@rebasepro/server 0.12.1-canary.gf5f1d39 → 0.13.0

package/dist/backend-CIxN4FVm.js

@@ -0,0 +1,15 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+//#region ../types/src/types/backend.ts
+/**
+* Type guard: does this admin support SQL operations?
+* @group Admin
+*/
+function isSQLAdmin(admin) {
+	return !!admin && typeof admin.executeSql === "function";
+}
+//#endregion
+export { isSQLAdmin as t };
+
+//# sourceMappingURL=backend-CIxN4FVm.js.map

package/dist/backend-CIxN4FVm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-CIxN4FVm.js","names":[],"sources":["../../types/src/types/backend.ts"],"sourcesContent":["import type { CollectionConfig, FilterValues, WhereFilterOp } from \"./collections\";\nimport type { LogicalCondition } from \"../controllers/data\";\nimport type { AuthAdapter } from \"./auth_adapter\";\nimport type { HistoryConfig } from \"../controllers/client\";\nimport type { ChannelBusSetting } from \"./channel_bus\";\n\n// =============================================================================\n// DATABASE CONNECTION INTERFACES\n// =============================================================================\n\n/**\n * Abstract database connection interface.\n * Represents a connection to any database system.\n */\nexport interface DatabaseConnection {\n    /**\n     * Type identifier for this database (e.g., 'postgres', 'mongodb', 'mysql')\n     */\n    readonly type: string;\n\n    /**\n     * Whether the connection is currently active\n     */\n    readonly isConnected?: boolean;\n\n    /**\n     * Close the database connection and release resources.\n     */\n    close?(): Promise<void>;\n}\n\n// =============================================================================\n// QUERY BUILDING INTERFACES\n// =============================================================================\n\n/**\n * A single filter condition for database queries\n */\nexport interface QueryFilter {\n    field: string;\n    operator: WhereFilterOp;\n    value: unknown;\n}\n\n/**\n * Options for fetching a collection of entities\n */\nexport interface FetchCollectionOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    orderBy?: string;\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    offset?: number;\n    startAfter?: unknown;\n    searchString?: string;\n    databaseId?: string;\n    collection?: CollectionConfig;\n}\n\n/**\n * Options for searching entities\n */\nexport interface SearchOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    orderBy?: string;\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    databaseId?: string;\n    collection?: CollectionConfig;\n}\n\n/**\n * Options for counting entities\n */\nexport interface CountOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    /**\n     * An `or(...)`/`and(...)` group, alongside `filter`.\n     *\n     * Counted as well as fetched, or `total` describes a different set of rows\n     * from the one that was served — the same reason `filter` is here.\n     */\n    logical?: LogicalCondition;\n    searchString?: string;\n    databaseId?: string;\n}\n\n/**\n * Abstract condition builder interface.\n * Implementations translate Rebase filter conditions to database-specific queries.\n *\n * Note: This interface can be implemented as instance methods or as a class with static methods.\n * For static implementations (like DrizzleConditionBuilder), use the ConditionBuilderStatic type.\n *\n * @template T The type of condition returned by the builder (e.g., SQL for PostgreSQL, Filter<Document> for MongoDB)\n */\nexport interface ConditionBuilder<T = unknown> {\n    /**\n     * Build filter conditions from Rebase FilterValues\n     */\n    buildFilterConditions<M extends Record<string, unknown>>(\n        filter: FilterValues<Extract<keyof M, string>>,\n        collectionPath: string,\n        ...args: unknown[]\n    ): T[];\n\n    /**\n     * Build search conditions for text search\n     */\n    buildSearchConditions(\n        searchString: string,\n        properties: Record<string, unknown>,\n        ...args: unknown[]\n    ): T[];\n\n    /**\n     * Combine multiple conditions with AND operator\n     */\n    combineConditionsWithAnd(conditions: T[]): T | undefined;\n\n    /**\n     * Combine multiple conditions with OR operator\n     */\n    combineConditionsWithOr(conditions: T[]): T | undefined;\n}\n\n/**\n * Static condition builder type for implementations using static methods.\n * Use this type when the class provides static methods rather than instance methods.\n *\n * @example\n * // DrizzleConditionBuilder satisfies this type\n * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;\n */\nexport type ConditionBuilderStatic<T = unknown> = {\n    buildFilterConditions<M extends Record<string, unknown>>(\n        filter: FilterValues<Extract<keyof M, string>>,\n        ...args: unknown[]\n    ): T[];\n    buildSearchConditions(\n        searchString: string,\n        properties: Record<string, unknown>,\n        ...args: unknown[]\n    ): T[];\n    combineConditionsWithAnd(conditions: T[]): T | undefined;\n    combineConditionsWithOr(conditions: T[]): T | undefined;\n};\n\n// =============================================================================\n// ENTITY REPOSITORY INTERFACES\n// =============================================================================\n\n/**\n * Abstract entity repository interface.\n * Handles all CRUD operations for entities in the database.\n *\n * Implementations should handle:\n * - Entity serialization/deserialization\n * - Relation resolution\n * - ID generation and conversion\n */\nexport interface DataRepository {\n    /**\n     * Fetch a single entity by ID\n     */\n    fetchOne<M extends Record<string, unknown>>(\n        collectionPath: string,\n        id: string | number,\n        databaseId?: string\n    ): Promise<Record<string, unknown> | undefined>;\n\n    /**\n     * Fetch a collection of entities with optional filtering, ordering, and pagination\n     */\n    fetchCollection<M extends Record<string, unknown>>(\n        collectionPath: string,\n        options?: FetchCollectionOptions<M>\n    ): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Search entities by text\n     */\n    searchRows<M extends Record<string, unknown>>(\n        collectionPath: string,\n        searchString: string,\n        options?: SearchOptions<M>\n    ): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Count entities in a collection\n     */\n    count<M extends Record<string, unknown>>(\n        collectionPath: string,\n        options?: CountOptions<M>\n    ): Promise<number>;\n\n    /**\n     * Save a entity (create or update)\n     */\n    save<M extends Record<string, unknown>>(\n        collectionPath: string,\n        values: Partial<M>,\n        id?: string | number,\n        databaseId?: string\n    ): Promise<Record<string, unknown>>;\n\n    /**\n     * Delete a entity by ID\n     */\n    delete(\n        collectionPath: string,\n        id: string | number,\n        databaseId?: string\n    ): Promise<void>;\n\n    /**\n     * Check if a field value is unique in a collection\n     */\n    checkUniqueField(\n        collectionPath: string,\n        fieldName: string,\n        value: unknown,\n        excludeEntityId?: string,\n        databaseId?: string\n    ): Promise<boolean>;\n\n}\n\n// =============================================================================\n// REALTIME INTERFACES\n// =============================================================================\n\n/**\n * Configuration for subscribing to a collection\n */\nexport interface CollectionSubscriptionConfig {\n    clientId: string;\n    path: string;\n    filter?: unknown;\n    orderBy?: string;\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    startAfter?: unknown;\n    databaseId?: string;\n    searchString?: string;\n}\n\n/**\n * Configuration for subscribing to a single entity\n */\nexport interface SingleSubscriptionConfig {\n    clientId: string;\n    path: string;\n    id: string | number;\n}\n\n/**\n * Opt-in retention for one set of broadcast channels.