@rebasepro/server-postgres 0.18.0 → 0.19.0

package/dist/ensure-tables-CIojK-Rx.js

@@ -0,0 +1,650 @@
+import { createRequire as __createRequire } from "module";
+__createRequire(import.meta.url);
+import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
+import { r as authUsersColumnSql, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
+import { n as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-DLDnUjtx.js";
+import { logger } from "@rebasepro/server";
+import { sql } from "drizzle-orm";
+import { revokeInternalTableAccess } from "@rebasepro/common";
+/** Key under which the version is stored in the auth schema's meta table. */
+var VERSION_KEY = "auth_schema_version";
+/**
+* Columns `refresh_tokens` must have for the current runtime's auth write path
+* to work. Checked by the health probe so a database that drifted *below* this
+* runtime is reported as unhealthy rather than discovered one failed login at a
+* time. Kept in step with the migration in `ensureAuthTablesExist`.
+*/
+var REQUIRED_REFRESH_TOKEN_COLUMNS = [
+	"session_id",
+	"revoked",
+	"rotated_at",
+	"session_started_at"
+];
+/**
+* A constraint whose *presence* means the database is still at version 1, in a
+* shape this runtime's rotation logic cannot write to: it makes two live tokens
+* of one rotating session collide.
+*/
+var RETIRED_REFRESH_TOKEN_CONSTRAINT = "unique_device_session";
+/**
+* Thrown when the database was migrated by a runtime newer than this one.
+*
+* Distinct class rather than a bare `Error` because `ensureAuthTablesExist`
+* wraps its migrations in a catch that deliberately swallows failures and
+* continues — every other problem there is better survived than crashed on.
+* This one is not, so the catch rethrows on this type specifically.
+*/
+var AuthSchemaVersionError = class extends Error {
+	databaseVersion;
+	runtimeVersion;
+	constructor(databaseVersion, runtimeVersion) {
+		super(`Auth schema version mismatch: the database is at version ${databaseVersion}, but this runtime understands version ${runtimeVersion}.\n\nA newer version of the framework has already migrated this database. Running this older runtime against it would boot cleanly and then fail every login and token refresh, because the auth schema it expects no longer exists.
+
+Refusing to start. Deploy a framework version at or above the one that migrated this database, or restore the database from a backup taken before the upgrade.`);
+		this.name = "AuthSchemaVersionError";
+		this.databaseVersion = databaseVersion;
+		this.runtimeVersion = runtimeVersion;
+	}
+};
+/**
+* The schema the auth tables live in, derived exactly as `ensureAuthTablesExist`
+* derives it. Shared so the two cannot drift: a stamp written to one schema and
+* read from another would read as "never stamped" forever.
+*/
+function resolveAuthSchema(collection) {
+	if (!collection) return "rebase";
+	const usersSchema = "schema" in collection && typeof collection.schema === "string" ? collection.schema : "public";
+	return usersSchema === "public" ? "rebase" : usersSchema;
+}
+/**
+* Read the stamped version, or `null` when the database has never been stamped.
+*
+* `null` is not an error and must not be treated as one: every database
+* provisioned before this file existed is unstamped, and so is every fresh one.
+* Uses `to_regclass` rather than selecting straight from the table so a missing
+* schema or table is a `null` rather than a thrown 42P01.
+*/
+async function readAuthSchemaVersion(db, authSchema) {
+	const qualified = `"${authSchema}"."schema_meta"`;
+	if (!(await db.execute(sql`SELECT to_regclass(${qualified}) IS NOT NULL AS present`)).rows[0]?.present) return null;
+	const raw = (await db.execute(sql`
+        SELECT value FROM ${sql.raw(qualified)} WHERE key = ${VERSION_KEY}
+    `)).rows[0]?.value;
+	if (raw === void 0) return null;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isFinite(parsed) ? parsed : null;
+}
+/**
+* Refuse to run against a database a newer runtime has already migrated.
+*
+* Deliberately one-directional. A database *older* than this runtime is the
+* normal upgrade path — the migrations in `ensureAuthTablesExist` are about to
+* bring it forward, so it is not an error. Only the reverse is unrecoverable.
