@rebasepro/server-postgres 0.25.0 → 0.26.0

package/dist/{open-rebase-BKA7Nyoe.js → open-rebase-C8jQ6s5a.js}

@@ -1,30 +1,31 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { i as createPostgresDatabaseConnection } from "./connection-C938nR3E.js";
-import { _ as visibleColumnProjection, a as buildSearchColumnSpec, l as searchColumnNames, r as SEARCH_UNACCENT_FN, s as hiddenColumnsOption } from "./search-column-BM-GV6vH.js";
-import { a as diagnoseDbError, c as isEconnrefused, n as closedDatabaseName, nt as extractCauseMessage, r as deepestErrorMessage, u as parseHostInfo } from "./cli-errors-DwQnNATs.js";
-import { a as pgErrorToFriendlyMessage, i as isRowLevelSecurityDenial, n as extractPgError, o as reachedDatabase, r as isRoleSwitchingPermissionError, s as sanitizeErrorForClient, t as classifyConnectFailure } from "./pg-error-utils-Bv5n2PLn.js";
-import { t as BranchService } from "./BranchService-iXXZeVYD.js";
-import { a as ensureAppRoleGrants, d as warnOnLegacyRlsFunctions, f as warnOnRoleSchemaCollision, i as ensureAppRole, l as validatePolicyPgRoles, n as applyAuthContext, r as detectConnectionPosture, s as revokeUserRoleSql, t as REBASE_USER_ROLE$1, u as warnOnAnonymousGrants } from "./rls-enforcement-D7P4-ZYX.js";
-import { u as resolveColumnName } from "./column-plan-helpers-D_V4oaZh.js";
-import { i as isAuthCollection, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-C72EMoDJ.js";
-import { n as planSchema, o as sharedRelationName } from "./plan-schema-CXOucCw-.js";
-import { t as generateSchema } from "./generate-drizzle-schema-logic-DA3zM8zc.js";
-import { r as renderPgType } from "./render-ddl-CQNwZdse.js";
-import { u as typesAgree } from "./deferred-index-build-Cis_HoGn.js";
-import { a as isLockTimeout, c as resolveBootLockOptions, l as sleep, n as BOOT_LOCK_TIMEOUT_MS } from "./boot-ddl-s_3Hkz94.js";
-import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-DvvImXDe.js";
-import { t as DatabasePoolManager } from "./databasePoolManager-Yqdw14wY.js";
-import { a as resolveAuthSchema, i as probeAuthSchema, r as assertAuthSchemaCompatible, t as ensureAuthTablesExist } from "./ensure-tables-Dpgwx5sy.js";
-import { _ as humanize, g as mapPgType, i as buildTablesMap, l as getIconForTable, p as singularize, r as buildEnumMap, u as identifyJoinTables } from "./introspect-db-logic-CI5CU_n0.js";
+import { i as createPostgresDatabaseConnection } from "./connection-czvI7TZL.js";
+import { _ as visibleColumnProjection, a as buildSearchColumnSpec, r as SEARCH_UNACCENT_FN, s as hiddenColumnsOption } from "./search-column-BM-GV6vH.js";
+import { a as diagnoseDbError, c as isEconnrefused, n as closedDatabaseName, r as deepestErrorMessage, rt as extractCauseMessage, u as parseHostInfo } from "./cli-errors-DsYyNYzd.js";
+import { a as pgErrorToFriendlyMessage, i as isRowLevelSecurityDenial, n as extractPgError, o as reachedDatabase, r as isRoleSwitchingPermissionError, s as sanitizeErrorForClient, t as classifyConnectFailure } from "./pg-error-utils-DhiUTlVx.js";
+import { t as BranchService } from "./BranchService-CWBnDhcv.js";
+import { a as ensureAppRoleGrants, c as revokeUserRoleSql, d as warnOnAnonymousGrants, f as warnOnLegacyRlsFunctions, i as ensureAppRole, n as applyAuthContext, o as findExposedInternalTables, p as warnOnRoleSchemaCollision, r as detectConnectionPosture, t as REBASE_USER_ROLE$1, u as validatePolicyPgRoles } from "./rls-enforcement-BOHuHVlc.js";
+import { u as resolveColumnName } from "./column-plan-helpers-IG6uFb1s.js";
+import { t as AUTH_USERS_COLUMNS } from "./auth-users-columns-C72EMoDJ.js";
+import { n as planSchema } from "./plan-schema-Czf3q4-Q.js";
+import { t as generateSchema } from "./generate-drizzle-schema-logic-CPzCRD-8.js";
+import { r as renderPgType } from "./render-ddl-4v88y-Gv.js";
+import { u as typesAgree } from "./deferred-index-build-CqaOv1Xx.js";
+import { a as isLockTimeout, c as resolveBootLockOptions, l as sleep, n as BOOT_LOCK_TIMEOUT_MS } from "./boot-ddl-EsgqDkx0.js";
+import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-CFIRq8ni.js";
+import { a as mergeDatabaseBranch, i as diffDatabaseBranch } from "./branch-diff-CxE4VlxT.js";
+import { t as DatabasePoolManager } from "./databasePoolManager-3stMNFL-.js";
+import { a as resolveAuthSchema, i as probeAuthSchema, r as assertAuthSchemaCompatible, t as ensureAuthTablesExist } from "./ensure-tables-4nA-tfwi.js";
+import { a as buildBaasSchema, c as introspectSchema, i as warnOnGeneratedSchemaDrift, l as readRlsStatus, n as diffGeneratedSchemaAgainstCatalogue, o as readCatalogueSchema, s as buildCollectionsFromSchema } from "./generated-schema-diff-eZCklRZQ.js";
 import { Client, DatabaseError, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, assertQueryFieldsReadable, createDdlBootstrapper, createEmailService, logger, rawQueryLoggingEnabled, resolveBatchRefs, rowETag, splitFieldOps } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, is, isNotNull, isNull, isTable, lt, lte, not, notInArray, or, relations, sql } from "drizzle-orm";
-import { PgArray, PgNumeric, PgTable, PgTimestamp, PgTimestampString, PgTransaction, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
-import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, INCLUDE_COUNT_KEY, JUNCTION_PIVOT_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, parseEnvBoolean, parseRelationAggregateSort, resolveClientListLimit, resourceEnvSuffix, resourceKeyOf } from "@rebasepro/types";
-import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, REBASE_USER_ROLE, UnknownFilterOperatorError, apiHiddenFieldNames, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createAccessorSlugResolver, createRelationRef, createRelationRefWithData, deserializeFilter, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, firstSqlRow, getColumnName, getDeclaredPrimaryKeys, getJunctionCollectionConfig, getJunctionConfigForRelation, getTableName as getTableName$1, getTenantConfig, hasFieldAccessRules, includableRelationNames, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseIdValues as parseIdValues$1, parseOrderBySpecStrict, queryableFieldNames, requireCallbackClient, requireCallbackCollection, resolveCollectionRelations, resolveJunctionSpecs, resolveTenantWrite, restoresSoftDeletedRow, revokeInternalTableSql, softDeleteFieldOf, sqlRows, tenantBypassRoles, toCallbackError, toFilterTuples, unknownAggregateField, unknownFilterField, unknownIncludeRelation, unknownOrderByField, unknownProjectionField, unknownRelationTargetField, unknownVectorProperty, updateDateAutoValues, updateUserAutoValues, withRelationReferencesOnly } from "@rebasepro/common";
-import { camelCase, firstFreeKey, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, splitSearchTerms, toSnakeCase, toWireKey, unref } from "@rebasepro/utils";
+import { PgArray, PgNumeric, PgTable, PgTimestamp, PgTimestampString, PgTransaction, bigint, boolean, getTableConfig, index, integer, jsonb, pgSchema, pgTable, text, timestamp, unique, uuid } from "drizzle-orm/pg-core";
+import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, INCLUDE_COUNT_KEY, JUNCTION_PIVOT_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, parseEnvBoolean, parseRelationAggregateSort, resolveClientListLimit, resourceEnvSuffix, resourceKeyOf, roleNameProblem } from "@rebasepro/types";
+import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, REBASE_USER_ROLE, UnknownFilterOperatorError, apiHiddenFieldNames, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createAccessorSlugResolver, createRelationRef, createRelationRefWithData, deserializeFilter, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, firstSqlRow, getColumnName, getDeclaredPrimaryKeys, getJunctionConfigForRelation, getTableName as getTableName$1, getTenantConfig, hasFieldAccessRules, includableRelationNames, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseIdValues as parseIdValues$1, parseOrderBySpecStrict, queryableFieldNames, requireCallbackClient, requireCallbackCollection, resolveCollectionRelations, resolveTenantWrite, restoresSoftDeletedRow, revokeInternalTableSql, softDeleteFieldOf, sqlRows, tenantBypassRoles, toCallbackError, toFilterTuples, unknownAggregateField, unknownFilterField, unknownIncludeRelation, unknownOrderByField, unknownProjectionField, unknownRelationTargetField, unknownVectorProperty, updateDateAutoValues, updateUserAutoValues, withRelationReferencesOnly } from "@rebasepro/common";
+import { camelCase, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, splitSearchTerms, toSnakeCase, toWireKey, unref } from "@rebasepro/utils";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { WebSocket } from "ws";
 import { EventEmitter } from "events";
@@ -4404,6 +4405,38 @@ function isJunctionBackedRelation(relation) {
 	return relation.shared;
 }
 /**
+* Reject a create or update whose body names a relation Rebase does not write
+* — a multi-hop `via` (`writable: false`) — before anything is read or written.
+*
+* A single-hop `via` is written through this door as it shipped (to-one: the
+* target's key; to-many: one junction's rows). A longer chain used to get as
+* far as the writer: a to-many one failed inside the transaction as a 500
+* RELATION_MISCONFIGURED telling the caller to regenerate a schema that was
+* fine, and a to-one one re-pointed the target at the first step's column.
+*
+* Matched the way the write path matches: a key that is a relation's own name
+* (the to-many split), or a `relation` property that resolves to one (the
+* to-one transformer). An `undefined` value is no value — the transformer skips
+* it — so it is not a write; `null` is, since it would unlink.
+*/
+function assertNoReadOnlyRelationValues(values, collection) {
+	const properties = collection.properties ?? {};
+	let relations;
+	const named = [];
+	for (const [key, value] of Object.entries(values)) {
+		if (value === void 0) continue;
+		relations ??= resolveCollectionRelations(collection);
+		const relation = relations[key] ?? (properties[key]?.type === "relation" ? findRelation(relations, key) : void 0);
+		if (relation && !relation.writable) named.push(key);
+	}
+	if (named.length === 0) return;
+	const list = named.map((key) => `'${key}'`).join(", ");
+	throw ApiError.badRequest(`${list} on '${collection.slug}' ${named.length > 1 ? "are multi-hop `via` relations" : "is a multi-hop `via` relation"}, which is read-only: only single-hop via relations are writable — a to-one chain of one step, or a to-many chain through one junction table. Write the rows the chain joins directly.`, "RELATION_NOT_WRITABLE", {
+		collection: collection.slug,
+		fields: named
+	});
+}
+/**
 * Reject a nested write whose final segment is a to-one relation.
 *
 * There is no column on the target row that records a to-one parent — the
@@ -4415,8 +4448,8 @@ function isJunctionBackedRelation(relation) {
 */
 function assertWritableThrough(hop, path) {
 	const { relation } = hop;
-	if (relation.writable && relation.cardinality === "many") return;
-	if (!relation.writable) throw ApiError.badRequest(`"${path}" ends in '${hop.relationKey}', a \`via\` relation. Rebase will not infer how to write through an arbitrary join chain — write the row at "${hop.targetCollection.slug}" directly.`, "RELATION_NOT_WRITABLE");
+	if (relation.kind !== "via" && relation.writable && relation.cardinality === "many") return;
+	if (relation.kind === "via") throw ApiError.badRequest(`"${path}" ends in '${hop.relationKey}', a \`via\` relation, which a nested path does not write through — write the row at "${hop.targetCollection.slug}" directly` + (relation.writable ? `, and link it by setting '${hop.relationKey}' in an update of the '${hop.parentCollection.slug}' row.` : "."), "RELATION_NOT_WRITABLE");
 	throw ApiError.badRequest(`"${path}" ends in the to-one relation '${hop.relationKey}', which cannot be written through: the foreign key for a to-one relation lives on '${hop.parentCollection.slug}', not on '${hop.targetCollection.slug}'. Write the target row at "${hop.targetCollection.slug}" and set '${hop.relationKey}' on the parent instead.`, "RELATION_NOT_WRITABLE");
 }
 //#endregion
@@ -5339,6 +5372,38 @@ var FetchService = class FetchService {
 		return values;
 	}
 	/**
+	* Every row of a collection's table, as stored, a page at a time, in key
+	* order — the driver's `scanStoredRows`.
