@rebasepro/server-postgres 0.23.0 → 0.24.1-canary.g19596ef

package/dist/PostgresBootstrapper.d.ts

@@ -4,7 +4,7 @@
  * Implements the `BackendBootstrapper` interface for PostgreSQL.
  */
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { BackendBootstrapper, CollectionConfig, type RealtimeChannelsConfig } from "@rebasepro/types";
+import { BackendBootstrapper, CollectionConfig, InitializedDriver, type DatabaseAdapterInitConfig, type RealtimeChannelsConfig } from "@rebasepro/types";
 import { PostgresBackendDriver } from "./PostgresBackendDriver.js";
 import { RealtimeService } from "./services/realtimeService.js";
 import { DatabasePoolManager } from "./databasePoolManager.js";
@@ -14,7 +14,27 @@ import { type UnknownFilterFieldsMode } from "./utils/drizzle-conditions.js";
 export interface PostgresDriverConfig {
     connectionString?: string;
     adminConnectionString?: string;
+    /**
+     * This database's read replica: reads are routed there, writes stay on
+     * the primary. Unset, the boot ({@link postgresDriverConfigFromEnv}) fills
+     * it from `DATABASE_READ_URL` for the default source only; any other
+     * source has none unless its config names one — the managed runtime
+     * resolves `DATABASE_READ_URL__<KEY>` into this for each source.
+     */
     readConnectionString?: string;
+    /**
+     * A direct (non-pooled) URL to this database, for the connections that
+     * hold a `LISTEN`: change capture, cross-instance realtime, the Postgres
+     * channel bus and `admin.listen`. A transaction-mode pooler such as
+     * PgBouncer does not keep a `LISTEN`, so behind one this has to name the
+     * database itself.
+     *
+     * Unset, the boot fills it from `DATABASE_DIRECT_URL` for the default
+     * source only, and any other source listens on its own
+     * `connectionString` — see {@link resolveSourceUrls}. The managed runtime
+     * resolves `DATABASE_DIRECT_URL__<KEY>` into this for each source.
+     */
+    directConnectionString?: string;
     connection?: unknown;
     /**
      * The project's generated Drizzle module, for **diagnostics only**.
@@ -37,13 +57,17 @@ export interface PostgresDriverConfig {
      */
     introspectionSchema?: string;
     /**
-     * Realtime options, both opt-in:
+     * Realtime options, among them:
      *
      *  - `channels` — retention. Without rules no channel keeps any history and
      *    broadcast stays fire-and-forget. See {@link ChannelRetentionRule}.
      *  - `bus` — the cross-instance transport for channel broadcast and
      *    presence. Defaults to in-process only, which is correct for a single
      *    instance and wrong for two. See {@link ChannelBusConfig}.
+     *  - `cdc` — how changes are captured (`auto` by default).
+     *
+     * At boot each has an environment variable that wins over it — see
+     * {@link postgresDriverConfigFromEnv}.
      */
     realtime?: RealtimeChannelsConfig;
     /**
@@ -65,6 +89,13 @@ export interface PostgresDriverInternals {
     realtimeService: RealtimeService;
     driver: PostgresBackendDriver;
     poolManager?: DatabasePoolManager;
+    /**
+     * Whether the driver was opened with provisioning (`provision`, default
+     * true). The hooks that run after it — auth, history, the final security
+     * posture — read it, so `provision: false` means no DDL anywhere on the
+     * driver's path, not only while it opens.
+     */
+    provisioned: boolean;
     /**
      * Attach CDC triggers to tables that did not exist when the driver
      * bootstrapped. Only set when database-level capture is actually active.
@@ -118,6 +149,27 @@ export declare function describeSchemaDriftCause(provisioning: {
     attempted: boolean;
     reason?: string;
 } | undefined): string[];
+/**
+ * The URLs one source's driver opens besides its pool: the read replica, and
+ * the direct connection its `LISTEN`s are held on.
+ *
+ * The bare `DATABASE_READ_URL` and `DATABASE_DIRECT_URL` belong to the default
+ * source. Both used to be read here for every source, so a second database
+ * (`database("analytics")`) held its change-capture `LISTEN` on the default
+ * database — where none of its notifications are sent, so its realtime feed
+ * was silent — and read through the default's replica. A keyed source gets
+ * the URLs its config names, and otherwise its own connection and no replica.
+ *
+ * The default source still falls back to the environment: an application that
+ * builds this adapter itself passes a `connectionString` and nothing else, and
+ * has always had those two variables honoured.
+ *
+ * Exported for its own test; the caller needs a live database.
+ */
+export declare function resolveSourceUrls(pgConfig: Pick<PostgresDriverConfig, "connectionString" | "readConnectionString" | "directConnectionString">, sourceKey: string, env?: Record<string, string | undefined>): {
+    readUrl?: string;
+    directUrl?: string;
+};
 /**
  * Is this the local database `rebase init` scaffolds — i.e. the one case where
  * "you are connected as a superuser" is not news?
@@ -144,4 +196,51 @@ export declare function describeSchemaDriftCause(provisioning: {
  * ships `NODE_ENV=development` and some deployments inherit it.
  */
 export declare function isScaffoldedLocalDatabase(connectionString: string | undefined): boolean;
+/**
+ * `config` with the environment read into it, the way the server's boot reads
+ * it. The one place this driver reads environment variables:
+ *
+ * | variable                               | setting                                |
+ * |----------------------------------------|----------------------------------------|
+ * | `DATABASE_READ_URL`                    | `readConnectionString`, when unset (*) |
+ * | `DATABASE_DIRECT_URL`                  | `directConnectionString`, when unset (*)|
+ * | `REALTIME_CDC`                         | `realtime.cdc`                         |
+ * | `REALTIME_CHANNEL_BUS`                 | `realtime.bus` (a named transport)     |
+ * | `REALTIME_MAX_SUBSCRIPTIONS_PER_SOCKET`| `realtime.maxSubscriptionsPerSocket`   |
+ * | `REALTIME_MAX_SOCKETS_PER_USER`        | `realtime.maxSocketsPerUser`           |
+ * | `REALTIME_REFETCH_MAX_WAIT_MS`         | `realtime.refetchMaxWaitMs`            |
+ * | `REALTIME_RECOUNT_INTERVAL_MS`         | `realtime.recountIntervalMs`           |
+ * | `REALTIME_RECOUNT_MIN_ROWS`            | `realtime.recountMinRows`              |
+ *
+ * A `REALTIME_*` variable that is set wins over the option, so a deployment
+ * can change it without a rebuild; the URLs fill in only what the config left
+ * empty. A mistyped number throws, naming the variable.
+ *
+ * (*) For the default source only. The bare URL variables name the default
+ * database; read for a second source (`database("analytics")`), they put its
+ * change-capture `LISTEN` on the default database, where none of its
+ * notifications arrive, and its reads on the default's replica. A keyed
+ * source's URLs come from its own config — the managed runtime passes
+ * `DATABASE_*_URL__<KEY>` there — see {@link resolveSourceUrls}.
+ *
+ * `createPostgresAdapter` applies this when the server boots, and
+ * {@link openPostgresDriver} does not — a script that opens the driver itself
+ * gets exactly the config it passed.
+ */
+export declare function postgresDriverConfigFromEnv(config: PostgresDriverConfig, env?: NodeJS.ProcessEnv, sourceKey?: string): PostgresDriverConfig;
+/**
+ * Open the Postgres data driver from explicit settings.
+ *
+ * What `createPostgresAdapter` runs when the server boots, once it has read
+ * the environment into `pgConfig` (see {@link postgresDriverConfigFromEnv});
+ * this function reads no environment variable itself. `config` says what the
+ * caller wants opened: which collections, whether opening may change the
+ * database (`provision`, default true), and what part this process takes in
+ * realtime (`realtime`, or `false` for none at all).
+ *
+ * `openRebase` is this with `provision: false` and `realtime: false`.
+ */
+export declare function openPostgresDriver(pgConfig: PostgresDriverConfig, config: DatabaseAdapterInitConfig): Promise<InitializedDriver & {
+    internals: PostgresDriverInternals;
+}>;
 export declare function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): BackendBootstrapper;

