@rebasepro/server-postgresql 0.7.0 → 0.8.0

package/build-errors.txt

@@ -0,0 +1,37 @@
+
+> @rebasepro/server-postgresql@0.0.1 build /Users/francesco/rebase/packages/server-postgresql
+> vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json
+
+vite v5.4.21 building for production...
+transforming...
+✓ 328 modules transformed.
+rendering chunks...
+computing gzip size...
+dist/index.es.js  434.54 kB │ gzip: 83.11 kB │ map: 1,031.37 kB
+dist/index.umd.js  459.59 kB │ gzip: 84.58 kB │ map: 1,035.30 kB
+✓ built in 1.23s
+src/auth/services.ts(119,15): error TS2322: Type '{ id: unknown; email: unknown; passwordHash: {} | null; displayName: {} | null; photoUrl: {} | null; provider: unknown; googleId: {} | null; emailVerified: {}; emailVerificationToken: {} | null; emailVerificationSentAt: {} | null; createdAt: unknown; updatedAt: unknown; }[]' is not assignable to type '{ email: string; id: string; createdAt: Date; passwordHash: string | null; displayName: string | null; photoUrl: string | null; provider: string; googleId: string | null; emailVerified: boolean; emailVerificationToken: string | null; emailVerificationSentAt: Date | null; updatedAt: Date; }[]'.
+  Type '{ id: unknown; email: unknown; passwordHash: {} | null; displayName: {} | null; photoUrl: {} | null; provider: unknown; googleId: {} | null; emailVerified: {}; emailVerificationToken: {} | null; emailVerificationSentAt: {} | null; createdAt: unknown; updatedAt: unknown; }' is not assignable to type '{ email: string; id: string; createdAt: Date; passwordHash: string | null; displayName: string | null; photoUrl: string | null; provider: string; googleId: string | null; emailVerified: boolean; emailVerificationToken: string | null; emailVerificationSentAt: Date | null; updatedAt: Date; }'.
+    Types of property 'email' are incompatible.
+      Type 'unknown' is not assignable to type 'string'.
+src/collections/PostgresCollectionRegistry.ts(90,143): error TS2344: Type 'Record<string, unknown>' does not satisfy the constraint 'User'.
+  Type 'Record<string, unknown>' is missing the following properties from type 'User': uid, displayName, email, photoURL, and 2 more.
+src/PostgresBootstrapper.ts(201,59): error TS2345: Argument of type 'number | undefined' is not assignable to parameter of type 'Partial<HistoryRetentionConfig> | undefined'.
+  Type 'number' has no properties in common with type 'Partial<HistoryRetentionConfig>'.
+src/schema/generate-drizzle-schema-logic.ts(455,121): error TS2344: Type 'Record<string, unknown>' does not satisfy the constraint 'User'.
+  Type 'Record<string, unknown>' is missing the following properties from type 'User': uid, displayName, email, photoURL, and 2 more.
+src/services/EntityFetchService.ts(37,72): error TS2344: Type 'Record<string, unknown>' does not satisfy the constraint 'TablesRelationalConfig'.
+  'string' index signatures are incompatible.
+    Type 'unknown' is not assignable to type 'TableRelationalConfig'.
+src/services/EntityFetchService.ts(39,61): error TS2344: Type 'Record<string, unknown>' does not satisfy the constraint 'TablesRelationalConfig'.
+  'string' index signatures are incompatible.
+    Type 'unknown' is not assignable to type 'TableRelationalConfig'.
+src/services/realtimeService.ts(621,21): error TS2322: Type 'Record<string, unknown> | undefined' is not assignable to type 'Partial<Record<string, [WhereFilterOp, unknown]>> | undefined'.
+  Type 'Record<string, unknown>' is not assignable to type 'Partial<Record<string, [WhereFilterOp, unknown]>>'.
+    'string' index signatures are incompatible.
+      Type 'unknown' is not assignable to type '[WhereFilterOp, unknown] | undefined'.
+src/services/realtimeService.ts(630,13): error TS2322: Type 'Record<string, unknown> | undefined' is not assignable to type 'Partial<Record<string, [WhereFilterOp, unknown]>> | undefined'.
+  Type 'Record<string, unknown>' is not assignable to type 'Partial<Record<string, [WhereFilterOp, unknown]>>'.
+    'string' index signatures are incompatible.
+      Type 'unknown' is not assignable to type '[WhereFilterOp, unknown] | undefined'.
+ ELIFECYCLE  Command failed with exit code 2.