+*/
+async function assertAuthSchemaCompatible(db, authSchema) {
+	const databaseVersion = await readAuthSchemaVersion(db, authSchema);
+	if (databaseVersion !== null && databaseVersion > 2) throw new AuthSchemaVersionError(databaseVersion, 2);
+}
+/**
+* Record that this runtime's migrations have been applied.
+*
+* Called at the end of `ensureAuthTablesExist`, so a boot that failed partway
+* through leaves the older stamp in place and the next boot migrates again.
+*/
+async function stampAuthSchemaVersion(db, authSchema) {
+	const qualified = `"${authSchema}"."schema_meta"`;
+	await db.execute(sql`
+        CREATE TABLE IF NOT EXISTS ${sql.raw(qualified)} (
+            key TEXT PRIMARY KEY,
+            value TEXT NOT NULL,
+            updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
+        )
+    `);
+	await db.execute(sql`
+        INSERT INTO ${sql.raw(qualified)} (key, value)
+        VALUES (${VERSION_KEY}, ${String(2)})
+        ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()
+    `);
+}
+/**
+* Check that the auth schema is one this runtime can actually write to.
+*
+* Two independent checks, because either alone has a blind spot:
+*
+*  - The **stamp** catches a runtime older than the database. It is the precise
+*    signal, but it is blind on every database provisioned before stamping
+*    existed — which today is all of them.
+*  - The **structure** catches a database older than the runtime, and works on
+*    unstamped databases. It is what makes this useful immediately rather than
+*    one upgrade cycle from now.
+*
+* Never throws: a probe that fails to run reports unhealthy with the reason, so
+* a broken check surfaces as a degraded health response rather than a 500 from
+* the health endpoint itself.
+*/
+async function probeAuthSchema(db, authSchema) {
+	const problems = [];
+	let databaseVersion = null;
+	try {
+		databaseVersion = await readAuthSchemaVersion(db, authSchema);
+		if (databaseVersion !== null && databaseVersion > 2) problems.push(`database is at auth schema version ${databaseVersion}, this runtime understands 2 — it was migrated by a newer framework version`);
+		const refreshTokens = `"${authSchema}"."refresh_tokens"`;
+		if (!(await db.execute(sql`SELECT to_regclass(${refreshTokens}) IS NOT NULL AS present`)).rows[0]?.present) return {
+			healthy: problems.length === 0,
+			databaseVersion,
+			runtimeVersion: 2,
+			problems
+		};
+		const columns = await db.execute(sql`
+            SELECT column_name FROM information_schema.columns
+            WHERE table_schema = ${authSchema} AND table_name = 'refresh_tokens'
+        `);
+		const found = new Set(columns.rows.map((row) => row.column_name));
+		const missing = REQUIRED_REFRESH_TOKEN_COLUMNS.filter((column) => !found.has(column));
+		if (missing.length > 0) problems.push(`refresh_tokens is missing ${missing.join(", ")} — the auth migrations have not been applied to this database, so token rotation will fail`);
+		if ((await db.execute(sql`
+            SELECT 1 FROM pg_constraint c
+            JOIN pg_class t ON t.oid = c.conrelid
+            JOIN pg_namespace n ON n.oid = t.relnamespace
+            WHERE n.nspname = ${authSchema}
+              AND t.relname = 'refresh_tokens'
+              AND c.conname = ${RETIRED_REFRESH_TOKEN_CONSTRAINT}
+        `)).rows.length > 0) problems.push(`refresh_tokens still carries ${RETIRED_REFRESH_TOKEN_CONSTRAINT} — concurrent token rotation for one session will fail on it`);
+	} catch (error) {
+		problems.push(`auth schema probe failed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	return {
+		healthy: problems.length === 0,
+		databaseVersion,
+		runtimeVersion: 2,
+		problems
+	};
+}
+//#endregion
+//#region src/auth/ensure-tables.ts
+var ensure_tables_exports = /* @__PURE__ */ __exportAll({ ensureAuthTablesExist: () => ensureAuthTablesExist });
+/**
+* Auto-create auth tables if they don't exist.
+*
+* @param db         — Drizzle database instance
+* @param collection — The collection that represents auth users.
+*                     When omitted, a default `rebase.users` table is created.
