@rebasepro/server-postgres 0.10.1-canary.31c773c → 0.10.1-canary.6f89f77

package/dist/index.es.js

@@ -5,7 +5,7 @@ import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, or, relations, sql } from "drizzle-orm";
-import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
+import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs, { promises } from "fs";
 import path from "path";
 import chokidar from "chokidar";
@@ -518,6 +518,25 @@ function getDataSourceCapabilities(engine) {
 	if (!engine) return POSTGRES_CAPABILITIES;
 	return CAPABILITIES_REGISTRY[engine] ?? DEFAULT_CAPABILITIES;
 }
+/**
+* Resolve a client-supplied list `limit` into a safe, always-defined value.
+*
+* - A provided limit is coerced to an integer and clamped to `[1, maxLimit]`,
+*   so `0`, negatives, and absurd values can never bypass the cap.
+* - An absent / blank / non-numeric limit falls back to the mode default:
+*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
+*
+* The return is never `undefined` — no ingress that routes its client limit
+* through this can produce an unbounded read.
+*/
+function resolveClientListLimit(rawLimit, opts = {}) {
+	const maxLimit = opts.maxLimit ?? 1e3;
+	if (rawLimit != null && String(rawLimit).trim() !== "") {
+		const parsed = typeof rawLimit === "number" ? rawLimit : parseInt(String(rawLimit), 10);
+		if (Number.isFinite(parsed)) return Math.min(Math.max(1, Math.floor(parsed)), maxLimit);
+	}
+	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
+}
 var snakeCaseRegex = /[A-Z]{2,}(?=[A-Z][a-z]|\b)|[A-Z]?[a-z]+|[0-9]+(?:[a-z](?![a-z]))?|[A-Z]/g;
 var toSnakeCase = (str) => {
 	if (!str || typeof str !== "string") return "";
@@ -9349,21 +9368,59 @@ function createAuthSchema(usersSchemaName = "rebase") {
 		isAnonymous: boolean("is_anonymous").default(false).notNull(),
 		roles: text("roles").array().default([]).notNull(),
 		metadata: jsonb("metadata").$type().default({}).notNull(),
+		/**
+		* Sessions that began before this instant are dead, whatever tokens
+		* they still hold. Password resets and admin revocations stamp it.
+		*
+		* Deleting the user's refresh-token rows (which we also do) is not
+		* sufficient on its own: a request already in flight can insert a
+		* freshly rotated row microseconds after the delete and survive it.
+		* This timestamp cannot be outrun that way — it is checked against
+		* `refresh_tokens.session_started_at`, which rotation carries forward.
+		*/
+		tokensValidAfter: timestamp("tokens_valid_after"),
 		createdAt: timestamp("created_at").defaultNow().notNull(),
 		updatedAt: timestamp("updated_at").defaultNow().notNull()
 	});
 	/**
-	* Refresh tokens for long-lived sessions
+	* Refresh tokens for long-lived sessions.
+	*
+	* A row is one token, not one device. Every token minted from the same
+	* sign-in shares a `sessionId`, and rotation ADDS a row rather than
+	* replacing one: the superseded token stays on file, flagged `revoked`
+	* with a `rotatedAt` stamp. That record is what lets the refresh endpoint
+	* tell a client replaying a token it never got an answer for (a response
+	* lost to a redeploy, a second tab racing on boot) apart from a stranger
+	* presenting a token that was never issued. Deleting the old row on sight
+	* — the previous behaviour — made those two cases indistinguishable, and
+	* the legitimate one is overwhelmingly the common one.
+	*
+	* There is deliberately NO unique constraint on (uid, user_agent,
+	* ip_address). Keying a session on the IP meant one row per "device",
+	* so a second browser profile behind the same NAT silently evicted the
+	* first, and a phone changing networks orphaned a row on every hop.
+	* User agent and IP are descriptive metadata for the sessions list;
+	* `sessionId` is the identity.
