@rebasepro/server-postgres 0.9.1-canary.73476f2 → 0.9.1-canary.74adfbe

package/src/PostgresBootstrapper.ts

@@ -4,7 +4,7 @@
  * Implements the `BackendBootstrapper` interface for PostgreSQL.
  */
 
-import { getTableName, isTable, Relations, sql } from "drizzle-orm";
+import { Relations, sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { PgEnum, PgTable } from "drizzle-orm/pg-core";
 import type { RebasePgTable } from "./types";
@@ -17,10 +17,12 @@ import {
     CollectionConfig,
     type HistoryConfig,
     InitializedDriver,
-    RealtimeProvider
+    RealtimeProvider,
+    type RealtimeChannelsConfig
 } from "@rebasepro/types";
 import { PostgresBackendDriver } from "./PostgresBackendDriver";
 import { RealtimeService } from "./services/realtimeService";
+import { buildCollectionRegistry } from "./collections/buildRegistry";
 import { DatabasePoolManager } from "./databasePoolManager";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
 import { createEmailService, type EmailConfig, type EmailService, logger } from "@rebasepro/server";
@@ -51,6 +53,12 @@ export interface PostgresDriverConfig {
      * (BaaS mode). Defaults to `public`.
      */
     introspectionSchema?: string;
+    /**
+     * Realtime options. Currently only channel retention, which is opt-in:
+     * without rules here no channel keeps any history and broadcast stays
+     * fire-and-forget. See {@link ChannelRetentionRule}.
+     */
+    realtime?: RealtimeChannelsConfig;
 }
 
 /**
@@ -64,6 +72,15 @@ export interface PostgresDriverInternals {
     realtimeService: RealtimeService;
     driver: PostgresBackendDriver;
     poolManager?: DatabasePoolManager;
+    /**
+     * Attach CDC triggers to tables that did not exist when the driver
+     * bootstrapped. Only set when database-level capture is actually active.
+     *
+     * Auth owns its own tables and creates them later in boot, so at driver
+     * bootstrap they are legitimately missing and get skipped; without this
+     * they would stay uninstrumented until the next restart.
+     */
+    provisionCdcForTables?: (tables: CdcTableRef[]) => Promise<void>;
 }
 
 // Re-export from shared CLI error utilities
@@ -161,30 +178,17 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
             }
 
             const activeCollections = introspectedCollections ?? collections;
-
-            // Create a fresh registry for this driver
-            const registry = new PostgresCollectionRegistry();
-            if (activeCollections) {
-                registry.registerMultiple(activeCollections);
-                logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map(c => c.slug).join(", ")}]`);
-            }
-
             const schemaTables = introspectedTables ?? pgConfig.schema?.tables;
-
-            // Register tables
-            if (schemaTables) {
-                Object.values(schemaTables).forEach((table) => {
-                    if (isTable(table)) {
-                        const tableName = getTableName(table);
-                        registry.registerTable(table as PgTable, tableName);
-                    }
-                });
-            }
-
-            if (pgConfig.schema?.enums) registry.registerEnums(pgConfig.schema.enums as Record<string, PgEnum<[string, ...string[]]>>);
-
             const schemaRelations = introspectedRelations ?? (pgConfig.schema?.relations as Record<string, Relations> | undefined);
-            if (schemaRelations) registry.registerRelations(schemaRelations);
+
+            // Create a fresh registry for this driver. Registration order is
+            // load-bearing, so it lives in one place — see `buildCollectionRegistry`.
+            const registry = buildCollectionRegistry({
+                collections: activeCollections,
+                tables: schemaTables,
+                enums: pgConfig.schema?.enums as Record<string, PgEnum<[string, ...string[]]>> | undefined,
+                relations: schemaRelations
+            });
 
             // Patch Drizzle's PgArray columns to handle NULL values safely.
             // Drizzle's mapFromDriverValue crashes with "value.map is not a function"
@@ -319,6 +323,16 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                 }
             }
 
+            // ── Channel history ──────────────────────────────────────────────
+            // Opt-in per channel pattern. With no rules this creates no tables
+            // and leaves broadcast on its original fire-and-forget path, so
+            // presence-only apps pay nothing for it.
+            try {
+                await realtimeService.configureChannelHistory(pgConfig.realtime?.channels);
+            } catch (err) {
+                logger.warn("⚠️ Could not initialize channel history tables — retained channels will not replay", { error: err });
+            }
+
             // ── Realtime change source ───────────────────────────────────────
             // Prefer DATABASE_DIRECT_URL to bypass PgBouncer for LISTEN/NOTIFY.
             const directUrl = process.env.DATABASE_DIRECT_URL || pgConfig.connectionString;
@@ -346,6 +360,7 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
             const wantsCdc = cdcMode !== "off";
             const explicitCdc = cdcMode === "trigger" || cdcMode === "wal";
             let cdcEnabled = false;
+            let provisionCdcForTables: PostgresDriverInternals["provisionCdcForTables"];
 