package/dist/auth/ensure-tables.d.ts

@@ -1,5 +1,17 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { CollectionConfig } from "@rebasepro/types";
+/**
+ * One statement that drops each named index — but only one that covers a
+ * single column that a valid, unique, non-partial btree on the same table also
+ * leads with. That is the UNIQUE (token_hash) constraint's index, which serves
+ * every `token_hash = $1` lookup; a table that somehow lacks it keeps its
+ * plain index, so no lookup is ever left without one.
+ *
+ * `DROP INDEX` takes the table's ACCESS EXCLUSIVE lock, on the tables every
+ * sign-in and token refresh touches, so it runs under the boot lock budget
+ * (`lock_timeout`, transaction-local to this statement — see `boot-ddl`).
+ */
+export declare function dropDuplicateTokenHashIndexesSql(schema: string, names: readonly string[]): string;
 /**
  * Auto-create auth tables if they don't exist.
  *

package/dist/auth/services.d.ts

@@ -1,7 +1,6 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { type RebasePgTable } from "../types.js";
-import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, RefreshTokenSession, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server";
-export type { Role };
+import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RefreshTokenInfo, RefreshTokenSession, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, AccountAccessState, PendingEmailChange } from "@rebasepro/server";
 export interface AuthSchemaTables {
     users: RebasePgTable;
     refreshTokens: RebasePgTable;
@@ -38,6 +37,8 @@ export declare class UserService implements UserRepository {
     private db;
     private usersTable;
     private userIdentitiesTable;
+    /** Read by `getAccountAccessState`, to say whether one sign-in is still live. */
+    private refreshTokensTable;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
     private getQualifiedUsersTableName;
     /**
@@ -83,6 +84,11 @@ export declare class UserService implements UserRepository {
     updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null>;
     deleteUser(id: string): Promise<void>;
     listUsers(): Promise<UserData[]>;
+    /**
+     * @see UserRepository.firstUserIds — an unordered `LIMIT` read of the
+     * primary key, not `listUsersPaginated`'s count and sort of every row.
+     */
+    firstUserIds(limit: number): Promise<string[]>;
     listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
     /**
      * Update user's password hash; `null` removes the password.
@@ -100,10 +106,6 @@ export declare class UserService implements UserRepository {
      * Find user by email verification token
      */
     getUserByVerificationToken(token: string): Promise<UserData | null>;
-    /**
-     * Get roles for a user from database (inline TEXT[] column)
-     */
-    getUserRoles(uid: string): Promise<Role[]>;
     /**
      * Get role IDs for a user
      */
@@ -116,12 +118,53 @@ export declare class UserService implements UserRepository {
      * Assign a specific role to new user (appends if not present)
      */
     assignDefaultRole(uid: string, roleId: string): Promise<void>;
+    /**
+     * One read of what an access token is judged against: whether the account
+     * exists, its roles, and its revocation watermark. See
+     * `TokenRepository.getAccountAccessState`.
+     *
+     * The watermark is read only where the table declares it, as
+     * `RefreshTokenService.getTokensValidAfter` reads it — a table without the
+     * column has no watermark rather than an error on every request.
+     */
+    getAccountAccessState(uid: string, sessionId?: string): Promise<AccountAccessState | null>;
+    /**
+     * Whether the users table has `disabled_at`. `ensureAuthTablesExist` adds
+     * it to every auth table at boot, but the app's own drizzle object may
+     * predate it, so the database is asked — once — rather than the object.
+     */
+    private disabledColumn?;
+    private hasDisabledColumn;
+    /**
+     * Whether the users table has the address-change columns. Added at boot to
+     * every auth table, but the app's drizzle object never declares them, so
+     * the database is asked — once — as for `disabled_at`.
+     */
+    private emailChangeColumns?;
+    private hasEmailChangeColumns;
+    private requireEmailChangeColumns;
+    /** @see UserRepository.setPendingEmailChange */
+    setPendingEmailChange(uid: string, change: {
+        email: string;
+        tokenHash: string;
+    } | null): Promise<void>;
+    /** @see UserRepository.getPendingEmailChange */
+    getPendingEmailChange(uid: string): Promise<PendingEmailChange | null>;
+    /** @see UserRepository.findPendingEmailChange */
+    findPendingEmailChange(tokenHash: string): Promise<{
