@rebasepro/server-postgres 0.9.1-canary.ff338b5 → 0.10.1-canary.14e53ae

package/dist/schema/auth-bootstrap-sql.d.ts

@@ -21,4 +21,4 @@
  * `DROP SCHEMA "rebase" CASCADE` on the next diff. The `auth` schema is safe
  * because the generated schema.sql declares it.
  */
-export declare const AUTH_BOOTSTRAP_SQL = "-- Auth schema + RLS helper functions (required by the policies below)\nCREATE SCHEMA IF NOT EXISTS auth;\n\nCREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$\n    SELECT NULLIF(current_setting('app.user_id', true), '');\n$$ LANGUAGE sql STABLE;\n\nCREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.jwt', true), ''),\n        '{}'\n    )::jsonb;\n$$ LANGUAGE sql STABLE;\n\nCREATE OR REPLACE FUNCTION auth.roles() RETURNS text AS $$\n    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');\n$$ LANGUAGE sql STABLE;\n";
+export declare const AUTH_BOOTSTRAP_SQL = "-- Auth schema + RLS helper functions (required by the policies below)\nCREATE SCHEMA IF NOT EXISTS auth;\n\n-- Falls back to the pre-rename `app.user_id` so a database that has taken the\n-- new schema but is still served by an older backend keeps resolving the\n-- principal. Drop the COALESCE once no such deployment remains.\nCREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.uid', true), ''),\n        NULLIF(current_setting('app.user_id', true), '')\n    );\n$$ LANGUAGE sql STABLE;\n\nCREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb AS $$\n    SELECT COALESCE(\n        NULLIF(current_setting('app.jwt', true), ''),\n        '{}'\n    )::jsonb;\n$$ LANGUAGE sql STABLE;\n\nCREATE OR REPLACE FUNCTION auth.roles() RETURNS text AS $$\n    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');\n$$ LANGUAGE sql STABLE;\n";