 	*/
 	const refreshTokens = tableCreator("refresh_tokens", {
 		id: uuid("id").defaultRandom().primaryKey(),
 		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+		sessionId: uuid("session_id").defaultRandom().notNull(),
 		tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
 		expiresAt: timestamp("expires_at").notNull(),
+		revoked: boolean("revoked").default(false).notNull(),
+		rotatedAt: timestamp("rotated_at"),
+		/**
+		* When the sign-in this token descends from happened — carried across
+		* every rotation, unlike `createdAt`. `users.tokensValidAfter` is
+		* compared against this, so a revocation cannot be outrun by a token
+		* that rotates immediately after it.
+		*/
+		sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
 		userAgent: varchar("user_agent", { length: 500 }),
 		ipAddress: varchar("ip_address", { length: 45 }),
 		createdAt: timestamp("created_at").defaultNow().notNull()
-	}, (table) => ({ uniqueDeviceSession: unique("unique_device_session").on(table.uid, table.userAgent, table.ipAddress) }));
+	}, (table) => ({ sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId) }));
 	/**
 	* Password reset tokens for forgot password flow
 	*/
@@ -10819,6 +10876,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				this.sendError(clientId, msg, subscriptionId);
 				return;
 			}
+			const boundedLimit = resolveClientListLimit(request.limit, { vectorSearch: !!request.vectorSearch });
 			this._subscriptions.set(subscriptionId, {
 				clientId,
 				type: "collection",
@@ -10827,7 +10885,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					filter: request.filter,
 					orderBy: request.orderBy,
 					order: request.order,
-					limit: request.limit,
+					limit: boundedLimit,
 					startAfter: request.startAfter,
 					databaseId: request.collection?.databaseId,
 					searchString: request.searchString
@@ -10838,7 +10896,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				filter: request.filter,
 				orderBy: request.orderBy,
 				order: request.order,
-				limit: request.limit,
+				limit: boundedLimit,
 				startAfter: request.startAfter,
 				searchString: request.searchString
 			}, authContext);
@@ -12463,11 +12521,57 @@ function buildPgRestoreArgs(opts) {
 	];
 	if (opts.clean) args.push("--clean", "--if-exists");
 	if (opts.noOwner) args.push("--no-owner");
-	if (opts.exitOnError) args.push("--exit-on-error");
+	if (opts.exitOnError !== false) args.push("--exit-on-error");
 	args.push(opts.inputFile);
 	return args;
 }
 /**
+* Assemble the `pg_restore --list` argument vector. Reading a dump's table
+* of contents parses the whole archive without touching a database, so it is
+* a cheap integrity check that the file isn't truncated or corrupt.
+*/
+function buildPgRestoreListArgs(inputFile) {
+	return ["--list", inputFile];
+}
+/**
+* Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other
+* cluster-wide objects) live outside any single database, so a per-database
+* `pg_dump` omits them. Without the `rebase_user` role the RLS GRANT
+* statements in the main dump fail on restore and RLS is silently lost — so
+* every backup captures the globals into a sidecar `.globals.sql`.
+*
+* `--no-role-passwords` keeps role secrets out of the artifact (backups may
+* be shipped off-box); roles are recreated password-less and re-secured by
+* the operator.
+*/
+function buildPgDumpallGlobalsArgs(opts) {
+	return [
+		"--globals-only",
+		"--no-role-passwords",
+		"--no-password",
+		`--file=${opts.outFile}`,
+		`--dbname=${opts.connectionString}`
+	];
+}
+/**
+* Derive the globals sidecar path/key for a given `.dump` file. Keeps the
+* two artifacts adjacent so listing, uploading and pruning can find one from
+* the other. A name that doesn't end in `.dump` is returned unchanged with a
+* `.globals.sql` suffix appended.
+*/
+function globalsFileForDump(dumpPath) {
+	return dumpPath.endsWith(".dump") ? dumpPath.slice(0, -5) + ".globals.sql" : dumpPath + ".globals.sql";
+}
+/**
+* Split a `pg_dumpall --globals-only` script into individual statements.
+* Used when replaying globals on restore so each `CREATE ROLE` / `GRANT`
+* can run independently and a benign "role already exists" on one doesn't
+* abort the rest. Drops `--` comment lines and blank statements.