+        user: UserData;
+        change: PendingEmailChange;
+    } | null>;
+    /** @see UserRepository.applyPendingEmailChange — one write, held to the token. */
+    applyPendingEmailChange(uid: string, tokenHash: string): Promise<UserData | null>;
+    /** @see UserRepository.setUserDisabled */
+    setUserDisabled(uid: string, disabled: boolean): Promise<void>;
     /**
      * Get user with their roles
      */
     getUserWithRoles(uid: string): Promise<{
         user: UserData;
-        roles: Role[];
+        roles: string[];
     } | null>;
 }
 export declare class RefreshTokenService {
@@ -191,6 +234,12 @@ export declare class RefreshTokenService {
     deleteAllForUser(uid: string): Promise<void>;
     listForUser(uid: string): Promise<RefreshTokenInfo[]>;
     deleteById(id: string, uid: string): Promise<void>;
+    /**
+     * Every token past its expiry, whoever holds it. `prune` clears a user's
+     * expired rows when that user refreshes; a session nobody comes back to
+     * is only ever cleared here.
+     */
+    deleteExpired(): Promise<void>;
 }
 /**
  * Password reset token service
@@ -235,6 +284,8 @@ export declare class MagicLinkTokenService {
     private getQualifiedTableName;
     createToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
     findValidByHash(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
+    /** Links and email codes past their expiry, used or not. */
+    deleteExpired(): Promise<void>;
     markAsUsed(tokenHash: string): Promise<void>;
 }
 /**
@@ -262,6 +313,10 @@ export declare class PostgresTokenRepository implements TokenRepository {
     findValidPasswordResetToken(tokenHash: string): Promise<PasswordResetTokenInfo | null>;
     markPasswordResetTokenUsed(tokenHash: string): Promise<void>;
     deleteAllPasswordResetTokensForUser(uid: string): Promise<void>;
+    /**
+     * @see TokenRepository.deleteExpiredTokens — reset links, magic links and
+     * email codes, and refresh tokens, each past its own expiry.
+     */
     deleteExpiredTokens(): Promise<void>;
     createMagicLinkToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
     findValidMagicLinkToken(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
@@ -288,23 +343,30 @@ export declare class PostgresAuthRepository implements AuthRepository {
     deleteUser(id: string): Promise<void>;
     listUsers(): Promise<UserData[]>;
     listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
+    firstUserIds(limit: number): Promise<string[]>;
     updatePassword(id: string, passwordHash: string | null): Promise<void>;
     setEmailVerified(id: string, verified: boolean): Promise<void>;
     setVerificationToken(id: string, token: string | null): Promise<void>;
     getUserByVerificationToken(token: string): Promise<UserData | null>;
-    getUserRoles(uid: string): Promise<RoleData[]>;
     getUserRoleIds(uid: string): Promise<string[]>;
     setUserRoles(uid: string, roleIds: string[]): Promise<void>;
     assignDefaultRole(uid: string, roleId: string): Promise<void>;
     getUserWithRoles(uid: string): Promise<{
         user: UserData;
-        roles: RoleData[];
+        roles: string[];
+    } | null>;
+    getAccountAccessState(uid: string, sessionId?: string): Promise<AccountAccessState | null>;
+    setUserDisabled(uid: string, disabled: boolean): Promise<void>;
+    setPendingEmailChange(uid: string, change: {
+        email: string;
+        tokenHash: string;
+    } | null): Promise<void>;
+    getPendingEmailChange(uid: string): Promise<PendingEmailChange | null>;
+    findPendingEmailChange(tokenHash: string): Promise<{
+        user: UserData;
+        change: PendingEmailChange;
     } | null>;
-    getRoleById(id: string): Promise<RoleData | null>;
-    listRoles(): Promise<RoleData[]>;
-    createRole(_data: CreateRoleData): Promise<RoleData>;
-    updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
-    deleteRole(_id: string): Promise<void>;
+    applyPendingEmailChange(uid: string, tokenHash: string): Promise<UserData | null>;
     createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<boolean>;
     markRefreshTokenRotated(tokenHash: string): Promise<void>;
     revokeRefreshTokenSession(sessionId: string): Promise<void>;
@@ -383,6 +445,8 @@ export declare class MfaService implements MfaRepository {
      * share a single increment.
      */
     recordMfaChallengeAttempt(challengeId: string): Promise<number>;
+    /** Challenges past their five minutes, answered or not. */
+    deleteExpiredChallenges(): Promise<void>;
     verifyMfaChallenge(challengeId: string): Promise<void>;
     createRecoveryCodes(uid: string, codeHashes: string[]): Promise<void>;
     useRecoveryCode(uid: string, codeHash: string): Promise<boolean>;

