supa-forge 0.1.1

package/dist/index.mjs

@@ -0,0 +1,1364 @@
+import "reflect-metadata";
+import y from "chalk";
+import { DataSource as pe } from "typeorm";
+import { Client as $e } from "pg";
+import * as g from "fs";
+import * as C from "path";
+import { z as I } from "zod";
+const w = {
+  security: Symbol("supaforge:security"),
+  rls: Symbol("supaforge:rls"),
+  cls: Symbol("supaforge:cls"),
+  runSql: Symbol("supaforge:runsql")
+};
+function me(e) {
+  const r = e.toLowerCase().trim().split(""), n = ["c", "r", "u", "d"], i = r.filter((a) => !n.includes(a));
+  if (i.length > 0)
+    throw new Error(`Invalid permissions: ${i.join(", ")}. Expected only ${n.join(", ")}.`);
+  const t = [...new Set(r)].sort((a, o) => n.indexOf(a) - n.indexOf(o));
+  return t.includes("u") && !t.includes("r") && console.warn(y.yellow("Security Audit: 'u' permission found without 'r' on a security rule. In PostgreSQL, updates generally require select permissions on the columns used in the WHERE clause. If this is intentional (e.g., blinded updates), ensure your RLS/CLS allows it.")), t;
+}
+function Qn() {
+  return (e) => {
+    Reflect.defineMetadata(w.security, !0, e);
+  };
+}
+function Wn(e) {
+  return (r, n) => {
+    const i = me(e), t = typeof r == "function" ? r : r.constructor, a = Reflect.getMetadata(w.rls, t) ?? [];
+    a.push({
+      name: String(n),
+      crud: i,
+      definition: r[n]
+    }), Reflect.defineMetadata(w.rls, a, t);
+  };
+}
+function Vn(e) {
+  return (r, n) => {
+    const t = (Array.isArray(e) ? e : [e]).flatMap(
+      (l) => Object.entries(l).map(([s, u]) => ({
+        role: s,
+        permissions: me(u)
+      }))
+    ), a = r.constructor, o = Reflect.getMetadata(w.cls, a) ?? [];
+    o.push({
+      propertyKey: String(n),
+      databaseName: "",
+      // Dynamically mapped via TypeORM introspection later
+      rules: t
+    }), Reflect.defineMetadata(w.cls, o, a);
+  };
+}
+function zn() {
+  return (e, r) => {
+    const n = typeof e == "function" ? e : e.constructor, i = Reflect.getMetadata(w.runSql, n) ?? [];
+    i.push({
+      name: String(r),
+      definition: e[r]
+    }), Reflect.defineMetadata(w.runSql, i, n);
+  };
+}
+const _ = {
+  isSecurityEnabled(e) {
+    return Reflect.getMetadata(w.security, e) === !0;
+  },
+  getRLS(e) {
+    return Reflect.getMetadata(w.rls, e) ?? [];
+  },
+  getCLS(e) {
+    return Reflect.getMetadata(w.cls, e) ?? [];
+  },
+  getCustomSql(e) {
+    return Reflect.getMetadata(w.runSql, e) ?? [];
+  }
+}, Q = [
+  "anon",
+  "authenticated",
+  "service_role",
+  "postgres",
+  "supabase_admin",
+  "authenticator"
+], De = `
+CREATE OR REPLACE FUNCTION supaforge_create_role(target_role_name text)
+RETURNS void
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = target_role_name) THEN
+    EXECUTE format('CREATE ROLE %I', target_role_name);
+  END IF;
+
+  EXECUTE format('GRANT %I TO postgres', target_role_name);
+  
+  IF EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'authenticated') THEN
+    EXECUTE format('REVOKE authenticated FROM %I', target_role_name);
+  END IF;
+  
+  IF EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'authenticator') THEN
+    EXECUTE format('GRANT %I TO authenticator', target_role_name);
+  END IF;
+
+  EXECUTE format('GRANT USAGE ON SCHEMA public TO %I', target_role_name);
+  EXECUTE format('GRANT USAGE ON ALL SEQUENCES IN SCHEMA public TO %I', target_role_name);
+END;
+$$;
+`.trim(), de = {
+  c: "INSERT",
+  r: "SELECT",
+  u: "UPDATE",
+  d: "DELETE"
+}, F = (e) => `"${e.replace(/"/g, '""')}"`, L = (e) => `'${e.replace(/'/g, "''")}'`;
+function k(e) {
+  return Q.includes(e.toLowerCase());
+}
+function Me(e) {
+  const r = [], n = `public.${F(e.tableName)}`, i = {};
+  for (const t of e.columns)
+    for (const a of t.rules) {
+      const o = a.role;
+      Object.prototype.hasOwnProperty.call(i, o) || (i[o] = { c: /* @__PURE__ */ new Set(), r: /* @__PURE__ */ new Set(), u: /* @__PURE__ */ new Set(), d: /* @__PURE__ */ new Set() });
+      for (const l of a.permissions)
+        i[o][l].add(t.databaseName);
+    }
+  for (const [t, a] of Object.entries(i)) {
+    const o = F(t);
+    for (const [l, s] of Object.entries(a)) {
+      if (s.size === 0) continue;
+      const u = de[l];
+      if (l === "d")
+        r.push(`GRANT DELETE ON ${n} TO ${o};`);
+      else {
+        const f = Array.from(s).map(F).join(", ");
+        r.push(`GRANT ${u} (${f}) ON ${n} TO ${o};`);
+      }
+    }
+  }
+  return r;
+}
+function ke(e) {
+  const r = [], n = `public.${F(e.tableName)}`;
+  for (const i of e.policies) {
+    const { role: t, expression: a } = i.definition(), o = Array.isArray(t) ? t : [t], l = o.map(F).join(", "), s = Array.isArray(t) ? t.join("_") : t;
+    for (const u of i.crud) {
+      const f = de[u], p = F(`supaforge_${e.tableName}_${s}_${u}_${i.name}`);
+      r.push(`DROP POLICY IF EXISTS ${p} ON ${n};`);
+      const c = `CREATE POLICY ${p} ON ${n} FOR ${f} TO ${l}`;
+      let d = `(${a})`;
+      if (o.some((h) => !k(h))) {
+        const h = o.filter((A) => !k(A)).map((A) => `(pg_has_role(current_user, ${L(A)}, 'MEMBER') AND (coalesce(auth.jwt() ->> 'user_role', 'none') = ${L(A)} OR (auth.jwt() -> 'user_roles') ? ${L(A)}))`);
+        d = `((${[...o.filter((A) => k(A)).map((A) => `pg_has_role(current_user, ${L(A)}, 'MEMBER')`), ...h].join(" OR ")}) AND ${d})`;
+      }
+      u === "c" ? r.push(`${c} WITH CHECK (${d});`) : u === "u" ? r.push(`${c} USING (${d}) WITH CHECK (${d});`) : r.push(`${c} USING (${d});`);
+    }
+  }
+  return r;
+}
+function ye(e, r = {}) {
+  const { cls: n = !0, rls: i = !0 } = r, t = [];
+  t.push("-- Supaforge Security Migration"), t.push(""), t.push(De), t.push("");