+	*
+	* Deliberately none of the read pipeline: no `beforeQuery` (a sweep has no
+	* caller to scope to, and the documented hook narrows a caller-less read to
+	* the rows owned by nobody), no soft-delete filter, no `afterRead`, no
+	* field stripping. The columns come back under their table names; a sweep
+	* reads values, not keys. Paged by the key rather than an offset, so a row
+	* deleted during the scan never shifts another past the next page.
+	*/
+	async *scanStoredRows(collectionPath, pageSize = 500) {
+		const collection = getCollectionByPath(collectionPath, this.registry);
+		const table = getTableForCollection(collection, this.registry);
+		const keys = primaryKeyColumns(table, requirePrimaryKeys(collection, this.registry), collectionPath);
+		const keyNames = keys.map((column) => {
+			const entry = Object.entries(getTableColumns(table)).find(([, candidate]) => candidate === column);
+			if (!entry) throw new Error(`Key column '${column.name}' not found in table for collection '${collectionPath}'`);
+			return entry[0];
+		});
+		const limit = Math.max(1, pageSize);
+		let after;
+		for (;;) {
+			const past = after ? or(...keys.map((column, i) => and(...keys.slice(0, i).map((earlier, j) => eq(earlier, after[j])), gt(column, after[i])))) : void 0;
+			const query = this.db.select().from(table);
+			const rows = await (past ? query.where(past) : query).orderBy(...keys.map((column) => asc(column))).limit(limit);
+			if (rows.length > 0) yield rows;
+			if (rows.length < limit) return;
+			const last = rows[rows.length - 1];
+			after = keyNames.map((name) => last[name]);
+		}
+	}
+	/**
 	* Fetch a collection of rows
 	*/
 	async fetchCollection(collectionPath, options = {}) {
@@ -6804,6 +6869,7 @@ var PersistService = class {
 			}
 		}
 		const collection = getCollectionByPath(effectiveCollectionPath, this.registry);
+		assertNoReadOnlyRelationValues(effectiveValues, collection);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = getPrimaryKeys(collection, this.registry);
 		idInfoArray.map((info) => info.fieldName);
@@ -8900,6 +8966,15 @@ var DEFAULT_RECONNECT_DELAY_MS = 3e3;
 /** Guards the identifier interpolated into `LISTEN`. */
 var SAFE_CHANNEL = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /**
+* Why a connect failed, in one line: the message, and the SQLSTATE or socket
+* code when the message does not already carry it.
+*/
+function connectFailureReason(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : void 0;
+	return code && !message.includes(code) ? `${message} [${code}]` : message;
+}
+/**
 * A half-open connection — one whose packets stop arriving, with no FIN and no
 * RST, which is what an idle-flow timeout on a load balancer, a NAT, a dead
 * middlebox or a failed-over network looks like — fires no `error` and no
@@ -8923,6 +8998,8 @@ var PgNotifyListener = class {
 	heartbeatInFlight = false;
 	downSince;
 	lastHeartbeatAt;
+	/** Whether this outage's "could not be opened" has been said. Cleared once it listens again. */
+	outageWarned = false;
 	constructor(options) {
 		this.options = options;
 		if (!SAFE_CHANNEL.test(options.channel)) throw new Error(`Unsafe NOTIFY channel name "${options.channel}" — expected a plain SQL identifier.`);
@@ -9014,6 +9091,7 @@ var PgNotifyListener = class {
 			this.client = client;
 			pending = void 0;
 			this.downSince = void 0;
+			this.outageWarned = false;
 			this.lastHeartbeatAt = Date.now();
 			this.startHeartbeat(client);
 			logger.debug(`📡 ${logLabel} Listening on channel "${channel}".`);
@@ -9022,7 +9100,12 @@ var PgNotifyListener = class {
 				await pending.end();
 			} catch {}
 			if (first && !this.options.retryInitialConnect) throw err;
-			logger.error(`❌ ${logLabel} Failed to connect LISTEN client`, { error: err });
+			const retry = `${logLabel} LISTEN connection could not be opened (${connectFailureReason(err)}); retrying every ${Math.round((this.options.reconnectDelayMs ?? DEFAULT_RECONNECT_DELAY_MS) / 1e3)} s.`;
+			if (this.outageWarned) logger.debug(retry);
+			else {
+				this.outageWarned = true;
+				logger.warn(`⚠️ ${retry}`);
+			}
 			this.scheduleReconnect();
 			return;
 		}
@@ -9460,10 +9543,29 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				createBranch: this.branchService.createBranch.bind(this.branchService),
 				deleteBranch: this.branchService.deleteBranch.bind(this.branchService),
 				listBranches: this.branchService.listBranches.bind(this.branchService),
-				getBranchInfo: this.branchService.getBranchInfo.bind(this.branchService)
+				getBranchInfo: this.branchService.getBranchInfo.bind(this.branchService),
+				diffBranch: async (name, options) => this.nameDiffCollections(await diffDatabaseBranch(this.admin, name, options)),
+				mergeBranch: (name, options) => mergeDatabaseBranch(this.admin, name, options)
 			} : {}
 		};
 	}
+	/** The diff with each table named by the collection it backs, where one does. */
+	nameDiffCollections(diff) {
+		const collections = this.registry?.getCollections() ?? [];
+		const slugOf = (schema, table) => collections.find((collection) => {
+			return ("schema" in collection && typeof collection.schema === "string" ? collection.schema : "public") === schema && getTableName$1(collection) === table;
+		})?.slug;
+		return {
+			...diff,
+			data: diff.data.map((entry) => {
+				const collection = slugOf(entry.schema, entry.table);
+				return collection ? {
+					...entry,
+					collection
+				} : entry;
+			})
+		};
+	}
 	/**
 	* `SQLAdmin.listen`: a `LISTEN` on a connection of its own, through the
 	* listener CDC and the channel bus use, which reconnects and heartbeats.
@@ -9558,6 +9660,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		const client = this.client;
 		return {
 			user: this.user,
+			...this.user?.credential ? { credential: this.user.credential } : {},
 			driver: this,
 			data: this.data,
 			get client() {
@@ -9727,6 +9830,15 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		return rows;
 	}
 	/**
+	* Every stored row of a collection, past every read hook, for a whole-store
+	* sweep — see `DataDriver.scanStoredRows`. Only this unscoped driver has
+	* it: {@link AuthenticatedPostgresBackendDriver} reads as a caller, and a
+	* caller's reads are scoped.
+	*/
+	scanStoredRows(props) {
+		return this.dataService.getFetchService().scanStoredRows(props.path, props.pageSize);
+	}
+	/**
 	* Listen to a collection: the rows now, then again after every change.
 	*
 	* The realtime service runs every read, the first one included, as
@@ -11066,6 +11178,7 @@ var AuthenticatedPostgresBackendDriver = class {
 		const client = this.delegate.client;
 		writeScope?.setSettledContext({
 			user: this.user,
+			...this.user?.credential ? { credential: this.user.credential } : {},
 			driver: this,
 			data: this.data,
 			get client() {
@@ -13026,9 +13139,13 @@ var ChannelPresenceStore = class {
 	* `tablesReady` is now set from a probe of what exists, not from having been
 	* the instance that created it.
 	*/
-	async ensureTables() {
-		if (this.tablesReady) return;
+	async ensureTables(options = {}) {
+		if (this.tablesReady) return true;
 		const ddl = drizzleDdlBootstrapper(this.db, "channel-presence");
+		if (options.provision === false) {
+			this.tablesReady = await ddl.isReadable("rebase.channel_presence");
+			return this.tablesReady;
+		}
 		await ddl.ensureObject("rebase schema", "CREATE SCHEMA IF NOT EXISTS rebase");
 		await ddl.ensureObject("channel_presence table", `
             CREATE TABLE IF NOT EXISTS rebase.channel_presence (
@@ -13052,6 +13169,7 @@ var ChannelPresenceStore = class {
 			await ddl.step("channel_presence revoke", () => this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence"))));
 			this.tablesReady = true;
 		}
+		return this.tablesReady;
 	}
 	/** Record (or refresh) a client's presence. */
 	async track(channel, clientId, state) {
@@ -13734,6 +13852,14 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	refetchQueue = /* @__PURE__ */ new Set();
 	/** Group refetches running now — at most {@link maxConcurrentRefetches}. */
 	refetchesRunning = 0;
+	/**
+	* What a group refetch runs inside — see {@link setScopeRunner}. A refetch
+	* runs on a timer armed by whatever announced the change; one armed by a
+	* change-capture notification inherits the LISTEN connection's context,
+	* which is no backend's, so a hook the read reached saw the process
+	* default as `rebase`.
+	*/
+	runInScope = (fn) => fn();
 	/** See {@link refetchConcurrencyFor}. */
 	maxConcurrentRefetches;
 	/**
@@ -14002,6 +14128,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (group.pending !== "all") group.pending.delete(key);
 		if (group.members.size > 0) return;
 		if (group.timer) clearTimeout(group.timer);
+		if (group.recountTimer) clearTimeout(group.recountTimer);
 		this.refetchQueue.delete(group);
 		this.groups.delete(group.key);
 		const [index, address] = group.type === "collection" ? [this.collectionGroupsByPath, group.path] : [this.singleGroupsByAddress, `${group.path}\u0000${group.id}`];
@@ -14075,7 +14202,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			this.refetchQueue.delete(group);
 			if (this.groups.get(group.key) !== group) continue;
 			this.refetchesRunning++;
-			this.refetchGroup(group).finally(() => {
+			this.runInScope(() => this.refetchGroup(group)).finally(() => {
 				this.refetchesRunning--;
 				this.drainRefetchQueue();
 			});
@@ -14849,6 +14976,17 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		});
 	}
 	/**
+	* Refetch `group` — and so count it again — at `at`, when the total its
+	* last frame reused expires. One pending at a time per group.
+	*/
+	scheduleRecount(group, at) {
+		if (group.recountTimer) return;
+		group.recountTimer = setTimeout(() => {
+			group.recountTimer = void 0;
+			if (this.groups.get(group.key) === group) this.scheduleGroupRefetch(group);
+		}, Math.max(0, at - Date.now()) + 1);
+	}
+	/**
 	* The `meta` a `collection_update` frame carries beside its rows, counted
 	* through `service` — the subscriber's own transaction, read only, with
 	* its auth context and `beforeQuery` narrowing already bound.
@@ -14877,6 +15015,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		else if (reusable && this.recountIntervalMs !== void 0 && reusable.total >= this.recountMinRows && Date.now() - reusable.at < this.recountIntervalMs) {
 			total = reusable.total;
 			totalAsOf = new Date(reusable.at).toISOString();
+			if (group) this.scheduleRecount(group, reusable.at + this.recountIntervalMs);
 		} else {
 			try {
 				total = await service.count(notifyPath, {
@@ -15455,7 +15594,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* what it was before this existed, whereas refusing to boot takes the whole
 	* backend down for it.
