@rebasepro/server-postgres 0.10.0 → 0.10.1-canary.14e53ae

package/dist/PostgresBootstrapper.d.ts

@@ -26,9 +26,13 @@ export interface PostgresDriverConfig {
      */
     introspectionSchema?: string;
     /**
-     * Realtime options. Currently only channel retention, which is opt-in:
-     * without rules here no channel keeps any history and broadcast stays
-     * fire-and-forget. See {@link ChannelRetentionRule}.
+     * Realtime options, both opt-in:
+     *
+     *  - `channels` — retention. Without rules no channel keeps any history and
+     *    broadcast stays fire-and-forget. See {@link ChannelRetentionRule}.
+     *  - `bus` — the cross-instance transport for channel broadcast and
+     *    presence. Defaults to in-process only, which is correct for a single
+     *    instance and wrong for two. See {@link ChannelBusConfig}.
      */
     realtime?: RealtimeChannelsConfig;
 }

package/dist/auth/services.d.ts

@@ -1,6 +1,6 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { RebasePgTable } from "../types";
-import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server";
+import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, RefreshTokenSession, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server";
 export type { Role };
 export interface AuthSchemaTables {
     users: RebasePgTable;
@@ -90,9 +90,38 @@ export declare class UserService implements UserRepository {
 export declare class RefreshTokenService {
     private db;
     private refreshTokensTable;
+    private usersTable;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
-    createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    /**
+     * Whether the table actually carries a column, so a host application that
+     * supplied its own `refresh_tokens` table — one that predates session
+     * grouping — degrades instead of throwing on every sign-in.
+     */
+    private has;
+    private col;
+    /** The columns to read back, narrowed to the ones this table has. */
+    private selection;
+    createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
     findByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
+    /**
+     * Record that a token was rotated away, keeping the row.
+     *
+     * The row is what lets `/auth/refresh` distinguish "you already used this,
+     * here is a fresh one" from "no idea what this is". Deleting it — which is
+     * what this used to do — collapsed both into a 401 and signed the user out
+     * for the crime of losing a response.
+     */
+    markRotated(tokenHash: string): Promise<void>;
+    /** Final kill of one sign-in: logout, or revoking a device remotely. */
+    revokeSession(sessionId: string): Promise<void>;
+    /**
+     * Housekeeping: rotation would otherwise leave a row per refresh forever.
+     * Superseded rows are only needed for as long as a straggler might still
+     * present them, and expired ones are dead weight everywhere.
+     */
+    prune(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    getTokensValidAfter(uid: string): Promise<Date | null>;
+    setTokensValidAfter(uid: string, at: Date): Promise<void>;
     deleteByHash(tokenHash: string): Promise<void>;
     deleteAllForUser(uid: string): Promise<void>;
     listForUser(uid: string): Promise<RefreshTokenInfo[]>;
@@ -153,7 +182,12 @@ export declare class PostgresTokenRepository implements TokenRepository {
     private passwordResetTokenService;
     private magicLinkTokenService;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
-    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
+    markRefreshTokenRotated(tokenHash: string): Promise<void>;
+    revokeRefreshTokenSession(sessionId: string): Promise<void>;
+    pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    getTokensValidAfter(uid: string): Promise<Date | null>;
+    setTokensValidAfter(uid: string, at: Date): Promise<void>;
     findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
     deleteRefreshToken(tokenHash: string): Promise<void>;
     deleteAllRefreshTokensForUser(uid: string): Promise<void>;
@@ -205,7 +239,12 @@ export declare class PostgresAuthRepository implements AuthRepository {
     createRole(_data: CreateRoleData): Promise<RoleData>;
     updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
     deleteRole(_id: string): Promise<void>;
-    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
+    markRefreshTokenRotated(tokenHash: string): Promise<void>;
+    revokeRefreshTokenSession(sessionId: string): Promise<void>;
+    pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    getTokensValidAfter(uid: string): Promise<Date | null>;
+    setTokensValidAfter(uid: string, at: Date): Promise<void>;
     findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
     deleteRefreshToken(tokenHash: string): Promise<void>;
     deleteAllRefreshTokensForUser(uid: string): Promise<void>;