+  const a = /* @__PURE__ */ new Set();
+  for (const o of e) {
+    for (const l of o.columns)
+      for (const s of l.rules)
+        k(s.role) || a.add(s.role);
+    for (const l of o.policies) {
+      const { role: s } = l.definition();
+      Array.isArray(s) ? s.forEach((u) => {
+        k(u) || a.add(u);
+      }) : k(s) || a.add(s);
+    }
+  }
+  if (a.size > 0) {
+    t.push("-- Create custom security roles");
+    for (const o of a)
+      t.push(`SELECT supaforge_create_role(${L(o)});`);
+    t.push("");
+  }
+  for (const o of e) {
+    t.push(`-- Table: ${o.tableName}`);
+    const l = `public.${F(o.tableName)}`;
+    i && o.isSecurityEnabled ? t.push(`ALTER TABLE ${l} ENABLE ROW LEVEL SECURITY;`) : i || t.push(`ALTER TABLE ${l} DISABLE ROW LEVEL SECURITY;`), n && t.push(`REVOKE ALL ON TABLE ${l} FROM anon, authenticated, public;`), t.push(`
+DO $$ DECLARE pol RECORD; 
+BEGIN 
+  FOR pol IN (
+    SELECT policyname FROM pg_policies 
+    WHERE schemaname = 'public' 
+      AND tablename = ${L(o.tableName)} 
+      AND policyname LIKE 'supaforge_%'
+  ) LOOP 
+    EXECUTE format('DROP POLICY IF EXISTS %I ON %s', pol.policyname, ${L(l)}); 
+  END LOOP; 
+END $$;`.trim()), n && t.push(...Me(o)), i && t.push(...ke(o));
+    for (const s of o.customSql)
+      t.push(`-- Custom SQL: ${s.name}`), t.push(s.definition());
+    t.push("");
+  }
+  return t.join(`
+`);
+}
+function ge(e, r, n = "-- Revert logic generally requires manual review") {
+  return [
+    'import { MigrationInterface, QueryRunner } from "typeorm";',
+    "",
+    `export class ${e} implements MigrationInterface {`,
+    `    name = '${e}'`,
+    "",
+    "    public async up(queryRunner: QueryRunner): Promise<void> {",
+    "        await queryRunner.query(`",
+    r.replace(/`/g, "\\\\`"),
+    "        `);",
+    "    }",
+    "",
+    "    public async down(queryRunner: QueryRunner): Promise<void> {",
+    "        await queryRunner.query(`",
+    n.replace(/`/g, "\\\\`"),
+    "        `);",
+    "    }",
+    "}"
+  ].join(`
+`);
+}
+/*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT */
+function he(e) {
+  return typeof e > "u" || e === null;
+}
+function Pe(e) {
+  return typeof e == "object" && e !== null;
+}
+function Ue(e) {
+  return Array.isArray(e) ? e : he(e) ? [] : [e];
+}
+function Ye(e, r) {
+  var n, i, t, a;
+  if (r)
+    for (a = Object.keys(r), n = 0, i = a.length; n < i; n += 1)
+      t = a[n], e[t] = r[t];
+  return e;
+}
+function qe(e, r) {
+  var n = "", i;
+  for (i = 0; i < r; i += 1)
+    n += e;
+  return n;
+}
+function je(e) {
+  return e === 0 && Number.NEGATIVE_INFINITY === 1 / e;
+}
+var He = he, Be = Pe, Ke = Ue, Ge = qe, Qe = je, We = Ye, $ = {
+  isNothing: He,
+  isObject: Be,
+  toArray: Ke,
+  repeat: Ge,
+  isNegativeZero: Qe,
+  extend: We
+};
+function Ee(e, r) {
+  var n = "", i = e.reason || "(unknown reason)";
+  return e.mark ? (e.mark.name && (n += 'in "' + e.mark.name + '" '), n += "(" + (e.mark.line + 1) + ":" + (e.mark.column + 1) + ")", !r && e.mark.snippet && (n += `
+
+` + e.mark.snippet), i + " " + n) : i;
+}
+function q(e, r) {
+  Error.call(this), this.name = "YAMLException", this.reason = e, this.mark = r, this.message = Ee(this, !1), Error.captureStackTrace ? Error.captureStackTrace(this, this.constructor) : this.stack = new Error().stack || "";
+}
+q.prototype = Object.create(Error.prototype);
+q.prototype.constructor = q;
+q.prototype.toString = function(r) {
+  return this.name + ": " + Ee(this, r);
+};
+var N = q, Ve = [
+  "kind",
+  "multi",
+  "resolve",
+  "construct",
+  "instanceOf",
+  "predicate",
+  "represent",
+  "representName",
+  "defaultStyle",
+  "styleAliases"
+], ze = [
+  "scalar",
+  "sequence",
+  "mapping"
+];
+function Xe(e) {
+  var r = {};
+  return e !== null && Object.keys(e).forEach(function(n) {
+    e[n].forEach(function(i) {
+      r[String(i)] = n;
+    });
+  }), r;
+}
+function Ze(e, r) {
+  if (r = r || {}, Object.keys(r).forEach(function(n) {
+    if (Ve.indexOf(n) === -1)
+      throw new N('Unknown option "' + n + '" is met in definition of "' + e + '" YAML type.');
+  }), this.options = r, this.tag = e, this.kind = r.kind || null, this.resolve = r.resolve || function() {
+    return !0;
+  }, this.construct = r.construct || function(n) {
+    return n;
+  }, this.instanceOf = r.instanceOf || null, this.predicate = r.predicate || null, this.represent = r.represent || null, this.representName = r.representName || null, this.defaultStyle = r.defaultStyle || null, this.multi = r.multi || !1, this.styleAliases = Xe(r.styleAliases || null), ze.indexOf(this.kind) === -1)
+    throw new N('Unknown kind "' + this.kind + '" is specified for "' + e + '" YAML type.');
+}
+var S = Ze;
+function re(e, r) {
+  var n = [];
+  return e[r].forEach(function(i) {
+    var t = n.length;
+    n.forEach(function(a, o) {
+      a.tag === i.tag && a.kind === i.kind && a.multi === i.multi && (t = o);
+    }), n[t] = i;
+  }), n;
+}
+function Je() {
+  var e = {
+    scalar: {},
+    sequence: {},
+    mapping: {},
+    fallback: {},
+    multi: {
+      scalar: [],
+      sequence: [],
+      mapping: [],
+      fallback: []
+    }
+  }, r, n;
+  function i(t) {
+    t.multi ? (e.multi[t.kind].push(t), e.multi.fallback.push(t)) : e[t.kind][t.tag] = e.fallback[t.tag] = t;
+  }
+  for (r = 0, n = arguments.length; r < n; r += 1)
+    arguments[r].forEach(i);
+  return e;
+}
+function W(e) {
+  return this.extend(e);
+}
+W.prototype.extend = function(r) {
+  var n = [], i = [];
+  if (r instanceof S)
+    i.push(r);
+  else if (Array.isArray(r))
+    i = i.concat(r);
+  else if (r && (Array.isArray(r.implicit) || Array.isArray(r.explicit)))
