@rebasepro/server-postgres 0.15.0 → 0.16.0

package/dist/index.es.js

@@ -3,11 +3,11 @@ import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
 import { n as resolveClientListLimit, t as ListLimitError } from "./data_driver-ULAyJEi9.js";
-import { $ as mergeDeep, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as isPrototypePollutingKey, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as toWireKey, Z as getPolicyNamesForRule, _ as OrderBySpecError, at as isManyToMany, b as CollectionRegistry, et as camelCase, g as buildSdkData, h as visibleColumnProjection, it as hasForeignKeyOnTarget, j as findRelation, l as buildSearchColumnSpec, ot as Vector, q as generateForeignKeyName, r as authUsersColumnSql, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as toSnakeCase, u as hiddenColumnsOption, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./auth-users-columns-JJ8ngvy5.js";
+import { $ as mergeDeep, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as isPrototypePollutingKey, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as toWireKey, Z as getPolicyNamesForRule, _ as OrderBySpecError, at as isManyToMany, b as CollectionRegistry, et as camelCase, g as buildSdkData, h as visibleColumnProjection, it as hasForeignKeyOnTarget, j as findRelation, l as buildSearchColumnSpec, ot as Vector, q as generateForeignKeyName, r as authUsersColumnSql, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as toSnakeCase, u as hiddenColumnsOption, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./auth-users-columns-CgyPWQ18.js";
 import { c as isPostgresCollectionConfig, f as ALL_WHERE_FILTER_OPS, g as encodeRelationAggregateSort, l as isRelationalCollectionConfig, v as parseRelationAggregateSort } from "./src-BBFsDaeA.js";
 import { t as createPostgresWebSocket } from "./websocket-BVgDVO-V.js";
-import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-BDBfuTD4.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-czK-OAuG.js";
+import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-Ch0T6OwW.js";
+import { A as parseDbNameFromUrl, C as buildRowSecurityPgOptions, D as joinStorageKey, E as globalsFileForDump, F as withDatabaseName, M as resolveConnectionString, N as serverVersionNumToMajor, O as parseBackupDestination, P as splitGlobalsStatements, S as buildPgRestoreListArgs, T as diagnoseRowSecurityDumpFailure, _ as selectBackupsToPrune, a as detectToolMajor, b as buildPgDumpallGlobalsArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as require_source, h as validateDump, i as createDump, j as parsePgToolMajor, k as parseBackupTimestamp, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildBackupFilename, w as checkToolServerCompatibility, x as buildPgRestoreArgs, y as buildPgDumpArgs } from "./backup-service-BZoixhVl.js";
 import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-B5Sajku6.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
@@ -6403,7 +6403,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	* PostgreSQL roles from `pg_roles` (`postgres`, `rebase_user`, …). Those
 	* are the roles the SQL editor can `SET ROLE` to. *These* are the strings
 	* held in the users table's `roles` column, injected per-transaction as
-	* `auth.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
+	* `rebase.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
 	* into a `SecurityRule.roles` field produces a condition no user can ever
 	* satisfy, so the two must not be conflated.
 	*
@@ -9898,9 +9898,10 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* inert, no schema is created, and broadcast keeps its original
 	* fire-and-forget path.
 	*/
-	async configureChannelHistory(rules) {
+	async configureChannelHistory(rules, options) {
 		this.channelHistory = new ChannelHistoryStore(this.db, rules ?? []);
 		if (!this.channelHistory.enabled) return;
+		if (options?.provision === false) return;
 		await this.channelHistory.ensureTables();
 	}
 	/** Whether any channel is configured to retain messages. */
@@ -10560,7 +10561,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-czK-OAuG.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-BZoixhVl.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -11597,7 +11598,7 @@ var UserService = class {
 	* Run a privileged auth write with an explicitly cleared RLS context.
 	*
 	* The auth services run on the base/owner connection, which by design
-	* carries a NULL `app.uid` so the `auth.uid() IS NULL` server-escape
+	* carries a NULL `app.uid` so the `rebase.uid() IS NULL` server-escape
 	* in the default policies applies. That NULL is normally guaranteed by
 	* `set_config(..., is_local = true)` resetting at transaction end — but a
 	* GUC that survives on a pooled connection (or a connection role that
@@ -11605,7 +11606,7 @@ var UserService = class {
 	* turns the trusted write into an RLS-scoped one and denies it with
 	* SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
 	* single chokepoint, makes the server context deterministic instead of
-	* trusting whatever state the pool hands us. `auth.uid()` reads '' as
+	* trusting whatever state the pool hands us. `rebase.uid()` reads '' as
 	* NULL via NULLIF, so '' is the server context.