+*/
+function splitGlobalsStatements(sql) {
+	return sql.split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/**
 * Resolve the Postgres connection string the backup commands should use,
 * mirroring the precedence the branch command already relies on.
 */
@@ -20756,6 +20860,58 @@ function resolveLocalBin(binName) {
 	return null;
 }
 //#endregion
+//#region src/backup/backup-logic.ts
+/**
+* Pure-ish orchestration for the backup/restore paths, kept free of `execa`
+* and `pg` value imports so it can be unit-tested under jest (the impure
+* edges — spawning processes, opening connections — live in
+* `backup-service.ts`, which is vitest/runtime only).
+*
+* The functions here take their side-effecting dependency as an argument
+* (a statement runner, an object deleter) so tests can inject fakes.
+*/
+/**
+* Replay a `pg_dumpall --globals-only` script one statement at a time,
+* tolerating per-statement failures. On a same-cluster restore the roles
+* usually already exist (`CREATE ROLE` → "already exists") and on a managed
+* provider an `ALTER ROLE <superuser>` may be refused; neither should abort
+* recreation of the roles that *are* missing. Returns how many statements
+* applied vs were skipped.
+*
+* `runStatement` executes one SQL statement and rejects on error.
+*/
+async function applyGlobalsWith(runStatement, globalsSql, log = () => {}) {
+	let applied = 0;
+	let skipped = 0;
+	for (const statement of splitGlobalsStatements(globalsSql)) try {
+		await runStatement(statement);
+		applied++;
+	} catch (err) {
+		skipped++;
+		log(`  • Skipped global: ${statement.split("\n")[0].slice(0, 80)} (${err instanceof Error ? err.message : String(err)})`);
+	}
+	return {
+		applied,
+		skipped
+	};
+}
+/**
+* Delete each pruned dump together with its `.globals.sql` roles sidecar, so
+* pruning never orphans the roles file. The sidecar is best-effort — older
+* backups predate it, so a missing-sidecar failure is swallowed while a
+* failure deleting the dump itself propagates.
+*
+* `deleteObject` removes one key and rejects if it cannot (e.g. not found).
+*/
+async function pruneWith(keys, deleteObject) {
+	for (const key of keys) {
+		await deleteObject(key);
+		try {
+			await deleteObject(globalsFileForDump(key));
+		} catch {}
+	}
+}
+//#endregion
 //#region src/backup/backup-service.ts
 /**
 * Backup / restore orchestration: thin, well-typed wrappers around
@@ -20768,6 +20924,7 @@ function resolveLocalBin(binName) {
 */
 var backup_service_exports = /* @__PURE__ */ __exportAll({
 	BackupToolError: () => BackupToolError,
+	applyGlobals: () => applyGlobals,
 	createDump: () => createDump,
 	detectToolMajor: () => detectToolMajor,
 	ensureDatabaseExists: () => ensureDatabaseExists,
@@ -20777,7 +20934,8 @@ var backup_service_exports = /* @__PURE__ */ __exportAll({
 	pruneBackups: () => pruneBackups,
 	resolvePgBinary: () => resolvePgBinary,
 	restoreDump: () => restoreDump,
-	uploadBackup: () => uploadBackup
+	uploadBackup: () => uploadBackup,
+	validateDump: () => validateDump
 });
 var BackupToolError = class extends Error {
 	hint;
@@ -20787,10 +20945,10 @@ var BackupToolError = class extends Error {
 		this.name = "BackupToolError";
 	}
 };
-/** Locate `pg_dump` / `pg_restore`, honouring an env override. */
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
 function resolvePgBinary(tool, env = process.env) {
-	const override = tool === "pg_dump" ? env.PG_DUMP_PATH : env.PG_RESTORE_PATH;
-	if (override && fs.existsSync(override)) return override;
+	const overrideVar = tool === "pg_dump" ? env.PG_DUMP_PATH : tool === "pg_restore" ? env.PG_RESTORE_PATH : env.PG_DUMPALL_PATH;
+	if (overrideVar && fs.existsSync(overrideVar)) return overrideVar;
 	return resolveLocalBin(tool);
 }
 /** Run `<bin> --version` and extract the major version. */
@@ -20834,6 +20992,11 @@ async function preflight(tool, connectionString, env = process.env) {
 * Produce a custom-format dump on local disk. When `outDir` is omitted the
 * file is written to the OS temp directory (used by the upload path, which
 * cleans it up afterwards).