package/dist/PostgresAdapter.d.ts

@@ -0,0 +1,6 @@
+import { DatabaseAdapter } from "@rebasepro/types";
+import type { PostgresDriverConfig } from "./PostgresBootstrapper";
+/**
+ * Creates a Postgres database adapter for Rebase.
+ */
+export declare function createPostgresAdapter(pgConfig: PostgresDriverConfig): DatabaseAdapter;

package/dist/PostgresBackendDriver.d.ts

@@ -0,0 +1,118 @@
+import { EntityService } from "./services/entityService";
+import { BranchService } from "./services/BranchService";
+import { RealtimeService } from "./services/realtimeService";
+import { DatabasePoolManager } from "./databasePoolManager";
+import { DrizzleClient } from "./interfaces";
+import { DatabaseAdmin, DataDriver, DeleteEntityProps, Entity, EntityCollection, FetchCollectionProps, FetchEntityProps, ListenCollectionProps, ListenEntityProps, RebaseClient, RebaseData, RestFetchService, SaveEntityProps, TableMetadata, User } from "@rebasepro/types";
+import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
+import { HistoryService } from "./history/HistoryService";
+export declare class PostgresBackendDriver implements DataDriver {
+    db: DrizzleClient;
+    readonly registry: PostgresCollectionRegistry;
+    poolManager?: DatabasePoolManager | undefined;
+    key: string;
+    initialised: boolean;
+    entityService: EntityService;
+    realtimeService: RealtimeService;
+    historyService?: HistoryService;
+    branchService?: BranchService;
+    user?: User;
+    data: RebaseData;
+    client?: RebaseClient;
+    /**
+     * Auto-set to `true` when a SET LOCAL ROLE fails with insufficient
+     * privileges, so subsequent queries skip the doomed attempt.
+     * Mirrors the static `DISABLE_DB_ROLE_SWITCHING` env var but is
+     * learned at runtime.
+     */
+    private _roleSwitchingDisabled;
+    /**
+     * When true, realtime notifications are deferred until after the
+     * wrapping transaction commits.  Set by `withAuth` → `withTransaction`.
+     */
+    _deferNotifications: boolean;
+    _pendingNotifications: Array<{
+        path: string;
+        entityId: string;
+        entity: Entity | null;
+        databaseId?: string;
+    }>;
+    constructor(db: DrizzleClient, realtimeService: RealtimeService, registry: PostgresCollectionRegistry, user?: User, poolManager?: DatabasePoolManager | undefined, historyService?: HistoryService);
+    /**
+     * Typed admin capabilities (SQLAdmin + SchemaAdmin + BranchAdmin).
+     * Implemented as a getter so method references are resolved at call-time,
+     * allowing test spies applied after construction to take effect.
+     */
+    get admin(): DatabaseAdmin;
+    /**
+     * REST-optimised fetch service (include-aware eager-loading).
+     * Delegates to the underlying EntityFetchService which already
+     * implements the matching method signatures.
+     */
+    get restFetchService(): import("./services").EntityFetchService;
+    private buildCallContext;
+    private resolveCollectionCallbacks;
+    fetchCollection<M extends Record<string, unknown>>({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, vectorSearch }: FetchCollectionProps<M>): Promise<Entity<M>[]>;
+    listenCollection<M extends Record<string, unknown>>({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, onUpdate, onError }: ListenCollectionProps<M>): () => void;
+    fetchEntity<M extends Record<string, unknown>>({ path, entityId, databaseId, collection }: FetchEntityProps<M>): Promise<Entity<M> | undefined>;
+    listenEntity<M extends Record<string, unknown>>({ path, entityId, collection, onUpdate, onError }: ListenEntityProps<M>): () => void;
+    saveEntity<M extends Record<string, unknown>>({ path, entityId, values, collection, status }: SaveEntityProps<M>): Promise<Entity<M>>;
+    deleteEntity<M extends Record<string, unknown>>({ entity, collection }: DeleteEntityProps<M>): Promise<void>;
+    deleteAll(path: string): Promise<void>;
+    checkUniqueField(path: string, name: string, value: unknown, entityId?: string, collection?: EntityCollection): Promise<boolean>;
+    countEntities<M extends Record<string, unknown>>({ path, collection, filter, searchString }: FetchCollectionProps<M>): Promise<number>;
+    private getTargetDb;
+    executeSql(sqlText: string, options?: {
+        database?: string;
+        role?: string;
+        params?: unknown[];
+    }): Promise<Record<string, unknown>[]>;
+    fetchAvailableDatabases(): Promise<string[]>;
+    fetchAvailableRoles(): Promise<string[]>;
+    fetchCurrentDatabase(): Promise<string | undefined>;
+    /**
+     * Fetch public tables that are not yet mapped to a collection.
+     * Excludes internal tables (_rebase_*, _auth_*, auth tables, etc.)
+     * and junction/connection tables used for many-to-many relations.
+     */
+    fetchUnmappedTables(mappedPaths?: string[]): Promise<string[]>;
+    /**
+     * Fetch metadata for a given table from information_schema (columns, policies, constraints).
+     */
+    fetchTableMetadata(tableName: string): Promise<TableMetadata>;
+    private generateSubscriptionId;
+    /**
+     * Create a new delegate instance with authenticated context.
+     * Starts a transaction and sets the current_user_id and current_user_roles
+     * configuration parameters for PostgreSQL Row Level Security.
+     */
+    withAuth(user: User): Promise<DataDriver>;
+}
+export declare class AuthenticatedPostgresBackendDriver implements DataDriver {
+    delegate: PostgresBackendDriver;
+    key: string;
+    initialised: boolean;
+    user: User;
+    data: RebaseData;
+    constructor(delegate: PostgresBackendDriver, user: User);
+    /**
+     * Typed admin capabilities — delegates to the base driver.
+     */
+    admin: DatabaseAdmin;
+    get restFetchService(): RestFetchService | undefined;
+    private withTransaction;
+    fetchCollection<M extends Record<string, unknown>>(props: FetchCollectionProps<M>): Promise<Entity<M>[]>;
+    /**
+     * Injects the authenticated user's context into the most recently
+     * registered realtime subscription so RLS-aware polling can apply.
+     */
+    private injectAuthContext;
+    listenCollection<M extends Record<string, unknown>>(props: ListenCollectionProps<M>): () => void;
+    fetchEntity<M extends Record<string, unknown>>(props: FetchEntityProps<M>): Promise<Entity<M> | undefined>;
+    listenEntity<M extends Record<string, unknown>>(props: ListenEntityProps<M>): () => void;
+    saveEntity<M extends Record<string, unknown>>(props: SaveEntityProps<M>): Promise<Entity<M>>;
+    deleteEntity<M extends Record<string, unknown>>(props: DeleteEntityProps<M>): Promise<void>;
+    deleteAll(path: string): Promise<void>;
+    checkUniqueField(path: string, name: string, value: unknown, entityId?: string, collection?: EntityCollection): Promise<boolean>;
+    countEntities<M extends Record<string, unknown>>(props: FetchCollectionProps<M>): Promise<number>;
+}

