@rebasepro/server-postgres 0.9.1-canary.a57c262 → 0.9.1-canary.a8dbf1c

package/dist/index.es.js

@@ -71,16 +71,51 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 var connection_exports = /* @__PURE__ */ __exportAll({
 	createDirectDatabaseConnection: () => createDirectDatabaseConnection,
 	createPostgresDatabaseConnection: () => createPostgresDatabaseConnection,
-	createReadReplicaConnection: () => createReadReplicaConnection
+	createReadReplicaConnection: () => createReadReplicaConnection,
+	guardPoolAgainstDirtyRelease: () => guardPoolAgainstDirtyRelease
 });
 var DEFAULT_POOL = {
 	max: 20,
 	idleTimeoutMillis: 3e4,
 	connectionTimeoutMillis: 1e4,
-	queryTimeout: 3e4,
+	queryTimeout: 6e4,
 	statementTimeout: 3e4,
 	keepAlive: true
 };
+/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
+var TX_IDLE = "I";
+/**
+* Destroy pool clients that are released while still inside a transaction.
+*
+* pg-pool returns a client to the idle list whenever `release()` is called
+* without an error — even if the connection is still mid-transaction (status
+* `T`/`E`). That happens in practice: drizzle's pool transaction releases in
+* a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
+* (e.g. it was queued behind a statement that hit the client-side
+* query_timeout), the client goes back dirty. The next checkout then runs
+* its statements inside the zombie transaction — with the previous request's
+* `app.*` RLS GUCs still applied, which turns unrelated queries into
+* RLS-scoped ones (observed in production as registration failing with
+* SQLSTATE 42501 under a leaked anonymous context).
+*
+* pg-pool emits `release` before it consults its private `_expired` set, so
+* marking the client expired here makes `_release()` destroy it instead of
+* pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
+* private APIs — feature-detect and fall back to loud logging so an upstream
+* change degrades to observability, never to silent corruption.
+*/
+function guardPoolAgainstDirtyRelease(pool, label) {
+	pool.on("release", (err, client) => {
+		if (err) return;
+		const txStatus = client?._txStatus;
+		if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
+		const expired = pool._expired;
+		if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
+			expired.add(client);
+			logger.error(`[${label}] Client released back to the pool while still in a transaction (status '${txStatus}') — destroying it so the open transaction and its session state (RLS GUCs) cannot leak into the next request.`);
+		} else logger.error(`[${label}] Client released mid-transaction (status '${txStatus}') but the pool's internal expiry set is unavailable (pg-pool internals changed?). The connection may leak its open transaction into subsequent requests.`);
+	});
+}
 /**
 * Create a Drizzle-backed Postgres connection with a production-grade
 * connection pool.
@@ -112,6 +147,7 @@ function createPostgresDatabaseConnection(connectionString, schema, poolConfig)
 		logger.error("[pg-pool] Unexpected pool error", { detail: err.message });
 		if (err.message.includes("ETIMEDOUT")) logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -144,6 +180,7 @@ function createDirectDatabaseConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -173,6 +210,7 @@ function createReadReplicaConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -315,7 +353,7 @@ function getDeclaredSubcollections(collection) {
 /**
 * The id a request without a logged-in user reports as `auth.uid()`.
 *
-* A user-context request always sets `app.user_id`: blank would read back as
+* A user-context request always sets `app.uid`: blank would read back as
 * `NULL`, and `NULL` is how the trusted server context is recognised, so an
 * anonymous visitor would be promoted to server privileges. The driver
 * therefore substitutes this sentinel at the single chokepoint where the GUC
@@ -2096,7 +2134,7 @@ function getSubcollections(collection) {
 * It handles:
 * - `field = 'literal'`
 * - `field != 'literal'`
-* - `field = current_setting('app.user_id')`
+* - `field = current_setting('app.uid')` (or the legacy `app.user_id`)
 * - `A AND B`, `A OR B` — only where the keyword is at the top level
 * - `true`
 * - `IN (...)` (as optimistic true)
@@ -2297,7 +2335,7 @@ function findAnonymousGrants(expr) {
 	return found;
 }
 function parseOperand(str) {
-	if (/current_setting\s*\(\s*'app\.user_id'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return policy.authUid();
+	if (/current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return policy.authUid();
 	const stringMatch = str.match(/^'(.+)'$/);
 	if (stringMatch) return policy.literal(stringMatch[1]);
 	if (/^\w+$/.test(str)) return policy.field(str);
@@ -5228,6 +5266,7 @@ var DrizzleConditionBuilder = class {
 	static buildVectorSearchConditions(table, vectorSearch) {
 		const column = table[vectorSearch.property];
 		if (!column) throw new Error(`Vector column '${vectorSearch.property}' not found in table`);
+		if (!Array.isArray(vectorSearch.vector) || vectorSearch.vector.length === 0 || !vectorSearch.vector.every((n) => typeof n === "number" && Number.isFinite(n))) throw new Error("Vector search requires a non-empty array of finite numbers");
 		const vectorLiteral = `'[${vectorSearch.vector.join(",")}]'::vector`;
 		const distanceFn = vectorSearch.distance || "cosine";
 		let operator;
@@ -6456,9 +6495,56 @@ function unwrapJunctionRow(item) {
 	const nestedKey = Object.keys(item).find((key) => typeof item[key] === "object" && item[key] !== null && !Array.isArray(item[key]));
 	return nestedKey ? item[nestedKey] : item;
 }
+/**
+* Give back the number a `number` property was declared to be.
+*
+* Postgres returns NUMERIC as a string and drizzle keeps it that way, since a
+* numeric can hold more precision than a double. But the collection declared
+* this property `number` and the OpenAPI spec this server publishes says
+* `type: number`, so serving `"9.99"` breaks its own contract — and breaks it
+* asymmetrically, because a create answers with the number and the read that
+* follows answers with the string. Any client that multiplies a price works
+* until the first refresh.
+*
+* Declaring a property `number` already accepts double precision — that is what
+* the admin has always parsed it to. Columns REST serves that no property
+* declares are left exactly as the database returned them.
+*/
+function coerceDeclaredNumber(value, property) {
+	if (property?.type !== "number" || typeof value !== "string") return value;
+	const parsed = parseFloat(value);
+	return isNaN(parsed) ? null : parsed;
+}
+/** Apply {@link coerceDeclaredNumber} across a row, leaving every other column alone. */
+function coerceDeclaredNumbers(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	const out = {};
+	for (const [key, value] of Object.entries(row)) out[key] = coerceDeclaredNumber(value, properties[key]);
+	return out;
+}
 /** Render one target row in the requested style. */
+/**
+* Drop every column the collection marked `excludeFromApi`.
+*
+* Password hashes and verification tokens have to be readable server-side but
+* must never reach a client — and "never" has to mean every exit from this
+* pipeline, including relation targets, or a secret leaks through whichever
+* path was overlooked. Keyed by both the property name and its column name,
+* since a row can arrive keyed either way depending on the caller.
+*/
+function stripExcluded(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	for (const [key, property] of Object.entries(properties)) {
+		if (!property?.excludeFromApi) continue;
+		delete row[key];
+		if (property.columnName) delete row[property.columnName];
+	}
+	return row;
+}
 function renderTarget(targetRow, targetCollection, style, registry) {
-	if (style === "inline") return { ...targetRow };
+	if (style === "inline") return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
 	const address = relationTargetAddress(targetRow, targetCollection, registry);
 	const path = targetCollection.slug;
 	return createRelationRefWithData(address, path, {
@@ -6500,14 +6586,17 @@ function toCmsRow(row, collection, registry) {
 			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, targetCollection, "ref", registry));
 		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
 	}
-	return normalized;
+	return stripExcluded(normalized, collection);
 }
 /**
 * The row REST serves: every column under its own name, with the value Postgres
 * returned, and relations inlined as the target's columns.
 *
-* Deliberately not normalized: REST serves what the database holds, and JSON
-* has its own opinions about dates that the admin's view-model does not share.
+* Values are the ones the database returned, except where that contradicts the
+* declared type: a `number` property is served as a number (see
+* {@link coerceDeclaredNumber}). Dates stay as the database returned them —
+* JSON has its own opinions about dates that the admin's view-model does not
+* share.
 *
 * Keyed by the row rather than by the relation list — a REST fetch only loads
 * the relations `include` asked for, so the row is the authority on which are
@@ -6520,9 +6609,9 @@ function toRestRow(row, collection, registry) {
 		const relation = findRelation(resolvedRelations, key);
 		if (relation && Array.isArray(value)) flat[key] = value.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, relation.target(), "inline", registry));
 		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
-		else flat[key] = value;
+		else flat[key] = coerceDeclaredNumber(value, collection.properties?.[key]);
 	}
-	return flat;
+	return stripExcluded(flat, collection);
 }
 //#endregion
 //#region src/services/FetchService.ts
@@ -7625,7 +7714,7 @@ var PersistService = class {
 		} catch (error) {
 			throw this.toUserFriendlyError(error, collection.slug);
 		}
-		const finalEntity = await this.fetchService.fetchOne(collection.slug, savedId, databaseId);
+		const finalEntity = await this.fetchService.fetchOneForRest(collection.slug, savedId, void 0, databaseId);
 		if (!finalEntity) throw new Error("Could not fetch row after save.");
 		return finalEntity;
 	}
@@ -8093,7 +8182,7 @@ async function ensureAppRole(run, schemas) {
 * SECURITY: this function is only ever called on the **user** path (the server
 * context uses the base/owner driver and never calls it). The default policies
 * treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`
-* is `NULLIF(current_setting('app.user_id'), '')` — so an EMPTY user id would
+* is `NULLIF(current_setting('app.uid'), '')` — so an EMPTY user id would
 * be read as NULL and silently escalate a user request to server privileges.
 * Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,
 * rather than trusting every caller (e.g. realtime subscription auth) to do it.
@@ -8101,14 +8190,15 @@ async function ensureAppRole(run, schemas) {
 * semantics: it is why `auth.uid() IS NOT NULL` is true for anonymous requests.