+*
+* Alongside the `-Fc` dump it writes a `<name>.globals.sql` sidecar via
+* `pg_dumpall --globals-only` so the roles the dump's GRANT/RLS statements
+* depend on can be recreated on restore. Set `includeGlobals: false` to skip
+* it (e.g. when the caller has no privilege to read cluster globals).
 */
 async function createDump(opts) {
 	const env = opts.env ?? process.env;
@@ -20852,17 +21015,92 @@ async function createDump(opts) {
 		stdio: opts.inheritStdio ? "inherit" : "pipe",
 		env: { ...env }
 	});
-	return {
+	const result = {
 		localFile,
 		fileName,
 		sizeBytes: fs.existsSync(localFile) ? fs.statSync(localFile).size : 0
 	};
+	if (opts.includeGlobals !== false) {
+		const dumpallBin = resolvePgBinary("pg_dumpall", env);
+		if (!dumpallBin) throw new BackupToolError("Could not find the 'pg_dumpall' binary needed to capture cluster roles.", "Install the PostgreSQL client tools or set PG_DUMPALL_PATH. To take a role-incomplete backup anyway, pass includeGlobals: false.");
+		const globalsFile = globalsFileForDump(localFile);
+		await execa(dumpallBin, buildPgDumpallGlobalsArgs({
+			connectionString: opts.connectionString,
+			outFile: globalsFile
+		}), {
+			stdio: opts.inheritStdio ? "inherit" : "pipe",
+			env: { ...env }
+		});
+		result.globalsFile = globalsFile;
+		result.globalsSizeBytes = fs.existsSync(globalsFile) ? fs.statSync(globalsFile).size : 0;
+	}
+	return result;
+}
+/**
+* Cheap integrity check on a freshly written dump: it must be non-empty and
+* `pg_restore --list` must parse its table of contents without error. Used
+* before pruning older backups so a corrupt-but-exit-0 dump never becomes
+* the reason the last good backup is deleted.
+*/
+async function validateDump(localFile, env = process.env) {
+	if (!fs.existsSync(localFile)) return {
+		ok: false,
+		reason: `Dump file does not exist: ${localFile}`
+	};
+	if (fs.statSync(localFile).size === 0) return {
+		ok: false,
+		reason: "Dump file is empty (0 bytes)."
+	};
+	const bin = resolvePgBinary("pg_restore", env);
+	if (!bin) return {
+		ok: false,
+		reason: "Could not find 'pg_restore' to verify the dump."
+	};
+	try {
+		await execa(bin, buildPgRestoreListArgs(localFile), {
+			stdio: "pipe",
+			env: { ...env }
+		});
+		return { ok: true };
+	} catch (err) {
+		return {
+			ok: false,
+			reason: `pg_restore --list failed: ${err instanceof Error ? err.message : String(err)}`
+		};
+	}
+}
+/**
+* Replay a `pg_dumpall --globals-only` script to recreate cluster roles
+* before a restore, so the dump's GRANT/RLS statements (which reference
+* `rebase_user` and any owner roles) actually apply. Runs statement by
+* statement and tolerates per-statement failures — on a same-cluster restore
+* the roles usually already exist (`CREATE ROLE` → "already exists"), and on
+* a managed provider an `ALTER ROLE <superuser>` may be refused; neither
+* should abort role recreation. Returns how many statements applied vs were
+* skipped.
+*/
+async function applyGlobals(connectionString, globalsSql, log = () => {}) {
+	const { Client } = await import("pg");
+	const client = new Client({ connectionString });
+	await client.connect();
+	try {
+		return await applyGlobalsWith(async (sql) => {
+			await client.query(sql);
+		}, globalsSql, log);
+	} finally {
+		await client.end();
+	}
 }
 /**
 * Restore a custom-format dump into the database named by
 * `connectionString`. Destructive when `clean` is set (drops objects
 * first). Never called automatically — the CLI gates it behind explicit
 * confirmation.
