, not tidiness.** `Fail` means the stack will not work. `Degrade`
+ * means a named feature is unavailable and everything else is fine. `Warn` means the operator
+ * should know something, and nothing is wrong.
+ */
+import pg from "pg";
+export type Severity = "pass" | "warn" | "degrade" | "fail";
+export interface CheckResult {
+    id: string;
+    title: string;
+    severity: Severity;
+    /** What was found, in the operator's terms. */
+    detail: string;
+    /** What stops working, named. Omitted when nothing does. */
+    impact?: string;
+    /** SQL that resolves it, if SQL can. */
+    remedy?: string;
+    /**
+     * True when the remedy cannot run inside a transaction — server settings, chiefly. `--fix`
+     * refuses these and reports them rather than half-applying.
+     */
+    remedyNeedsOperator?: boolean;
+}
+export interface PreflightReport {
+    results: CheckResult[];
+    /** Highest severity seen, so a caller can pick an exit code without re-deriving it. */
+    worst: Severity;
+}
+/**
+ * Stands in for the `authenticator` password when the operator has not supplied one.
+ *
+ * Fine to print for a human to replace; never acceptable to execute. `--fix` refuses when a remedy
+ * still contains it, because the decision was that this credential belongs to the operator —
+ * Supatype does not invent one for a database it does not own, and creating a role with a
+ * placeholder password would be worse than refusing.
+ */
+export declare const PASSWORD_PLACEHOLDER = "<choose-a-password>";
+/** True when this remedy would execute the placeholder rather than a real credential. */
+export declare function needsOperatorPassword(remedies: readonly CheckResult[]): boolean;
+export interface PreflightOptions {
+    /** Schema Supatype will manage. Matches `schema.pg_schema`. */
+    schema: string;
+    /** Password to give `authenticator` in the remedy, when it has to be created. */
+    authenticatorPassword?: string;
+}
+export declare function runPreflight(client: pg.ClientBase, opts: PreflightOptions): Promise<PreflightReport>;
+/**
+ * Everything `--fix` can apply, as one script.
+ *
+ * Excludes anything needing the operator (server settings), because those cannot be transactional
+ * and mostly cannot be done in SQL on managed Postgres at all.
+ */
+export declare function transactionalRemedies(report: PreflightReport): CheckResult[];
+export declare function operatorRemedies(report: PreflightReport): CheckResult[];
+/**
+ * Apply the transactional remedies in a **single transaction**.
+ *
+ * `CREATE ROLE`, `GRANT`, `CREATE SCHEMA` and `CREATE EXTENSION` are all transactional in
+ * Postgres, so any failure rolls the whole thing back and the database is exactly as it was. That
+ * is the guarantee worth having when the database belongs to someone else.
+ *
+ * Server settings are the exception and are never included — `ALTER SYSTEM` cannot run in a
+ * transaction, and needs a restart besides. Those are reported for the operator to do.
+ */
+export declare function applyRemedies(client: pg.ClientBase, remedies: readonly CheckResult[]): Promise<void>;
+//# sourceMappingURL=db-preflight.d.ts.map

package/dist/db-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-preflight.d.ts","sourceRoot":"","sources":["../src/db-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAA;AAEnB,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAA;AAE3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,QAAQ,CAAA;IAClB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAA;IACd,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,uFAAuF;IACvF,KAAK,EAAE,QAAQ,CAAA;CAChB;AAwED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AAEzD,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAE/E;AAcD,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAA;IACd,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,eAAe,CAAC,CAgT1B;AA4ED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CAE5E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CAEvE;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,QAAQ,EAAE,SAAS,WAAW,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/db-preflight.js

@@ -0,0 +1,452 @@
+/**
+ * Does this database meet what Supatype needs of it?
+ *
+ * Written for the bring-your-own-Postgres case: an external database will not look like
+ * `supatype/postgres`, and the failures it produces are mostly indirect. The four API roles are
+ * the sharpest example — every `GRANT` the engine emits is guarded with
+ * `IF EXISTS (SELECT 1 FROM pg_roles …)`, so a missing role is skipped in silence and the symptom
+ * is an API that cannot switch roles at all, days later.
+ *
+ * So each check states the requirement, what depends on it, and the SQL that fixes it. One module
+ * holds both the probe and the remedy on purpose: `--emit` and `--fix` cannot then disagree with
+ * what `check` reported.
+ *
+ * **Severity is about consequence, not tidiness.** `Fail` means the stack will not work. `Degrade`
+ * means a named feature is unavailable and everything else is fine. `Warn` means the operator
+ * should know something, and nothing is wrong.
+ */
+/** Slot name for the decoding probe. Dropped immediately; never left behind. */
+const PROBE_SLOT = "supatype_preflight_probe";
+/**
+ * Ask the database to do the one thing realtime needs, then undo it.