package/dist/{auth-users-columns-D2LBFrMH.js → auth-users-columns-C72EMoDJ.js}

@@ -62,6 +62,22 @@ var AUTH_USERS_COLUMNS = [
 		column: "tokens_valid_after",
 		type: "TIMESTAMP WITH TIME ZONE"
 	},
+	{
+		column: "disabled_at",
+		type: "TIMESTAMP WITH TIME ZONE"
+	},
+	{
+		column: "pending_email",
+		type: "TEXT"
+	},
+	{
+		column: "email_change_token",
+		type: "TEXT"
+	},
+	{
+		column: "email_change_sent_at",
+		type: "TIMESTAMP WITH TIME ZONE"
+	},
 	{
 		column: "created_at",
 		type: "TIMESTAMP WITH TIME ZONE",
@@ -113,4 +129,4 @@ function isAuthCollection(collection) {
 //#endregion
 export { isAuthCollection as i, authUsersColumnDefinition as n, authUsersColumnSql as r, AUTH_USERS_COLUMNS as t };
 
-//# sourceMappingURL=auth-users-columns-D2LBFrMH.js.map
+//# sourceMappingURL=auth-users-columns-C72EMoDJ.js.map

package/dist/{auth-users-columns-D2LBFrMH.js.map → auth-users-columns-C72EMoDJ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-users-columns-D2LBFrMH.js","names":[],"sources":["../src/schema/auth-users-columns.ts"],"sourcesContent":["/**\n * The one description of what an auth user table's columns must be.\n *\n * ## Why this exists\n *\n * Three different code paths create `rebase.users`, and before this module they\n * disagreed about it:\n *\n * | column           | `db push` (generator) | `ensureAuthTablesExist` | `ensureCollectionTables` |\n * |------------------|-----------------------|-------------------------|--------------------------|\n * | `email`          | `TEXT UNIQUE NOT NULL`| `TEXT NOT NULL` + CHECK | `TEXT` (nullable)        |\n * | `roles`          | `TEXT[]`              | `NOT NULL DEFAULT '{}'` | nullable, no default     |\n * | `email_verified` | `BOOLEAN`             | `NOT NULL DEFAULT FALSE`| nullable                 |\n * | `created_at`     | `DEFAULT now()`       | `NOT NULL DEFAULT NOW()`| no default               |\n *\n * They are all `CREATE TABLE IF NOT EXISTS` / `ADD COLUMN IF NOT EXISTS`, so\n * whichever ran first decided the table and the other two silently no-op'd.\n * Boot order therefore chose the constraints: a managed deploy (collection\n * tables first) got a users table whose `email` was nullable and whose\n * `email_verified` had no default, while the same project pushed from a\n * checkout got the strict one. In the same table, `is_anonymous` came out\n * `NOT NULL DEFAULT false` — because *that* column existed in only one of the\n * three lists, so its owner's definition won by default.\n *\n * A second consequence was drift in the other direction. The scaffold's\n * `users.ts` describes 12 columns; auth needs 14. `db push` is declarative and\n * builds its desired state from the collection alone, so the two columns only\n * auth knows about (`is_anonymous`, `tokens_valid_after`) read as unmanaged\n * drift, and a push run after the server had booted once planned to DROP them.\n *\n * Both problems are the same problem: no single place said what this table is.\n * This is that place. Every creator asks here first and only then falls back to\n * the collection's own property definitions, so a column auth owns has one\n * definition regardless of who gets there first, and a column the developer\n * added to their users collection still behaves like any other field.\n *\n * ## What belongs here\n *\n * Only columns the auth services read or write. A developer's own additions to\n * their users collection (`bio`, `stripe_customer_id`) are ordinary columns and\n * must NOT be listed — they are generated from the collection like every other\n * field, and listing them here would freeze a user's schema.\n *\n * `id` is deliberately absent: its type comes from the collection's id property\n * (uuid / increment / text) and each creator already derives it.\n *\n * Keep in step with {@link AUTH_SCHEMA_VERSION} when a change here makes an\n * older runtime unable to work against a migrated table.\n */\n\n/**\n * A column auth owns.\n *\n * Structured rather than one SQL string because the same facts are needed in\n * three grammars — a `CREATE TABLE` column list, an `ADD COLUMN IF NOT EXISTS`,\n * and a pair of `ALTER COLUMN … SET DEFAULT` / `SET NOT NULL` reconciles for a\n * table that already exists with the wrong shape. Parsing a string back apart\n * for the third of those is how the copies drifted in the first place.