@rebasepro/server-postgresql 0.6.1 → 0.8.0

package/dist/index.es.js

@@ -152,15 +152,118 @@ var Vector = class {
 	}
 };
 //#endregion
+//#region ../types/src/types/filter-operators.ts
+/** Maps REST short-code operators to their canonical equivalents. */
+var REST_TO_CANONICAL = {
+	"eq": "==",
+	"neq": "!=",
+	"gt": ">",
+	"gte": ">=",
+	"lt": "<",
+	"lte": "<=",
+	"in": "in",
+	"nin": "not-in",
+	"cs": "array-contains",
+	"csa": "array-contains-any"
+};
+/** All canonical operator strings for runtime validation. */
+var CANONICAL_OPS = new Set([
+	"<",
+	"<=",
+	"==",
+	"!=",
+	">=",
+	">",
+	"in",
+	"not-in",
+	"array-contains",
+	"array-contains-any"
+]);
+/**
+* Resolve any operator string (canonical or REST short-code) to its
+* canonical `WhereFilterOp` form. Returns `undefined` for unknown operators.
+*
+* @example
+* toCanonicalOp("==")   // "=="
+* toCanonicalOp("eq")   // "=="
+* toCanonicalOp("cs")   // "array-contains"
+* toCanonicalOp("xyz")  // undefined
+*/
+function toCanonicalOp(op) {
+	if (CANONICAL_OPS.has(op)) return op;
+	return REST_TO_CANONICAL[op];
+}
+//#endregion
 //#region ../types/src/types/collections.ts
 /**
 * Type guard for PostgreSQL collections.
-* Returns true if the collection uses the Postgres driver (or the default driver).
+* Returns true if the collection uses the Postgres engine (or the default engine).
 * @group Models
 */
 function isPostgresCollection(collection) {
-	return !collection.driver || collection.driver === "postgres";
+	return !collection.engine || collection.engine === "postgres";
 }
+/**
+* Reads a collection's driver-declared subcollections thunk (the `subcollections`
+* field) independent of engine identity, so engine-agnostic code doesn't have to
+* type-guard against a specific driver. Returns `undefined` when the collection
+* declares none.
+*
+* Pair with `getDataSourceCapabilities(engine).supportsSubcollections` to decide
+* whether the engine honours subcollections at all before reading them.
+* @group Models
+*/
+function getDeclaredSubcollections(collection) {
+	return collection.subcollections;
+}
+//#endregion
+//#region ../types/src/types/policy.ts
+/** @group Models */
+var policy = {
+	true: () => ({ kind: "true" }),
+	false: () => ({ kind: "false" }),
+	and: (...operands) => ({
+		kind: "and",
+		operands
+	}),
+	or: (...operands) => ({
+		kind: "or",
+		operands
+	}),
+	not: (operand) => ({
+		kind: "not",
+		operand
+	}),
+	compare: (left, op, right) => ({
+		kind: "compare",
+		op,
+		left,
+		right
+	}),
+	rolesOverlap: (roles) => ({
+		kind: "rolesOverlap",
+		roles
+	}),
+	rolesContain: (roles) => ({
+		kind: "rolesContain",
+		roles
+	}),
+	authenticated: () => ({ kind: "authenticated" }),
+	raw: (sql) => ({
+		kind: "raw",
+		sql
+	}),
+	field: (name) => ({
+		kind: "field",
+		name
+	}),
+	literal: (value) => ({
+		kind: "literal",
+		value
+	}),
+	authUid: () => ({ kind: "authUid" }),
+	authRoles: () => ({ kind: "authRoles" })
+};
 //#endregion
 //#region ../types/src/types/backend.ts
 /**
@@ -177,8 +280,6 @@ function isSQLAdmin(admin) {
 function isSchemaAdmin(admin) {
 	return !!admin && (typeof admin.fetchUnmappedTables === "function" || typeof admin.fetchTableMetadata === "function");
 }
-//#endregion
-//#region ../types/src/types/data_source.ts
 /** @group Models */
 var POSTGRES_CAPABILITIES = {
 	key: "postgres",
@@ -246,13 +347,13 @@ var CAPABILITIES_REGISTRY = {
 	"(default)": DEFAULT_CAPABILITIES
 };
 /**
-* Look up capabilities for a given driver key.
-* If `driver` is undefined or not found, returns `DEFAULT_CAPABILITIES`.
+* Look up capabilities for a given engine key.
+* If `engine` is undefined or not found, returns `DEFAULT_CAPABILITIES`.
 * @group Models
 */
-function getDataSourceCapabilities(driver) {
-	if (!driver) return POSTGRES_CAPABILITIES;
-	return CAPABILITIES_REGISTRY[driver] ?? DEFAULT_CAPABILITIES;
+function getDataSourceCapabilities(engine) {
+	if (!engine) return POSTGRES_CAPABILITIES;
+	return CAPABILITIES_REGISTRY[engine] ?? DEFAULT_CAPABILITIES;
 }
 var snakeCaseRegex = /[A-Z]{2,}(?=[A-Z][a-z]|\b)|[A-Z]?[a-z]+|[0-9]+(?:[a-z](?![a-z]))?|[A-Z]/g;
 var toSnakeCase = (str) => {
@@ -1443,7 +1544,7 @@ function sanitizeRelation(relation, sourceCollection, resolveCollection) {
 			if (!newRelation.foreignKeyOnTarget) {
 				let foundForeignKey = false;
 				try {
-					const targetRelations = getDataSourceCapabilities(targetCollection.driver).supportsRelations ? targetCollection.relations || [] : [];
+					const targetRelations = getDataSourceCapabilities(targetCollection.engine).supportsRelations ? targetCollection.relations || [] : [];
 					for (const targetRel of targetRelations) if (targetRel.direction === "owning" && targetRel.cardinality === "one" && targetRel.localKey) try {
 						if (targetRel.target().slug === sourceCollection.slug) {
 							newRelation.foreignKeyOnTarget = targetRel.localKey;
@@ -1459,7 +1560,7 @@ function sanitizeRelation(relation, sourceCollection, resolveCollection) {
 		} else if (newRelation.cardinality === "many" && newRelation.direction === "inverse") {
 			let isManyToManyInverse = false;
 			if (newRelation.inverseRelationName && !newRelation.foreignKeyOnTarget) try {
-				const targetRelations = getDataSourceCapabilities(targetCollection.driver).supportsRelations ? targetCollection.relations || [] : [];
+				const targetRelations = getDataSourceCapabilities(targetCollection.engine).supportsRelations ? targetCollection.relations || [] : [];
 				for (const targetRel of targetRelations) if (targetRel.cardinality === "many" && (targetRel.direction === "owning" || !targetRel.direction) && targetRel.relationName === newRelation.inverseRelationName) {
 					isManyToManyInverse = true;
 					break;
@@ -1494,11 +1595,10 @@ var _resolvedRelationsCache = /* @__PURE__ */ new WeakMap();
 function resolveCollectionRelations(collection) {
 	const cached = _resolvedRelationsCache.get(collection);
 	if (cached) return cached;
-	if (!getDataSourceCapabilities(collection.driver).supportsRelations) return {};
-	const relCollection = collection;
+	if (!getDataSourceCapabilities(collection.engine).supportsRelations) return {};
 	const relations = {};
 	const registeredRelationNames = /* @__PURE__ */ new Set();
-	if (relCollection.relations) relCollection.relations.forEach((relation) => {
+	if (collection.relations) collection.relations.forEach((relation) => {
 		try {
 			const normalizedRelation = sanitizeRelation(relation, collection);
 			const relationKey = normalizedRelation.relationName;
@@ -1545,7 +1645,7 @@ function resolvePropertyRelation({ propertyKey, property, sourceCollection }) {
 	console.warn(`Unrecognized or missing relation target for property '${propertyKey}' in collection '${sourceCollection.slug}'`);
 }
 function getTableName$1(collection) {
-	if (getDataSourceCapabilities(collection.driver).supportsRelations) return collection.table ?? toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
+	if (getDataSourceCapabilities(collection.engine).supportsRelations) return collection.table ?? toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
 	return toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
 }
 function getTableVarName(tableName) {
@@ -1577,8 +1677,9 @@ function findRelation(resolvedRelations, key) {
 //#region ../common/src/util/resolutions.ts
 function getSubcollections(collection) {
 	if (collection.childCollections) return collection.childCollections() ?? [];
-	if (getDataSourceCapabilities(collection.driver).supportsSubcollections && collection.subcollections) return collection.subcollections() ?? [];
-	if (getDataSourceCapabilities(collection.driver).supportsRelations) {
+	const declaredSubcollections = getDeclaredSubcollections(collection);
+	if (getDataSourceCapabilities(collection.engine).supportsSubcollections && declaredSubcollections) return declaredSubcollections() ?? [];
+	if (getDataSourceCapabilities(collection.engine).supportsRelations) {
 		const resolvedRelations = resolveCollectionRelations(collection);
 		return Object.values(resolvedRelations).filter((r) => r.cardinality === "many").map((r) => {
 			const target = r.target();
@@ -1604,6 +1705,164 @@ function getSubcollections(collection) {
 	return [];
 }
 //#endregion
+//#region ../common/src/util/policy/sqlToPolicy.ts
+/**
+* A tiny, regex-based SQL "parser" for security rules.
+*
+* This is NOT a full SQL parser. It is designed to handle the subset of SQL
+* commonly used in `USING` and `WITH CHECK` clauses, enough to drive the
+* optimistic client-side UI decision.
+*
+* It handles:
+* - `field = 'literal'`
+* - `field != 'literal'`
+* - `field = current_setting('app.user_id')`
+* - `A AND B`
+* - `true`
+* - `IN (...)` (as optimistic true)
+*
+* For anything it doesn't understand, it returns a `raw` expression, which
+* the evaluator treats as "unknown" (and usually optimistic true).
+*/
+function sqlToPolicy(sql) {
+	const trimmed = sql.trim();
+	if (trimmed.toLowerCase() === "true") return policy.true();
+	if (trimmed.toLowerCase() === "false") return policy.false();
+	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
+	if (overlapMatch) {
+		const roles = overlapMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+		return policy.rolesOverlap(roles);
+	}
+	const containMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
+	if (containMatch) {
+		const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+		return policy.rolesContain(roles);
+	}
+	if (trimmed.toUpperCase().includes(" OR ")) {
+		const parts = trimmed.split(/ OR /i);
+		return policy.or(...parts.map(sqlToPolicy));
+	}
+	if (trimmed.toUpperCase().includes(" AND ")) {
+		const parts = trimmed.split(/ AND /i);
+		return policy.and(...parts.map(sqlToPolicy));
+	}
+	const match = trimmed.match(/^(.+?)\s*(!?=)\s*(.+)$/);
+	if (match) {
+		const [, leftStr, op, rightStr] = match;
+		const left = parseOperand(leftStr.trim());
+		const right = parseOperand(rightStr.trim());
+		if (left && right) return policy.compare(left, op === "=" ? "eq" : "neq", right);
+	}
+	return policy.raw(sql);
+}
+function parseOperand(str) {
+	if (/current_setting\s*\(\s*'app\.user_id'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return policy.authUid();
+	const stringMatch = str.match(/^'(.+)'$/);
+	if (stringMatch) return policy.literal(stringMatch[1]);
+	if (/^\w+$/.test(str)) return policy.field(str);
+	return null;
+}
+//#endregion
+//#region ../common/src/util/policy/securityRuleToConditions.ts
+/**
+* Desugars a {@link SecurityRule} — its `access`/`ownerField`/`roles` shortcuts,
+* structured `condition`/`check`, and raw `using`/`withCheck` — into a single
+* normalized {@link PolicyExpression} pair.
+*
+* **This is the linchpin against drift:** both the Postgres DDL generators and
+* the client-side evaluator consume this one function, so there is exactly one
+* definition of what a rule means. In particular, application `roles` are folded
+* into the expression here (AND'd with the base condition, matching how Postgres
+* generates the clause) rather than being handled separately by each consumer.
+*/
+function securityRuleToConditions(rule) {
+	return {
+		usingExpr: withRoles(baseUsing(rule), rule),
+		withCheckExpr: withRoles(baseWithCheck(rule), rule)
+	};
+}
+function baseUsing(rule) {
+	if (rule.condition) return rule.condition;
+	if (rule.using != null) return sqlToPolicy(rule.using);
+	if (rule.access === "public") return policy.true();
+	if (rule.ownerField) return policy.compare(policy.field(rule.ownerField), "eq", policy.authUid());
+	return null;
+}
+function baseWithCheck(rule) {
+	if (rule.check) return rule.check;
+	if (rule.withCheck != null) return sqlToPolicy(rule.withCheck);
+	return baseUsing(rule);
+}
+/**
+* AND the base condition with an application-role check, or produce a roles-only
+* condition when there is no base. Mirrors the Postgres generator so that a
+* role-scoped restrictive rule denies exactly the same set of users on both
+* sides.
+*/
+function withRoles(base, rule) {
+	if (!rule.roles || rule.roles.length === 0) return base;
+	const rolesExpr = policy.rolesOverlap(rule.roles);
+	if (rule.mode === "restrictive") return base ? policy.or(policy.not(rolesExpr), base) : policy.not(rolesExpr);
+	return base ? policy.and(base, rolesExpr) : rolesExpr;
+}
+//#endregion
+//#region ../common/src/util/policy/policyToPostgres.ts
+/**
+* Compiles a {@link PolicyExpression} to a PostgreSQL boolean SQL string,
+* suitable for a `USING (...)` / `WITH CHECK (...)` clause.
+*
+* This is one of the two consumers of the shared policy model (the other being
+* {@link evaluatePolicy}); the Postgres schema generators call it so that DDL
+* and the admin UI derive from the exact same expression.
+*/
+function policyToPostgres(expr, collection) {
+	switch (expr.kind) {
+		case "true": return "true";
+		case "false": return "false";
+		case "and": return expr.operands.length === 0 ? "true" : expr.operands.map((o) => `(${policyToPostgres(o, collection)})`).join(" AND ");
+		case "or": return expr.operands.length === 0 ? "false" : expr.operands.map((o) => `(${policyToPostgres(o, collection)})`).join(" OR ");
+		case "not":
+			if (expr.operand.kind === "authenticated") return "auth.uid() IS NULL";
+			return `NOT (${policyToPostgres(expr.operand, collection)})`;
+		case "compare": return `${operandToSql(expr.left, collection)} ${COMPARE_SQL[expr.op]} ${operandToSql(expr.right, collection)}`;
+		case "rolesOverlap": return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
+		case "rolesContain": return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
+		case "authenticated": return "auth.uid() IS NOT NULL";
+		case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => col);
+	}
+}
+var COMPARE_SQL = {
+	eq: "=",
+	neq: "!=",
+	lt: "<",
+	lte: "<=",
+	gt: ">",
+	gte: ">="
+};
+function operandToSql(operand, collection) {
+	switch (operand.kind) {
+		case "field": return resolveColumnName$1(operand.name, collection);
+		case "literal": return quoteLiteral(operand.value);
+		case "authUid": return "auth.uid()";
+		case "authRoles": return "string_to_array(auth.roles(), ',')";
+	}
+}
+function resolveColumnName$1(propName, collection) {
+	const prop = collection?.properties?.[propName];
+	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+	return toSnakeCase(propName);
+}
+function quoteLiteral(value) {
+	if (value === null) return "NULL";
+	if (typeof value === "boolean") return value ? "true" : "false";
+	if (typeof value === "number") return String(value);
+	return `'${value.replace(/'/g, "''")}'`;
+}
+/** Sorted, single-quoted `ARRAY['a','b']` — matches the generators' output. */
+function rolesArraySql(roles) {
+	return `ARRAY[${[...roles].sort().map((r) => `'${r}'`).join(",")}]`;
+}
+//#endregion
 //#region ../common/src/util/callbacks.ts
 /**
 * Helper function to recursively check if there are any callbacks in the properties.
@@ -2366,8 +2625,67 @@ function createCustomEqual(options = {}) {
 	});
 }
 //#endregion
+//#region ../common/src/data/resolveDataSource.ts
+/**
+* Resolve the effective data source for a collection — the single source of
+* truth shared by the frontend router, the backend driver registry, and the
+* editor's capability lookups.
+*
+* Resolution order:
+* 1. The routing **key** is `collection.dataSource`, else
+*    {@link DEFAULT_DATA_SOURCE_KEY}.