 	*/
-	async configureChannelBus(bus) {
+	async configureChannelBus(bus, options = {}) {
 		if (bus.kind === "memory") {
 			this.bus = bus;
 			return;
@@ -15471,7 +15610,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		this.bus = bus;
 		try {
 			const store = new ChannelPresenceStore(this.db, this.instanceId);
-			await store.ensureTables();
+			if (!await store.ensureTables({ provision: options.provision }) && options.provision === false) throw new Error("rebase.channel_presence does not exist, and this backend changes nothing in its database. A provisioning run with the same channel bus configured creates it.");
 			this.presenceStore = store;
 			this.ensurePresenceSweep();
 		} catch (error) {
@@ -15802,6 +15941,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		for (const group of this.groups.values()) {
 			if (group.timer) clearTimeout(group.timer);
 			group.timer = void 0;
+			if (group.recountTimer) clearTimeout(group.recountTimer);
+			group.recountTimer = void 0;
 		}
 		this.unscheduledListGroups.clear();
 		this.listPathChangedAt.clear();
@@ -15861,6 +16002,10 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	isCdcActive() {
 		return this.cdcActive && this.cdcListener?.connected === true;
 	}
+	/** See `RealtimeProvider.setScopeRunner`. */
+	setScopeRunner(run) {
+		this.runInScope = run;
+	}
 	/** The LISTEN connections this service depends on — see `RealtimeProvider.health`. */
 	health() {
 		const listeners = [];
@@ -16395,7 +16540,7 @@ function columnNames(table) {
 	}
 	return names;
 }
-var quote = (xs) => Array.from(xs).map((s) => `\`${s}\``).join(", ");
+var quote$1 = (xs) => Array.from(xs).map((s) => `\`${s}\``).join(", ");
 /** `on.from` / `on.to` accept a single column or a composite tuple. */
 var asColumns = (value) => Array.isArray(value) ? value : [value];
 /**
@@ -16417,7 +16562,7 @@ function compositeKeyDefect(relation, source, target, registry) {
 		const keys = getPrimaryKeys(keyed, registry);
 		if (keys.length < 2) return void 0;
 		return {
-			problem: `${linkColumn} is one column, and \`${keyed.slug}\` is keyed on ${quote(keys.map((key) => key.fieldName))} together — one column cannot reference a composite key`,
+			problem: `${linkColumn} is one column, and \`${keyed.slug}\` is keyed on ${quote$1(keys.map((key) => key.fieldName))} together — one column cannot reference a composite key`,
 			fix
 		};
 	};
@@ -16546,7 +16691,7 @@ function findRelationDefects(collections, registry, given) {
 						} : {
 							...at,
 							problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
-							fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
+							fix: `add the column, or set \`localKey\` to one of: ${quote$1(sourceColumns)}`
 						});
 					}
 					break;
@@ -16560,13 +16705,13 @@ function findRelationDefects(collections, registry, given) {
 						} : {
 							...at,
 							problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
-							fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
+							fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote$1(targetColumns)}`
 						});
 					}
 					if (relation.sourceKey && !sourceColumns.has(relation.sourceKey)) defects.push({
 						...at,
 						problem: `\`sourceKey: "${relation.sourceKey}"\` is not a column on \`${sourceTableName}\``,
-						fix: targetColumns.has(relation.sourceKey) ? `it is a column on the *target* table \`${targetTableName}\` — \`sourceKey\` names the column on this collection that the target's foreign key points at, so it must be one of: ${quote(sourceColumns)}` : `add the column, or set \`sourceKey\` to one of: ${quote(sourceColumns)}`
+						fix: targetColumns.has(relation.sourceKey) ? `it is a column on the *target* table \`${targetTableName}\` — \`sourceKey\` names the column on this collection that the target's foreign key points at, so it must be one of: ${quote$1(sourceColumns)}` : `add the column, or set \`sourceKey\` to one of: ${quote$1(sourceColumns)}`
 					});
 					break;
 				case "manyToMany": {
@@ -16593,7 +16738,7 @@ function findRelationDefects(collections, registry, given) {
 						} : {
 							...at,
 							problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
-							fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
+							fix: `set \`through.${label}\` to one of: ${quote$1(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
 						});
 					}
 					break;
@@ -16625,12 +16770,12 @@ function findRelationDefects(collections, registry, given) {
 						for (const column of asColumns(step.on.from)) if (!prevColumns.has(column)) defects.push({
 							...at,
 							problem: `step ${i + 1} joins \`${prevName}.${column}\` → \`${step.table}\`, but \`${column}\` is not a column on \`${prevName}\``,
-							fix: `\`joinPath[${i}].on.from\` names columns on ${i === 0 ? "this collection's table" : `the previous step's table (\`${prevName}\`)`}: ${quote(prevColumns)}`
+							fix: `\`joinPath[${i}].on.from\` names columns on ${i === 0 ? "this collection's table" : `the previous step's table (\`${prevName}\`)`}: ${quote$1(prevColumns)}`
 						});
 						for (const column of asColumns(step.on.to)) if (!stepColumns.has(column)) defects.push({
 							...at,
 							problem: `step ${i + 1} joins into \`${step.table}.${column}\`, but \`${column}\` is not a column on \`${step.table}\``,
-							fix: `\`joinPath[${i}].on.to\` names columns on \`${step.table}\`: ${quote(stepColumns)}`
+							fix: `\`joinPath[${i}].on.to\` names columns on \`${step.table}\`: ${quote$1(stepColumns)}`
 						});
 						if (asColumns(step.on.from).length !== asColumns(step.on.to).length) defects.push({
 							...at,
@@ -17122,14 +17267,26 @@ var UserService = class {
 		return result.rows[0].roles ?? [];
 	}
 	/**
-	* Set roles for a user (replaces existing roles)
+	* Set roles for a user (replaces existing roles).
+	*
+	* Each role is its own bound parameter. The array used to be spelled as a
+	* literal, `{${roles.join(",")}}`, so the database parsed what the caller
+	* had only checked as strings: `"support,admin"` was stored as two roles,
+	* one of them `admin`, and `"NULL"` as a SQL NULL. A name that would be read
+	* back as other roles is refused (`roleNameProblem`) — RLS splits the
+	* comma-joined `app.user_roles` the same way.
 	*/
 	async setUserRoles(uid, roleIds) {
+		const problems = roleIds.flatMap((role) => {
+			const problem = roleNameProblem(role);
+			return problem ? [`${JSON.stringify(role)} ${problem}`] : [];
+		});
+		if (problems.length > 0) throw ApiError.badRequest(`Not valid role names: ${problems.join("; ")}`, "INVALID_ROLE");
 		const usersTableName = this.getQualifiedUsersTableName();
-		const rolesArray = `{${roleIds.join(",")}}`;
+		const rolesArray = roleIds.length === 0 ? sql`'{}'::text[]` : sql`ARRAY[${sql.join(roleIds.map((role) => sql`${role}`), sql`, `)}]::text[]`;
 		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
-            SET roles = ${rolesArray}::text[], updated_at = NOW()
+            SET roles = ${rolesArray}, updated_at = NOW()
             WHERE id = ${uid}
         `));
 	}
@@ -18151,6 +18308,59 @@ var MfaService = class {
 	}
 };
 //#endregion
+//#region src/auth/verify-auth-tables.ts
+/**
+* Whether the auth tables a backend reads are there, on a backend that may not
+* create them.
+*
+* A driver opened without provisioning skips `ensureAuthTablesExist` — the
+* tables are another process's to make — and before this nothing took its
+* place. A database that lacked `rebase.refresh_tokens`, or had a users table
+* from a release before `disabled_at`, booted green and then failed every
+* sign-in with a 500 whose cause was one missing relation. Auth cannot run on
+* part of its schema, so this is a refusal at boot, naming each table.
+*
+* Asked by reading, not by the catalogue: a `SELECT` of every column the auth
+* services name, `WHERE false`. That answers "missing", "out of date" and "this
+* role may not read it" in one statement per table, with the database's own
+* words for whichever it is.
+*/
+var quote = (identifier) => `"${identifier.replace(/"/g, "\"\"")}"`;
+/** What a Drizzle table definition says auth will query. */
+function expectationOf(table) {
+	const config = getTableConfig(table);
+	return {
+		table: config.schema ? `${quote(config.schema)}.${quote(config.name)}` : quote(config.name),
+		columns: Object.values(getTableColumns(table)).map((column) => column.name)
+	};
+}
+/**
+* The users table, which is the project's own when it declares an auth
+* collection: only the columns the auth bootstrap guarantees on it are
+* expected, never the collection's other fields — those are the collection
+* schema's business, checked where collections are.
+*/
+function usersExpectation(qualifiedTable) {
+	return {
+		table: qualifiedTable,
+		columns: ["id", ...AUTH_USERS_COLUMNS.map((spec) => spec.column)]
+	};
+}
+/** Each table that cannot be read as expected, with the database's reason. */
+async function findUnusableAuthTables(db, expectations) {
+	const problems = [];
+	for (const { table, columns } of expectations) try {
+		await db.execute(sql.raw(`SELECT ${columns.map(quote).join(", ")} FROM ${table} WHERE false`));
+	} catch (err) {
+		problems.push(`${table}: ${deepestErrorMessage(err)}`);
+	}
+	return problems;
+}
+/** The refusal, phrased as what to run. */
+function unusableAuthTablesError(problems) {
+	return /* @__PURE__ */ new Error("Auth cannot run on this database, and this backend changes nothing in it (provisioning is off):\n" + problems.map((problem) => `  - ${problem}`).join("\n") + "\nCreate them with a provisioning run against this database (REBASE_PROVISION_ONLY=true, without REBASE_PROVISION=false), or apply the SQL such a run recorded (REBASE_PROVISION_SQL_OUT).");
+}
+//#endregion
 //#region src/history/ensure-history-table.ts
 /** How a history entry gets written from inside the write it records. */
 var RECORD_HISTORY_FUNCTION = "rebase.record_history";
@@ -18554,6 +18764,28 @@ var HistoryService = class {
         `)) ?? null;
 	}
 	/**
+	* Every entry's `values` and `previous_values`, of every row, a page at a
+	* time in id order — for a whole-store sweep. `rebase storage orphans`
+	* reads it because a history revert restores the values an entry holds,
+	* so a file only an entry names is still in use.
+	*/
+	async *scanStoredValues(pageSize = 1e3) {
+		const limit = Math.max(1, pageSize);
+		let after;
+		for (;;) {
+			const rows = sqlRows(await this.db.execute(sql`
+                SELECT id, "values", previous_values
+                FROM rebase.entity_history
+                ${after === void 0 ? sql`` : sql`WHERE id > ${after}`}
+                ORDER BY id
+                LIMIT ${limit}
+            `));
+			if (rows.length > 0) yield rows.map((row) => [row.values, row.previous_values]);
+			if (rows.length < limit) return;
+			after = rows[rows.length - 1].id;
+		}
+	}
+	/**
 	* Each entry's `format`. A table without the column holds only entries
 	* that store the whole previous row, which is what `1` says.
 	*/
@@ -18758,991 +18990,6 @@ function patchPgNumericToNumber(tables) {
 	if (patchedCount > 0) logger.debug(`[PgNumeric] ${patchedCount} numeric column(s) will be served as numbers`);
 }
 //#endregion
-//#region src/schema/introspect-runtime.ts
-/**
-* Read the RLS posture of each table in a schema.
-*
-* This is what decides whether baas mode may serve a table. A table with RLS
-* disabled has no authorization model: since every authenticated request runs
-* as `rebase_user`, and that role is granted DML on the schema, serving such a
-* table hands every row to every logged-in user.
-*/
-async function readRlsStatus(client, pgSchema) {
-	const { rows } = await client.query(`SELECT c.relname AS table,
-                c.relrowsecurity AS rls_enabled,
-                (SELECT count(*) FROM pg_policy p WHERE p.polrelid = c.oid) AS policy_count
-         FROM pg_class c
-         JOIN pg_namespace n ON n.oid = c.relnamespace
-         WHERE n.nspname = $1 AND c.relkind = 'r'`, [pgSchema]);
-	return new Map(rows.map((r) => [r.table, {
-		table: r.table,
-		rlsEnabled: r.rls_enabled === true,
-		policyCount: Number(r.policy_count ?? 0)
-	}]));
-}
-/**
-* Read tables, columns, enums, primary keys and foreign keys for a schema.
