@rebasepro/server-postgres 0.25.1 → 0.26.0

package/dist/{open-rebase-EmqVmS14.js → open-rebase-C8jQ6s5a.js}

@@ -2,26 +2,28 @@ import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { i as createPostgresDatabaseConnection } from "./connection-czvI7TZL.js";
 import { _ as visibleColumnProjection, a as buildSearchColumnSpec, r as SEARCH_UNACCENT_FN, s as hiddenColumnsOption } from "./search-column-BM-GV6vH.js";
-import { a as diagnoseDbError, c as isEconnrefused, n as closedDatabaseName, nt as extractCauseMessage, r as deepestErrorMessage, u as parseHostInfo } from "./cli-errors-DiA0XFIS.js";
-import { a as pgErrorToFriendlyMessage, i as isRowLevelSecurityDenial, n as extractPgError, o as reachedDatabase, r as isRoleSwitchingPermissionError, s as sanitizeErrorForClient, t as classifyConnectFailure } from "./pg-error-utils-CFEnm2m9.js";
-import { t as BranchService } from "./BranchService-ClklxyAQ.js";
-import { a as ensureAppRoleGrants, d as warnOnLegacyRlsFunctions, f as warnOnRoleSchemaCollision, i as ensureAppRole, l as validatePolicyPgRoles, n as applyAuthContext, r as detectConnectionPosture, s as revokeUserRoleSql, t as REBASE_USER_ROLE$1, u as warnOnAnonymousGrants } from "./rls-enforcement-DDyNoOSy.js";
+import { a as diagnoseDbError, c as isEconnrefused, n as closedDatabaseName, r as deepestErrorMessage, rt as extractCauseMessage, u as parseHostInfo } from "./cli-errors-DsYyNYzd.js";
+import { a as pgErrorToFriendlyMessage, i as isRowLevelSecurityDenial, n as extractPgError, o as reachedDatabase, r as isRoleSwitchingPermissionError, s as sanitizeErrorForClient, t as classifyConnectFailure } from "./pg-error-utils-DhiUTlVx.js";
+import { t as BranchService } from "./BranchService-CWBnDhcv.js";
+import { a as ensureAppRoleGrants, c as revokeUserRoleSql, d as warnOnAnonymousGrants, f as warnOnLegacyRlsFunctions, i as ensureAppRole, n as applyAuthContext, o as findExposedInternalTables, p as warnOnRoleSchemaCollision, r as detectConnectionPosture, t as REBASE_USER_ROLE$1, u as validatePolicyPgRoles } from "./rls-enforcement-BOHuHVlc.js";
 import { u as resolveColumnName } from "./column-plan-helpers-IG6uFb1s.js";
+import { t as AUTH_USERS_COLUMNS } from "./auth-users-columns-C72EMoDJ.js";
 import { n as planSchema } from "./plan-schema-Czf3q4-Q.js";
 import { t as generateSchema } from "./generate-drizzle-schema-logic-CPzCRD-8.js";
 import { r as renderPgType } from "./render-ddl-4v88y-Gv.js";
-import { u as typesAgree } from "./deferred-index-build-BE0I6sYU.js";
-import { a as isLockTimeout, c as resolveBootLockOptions, l as sleep, n as BOOT_LOCK_TIMEOUT_MS } from "./boot-ddl-DYH95Qeg.js";
-import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-Cet4650m.js";
+import { u as typesAgree } from "./deferred-index-build-CqaOv1Xx.js";
+import { a as isLockTimeout, c as resolveBootLockOptions, l as sleep, n as BOOT_LOCK_TIMEOUT_MS } from "./boot-ddl-EsgqDkx0.js";
+import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-CFIRq8ni.js";
+import { a as mergeDatabaseBranch, i as diffDatabaseBranch } from "./branch-diff-CxE4VlxT.js";
 import { t as DatabasePoolManager } from "./databasePoolManager-3stMNFL-.js";
-import { a as resolveAuthSchema, i as probeAuthSchema, r as assertAuthSchemaCompatible, t as ensureAuthTablesExist } from "./ensure-tables-l_OgFQjN.js";
+import { a as resolveAuthSchema, i as probeAuthSchema, r as assertAuthSchemaCompatible, t as ensureAuthTablesExist } from "./ensure-tables-4nA-tfwi.js";
 import { a as buildBaasSchema, c as introspectSchema, i as warnOnGeneratedSchemaDrift, l as readRlsStatus, n as diffGeneratedSchemaAgainstCatalogue, o as readCatalogueSchema, s as buildCollectionsFromSchema } from "./generated-schema-diff-eZCklRZQ.js";
 import { Client, DatabaseError, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, assertQueryFieldsReadable, createDdlBootstrapper, createEmailService, logger, rawQueryLoggingEnabled, resolveBatchRefs, rowETag, splitFieldOps } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, is, isNotNull, isNull, isTable, lt, lte, not, notInArray, or, relations, sql } from "drizzle-orm";
 import { PgArray, PgNumeric, PgTable, PgTimestamp, PgTimestampString, PgTransaction, bigint, boolean, getTableConfig, index, integer, jsonb, pgSchema, pgTable, text, timestamp, unique, uuid } from "drizzle-orm/pg-core";
-import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, INCLUDE_COUNT_KEY, JUNCTION_PIVOT_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, parseEnvBoolean, parseRelationAggregateSort, resolveClientListLimit, resourceEnvSuffix, resourceKeyOf } from "@rebasepro/types";
+import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, INCLUDE_COUNT_KEY, JUNCTION_PIVOT_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, parseEnvBoolean, parseRelationAggregateSort, resolveClientListLimit, resourceEnvSuffix, resourceKeyOf, roleNameProblem } from "@rebasepro/types";
 import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, REBASE_USER_ROLE, UnknownFilterOperatorError, apiHiddenFieldNames, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createAccessorSlugResolver, createRelationRef, createRelationRefWithData, deserializeFilter, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, firstSqlRow, getColumnName, getDeclaredPrimaryKeys, getJunctionConfigForRelation, getTableName as getTableName$1, getTenantConfig, hasFieldAccessRules, includableRelationNames, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseIdValues as parseIdValues$1, parseOrderBySpecStrict, queryableFieldNames, requireCallbackClient, requireCallbackCollection, resolveCollectionRelations, resolveTenantWrite, restoresSoftDeletedRow, revokeInternalTableSql, softDeleteFieldOf, sqlRows, tenantBypassRoles, toCallbackError, toFilterTuples, unknownAggregateField, unknownFilterField, unknownIncludeRelation, unknownOrderByField, unknownProjectionField, unknownRelationTargetField, unknownVectorProperty, updateDateAutoValues, updateUserAutoValues, withRelationReferencesOnly } from "@rebasepro/common";
 import { camelCase, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, splitSearchTerms, toSnakeCase, toWireKey, unref } from "@rebasepro/utils";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -4403,6 +4405,38 @@ function isJunctionBackedRelation(relation) {
 	return relation.shared;
 }
 /**
+* Reject a create or update whose body names a relation Rebase does not write
+* — a multi-hop `via` (`writable: false`) — before anything is read or written.