package/dist/backup/backup-logic.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Replay a `pg_dumpall --globals-only` script one statement at a time,
+ * tolerating per-statement failures. On a same-cluster restore the roles
+ * usually already exist (`CREATE ROLE` → "already exists") and on a managed
+ * provider an `ALTER ROLE <superuser>` may be refused; neither should abort
+ * recreation of the roles that *are* missing. Returns how many statements
+ * applied vs were skipped.
+ *
+ * `runStatement` executes one SQL statement and rejects on error.
+ */
+export declare function applyGlobalsWith(runStatement: (sql: string) => Promise<void>, globalsSql: string, log?: (message: string) => void): Promise<{
+    applied: number;
+    skipped: number;
+}>;
+/**
+ * Delete each pruned dump together with its `.globals.sql` roles sidecar, so
+ * pruning never orphans the roles file. The sidecar is best-effort — older
+ * backups predate it, so a missing-sidecar failure is swallowed while a
+ * failure deleting the dump itself propagates.
+ *
+ * `deleteObject` removes one key and rejects if it cannot (e.g. not found).
+ */
+export declare function pruneWith(keys: string[], deleteObject: (key: string) => Promise<void>): Promise<void>;

package/dist/backup/backup-service.d.ts

@@ -5,8 +5,8 @@ export declare class BackupToolError extends Error {
     readonly hint?: string | undefined;
     constructor(message: string, hint?: string | undefined);
 }
-/** Locate `pg_dump` / `pg_restore`, honouring an env override. */
-export declare function resolvePgBinary(tool: "pg_dump" | "pg_restore", env?: Record<string, string | undefined>): string | null;
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
+export declare function resolvePgBinary(tool: "pg_dump" | "pg_restore" | "pg_dumpall", env?: Record<string, string | undefined>): string | null;
 /** Run `<bin> --version` and extract the major version. */
 export declare function detectToolMajor(bin: string): Promise<number | null>;
 /** Query the server for its major version via `server_version_num`. */
@@ -27,11 +27,22 @@ export interface BackupResult {
     localFile: string;
     fileName: string;
     sizeBytes: number;
+    /**
+     * Absolute path of the `.globals.sql` sidecar holding cluster-wide roles
+     * (present unless globals capture was disabled or unavailable).
+     */
+    globalsFile?: string;
+    globalsSizeBytes?: number;
 }
 /**
  * Produce a custom-format dump on local disk. When `outDir` is omitted the
  * file is written to the OS temp directory (used by the upload path, which
  * cleans it up afterwards).
+ *
+ * Alongside the `-Fc` dump it writes a `<name>.globals.sql` sidecar via
+ * `pg_dumpall --globals-only` so the roles the dump's GRANT/RLS statements
+ * depend on can be recreated on restore. Set `includeGlobals: false` to skip
+ * it (e.g. when the caller has no privilege to read cluster globals).
  */
 export declare function createDump(opts: {
     connectionString: string;
@@ -41,19 +52,50 @@ export declare function createDump(opts: {
     excludeSchemas?: string[];
     noOwner?: boolean;
     inheritStdio?: boolean;
+    includeGlobals?: boolean;
     env?: Record<string, string | undefined>;
 }): Promise<BackupResult>;
+/**
+ * Cheap integrity check on a freshly written dump: it must be non-empty and
+ * `pg_restore --list` must parse its table of contents without error. Used
+ * before pruning older backups so a corrupt-but-exit-0 dump never becomes
+ * the reason the last good backup is deleted.
+ */
+export declare function validateDump(localFile: string, env?: Record<string, string | undefined>): Promise<{
+    ok: boolean;
+    reason?: string;
+}>;
+/**
+ * Replay a `pg_dumpall --globals-only` script to recreate cluster roles
+ * before a restore, so the dump's GRANT/RLS statements (which reference
+ * `rebase_user` and any owner roles) actually apply. Runs statement by
+ * statement and tolerates per-statement failures — on a same-cluster restore
+ * the roles usually already exist (`CREATE ROLE` → "already exists"), and on
+ * a managed provider an `ALTER ROLE <superuser>` may be refused; neither
+ * should abort role recreation. Returns how many statements applied vs were
+ * skipped.
+ */
+export declare function applyGlobals(connectionString: string, globalsSql: string, log?: (message: string) => void): Promise<{
+    applied: number;
+    skipped: number;
+}>;
 /**
  * Restore a custom-format dump into the database named by
  * `connectionString`. Destructive when `clean` is set (drops objects
  * first). Never called automatically — the CLI gates it behind explicit
  * confirmation.
+ *
+ * Runs with `--exit-on-error` by default: a restore that logs-and-continues
+ * past a failed GRANT (because a role was missing) reports success with RLS
+ * un-enforced. Callers should recreate roles first (see {@link applyGlobals})
+ * and only set `exitOnError: false` deliberately.
  */
 export declare function restoreDump(opts: {
     connectionString: string;
     inputFile: string;
     clean?: boolean;
     noOwner?: boolean;
+    exitOnError?: boolean;
     inheritStdio?: boolean;
     env?: Record<string, string | undefined>;
 }): Promise<void>;