 */
 async function applyAuthContext(tx, auth, userRole) {
-	const userId = typeof auth.userId === "string" && auth.userId.trim() !== "" ? auth.userId : ANONYMOUS_USER_ID;
+	const uid = typeof auth.uid === "string" && auth.uid.trim() !== "" ? auth.uid : ANONYMOUS_USER_ID;
 	const normalizedRoles = auth.roles.map((r) => typeof r === "string" ? r : r?.id ?? String(r));
 	await tx.execute(sql`
         SELECT
-            set_config('app.user_id', ${userId}, true),
+            set_config('app.uid', ${uid}, true),
+            set_config('app.user_id', ${uid}, true),
             set_config('app.user_roles', ${normalizedRoles.join(",")}, true),
             set_config('app.jwt', ${JSON.stringify({
-		sub: userId,
+		sub: uid,
 		roles: auth.roles
 	})}, true)
     `);
@@ -8254,6 +8344,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			executeSql: (...args) => this.executeSql(...args),
 			fetchAvailableDatabases: () => this.fetchAvailableDatabases(),
 			fetchAvailableRoles: () => this.fetchAvailableRoles(),
+			fetchApplicationRoles: () => this.fetchApplicationRoles(),
 			fetchCurrentDatabase: () => this.fetchCurrentDatabase(),
 			fetchUnmappedTables: (...args) => this.fetchUnmappedTables(...args),
 			fetchTableMetadata: (...args) => this.fetchTableMetadata(...args),
@@ -8544,12 +8635,14 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
 		let previousValuesForHistory;
-		if (status === "existing" && id) {
-			const existing = await this.dataService.fetchOne(path, id, resolvedCollection?.databaseId);
+		if (status === "existing" && id) try {
+			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
 			if (existing) {
 				const { id: _existingId, ...existingValues } = existing;
 				previousValuesForHistory = existingValues;
 			}
+		} catch (err) {
+			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
 		}
 		if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
 			if (globalCallbacks?.beforeSave) {
@@ -8905,6 +8998,45 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	async fetchAvailableRoles() {
 		return (await this.executeSql("SELECT rolname FROM pg_roles WHERE pg_has_role(current_user, rolname, 'member') ORDER BY rolname;")).map((r) => r.rolname);
 	}
+	/**
+	* Application-level roles actually in use in this project.
+	*
+	* Distinct from {@link fetchAvailableRoles}, which returns native
+	* PostgreSQL roles from `pg_roles` (`postgres`, `rebase_user`, …). Those
+	* are the roles the SQL editor can `SET ROLE` to. *These* are the strings
+	* held in the users table's `roles` column, injected per-transaction as
+	* `auth.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
+	* into a `SecurityRule.roles` field produces a condition no user can ever
+	* satisfy, so the two must not be conflated.
+	*
+	* Roles have no registry table — they were migrated out of
+	* `rebase.user_roles` onto an inline `roles TEXT[]` column — so the live
+	* set is derived from what is assigned. A role that is declared in a policy
+	* but held by nobody yet cannot be discovered here; callers that need it
+	* should union in the roles they already know about.
+	*/
+	async fetchApplicationRoles() {
+		const located = await this.executeSql(`
+            SELECT table_schema, table_name
+            FROM information_schema.columns
+            WHERE column_name = 'roles'
+              AND data_type = 'ARRAY'
+              AND table_name = 'users'
+              AND table_schema NOT IN ('information_schema', 'pg_catalog')
+            ORDER BY (table_schema = 'rebase') DESC, table_schema
+            LIMIT 1;
+        `);
+		if (located.length === 0) return [];
+		const schema = located[0].table_schema;
+		const table = located[0].table_name;
+		const qualified = `"${schema.replace(/"/g, "\"\"")}"."${table.replace(/"/g, "\"\"")}"`;
+		return (await this.executeSql(`
+            SELECT DISTINCT unnest(roles) AS role
+            FROM ${qualified}
+            WHERE roles IS NOT NULL
+            ORDER BY role;
+        `)).map((r) => r.role).filter((r) => typeof r === "string" && r.length > 0);
+	}
 	async fetchCurrentDatabase() {
 		return this.poolManager?.defaultDatabaseName;
 	}
@@ -9046,15 +9178,15 @@ var AuthenticatedPostgresBackendDriver = class {
 	async withTransaction(operation, options) {
 		const pendingNotifications = [];
 		const result = await this.delegate.db.transaction(async (tx) => {
-			let userId = this.user?.uid;
-			if (!userId) {
+			let uid = this.user?.uid;
+			if (!uid) {
 				logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
-				userId = "anonymous";
+				uid = "anonymous";
 			}
 			const userRoles = this.user?.roles ?? [];
 			if (!this.user?.roles) logger.warn("[DataDriver] User roles are missing for authenticated delegate. Using empty array. User object", { detail: this.user });
 			await applyAuthContext(tx, {
-				userId,
+				uid,
 				roles: userRoles
 			}, this.delegate.rlsUserRole);
 			const txEntityService = new DataService(tx, this.delegate.registry);
@@ -9081,7 +9213,7 @@ var AuthenticatedPostgresBackendDriver = class {
 	*/
 	injectAuthContext(unsubscribe) {
 		const authContext = {
-			userId: this.user?.uid || "anonymous",
+			uid: this.user?.uid || "anonymous",
 			roles: this.user?.roles ?? []
 		};
 		const entries = Array.from(this.delegate.realtimeService.subscriptions.entries());
@@ -9162,6 +9294,7 @@ var DatabasePoolManager = class {
 		pool.on("error", (err) => {
 			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
 		});
+		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 		this.pools.set(databaseName, pool);
 		return pool;
 	}
@@ -9224,19 +9357,19 @@ function createAuthSchema(usersSchemaName = "rebase") {
 	*/
 	const refreshTokens = tableCreator("refresh_tokens", {
 		id: uuid("id").defaultRandom().primaryKey(),
-		userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 		tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
 		expiresAt: timestamp("expires_at").notNull(),
 		userAgent: varchar("user_agent", { length: 500 }),
 		ipAddress: varchar("ip_address", { length: 45 }),
 		createdAt: timestamp("created_at").defaultNow().notNull()
-	}, (table) => ({ uniqueDeviceSession: unique("unique_device_session").on(table.userId, table.userAgent, table.ipAddress) }));
+	}, (table) => ({ uniqueDeviceSession: unique("unique_device_session").on(table.uid, table.userAgent, table.ipAddress) }));
 	/**
 	* Password reset tokens for forgot password flow
 	*/
 	const passwordResetTokens = tableCreator("password_reset_tokens", {
 		id: uuid("id").defaultRandom().primaryKey(),
-		userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 		tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
 		expiresAt: timestamp("expires_at").notNull(),
 		usedAt: timestamp("used_at"),
@@ -9255,7 +9388,7 @@ function createAuthSchema(usersSchemaName = "rebase") {
 	*/
 	const userIdentities = tableCreator("user_identities", {
 		id: uuid("id").defaultRandom().primaryKey(),
-		userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 		provider: varchar("provider", { length: 50 }).notNull(),
 		providerId: varchar("provider_id", { length: 255 }).notNull(),
 		profileData: jsonb("profile_data"),
@@ -9267,7 +9400,7 @@ function createAuthSchema(usersSchemaName = "rebase") {
 	*/
 	const mfaFactors = tableCreator("mfa_factors", {
 		id: uuid("id").defaultRandom().primaryKey(),
-		userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 		factorType: varchar("factor_type", { length: 20 }).notNull(),
 		secretEncrypted: varchar("secret_encrypted", { length: 500 }).notNull(),
 		friendlyName: varchar("friendly_name", { length: 255 }),
@@ -9293,14 +9426,14 @@ function createAuthSchema(usersSchemaName = "rebase") {
 		}),
 		recoveryCodes: tableCreator("recovery_codes", {
 			id: uuid("id").defaultRandom().primaryKey(),
-			userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 			codeHash: varchar("code_hash", { length: 255 }).notNull(),
 			usedAt: timestamp("used_at"),
 			createdAt: timestamp("created_at").defaultNow().notNull()
 		}),
 		magicLinkTokens: tableCreator("magic_link_tokens", {
 			id: uuid("id").defaultRandom().primaryKey(),
-			userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 			tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
 			expiresAt: timestamp("expires_at").notNull(),
 			usedAt: timestamp("used_at"),
@@ -9328,20 +9461,20 @@ var usersRelations = relations(users, ({ many }) => ({
 	magicLinkTokens: many(magicLinkTokens)
 }));
 var refreshTokensRelations = relations(refreshTokens, ({ one }) => ({ user: one(users, {
-	fields: [refreshTokens.userId],
+	fields: [refreshTokens.uid],
 	references: [users.id]
 }) }));
 var passwordResetTokensRelations = relations(passwordResetTokens, ({ one }) => ({ user: one(users, {
-	fields: [passwordResetTokens.userId],
+	fields: [passwordResetTokens.uid],
 	references: [users.id]
 }) }));
 var userIdentitiesRelations = relations(userIdentities, ({ one }) => ({ user: one(users, {
-	fields: [userIdentities.userId],
+	fields: [userIdentities.uid],
 	references: [users.id]
 }) }));
 var mfaFactorsRelations = relations(mfaFactors, ({ one, many }) => ({
 	user: one(users, {
-		fields: [mfaFactors.userId],
+		fields: [mfaFactors.uid],
 		references: [users.id]
 	}),
 	challenges: many(mfaChallenges)
@@ -9351,11 +9484,11 @@ var mfaChallengesRelations = relations(mfaChallenges, ({ one }) => ({ factor: on
 	references: [mfaFactors.id]
 }) }));
 var recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({ user: one(users, {
-	fields: [recoveryCodes.userId],
+	fields: [recoveryCodes.uid],
 	references: [users.id]
 }) }));
 var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user: one(users, {
-	fields: [magicLinkTokens.userId],
+	fields: [magicLinkTokens.uid],
 	references: [users.id]
 }) }));
 //#endregion
@@ -10188,6 +10321,267 @@ var CdcListener = class CdcListener {
 	}
 };
 //#endregion
+//#region src/services/channel-history.ts
+/**
+* Ordered, replayable per-channel message history.
+*
+* Broadcast on its own is fire-and-forget to whoever is connected at the
+* instant it is sent: fine for presence and for "someone saved" notifications,
+* not enough for op-based collaborative editing, where a client that blinks
+* out for two seconds has to resync a whole document rather than catch up on
+* the four operations it missed. This adds the missing half — every retained
+* broadcast gets a per-channel sequence number, and a client can ask for
+* everything after the last one it saw.
+*
+* Three decisions worth stating, because each rules out a simpler-looking one:
+*
+*  - **Retention is server-side and opt-in.** A channel is created by whoever
+*    names it, so a client-supplied history depth would let any visitor commit
+*    the backend to unbounded storage. And presence channels — the common case
+*    — must not pay for this: with no rules configured nothing is written, no
+*    table is created, and `broadcast` runs exactly the code it ran before.
+*
+*  - **Sequence numbers come from the database, not from a counter in this
+*    process.** They have to survive a restart and be shared across instances;
+*    an in-memory counter would restart at 1 after a deploy and hand a
+*    reconnecting client a replay from the wrong era, silently.
+*
+*  - **The cursor row outlives the messages it numbered.** Pruning is what
+*    makes retention affordable, but pruning the cursor along with the messages
+*    would restart the sequence and make `sinceSeq` mean something different
+*    before and after — the worst kind of bug, because replay would still
+*    return rows and they would look plausible. Cursors are tiny and are kept
+*    forever; see {@link prune}, which touches only `channel_messages`.
+*/
+/** How many messages a replay returns when the caller does not say. */
+var DEFAULT_REPLAY_LIMIT = 200;
+/**
+* Hard ceiling on one replay, whatever the caller asks for.
+*
+* A reconnecting client names its own `limit`, so this is the only thing
+* standing between a stale `sinceSeq` and a single frame carrying a channel's
+* entire retained history. A client that is further behind than this is told so
+* via `latestSeq` and can decide to resync wholesale instead of paging.
+*/
+var MAX_REPLAY_LIMIT = 1e3;
+/** Minimum gap between two prunes of the same channel. */
+var PRUNE_THROTTLE_MS = 3e4;
+/**
+* Parse a retention TTL into milliseconds.