+*
+* A single-hop `via` is written through this door as it shipped (to-one: the
+* target's key; to-many: one junction's rows). A longer chain used to get as
+* far as the writer: a to-many one failed inside the transaction as a 500
+* RELATION_MISCONFIGURED telling the caller to regenerate a schema that was
+* fine, and a to-one one re-pointed the target at the first step's column.
+*
+* Matched the way the write path matches: a key that is a relation's own name
+* (the to-many split), or a `relation` property that resolves to one (the
+* to-one transformer). An `undefined` value is no value — the transformer skips
+* it — so it is not a write; `null` is, since it would unlink.
+*/
+function assertNoReadOnlyRelationValues(values, collection) {
+	const properties = collection.properties ?? {};
+	let relations;
+	const named = [];
+	for (const [key, value] of Object.entries(values)) {
+		if (value === void 0) continue;
+		relations ??= resolveCollectionRelations(collection);
+		const relation = relations[key] ?? (properties[key]?.type === "relation" ? findRelation(relations, key) : void 0);
+		if (relation && !relation.writable) named.push(key);
+	}
+	if (named.length === 0) return;
+	const list = named.map((key) => `'${key}'`).join(", ");
+	throw ApiError.badRequest(`${list} on '${collection.slug}' ${named.length > 1 ? "are multi-hop `via` relations" : "is a multi-hop `via` relation"}, which is read-only: only single-hop via relations are writable — a to-one chain of one step, or a to-many chain through one junction table. Write the rows the chain joins directly.`, "RELATION_NOT_WRITABLE", {
+		collection: collection.slug,
+		fields: named
+	});
+}
+/**
 * Reject a nested write whose final segment is a to-one relation.
 *
 * There is no column on the target row that records a to-one parent — the
@@ -4414,8 +4448,8 @@ function isJunctionBackedRelation(relation) {
 */
 function assertWritableThrough(hop, path) {
 	const { relation } = hop;
-	if (relation.writable && relation.cardinality === "many") return;
-	if (!relation.writable) throw ApiError.badRequest(`"${path}" ends in '${hop.relationKey}', a \`via\` relation. Rebase will not infer how to write through an arbitrary join chain — write the row at "${hop.targetCollection.slug}" directly.`, "RELATION_NOT_WRITABLE");
+	if (relation.kind !== "via" && relation.writable && relation.cardinality === "many") return;
+	if (relation.kind === "via") throw ApiError.badRequest(`"${path}" ends in '${hop.relationKey}', a \`via\` relation, which a nested path does not write through — write the row at "${hop.targetCollection.slug}" directly` + (relation.writable ? `, and link it by setting '${hop.relationKey}' in an update of the '${hop.parentCollection.slug}' row.` : "."), "RELATION_NOT_WRITABLE");
 	throw ApiError.badRequest(`"${path}" ends in the to-one relation '${hop.relationKey}', which cannot be written through: the foreign key for a to-one relation lives on '${hop.parentCollection.slug}', not on '${hop.targetCollection.slug}'. Write the target row at "${hop.targetCollection.slug}" and set '${hop.relationKey}' on the parent instead.`, "RELATION_NOT_WRITABLE");
 }
 //#endregion
@@ -5338,6 +5372,38 @@ var FetchService = class FetchService {
 		return values;
 	}
 	/**
+	* Every row of a collection's table, as stored, a page at a time, in key
+	* order — the driver's `scanStoredRows`.
+	*
+	* Deliberately none of the read pipeline: no `beforeQuery` (a sweep has no
+	* caller to scope to, and the documented hook narrows a caller-less read to
+	* the rows owned by nobody), no soft-delete filter, no `afterRead`, no
+	* field stripping. The columns come back under their table names; a sweep
+	* reads values, not keys. Paged by the key rather than an offset, so a row
+	* deleted during the scan never shifts another past the next page.