+    r.implicit && (n = n.concat(r.implicit)), r.explicit && (i = i.concat(r.explicit));
+  else
+    throw new N("Schema.extend argument should be a Type, [ Type ], or a schema definition ({ implicit: [...], explicit: [...] })");
+  n.forEach(function(a) {
+    if (!(a instanceof S))
+      throw new N("Specified list of YAML types (or a single Type object) contains a non-Type object.");
+    if (a.loadKind && a.loadKind !== "scalar")
+      throw new N("There is a non-scalar type in the implicit list of a schema. Implicit resolving of such types is not supported.");
+    if (a.multi)
+      throw new N("There is a multi type in the implicit list of a schema. Multi tags can only be listed as explicit.");
+  }), i.forEach(function(a) {
+    if (!(a instanceof S))
+      throw new N("Specified list of YAML types (or a single Type object) contains a non-Type object.");
+  });
+  var t = Object.create(W.prototype);
+  return t.implicit = (this.implicit || []).concat(n), t.explicit = (this.explicit || []).concat(i), t.compiledImplicit = re(t, "implicit"), t.compiledExplicit = re(t, "explicit"), t.compiledTypeMap = Je(t.compiledImplicit, t.compiledExplicit), t;
+};
+var er = W, rr = new S("tag:yaml.org,2002:str", {
+  kind: "scalar",
+  construct: function(e) {
+    return e !== null ? e : "";
+  }
+}), nr = new S("tag:yaml.org,2002:seq", {
+  kind: "sequence",
+  construct: function(e) {
+    return e !== null ? e : [];
+  }
+}), tr = new S("tag:yaml.org,2002:map", {
+  kind: "mapping",
+  construct: function(e) {
+    return e !== null ? e : {};
+  }
+}), ir = new er({
+  explicit: [
+    rr,
+    nr,
+    tr
+  ]
+});
+function or(e) {
+  if (e === null) return !0;
+  var r = e.length;
+  return r === 1 && e === "~" || r === 4 && (e === "null" || e === "Null" || e === "NULL");
+}
+function ar() {
+  return null;
+}
+function lr(e) {
+  return e === null;
+}
+var sr = new S("tag:yaml.org,2002:null", {
+  kind: "scalar",
+  resolve: or,
+  construct: ar,
+  predicate: lr,
+  represent: {
+    canonical: function() {
+      return "~";
+    },
+    lowercase: function() {
+      return "null";
+    },
+    uppercase: function() {
+      return "NULL";
+    },
+    camelcase: function() {
+      return "Null";
+    },
+    empty: function() {
+      return "";
+    }
+  },
+  defaultStyle: "lowercase"
+});
+function ur(e) {
+  if (e === null) return !1;
+  var r = e.length;
+  return r === 4 && (e === "true" || e === "True" || e === "TRUE") || r === 5 && (e === "false" || e === "False" || e === "FALSE");
+}
+function cr(e) {
+  return e === "true" || e === "True" || e === "TRUE";
+}
+function fr(e) {
+  return Object.prototype.toString.call(e) === "[object Boolean]";
+}
+var pr = new S("tag:yaml.org,2002:bool", {
+  kind: "scalar",
+  resolve: ur,
+  construct: cr,
+  predicate: fr,
+  represent: {
+    lowercase: function(e) {
+      return e ? "true" : "false";
+    },
+    uppercase: function(e) {
+      return e ? "TRUE" : "FALSE";
+    },
+    camelcase: function(e) {
+      return e ? "True" : "False";
+    }
+  },
+  defaultStyle: "lowercase"
+});
+function mr(e) {
+  return 48 <= e && e <= 57 || 65 <= e && e <= 70 || 97 <= e && e <= 102;
+}
+function dr(e) {
+  return 48 <= e && e <= 55;
+}
+function yr(e) {
+  return 48 <= e && e <= 57;
+}
+function gr(e) {
+  if (e === null) return !1;
+  var r = e.length, n = 0, i = !1, t;
+  if (!r) return !1;
+  if (t = e[n], (t === "-" || t === "+") && (t = e[++n]), t === "0") {
+    if (n + 1 === r) return !0;
+    if (t = e[++n], t === "b") {
+      for (n++; n < r; n++)
+        if (t = e[n], t !== "_") {
+          if (t !== "0" && t !== "1") return !1;
+          i = !0;
+        }
+      return i && t !== "_";
+    }
+    if (t === "x") {
+      for (n++; n < r; n++)
+        if (t = e[n], t !== "_") {
+          if (!mr(e.charCodeAt(n))) return !1;
+          i = !0;
+        }
+      return i && t !== "_";
+    }
+    if (t === "o") {
+      for (n++; n < r; n++)
+        if (t = e[n], t !== "_") {
+          if (!dr(e.charCodeAt(n))) return !1;
+          i = !0;
+        }
+      return i && t !== "_";
+    }
+  }
+  if (t === "_") return !1;
+  for (; n < r; n++)
+    if (t = e[n], t !== "_") {
+      if (!yr(e.charCodeAt(n)))
+        return !1;
+      i = !0;
+    }
+  return !(!i || t === "_");
+}
+function hr(e) {
+  var r = e, n = 1, i;
+  if (r.indexOf("_") !== -1 && (r = r.replace(/_/g, "")), i = r[0], (i === "-" || i === "+") && (i === "-" && (n = -1), r = r.slice(1), i = r[0]), r === "0") return 0;
+  if (i === "0") {
+    if (r[1] === "b") return n * parseInt(r.slice(2), 2);
+    if (r[1] === "x") return n * parseInt(r.slice(2), 16);
+    if (r[1] === "o") return n * parseInt(r.slice(2), 8);
+  }
+  return n * parseInt(r, 10);
+}
+function Er(e) {
+  return Object.prototype.toString.call(e) === "[object Number]" && e % 1 === 0 && !$.isNegativeZero(e);
+}
+var Sr = new S("tag:yaml.org,2002:int", {
+  kind: "scalar",
+  resolve: gr,
+  construct: hr,
+  predicate: Er,
+  represent: {
+    binary: function(e) {
+      return e >= 0 ? "0b" + e.toString(2) : "-0b" + e.toString(2).slice(1);
+    },
+    octal: function(e) {
+      return e >= 0 ? "0o" + e.toString(8) : "-0o" + e.toString(8).slice(1);
+    },
+    decimal: function(e) {
+      return e.toString(10);
+    },
+    /* eslint-disable max-len */
+    hexadecimal: function(e) {
+      return e >= 0 ? "0x" + e.toString(16).toUpperCase() : "-0x" + e.toString(16).toUpperCase().slice(1);
+    }
+  },
+  defaultStyle: "decimal",
+  styleAliases: {
+    binary: [2, "bin"],
+    octal: [8, "oct"],
+    decimal: [10, "dec"],
+    hexadecimal: [16, "hex"]
+  }
+}), xr = new RegExp(
+  // 2.5e4, 2.5 and integers