+*
+* Runs with `--exit-on-error` by default: a restore that logs-and-continues
+* past a failed GRANT (because a role was missing) reports success with RLS
+* un-enforced. Callers should recreate roles first (see {@link applyGlobals})
+* and only set `exitOnError: false` deliberately.
 */
 async function restoreDump(opts) {
 	const env = opts.env ?? process.env;
@@ -20872,7 +21110,8 @@ async function restoreDump(opts) {
 		connectionString: opts.connectionString,
 		inputFile: opts.inputFile,
 		clean: opts.clean,
-		noOwner: opts.noOwner
+		noOwner: opts.noOwner,
+		exitOnError: opts.exitOnError
 	}), {
 		stdio: opts.inheritStdio ? "inherit" : "pipe",
 		env: { ...env }
@@ -20949,9 +21188,13 @@ async function listBackups(dest, storage) {
 */
 async function pruneBackups(dest, options, storage) {
 	const toDelete = selectBackupsToPrune(await listBackups(dest, storage), options);
-	for (const key of toDelete) if (dest.kind === "local") {
-		if (fs.existsSync(key)) fs.unlinkSync(key);
-	} else if (storage) await storage.deleteObject(key, dest.bucket);
+	await pruneWith(toDelete, dest.kind === "local" ? async (key) => {
+		if (!fs.existsSync(key)) throw new Error(`not found: ${key}`);
+		fs.unlinkSync(key);
+	} : async (key) => {
+		if (!storage) throw new BackupToolError("Storage backend required to prune object backups.");
+		await storage.deleteObject(key, dest.bucket);
+	});
 	return toDelete;
 }
 //#endregion
@@ -21016,7 +21259,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup } = await Promise.resolve().then(() => backup_service_exports);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await Promise.resolve().then(() => backup_service_exports);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -21028,15 +21271,23 @@ function createBackupCron(config) {
 				excludeSchemas
 			});
 			log(`Dump created: ${dump.fileName} (${formatBytes(dump.sizeBytes)})`);
+			const check = await validateDump(dump.localFile);
+			if (!check.ok) {
+				if (destination.kind !== "local" && fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);
+				if (dump.globalsFile && destination.kind !== "local" && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);
+				throw new Error(`New backup failed validation — skipping upload and pruning to protect existing backups. ${check.reason}`);
+			}
 			let storedKey = dump.localFile;
 			try {
 				if (destination.kind !== "local") {
 					const uploaded = await uploadBackup(config.storage, dump.localFile, destination);
 					storedKey = uploaded.storageUrl;
 					log(`Uploaded to ${uploaded.storageUrl}`);
+					if (dump.globalsFile && fs.existsSync(dump.globalsFile)) log(`Uploaded roles sidecar to ${(await uploadBackup(config.storage, dump.globalsFile, destination)).storageUrl}`);
 				}
 			} finally {
 				if (destination.kind !== "local" && fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);
+				if (dump.globalsFile && destination.kind !== "local" && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);
 			}
 			let pruned = [];
 			if (config.retentionDays && config.retentionDays > 0) {
@@ -21153,6 +21404,7 @@ async function ensureAuthTablesExist(db, collection) {
                 email_verification_sent_at TIMESTAMP WITH TIME ZONE,
                 is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
                 metadata JSONB DEFAULT '{}' NOT NULL,
+                tokens_valid_after TIMESTAMP WITH TIME ZONE,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
             )
@@ -21233,12 +21485,15 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
                 uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                session_id TEXT NOT NULL DEFAULT gen_random_uuid()::text,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+                revoked BOOLEAN DEFAULT FALSE NOT NULL,
+                rotated_at TIMESTAMP WITH TIME ZONE,
+                session_started_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 user_agent TEXT,
                 ip_address TEXT,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-                CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
         `);
 		await db.execute(sql`
@@ -21328,6 +21583,7 @@ async function ensureAuthTablesExist(db, collection) {
 			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
 			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
 			"metadata JSONB DEFAULT '{}' NOT NULL",
+			"tokens_valid_after TIMESTAMP WITH TIME ZONE",
 			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
 			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
 		]) await db.execute(sql`
@@ -21344,42 +21600,36 @@ async function ensureAuthTablesExist(db, collection) {
 			for (const { table_schema } of found) {
 				const qualified = `"${table_schema}"."refresh_tokens"`;