+	*/
+	async *scanStoredRows(collectionPath, pageSize = 500) {
+		const collection = getCollectionByPath(collectionPath, this.registry);
+		const table = getTableForCollection(collection, this.registry);
+		const keys = primaryKeyColumns(table, requirePrimaryKeys(collection, this.registry), collectionPath);
+		const keyNames = keys.map((column) => {
+			const entry = Object.entries(getTableColumns(table)).find(([, candidate]) => candidate === column);
+			if (!entry) throw new Error(`Key column '${column.name}' not found in table for collection '${collectionPath}'`);
+			return entry[0];
+		});
+		const limit = Math.max(1, pageSize);
+		let after;
+		for (;;) {
+			const past = after ? or(...keys.map((column, i) => and(...keys.slice(0, i).map((earlier, j) => eq(earlier, after[j])), gt(column, after[i])))) : void 0;
+			const query = this.db.select().from(table);
+			const rows = await (past ? query.where(past) : query).orderBy(...keys.map((column) => asc(column))).limit(limit);
+			if (rows.length > 0) yield rows;
+			if (rows.length < limit) return;
+			const last = rows[rows.length - 1];
+			after = keyNames.map((name) => last[name]);
+		}
+	}
+	/**
 	* Fetch a collection of rows
 	*/
 	async fetchCollection(collectionPath, options = {}) {
@@ -6803,6 +6869,7 @@ var PersistService = class {
 			}
 		}
 		const collection = getCollectionByPath(effectiveCollectionPath, this.registry);
+		assertNoReadOnlyRelationValues(effectiveValues, collection);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = getPrimaryKeys(collection, this.registry);
 		idInfoArray.map((info) => info.fieldName);
@@ -9476,10 +9543,29 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				createBranch: this.branchService.createBranch.bind(this.branchService),
 				deleteBranch: this.branchService.deleteBranch.bind(this.branchService),
 				listBranches: this.branchService.listBranches.bind(this.branchService),
-				getBranchInfo: this.branchService.getBranchInfo.bind(this.branchService)
+				getBranchInfo: this.branchService.getBranchInfo.bind(this.branchService),
+				diffBranch: async (name, options) => this.nameDiffCollections(await diffDatabaseBranch(this.admin, name, options)),
+				mergeBranch: (name, options) => mergeDatabaseBranch(this.admin, name, options)
 			} : {}
 		};
 	}
+	/** The diff with each table named by the collection it backs, where one does. */
+	nameDiffCollections(diff) {
+		const collections = this.registry?.getCollections() ?? [];
+		const slugOf = (schema, table) => collections.find((collection) => {
+			return ("schema" in collection && typeof collection.schema === "string" ? collection.schema : "public") === schema && getTableName$1(collection) === table;
+		})?.slug;
+		return {
+			...diff,
+			data: diff.data.map((entry) => {
+				const collection = slugOf(entry.schema, entry.table);
+				return collection ? {
+					...entry,
+					collection
+				} : entry;
+			})
+		};
+	}
 	/**
 	* `SQLAdmin.listen`: a `LISTEN` on a connection of its own, through the
 	* listener CDC and the channel bus use, which reconnects and heartbeats.
@@ -9574,6 +9660,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		const client = this.client;
 		return {
 			user: this.user,
+			...this.user?.credential ? { credential: this.user.credential } : {},
 			driver: this,
 			data: this.data,
 			get client() {
@@ -9743,6 +9830,15 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		return rows;
 	}
 	/**
+	* Every stored row of a collection, past every read hook, for a whole-store
+	* sweep — see `DataDriver.scanStoredRows`. Only this unscoped driver has
+	* it: {@link AuthenticatedPostgresBackendDriver} reads as a caller, and a
+	* caller's reads are scoped.
+	*/
+	scanStoredRows(props) {
+		return this.dataService.getFetchService().scanStoredRows(props.path, props.pageSize);
+	}
+	/**
 	* Listen to a collection: the rows now, then again after every change.
 	*
 	* The realtime service runs every read, the first one included, as
@@ -11082,6 +11178,7 @@ var AuthenticatedPostgresBackendDriver = class {
 		const client = this.delegate.client;
 		writeScope?.setSettledContext({
 			user: this.user,
+			...this.user?.credential ? { credential: this.user.credential } : {},
 			driver: this,
 			data: this.data,
 			get client() {
@@ -13042,9 +13139,13 @@ var ChannelPresenceStore = class {
 	* `tablesReady` is now set from a probe of what exists, not from having been
 	* the instance that created it.
 	*/
-	async ensureTables() {
-		if (this.tablesReady) return;
+	async ensureTables(options = {}) {
+		if (this.tablesReady) return true;
 		const ddl = drizzleDdlBootstrapper(this.db, "channel-presence");
+		if (options.provision === false) {
+			this.tablesReady = await ddl.isReadable("rebase.channel_presence");
+			return this.tablesReady;
+		}
 		await ddl.ensureObject("rebase schema", "CREATE SCHEMA IF NOT EXISTS rebase");
 		await ddl.ensureObject("channel_presence table", `
             CREATE TABLE IF NOT EXISTS rebase.channel_presence (
@@ -13068,6 +13169,7 @@ var ChannelPresenceStore = class {
 			await ddl.step("channel_presence revoke", () => this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence"))));
 			this.tablesReady = true;
 		}
+		return this.tablesReady;
 	}
 	/** Record (or refresh) a client's presence. */
 	async track(channel, clientId, state) {
@@ -13750,6 +13852,14 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	refetchQueue = /* @__PURE__ */ new Set();
 	/** Group refetches running now — at most {@link maxConcurrentRefetches}. */
 	refetchesRunning = 0;
+	/**
+	* What a group refetch runs inside — see {@link setScopeRunner}. A refetch
+	* runs on a timer armed by whatever announced the change; one armed by a
+	* change-capture notification inherits the LISTEN connection's context,
+	* which is no backend's, so a hook the read reached saw the process
+	* default as `rebase`.
+	*/
+	runInScope = (fn) => fn();
 	/** See {@link refetchConcurrencyFor}. */
 	maxConcurrentRefetches;
 	/**
@@ -14018,6 +14128,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (group.pending !== "all") group.pending.delete(key);
 		if (group.members.size > 0) return;
 		if (group.timer) clearTimeout(group.timer);
+		if (group.recountTimer) clearTimeout(group.recountTimer);
 		this.refetchQueue.delete(group);
 		this.groups.delete(group.key);
 		const [index, address] = group.type === "collection" ? [this.collectionGroupsByPath, group.path] : [this.singleGroupsByAddress, `${group.path}\u0000${group.id}`];
@@ -14091,7 +14202,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			this.refetchQueue.delete(group);
 			if (this.groups.get(group.key) !== group) continue;
 			this.refetchesRunning++;
-			this.refetchGroup(group).finally(() => {
+			this.runInScope(() => this.refetchGroup(group)).finally(() => {
 				this.refetchesRunning--;
 				this.drainRefetchQueue();
 			});
@@ -14865,6 +14976,17 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		});
 	}
 	/**
+	* Refetch `group` — and so count it again — at `at`, when the total its
+	* last frame reused expires. One pending at a time per group.