-* Mirrors the queries in introspect-db.ts.
-*/
-async function introspectSchema(client, pgSchema) {
-	const { rows: tables } = await client.query(`SELECT table_name
-         FROM information_schema.tables
-         WHERE table_schema = $1 AND table_type = 'BASE TABLE'
-           AND table_name NOT LIKE 'drizzle_%'
-           AND table_name NOT LIKE 'rebase_%'
-         ORDER BY table_name`, [pgSchema]);
-	const { rows: columns } = await client.query(`SELECT
-            c.table_name,
-            c.column_name,
-            c.data_type,
-            c.udt_name,
-            c.is_nullable,
-            c.column_default,
-            -- A stored generated column must be declared as one, or drizzle
-            -- writes DEFAULT into it on every INSERT. Postgres tolerates that
-            -- today; the generated module has always declared them properly,
-            -- and the runtime tables are built to match it.
-            c.is_generated,
-            c.generation_expression,
-            (SELECT a.atttypmod FROM pg_attribute a
-             JOIN pg_class pc ON a.attrelid = pc.oid
-             WHERE pc.relname = c.table_name
-               AND a.attname = c.column_name
-               AND pc.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = c.table_schema)) as atttypmod
-         FROM information_schema.columns c
-         WHERE c.table_schema = $1`, [pgSchema]);
-	const { rows: enumValues } = await client.query(`SELECT t.typname AS enum_name,
-                e.enumlabel AS enum_value,
-                e.enumsortorder AS sort_order
-         FROM pg_type t
-         JOIN pg_enum e ON t.oid = e.enumtypid
-         JOIN pg_namespace n ON t.typnamespace = n.oid
-         WHERE n.nspname = $1
-         ORDER BY t.typname, e.enumsortorder`, [pgSchema]);
-	const { rows: pks } = await client.query(`SELECT t.relname as table_name, a.attname as column_name
-         FROM   pg_index i
-         JOIN   pg_attribute a ON a.attrelid = i.indrelid
-                             AND a.attnum = ANY(i.indkey)
-         JOIN   pg_class t ON t.oid = i.indrelid
-         JOIN   pg_namespace n ON n.oid = t.relnamespace
-         WHERE  i.indisprimary AND n.nspname = $1`, [pgSchema]);
-	const { rows: fks } = await client.query(`SELECT
-            tc.table_name,
-            kcu.column_name,
-            ccu.table_name AS foreign_table_name,
-            ccu.column_name AS foreign_column_name
-         FROM information_schema.table_constraints AS tc
-         JOIN information_schema.key_column_usage AS kcu
-           ON tc.constraint_name = kcu.constraint_name
-           AND tc.table_schema = kcu.table_schema
-         JOIN information_schema.constraint_column_usage AS ccu
-           ON ccu.constraint_name = tc.constraint_name
-           AND ccu.table_schema = tc.table_schema
-         WHERE tc.constraint_type = 'FOREIGN KEY' AND tc.table_schema = $1`, [pgSchema]);
-	const tablesMap = buildTablesMap(tables, columns, pks, fks);
-	return {
-		tablesMap,
-		enumMap: buildEnumMap(enumValues),
-		joinTables: identifyJoinTables(tablesMap)
-	};
-}
-/** Derive the `isId` flavour for a primary-key column. */
-function idKindFor(col, propType) {
-	if (col.data_type.toLowerCase() === "uuid") return "uuid";
-	if (propType === "number") return "increment";
-	return true;
-}
-function buildProperties(meta, enumMap) {
-	const properties = {};
-	const takenKeys = /* @__PURE__ */ new Set();
-	for (const col of meta.columns) {
-		const isPk = meta.pks.includes(col.column_name);
-		if (meta.fks.some((fk) => fk.column_name === col.column_name) && !isPk) continue;
-		const enumValues = enumMap.get(col.udt_name);
-		const isEnum = col.data_type === "USER-DEFINED" && enumValues !== void 0;
-		const isVector = col.udt_name === "vector";
-		const propType = isEnum ? "string" : isVector ? "vector" : mapPgType(col.data_type);
-		const property = {
-			name: humanize(col.column_name),
-			columnName: col.column_name,
-			type: propType
-		};
-		const key = firstFreeKey([toWireKey(col.column_name), col.column_name], takenKeys);
-		takenKeys.add(key);
-		if (isPk) property.isId = idKindFor(col, propType);
-		else if (col.is_nullable === "NO" && col.column_default === null) property.validation = { required: true };
-		if (isEnum && enumValues) property.enum = enumValues.map((value) => ({
-			id: value,
-			label: humanize(value)
-		}));
-		properties[key] = property;
-	}
-	return properties;
-}
-/**
-* Owning relations, derived from this table's foreign keys — the same shape
-* `generateCollectionFile` writes into a collection file: a `relation` property
-* whose nested descriptor carries `kind`, a `target` thunk and the `localKey`.
-*
-* The shape is load-bearing, not cosmetic. `resolveCollectionRelations` reads
-* relations from `property.relation` and `resolveRelation` requires `target` to
-* be a thunk; this used to emit `target`/`cardinality`/`localKey` flat on the
-* property with the slug as a bare string, which satisfies neither. Nothing
-* threw — the resolver simply skipped every such property and reported that the
-* collection had no relations. So an introspected BaaS collection had its FK
-* columns removed from `properties` (they "surface as relations") and then no
-* resolvable relation to surface as, which is why writing the FK column
-* directly came back as `has no field 'product_id'`: `assertKnownWriteFields`
-* learns that column from the resolved relation's `localKey`.
-*
-* The thunk closes over the collections being built in this same pass rather
-* than importing a module, which is what a runtime introspection has instead of
-* generated files. It is called lazily, after the map is fully populated, so a
-* table may reference one introspected later.
-*/
-function buildRelations(meta, slugByTable, collectionBySlug) {
-	const relations = {};
-	for (const fk of meta.fks) {
-		const targetSlug = slugByTable.get(fk.foreign_table_name);
-		if (!targetSlug) continue;
-		let key = toWireKey(fk.column_name.replace(/_id$/, ""));
-		if (meta.pks.includes(fk.column_name) && key === fk.column_name) key = fk.foreign_table_name;
-		relations[key] = {
-			name: humanize(key),
-			type: "relation",
-			relation: {
-				kind: "belongsTo",
-				target: () => collectionBySlug.get(targetSlug),
-				localKey: fk.column_name
-			}
-		};
-	}
-	return relations;
-}
-/**
-* Turn an introspected schema into collections.
-*
-* Join tables are skipped: they carry no identity of their own and exist to
-* express a many-to-many edge between two other tables.
-*/
-function buildCollectionsFromSchema({ tablesMap, enumMap, joinTables }, pgSchema) {
-	const slugByTable = /* @__PURE__ */ new Map();
-	for (const tableName of tablesMap.keys()) if (!joinTables.has(tableName)) slugByTable.set(tableName, tableName);
-	const collections = [];
-	const collectionBySlug = /* @__PURE__ */ new Map();
-	for (const [tableName, meta] of tablesMap) {
-		if (joinTables.has(tableName)) continue;
-		const collectionName = humanize(tableName);
-		const collection = {
-			name: collectionName,
-			singularName: singularize(collectionName),
-			slug: tableName,
-			table: tableName,
-			schema: pgSchema,
-			icon: getIconForTable(tableName),
-			properties: {
-				...buildProperties(meta, enumMap),
-				...buildRelations(meta, slugByTable, collectionBySlug)
-			}
-		};
-		collections.push(collection);
-		collectionBySlug.set(tableName, collection);
-	}
-	return collections;
-}
-//#endregion
-//#region src/schema/dynamic-tables.ts
-/**
-* Build drizzle tables at runtime from an introspected schema.
-*
-* **Every** data source's tables are built here, from `information_schema`,
-* after boot-ensure has run — a project with declared collections included. The
-* committed `schema.generated.ts` is a build artefact for Atlas, `db push`,
-* `eject` and user code; the runtime does not read it for its tables, because a
-* file that is one commit behind the database used to change what the server
-* served (a renamed foreign-key column 500'd every request, a lost relation
-* silently emptied a list). See `catalogue-schema.ts` for the caller.
-*
-* These are handed to drizzle as its schema, which keeps the relational query
-* path (`db.query.*`) working; without them FetchService would fall back to
-* plain selects and lose relation loading.
-*
-* Two things a caller has to supply for the tables to match what the generated
-* module used to produce, both about *names*: the Drizzle object is keyed by the
-* wire name of a column and not by the column (`authorId`, not `author_id`), and
-* a relation is keyed by the collection's own relation key rather than by a
-* guess made from the foreign key. Both come from the collections — see
-* `columnKeysFromCollections` and `buildDrizzleRelationsFromCollections`.
-*/
-var columnNameAsKey = (_table, column) => column;
-/** drizzle ships no bytea builder; binary must round-trip as a Buffer. */
-var bytea = customType({ dataType: () => "bytea" });
-/**
-* A full-text search column, declared with its real SQL type.
-*
-* Not cosmetic: `isSearchIndexColumn` asks the column for its type and drops
-* every `tsvector` from the projection, so a search column that fell through to
-* `text` (the old default for an unrecognised type) would be selected, returned
-* to callers, and rendered in the admin as a wall of lexemes. drizzle ships no
-* builder for these two.
-*/
-var tsvector = customType({ dataType: () => "tsvector" });
-var tsquery = customType({ dataType: () => "tsquery" });
-/**
-* Postgres stores a column's type modifier (varchar length, vector dimensions)
-* in `atttypmod`. For length-carrying string types it is length + VARHDRSZ(4);
-* for pgvector it is the dimension count as-is. -1 means unspecified.
-*/
-function varlenLength(col) {
-	return col.atttypmod && col.atttypmod > 4 ? col.atttypmod - 4 : void 0;
-}
-/**
-* Map a Postgres type to a drizzle column builder, keyed on `udt_name` — the
-* concrete underlying type, which is exact where `data_type` reports umbrella
-* values like "ARRAY" or "USER-DEFINED".
-*
-* Unknown types fall back to `text`: the driver still reads and writes them,
-* with the value passing through as a string, which beats dropping the column.
-*/
-function scalarBuilder(udtName, name, col) {
-	switch (udtName) {
-		case "uuid": return uuid(name);
-		case "bool": return boolean(name);
-		case "int2": return smallint(name);
-		case "int4": return integer(name);
-		case "int8": return bigint(name, { mode: "number" });
-		case "float4": return real(name);
-		case "float8": return doublePrecision(name);
-		case "numeric":
-		case "money": return numeric(name);
-		case "json": return json(name);
-		case "jsonb": return jsonb(name);
-		case "date": return date(name);
-		case "time": return time(name);
-		case "timetz": return time(name, { withTimezone: true });
-		case "timestamp": return timestamp(name, { mode: "string" });
-		case "timestamptz": return timestamp(name, {
-			withTimezone: true,
-			mode: "string"
-		});
-		case "interval": return interval(name);
-		case "bytea": return bytea(name);
-		case "inet": return inet(name);
-		case "cidr": return cidr(name);
-		case "macaddr": return macaddr(name);
-		case "macaddr8": return macaddr8(name);
-		case "point": return point(name);
-		case "line": return line(name);
-		case "geometry": return geometry(name);
-		case "vector": {
-			const dimensions = col.atttypmod && col.atttypmod > 0 ? col.atttypmod : void 0;
-			return dimensions ? vector(name, { dimensions }) : text(name);
-		}
-		case "bpchar": {
-			const length = varlenLength(col);
-			return length ? char(name, { length }) : char(name);
-		}
-		case "varchar": {
-			const length = varlenLength(col);
-			return length ? varchar(name, { length }) : text(name);
-		}
-		case "tsvector": return tsvector(name);
-		case "tsquery": return tsquery(name);
-		default: return text(name);
-	}
-}
-/** See {@link FluentColumnBuilder}. */
-var fluent = (builder) => builder;
-function columnBuilderFor(col) {
-	if (col.udt_name.startsWith("_")) return fluent(scalarBuilder(col.udt_name.slice(1), col.column_name, col)).array();
-	return scalarBuilder(col.udt_name, col.column_name, col);
-}
-/**
-* Build one drizzle table per introspected table, keyed by table name.