\n */\nexport interface AuthUsersColumn {\n    /** Physical column name. */\n    column: string;\n    /** Postgres type. */\n    type: string;\n    /** Default expression, verbatim, or absent for no default. */\n    default?: string;\n    /** Whether the column is NOT NULL. */\n    notNull?: boolean;\n}\n\n/**\n * `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it\n * — it synthesizes `anon_<32 hex>@anonymous.local` rather than inserting NULL.\n * The 320-char bound (RFC 5321) is a CHECK rather than a `VARCHAR(n)`, added\n * separately by `ensureAuthTablesExist` so it can be `NOT VALID` on an adopted\n * table that already holds a longer row.\n */\nexport const AUTH_USERS_COLUMNS: readonly AuthUsersColumn[] = [\n    { column: \"email\", type: \"TEXT\", notNull: true },\n    { column: \"display_name\", type: \"TEXT\" },\n    { column: \"photo_url\", type: \"TEXT\" },\n    { column: \"roles\", type: \"TEXT[]\", default: \"'{}'\", notNull: true },\n    { column: \"password_hash\", type: \"TEXT\" },\n    { column: \"email_verified\", type: \"BOOLEAN\", default: \"FALSE\", notNull: true },\n    { column: \"email_verification_token\", type: \"TEXT\" },\n    { column: \"email_verification_sent_at\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    { column: \"is_anonymous\", type: \"BOOLEAN\", default: \"FALSE\", notNull: true },\n    { column: \"metadata\", type: \"JSONB\", default: \"'{}'\", notNull: true },\n    { column: \"tokens_valid_after\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    { column: \"created_at\", type: \"TIMESTAMP WITH TIME ZONE\", default: \"NOW()\", notNull: true },\n    { column: \"updated_at\", type: \"TIMESTAMP WITH TIME ZONE\", default: \"NOW()\", notNull: true }\n];\n\nconst BY_COLUMN = new Map(AUTH_USERS_COLUMNS.map(c => [c.column, c]));\n\n/** Type + inline constraints, as they appear after the column name. */\nexport function authUsersColumnSql(spec: AuthUsersColumn): string {\n    return [\n        spec.type,\n        spec.default !== undefined ? `DEFAULT ${spec.default}` : \"\",\n        spec.notNull ? \"NOT NULL\" : \"\"\n    ].filter(Boolean).join(\" \");\n}\n\n/**\n * The auth-owned definition for a physical column name, or `undefined` when\n * auth does not own it.\n *\n * Callers pass the RESOLVED column name (after `columnName` mapping), because\n * that is the only name the three creators agree on: the scaffold's users\n * collection spells the property `displayName` and the column `display_name`.\n */\nexport function authUsersColumnDefinition(column: string): string | undefined {\n    const spec = BY_COLUMN.get(column);\n    return spec ? authUsersColumnSql(spec) : undefined;\n}\n\n/**\n * Whether a collection is an auth collection, i.e. whether the definitions in\n * this module apply to its table at all.\n *\n * Duplicated in shape from `@rebasepro/common`'s policy defaults on purpose:\n * that one takes a `CollectionConfig`, this one is called from DDL code paths\n * that hold looser objects, and both spellings must accept `auth: true` as well\n * as `auth: { enabled: true }`.\n */\nexport function isAuthCollection(collection: unknown): boolean {\n    const auth = (collection as { auth?: unknown } | undefined)?.auth;\n    if (auth === true) return true;\n    return typeof auth === \"object\" && auth !== null && (auth as { enabled?: unknown }).enabled === true;\n}\n"],"mappings":";;;;;;;;;;AA6EA,IAAa,qBAAiD;CAC1D;EAAE,QAAQ;EAAS,MAAM;EAAQ,SAAS;CAAK;CAC/C;EAAE,QAAQ;EAAgB,MAAM;CAAO;CACvC;EAAE,QAAQ;EAAa,MAAM;CAAO;CACpC;EAAE,QAAQ;EAAS,MAAM;EAAU,SAAS;EAAQ,SAAS;CAAK;CAClE;EAAE,QAAQ;EAAiB,MAAM;CAAO;CACxC;EAAE,QAAQ;EAAkB,MAAM;EAAW,SAAS;EAAS,SAAS;CAAK;CAC7E;EAAE,QAAQ;EAA4B,MAAM;CAAO;CACnD;EAAE,QAAQ;EAA8B,MAAM;CAA2B;CACzE;EAAE,QAAQ;EAAgB,MAAM;EAAW,SAAS;EAAS,SAAS;CAAK;CAC3E;EAAE,QAAQ;EAAY,MAAM;EAAS,SAAS;EAAQ,SAAS;CAAK;CACpE;EAAE,QAAQ;EAAsB,MAAM;CAA2B;CACjE;EAAE,QAAQ;EAAc,MAAM;EAA4B,SAAS;EAAS,SAAS;CAAK;CAC1F;EAAE,QAAQ;EAAc,MAAM;EAA4B,SAAS;EAAS,SAAS;CAAK;AAC9F;AAEA,IAAM,YAAY,IAAI,IAAI,mBAAmB,KAAI,MAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;;AAGpE,SAAgB,mBAAmB,MAA+B;CAC9D,OAAO;EACH,KAAK;EACL,KAAK,YAAY,KAAA,IAAY,WAAW,KAAK,YAAY;EACzD,KAAK,UAAU,aAAa;CAChC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;AAC9B;;;;;;;;;AAUA,SAAgB,0BAA0B,QAAoC;CAC1E,MAAM,OAAO,UAAU,IAAI,MAAM;CACjC,OAAO,OAAO,mBAAmB,IAAI,IAAI,KAAA;AAC7C;;;;;;;;;;AAWA,SAAgB,iBAAiB,YAA8B;CAC3D,MAAM,OAAQ,YAA+C;CAC7D,IAAI,SAAS,MAAM,OAAO;CAC1B,OAAO,OAAO,SAAS,YAAY,SAAS,QAAS,KAA+B,YAAY;AACpG"}