+  "^(?:[-+]?(?:[0-9][0-9_]*)(?:\\.[0-9_]*)?(?:[eE][-+]?[0-9]+)?|\\.[0-9_]+(?:[eE][-+]?[0-9]+)?|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$"
+);
+function vr(e) {
+  return !(e === null || !xr.test(e) || // Quick hack to not allow integers end with `_`
+  // Probably should update regexp & check speed
+  e[e.length - 1] === "_");
+}
+function Ar(e) {
+  var r, n;
+  return r = e.replace(/_/g, "").toLowerCase(), n = r[0] === "-" ? -1 : 1, "+-".indexOf(r[0]) >= 0 && (r = r.slice(1)), r === ".inf" ? n === 1 ? Number.POSITIVE_INFINITY : Number.NEGATIVE_INFINITY : r === ".nan" ? NaN : n * parseFloat(r, 10);
+}
+var Nr = /^[-+]?[0-9]+e/;
+function wr(e, r) {
+  var n;
+  if (isNaN(e))
+    switch (r) {
+      case "lowercase":
+        return ".nan";
+      case "uppercase":
+        return ".NAN";
+      case "camelcase":
+        return ".NaN";
+    }
+  else if (Number.POSITIVE_INFINITY === e)
+    switch (r) {
+      case "lowercase":
+        return ".inf";
+      case "uppercase":
+        return ".INF";
+      case "camelcase":
+        return ".Inf";
+    }
+  else if (Number.NEGATIVE_INFINITY === e)
+    switch (r) {
+      case "lowercase":
+        return "-.inf";
+      case "uppercase":
+        return "-.INF";
+      case "camelcase":
+        return "-.Inf";
+    }
+  else if ($.isNegativeZero(e))
+    return "-0.0";
+  return n = e.toString(10), Nr.test(n) ? n.replace("e", ".e") : n;
+}
+function Rr(e) {
+  return Object.prototype.toString.call(e) === "[object Number]" && (e % 1 !== 0 || $.isNegativeZero(e));
+}
+var Tr = new S("tag:yaml.org,2002:float", {
+  kind: "scalar",
+  resolve: vr,
+  construct: Ar,
+  predicate: Rr,
+  represent: wr,
+  defaultStyle: "lowercase"
+}), _r = ir.extend({
+  implicit: [
+    sr,
+    pr,
+    Sr,
+    Tr
+  ]
+}), Cr = _r, Se = new RegExp(
+  "^([0-9][0-9][0-9][0-9])-([0-9][0-9])-([0-9][0-9])$"
+), xe = new RegExp(
+  "^([0-9][0-9][0-9][0-9])-([0-9][0-9]?)-([0-9][0-9]?)(?:[Tt]|[ \\t]+)([0-9][0-9]?):([0-9][0-9]):([0-9][0-9])(?:\\.([0-9]*))?(?:[ \\t]*(Z|([-+])([0-9][0-9]?)(?::([0-9][0-9]))?))?$"
+);
+function Or(e) {
+  return e === null ? !1 : Se.exec(e) !== null || xe.exec(e) !== null;
+}
+function br(e) {
+  var r, n, i, t, a, o, l, s = 0, u = null, f, p, c;
+  if (r = Se.exec(e), r === null && (r = xe.exec(e)), r === null) throw new Error("Date resolve error");
+  if (n = +r[1], i = +r[2] - 1, t = +r[3], !r[4])
+    return new Date(Date.UTC(n, i, t));
+  if (a = +r[4], o = +r[5], l = +r[6], r[7]) {
+    for (s = r[7].slice(0, 3); s.length < 3; )
+      s += "0";
+    s = +s;
+  }
+  return r[9] && (f = +r[10], p = +(r[11] || 0), u = (f * 60 + p) * 6e4, r[9] === "-" && (u = -u)), c = new Date(Date.UTC(n, i, t, a, o, l, s)), u && c.setTime(c.getTime() - u), c;
+}
+function Ir(e) {
+  return e.toISOString();
+}
+var Lr = new S("tag:yaml.org,2002:timestamp", {
+  kind: "scalar",
+  resolve: Or,
+  construct: br,
+  instanceOf: Date,
+  represent: Ir
+});
+function Fr(e) {
+  return e === "<<" || e === null;
+}
+var $r = new S("tag:yaml.org,2002:merge", {
+  kind: "scalar",
+  resolve: Fr
+}), J = `ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=
+\r`;
+function Dr(e) {
+  if (e === null) return !1;
+  var r, n, i = 0, t = e.length, a = J;
+  for (n = 0; n < t; n++)
+    if (r = a.indexOf(e.charAt(n)), !(r > 64)) {
+      if (r < 0) return !1;
+      i += 6;
+    }
+  return i % 8 === 0;
+}
+function Mr(e) {
+  var r, n, i = e.replace(/[\r\n=]/g, ""), t = i.length, a = J, o = 0, l = [];
+  for (r = 0; r < t; r++)
+    r % 4 === 0 && r && (l.push(o >> 16 & 255), l.push(o >> 8 & 255), l.push(o & 255)), o = o << 6 | a.indexOf(i.charAt(r));
+  return n = t % 4 * 6, n === 0 ? (l.push(o >> 16 & 255), l.push(o >> 8 & 255), l.push(o & 255)) : n === 18 ? (l.push(o >> 10 & 255), l.push(o >> 2 & 255)) : n === 12 && l.push(o >> 4 & 255), new Uint8Array(l);
+}
+function kr(e) {
+  var r = "", n = 0, i, t, a = e.length, o = J;
+  for (i = 0; i < a; i++)
+    i % 3 === 0 && i && (r += o[n >> 18 & 63], r += o[n >> 12 & 63], r += o[n >> 6 & 63], r += o[n & 63]), n = (n << 8) + e[i];
+  return t = a % 3, t === 0 ? (r += o[n >> 18 & 63], r += o[n >> 12 & 63], r += o[n >> 6 & 63], r += o[n & 63]) : t === 2 ? (r += o[n >> 10 & 63], r += o[n >> 4 & 63], r += o[n << 2 & 63], r += o[64]) : t === 1 && (r += o[n >> 2 & 63], r += o[n << 4 & 63], r += o[64], r += o[64]), r;
+}
+function Pr(e) {
+  return Object.prototype.toString.call(e) === "[object Uint8Array]";
+}
+var Ur = new S("tag:yaml.org,2002:binary", {
+  kind: "scalar",
+  resolve: Dr,
+  construct: Mr,
+  predicate: Pr,
+  represent: kr
+}), Yr = Object.prototype.hasOwnProperty, qr = Object.prototype.toString;
+function jr(e) {
+  if (e === null) return !0;
+  var r = [], n, i, t, a, o, l = e;
+  for (n = 0, i = l.length; n < i; n += 1) {
+    if (t = l[n], o = !1, qr.call(t) !== "[object Object]") return !1;
+    for (a in t)
+      if (Yr.call(t, a))
+        if (!o) o = !0;
+        else return !1;
+    if (!o) return !1;
+    if (r.indexOf(a) === -1) r.push(a);
+    else return !1;
+  }
+  return !0;
+}
+function Hr(e) {
+  return e !== null ? e : [];
+}
+var Br = new S("tag:yaml.org,2002:omap", {
+  kind: "sequence",
+  resolve: jr,
+  construct: Hr
+}), Kr = Object.prototype.toString;
+function Gr(e) {
+  if (e === null) return !0;
+  var r, n, i, t, a, o = e;
+  for (a = new Array(o.length), r = 0, n = o.length; r < n; r += 1) {
+    if (i = o[r], Kr.call(i) !== "[object Object]" || (t = Object.keys(i), t.length !== 1)) return !1;
+    a[r] = [t[0], i[t[0]]];
+  }
+  return !0;
+}
+function Qr(e) {
+  if (e === null) return [];
+  var r, n, i, t, a, o = e;
+  for (a = new Array(o.length), r = 0, n = o.length; r < n; r += 1)