+*/
+async function ensureAuthTablesExist(db, collection) {
+	logger.debug("🔍 Checking auth tables...");
+	await assertAuthSchemaCompatible(db, resolveAuthSchema(collection));
+	try {
+		let usersTableName = "\"rebase\".\"users\"";
+		let userIdType = "TEXT";
+		let usersSchema = "rebase";
+		let resolvedTable = "users";
+		if (collection) {
+			resolvedTable = "table" in collection && typeof collection.table === "string" ? collection.table : collection.slug;
+			usersSchema = "schema" in collection && typeof collection.schema === "string" ? collection.schema : "public";
+			usersTableName = usersSchema === "public" ? `"${resolvedTable}"` : `"${usersSchema}"."${resolvedTable}"`;
+			const idProp = collection.properties?.id;
+			if (idProp) {
+				const isId = "isId" in idProp ? idProp.isId : void 0;
+				if (isId === "uuid") userIdType = "UUID";
+				else if (isId === "increment") userIdType = "INTEGER";
+			}
+		}
+		try {
+			const result = await db.execute(sql`
+                SELECT data_type 
+                FROM information_schema.columns 
+                WHERE table_schema = ${usersSchema} 
+                  AND table_name = ${resolvedTable} 
+                  AND column_name = 'id'
+            `);
+			if (result && result.rows && result.rows.length > 0) {
+				const dbType = String(result.rows[0].data_type).toUpperCase();
+				if (dbType === "UUID") userIdType = "UUID";
+				else if (dbType === "INTEGER" || dbType === "SMALLINT" || dbType === "BIGINT") userIdType = "INTEGER";
+				else userIdType = "TEXT";
+				logger.debug(`✨ Detected ${usersTableName}.id type from database: ${dbType}. Using user_id type: ${userIdType}`);
+			}
+		} catch (err) {
+			logger.warn(`⚠️ Failed to introspect ${usersTableName}.id type from database, falling back to config type: ${userIdType}`, { error: err });
+		}
+		if (usersSchema !== "public") await db.execute(sql`CREATE SCHEMA IF NOT EXISTS ${sql.raw(usersSchema)}`);
+		await db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
+		const authSchema = usersSchema === "public" ? "rebase" : usersSchema;
+		const userIdentitiesTable = `"${authSchema}"."user_identities"`;
+		const refreshTokensTableName = `"${authSchema}"."refresh_tokens"`;
+		const passwordResetTokensTableName = `"${authSchema}"."password_reset_tokens"`;
+		const appConfigTableName = `"${authSchema}"."app_config"`;
+		const idDefault = userIdType === "UUID" ? "DEFAULT gen_random_uuid()" : userIdType === "INTEGER" ? "GENERATED ALWAYS AS IDENTITY" : "DEFAULT gen_random_uuid()::text";
+		const authIdentifier = (suffix) => `${resolvedTable}_${suffix}`.slice(0, 63);
+		const emailLengthConstraint = `"${authIdentifier("email_length_check")}"`;
+		const emailLowerUniqueIndex = authIdentifier("email_lower_key");
+		const verificationTokenIndex = authIdentifier("email_verification_token_idx");
+		const usersColumnDdl = AUTH_USERS_COLUMNS.map((spec) => spec.column === "email" ? `${spec.column} ${authUsersColumnSql(spec)} CONSTRAINT ${emailLengthConstraint} CHECK (length(email) <= 320)` : `${spec.column} ${authUsersColumnSql(spec)}`).join(",\n                ");
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS ${sql.raw(usersTableName)} (
+                id ${sql.raw(userIdType)} PRIMARY KEY ${sql.raw(idDefault)},
+                ${sql.raw(usersColumnDdl)}
+            )
+        `);
+		const legacyFkTables = [
+			"user_identities",
+			"refresh_tokens",
+			"password_reset_tokens",
+			"magic_link_tokens",
+			"mfa_factors",
+			"recovery_codes"
+		];
+		const legacyFkTableList = legacyFkTables.map((t) => `'${t}'`).join(", ");
+		const legacyUserIdPresent = await db.execute(sql`
+            SELECT 1
+            FROM information_schema.columns
+            WHERE table_schema = ${authSchema}
+              AND table_name IN (${sql.raw(legacyFkTableList)})
+              AND column_name = 'user_id'
+            LIMIT 1
+        `);
+		if (legacyUserIdPresent.rows.length > 0) await db.execute(sql`
+                CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
+                BEGIN
+                    IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
+                        NEW.uid := NEW.user_id;
+                    ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
+                        NEW.user_id := NEW.uid;
+                    END IF;
+                    RETURN NEW;
+                END $$ LANGUAGE plpgsql
+            `);