+ *
+ * SQLSTATEs measured against `supatype/postgres` rather than recalled:
+ * `55000` wal_level too low, `58P01` the plugin's library is absent, `42501` the role may not use
+ * replication slots.
+ */
+async function probeLogicalDecoding(q) {
+    const base = { id: "logical-decoding", title: "wal2json logical decoding (realtime)" };
+    try {
+        await q(`SELECT pg_create_logical_replication_slot($1, 'wal2json')`, [PROBE_SLOT]);
+    }
+    catch (error) {
+        const code = error.code;
+        const detail = code === "58P01"
+            ? "the wal2json output plugin is not installed on this server"
+            : code === "42501"
+                ? "this role may not use replication slots (no REPLICATION attribute)"
+                : error instanceof Error
+                    ? error.message
+                    : String(error);
+        return {
+            ...base,
+            severity: "degrade",
+            detail,
+            impact: "Realtime subscriptions are unavailable; everything else is unaffected. The service still " +
+                "starts, reports this reason on /health/ready, and serves nothing else differently.",
+            ...(code === "42501"
+                ? { remedy: `ALTER ROLE CURRENT_USER WITH REPLICATION;`, remedyNeedsOperator: true }
+                : {
+                    remedy: [
+                        "-- wal2json is a server library, not an extension: it must be installed on the host",
+                        "-- (or offered by your provider) and cannot be added over SQL. Supatype's own image",
+                        "-- ships it. Set database.external.realtime: false to stop starting the service.",
+                    ].join("\n"),
+                    remedyNeedsOperator: true,
+                }),
+        };
+    }
+    // Leave nothing behind. A slot that is never read holds WAL forever, which on a database Supatype
+    // does not own is the rudest possible failure: the disk fills and nothing says why.
+    try {
+        await q(`SELECT pg_drop_replication_slot($1)`, [PROBE_SLOT]);
+    }
+    catch (error) {
+        return {
+            ...base,
+            severity: "warn",
+            detail: "the probe slot was created but could not be dropped",
+            impact: `An unread replication slot named "${PROBE_SLOT}" retains WAL indefinitely and will ` +
+                "eventually fill the disk.",
+            remedy: `SELECT pg_drop_replication_slot('${PROBE_SLOT}');`,
+        };
+    }
+    return { ...base, severity: "pass", detail: "a wal2json slot can be created and dropped" };
+}
+const REQUIRED_ROLES = ["anon", "authenticated", "service_role", "authenticator"];
+/**
+ * Stands in for the `authenticator` password when the operator has not supplied one.
+ *
+ * Fine to print for a human to replace; never acceptable to execute. `--fix` refuses when a remedy
+ * still contains it, because the decision was that this credential belongs to the operator —
+ * Supatype does not invent one for a database it does not own, and creating a role with a
+ * placeholder password would be worse than refusing.
+ */
+export const PASSWORD_PLACEHOLDER = "<choose-a-password>";
+/** True when this remedy would execute the placeholder rather than a real credential. */
+export function needsOperatorPassword(remedies) {
+    return remedies.some((r) => r.remedy?.includes(PASSWORD_PLACEHOLDER) === true);
+}
+const SEVERITY_ORDER = { pass: 0, warn: 1, degrade: 2, fail: 3 };
+function worstOf(results) {
+    return results.reduce((acc, r) => (SEVERITY_ORDER[r.severity] > SEVERITY_ORDER[acc] ? r.severity : acc), "pass");
+}
+/** Minimum server version. Settled by the owner; the masking rewrite touches planner internals. */
+const MIN_MAJOR = 17;
+export async function runPreflight(client, opts) {
+    const results = [];
+    const q = async (sql, params = []) => (await client.query(sql, params)).rows;
+    /** For probes that always return exactly one row. */
+    const one = async (sql, params = []) => {
+        const rows = await q(sql, params);
+        const row = rows[0];
+        if (!row)
+            throw new Error(`Preflight probe returned no rows: ${sql}`);
+        return row;
+    };
+    // ── Server version ─────────────────────────────────────────────────────────
+    const { server_version_num } = await one("SHOW server_version_num");
+    const major = Math.floor(Number(server_version_num) / 10000);
+    results.push({
+        id: "server-version",
+        title: `Postgres ${MIN_MAJOR} or later`,
+        severity: major >= MIN_MAJOR ? "pass" : "fail",
+        detail: `server reports major version ${major}`,
+        ...(major < MIN_MAJOR && {
+            impact: "Supatype's baseline is PG17; the masking rewrite depends on planner internals that are not stable across majors.",
+        }),
+    });
+    // ── Who are we, and what can we do ─────────────────────────────────────────
+    const privs = await one(`SELECT current_user,
+             rolsuper      AS is_super,
+             rolcreaterole AS can_create_role