\n *\n * Retention is configured on the server and nowhere else. A channel is created\n * by whoever names it, so letting a client ask for its own history depth would\n * let any visitor commit the backend to unbounded storage; and presence-only or\n * notification-only channels — the overwhelming majority — must not pay for a\n * feature they never use. With no rules configured nothing is written, no table\n * is created, and broadcast behaves exactly as it did before history existed.\n */\nexport interface ChannelRetentionRule {\n    /**\n     * Channel name to match. Either exact (`\"doc:42\"`) or a trailing-`*` prefix\n     * (`\"doc:*\"`). Deliberately not a full glob or RegExp: this decides what\n     * gets written to disk, and a rule whose blast radius is not obvious at a\n     * glance is the wrong shape for that.\n     */\n    match: string;\n    /** Keep at most this many of the most recent messages per channel. */\n    limit?: number;\n    /**\n     * Keep messages for at most this long. Accepts a millisecond count or a\n     * short duration string (`\"30s\"`, `\"15m\"`, `\"24h\"`, `\"7d\"`).\n     */\n    ttl?: number | string;\n}\n\n/**\n * Server-side realtime options.\n *\n * The channel bus contract and its config live in `./channel_bus` so that a\n * transport shipped as its own package depends on the contract alone.\n */\nexport interface RealtimeChannelsConfig {\n    /**\n     * Retention rules, most specific first — the first match wins. Omitted or\n     * empty means no channel retains anything.\n     */\n    channels?: ChannelRetentionRule[];\n    /**\n     * How channel broadcast and presence reach other backend instances.\n     * Defaults to `{ type: \"memory\" }` — i.e. they don't.\n     */\n    bus?: ChannelBusSetting;\n}\n\n/**\n * Abstract realtime provider interface.\n * Handles real-time subscriptions and notifications for entity changes.\n */\nexport interface RealtimeProvider {\n    /**\n     * Subscribe to collection changes\n     */\n    subscribeToCollection(\n        subscriptionId: string,\n        config: CollectionSubscriptionConfig,\n        callback?: (rows: Record<string, unknown>[]) => void\n    ): void;\n\n    /**\n     * Subscribe to single entity changes\n     */\n    subscribeToOne(\n        subscriptionId: string,\n        config: SingleSubscriptionConfig,\n        callback?: (row: Record<string, unknown> | null) => void\n    ): void;\n\n    /**\n     * Unsubscribe from a subscription\n     */\n    unsubscribe(subscriptionId: string): void;\n\n    /**\n     * Notify all relevant subscribers of a entity update\n     */\n    notifyUpdate(\n        path: string,\n        id: string,\n        row: Record<string, unknown> | null,\n        databaseId?: string\n    ): Promise<void>;\n\n    /**\n     * Called when the HTTP server is ready and listening.\n     * Useful for providers that need the server address for callbacks.\n     */\n    onServerReady?(serverInfo: { port: number; hostname?: string }): void;\n\n    /**\n     * Gracefully shut down the realtime provider.\n     * Called during server shutdown to clean up resources.\n     */\n    destroy?(): Promise<void>;\n\n    /**\n     * Stop the internal LISTEN client (e.g., PostgreSQL LISTEN/NOTIFY).\n     * Called during graceful shutdown before closing database connections.\n     */\n    stopListening?(): Promise<void>;\n}\n\n// =============================================================================\n// COLLECTION REGISTRY INTERFACES\n// =============================================================================\n\n/**\n * Abstract collection registry interface.\n * Manages registration and lookup of entity collections.\n */\nexport interface CollectionRegistryInterface {\n    /**\n     * Register a collection\n     */\n    register(collection: CollectionConfig): void;\n\n    /**\n     * Get a collection by its path\n     */\n    getCollectionByPath(path: string): CollectionConfig | undefined;\n\n    /**\n     * Get all registered collections\n     */\n    getCollections(): CollectionConfig[];\n\n    /**\n     * Get the currently registered global callbacks, if any.\n     */\n    getGlobalCallbacks(): any | undefined;\n}\n\n// =============================================================================\n// DATA TRANSFORMER INTERFACES\n// =============================================================================\n\n/**\n * Abstract data transformer interface.\n * Handles serialization/deserialization between frontend and database formats.\n */\nexport interface DataTransformer {\n    /**\n     * Transform entity data for storage in the database\n     */\n    serializeToDatabase<M extends Record<string, unknown>>(\n        entity: M,\n        collection: CollectionConfig\n    ): Record<string, unknown>;\n\n    /**\n     * Transform database data back to entity format\n     */\n    deserializeFromDatabase<M extends Record<string, unknown>>(\n        data: Record<string, unknown>,\n        collection: CollectionConfig\n    ): Promise<M>;\n}\n\n// =============================================================================\n// DATABASE ADMIN — CAPABILITY-SPECIFIC INTERFACES (1.3)\n// =============================================================================\n\n/**\n * Administrative operations for SQL-based databases (PostgreSQL, MySQL, etc.).\n * Used by the SQL Editor, RLS Editor, and schema browser.\n *\n * @group Admin\n */\nexport interface SQLAdmin {\n    /**\n     * Execute raw SQL against the database.\n     */\n    executeSql(sql: string, options?: { database?: string; role?: string; params?: unknown[] }): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Fetch the available databases on the server.\n     */\n    fetchAvailableDatabases?(): Promise<string[]>;\n\n    /**\n     * Fetch the available *native PostgreSQL* database roles (from `pg_roles`).\n     *\n     * These are connection-level roles — what the SQL editor can `SET ROLE` to,\n     * and what `SecurityRule.pgRoles` targets. They are NOT application roles;\n     * for those use {@link fetchApplicationRoles}.\n     */\n    fetchAvailableRoles?(): Promise<string[]>;\n\n    /**\n     * Fetch the *application-level* roles in use in this project.\n     *\n     * These are the strings stored on the users table's `roles` column and\n     * exposed to policies as `auth.roles()` — what `SecurityRule.roles`\n     * matches against. Distinct from {@link fetchAvailableRoles}; the two are\n     * not interchangeable.\n     */\n    fetchApplicationRoles?(): Promise<string[]>;\n\n    /**\n     * Fetch the current database name.\n     */\n    fetchCurrentDatabase?(): Promise<string | undefined>;\n}\n\n/**\n * Administrative operations for document-based databases (MongoDB, Firestore, etc.).\n * Used by future document administration tools.\n *\n * @group Admin\n */\nexport interface DocumentAdmin {\n    /**\n     * Execute an aggregation pipeline or equivalent query.\n     */\n    executeAggregate?(pipeline: Record<string, unknown>[]): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Fetch statistics for a collection (document count, size, etc.).\n     */\n    fetchCollectionStats?(collectionName: string): Promise<{ count: number; sizeBytes?: number }>;\n}\n\n/**\n * Administrative operations for schema management.