+*
+* Accepts a raw millisecond count or a short duration string (`"30s"`, `"15m"`,
+* `"24h"`, `"7d"`). Returns undefined for anything unparseable, which the
+* caller treats as "no TTL" — a misspelt duration must not silently become an
+* aggressive one.
+*/
+function parseTtlMs(ttl) {
+	if (ttl === void 0 || ttl === null) return void 0;
+	if (typeof ttl === "number") return Number.isFinite(ttl) && ttl > 0 ? ttl : void 0;
+	const match = /^\s*(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)\s*$/i.exec(ttl);
+	if (!match) {
+		logger.warn(`⚠️ [ChannelHistory] Ignoring unparseable retention ttl "${ttl}" — expected e.g. "30s", "15m", "24h", "7d".`);
+		return;
+	}
+	const value = parseFloat(match[1]);
+	const unit = match[2].toLowerCase();
+	const ms = value * (unit === "ms" ? 1 : unit === "s" ? 1e3 : unit === "m" ? 6e4 : unit === "h" ? 36e5 : 864e5);
+	return ms > 0 ? ms : void 0;
+}
+/**
+* Whether `channel` is covered by `rule`.
+*
+* Exact match, or a trailing `*` acting as a prefix. Not a general glob: this
+* decides what reaches disk, and a pattern language whose reach is not obvious
+* at a glance is the wrong tool for that job.
+*/
+function channelMatchesRule(channel, rule) {
+	const pattern = rule.match;
+	if (pattern === "*") return true;
+	if (pattern.endsWith("*")) return channel.startsWith(pattern.slice(0, -1));
+	return channel === pattern;
+}
+/**
+* Persistence and replay for retained channels.
+*
+* Inert unless constructed with at least one rule: {@link enabled} is false,
+* {@link ensureTables} does nothing, and {@link retentionFor} answers undefined
+* for every channel, so the realtime service never reaches the SQL below.
+*/
+var ChannelHistoryStore = class {
+	db;
+	rules;
+	/** Resolved rule per channel name, so the match runs once per channel. */
+	resolved = /* @__PURE__ */ new Map();
+	/** Channel → timestamp of its last prune, for {@link PRUNE_THROTTLE_MS}. */
+	lastPruned = /* @__PURE__ */ new Map();
+	tablesReady = false;
+	constructor(db, rules = []) {
+		this.db = db;
+		this.rules = rules.filter((rule) => {
+			if (!rule?.match) {
+				logger.warn("⚠️ [ChannelHistory] Ignoring a retention rule with no `match`.");
+				return false;
+			}
+			if (!(rule.limit !== void 0 || rule.ttl !== void 0)) {
+				logger.warn(`⚠️ [ChannelHistory] Retention rule "${rule.match}" sets neither \`limit\` nor \`ttl\` — ignoring it, as it would retain forever.`);
+				return false;
+			}
+			return true;
+		});
+	}
+	/** Whether any channel retains anything at all. */
+	get enabled() {
+		return this.rules.length > 0;
+	}
+	/**
+	* The retention that applies to `channel`, or undefined when none does.
+	*
+	* First matching rule wins, so callers order them most-specific first.
+	*/
+	retentionFor(channel) {
+		if (!this.enabled || !channel) return void 0;
+		const cached = this.resolved.get(channel);
+		if (cached !== void 0) return cached ?? void 0;
+		const rule = this.rules.find((r) => channelMatchesRule(channel, r));
+		const resolved = rule ? {
+			limit: rule.limit,
+			ttlMs: parseTtlMs(rule.ttl)
+		} : null;
+		this.resolved.set(channel, resolved);
+		return resolved ?? void 0;
+	}
+	/**
+	* Create the history tables. Idempotent, and a no-op when no rule is set —
+	* a deployment that never retains anything gets no schema for it.
+	*/
+	async ensureTables() {
+		if (!this.enabled || this.tablesReady) return;
+		await this.db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
+		await this.db.execute(sql`
+            CREATE TABLE IF NOT EXISTS rebase.channel_messages (
+                channel TEXT NOT NULL,
+                seq BIGINT NOT NULL,
+                event TEXT NOT NULL,
+                payload JSONB,
+                sender_id TEXT,
+                created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                PRIMARY KEY (channel, seq)
+            )
+        `);
+		await this.db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_channel_messages_created
+            ON rebase.channel_messages (created_at)
+        `);
+		await this.db.execute(sql`
+            CREATE TABLE IF NOT EXISTS rebase.channel_cursors (
+                channel TEXT PRIMARY KEY,
+                last_seq BIGINT NOT NULL
+            )
+        `);
+		this.tablesReady = true;
+		logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
+	}
+	/**
+	* Append a broadcast and return the sequence number it was given.
+	*
+	* The sequence is allocated by the same statement that stores the message,
+	* so a crash between the two is not a possibility. `ON CONFLICT DO UPDATE`
+	* takes a row lock on the channel's cursor, which is what makes concurrent
+	* broadcasts to one channel line up in a single order — and what keeps
+	* different channels from contending with each other at all.
+	*/
+	async append(channel, event, payload, senderId) {
+		const row = (await this.db.execute(sql`
+            WITH next AS (
+                INSERT INTO rebase.channel_cursors (channel, last_seq)
+                VALUES (${channel}, 1)
+                ON CONFLICT (channel)
+                DO UPDATE SET last_seq = rebase.channel_cursors.last_seq + 1
+                RETURNING last_seq
+            )
+            INSERT INTO rebase.channel_messages (channel, seq, event, payload, sender_id)
+            SELECT ${channel}, next.last_seq, ${event}, ${JSON.stringify(payload ?? null)}::jsonb, ${senderId ?? null}
+            FROM next
+            RETURNING seq, created_at
+        `)).rows[0];
+		if (!row) throw new Error(`Failed to append to channel history for "${channel}"`);
+		return {
+			seq: Number(row.seq),
+			at: row.created_at instanceof Date ? row.created_at.toISOString() : String(row.created_at)
+		};
+	}
+	/**
+	* Everything retained for `channel` after `sinceSeq`, oldest first.
+	*
+	* `latestSeq` is reported whether or not the messages were capped, so a
+	* client that is further behind than one page can tell.
+	*/
+	async replay(channel, sinceSeq = 0, limit = DEFAULT_REPLAY_LIMIT) {
+		const capped = Math.max(1, Math.min(Math.floor(limit) || DEFAULT_REPLAY_LIMIT, MAX_REPLAY_LIMIT));
+		const after = Number.isFinite(sinceSeq) && sinceSeq > 0 ? Math.floor(sinceSeq) : 0;
+		const messages = (await this.db.execute(sql`
+            SELECT seq, event, payload, sender_id, created_at
+            FROM rebase.channel_messages
+            WHERE channel = ${channel} AND seq > ${after}
+            ORDER BY seq ASC
+            LIMIT ${capped}
+        `)).rows.map((row) => ({
+			seq: Number(row.seq),
+			event: row.event,
+			payload: row.payload,
+			senderId: row.sender_id ?? void 0,
+			at: row.created_at instanceof Date ? row.created_at.toISOString() : String(row.created_at)
+		}));
+		const cursorRow = (await this.db.execute(sql`
+            SELECT last_seq FROM rebase.channel_cursors WHERE channel = ${channel}
+        `)).rows[0];
+		return {
+			messages,
+			latestSeq: cursorRow ? Number(cursorRow.last_seq) : 0
+		};
+	}
+	/**
+	* Enforce a channel's retention bounds.
+	*
+	* Throttled per channel, so a burst of operations prunes once rather than
+	* once per message — the cost then tracks elapsed time instead of write
+	* volume, which is what makes retention affordable on a hot channel.
+	*/
+	async prune(channel, retention) {
+		const now = Date.now();
+		if (now - (this.lastPruned.get(channel) ?? 0) < PRUNE_THROTTLE_MS) return 0;
+		this.lastPruned.set(channel, now);
+		let deleted = 0;
+		if (retention.ttlMs !== void 0) {
+			const result = await this.db.execute(sql`
+                DELETE FROM rebase.channel_messages
+                WHERE channel = ${channel}
+                  AND created_at < NOW() - MAKE_INTERVAL(secs => ${retention.ttlMs / 1e3})
+            `);
+			deleted += result.rowCount ?? 0;
+		}
+		if (retention.limit !== void 0 && retention.limit > 0) {
+			const result = await this.db.execute(sql`
+                DELETE FROM rebase.channel_messages
+                WHERE channel = ${channel}
+                  AND seq <= (
+                      SELECT seq FROM rebase.channel_messages
+                      WHERE channel = ${channel}
+                      ORDER BY seq DESC
+                      OFFSET ${Math.floor(retention.limit)} LIMIT 1
+                  )
+            `);
+			deleted += result.rowCount ?? 0;
+		}
+		return deleted;
+	}
+	/** Forget throttle and match caches. Called on shutdown. */
+	clear() {
+		this.resolved.clear();
+		this.lastPruned.clear();
+	}
+};
+//#endregion
 //#region src/services/realtimeService.ts
 /** Channel name used for Postgres LISTEN/NOTIFY cross-instance realtime. */
 var PG_NOTIFY_CHANNEL = "rebase_entity_changes";
@@ -10203,6 +10597,26 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	clients = /* @__PURE__ */ new Map();
 	channels = /* @__PURE__ */ new Map();
 	presence = /* @__PURE__ */ new Map();
+	/**
+	* Ordered, replayable history for channels that opt into it.
+	*
+	* Undefined until {@link configureChannelHistory} is called, and inert even
+	* then unless retention rules were supplied — so presence and ephemeral
+	* notification channels never touch it. See `channel-history.ts`.
+	*/
+	channelHistory;
+	/**
+	* One promise chain per retained channel, so that assigning a sequence
+	* number and fanning the message out happen in the same order for every
+	* message on that channel.
+	*
+	* Without it, two concurrent broadcasts can be numbered 4 and 5 by the
+	* database and still reach subscribers as 5 then 4 — live order and replay
+	* order would disagree, which is exactly the divergence sequence numbers
+	* are supposed to rule out. Keyed by channel, so unrelated channels never
+	* wait on each other.