+* 2. If a definition is registered for that key, it provides `engine`,
+*    `transport`, and `databaseId`.
+* 3. Otherwise values are synthesized: `engine` from `collection.engine`
+*    (or the key, or `"postgres"`), `transport` defaults to `"server"`,
+*    and `databaseId` from the collection.
+*
+* `capabilities` are always derived from the resolved `engine`, so two
+* data sources sharing an engine share capabilities.
+*
+* @param collection the collection (or any object carrying the routing fields)
+* @param registry   optional registry of declared data sources
+*/
+function resolveDataSource(collection, registry) {
+	const key = collection?.dataSource ?? "(default)";
+	const def = registry?.[key];
+	const engine = def?.engine ?? collection?.engine ?? (key !== "(default)" ? key : "postgres");
+	return {
+		key,
+		engine,
+		transport: def?.transport ?? "server",
+		databaseId: collection?.databaseId ?? def?.databaseId,
+		capabilities: getDataSourceCapabilities(engine)
+	};
+}
+//#endregion
 //#region ../common/src/collections/CollectionRegistry.ts
 var CollectionRegistry = class {
+	/**
+	* Declared data sources, used during normalization to resolve each
+	* collection's engine (so `dataSource`-only collections get the right
+	* capabilities). Empty by default.
+	*/
+	dataSources = {};
+	/**
+	* Global lifecycle callbacks applied to every collection.
+	* Runs on all data paths (REST, WebSocket, `rebase.data`).
+	* Execution order: global → collection → property callbacks.
+	*/
+	_globalCallbacks;
+	/**
+	* Set global lifecycle callbacks that apply to every collection.
+	* Typically called once during backend initialization.
+	*/
+	setGlobalCallbacks(callbacks) {
+		this._globalCallbacks = callbacks;
+	}
+	/**
+	* Get the currently registered global callbacks, if any.
+	*/
+	getGlobalCallbacks() {
+		return this._globalCallbacks;
+	}
 	collectionsByTableName = /* @__PURE__ */ new Map();
 	collectionsBySlug = /* @__PURE__ */ new Map();
 	rootCollections = [];
@@ -2377,9 +2695,20 @@ var CollectionRegistry = class {
 	rawRootCollections = [];
 	cachedRawCollectionsList = null;
 	lastRawInputSnapshot = null;
-	constructor(collections) {
+	constructor(collections, dataSources) {
+		if (dataSources) this.dataSources = dataSources;
 		if (collections) this.registerMultiple(collections);
 	}
+	/**
+	* Provide the declared data sources used to resolve each collection's
+	* engine during normalization. Set this before registering collections.
+	* Returns true if the registry changed (callers may re-register).
+	*/
+	setDataSources(dataSources) {
+		if (deepEqual$1(this.dataSources, dataSources)) return false;
+		this.dataSources = dataSources ?? {};
+		return true;
+	}
 	reset() {
 		this.collectionsByTableName.clear();
 		this.collectionsBySlug.clear();
@@ -2448,9 +2777,14 @@ var CollectionRegistry = class {
 	}
 	normalizeCollection(collection) {
 		const result = { ...collection };
+		{
+			const resolved = resolveDataSource(result, this.dataSources);
+			if (!result.dataSource) result.dataSource = resolved.key;
+			if (!result.engine) result.engine = resolved.engine;
+		}
 		const extractedRelations = this.extractRelationsFromProperties(result.properties);
 		const relResult = result;
-		const manualRelations = getDataSourceCapabilities(result.driver).supportsRelations ? relResult.relations ?? [] : [];
+		const manualRelations = getDataSourceCapabilities(result.engine).supportsRelations ? relResult.relations ?? [] : [];
 		const mergedRelationsRaw = [...extractedRelations];
 		for (const manual of manualRelations) {
 			const name = manual.relationName;
@@ -2465,7 +2799,7 @@ var CollectionRegistry = class {
 			}
 		}
 		let mergedRelations = mergedRelationsRaw;
-		if (getDataSourceCapabilities(result.driver).supportsRelations) {
+		if (getDataSourceCapabilities(result.engine).supportsRelations) {
 			mergedRelations = mergedRelationsRaw.map((r) => {
 				try {
 					return sanitizeRelation(r, result, (slug) => this.get(slug));
@@ -2477,8 +2811,10 @@ var CollectionRegistry = class {
 		}
 		result.properties = this.normalizeProperties(result.properties, mergedRelations);
 		if (!result.childCollections) {
-			if (getDataSourceCapabilities(result.driver).supportsSubcollections && result.subcollections) result.childCollections = result.subcollections;
-			else if (getDataSourceCapabilities(result.driver).supportsRelations && relResult.relations) {
+			const capabilities = getDataSourceCapabilities(result.engine);
+			const declaredSubcollections = getDeclaredSubcollections(result);
+			if (capabilities.supportsSubcollections && declaredSubcollections) result.childCollections = declaredSubcollections;
+			else if (capabilities.supportsRelations && relResult.relations) {
 				const manyRelations = relResult.relations.filter((r) => r.cardinality === "many");
 				if (manyRelations.length > 0) result.childCollections = () => manyRelations.map((r) => {
 					const target = r.target();
@@ -2580,7 +2916,7 @@ var CollectionRegistry = class {
 		if (!currentCollection) throw new Error(`Root collection not found: ${rootCollectionPath}`);
 		for (let i = 2; i < pathSegments.length; i += 2) {
 			const relationKey = pathSegments[i];
-			if (!getDataSourceCapabilities(currentCollection.driver).supportsRelations) throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses driver '${currentCollection.driver}'`);
+			if (!getDataSourceCapabilities(currentCollection.engine).supportsRelations) throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses engine '${currentCollection.engine}'`);
 			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
 			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
 			const target = relation.target();
@@ -2664,8 +3000,8 @@ var QueryBuilder = class {
 	* @example
 	* client.collection('users').orderBy('createdAt', 'desc').find()
 	*/
-	orderBy(column, ascending = "asc") {
-		this.params.orderBy = `${column}:${ascending}`;
+	orderBy(column, direction = "asc") {
+		this.params.orderBy = `${column}:${direction}`;
 		return this;
 	}
 	/**
@@ -2720,80 +3056,83 @@ var QueryBuilder = class {
 	}
 };
 //#endregion
-//#region ../common/src/data/buildRebaseData.ts
+//#region ../common/src/data/filter-dialect.ts
 /**
-* Convert where-clause filter object to the internal DataDriver FilterValues format.
+* REST wire-format adapter for the unified filter system.
 *
-* Supports multiple value formats:
-* - PostgREST string: { status: "eq.published", age: "gte.18" }
-* - Equality shorthand: { company_profile_id: null, status: "active", age: 18 }
-* - Tuple syntax: { age: [">=", 18], role: ["in", ["admin", "editor"]] }
+* This module is the ONLY code in the entire codebase that knows about
+* PostgREST-style dot-syntax strings (`eq.active`, `gt.18`, `in.(a,b)`).
+* Everything else speaks `FilterValues` exclusively.
 *
-* Internal:  { status: ["==", "published"], age: [">=", 18] }
+* @module
 */
-function convertWhereToFilter(where) {
-	if (!where) return void 0;
-	const operatorMap = {
-		"eq": "==",
-		"neq": "!=",
-		"gt": ">",
-		"gte": ">=",
-		"lt": "<",
-		"lte": "<=",
-		"in": "in",
-		"nin": "not-in",
-		"not-in": "not-in",
-		"cs": "array-contains",
-		"csa": "array-contains-any",
-		"==": "==",
-		"!=": "!=",
-		">": ">",
-		">=": ">=",
-		"<": "<",
-		"<=": "<=",
-		"array-contains": "array-contains",
-		"array-contains-any": "array-contains-any"
-	};
-	const filter = {};
-	for (const [field, rawValue] of Object.entries(where)) {
-		if (rawValue === null) {
-			filter[field] = ["==", null];
-			continue;
-		}
-		if (typeof rawValue === "boolean") {
-			filter[field] = ["==", rawValue];
-			continue;
-		}
-		if (typeof rawValue === "number") {
-			filter[field] = ["==", rawValue];
-			continue;
-		}
-		if (Array.isArray(rawValue)) {
-			const mappedConditions = (Array.isArray(rawValue[0]) ? rawValue : [rawValue]).map(([rawOp, val]) => {
-				return [operatorMap[rawOp] ?? "==", val];
-			});
-			filter[field] = Array.isArray(rawValue[0]) ? mappedConditions : mappedConditions[0];
+/**
+* Coerce a raw querystring value to its natural JS type.
+* - `"true"` / `"false"` → boolean
+* - `"null"` → null
+* - Numeric strings → number
+* - Everything else → string (unchanged)
+*/
+function coerceValue(raw) {
+	if (raw === "true") return true;
+	if (raw === "false") return false;
+	if (raw === "null") return null;
+	if (raw !== "" && !isNaN(Number(raw))) return Number(raw);
+	return raw;
+}
+/**
+* Parse a single PostgREST dot-string into a `[WhereFilterOp, unknown]` tuple.
+*
+* If the string doesn't match a known operator prefix, falls back to
+* `["==", originalString]` (treating the whole string as an equality value).
+*/
+function deserializeSingle(raw) {
+	const dotIndex = raw.indexOf(".");
+	if (dotIndex === -1) return ["==", coerceValue(raw)];
+	const prefix = raw.substring(0, dotIndex);
+	const rest = raw.substring(dotIndex + 1);
+	const canonicalOp = REST_TO_CANONICAL[prefix];
+	if (!canonicalOp) return ["==", raw];
+	if (rest.startsWith("(") && rest.endsWith(")")) return [canonicalOp, rest.slice(1, -1).split(",").map((s) => coerceValue(s.trim()))];
+	return [canonicalOp, coerceValue(rest)];
+}
+/**
+* Convert a PostgREST-style querystring record to `FilterValues`.
+*
+* - String values are parsed as single conditions.
+* - String arrays (repeated query params) become multiple conditions on the same field.
+*
+* @example
+* deserializeFilter({ status: "eq.active" })
+* // → { status: ["==", "active"] }
+*
+* deserializeFilter({ age: ["gte.18", "lt.65"] })
+* // → { age: [[">=", 18], ["<", 65]] }
+*/
+function deserializeFilter(query) {
+	const result = {};
+	for (const [field, raw] of Object.entries(query)) {
+		if (raw === void 0) continue;
+		if (Array.isArray(raw) && raw.length === 2 && typeof raw[0] === "string" && toCanonicalOp(raw[0]) === raw[0]) {
+			result[field] = raw;
 			continue;
 		}
-		if (typeof rawValue === "string") {
-			const dotIndex = rawValue.indexOf(".");
-			if (dotIndex === -1) {
-				filter[field] = ["==", rawValue];
+		if (Array.isArray(raw)) {
+			if (raw.length === 0) continue;
+			if (Array.isArray(raw[0]) && raw[0].length === 2 && typeof raw[0][0] === "string" && toCanonicalOp(raw[0][0]) === raw[0][0]) {
+				result[field] = raw;
 				continue;
 			}
-			const op = rawValue.substring(0, dotIndex);
-			let value = rawValue.substring(dotIndex + 1);
-			if (typeof value === "string" && value.startsWith("(") && value.endsWith(")")) value = value.slice(1, -1).split(",").map((v) => v.trim());
-			if (value === "null") value = null;
-			else if (value === "true") value = true;
-			else if (value === "false") value = false;
-			else if (typeof value === "string" && !isNaN(Number(value)) && value.trim() !== "") value = Number(value);
-			const mappedOp = operatorMap[op];
-			if (mappedOp) filter[field] = [mappedOp, value];
-		}
+			if (raw.length === 1) result[field] = typeof raw[0] === "string" ? deserializeSingle(raw[0]) : ["==", raw[0]];
+			else if (typeof raw[0] === "string" && raw[0].includes(".")) result[field] = raw.map((r) => typeof r === "string" ? deserializeSingle(r) : ["==", r]);
+			else result[field] = ["in", raw];
+		} else if (typeof raw === "string") result[field] = deserializeSingle(raw);
+		else result[field] = ["==", raw];
 	}
-	return Object.keys(filter).length > 0 ? filter : void 0;
+	return result;
 }
+//#endregion
+//#region ../common/src/data/buildRebaseData.ts
 /**
 * Parse an orderBy string like "created_at:desc" into [field, direction].
 */
@@ -2806,11 +3145,12 @@ function createDriverAccessor(driver, slug) {
 	const accessor = {
 		async find(params) {
 			const orderParsed = parseOrderBy(params?.orderBy);
+			const filter = params?.where ? deserializeFilter(params.where) : void 0;
 			const entities = await driver.fetchCollection({
 				path: slug,
 				limit: params?.limit,
 				offset: params?.offset,
-				filter: convertWhereToFilter(params?.where),
+				filter,
 				orderBy: orderParsed?.[0],
 				order: orderParsed?.[1],
 				searchString: params?.searchString
@@ -2860,9 +3200,10 @@ function createDriverAccessor(driver, slug) {
 			return driver.deleteAll(slug);
 		} : void 0,
 		count: driver.countEntities ? async (params) => {
+			const filter = params?.where ? deserializeFilter(params.where) : void 0;
 			return driver.countEntities({
 				path: slug,
-				filter: convertWhereToFilter(params?.where)
+				filter
 			});
 		} : void 0,
 		listen: driver.listenCollection ? (params, onUpdate, onError) => {
@@ -2873,7 +3214,7 @@ function createDriverAccessor(driver, slug) {
 				path: slug,
 				limit: params?.limit,
 				offset: params?.offset,
-				filter: convertWhereToFilter(params?.where),
+				filter: params?.where,
 				orderBy: orderParsed?.[0],
 				order: orderParsed?.[1],
 				searchString: params?.searchString,
@@ -2952,6 +3293,72 @@ function buildRebaseData(driver) {
 	} });
 }
 //#endregion
+//#region ../common/src/table-classification.ts
+/** Schemas that are always considered Rebase-internal. */
+var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
+/** Table-name prefixes that mark a table as Rebase-internal regardless of schema. */
+var REBASE_INTERNAL_PREFIXES = [
+	"_rebase_",
+	"_auth_",
+	"drizzle_"
+];
+/**
+* Synchronously classify a table based on naming conventions.
+*
+* @param tableName  - The unqualified name of the table.
+* @param schemaName - The schema the table belongs to (e.g. `"public"`, `"rebase"`).
+* @returns `"rebase-internal"` when the table belongs to a reserved schema or
+*          carries a reserved prefix; `"user"` otherwise.
+*
+* @remarks
+* Junction-table detection requires an async database query and is therefore
+* **not** handled by this function. Use {@link detectJunctionTables} to obtain
+* the set of junction tables, then reclassify as needed.
+*/
+function classifyTable(tableName, schemaName) {
+	if (REBASE_INTERNAL_SCHEMAS.includes(schemaName) || REBASE_INTERNAL_PREFIXES.some((prefix) => tableName.startsWith(prefix))) return "rebase-internal";
+	return "user";
+}
+/** SQL query that detects junction tables in the `public` schema. */
+var JUNCTION_TABLES_SQL = `
+  SELECT t.table_name
+  FROM information_schema.tables t
+  WHERE t.table_schema = 'public'
+    AND t.table_type = 'BASE TABLE'
+    AND NOT EXISTS (
+      SELECT 1
+      FROM information_schema.columns c
+      WHERE c.table_schema = t.table_schema
+        AND c.table_name = t.table_name
+        AND c.column_name NOT IN (
+          SELECT kcu.column_name
+          FROM information_schema.key_column_usage kcu
+          JOIN information_schema.table_constraints tc
+            ON tc.constraint_name = kcu.constraint_name
+            AND tc.table_schema = kcu.table_schema
+          WHERE tc.constraint_type = 'FOREIGN KEY'
+            AND kcu.table_schema = t.table_schema
+            AND kcu.table_name = t.table_name
+        )
+    )
+`;
+/**
+* Asynchronously detect junction (link) tables in the `public` schema.
+*
+* A junction table is defined as a table where **every** column participates in
+* at least one foreign-key constraint.
+*
+* @param executeSql - A callback that executes a raw SQL string and returns the
+*                     resulting rows.
+* @returns A `Set` containing the names of all detected junction tables.