package/dist/PostgresBootstrapper.d.ts

@@ -0,0 +1,46 @@
+/**
+ * PostgresBootstrapper
+ *
+ * Implements the `BackendBootstrapper` interface for PostgreSQL.
+ */
+import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { BackendBootstrapper } from "@rebasepro/types";
+import { PostgresBackendDriver } from "./PostgresBackendDriver";
+import { RealtimeService } from "./services/realtimeService";
+import { DatabasePoolManager } from "./databasePoolManager";
+import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
+export interface PostgresDriverConfig {
+    connectionString?: string;
+    adminConnectionString?: string;
+    readConnectionString?: string;
+    connection?: unknown;
+    schema?: {
+        tables?: Record<string, unknown>;
+        enums?: Record<string, unknown>;
+        relations?: Record<string, unknown>;
+    };
+}
+/**
+ * Opaque internals bag that PostgresBootstrapper stores during `initializeDriver()`
+ * and re-uses in subsequent lifecycle hooks.
+ */
+export interface PostgresDriverInternals {
+    db: NodePgDatabase<any>;
+    readDb?: NodePgDatabase<any>;
+    registry: PostgresCollectionRegistry;
+    realtimeService: RealtimeService;
+    driver: PostgresBackendDriver;
+    poolManager?: DatabasePoolManager;
+}
+/**
+ * Default PostgreSQL bootstrapper.
+ *
+ * Use it to register Postgres with `initializeRebaseBackend()`:
+ * ```typescript
+ * initializeRebaseBackend({
+ *   ...config,
+ *   bootstrappers: [postgresBootstrapper()]
+ * });
+ * ```
+ */
+export declare function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): BackendBootstrapper;

package/dist/auth/ensure-tables.d.ts

@@ -0,0 +1,10 @@
+import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { EntityCollection } from "@rebasepro/types";
+/**
+ * Auto-create auth tables if they don't exist.
+ *
+ * @param db         — Drizzle database instance
+ * @param collection — The collection that represents auth users.
+ *                     When omitted, a default `rebase.users` table is created.
+ */
+export declare function ensureAuthTablesExist(db: NodePgDatabase, collection?: EntityCollection): Promise<void>;