package/dist/backup/pg-tools.d.ts

@@ -99,10 +99,50 @@ export declare function buildPgRestoreArgs(opts: {
     inputFile: string;
     /** Drop objects before recreating them (destructive but idempotent). */
     clean?: boolean;
-    /** Continue past individual errors instead of aborting. */
+    /**
+     * Abort on the first error instead of logging and continuing. Defaults
+     * ON: a restore that silently skips failed GRANT/RLS statements (because
+     * a role is missing) "succeeds" with RLS un-enforced — a security hole.
+     * Fail loudly instead so the operator knows the restore is incomplete.
+     */
     exitOnError?: boolean;
     noOwner?: boolean;
 }): string[];
+/**
+ * Assemble the `pg_restore --list` argument vector. Reading a dump's table
+ * of contents parses the whole archive without touching a database, so it is
+ * a cheap integrity check that the file isn't truncated or corrupt.
+ */
+export declare function buildPgRestoreListArgs(inputFile: string): string[];
+/**
+ * Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other
+ * cluster-wide objects) live outside any single database, so a per-database
+ * `pg_dump` omits them. Without the `rebase_user` role the RLS GRANT
+ * statements in the main dump fail on restore and RLS is silently lost — so
+ * every backup captures the globals into a sidecar `.globals.sql`.
+ *
+ * `--no-role-passwords` keeps role secrets out of the artifact (backups may
+ * be shipped off-box); roles are recreated password-less and re-secured by
+ * the operator.
+ */
+export declare function buildPgDumpallGlobalsArgs(opts: {
+    connectionString: string;
+    outFile: string;
+}): string[];
+/**
+ * Derive the globals sidecar path/key for a given `.dump` file. Keeps the
+ * two artifacts adjacent so listing, uploading and pruning can find one from
+ * the other. A name that doesn't end in `.dump` is returned unchanged with a
+ * `.globals.sql` suffix appended.
+ */
+export declare function globalsFileForDump(dumpPath: string): string;
+/**
+ * Split a `pg_dumpall --globals-only` script into individual statements.
+ * Used when replaying globals on restore so each `CREATE ROLE` / `GRANT`
+ * can run independently and a benign "role already exists" on one doesn't
+ * abort the rest. Drops `--` comment lines and blank statements.
+ */
+export declare function splitGlobalsStatements(sql: string): string[];
 /**
  * Resolve the Postgres connection string the backup commands should use,
  * mirroring the precedence the branch command already relies on.

package/dist/chunk-DSJWtz9O.js

@@ -0,0 +1,40 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+const require = __createRequire(import.meta.url);
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, { get: (a, b) => (typeof require !== "undefined" ? require : a)[b] }) : x)(function(x) {
+	if (typeof require !== "undefined") return require.apply(this, arguments);
+	throw Error("Calling `require` for \"" + x + "\" in an environment that doesn't expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.");
+});
+//#endregion
+export { __toESM as i, __exportAll as n, __require as r, __commonJSMin as t };

package/dist/cli-helpers.d.ts

@@ -4,4 +4,36 @@ export declare function getTableIncludesFromCollections(collections: CollectionC
 export declare function getTableIncludes(collectionsPath: string): Promise<string[]>;
 export declare function getDevDatabaseUrl(databaseUrl: string): string;
 export declare function ensureDevDatabaseExists(databaseUrl: string, devDatabaseUrl: string): Promise<void>;
-export declare function getTableExcludes(databaseUrl: string, collectionsPath: string): Promise<string[]>;
+/**
+ * Query the live database for every user table/view outside the system
+ * catalogs. Separated from {@link getTableExcludes} so its failure mode can
+ * be handled explicitly (fail closed) and so tests can inject a stub.
+ */
+export declare function queryExistingTables(databaseUrl: string): Promise<string[]>;
+/**
+ * Raised when the exclude list could not be built. `db push` MUST abort on
+ * this rather than continue: the exclude list is the only thing shielding
+ * non-collection (user/system) tables from the auto-approved declarative
+ * apply. A partial list — the old fail-open behaviour — meant a transient
+ * introspection hiccup dropped every table not present in `schema.sql`.
+ */
+export declare class ExcludeIntrospectionError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+/**
+ * Build the `--exclude` list that protects tables Rebase doesn't manage from
+ * the declarative apply. Anything not backing a collection (or its M2M
+ * junctions) is excluded so Atlas never drops it.
+ *
+ * Fails **closed**: if the database can't be introspected we cannot know
+ * which tables to protect, so we throw {@link ExcludeIntrospectionError}
+ * instead of returning a near-empty list and letting the caller drop
+ * everything.
+ *
+ * `deps` is injectable for tests; production uses the real pg-backed queries.
+ */
+export declare function getTableExcludes(databaseUrl: string, collectionsPath: string, deps?: {
+    queryExistingTables?: (databaseUrl: string) => Promise<string[]>;
+    getIncludes?: (collectionsPath: string) => Promise<string[]>;
+}): Promise<string[]>;

