Grant Script Endpoint

Return the minimal-privilege psql script the customer should run on their source PostgreSQL to grant the replication user the access pgstream needs.

Output shape (idempotent — same connector + same selection => same script): { "sql": "...complete psql artifact...", "source_provider": "rds" | "supabase" | "cloudsql" | "vanilla" | ..., "replication_username": "<the username on the connector>", "schemas_per_database": {"<db>": ["<schema>", ...], ...} }

The SQL covers (per ARD-1051):

• the replication role attribute (provider-specific line),
• GRANT CONNECT + GRANT CREATE per database (so pgstream can CREATE PUBLICATION and its bookkeeping schema),
• GRANT USAGE + SELECT on tables and sequences per schema,
• ALTER DEFAULT PRIVILEGES for both TABLES and SEQUENCES so objects added to source AFTER the grants run also replicate.

Errors:

• 404 — connector not found / no RLS access.
• 422 — connector is not a PostgreSQL service, discovery has not run, no schemas selected, or connection_details is missing the username field. The detail string names the exact next step.
• 500 — Key Vault decryption failed.

Note for RDS sources: this endpoint emits the GRANT line; the rds.logical_replication parameter still has to be set to 1 in the cluster's parameter group and the instance restarted before logical replication will work. The grant-script comment header reminds the customer.