+{"version":3,"file":"auth-users-columns-C72EMoDJ.js","names":[],"sources":["../src/schema/auth-users-columns.ts"],"sourcesContent":["/**\n * The one description of what an auth user table's columns must be.\n *\n * ## Why this exists\n *\n * Three different code paths create `rebase.users`, and before this module they\n * disagreed about it:\n *\n * | column           | `db push` (generator) | `ensureAuthTablesExist` | `ensureCollectionTables` |\n * |------------------|-----------------------|-------------------------|--------------------------|\n * | `email`          | `TEXT UNIQUE NOT NULL`| `TEXT NOT NULL` + CHECK | `TEXT` (nullable)        |\n * | `roles`          | `TEXT[]`              | `NOT NULL DEFAULT '{}'` | nullable, no default     |\n * | `email_verified` | `BOOLEAN`             | `NOT NULL DEFAULT FALSE`| nullable                 |\n * | `created_at`     | `DEFAULT now()`       | `NOT NULL DEFAULT NOW()`| no default               |\n *\n * They are all `CREATE TABLE IF NOT EXISTS` / `ADD COLUMN IF NOT EXISTS`, so\n * whichever ran first decided the table and the other two silently no-op'd.\n * Boot order therefore chose the constraints: a managed deploy (collection\n * tables first) got a users table whose `email` was nullable and whose\n * `email_verified` had no default, while the same project pushed from a\n * checkout got the strict one. In the same table, `is_anonymous` came out\n * `NOT NULL DEFAULT false` — because *that* column existed in only one of the\n * three lists, so its owner's definition won by default.\n *\n * A second consequence was drift in the other direction. The scaffold's\n * `users.ts` describes 12 columns; auth needs 14. `db push` is declarative and\n * builds its desired state from the collection alone, so the two columns only\n * auth knows about (`is_anonymous`, `tokens_valid_after`) read as unmanaged\n * drift, and a push run after the server had booted once planned to DROP them.\n *\n * Both problems are the same problem: no single place said what this table is.\n * This is that place. Every creator asks here first and only then falls back to\n * the collection's own property definitions, so a column auth owns has one\n * definition regardless of who gets there first, and a column the developer\n * added to their users collection still behaves like any other field.\n *\n * ## What belongs here\n *\n * Only columns the auth services read or write. A developer's own additions to\n * their users collection (`bio`, `stripe_customer_id`) are ordinary columns and\n * must NOT be listed — they are generated from the collection like every other\n * field, and listing them here would freeze a user's schema.\n *\n * `id` is deliberately absent: its type comes from the collection's id property\n * (uuid / increment / text) and each creator already derives it.\n *\n * Keep in step with {@link AUTH_SCHEMA_VERSION} when a change here makes an\n * older runtime unable to work against a migrated table.\n */\n\n/**\n * A column auth owns.\n *\n * Structured rather than one SQL string because the same facts are needed in\n * three grammars — a `CREATE TABLE` column list, an `ADD COLUMN IF NOT EXISTS`,\n * and a pair of `ALTER COLUMN … SET DEFAULT` / `SET NOT NULL` reconciles for a\n * table that already exists with the wrong shape. Parsing a string back apart\n * for the third of those is how the copies drifted in the first place.\n */\nexport interface AuthUsersColumn {\n    /** Physical column name. */\n    column: string;\n    /** Postgres type. */\n    type: string;\n    /** Default expression, verbatim, or absent for no default. */\n    default?: string;\n    /** Whether the column is NOT NULL. */\n    notNull?: boolean;\n}\n\n/**\n * `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it\n * — it synthesizes `anon_<32 hex>@anonymous.local` rather than inserting NULL.\n * The 320-char bound (RFC 5321) is a CHECK rather than a `VARCHAR(n)`, added\n * separately by `ensureAuthTablesExist` so it can be `NOT VALID` on an adopted\n * table that already holds a longer row.