\n * Shared across SQL and document databases.\n *\n * @group Admin\n */\nexport interface SchemaAdmin {\n    /**\n     * Fetch database tables/collections not yet mapped to a Rebase collection.\n     */\n    fetchUnmappedTables?(mappedPaths?: string[]): Promise<string[]>;\n\n    /**\n     * Fetch column/field metadata for a single table/collection.\n     * The return type is generic — SQL backends return TableMetadata,\n     * document backends may return a different shape.\n     */\n    fetchTableMetadata?(tableName: string): Promise<unknown>;\n}\n\n/**\n * Metadata for a database branch.\n * @group Admin\n */\nexport interface BranchInfo {\n    /** Branch name (without prefix). */\n    name: string;\n    /** The database this branch was created from. */\n    parentDatabase: string;\n    /** When the branch was created. */\n    createdAt: Date;\n    /** Size in bytes, if available from the server. */\n    sizeBytes?: number;\n}\n\n/**\n * Administrative operations for database branching.\n * Allows creating isolated database copies for development/preview workflows.\n *\n * @group Admin\n */\nexport interface BranchAdmin {\n    /** Create a new branch (database copy) from the current or specified source database. */\n    createBranch(name: string, options?: { source?: string }): Promise<BranchInfo>;\n\n    /** Delete a branch database. Cannot delete the main/default database. */\n    deleteBranch(name: string): Promise<void>;\n\n    /** List all branches (databases that were created via branching). */\n    listBranches(): Promise<BranchInfo[]>;\n\n    /** Get info about a specific branch. */\n    getBranchInfo(name: string): Promise<BranchInfo | undefined>;\n}\n\n/**\n * Union type for all admin capabilities.\n * A backend may implement any combination of these interfaces.\n *\n * Use type guards (`isSQLAdmin`, `isDocumentAdmin`, `isSchemaAdmin`, `isBranchAdmin`)\n * to safely narrow the type before calling methods.\n *\n * @group Admin\n */\nexport type DatabaseAdmin = Partial<SQLAdmin> & Partial<DocumentAdmin> & Partial<SchemaAdmin> & Partial<BranchAdmin>;\n\n/**\n * Type guard: does this admin support SQL operations?\n * @group Admin\n */\nexport function isSQLAdmin(admin: DatabaseAdmin | undefined): admin is SQLAdmin {\n    return !!admin && typeof (admin as SQLAdmin).executeSql === \"function\";\n}\n\n/**\n * Type guard: does this admin support document operations?\n * @group Admin\n */\nexport function isDocumentAdmin(admin: DatabaseAdmin | undefined): admin is DocumentAdmin {\n    return !!admin && (\n        typeof (admin as DocumentAdmin).executeAggregate === \"function\" ||\n        typeof (admin as DocumentAdmin).fetchCollectionStats === \"function\"\n    );\n}\n\n/**\n * Type guard: does this admin support schema management?\n * @group Admin\n */\nexport function isSchemaAdmin(admin: DatabaseAdmin | undefined): admin is SchemaAdmin {\n    return !!admin && (\n        typeof (admin as SchemaAdmin).fetchUnmappedTables === \"function\" ||\n        typeof (admin as SchemaAdmin).fetchTableMetadata === \"function\"\n    );\n}\n\n/**\n * Type guard: does this admin support database branching?\n * @group Admin\n */\nexport function isBranchAdmin(admin: DatabaseAdmin | undefined): admin is BranchAdmin {\n    return !!admin && typeof (admin as BranchAdmin).createBranch === \"function\";\n}\n\n// =============================================================================\n// LIFECYCLE INTERFACES (1.4)\n// =============================================================================\n\n/**\n * Health check result returned by `healthCheck()`.\n * @group Lifecycle\n */\nexport interface HealthCheckResult {\n    /** Whether the backend is healthy and able to serve requests. */\n    healthy: boolean;\n    /** Round-trip latency to the database in milliseconds. */\n    latencyMs: number;\n    /** Optional details (e.g., pool stats, replication lag). */\n    details?: Record<string, unknown>;\n}\n\n/**\n * Lifecycle contract for backend components that hold resources\n * (database connections, WebSocket pools, timers, etc.).\n *\n * All methods are optional — simple backends (e.g., in-memory) can skip them.\n * @group Lifecycle\n */\nexport interface BackendLifecycle {\n    /**\n     * Initialize the backend: open connections, run migrations, seed data.\n     * Called once during startup. Idempotent.\n     */\n    initialize?(): Promise<void>;\n\n    /**\n     * Check whether the backend is healthy and reachable.\n     * Should be fast (< 1 s) and safe to call frequently.\n     */\n    healthCheck?(): Promise<HealthCheckResult>;\n\n    /**\n     * Gracefully shut down: close connections, flush buffers, cancel timers.\n     * After calling `destroy()`, no other methods should be called.\n     */\n    destroy?(): Promise<void>;\n}\n\n// =============================================================================\n// BACKEND FACTORY INTERFACES\n// =============================================================================\n\n/**\n * Configuration for creating a database backend\n */\nexport interface BackendConfig {\n    /**\n     * Type of database backend\n     */\n    type: string;\n\n    /**\n     * Database connection (implementation-specific)\n     */\n    connection: unknown;\n\n    /**\n     * Schema definition (implementation-specific, e.g., Drizzle schema for PostgreSQL)\n     */\n    schema?: unknown;\n}\n\n/**\n * A complete backend instance with all required services.\n *\n * Now includes optional lifecycle management and admin capabilities.\n */\nexport interface BackendInstance extends BackendLifecycle {\n    /**\n     * Entity repository for CRUD operations\n     */\n    entityRepository: DataRepository;\n\n    /**\n     * Realtime provider for subscriptions\n     */\n    realtimeProvider: RealtimeProvider;\n\n    /**\n     * Collection registry\n     */\n    collectionRegistry: CollectionRegistryInterface;\n\n    /**\n     * The underlying database connection\n     */\n    connection: DatabaseConnection;\n\n    /**\n     * Administrative operations (SQL, schema, documents).\n     * What's available depends on the backend type — use type guards\n     * (`isSQLAdmin`, `isSchemaAdmin`, etc.) to narrow.\n     */\n    admin?: DatabaseAdmin;\n}\n\n/**\n * Factory function type for creating backend instances\n */\nexport type BackendFactory<TConfig extends BackendConfig = BackendConfig> =\n    (config: TConfig) => BackendInstance;\n\n// =============================================================================\n// BACKEND BOOTSTRAPPER (1.2)\n// =============================================================================\n\n/**\n * A `BackendBootstrapper` encapsulates all driver-specific initialization logic.\n *\n * Instead of hard-coding Postgres setup into `initializeRebaseBackend()`,\n * each database backend provides its own bootstrapper that knows how to:\n * - Create the DataDriver from a config object\n * - Optionally initialize auth tables\n * - Optionally create a realtime service\n * - Mount driver-specific API routes\n *\n * The main `initializeRebaseBackend()` becomes a **coordinator** that iterates\n * registered bootstrappers, calls their hooks, and wires the results together.\n *\n * @group Backend\n *\n * @example\n * ```typescript\n * // Third-party MySQL bootstrapper\n * const mysqlBootstrapper: BackendBootstrapper = {\n *   type: \"mysql\",\n *   initializeDriver: async (config) => new MySQLDataDriver(config.connection),\n *   initializeRealtime: async (config) => new MySQLChangeStreamRealtime(config.connection),\n * };\n *\n * initializeRebaseBackend({\n *   ...config,\n *   bootstrappers: [postgresBootstrapper, mysqlBootstrapper]\n * });\n * ```\n */\nexport interface BackendBootstrapper {\n    /**\n     * Which driver type this bootstrapper handles.