package/dist/schema/auth-schema.d.ts

@@ -232,6 +232,23 @@ export declare function createAuthSchema(usersSchemaName?: string): {
             }, {}, {
                 $type: Record<string, unknown>;
             }>;
+            tokensValidAfter: import("drizzle-orm/pg-core").PgColumn<{
+                name: "tokens_valid_after";
+                tableName: "users";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             createdAt: import("drizzle-orm/pg-core").PgColumn<{
                 name: "created_at";
                 tableName: "users";
@@ -290,8 +307,8 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
-            userId: import("drizzle-orm/pg-core").PgColumn<{
-                name: "user_id";
+            uid: import("drizzle-orm/pg-core").PgColumn<{
+                name: "uid";
                 tableName: "refresh_tokens";
                 dataType: "string";
                 columnType: "PgUUID";
@@ -307,6 +324,23 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            sessionId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "session_id";
+                tableName: "refresh_tokens";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             tokenHash: import("drizzle-orm/pg-core").PgColumn<{
                 name: "token_hash";
                 tableName: "refresh_tokens";
@@ -343,6 +377,57 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            revoked: import("drizzle-orm/pg-core").PgColumn<{
+                name: "revoked";
+                tableName: "refresh_tokens";
+                dataType: "boolean";
+                columnType: "PgBoolean";
+                data: boolean;
+                driverParam: boolean;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            rotatedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "rotated_at";
+                tableName: "refresh_tokens";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            sessionStartedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "session_started_at";
+                tableName: "refresh_tokens";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             userAgent: import("drizzle-orm/pg-core").PgColumn<{
                 name: "user_agent";
                 tableName: "refresh_tokens";
@@ -422,8 +507,8 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
-            userId: import("drizzle-orm/pg-core").PgColumn<{
-                name: "user_id";
+            uid: import("drizzle-orm/pg-core").PgColumn<{
+                name: "uid";
                 tableName: "password_reset_tokens";
                 dataType: "string";
                 columnType: "PgUUID";
@@ -593,8 +678,8 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
-            userId: import("drizzle-orm/pg-core").PgColumn<{
-                name: "user_id";
+            uid: import("drizzle-orm/pg-core").PgColumn<{
+                name: "uid";
                 tableName: "user_identities";
                 dataType: "string";
                 columnType: "PgUUID";
@@ -723,8 +808,8 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
-            userId: import("drizzle-orm/pg-core").PgColumn<{
-                name: "user_id";
+            uid: import("drizzle-orm/pg-core").PgColumn<{
+                name: "uid";
                 tableName: "mfa_factors";
                 dataType: "string";
                 columnType: "PgUUID";
@@ -983,8 +1068,8 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
-            userId: import("drizzle-orm/pg-core").PgColumn<{
-                name: "user_id";
+            uid: import("drizzle-orm/pg-core").PgColumn<{
+                name: "uid";
                 tableName: "recovery_codes";
                 dataType: "string";
                 columnType: "PgUUID";
@@ -1077,8 +1162,8 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
-            userId: import("drizzle-orm/pg-core").PgColumn<{
-                name: "user_id";
+            uid: import("drizzle-orm/pg-core").PgColumn<{
+                name: "uid";
                 tableName: "magic_link_tokens";
                 dataType: "string";
                 columnType: "PgUUID";
@@ -1398,6 +1483,23 @@ export declare const users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {
             $type: Record<string, unknown>;
         }>;
+        tokensValidAfter: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tokens_valid_after";
+            tableName: "users";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
             tableName: "users";
@@ -1456,8 +1558,8 @@ export declare const refreshTokens: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        userId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "user_id";
+        uid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "uid";
             tableName: "refresh_tokens";
             dataType: "string";
             columnType: "PgUUID";
@@ -1473,6 +1575,23 @@ export declare const refreshTokens: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "session_id";
+            tableName: "refresh_tokens";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         tokenHash: import("drizzle-orm/pg-core").PgColumn<{
             name: "token_hash";
             tableName: "refresh_tokens";
@@ -1509,6 +1628,57 @@ export declare const refreshTokens: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        revoked: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revoked";
+            tableName: "refresh_tokens";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        rotatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "rotated_at";
+            tableName: "refresh_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sessionStartedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "session_started_at";
+            tableName: "refresh_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         userAgent: import("drizzle-orm/pg-core").PgColumn<{
             name: "user_agent";
             tableName: "refresh_tokens";
@@ -1588,8 +1758,8 @@ export declare const passwordResetTokens: import("drizzle-orm/pg-core").PgTableW
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        userId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "user_id";
+        uid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "uid";
             tableName: "password_reset_tokens";
             dataType: "string";
             columnType: "PgUUID";
@@ -1759,8 +1929,8 @@ export declare const userIdentities: import("drizzle-orm/pg-core").PgTableWithCo
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        userId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "user_id";
+        uid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "uid";
             tableName: "user_identities";
             dataType: "string";
             columnType: "PgUUID";
@@ -1889,8 +2059,8 @@ export declare const mfaFactors: import("drizzle-orm/pg-core").PgTableWithColumn
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        userId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "user_id";
+        uid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "uid";
             tableName: "mfa_factors";
             dataType: "string";
             columnType: "PgUUID";
@@ -2149,8 +2319,8 @@ export declare const recoveryCodes: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        userId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "user_id";
+        uid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "uid";
             tableName: "recovery_codes";
             dataType: "string";
             columnType: "PgUUID";
@@ -2243,8 +2413,8 @@ export declare const magicLinkTokens: import("drizzle-orm/pg-core").PgTableWithC
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        userId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "user_id";
+        uid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "uid";
             tableName: "magic_link_tokens";
             dataType: "string";
             columnType: "PgUUID";