-*
-* @param columnKey how a column is named on the wire — see {@link ColumnKeyResolver}.
-*/
-function buildDrizzleTablesFromSchema(tablesMap, pgSchemaName = "public", columnKey = columnNameAsKey) {
-	const schema = pgSchemaName === "public" ? null : pgSchema(pgSchemaName);
-	const createTable = schema ? schema.table.bind(schema) : pgTable;
-	const tables = {};
-	for (const [tableName, meta] of tablesMap) {
-		const columns = {};
-		const keyOf = /* @__PURE__ */ new Map();
-		for (const col of meta.columns) {
-			let builder = columnBuilderFor(col);
-			if (col.is_nullable === "NO") builder = fluent(builder).notNull();
-			if (meta.pks.length === 1 && meta.pks[0] === col.column_name) builder = fluent(builder).primaryKey();
-			if (col.is_generated === "ALWAYS") builder = fluent(builder).generatedAlwaysAs(sql.raw(col.generation_expression ?? ""));
-			const key = columnKey(tableName, col.column_name);
-			keyOf.set(col.column_name, key);
-			columns[key] = builder;
-		}
-		tables[tableName] = createTable(tableName, columns, meta.pks.length > 1 ? (t) => [primaryKey({ columns: meta.pks.map((pk) => t[keyOf.get(pk) ?? pk]) })] : void 0);
-	}
-	return tables;
-}
-/**
-* Build drizzle `relations()` for the foreign keys, so the relational query
-* path can actually load them.
-*
-* FetchService asks drizzle for `with: { <key>: true }`, keyed by the relation
-* property on the collection. Tables alone don't satisfy that — without these,
-* `?include=author` silently returns the raw `author_id` and no author.
-*
-* The keys here must match `buildRelations` in introspect-runtime.ts, which is
-* what names the collection's relation properties.
-*/
-function buildDrizzleRelationsFromSchema(tablesMap, tables, columnKey = columnNameAsKey) {
-	/** Owning side, per table: the `one()` relations from its foreign keys. */
-	const owning = /* @__PURE__ */ new Map();
-	/** Inverse side, per referenced table: the matching `many()` back-references. */
-	const inverse = /* @__PURE__ */ new Map();
-	for (const [tableName, meta] of tablesMap) {
-		if (!tables[tableName]) continue;
-		const columnNames = new Set(meta.columns.map((c) => columnKey(tableName, c.column_name)));
-		for (const fk of meta.fks) {
-			if (!tables[fk.foreign_table_name]) continue;
-			let key = toWireKey(fk.column_name.replace(/_id$/, ""));
-			if (meta.pks.includes(fk.column_name) && key === fk.column_name) key = fk.foreign_table_name;
-			if (columnNames.has(key)) continue;
-			const relationName = `${tableName}_${fk.column_name}`;
-			owning.set(tableName, [...owning.get(tableName) ?? [], {
-				key,
-				targetTable: fk.foreign_table_name,
-				fkColumn: columnKey(tableName, fk.column_name),
-				targetColumn: columnKey(fk.foreign_table_name, fk.foreign_column_name),
-				relationName
-			}]);
-			const backKey = tableName;
-			if (new Set((tablesMap.get(fk.foreign_table_name)?.columns ?? []).map((c) => columnKey(fk.foreign_table_name, c.column_name))).has(backKey)) continue;
-			inverse.set(fk.foreign_table_name, [...inverse.get(fk.foreign_table_name) ?? [], {
-				key: backKey,
-				sourceTable: tableName,
-				relationName
-			}]);
-		}
-	}
-	const built = {};
-	for (const tableName of tablesMap.keys()) {
-		const table = tables[tableName];
-		const ones = owning.get(tableName) ?? [];
-		const manys = inverse.get(tableName) ?? [];
-		if (!table || ones.length === 0 && manys.length === 0) continue;
-		built[`${tableName}Relations`] = relations(table, ({ one, many }) => {
-			const map = {};
-			for (const rel of ones) map[rel.key] = one(tables[rel.targetTable], {
-				fields: [getTableColumns(table)[rel.fkColumn]],
-				references: [getTableColumns(tables[rel.targetTable])[rel.targetColumn]],
-				relationName: rel.relationName
-			});
-			for (const rel of manys) {
-				if (map[rel.key]) continue;
-				map[rel.key] = many(tables[rel.sourceTable], { relationName: rel.relationName });
-			}
-			return map;
-		});
-	}
-	return built;
-}
-//#endregion
-//#region src/schema/config-relations.ts
-/**
-* Build drizzle `relations()` for declared collections, from the collections.
-*
-* The heuristic builder in `dynamic-tables.ts` names a relation after the
-* foreign-key column (`author_id` → `author`), which is the only evidence a
-* database offers and is right for BaaS mode. It is wrong for a project that
-* declares its collections: there the relation's name is whatever the author
-* called it, `include=writer` addresses that name, and a relation whose key was
-* guessed from the column simply does not answer to it — the read returns the
-* bare foreign key and no target, silently, which is how a demo lost every
-* relation in its list view while the detail view (a different code path) kept
-* working.
-*
-* So when there are collections, they are the authority for *which* relations
-* exist and what they are called; the live catalogue is the authority for the
-* columns underneath. This is the same pairing `generate-drizzle-schema-logic`
-* emits into `schema.generated.ts` — kind for kind, key for key, and paired by
-* the same {@link sharedRelationName} — only built against tables read back from
-* `information_schema` rather than against a file.
-*/
-/** A collection's table, with any schema prefix stripped — as the DDL creates it. */
-function bareTableName(name) {
-	return name.includes(".") ? name.split(".").pop() : name;
-}
-/**
-* The field key a collection's rows are addressed by, as the generated module
-* spells it: the property marked `isId`, else `id`.
-*
-* Deliberately the config's answer rather than the catalogue's primary key —
-* `references: [users.id]` in the generated file is keyed the same way, and the
-* two have to name the same Drizzle key for a relation to compile at all.
-*/
-function primaryKeyFieldKey(collection) {
-	for (const [key, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && Boolean(prop.isId)) return key;
-	return "id";
-}
-/**
-* The field key on the source table that a `hasOne`/`hasMany` foreign key
-* holds: its `sourceKey` when the link names one, else the primary key.
-*/
-function sourceKeyFieldKey(relation, collection) {
-	return relation.sourceKey ? fieldKeyForColumn(collection, relation.sourceKey) : primaryKeyFieldKey(collection);
-}
-/**
-* A column of a built table, by its Drizzle key or by its column name.
-*
-* The key is the answer in the ordinary case, and the name is the fallback for
-* the one place a caller holds a column and not a field: a junction table's two
-* foreign keys, which are keyed by column *unless* the project also declares a
-* collection over that table, in which case they are keyed by its property
-* names. Looking both up costs a scan of one table and removes the difference.
-*/
-function columnOf(table, key) {
-	if (!table) return void 0;
-	const direct = getTableColumns(table)[key];
-	if (direct) return direct;
-	for (const column of Object.values(getTableColumns(table))) if (column?.name === key) return column;
-}
-/**
-* Drizzle relations for every declared collection, keyed `<table>Relations`.
-*
-* @param collections every collection backed by a table in `tables`
-* @param tables      catalogue-built tables, keyed by bare table name
-*/
-function buildDrizzleRelationsFromCollections(collections, tables) {
-	const ones = /* @__PURE__ */ new Map();
-	const manys = /* @__PURE__ */ new Map();
-	/** `<relationName>::<kind>` already emitted on a table — the generator dedupes the same way. */
-	const emitted = /* @__PURE__ */ new Map();
-	const claim = (table, name, kind) => {
-		const seen = emitted.get(table) ?? /* @__PURE__ */ new Set();
-		emitted.set(table, seen);
-		const key = `${name}::${kind}`;
-		if (seen.has(key)) return false;
-		seen.add(key);
-		return true;
-	};
-	const addOne = (table, spec) => ones.set(table, [...ones.get(table) ?? [], spec]);
-	const addMany = (table, spec) => manys.set(table, [...manys.get(table) ?? [], spec]);
-	const byTable = /* @__PURE__ */ new Map();
-	for (const collection of collections) {
-		const table = bareTableName(getTableName$1(collection));
-		if (table && tables[table]) byTable.set(table, collection);
-	}
-	for (const [tableName, collection] of byTable) {
-		const table = tables[tableName];
-		for (const [relationKey, relation] of Object.entries(resolveCollectionRelations(collection))) {
-			let target;
-			try {
-				target = relation.target();
-			} catch (err) {
-				logger.debug(`[schema] Relation ${collection.slug}.${relationKey} has no resolvable target`, { error: err });
-				continue;
-			}
-			const targetTable = tables[bareTableName(getTableName$1(target))];
-			const name = sharedRelationName(relation, collection);
-			switch (relation.kind) {
-				case "belongsTo": {
-					if (!targetTable) continue;
-					if (!claim(tableName, name, relation.kind)) continue;
-					const localKey = fieldKeyForColumn(collection, relation.localKey);
-					const referenced = primaryKeyFieldKey(target);
-					const field = columnOf(table, localKey);
-					const reference = columnOf(targetTable, referenced);
-					if (!field || !reference) continue;
-					addOne(tableName, {
-						key: relationKey,
-						target: targetTable,
-						fields: [field],
-						references: [reference],
-						relationName: name
-					});
-					break;
-				}
-				case "hasOne": {
-					if (!targetTable) continue;
-					if (!claim(tableName, name, relation.kind)) continue;
-					const field = columnOf(table, sourceKeyFieldKey(relation, collection));
-					const reference = columnOf(targetTable, fieldKeyForColumn(target, relation.foreignKeyOnTarget));
-					if (!field || !reference) continue;
-					addOne(tableName, {
-						key: relationKey,
-						target: targetTable,
-						fields: [field],
-						references: [reference],
-						relationName: name
-					});
-					break;
-				}
-				case "hasMany":
-					if (!targetTable) continue;
-					if (!claim(tableName, name, relation.kind)) continue;
-					addMany(tableName, {
-						key: relationKey,
-						target: targetTable,
-						relationName: name
-					});
-					break;
-				case "manyToMany": {
-					const junctionName = bareTableName(relation.through.table);
-					const junction = tables[junctionName];
-					if (!junction) continue;
-					if (!claim(tableName, name, relation.kind)) continue;
-					addMany(tableName, {
-						key: relationKey,
-						target: junction,
-						relationName: name
-					});
-					addJunctionSides(relation, collection, target, junctionName, tables, addOne, claim);
-					break;
-				}
-				case "via": break;
-			}
-		}
-	}
-	for (const [tableName, collection] of byTable) {
-		const table = tables[tableName];
-		for (const [, relation] of Object.entries(resolveCollectionRelations(collection))) {
-			if (relation.kind !== "hasMany" && relation.kind !== "hasOne") continue;
-			let target;
-			try {
-				target = relation.target();
-			} catch {
-				continue;
-			}
-			const targetTableName = bareTableName(getTableName$1(target));
-			const targetTable = tables[targetTableName];
-			if (!targetTable) continue;
-			const name = sharedRelationName(relation, collection);
-			if (!claim(targetTableName, name, "belongsTo")) continue;
-			const fkKey = fieldKeyForColumn(target, relation.foreignKeyOnTarget);
-			const field = columnOf(targetTable, fkKey);
-			const reference = columnOf(table, sourceKeyFieldKey(relation, collection));
-			if (!field || !reference) continue;
-			addOne(targetTableName, {
-				key: `_synth_${targetTableName}_${fkKey}`,
-				target: tables[tableName],
-				fields: [field],
-				references: [reference],
-				relationName: name
-			});
-		}
-	}
-	const built = {};
-	for (const tableName of /* @__PURE__ */ new Set([...ones.keys(), ...manys.keys()])) {
-		const table = tables[tableName];
-		if (!table) continue;
-		const tableOnes = ones.get(tableName) ?? [];
-		const tableManys = manys.get(tableName) ?? [];
-		built[`${tableName}Relations`] = relations(table, ({ one, many }) => {
-			const map = {};
-			for (const spec of tableOnes) map[spec.key] = one(spec.target, {
-				fields: spec.fields,
-				references: spec.references,
-				relationName: spec.relationName
-			});
-			for (const spec of tableManys) {
-				if (map[spec.key]) continue;
-				map[spec.key] = many(spec.target, { relationName: spec.relationName });
-			}
-			return map;
-		});
-	}
-	return built;
-}
-/**
-* The junction table's own two `one()` sides.