 	*/
 	async withServerContext(fn) {
@@ -13633,6 +13634,15 @@ function isScaffoldedLocalDatabase(connectionString) {
 * });
 * ```
 */
+/**
+* Where the collections schema stamp lives.
+*
+* The runtime's own internal schema, always — unlike the auth stamp, which
+* follows the users collection. `rebase` and `auth` sit outside
+* `introspectionSchema` by construction, so nothing here is ever served as a
+* collection.
+*/
+var SCHEMA_META_SCHEMA = "rebase";
 function createPostgresBootstrapper(pgConfig) {
 	if (pgConfig.unknownFilterFields) configureUnknownFilterFields(pgConfig.unknownFilterFields);
 	/**
@@ -13651,6 +13661,17 @@ function createPostgresBootstrapper(pgConfig) {
 	* builder, not to `execute(sql.raw(...))` — and every statement these hooks
 	* emit is schema-qualified DDL, so neither depends on `search_path`.
 	*/
+	/**
+	* The drizzle handle itself, for the statements that want parameters.
+	*
+	* `provisioningQueryable` below hands back a `query(text)` shim because the
+	* DDL it serves is built as text. The schema stamp writes a *value*, so it
+	* wants the parameterised form — building that string by hand would be one
+	* more place a quoted literal has to be got right for no benefit.
+	*/
+	const provisioningDb = (driverResult) => {
+		return (driverResult?.internals)?.db ?? pgConfig.connection;
+	};
 	const provisioningQueryable = (driverResult) => {
 		const db = (driverResult?.internals)?.db ?? pgConfig.connection;
 		if (!db) throw new Error("Cannot provision the collection schema: this Postgres adapter was created without a `connection`, and no initialized driver was supplied to fall back on. Pass `connection` to `createPostgresAdapter` (see `createPostgresDatabaseConnection`).");
@@ -13662,7 +13683,9 @@ function createPostgresBootstrapper(pgConfig) {
 	return {
 		type: "postgres",
 		async initializeDriver(config) {
-			const { collections, collectionRegistry, introspectCollections, baas, schemaProvisioning } = config;
+			const { collections, collectionRegistry, introspectCollections, baas, schemaProvisioning, realtime } = config;
+			const realtimeSubscribes = realtime?.subscribe ?? true;
+			const realtimeProvisions = realtime?.provision ?? true;
 			const unprotectedTables = baas?.unprotectedTables ?? "exclude";
 			const connection = pgConfig.connection;
 			const rawClient = connection && typeof connection === "object" && "$client" in connection ? connection.$client : connection;
@@ -13775,7 +13798,7 @@ function createPostgresBootstrapper(pgConfig) {
 				logger.warn("⚠️ Could not initialize branch metadata table", { error: err });
 			}
 			try {
-				await realtimeService.configureChannelHistory(pgConfig.realtime?.channels);
+				await realtimeService.configureChannelHistory(pgConfig.realtime?.channels, { provision: realtimeProvisions });
 			} catch (err) {
 				logger.warn("⚠️ Could not initialize channel history tables — retained channels will not replay", { error: err });
 			}
@@ -13800,7 +13823,7 @@ function createPostgresBootstrapper(pgConfig) {
 				logger.warn(`⚠️ [CDC] Unknown REALTIME_CDC value "${cdcMode}" — expected auto|wal|trigger|off. Defaulting to "auto".`);
 				cdcMode = "auto";
 			}
-			const wantsCdc = cdcMode !== "off";
+			const wantsCdc = cdcMode !== "off" && (realtimeSubscribes || realtimeProvisions);
 			const explicitCdc = cdcMode === "trigger" || cdcMode === "wal";
 			let cdcEnabled = false;
 			let provisionCdcForTables;
@@ -13822,19 +13845,19 @@ function createPostgresBootstrapper(pgConfig) {
 						schema: link.schema,
 						table: link.table
 					});
-					await provisionTriggerCdc(cdcRunSql, cdcTables);
-					await realtimeService.enableCdc(directUrl);
+					if (realtimeProvisions) await provisionTriggerCdc(cdcRunSql, cdcTables);
+					if (realtimeSubscribes) await realtimeService.enableCdc(directUrl);
 					cdcEnabled = true;
-					provisionCdcForTables = async (tables) => {
+					if (realtimeProvisions) provisionCdcForTables = async (tables) => {
 						await provisionTriggerCdc(cdcRunSql, tables);
 					};
-					logger.info(`📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). All writes now emit realtime events regardless of origin.`);
+					logger.info(`📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). All writes now emit realtime events regardless of origin.` + (realtimeSubscribes ? "" : " This process installs the capture but does not consume it."));
 				} catch (err) {
 					if (explicitCdc) logger.warn("⚠️ [CDC] Could not enable database-level change capture — falling back to app-level realtime.", { error: err });
