gencow 0.1.184 → 0.1.185

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gencow",
-  "version": "0.1.184",
+  "version": "0.1.185",
   "description": "Gencow — AI Backend Engine",
   "type": "module",
   "bin": {

package/runtime/server.mjs

@@ -72126,6 +72126,34 @@ async function ensurePlatformRlsPolicies(params) {
   if (!params.isPlatform)
     return;
   const logger3 = params.logger ?? console;
+  if (params.reconcile === false) {
+    const expectedValues = PLATFORM_RLS_TARGET_TABLES.map((_table, index) => `($${index * 2 + 1}::text, $${index * 2 + 2}::text)`).join(", ");
+    const expectedParams = PLATFORM_RLS_TARGET_TABLES.flatMap((table) => [table.tableName, table.policyName]);
+    const result2 = await params.rawSql(`SELECT expected.table_name,
+              expected.policy_name,
+              COALESCE(c.relrowsecurity, false) AS row_security,
+              COALESCE(c.relforcerowsecurity, false) AS force_row_security,
+              EXISTS (
+                SELECT 1 FROM pg_policy p
+                WHERE p.polrelid = c.oid AND p.polname = expected.policy_name
+              ) AS policy_exists
+       FROM (VALUES ${expectedValues}) AS expected(table_name, policy_name)
+       LEFT JOIN pg_namespace n ON n.nspname = 'public'
+       LEFT JOIN pg_class c ON c.relnamespace = n.oid AND c.relname = expected.table_name`, expectedParams);
+    const rows4 = Array.isArray(result2) ? result2 : [];
+    const drifted = rows4.filter((row) => {
+      if (!row || typeof row !== "object")
+        return true;
+      const state = row;
+      return state.row_security !== true || state.force_row_security !== true || state.policy_exists !== true;
+    });
+    if (rows4.length !== PLATFORM_RLS_TARGET_TABLES.length || drifted.length > 0) {
+      const names = drifted.map((row) => row && typeof row === "object" && typeof row.table_name === "string" ? row.table_name : "unknown").join(",");
+      throw new Error(`PLATFORM_RLS_POLICY_DRIFT:${names || "catalog_incomplete"}`);
+    }
+    logger3.log(`[db] platform RLS policies verified for ${rows4.length} table(s)`);
+    return;
+  }
   const existing = await listExistingPublicTables(params.rawSql);
   const tables = PLATFORM_RLS_TARGET_TABLES.filter((table) => existing.has(table.tableName));
   const missing = PLATFORM_RLS_TARGET_TABLES.filter((table) => !existing.has(table.tableName));
@@ -75492,17 +75520,35 @@ var init_server_platform_node_capacity_schema = __esm({
      CONSTRAINT platform_node_capacity_audit_reason_check CHECK (char_length(reason) BETWEEN 10 AND 500),
      CONSTRAINT platform_node_capacity_audit_outcome_check CHECK (outcome IN ('applied', 'pending', 'rejected', 'failed', 'noop'))
    )`,
-      `CREATE INDEX IF NOT EXISTS platform_node_capacity_audit_node_created_idx
-   ON platform_node_capacity_audit_events (node_id, created_at DESC)`,
-      `CREATE OR REPLACE FUNCTION _gencow_reject_capacity_audit_mutation()
-   RETURNS trigger LANGUAGE plpgsql AS $$
-   BEGIN
-     RAISE EXCEPTION 'platform node capacity audit events are append-only';
+      `DO $$ BEGIN
+     IF to_regclass('platform_node_capacity_audit_node_created_idx') IS NULL THEN
+       CREATE INDEX platform_node_capacity_audit_node_created_idx
+       ON platform_node_capacity_audit_events (node_id, created_at DESC);
+     END IF;
+   END $$`,
+      `DO $bootstrap$ BEGIN