+	*/
+	channelSendQueues = /* @__PURE__ */ new Map();
 	presenceInterval;
 	static PRESENCE_TIMEOUT_MS = 3e4;
 	dataService;
@@ -10379,6 +10793,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			case "broadcast":
 				this.broadcastToChannel(clientId, payload?.channel, payload?.event, payload?.payload);
 				break;
+			case "channel_history":
+				await this.handleChannelHistoryRequest(clientId, payload?.channel, payload?.sinceSeq, payload?.limit);
+				break;
 			case "presence_track":
 				this.joinChannel(clientId, payload?.channel);
 				this.trackPresence(clientId, payload?.channel, payload?.state ?? {});
@@ -10589,12 +11006,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (this.driver) {
 			const collection = this.registry.getCollectionByPath(notifyPath);
 			const activeAuth = authContext || {
-				userId: "anon",
+				uid: "anon",
 				roles: ["anon"]
 			};
 			return await this.db.transaction(async (tx) => {
 				await applyAuthContext(tx, {
-					userId: activeAuth.userId,
+					uid: activeAuth.uid,
 					roles: activeAuth.roles
 				}, this.rlsUserRole);
 				const txEntityService = new DataService(tx, this.registry);
@@ -10626,7 +11043,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
 					const contextForCallback = {
 						user: {
-							uid: activeAuth.userId,
+							uid: activeAuth.uid,
 							roles: activeAuth.roles
 						},
 						driver: this.driver,
@@ -10718,12 +11135,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (this.driver) {
 			const collection = this.registry.getCollectionByPath(notifyPath);
 			const activeAuth = authContext || {
-				userId: "anon",
+				uid: "anon",
 				roles: ["anon"]
 			};
 			return await this.db.transaction(async (tx) => {
 				await applyAuthContext(tx, {
-					userId: activeAuth.userId,
+					uid: activeAuth.uid,
 					roles: activeAuth.roles
 				}, this.rlsUserRole);
 				let processedEntity = await new DataService(tx, this.registry).fetchOne(notifyPath, id, collection?.databaseId);
@@ -10739,7 +11156,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
 						const contextForCallback = {
 							user: {
-								uid: activeAuth.userId,
+								uid: activeAuth.uid,
 								roles: activeAuth.roles
 							},
 							driver: this.driver,
@@ -10865,15 +11282,67 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		this.removePresence(clientId, channel);
 	}
-	/** Broadcast a message to all clients in a channel except sender */
+	/**
+	* Broadcast a message to all clients in a channel except the sender.
+	*
+	* On a channel with no retention rule this is what it always was: a
+	* synchronous fan-out to whoever is connected, with no sequence number, no
+	* SQL and no await — the body below runs to completion before returning.
+	*
+	* On a retained channel the message is durably numbered first and only then
+	* delivered, through a per-channel queue so that delivery order matches
+	* sequence order. That ordering is the whole point: a client that catches up
+	* with `sinceSeq` has to arrive at the same state as one that never
+	* disconnected.
+	*/
 	broadcastToChannel(clientId, channel, event, payload) {
+		const retention = this.channelHistory?.retentionFor(channel);
+		if (!retention) {
+			this.fanOutBroadcast(clientId, channel, event, payload);
+			return;
+		}
+		const next = (this.channelSendQueues.get(channel) ?? Promise.resolve()).catch(() => {}).then(() => this.persistAndFanOut(clientId, channel, event, payload, retention));
+		this.channelSendQueues.set(channel, next);
+		next.finally(() => {
+			if (this.channelSendQueues.get(channel) === next) this.channelSendQueues.delete(channel);
+		});
+	}
+	/**
+	* Number a broadcast, store it, then deliver it.
+	*
+	* A message that cannot be stored is **not** delivered. Delivering it would
+	* put it in front of live subscribers while leaving it absent from every
+	* future replay — the two views of the channel would disagree permanently,
+	* and no later message could repair the gap. Failing loudly to the sender
+	* instead lets it retry, which for an operation stream is the only outcome
+	* that keeps clients convergent.
+	*/
+	async persistAndFanOut(clientId, channel, event, payload, retention) {
+		let seq;
+		try {
+			({seq} = await this.channelHistory.append(channel, event, payload, clientId));
+		} catch (error) {
+			logger.error(`❌ [ChannelHistory] Could not persist broadcast on "${channel}" — message dropped`, { error });
+			this.sendError(clientId, `Could not persist broadcast on retained channel "${channel}"`, void 0, "CHANNEL_HISTORY_WRITE_FAILED");
+			return;
+		}
+		this.fanOutBroadcast(clientId, channel, event, payload, seq);
+		try {
+			await this.channelHistory.prune(channel, retention);
+		} catch (error) {
+			logger.warn(`⚠️ [ChannelHistory] Prune failed for "${channel}"`, { error });
+		}
+	}
+	/** Deliver a broadcast frame to every member of a channel but the sender. */
+	fanOutBroadcast(clientId, channel, event, payload, seq) {
 		const members = this.channels.get(channel);
 		if (!members) return;
 		const message = JSON.stringify({
 			type: "broadcast",
 			channel,
 			event,
-			payload
+			payload,
+			...seq !== void 0 ? { seq } : {}
 		});
 		for (const memberId of members) {
 			if (memberId === clientId) continue;
@@ -10881,6 +11350,55 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			if (ws && ws.readyState === WebSocket.OPEN) ws.send(message);
 		}
 	}
+	/**
+	* Install retention rules and create the tables they need.
+	*
+	* Safe to call with no rules (and safe not to call at all): the store stays
+	* inert, no schema is created, and broadcast keeps its original
+	* fire-and-forget path.
+	*/
+	async configureChannelHistory(rules) {
+		this.channelHistory = new ChannelHistoryStore(this.db, rules ?? []);
+		if (!this.channelHistory.enabled) return;
+		await this.channelHistory.ensureTables();
+	}
+	/** Whether any channel is configured to retain messages. */
+	isChannelHistoryEnabled() {
+		return this.channelHistory?.enabled ?? false;
+	}
+	/**
+	* Answer a client's catch-up request.
+	*
+	* A channel with no retention rule is answered with `retained: false`
+	* rather than an empty list, so the client can tell "you missed nothing"
+	* apart from "this channel never keeps anything" — the second means its
+	* reconnect strategy has to be a full resync, and silence would leave it
+	* guessing.
+	*/
+	async handleChannelHistoryRequest(clientId, channel, sinceSeq, limit) {
+		if (!channel) return;
+		if (!this.channelHistory?.retentionFor(channel)) {
+			this.sendChannelHistory(clientId, channel, [], false);
+			return;
+		}
+		try {
+			const { messages, latestSeq } = await this.channelHistory.replay(channel, sinceSeq, limit);
+			this.sendChannelHistory(clientId, channel, messages, true, latestSeq);
+		} catch (error) {
+			logger.error(`❌ [ChannelHistory] Replay failed for "${channel}"`, { error });
+			this.sendError(clientId, `Could not replay history for channel "${channel}"`, void 0, "CHANNEL_HISTORY_READ_FAILED");
+		}
+	}
+	sendChannelHistory(clientId, channel, messages, retained, latestSeq) {
+		const ws = this.clients.get(clientId);
+		if (ws && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({
+			type: "channel_history",
+			channel,
+			messages,
+			retained,
+			...latestSeq !== void 0 ? { latestSeq } : {}
+		}));
+	}
 	/** Track presence in a channel */
 	trackPresence(clientId, channel, state) {
 		if (!this.presence.has(channel)) this.presence.set(channel, /* @__PURE__ */ new Map());
@@ -10961,6 +11479,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		this.subscriptionCallbacks.clear();
 		this.channels.clear();
 		this.presence.clear();
+		await Promise.allSettled([...this.channelSendQueues.values()]);
+		this.channelSendQueues.clear();
+		this.channelHistory?.clear();
 		if (this.presenceInterval) {
 			clearInterval(this.presenceInterval);
 			this.presenceInterval = void 0;
@@ -11302,20 +11823,20 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					if (authAdapter) try {
 						const adapterUser = authAdapter.verifyToken ? await authAdapter.verifyToken(token) : await authAdapter.verifyRequest(new Request("http://localhost/_ws_auth", { headers: { Authorization: `Bearer ${token}` } }));
 						if (adapterUser) verifiedUser = {
-							userId: adapterUser.uid,
+							uid: adapterUser.uid,
 							roles: adapterUser.roles,
 							isAdmin: adapterUser.isAdmin
 						};
 					} catch {}
 					else if (authConfig?.serviceKey && safeCompare(token, authConfig.serviceKey)) verifiedUser = {
-						userId: "service",
+						uid: "service",
 						roles: ["admin"],
 						isAdmin: true
 					};
 					else {
 						const jwtPayload = extractUserFromToken(token);
 						if (jwtPayload) verifiedUser = {
-							userId: jwtPayload.userId,
+							uid: jwtPayload.uid,
 							roles: jwtPayload.roles ?? [],
 							isAdmin: (jwtPayload.roles ?? []).some((r) => r === "admin")
 						};
@@ -11331,11 +11852,11 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 							type: "AUTH_SUCCESS",
 							requestId,
 							payload: {
-								userId: verifiedUser.userId,
+								uid: verifiedUser.uid,
 								roles: verifiedUser.roles
 							}
 						}));
-						wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.userId}`);
+						wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.uid}`);
 					} else {
 						wsDebug(`[WS] replying AUTH_ERROR for requestId ${requestId} (invalid token)`);
 						sendError("AUTH_ERROR", "INVALID_TOKEN", "Invalid or expired token");
@@ -11373,7 +11894,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					const session = clientSessions.get(clientId);
 					if (typeof driver.withAuth === "function") try {
 						const userForAuth = session?.user ? {
-							uid: session.user.userId,
+							uid: session.user.uid,
 							displayName: null,
 							email: null,
 							photoURL: null,
@@ -11507,7 +12028,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 									sql: typeof sql === "string" ? sql.substring(0, 500) : sql,
 									options,
 									resultRows: Array.isArray(result) ? result.length : "unknown",
-									userId: auditSession?.user?.userId ?? "unknown",
+									uid: auditSession?.user?.uid ?? "unknown",
 									roles: auditSession?.user?.roles ?? [],
 									isAdmin: auditSession?.user?.isAdmin ?? false
 								}));
@@ -11552,6 +12073,21 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 							ws.send(JSON.stringify(response));
 						}
 						break;
+					case "FETCH_APPLICATION_ROLES":
+						{
+							wsDebug("👤 [WebSocket Server] Processing FETCH_APPLICATION_ROLES request");
+							const admin = (await getScopedDelegate()).admin;
+							let roles = [];
+							if (isSQLAdmin(admin) && admin.fetchApplicationRoles) roles = await admin.fetchApplicationRoles();
+							wsDebug(`👤 [WebSocket Server] Fetched ${roles.length} application roles.`);
+							const response = {
+								type: "FETCH_APPLICATION_ROLES_SUCCESS",
+								payload: { roles },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
 					case "FETCH_CURRENT_DATABASE":
 						{
 							wsDebug("📚 [WebSocket Server] Processing FETCH_CURRENT_DATABASE request");
@@ -11658,14 +12194,15 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					case "broadcast":
 					case "presence_track":
 					case "presence_untrack":
-					case "presence_state": {
+					case "presence_state":
+					case "channel_history": {
 						wsDebug("🔄 [WebSocket Server] Routing realtime message to RealtimeService:", type);
 						const session = clientSessions.get(clientId);
 						const authContext = session?.user ? {
-							userId: session.user.userId,
+							uid: session.user.uid,
 							roles: session.user.roles ?? []
 						} : {
-							userId: "anon",
+							uid: "anon",
 							roles: ["anon"]
 						};
 						await realtimeService.handleClientMessage(clientId, {
@@ -20621,9 +21158,65 @@ async function ensureAuthTablesExist(db, collection) {
             )
         `);
 		await db.execute(sql`
+            CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
+            BEGIN
+                IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
+                    NEW.uid := NEW.user_id;
+                ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
+                    NEW.user_id := NEW.uid;
+                END IF;
+                RETURN NEW;
+            END $$ LANGUAGE plpgsql
+        `);
+		for (const authTable of [
+			"user_identities",
+			"refresh_tokens",
+			"password_reset_tokens",
+			"magic_link_tokens",
+			"mfa_factors",
+			"recovery_codes"
+		]) {
+			const qualified = `"${authSchema}"."${authTable}"`;
+			await db.execute(sql`
+                DO $$
+                DECLARE
+                    has_legacy boolean;
+                    has_uid    boolean;
+                BEGIN
+                    SELECT
+                        bool_or(column_name = 'user_id'),
+                        bool_or(column_name = 'uid')
+                    INTO has_legacy, has_uid
+                    FROM information_schema.columns
+                    WHERE table_schema = ${sql.raw(`'${authSchema}'`)}
+                      AND table_name = ${sql.raw(`'${authTable}'`)};
+
+                    -- Table absent, or already uid-only (a fresh install, or
+                    -- phase 2 already run): nothing to do.