package/dist/auth/services.d.ts

@@ -0,0 +1,251 @@
+import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { RebasePgTable } from "../types";
+import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server-core";
+export type { Role };
+export interface AuthSchemaTables {
+    users: RebasePgTable;
+    refreshTokens: RebasePgTable;
+    passwordResetTokens: RebasePgTable;
+    appConfig: RebasePgTable;
+    userIdentities: RebasePgTable;
+}
+/**
+ * PostgreSQL implementation of UserRepository.
+ * Handles all user-related database operations using Drizzle ORM.
+ */
+export declare class UserService implements UserRepository {
+    private db;
+    private usersTable;
+    private userIdentitiesTable;
+    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
+    private getQualifiedUsersTableName;
+    private mapRowToUser;
+    private mapPayload;
+    createUser(data: CreateUserData): Promise<UserData>;
+    getUserById(id: string): Promise<UserData | null>;
+    getUserByEmail(email: string): Promise<UserData | null>;
+    getUserByIdentity(provider: string, providerId: string): Promise<UserData | null>;
+    getUserIdentities(userId: string): Promise<UserIdentityData[]>;
+    linkUserIdentity(userId: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
+    updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null>;
+    deleteUser(id: string): Promise<void>;
+    listUsers(): Promise<UserData[]>;
+    listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
+    /**
+     * Update user's password hash
+     */
+    updatePassword(id: string, passwordHash: string): Promise<void>;
+    /**
+     * Set email verification status
+     */
+    setEmailVerified(id: string, verified: boolean): Promise<void>;
+    /**
+     * Set email verification token
+     */
+    setVerificationToken(id: string, token: string | null): Promise<void>;
+    /**
+     * Find user by email verification token
+     */
+    getUserByVerificationToken(token: string): Promise<UserData | null>;
+    /**
+     * Get roles for a user from database (inline TEXT[] column)
+     */
+    getUserRoles(userId: string): Promise<Role[]>;
+    /**
+     * Get role IDs for a user
+     */
+    getUserRoleIds(userId: string): Promise<string[]>;
+    /**
+     * Set roles for a user (replaces existing roles)
+     */
+    setUserRoles(userId: string, roleIds: string[]): Promise<void>;
+    /**
+     * Assign a specific role to new user (appends if not present)
+     */
+    assignDefaultRole(userId: string, roleId: string): Promise<void>;
+    /**
+     * Get user with their roles
+     */
+    getUserWithRoles(userId: string): Promise<{
+        user: UserData;
+        roles: Role[];
+    } | null>;
+}
+export declare class RefreshTokenService {
+    private db;
+    private refreshTokensTable;
+    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
+    private getQualifiedRefreshTokensTableName;
+    createToken(userId: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    findByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
+    deleteByHash(tokenHash: string): Promise<void>;
+    deleteAllForUser(userId: string): Promise<void>;
+    listForUser(userId: string): Promise<RefreshTokenInfo[]>;
+    deleteById(id: string, userId: string): Promise<void>;
+}
+/**
+ * Password reset token service
+ */
+export declare class PasswordResetTokenService {
+    private db;
+    private passwordResetTokensTable;
+    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
+    private getQualifiedPasswordResetTokensTableName;
+    /**
+     * Create a password reset token
+     */
+    createToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    /**
+     * Find a valid (not expired, not used) token by hash
+     */
+    findValidByHash(tokenHash: string): Promise<{
+        userId: string;
+        expiresAt: Date;
+    } | null>;
+    /**
+     * Mark token as used
+     */
+    markAsUsed(tokenHash: string): Promise<void>;
+    /**
+     * Delete all tokens for a user
+     */
+    deleteAllForUser(userId: string): Promise<void>;
+    /**
+     * Clean up expired tokens
+     */
+    deleteExpired(): Promise<void>;
+}
+/**
+ * Magic link token service.
+ * Handles magic link token storage for passwordless email login.
+ */
+export declare class MagicLinkTokenService {
+    private db;
+    private magicLinkTokensTable;
+    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
+    private getQualifiedTableName;
+    createToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    findValidByHash(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
+    markAsUsed(tokenHash: string): Promise<void>;
+}
+/**
+ * PostgreSQL implementation of TokenRepository.
+ * Combines refresh token and password reset token operations.
+ */
+export declare class PostgresTokenRepository implements TokenRepository {
+    private db;
+    private refreshTokenService;
+    private passwordResetTokenService;
+    private magicLinkTokenService;
+    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
+    createRefreshToken(userId: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
+    deleteRefreshToken(tokenHash: string): Promise<void>;
+    deleteAllRefreshTokensForUser(userId: string): Promise<void>;
+    listRefreshTokensForUser(userId: string): Promise<RefreshTokenInfo[]>;
+    deleteRefreshTokenById(id: string, userId: string): Promise<void>;
+    createPasswordResetToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    findValidPasswordResetToken(tokenHash: string): Promise<PasswordResetTokenInfo | null>;