package/dist/schema/destructive-sql.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Pure helpers that classify an Atlas declarative-apply plan as destructive
+ * or not, and decide what `rebase db push` should do about it.
+ *
+ * `db push` runs `atlas schema apply` to make the live database match the
+ * generated `schema.sql`. Removing a collection field compiles to
+ * `DROP COLUMN`; renaming compiles to drop-then-add — either destroys data.
+ * We first run the apply with `--dry-run` to obtain the planned SQL, scan it
+ * here, and refuse to auto-approve anything destructive without an explicit
+ * opt-in.
+ *
+ * Everything in this file is side-effect free so it can be unit-tested
+ * without Atlas or a database.
+ */
+/**
+ * Split a SQL script into individual statements, dropping blank lines and
+ * `--` comment lines. Deliberately simple: Atlas emits one plain statement
+ * per `;`, without string literals that contain semicolons in a schema DDL
+ * plan, so a naive split is safe and keeps this dependency-free.
+ */
+export declare function splitSqlStatements(sql: string): string[];
+export interface DestructiveStatement {
+    /** The offending statement (trimmed, without the trailing `;`). */
+    statement: string;
+    /** Which destructive operation it was flagged for, e.g. "DROP COLUMN". */
+    kind: string;
+}
+/**
+ * Scan an Atlas plan (the SQL printed by `schema apply --dry-run`) and return
+ * the statements that would destroy data. An empty array means the plan is
+ * safe to auto-approve.
+ */
+export declare function detectDestructiveStatements(planSql: string): DestructiveStatement[];
+export type PushDecision = "apply" | "confirm" | "refuse";
+/**
+ * Decide how `db push` should proceed given the plan's destructiveness and
+ * the invocation context.
+ *
+ *  - No destructive statements → `apply` (safe to auto-approve).
+ *  - Destructive + `--allow-destructive` → `apply` (operator opted in).
+ *  - Destructive + interactive TTY → `confirm` (prompt before applying).
+ *  - Destructive + non-interactive → `refuse` (never silently drop data in
+ *    CI / scripts / agents).
+ */
+export declare function decidePushSafety(opts: {
+    destructiveCount: number;
+    allowDestructive: boolean;
+    interactive: boolean;
+}): PushDecision;

package/dist/schema/ensure-collection-tables.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Bringing a database up to date with a bundle's collections, additively.
+ *
+ * ## Why this exists
+ *
+ * A managed runtime boots someone else's compiled project against a database it
+ * has never seen. Auth tables are ensured at boot already, but collection tables
+ * were not created by anything: the platform ran the app and every `/api/data/*`
+ * request answered 500 on a missing relation. `rebase db push` cannot help — it
+ * is an Atlas-driven CLI command, and the runtime image ships no CLI.
+ *
+ * ## Why additive-only, forever
+ *
+ * This runs unattended, against a database with customers' data in it, with no
+ * human reading a diff. So it may only ever do things that cannot lose data:
+ * create a missing table, add a missing column, create a missing enum type.
+ *
+ * It will **never** drop a table or a column, narrow a type, or alter a
+ * constraint. A removed field leaves its column behind; a renamed field looks
+ * like an addition and the old column stays. That is the correct trade for an
+ * automated path — the alternative is an unattended process that can silently
+ * destroy a column, which is precisely the failure `db push` was hardened
+ * against. Destructive changes stay a deliberate, human-reviewed migration.
+ *
+ * Because of that, this is safe to run on every boot, and re-running it is a
+ * no-op.
+ */
+import { type CollectionConfig } from "@rebasepro/types";
+/**
+ * The subset of a database handle this needs: run a statement, get rows back.
+ *
+ * Deliberately parameterless. Everything here is DDL or catalogue reads keyed by
+ * schema name, and schema names are identifiers — they cannot be bound as
+ * parameters anyway. They are validated against {@link SAFE_IDENTIFIER} before
+ * they reach a statement, so a config that somehow carried a quote is refused
+ * rather than concatenated.
+ */
+export interface Queryable {
+    query<T = unknown>(sql: string): Promise<{
+        rows: T[];
+    }>;
+}
+/** What the database currently has, as the planner needs it. */
+export interface ExistingSchema {
+    /** `schema.table` → set of column names. */
+    tables: Map<string, Set<string>>;
+    /** `schema.typename` of every enum type that already exists. */
+    enums: Set<string>;
+}
+export interface EnsureAction {
+    kind: "create-enum" | "create-table" | "add-column";
+    /** Qualified target, for logging: `public.posts` or `public.posts.title`. */
+    target: string;
+    sql: string;
+}
+export interface EnsurePlan {
+    actions: EnsureAction[];
+    /** Every statement, in dependency order. Empty when the schema is current. */
+    statements: string[];
+}
+/**
+ * Decide what to add. Pure — the caller supplies what exists and runs the result.
+ *
+ * Ordering matters and is deliberate: enum types before the tables and columns
+ * that reference them, tables before the columns added to other tables (a new
+ * table may be the target of a relation), and nothing is emitted twice.
+ */
+export declare function planCollectionSchemaEnsure(collections: CollectionConfig[], existing: ExistingSchema): EnsurePlan;
+/** Read what the database has, for the schemas the collections live in. */
+export declare function readExistingSchema(client: Queryable, schemas: string[]): Promise<ExistingSchema>;
+/**
+ * Bring the database up to date. Returns what it did.
+ *
+ * Each statement runs on its own rather than in one transaction: they are all
+ * independently safe and idempotent, and a single failure (an enum label that
+ * cannot be added, say) should not roll back the tables that were created fine.
+ * The error is surfaced with the statement that caused it.
+ */
+export declare function ensureCollectionTables(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void): Promise<EnsurePlan>;