+		for (const authTable of legacyUserIdPresent.rows.length > 0 ? legacyFkTables : []) {
+			const qualified = `"${authSchema}"."${authTable}"`;
+			await db.execute(sql`
+                DO $$
+                DECLARE
+                    has_legacy boolean;
+                    has_uid    boolean;
+                BEGIN
+                    SELECT
+                        bool_or(column_name = 'user_id'),
+                        bool_or(column_name = 'uid')
+                    INTO has_legacy, has_uid
+                    FROM information_schema.columns
+                    WHERE table_schema = ${sql.raw(`'${authSchema}'`)}
+                      AND table_name = ${sql.raw(`'${authTable}'`)};
+
+                    -- Table absent, or already uid-only (a fresh install, or
+                    -- phase 2 already run): nothing to do.
+                    IF has_legacy IS NOT TRUE THEN
+                        RETURN;
+                    END IF;
+
+                    IF has_uid IS NOT TRUE THEN
+                        EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ADD COLUMN uid ${userIdType} REFERENCES ${usersTableName}(id) ON DELETE CASCADE'`)};
+                        EXECUTE ${sql.raw(`'UPDATE ${qualified} SET uid = user_id WHERE uid IS NULL'`)};
+                        EXECUTE ${sql.raw(`'CREATE INDEX IF NOT EXISTS idx_${authTable}_uid ON ${qualified}(uid)'`)};
+                    END IF;
+
+                    -- New code inserts uid and never user_id, so the legacy
+                    -- column can no longer be NOT NULL. The trigger below
+                    -- backfills it, but the constraint is checked first.
+                    EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ALTER COLUMN user_id DROP NOT NULL'`)};
+
+                    EXECUTE ${sql.raw(`'DROP TRIGGER IF EXISTS sync_uid_user_id ON ${qualified}'`)};
+                    EXECUTE ${sql.raw(`'CREATE TRIGGER sync_uid_user_id BEFORE INSERT OR UPDATE ON ${qualified} FOR EACH ROW EXECUTE FUNCTION "${authSchema}".sync_uid_user_id()'`)};
+                END $$
+            `);
+		}
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS ${sql.raw(userIdentitiesTable)} (
+                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                provider TEXT NOT NULL,
+                provider_id TEXT NOT NULL,
+                profile_data JSONB,
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+                UNIQUE(provider, provider_id)
+            )
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_user_identities_user 
+            ON ${sql.raw(userIdentitiesTable)}(uid)
+        `);
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
+                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                session_id TEXT NOT NULL DEFAULT gen_random_uuid()::text,
+                token_hash TEXT NOT NULL UNIQUE,
+                expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+                revoked BOOLEAN DEFAULT FALSE NOT NULL,
+                rotated_at TIMESTAMP WITH TIME ZONE,
+                session_started_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
+                user_agent TEXT,
+                ip_address TEXT,
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+            )
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_refresh_tokens_hash 
+            ON ${sql.raw(refreshTokensTableName)}(token_hash)
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user 
+            ON ${sql.raw(refreshTokensTableName)}(uid)
+        `);
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS ${sql.raw(passwordResetTokensTableName)} (
+                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                token_hash TEXT NOT NULL UNIQUE,
+                expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+                used_at TIMESTAMP WITH TIME ZONE,
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+            )
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_hash 
+            ON ${sql.raw(passwordResetTokensTableName)}(token_hash)
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user 
+            ON ${sql.raw(passwordResetTokensTableName)}(uid)
+        `);
+		const magicLinkTokensTableName = `"${authSchema}"."magic_link_tokens"`;
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS ${sql.raw(magicLinkTokensTableName)} (
+                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                token_hash TEXT NOT NULL UNIQUE,