+    markPasswordResetTokenUsed(tokenHash: string): Promise<void>;
+    deleteAllPasswordResetTokensForUser(userId: string): Promise<void>;
+    deleteExpiredTokens(): Promise<void>;
+    createMagicLinkToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    findValidMagicLinkToken(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
+    markMagicLinkTokenUsed(tokenHash: string): Promise<void>;
+}
+/**
+ * PostgreSQL implementation of AuthRepository.
+ * Combines user, role, and token repository operations.
+ * This provides a convenient single-class interface for all auth operations.
+ */
+export declare class PostgresAuthRepository implements AuthRepository {
+    private db;
+    private userService;
+    private tokenRepository;
+    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
+    createUser(data: CreateUserData): Promise<UserData>;
+    getUserById(id: string): Promise<UserData | null>;
+    getUserByEmail(email: string): Promise<UserData | null>;
+    getUserByIdentity(provider: string, providerId: string): Promise<UserData | null>;
+    getUserIdentities(userId: string): Promise<UserIdentityData[]>;
+    linkUserIdentity(userId: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
+    updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null>;
+    deleteUser(id: string): Promise<void>;
+    listUsers(): Promise<UserData[]>;
+    listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
+    updatePassword(id: string, passwordHash: string): Promise<void>;
+    setEmailVerified(id: string, verified: boolean): Promise<void>;
+    setVerificationToken(id: string, token: string | null): Promise<void>;
+    getUserByVerificationToken(token: string): Promise<UserData | null>;
+    getUserRoles(userId: string): Promise<RoleData[]>;
+    getUserRoleIds(userId: string): Promise<string[]>;
+    setUserRoles(userId: string, roleIds: string[]): Promise<void>;
+    assignDefaultRole(userId: string, roleId: string): Promise<void>;
+    getUserWithRoles(userId: string): Promise<{
+        user: UserData;
+        roles: RoleData[];
+    } | null>;
+    getRoleById(id: string): Promise<RoleData | null>;
+    listRoles(): Promise<RoleData[]>;
+    createRole(_data: CreateRoleData): Promise<RoleData>;
+    updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
+    deleteRole(_id: string): Promise<void>;
+    createRefreshToken(userId: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
+    deleteRefreshToken(tokenHash: string): Promise<void>;
+    deleteAllRefreshTokensForUser(userId: string): Promise<void>;
+    listRefreshTokensForUser(userId: string): Promise<RefreshTokenInfo[]>;
+    deleteRefreshTokenById(id: string, userId: string): Promise<void>;
+    createPasswordResetToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    findValidPasswordResetToken(tokenHash: string): Promise<PasswordResetTokenInfo | null>;
+    markPasswordResetTokenUsed(tokenHash: string): Promise<void>;
+    deleteAllPasswordResetTokensForUser(userId: string): Promise<void>;
+    deleteExpiredTokens(): Promise<void>;
+    createMagicLinkToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    findValidMagicLinkToken(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
+    markMagicLinkTokenUsed(tokenHash: string): Promise<void>;
+    private _mfaService;
+    private getMfaService;
+    createMfaFactor(userId: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
+    getMfaFactors(userId: string): Promise<MfaFactor[]>;
+    getMfaFactorById(factorId: string): Promise<(MfaFactor & {
+        secretEncrypted: string;
+    }) | null>;
+    verifyMfaFactor(factorId: string): Promise<void>;
+    deleteMfaFactor(factorId: string, userId: string): Promise<void>;
+    createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
+    getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
+    verifyMfaChallenge(challengeId: string): Promise<void>;
+    createRecoveryCodes(userId: string, codeHashes: string[]): Promise<void>;
+    useRecoveryCode(userId: string, codeHash: string): Promise<boolean>;
+    getUnusedRecoveryCodeCount(userId: string): Promise<number>;
+    deleteAllRecoveryCodes(userId: string): Promise<void>;
+    hasVerifiedMfaFactors(userId: string): Promise<boolean>;
+}
+/**
+ * PostgreSQL implementation of MfaRepository.
+ * Handles all MFA-related database operations.
+ */
+export declare class MfaService implements MfaRepository {
+    private db;
+    private schemaName;
+    constructor(db: NodePgDatabase, schemaName?: string);
+    private qualify;
+    createMfaFactor(userId: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
+    getMfaFactors(userId: string): Promise<MfaFactor[]>;
+    getMfaFactorById(factorId: string): Promise<(MfaFactor & {
+        secretEncrypted: string;
+    }) | null>;
+    verifyMfaFactor(factorId: string): Promise<void>;
+    deleteMfaFactor(factorId: string, userId: string): Promise<void>;
+    createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
+    getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
+    verifyMfaChallenge(challengeId: string): Promise<void>;
+    createRecoveryCodes(userId: string, codeHashes: string[]): Promise<void>;
+    useRecoveryCode(userId: string, codeHash: string): Promise<boolean>;
+    getUnusedRecoveryCodeCount(userId: string): Promise<number>;
+    deleteAllRecoveryCodes(userId: string): Promise<void>;
+    hasVerifiedMfaFactors(userId: string): Promise<boolean>;
+}
+/** PostgreSQL user repository implementation */
+export type PostgresUserRepository = UserService;