+	*/
+	scheduleRecount(group, at) {
+		if (group.recountTimer) return;
+		group.recountTimer = setTimeout(() => {
+			group.recountTimer = void 0;
+			if (this.groups.get(group.key) === group) this.scheduleGroupRefetch(group);
+		}, Math.max(0, at - Date.now()) + 1);
+	}
+	/**
 	* The `meta` a `collection_update` frame carries beside its rows, counted
 	* through `service` — the subscriber's own transaction, read only, with
 	* its auth context and `beforeQuery` narrowing already bound.
@@ -14893,6 +15015,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		else if (reusable && this.recountIntervalMs !== void 0 && reusable.total >= this.recountMinRows && Date.now() - reusable.at < this.recountIntervalMs) {
 			total = reusable.total;
 			totalAsOf = new Date(reusable.at).toISOString();
+			if (group) this.scheduleRecount(group, reusable.at + this.recountIntervalMs);
 		} else {
 			try {
 				total = await service.count(notifyPath, {
@@ -15471,7 +15594,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* what it was before this existed, whereas refusing to boot takes the whole
 	* backend down for it.
 	*/
-	async configureChannelBus(bus) {
+	async configureChannelBus(bus, options = {}) {
 		if (bus.kind === "memory") {
 			this.bus = bus;
 			return;
@@ -15487,7 +15610,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		this.bus = bus;
 		try {
 			const store = new ChannelPresenceStore(this.db, this.instanceId);
-			await store.ensureTables();
+			if (!await store.ensureTables({ provision: options.provision }) && options.provision === false) throw new Error("rebase.channel_presence does not exist, and this backend changes nothing in its database. A provisioning run with the same channel bus configured creates it.");
 			this.presenceStore = store;
 			this.ensurePresenceSweep();
 		} catch (error) {
@@ -15818,6 +15941,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		for (const group of this.groups.values()) {
 			if (group.timer) clearTimeout(group.timer);
 			group.timer = void 0;
+			if (group.recountTimer) clearTimeout(group.recountTimer);
+			group.recountTimer = void 0;
 		}
 		this.unscheduledListGroups.clear();
 		this.listPathChangedAt.clear();
@@ -15877,6 +16002,10 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	isCdcActive() {
 		return this.cdcActive && this.cdcListener?.connected === true;
 	}
+	/** See `RealtimeProvider.setScopeRunner`. */
+	setScopeRunner(run) {
+		this.runInScope = run;
+	}
 	/** The LISTEN connections this service depends on — see `RealtimeProvider.health`. */
 	health() {
 		const listeners = [];
@@ -16411,7 +16540,7 @@ function columnNames(table) {
 	}
 	return names;
 }
-var quote = (xs) => Array.from(xs).map((s) => `\`${s}\``).join(", ");
+var quote$1 = (xs) => Array.from(xs).map((s) => `\`${s}\``).join(", ");
 /** `on.from` / `on.to` accept a single column or a composite tuple. */
 var asColumns = (value) => Array.isArray(value) ? value : [value];
 /**
@@ -16433,7 +16562,7 @@ function compositeKeyDefect(relation, source, target, registry) {
 		const keys = getPrimaryKeys(keyed, registry);
 		if (keys.length < 2) return void 0;
 		return {
-			problem: `${linkColumn} is one column, and \`${keyed.slug}\` is keyed on ${quote(keys.map((key) => key.fieldName))} together — one column cannot reference a composite key`,
+			problem: `${linkColumn} is one column, and \`${keyed.slug}\` is keyed on ${quote$1(keys.map((key) => key.fieldName))} together — one column cannot reference a composite key`,
 			fix
 		};
 	};
@@ -16562,7 +16691,7 @@ function findRelationDefects(collections, registry, given) {
 						} : {
 							...at,
 							problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
-							fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
+							fix: `add the column, or set \`localKey\` to one of: ${quote$1(sourceColumns)}`
 						});
 					}
 					break;
@@ -16576,13 +16705,13 @@ function findRelationDefects(collections, registry, given) {
 						} : {
 							...at,
 							problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
-							fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
+							fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote$1(targetColumns)}`
 						});
 					}
 					if (relation.sourceKey && !sourceColumns.has(relation.sourceKey)) defects.push({
 						...at,
 						problem: `\`sourceKey: "${relation.sourceKey}"\` is not a column on \`${sourceTableName}\``,
-						fix: targetColumns.has(relation.sourceKey) ? `it is a column on the *target* table \`${targetTableName}\` — \`sourceKey\` names the column on this collection that the target's foreign key points at, so it must be one of: ${quote(sourceColumns)}` : `add the column, or set \`sourceKey\` to one of: ${quote(sourceColumns)}`
+						fix: targetColumns.has(relation.sourceKey) ? `it is a column on the *target* table \`${targetTableName}\` — \`sourceKey\` names the column on this collection that the target's foreign key points at, so it must be one of: ${quote$1(sourceColumns)}` : `add the column, or set \`sourceKey\` to one of: ${quote$1(sourceColumns)}`
 					});
 					break;
 				case "manyToMany": {
@@ -16609,7 +16738,7 @@ function findRelationDefects(collections, registry, given) {
 						} : {
 							...at,
 							problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
-							fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
+							fix: `set \`through.${label}\` to one of: ${quote$1(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
 						});
 					}
 					break;
@@ -16641,12 +16770,12 @@ function findRelationDefects(collections, registry, given) {
 						for (const column of asColumns(step.on.from)) if (!prevColumns.has(column)) defects.push({
 							...at,
 							problem: `step ${i + 1} joins \`${prevName}.${column}\` → \`${step.table}\`, but \`${column}\` is not a column on \`${prevName}\``,
-							fix: `\`joinPath[${i}].on.from\` names columns on ${i === 0 ? "this collection's table" : `the previous step's table (\`${prevName}\`)`}: ${quote(prevColumns)}`
+							fix: `\`joinPath[${i}].on.from\` names columns on ${i === 0 ? "this collection's table" : `the previous step's table (\`${prevName}\`)`}: ${quote$1(prevColumns)}`
 						});
 						for (const column of asColumns(step.on.to)) if (!stepColumns.has(column)) defects.push({
 							...at,
 							problem: `step ${i + 1} joins into \`${step.table}.${column}\`, but \`${column}\` is not a column on \`${step.table}\``,
-							fix: `\`joinPath[${i}].on.to\` names columns on \`${step.table}\`: ${quote(stepColumns)}`
+							fix: `\`joinPath[${i}].on.to\` names columns on \`${step.table}\`: ${quote$1(stepColumns)}`
 						});
 						if (asColumns(step.on.from).length !== asColumns(step.on.to).length) defects.push({
 							...at,
@@ -17138,14 +17267,26 @@ var UserService = class {
 		return result.rows[0].roles ?? [];
 	}
 	/**
-	* Set roles for a user (replaces existing roles)
+	* Set roles for a user (replaces existing roles).