+        FROM pg_roles WHERE rolname = current_user`);
+    results.push({
+        id: "connection-identity",
+        title: "Connected identity",
+        severity: "pass",
+        detail: `connected as "${privs.current_user}"` +
+            (privs.is_super ? " (superuser)" : privs.can_create_role ? " (can create roles)" : " (cannot create roles)"),
+    });
+    // ── Target schema ──────────────────────────────────────────────────────────
+    const schemaRows = await q("SELECT nspname FROM pg_namespace WHERE nspname = $1", [opts.schema]);
+    const schemaExists = schemaRows.length > 0;
+    const { can_create, database } = await one(`SELECT has_database_privilege(current_database(), 'CREATE') AS can_create,
+            current_database() AS database`);
+    results.push({
+        id: "target-schema",
+        title: `Schema "${opts.schema}"`,
+        severity: schemaExists || can_create ? "pass" : "fail",
+        detail: schemaExists
+            ? `exists`
+            : can_create
+                ? "does not exist, and can be created"
+                : "does not exist, and this role cannot create it",
+        ...(!schemaExists && can_create && { remedy: `CREATE SCHEMA IF NOT EXISTS ${ident(opts.schema)};` }),
+        ...(!schemaExists && !can_create && {
+            impact: "The engine needs its own schema for migration history and schema state.",
+        }),
+    });
+    // `CREATE` on the database, which the check above only asked about when the target schema was
+    // missing — and `public` always exists, so on a database where the role cannot create schemas that
+    // check passed while the stack could not start.
+    //
+    // Measured on a role with `CONNECT` and `USAGE ON SCHEMA public` but no `CREATE`: storage's
+    // bootstrap fails `42501 permission denied for database`, and so does every one of the engine's own
+    // schemas. Storage was the least examined service in this plan and this is the whole of what it
+    // needs — no extensions, no superuser, no replication, just somewhere to put `storage.buckets` and
+    // `storage.objects`.
+    results.push({
+        id: "create-schemas",
+        title: "CREATE on the database",
+        severity: can_create ? "pass" : "fail",
+        detail: can_create ? "granted" : "not granted to this role",
+        ...(!can_create && {
+            impact: "Four schemas cannot be created: `storage` (buckets and objects), `_platform` (trigger " +
+                "functions), `supatype` (Studio's views) and `_supatype` (migration history). Storage exits " +
+                "at boot and the engine cannot record a migration.",
+            remedy: `GRANT CREATE ON DATABASE ${ident(database)} TO ${ident(privs.current_user)};`,
+        }),
+    });
+    // ── The four API roles ─────────────────────────────────────────────────────
+    const roleRows = await q(`SELECT rolname, rolinherit, rolcanlogin FROM pg_roles WHERE rolname = ANY($1)`, [REQUIRED_ROLES]);
+    const present = new Map(roleRows.map((r) => [r.rolname, r]));
+    const missing = REQUIRED_ROLES.filter((r) => !present.has(r));
+    results.push({
+        id: "api-roles",
+        title: "API roles (anon, authenticated, service_role, authenticator)",
+        severity: missing.length === 0 ? "pass" : "fail",
+        detail: missing.length === 0
+            ? "all four present"
+            : `missing: ${missing.join(", ")}`,
+        ...(missing.length > 0 && {
+            // The silence is the point: without these, nothing errors, the API just cannot switch roles.
+            impact: "PostgREST switches to these roles per request. Every GRANT the engine emits is guarded " +
+                "with IF EXISTS on the role, so absent roles are skipped silently and the failure surfaces " +
+                "later as an API that cannot authenticate." +
+                // Found by running --fix as a CREATEROLE-but-not-superuser operator, which is what a
+                // managed provider typically gives you: it failed with a bare "permission denied to
+                // create role" because BYPASSRLS is superuser-only. Better to say so up front.
+                (needsSuperuserForRoles(missing, privs.is_super)
+                    ? "\n         Note: service_role needs BYPASSRLS, which only a superuser can grant. " +
+                        `This connection is not a superuser, so --fix cannot create it — have someone with ` +
+                        `superuser apply the emitted SQL, or create service_role first.`
+                    : ""),
+            remedy: roleRemedy(missing, opts.authenticatorPassword),
+            // A remedy that cannot succeed at this privilege level should not be attempted in a
+            // transaction that will only roll back.
+            ...(needsSuperuserForRoles(missing, privs.is_super) && { remedyNeedsOperator: true }),
+        }),
+    });
+    // `authenticator` must not inherit: it is the containment boundary that stops a JWT naming a
+    // privileged role from getting it.