+                    IF has_legacy IS NOT TRUE THEN
+                        RETURN;
+                    END IF;
+
+                    IF has_uid IS NOT TRUE THEN
+                        EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ADD COLUMN uid ${userIdType} REFERENCES ${usersTableName}(id) ON DELETE CASCADE'`)};
+                        EXECUTE ${sql.raw(`'UPDATE ${qualified} SET uid = user_id WHERE uid IS NULL'`)};
+                        EXECUTE ${sql.raw(`'CREATE INDEX IF NOT EXISTS idx_${authTable}_uid ON ${qualified}(uid)'`)};
+                    END IF;
+
+                    -- New code inserts uid and never user_id, so the legacy
+                    -- column can no longer be NOT NULL. The trigger below
+                    -- backfills it, but the constraint is checked first.
+                    EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ALTER COLUMN user_id DROP NOT NULL'`)};
+
+                    EXECUTE ${sql.raw(`'DROP TRIGGER IF EXISTS sync_uid_user_id ON ${qualified}'`)};
+                    EXECUTE ${sql.raw(`'CREATE TRIGGER sync_uid_user_id BEFORE INSERT OR UPDATE ON ${qualified} FOR EACH ROW EXECUTE FUNCTION "${authSchema}".sync_uid_user_id()'`)};
+                END $$
+            `);
+		}
+		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(userIdentitiesTable)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 provider TEXT NOT NULL,
                 provider_id TEXT NOT NULL,
                 profile_data JSONB,
@@ -20634,18 +21227,18 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_user_identities_user 
-            ON ${sql.raw(userIdentitiesTable)}(user_id)
+            ON ${sql.raw(userIdentitiesTable)}(uid)
         `);
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 user_agent TEXT,
                 ip_address TEXT,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-                CONSTRAINT unique_device_session UNIQUE (user_id, user_agent, ip_address)
+                CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
             )
         `);
 		await db.execute(sql`
@@ -20654,12 +21247,12 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user 
-            ON ${sql.raw(refreshTokensTableName)}(user_id)
+            ON ${sql.raw(refreshTokensTableName)}(uid)
         `);
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(passwordResetTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
@@ -20672,13 +21265,13 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user 
-            ON ${sql.raw(passwordResetTokensTableName)}(user_id)
+            ON ${sql.raw(passwordResetTokensTableName)}(uid)
         `);
 		const magicLinkTokensTableName = `"${authSchema}"."magic_link_tokens"`;
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(magicLinkTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
@@ -20691,7 +21284,7 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_magic_link_tokens_user 
-            ON ${sql.raw(magicLinkTokensTableName)}(user_id)
+            ON ${sql.raw(magicLinkTokensTableName)}(uid)
         `);
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(appConfigTableName)} (
@@ -20705,7 +21298,10 @@ async function ensureAuthTablesExist(db, collection) {
 			await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
 			await tx.execute(sql`
                 CREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$
-                    SELECT NULLIF(current_setting('app.user_id', true), '');
+                    SELECT COALESCE(
+                        NULLIF(current_setting('app.uid', true), ''),
+                        NULLIF(current_setting('app.user_id', true), '')
+                    );
                 $$ LANGUAGE sql STABLE
             `);
 			await tx.execute(sql`
@@ -20722,14 +21318,22 @@ async function ensureAuthTablesExist(db, collection) {
                 $$ LANGUAGE sql STABLE
             `);
 		});
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
-        `);
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
-        `);
+		for (const columnDef of [
+			"display_name VARCHAR(255)",
+			"photo_url VARCHAR(500)",
+			"roles TEXT[] DEFAULT '{}' NOT NULL",
+			"password_hash VARCHAR(255)",
+			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
+			"email_verification_token VARCHAR(255)",
+			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
+			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
+			"metadata JSONB DEFAULT '{}' NOT NULL",
+			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
+			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
+		]) await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+            `);
 		try {
 			if ((await db.execute(sql`
                 SELECT EXISTS (
@@ -20760,7 +21364,7 @@ async function ensureAuthTablesExist(db, collection) {
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(mfaFactorsTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 factor_type TEXT NOT NULL DEFAULT 'totp',
                 secret_encrypted TEXT NOT NULL,
                 friendly_name TEXT,
@@ -20771,7 +21375,7 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_mfa_factors_user
-            ON ${sql.raw(mfaFactorsTableName)}(user_id)
+            ON ${sql.raw(mfaFactorsTableName)}(uid)
         `);
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(mfaChallengesTableName)} (
@@ -20790,7 +21394,7 @@ async function ensureAuthTablesExist(db, collection) {
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(recoveryCodesTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 code_hash TEXT NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
@@ -20798,8 +21402,36 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_recovery_codes_user
-            ON ${sql.raw(recoveryCodesTableName)}(user_id)
+            ON ${sql.raw(recoveryCodesTableName)}(uid)
         `);
+		try {
+			const authTablePairs = [
+				[usersSchema, resolvedTable],
+				[authSchema, "user_identities"],
+				[authSchema, "refresh_tokens"],
+				[authSchema, "password_reset_tokens"],
+				[authSchema, "app_config"],
+				[authSchema, "mfa_factors"],
+				[authSchema, "mfa_challenges"],
+				[authSchema, "recovery_codes"]
+			];
+			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
+                    SELECT 1
+                    FROM pg_class c
+                    JOIN pg_namespace n ON n.oid = c.relnamespace
+                    WHERE n.nspname = ${schemaName}
+                      AND c.relname = ${tableName}
+                      AND c.relforcerowsecurity
+                `)).rows.length > 0) {
+				await db.execute(sql`
+                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
+                        NO FORCE ROW LEVEL SECURITY
+                    `);
+				logger.warn(`🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" (legacy RLS model — it binds the owner connection and breaks privileged auth writes)`);
+			}
+		} catch (rlsReconcileError) {
+			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
+		}
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
 		logger.error("❌ Failed to create auth tables", { error });
@@ -20847,6 +21479,32 @@ var UserService = class {
 		const name = getTableName(this.usersTable);
 		return `"${getTableConfig(this.usersTable).schema || "public"}"."${name}"`;
 	}
+	/**
+	* Run a privileged auth write with an explicitly cleared RLS context.
+	*
+	* The auth services run on the base/owner connection, which by design
+	* carries a NULL `app.uid` so the `auth.uid() IS NULL` server-escape
+	* in the default policies applies. That NULL is normally guaranteed by
+	* `set_config(..., is_local = true)` resetting at transaction end — but a
+	* GUC that survives on a pooled connection (or a connection role that
+	* doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
+	* turns the trusted write into an RLS-scoped one and denies it with
+	* SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
+	* single chokepoint, makes the server context deterministic instead of
+	* trusting whatever state the pool hands us. `auth.uid()` reads '' as
+	* NULL via NULLIF, so '' is the server context.
+	*/
+	async withServerContext(fn) {
+		return await this.db.transaction(async (tx) => {
+			await tx.execute(sql`
+                SELECT set_config('app.uid', '', true),
+                       set_config('app.user_id', '', true),
+                       set_config('app.user_roles', '', true),
+                       set_config('app.jwt', '', true)
+            `);
+			return await fn(tx);
+		});
+	}
 	mapRowToUser(row) {
 		if (!row) return row;
 		const id = row.id ?? row.uid;
@@ -20944,7 +21602,7 @@ var UserService = class {
 	}
 	async createUser(data) {
 		const payload = this.mapPayload(data);
-		const [row] = await this.db.insert(this.usersTable).values(payload).returning();
+		const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
 		return this.mapRowToUser(row);
 	}
 	async getUserById(id) {
@@ -20962,19 +21620,19 @@ var UserService = class {
 	async getUserByIdentity(provider, providerId) {
 		const userIdCol = getColumn(this.usersTable, "id");
 		if (!userIdCol) return null;
-		const result = await this.db.select({ user: this.usersTable }).from(this.usersTable).innerJoin(this.userIdentitiesTable, eq(userIdCol, this.userIdentitiesTable.userId)).where(sql`${this.userIdentitiesTable.provider} = ${provider} AND ${this.userIdentitiesTable.providerId} = ${providerId}`).limit(1);
+		const result = await this.db.select({ user: this.usersTable }).from(this.usersTable).innerJoin(this.userIdentitiesTable, eq(userIdCol, this.userIdentitiesTable.uid)).where(sql`${this.userIdentitiesTable.provider} = ${provider} AND ${this.userIdentitiesTable.providerId} = ${providerId}`).limit(1);
 		if (result.length === 0) return null;
 		return this.mapRowToUser(result[0].user);
 	}
-	async getUserIdentities(userId) {
+	async getUserIdentities(uid) {
 		const schema = getTableConfig(this.userIdentitiesTable).schema || "public";
 		return (await this.db.execute(sql`
-            SELECT id, user_id, provider, provider_id, profile_data, created_at, updated_at
+            SELECT id, uid, provider, provider_id, profile_data, created_at, updated_at
             FROM ${sql.raw(`"${schema}"."user_identities"`)}
-            WHERE user_id = ${userId}
+            WHERE uid = ${uid}
         `)).rows.map((row) => ({
 			id: row.id,
-			userId: row.user_id,
+			uid: row.uid,
 			provider: row.provider,
 			providerId: row.provider_id,
 			profileData: row.profile_data ?? null,
@@ -20982,13 +21640,13 @@ var UserService = class {