+	*
+	* Each role is its own bound parameter. The array used to be spelled as a
+	* literal, `{${roles.join(",")}}`, so the database parsed what the caller
+	* had only checked as strings: `"support,admin"` was stored as two roles,
+	* one of them `admin`, and `"NULL"` as a SQL NULL. A name that would be read
+	* back as other roles is refused (`roleNameProblem`) — RLS splits the
+	* comma-joined `app.user_roles` the same way.
 	*/
 	async setUserRoles(uid, roleIds) {
+		const problems = roleIds.flatMap((role) => {
+			const problem = roleNameProblem(role);
+			return problem ? [`${JSON.stringify(role)} ${problem}`] : [];
+		});
+		if (problems.length > 0) throw ApiError.badRequest(`Not valid role names: ${problems.join("; ")}`, "INVALID_ROLE");
 		const usersTableName = this.getQualifiedUsersTableName();
-		const rolesArray = `{${roleIds.join(",")}}`;
+		const rolesArray = roleIds.length === 0 ? sql`'{}'::text[]` : sql`ARRAY[${sql.join(roleIds.map((role) => sql`${role}`), sql`, `)}]::text[]`;
 		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
-            SET roles = ${rolesArray}::text[], updated_at = NOW()
+            SET roles = ${rolesArray}, updated_at = NOW()
             WHERE id = ${uid}
         `));
 	}
@@ -18167,6 +18308,59 @@ var MfaService = class {
 	}
 };
 //#endregion
+//#region src/auth/verify-auth-tables.ts
+/**
+* Whether the auth tables a backend reads are there, on a backend that may not
+* create them.
+*
+* A driver opened without provisioning skips `ensureAuthTablesExist` — the
+* tables are another process's to make — and before this nothing took its
+* place. A database that lacked `rebase.refresh_tokens`, or had a users table
+* from a release before `disabled_at`, booted green and then failed every
+* sign-in with a 500 whose cause was one missing relation. Auth cannot run on
+* part of its schema, so this is a refusal at boot, naming each table.
+*
+* Asked by reading, not by the catalogue: a `SELECT` of every column the auth
+* services name, `WHERE false`. That answers "missing", "out of date" and "this
+* role may not read it" in one statement per table, with the database's own
+* words for whichever it is.
+*/
+var quote = (identifier) => `"${identifier.replace(/"/g, "\"\"")}"`;
+/** What a Drizzle table definition says auth will query. */
+function expectationOf(table) {
+	const config = getTableConfig(table);
+	return {
+		table: config.schema ? `${quote(config.schema)}.${quote(config.name)}` : quote(config.name),
+		columns: Object.values(getTableColumns(table)).map((column) => column.name)
+	};
+}
+/**
+* The users table, which is the project's own when it declares an auth
+* collection: only the columns the auth bootstrap guarantees on it are
+* expected, never the collection's other fields — those are the collection
+* schema's business, checked where collections are.
+*/
+function usersExpectation(qualifiedTable) {
+	return {
+		table: qualifiedTable,
+		columns: ["id", ...AUTH_USERS_COLUMNS.map((spec) => spec.column)]
+	};
+}
+/** Each table that cannot be read as expected, with the database's reason. */
+async function findUnusableAuthTables(db, expectations) {
+	const problems = [];
+	for (const { table, columns } of expectations) try {
+		await db.execute(sql.raw(`SELECT ${columns.map(quote).join(", ")} FROM ${table} WHERE false`));
+	} catch (err) {
+		problems.push(`${table}: ${deepestErrorMessage(err)}`);
+	}
+	return problems;
+}
+/** The refusal, phrased as what to run. */
+function unusableAuthTablesError(problems) {
+	return /* @__PURE__ */ new Error("Auth cannot run on this database, and this backend changes nothing in it (provisioning is off):\n" + problems.map((problem) => `  - ${problem}`).join("\n") + "\nCreate them with a provisioning run against this database (REBASE_PROVISION_ONLY=true, without REBASE_PROVISION=false), or apply the SQL such a run recorded (REBASE_PROVISION_SQL_OUT).");
+}
+//#endregion
 //#region src/history/ensure-history-table.ts
 /** How a history entry gets written from inside the write it records. */
 var RECORD_HISTORY_FUNCTION = "rebase.record_history";
@@ -18570,6 +18764,28 @@ var HistoryService = class {
         `)) ?? null;
 	}
 	/**
+	* Every entry's `values` and `previous_values`, of every row, a page at a
+	* time in id order — for a whole-store sweep. `rebase storage orphans`
+	* reads it because a history revert restores the values an entry holds,
+	* so a file only an entry names is still in use.
+	*/
+	async *scanStoredValues(pageSize = 1e3) {
+		const limit = Math.max(1, pageSize);
+		let after;
+		for (;;) {
+			const rows = sqlRows(await this.db.execute(sql`
+                SELECT id, "values", previous_values
+                FROM rebase.entity_history
+                ${after === void 0 ? sql`` : sql`WHERE id > ${after}`}
+                ORDER BY id
+                LIMIT ${limit}
+            `));
+			if (rows.length > 0) yield rows.map((row) => [row.values, row.previous_values]);
+			if (rows.length < limit) return;
+			after = rows[rows.length - 1].id;
+		}
+	}
+	/**
 	* Each entry's `format`. A table without the column holds only entries
 	* that store the whole previous row, which is what `1` says.