\n     * Must match the `type` field on the driver config object\n     * (e.g., `\"postgres\"`, `\"mongodb\"`, `\"mysql\"`).\n     */\n    type: string;\n\n    /**\n     * Unique identifier for this bootstrapper instance.\n     * Used to register the driver in the driver registry.\n     * Defaults to `type` if not set.\n     */\n    id?: string;\n\n    /**\n     * Whether this bootstrapper provides the default driver.\n     * When true, the coordinator uses this driver as the primary one.\n     */\n    isDefault?: boolean;\n\n    /**\n     * Run database migrations for this driver.\n     * Called by the coordinator after all drivers are initialized.\n     */\n    runMigrations?(config: unknown, driverResult: InitializedDriver): Promise<void>;\n\n    /**\n     * Create a DataDriver from the given config.\n     * This is the only **required** method.\n     */\n    initializeDriver(config: unknown): Promise<InitializedDriver>;\n\n    /**\n     * Initialize auth tables / services if this driver supports them.\n     * Return undefined if auth is not supported by this backend.\n     */\n    initializeAuth?(config: unknown, driverResult: InitializedDriver): Promise<BootstrappedAuth | undefined>;\n\n    /**\n     * Initialize history tables / services if this driver supports them.\n     * Return undefined if history is not supported by this backend.\n     */\n    initializeHistory?(config: HistoryConfig, driverResult: InitializedDriver): Promise<{ historyService: unknown } | undefined>;\n\n    /**\n     * Create a realtime provider for this driver.\n     * Return undefined if the driver does not support realtime.\n     */\n    initializeRealtime?(config: unknown, driverResult: InitializedDriver): Promise<RealtimeProvider | undefined>;\n\n    /**\n     * Mount any driver-specific HTTP routes (e.g., custom admin endpoints).\n     * Called after all drivers are initialized.\n     */\n    mountRoutes?(app: unknown, basePath: string, driverResult: InitializedDriver): void;\n\n    /**\n     * Return admin capabilities for this driver.\n     */\n    getAdmin?(driverResult: InitializedDriver): DatabaseAdmin | undefined;\n\n    /**\n     * Bring the database's collection tables up to date, additively.\n     *\n     * Optional because it is only meaningful for schema-ful drivers. A managed\n     * runtime boots a compiled project against a database it has never seen; auth\n     * tables are ensured on boot but collection tables were created by nothing,\n     * so every data request answered 500 on a missing relation. The CLI's `db\n     * push` cannot fill the gap — it needs Atlas, and the runtime image ships no\n     * CLI.\n     *\n     * Implementations MUST be additive-only: create missing tables, columns and\n     * enum types, and never drop, narrow or rewrite anything. This runs\n     * unattended against live customer data with nobody reading a diff, so the\n     * destructive half stays a deliberate migration.\n     */\n    ensureCollectionSchema?(\n        collections: unknown[],\n        driverResult: InitializedDriver,\n        log?: (message: string) => void\n    ): Promise<{ applied: number }>;\n\n    /**\n     * Apply the collections' row-level-security policies, additively and\n     * idempotently — the companion to {@link ensureCollectionSchema}.\n     *\n     * That method creates the tables; a table with RLS disabled and no policies\n     * is not servable, because authenticated requests run as a restricted role:\n     * a read with no `SELECT` policy returns nothing (a public collection\n     * answers 401) and a write with no `INSERT`/`UPDATE` policy is denied. The\n     * `db push` CLI applies these from the same collections, but it cannot reach\n     * a managed tenant's in-cluster database — the runtime, already connected,\n     * is the only thing that can.\n     *\n     * MUST be idempotent (re-run on every boot) and MUST NOT be destructive.\n     * Runs after auth initialization, because the generated policies call the\n     * `auth.*` helper functions and `CREATE POLICY` validates they exist.\n     */\n    ensureCollectionPolicies?(\n        collections: unknown[],\n        driverResult: InitializedDriver,\n        log?: (message: string) => void\n    ): Promise<{ applied: number }>;\n\n    /**\n     * Initialize WebSocket server for realtime operations.\n     */\n    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: import(\"../controllers/data_driver\").DataDriver, config?: unknown, authAdapter?: AuthAdapter): Promise<void> | void;\n}\n\n/**\n * Result of `BackendBootstrapper.initializeDriver()`.\n * @group Backend\n */\nexport interface InitializedDriver {\n    /** The DataDriver instance, ready for use. */\n    driver: import(\"../controllers/data_driver\").DataDriver;\n\n    /** The realtime service, if the driver created one during init. */\n    realtimeProvider?: RealtimeProvider;\n\n    /** A collection registry to register schema / tables into. */\n    collectionRegistry?: CollectionRegistryInterface;\n\n    /**\n     * Collections the driver derived from the live database schema.\n     *\n     * Set by drivers that introspect in `baas` mode; the server serves these\n     * instead of collections loaded from config files.\n     */\n    collections?: import(\"./collections\").CollectionConfig[];\n\n    /** The underlying database connection (for lifecycle management). */\n    connection?: DatabaseConnection;\n\n    /**\n     * Opaque handle that the bootstrapper can use in subsequent hooks\n     * (e.g., `initializeAuth`, `mountRoutes`) to access driver internals.\n     * Not used by the coordinator.\n     */\n    internals?: unknown;\n}\n\n/**\n * Result of `BackendBootstrapper.initializeAuth()`.\n * @group Backend\n */\nexport interface BootstrappedAuth {\n    /** User management service. */\n    userService: unknown;\n    /** Role management service (optional, roles are now simple strings). */\n    roleService?: unknown;\n    /** Email service (optional). */\n    emailService?: unknown;\n    /** Combined Auth Repository for unified token and user management. */\n    authRepository?: unknown;\n    /**\n     * Whether the auth schema in the database is one this runtime can serve.\n     *\n     * Folded into `healthCheck()` so a schema mismatch shows up as a degraded\n     * health response. Without it, a server whose auth is entirely broken still\n     * reports healthy — the database connection it probes is fine, and the\n     * mismatch is only discovered one failed login at a time.\n     */\n    schemaHealthCheck?(): Promise<AuthSchemaHealth>;\n}\n\n/**\n * Result of {@link BootstrappedAuth.schemaHealthCheck}.\n * @group Lifecycle\n */\nexport interface AuthSchemaHealth {\n    /** False when this runtime cannot be trusted to serve auth against this database. */\n    healthy: boolean;\n    /** Human-readable descriptions of each mismatch found. Empty when healthy. */\n    problems: string[];\n    /** Auth schema version recorded in the database, when it records one. */\n    databaseVersion?: number | null;\n    /** Auth schema version this runtime expects. */\n    runtimeVersion?: number;\n}\n"],"mappings":";;;;;;;;AAqiBA,SAAgB,WAAW,OAAqD;CAC5E,OAAO,CAAC,CAAC,SAAS,OAAQ,MAAmB,eAAe;AAChE"}

package/dist/backup-CVggVhR2.js

@@ -0,0 +1,163 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
+import { n as errorHandler, t as ApiError } from "./errors-CgkCzoj7.js";
+import fs from "fs";
+import path from "path";
+import { Hono } from "hono";
+//#region src/backup/backup-common.ts
+/**
+* Storage-generic backup helpers used by the admin backup routes.