package/dist/ensure-collection-tables-CNlIONzj.js

@@ -0,0 +1,304 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { l as isPostgresCollectionConfig } from "./src-B0v4IKaI.js";
+import { g as getTableName, k as toSnakeCase, p as findRelation, v as resolveCollectionRelations } from "./src-DmsRg8MR.js";
+//#region src/schema/generate-postgres-ddl-logic.ts
+var resolveColumnName = (propName, prop) => {
+	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+	return toSnakeCase(propName);
+};
+var getPrimaryKeyProp = (collection) => {
+	if (collection.properties) {
+		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
+		if (idPropEntry) {
+			const prop = idPropEntry[1];
+			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
+			return {
+				name: idPropEntry[0],
+				type: prop.type === "number" ? "number" : "string",
+				isUuid
+			};
+		}
+	}
+	const idProp = collection.properties?.["id"];
+	if (idProp?.type === "number") return {
+		name: "id",
+		type: "number",
+		isUuid: false
+	};
+	return {
+		name: "id",
+		type: "string",
+		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
+	};
+};
+var isIdProperty = (propName, prop, collection) => {
+	if ("isId" in prop && Boolean(prop.isId)) return true;
+	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
+};
+var getSqlColumnType = (propName, prop, collection, collections) => {
+	switch (prop.type) {
+		case "string": {
+			const stringProp = prop;
+			if (stringProp.enum) {
+				const tableName = getTableName(collection);
+				const colName = resolveColumnName(propName, prop);
+				return `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${tableName}_${colName}"`;
+			}
+			if (stringProp.isId === "uuid" || stringProp.columnType === "uuid") return "UUID";
+			if (stringProp.columnType === "text" || stringProp.ui?.markdown || stringProp.ui?.multiline) return "TEXT";
+			if (stringProp.columnType === "char") return "CHAR(255)";
+			return "VARCHAR(255)";
+		}
+		case "number": {
+			const numProp = prop;
+			const isId = isIdProperty(propName, prop, collection);
+			if ("isId" in numProp && numProp.isId === "increment") return "INTEGER GENERATED BY DEFAULT AS IDENTITY";
+			if (numProp.columnType) {
+				if (numProp.columnType === "double precision") return "DOUBLE PRECISION";
+				return numProp.columnType.toUpperCase();
+			}
+			return numProp.validation?.integer || isId ? "INTEGER" : "NUMERIC";
+		}
+		case "boolean": return "BOOLEAN";
+		case "date": {
+			const dateProp = prop;
+			if (dateProp.columnType === "date") return "DATE";
+			if (dateProp.columnType === "time") return "TIME";
+			return "TIMESTAMP WITH TIME ZONE";
+		}
+		case "map": return prop.columnType === "json" ? "JSON" : "JSONB";
+		case "array": {
+			const arrayProp = prop;
+			let colType = arrayProp.columnType;
+			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
+				const ofProp = arrayProp.of;
+				if (ofProp.type === "string") colType = "text[]";
+				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
+				else if (ofProp.type === "boolean") colType = "boolean[]";
+			}
+			if (colType === "json") return "JSON";
+			if (colType === "text[]") return "TEXT[]";
+			if (colType === "integer[]") return "INTEGER[]";
+			if (colType === "boolean[]") return "BOOLEAN[]";
+			if (colType === "numeric[]") return "NUMERIC[]";
+			return "JSONB";
+		}
+		case "vector": return `VECTOR(${prop.dimensions})`;
+		case "binary": return "BYTEA";
+		case "relation": {
+			const refProp = prop;
+			const relation = findRelation(resolveCollectionRelations(collection), refProp.relationName ?? propName);
+			if (!relation || relation.direction !== "owning" || relation.cardinality !== "one") throw new Error(`Relation ${propName} is not an owning one-to-one/many-to-one relation`);
+			let targetCollection;
+			try {
+				targetCollection = relation.target();
+			} catch {
+				return "VARCHAR(255)";
+			}
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "VARCHAR(255)";
+		}
+		case "reference": {
+			const refProp = prop;
+			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
+			if (!targetCollection) return "VARCHAR(255)";