 	*/
@@ -19206,6 +19422,7 @@ async function openPostgresDriver(pgConfig, config) {
 	driver.listenConnectionString = directUrl;
 	realtimeService.setDataDriver(driver);
 	let rlsEnforcement;
+	let exposedInternalTables;
 	{
 		const runSql = async (text) => {
 			return (await schemaAwareDb.execute(sql.raw(text))).rows ?? [];
@@ -19223,6 +19440,10 @@ async function openPostgresDriver(pgConfig, config) {
 			if (!provision) {
 				const roleExists = (await runSql(`SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE$1}'`)).length > 0;
 				switched = roleExists || bypassesNow;
+				if (roleExists) {
+					exposedInternalTables = await findExposedInternalTables(runSql, managedSchemas);
+					if (exposedInternalTables.length > 0) logger.warn(`⚠️ RLS enforcement: the request role "${REBASE_USER_ROLE$1}" can reach framework tables no user should: ${exposedInternalTables.join(", ")}. A provisioning boot revokes this; this driver was opened without provisioning, so nothing does.`);
+				}
 				if (!roleExists && bypassesNow) logger.warn(`⚠️ RLS enforcement: connection role "${posture.role}" bypasses row-level security and the restricted role "${REBASE_USER_ROLE$1}" does not exist yet — this driver was opened without provisioning, so it was not created. Requests made as a user will fail until a server boot (or \`rebase db push\`) creates it; requests as the connection itself are unaffected.`);
 			} else try {
 				await ensureAppRole(runSql, managedSchemas);
@@ -19262,7 +19483,7 @@ async function openPostgresDriver(pgConfig, config) {
 		if (!realtimeOff && (isChannelBusInstance(busSetting) || busSetting.type !== "memory")) await realtimeService.configureChannelBus(createChannelBus(busSetting, {
 			db: schemaAwareDb,
 			directUrl
-		}));
+		}), { provision });
 	} catch (err) {
 		logger.warn("⚠️ [ChannelBus] Could not configure the channel bus — channel broadcast and presence stay per-instance", { error: err });
 	}
@@ -19397,6 +19618,7 @@ async function openPostgresDriver(pgConfig, config) {
 		poolManager,
 		provisioned: provision,
 		rlsEnforcement,
+		exposedInternalTables,
 		provisionCdcForTables
 	};
 	return {
@@ -19467,7 +19689,7 @@ function createPostgresBootstrapper(pgConfig) {
 	const openIndexBuildSession = (driverResult) => async () => {
 		const db = requireProvisioningDb(driverResult);
 		const pool = "$client" in db ? db.$client : void 0;
-		const { isPgPool, poolIndexBuildSession } = await import("./deferred-index-build-BE0I6sYU.js").then((n) => n.r);
+		const { isPgPool, poolIndexBuildSession } = await import("./deferred-index-build-CqaOv1Xx.js").then((n) => n.r);
 		if (isPgPool(pool)) return poolIndexBuildSession(pool)();
 		const queryable = provisioningQueryable(driverResult);
 		return {
@@ -19493,7 +19715,7 @@ function createPostgresBootstrapper(pgConfig) {
 	*/
 	const provisionRlsRuntime = async (driverResult) => {
 		const db = requireProvisioningDb(driverResult);
-		const { RLS_BOOTSTRAP_STATEMENTS, rlsRuntimeIsCurrent } = await import("./db-subcommands-BPoHCxJR.js").then((n) => n.v);
+		const { RLS_BOOTSTRAP_STATEMENTS, rlsRuntimeIsCurrent } = await import("./migrate-baseline-B-2Ef4Mv.js").then((n) => n.w);
 		const run = async (text) => sqlRows(await db.execute(sql.raw(text)));
 		if (await rlsRuntimeIsCurrent(run).catch(() => false)) return;
 		await db.transaction(async (tx) => {
@@ -19526,6 +19748,9 @@ function createPostgresBootstrapper(pgConfig) {
 			const init = config;
 			const opened = await openPostgresDriver(effectiveConfig(init.dataSourceKey), init);
 			if (opened.internals.rlsEnforcement) logger.info(opened.internals.rlsEnforcement);
+			const exposed = opened.internals.exposedInternalTables ?? [];
+			if (exposed.length > 0) throw new Error(`The request role "${REBASE_USER_ROLE$1}" can read or write framework tables that hold sessions, key hashes and job payloads: ${exposed.join(", ")}.\nA provisioning boot revokes this, and this backend changes nothing in its database (provisioning is off). Revoke it as part of your change process:
+` + exposed.map((table) => `  REVOKE ALL ON ${table.split(".").map((part) => `"${part}"`).join(".")} FROM ${REBASE_USER_ROLE$1};`).join("\n"));
 			return opened;
 		},
 		async initializeAuth(config, driverResult) {
@@ -19536,7 +19761,23 @@ function createPostgresBootstrapper(pgConfig) {
 			const registry = internals.registry;
 			const authCollection = authConfig.collection;
 			if (internals.provisioned !== false) await ensureAuthTablesExist(db, authCollection);
-			else await assertAuthSchemaCompatible(db, resolveAuthSchema(authCollection));
+			else {
+				await assertAuthSchemaCompatible(db, resolveAuthSchema(authCollection));
+				const usersSchema = authCollection ? "schema" in authCollection && typeof authCollection.schema === "string" ? authCollection.schema : "public" : "rebase";
+				const usersTableName = authCollection ? "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug : "users";
+				const expected = createAuthSchema(usersSchema === "public" ? "rebase" : usersSchema);
+				const problems = await findUnusableAuthTables(db, [usersExpectation(usersSchema === "public" ? `"${usersTableName}"` : `"${usersSchema}"."${usersTableName}"`), ...[
+					expected.refreshTokens,
+					expected.passwordResetTokens,