-*
-* A many-to-many is a `many(junction)` on each endpoint, so the junction has to
-* carry the matching `one()` back to each — without them drizzle can join a
-* post to its `posts_tags` rows and no further, and the tags come back as
-* junction rows. Keyed by the junction's own columns, which is how the
-* generated file keys them too.
-*/
-function addJunctionSides(relation, sourceCollection, targetCollection, junctionName, tables, addOne, claim) {
-	const junction = tables[junctionName];
-	const sourceTable = tables[bareTableName(getTableName$1(sourceCollection))];
-	const targetTable = tables[bareTableName(getTableName$1(targetCollection))];
-	if (!junction || !sourceTable || !targetTable) return;
-	const sourceName = sharedRelationName(relation, sourceCollection);
-	const inverse = Object.values(resolveCollectionRelations(targetCollection)).find((r) => r.kind === "manyToMany" && bareTableName(r.through.table) === junctionName);
-	const targetName = inverse ? sharedRelationName(inverse, targetCollection) : `${junctionName}_${relation.through.targetColumn}`;
-	const pairs = [[
-		relation.through.sourceColumn,
-		sourceTable,
-		sourceName,
-		sourceCollection,
-		"source"
-	], [
-		relation.through.targetColumn,
-		targetTable,
-		targetName,
-		targetCollection,
-		"target"
-	]];
-	for (const [column, endpointTable, relationName, endpointCollection] of pairs) {
-		if (!claim(junctionName, relationName, "junction")) continue;
-		const field = columnOf(junction, column);
-		const reference = columnOf(endpointTable, primaryKeyFieldKey(endpointCollection));
-		if (!field || !reference) continue;
-		addOne(junctionName, {
-			key: column,
-			target: endpointTable,
-			fields: [field],
-			references: [reference],
-			relationName
-		});
-	}
-}
-//#endregion
-//#region src/schema/catalogue-schema.ts
-/** The Postgres schema a collection's table lives in. */
-function schemaOfCollection(collection, fallback) {
-	const declared = collection.schema;
-	return typeof declared === "string" && declared.length > 0 ? declared : fallback;
-}
-/**
-* How a column of each table is keyed in the Drizzle object.
-*
-* The wire name, which is the property key — `authorId`, never `author_id` —
-* because that is what every read and write path in this driver indexes tables
-* and rows by, and what the generated module has always emitted. Getting this
-* wrong does not throw: drizzle leaves an unknown key out of the statement and
-* the write reports success having stored nothing.
-*
-* Two exceptions, both columns no property declares:
-*
-*  - the generated search columns keep their raw names, because `search_vector`
-*    is how `searchColumnNames` excludes them from responses and how the
-*    condition builder finds the one to match against;
-*  - a table no collection claims (a junction) is keyed by its **key** columns'
-*    names, which is also what the generated file does for them — but a
-*    junction that declares `through.properties` keys those payload columns by
-*    their property key, for the same reason a collection does. `joinedAt` with
-*    `columnName: "joined_at"` has to be one name on both sides or a `_pivot`
-*    write is silently dropped by drizzle and the read serves a key the caller
-*    never declared.
-*/
-function columnKeysFromCollections(collections) {
-	const byTable = /* @__PURE__ */ new Map();
-	const rawColumns = /* @__PURE__ */ new Map();
-	for (const collection of collections) {
-		const table = bareTableName(getTableName$1(collection));
-		if (!table) continue;
-		byTable.set(table, collection);
-		rawColumns.set(table, new Set(searchColumnNames(collection)));
-	}
-	const junctionByTable = /* @__PURE__ */ new Map();
-	for (const spec of resolveJunctionSpecs(collections).values()) {
-		if (Object.keys(spec.properties).length === 0) continue;
-		junctionByTable.set(bareTableName(spec.table), getJunctionCollectionConfig(spec));
-	}
-	return (tableName, columnName) => {
-		const collection = byTable.get(tableName);
-		if (!collection) {
-			const junction = junctionByTable.get(tableName);
-			return junction ? fieldKeyForColumn(junction, columnName) : columnName;
-		}
-		if (rawColumns.get(tableName)?.has(columnName)) return columnName;
-		return fieldKeyForColumn(collection, columnName);
-	};
-}
-/**
-* Read the tables this data source serves out of `information_schema`.
-*
-* Restricted to the collections handed in, because the driver is given every
-* collection the project declares while each database holds only its own: an
-* unfiltered read had a second source (`database("analytics")`) reporting the
-* default's tables as its own. Junction tables come too — they back no
-* collection and a many-to-many is unreadable without them.
-*
-* Every schema the collections name is read, not just `public`. The users
-* collection lives in `rebase`, and a run restricted to `public` would leave the
-* registry with no table for it at all.
-*/
-async function readCatalogueSchema(options) {
-	const { client, collections, defaultSchema } = options;
-	/** schema → the tables wanted from it. */
-	const wanted = /* @__PURE__ */ new Map();
-	const want = (schema, table) => {
-		const set = wanted.get(schema) ?? /* @__PURE__ */ new Set();
-		wanted.set(schema, set);
-		set.add(table);
-	};
-	for (const collection of collections) {
-		const table = bareTableName(getTableName$1(collection));
-		if (table) want(schemaOfCollection(collection, defaultSchema), table);
-	}
-	for (const spec of resolveJunctionSpecs(collections).values()) want(spec.schema, bareTableName(spec.table));
-	const columnKey = columnKeysFromCollections(collections);
-	const tables = {};
-	const meta = /* @__PURE__ */ new Map();
-	const missing = [];
-	for (const [schema, names] of wanted) {
-		const live = await introspectSchema(client, schema);
-		const present = /* @__PURE__ */ new Map();
-		for (const name of names) {
-			const found = live.tablesMap.get(name);
-			if (!found) {
-				missing.push(schema === defaultSchema ? name : `${schema}.${name}`);
-				continue;
-			}
-			if (tables[name]) continue;
-			present.set(name, found);
-			meta.set(name, found);
-		}
-		Object.assign(tables, buildDrizzleTablesFromSchema(present, schema, columnKey));
-	}
-	return {
-		tables,
-		relations: buildDrizzleRelationsFromCollections(collections, tables),
-		meta,
-		missing
-	};
-}
-/**
-* The BaaS variant: no collections are declared, so every table in one schema is
-* served and both the collections and the relations are derived from the
-* foreign keys.
-*
-* Kept apart from {@link readCatalogueSchema} because the two answer different
-* questions. Here the database is the entire specification; there it supplies
-* the columns for a specification the project already wrote down.
-*/
-function buildBaasSchema(tablesMap, pgSchemaName, collections) {
-	const columnKey = columnKeysFromCollections(collections);
-	const tables = buildDrizzleTablesFromSchema(tablesMap, pgSchemaName, columnKey);
-	return {
-		tables,
-		relations: buildDrizzleRelationsFromSchema(tablesMap, tables, columnKey)
-	};
-}
-//#endregion
-//#region src/schema/generated-schema-diff.ts
-/**
-* Compare the committed `schema.generated.ts` against the live catalogue, and
-* say so — once per difference, at boot, as a warning and nothing more.
-*
-* The runtime stopped reading that file for its tables (see
-* `catalogue-schema.ts`), which removes an entire class of production failure
-* and creates a smaller one: a stale file is now *invisible*. It is still real —
-* it is what Atlas plans migrations from, what `db push` diffs, what `eject`
-* writes out and what user code imports — so a project whose file no longer
-* describes its database will hit it later, in a tool, with no clue that boot
-* already knew.
-*
-* Hence this: a guard rather than a doc. It never fails boot and never changes
-* what is served — the previous arrangement, where the file could do both,
-* is exactly what was removed.
-*
-* `generated-schema-staleness.ts` answers a narrower question (does the file
-* name every table the collections do) from the file's *source text*. This one
-* compares the loaded module against the database, column by column.
-*/
-/**
-* The families a boot warning is worth raising over.
-*
-* Deliberately coarse. `varchar(120)` and `text` are the same family because the
-* runtime treats them identically and a warning about the difference would fire
-* on every boot of a correct project — the widths still reach Postgres, which
-* enforces them. What this is looking for is the kind of drift that changes what
-* a value *is*: a number that became text, a timestamp that became a date, a
-* column that stopped existing.
-*/
-function typeFamily(sqlType) {
-	if (!sqlType) return "unknown";
-	let type = sqlType.trim().toLowerCase();
-	const isArray = type.endsWith("[]") || type.startsWith("_");
-	type = type.replace(/\[\]$/, "").replace(/^_/, "");
-	type = type.replace(/\s*\([^)]*\)\s*$/, "").trim();
-	const family = FAMILIES[type] ?? type;
-	return isArray ? `${family}[]` : family;
-}
-var FAMILIES = {
-	text: "text",
-	varchar: "text",
-	"character varying": "text",
-	bpchar: "text",
-	char: "text",
-	character: "text",
-	citext: "text",
-	name: "text",
-	int2: "integer",
-	smallint: "integer",
-	smallserial: "integer",
-	int4: "integer",
-	int: "integer",
-	integer: "integer",
-	serial: "integer",
-	int8: "bigint",
-	bigint: "bigint",
-	bigserial: "bigint",
-	float4: "float",
-	real: "float",
-	float8: "float",
-	"double precision": "float",
-	numeric: "numeric",
-	decimal: "numeric",
-	money: "numeric",
-	bool: "boolean",
-	boolean: "boolean",
-	uuid: "uuid",
-	json: "json",
-	jsonb: "jsonb",
-	date: "date",
-	time: "time",
-	"time without time zone": "time",
-	timetz: "time",
-	"time with time zone": "time",
-	timestamp: "timestamp",
-	"timestamp without time zone": "timestamp",
-	timestamptz: "timestamptz",
-	"timestamp with time zone": "timestamptz",
-	interval: "interval",
-	bytea: "bytea",
-	tsvector: "tsvector",
-	tsquery: "tsquery",
-	vector: "vector"
-};
-function catalogueColumns(meta) {
-	const columns = /* @__PURE__ */ new Map();
-	for (const col of meta.columns) columns.set(col.column_name, {
-		name: col.column_name,
-		family: typeFamily(col.udt_name || col.data_type),
-		notNull: col.is_nullable === "NO"
-	});
-	return columns;
-}
-/**
-* Every way the generated module and the database disagree, for the tables both
-* describe.
-*
-* One-directional in one respect only: a table the module has and the database
-* does not is reported (that is the stale-file case), while a table the database
-* has and the module does not is left alone — a database may hold anything, and
-* the collections-vs-file question is `generated-schema-staleness`'s.