+*
+* These live in server (which owns {@link StorageController}) so the
+* admin API can list backups without depending on the Postgres driver —
+* `server` must not import from `server-postgres`. The `pg_dump`-side
+* copies of the tiny pure parsers live in `@rebasepro/server-postgres`;
+* keep the two in sync if the naming scheme ever changes.
+*/
+/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */
+function parseBackupDestination(out) {
+	const s3 = out.match(/^s3:\/\/([^/]+)\/?(.*)$/);
+	if (s3) return {
+		kind: "s3",
+		bucket: s3[1],
+		prefix: s3[2].replace(/\/+$/, "")
+	};
+	const gcs = out.match(/^gs:\/\/([^/]+)\/?(.*)$/);
+	if (gcs) return {
+		kind: "gcs",
+		bucket: gcs[1],
+		prefix: gcs[2].replace(/\/+$/, "")
+	};
+	return {
+		kind: "local",
+		path: out
+	};
+}
+/**
+* Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.
+* Returns `null` for names that don't match, so foreign objects are ignored.
+*/
+function parseBackupTimestamp(fileName) {
+	const match = (fileName.split("/").pop() ?? fileName).match(/-(\d{8})T(\d{6})Z\.dump$/);
+	if (!match) return null;
+	const [, ymd, hms] = match;
+	const iso = `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;
+	const date = new Date(iso);
+	return Number.isNaN(date.getTime()) ? null : date;
+}
+/**
+* List the backups at a destination as {@link BackupInfo}, newest first.
+* Only `.dump` files are considered.
+*/
+async function listBackupObjects(dest, storage) {
+	if (dest.kind === "local") {
+		if (!fs.existsSync(dest.path)) return [];
+		const dir = fs.statSync(dest.path).isDirectory() ? dest.path : path.dirname(dest.path);
+		if (!fs.existsSync(dir)) return [];
+		return fs.readdirSync(dir).filter((f) => f.endsWith(".dump")).map((f) => {
+			const full = path.join(dir, f);
+			const st = fs.statSync(full);
+			const createdAt = parseBackupTimestamp(f) ?? st.mtime;
+			return {
+				key: full,
+				name: f,
+				sizeBytes: st.size,
+				createdAt: createdAt.toISOString(),
+				destinationKind: "local"
+			};
+		}).sort(byNewest);
+	}
+	if (!storage) return [];
+	return (await storage.listObjects(dest.prefix ? `${dest.prefix}/` : "", {
+		bucket: dest.bucket,
+		maxResults: 1e3
+	})).items.map((item) => item.fullPath).filter((key) => key.endsWith(".dump")).map((key) => {
+		const createdAt = parseBackupTimestamp(key);
+		return {
+			key,
+			name: key.split("/").pop() || key,
+			createdAt: createdAt ? createdAt.toISOString() : void 0,
+			destinationKind: dest.kind
+		};
+	}).sort(byNewest);
+}
+function byNewest(a, b) {
+	const ta = a.createdAt ? Date.parse(a.createdAt) : 0;
+	return (b.createdAt ? Date.parse(b.createdAt) : 0) - ta;
+}
+/** Read a single backup's bytes. Guards against path traversal for local. */
+async function readBackupBytes(dest, key, storage) {
+	if (dest.kind === "local") {
+		const dir = (fs.existsSync(dest.path) ? fs.statSync(dest.path) : null)?.isDirectory() ? dest.path : path.dirname(dest.path);
+		const resolvedDir = path.resolve(dir);
+		const resolved = path.resolve(key);
+		if (!resolved.startsWith(resolvedDir + path.sep) || !resolved.endsWith(".dump")) return null;
+		if (!fs.existsSync(resolved)) return null;
+		return {
+			bytes: new Uint8Array(fs.readFileSync(resolved)),
+			name: path.basename(resolved)
+		};
+	}
+	if (!storage) return null;
+	if (!key.endsWith(".dump")) return null;
+	const file = await storage.getObject(key, dest.bucket);
+	if (!file) return null;
+	return {
+		bytes: new Uint8Array(await file.arrayBuffer()),
+		name: key.split("/").pop() || key
+	};
+}
+//#endregion
+//#region src/backup/backup-routes.ts
+/**
+* Admin REST routes for the Backups panel.