+    i = o[r], t = Object.keys(i), a[r] = [t[0], i[t[0]]];
+  return a;
+}
+var Wr = new S("tag:yaml.org,2002:pairs", {
+  kind: "sequence",
+  resolve: Gr,
+  construct: Qr
+}), Vr = Object.prototype.hasOwnProperty;
+function zr(e) {
+  if (e === null) return !0;
+  var r, n = e;
+  for (r in n)
+    if (Vr.call(n, r) && n[r] !== null)
+      return !1;
+  return !0;
+}
+function Xr(e) {
+  return e !== null ? e : {};
+}
+var Zr = new S("tag:yaml.org,2002:set", {
+  kind: "mapping",
+  resolve: zr,
+  construct: Xr
+}), Jr = Cr.extend({
+  implicit: [
+    Lr,
+    $r
+  ],
+  explicit: [
+    Ur,
+    Br,
+    Wr,
+    Zr
+  ]
+});
+function ne(e) {
+  return e === 48 ? "\0" : e === 97 ? "\x07" : e === 98 ? "\b" : e === 116 || e === 9 ? "	" : e === 110 ? `
+` : e === 118 ? "\v" : e === 102 ? "\f" : e === 114 ? "\r" : e === 101 ? "\x1B" : e === 32 ? " " : e === 34 ? '"' : e === 47 ? "/" : e === 92 ? "\\" : e === 78 ? "…" : e === 95 ? " " : e === 76 ? "\u2028" : e === 80 ? "\u2029" : "";
+}
+var en = new Array(256), rn = new Array(256);
+for (var D = 0; D < 256; D++)
+  en[D] = ne(D) ? 1 : 0, rn[D] = ne(D);
+var ve = Object.prototype.toString, Ae = Object.prototype.hasOwnProperty, ee = 65279, nn = 9, j = 10, tn = 13, on = 32, an = 33, ln = 34, V = 35, sn = 37, un = 38, cn = 39, fn = 42, Ne = 44, pn = 45, K = 58, mn = 61, dn = 62, yn = 63, gn = 64, we = 91, Re = 93, hn = 96, Te = 123, En = 124, _e = 125, x = {};
+x[0] = "\\0";
+x[7] = "\\a";
+x[8] = "\\b";
+x[9] = "\\t";
+x[10] = "\\n";
+x[11] = "\\v";
+x[12] = "\\f";
+x[13] = "\\r";
+x[27] = "\\e";
+x[34] = '\\"';
+x[92] = "\\\\";
+x[133] = "\\N";
+x[160] = "\\_";
+x[8232] = "\\L";
+x[8233] = "\\P";
+var Sn = [
+  "y",
+  "Y",
+  "yes",
+  "Yes",
+  "YES",
+  "on",
+  "On",
+  "ON",
+  "n",
+  "N",
+  "no",
+  "No",
+  "NO",
+  "off",
+  "Off",
+  "OFF"
+], xn = /^[-+]?[0-9_]+(?::[0-9_]+)+(?:\.[0-9_]*)?$/;
+function vn(e, r) {
+  var n, i, t, a, o, l, s;
+  if (r === null) return {};
+  for (n = {}, i = Object.keys(r), t = 0, a = i.length; t < a; t += 1)
+    o = i[t], l = String(r[o]), o.slice(0, 2) === "!!" && (o = "tag:yaml.org,2002:" + o.slice(2)), s = e.compiledTypeMap.fallback[o], s && Ae.call(s.styleAliases, l) && (l = s.styleAliases[l]), n[o] = l;
+  return n;
+}
+function An(e) {
+  var r, n, i;
+  if (r = e.toString(16).toUpperCase(), e <= 255)
+    n = "x", i = 2;
+  else if (e <= 65535)
+    n = "u", i = 4;
+  else if (e <= 4294967295)
+    n = "U", i = 8;
+  else
+    throw new N("code point within a string may not be greater than 0xFFFFFFFF");
+  return "\\" + n + $.repeat("0", i - r.length) + r;
+}
+var Nn = 1, H = 2;
+function wn(e) {
+  this.schema = e.schema || Jr, this.indent = Math.max(1, e.indent || 2), this.noArrayIndent = e.noArrayIndent || !1, this.skipInvalid = e.skipInvalid || !1, this.flowLevel = $.isNothing(e.flowLevel) ? -1 : e.flowLevel, this.styleMap = vn(this.schema, e.styles || null), this.sortKeys = e.sortKeys || !1, this.lineWidth = e.lineWidth || 80, this.noRefs = e.noRefs || !1, this.noCompatMode = e.noCompatMode || !1, this.condenseFlow = e.condenseFlow || !1, this.quotingType = e.quotingType === '"' ? H : Nn, this.forceQuotes = e.forceQuotes || !1, this.replacer = typeof e.replacer == "function" ? e.replacer : null, this.implicitTypes = this.schema.compiledImplicit, this.explicitTypes = this.schema.compiledExplicit, this.tag = null, this.result = "", this.duplicates = [], this.usedDuplicates = null;
+}
+function te(e, r) {
+  for (var n = $.repeat(" ", r), i = 0, t = -1, a = "", o, l = e.length; i < l; )
+    t = e.indexOf(`
+`, i), t === -1 ? (o = e.slice(i), i = l) : (o = e.slice(i, t + 1), i = t + 1), o.length && o !== `
+` && (a += n), a += o;
+  return a;
+}
+function z(e, r) {
+  return `
+` + $.repeat(" ", e.indent * r);
+}
+function Rn(e, r) {
+  var n, i, t;
+  for (n = 0, i = e.implicitTypes.length; n < i; n += 1)
+    if (t = e.implicitTypes[n], t.resolve(r))
+      return !0;
+  return !1;
+}
+function G(e) {
+  return e === on || e === nn;
+}
+function B(e) {
+  return 32 <= e && e <= 126 || 161 <= e && e <= 55295 && e !== 8232 && e !== 8233 || 57344 <= e && e <= 65533 && e !== ee || 65536 <= e && e <= 1114111;
+}
+function ie(e) {
+  return B(e) && e !== ee && e !== tn && e !== j;
+}
+function oe(e, r, n) {
+  var i = ie(e), t = i && !G(e);
+  return (
+    // ns-plain-safe
+    (n ? (
+      // c = flow-in
+      i
+    ) : i && e !== Ne && e !== we && e !== Re && e !== Te && e !== _e) && e !== V && !(r === K && !t) || ie(r) && !G(r) && e === V || r === K && t
+  );
+}
+function Tn(e) {
+  return B(e) && e !== ee && !G(e) && e !== pn && e !== yn && e !== K && e !== Ne && e !== we && e !== Re && e !== Te && e !== _e && e !== V && e !== un && e !== fn && e !== an && e !== En && e !== mn && e !== dn && e !== cn && e !== ln && e !== sn && e !== gn && e !== hn;
+}
+function _n(e) {
+  return !G(e) && e !== K;
+}
+function Y(e, r) {
+  var n = e.charCodeAt(r), i;
+  return n >= 55296 && n <= 56319 && r + 1 < e.length && (i = e.charCodeAt(r + 1), i >= 56320 && i <= 57343) ? (n - 55296) * 1024 + i - 56320 + 65536 : n;
+}
+function Ce(e) {
+  var r = /^\n* /;
+  return r.test(e);
+}
+var Oe = 1, X = 2, be = 3, Ie = 4, M = 5;
+function Cn(e, r, n, i, t, a, o, l) {
+  var s, u = 0, f = null, p = !1, c = !1, d = i !== -1, E = -1, h = Tn(Y(e, 0)) && _n(Y(e, e.length - 1));
+  if (r || o)
+    for (s = 0; s < e.length; u >= 65536 ? s += 2 : s++) {
+      if (u = Y(e, s), !B(u))
+        return M;
+      h = h && oe(u, f, l), f = u;
+    }
+  else {
+    for (s = 0; s < e.length; u >= 65536 ? s += 2 : s++) {
+      if (u = Y(e, s), u === j)
+        p = !0, d && (c = c || // Foldable line = too long, and not more-indented.