+					expected.appConfig,
+					expected.userIdentities,
+					expected.mfaFactors,
+					expected.mfaChallenges,
+					expected.recoveryCodes,
+					expected.magicLinkTokens
+				].map(expectationOf)]);
+				if (problems.length > 0) throw unusableAuthTablesError(problems);
+			}
 			if (authCollection && internals.provisionCdcForTables) {
 				const authSchema = "schema" in authCollection && typeof authCollection.schema === "string" ? authCollection.schema : "rebase";
 				const authTable = "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug;
@@ -19587,11 +19828,11 @@ function createPostgresBootstrapper(pgConfig) {
 					unavailable: historyUnavailableReason(state, { requireTransaction: false })
 				}) };
 			}
-			const { BOOT_LOCK_TIMEOUT_MS } = await import("./boot-ddl-DYH95Qeg.js").then((n) => n.i);
+			const { BOOT_LOCK_TIMEOUT_MS } = await import("./boot-ddl-EsgqDkx0.js").then((n) => n.i);
 			const historyTable = await ensureHistoryTableExists(db, { lockTimeoutMs: BOOT_LOCK_TIMEOUT_MS });
 			const historyIndexes = await ensureHistoryIndexes(db, { lockTimeoutMs: BOOT_LOCK_TIMEOUT_MS });
 			if (historyIndexes.length > 0) {
-				const { buildDeferredIndexes, scheduleDeferredIndexBuild } = await import("./deferred-index-build-BE0I6sYU.js").then((n) => n.r);
+				const { buildDeferredIndexes, scheduleDeferredIndexBuild } = await import("./deferred-index-build-CqaOv1Xx.js").then((n) => n.r);
 				const indexOptions = {
 					log: (message) => logger.info(`[history] ${message}`),
 					lockTimeoutMs: BOOT_LOCK_TIMEOUT_MS
@@ -19647,9 +19888,9 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-Cet4650m.js").then((n) => n.n);
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-CFIRq8ni.js").then((n) => n.n);
 			const queryable = provisioningQueryable(driverResult);
-			const { BOOT_LOCK_TIMEOUT_MS } = await import("./boot-ddl-DYH95Qeg.js").then((n) => n.i);
+			const { BOOT_LOCK_TIMEOUT_MS } = await import("./boot-ddl-EsgqDkx0.js").then((n) => n.i);
 			const provisionOnly = ["1", "true"].includes((process.env.REBASE_PROVISION_ONLY ?? "").trim().toLowerCase());
 			const plan = await ensureCollectionTables(queryable, collections, log, {
 				lockTimeoutMs: BOOT_LOCK_TIMEOUT_MS,
@@ -19661,7 +19902,7 @@ function createPostgresBootstrapper(pgConfig) {
 			pendingIndexBuild?.cancel();
 			pendingIndexBuild = void 0;
 			if (!provisionOnly && plan.deferredIndexes.length > 0) {
-				const { scheduleDeferredIndexBuild } = await import("./deferred-index-build-BE0I6sYU.js").then((n) => n.r);
+				const { scheduleDeferredIndexBuild } = await import("./deferred-index-build-CqaOv1Xx.js").then((n) => n.r);
 				logger.info(`[schema] ${plan.deferredIndexes.length} index(es) are missing, or were left INVALID, on tables that already exist. They are built in the background once the server is serving, one at a time, without blocking reads or writes.`);
 				pendingIndexBuild = scheduleDeferredIndexBuild(openIndexBuildSession(driverResult), plan.deferredIndexes, {
 					log: (message) => logger.info(`[schema] ${message}`),
@@ -19701,7 +19942,7 @@ function createPostgresBootstrapper(pgConfig) {
 			await provisionRlsRuntime(driverResult);
 		},
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies, describeRulesDropped } = await import("./ensure-collection-policies-BnGOURpG.js");
+			const { ensureCollectionPolicies, describeRulesDropped } = await import("./ensure-collection-policies-DLWgabQ2.js");
 			const queryable = provisioningQueryable(driverResult);
 			const { rows } = await queryable.query("SELECT to_regprocedure('rebase.roles()') IS NOT NULL AS present");
 			if (!rows[0]?.present) await provisionRlsRuntime(driverResult);
@@ -19726,7 +19967,7 @@ function createPostgresBootstrapper(pgConfig) {
 			for (const u of outcome.unsecured.filter((u) => u.grantWithdrawn)) logger.error(`🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. Its privileges have been revoked from ${REBASE_USER_ROLE$1}, so the table is unreachable rather than unprotected. Reads and writes to that collection will fail until RLS can be enabled.`);
 			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE$1} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
-				const { dropLegacyAuthSchema } = await import("./db-subcommands-BPoHCxJR.js").then((n) => n.v);
+				const { dropLegacyAuthSchema } = await import("./migrate-baseline-B-2Ef4Mv.js").then((n) => n.w);
 				await dropLegacyAuthSchema(async (text) => (await queryable.query(text)).rows, {
 					info: (m) => logger.info(m),
 					warn: (m) => logger.warn(m)
@@ -19746,14 +19987,14 @@ function createPostgresBootstrapper(pgConfig) {
 		async readCollectionsSchemaVersion(driverResult) {
 			const db = provisioningDb(driverResult);
 			if (!db) return null;
-			const { readCollectionsSchemaVersion } = await import("./collections-schema-version-T6cGvrDi.js");
+			const { readCollectionsSchemaVersion } = await import("./collections-schema-version-D7bDI0PJ.js");
 			return readCollectionsSchemaVersion(db, SCHEMA_META_SCHEMA);
 		},
 		/** Record what this process just applied. Only the provisioning process calls this. */
 		async stampCollectionsSchemaVersion(version, driverResult) {
 			const db = provisioningDb(driverResult);
 			if (!db) return;
-			const { stampCollectionsSchemaVersion } = await import("./collections-schema-version-T6cGvrDi.js");