+    const authenticator = present.get("authenticator");
+    if (authenticator) {
+        const ok = !authenticator.rolinherit && authenticator.rolcanlogin;
+        results.push({
+            id: "authenticator-shape",
+            title: "authenticator is NOINHERIT and can log in",
+            severity: ok ? "pass" : "fail",
+            detail: `rolinherit=${authenticator.rolinherit}, rolcanlogin=${authenticator.rolcanlogin}`,
+            ...(!ok && {
+                impact: "NOINHERIT is what confines PostgREST to anon/authenticated/service_role. An INHERIT " +
+                    "authenticator carries the privileges of every role granted to it.",
+                remedy: `ALTER ROLE authenticator NOINHERIT LOGIN;`,
+            }),
+        });
+        const memberships = await q(`SELECT r.rolname FROM pg_auth_members m
+         JOIN pg_roles r ON r.oid = m.roleid
+         JOIN pg_roles g ON g.oid = m.member
+        WHERE g.rolname = 'authenticator'`);
+        const held = new Set(memberships.map((m) => m.rolname));
+        const needed = ["anon", "authenticated", "service_role"].filter((r) => !held.has(r));
+        results.push({
+            id: "authenticator-memberships",
+            title: "authenticator can reach the three API roles",
+            severity: needed.length === 0 ? "pass" : "fail",
+            detail: needed.length === 0 ? "all three granted" : `not granted: ${needed.join(", ")}`,
+            ...(needed.length > 0 && {
+                impact: "PostgREST cannot SET ROLE to a role it is not a member of; those requests fail.",
+                remedy: needed.map((r) => `GRANT ${r} TO authenticator;`).join("\n"),
+            }),
+        });
+    }
+    // ── Extensions ─────────────────────────────────────────────────────────────
+    const installed = new Set((await q("SELECT extname FROM pg_extension")).map((r) => r.extname));
+    const available = new Set((await q("SELECT name FROM pg_available_extensions")).map((r) => r.name));
+    results.push(extensionCheck("pgcrypto", installed, available, {
+        title: "pgcrypto",
+        needs: "UUID primary keys — the engine emits gen_random_uuid() defaults.",
+        whenMissing: "fail",
+    }));
+    for (const name of ["vector", "postgis"]) {
+        results.push(extensionCheck(name, installed, available, {
+            title: name,
+            needs: `only schemas using ${name === "vector" ? "Vector<> fields" : "Geo/GeoPoint fields"}.`,
+            whenMissing: "warn",
+        }));
+    }
+    // Field rules are enforced either way now, so this is no longer a degrade.
+    //
+    // It reported "per-column rules cannot be enforced" and "a push carrying them refuses", both of
+    // which stopped being true when the view tier landed. What the operator needs to know is *which*
+    // mechanism they will get and the one way the two differ.
+    results.push({
+        id: "ext-supatype_mask",
+        title: "Field-level access rules (access.fields)",
+        severity: installed.has("supatype_mask") ? "pass" : "warn",
+        detail: installed.has("supatype_mask")
+            ? "enforced by supatype_mask, the planner rewrite (tier 1)"
+            : available.has("supatype_mask")
+                ? "supatype_mask is available but not installed — rules will be enforced by generated api views (tier 2)"
+                : "enforced by generated api views (tier 2); supatype_mask is not available on this server",
+        ...(!installed.has("supatype_mask") && {
+            impact: "Tier 2 puts the masking expression in a view instead of the query planner. It is the same " +
+                "behaviour with one exception: an aggregate over a masked column returns the sum of what the " +
+                "caller may read, where tier 1 raises. Unreachable through the API — PostgREST ships with " +
+                "aggregates disabled and Supatype never enables them — so this matters only for direct SQL " +
+                "against the api views. PostgREST is pointed at `api` instead of your managed schema, and the " +
+                "API roles hold their privileges on the views rather than the tables.",
+            ...(available.has("supatype_mask") && {
+                remedy: "CREATE EXTENSION IF NOT EXISTS supatype_mask;",
+            }),
+        }),
+    });
+    // ── Realtime ───────────────────────────────────────────────────────────────
+    const { wal_level } = await one("SHOW wal_level");
+    const walLogical = wal_level === "logical";
+    results.push({
+        id: "wal-level",
+        title: "wal_level = logical (realtime)",
+        severity: walLogical ? "pass" : "degrade",
+        detail: `wal_level is "${wal_level}"`,
+        ...(!walLogical && {
+            impact: "Realtime subscriptions are unavailable; everything else is unaffected.",
+            remedy: "-- Requires a server restart, and on managed Postgres a parameter-group change\n" +
+                "-- rather than SQL. Shown for a self-managed server:\n" +
+                "ALTER SYSTEM SET wal_level = 'logical';",
+            remedyNeedsOperator: true,
+        }),
+    });
+    const slots = await one(`SELECT (SELECT count(*) FROM pg_replication_slots)::text AS used,
+            current_setting('max_replication_slots') AS max`);
+    const slotsFree = Number(slots.max) - Number(slots.used);
+    results.push({
+        id: "replication-slots",
+        title: "A spare replication slot (realtime)",
+        severity: slotsFree > 0 ? "pass" : "degrade",
+        detail: `${slots.used} of ${slots.max} in use`,
+        ...(slotsFree <= 0 && {
+            impact: "Realtime cannot create its slot.",
+            remedy: "ALTER SYSTEM SET max_replication_slots = 10;",
+            remedyNeedsOperator: true,
+        }),
+    });
+    // The definitive realtime check: create the slot realtime would create, then drop it.