package/dist/schema/generate-postgres-ddl-logic.d.ts

@@ -1,4 +1,7 @@
-import { CollectionConfig } from "@rebasepro/types";
+import { CollectionConfig, Property } from "@rebasepro/types";
+export declare const resolveColumnName: (propName: string, prop?: Property | null) => string;
+export declare const isIdProperty: (propName: string, prop: Property, collection: CollectionConfig) => boolean;
+export declare const getSqlColumnType: (propName: string, prop: Property, collection: CollectionConfig, collections: CollectionConfig[]) => string;
 export declare const generatePostgresDdl: (collections: CollectionConfig[], options?: {
     includePolicies?: boolean;
 }) => Promise<string>;

package/dist/schema/introspect-db-logic.d.ts

@@ -32,11 +32,6 @@ export interface TableMeta {
     fks: ForeignKeyRow[];
 }
 export declare function singularize(word: string): string;
-/**
- * Convert a snake_case name to a human-readable Title Case label.
- * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
- */
-export declare function humanize(snakeName: string): string;
 /**
  * Convert a snake_case table name to a camelCase + "Collection" variable name.
  * e.g. "company_token" -> "companyTokenCollection"

package/dist/schema/introspect-db-naming.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Naming helpers shared by the introspection modules. These live apart from
+ * `introspect-db-logic.ts` because the inference pass needs them too, and
+ * importing them from there would close a cycle back through this module.
+ */
+/**
+ * Convert a snake_case name to a human-readable Title Case label.
+ * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
+ */
+export declare function humanize(snakeName: string): string;

package/dist/security/policy-drift.d.ts

@@ -26,6 +26,14 @@ export interface PolicyRef {
     hasUsing: boolean;
     /** Whether a WITH CHECK clause is present at all (not what it says). */
     hasWithCheck: boolean;
+    /**
+     * The live clause text, when read from `pg_policies`. Present only for live
+     * policies (the expected side is parsed from DDL and does not carry it).
+     * Used solely for the insecure-tautology scan, not for divergence — Postgres
+     * rewrites this text, so it is not safe to diff against expected.
+     */
+    qual?: string | null;
+    withCheck?: string | null;
 }
 export interface PolicyDrift {
     /** Described by the collections, absent from the database. */
@@ -38,6 +46,22 @@ export interface PolicyDrift {
         actual: PolicyRef;
         differences: string[];
     }[];
+    /**
+     * A live policy whose expression is the known-permissive tautology
+     * `auth.uid() IS NOT NULL` — true for anonymous visitors too, because the
+     * user path coerces a blank id to the `'anonymous'` sentinel. This is what
+     * `policy.authenticated()` used to compile to, so a database pushed before
+     * that fix carries it, and neither the name, roles, command nor clause
+     * *presence* differs from the corrected policy — the only thing that changed
+     * is the expression text, which this checker otherwise (correctly) ignores.
+     * So it is the one drift that hides from every other check here.
+     *
+     * @see reason  a sentence naming the clause and what to do.
+     */
+    insecure: {
+        policy: PolicyRef;
+        reason: string;
+    }[];
 }
 export interface Queryable {
     query<R>(text: string, values?: unknown[]): Promise<{