+                expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+                used_at TIMESTAMP WITH TIME ZONE,
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+            )
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_magic_link_tokens_hash 
+            ON ${sql.raw(magicLinkTokensTableName)}(token_hash)
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_magic_link_tokens_user 
+            ON ${sql.raw(magicLinkTokensTableName)}(uid)
+        `);
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS ${sql.raw(appConfigTableName)} (
+                key TEXT PRIMARY KEY,
+                value JSONB NOT NULL,
+                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+            )
+        `);
+		await db.transaction(async (tx) => {
+			await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
+			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await tx.execute(sql.raw(statement));
+		});
+		for (const spec of AUTH_USERS_COLUMNS) {
+			if (spec.column === "email") continue;
+			await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(`${spec.column} ${authUsersColumnSql(spec)}`)}
+            `);
+		}
+		const usersColumnRows = (await db.execute(sql`
+            SELECT column_name, data_type, is_nullable, column_default
+            FROM information_schema.columns
+            WHERE table_schema = ${usersSchema} AND table_name = ${resolvedTable}
+        `)).rows;
+		const usersColumnTypes = new Map(usersColumnRows.map((row) => [row.column_name, row.data_type]));
+		const usersColumnState = new Map(usersColumnRows.map((row) => [row.column_name, row]));
+		for (const spec of AUTH_USERS_COLUMNS) {
+			const state = usersColumnState.get(spec.column);
+			if (!state) continue;
+			if (spec.default !== void 0 && state.column_default === null) {
+				await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET DEFAULT ${sql.raw(spec.default)}
+                `);
+				logger.info(`🔧 Restored the default on ${usersTableName}.${spec.column}`);
+			}
+			if (!spec.notNull || state.is_nullable !== "YES") continue;
+			if (spec.default !== void 0) await db.execute(sql`
+                    UPDATE ${sql.raw(usersTableName)}
+                    SET ${sql.raw(`"${spec.column}"`)} = ${sql.raw(spec.default)}
+                    WHERE ${sql.raw(`"${spec.column}"`)} IS NULL
+                `);
+			try {
+				await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET NOT NULL
+                `);
+				logger.info(`🔧 Restored NOT NULL on ${usersTableName}.${spec.column}`);
+			} catch (err) {
+				logger.warn(`⚠️ ${usersTableName}.${spec.column} should be NOT NULL but still holds NULLs, so the constraint was not applied. Fill or remove those rows and restart: ` + (err instanceof Error ? err.message : String(err)));
+			}
+		}
+		for (const column of [
+			"email",
+			"display_name",
+			"photo_url",
+			"password_hash",
+			"email_verification_token"
+		]) {
+			if (usersColumnTypes.get(column) !== "character varying") continue;
+			await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ALTER COLUMN ${sql.raw(`"${column}"`)} TYPE TEXT
+            `);
+			logger.info(`🔧 Widened ${usersTableName}.${column} from VARCHAR(n) to TEXT`);
+		}
+		if (usersColumnTypes.has("email")) {
+			if ((await db.execute(sql`
+                SELECT 1 FROM pg_class c
+                JOIN pg_namespace n ON n.oid = c.relnamespace
+                WHERE n.nspname = ${usersSchema} AND c.relname = ${emailLowerUniqueIndex} AND c.relkind = 'i'
+            `)).rows.length === 0) {
+				const collisions = await db.execute(sql`
+                    SELECT lower(email) AS normalized, count(*)::int AS occurrences
+                    FROM ${sql.raw(usersTableName)}
+                    WHERE email IS NOT NULL
+                    GROUP BY lower(email)
+                    HAVING count(*) > 1
+                    LIMIT 10
+                `);
+				if (collisions.rows.length > 0) {
+					const sample = collisions.rows.map((row) => `${row.normalized} (×${row.occurrences})`).join(", ");
+					logger.error(`❌ Cannot enforce case-insensitive email uniqueness on ${usersTableName}: these addresses already exist more than once, differing only in case — ${sample}. Merge or delete the duplicates and restart; until then two accounts can share one address and only the lower-cased one is reachable by login.`);
+				} else {
+					const folded = await db.execute(sql`
+                        UPDATE ${sql.raw(usersTableName)}