 			updatedAt: row.updated_at
 		}));
 	}
-	async linkUserIdentity(userId, provider, providerId, profileData) {
-		await this.db.insert(this.userIdentitiesTable).values({
-			userId,
+	async linkUserIdentity(uid, provider, providerId, profileData) {
+		await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
+			uid,
 			provider,
 			providerId,
 			profileData: profileData || null
-		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] });
+		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] }));
 	}
 	async updateUser(id, data) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -20996,13 +21654,13 @@ var UserService = class {
 		const payload = this.mapPayload(data);
 		const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 		payload[updatedAtKey] = /* @__PURE__ */ new Date();
-		const [row] = await this.db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning();
+		const [row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
 		return row ? this.mapRowToUser(row) : null;
 	}
 	async deleteUser(id) {
 		const idCol = getColumn(this.usersTable, "id");
 		if (!idCol) return;
-		await this.db.delete(this.usersTable).where(eq(idCol, id));
+		await this.withServerContext(async (db) => db.delete(this.usersTable).where(eq(idCol, id)));
 	}
 	async listUsers() {
 		return (await this.db.select().from(this.usersTable)).map((row) => this.mapRowToUser(row));
@@ -21056,10 +21714,10 @@ var UserService = class {
 		if (!idCol) return;
 		const passwordHashColKey = getColumnKey(this.usersTable, "passwordHash", "password_hash") || "passwordHash";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[passwordHashColKey]: passwordHash,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification status
@@ -21070,11 +21728,11 @@ var UserService = class {
 		const emailVerifiedColKey = getColumnKey(this.usersTable, "emailVerified", "email_verified") || "emailVerified";
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerifiedColKey]: verified,
 			[emailVerificationTokenColKey]: null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification token
@@ -21085,11 +21743,11 @@ var UserService = class {
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const emailVerificationSentAtColKey = getColumnKey(this.usersTable, "emailVerificationSentAt", "email_verification_sent_at") || "emailVerificationSentAt";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerificationTokenColKey]: token,
 			[emailVerificationSentAtColKey]: token ? /* @__PURE__ */ new Date() : null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Find user by email verification token
@@ -21103,10 +21761,10 @@ var UserService = class {
 	/**
 	* Get roles for a user from database (inline TEXT[] column)
 	*/
-	async getUserRoles(userId) {
+	async getUserRoles(uid) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const result = await this.db.execute(sql`
-            SELECT roles FROM ${sql.raw(usersTableName)} WHERE id = ${userId}
+            SELECT roles FROM ${sql.raw(usersTableName)} WHERE id = ${uid}
         `);
 		if (result.rows.length === 0) return [];
 		return (result.rows[0].roles ?? []).map((id) => ({
@@ -21120,10 +21778,10 @@ var UserService = class {
 	/**
 	* Get role IDs for a user
 	*/
-	async getUserRoleIds(userId) {
+	async getUserRoleIds(uid) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const result = await this.db.execute(sql`
-            SELECT roles FROM ${sql.raw(usersTableName)} WHERE id = ${userId}
+            SELECT roles FROM ${sql.raw(usersTableName)} WHERE id = ${uid}
         `);
 		if (result.rows.length === 0) return [];
 		return result.rows[0].roles ?? [];
@@ -21131,35 +21789,35 @@ var UserService = class {
 	/**
 	* Set roles for a user (replaces existing roles)
 	*/
-	async setUserRoles(userId, roleIds) {
+	async setUserRoles(uid, roleIds) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const rolesArray = `{${roleIds.join(",")}}`;
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = ${rolesArray}::text[], updated_at = NOW()
-            WHERE id = ${userId}
-        `);
+            WHERE id = ${uid}
+        `));
 	}
 	/**
 	* Assign a specific role to new user (appends if not present)
 	*/
-	async assignDefaultRole(userId, roleId) {
+	async assignDefaultRole(uid, roleId) {
 		const usersTableName = this.getQualifiedUsersTableName();
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = array_append(roles, ${roleId}), updated_at = NOW()
-            WHERE id = ${userId} AND NOT (${roleId} = ANY(roles))
-        `);
+            WHERE id = ${uid} AND NOT (${roleId} = ANY(roles))
+        `));
 	}
 	/**
 	* Get user with their roles
 	*/
-	async getUserWithRoles(userId) {
-		const user = await this.getUserById(userId);
+	async getUserWithRoles(uid) {
+		const user = await this.getUserById(uid);
 		if (!user) return null;
 		return {
 			user,
-			roles: await this.getUserRoles(userId)
+			roles: await this.getUserRoles(uid)
 		};
 	}
 };
@@ -21171,18 +21829,18 @@ var RefreshTokenService = class {
 		if (tableOrTables && (tableOrTables.refreshTokens || tableOrTables.users)) this.refreshTokensTable = tableOrTables.refreshTokens || refreshTokens;
 		else this.refreshTokensTable = tableOrTables || refreshTokens;
 	}
-	async createToken(userId, tokenHash, expiresAt, userAgent, ipAddress) {
+	async createToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
 		const safeUserAgent = userAgent || "";
 		const safeIpAddress = ipAddress || "";
 		await this.db.insert(this.refreshTokensTable).values({
-			userId,
+			uid,
 			tokenHash,
 			expiresAt,
 			userAgent: safeUserAgent,
 			ipAddress: safeIpAddress
 		}).onConflictDoUpdate({
 			target: [
-				this.refreshTokensTable.userId,
+				this.refreshTokensTable.uid,
 				this.refreshTokensTable.userAgent,
 				this.refreshTokensTable.ipAddress
 			],
@@ -21195,7 +21853,7 @@ var RefreshTokenService = class {
 	async findByHash(tokenHash) {
 		const [token] = await this.db.select({
 			id: this.refreshTokensTable.id,
-			userId: this.refreshTokensTable.userId,
+			uid: this.refreshTokensTable.uid,
 			tokenHash: this.refreshTokensTable.tokenHash,
 			expiresAt: this.refreshTokensTable.expiresAt,
 			createdAt: this.refreshTokensTable.createdAt,
@@ -21207,22 +21865,22 @@ var RefreshTokenService = class {
 	async deleteByHash(tokenHash) {
 		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 	}
-	async deleteAllForUser(userId) {
-		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.userId, userId));
+	async deleteAllForUser(uid) {
+		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid));
 	}
-	async listForUser(userId) {
+	async listForUser(uid) {
 		return await this.db.select({
 			id: this.refreshTokensTable.id,
-			userId: this.refreshTokensTable.userId,
+			uid: this.refreshTokensTable.uid,
 			tokenHash: this.refreshTokensTable.tokenHash,
 			expiresAt: this.refreshTokensTable.expiresAt,
 			createdAt: this.refreshTokensTable.createdAt,
 			userAgent: this.refreshTokensTable.userAgent,
 			ipAddress: this.refreshTokensTable.ipAddress
-		}).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.userId, userId)).orderBy(this.refreshTokensTable.createdAt);
+		}).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid)).orderBy(this.refreshTokensTable.createdAt);
 	}
-	async deleteById(id, userId) {
-		await this.db.delete(this.refreshTokensTable).where(sql`${this.refreshTokensTable.id} = ${id} AND ${this.refreshTokensTable.userId} = ${userId}`);
+	async deleteById(id, uid) {
+		await this.db.delete(this.refreshTokensTable).where(sql`${this.refreshTokensTable.id} = ${id} AND ${this.refreshTokensTable.uid} = ${uid}`);
 	}
 };
 /**
@@ -21243,14 +21901,14 @@ var PasswordResetTokenService = class {
 	/**
 	* Create a password reset token
 	*/
-	async createToken(userId, tokenHash, expiresAt) {
+	async createToken(uid, tokenHash, expiresAt) {
 		const tableName = this.getQualifiedPasswordResetTokensTableName();
 		await this.db.execute(sql`
             DELETE FROM ${sql.raw(tableName)} 
-            WHERE user_id = ${userId} AND used_at IS NULL
+            WHERE uid = ${uid} AND used_at IS NULL
         `);
 		await this.db.insert(this.passwordResetTokensTable).values({
-			userId,
+			uid,
 			tokenHash,
 			expiresAt
 		});
@@ -21260,13 +21918,13 @@ var PasswordResetTokenService = class {
 	*/
 	async findValidByHash(tokenHash) {
 		const [token] = await this.db.select({
-			userId: this.passwordResetTokensTable.userId,
+			uid: this.passwordResetTokensTable.uid,
 			expiresAt: this.passwordResetTokensTable.expiresAt
 		}).from(this.passwordResetTokensTable).where(eq(this.passwordResetTokensTable.tokenHash, tokenHash));
 		if (!token) return null;
 		const tableName = this.getQualifiedPasswordResetTokensTableName();
 		const result = await this.db.execute(sql`
-            SELECT user_id, expires_at 
+            SELECT uid, expires_at 
             FROM ${sql.raw(tableName)} 
             WHERE token_hash = ${tokenHash} 
               AND used_at IS NULL 
@@ -21275,7 +21933,7 @@ var PasswordResetTokenService = class {
 		if (result.rows.length === 0) return null;
 		const row = result.rows[0];
 		return {
-			userId: row.user_id,
+			uid: row.uid,
 			expiresAt: new Date(row.expires_at)
 		};
 	}
@@ -21288,8 +21946,8 @@ var PasswordResetTokenService = class {
 	/**
 	* Delete all tokens for a user
 	*/
-	async deleteAllForUser(userId) {
-		await this.db.delete(this.passwordResetTokensTable).where(eq(this.passwordResetTokensTable.userId, userId));
+	async deleteAllForUser(uid) {
+		await this.db.delete(this.passwordResetTokensTable).where(eq(this.passwordResetTokensTable.uid, uid));
 	}
 	/**
 	* Clean up expired tokens
@@ -21317,14 +21975,14 @@ var MagicLinkTokenService = class {
 		const name = getTableName(this.magicLinkTokensTable);
 		return `"${getTableConfig(this.magicLinkTokensTable).schema || "public"}"."${name}"`;
 	}
-	async createToken(userId, tokenHash, expiresAt) {
+	async createToken(uid, tokenHash, expiresAt) {
 		const tableName = this.getQualifiedTableName();
 		await this.db.execute(sql`
             DELETE FROM ${sql.raw(tableName)} 
-            WHERE user_id = ${userId} AND used_at IS NULL
+            WHERE uid = ${uid} AND used_at IS NULL
         `);
 		await this.db.insert(this.magicLinkTokensTable).values({
-			userId,
+			uid,
 			tokenHash,
 			expiresAt
 		});
@@ -21332,7 +21990,7 @@ var MagicLinkTokenService = class {
 	async findValidByHash(tokenHash) {
 		const tableName = this.getQualifiedTableName();
 		const result = await this.db.execute(sql`
-            SELECT user_id, expires_at 
+            SELECT uid, expires_at 