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "VARCHAR(255)";
+		}
+		default: return "VARCHAR(255)";
+	}
+};
+//#endregion
+//#region src/schema/ensure-collection-tables.ts
+/**
+* Bringing a database up to date with a bundle's collections, additively.
+*
+* ## Why this exists
+*
+* A managed runtime boots someone else's compiled project against a database it
+* has never seen. Auth tables are ensured at boot already, but collection tables
+* were not created by anything: the platform ran the app and every `/api/data/*`
+* request answered 500 on a missing relation. `rebase db push` cannot help — it
+* is an Atlas-driven CLI command, and the runtime image ships no CLI.
+*
+* ## Why additive-only, forever
+*
+* This runs unattended, against a database with customers' data in it, with no
+* human reading a diff. So it may only ever do things that cannot lose data:
+* create a missing table, add a missing column, create a missing enum type.
+*
+* It will **never** drop a table or a column, narrow a type, or alter a
+* constraint. A removed field leaves its column behind; a renamed field looks
+* like an addition and the old column stays. That is the correct trade for an
+* automated path — the alternative is an unattended process that can silently
+* destroy a column, which is precisely the failure `db push` was hardened
+* against. Destructive changes stay a deliberate, human-reviewed migration.
+*
+* Because of that, this is safe to run on every boot, and re-running it is a
+* no-op.
+*/
+/** Postgres identifiers this module is willing to interpolate. */
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+function assertSafeIdentifier(value, what) {
+	if (!SAFE_IDENTIFIER.test(value)) throw new Error(`Refusing to build SQL with an unsafe ${what}: ${JSON.stringify(value)}`);
+	return value;
+}
+function schemaOf(collection) {
+	return isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+}
+function qualified(collection) {
+	return `${schemaOf(collection)}.${getTableName(collection)}`;
+}
+/**
+* Enum types a collection's properties require, as `schema.typename`.
+*
+* Named exactly as the DDL generator names them (`<table>_<column>`), because
+* a column added here has to reference the same type the generator would have
+* created — a second, differently-named type for the same field would be a
+* silent schema fork.
+*/
+function requiredEnums(collection) {
+	const table = getTableName(collection);
+	const schema = schemaOf(collection);
+	const out = [];
+	for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
+		const p = prop;
+		if (!("enum" in p) || !p.enum) continue;
+		if (p.type !== "string" && p.type !== "number") continue;
+		const values = p.enum.map((entry) => entry && typeof entry === "object" && "id" in entry ? String(entry.id) : String(entry)).filter((v) => v.length > 0);
+		if (values.length === 0) continue;
+		out.push({
+			name: `${schema}.${table}_${resolveColumnName(propName, p)}`,
+			values
+		});
+	}
+	return out;
+}
+/** Single-quote escaping for an enum label. */
+function quoteLiteral(value) {
+	return `'${value.replace(/'/g, "''")}'`;
+}
+/**
+* Decide what to add. Pure — the caller supplies what exists and runs the result.
+*
+* Ordering matters and is deliberate: enum types before the tables and columns
+* that reference them, tables before the columns added to other tables (a new
+* table may be the target of a relation), and nothing is emitted twice.
+*/
+function planCollectionSchemaEnsure(collections, existing) {
+	const actions = [];
+	const plannedEnums = /* @__PURE__ */ new Set();
+	for (const collection of collections) for (const { name, values } of requiredEnums(collection)) {
+		if (existing.enums.has(name) || plannedEnums.has(name)) continue;
+		plannedEnums.add(name);
+		const [schema, typeName] = name.split(".");
+		actions.push({
+			kind: "create-enum",
+			target: name,
+			sql: `CREATE TYPE "${schema}"."${typeName}" AS ENUM (${values.map(quoteLiteral).join(", ")});`
+		});
+	}
+	const created = /* @__PURE__ */ new Set();
+	for (const collection of collections) {