+    //
+    // There is no catalog to consult. `wal2json` is a shared library, not an extension, so it never
+    // appears in `pg_available_extensions` — the only way to know whether this database can decode is
+    // to ask it to. Cloud SQL does not ship the plugin at all; plenty of managed Postgres will not
+    // grant `REPLICATION`. Both produce a stack that looks healthy until the first subscription.
+    //
+    // Skipped when `wal_level` or the slot budget already rules it out, since the probe would fail for
+    // that reason and report it a second time under a less specific heading.
+    if (walLogical && slotsFree > 0) {
+        results.push(await probeLogicalDecoding(q));
+    }
+    // ── Existing tables in the target schema ───────────────────────────────────
+    if (schemaExists) {
+        const tables = await q(
+        // Anything not carrying Supatype's ownership marker. Today that is every table, since
+        // tables are not stamped yet (E4); once they are, this narrows to genuinely foreign ones
+        // without needing to change.
+        `SELECT c.relname FROM pg_class c
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+        WHERE n.nspname = $1 AND c.relkind = 'r'
+          AND coalesce(obj_description(c.oid, 'pg_class'), '') NOT LIKE 'supatype:managed%'
+        ORDER BY c.relname`, [opts.schema]);
+        if (tables.length > 0) {
+            const names = tables.map((t) => t.relname);
+            results.push({
+                id: "existing-tables",
+                title: `Existing tables in "${opts.schema}"`,
+                severity: "warn",
+                detail: `${names.length} table(s) Supatype did not create: ` +
+                    names.slice(0, 8).join(", ") +
+                    (names.length > 8 ? `, … and ${names.length - 8} more` : ""),
+                impact: "These are not described by your schema. Model them, or keep them out of the managed " +
+                    "schema — a push only manages what it created.",
+            });
+        }
+    }
+    return { results, worst: worstOf(results) };
+}
+function extensionCheck(name, installed, available, meta) {
+    if (installed.has(name)) {
+        return { id: `ext-${name}`, title: meta.title, severity: "pass", detail: "installed" };
+    }
+    if (available.has(name)) {
+        return {
+            id: `ext-${name}`,
+            title: meta.title,
+            severity: "warn",
+            detail: "available but not installed",
+            impact: `Needed for ${meta.needs}`,
+            remedy: `CREATE EXTENSION IF NOT EXISTS ${ident(name)};`,
+        };
+    }
+    return {
+        id: `ext-${name}`,
+        title: meta.title,
+        severity: meta.whenMissing,
+        detail: "not available on this server",
+        impact: `Needed for ${meta.needs}`,
+    };
+}
+/**
+ * SQL to create the missing API roles.
+ *
+ * `authenticator` needs a password because PostgREST logs in as it; the others never do. The
+ * password is the operator's to supply — Supatype does not invent a credential for a database it
+ * does not own.
+ */
+function roleRemedy(missing, authenticatorPassword) {
+    const lines = [];
+    for (const role of missing) {
+        if (role === "authenticator") {
+            const pw = authenticatorPassword
+                ? `'${authenticatorPassword.replace(/'/g, "''")}'`
+                : `'${PASSWORD_PLACEHOLDER}'`;
+            lines.push(`CREATE ROLE authenticator LOGIN NOINHERIT PASSWORD ${pw};`);
+        }
+        else if (role === "service_role") {
+            // BYPASSRLS is what makes seeds, migrations and server-side code work.
+            lines.push(`CREATE ROLE service_role NOLOGIN NOINHERIT BYPASSRLS;`);
+        }
+        else {
+            lines.push(`CREATE ROLE ${ident(role)} NOLOGIN NOINHERIT;`);
+        }
+    }
+    if (missing.includes("authenticator") || missing.length > 0) {
+        for (const role of ["anon", "authenticated", "service_role"]) {
+            lines.push(`GRANT ${role} TO authenticator;`);
+        }
+    }
+    return lines.join("\n");
+}
+/**
+ * Whether creating the missing roles needs superuser rather than merely CREATEROLE.
+ *
+ * `service_role` carries `BYPASSRLS`, and only a superuser may set that attribute. A CREATEROLE
+ * operator — which is what managed Postgres typically gives you — gets "permission denied to
+ * create role" with no indication that the attribute is the reason.