\n */\nexport const AUTH_USERS_COLUMNS: readonly AuthUsersColumn[] = [\n    { column: \"email\", type: \"TEXT\", notNull: true },\n    { column: \"display_name\", type: \"TEXT\" },\n    { column: \"photo_url\", type: \"TEXT\" },\n    { column: \"roles\", type: \"TEXT[]\", default: \"'{}'\", notNull: true },\n    { column: \"password_hash\", type: \"TEXT\" },\n    { column: \"email_verified\", type: \"BOOLEAN\", default: \"FALSE\", notNull: true },\n    { column: \"email_verification_token\", type: \"TEXT\" },\n    { column: \"email_verification_sent_at\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    { column: \"is_anonymous\", type: \"BOOLEAN\", default: \"FALSE\", notNull: true },\n    { column: \"metadata\", type: \"JSONB\", default: \"'{}'\", notNull: true },\n    { column: \"tokens_valid_after\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    // When an administrator switched the account off; NULL while it is on.\n    { column: \"disabled_at\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    // A self-service address change waiting for its link: the address, the\n    // hash of the token mailed to it, and when (it lives 24 hours).\n    { column: \"pending_email\", type: \"TEXT\" },\n    { column: \"email_change_token\", type: \"TEXT\" },\n    { column: \"email_change_sent_at\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    { column: \"created_at\", type: \"TIMESTAMP WITH TIME ZONE\", default: \"NOW()\", notNull: true },\n    { column: \"updated_at\", type: \"TIMESTAMP WITH TIME ZONE\", default: \"NOW()\", notNull: true }\n];\n\nconst BY_COLUMN = new Map(AUTH_USERS_COLUMNS.map(c => [c.column, c]));\n\n/** Type + inline constraints, as they appear after the column name. */\nexport function authUsersColumnSql(spec: AuthUsersColumn): string {\n    return [\n        spec.type,\n        spec.default !== undefined ? `DEFAULT ${spec.default}` : \"\",\n        spec.notNull ? \"NOT NULL\" : \"\"\n    ].filter(Boolean).join(\" \");\n}\n\n/**\n * The auth-owned definition for a physical column name, or `undefined` when\n * auth does not own it.\n *\n * Callers pass the RESOLVED column name (after `columnName` mapping), because\n * that is the only name the three creators agree on: the scaffold's users\n * collection spells the property `displayName` and the column `display_name`.\n */\nexport function authUsersColumnDefinition(column: string): string | undefined {\n    const spec = BY_COLUMN.get(column);\n    return spec ? authUsersColumnSql(spec) : undefined;\n}\n\n/**\n * Whether a collection is an auth collection, i.e. whether the definitions in\n * this module apply to its table at all.\n *\n * Duplicated in shape from `@rebasepro/common`'s policy defaults on purpose:\n * that one takes a `CollectionConfig`, this one is called from DDL code paths\n * that hold looser objects, and both spellings must accept `auth: true` as well\n * as `auth: { enabled: true }`.\n */\nexport function isAuthCollection(collection: unknown): boolean {\n    const auth = (collection as { auth?: unknown } | undefined)?.auth;\n    if (auth === true) return true;\n    return typeof auth === \"object\" && auth !== null && (auth as { enabled?: unknown }).enabled === true;\n}\n"],"mappings":";;;;;;;;;;AA6EA,IAAa,qBAAiD;CAC1D;EAAE,QAAQ;EAAS,MAAM;EAAQ,SAAS;CAAK;CAC/C;EAAE,QAAQ;EAAgB,MAAM;CAAO;CACvC;EAAE,QAAQ;EAAa,MAAM;CAAO;CACpC;EAAE,QAAQ;EAAS,MAAM;EAAU,SAAS;EAAQ,SAAS;CAAK;CAClE;EAAE,QAAQ;EAAiB,MAAM;CAAO;CACxC;EAAE,QAAQ;EAAkB,MAAM;EAAW,SAAS;EAAS,SAAS;CAAK;CAC7E;EAAE,QAAQ;EAA4B,MAAM;CAAO;CACnD;EAAE,QAAQ;EAA8B,MAAM;CAA2B;CACzE;EAAE,QAAQ;EAAgB,MAAM;EAAW,SAAS;EAAS,SAAS;CAAK;CAC3E;EAAE,QAAQ;EAAY,MAAM;EAAS,SAAS;EAAQ,SAAS;CAAK;CACpE;EAAE,QAAQ;EAAsB,MAAM;CAA2B;CAEjE;EAAE,QAAQ;EAAe,MAAM;CAA2B;CAG1D;EAAE,QAAQ;EAAiB,MAAM;CAAO;CACxC;EAAE,QAAQ;EAAsB,MAAM;CAAO;CAC7C;EAAE,QAAQ;EAAwB,MAAM;CAA2B;CACnE;EAAE,QAAQ;EAAc,MAAM;EAA4B,SAAS;EAAS,SAAS;CAAK;CAC1F;EAAE,QAAQ;EAAc,MAAM;EAA4B,SAAS;EAAS,SAAS;CAAK;AAC9F;AAEA,IAAM,YAAY,IAAI,IAAI,mBAAmB,KAAI,MAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;;AAGpE,SAAgB,mBAAmB,MAA+B;CAC9D,OAAO;EACH,KAAK;EACL,KAAK,YAAY,KAAA,IAAY,WAAW,KAAK,YAAY;EACzD,KAAK,UAAU,aAAa;CAChC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;AAC9B;;;;;;;;;AAUA,SAAgB,0BAA0B,QAAoC;CAC1E,MAAM,OAAO,UAAU,IAAI,MAAM;CACjC,OAAO,OAAO,mBAAmB,IAAI,IAAI,KAAA;AAC7C;;;;;;;;;;AAWA,SAAgB,iBAAiB,YAA8B;CAC3D,MAAM,OAAQ,YAA+C;CAC7D,IAAI,SAAS,MAAM,OAAO;CAC1B,OAAO,OAAO,SAAS,YAAY,SAAS,QAAS,KAA+B,YAAY;AACpG"}