-*/
-function diffGeneratedSchemaAgainstCatalogue(options) {
-	const { generated, catalogue, collections } = options;
-	if (!generated) return [];
-	const collectionByTable = /* @__PURE__ */ new Map();
-	for (const collection of collections) {
-		const table = getTableName$1(collection);
-		if (table) collectionByTable.set(bareTableName(table), collection);
-	}
-	const differences = [];
-	for (const value of Object.values(generated)) {
-		if (!isTable(value)) continue;
-		const table = getTableName(value);
-		const collection = collectionByTable.get(table);
-		const at = {
-			table,
-			collection: collection?.slug
-		};
-		const meta = catalogue.get(table);
-		if (!meta) {
-			if (collection) differences.push({
-				...at,
-				kind: "missing-table"
-			});
-			continue;
-		}
-		const live = catalogueColumns(meta);
-		const seen = /* @__PURE__ */ new Set();
-		const authOwned = isAuthCollection(collection) ? new Set(AUTH_USERS_COLUMNS.map((c) => c.column)) : void 0;
-		for (const [key, column] of Object.entries(getTableColumns(value))) {
-			const name = column.name ?? key;
-			seen.add(name);
-			const property = collection ? fieldKeyForColumn(collection, name) : key;
-			const generatedFamily = typeFamily(column.getSQLType?.());
-			const generatedNotNull = Boolean(column.notNull);
-			const found = live.get(name);
-			if (!found) {
-				differences.push({
-					...at,
-					kind: "missing-column",
-					column: name,
-					property,
-					generated: generatedFamily
-				});
-				continue;
-			}
-			if (found.family !== generatedFamily) differences.push({
-				...at,
-				kind: "type",
-				column: name,
-				property,
-				generated: generatedFamily,
-				live: found.family
-			});
-			if (found.notNull !== generatedNotNull && !authOwned?.has(name)) differences.push({
-				...at,
-				kind: "nullability",
-				column: name,
-				property,
-				generated: generatedNotNull ? "NOT NULL" : "nullable",
-				live: found.notNull ? "NOT NULL" : "nullable"
-			});
-		}
-		for (const [name, column] of live) {
-			if (seen.has(name)) continue;
-			if (authOwned?.has(name)) continue;
-			differences.push({
-				...at,
-				kind: "extra-column",
-				column: name,
-				property: collection ? fieldKeyForColumn(collection, name) : name,
-				live: column.family
-			});
-		}
-	}
-	return differences;
-}
-/** One line, in the terms the reader has: collection, property, column. */
-function describeSchemaDifference(difference) {
-	const where = difference.collection ? `${difference.collection} (table "${difference.table}")` : `table "${difference.table}"`;
-	const field = difference.column ? `${difference.property && difference.property !== difference.column ? `${difference.property} → "${difference.column}"` : `"${difference.column}"`}` : void 0;
-	switch (difference.kind) {
-		case "missing-table": return `${where} is in schema.generated.ts but not in the database`;
-		case "missing-column": return `${where}: ${field} is in schema.generated.ts but not in the database`;
-		case "extra-column": return `${where}: ${field} is in the database but not in schema.generated.ts (${difference.live})`;
-		case "type": return `${where}: ${field} is ${difference.generated} in schema.generated.ts and ${difference.live} in the database`;
-		case "nullability": return `${where}: ${field} is ${difference.generated} in schema.generated.ts and ${difference.live} in the database`;
-	}
-}
-/**
-* Report the differences, one warning each, and never throw.
-*
-* Per difference rather than one summary block on purpose: these are read out of
-* a log aggregator as often as a terminal, and a single multi-line message
-* cannot be filtered down to the one collection somebody is looking at.
-*
-* The fix it names is `rebase db push`. `rebase dev` rewrites
-* schema.generated.ts from the collections on every change, and boot applies
-* only additive changes, so what is still different at boot is the database
-* behind the file: a rename, a dropped column, a narrowed type, a NOT NULL.
-* `rebase schema generate` rewrites the file and leaves the database as it is,
-* so it is named only for collections that changed since the file was written.
-*/
-function warnOnGeneratedSchemaDrift(differences) {
-	if (differences.length === 0) return;
-	logger.warn(`📄 [schema] schema.generated.ts and the database disagree (${differences.length} difference${differences.length === 1 ? "" : "s"}). Boot applies only additive changes; these are the ones it left for you. Run \`rebase db push\` to apply them (it shows the plan and asks before anything destructive), or \`rebase db generate\` for a migration. If the collections changed since schema.generated.ts was written, run \`rebase schema generate\` first.`);
-	for (const difference of differences) logger.warn(`   • ${describeSchemaDifference(difference)}`, {
-		schemaDrift: {
-			kind: difference.kind,
-			table: difference.table,
-			collection: difference.collection,
-			column: difference.column,
-			property: difference.property,
-			generated: difference.generated,
-			live: difference.live
-		},
-		fix: "rebase db push"
-	});
-}
-//#endregion
 //#region src/PostgresBootstrapper.ts
 /**
 * PostgresBootstrapper
@@ -20164,7 +19411,7 @@ async function openPostgresDriver(pgConfig, config) {
 	const { readUrl, directUrl } = resolveSourceUrls(pgConfig, sourceKey, {});
 	let readDb;
 	if (readUrl && readUrl !== pgConfig.connectionString) try {
-		const { createReadReplicaConnection } = await import("./connection-C938nR3E.js").then((n) => n.n);
+		const { createReadReplicaConnection } = await import("./connection-czvI7TZL.js").then((n) => n.n);
 		readDb = createReadReplicaConnection(readUrl, mergedSchema).db;
 		logger.info("📖 [PostgresBootstrapper] Read replica connection established");
 	} catch (err) {
@@ -20175,6 +19422,7 @@ async function openPostgresDriver(pgConfig, config) {
 	driver.listenConnectionString = directUrl;
 	realtimeService.setDataDriver(driver);
 	let rlsEnforcement;
+	let exposedInternalTables;
 	{
 		const runSql = async (text) => {
 			return (await schemaAwareDb.execute(sql.raw(text))).rows ?? [];
@@ -20192,6 +19440,10 @@ async function openPostgresDriver(pgConfig, config) {
 			if (!provision) {
 				const roleExists = (await runSql(`SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE$1}'`)).length > 0;
 				switched = roleExists || bypassesNow;
+				if (roleExists) {
+					exposedInternalTables = await findExposedInternalTables(runSql, managedSchemas);
+					if (exposedInternalTables.length > 0) logger.warn(`⚠️ RLS enforcement: the request role "${REBASE_USER_ROLE$1}" can reach framework tables no user should: ${exposedInternalTables.join(", ")}. A provisioning boot revokes this; this driver was opened without provisioning, so nothing does.`);
+				}
 				if (!roleExists && bypassesNow) logger.warn(`⚠️ RLS enforcement: connection role "${posture.role}" bypasses row-level security and the restricted role "${REBASE_USER_ROLE$1}" does not exist yet — this driver was opened without provisioning, so it was not created. Requests made as a user will fail until a server boot (or \`rebase db push\`) creates it; requests as the connection itself are unaffected.`);
 			} else try {
 				await ensureAppRole(runSql, managedSchemas);
@@ -20231,7 +19483,7 @@ async function openPostgresDriver(pgConfig, config) {
 		if (!realtimeOff && (isChannelBusInstance(busSetting) || busSetting.type !== "memory")) await realtimeService.configureChannelBus(createChannelBus(busSetting, {
 			db: schemaAwareDb,
 			directUrl
-		}));
+		}), { provision });
 	} catch (err) {
 		logger.warn("⚠️ [ChannelBus] Could not configure the channel bus — channel broadcast and presence stay per-instance", { error: err });
 	}
@@ -20277,7 +19529,7 @@ async function openPostgresDriver(pgConfig, config) {
 			};
 			logger.info(`📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). All writes now emit realtime events regardless of origin.` + (realtimeSubscribes ? "" : " This process installs the capture but does not consume it."));
 		} catch (err) {
-			if (explicitCdc) logger.warn("⚠️ [CDC] Could not enable database-level change capture — falling back to app-level realtime.", { error: err });
+			if (explicitCdc) logger.warn("⚠️ [CDC] Could not enable database-level change capture — falling back to app-level realtime.", { detail: err instanceof Error ? err.message : String(err) });
 			else logger.info("ℹ️ [CDC] Database-level change capture unavailable (likely insufficient privileges to create triggers, or the LISTEN connection was refused) — using app-level realtime. Set REALTIME_CDC=off to silence this.", { detail: err instanceof Error ? err.message : String(err) });
 		}
 	}
@@ -20293,7 +19545,7 @@ async function openPostgresDriver(pgConfig, config) {
 	if (!cdcEnabled && directUrl && realtimeSubscribes) try {
 		await realtimeService.startListening(directUrl);
 	} catch (err) {
-		logger.warn("⚠️ Cross-instance realtime could not be started", { error: err });
+		logger.warn("⚠️ Cross-instance realtime could not be started", { detail: err instanceof Error ? err.message : String(err) });
 	}
 	else if (!cdcEnabled && !realtimeSubscribes && !realtimeOff) realtimeService.startPublishing();
 	try {
@@ -20366,6 +19618,7 @@ async function openPostgresDriver(pgConfig, config) {
 		poolManager,
 		provisioned: provision,
 		rlsEnforcement,
+		exposedInternalTables,
 		provisionCdcForTables
 	};
 	return {
@@ -20436,7 +19689,7 @@ function createPostgresBootstrapper(pgConfig) {
 	const openIndexBuildSession = (driverResult) => async () => {
 		const db = requireProvisioningDb(driverResult);
 		const pool = "$client" in db ? db.$client : void 0;
-		const { isPgPool, poolIndexBuildSession } = await import("./deferred-index-build-Cis_HoGn.js").then((n) => n.r);
+		const { isPgPool, poolIndexBuildSession } = await import("./deferred-index-build-CqaOv1Xx.js").then((n) => n.r);
 		if (isPgPool(pool)) return poolIndexBuildSession(pool)();
 		const queryable = provisioningQueryable(driverResult);
 		return {
@@ -20462,7 +19715,7 @@ function createPostgresBootstrapper(pgConfig) {
 	*/
 	const provisionRlsRuntime = async (driverResult) => {
 		const db = requireProvisioningDb(driverResult);
-		const { RLS_BOOTSTRAP_STATEMENTS, rlsRuntimeIsCurrent } = await import("./rls-bootstrap-sql-Bd-hJk08.js").then((n) => n.a);
+		const { RLS_BOOTSTRAP_STATEMENTS, rlsRuntimeIsCurrent } = await import("./migrate-baseline-B-2Ef4Mv.js").then((n) => n.w);
 		const run = async (text) => sqlRows(await db.execute(sql.raw(text)));
 		if (await rlsRuntimeIsCurrent(run).catch(() => false)) return;
 		await db.transaction(async (tx) => {
@@ -20495,6 +19748,9 @@ function createPostgresBootstrapper(pgConfig) {
 			const init = config;
 			const opened = await openPostgresDriver(effectiveConfig(init.dataSourceKey), init);
 			if (opened.internals.rlsEnforcement) logger.info(opened.internals.rlsEnforcement);
+			const exposed = opened.internals.exposedInternalTables ?? [];
+			if (exposed.length > 0) throw new Error(`The request role "${REBASE_USER_ROLE$1}" can read or write framework tables that hold sessions, key hashes and job payloads: ${exposed.join(", ")}.\nA provisioning boot revokes this, and this backend changes nothing in its database (provisioning is off). Revoke it as part of your change process:
+` + exposed.map((table) => `  REVOKE ALL ON ${table.split(".").map((part) => `"${part}"`).join(".")} FROM ${REBASE_USER_ROLE$1};`).join("\n"));
 			return opened;
 		},
 		async initializeAuth(config, driverResult) {
@@ -20505,7 +19761,23 @@ function createPostgresBootstrapper(pgConfig) {