+*/
+async function detectJunctionTables(executeSql) {
+	const rows = await executeSql(JUNCTION_TABLES_SQL);
+	const junctionTables = /* @__PURE__ */ new Set();
+	for (const row of rows) if (typeof row.table_name === "string") junctionTables.add(row.table_name);
+	return junctionTables;
+}
+//#endregion
 //#region src/services/entity-helpers.ts
 /** Safely extract Drizzle column metadata from a column object. */
 function getColumnMeta(col) {
@@ -5700,6 +6107,21 @@ function extractCauseMessage(error) {
 	return null;
 }
 /**
+* Detect whether an error is specifically a role-switching permission failure
+* (e.g. "permission denied to set role" or "must be member of role"),
+* as opposed to a table-level permission denial.
+*
+* This is used by the backend driver to auto-disable role switching when the
+* connection user lacks SET ROLE privileges, rather than surfacing a confusing
+* error to the Studio SQL Editor user.
+*/
+function isRoleSwitchingPermissionError(error) {
+	const pgError = extractPgError(error);
+	if (!pgError || pgError.code !== "42501") return false;
+	const msg = pgError.message.toLowerCase();
+	return msg.includes("set role") || msg.includes("member of role");
+}
+/**
 * Translate a raw PostgreSQL error into a user-friendly message.
 *
 * @param pgError  - The extracted PostgreSQL error (from {@link extractPgError})
@@ -5835,11 +6257,14 @@ var EntityPersistService = class {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = getPrimaryKeys(collection, this.registry);
-		const idInfo = idInfoArray[0];
-		const idField = table[idInfo.fieldName];
-		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
-		const parsedId = parseIdValues(entityId, idInfoArray)[idInfo.fieldName];
-		await this.db.delete(table).where(eq(idField, parsedId));
+		const parsedIdObj = parseIdValues(entityId, idInfoArray);
+		const conditions = [];
+		for (const info of idInfoArray) {
+			const field = table[info.fieldName];
+			if (!field) throw new Error(`ID field '${info.fieldName}' not found in table for collection '${collectionPath}'`);
+			conditions.push(eq(field, parsedIdObj[info.fieldName]));
+		}
+		await this.db.delete(table).where(and(...conditions));
 	}
 	/**
 	* Delete all entities from a collection
@@ -6082,10 +6507,23 @@ var EntityService = class {
 	/**
 	* Execute raw SQL
 	*/
-	async executeSql(sqlText) {
-		if (process.env.NODE_ENV !== "production") console.debug("Executing raw SQL:", sqlText);
+	async executeSql(sqlText, params) {
+		if (process.env.NODE_ENV !== "production") console.debug("Executing raw SQL:", sqlText, params?.length ? `with ${params.length} params` : "");
 		const { sql } = await import("drizzle-orm");
-		const rows = (await this.db.execute(sql.raw(sqlText))).rows;
+		let result;
+		if (params && params.length > 0) {
+			const parts = sqlText.split(/\$(\d+)/);
+			const chunks = [];
+			for (let i = 0; i < parts.length; i++) if (i % 2 === 0) {
+				if (parts[i].length > 0) chunks.push(sql.raw(parts[i]));
+			} else {
+				const paramIndex = Number(parts[i]) - 1;
+				chunks.push(sql.param(params[paramIndex]));
+			}
+			const query = sql.join(chunks, sql.raw(""));
+			result = await this.db.execute(query);
+		} else result = await this.db.execute(sql.raw(sqlText));
+		const rows = result.rows;
 		if (process.env.NODE_ENV !== "production") console.debug(`SQL executed successfully. Returned ${Array.isArray(rows) ? rows.length : "non-array"} rows.`);
 		return rows;
 	}
@@ -6287,6 +6725,13 @@ var PostgresBackendDriver = class {
 	data;
 	client;
 	/**
+	* Auto-set to `true` when a SET LOCAL ROLE fails with insufficient
+	* privileges, so subsequent queries skip the doomed attempt.
+	* Mirrors the static `DISABLE_DB_ROLE_SWITCHING` env var but is
+	* learned at runtime.
+	*/
+	_roleSwitchingDisabled = false;
+	/**
 	* When true, realtime notifications are deferred until after the
 	* wrapping transaction commits.  Set by `withAuth` → `withTransaction`.
 	*/
@@ -6345,6 +6790,7 @@ var PostgresBackendDriver = class {
 		if (!collection && !path) return {
 			collection: void 0,
 			callbacks: void 0,
+			globalCallbacks: void 0,
 			propertyCallbacks: void 0
 		};
 		const registryCollection = this.registry?.getCollectionByPath(path);
@@ -6353,12 +6799,14 @@ var PostgresBackendDriver = class {
 			...registryCollection
 		} : collection;
 		const callbacks = resolvedCollection?.callbacks;
+		const globalCallbacks = this.registry?.getGlobalCallbacks();
 		const properties = resolvedCollection?.properties;
 		let propertyCallbacks;
 		if (properties) propertyCallbacks = buildPropertyCallbacks(properties);
 		return {
 			collection: resolvedCollection,
 			callbacks,
+			globalCallbacks,
 			propertyCallbacks
 		};
 	}
@@ -6374,11 +6822,17 @@ var PostgresBackendDriver = class {
 			searchString,
 			vectorSearch
 		});
-		const { collection: resolvedCollection, callbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
-		if (callbacks?.afterRead || propertyCallbacks?.afterRead) {
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
+		if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
 			const contextForCallback = this.buildCallContext();
 			return Promise.all(entities.map(async (entity) => {
 				let fetched = entity;
+				if (globalCallbacks?.afterRead) fetched = await globalCallbacks.afterRead({
+					collection: resolvedCollection,
+					path,
+					entity: fetched,
+					context: contextForCallback
+				});
 				if (callbacks?.afterRead) fetched = await callbacks.afterRead({
 					collection: resolvedCollection,
 					path,
@@ -6390,7 +6844,7 @@ var PostgresBackendDriver = class {
 					path,
 					entity: fetched,
 					context: contextForCallback
-				}) ?? fetched;
+				});
 				return fetched;
 			}));
 		}
@@ -6439,21 +6893,27 @@ var PostgresBackendDriver = class {
 	}
 	async fetchEntity({ path, entityId, databaseId, collection }) {
 		let entity = await this.entityService.fetchEntity(path, entityId, databaseId || collection?.databaseId);
-		const { collection: resolvedCollection, callbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
-		if (entity && (callbacks?.afterRead || propertyCallbacks?.afterRead)) {
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
+		if (entity && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
 			const contextForCallback = this.buildCallContext();
+			if (globalCallbacks?.afterRead) entity = await globalCallbacks.afterRead({
+				collection: resolvedCollection,
+				path,
+				entity,
+				context: contextForCallback
+			});
 			if (callbacks?.afterRead) entity = await callbacks.afterRead({
 				collection: resolvedCollection,
 				path,
 				entity,
 				context: contextForCallback
-			}) ?? entity;
+			});
 			if (propertyCallbacks?.afterRead) entity = await propertyCallbacks.afterRead({
 				collection: resolvedCollection,
 				path,
 				entity,
 				context: contextForCallback
-			}) ?? entity;
+			});
 		}
 		return entity;
 	}
@@ -6484,7 +6944,7 @@ var PostgresBackendDriver = class {
 		};
 	}
 	async saveEntity({ path, entityId, values, collection, status }) {
-		const { collection: resolvedCollection, callbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
 		let previousValuesForHistory;
@@ -6492,7 +6952,19 @@ var PostgresBackendDriver = class {
 			const existing = await this.entityService.fetchEntity(path, entityId, resolvedCollection?.databaseId);
 			if (existing) previousValuesForHistory = existing.values;
 		}
-		if (callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
+		if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
+			if (globalCallbacks?.beforeSave) {
+				const result = await globalCallbacks.beforeSave({
+					collection: resolvedCollection,
+					path,
+					entityId,
+					values: updatedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+				if (result) updatedValues = mergeDeep(updatedValues, result);
+			}
 			if (callbacks?.beforeSave) {
 				const result = await callbacks.beforeSave({
 					collection: resolvedCollection,
@@ -6526,7 +6998,13 @@ var PostgresBackendDriver = class {
 		});
 		try {
 			let savedEntity = await this.entityService.saveEntity(path, updatedValues, entityId, resolvedCollection?.databaseId);
-			if (savedEntity && (callbacks?.afterRead || propertyCallbacks?.afterRead)) {
+			if (savedEntity && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
+				if (globalCallbacks?.afterRead) savedEntity = await globalCallbacks.afterRead({
+					collection: resolvedCollection,
+					path,
+					entity: savedEntity,
+					context: contextForCallback
+				});
 				if (callbacks?.afterRead) savedEntity = await callbacks.afterRead({
 					collection: resolvedCollection,
 					path,
@@ -6538,9 +7016,18 @@ var PostgresBackendDriver = class {
 					path,
 					entity: savedEntity,
 					context: contextForCallback
-				}) ?? savedEntity;
+				});
 			}
-			if (callbacks?.afterSave || propertyCallbacks?.afterSave) {
+			if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
+				if (globalCallbacks?.afterSave) await globalCallbacks.afterSave({
+					collection: resolvedCollection,
+					path,
+					entityId: savedEntity.id,
+					values: savedEntity.values,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
 				if (callbacks?.afterSave) await callbacks.afterSave({
 					collection: resolvedCollection,
 					path,
@@ -6577,7 +7064,16 @@ var PostgresBackendDriver = class {
 			else await this.realtimeService.notifyEntityUpdate(path, savedEntity.id.toString(), savedEntity, resolvedCollection?.databaseId);
 			return savedEntity;
 		} catch (error) {
-			if (callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
+			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
+				if (globalCallbacks?.afterSaveError) await globalCallbacks.afterSaveError({
+					collection: resolvedCollection,
+					path,
+					entityId: entityId || "unknown",
+					values: updatedValues,
+					previousValues: void 0,
+					status,
+					context: contextForCallback
+				});
 				if (callbacks?.afterSaveError) await callbacks.afterSaveError({
 					collection: resolvedCollection,
 					path,
@@ -6601,10 +7097,19 @@ var PostgresBackendDriver = class {
 		}
 	}
 	async deleteEntity({ entity, collection }) {
-		const { collection: resolvedCollection, callbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, entity.path);
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, entity.path);
 		const contextForCallback = this.buildCallContext();
-		if (callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
+		if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
 			let preventDefault = false;
+			if (globalCallbacks?.beforeDelete) {
+				if (await globalCallbacks.beforeDelete({
+					collection: resolvedCollection,
+					path: entity.path,
+					entityId: entity.id,
+					entity,
+					context: contextForCallback
+				}) === false) preventDefault = true;
+			}
 			if (callbacks?.beforeDelete) {
 				if (await callbacks.beforeDelete({
 					collection: resolvedCollection,
@@ -6626,7 +7131,14 @@ var PostgresBackendDriver = class {
 			if (preventDefault) return;
 		}
 		await this.entityService.deleteEntity(entity.path, entity.id, entity.databaseId || resolvedCollection?.databaseId);
-		if (callbacks?.afterDelete || propertyCallbacks?.afterDelete) {
+		if (globalCallbacks?.afterDelete || callbacks?.afterDelete || propertyCallbacks?.afterDelete) {
+			if (globalCallbacks?.afterDelete) await globalCallbacks.afterDelete({
+				collection: resolvedCollection,
+				path: entity.path,
+				entityId: entity.id,
+				entity,
+				context: contextForCallback
+			});
 			if (callbacks?.afterDelete) await callbacks.afterDelete({
 				collection: resolvedCollection,
 				path: entity.path,
@@ -6676,11 +7188,11 @@ var PostgresBackendDriver = class {
 		return this.poolManager.getDrizzle(databaseName);
 	}
 	async executeSql(sqlText, options) {
-		if (!options?.database && !options?.role) return this.entityService.executeSql(sqlText);
+		if (!options?.database && !options?.role) return this.entityService.executeSql(sqlText, options?.params);
 		const targetDb = this.getTargetDb(options?.database);
 		try {
 			let needsRoleSwitch = false;
-			if (options?.role && process.env.DISABLE_DB_ROLE_SWITCHING !== "true") try {
+			if (options?.role && process.env.DISABLE_DB_ROLE_SWITCHING !== "true" && !this._roleSwitchingDisabled) try {
 				const currentRole = ((await targetDb.execute(sql.raw("SELECT current_user AS role"))).rows?.[0])?.role;
 				needsRoleSwitch = !!currentRole && currentRole !== options.role;
 			} catch {
@@ -6688,12 +7200,37 @@ var PostgresBackendDriver = class {
 			}
 			if (needsRoleSwitch && options?.role) {
 				const safeRole = options.role.replace(/"/g, "\"\"");
-				return await targetDb.transaction(async (tx) => {
-					await tx.execute(sql.raw(`SET LOCAL ROLE "${safeRole}"`));
-					return (await tx.execute(sql.raw(sqlText))).rows;
-				});
+				try {
+					return await targetDb.transaction(async (tx) => {
+						await tx.execute(sql.raw(`SET LOCAL ROLE "${safeRole}"`));
+						let result;
+						if (options?.params && options.params.length > 0) {
+							const parts = sqlText.split(/\$(\d+)/);
+							const chunks = [];
+							for (let i = 0; i < parts.length; i++) if (i % 2 === 0) {
+								if (parts[i].length > 0) chunks.push(sql.raw(parts[i]));
+							} else chunks.push(sql.param(options.params[Number(parts[i]) - 1]));
+							result = await tx.execute(sql.join(chunks, sql.raw("")));
+						} else result = await tx.execute(sql.raw(sqlText));
+						return result.rows;
+					});
+				} catch (roleError) {
+					if (isRoleSwitchingPermissionError(roleError)) {
+						logger.warn(`[PostgresBackendDriver] SET LOCAL ROLE "${safeRole}" failed — the connection user lacks permission. Falling back to executing without role switching. To suppress this warning, set DISABLE_DB_ROLE_SWITCHING=true in your .env file.`);
+						this._roleSwitchingDisabled = true;
+					} else throw roleError;
+				}
 			}
-			return (await targetDb.execute(sql.raw(sqlText))).rows;
+			let result;
+			if (options?.params && options.params.length > 0) {
+				const parts = sqlText.split(/\$(\d+)/);
+				const chunks = [];
+				for (let i = 0; i < parts.length; i++) if (i % 2 === 0) {
+					if (parts[i].length > 0) chunks.push(sql.raw(parts[i]));
+				} else chunks.push(sql.param(options.params[Number(parts[i]) - 1]));
+				result = await targetDb.execute(sql.join(chunks, sql.raw("")));
+			} else result = await targetDb.execute(sql.raw(sqlText));
+			return result.rows;
 		} catch (error) {
 			const msg = error instanceof Error ? error.message : String(error);
 			if (msg.includes("pg_hba.conf") || msg.includes("no encryption") || msg.includes("connection refused")) {
@@ -6731,53 +7268,16 @@ var PostgresBackendDriver = class {
 	* and junction/connection tables used for many-to-many relations.