package/dist/cli-errors.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Detect whether an error (or AggregateError wrapping multiple attempts)
+ * represents an ECONNREFUSED — i.e. the database is simply not running.
+ *
+ * Handles:
+ * - Direct `{ code: "ECONNREFUSED" }` errors from Node `net`
+ * - `AggregateError` from dual-stack IPv4+IPv6 connection attempts
+ * - Drizzle's `cause`-wrapped pg errors
+ */
+export declare function isEconnrefused(err: unknown): boolean;
+/**
+ * Detect PostgreSQL authentication failures.
+ * PG error codes: 28P01 (invalid_password), 28000 (invalid_authorization_specification)
+ */
+export declare function isAuthFailure(err: unknown): boolean;
+/**
+ * Pre-flight check: verify that the database is reachable before running
+ * a heavy subprocess (Atlas, migrations, etc.).
+ *
+ * Exits with code 1 and a friendly banner on known failure modes.
+ * On unknown errors, logs a warning and allows the caller to proceed.
+ */
+export declare function checkDatabaseConnectivity(databaseUrl: string): Promise<void>;
+/**
+ * Post-hoc error diagnosis for direct database operations (e.g. applyPolicies).
+ * Returns a formatted diagnostic string if the error matches a known pattern,
+ * or null if unrecognized.
+ */
+export declare function diagnoseDbError(err: unknown, databaseUrl?: string): string | null;