+*
+* Routes (mounted under `/admin/backups`, admin-guarded by the caller):
+*   GET /            → list available backups
+*   GET /download    → download a backup's bytes (?key=…)
+*/
+function createBackupRoutes(config) {
+	const router = new Hono();
+	router.onError(errorHandler);
+	router.get("/", async (c) => {
+		const dest = config.getDestination();
+		if (!dest) return c.json({
+			backups: [],
+			destinationKind: "local",
+			configured: false
+		});
+		const backups = await listBackupObjects(dest, config.storage);
+		return c.json({
+			backups,
+			destinationKind: dest.kind,
+			configured: true
+		});
+	});
+	router.get("/download", async (c) => {
+		const dest = config.getDestination();
+		if (!dest) throw ApiError.badRequest("Backups are not configured (set BACKUP_DESTINATION).");
+		const key = c.req.query("key");
+		if (!key) throw ApiError.badRequest("Missing 'key' query parameter.");
+		const result = await readBackupBytes(dest, key, config.storage);
+		if (!result) throw ApiError.notFound(`Backup not found: ${key}`);
+		c.header("Content-Type", "application/octet-stream");
+		c.header("Content-Disposition", `attachment; filename="${result.name}"`);
+		return c.body(result.bytes);
+	});
+	return router;
+}
+//#endregion
+//#region src/backup/index.ts
+var backup_exports = /* @__PURE__ */ __exportAll({
+	createBackupRoutes: () => createBackupRoutes,
+	listBackupObjects: () => listBackupObjects,
+	parseBackupDestination: () => parseBackupDestination,
+	parseBackupTimestamp: () => parseBackupTimestamp,
+	readBackupBytes: () => readBackupBytes
+});
+//#endregion
+export { parseBackupTimestamp as a, parseBackupDestination as i, createBackupRoutes as n, readBackupBytes as o, listBackupObjects as r, backup_exports as t };
+
+//# sourceMappingURL=backup-CVggVhR2.js.map

package/dist/backup-CVggVhR2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-CVggVhR2.js","names":[],"sources":["../src/backup/backup-common.ts","../src/backup/backup-routes.ts","../src/backup/index.ts"],"sourcesContent":["/**\n * Storage-generic backup helpers used by the admin backup routes.\n *\n * These live in server (which owns {@link StorageController}) so the\n * admin API can list backups without depending on the Postgres driver —\n * `server` must not import from `server-postgres`. The `pg_dump`-side\n * copies of the tiny pure parsers live in `@rebasepro/server-postgres`;\n * keep the two in sync if the naming scheme ever changes.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport type { BackupInfo, BackupDestinationKind } from \"@rebasepro/types\";\nimport type { StorageController } from \"../storage\";\n\nexport type BackupDestination =\n    | { kind: \"local\"; path: string }\n    | { kind: \"s3\"; bucket: string; prefix: string }\n    | { kind: \"gcs\"; bucket: string; prefix: string };\n\n/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */\nexport function parseBackupDestination(out: string): BackupDestination {\n    const s3 = out.match(/^s3:\\/\\/([^/]+)\\/?(.*)$/);\n    if (s3) return { kind: \"s3\", bucket: s3[1], prefix: s3[2].replace(/\\/+$/, \"\") };\n    const gcs = out.match(/^gs:\\/\\/([^/]+)\\/?(.*)$/);\n    if (gcs) return { kind: \"gcs\", bucket: gcs[1], prefix: gcs[2].replace(/\\/+$/, \"\") };\n    return { kind: \"local\", path: out };\n}\n\n/**\n * Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.\n * Returns `null` for names that don't match, so foreign objects are ignored.\n */\nexport function parseBackupTimestamp(fileName: string): Date | null {\n    const base = fileName.split(\"/\").pop() ?? fileName;\n    const match = base.match(/-(\\d{8})T(\\d{6})Z\\.dump$/);\n    if (!match) return null;\n    const [, ymd, hms] = match;\n    const iso =\n        `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}` +\n        `T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;\n    const date = new Date(iso);\n    return Number.isNaN(date.getTime()) ? null : date;\n}\n\n/**\n * List the backups at a destination as {@link BackupInfo}, newest first.\n * Only `.dump` files are considered.\n */\nexport async function listBackupObjects(\n    dest: BackupDestination,\n    storage?: StorageController\n): Promise<BackupInfo[]> {\n    if (dest.kind === \"local\") {\n        if (!fs.existsSync(dest.path)) return [];\n        const stat = fs.statSync(dest.path);\n        const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);\n        if (!fs.existsSync(dir)) return [];\n        return fs\n            .readdirSync(dir)\n            .filter((f) => f.endsWith(\".dump\"))\n            .map((f): BackupInfo => {\n                const full = path.join(dir, f);\n                const st = fs.statSync(full);\n                const createdAt = parseBackupTimestamp(f) ?? st.mtime;\n                return {\n                    key: full,\n                    name: f,\n                    sizeBytes: st.size,\n                    createdAt: createdAt.toISOString(),\n                    destinationKind: \"local\"\n                };\n            })\n            .sort(byNewest);\n    }\n\n    if (!storage) return [];\n    const result = await storage.listObjects(dest.prefix ? `${dest.prefix}/` : \"\", {\n        bucket: dest.bucket,\n        maxResults: 1000\n    });\n    return result.items\n        .map((item) => item.fullPath)\n        .filter((key) => key.endsWith(\".dump\"))\n        .map((key): BackupInfo => {\n            const createdAt = parseBackupTimestamp(key);\n            return {\n                key,\n                name: key.split(\"/\").pop() || key,\n                createdAt: createdAt ? createdAt.toISOString() : undefined,\n                destinationKind: dest.kind as BackupDestinationKind\n            };\n        })\n        .sort(byNewest);\n}\n\nfunction byNewest(a: BackupInfo, b: BackupInfo): number {\n    const ta = a.createdAt ? Date.parse(a.createdAt) : 0;\n    const tb = b.createdAt ? Date.parse(b.createdAt) : 0;\n    return tb - ta;\n}\n\n/** Read a single backup's bytes. Guards against path traversal for local. */\nexport async function readBackupBytes(\n    dest: BackupDestination,\n    key: string,\n    storage?: StorageController\n): Promise<{ bytes: Uint8Array<ArrayBuffer>; name: string } | null> {\n    if (dest.kind === \"local\") {\n        const stat = fs.existsSync(dest.path) ? fs.statSync(dest.path) : null;\n        const dir = stat?.isDirectory() ? dest.path : path.dirname(dest.path);\n        const resolvedDir = path.resolve(dir);\n        const resolved = path.resolve(key);\n        // Only allow reads inside the backup directory, and only .dump files.