 	*/
 	async fetchUnmappedTables(mappedPaths) {
-		const result = await this.executeSql(`
+		const allTables = (await this.executeSql(`
             SELECT table_name
             FROM information_schema.tables
             WHERE table_schema = 'public'
               AND table_type = 'BASE TABLE'
             ORDER BY table_name;
-        `);
-		const internalPrefixes = ["_rebase_", "_auth_"];
-		const internalExact = [
-			"users",
-			"roles",
-			"user_roles",
-			"refresh_tokens",
-			"password_reset_tokens",
-			"email_verification_tokens"
-		];
-		const allTables = result.map((r) => r.table_name).filter((name) => {
-			if (internalPrefixes.some((prefix) => name.startsWith(prefix))) return false;
-			if (internalExact.includes(name)) return false;
-			return true;
-		});
+        `)).map((r) => r.table_name).filter((name) => classifyTable(name, "public") !== "rebase-internal");
 		let junctionTables = /* @__PURE__ */ new Set();
 		try {
-			const junctionResult = await this.executeSql(`
-                SELECT t.table_name
-                FROM information_schema.tables t
-                WHERE t.table_schema = 'public'
-                  AND t.table_type = 'BASE TABLE'
-                  AND NOT EXISTS (
-                    -- Find columns that are NOT part of any foreign key
-                    SELECT 1
-                    FROM information_schema.columns c
-                    WHERE c.table_schema = t.table_schema
-                      AND c.table_name = t.table_name
-                      AND c.column_name NOT IN (
-                        SELECT kcu.column_name
-                        FROM information_schema.key_column_usage kcu
-                        JOIN information_schema.table_constraints tc
-                          ON tc.constraint_name = kcu.constraint_name
-                          AND tc.table_schema = kcu.table_schema
-                        WHERE tc.constraint_type = 'FOREIGN KEY'
-                          AND kcu.table_schema = t.table_schema
-                          AND kcu.table_name = t.table_name
-                      )
-                  );
-            `);
-			junctionTables = new Set(junctionResult.map((r) => r.table_name));
+			junctionTables = await detectJunctionTables(this.executeSql.bind(this));
 		} catch (e) {
 			logger.warn("Could not detect junction tables", { error: e });
 		}
@@ -7146,6 +7646,14 @@ function createAuthSchema(usersSchemaName = "rebase") {
 			codeHash: varchar("code_hash", { length: 255 }).notNull(),
 			usedAt: timestamp("used_at"),
 			createdAt: timestamp("created_at").defaultNow().notNull()
+		}),
+		magicLinkTokens: tableCreator("magic_link_tokens", {
+			id: uuid("id").defaultRandom().primaryKey(),
+			userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+			tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
+			expiresAt: timestamp("expires_at").notNull(),
+			usedAt: timestamp("used_at"),
+			createdAt: timestamp("created_at").defaultNow().notNull()
 		})
 	};
 }
@@ -7159,12 +7667,14 @@ var userIdentities = defaultAuthSchema.userIdentities;
 var mfaFactors = defaultAuthSchema.mfaFactors;
 var mfaChallenges = defaultAuthSchema.mfaChallenges;
 var recoveryCodes = defaultAuthSchema.recoveryCodes;
+var magicLinkTokens = defaultAuthSchema.magicLinkTokens;
 var usersRelations = relations(users, ({ many }) => ({
 	refreshTokens: many(refreshTokens),
 	passwordResetTokens: many(passwordResetTokens),
 	userIdentities: many(userIdentities),
 	mfaFactors: many(mfaFactors),
-	recoveryCodes: many(recoveryCodes)
+	recoveryCodes: many(recoveryCodes),
+	magicLinkTokens: many(magicLinkTokens)
 }));
 var refreshTokensRelations = relations(refreshTokens, ({ one }) => ({ user: one(users, {
 	fields: [refreshTokens.userId],
@@ -7193,6 +7703,93 @@ var recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({ user: one(
 	fields: [recoveryCodes.userId],
 	references: [users.id]
 }) }));
+var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user: one(users, {
+	fields: [magicLinkTokens.userId],
+	references: [users.id]
+}) }));
+//#endregion
+//#region src/schema/auth-default-policies.ts
+/**
+* Default RLS for authentication collections.
+*
+* Users are persisted through the same write path as any other collection —
+* the only thing that distinguishes them is the `auth` flag. That means
+* privileged columns (most importantly `roles`) would be editable by any
+* authenticated user unless the collection author remembers to write a correct
+* admin-only write policy.
+*
+* To make this safe by default, the schema generator injects two policies for
+* every write operation on an auth collection. Enforcement lives in the
+* database (RLS), so it applies to every write path — REST, WebSocket, and any
+* internal caller — not just one entry point:
+*
+*  1. A **restrictive** admin gate. Restrictive policies are AND'd with every
+*     other policy, so this guarantees a write is rejected unless the caller is
+*     an admin (or the trusted server context) — even if the author also wrote
+*     a permissive rule such as "a user may edit their own row". Without this,
+*     a permissive owner rule would let a user change their own `roles`.
+*
+*  2. A **permissive** admin grant. Restrictive policies only constrain; at
+*     least one permissive policy must also pass for the write to be allowed.
+*     This grants the baseline write so admins (and the server context) can
+*     manage users even when the collection has no other permissive write rule.
+*
+* Both mirror the framework's trusted-server convention: the write is allowed
+* when there is no authenticated user context (`auth.uid() IS NULL`, used by
+* the built-in auth flows that run as the service role) OR the caller holds the
+* `admin` role. Net effect: only admins (or the server) can write the row, and
+* therefore only admins can change privileged columns like `roles`.
+*
+* Author-provided write rules are preserved but cannot loosen this guarantee —
+* a non-admin write is always blocked by the restrictive gate. To take full
+* control of an auth collection's write authorization, set
+* `disableDefaultAuthPolicies: true` on the collection.
+*/
+var ADMIN_WRITE_EXPR = policy.or(policy.not(policy.authenticated()), policy.rolesOverlap(["admin"]));
+/** Write operations that must be admin-gated by default on auth collections. */
+var DEFAULT_GUARDED_OPS = [
+	"insert",
+	"update",
+	"delete"
+];
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection) {
+	const auth = collection.auth;
+	return auth === true || typeof auth === "object" && auth?.enabled === true;
+}
+/**
+* Returns the security rules that should be applied to a collection: the
+* author's explicit `securityRules`, plus, for auth collections, an
+* auto-injected restrictive admin gate and permissive admin grant on every
+* write operation. Together these guarantee only admins (or the trusted server
+* context) can write the row.
+*
+* Non-auth collections, and auth collections that opt out via
+* `disableDefaultAuthPolicies`, are returned unchanged.
+*/
+function getEffectiveSecurityRules(collection) {
+	const explicit = (isPostgresCollection(collection) ? collection.securityRules : void 0) ?? [];
+	if (!isAuthCollection(collection) || collection.disableDefaultAuthPolicies) return explicit;
+	const tableName = getTableName$1(collection);
+	const requireAdminGate = {
+		name: `${tableName}_require_admin_write`,
+		mode: "restrictive",
+		operations: [...DEFAULT_GUARDED_OPS],
+		condition: ADMIN_WRITE_EXPR,
+		check: ADMIN_WRITE_EXPR
+	};
+	const allowAdminWrite = {
+		name: `${tableName}_default_admin_write`,
+		operations: [...DEFAULT_GUARDED_OPS],
+		condition: ADMIN_WRITE_EXPR,
+		check: ADMIN_WRITE_EXPR
+	};
+	return [
+		...explicit,
+		allowAdminWrite,
+		requireAdminGate
+	];
+}
 //#endregion
 //#region src/schema/generate-drizzle-schema-logic.ts
 /**
@@ -7269,7 +7866,7 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}("${colName}")`;
 			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid("${colName}")`;
 			else if (stringProp.columnType === "uuid") columnDefinition = `uuid("${colName}")`;
-			else if (stringProp.columnType === "text") columnDefinition = `text("${colName}")`;
+			else if (stringProp.columnType === "text" || stringProp.ui?.markdown || stringProp.ui?.multiline) columnDefinition = `text("${colName}")`;
 			else if (stringProp.columnType === "char") columnDefinition = `char("${colName}")`;
 			else columnDefinition = `varchar("${colName}")`;
 			if (isIdProperty(propName, prop, collection)) columnDefinition += ".primaryKey()";
@@ -7388,47 +7985,9 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 	return `    ${propName}: ${columnDefinition}`;
 };
 /**
-* Resolves a raw SQL string, replacing `{column_name}` with `${table.column_name}`.
-* The result is wrapped in a Drizzle sql`` template literal.
-*/
-var resolveRawSql = (expression) => {
-	return `sql\`${expression.replace(/\{(\w+)\}/g, (_, col) => col)}\``;
-};
-/**
-* Wraps a SQL clause with a role check using AND.
-* Generates: `(<clause>) AND (string_to_array(auth.roles(), ',') && ARRAY['<role1>','<role2>'])`
-*/
-var wrapWithRoleCheck = (clause, roles) => {
-	const roleCondition = `string_to_array(auth.roles(), ',') && ${`ARRAY[${roles.map((r) => `'${r}'`).join(",")}]`}`;
-	return `sql\`(${unwrapSql(clause)}) AND (${roleCondition})\``;
-};
-/**
-* Extracts the inner expression from a `sql\`...\`` wrapper.
-*/
-var unwrapSql = (sqlExpr) => {
-	const match = sqlExpr.match(/^sql`(.*)`$/s);
-	return match ? match[1] : sqlExpr;
-};
-/**
-* Builds the USING clause for a policy based on shortcuts or raw SQL.
-*/
-var buildUsingClause = (rule, collection) => {
-	if (rule.using) return resolveRawSql(rule.using);
-	if (rule.access === "public") return "sql`true`";
-	if (rule.ownerField) {
-		const prop = collection.properties?.[rule.ownerField];
-		return `sql\`${resolveColumnName(rule.ownerField, prop)} = auth.uid()\``;
-	}
-	return null;
-};
-/**
-* Builds the WITH CHECK clause for a policy based on shortcuts or raw SQL.
-* Falls back to the USING clause if not explicitly provided.
+* Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
 */
-var buildWithCheckClause = (rule, collection) => {
-	if (rule.withCheck) return resolveRawSql(rule.withCheck);
-	return buildUsingClause(rule, collection);
-};
+var wrapSql = (clause) => `sql\`${clause}\``;
 /**
 * Generates a deterministic hash based on the rule configuration.
 */
@@ -7442,7 +8001,9 @@ var getPolicyNameHash = (rule) => {
 		rol: rule.roles?.slice().sort(),
 		pg: rule.pgRoles?.slice().sort(),
 		u: rule.using,
-		w: rule.withCheck
+		w: rule.withCheck,
+		c: rule.condition,
+		ch: rule.check
 	});
 	return createHash("sha1").update(data).digest("hex").substring(0, 7);
 };
@@ -7469,17 +8030,11 @@ var generatePolicyCode = (collection, rule, index) => {
 */
 var generateSinglePolicyCode = (collection, rule, operation, policyName) => {
 	const mode = rule.mode ?? "permissive";
-	const roles = rule.roles ? [...rule.roles].sort() : void 0;
 	const needsUsing = operation !== "insert";
 	const needsWithCheck = operation !== "select" && operation !== "delete";
-	let usingClause = needsUsing ? buildUsingClause(rule, collection) : null;
-	let withCheckClause = needsWithCheck ? buildWithCheckClause(rule, collection) : null;
-	if (roles && roles.length > 0) {
-		if (usingClause) usingClause = wrapWithRoleCheck(usingClause, roles);
-		else if (needsUsing) usingClause = `sql\`string_to_array(auth.roles(), ',') && ${`ARRAY[${roles.map((r) => `'${r}'`).join(",")}]`}\``;
-		if (withCheckClause) withCheckClause = wrapWithRoleCheck(withCheckClause, roles);
-		else if (needsWithCheck) withCheckClause = `sql\`string_to_array(auth.roles(), ',') && ${`ARRAY[${roles.map((r) => `'${r}'`).join(",")}]`}\``;
-	}
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	let usingClause = needsUsing && usingExpr ? wrapSql(policyToPostgres(usingExpr, collection)) : null;
+	let withCheckClause = needsWithCheck && withCheckExpr ? wrapSql(policyToPostgres(withCheckExpr, collection)) : null;
 	if (!usingClause && needsUsing) usingClause = "sql`false`";
 	if (!withCheckClause && needsWithCheck) withCheckClause = "sql`false`";
 	const parts = [];
@@ -7587,7 +8142,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 			if ("enum" in prop && (prop.type === "string" || prop.type === "number") && prop.enum) {
 				const enumVarName = getEnumVarName(collectionPath, propName);
 				const enumDbName = `${collectionPath}_${resolveColumnName(propName, prop)}`;
-				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(v.id ?? v)) : Object.keys(prop.enum);
+				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
 				if (values.length > 0) {
 					schemaContent += `export const ${enumVarName} = pgEnum(\"${enumDbName}\", [${values.map((v) => `'${v}'`).join(", ")}]);\n`;
 					if (!exportedEnumVars.includes(enumVarName)) exportedEnumVars.push(enumVarName);
@@ -7644,8 +8199,8 @@ var generateSchema = async (collections, stripPolicies = false) => {
 			});
 			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: varchar(\"id\").primaryKey()");
 			schemaContent += `${Array.from(columns).join(",\n")}`;
-			const securityRules = isPostgresCollection(collection) ? collection.securityRules : void 0;
-			if (!stripPolicies && securityRules && securityRules.length > 0) {
+			const securityRules = getEffectiveSecurityRules(collection);
+			if (!stripPolicies && securityRules.length > 0) {
 				schemaContent += "\n}, (table) => ([\n";
 				securityRules.forEach((rule, idx) => {
 					schemaContent += generatePolicyCode(collection, rule, idx);
@@ -7781,8 +8336,7 @@ var runGeneration = async (collectionsFilePath, outputPath) => {
 			for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") {
 				const filePath = path.join(resolvedPath, file);
 				try {
-					const fileUrl = pathToFileURL(filePath).href;
-					const module = await new Function("url", "return import(url)")(fileUrl);
+					const module = await import(pathToFileURL(filePath).href);
 					if (module && module.default) collections.push(module.default);
 				} catch (err) {
 					const message = err instanceof Error ? err.message : String(err);
@@ -7790,8 +8344,7 @@ var runGeneration = async (collectionsFilePath, outputPath) => {
 				}
 			}
 		} else {
-			const fileUrl = pathToFileURL(resolvedPath).href + `?t=${Date.now()}`;
-			const imported = await new Function("url", "return import(url)")(fileUrl);
+			const imported = await import(pathToFileURL(resolvedPath).href + `?t=${Date.now()}`);
 			collections = imported.backendCollections || imported.collections;
 		}
 		if (!collections || !Array.isArray(collections)) collections = [];
@@ -7801,7 +8354,7 @@ var runGeneration = async (collectionsFilePath, outputPath) => {
 			const outputDir = path.dirname(outputPath);
 			await promises.mkdir(outputDir, { recursive: true });
 			await promises.writeFile(outputPath, schemaContent);
-			logger.info("✅ Drizzle schema generated successfully at", { detail: outputPath });
+			logger.info(`✅ Drizzle schema generated successfully at ${outputPath}`);
 		} else {
 			logger.info("✅ Drizzle schema generated successfully.");
 			logger.info(String(schemaContent));
@@ -8236,8 +8789,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					...registryCollection
 				} : registryCollection;
 				const callbacks = resolvedCollection?.callbacks;
+				const globalCallbacks = this.registry?.getGlobalCallbacks();
 				const propertyCallbacks = resolvedCollection?.properties ? buildPropertyCallbacks(resolvedCollection.properties) : void 0;
-				if (callbacks?.afterRead || propertyCallbacks?.afterRead) {
+				if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
 					const contextForCallback = {
 						user: {
 							uid: activeAuth.userId,
@@ -8248,6 +8802,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					};
 					return await Promise.all(fetchedEntities.map(async (entity) => {
 						let processedEntity = entity;
+						if (globalCallbacks?.afterRead) processedEntity = await globalCallbacks.afterRead({
+							collection: resolvedCollection,
+							path: notifyPath,
+							entity: processedEntity,
+							context: contextForCallback
+						}) ?? processedEntity;
 						if (callbacks?.afterRead) processedEntity = await callbacks.afterRead({
 							collection: resolvedCollection,
 							path: notifyPath,
@@ -8344,8 +8904,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 						...registryCollection
 					} : registryCollection;
 					const callbacks = resolvedCollection?.callbacks;
+					const globalCallbacks = this.registry?.getGlobalCallbacks();
 					const propertyCallbacks = resolvedCollection?.properties ? buildPropertyCallbacks(resolvedCollection.properties) : void 0;
-					if (callbacks?.afterRead || propertyCallbacks?.afterRead) {
+					if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
 						const contextForCallback = {
 							user: {
 								uid: activeAuth.userId,
@@ -8354,6 +8915,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 							driver: this.driver,
 							data: this.driver && "data" in this.driver ? this.driver.data : void 0
 						};
+						if (globalCallbacks?.afterRead) processedEntity = await globalCallbacks.afterRead({
+							collection: resolvedCollection,
+							path: notifyPath,
+							entity: processedEntity,
+							context: contextForCallback
+						}) ?? processedEntity;
 						if (callbacks?.afterRead) processedEntity = await callbacks.afterRead({
 							collection: resolvedCollection,
 							path: notifyPath,
@@ -8967,6 +9534,15 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 								}
 								const result = await admin.executeSql(sql, options);
 								if (process.env.NODE_ENV !== "production") wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
+								const auditSession = clientSessions.get(clientId);
+								console.log("[SQL Audit] WebSocket SQL execution", JSON.stringify({
+									sql: typeof sql === "string" ? sql.substring(0, 500) : sql,
+									options,
+									resultRows: Array.isArray(result) ? result.length : "unknown",
+									userId: auditSession?.user?.userId ?? "unknown",
+									roles: auditSession?.user?.roles ?? [],
+									isAdmin: auditSession?.user?.isAdmin ?? false
+								}));
 								const response = {
 									type: "EXECUTE_SQL_SUCCESS",
 									payload: { result },
@@ -9181,10 +9757,10 @@ var PostgresCollectionRegistry = class extends CollectionRegistry {
 		return Array.from(this.tables.keys());
 	}
 	/**
-	* Finds collections assigned to a specific driver that do not have a registered table.