package/dist/cli-helpers.d.ts

@@ -0,0 +1,7 @@
+import type { EntityCollection } from "@rebasepro/types";
+export declare function resolveLocalBin(binName: string): string | null;
+export declare function getTableIncludesFromCollections(collections: EntityCollection[]): Promise<string[]>;
+export declare function getTableIncludes(collectionsPath: string): Promise<string[]>;
+export declare function getDevDatabaseUrl(databaseUrl: string): string;
+export declare function ensureDevDatabaseExists(databaseUrl: string, devDatabaseUrl: string): Promise<void>;
+export declare function getTableExcludes(databaseUrl: string, collectionsPath: string): Promise<string[]>;

package/dist/cli.d.ts

@@ -0,0 +1 @@
+export declare function runPluginCommand(args: string[]): Promise<void>;

package/dist/collections/PostgresCollectionRegistry.d.ts

@@ -0,0 +1,47 @@
+import { CollectionRegistry } from "@rebasepro/common";
+import { type EntityCollection } from "@rebasepro/types";
+import { PgEnum, PgTable } from "drizzle-orm/pg-core";
+import { Relations } from "drizzle-orm";
+import { CollectionRegistryInterface } from "../interfaces";
+/**
+ * PostgreSQL-specific collection registry.
+ * Extends the base CollectionRegistry with support for Drizzle ORM tables, enums, and relations.
+ *
+ * Satisfies CollectionRegistryInterface through inheritance from CollectionRegistry.
+ */
+export declare class PostgresCollectionRegistry extends CollectionRegistry implements CollectionRegistryInterface {
+    private tables;
+    private enums;
+    private relations;
+    registerTable(table: PgTable, tableName: string): void;
+    getTable(tableName: string): PgTable | undefined;
+    /**
+     * Checks if a specific collection has a registered table
+     */
+    hasTableForCollection(tableName: string): boolean;
+    /**
+     * Returns all registered table names.
+     */
+    getTableNames(): string[];
+    /**
+     * Finds collections assigned to a specific data source that do not have a registered table.
+     */
+    getCollectionsWithoutTables(dataSourceKey?: string): EntityCollection[];
+    registerEnums(enums: Record<string, PgEnum<[string, ...string[]]>>): void;
+    registerRelations(relations: Record<string, Relations>): void;
+    getEnum(name: string): PgEnum<[string, ...string[]]> | undefined;
+    getRelation(name: string): Relations | undefined;
+    getAllEnums(): Record<string, PgEnum<[string, ...string[]]>>;
+    getAllRelations(): Record<string, Relations>;
+    /**
+     * Get the merged schema object (tables + relations) for use with Drizzle's
+     * relational query API (`db.query`).
+     */
+    getMergedSchema(): Record<string, unknown>;
+    /**
+     * Get the available Drizzle relation keys for a given collection path.
+     * Maps from the collection's relation property names to the Drizzle relation names
+     * defined in the schema.
+     */
+    getRelationKeysForCollection(collectionPath: string): string[];
+}