             if (wantsCdc && !directUrl) {
                 const reason = "no direct database connection is available for the realtime LISTEN client (set DATABASE_DIRECT_URL)";
@@ -379,6 +394,11 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                     await provisionTriggerCdc(cdcRunSql, cdcTables);
                     await realtimeService.enableCdc(directUrl);
                     cdcEnabled = true;
+                    // Boot steps that create their own tables (auth) run after
+                    // this one and use it to instrument what they just created.
+                    provisionCdcForTables = async (tables) => {
+                        await provisionTriggerCdc(cdcRunSql, tables);
+                    };
                     logger.info(
                         `📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). ` +
                         `All writes now emit realtime events regardless of origin.`
@@ -429,6 +449,14 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                     );
                     const missing: Array<{ slug: string; table: string }> = [];
                     for (const col of registeredCollections) {
+                        // Auth owns its table and creates it later in this same
+                        // boot (initializeAuth → ensureAuthTablesExist), so it is
+                        // legitimately absent right now. Reporting it as drift
+                        // tells the user to `db:push` a table that is about to
+                        // exist — and on an introspected database, one that the
+                        // database was never supposed to hold.
+                        if ((col as { auth?: { enabled?: boolean } }).auth?.enabled) continue;
+
                         const schemaName = "schema" in col && col.schema ? col.schema : "public";
                         const tableName = registry.hasTableForCollection(
                             col.table ?? col.slug
@@ -443,8 +471,10 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                         const checkName = resolvedTable ?? tableName;
                         const fullCheckName = schemaName === "public" ? checkName : `${schemaName}.${checkName}`;
                         if (!dbTables.has(fullCheckName)) {
+                            // Report what was actually looked up: an unqualified
+                            // "users" sends people hunting for public.users.
                             missing.push({ slug: col.slug,
-table: checkName });
+table: fullCheckName });
                         }
                     }
                     if (missing.length > 0) {
@@ -478,7 +508,8 @@ table: checkName });
                 registry,
                 realtimeService,
                 driver,
-                poolManager
+                poolManager,
+                provisionCdcForTables
             };
 
             return {
@@ -507,6 +538,29 @@ table: checkName });
             // ensureAuthTablesExist works with the collection abstraction — no Drizzle leakage.
             await ensureAuthTablesExist(db, authCollection);
 
+            // The driver bootstrapped before these tables existed, so CDC skipped
+            // them. Instrument them now, or writes to the user table emit no
+            // realtime events until the next restart.
+            if (authCollection && internals.provisionCdcForTables) {
+                const authSchema = "schema" in authCollection && typeof authCollection.schema === "string"
+                    ? authCollection.schema
+                    : "rebase";
+                const authTable = "table" in authCollection && typeof authCollection.table === "string"
+                    ? authCollection.table
+                    : authCollection.slug;
+                if (authTable) {
+                    try {
+                        await internals.provisionCdcForTables([{ schema: authSchema, table: authTable }]);
+                    } catch (err) {
+                        logger.warn(
+                            `⚠️ [CDC] Could not attach change-capture to the auth table "${authSchema}.${authTable}" — ` +
+                            "writes to it won't emit database-level events.",
+                            { detail: err instanceof Error ? err.message : String(err) }
+                        );
+                    }
+                }
+            }
+
             let emailService: EmailService | undefined;
             if (authConfig.email) {
                 emailService = createEmailService(authConfig.email as EmailConfig);

package/src/auth/ensure-tables.ts

@@ -112,13 +112,87 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             )
         `);
 