+	* Finds collections assigned to a specific data source that do not have a registered table.
 	*/
-	getCollectionsWithoutTables(driverId = "(default)") {
-		return this.getCollections().filter((c) => c.driver === driverId || !c.driver && driverId === "(default)").filter((c) => !this.tables.has(getTableName$1(c)));
+	getCollectionsWithoutTables(dataSourceKey = "(default)") {
+		return this.getCollections().filter((c) => c.dataSource === dataSourceKey || !c.dataSource && dataSourceKey === "(default)").filter((c) => !this.tables.has(getTableName$1(c)));
 	}
 	registerEnums(enums) {
 		Object.entries(enums).forEach(([name, value]) => this.enums.set(name, value));
@@ -9221,7 +9797,7 @@ var PostgresCollectionRegistry = class extends CollectionRegistry {
 	*/
 	getRelationKeysForCollection(collectionPath) {
 		const collection = this.getCollectionByPath(collectionPath);
-		if (!collection || !getDataSourceCapabilities(collection.driver).supportsRelations || !collection.relations) return [];
+		if (!collection || !getDataSourceCapabilities(collection.engine).supportsRelations || !collection.relations) return [];
 		return collection.relations.map((r) => r.relationName || r.localKey || "").filter(Boolean);
 	}
 };
@@ -9277,6 +9853,24 @@ async function ensureAuthTablesExist(db, collection) {
 		const refreshTokensTableName = `"${authSchema}"."refresh_tokens"`;
 		const passwordResetTokensTableName = `"${authSchema}"."password_reset_tokens"`;
 		const appConfigTableName = `"${authSchema}"."app_config"`;
+		const idDefault = userIdType === "UUID" ? "DEFAULT gen_random_uuid()" : userIdType === "INTEGER" ? "GENERATED ALWAYS AS IDENTITY" : "DEFAULT gen_random_uuid()::text";
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS ${sql.raw(usersTableName)} (
+                id ${sql.raw(userIdType)} PRIMARY KEY ${sql.raw(idDefault)},
+                email VARCHAR(255) UNIQUE NOT NULL,
+                display_name VARCHAR(255),
+                photo_url VARCHAR(500),
+                roles TEXT[] DEFAULT '{}' NOT NULL,
+                password_hash VARCHAR(255),
+                email_verified BOOLEAN DEFAULT FALSE NOT NULL,
+                email_verification_token VARCHAR(255),
+                email_verification_sent_at TIMESTAMP WITH TIME ZONE,
+                is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
+                metadata JSONB DEFAULT '{}' NOT NULL,
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
+                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
+            )
+        `);
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(userIdentitiesTable)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
@@ -9330,6 +9924,25 @@ async function ensureAuthTablesExist(db, collection) {
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user 
             ON ${sql.raw(passwordResetTokensTableName)}(user_id)
+        `);
+		const magicLinkTokensTableName = `"${authSchema}"."magic_link_tokens"`;
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS ${sql.raw(magicLinkTokensTableName)} (
+                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                token_hash TEXT NOT NULL UNIQUE,
+                expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+                used_at TIMESTAMP WITH TIME ZONE,
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+            )
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_magic_link_tokens_hash 
+            ON ${sql.raw(magicLinkTokensTableName)}(token_hash)
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_magic_link_tokens_user 
+            ON ${sql.raw(magicLinkTokensTableName)}(user_id)
         `);
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(appConfigTableName)} (
@@ -9942,6 +10555,53 @@ var PasswordResetTokenService = class {
 	}
 };
 /**
+* Magic link token service.
+* Handles magic link token storage for passwordless email login.
+*/
+var MagicLinkTokenService = class {
+	db;
+	magicLinkTokensTable;
+	constructor(db, tableOrTables) {
+		this.db = db;
+		this.magicLinkTokensTable = magicLinkTokens;
+	}
+	getQualifiedTableName() {
+		const name = getTableName(this.magicLinkTokensTable);
+		return `"${getTableConfig(this.magicLinkTokensTable).schema || "public"}"."${name}"`;
+	}
+	async createToken(userId, tokenHash, expiresAt) {
+		const tableName = this.getQualifiedTableName();
+		await this.db.execute(sql`
+            DELETE FROM ${sql.raw(tableName)} 
+            WHERE user_id = ${userId} AND used_at IS NULL
+        `);
+		await this.db.insert(this.magicLinkTokensTable).values({
+			userId,
+			tokenHash,
+			expiresAt
+		});
+	}
+	async findValidByHash(tokenHash) {
+		const tableName = this.getQualifiedTableName();
+		const result = await this.db.execute(sql`
+            SELECT user_id, expires_at 
+            FROM ${sql.raw(tableName)} 
+            WHERE token_hash = ${tokenHash} 
+              AND used_at IS NULL 
+              AND expires_at > NOW()
+        `);
+		if (result.rows.length === 0) return null;
+		const row = result.rows[0];
+		return {
+			userId: row.user_id,
+			expiresAt: new Date(row.expires_at)
+		};
+	}
+	async markAsUsed(tokenHash) {
+		await this.db.update(this.magicLinkTokensTable).set({ usedAt: /* @__PURE__ */ new Date() }).where(eq(this.magicLinkTokensTable.tokenHash, tokenHash));
+	}
+};
+/**
 * PostgreSQL implementation of TokenRepository.
 * Combines refresh token and password reset token operations.
 */
@@ -9949,10 +10609,12 @@ var PostgresTokenRepository = class {
 	db;
 	refreshTokenService;
 	passwordResetTokenService;
+	magicLinkTokenService;
 	constructor(db, tableOrTables) {
 		this.db = db;
 		this.refreshTokenService = new RefreshTokenService(db, tableOrTables);
 		this.passwordResetTokenService = new PasswordResetTokenService(db, tableOrTables);
+		this.magicLinkTokenService = new MagicLinkTokenService(db, tableOrTables);
 	}
 	async createRefreshToken(userId, tokenHash, expiresAt, userAgent, ipAddress) {
 		await this.refreshTokenService.createToken(userId, tokenHash, expiresAt, userAgent, ipAddress);
@@ -9987,6 +10649,15 @@ var PostgresTokenRepository = class {
 	async deleteExpiredTokens() {
 		await this.passwordResetTokenService.deleteExpired();
 	}
+	async createMagicLinkToken(userId, tokenHash, expiresAt) {
+		await this.magicLinkTokenService.createToken(userId, tokenHash, expiresAt);
+	}
+	async findValidMagicLinkToken(tokenHash) {
+		return this.magicLinkTokenService.findValidByHash(tokenHash);
+	}
+	async markMagicLinkTokenUsed(tokenHash) {
+		await this.magicLinkTokenService.markAsUsed(tokenHash);
+	}
 };
 /**
 * PostgreSQL implementation of AuthRepository.
@@ -10145,6 +10816,15 @@ var PostgresAuthRepository = class {
 	async deleteExpiredTokens() {
 		await this.tokenRepository.deleteExpiredTokens();
 	}
+	async createMagicLinkToken(userId, tokenHash, expiresAt) {
+		await this.tokenRepository.createMagicLinkToken(userId, tokenHash, expiresAt);
+	}
+	async findValidMagicLinkToken(tokenHash) {
+		return this.tokenRepository.findValidMagicLinkToken(tokenHash);
+	}
+	async markMagicLinkTokenUsed(tokenHash) {
+		await this.tokenRepository.markMagicLinkTokenUsed(tokenHash);
+	}
 	_mfaService = null;
 	getMfaService() {
 		if (!this._mfaService) this._mfaService = new MfaService(this.db);
@@ -10590,6 +11270,2071 @@ function patchPgArrayNullSafety(tables) {
 	if (patchedCount > 0) logger.debug(`[PgArray] Patched ${patchedCount} array column(s) for null-safety`);
 }
 //#endregion
+//#region ../../node_modules/.pnpm/color-name@1.1.4/node_modules/color-name/index.js
+var require_color_name = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = {
+		"aliceblue": [
+			240,
+			248,
+			255
+		],
+		"antiquewhite": [
+			250,
+			235,
+			215
+		],
+		"aqua": [
+			0,
+			255,
+			255
+		],
+		"aquamarine": [
+			127,
+			255,
+			212
+		],
+		"azure": [
+			240,
+			255,
+			255
+		],
+		"beige": [
+			245,
+			245,
+			220
+		],
+		"bisque": [
+			255,
+			228,
+			196
+		],
+		"black": [
+			0,
+			0,
+			0
+		],
+		"blanchedalmond": [
+			255,
+			235,
+			205
+		],
+		"blue": [
+			0,
+			0,
+			255
+		],
+		"blueviolet": [
+			138,
+			43,
+			226
+		],
+		"brown": [
+			165,
+			42,
+			42
+		],
+		"burlywood": [
+			222,
+			184,
+			135
+		],
+		"cadetblue": [
+			95,
+			158,
+			160
+		],
+		"chartreuse": [
+			127,
+			255,
+			0
+		],
+		"chocolate": [
+			210,
+			105,
+			30
+		],
+		"coral": [
+			255,
+			127,
+			80
+		],
+		"cornflowerblue": [
+			100,
+			149,
+			237
+		],
+		"cornsilk": [
+			255,
+			248,
+			220
+		],
+		"crimson": [
+			220,
+			20,
+			60
+		],
+		"cyan": [
+			0,
+			255,
+			255
+		],
+		"darkblue": [
+			0,
+			0,
+			139
+		],
+		"darkcyan": [
+			0,
+			139,
+			139
+		],
+		"darkgoldenrod": [
+			184,
+			134,
+			11
+		],
+		"darkgray": [
+			169,
+			169,
+			169
+		],
+		"darkgreen": [
+			0,
+			100,
+			0
+		],
+		"darkgrey": [
+			169,
+			169,
+			169
+		],
+		"darkkhaki": [
+			189,
+			183,
+			107
+		],
+		"darkmagenta": [
+			139,
+			0,
+			139
+		],
+		"darkolivegreen": [
+			85,
+			107,
+			47
+		],
+		"darkorange": [
+			255,
+			140,
+			0
+		],
+		"darkorchid": [
+			153,
+			50,
+			204
+		],
+		"darkred": [
+			139,
+			0,
+			0
+		],
+		"darksalmon": [
+			233,
+			150,
+			122
+		],
+		"darkseagreen": [
+			143,
+			188,
+			143
+		],
+		"darkslateblue": [
+			72,
+			61,
+			139
+		],
+		"darkslategray": [
+			47,
+			79,
+			79
+		],
+		"darkslategrey": [
+			47,
+			79,
+			79
+		],
+		"darkturquoise": [
+			0,
+			206,
+			209
+		],
+		"darkviolet": [
+			148,
+			0,
+			211
+		],
+		"deeppink": [
+			255,
+			20,
+			147
+		],
+		"deepskyblue": [
+			0,
+			191,
+			255
+		],
+		"dimgray": [
+			105,
+			105,
+			105
+		],
+		"dimgrey": [
+			105,
+			105,
+			105
+		],
+		"dodgerblue": [
+			30,
+			144,
+			255
+		],
+		"firebrick": [
+			178,
+			34,
+			34
+		],
+		"floralwhite": [
+			255,
+			250,
+			240
+		],
+		"forestgreen": [
+			34,
+			139,
+			34
+		],
+		"fuchsia": [
+			255,
+			0,
+			255
+		],
+		"gainsboro": [
+			220,
+			220,
+			220
+		],
+		"ghostwhite": [
+			248,
+			248,
+			255
+		],
+		"gold": [
+			255,
+			215,
+			0
+		],
+		"goldenrod": [
+			218,
+			165,
+			32
+		],
+		"gray": [
+			128,
+			128,
+			128
+		],
+		"green": [
+			0,
+			128,
+			0
+		],
+		"greenyellow": [
+			173,
+			255,
+			47
+		],
+		"grey": [
+			128,
+			128,
+			128
+		],
+		"honeydew": [
+			240,
+			255,
+			240
+		],
+		"hotpink": [
+			255,
+			105,
+			180
+		],
+		"indianred": [
+			205,
+			92,
+			92
+		],
+		"indigo": [
+			75,
+			0,
+			130
+		],
+		"ivory": [
+			255,
+			255,
+			240
+		],
+		"khaki": [
+			240,
+			230,
+			140
+		],
+		"lavender": [
+			230,
+			230,
+			250
+		],
+		"lavenderblush": [
+			255,
+			240,
+			245
+		],
+		"lawngreen": [
+			124,
+			252,
+			0
+		],
+		"lemonchiffon": [
+			255,
+			250,
+			205
+		],
+		"lightblue": [
+			173,
+			216,
+			230
+		],
+		"lightcoral": [
+			240,
+			128,
+			128
+		],
+		"lightcyan": [
+			224,
+			255,
+			255
+		],
+		"lightgoldenrodyellow": [
+			250,
+			250,
+			210
+		],
+		"lightgray": [
+			211,
+			211,
+			211
+		],
+		"lightgreen": [
+			144,
+			238,
+			144
+		],
+		"lightgrey": [
+			211,
+			211,
+			211
+		],
+		"lightpink": [
+			255,
+			182,
+			193
+		],
+		"lightsalmon": [
+			255,
+			160,
+			122
+		],
+		"lightseagreen": [
+			32,
+			178,
+			170
+		],
+		"lightskyblue": [
+			135,
+			206,
+			250
+		],
+		"lightslategray": [
+			119,
+			136,
+			153
+		],
+		"lightslategrey": [
+			119,
+			136,
+			153
+		],
+		"lightsteelblue": [
+			176,
+			196,
+			222
+		],
+		"lightyellow": [
+			255,
+			255,
+			224
+		],
+		"lime": [
+			0,
+			255,
+			0
+		],
+		"limegreen": [
+			50,
+			205,
+			50
+		],
+		"linen": [
+			250,
+			240,
+			230
+		],
+		"magenta": [
+			255,
+			0,
+			255
+		],
+		"maroon": [
+			128,
+			0,
+			0
+		],
+		"mediumaquamarine": [
+			102,
+			205,
+			170
+		],
+		"mediumblue": [
+			0,
+			0,
+			205
+		],
+		"mediumorchid": [
+			186,
+			85,
+			211
+		],
+		"mediumpurple": [
+			147,
+			112,
+			219
+		],
+		"mediumseagreen": [
+			60,
+			179,
+			113
+		],
+		"mediumslateblue": [
+			123,
+			104,
+			238
+		],
+		"mediumspringgreen": [
+			0,
+			250,
+			154
+		],
+		"mediumturquoise": [
+			72,
+			209,
+			204
+		],
+		"mediumvioletred": [
+			199,
+			21,
+			133
+		],
+		"midnightblue": [
+			25,
+			25,
+			112
+		],
+		"mintcream": [
+			245,
+			255,
+			250
+		],
+		"mistyrose": [
+			255,
+			228,
+			225
+		],
+		"moccasin": [
+			255,
+			228,
+			181
+		],
+		"navajowhite": [
+			255,
+			222,
+			173
+		],
+		"navy": [
+			0,
+			0,
+			128
+		],
+		"oldlace": [
+			253,
+			245,
+			230
+		],
+		"olive": [
+			128,
+			128,
+			0
+		],
+		"olivedrab": [
+			107,
+			142,
+			35
+		],
+		"orange": [
+			255,
+			165,
+			0
+		],
+		"orangered": [
+			255,
+			69,
+			0
+		],
+		"orchid": [
+			218,
+			112,
+			214
+		],
+		"palegoldenrod": [
+			238,
+			232,
+			170
+		],
+		"palegreen": [
+			152,
+			251,
+			152
+		],
+		"paleturquoise": [
+			175,
+			238,
+			238
+		],