+        s - E - 1 > i && e[E + 1] !== " ", E = s);
+      else if (!B(u))
+        return M;
+      h = h && oe(u, f, l), f = u;
+    }
+    c = c || d && s - E - 1 > i && e[E + 1] !== " ";
+  }
+  return !p && !c ? h && !o && !t(e) ? Oe : a === H ? M : X : n > 9 && Ce(e) ? M : o ? a === H ? M : X : c ? Ie : be;
+}
+function On(e, r, n, i, t) {
+  e.dump = function() {
+    if (r.length === 0)
+      return e.quotingType === H ? '""' : "''";
+    if (!e.noCompatMode && (Sn.indexOf(r) !== -1 || xn.test(r)))
+      return e.quotingType === H ? '"' + r + '"' : "'" + r + "'";
+    var a = e.indent * Math.max(1, n), o = e.lineWidth === -1 ? -1 : Math.max(Math.min(e.lineWidth, 40), e.lineWidth - a), l = i || e.flowLevel > -1 && n >= e.flowLevel;
+    function s(u) {
+      return Rn(e, u);
+    }
+    switch (Cn(
+      r,
+      l,
+      e.indent,
+      o,
+      s,
+      e.quotingType,
+      e.forceQuotes && !i,
+      t
+    )) {
+      case Oe:
+        return r;
+      case X:
+        return "'" + r.replace(/'/g, "''") + "'";
+      case be:
+        return "|" + ae(r, e.indent) + le(te(r, a));
+      case Ie:
+        return ">" + ae(r, e.indent) + le(te(bn(r, o), a));
+      case M:
+        return '"' + In(r) + '"';
+      default:
+        throw new N("impossible error: invalid scalar style");
+    }
+  }();
+}
+function ae(e, r) {
+  var n = Ce(e) ? String(r) : "", i = e[e.length - 1] === `
+`, t = i && (e[e.length - 2] === `
+` || e === `
+`), a = t ? "+" : i ? "" : "-";
+  return n + a + `
+`;
+}
+function le(e) {
+  return e[e.length - 1] === `
+` ? e.slice(0, -1) : e;
+}
+function bn(e, r) {
+  for (var n = /(\n+)([^\n]*)/g, i = function() {
+    var u = e.indexOf(`
+`);
+    return u = u !== -1 ? u : e.length, n.lastIndex = u, se(e.slice(0, u), r);
+  }(), t = e[0] === `
+` || e[0] === " ", a, o; o = n.exec(e); ) {
+    var l = o[1], s = o[2];
+    a = s[0] === " ", i += l + (!t && !a && s !== "" ? `
+` : "") + se(s, r), t = a;
+  }
+  return i;
+}
+function se(e, r) {
+  if (e === "" || e[0] === " ") return e;
+  for (var n = / [^ ]/g, i, t = 0, a, o = 0, l = 0, s = ""; i = n.exec(e); )
+    l = i.index, l - t > r && (a = o > t ? o : l, s += `
+` + e.slice(t, a), t = a + 1), o = l;
+  return s += `
+`, e.length - t > r && o > t ? s += e.slice(t, o) + `
+` + e.slice(o + 1) : s += e.slice(t), s.slice(1);
+}
+function In(e) {
+  for (var r = "", n = 0, i, t = 0; t < e.length; n >= 65536 ? t += 2 : t++)
+    n = Y(e, t), i = x[n], !i && B(n) ? (r += e[t], n >= 65536 && (r += e[t + 1])) : r += i || An(n);
+  return r;
+}
+function Ln(e, r, n) {
+  var i = "", t = e.tag, a, o, l;
+  for (a = 0, o = n.length; a < o; a += 1)
+    l = n[a], e.replacer && (l = e.replacer.call(n, String(a), l)), (R(e, r, l, !1, !1) || typeof l > "u" && R(e, r, null, !1, !1)) && (i !== "" && (i += "," + (e.condenseFlow ? "" : " ")), i += e.dump);
+  e.tag = t, e.dump = "[" + i + "]";
+}
+function ue(e, r, n, i) {
+  var t = "", a = e.tag, o, l, s;
+  for (o = 0, l = n.length; o < l; o += 1)
+    s = n[o], e.replacer && (s = e.replacer.call(n, String(o), s)), (R(e, r + 1, s, !0, !0, !1, !0) || typeof s > "u" && R(e, r + 1, null, !0, !0, !1, !0)) && ((!i || t !== "") && (t += z(e, r)), e.dump && j === e.dump.charCodeAt(0) ? t += "-" : t += "- ", t += e.dump);
+  e.tag = a, e.dump = t || "[]";
+}
+function Fn(e, r, n) {
+  var i = "", t = e.tag, a = Object.keys(n), o, l, s, u, f;
+  for (o = 0, l = a.length; o < l; o += 1)
+    f = "", i !== "" && (f += ", "), e.condenseFlow && (f += '"'), s = a[o], u = n[s], e.replacer && (u = e.replacer.call(n, s, u)), R(e, r, s, !1, !1) && (e.dump.length > 1024 && (f += "? "), f += e.dump + (e.condenseFlow ? '"' : "") + ":" + (e.condenseFlow ? "" : " "), R(e, r, u, !1, !1) && (f += e.dump, i += f));
+  e.tag = t, e.dump = "{" + i + "}";
+}
+function $n(e, r, n, i) {
+  var t = "", a = e.tag, o = Object.keys(n), l, s, u, f, p, c;
+  if (e.sortKeys === !0)
+    o.sort();
+  else if (typeof e.sortKeys == "function")
+    o.sort(e.sortKeys);
+  else if (e.sortKeys)
+    throw new N("sortKeys must be a boolean or a function");
+  for (l = 0, s = o.length; l < s; l += 1)
+    c = "", (!i || t !== "") && (c += z(e, r)), u = o[l], f = n[u], e.replacer && (f = e.replacer.call(n, u, f)), R(e, r + 1, u, !0, !0, !0) && (p = e.tag !== null && e.tag !== "?" || e.dump && e.dump.length > 1024, p && (e.dump && j === e.dump.charCodeAt(0) ? c += "?" : c += "? "), c += e.dump, p && (c += z(e, r)), R(e, r + 1, f, !0, p) && (e.dump && j === e.dump.charCodeAt(0) ? c += ":" : c += ": ", c += e.dump, t += c));
+  e.tag = a, e.dump = t || "{}";
+}
+function ce(e, r, n) {
+  var i, t, a, o, l, s;
+  for (t = n ? e.explicitTypes : e.implicitTypes, a = 0, o = t.length; a < o; a += 1)
+    if (l = t[a], (l.instanceOf || l.predicate) && (!l.instanceOf || typeof r == "object" && r instanceof l.instanceOf) && (!l.predicate || l.predicate(r))) {
+      if (n ? l.multi && l.representName ? e.tag = l.representName(r) : e.tag = l.tag : e.tag = "?", l.represent) {
+        if (s = e.styleMap[l.tag] || l.defaultStyle, ve.call(l.represent) === "[object Function]")
+          i = l.represent(r, s);
+        else if (Ae.call(l.represent, s))
+          i = l.represent[s](r, s);
+        else
+          throw new N("!<" + l.tag + '> tag resolver accepts not "' + s + '" style');
+        e.dump = i;
+      }
+      return !0;
+    }
+  return !1;
+}
+function R(e, r, n, i, t, a, o) {
+  e.tag = null, e.dump = n, ce(e, n, !1) || ce(e, n, !0);
+  var l = ve.call(e.dump), s = i, u;
+  i && (i = e.flowLevel < 0 || e.flowLevel > r);
+  var f = l === "[object Object]" || l === "[object Array]", p, c;
+  if (f && (p = e.duplicates.indexOf(n), c = p !== -1), (e.tag !== null && e.tag !== "?" || c || e.indent !== 2 && r > 0) && (t = !1), c && e.usedDuplicates[p])
+    e.dump = "*ref_" + p;
+  else {
+    if (f && c && !e.usedDuplicates[p] && (e.usedDuplicates[p] = !0), l === "[object Object]")
+      i && Object.keys(e.dump).length !== 0 ? ($n(e, r, e.dump, t), c && (e.dump = "&ref_" + p + e.dump)) : (Fn(e, r, e.dump), c && (e.dump = "&ref_" + p + " " + e.dump));
+    else if (l === "[object Array]")
+      i && e.dump.length !== 0 ? (e.noArrayIndent && !o && r > 0 ? ue(e, r - 1, e.dump, t) : ue(e, r, e.dump, t), c && (e.dump = "&ref_" + p + e.dump)) : (Ln(e, r, e.dump), c && (e.dump = "&ref_" + p + " " + e.dump));
+    else if (l === "[object String]")
+      e.tag !== "?" && On(e, e.dump, r, a, s);
+    else {
+      if (l === "[object Undefined]")
+        return !1;
+      if (e.skipInvalid) return !1;
+      throw new N("unacceptable kind of an object to dump " + l);
+    }
+    e.tag !== null && e.tag !== "?" && (u = encodeURI(
+      e.tag[0] === "!" ? e.tag.slice(1) : e.tag
+    ).replace(/!/g, "%21"), e.tag[0] === "!" ? u = "!" + u : u.slice(0, 18) === "tag:yaml.org,2002:" ? u = "!!" + u.slice(18) : u = "!<" + u + ">", e.dump = u + " " + e.dump);
+  }
+  return !0;
+}
+function Dn(e, r) {
+  var n = [], i = [], t, a;
+  for (Z(e, n, i), t = 0, a = i.length; t < a; t += 1)
+    r.duplicates.push(n[i[t]]);
+  r.usedDuplicates = new Array(a);
+}
+function Z(e, r, n) {
+  var i, t, a;
+  if (e !== null && typeof e == "object")
+    if (t = r.indexOf(e), t !== -1)
+      n.indexOf(t) === -1 && n.push(t);
+    else if (r.push(e), Array.isArray(e))
+      for (t = 0, a = e.length; t < a; t += 1)
+        Z(e[t], r, n);
+    else
+      for (i = Object.keys(e), t = 0, a = i.length; t < a; t += 1)
+        Z(e[i[t]], r, n);
+}
+function Mn(e, r) {
+  r = r || {};