 					else logger.info("ℹ️ [CDC] Database-level change capture unavailable (likely insufficient privileges to create triggers, or the LISTEN connection was refused) — using app-level realtime. Set REALTIME_CDC=off to silence this.", { detail: err instanceof Error ? err.message : String(err) });
 				}
 			}
-			if (!cdcEnabled && directUrl) try {
+			if (!cdcEnabled && directUrl && realtimeSubscribes) try {
 				await realtimeService.startListening(directUrl);
 			} catch (err) {
 				logger.warn("⚠️ Cross-instance realtime could not be started", { error: err });
@@ -13978,7 +14001,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-BHUjQ-z4.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-BY1pHRD_.js");
 			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(failure.kind === "comment-column" ? `🔍 [schema] Could not record the search fingerprint on "${failure.target}" — search works, but a later change to the \`search\` block will not be detected: ${failure.error}` : `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
 			return { applied: plan.actions.length - plan.failures.length };
@@ -13990,8 +14013,8 @@ function createPostgresBootstrapper(pgConfig) {
 		*
 		* The companion to {@link ensureCollectionSchema}: that creates the
 		* tables, this makes them servable. Boot runs it *after* auth
-		* initialization, because the generated policies call `auth.uid()` /
-		* `auth.roles()`, and `CREATE POLICY` validates those functions exist.
+		* initialization, because the generated policies call `rebase.uid()` /
+		* `rebase.roles()`, and `CREATE POLICY` validates those functions exist.
 		*
 		* Runs through the same drizzle handle, one statement at a time (that
 		* handle speaks the extended query protocol, which rejects multi-command
@@ -13999,7 +14022,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* stays RLS-enabled, so it denies rather than leaks.
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-D5PtQLyR.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-BVFb2olB.js");
 			const queryable = provisioningQueryable(driverResult);
 			const outcome = await ensureCollectionPolicies(queryable, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
@@ -14018,6 +14041,25 @@ function createPostgresBootstrapper(pgConfig) {
 			}
 			return { applied: outcome.policiesApplied };
 		},
+		/**
+		* Read what the last provisioning boot recorded, or `null`.
+		*
+		* The meta schema is `rebase` rather than the auth stamp's — see
+		* `schema/collections-schema-version.ts` for why the two can differ.
+		*/
+		async readCollectionsSchemaVersion(driverResult) {
+			const db = provisioningDb(driverResult);
+			if (!db) return null;
+			const { readCollectionsSchemaVersion } = await import("./collections-schema-version-BMeu3cgv.js");
+			return readCollectionsSchemaVersion(db, SCHEMA_META_SCHEMA);
+		},
+		/** Record what this process just applied. Only the provisioning process calls this. */
+		async stampCollectionsSchemaVersion(version, driverResult) {
+			const db = provisioningDb(driverResult);
+			if (!db) return;
+			const { stampCollectionsSchemaVersion } = await import("./collections-schema-version-BMeu3cgv.js");
+			await stampCollectionsSchemaVersion(db, SCHEMA_META_SCHEMA, version);
+		},
 		getAdmin(driverResult) {
 			return driverResult.internals.driver.admin;
 		},
@@ -14054,6 +14096,8 @@ function createPostgresAdapter(pgConfig) {
 		},
 		ensureCollectionSchema: bootstrapper.ensureCollectionSchema ? (collections, driverResult, log) => bootstrapper.ensureCollectionSchema(collections, driverResult, log) : void 0,
 		ensureCollectionPolicies: bootstrapper.ensureCollectionPolicies ? (collections, driverResult, log) => bootstrapper.ensureCollectionPolicies(collections, driverResult, log) : void 0,
+		readCollectionsSchemaVersion: bootstrapper.readCollectionsSchemaVersion ? (driverResult) => bootstrapper.readCollectionsSchemaVersion(driverResult) : void 0,
+		stampCollectionsSchemaVersion: bootstrapper.stampCollectionsSchemaVersion ? (version, driverResult) => bootstrapper.stampCollectionsSchemaVersion(version, driverResult) : void 0,
 		getAdmin(driverResult) {
 			if (bootstrapper.getAdmin) return bootstrapper.getAdmin(driverResult);
 		},
@@ -14063,6 +14107,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, describeSchemaDriftCause, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, describeSchemaDriftCause, detectToolMajor, diagnoseRowSecurityDumpFailure, discardPartialDump, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map