 			const registry = internals.registry;
 			const authCollection = authConfig.collection;
 			if (internals.provisioned !== false) await ensureAuthTablesExist(db, authCollection);
-			else await assertAuthSchemaCompatible(db, resolveAuthSchema(authCollection));
+			else {
+				await assertAuthSchemaCompatible(db, resolveAuthSchema(authCollection));
+				const usersSchema = authCollection ? "schema" in authCollection && typeof authCollection.schema === "string" ? authCollection.schema : "public" : "rebase";
+				const usersTableName = authCollection ? "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug : "users";
+				const expected = createAuthSchema(usersSchema === "public" ? "rebase" : usersSchema);
+				const problems = await findUnusableAuthTables(db, [usersExpectation(usersSchema === "public" ? `"${usersTableName}"` : `"${usersSchema}"."${usersTableName}"`), ...[
+					expected.refreshTokens,
+					expected.passwordResetTokens,
+					expected.appConfig,
+					expected.userIdentities,
+					expected.mfaFactors,
+					expected.mfaChallenges,
+					expected.recoveryCodes,
+					expected.magicLinkTokens
+				].map(expectationOf)]);
+				if (problems.length > 0) throw unusableAuthTablesError(problems);
+			}
 			if (authCollection && internals.provisionCdcForTables) {
 				const authSchema = "schema" in authCollection && typeof authCollection.schema === "string" ? authCollection.schema : "rebase";
 				const authTable = "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug;
@@ -20556,11 +19828,11 @@ function createPostgresBootstrapper(pgConfig) {
 					unavailable: historyUnavailableReason(state, { requireTransaction: false })
 				}) };
 			}
-			const { BOOT_LOCK_TIMEOUT_MS } = await import("./boot-ddl-s_3Hkz94.js").then((n) => n.i);
+			const { BOOT_LOCK_TIMEOUT_MS } = await import("./boot-ddl-EsgqDkx0.js").then((n) => n.i);
 			const historyTable = await ensureHistoryTableExists(db, { lockTimeoutMs: BOOT_LOCK_TIMEOUT_MS });
 			const historyIndexes = await ensureHistoryIndexes(db, { lockTimeoutMs: BOOT_LOCK_TIMEOUT_MS });
 			if (historyIndexes.length > 0) {
-				const { buildDeferredIndexes, scheduleDeferredIndexBuild } = await import("./deferred-index-build-Cis_HoGn.js").then((n) => n.r);
+				const { buildDeferredIndexes, scheduleDeferredIndexBuild } = await import("./deferred-index-build-CqaOv1Xx.js").then((n) => n.r);
 				const indexOptions = {
 					log: (message) => logger.info(`[history] ${message}`),
 					lockTimeoutMs: BOOT_LOCK_TIMEOUT_MS
@@ -20616,9 +19888,9 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-DvvImXDe.js").then((n) => n.n);
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-CFIRq8ni.js").then((n) => n.n);
 			const queryable = provisioningQueryable(driverResult);
-			const { BOOT_LOCK_TIMEOUT_MS } = await import("./boot-ddl-s_3Hkz94.js").then((n) => n.i);
+			const { BOOT_LOCK_TIMEOUT_MS } = await import("./boot-ddl-EsgqDkx0.js").then((n) => n.i);
 			const provisionOnly = ["1", "true"].includes((process.env.REBASE_PROVISION_ONLY ?? "").trim().toLowerCase());
 			const plan = await ensureCollectionTables(queryable, collections, log, {
 				lockTimeoutMs: BOOT_LOCK_TIMEOUT_MS,
@@ -20630,7 +19902,7 @@ function createPostgresBootstrapper(pgConfig) {
 			pendingIndexBuild?.cancel();
 			pendingIndexBuild = void 0;
 			if (!provisionOnly && plan.deferredIndexes.length > 0) {
-				const { scheduleDeferredIndexBuild } = await import("./deferred-index-build-Cis_HoGn.js").then((n) => n.r);
+				const { scheduleDeferredIndexBuild } = await import("./deferred-index-build-CqaOv1Xx.js").then((n) => n.r);
 				logger.info(`[schema] ${plan.deferredIndexes.length} index(es) are missing, or were left INVALID, on tables that already exist. They are built in the background once the server is serving, one at a time, without blocking reads or writes.`);
 				pendingIndexBuild = scheduleDeferredIndexBuild(openIndexBuildSession(driverResult), plan.deferredIndexes, {
 					log: (message) => logger.info(`[schema] ${message}`),
@@ -20670,7 +19942,7 @@ function createPostgresBootstrapper(pgConfig) {
 			await provisionRlsRuntime(driverResult);
 		},
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies, describeRulesDropped } = await import("./ensure-collection-policies-CCqayoUz.js");
+			const { ensureCollectionPolicies, describeRulesDropped } = await import("./ensure-collection-policies-DLWgabQ2.js");
 			const queryable = provisioningQueryable(driverResult);
 			const { rows } = await queryable.query("SELECT to_regprocedure('rebase.roles()') IS NOT NULL AS present");
 			if (!rows[0]?.present) await provisionRlsRuntime(driverResult);
@@ -20695,7 +19967,7 @@ function createPostgresBootstrapper(pgConfig) {
 			for (const u of outcome.unsecured.filter((u) => u.grantWithdrawn)) logger.error(`🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. Its privileges have been revoked from ${REBASE_USER_ROLE$1}, so the table is unreachable rather than unprotected. Reads and writes to that collection will fail until RLS can be enabled.`);
 			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE$1} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
-				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-Bd-hJk08.js").then((n) => n.a);
+				const { dropLegacyAuthSchema } = await import("./migrate-baseline-B-2Ef4Mv.js").then((n) => n.w);
 				await dropLegacyAuthSchema(async (text) => (await queryable.query(text)).rows, {
 					info: (m) => logger.info(m),
 					warn: (m) => logger.warn(m)
@@ -20715,14 +19987,14 @@ function createPostgresBootstrapper(pgConfig) {
 		async readCollectionsSchemaVersion(driverResult) {
 			const db = provisioningDb(driverResult);
 			if (!db) return null;
-			const { readCollectionsSchemaVersion } = await import("./collections-schema-version-T6cGvrDi.js");
+			const { readCollectionsSchemaVersion } = await import("./collections-schema-version-D7bDI0PJ.js");
 			return readCollectionsSchemaVersion(db, SCHEMA_META_SCHEMA);
 		},
 		/** Record what this process just applied. Only the provisioning process calls this. */
 		async stampCollectionsSchemaVersion(version, driverResult) {
 			const db = provisioningDb(driverResult);
 			if (!db) return;
-			const { stampCollectionsSchemaVersion } = await import("./collections-schema-version-T6cGvrDi.js");
+			const { stampCollectionsSchemaVersion } = await import("./collections-schema-version-D7bDI0PJ.js");
 			await stampCollectionsSchemaVersion(db, SCHEMA_META_SCHEMA, version);
 		},
 		/**
@@ -20786,7 +20058,7 @@ function createPostgresBootstrapper(pgConfig) {
 			return driverResult.internals.driver.admin;
 		},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter, limits) {
-			const { createPostgresWebSocket, isSocketRealtimeService, socketRealtimeMissing } = await import("./websocket-MC0zTBar.js").then((n) => n.c);
+			const { createPostgresWebSocket, isSocketRealtimeService, socketRealtimeMissing } = await import("./websocket-CKYc3V4N.js").then((n) => n.c);
 			if (!isSocketRealtimeService(realtimeService)) throw new Error(`The realtime service handed to the Postgres socket cannot serve it — it has no ${socketRealtimeMissing(realtimeService).join(", ")}. Every socket would fail on its first frame.`);
 			const realtimeConfig = effectiveConfig().realtime;
 			const maxSocketsPerUser = realtimeConfig?.maxSocketsPerUser !== void 0 ? parseMaxSocketsPerUser(realtimeConfig.maxSocketsPerUser, "realtime.maxSocketsPerUser") : void 0;
@@ -20860,6 +20132,7 @@ async function openRebase(options) {
 		const hint = extractPgError(error)?.hint;
 		throw new Error(`Cannot connect to PostgreSQL at ${parseHostInfo(connectionString ?? "")}: ${deepestErrorMessage(error) ?? "the connection failed"}.${hint ? ` ${hint}` : ""}`, { cause: error });
 	}
+	const ownKey = options.dataSourceKey ?? DEFAULT_DATA_SOURCE_KEY;
 	let opened;
 	try {
 		opened = await openPostgresDriver({
@@ -20867,7 +20140,7 @@ async function openRebase(options) {
 			connectionString
 		}, {
 			collections: options.collections,
-			dataSourceKey: options.dataSourceKey ?? DEFAULT_DATA_SOURCE_KEY,
+			dataSourceKey: ownKey,
 			introspectCollections: options.collections.length === 0,
 			provision: false,
 			realtime: false,
@@ -20882,6 +20155,7 @@ async function openRebase(options) {
 	}
 	const driver = opened.internals.driver;
 	const registry = opened.internals.registry;
+	if (options.callbacks) registry.setGlobalCallbacks(options.callbacks);
 	if (opened.internals.rlsEnforcement) logger.debug(opened.internals.rlsEnforcement);
 	const collections = opened.collections ?? options.collections;
 	if (collections.some((collection) => collection.history)) try {
@@ -20906,10 +20180,13 @@ async function openRebase(options) {
 		collections,
 		async sql(query, sqlOptions) {
 			if (!isSQLAdmin(admin)) throw new Error("This driver cannot run raw SQL.");
+			if (sqlOptions?.database !== void 0) {
+				const asked = resourceKeyOf(sqlOptions.database);
+				if (asked !== ownKey) throw new Error(`openRebase opened the "${ownKey}" data source only, so it cannot run SQL on "${asked}". Open that one with its own openRebase({ databaseUrl, dataSourceKey: "${asked}" }).`);
+			}
 			return admin.executeSql(query, sqlOptions && {
 				role: sqlOptions.role,
-				params: sqlOptions.params,
-				...sqlOptions.database !== void 0 ? { database: resourceKeyOf(sqlOptions.database) } : {}
+				params: sqlOptions.params
 			});
 		},
 		async withAuth(user) {
@@ -20925,4 +20202,4 @@ async function openRebase(options) {
 //#endregion
 export { AuthenticatedPostgresBackendDriver as $, budgetSendBuffers as A, mfaFactors as B, PG_NOTIFY_MAX_PAYLOAD_BYTES as C, MemoryChannelBus as D, parseChannelBusPayload as E, createAuthSchema as F, recoveryCodesRelations as G, passwordResetTokens as H, magicLinkTokens as I, userIdentities as J, refreshTokens as K, magicLinkTokensRelations as L, terminateIfBacklogged as M, assertReadRequestReadable as N, frameByteLength as O, appConfig as P, usersSchema as Q, mfaChallenges as R, DEFAULT_BATCH_WINDOW_MS as S, parseChannelBusFrame as T, passwordResetTokensRelations as U, mfaFactorsRelations as V, recoveryCodes as W, users as X, userIdentitiesRelations as Y, usersRelations as Z, parseRealtimeTuning as _, listedColumnKeys as _t, openPostgresDriver as a, isRoleSwitchingOptedOut as at, resolveChannelBusSetting as b, resolveSourceUrls as c, SqlResultTooLargeError as ct, DEFAULT_RECOUNT_MIN_ROWS as d, DrizzleConditionBuilder as dt, CONNECTION_OWNER as et, PostgresRealtimeProvider as f, PostgresConditionBuilder as ft, parseMaxSubscriptionsPerSocket as g, joinColumn as gt, parseMaxSocketsPerUser as h, getUnknownFilterFieldsMode as ht, isScaffoldedLocalDatabase as i, effectiveSqlRole as it, reapSilentSockets as j, isChannelBusInstance$1 as k, PostgresCollectionRegistry as l, isNestedPath as lt, packEntityChanges as m, escapeLikePattern as mt, createPostgresBootstrapper as n, RoleSwitchUnavailableError as nt, postgresDriverConfigFromEnv as o, sqlRoleRanAs as ot, RealtimeService as p, configureUnknownFilterFields as pt, refreshTokensRelations as q, describeSchemaDriftCause as r, branchParentDatabase as rt, resolveDriftCheckName as s, SQL_RESULT_BYTE_BUDGET as st, openRebase as t, PostgresBackendDriver as tt, DEFAULT_MAX_SUBSCRIPTIONS_PER_SOCKET as u, resolveNestedPath as ut, refetchConcurrencyFor as v, PostgresChannelBus as w, CHANNEL_BUS_NOTIFY_CHANNEL as x, createChannelBus as y, mfaChallengesRelations as z };
 
-//# sourceMappingURL=open-rebase-BKA7Nyoe.js.map
+//# sourceMappingURL=open-rebase-C8jQ6s5a.js.map