+                        SET email = lower(email)
+                        WHERE email IS NOT NULL AND email <> lower(email)
+                    `);
+					if (folded.rowCount) logger.info(`🔧 Lower-cased ${folded.rowCount} email address(es) in ${usersTableName}`);
+					await db.execute(sql`
+                        CREATE UNIQUE INDEX IF NOT EXISTS ${sql.raw(`"${emailLowerUniqueIndex}"`)}
+                        ON ${sql.raw(usersTableName)} (lower(email))
+                    `);
+					logger.info(`✅ Email uniqueness on ${usersTableName} is now case-insensitive`);
+				}
+			}
+		}
+		if (usersColumnTypes.has("email")) {
+			if ((await db.execute(sql`
+                SELECT 1 FROM pg_constraint c
+                JOIN pg_class t ON t.oid = c.conrelid
+                JOIN pg_namespace n ON n.oid = t.relnamespace
+                WHERE n.nspname = ${usersSchema}
+                  AND t.relname = ${resolvedTable}
+                  AND c.conname = ${authIdentifier("email_length_check")}
+            `)).rows.length === 0) await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ADD CONSTRAINT ${sql.raw(emailLengthConstraint)} CHECK (length(email) <= 320) NOT VALID
+                `);
+		}
+		if (usersColumnTypes.has("email_verification_token")) await db.execute(sql`
+                CREATE INDEX IF NOT EXISTS ${sql.raw(`"${verificationTokenIndex}"`)}
+                ON ${sql.raw(usersTableName)} (email_verification_token)
+                WHERE email_verification_token IS NOT NULL
+            `);
+		try {
+			const found = (await db.execute(sql`
+                SELECT table_schema, table_name
+                FROM information_schema.tables
+                WHERE table_name = 'refresh_tokens'
+            `)).rows;
+			logger.debug(`🔍 refresh_tokens reconcile: found ${found.length} table(s): ${found.map((r) => `"${r.table_schema}"."${r.table_name}"`).join(", ") || "(none)"}`);
+			for (const { table_schema } of found) {
+				const qualified = `"${table_schema}"."refresh_tokens"`;
+				try {
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_id TEXT`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS aal TEXT`);
+					await db.execute(sql`
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_id = gen_random_uuid()::text
+                        WHERE session_id IS NULL
+                    `);
+					await db.execute(sql`
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_started_at = COALESCE(created_at, NOW())
+                        WHERE session_started_at IS NULL
+                    `);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET DEFAULT gen_random_uuid()::text`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET DEFAULT NOW()`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET NOT NULL`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET NOT NULL`);
+					await db.execute(sql`
+                        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_session
+                        ON ${sql.raw(qualified)}(session_id)
+                    `);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
+					logger.debug(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
+				} catch (perTableError) {
+					logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);
+				}
+			}
+		} catch (migrationError) {
+			logger.warn(`⚠️  refresh_tokens session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
+		}
+		try {
+			if ((await db.execute(sql`
+                SELECT EXISTS (
+                    SELECT 1 FROM information_schema.tables
+                    WHERE table_schema = 'rebase' AND table_name = 'user_roles'
+                ) AS has_user_roles
+            `)).rows[0].has_user_roles) {
+				logger.info("🔄 Migrating roles from legacy user_roles table...");
+				await db.execute(sql`
+                    UPDATE ${sql.raw(usersTableName)} u
+                    SET roles = COALESCE((
+                        SELECT array_agg(ur.role_id)
+                        FROM "rebase"."user_roles" ur
+                        WHERE ur.user_id = u.id
+                    ), '{}')
+                    WHERE u.roles = '{}' OR u.roles IS NULL
+                `);
+				await db.execute(sql`DROP TABLE IF EXISTS "rebase"."user_roles" CASCADE`);
+				await db.execute(sql`DROP TABLE IF EXISTS "rebase"."roles" CASCADE`);
+				logger.info("✅ Legacy roles tables migrated and dropped");
+			}
+		} catch (migrationError) {