package/dist/connection.d.ts

@@ -0,0 +1,65 @@
+import { Pool } from "pg";
+/**
+ * Configuration for the Postgres connection pool.
+ *
+ * Sensible defaults are provided for production Cloud Run / single-instance
+ * deployments. Override via environment variables or explicit config.
+ */
+export interface PostgresPoolConfig {
+    /** Maximum number of connections in the pool (default: 20) */
+    max?: number;
+    /** Close idle connections after this many ms (default: 30 000) */
+    idleTimeoutMillis?: number;
+    /** Abort connection attempts after this many ms (default: 10 000) */
+    connectionTimeoutMillis?: number;
+    /** Per-query timeout in ms (default: 30 000) */
+    queryTimeout?: number;
+    /** Per-statement timeout in ms (default: 30 000) */
+    statementTimeout?: number;
+    /** Enable TCP keep-alive (default: true) */
+    keepAlive?: boolean;
+}
+/**
+ * Create a Drizzle-backed Postgres connection with a production-grade
+ * connection pool.
+ *
+ * @param connectionString  Postgres connection URL
+ * @param schema            Optional Drizzle schema for the relational API
+ * @param poolConfig        Optional pool tuning (merged over defaults)
+ *
+ * @returns `{ db, pool, connectionString }` — the `pool` is exposed so
+ *          callers can register shutdown hooks (`pool.end()`) or monitor
+ *          pool metrics.
+ */
+export declare function createPostgresDatabaseConnection(connectionString: string, schema?: Record<string, unknown>, poolConfig?: PostgresPoolConfig): {
+    db: import("drizzle-orm/node-postgres").NodePgDatabase<Record<string, unknown>> & {
+        $client: Pool;
+    };
+    pool: Pool;
+    connectionString: string;
+};
+/**
+ * Create a direct (non-pooled) connection for operations that require
+ * session-level features incompatible with PgBouncer transaction mode,
+ * such as LISTEN/NOTIFY, prepared statements, or advisory locks.
+ *
+ * Uses a smaller pool since this is only for specific use cases.
+ */
+export declare function createDirectDatabaseConnection(connectionString: string, schema?: Record<string, unknown>, poolConfig?: PostgresPoolConfig): {
+    db: import("drizzle-orm/node-postgres").NodePgDatabase<Record<string, unknown>> & {
+        $client: Pool;
+    };
+    pool: Pool;
+    connectionString: string;
+};
+/**
+ * Create a read-only connection for routing read queries to replicas.
+ * Uses a moderate pool size since reads are distributed across replicas.
+ */
+export declare function createReadReplicaConnection(connectionString: string, schema?: Record<string, unknown>, poolConfig?: PostgresPoolConfig): {
+    db: import("drizzle-orm/node-postgres").NodePgDatabase<Record<string, unknown>> & {
+        $client: Pool;
+    };
+    pool: Pool;
+    connectionString: string;
+};