+		"palevioletred": [
+			219,
+			112,
+			147
+		],
+		"papayawhip": [
+			255,
+			239,
+			213
+		],
+		"peachpuff": [
+			255,
+			218,
+			185
+		],
+		"peru": [
+			205,
+			133,
+			63
+		],
+		"pink": [
+			255,
+			192,
+			203
+		],
+		"plum": [
+			221,
+			160,
+			221
+		],
+		"powderblue": [
+			176,
+			224,
+			230
+		],
+		"purple": [
+			128,
+			0,
+			128
+		],
+		"rebeccapurple": [
+			102,
+			51,
+			153
+		],
+		"red": [
+			255,
+			0,
+			0
+		],
+		"rosybrown": [
+			188,
+			143,
+			143
+		],
+		"royalblue": [
+			65,
+			105,
+			225
+		],
+		"saddlebrown": [
+			139,
+			69,
+			19
+		],
+		"salmon": [
+			250,
+			128,
+			114
+		],
+		"sandybrown": [
+			244,
+			164,
+			96
+		],
+		"seagreen": [
+			46,
+			139,
+			87
+		],
+		"seashell": [
+			255,
+			245,
+			238
+		],
+		"sienna": [
+			160,
+			82,
+			45
+		],
+		"silver": [
+			192,
+			192,
+			192
+		],
+		"skyblue": [
+			135,
+			206,
+			235
+		],
+		"slateblue": [
+			106,
+			90,
+			205
+		],
+		"slategray": [
+			112,
+			128,
+			144
+		],
+		"slategrey": [
+			112,
+			128,
+			144
+		],
+		"snow": [
+			255,
+			250,
+			250
+		],
+		"springgreen": [
+			0,
+			255,
+			127
+		],
+		"steelblue": [
+			70,
+			130,
+			180
+		],
+		"tan": [
+			210,
+			180,
+			140
+		],
+		"teal": [
+			0,
+			128,
+			128
+		],
+		"thistle": [
+			216,
+			191,
+			216
+		],
+		"tomato": [
+			255,
+			99,
+			71
+		],
+		"turquoise": [
+			64,
+			224,
+			208
+		],
+		"violet": [
+			238,
+			130,
+			238
+		],
+		"wheat": [
+			245,
+			222,
+			179
+		],
+		"white": [
+			255,
+			255,
+			255
+		],
+		"whitesmoke": [
+			245,
+			245,
+			245
+		],
+		"yellow": [
+			255,
+			255,
+			0
+		],
+		"yellowgreen": [
+			154,
+			205,
+			50
+		]
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/color-convert@2.0.1/node_modules/color-convert/conversions.js
+var require_conversions = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var cssKeywords = require_color_name();
+	var reverseKeywords = {};
+	for (const key of Object.keys(cssKeywords)) reverseKeywords[cssKeywords[key]] = key;
+	var convert = {
+		rgb: {
+			channels: 3,
+			labels: "rgb"
+		},
+		hsl: {
+			channels: 3,
+			labels: "hsl"
+		},
+		hsv: {
+			channels: 3,
+			labels: "hsv"
+		},
+		hwb: {
+			channels: 3,
+			labels: "hwb"
+		},
+		cmyk: {
+			channels: 4,
+			labels: "cmyk"
+		},
+		xyz: {
+			channels: 3,
+			labels: "xyz"
+		},
+		lab: {
+			channels: 3,
+			labels: "lab"
+		},
+		lch: {
+			channels: 3,
+			labels: "lch"
+		},
+		hex: {
+			channels: 1,
+			labels: ["hex"]
+		},
+		keyword: {
+			channels: 1,
+			labels: ["keyword"]
+		},
+		ansi16: {
+			channels: 1,
+			labels: ["ansi16"]
+		},
+		ansi256: {
+			channels: 1,
+			labels: ["ansi256"]
+		},
+		hcg: {
+			channels: 3,
+			labels: [
+				"h",
+				"c",
+				"g"
+			]
+		},
+		apple: {
+			channels: 3,
+			labels: [
+				"r16",
+				"g16",
+				"b16"
+			]
+		},
+		gray: {
+			channels: 1,
+			labels: ["gray"]
+		}
+	};
+	module.exports = convert;
+	for (const model of Object.keys(convert)) {
+		if (!("channels" in convert[model])) throw new Error("missing channels property: " + model);
+		if (!("labels" in convert[model])) throw new Error("missing channel labels property: " + model);
+		if (convert[model].labels.length !== convert[model].channels) throw new Error("channel and label counts mismatch: " + model);
+		const { channels, labels } = convert[model];
+		delete convert[model].channels;
+		delete convert[model].labels;
+		Object.defineProperty(convert[model], "channels", { value: channels });
+		Object.defineProperty(convert[model], "labels", { value: labels });
+	}
+	convert.rgb.hsl = function(rgb) {
+		const r = rgb[0] / 255;
+		const g = rgb[1] / 255;
+		const b = rgb[2] / 255;
+		const min = Math.min(r, g, b);
+		const max = Math.max(r, g, b);
+		const delta = max - min;
+		let h;
+		let s;
+		if (max === min) h = 0;
+		else if (r === max) h = (g - b) / delta;
+		else if (g === max) h = 2 + (b - r) / delta;
+		else if (b === max) h = 4 + (r - g) / delta;
+		h = Math.min(h * 60, 360);
+		if (h < 0) h += 360;
+		const l = (min + max) / 2;
+		if (max === min) s = 0;
+		else if (l <= .5) s = delta / (max + min);
+		else s = delta / (2 - max - min);
+		return [
+			h,
+			s * 100,
+			l * 100
+		];
+	};
+	convert.rgb.hsv = function(rgb) {
+		let rdif;
+		let gdif;
+		let bdif;
+		let h;
+		let s;
+		const r = rgb[0] / 255;
+		const g = rgb[1] / 255;
+		const b = rgb[2] / 255;
+		const v = Math.max(r, g, b);
+		const diff = v - Math.min(r, g, b);
+		const diffc = function(c) {
+			return (v - c) / 6 / diff + 1 / 2;
+		};
+		if (diff === 0) {
+			h = 0;
+			s = 0;
+		} else {
+			s = diff / v;
+			rdif = diffc(r);
+			gdif = diffc(g);
+			bdif = diffc(b);
+			if (r === v) h = bdif - gdif;
+			else if (g === v) h = 1 / 3 + rdif - bdif;
+			else if (b === v) h = 2 / 3 + gdif - rdif;
+			if (h < 0) h += 1;
+			else if (h > 1) h -= 1;
+		}
+		return [
+			h * 360,
+			s * 100,
+			v * 100
+		];
+	};
+	convert.rgb.hwb = function(rgb) {
+		const r = rgb[0];
+		const g = rgb[1];
+		let b = rgb[2];
+		const h = convert.rgb.hsl(rgb)[0];
+		const w = 1 / 255 * Math.min(r, Math.min(g, b));
+		b = 1 - 1 / 255 * Math.max(r, Math.max(g, b));
+		return [
+			h,
+			w * 100,
+			b * 100
+		];
+	};
+	convert.rgb.cmyk = function(rgb) {
+		const r = rgb[0] / 255;
+		const g = rgb[1] / 255;
+		const b = rgb[2] / 255;
+		const k = Math.min(1 - r, 1 - g, 1 - b);
+		const c = (1 - r - k) / (1 - k) || 0;
+		const m = (1 - g - k) / (1 - k) || 0;
+		const y = (1 - b - k) / (1 - k) || 0;
+		return [
+			c * 100,
+			m * 100,
+			y * 100,
+			k * 100
+		];
+	};
+	function comparativeDistance(x, y) {
+		return (x[0] - y[0]) ** 2 + (x[1] - y[1]) ** 2 + (x[2] - y[2]) ** 2;
+	}
+	convert.rgb.keyword = function(rgb) {
+		const reversed = reverseKeywords[rgb];
+		if (reversed) return reversed;
+		let currentClosestDistance = Infinity;
+		let currentClosestKeyword;
+		for (const keyword of Object.keys(cssKeywords)) {
+			const value = cssKeywords[keyword];
+			const distance = comparativeDistance(rgb, value);
+			if (distance < currentClosestDistance) {
+				currentClosestDistance = distance;
+				currentClosestKeyword = keyword;
+			}
+		}
+		return currentClosestKeyword;
+	};
+	convert.keyword.rgb = function(keyword) {
+		return cssKeywords[keyword];
+	};
+	convert.rgb.xyz = function(rgb) {
+		let r = rgb[0] / 255;
+		let g = rgb[1] / 255;
+		let b = rgb[2] / 255;
+		r = r > .04045 ? ((r + .055) / 1.055) ** 2.4 : r / 12.92;
+		g = g > .04045 ? ((g + .055) / 1.055) ** 2.4 : g / 12.92;
+		b = b > .04045 ? ((b + .055) / 1.055) ** 2.4 : b / 12.92;
+		const x = r * .4124 + g * .3576 + b * .1805;
+		const y = r * .2126 + g * .7152 + b * .0722;
+		const z = r * .0193 + g * .1192 + b * .9505;
+		return [
+			x * 100,
+			y * 100,
+			z * 100
+		];
+	};
+	convert.rgb.lab = function(rgb) {
+		const xyz = convert.rgb.xyz(rgb);
+		let x = xyz[0];
+		let y = xyz[1];
+		let z = xyz[2];
+		x /= 95.047;
+		y /= 100;
+		z /= 108.883;
+		x = x > .008856 ? x ** (1 / 3) : 7.787 * x + 16 / 116;
+		y = y > .008856 ? y ** (1 / 3) : 7.787 * y + 16 / 116;
+		z = z > .008856 ? z ** (1 / 3) : 7.787 * z + 16 / 116;
+		return [
+			116 * y - 16,
+			500 * (x - y),
+			200 * (y - z)
+		];
+	};
+	convert.hsl.rgb = function(hsl) {
+		const h = hsl[0] / 360;
+		const s = hsl[1] / 100;
+		const l = hsl[2] / 100;
+		let t2;
+		let t3;
+		let val;
+		if (s === 0) {
+			val = l * 255;
+			return [
+				val,
+				val,
+				val
+			];
+		}
+		if (l < .5) t2 = l * (1 + s);
+		else t2 = l + s - l * s;
+		const t1 = 2 * l - t2;
+		const rgb = [
+			0,
+			0,
+			0
+		];
+		for (let i = 0; i < 3; i++) {
+			t3 = h + 1 / 3 * -(i - 1);
+			if (t3 < 0) t3++;
+			if (t3 > 1) t3--;
+			if (6 * t3 < 1) val = t1 + (t2 - t1) * 6 * t3;
+			else if (2 * t3 < 1) val = t2;
+			else if (3 * t3 < 2) val = t1 + (t2 - t1) * (2 / 3 - t3) * 6;
+			else val = t1;
+			rgb[i] = val * 255;
+		}
+		return rgb;
+	};
+	convert.hsl.hsv = function(hsl) {
+		const h = hsl[0];
+		let s = hsl[1] / 100;
+		let l = hsl[2] / 100;
+		let smin = s;
+		const lmin = Math.max(l, .01);
+		l *= 2;
+		s *= l <= 1 ? l : 2 - l;
+		smin *= lmin <= 1 ? lmin : 2 - lmin;
+		const v = (l + s) / 2;
+		return [
+			h,
+			(l === 0 ? 2 * smin / (lmin + smin) : 2 * s / (l + s)) * 100,
+			v * 100
+		];
+	};
+	convert.hsv.rgb = function(hsv) {
+		const h = hsv[0] / 60;
+		const s = hsv[1] / 100;
+		let v = hsv[2] / 100;
+		const hi = Math.floor(h) % 6;
+		const f = h - Math.floor(h);
+		const p = 255 * v * (1 - s);
+		const q = 255 * v * (1 - s * f);
+		const t = 255 * v * (1 - s * (1 - f));
+		v *= 255;
+		switch (hi) {
+			case 0: return [
+				v,
+				t,
+				p
+			];
+			case 1: return [
+				q,
+				v,
+				p
+			];
+			case 2: return [
+				p,
+				v,
+				t
+			];
+			case 3: return [
+				p,
+				q,
+				v
+			];
+			case 4: return [
+				t,
+				p,
+				v
+			];
+			case 5: return [
+				v,
+				p,
+				q
+			];
+		}
+	};
+	convert.hsv.hsl = function(hsv) {
+		const h = hsv[0];
+		const s = hsv[1] / 100;
+		const v = hsv[2] / 100;
+		const vmin = Math.max(v, .01);
+		let sl;
+		let l;
+		l = (2 - s) * v;
+		const lmin = (2 - s) * vmin;
+		sl = s * vmin;
+		sl /= lmin <= 1 ? lmin : 2 - lmin;
+		sl = sl || 0;
+		l /= 2;
+		return [
+			h,
+			sl * 100,
+			l * 100
+		];
+	};
+	convert.hwb.rgb = function(hwb) {
+		const h = hwb[0] / 360;
+		let wh = hwb[1] / 100;
+		let bl = hwb[2] / 100;
+		const ratio = wh + bl;
+		let f;
+		if (ratio > 1) {
+			wh /= ratio;
+			bl /= ratio;
+		}
+		const i = Math.floor(6 * h);
+		const v = 1 - bl;
+		f = 6 * h - i;
+		if ((i & 1) !== 0) f = 1 - f;
+		const n = wh + f * (v - wh);
+		let r;
+		let g;
+		let b;
+		switch (i) {
+			default:
+			case 6:
+			case 0:
+				r = v;
+				g = n;
+				b = wh;
+				break;
+			case 1:
+				r = n;
+				g = v;
+				b = wh;
+				break;
+			case 2:
+				r = wh;
+				g = v;
+				b = n;
+				break;
+			case 3:
+				r = wh;
+				g = n;
+				b = v;
+				break;
+			case 4:
+				r = n;
+				g = wh;
+				b = v;
+				break;
+			case 5:
+				r = v;
+				g = wh;
+				b = n;
+				break;
+		}
+		return [
+			r * 255,
+			g * 255,
+			b * 255
+		];
+	};
+	convert.cmyk.rgb = function(cmyk) {
+		const c = cmyk[0] / 100;
+		const m = cmyk[1] / 100;
+		const y = cmyk[2] / 100;
+		const k = cmyk[3] / 100;
+		const r = 1 - Math.min(1, c * (1 - k) + k);
+		const g = 1 - Math.min(1, m * (1 - k) + k);
+		const b = 1 - Math.min(1, y * (1 - k) + k);
+		return [
+			r * 255,
+			g * 255,
+			b * 255
+		];
+	};
+	convert.xyz.rgb = function(xyz) {
+		const x = xyz[0] / 100;
+		const y = xyz[1] / 100;
+		const z = xyz[2] / 100;
+		let r;
+		let g;
+		let b;
+		r = x * 3.2406 + y * -1.5372 + z * -.4986;
+		g = x * -.9689 + y * 1.8758 + z * .0415;
+		b = x * .0557 + y * -.204 + z * 1.057;
+		r = r > .0031308 ? 1.055 * r ** (1 / 2.4) - .055 : r * 12.92;
+		g = g > .0031308 ? 1.055 * g ** (1 / 2.4) - .055 : g * 12.92;
+		b = b > .0031308 ? 1.055 * b ** (1 / 2.4) - .055 : b * 12.92;
+		r = Math.min(Math.max(0, r), 1);
+		g = Math.min(Math.max(0, g), 1);
+		b = Math.min(Math.max(0, b), 1);
+		return [
+			r * 255,
+			g * 255,
+			b * 255
+		];
+	};
+	convert.xyz.lab = function(xyz) {
+		let x = xyz[0];
+		let y = xyz[1];
+		let z = xyz[2];
+		x /= 95.047;
+		y /= 100;
+		z /= 108.883;
+		x = x > .008856 ? x ** (1 / 3) : 7.787 * x + 16 / 116;
+		y = y > .008856 ? y ** (1 / 3) : 7.787 * y + 16 / 116;
+		z = z > .008856 ? z ** (1 / 3) : 7.787 * z + 16 / 116;
+		return [
+			116 * y - 16,
+			500 * (x - y),
+			200 * (y - z)
+		];
+	};
+	convert.lab.xyz = function(lab) {
+		const l = lab[0];
+		const a = lab[1];
+		const b = lab[2];
+		let x;
+		let y;
+		let z;
+		y = (l + 16) / 116;
+		x = a / 500 + y;
+		z = y - b / 200;
+		const y2 = y ** 3;
+		const x2 = x ** 3;
+		const z2 = z ** 3;
+		y = y2 > .008856 ? y2 : (y - 16 / 116) / 7.787;
+		x = x2 > .008856 ? x2 : (x - 16 / 116) / 7.787;
+		z = z2 > .008856 ? z2 : (z - 16 / 116) / 7.787;
+		x *= 95.047;
+		y *= 100;
+		z *= 108.883;
+		return [
+			x,
+			y,
+			z
+		];
+	};
+	convert.lab.lch = function(lab) {
+		const l = lab[0];
+		const a = lab[1];
+		const b = lab[2];
+		let h;
+		h = Math.atan2(b, a) * 360 / 2 / Math.PI;
+		if (h < 0) h += 360;
+		return [
+			l,
+			Math.sqrt(a * a + b * b),
+			h
+		];
+	};
+	convert.lch.lab = function(lch) {
+		const l = lch[0];
+		const c = lch[1];
+		const hr = lch[2] / 360 * 2 * Math.PI;
+		return [
+			l,
+			c * Math.cos(hr),
+			c * Math.sin(hr)
+		];
+	};
+	convert.rgb.ansi16 = function(args, saturation = null) {
+		const [r, g, b] = args;
+		let value = saturation === null ? convert.rgb.hsv(args)[2] : saturation;
+		value = Math.round(value / 50);
+		if (value === 0) return 30;
+		let ansi = 30 + (Math.round(b / 255) << 2 | Math.round(g / 255) << 1 | Math.round(r / 255));
+		if (value === 2) ansi += 60;
+		return ansi;
+	};
+	convert.hsv.ansi16 = function(args) {
+		return convert.rgb.ansi16(convert.hsv.rgb(args), args[2]);
+	};
+	convert.rgb.ansi256 = function(args) {
+		const r = args[0];
+		const g = args[1];
+		const b = args[2];
+		if (r === g && g === b) {