+			logger.warn(`⚠️  Legacy roles migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
+		}
+		const mfaFactorsTableName = `"${authSchema}"."mfa_factors"`;
+		const mfaChallengesTableName = `"${authSchema}"."mfa_challenges"`;
+		const recoveryCodesTableName = `"${authSchema}"."recovery_codes"`;
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS ${sql.raw(mfaFactorsTableName)} (
+                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                factor_type TEXT NOT NULL DEFAULT 'totp',
+                secret_encrypted TEXT NOT NULL,
+                friendly_name TEXT,
+                verified BOOLEAN DEFAULT FALSE,
+                last_used_counter BIGINT,
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+            )
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_mfa_factors_user
+            ON ${sql.raw(mfaFactorsTableName)}(uid)
+        `);
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS ${sql.raw(mfaChallengesTableName)} (
+                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                factor_id TEXT NOT NULL REFERENCES ${sql.raw(mfaFactorsTableName)}(id) ON DELETE CASCADE,
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+                verified_at TIMESTAMP WITH TIME ZONE,
+                ip_address TEXT,
+                attempts INTEGER NOT NULL DEFAULT 0,
+                expires_at TIMESTAMP WITH TIME ZONE NOT NULL
+            )
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_mfa_challenges_factor
+            ON ${sql.raw(mfaChallengesTableName)}(factor_id)
+        `);
+		try {
+			await db.execute(sql`ALTER TABLE ${sql.raw(mfaFactorsTableName)} ADD COLUMN IF NOT EXISTS last_used_counter BIGINT`);
+			await db.execute(sql`ALTER TABLE ${sql.raw(mfaChallengesTableName)} ADD COLUMN IF NOT EXISTS attempts INTEGER NOT NULL DEFAULT 0`);
+		} catch (mfaMigrationError) {
+			logger.warn(`⚠️  MFA hardening columns skipped: ${mfaMigrationError instanceof Error ? mfaMigrationError.message : String(mfaMigrationError)}`);
+		}
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS ${sql.raw(recoveryCodesTableName)} (
+                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                code_hash TEXT NOT NULL,
+                used_at TIMESTAMP WITH TIME ZONE,
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+            )
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_recovery_codes_user
+            ON ${sql.raw(recoveryCodesTableName)}(uid)
+        `);
+		try {
+			const authTablePairs = [
+				[usersSchema, resolvedTable],
+				[authSchema, "user_identities"],
+				[authSchema, "refresh_tokens"],
+				[authSchema, "password_reset_tokens"],
+				[authSchema, "magic_link_tokens"],
+				[authSchema, "app_config"],
+				[authSchema, "mfa_factors"],
+				[authSchema, "mfa_challenges"],
+				[authSchema, "recovery_codes"],
+				[authSchema, "schema_meta"]
+			];
+			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
+                    SELECT 1
+                    FROM pg_class c
+                    JOIN pg_namespace n ON n.oid = c.relnamespace
+                    WHERE n.nspname = ${schemaName}
+                      AND c.relname = ${tableName}
+                      AND c.relforcerowsecurity
+                `)).rows.length > 0) {
+				await db.execute(sql`
+                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
+                        NO FORCE ROW LEVEL SECURITY
+                    `);
+				logger.warn(`🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" (legacy RLS model — it binds the owner connection and breaks privileged auth writes)`);
+			}
+		} catch (rlsReconcileError) {
+			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
+		}
+		await stampAuthSchemaVersion(db, authSchema);
+		await revokeInternalTableAccess(async (text) => {
+			await db.execute(sql.raw(text));
+		}, authSchema, { onError: (table, err) => logger.warn(`🔐 Could not revoke authenticated-role access to "${authSchema}"."${table}": ` + (err instanceof Error ? err.message : String(err))) });
+		logger.debug("✅ Auth tables ready");
+	} catch (error) {
+		if (error instanceof AuthSchemaVersionError) throw error;
+		logger.error("❌ Failed to create auth tables", { error });
+		logger.warn("⚠️ Continuing without creating auth tables.");
+	}
+}
+//#endregion
+export { resolveAuthSchema as i, ensure_tables_exports as n, probeAuthSchema as r, ensureAuthTablesExist as t };
+
+//# sourceMappingURL=ensure-tables-CIojK-Rx.js.map