package/dist/backup/backup-cli.d.ts

@@ -3,9 +3,82 @@
  * `rebase db backups list`. Kept out of the main `cli.ts` dispatcher so the
  * backup surface stays self-contained.
  */
-import arg from "arg";
+import type arg from "arg";
+import type { StorageController } from "@rebasepro/server";
+import { BackupDestination } from "./pg-tools.js";
+/**
+ * The controller for an object-storage destination, or `null` for a local one.
+ *
+ * Built by `backupStorageFromEnv` from `@rebasepro/server` — the function the
+ * Backups panel's routes use — so the CLI and the panel read a bucket the same
+ * way. This file had its own copy, and the two had already drifted once
+ * (`S3_FORCE_PATH_STYLE` read as `=== "true"`, so a MinIO backup addressed the
+ * bucket as a host).
+ *
+ * Exported for its test.
+ */
+export declare function resolveStorageForDestination(dest: BackupDestination, env: Record<string, string | undefined>): Promise<StorageController | null>;
+/**
+ * The directory `rebase` was run from, which `rebase` puts here for the driver.
+ *
+ * The driver runs in the project's `backend/`, so a relative path resolved
+ * against its own working directory named a different place from the one the
+ * user typed it in: `rebase db backup --out ./backups` wrote to `<root>/backups`
+ * (the CLI resolves explicit paths itself) while `rebase db backups list`
+ * looked in `<root>/backend/backups`. Spelled the same in
+ * `packages/cli/src/commands/db.ts`.
+ */
+export declare const INVOCATION_CWD_ENV = "REBASE_INVOCATION_CWD";
+/** Where a relative path the user typed is relative to: where they ran `rebase`. */
+export declare function invocationDir(env?: Readonly<Record<string, string | undefined>>): string;
+/**
+ * Where `db backup` writes and `db backups list` reads, by one rule.
+ *
+ * - `--out` is relative to where `rebase` was run, like any path typed on a
+ *   command line.
+ * - `BACKUP_DESTINATION` is relative to the backend directory, because the
+ *   server reads the same variable there: the Backups panel and the scheduled
+ *   backup have to find what the CLI wrote.
+ * - With neither, `./backups` where `rebase` was run, as the help says.
+ *
+ * An `s3://` or `gs://` destination is returned as given.
+ */
+export declare function resolveBackupLocation(opts: {
+    flag?: string;
+    configured?: string;
+    invocationDir: string;
+    backendDir: string;
+}): string;
+/**
+ * Parse a `rebase db backup …` line. An undeclared flag is refused (see
+ * `parseCommandFlags`), and so is a positional: `rebase db backup ./backups`
+ * means `--out ./backups`, and taken as nothing it wrote to the default
+ * directory.
+ */
+export declare function parseBackupLine(rawArgs: string[]): arg.Result<{
+    "--database-url": StringConstructor;
+    "--docker": BooleanConstructor;
+    "--debug": BooleanConstructor;
+    "--help": BooleanConstructor;
+    "-h": string;
+} & {
+    "--out": StringConstructor;
+    "--output": string;
+    "--exclude-schema": [StringConstructor];
+    "--no-owner": BooleanConstructor;
+    "--enable-row-security": BooleanConstructor;
+    "--row-security-role": StringConstructor;
+    "-o": string;
+}>;
 export declare function backupCommand(rawArgs: string[]): Promise<void>;
-/** Parse a `rebase db restore …` line; the first positional is the backup. */
+/**
+ * Parse a `rebase db restore …` line; the one positional is the backup.
+ *
+ * Strict, because this is the command where a typo costs most: parsed
+ * permissively, `--targt-db x` became a second positional, the target fell
+ * back to DATABASE_URL's own database, and the restore ran against the live
+ * one.
+ */
 export declare function parseRestoreLine(rawArgs: string[]): arg.Result<{
     "--database-url": StringConstructor;
     "--docker": BooleanConstructor;

package/dist/backup/backup-service.d.ts

@@ -1,4 +1,5 @@
 import type { StorageController } from "@rebasepro/server";
+import { resolvePgBinary } from "./pg-binary.js";
 import { BackupDestination, type RowSecurityIdentity, VersionCompatibility } from "./pg-tools.js";
 import { BackupObject, RetentionOptions } from "./retention.js";
 /**
@@ -11,8 +12,7 @@ export declare class BackupToolError extends Error {
     readonly hint?: string | undefined;
     constructor(message: string, hint?: string | undefined);
 }
-/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
-export declare function resolvePgBinary(tool: "pg_dump" | "pg_restore" | "pg_dumpall", env?: Record<string, string | undefined>): string | null;
+export { resolvePgBinary };
 /** Run `<bin> --version` and extract the major version. */
 export declare function detectToolMajor(bin: string): Promise<number | null>;
 /** Query the server for its major version via `server_version_num`. */

package/dist/backup/pg-binary.d.ts

@@ -0,0 +1,5 @@
+export type PgTool = "pg_dump" | "pg_restore" | "pg_dumpall";
+/** The variable that points at `tool` when it is not on the PATH. */
+export declare function pgToolVariable(tool: PgTool): string;
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
+export declare function resolvePgBinary(tool: PgTool, env?: Record<string, string | undefined>): string | null;