+        // ── Migration: auth FK column user_id → uid, phase 1 (expand) ───────
+        // Must run BEFORE the dependent tables below: CREATE TABLE IF NOT
+        // EXISTS never revisits an existing table, so a database provisioned
+        // before this migration still lacks `uid` — and the
+        // CREATE INDEX ... (uid) statements that follow would fail on it.
+        //
+        // Deliberately NOT a plain RENAME. Both Cloud Run and Kubernetes roll
+        // deploys, so old and new pods serve the same database at the same time,
+        // and a rollback puts old code back in front of a migrated database. A
+        // rename breaks every auth query on whichever side is out of step.
+        // Instead: add `uid`, backfill it, drop the NOT NULL on `user_id`, and
+        // keep the two in sync with a trigger, so a backend of either era can
+        // read and write. `scripts/drop-legacy-auth-user-id.sql` removes the
+        // column once no old backend remains (phase 2, contract).
+        //
+        // Idempotent throughout: every step is guarded on catalogue state.
+        await db.execute(sql`
+            CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
+            BEGIN
+                IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
+                    NEW.uid := NEW.user_id;
+                ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
+                    NEW.user_id := NEW.uid;
+                END IF;
+                RETURN NEW;
+            END $$ LANGUAGE plpgsql
+        `);
+
+        for (const authTable of [
+            "user_identities",
+            "refresh_tokens",
+            "password_reset_tokens",
+            "magic_link_tokens",
+            "mfa_factors",
+            "recovery_codes"
+        ]) {
+            const qualified = `"${authSchema}"."${authTable}"`;
+            await db.execute(sql`
+                DO $$
+                DECLARE
+                    has_legacy boolean;
+                    has_uid    boolean;
+                BEGIN
+                    SELECT
+                        bool_or(column_name = 'user_id'),
+                        bool_or(column_name = 'uid')
+                    INTO has_legacy, has_uid
+                    FROM information_schema.columns
+                    WHERE table_schema = ${sql.raw(`'${authSchema}'`)}
+                      AND table_name = ${sql.raw(`'${authTable}'`)};
+
+                    -- Table absent, or already uid-only (a fresh install, or
+                    -- phase 2 already run): nothing to do.
+                    IF has_legacy IS NOT TRUE THEN
+                        RETURN;
+                    END IF;
+
+                    IF has_uid IS NOT TRUE THEN
+                        EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ADD COLUMN uid ${userIdType} REFERENCES ${usersTableName}(id) ON DELETE CASCADE'`)};
+                        EXECUTE ${sql.raw(`'UPDATE ${qualified} SET uid = user_id WHERE uid IS NULL'`)};
+                        EXECUTE ${sql.raw(`'CREATE INDEX IF NOT EXISTS idx_${authTable}_uid ON ${qualified}(uid)'`)};
+                    END IF;
+
+                    -- New code inserts uid and never user_id, so the legacy
+                    -- column can no longer be NOT NULL. The trigger below
+                    -- backfills it, but the constraint is checked first.
+                    EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ALTER COLUMN user_id DROP NOT NULL'`)};
+
+                    EXECUTE ${sql.raw(`'DROP TRIGGER IF EXISTS sync_uid_user_id ON ${qualified}'`)};
+                    EXECUTE ${sql.raw(`'CREATE TRIGGER sync_uid_user_id BEFORE INSERT OR UPDATE ON ${qualified} FOR EACH ROW EXECUTE FUNCTION "${authSchema}".sync_uid_user_id()'`)};
+                END $$
+            `);
+        }
+
         // ── Create dependent auth tables (idempotent) ───────────────────
 
         // Create user_identities table
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(userIdentitiesTable)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 provider TEXT NOT NULL,
                 provider_id TEXT NOT NULL,
                 profile_data JSONB,
@@ -131,7 +205,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // Create indexes on user_identities
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_user_identities_user 
-            ON ${sql.raw(userIdentitiesTable)}(user_id)
+            ON ${sql.raw(userIdentitiesTable)}(uid)
         `);
 
 
@@ -139,13 +213,13 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 user_agent TEXT,
                 ip_address TEXT,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-                CONSTRAINT unique_device_session UNIQUE (user_id, user_agent, ip_address)
+                CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
             )
         `);
 
@@ -155,17 +229,17 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             ON ${sql.raw(refreshTokensTableName)}(token_hash)
         `);
 
-        // Create index on user_id for cleanup operations
+        // Create index on uid for cleanup operations
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user 
-            ON ${sql.raw(refreshTokensTableName)}(user_id)
+            ON ${sql.raw(refreshTokensTableName)}(uid)
         `);
 
         // Create password reset tokens table
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(passwordResetTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
@@ -179,10 +253,10 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             ON ${sql.raw(passwordResetTokensTableName)}(token_hash)
         `);
 
-        // Create index on user_id for password reset cleanup
+        // Create index on uid for password reset cleanup
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user 
-            ON ${sql.raw(passwordResetTokensTableName)}(user_id)
+            ON ${sql.raw(passwordResetTokensTableName)}(uid)
         `);
 
         // Create magic link tokens table
@@ -190,7 +264,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(magicLinkTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
@@ -204,10 +278,10 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             ON ${sql.raw(magicLinkTokensTableName)}(token_hash)
         `);
 
-        // Create index on user_id for magic link cleanup
+        // Create index on uid for magic link cleanup
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_magic_link_tokens_user 
-            ON ${sql.raw(magicLinkTokensTableName)}(user_id)
+            ON ${sql.raw(magicLinkTokensTableName)}(uid)
         `);
 
         // Create app config table
@@ -226,9 +300,15 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         await db.transaction(async (tx) => {
             await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
 