package/dist/security/rls-enforcement.d.ts

@@ -51,7 +51,7 @@ export interface ConnectionPosture {
     privileged: boolean;
 }
 export interface AuthContext {
-    userId: string;
+    uid: string;
     /** Raw roles as carried on the user (strings or `{ id }` objects). */
     roles: unknown[];
 }
@@ -93,7 +93,7 @@ export declare function ensureAppRole(run: RawSqlRunner, schemas: string[]): Pro
  * SECURITY: this function is only ever called on the **user** path (the server
  * context uses the base/owner driver and never calls it). The default policies
  * treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`
- * is `NULLIF(current_setting('app.user_id'), '')` — so an EMPTY user id would
+ * is `NULLIF(current_setting('app.uid'), '')` — so an EMPTY user id would
  * be read as NULL and silently escalate a user request to server privileges.
  * Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,
  * rather than trusting every caller (e.g. realtime subscription auth) to do it.

package/dist/services/cdc/CdcListener.d.ts

@@ -23,19 +23,14 @@ export declare function parseCdcPayload(payload: string): CdcChangeEvent | null;
 /**
  * Dedicated Postgres LISTEN client for database-level CDC.
  *
- * Mirrors the resilience of the RealtimeService cross-instance LISTEN client: a
- * standalone `pg.Client` (outside the Drizzle pool) that stays connected, and
- * transparently reconnects on error/disconnect. Each backend instance runs one,
- * so every instance observes every committed change regardless of which
- * instance (or external process) made the write.
+ * A {@link PgNotifyListener} — a connection outside the Drizzle pool that stays
+ * open and repairs itself — plus the parsing that turns a `rebase_cdc` payload
+ * into a change event. Each backend instance runs one, so every instance
+ * observes every committed change regardless of which instance (or external
+ * process) made the write.
  */
 export declare class CdcListener {
-    private readonly connectionString;
-    private readonly onEvent;
-    private client?;
-    private running;
-    private reconnectTimer?;
-    private static readonly RECONNECT_DELAY_MS;
+    private readonly listener;
     constructor(connectionString: string, onEvent: (event: CdcChangeEvent) => void | Promise<void>);
     /**
      * Connect and begin listening. Idempotent.
@@ -44,11 +39,9 @@ export declare class CdcListener {
      * established (or `LISTEN` is refused), this rejects so callers — notably
      * `REALTIME_CDC=auto` — can detect an unusable connection and fall back to
      * app-level realtime. Once the initial connection succeeds, later drops
-     * self-heal via {@link scheduleReconnect}.
+     * self-heal in the background.
      */
     start(): Promise<void>;
     /** Stop listening and release the connection. */
     stop(): Promise<void>;
-    private connect;
-    private scheduleReconnect;
 }

package/dist/services/channel-bus/ChannelBus.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Runtime pieces of the channel bus that are not the contract itself.
+ *
+ * The interface, the frame shape and the implementer's contract live in
+ * `@rebasepro/types` (`types/channel_bus.ts`), so a transport shipped as its own
+ * package — a Redis one, say — depends on the contract and not on this database
+ * adapter. They are re-exported here for convenience: code already importing
+ * from the adapter should not have to know where the types are declared.
+ */
+import type { ChannelBusFrame } from "@rebasepro/types";
+export type { ChannelBus, ChannelBusFrame, ChannelBusHandler, ChannelBusConfig, ChannelBusSetting } from "@rebasepro/types";
+export { isChannelBusInstance } from "@rebasepro/types";
+/**
+ * The default: no cross-instance delivery at all.
+ *
+ * This is what every deployment ran before the bus existed, and what a
+ * single-instance deployment should keep running — `publish` resolves without
+ * touching the network, so the broadcast path is the same handful of `ws.send`
+ * calls it always was.
+ */
+export declare class MemoryChannelBus {
+    readonly kind: "memory";
+    readonly maxFrameBytes: number;
+    start(): Promise<void>;
+    publish(): Promise<void>;
+    stop(): Promise<void>;
+}
+/** Encoded size of a frame, for a transport's size check. */
+export declare function frameByteLength(frame: ChannelBusFrame): number;