+  var n = new wn(r);
+  n.noRefs || Dn(e, n);
+  var i = e;
+  return n.replacer && (i = n.replacer.call({ "": i }, "", i)), R(n, 0, i, !0, !0) ? n.dump + `
+` : "";
+}
+var kn = Mn, Pn = {
+  dump: kn
+}, Un = Pn.dump;
+function Yn(e) {
+  const r = [];
+  for (const n of e.entityMetadatas) {
+    if (typeof n.target == "string") continue;
+    const i = n.target, t = _.isSecurityEnabled(i), a = _.getRLS(i), o = _.getCLS(i), l = _.getCustomSql(i);
+    if (!t && (a.length > 0 || o.length > 0)) {
+      console.warn(y.yellow(`${n.name}: Found Security decorators (@rls / @cls) but missing @security class decorator. Skipping.`));
+      continue;
+    }
+    if (!t && l.length === 0) continue;
+    const s = o.map((u) => {
+      const f = n.columns.find((c) => c.propertyName === u.propertyKey);
+      if (f)
+        return { ...u, databaseName: f.databaseName };
+      const p = n.relations.find((c) => c.propertyName === u.propertyKey);
+      if (p) {
+        if (p.joinColumns.length > 0)
+          return { ...u, databaseName: p.joinColumns[0].databaseName };
+        const c = n.columns.find((d) => d.relationMetadata === p);
+        if (c)
+          return { ...u, databaseName: c.databaseName };
+      }
+      throw console.error(y.red(`
+[supaforge debug] Property ${n.name}.${u.propertyKey} not found.`)), console.error(y.gray(`Available columns: ${n.columns.map((c) => c.propertyName).join(", ")}`)), console.error(y.gray(`Available relations: ${n.relations.map((c) => c.propertyName).join(", ")}`)), new Error(`Internal Sync Error: Database column not found for property ${n.name}.${u.propertyKey}`);
+    });
+    r.push({
+      tableName: n.tableName,
+      entityName: n.name,
+      policies: a,
+      columns: s,
+      customSql: l,
+      isSecurityEnabled: t
+    });
+  }
+  return r;
+}
+async function Le(e) {
+  const r = [];
+  if (!g.existsSync(e))
+    throw new Error(`Cannot load entities. Path does not exist: ${e}`);
+  const i = g.statSync(e).isDirectory() ? g.readdirSync(e).filter((t) => t.endsWith(".ts") || t.endsWith(".js")).map((t) => C.join(e, t)) : [e];
+  for (const t of i)
+    try {
+      const a = await import(t);
+      for (const o of Object.values(a))
+        typeof o == "function" && o.name && r.push(o);
+    } catch {
+      console.warn(y.red(`Could not import entity file ${t}. Skipped.`));
+    }
+  return r;
+}
+function qn(e) {
+  if (!g.existsSync(e)) return null;
+  const n = g.readdirSync(e).map((i) => {
+    const t = i.match(/^(\d+)-(.+)\.ts$/);
+    return t && !i.toLowerCase().includes("_sec") ? {
+      timestamp: t[1],
+      name: t[2],
+      filename: i
+    } : null;
+  }).filter((i) => i !== null).sort((i, t) => Number(t.timestamp) - Number(i.timestamp));
+  return n.length > 0 ? { timestamp: n[0].timestamp, name: n[0].name } : null;
+}
+async function Xn(e) {
+  const { entityPath: r, outputDir: n, dbConfig: i } = e, t = C.resolve(r);
+  console.log(y.cyan("Syncing security..."));
+  const a = await Le(t);
+  if (a.length === 0)
+    return console.info(y.yellow(`No entities found at ${t}`)), "";
+  const o = new pe({
+    type: "postgres",
+    ...i,
+    username: i.user,
+    synchronize: !!e.syncSchema,
+    entities: a,
+    logging: !1
+  });
+  await o.initialize(), e.syncSchema && (console.log(y.gray("Synchronizing schema...")), await o.synchronize());
+  try {
+    const l = Yn(o);
+    if (l.length === 0)
+      return console.info(y.green("No security decorators found.")), "";
+    const s = ye(l, { cls: e.cls, rls: e.rls }), u = qn(n), f = u ? u.timestamp : String(Date.now()), c = `${e.migrationName || (u ? u.name : "SecuritySync")}_sec`.replace(/_sec_sec$/, "_sec"), d = `${c}${f}`, E = `${f}-${c}`;
+    g.existsSync(n) || g.mkdirSync(n, { recursive: !0 });
+    const h = C.join(n, `${E}.ts`), v = C.join(n, `${E}.sql`), O = ge(d, s);
+    return g.writeFileSync(h, O), g.writeFileSync(v, s), console.log(y.green("Migration artifacts generated:")), console.log(y.gray(`   TS  -> ${h}`)), console.log(y.gray(`   SQL -> ${v}`)), s;
+  } finally {
+    await o.destroy();
+  }
+}
+function Zn(e) {
+  const { outputDir: r, migrationName: n = "ManualMigration" } = e;
+  g.existsSync(r) || g.mkdirSync(r, { recursive: !0 });
+  const i = String(Date.now()), t = `${n}${i}`, a = C.join(r, `${i}-${n}.ts`), o = ge(t, "-- Manual migration (Up)", "-- Manual migration (Down)");
+  g.writeFileSync(a, o), console.log(y.green(`Blank migration stub ready at ${a}`));
+}
+async function Jn(e, r, n, i, t = []) {
+  const a = Array.isArray(r) ? r : [r], o = a[0];
+  await e.query("RESET ROLE"), await e.query("BEGIN");
+  try {
+    if (o !== "postgres" && o !== "supabase_admin") {
+      const u = a.every((v) => Q.includes(v.toLowerCase())), f = a.length === 1 && !u ? a[0] : null, p = a.filter((v) => !Q.includes(v.toLowerCase())), c = { sub: n, role: u ? a[0] : "authenticated" };
+      f && (c.user_role = f), p.length > 0 && (c.user_roles = p);
+      const E = JSON.stringify(c).replace(/'/g, "''"), h = n.replace(/'/g, "''");
+      if (await e.query(`SET LOCAL request.jwt.claims = '${E}'`), await e.query(`SELECT set_config('request.jwt.claim.sub', '${h}', true)`), a.length === 1)
+        await e.query(`SET LOCAL ROLE ${a[0]}`);
+      else {
+        const v = `supaforge_session_${Math.random().toString(36).substring(7)}`;
+        await e.query(`CREATE ROLE ${v} NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT`);
+        for (const O of a)
+          await e.query(`GRANT ${O} TO ${v}`);
+        await e.query(`SET LOCAL ROLE ${v}`);
+      }
+    }
+    const l = await e.query(i, t);
+    if (await e.query("COMMIT"), Array.isArray(l) && l.length > 0 && Array.isArray(l[0]))
+      return l[0];
+    const s = l;
+    return s != null && s.rows ? s.rows : Array.isArray(l) ? l : [];
+  } catch (l) {
+    throw await e.query("ROLLBACK"), l;
+  } finally {
+    await e.query("RESET ROLE");
+  }
+}
+async function et(e) {
+  const { outputDir: r, dbConfig: n } = e;
+  if (!g.existsSync(r)) {
+    console.warn(y.yellow(`Migration directory not found: ${r}`));
+    return;
+  }
+  const i = g.readdirSync(r).filter((a) => a.endsWith("_sec.sql")).sort((a, o) => a.localeCompare(o));
+  if (i.length === 0) {
+    console.info(y.blue("No migrations found to apply."));
+    return;
+  }
+  console.log(y.cyan("Applying migrations..."));
+  const t = new $e(n);
+  await t.connect();
+  try {
+    for (const a of i) {
+      const o = C.join(r, a);
+      console.log(y.gray(`Applying ${a}...`));
+      const l = g.readFileSync(o, "utf8");
+      await t.query(l);
+    }
+    console.log(y.green(`
+Successfully applied ${String(i.length)} migration(s).`));
+  } catch (a) {
+    const o = a instanceof Error ? a.message : String(a);
+    throw console.error(y.red(`
+Migration Execution Fault: ${o}`)), a;
+  } finally {
+    await t.end();
+  }
+}
+async function rt(e) {
+  const { entityPath: r, outputDir: n, dbConfig: i } = e, t = C.resolve(r);
+  console.log(y.cyan("Generating documentation..."));
+  const a = await Le(t);
+  if (a.length === 0) {
+    console.info(y.yellow(`No entities found at ${t}`));
+    return;
+  }
+  const o = new pe({
+    type: "postgres",
+    ...i,
+    username: i.user,
+    synchronize: !1,
+    entities: a,
+    logging: !1
+  });
+  await o.initialize();
+  try {
+    const l = e.rls !== !1, s = e.cls !== !1, f = {
+      documentation: `
+Supaforge Documentation and Rules:
+
+1. PROHIBITED: SELECT (*) USAGE
+   - SELECT (*) is strictly forbidden across the framework. 