             FROM ${sql.raw(tableName)} 
             WHERE token_hash = ${tokenHash} 
               AND used_at IS NULL 
@@ -21341,7 +21999,7 @@ var MagicLinkTokenService = class {
 		if (result.rows.length === 0) return null;
 		const row = result.rows[0];
 		return {
-			userId: row.user_id,
+			uid: row.uid,
 			expiresAt: new Date(row.expires_at)
 		};
 	}
@@ -21364,8 +22022,8 @@ var PostgresTokenRepository = class {
 		this.passwordResetTokenService = new PasswordResetTokenService(db, tableOrTables);
 		this.magicLinkTokenService = new MagicLinkTokenService(db, tableOrTables);
 	}
-	async createRefreshToken(userId, tokenHash, expiresAt, userAgent, ipAddress) {
-		await this.refreshTokenService.createToken(userId, tokenHash, expiresAt, userAgent, ipAddress);
+	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
+		await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
 	}
 	async findRefreshTokenByHash(tokenHash) {
 		return this.refreshTokenService.findByHash(tokenHash);
@@ -21373,17 +22031,17 @@ var PostgresTokenRepository = class {
 	async deleteRefreshToken(tokenHash) {
 		await this.refreshTokenService.deleteByHash(tokenHash);
 	}
-	async deleteAllRefreshTokensForUser(userId) {
-		await this.refreshTokenService.deleteAllForUser(userId);
+	async deleteAllRefreshTokensForUser(uid) {
+		await this.refreshTokenService.deleteAllForUser(uid);
 	}
-	async listRefreshTokensForUser(userId) {
-		return this.refreshTokenService.listForUser(userId);
+	async listRefreshTokensForUser(uid) {
+		return this.refreshTokenService.listForUser(uid);
 	}
-	async deleteRefreshTokenById(id, userId) {
-		await this.refreshTokenService.deleteById(id, userId);
+	async deleteRefreshTokenById(id, uid) {
+		await this.refreshTokenService.deleteById(id, uid);
 	}
-	async createPasswordResetToken(userId, tokenHash, expiresAt) {
-		await this.passwordResetTokenService.createToken(userId, tokenHash, expiresAt);
+	async createPasswordResetToken(uid, tokenHash, expiresAt) {
+		await this.passwordResetTokenService.createToken(uid, tokenHash, expiresAt);
 	}
 	async findValidPasswordResetToken(tokenHash) {
 		return this.passwordResetTokenService.findValidByHash(tokenHash);
@@ -21391,14 +22049,14 @@ var PostgresTokenRepository = class {
 	async markPasswordResetTokenUsed(tokenHash) {
 		await this.passwordResetTokenService.markAsUsed(tokenHash);
 	}
-	async deleteAllPasswordResetTokensForUser(userId) {
-		await this.passwordResetTokenService.deleteAllForUser(userId);
+	async deleteAllPasswordResetTokensForUser(uid) {
+		await this.passwordResetTokenService.deleteAllForUser(uid);
 	}
 	async deleteExpiredTokens() {
 		await this.passwordResetTokenService.deleteExpired();
 	}
-	async createMagicLinkToken(userId, tokenHash, expiresAt) {
-		await this.magicLinkTokenService.createToken(userId, tokenHash, expiresAt);
+	async createMagicLinkToken(uid, tokenHash, expiresAt) {
+		await this.magicLinkTokenService.createToken(uid, tokenHash, expiresAt);
 	}
 	async findValidMagicLinkToken(tokenHash) {
 		return this.magicLinkTokenService.findValidByHash(tokenHash);
@@ -21433,11 +22091,11 @@ var PostgresAuthRepository = class {
 	async getUserByIdentity(provider, providerId) {
 		return this.userService.getUserByIdentity(provider, providerId);
 	}
-	async getUserIdentities(userId) {
-		return this.userService.getUserIdentities(userId);
+	async getUserIdentities(uid) {
+		return this.userService.getUserIdentities(uid);
 	}
-	async linkUserIdentity(userId, provider, providerId, profileData) {
-		return this.userService.linkUserIdentity(userId, provider, providerId, profileData);
+	async linkUserIdentity(uid, provider, providerId, profileData) {
+		return this.userService.linkUserIdentity(uid, provider, providerId, profileData);
 	}
 	async updateUser(id, data) {
 		return this.userService.updateUser(id, data);
@@ -21463,20 +22121,20 @@ var PostgresAuthRepository = class {
 	async getUserByVerificationToken(token) {
 		return this.userService.getUserByVerificationToken(token);
 	}
-	async getUserRoles(userId) {
-		return this.userService.getUserRoles(userId);
+	async getUserRoles(uid) {
+		return this.userService.getUserRoles(uid);
 	}
-	async getUserRoleIds(userId) {
-		return this.userService.getUserRoleIds(userId);
+	async getUserRoleIds(uid) {
+		return this.userService.getUserRoleIds(uid);
 	}
-	async setUserRoles(userId, roleIds) {
-		await this.userService.setUserRoles(userId, roleIds);
+	async setUserRoles(uid, roleIds) {
+		await this.userService.setUserRoles(uid, roleIds);
 	}
-	async assignDefaultRole(userId, roleId) {
-		await this.userService.assignDefaultRole(userId, roleId);
+	async assignDefaultRole(uid, roleId) {
+		await this.userService.assignDefaultRole(uid, roleId);
 	}
-	async getUserWithRoles(userId) {
-		return this.userService.getUserWithRoles(userId);
+	async getUserWithRoles(uid) {
+		return this.userService.getUserWithRoles(uid);
 	}
 	async getRoleById(id) {
 		return {
@@ -21531,8 +22189,8 @@ var PostgresAuthRepository = class {
 		};
 	}
 	async deleteRole(_id) {}
-	async createRefreshToken(userId, tokenHash, expiresAt, userAgent, ipAddress) {
-		await this.tokenRepository.createRefreshToken(userId, tokenHash, expiresAt, userAgent, ipAddress);
+	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
+		await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
 	}
 	async findRefreshTokenByHash(tokenHash) {
 		return this.tokenRepository.findRefreshTokenByHash(tokenHash);
@@ -21540,17 +22198,17 @@ var PostgresAuthRepository = class {
 	async deleteRefreshToken(tokenHash) {
 		await this.tokenRepository.deleteRefreshToken(tokenHash);
 	}
-	async deleteAllRefreshTokensForUser(userId) {
-		await this.tokenRepository.deleteAllRefreshTokensForUser(userId);
+	async deleteAllRefreshTokensForUser(uid) {
+		await this.tokenRepository.deleteAllRefreshTokensForUser(uid);
 	}
-	async listRefreshTokensForUser(userId) {
-		return this.tokenRepository.listRefreshTokensForUser(userId);
+	async listRefreshTokensForUser(uid) {
+		return this.tokenRepository.listRefreshTokensForUser(uid);
 	}
-	async deleteRefreshTokenById(id, userId) {
-		await this.tokenRepository.deleteRefreshTokenById(id, userId);
+	async deleteRefreshTokenById(id, uid) {
+		await this.tokenRepository.deleteRefreshTokenById(id, uid);
 	}
-	async createPasswordResetToken(userId, tokenHash, expiresAt) {
-		await this.tokenRepository.createPasswordResetToken(userId, tokenHash, expiresAt);
+	async createPasswordResetToken(uid, tokenHash, expiresAt) {
+		await this.tokenRepository.createPasswordResetToken(uid, tokenHash, expiresAt);
 	}
 	async findValidPasswordResetToken(tokenHash) {
 		return this.tokenRepository.findValidPasswordResetToken(tokenHash);
@@ -21558,14 +22216,14 @@ var PostgresAuthRepository = class {
 	async markPasswordResetTokenUsed(tokenHash) {
 		await this.tokenRepository.markPasswordResetTokenUsed(tokenHash);
 	}
-	async deleteAllPasswordResetTokensForUser(userId) {
-		await this.tokenRepository.deleteAllPasswordResetTokensForUser(userId);
+	async deleteAllPasswordResetTokensForUser(uid) {
+		await this.tokenRepository.deleteAllPasswordResetTokensForUser(uid);
 	}
 	async deleteExpiredTokens() {
 		await this.tokenRepository.deleteExpiredTokens();
 	}
-	async createMagicLinkToken(userId, tokenHash, expiresAt) {
-		await this.tokenRepository.createMagicLinkToken(userId, tokenHash, expiresAt);
+	async createMagicLinkToken(uid, tokenHash, expiresAt) {
+		await this.tokenRepository.createMagicLinkToken(uid, tokenHash, expiresAt);
 	}
 	async findValidMagicLinkToken(tokenHash) {
 		return this.tokenRepository.findValidMagicLinkToken(tokenHash);
@@ -21578,11 +22236,11 @@ var PostgresAuthRepository = class {
 		if (!this._mfaService) this._mfaService = new MfaService(this.db);
 		return this._mfaService;
 	}
-	async createMfaFactor(userId, factorType, secretEncrypted, friendlyName) {
-		return this.getMfaService().createMfaFactor(userId, factorType, secretEncrypted, friendlyName);
+	async createMfaFactor(uid, factorType, secretEncrypted, friendlyName) {
+		return this.getMfaService().createMfaFactor(uid, factorType, secretEncrypted, friendlyName);
 	}
-	async getMfaFactors(userId) {
-		return this.getMfaService().getMfaFactors(userId);
+	async getMfaFactors(uid) {
+		return this.getMfaService().getMfaFactors(uid);
 	}
 	async getMfaFactorById(factorId) {
 		return this.getMfaService().getMfaFactorById(factorId);
@@ -21590,8 +22248,8 @@ var PostgresAuthRepository = class {
 	async verifyMfaFactor(factorId) {
 		return this.getMfaService().verifyMfaFactor(factorId);
 	}
-	async deleteMfaFactor(factorId, userId) {
-		return this.getMfaService().deleteMfaFactor(factorId, userId);
+	async deleteMfaFactor(factorId, uid) {
+		return this.getMfaService().deleteMfaFactor(factorId, uid);
 	}
 	async createMfaChallenge(factorId, ipAddress) {
 		return this.getMfaService().createMfaChallenge(factorId, ipAddress);
@@ -21602,20 +22260,20 @@ var PostgresAuthRepository = class {
 	async verifyMfaChallenge(challengeId) {
 		return this.getMfaService().verifyMfaChallenge(challengeId);
 	}
-	async createRecoveryCodes(userId, codeHashes) {
-		return this.getMfaService().createRecoveryCodes(userId, codeHashes);
+	async createRecoveryCodes(uid, codeHashes) {
+		return this.getMfaService().createRecoveryCodes(uid, codeHashes);
 	}
-	async useRecoveryCode(userId, codeHash) {
-		return this.getMfaService().useRecoveryCode(userId, codeHash);
+	async useRecoveryCode(uid, codeHash) {
+		return this.getMfaService().useRecoveryCode(uid, codeHash);
 	}
-	async getUnusedRecoveryCodeCount(userId) {
-		return this.getMfaService().getUnusedRecoveryCodeCount(userId);
+	async getUnusedRecoveryCodeCount(uid) {
+		return this.getMfaService().getUnusedRecoveryCodeCount(uid);
 	}
-	async deleteAllRecoveryCodes(userId) {
-		return this.getMfaService().deleteAllRecoveryCodes(userId);
+	async deleteAllRecoveryCodes(uid) {
+		return this.getMfaService().deleteAllRecoveryCodes(uid);
 	}
-	async hasVerifiedMfaFactors(userId) {
-		return this.getMfaService().hasVerifiedMfaFactors(userId);
+	async hasVerifiedMfaFactors(uid) {
+		return this.getMfaService().hasVerifiedMfaFactors(uid);
 	}
 };
 /**
@@ -21632,16 +22290,16 @@ var MfaService = class {
 	qualify(tableName) {
 		return `"${this.schemaName}"."${tableName}"`;
 	}
-	async createMfaFactor(userId, factorType, secretEncrypted, friendlyName) {
+	async createMfaFactor(uid, factorType, secretEncrypted, friendlyName) {
 		const tableName = this.qualify("mfa_factors");
 		const row = (await this.db.execute(sql`