+            // Falls back to the pre-rename `app.user_id` so a database that has
+            // taken the new schema but is still served by an older backend keeps
+            // resolving the principal. Keep in sync with AUTH_BOOTSTRAP_SQL.
             await tx.execute(sql`
                 CREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$
-                    SELECT NULLIF(current_setting('app.user_id', true), '');
+                    SELECT COALESCE(
+                        NULLIF(current_setting('app.uid', true), ''),
+                        NULLIF(current_setting('app.user_id', true), '')
+                    );
                 $$ LANGUAGE sql STABLE
             `);
 
@@ -251,17 +331,32 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // Seed default roles if none exist
         // (no-op: roles are now stored inline on the users table)
 
-        // ── Migration: Add is_anonymous column (safe for existing tables) ────
-        await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
-        `);
-
-        // ── Migration: Add inline roles column (safe for existing tables) ────
-        await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
-        `);
+        // ── Migration: reconcile the full users column set (safe for existing tables) ──
+        // CREATE TABLE IF NOT EXISTS never revisits an existing table, so a
+        // database provisioned by an older framework era is missing every
+        // column added since. Each column the auth services read or write must
+        // be back-filled here, or upgraded deployments break on the first
+        // statement that references it. `email` is deliberately absent: it has
+        // existed since the first era and cannot be added NOT NULL safely.
+        const userColumnBackfills = [
+            "display_name VARCHAR(255)",
+            "photo_url VARCHAR(500)",
+            "roles TEXT[] DEFAULT '{}' NOT NULL",
+            "password_hash VARCHAR(255)",
+            "email_verified BOOLEAN DEFAULT FALSE NOT NULL",
+            "email_verification_token VARCHAR(255)",
+            "email_verification_sent_at TIMESTAMP WITH TIME ZONE",
+            "is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
+            "metadata JSONB DEFAULT '{}' NOT NULL",
+            "created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
+            "updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
+        ];
+        for (const columnDef of userColumnBackfills) {
+            await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+            `);
+        }
 
         // ── Migration: Copy roles from legacy junction table to inline column ──
         // If the old rebase.user_roles and rebase.roles tables exist, migrate
@@ -307,7 +402,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(mfaFactorsTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 factor_type TEXT NOT NULL DEFAULT 'totp',
                 secret_encrypted TEXT NOT NULL,
                 friendly_name TEXT,
@@ -320,7 +415,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // Create indexes on mfa_factors
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_mfa_factors_user
-            ON ${sql.raw(mfaFactorsTableName)}(user_id)
+            ON ${sql.raw(mfaFactorsTableName)}(uid)
         `);
 
         // Create mfa_challenges table
@@ -345,7 +440,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(recoveryCodesTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 code_hash TEXT NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
@@ -355,9 +450,56 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // Create indexes on recovery_codes
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_recovery_codes_user
-            ON ${sql.raw(recoveryCodesTableName)}(user_id)
+            ON ${sql.raw(recoveryCodesTableName)}(uid)
         `);
 
+        // ── Migration: clear stale FORCE ROW LEVEL SECURITY (older RLS model) ──
+        // The current model never emits FORCE: privileged auth writes run as
+        // the table owner and rely on the owner bypassing plain ENABLE RLS
+        // (see generate-postgres-ddl-logic). A table still carrying FORCE from
+        // an older framework era binds the owner too, so the first user
+        // registration after an upgrade fails with SQLSTATE 42501. Reconcile
+        // on boot; only tables actually flagged get the ALTER (and its lock).
+        try {
+            const authTablePairs: [string, string][] = [
+                [usersSchema, resolvedTable],
+                [authSchema, "user_identities"],
+                [authSchema, "refresh_tokens"],
+                [authSchema, "password_reset_tokens"],
+                [authSchema, "app_config"],
+                [authSchema, "mfa_factors"],
+                [authSchema, "mfa_challenges"],
+                [authSchema, "recovery_codes"]
+            ];
+            for (const [schemaName, tableName] of authTablePairs) {
+                const forced = await db.execute(sql`
+                    SELECT 1
+                    FROM pg_class c
+                    JOIN pg_namespace n ON n.oid = c.relnamespace
+                    WHERE n.nspname = ${schemaName}
+                      AND c.relname = ${tableName}
+                      AND c.relforcerowsecurity
+                `);
+                if (forced.rows.length > 0) {
+                    await db.execute(sql`
+                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
+                        NO FORCE ROW LEVEL SECURITY
+                    `);
+                    logger.warn(
+                        `🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" ` +
+                        "(legacy RLS model — it binds the owner connection and breaks privileged auth writes)"
+                    );
+                }
+            }
+        } catch (rlsReconcileError: unknown) {
+            // Non-fatal: the connection may lack ownership on a pre-provisioned
+            // table; registration will still fail loudly (42501) if FORCE remains.
+            logger.warn(
+                `⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ` +
+                `${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`
+            );
+        }
+
         logger.info("✅ Auth tables ready");
     } catch (error) {
         logger.error("❌ Failed to create auth tables", { error });