+			const { stampCollectionsSchemaVersion } = await import("./collections-schema-version-D7bDI0PJ.js");
 			await stampCollectionsSchemaVersion(db, SCHEMA_META_SCHEMA, version);
 		},
 		/**
@@ -19817,7 +20058,7 @@ function createPostgresBootstrapper(pgConfig) {
 			return driverResult.internals.driver.admin;
 		},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter, limits) {
-			const { createPostgresWebSocket, isSocketRealtimeService, socketRealtimeMissing } = await import("./websocket-BKZwsjmf.js").then((n) => n.c);
+			const { createPostgresWebSocket, isSocketRealtimeService, socketRealtimeMissing } = await import("./websocket-CKYc3V4N.js").then((n) => n.c);
 			if (!isSocketRealtimeService(realtimeService)) throw new Error(`The realtime service handed to the Postgres socket cannot serve it — it has no ${socketRealtimeMissing(realtimeService).join(", ")}. Every socket would fail on its first frame.`);
 			const realtimeConfig = effectiveConfig().realtime;
 			const maxSocketsPerUser = realtimeConfig?.maxSocketsPerUser !== void 0 ? parseMaxSocketsPerUser(realtimeConfig.maxSocketsPerUser, "realtime.maxSocketsPerUser") : void 0;
@@ -19891,6 +20132,7 @@ async function openRebase(options) {
 		const hint = extractPgError(error)?.hint;
 		throw new Error(`Cannot connect to PostgreSQL at ${parseHostInfo(connectionString ?? "")}: ${deepestErrorMessage(error) ?? "the connection failed"}.${hint ? ` ${hint}` : ""}`, { cause: error });
 	}
+	const ownKey = options.dataSourceKey ?? DEFAULT_DATA_SOURCE_KEY;
 	let opened;
 	try {
 		opened = await openPostgresDriver({
@@ -19898,7 +20140,7 @@ async function openRebase(options) {
 			connectionString
 		}, {
 			collections: options.collections,
-			dataSourceKey: options.dataSourceKey ?? DEFAULT_DATA_SOURCE_KEY,
+			dataSourceKey: ownKey,
 			introspectCollections: options.collections.length === 0,
 			provision: false,
 			realtime: false,
@@ -19913,6 +20155,7 @@ async function openRebase(options) {
 	}
 	const driver = opened.internals.driver;
 	const registry = opened.internals.registry;
+	if (options.callbacks) registry.setGlobalCallbacks(options.callbacks);
 	if (opened.internals.rlsEnforcement) logger.debug(opened.internals.rlsEnforcement);
 	const collections = opened.collections ?? options.collections;
 	if (collections.some((collection) => collection.history)) try {
@@ -19937,10 +20180,13 @@ async function openRebase(options) {
 		collections,
 		async sql(query, sqlOptions) {
 			if (!isSQLAdmin(admin)) throw new Error("This driver cannot run raw SQL.");
+			if (sqlOptions?.database !== void 0) {
+				const asked = resourceKeyOf(sqlOptions.database);
+				if (asked !== ownKey) throw new Error(`openRebase opened the "${ownKey}" data source only, so it cannot run SQL on "${asked}". Open that one with its own openRebase({ databaseUrl, dataSourceKey: "${asked}" }).`);
+			}
 			return admin.executeSql(query, sqlOptions && {
 				role: sqlOptions.role,
-				params: sqlOptions.params,
-				...sqlOptions.database !== void 0 ? { database: resourceKeyOf(sqlOptions.database) } : {}
+				params: sqlOptions.params
 			});
 		},
 		async withAuth(user) {
@@ -19956,4 +20202,4 @@ async function openRebase(options) {
 //#endregion
 export { AuthenticatedPostgresBackendDriver as $, budgetSendBuffers as A, mfaFactors as B, PG_NOTIFY_MAX_PAYLOAD_BYTES as C, MemoryChannelBus as D, parseChannelBusPayload as E, createAuthSchema as F, recoveryCodesRelations as G, passwordResetTokens as H, magicLinkTokens as I, userIdentities as J, refreshTokens as K, magicLinkTokensRelations as L, terminateIfBacklogged as M, assertReadRequestReadable as N, frameByteLength as O, appConfig as P, usersSchema as Q, mfaChallenges as R, DEFAULT_BATCH_WINDOW_MS as S, parseChannelBusFrame as T, passwordResetTokensRelations as U, mfaFactorsRelations as V, recoveryCodes as W, users as X, userIdentitiesRelations as Y, usersRelations as Z, parseRealtimeTuning as _, listedColumnKeys as _t, openPostgresDriver as a, isRoleSwitchingOptedOut as at, resolveChannelBusSetting as b, resolveSourceUrls as c, SqlResultTooLargeError as ct, DEFAULT_RECOUNT_MIN_ROWS as d, DrizzleConditionBuilder as dt, CONNECTION_OWNER as et, PostgresRealtimeProvider as f, PostgresConditionBuilder as ft, parseMaxSubscriptionsPerSocket as g, joinColumn as gt, parseMaxSocketsPerUser as h, getUnknownFilterFieldsMode as ht, isScaffoldedLocalDatabase as i, effectiveSqlRole as it, reapSilentSockets as j, isChannelBusInstance$1 as k, PostgresCollectionRegistry as l, isNestedPath as lt, packEntityChanges as m, escapeLikePattern as mt, createPostgresBootstrapper as n, RoleSwitchUnavailableError as nt, postgresDriverConfigFromEnv as o, sqlRoleRanAs as ot, RealtimeService as p, configureUnknownFilterFields as pt, refreshTokensRelations as q, describeSchemaDriftCause as r, branchParentDatabase as rt, resolveDriftCheckName as s, SQL_RESULT_BYTE_BUDGET as st, openRebase as t, PostgresBackendDriver as tt, DEFAULT_MAX_SUBSCRIPTIONS_PER_SOCKET as u, resolveNestedPath as ut, refetchConcurrencyFor as v, PostgresChannelBus as w, CHANNEL_BUS_NOTIFY_CHANNEL as x, createChannelBus as y, mfaChallengesRelations as z };
 
-//# sourceMappingURL=open-rebase-EmqVmS14.js.map
+//# sourceMappingURL=open-rebase-C8jQ6s5a.js.map