+			if (r < 8) return 16;
+			if (r > 248) return 231;
+			return Math.round((r - 8) / 247 * 24) + 232;
+		}
+		return 16 + 36 * Math.round(r / 255 * 5) + 6 * Math.round(g / 255 * 5) + Math.round(b / 255 * 5);
+	};
+	convert.ansi16.rgb = function(args) {
+		let color = args % 10;
+		if (color === 0 || color === 7) {
+			if (args > 50) color += 3.5;
+			color = color / 10.5 * 255;
+			return [
+				color,
+				color,
+				color
+			];
+		}
+		const mult = (~~(args > 50) + 1) * .5;
+		return [
+			(color & 1) * mult * 255,
+			(color >> 1 & 1) * mult * 255,
+			(color >> 2 & 1) * mult * 255
+		];
+	};
+	convert.ansi256.rgb = function(args) {
+		if (args >= 232) {
+			const c = (args - 232) * 10 + 8;
+			return [
+				c,
+				c,
+				c
+			];
+		}
+		args -= 16;
+		let rem;
+		return [
+			Math.floor(args / 36) / 5 * 255,
+			Math.floor((rem = args % 36) / 6) / 5 * 255,
+			rem % 6 / 5 * 255
+		];
+	};
+	convert.rgb.hex = function(args) {
+		const string = (((Math.round(args[0]) & 255) << 16) + ((Math.round(args[1]) & 255) << 8) + (Math.round(args[2]) & 255)).toString(16).toUpperCase();
+		return "000000".substring(string.length) + string;
+	};
+	convert.hex.rgb = function(args) {
+		const match = args.toString(16).match(/[a-f0-9]{6}|[a-f0-9]{3}/i);
+		if (!match) return [
+			0,
+			0,
+			0
+		];
+		let colorString = match[0];
+		if (match[0].length === 3) colorString = colorString.split("").map((char) => {
+			return char + char;
+		}).join("");
+		const integer = parseInt(colorString, 16);
+		return [
+			integer >> 16 & 255,
+			integer >> 8 & 255,
+			integer & 255
+		];
+	};
+	convert.rgb.hcg = function(rgb) {
+		const r = rgb[0] / 255;
+		const g = rgb[1] / 255;
+		const b = rgb[2] / 255;
+		const max = Math.max(Math.max(r, g), b);
+		const min = Math.min(Math.min(r, g), b);
+		const chroma = max - min;
+		let grayscale;
+		let hue;
+		if (chroma < 1) grayscale = min / (1 - chroma);
+		else grayscale = 0;
+		if (chroma <= 0) hue = 0;
+		else if (max === r) hue = (g - b) / chroma % 6;
+		else if (max === g) hue = 2 + (b - r) / chroma;
+		else hue = 4 + (r - g) / chroma;
+		hue /= 6;
+		hue %= 1;
+		return [
+			hue * 360,
+			chroma * 100,
+			grayscale * 100
+		];
+	};
+	convert.hsl.hcg = function(hsl) {
+		const s = hsl[1] / 100;
+		const l = hsl[2] / 100;
+		const c = l < .5 ? 2 * s * l : 2 * s * (1 - l);
+		let f = 0;
+		if (c < 1) f = (l - .5 * c) / (1 - c);
+		return [
+			hsl[0],
+			c * 100,
+			f * 100
+		];
+	};
+	convert.hsv.hcg = function(hsv) {
+		const s = hsv[1] / 100;
+		const v = hsv[2] / 100;
+		const c = s * v;
+		let f = 0;
+		if (c < 1) f = (v - c) / (1 - c);
+		return [
+			hsv[0],
+			c * 100,
+			f * 100
+		];
+	};
+	convert.hcg.rgb = function(hcg) {
+		const h = hcg[0] / 360;
+		const c = hcg[1] / 100;
+		const g = hcg[2] / 100;
+		if (c === 0) return [
+			g * 255,
+			g * 255,
+			g * 255
+		];
+		const pure = [
+			0,
+			0,
+			0
+		];
+		const hi = h % 1 * 6;
+		const v = hi % 1;
+		const w = 1 - v;
+		let mg = 0;
+		switch (Math.floor(hi)) {
+			case 0:
+				pure[0] = 1;
+				pure[1] = v;
+				pure[2] = 0;
+				break;
+			case 1:
+				pure[0] = w;
+				pure[1] = 1;
+				pure[2] = 0;
+				break;
+			case 2:
+				pure[0] = 0;
+				pure[1] = 1;
+				pure[2] = v;
+				break;
+			case 3:
+				pure[0] = 0;
+				pure[1] = w;
+				pure[2] = 1;
+				break;
+			case 4:
+				pure[0] = v;
+				pure[1] = 0;
+				pure[2] = 1;
+				break;
+			default:
+				pure[0] = 1;
+				pure[1] = 0;
+				pure[2] = w;
+		}
+		mg = (1 - c) * g;
+		return [
+			(c * pure[0] + mg) * 255,
+			(c * pure[1] + mg) * 255,
+			(c * pure[2] + mg) * 255
+		];
+	};
+	convert.hcg.hsv = function(hcg) {
+		const c = hcg[1] / 100;
+		const v = c + hcg[2] / 100 * (1 - c);
+		let f = 0;
+		if (v > 0) f = c / v;
+		return [
+			hcg[0],
+			f * 100,
+			v * 100
+		];
+	};
+	convert.hcg.hsl = function(hcg) {
+		const c = hcg[1] / 100;
+		const l = hcg[2] / 100 * (1 - c) + .5 * c;
+		let s = 0;
+		if (l > 0 && l < .5) s = c / (2 * l);
+		else if (l >= .5 && l < 1) s = c / (2 * (1 - l));
+		return [
+			hcg[0],
+			s * 100,
+			l * 100
+		];
+	};
+	convert.hcg.hwb = function(hcg) {
+		const c = hcg[1] / 100;
+		const v = c + hcg[2] / 100 * (1 - c);
+		return [
+			hcg[0],
+			(v - c) * 100,
+			(1 - v) * 100
+		];
+	};
+	convert.hwb.hcg = function(hwb) {
+		const w = hwb[1] / 100;
+		const v = 1 - hwb[2] / 100;
+		const c = v - w;
+		let g = 0;
+		if (c < 1) g = (v - c) / (1 - c);
+		return [
+			hwb[0],
+			c * 100,
+			g * 100
+		];
+	};
+	convert.apple.rgb = function(apple) {
+		return [
+			apple[0] / 65535 * 255,
+			apple[1] / 65535 * 255,
+			apple[2] / 65535 * 255
+		];
+	};
+	convert.rgb.apple = function(rgb) {
+		return [
+			rgb[0] / 255 * 65535,
+			rgb[1] / 255 * 65535,
+			rgb[2] / 255 * 65535
+		];
+	};
+	convert.gray.rgb = function(args) {
+		return [
+			args[0] / 100 * 255,
+			args[0] / 100 * 255,
+			args[0] / 100 * 255
+		];
+	};
+	convert.gray.hsl = function(args) {
+		return [
+			0,
+			0,
+			args[0]
+		];
+	};
+	convert.gray.hsv = convert.gray.hsl;
+	convert.gray.hwb = function(gray) {
+		return [
+			0,
+			100,
+			gray[0]
+		];
+	};
+	convert.gray.cmyk = function(gray) {
+		return [
+			0,
+			0,
+			0,
+			gray[0]
+		];
+	};
+	convert.gray.lab = function(gray) {
+		return [
+			gray[0],
+			0,
+			0
+		];
+	};
+	convert.gray.hex = function(gray) {
+		const val = Math.round(gray[0] / 100 * 255) & 255;
+		const string = ((val << 16) + (val << 8) + val).toString(16).toUpperCase();
+		return "000000".substring(string.length) + string;
+	};
+	convert.rgb.gray = function(rgb) {
+		return [(rgb[0] + rgb[1] + rgb[2]) / 3 / 255 * 100];
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/color-convert@2.0.1/node_modules/color-convert/route.js
+var require_route = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var conversions = require_conversions();
+	function buildGraph() {
+		const graph = {};
+		const models = Object.keys(conversions);
+		for (let len = models.length, i = 0; i < len; i++) graph[models[i]] = {
+			distance: -1,
+			parent: null
+		};
+		return graph;
+	}
+	function deriveBFS(fromModel) {
+		const graph = buildGraph();
+		const queue = [fromModel];
+		graph[fromModel].distance = 0;
+		while (queue.length) {
+			const current = queue.pop();
+			const adjacents = Object.keys(conversions[current]);
+			for (let len = adjacents.length, i = 0; i < len; i++) {
+				const adjacent = adjacents[i];
+				const node = graph[adjacent];
+				if (node.distance === -1) {
+					node.distance = graph[current].distance + 1;
+					node.parent = current;
+					queue.unshift(adjacent);
+				}
+			}
+		}
+		return graph;
+	}
+	function link(from, to) {
+		return function(args) {
+			return to(from(args));
+		};
+	}
+	function wrapConversion(toModel, graph) {
+		const path = [graph[toModel].parent, toModel];
+		let fn = conversions[graph[toModel].parent][toModel];
+		let cur = graph[toModel].parent;
+		while (graph[cur].parent) {
+			path.unshift(graph[cur].parent);
+			fn = link(conversions[graph[cur].parent][cur], fn);
+			cur = graph[cur].parent;
+		}
+		fn.conversion = path;
+		return fn;
+	}
+	module.exports = function(fromModel) {
+		const graph = deriveBFS(fromModel);
+		const conversion = {};
+		const models = Object.keys(graph);
+		for (let len = models.length, i = 0; i < len; i++) {
+			const toModel = models[i];
+			if (graph[toModel].parent === null) continue;
+			conversion[toModel] = wrapConversion(toModel, graph);
+		}
+		return conversion;
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/color-convert@2.0.1/node_modules/color-convert/index.js
+var require_color_convert = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var conversions = require_conversions();
+	var route = require_route();
+	var convert = {};
+	var models = Object.keys(conversions);
+	function wrapRaw(fn) {
+		const wrappedFn = function(...args) {
+			const arg0 = args[0];
+			if (arg0 === void 0 || arg0 === null) return arg0;
+			if (arg0.length > 1) args = arg0;
+			return fn(args);
+		};
+		if ("conversion" in fn) wrappedFn.conversion = fn.conversion;
+		return wrappedFn;
+	}
+	function wrapRounded(fn) {
+		const wrappedFn = function(...args) {
+			const arg0 = args[0];
+			if (arg0 === void 0 || arg0 === null) return arg0;
+			if (arg0.length > 1) args = arg0;
+			const result = fn(args);
+			if (typeof result === "object") for (let len = result.length, i = 0; i < len; i++) result[i] = Math.round(result[i]);
+			return result;
+		};
+		if ("conversion" in fn) wrappedFn.conversion = fn.conversion;
+		return wrappedFn;
+	}
+	models.forEach((fromModel) => {
+		convert[fromModel] = {};
+		Object.defineProperty(convert[fromModel], "channels", { value: conversions[fromModel].channels });
+		Object.defineProperty(convert[fromModel], "labels", { value: conversions[fromModel].labels });
+		const routes = route(fromModel);
+		Object.keys(routes).forEach((toModel) => {
+			const fn = routes[toModel];
+			convert[fromModel][toModel] = wrapRounded(fn);
+			convert[fromModel][toModel].raw = wrapRaw(fn);
+		});
+	});
+	module.exports = convert;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/ansi-styles@4.3.0/node_modules/ansi-styles/index.js
+var require_ansi_styles = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var wrapAnsi16 = (fn, offset) => (...args) => {
+		return `\u001B[${fn(...args) + offset}m`;
+	};
+	var wrapAnsi256 = (fn, offset) => (...args) => {
+		const code = fn(...args);
+		return `\u001B[${38 + offset};5;${code}m`;
+	};
+	var wrapAnsi16m = (fn, offset) => (...args) => {
+		const rgb = fn(...args);
+		return `\u001B[${38 + offset};2;${rgb[0]};${rgb[1]};${rgb[2]}m`;
+	};
+	var ansi2ansi = (n) => n;
+	var rgb2rgb = (r, g, b) => [
+		r,
+		g,
+		b
+	];
+	var setLazyProperty = (object, property, get) => {
+		Object.defineProperty(object, property, {
+			get: () => {
+				const value = get();
+				Object.defineProperty(object, property, {
+					value,
+					enumerable: true,
+					configurable: true
+				});
+				return value;
+			},
+			enumerable: true,
+			configurable: true
+		});
+	};
+	/** @type {typeof import('color-convert')} */
+	var colorConvert;
+	var makeDynamicStyles = (wrap, targetSpace, identity, isBackground) => {
+		if (colorConvert === void 0) colorConvert = require_color_convert();
+		const offset = isBackground ? 10 : 0;
+		const styles = {};
+		for (const [sourceSpace, suite] of Object.entries(colorConvert)) {
+			const name = sourceSpace === "ansi16" ? "ansi" : sourceSpace;
+			if (sourceSpace === targetSpace) styles[name] = wrap(identity, offset);
+			else if (typeof suite === "object") styles[name] = wrap(suite[targetSpace], offset);
+		}
+		return styles;
+	};
+	function assembleStyles() {
+		const codes = /* @__PURE__ */ new Map();
+		const styles = {
+			modifier: {
+				reset: [0, 0],
+				bold: [1, 22],
+				dim: [2, 22],
+				italic: [3, 23],
+				underline: [4, 24],
+				inverse: [7, 27],
+				hidden: [8, 28],
+				strikethrough: [9, 29]
+			},
+			color: {
+				black: [30, 39],
+				red: [31, 39],
+				green: [32, 39],
+				yellow: [33, 39],
+				blue: [34, 39],
+				magenta: [35, 39],
+				cyan: [36, 39],
+				white: [37, 39],
+				blackBright: [90, 39],
+				redBright: [91, 39],
+				greenBright: [92, 39],
+				yellowBright: [93, 39],
+				blueBright: [94, 39],
+				magentaBright: [95, 39],
+				cyanBright: [96, 39],
+				whiteBright: [97, 39]
+			},
+			bgColor: {
+				bgBlack: [40, 49],
+				bgRed: [41, 49],
+				bgGreen: [42, 49],
+				bgYellow: [43, 49],
+				bgBlue: [44, 49],
+				bgMagenta: [45, 49],
+				bgCyan: [46, 49],
+				bgWhite: [47, 49],
+				bgBlackBright: [100, 49],
+				bgRedBright: [101, 49],
+				bgGreenBright: [102, 49],
+				bgYellowBright: [103, 49],
+				bgBlueBright: [104, 49],
+				bgMagentaBright: [105, 49],
+				bgCyanBright: [106, 49],
+				bgWhiteBright: [107, 49]
+			}
+		};
+		styles.color.gray = styles.color.blackBright;
+		styles.bgColor.bgGray = styles.bgColor.bgBlackBright;
+		styles.color.grey = styles.color.blackBright;
+		styles.bgColor.bgGrey = styles.bgColor.bgBlackBright;
+		for (const [groupName, group] of Object.entries(styles)) {
+			for (const [styleName, style] of Object.entries(group)) {
+				styles[styleName] = {
+					open: `\u001B[${style[0]}m`,
+					close: `\u001B[${style[1]}m`
+				};
+				group[styleName] = styles[styleName];
+				codes.set(style[0], style[1]);
+			}
+			Object.defineProperty(styles, groupName, {
+				value: group,
+				enumerable: false
+			});
+		}
+		Object.defineProperty(styles, "codes", {
+			value: codes,
+			enumerable: false
+		});
+		styles.color.close = "\x1B[39m";
+		styles.bgColor.close = "\x1B[49m";
+		setLazyProperty(styles.color, "ansi", () => makeDynamicStyles(wrapAnsi16, "ansi16", ansi2ansi, false));
+		setLazyProperty(styles.color, "ansi256", () => makeDynamicStyles(wrapAnsi256, "ansi256", ansi2ansi, false));
+		setLazyProperty(styles.color, "ansi16m", () => makeDynamicStyles(wrapAnsi16m, "rgb", rgb2rgb, false));
+		setLazyProperty(styles.bgColor, "ansi", () => makeDynamicStyles(wrapAnsi16, "ansi16", ansi2ansi, true));