\n        if (!resolved.startsWith(resolvedDir + path.sep) || !resolved.endsWith(\".dump\")) {\n            return null;\n        }\n        if (!fs.existsSync(resolved)) return null;\n        return { bytes: new Uint8Array(fs.readFileSync(resolved)), name: path.basename(resolved) };\n    }\n\n    if (!storage) return null;\n    if (!key.endsWith(\".dump\")) return null;\n    const file = await storage.getObject(key, dest.bucket);\n    if (!file) return null;\n    return { bytes: new Uint8Array(await file.arrayBuffer()), name: key.split(\"/\").pop() || key };\n}\n","import { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { ApiError, errorHandler } from \"../api/errors\";\nimport type { StorageController } from \"../storage\";\nimport { BackupDestination, listBackupObjects, readBackupBytes } from \"./backup-common\";\n\nexport interface BackupRoutesConfig {\n    /**\n     * Resolve the current backup destination, or `null` when backups are not\n     * configured (`BACKUP_DESTINATION` unset). Read lazily so a restart isn't\n     * required to pick up config.\n     */\n    getDestination: () => BackupDestination | null;\n    /** Storage controller for object-storage destinations. */\n    storage?: StorageController;\n}\n\n/**\n * Admin REST routes for the Backups panel.\n *\n * Routes (mounted under `/admin/backups`, admin-guarded by the caller):\n *   GET /            → list available backups\n *   GET /download    → download a backup's bytes (?key=…)\n */\nexport function createBackupRoutes(config: BackupRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    router.onError(errorHandler);\n\n    router.get(\"/\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            return c.json({ backups: [], destinationKind: \"local\" as const, configured: false });\n        }\n        const backups = await listBackupObjects(dest, config.storage);\n        return c.json({ backups, destinationKind: dest.kind, configured: true });\n    });\n\n    router.get(\"/download\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            throw ApiError.badRequest(\"Backups are not configured (set BACKUP_DESTINATION).\");\n        }\n        const key = c.req.query(\"key\");\n        if (!key) {\n            throw ApiError.badRequest(\"Missing 'key' query parameter.\");\n        }\n        const result = await readBackupBytes(dest, key, config.storage);\n        if (!result) {\n            throw ApiError.notFound(`Backup not found: ${key}`);\n        }\n        c.header(\"Content-Type\", \"application/octet-stream\");\n        c.header(\"Content-Disposition\", `attachment; filename=\"${result.name}\"`);\n        return c.body(result.bytes);\n    });\n\n    return router;\n}\n","/**\n * Storage-generic backup helpers and admin routes for the Backups panel.\n * The `pg_dump`/`pg_restore` machinery lives in `@rebasepro/server-postgres`.\n */\nexport * from \"./backup-common\";\nexport { createBackupRoutes } from \"./backup-routes\";\nexport type { BackupRoutesConfig } from \"./backup-routes\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,uBAAuB,KAAgC;CACnE,MAAM,KAAK,IAAI,MAAM,yBAAyB;CAC9C,IAAI,IAAI,OAAO;EAAE,MAAM;EAAM,QAAQ,GAAG;EAAI,QAAQ,GAAG,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAC9E,MAAM,MAAM,IAAI,MAAM,yBAAyB;CAC/C,IAAI,KAAK,OAAO;EAAE,MAAM;EAAO,QAAQ,IAAI;EAAI,QAAQ,IAAI,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAClF,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACtC;;;;;AAMA,SAAgB,qBAAqB,UAA+B;CAEhE,MAAM,SADO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAA,CACvB,MAAM,0BAA0B;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,KAAK,OAAO;CACrB,MAAM,MACF,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAA,GACnD,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE;CAC9D,MAAM,OAAO,IAAI,KAAK,GAAG;CACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO;AACjD;;;;;AAMA,eAAsB,kBAClB,MACA,SACqB;CACrB,IAAI,KAAK,SAAS,SAAS;EACvB,IAAI,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EAEvC,MAAM,MADO,GAAG,SAAS,KAAK,IAClB,CAAA,CAAK,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACnE,IAAI,CAAC,GAAG,WAAW,GAAG,GAAG,OAAO,CAAC;EACjC,OAAO,GACF,YAAY,GAAG,CAAC,CAChB,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK,MAAkB;GACpB,MAAM,OAAO,KAAK,KAAK,KAAK,CAAC;GAC7B,MAAM,KAAK,GAAG,SAAS,IAAI;GAC3B,MAAM,YAAY,qBAAqB,CAAC,KAAK,GAAG;GAChD,OAAO;IACH,KAAK;IACL,MAAM;IACN,WAAW,GAAG;IACd,WAAW,UAAU,YAAY;IACjC,iBAAiB;GACrB;EACJ,CAAC,CAAC,CACD,KAAK,QAAQ;CACtB;CAEA,IAAI,CAAC,SAAS,OAAO,CAAC;CAKtB,QAAO,MAJc,QAAQ,YAAY,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;EAC3E,QAAQ,KAAK;EACb,YAAY;CAChB,CAAC,EAAA,CACa,MACT,KAAK,SAAS,KAAK,QAAQ,CAAC,CAC5B,QAAQ,QAAQ,IAAI,SAAS,OAAO,CAAC,CAAC,CACtC,KAAK,QAAoB;EACtB,MAAM,YAAY,qBAAqB,GAAG;EAC1C,OAAO;GACH;GACA,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAC9B,WAAW,YAAY,UAAU,YAAY,IAAI,KAAA;GACjD,iBAAiB,KAAK;EAC1B;CACJ,CAAC,CAAC,CACD,KAAK,QAAQ;AACtB;AAEA,SAAS,SAAS,GAAe,GAAuB;CACpD,MAAM,KAAK,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI;CAEnD,QADW,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI,KACvC;AAChB;;AAGA,eAAsB,gBAClB,MACA,KACA,SACgE;CAChE,IAAI,KAAK,SAAS,SAAS;EAEvB,MAAM,OADO,GAAG,WAAW,KAAK,IAAI,IAAI,GAAG,SAAS,KAAK,IAAI,IAAI,KAAA,EAC/C,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACpE,MAAM,cAAc,KAAK,QAAQ,GAAG;EACpC,MAAM,WAAW,KAAK,QAAQ,GAAG;EAEjC,IAAI,CAAC,SAAS,WAAW,cAAc,KAAK,GAAG,KAAK,CAAC,SAAS,SAAS,OAAO,GAC1E,OAAO;EAEX,IAAI,CAAC,GAAG,WAAW,QAAQ,GAAG,OAAO;EACrC,OAAO;GAAE,OAAO,IAAI,WAAW,GAAG,aAAa,QAAQ,CAAC;GAAG,MAAM,KAAK,SAAS,QAAQ;EAAE;CAC7F;CAEA,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,CAAC,IAAI,SAAS,OAAO,GAAG,OAAO;CACnC,MAAM,OAAO,MAAM,QAAQ,UAAU,KAAK,KAAK,MAAM;CACrD,IAAI,CAAC,MAAM,OAAO;CAClB,OAAO;EAAE,OAAO,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;EAAG,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;CAAI;AAChG;;;;;;;;;;ACrGA,SAAgB,mBAAmB,QAA2C;CAC1E,MAAM,SAAS,IAAI,KAAc;CACjC,OAAO,QAAQ,YAAY;CAE3B,OAAO,IAAI,KAAK,OAAO,MAAM;EACzB,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,OAAO,EAAE,KAAK;GAAE,SAAS,CAAC;GAAG,iBAAiB;GAAkB,YAAY;EAAM,CAAC;EAEvF,MAAM,UAAU,MAAM,kBAAkB,MAAM,OAAO,OAAO;EAC5D,OAAO,EAAE,KAAK;GAAE;GAAS,iBAAiB,KAAK;GAAM,YAAY;EAAK,CAAC;CAC3E,CAAC;CAED,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,MAAM,SAAS,WAAW,sDAAsD;EAEpF,MAAM,MAAM,EAAE,IAAI,MAAM,KAAK;EAC7B,IAAI,CAAC,KACD,MAAM,SAAS,WAAW,gCAAgC;EAE9D,MAAM,SAAS,MAAM,gBAAgB,MAAM,KAAK,OAAO,OAAO;EAC9D,IAAI,CAAC,QACD,MAAM,SAAS,SAAS,qBAAqB,KAAK;EAEtD,EAAE,OAAO,gBAAgB,0BAA0B;EACnD,EAAE,OAAO,uBAAuB,yBAAyB,OAAO,KAAK,EAAE;EACvE,OAAO,EAAE,KAAK,OAAO,KAAK;CAC9B,CAAC;CAED,OAAO;AACX"}

package/dist/boot/boot.d.ts

@@ -57,3 +57,56 @@ export declare function bootFromBundle(options?: BootOptions): Promise<BootedRun
  * bug and the trace is the point.