 				try {
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS user_agent TEXT`);
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS ip_address TEXT`);
-					await db.execute(sql`UPDATE ${sql.raw(qualified)} SET user_agent = '' WHERE user_agent IS NULL`);
-					await db.execute(sql`UPDATE ${sql.raw(qualified)} SET ip_address = '' WHERE ip_address IS NULL`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_id TEXT`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);
 					await db.execute(sql`
-                        DELETE FROM ${sql.raw(qualified)} a
-                        USING ${sql.raw(qualified)} b
-                        WHERE a.ctid < b.ctid
-                          AND a.uid = b.uid
-                          AND a.user_agent = b.user_agent
-                          AND a.ip_address = b.ip_address
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_id = gen_random_uuid()::text
+                        WHERE session_id IS NULL
                     `);
-					const uniques = await db.execute(sql`
-                        SELECT conname, pg_get_constraintdef(oid) AS def
-                        FROM pg_constraint
-                        WHERE conrelid = ${sql.raw(`'${qualified}'`)}::regclass AND contype = 'u'
+					await db.execute(sql`
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_started_at = COALESCE(created_at, NOW())
+                        WHERE session_started_at IS NULL
                     `);
-					for (const u of uniques.rows) logger.info(`   ${qualified} unique: ${u.conname} → ${u.def}`);
-					if (uniques.rows.some((u) => {
-						const cols = (u.def.match(/\(([^)]*)\)/)?.[1] || "").split(",").map((c) => c.trim().replace(/"/g, ""));
-						return cols.length === 3 && cols.includes("uid") && cols.includes("user_agent") && cols.includes("ip_address");
-					})) logger.info(`✓ correct device-session unique already present on ${qualified}`);
-					else {
-						await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
-						await db.execute(sql`
-                            ALTER TABLE ${sql.raw(qualified)}
-                                ADD CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
-                        `);
-						logger.info(`✅ Added correct unique_device_session constraint to ${qualified}`);
-					}
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET DEFAULT gen_random_uuid()::text`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET DEFAULT NOW()`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET NOT NULL`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET NOT NULL`);
+					await db.execute(sql`
+                        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_session
+                        ON ${sql.raw(qualified)}(session_id)
+                    `);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
+					logger.info(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
 				} catch (perTableError) {
 					logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);
 				}
 			}
 		} catch (migrationError) {
-			logger.warn(`⚠️  refresh_tokens device-session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
+			logger.warn(`⚠️  refresh_tokens session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
 		}
 		try {
 			if ((await db.execute(sql`
@@ -21871,34 +22121,31 @@ var UserService = class {
 var RefreshTokenService = class {
 	db;
 	refreshTokensTable;
+	usersTable;
 	constructor(db, tableOrTables) {
 		this.db = db;
-		if (tableOrTables && (tableOrTables.refreshTokens || tableOrTables.users)) this.refreshTokensTable = tableOrTables.refreshTokens || refreshTokens;
-		else this.refreshTokensTable = tableOrTables || refreshTokens;
+		if (tableOrTables && (tableOrTables.refreshTokens || tableOrTables.users)) {
+			this.refreshTokensTable = tableOrTables.refreshTokens || refreshTokens;
+			this.usersTable = tableOrTables.users || users;
+		} else {
+			this.refreshTokensTable = tableOrTables || refreshTokens;
+			this.usersTable = users;
+		}
 	}
-	async createToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
-		const safeUserAgent = userAgent || "";
-		const safeIpAddress = ipAddress || "";
-		await this.db.insert(this.refreshTokensTable).values({
-			uid,
-			tokenHash,
-			expiresAt,
-			userAgent: safeUserAgent,
-			ipAddress: safeIpAddress
-		}).onConflictDoUpdate({
-			target: [
-				this.refreshTokensTable.uid,
-				this.refreshTokensTable.userAgent,
-				this.refreshTokensTable.ipAddress
-			],
-			set: {
-				tokenHash,
-				expiresAt
-			}
-		});
+	/**
+	* Whether the table actually carries a column, so a host application that
+	* supplied its own `refresh_tokens` table — one that predates session
+	* grouping — degrades instead of throwing on every sign-in.