+		setLazyProperty(styles.bgColor, "ansi256", () => makeDynamicStyles(wrapAnsi256, "ansi256", ansi2ansi, true));
+		setLazyProperty(styles.bgColor, "ansi16m", () => makeDynamicStyles(wrapAnsi16m, "rgb", rgb2rgb, true));
+		return styles;
+	}
+	Object.defineProperty(module, "exports", {
+		enumerable: true,
+		get: assembleStyles
+	});
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/supports-color@7.2.0/node_modules/supports-color/browser.js
+var require_browser = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = {
+		stdout: false,
+		stderr: false
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/chalk@4.1.2/node_modules/chalk/source/util.js
+var require_util = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var stringReplaceAll = (string, substring, replacer) => {
+		let index = string.indexOf(substring);
+		if (index === -1) return string;
+		const substringLength = substring.length;
+		let endIndex = 0;
+		let returnValue = "";
+		do {
+			returnValue += string.substr(endIndex, index - endIndex) + substring + replacer;
+			endIndex = index + substringLength;
+			index = string.indexOf(substring, endIndex);
+		} while (index !== -1);
+		returnValue += string.substr(endIndex);
+		return returnValue;
+	};
+	var stringEncaseCRLFWithFirstIndex = (string, prefix, postfix, index) => {
+		let endIndex = 0;
+		let returnValue = "";
+		do {
+			const gotCR = string[index - 1] === "\r";
+			returnValue += string.substr(endIndex, (gotCR ? index - 1 : index) - endIndex) + prefix + (gotCR ? "\r\n" : "\n") + postfix;
+			endIndex = index + 1;
+			index = string.indexOf("\n", endIndex);
+		} while (index !== -1);
+		returnValue += string.substr(endIndex);
+		return returnValue;
+	};
+	module.exports = {
+		stringReplaceAll,
+		stringEncaseCRLFWithFirstIndex
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/chalk@4.1.2/node_modules/chalk/source/templates.js
+var require_templates = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var TEMPLATE_REGEX = /(?:\\(u(?:[a-f\d]{4}|\{[a-f\d]{1,6}\})|x[a-f\d]{2}|.))|(?:\{(~)?(\w+(?:\([^)]*\))?(?:\.\w+(?:\([^)]*\))?)*)(?:[ \t]|(?=\r?\n)))|(\})|((?:.|[\r\n\f])+?)/gi;
+	var STYLE_REGEX = /(?:^|\.)(\w+)(?:\(([^)]*)\))?/g;
+	var STRING_REGEX = /^(['"])((?:\\.|(?!\1)[^\\])*)\1$/;
+	var ESCAPE_REGEX = /\\(u(?:[a-f\d]{4}|{[a-f\d]{1,6}})|x[a-f\d]{2}|.)|([^\\])/gi;
+	var ESCAPES = new Map([
+		["n", "\n"],
+		["r", "\r"],
+		["t", "	"],
+		["b", "\b"],
+		["f", "\f"],
+		["v", "\v"],
+		["0", "\0"],
+		["\\", "\\"],
+		["e", "\x1B"],
+		["a", "\x07"]
+	]);
+	function unescape(c) {
+		const u = c[0] === "u";
+		const bracket = c[1] === "{";
+		if (u && !bracket && c.length === 5 || c[0] === "x" && c.length === 3) return String.fromCharCode(parseInt(c.slice(1), 16));
+		if (u && bracket) return String.fromCodePoint(parseInt(c.slice(2, -1), 16));
+		return ESCAPES.get(c) || c;
+	}
+	function parseArguments(name, arguments_) {
+		const results = [];
+		const chunks = arguments_.trim().split(/\s*,\s*/g);
+		let matches;
+		for (const chunk of chunks) {
+			const number = Number(chunk);
+			if (!Number.isNaN(number)) results.push(number);
+			else if (matches = chunk.match(STRING_REGEX)) results.push(matches[2].replace(ESCAPE_REGEX, (m, escape, character) => escape ? unescape(escape) : character));
+			else throw new Error(`Invalid Chalk template style argument: ${chunk} (in style '${name}')`);
+		}
+		return results;
+	}
+	function parseStyle(style) {
+		STYLE_REGEX.lastIndex = 0;
+		const results = [];
+		let matches;
+		while ((matches = STYLE_REGEX.exec(style)) !== null) {
+			const name = matches[1];
+			if (matches[2]) {
+				const args = parseArguments(name, matches[2]);
+				results.push([name].concat(args));
+			} else results.push([name]);
+		}
+		return results;
+	}
+	function buildStyle(chalk, styles) {
+		const enabled = {};
+		for (const layer of styles) for (const style of layer.styles) enabled[style[0]] = layer.inverse ? null : style.slice(1);
+		let current = chalk;
+		for (const [styleName, styles] of Object.entries(enabled)) {
+			if (!Array.isArray(styles)) continue;
+			if (!(styleName in current)) throw new Error(`Unknown Chalk style: ${styleName}`);
+			current = styles.length > 0 ? current[styleName](...styles) : current[styleName];
+		}
+		return current;
+	}
+	module.exports = (chalk, temporary) => {
+		const styles = [];
+		const chunks = [];
+		let chunk = [];
+		temporary.replace(TEMPLATE_REGEX, (m, escapeCharacter, inverse, style, close, character) => {
+			if (escapeCharacter) chunk.push(unescape(escapeCharacter));
+			else if (style) {
+				const string = chunk.join("");
+				chunk = [];
+				chunks.push(styles.length === 0 ? string : buildStyle(chalk, styles)(string));
+				styles.push({
+					inverse,
+					styles: parseStyle(style)
+				});
+			} else if (close) {
+				if (styles.length === 0) throw new Error("Found extraneous } in Chalk template literal");
+				chunks.push(buildStyle(chalk, styles)(chunk.join("")));
+				chunk = [];
+				styles.pop();
+			} else chunk.push(character);
+		});
+		chunks.push(chunk.join(""));
+		if (styles.length > 0) {
+			const errMessage = `Chalk template literal is missing ${styles.length} closing bracket${styles.length === 1 ? "" : "s"} (\`}\`)`;
+			throw new Error(errMessage);
+		}
+		return chunks.join("");
+	};
+}));
+(/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var ansiStyles = require_ansi_styles();
+	var { stdout: stdoutColor, stderr: stderrColor } = require_browser();
+	var { stringReplaceAll, stringEncaseCRLFWithFirstIndex } = require_util();
+	var { isArray } = Array;
+	var levelMapping = [
+		"ansi",
+		"ansi",
+		"ansi256",
+		"ansi16m"
+	];
+	var styles = Object.create(null);
+	var applyOptions = (object, options = {}) => {
+		if (options.level && !(Number.isInteger(options.level) && options.level >= 0 && options.level <= 3)) throw new Error("The `level` option should be an integer from 0 to 3");
+		const colorLevel = stdoutColor ? stdoutColor.level : 0;
+		object.level = options.level === void 0 ? colorLevel : options.level;
+	};
+	var ChalkClass = class {
+		constructor(options) {
+			return chalkFactory(options);
+		}
+	};
+	var chalkFactory = (options) => {
+		const chalk = {};
+		applyOptions(chalk, options);
+		chalk.template = (...arguments_) => chalkTag(chalk.template, ...arguments_);
+		Object.setPrototypeOf(chalk, Chalk.prototype);
+		Object.setPrototypeOf(chalk.template, chalk);
+		chalk.template.constructor = () => {
+			throw new Error("`chalk.constructor()` is deprecated. Use `new chalk.Instance()` instead.");
+		};
+		chalk.template.Instance = ChalkClass;
+		return chalk.template;
+	};
+	function Chalk(options) {
+		return chalkFactory(options);
+	}
+	for (const [styleName, style] of Object.entries(ansiStyles)) styles[styleName] = { get() {
+		const builder = createBuilder(this, createStyler(style.open, style.close, this._styler), this._isEmpty);
+		Object.defineProperty(this, styleName, { value: builder });
+		return builder;
+	} };
+	styles.visible = { get() {
+		const builder = createBuilder(this, this._styler, true);
+		Object.defineProperty(this, "visible", { value: builder });
+		return builder;
+	} };
+	var usedModels = [
+		"rgb",
+		"hex",
+		"keyword",
+		"hsl",
+		"hsv",
+		"hwb",
+		"ansi",
+		"ansi256"
+	];
+	for (const model of usedModels) styles[model] = { get() {
+		const { level } = this;
+		return function(...arguments_) {
+			const styler = createStyler(ansiStyles.color[levelMapping[level]][model](...arguments_), ansiStyles.color.close, this._styler);
+			return createBuilder(this, styler, this._isEmpty);
+		};
+	} };
+	for (const model of usedModels) {
+		const bgModel = "bg" + model[0].toUpperCase() + model.slice(1);
+		styles[bgModel] = { get() {
+			const { level } = this;
+			return function(...arguments_) {
+				const styler = createStyler(ansiStyles.bgColor[levelMapping[level]][model](...arguments_), ansiStyles.bgColor.close, this._styler);
+				return createBuilder(this, styler, this._isEmpty);
+			};
+		} };
+	}
+	var proto = Object.defineProperties(() => {}, {
+		...styles,
+		level: {
+			enumerable: true,
+			get() {
+				return this._generator.level;
+			},
+			set(level) {
+				this._generator.level = level;
+			}
+		}
+	});
+	var createStyler = (open, close, parent) => {
+		let openAll;
+		let closeAll;
+		if (parent === void 0) {
+			openAll = open;
+			closeAll = close;
+		} else {
+			openAll = parent.openAll + open;
+			closeAll = close + parent.closeAll;
+		}
+		return {
+			open,
+			close,
+			openAll,
+			closeAll,
+			parent
+		};
+	};
+	var createBuilder = (self, _styler, _isEmpty) => {
+		const builder = (...arguments_) => {
+			if (isArray(arguments_[0]) && isArray(arguments_[0].raw)) return applyStyle(builder, chalkTag(builder, ...arguments_));
+			return applyStyle(builder, arguments_.length === 1 ? "" + arguments_[0] : arguments_.join(" "));
+		};
+		Object.setPrototypeOf(builder, proto);
+		builder._generator = self;
+		builder._styler = _styler;
+		builder._isEmpty = _isEmpty;
+		return builder;
+	};
+	var applyStyle = (self, string) => {
+		if (self.level <= 0 || !string) return self._isEmpty ? "" : string;
+		let styler = self._styler;
+		if (styler === void 0) return string;
+		const { openAll, closeAll } = styler;
+		if (string.indexOf("\x1B") !== -1) while (styler !== void 0) {
+			string = stringReplaceAll(string, styler.close, styler.open);
+			styler = styler.parent;
+		}
+		const lfIndex = string.indexOf("\n");
+		if (lfIndex !== -1) string = stringEncaseCRLFWithFirstIndex(string, closeAll, openAll, lfIndex);
+		return openAll + string + closeAll;
+	};
+	var template;
+	var chalkTag = (chalk, ...strings) => {
+		const [firstString] = strings;
+		if (!isArray(firstString) || !isArray(firstString.raw)) return strings.join(" ");
+		const arguments_ = strings.slice(1);
+		const parts = [firstString.raw[0]];
+		for (let i = 1; i < firstString.length; i++) parts.push(String(arguments_[i - 1]).replace(/[{}\\]/g, "\\$&"), String(firstString.raw[i]));
+		if (template === void 0) template = require_templates();
+		return template(chalk, parts.join(""));
+	};
+	Object.defineProperties(Chalk.prototype, styles);
+	var chalk = Chalk();
+	chalk.supportsColor = stdoutColor;
+	chalk.stderr = Chalk({ level: stderrColor ? stderrColor.level : 0 });
+	chalk.stderr.supportsColor = stderrColor;
+	module.exports = chalk;
+})))();
+/**
+* Detect whether an error (or AggregateError wrapping multiple attempts)
+* represents an ECONNREFUSED — i.e. the database is simply not running.
+*
+* Handles:
+* - Direct `{ code: "ECONNREFUSED" }` errors from Node `net`
+* - `AggregateError` from dual-stack IPv4+IPv6 connection attempts
+* - Drizzle's `cause`-wrapped pg errors
+*/
+function isEconnrefused(err) {
+	if (!err || typeof err !== "object") return false;
+	const e = err;
+	if (e.code === "ECONNREFUSED") return true;
+	if (Array.isArray(e.errors)) return e.errors.some((inner) => inner && typeof inner === "object" && inner.code === "ECONNREFUSED");
+	if (e.cause && typeof e.cause === "object") return isEconnrefused(e.cause);
+	return false;
+}
+//#endregion
 //#region src/PostgresBootstrapper.ts
 /**
 * PostgresBootstrapper
@@ -10636,6 +13381,18 @@ function createPostgresBootstrapper(pgConfig) {
 			try {
 				await schemaAwareDb.execute(sql`SELECT 1`);
 			} catch (err) {
+				if (isEconnrefused(err)) {
+					let hostInfo = pgConfig.connectionString || "unknown";
+					try {
+						const parsed = new URL(pgConfig.connectionString || "");
+						hostInfo = `${parsed.hostname}:${parsed.port || 5432}`;
+					} catch {}
+					const message = `
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ❌  Cannot connect to PostgreSQL at ${hostInfo}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  The database server is not running or is not accepting\n  connections. Common fixes:\n\n    • brew services start postgresql@18\n    • docker compose up -d postgres\n    • Verify DATABASE_URL in your .env file\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+					logger.error(message);
+					throw new Error(`Cannot connect to PostgreSQL at ${hostInfo}: connection refused. Is the database running?`);
+				}
 				logger.error("❌ Failed to connect to PostgreSQL", { error: err });
 				logger.warn("⚠️ Continuing without initial database verification. Drizzle/PG will attempt to connect on subsequent queries.");
 			}
@@ -10798,6 +13555,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, createAuthSchema, createDirectDatabaseConnection, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, generateSchema, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, passwordResetTokens, passwordResetTokensRelations, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema };
+export { AuthenticatedPostgresBackendDriver, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, createAuthSchema, createDirectDatabaseConnection, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, generateSchema, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, passwordResetTokens, passwordResetTokensRelations, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema };
 
 //# sourceMappingURL=index.es.js.map