+     IF to_regprocedure('_gencow_reject_capacity_audit_mutation()') IS NULL THEN
+       EXECUTE $function$
+         CREATE FUNCTION _gencow_reject_capacity_audit_mutation()
+         RETURNS trigger LANGUAGE plpgsql AS $body$
+         BEGIN
+           RAISE EXCEPTION 'platform node capacity audit events are append-only';
+         END $body$
+       $function$;
+     END IF;
+   END $bootstrap$`,
+      `DO $$ BEGIN
+     IF NOT EXISTS (
+       SELECT 1 FROM pg_trigger
+       WHERE tgname = 'platform_node_capacity_audit_append_only'
+         AND tgrelid = 'platform_node_capacity_audit_events'::regclass
+         AND NOT tgisinternal
+     ) THEN
+       CREATE TRIGGER platform_node_capacity_audit_append_only
+       BEFORE UPDATE OR DELETE ON platform_node_capacity_audit_events
+       FOR EACH ROW EXECUTE FUNCTION _gencow_reject_capacity_audit_mutation();
+     END IF;
    END $$`,
-      `DROP TRIGGER IF EXISTS platform_node_capacity_audit_append_only ON platform_node_capacity_audit_events`,
-      `CREATE TRIGGER platform_node_capacity_audit_append_only
-   BEFORE UPDATE OR DELETE ON platform_node_capacity_audit_events
-   FOR EACH ROW EXECUTE FUNCTION _gencow_reject_capacity_audit_mutation()`,
       `CREATE TABLE IF NOT EXISTS platform_node_capacity_runtime_events (
      event_id TEXT PRIMARY KEY,
      node_id TEXT NOT NULL,
@@ -75518,13 +75564,24 @@ var init_server_platform_node_capacity_schema = __esm({
      CONSTRAINT platform_node_capacity_runtime_event_unique
        UNIQUE (node_id, running_desired_revision, outcome, reason_code)
    )`,
-      `CREATE INDEX IF NOT EXISTS platform_node_capacity_runtime_node_created_idx
-   ON platform_node_capacity_runtime_events (node_id, created_at DESC)`,
-      `DROP TRIGGER IF EXISTS platform_node_capacity_runtime_append_only
-   ON platform_node_capacity_runtime_events`,
-      `CREATE TRIGGER platform_node_capacity_runtime_append_only
-   BEFORE UPDATE OR DELETE ON platform_node_capacity_runtime_events
-   FOR EACH ROW EXECUTE FUNCTION _gencow_reject_capacity_audit_mutation()`
+      `DO $$ BEGIN
+     IF to_regclass('platform_node_capacity_runtime_node_created_idx') IS NULL THEN
+       CREATE INDEX platform_node_capacity_runtime_node_created_idx
+       ON platform_node_capacity_runtime_events (node_id, created_at DESC);
+     END IF;
+   END $$`,
+      `DO $$ BEGIN
+     IF NOT EXISTS (
+       SELECT 1 FROM pg_trigger
+       WHERE tgname = 'platform_node_capacity_runtime_append_only'
+         AND tgrelid = 'platform_node_capacity_runtime_events'::regclass
+         AND NOT tgisinternal
+     ) THEN
+       CREATE TRIGGER platform_node_capacity_runtime_append_only
+       BEFORE UPDATE OR DELETE ON platform_node_capacity_runtime_events
+       FOR EACH ROW EXECUTE FUNCTION _gencow_reject_capacity_audit_mutation();
+     END IF;
+   END $$`
     ];
   }
 });
@@ -76133,6 +76190,7 @@ async function ensurePlatformSchemaUpgrade(params) {
   await ensurePlatformRlsPolicies({
     rawSql: params.rawSql,
     isPlatform: params.isPlatform,
+    reconcile: params.reconcileRls !== false,
     logger: logger3
   });
 }
@@ -117330,6 +117388,7 @@ async function bootstrapRuntimeSystemSchemas(params) {
   await schemaBootstrap.ensurePlatformSchemaUpgrade({
     rawSql: params.rawSql,
     isPlatform: params.isPlatform,
+    reconcileRls: false,
     logger: logger3
   });
   if (params.isPlatform) {