-            INSERT INTO ${sql.raw(tableName)} (user_id, factor_type, secret_encrypted, friendly_name)
-            VALUES (${userId}, ${factorType}, ${secretEncrypted}, ${friendlyName ?? null})
-            RETURNING id, user_id, factor_type, friendly_name, verified, created_at, updated_at
+            INSERT INTO ${sql.raw(tableName)} (uid, factor_type, secret_encrypted, friendly_name)
+            VALUES (${uid}, ${factorType}, ${secretEncrypted}, ${friendlyName ?? null})
+            RETURNING id, uid, factor_type, friendly_name, verified, created_at, updated_at
         `)).rows[0];
 		return {
 			id: row.id,
-			userId: row.user_id,
+			uid: row.uid,
 			factorType: row.factor_type,
 			friendlyName: row.friendly_name ?? void 0,
 			verified: row.verified,
@@ -21649,16 +22307,16 @@ var MfaService = class {
 			updatedAt: new Date(row.updated_at)
 		};
 	}
-	async getMfaFactors(userId) {
+	async getMfaFactors(uid) {
 		const tableName = this.qualify("mfa_factors");
 		return (await this.db.execute(sql`
-            SELECT id, user_id, factor_type, friendly_name, verified, created_at, updated_at
+            SELECT id, uid, factor_type, friendly_name, verified, created_at, updated_at
             FROM ${sql.raw(tableName)}
-            WHERE user_id = ${userId}
+            WHERE uid = ${uid}
             ORDER BY created_at
         `)).rows.map((row) => ({
 			id: row.id,
-			userId: row.user_id,
+			uid: row.uid,
 			factorType: row.factor_type,
 			friendlyName: row.friendly_name ?? void 0,
 			verified: row.verified,
@@ -21669,7 +22327,7 @@ var MfaService = class {
 	async getMfaFactorById(factorId) {
 		const tableName = this.qualify("mfa_factors");
 		const result = await this.db.execute(sql`
-            SELECT id, user_id, factor_type, secret_encrypted, friendly_name, verified, created_at, updated_at
+            SELECT id, uid, factor_type, secret_encrypted, friendly_name, verified, created_at, updated_at
             FROM ${sql.raw(tableName)}
             WHERE id = ${factorId}
         `);
@@ -21677,7 +22335,7 @@ var MfaService = class {
 		const row = result.rows[0];
 		return {
 			id: row.id,
-			userId: row.user_id,
+			uid: row.uid,
 			factorType: row.factor_type,
 			secretEncrypted: row.secret_encrypted,
 			friendlyName: row.friendly_name ?? void 0,
@@ -21694,11 +22352,11 @@ var MfaService = class {
             WHERE id = ${factorId}
         `);
 	}
-	async deleteMfaFactor(factorId, userId) {
+	async deleteMfaFactor(factorId, uid) {
 		const tableName = this.qualify("mfa_factors");
 		await this.db.execute(sql`
             DELETE FROM ${sql.raw(tableName)}
-            WHERE id = ${factorId} AND user_id = ${userId}
+            WHERE id = ${factorId} AND uid = ${uid}
         `);
 	}
 	async createMfaChallenge(factorId, ipAddress) {
@@ -21742,43 +22400,43 @@ var MfaService = class {
             WHERE id = ${challengeId}
         `);
 	}
-	async createRecoveryCodes(userId, codeHashes) {
+	async createRecoveryCodes(uid, codeHashes) {
 		const tableName = this.qualify("recovery_codes");
 		await this.db.execute(sql`
-            DELETE FROM ${sql.raw(tableName)} WHERE user_id = ${userId}
+            DELETE FROM ${sql.raw(tableName)} WHERE uid = ${uid}
         `);
 		for (const hash of codeHashes) await this.db.execute(sql`
-                INSERT INTO ${sql.raw(tableName)} (user_id, code_hash)
-                VALUES (${userId}, ${hash})
+                INSERT INTO ${sql.raw(tableName)} (uid, code_hash)
+                VALUES (${uid}, ${hash})
             `);
 	}
-	async useRecoveryCode(userId, codeHash) {
+	async useRecoveryCode(uid, codeHash) {
 		const tableName = this.qualify("recovery_codes");
 		return (await this.db.execute(sql`
             UPDATE ${sql.raw(tableName)}
             SET used_at = NOW()
-            WHERE user_id = ${userId} AND code_hash = ${codeHash} AND used_at IS NULL
+            WHERE uid = ${uid} AND code_hash = ${codeHash} AND used_at IS NULL
             RETURNING id
         `)).rows.length > 0;
 	}
-	async getUnusedRecoveryCodeCount(userId) {
+	async getUnusedRecoveryCodeCount(uid) {
 		const tableName = this.qualify("recovery_codes");
 		return (await this.db.execute(sql`
             SELECT COUNT(*)::int as count FROM ${sql.raw(tableName)}
-            WHERE user_id = ${userId} AND used_at IS NULL
+            WHERE uid = ${uid} AND used_at IS NULL
         `)).rows[0].count;
 	}
-	async deleteAllRecoveryCodes(userId) {
+	async deleteAllRecoveryCodes(uid) {
 		const tableName = this.qualify("recovery_codes");
 		await this.db.execute(sql`
-            DELETE FROM ${sql.raw(tableName)} WHERE user_id = ${userId}
+            DELETE FROM ${sql.raw(tableName)} WHERE uid = ${uid}
         `);
 	}
-	async hasVerifiedMfaFactors(userId) {
+	async hasVerifiedMfaFactors(uid) {
 		const tableName = this.qualify("mfa_factors");
 		return (await this.db.execute(sql`
             SELECT COUNT(*)::int as count FROM ${sql.raw(tableName)}
-            WHERE user_id = ${userId} AND verified = TRUE
+            WHERE uid = ${uid} AND verified = TRUE
         `)).rows[0].count > 0;
 	}
 };
@@ -22018,6 +22676,20 @@ function patchPgArrayNullSafety(tables) {
 	if (patchedCount > 0) logger.debug(`[PgArray] Patched ${patchedCount} array column(s) for null-safety`);
 }
 //#endregion
+//#region src/schema/introspect-db-naming.ts
+/**
+* Naming helpers shared by the introspection modules. These live apart from
+* `introspect-db-logic.ts` because the inference pass needs them too, and
+* importing them from there would close a cycle back through this module.
+*/
+/**
+* Convert a snake_case name to a human-readable Title Case label.
+* e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
+*/
+function humanize(snakeName) {
+	return snakeName.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+}
+//#endregion
 //#region src/schema/introspect-db-logic.ts
 var IRREGULAR_SINGULARS = {
 	people: "person",
@@ -22077,13 +22749,6 @@ function singularize(word) {
 	if (lower.endsWith("s") && !lower.endsWith("ss") && !lower.endsWith("us") && !lower.endsWith("is")) return word.slice(0, -1);
 	return word;
 }
-/**
-* Convert a snake_case name to a human-readable Title Case label.
-* e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
-*/
-function humanize(snakeName) {
-	return snakeName.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
-}
 function getIconForTable(tableName) {
 	const table = tableName.toLowerCase();
 	if (table.includes("user") || table.includes("account") || table.includes("member") || table.includes("customer") || table.includes("client") || table.includes("patient")) return "Users";
@@ -22604,6 +23269,11 @@ function createPostgresBootstrapper(pgConfig) {
 			} catch (err) {
 				logger.warn("⚠️ Could not initialize branch metadata table", { error: err });
 			}
+			try {
+				await realtimeService.configureChannelHistory(pgConfig.realtime?.channels);
+			} catch (err) {
+				logger.warn("⚠️ Could not initialize channel history tables — retained channels will not replay", { error: err });
+			}
 			const directUrl = process.env.DATABASE_DIRECT_URL || pgConfig.connectionString;
 			const validModes = new Set([
 				"auto",
@@ -22619,6 +23289,7 @@ function createPostgresBootstrapper(pgConfig) {
 			const wantsCdc = cdcMode !== "off";
 			const explicitCdc = cdcMode === "trigger" || cdcMode === "wal";
 			let cdcEnabled = false;
+			let provisionCdcForTables;
 			if (wantsCdc && !directUrl) {
 				const reason = "no direct database connection is available for the realtime LISTEN client (set DATABASE_DIRECT_URL)";
 				if (explicitCdc) logger.warn(`⚠️ [CDC] REALTIME_CDC=${cdcMode} but ${reason} — using app-level realtime.`);
@@ -22635,6 +23306,9 @@ function createPostgresBootstrapper(pgConfig) {
 					})).filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table)));
 					await realtimeService.enableCdc(directUrl);
 					cdcEnabled = true;
+					provisionCdcForTables = async (tables) => {
+						await provisionTriggerCdc(cdcRunSql, tables);
+					};
 					logger.info(`📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). All writes now emit realtime events regardless of origin.`);
 				} catch (err) {
 					if (explicitCdc) logger.warn("⚠️ [CDC] Could not enable database-level change capture — falling back to app-level realtime.", { error: err });
@@ -22659,13 +23333,14 @@ function createPostgresBootstrapper(pgConfig) {
 					const dbTables = new Set(result.rows.map((r) => r.table_schema === "public" ? r.table_name : `${r.table_schema}.${r.table_name}`));
 					const missing = [];
 					for (const col of registeredCollections) {
+						if (col.auth?.enabled) continue;
 						const schemaName = "schema" in col && col.schema ? col.schema : "public";
 						const tableName = registry.hasTableForCollection(col.table ?? col.slug) ? col.table ?? col.slug : col.slug;
 						const checkName = registry.getTableNames().find((k) => k === tableName || k === col.slug) ?? tableName;
 						const fullCheckName = schemaName === "public" ? checkName : `${schemaName}.${checkName}`;
 						if (!dbTables.has(fullCheckName)) missing.push({
 							slug: col.slug,
-							table: checkName
+							table: fullCheckName
 						});
 					}
 					if (missing.length > 0) {
@@ -22699,7 +23374,8 @@ function createPostgresBootstrapper(pgConfig) {
 					registry,
 					realtimeService,
 					driver,
-					poolManager
+					poolManager,
+					provisionCdcForTables
 				}
 			};
 		},
@@ -22711,6 +23387,18 @@ function createPostgresBootstrapper(pgConfig) {
 			const registry = internals.registry;
 			const authCollection = authConfig.collection;
 			await ensureAuthTablesExist(db, authCollection);
+			if (authCollection && internals.provisionCdcForTables) {
+				const authSchema = "schema" in authCollection && typeof authCollection.schema === "string" ? authCollection.schema : "rebase";
+				const authTable = "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug;
+				if (authTable) try {
+					await internals.provisionCdcForTables([{
+						schema: authSchema,
+						table: authTable
+					}]);
+				} catch (err) {
+					logger.warn(`⚠️ [CDC] Could not attach change-capture to the auth table "${authSchema}.${authTable}" — writes to it won't emit database-level events.`, { detail: err instanceof Error ? err.message : String(err) });
+				}
+			}
 			let emailService;
 			if (authConfig.email) emailService = createEmailService(authConfig.email);
 			const tableName = authCollection ? "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug : void 0;
@@ -22781,6 +23469,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map