+		const key = qualified(collection);
+		if (existing.tables.has(key) || created.has(key)) continue;
+		created.add(key);
+		const schema = schemaOf(collection);
+		const table = getTableName(collection);
+		const idEntry = Object.entries(collection.properties ?? {}).find(([n, p]) => isIdProperty(n, p, collection));
+		const idName = idEntry ? resolveColumnName(idEntry[0], idEntry[1]) : "id";
+		const idProp = idEntry?.[1];
+		let idDef;
+		if (idProp?.type === "number") idDef = `"${idName}" BIGSERIAL PRIMARY KEY`;
+		else if (idProp && idProp.type === "string" && idProp.isId === "uuid") idDef = `"${idName}" UUID PRIMARY KEY DEFAULT gen_random_uuid()`;
+		else idDef = `"${idName}" TEXT PRIMARY KEY`;
+		actions.push({
+			kind: "create-table",
+			target: key,
+			sql: `CREATE TABLE IF NOT EXISTS "${schema}"."${table}" (${idDef});`
+		});
+	}
+	for (const collection of collections) {
+		const key = qualified(collection);
+		const schema = schemaOf(collection);
+		const table = getTableName(collection);
+		const present = existing.tables.get(key) ?? /* @__PURE__ */ new Set();
+		for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
+			const p = prop;
+			if (isIdProperty(propName, p, collection)) continue;
+			if (p.type === "reference" || p.type === "relation") continue;
+			const column = resolveColumnName(propName, p);
+			if (present.has(column)) continue;
+			const type = getSqlColumnType(propName, p, collection, collections);
+			actions.push({
+				kind: "add-column",
+				target: `${key}.${column}`,
+				sql: `ALTER TABLE "${schema}"."${table}" ADD COLUMN IF NOT EXISTS "${column}" ${type};`
+			});
+		}
+	}
+	return {
+		actions,
+		statements: actions.map((a) => a.sql)
+	};
+}
+/** Read what the database has, for the schemas the collections live in. */
+async function readExistingSchema(client, schemas) {
+	const tables = /* @__PURE__ */ new Map();
+	const enums = /* @__PURE__ */ new Set();
+	if (schemas.length === 0) return {
+		tables,
+		enums
+	};
+	const inList = schemas.map((schema) => `'${assertSafeIdentifier(schema, "schema name")}'`).join(", ");
+	const { rows: columns } = await client.query(`SELECT table_schema, table_name, column_name
+         FROM information_schema.columns
+         WHERE table_schema IN (${inList})`);
+	for (const row of columns) {
+		const key = `${row.table_schema}.${row.table_name}`;
+		if (!tables.has(key)) tables.set(key, /* @__PURE__ */ new Set());
+		tables.get(key).add(row.column_name);
+	}
+	const { rows: enumRows } = await client.query(`SELECT n.nspname AS schema, t.typname AS name
+         FROM pg_type t
+         JOIN pg_namespace n ON t.typnamespace = n.oid
+         WHERE t.typtype = 'e' AND n.nspname IN (${inList})`);
+	for (const row of enumRows) enums.add(`${row.schema}.${row.name}`);
+	return {
+		tables,
+		enums
+	};
+}
+/**
+* Bring the database up to date. Returns what it did.
+*
+* Each statement runs on its own rather than in one transaction: they are all
+* independently safe and idempotent, and a single failure (an enum label that
+* cannot be added, say) should not roll back the tables that were created fine.
+* The error is surfaced with the statement that caused it.
+*/
+async function ensureCollectionTables(client, collections, log) {
+	const schemas = Array.from(new Set(collections.map(schemaOf)));
+	for (const schema of schemas) {
+		assertSafeIdentifier(schema, "schema name");
+		if (schema !== "public") await client.query(`CREATE SCHEMA IF NOT EXISTS "${schema}";`);
+	}
+	const plan = planCollectionSchemaEnsure(collections, await readExistingSchema(client, schemas));
+	if (plan.actions.length === 0) {
+		log?.("Schema is up to date; nothing to create.");
+		return plan;
+	}
+	for (const action of plan.actions) try {
+		await client.query(action.sql);
+		log?.(`${action.kind}: ${action.target}`);
+	} catch (err) {
+		throw new Error(`Failed to ${action.kind} ${action.target}: ${err instanceof Error ? err.message : String(err)}\n  ${action.sql}`);
+	}
+	return plan;
+}
+//#endregion
+export { ensureCollectionTables };
+
+//# sourceMappingURL=ensure-collection-tables-CNlIONzj.js.map