+	*/
+	has(column) {
+		return Boolean(this.refreshTokensTable[column]);
 	}
-	async findByHash(tokenHash) {
-		const [token] = await this.db.select({
+	col(column) {
+		return this.refreshTokensTable[column];
+	}
+	/** The columns to read back, narrowed to the ones this table has. */
+	selection() {
+		const selection = {
 			id: this.refreshTokensTable.id,
 			uid: this.refreshTokensTable.uid,
 			tokenHash: this.refreshTokensTable.tokenHash,
@@ -21906,9 +22153,94 @@ var RefreshTokenService = class {
 			createdAt: this.refreshTokensTable.createdAt,
 			userAgent: this.refreshTokensTable.userAgent,
 			ipAddress: this.refreshTokensTable.ipAddress
-		}).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
+		};
+		for (const optional of [
+			"sessionId",
+			"rotatedAt",
+			"revoked",
+			"sessionStartedAt"
+		]) if (this.has(optional)) selection[optional] = this.col(optional);
+		return selection;
+	}
+	async createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
+		const values = {
+			uid,
+			tokenHash,
+			expiresAt,
+			userAgent: userAgent || "",
+			ipAddress: ipAddress || ""
+		};
+		if (session && this.has("sessionId")) values.sessionId = session.id;
+		if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
+		await this.db.insert(this.refreshTokensTable).values(values);
+	}
+	async findByHash(tokenHash) {
+		const [token] = await this.db.select(this.selection()).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 		return token || null;
 	}
+	/**
+	* Record that a token was rotated away, keeping the row.
+	*
+	* The row is what lets `/auth/refresh` distinguish "you already used this,
+	* here is a fresh one" from "no idea what this is". Deleting it — which is
+	* what this used to do — collapsed both into a 401 and signed the user out
+	* for the crime of losing a response.
+	*/
+	async markRotated(tokenHash) {
+		if (!this.has("rotatedAt")) {
+			await this.deleteByHash(tokenHash);
+			return;
+		}
+		await this.db.update(this.refreshTokensTable).set({ rotatedAt: /* @__PURE__ */ new Date() }).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
+	}
+	/** Final kill of one sign-in: logout, or revoking a device remotely. */
+	async revokeSession(sessionId) {
+		if (!this.has("sessionId")) return;
+		if (this.has("revoked")) {
+			await this.db.update(this.refreshTokensTable).set({
+				revoked: true,
+				...this.has("rotatedAt") ? { rotatedAt: /* @__PURE__ */ new Date() } : {}
+			}).where(eq(this.col("sessionId"), sessionId));
+			return;
+		}
+		await this.db.delete(this.refreshTokensTable).where(eq(this.col("sessionId"), sessionId));
+	}
+	/**
+	* Housekeeping: rotation would otherwise leave a row per refresh forever.
+	* Superseded rows are only needed for as long as a straggler might still
+	* present them, and expired ones are dead weight everywhere.