+   - Reason: Column Level Security (CLS) revokes all public access by default. Accessing an unauthorized column triggers a Database Error.
+   - Requirement: You must explicitly specify columns in your queries (e.g., SELECT id, name).
+
+2. RLS (Row Level Security) Status: ${l ? "ACTIVE" : "PASSIVE"}
+   - ${l ? "ACTIVE: PostgreSQL filters every row based on JWT claims (role, sub/id). Users only see authorized data." : "PASSIVE: The table is open to all roles with table-level access. HIGH SECURITY RISK."}
+
+3. CLS (Column Level Security) Status: ${s ? "ACTIVE" : "PASSIVE"}
+   - ${s ? "ACTIVE: Operates on a 'Zero-Trust' model. All access is revoked, then selectively granted via @CLS tags found in the 'columns' section." : "PASSIVE: Standard PostgreSQL column permissions apply."}
+
+4. JSON Attributes Explanation:
+   - 'columns': Reflects TypeORM metadata and @cls rules (Role-based permissions).
+   - 'rls': Lists @rls rules with their SQL 'USING' or 'CHECK' expressions.
+   - 'runSql': Displays custom SQL for Triggers, Functions, or Hooks defined via @runSql.
+   - 'securitySql': The final, raw PostgreSQL code generated to implement the above security posture.
+    `.trim(),
+      entities: [],
+      generatedAt: "Deterministic output for stability"
+    };
+    for (const d of o.entityMetadatas) {
+      if (typeof d.target == "string") continue;
+      const E = d.target, h = _.isSecurityEnabled(E), v = _.getRLS(E), O = _.getCLS(E), A = _.getCustomSql(E), P = {
+        entityName: d.name,
+        tableName: d.tableName,
+        isSecurityEnabled: h,
+        columns: [],
+        rls: [],
+        runSql: [],
+        checks: d.checks.map((m) => ({ name: m.name || "", expression: m.expression || "" })),
+        securitySql: ""
+        // Will be calculated below
+      }, Fe = {
+        tableName: d.tableName,
+        entityName: d.name,
+        policies: v,
+        columns: O.map((m) => {
+          const T = d.columns.find((b) => b.propertyName === m.propertyKey);
+          if (T) return { ...m, databaseName: T.databaseName };
+          const U = d.relations.find((b) => b.propertyName === m.propertyKey);
+          return U && U.joinColumns.length > 0 ? { ...m, databaseName: U.joinColumns[0].databaseName } : { ...m, databaseName: m.propertyKey };
+        }),
+        customSql: A,
+        isSecurityEnabled: h
+      };
+      P.securitySql = ye([Fe], e);
+      for (const m of d.columns) {
+        const T = O.find((b) => b.propertyKey === m.propertyName), U = {
+          name: m.propertyName,
+          databaseName: m.databaseName,
+          type: String(m.type),
+          isText: m.type === "text" || m.type === String || typeof m.type == "string" && m.type.toLowerCase().includes("char"),
+          length: m.length,
+          isUnique: d.uniques.some((b) => b.columns.includes(m)),
+          isNullable: m.isNullable,
+          isPrimary: m.isPrimary,
+          cls: T ? T.rules : []
+        };
+        P.columns.push(U);
+      }
+      for (const m of v) {
+        const T = m.definition();
+        P.rls.push({
+          name: m.name,
+          crud: m.crud,
+          role: T.role,
+          expression: T.expression
+        });
+      }
+      for (const m of A)
+        P.runSql.push({
+          name: m.name,
+          sql: m.definition()
+        });
+      f.entities.push(P);
+    }
+    g.existsSync(n) || g.mkdirSync(n, { recursive: !0 });
+    const p = C.join(n, "supaforge-docs.yaml"), c = Un(f, {
+      noRefs: !0,
+      lineWidth: -1,
+      // No line wrap to keep SQL readable
+      styles: {
+        str: "folded"
+        // Better for multi-line SQL
+      }
+    });
+    g.writeFileSync(p, c), console.log(y.green("Documentation generated successfully:")), console.log(y.gray(`   YAML -> ${p}`));
+  } finally {
+    await o.destroy();
+  }
+}
+function nt(e = process.argv) {
+  const r = e, n = () => {
+    const a = r.indexOf("--name");
+    return a > -1 && r[a + 1] ? r[a + 1] : void 0;
+  }, i = r.includes("--sync") || r.includes("--temp");
+  return {
+    apply: r.includes("--apply"),
+    syncSchema: i,
+    migrationName: n()
+  };
+}
+const fe = ["c", "r", "u", "d"], tt = I.string().transform((e) => {
+  const n = e.toLowerCase().trim().split(""), i = n.filter((t) => !fe.includes(t));
+  if (i.length > 0)
+    throw new Error(`Invalid permission flag(s): ${i.join(", ")}. Allowed flags: ${fe.join(", ")}.`);
+  return [...new Set(n)];
+}), it = I.object({
+  host: I.string().optional().default("localhost"),
+  port: I.number().int().optional().default(5432),
+  user: I.string().optional().default("postgres"),
+  password: I.string().optional().default("postgres"),
+  database: I.string().optional().default("postgres")
+});
+export {
+  fe as CRUD_OPS,
+  it as DbConfigSchema,
+  tt as PermissionsSchema,
+  et as applyGeneratedMigrations,
+  ge as buildMigrationFile,
+  ye as buildSecuritySql,
+  Vn as cls,
+  Zn as createMigrationTemplate,
+  nt as extractCliOptions,
+  rt as generateDocumentation,
+  Yn as introspectEntities,
+  _ as registry,
+  Wn as rls,
+  Jn as runAsRole,
+  zn as runSql,
+  Xn as runSupaforge,
+  Qn as security
+};