+ */
+function needsSuperuserForRoles(missing, isSuperuser) {
+    return missing.includes("service_role") && !isSuperuser;
+}
+/** Quote an identifier for inclusion in emitted SQL. */
+function ident(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+/**
+ * Everything `--fix` can apply, as one script.
+ *
+ * Excludes anything needing the operator (server settings), because those cannot be transactional
+ * and mostly cannot be done in SQL on managed Postgres at all.
+ */
+export function transactionalRemedies(report) {
+    return report.results.filter((r) => r.remedy !== undefined && r.remedyNeedsOperator !== true);
+}
+export function operatorRemedies(report) {
+    return report.results.filter((r) => r.remedyNeedsOperator === true);
+}
+/**
+ * Apply the transactional remedies in a **single transaction**.
+ *
+ * `CREATE ROLE`, `GRANT`, `CREATE SCHEMA` and `CREATE EXTENSION` are all transactional in
+ * Postgres, so any failure rolls the whole thing back and the database is exactly as it was. That
+ * is the guarantee worth having when the database belongs to someone else.
+ *
+ * Server settings are the exception and are never included — `ALTER SYSTEM` cannot run in a
+ * transaction, and needs a restart besides. Those are reported for the operator to do.
+ */
+export async function applyRemedies(client, remedies) {
+    if (remedies.length === 0)
+        return;
+    await client.query("BEGIN");
+    try {
+        for (const r of remedies) {
+            // Comment lines are guidance, not SQL.
+            const sql = r.remedy.split("\n").filter((l) => !l.trimStart().startsWith("--")).join("\n");
+            if (sql.trim() === "")
+                continue;
+            await client.query(sql);
+        }
+        await client.query("COMMIT");
+    }
+    catch (err) {
+        await client.query("ROLLBACK").catch(() => undefined);
+        throw err;
+    }
+}
+//# sourceMappingURL=db-preflight.js.map

package/dist/db-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-preflight.js","sourceRoot":"","sources":["../src/db-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA6BH,gFAAgF;AAChF,MAAM,UAAU,GAAG,0BAA0B,CAAA;AAO7C;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CAAC,CAAU;IAC5C,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAA;IACtF,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,2DAA2D,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAA;QAC/C,MAAM,MAAM,GACV,IAAI,KAAK,OAAO;YACd,CAAC,CAAC,4DAA4D;YAC9D,CAAC,CAAC,IAAI,KAAK,OAAO;gBAChB,CAAC,CAAC,oEAAoE;gBACtE,CAAC,CAAC,KAAK,YAAY,KAAK;oBACtB,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACvB,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,SAAS;YACnB,MAAM;YACN,MAAM,EACJ,2FAA2F;gBAC3F,oFAAoF;YACtF,GAAG,CAAC,IAAI,KAAK,OAAO;gBAClB,CAAC,CAAC,EAAE,MAAM,EAAE,2CAA2C,EAAE,mBAAmB,EAAE,IAAI,EAAE;gBACpF,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,qFAAqF;wBACrF,qFAAqF;wBACrF,kFAAkF;qBACnF,CAAC,IAAI,CAAC,IAAI,CAAC;oBACZ,mBAAmB,EAAE,IAAI;iBAC1B,CAAC;SACP,CAAA;IACH,CAAC;IAED,kGAAkG;IAClG,oFAAoF;IACpF,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,qCAAqC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,qDAAqD;YAC7D,MAAM,EACJ,qCAAqC,UAAU,sCAAsC;gBACrF,2BAA2B;YAC7B,MAAM,EAAE,oCAAoC,UAAU,KAAK;SAC5D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAA;AAC5F,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,CAAU,CAAA;AAE1F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CAAC,QAAgC;IACpE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,IAAI,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,cAAc,GAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AAE1F,SAAS,OAAO,CAAC,OAAsB;IACrC,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EACjF,MAAM,CACP,CAAA;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,SAAS,GAAG,EAAE,CAAA;AASpB,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,IAAsB;IAEtB,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,MAAM,CAAC,GAAG,KAAK,EACb,GAAW,EACX,SAAoB,EAAE,EACR,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IAE5D,qDAAqD;IACrD,MAAM,GAAG,GAAG,KAAK,EAA+B,GAAW,EAAE,SAAoB,EAAE,EAAc,EAAE;QACjG,MAAM,IAAI,GAAG,MAAM,CAAC,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAA;QACrE,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,8EAA8E;IAC9E,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,GAAG,CACtC,yBAAyB,CAC1B,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAC,CAAA;IAC5D,OAAO,CAAC,IAAI,CAAC;QACX,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,YAAY,SAAS,WAAW;QACvC,QAAQ,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC9C,MAAM,EAAE,gCAAgC,KAAK,EAAE;QAC/C,GAAG,CAAC,KAAK,GAAG,SAAS,IAAI;YACvB,MAAM,EAAE,kHAAkH;SAC3H,CAAC;KACH,CAAC,CAAA;IAEF,8EAA8E;IAC9E,MAAM,KAAK,GAAG,MAAM,GAAG,CAIpB;;;mDAG8C,CAAC,CAAA;IAElD,OAAO,CAAC,IAAI,CAAC;QACX,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,MAAM;QAChB,MAAM,EACJ,iBAAiB,KAAK,CAAC,YAAY,GAAG;YACtC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,wBAAwB,CAAC;KAC/G,CAAC,CAAA;IAEF,8EAA8E;IAC9E,MAAM,UAAU,GAAG,MAAM,CAAC,CACxB,qDAAqD,EACrD,CAAC,IAAI,CAAC,MAAM,CAAC,CACd,CAAA;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;IAC1C,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CACxC;2CACuC,CACxC,CAAA;IACD,OAAO,CAAC,IAAI,CAAC;QACX,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,WAAW,IAAI,CAAC,MAAM,GAAG;QAChC,QAAQ,EAAE,YAAY,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACtD,MAAM,EAAE,YAAY;YAClB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,UAAU;gBACV,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,gDAAgD;QACtD,GAAG,CAAC,CAAC,YAAY,IAAI,UAAU,IAAI,EAAE,MAAM,EAAE,+BAA+B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACpG,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,UAAU,IAAI;YAClC,MAAM,EAAE,yEAAyE;SAClF,CAAC;KACH,CAAC,CAAA;IAEF,8FAA8F;IAC9F,mGAAmG;IACnG,gDAAgD;IAChD,EAAE;IACF,4FAA4F;IAC5F,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IACnG,qBAAqB;IACrB,OAAO,CAAC,IAAI,CAAC;QACX,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACtC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;QAC3D,GAAG,CAAC,CAAC,UAAU,IAAI;YACjB,MAAM,EACJ,wFAAwF;gBACxF,6FAA6F;gBAC7F,mDAAmD;YACrD,MAAM,EAAE,4BAA4B,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG;SACvF,CAAC;KACH,CAAC,CAAA;IAEF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,CAAC,CACtB,+EAA+E,EAC/E,CAAC,cAAqC,CAAC,CACxC,CAAA;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5D,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAE7D,OAAO,CAAC,IAAI,CAAC;QACX,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,8DAA8D;QACrE,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAChD,MAAM,EACJ,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACtC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI;YACxB,6FAA6F;YAC7F,MAAM,EACJ,yFAAyF;gBACzF,4FAA4F;gBAC5F,2CAA2C;gBAC3C,qFAAqF;gBACrF,oFAAoF;gBACpF,+EAA+E;gBAC/E,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;oBAC9C,CAAC,CAAC,mFAAmF;wBACnF,oFAAoF;wBACpF,gEAAgE;oBAClE,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC;YACvD,oFAAoF;YACpF,wCAAwC;YACxC,GAAG,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;SACtF,CAAC;KACH,CAAC,CAAA;IAEF,6FAA6F;IAC7F,mCAAmC;IACnC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,UAAU,IAAI,aAAa,CAAC,WAAW,CAAA;QACjE,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2CAA2C;YAClD,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC9B,MAAM,EAAE,cAAc,aAAa,CAAC,UAAU,iBAAiB,aAAa,CAAC,WAAW,EAAE;YAC1F,GAAG,CAAC,CAAC,EAAE,IAAI;gBACT,MAAM,EACJ,sFAAsF;oBACtF,mEAAmE;gBACrE,MAAM,EAAE,2CAA2C;aACpD,CAAC;SACH,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,MAAM,CAAC,CACzB;;;0CAGoC,CACrC,CAAA;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACpF,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,2BAA2B;YAC/B,KAAK,EAAE,6CAA6C;YACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC/C,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACvF,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI;gBACvB,MAAM,EAAE,iFAAiF;gBACzF,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;aACrE,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,CAAC,MAAM,CAAC,CAAsB,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACzF,CAAA;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,CAAC,MAAM,CAAC,CAAmB,0CAA0C,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC3F,CAAA;IAED,OAAO,CAAC,IAAI,CACV,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE;QAC/C,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,kEAAkE;QACzE,WAAW,EAAE,MAAM;KACpB,CAAC,CACH,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,CACV,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YACzC,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,sBAAsB,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,qBAAqB,GAAG;YAC7F,WAAW,EAAE,MAAM;SACpB,CAAC,CACH,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,EAAE;IACF,gGAAgG;IAChG,iGAAiG;IACjG,0DAA0D;IAC1D,OAAO,CAAC,IAAI,CAAC;QACX,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,0CAA0C;QACjD,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC1D,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC;YACpC,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC;gBAC9B,CAAC,CAAC,uGAAuG;gBACzG,CAAC,CAAC,yFAAyF;QAC/F,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI;YACrC,MAAM,EACJ,4FAA4F;gBAC5F,8FAA8F;gBAC9F,2FAA2F;gBAC3F,4FAA4F;gBAC5F,+FAA+F;gBAC/F,sEAAsE;YACxE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI;gBACpC,MAAM,EAAE,+CAA+C;aACxD,CAAC;SACH,CAAC;KACH,CAAC,CAAA;IAEF,8EAA8E;IAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,CAAwB,gBAAgB,CAAC,CAAA;IACxE,MAAM,UAAU,GAAG,SAAS,KAAK,SAAS,CAAA;IAC1C,OAAO,CAAC,IAAI,CAAC;QACX,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACzC,MAAM,EAAE,iBAAiB,SAAS,GAAG;QACrC,GAAG,CAAC,CAAC,UAAU,IAAI;YACjB,MAAM,EAAE,wEAAwE;YAChF,MAAM,EACJ,kFAAkF;gBAClF,wDAAwD;gBACxD,yCAAyC;YAC3C,mBAAmB,EAAE,IAAI;SAC1B,CAAC;KACH,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,MAAM,GAAG,CACrB;4DACwD,CACzD,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxD,OAAO,CAAC,IAAI,CAAC;QACX,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,qCAAqC;QAC5C,QAAQ,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,GAAG,SAAS;QAC9C,GAAG,CAAC,SAAS,IAAI,CAAC,IAAI;YACpB,MAAM,EAAE,kCAAkC;YAC1C,MAAM,EAAE,8CAA8C;YACtD,mBAAmB,EAAE,IAAI;SAC1B,CAAC;KACH,CAAC,CAAA;IAEF,sFAAsF;IACtF,EAAE;IACF,gGAAgG;IAChG,kGAAkG;IAClG,+FAA+F;IAC/F,6FAA6F;IAC7F,EAAE;IACF,mGAAmG;IACnG,yEAAyE;IACzE,IAAI,UAAU,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,8EAA8E;IAC9E,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,CAAC;QACpB,sFAAsF;QACtF,yFAAyF;QACzF,6BAA6B;QAC7B;;;;2BAIqB,EACrB,CAAC,IAAI,CAAC,MAAM,CAAC,CACd,CAAA;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YAC1C,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,iBAAiB;gBACrB,KAAK,EAAE,uBAAuB,IAAI,CAAC,MAAM,GAAG;gBAC5C,QAAQ,EAAE,MAAM;gBAChB,MAAM,EACJ,GAAG,KAAK,CAAC,MAAM,qCAAqC;oBACpD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC5B,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,EACJ,sFAAsF;oBACtF,+CAA+C;aAClD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,cAAc,CACrB,IAAY,EACZ,SAAsB,EACtB,SAAsB,EACtB,IAA6D;IAE7D,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,OAAO,IAAI,EAAE;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,6BAA6B;YACrC,MAAM,EAAE,cAAc,IAAI,CAAC,KAAK,EAAE;YAClC,MAAM,EAAE,kCAAkC,KAAK,CAAC,IAAI,CAAC,GAAG;SACzD,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,OAAO,IAAI,EAAE;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,WAAW;QAC1B,MAAM,EAAE,8BAA8B;QACtC,MAAM,EAAE,cAAc,IAAI,CAAC,KAAK,EAAE;KACnC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,OAA0B,EAAE,qBAA8B;IAC5E,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,qBAAqB;gBAC9B,CAAC,CAAC,IAAI,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;gBAClD,CAAC,CAAC,IAAI,oBAAoB,GAAG,CAAA;YAC/B,KAAK,CAAC,IAAI,CAAC,sDAAsD,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;aAAM,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,uEAAuE;YACvE,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAA;QACrE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,cAAc,CAAC,EAAE,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,OAA0B,EAAE,WAAoB;IAC9E,OAAO,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAA;AACzD,CAAC;AAED,wDAAwD;AACxD,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAA;AAC/F,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAuB;IACtD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,QAAgC;IAEhC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IACjC,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,uCAAuC;YACvC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC3F,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAQ;YAC/B,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACzB,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACrD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/dev-compose.d.ts

@@ -10,7 +10,7 @@ export interface DevComposeOptions {
     watch: boolean;
 }
 /** In-compose Postgres URL (SCRAM; not published to the host). */
-export declare function composeDbUrl(): string;
+export declare function composeDbUrl(cwd: string): string;
 /**
  * When `provider: docker` and `overrides.engine` is set, ensure Postgres is published
  * on the host (SUPATYPE_DEV_DB_PORT) so the local engine binary can connect.