+	*/
+	async prune(uid, sessionId, supersededBefore) {
+		const uidCol = this.refreshTokensTable.uid;
+		const expiresCol = this.refreshTokensTable.expiresAt;
+		if (!this.has("rotatedAt") || !this.has("sessionId")) {
+			await this.db.delete(this.refreshTokensTable).where(sql`${uidCol} = ${uid} AND ${expiresCol} < NOW()`);
+			return;
+		}
+		const rotatedCol = this.col("rotatedAt");
+		const sessionCol = this.col("sessionId");
+		await this.db.delete(this.refreshTokensTable).where(sql`
+            ${uidCol} = ${uid}
+            AND (
+                ${expiresCol} < NOW()
+                OR (
+                    ${sessionCol} = ${sessionId}
+                    AND ${rotatedCol} IS NOT NULL
+                    AND ${rotatedCol} < ${supersededBefore}
+                )
+            )
+        `);
+	}
+	async getTokensValidAfter(uid) {
+		if (!this.usersTable || !this.usersTable.tokensValidAfter) return null;
+		const [row] = await this.db.select({ tokensValidAfter: this.usersTable.tokensValidAfter }).from(this.usersTable).where(eq(this.usersTable.id, uid));
+		const value = row?.tokensValidAfter;
+		return value ? new Date(value) : null;
+	}
+	async setTokensValidAfter(uid, at) {
+		if (!this.usersTable || !this.usersTable.tokensValidAfter) return;
+		await this.db.update(this.usersTable).set({ tokensValidAfter: at }).where(eq(this.usersTable.id, uid));
+	}
 	async deleteByHash(tokenHash) {
 		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 	}
@@ -21916,15 +22248,7 @@ var RefreshTokenService = class {
 		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid));
 	}
 	async listForUser(uid) {
-		return await this.db.select({
-			id: this.refreshTokensTable.id,
-			uid: this.refreshTokensTable.uid,
-			tokenHash: this.refreshTokensTable.tokenHash,
-			expiresAt: this.refreshTokensTable.expiresAt,
-			createdAt: this.refreshTokensTable.createdAt,
-			userAgent: this.refreshTokensTable.userAgent,
-			ipAddress: this.refreshTokensTable.ipAddress
-		}).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid)).orderBy(this.refreshTokensTable.createdAt);
+		return await this.db.select(this.selection()).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid)).orderBy(this.refreshTokensTable.createdAt);
 	}
 	async deleteById(id, uid) {
 		await this.db.delete(this.refreshTokensTable).where(sql`${this.refreshTokensTable.id} = ${id} AND ${this.refreshTokensTable.uid} = ${uid}`);
@@ -22069,8 +22393,23 @@ var PostgresTokenRepository = class {
 		this.passwordResetTokenService = new PasswordResetTokenService(db, tableOrTables);
 		this.magicLinkTokenService = new MagicLinkTokenService(db, tableOrTables);
 	}
-	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
-		await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
+	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
+		await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+	}
+	async markRefreshTokenRotated(tokenHash) {
+		await this.refreshTokenService.markRotated(tokenHash);
+	}
+	async revokeRefreshTokenSession(sessionId) {
+		await this.refreshTokenService.revokeSession(sessionId);
+	}
+	async pruneRefreshTokens(uid, sessionId, supersededBefore) {
+		await this.refreshTokenService.prune(uid, sessionId, supersededBefore);
+	}
+	async getTokensValidAfter(uid) {
+		return this.refreshTokenService.getTokensValidAfter(uid);
+	}
+	async setTokensValidAfter(uid, at) {
+		await this.refreshTokenService.setTokensValidAfter(uid, at);
 	}
 	async findRefreshTokenByHash(tokenHash) {
 		return this.refreshTokenService.findByHash(tokenHash);
@@ -22236,8 +22575,23 @@ var PostgresAuthRepository = class {
 		};
 	}
 	async deleteRole(_id) {}
-	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
-		await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
+	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
+		await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+	}
+	async markRefreshTokenRotated(tokenHash) {
+		await this.tokenRepository.markRefreshTokenRotated(tokenHash);
+	}
+	async revokeRefreshTokenSession(sessionId) {
+		await this.tokenRepository.revokeRefreshTokenSession(sessionId);
+	}
+	async pruneRefreshTokens(uid, sessionId, supersededBefore) {
+		await this.tokenRepository.pruneRefreshTokens(uid, sessionId, supersededBefore);
+	}
+	async getTokensValidAfter(uid) {
+		return this.tokenRepository.getTokensValidAfter(uid);
+	}
+	async setTokensValidAfter(uid, at) {
+		await this.tokenRepository.setTokensValidAfter(uid, at);
 	}
 	async findRefreshTokenByHash(tokenHash) {
 		return this.tokenRepository.findRefreshTokenByHash(tokenHash);
@@ -23516,6 +23870,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, globalsFileForDump, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map