  */
 export declare function runFromBundle(options?: BootOptions): Promise<BootedRuntime>;
+/**
+ * Say so, once per boot, when a data source's driver is older than this runtime.
+ *
+ * The check exists because of how a managed deployment is assembled: the image
+ * supplies `@rebasepro/server` (the entrypoint symlinks it over the bundle's
+ * copy) while every driver comes from the bundle's own `deps.declared`, pinned
+ * by the project's package.json. So the platform can ship a fix, roll every
+ * tenant onto the new image, and still have none of them running the fixed
+ * driver. Nothing detected that before this: the halves simply disagreed in
+ * silence until some capability turned out to be missing three layers down.
+ *
+ * A warning rather than a refusal. Old drivers are usually fine — the pairing is
+ * supported, and a boot that dies on version arithmetic would be a far worse
+ * failure than the drift it is guarding against. This only has to make the skew
+ * *visible*, so that the next person reading the log starts from the right
+ * question.
+ */
+export declare function warnOnDriverSkew(dataSources: InitializedDataSource[], runtimeVersion: string | undefined): void;
+/**
+ * Bring the database's collection tables up to date before serving.
+ *
+ * Delegates to whichever driver bootstrapped the default data source; a driver
+ * without `ensureCollectionSchema` (a schemaless one, or an older build) skips
+ * rather than failing, which is why this cannot break an existing deployment.
+ *
+ * Every path out of here says why, at info or louder. Guaranteeing the tables
+ * exist is this function's entire job, so "it declined, and said nothing" is the
+ * one outcome it must never produce: a deployment that skips comes up answering
+ * sign-in and 500ing every `/api/data/*` route, and the operator's only evidence
+ * is what these lines print. Silence here has already sent one investigation
+ * chasing a stale runtime image that was not stale.
+ *
+ * Failure is fatal on purpose. Booting anyway would produce exactly the state
+ * this exists to prevent — an app that answers sign-in and 500s every data
+ * request — and a crash-looping pod with the DDL error in its logs is a far
+ * better signal than a running one that silently cannot serve.
+ */
+export declare function ensureCollectionSchema(bundle: LoadedBundle, dataSources: InitializedDataSource[], env: RebaseBootEnv): Promise<void>;
+/**
+ * Apply the project's RLS policies before serving — the companion to
+ * {@link ensureCollectionSchema}, which creates the tables this makes servable.
+ *
+ * Runs after `initializeRebaseBackend`, not alongside table creation: the
+ * generated policies call the `auth.*` helper functions, and `CREATE POLICY`
+ * validates those exist, so this cannot run before auth is initialized. The
+ * gate conditions mirror `ensureCollectionSchema` (mode, bundle shape, driver
+ * support) — and because that function already ran and explained any skip on
+ * this same boot, the benign gates here return quietly rather than logging the
+ * same reason twice. The one thing it does say out loud is a driver that
+ * created tables but cannot apply policies: that is the difference between a
+ * served collection and a 401, and it must not pass in silence.
+ */
+export declare function ensureCollectionPolicies(bundle: LoadedBundle, dataSources: InitializedDataSource[], env: RebaseBootEnv): Promise<void>;

package/dist/boot/driver.d.ts

@@ -1,4 +1,4 @@
-import type { BackendBootstrapper } from "@rebasepro/types";
+import type { BackendBootstrapper, DatabaseAdapter } from "@rebasepro/types";
 import type { ResolvedDataSourceConfig } from "./sources";
 /**
  * The connection handle a driver hands back at boot: the client object, the
@@ -39,6 +39,16 @@ export interface InitializedDataSource {
     key: string;
     engine: string;
     driverPackage: string;
+    /**
+     * The driver's installed version, when it could be read.
+     *
+     * Carried so a boot that finds a capability missing can say whether the
+     * driver is *old* or merely *different* — see `version-skew.ts`. Optional
+     * because a driver resolved from outside a `node_modules` tree (a linked
+     * workspace, a bare specifier) has no manifest to read, and that must not
+     * be fatal.
+     */
+    driverVersion?: string;
     bootstrapper: BackendBootstrapper;
     connection: DriverConnection;
 }
@@ -47,6 +57,30 @@ export interface BundleSchema {
     enums?: Record<string, unknown>;
     relations?: Record<string, unknown>;
 }
+/**
+ * Where to look for packages a bundle brought with it.
+ *
+ * A driver has to be resolved relative to the **bundle**, not to this package.
+ * A bare `import("@rebasepro/server-postgres")` resolves from wherever the
+ * runtime itself is installed, which on a real deployment is somewhere else
+ * entirely — the runtime image holds the server, the bundle holds the project's
+ * dependencies. Resolving from the bundle is also the honest semantics: the
+ * project declares which driver it uses, so the project's tree is where to look.
+ *
+ * Several roots, because a driver is installed wherever the project keeps its
+ * dependencies: beside a built bundle, but inside the backend package in a
+ * workspace running from source.
+ */
+export declare function bundleResolutionRoots(bundleDir: string): string[];
+/**
+ * Wrap a `DatabaseAdapter` as a `BackendBootstrapper` carrying a registry id.
+ *
+ * `initializeRebaseBackend` does this internally for its single-adapter
+ * convenience path, but that path hardcodes one anonymous driver. Multiple
+ * sources need an explicit `id` per adapter, because the id is exactly what
+ * `collection.dataSource` routes against.
+ */
+export declare function adapterToBootstrapper(adapter: DatabaseAdapter, id: string, isDefault: boolean): BackendBootstrapper;
 /**
  * Build a driver for one data source.
  *
@@ -64,8 +98,3 @@ export declare function initializeDataSource(source: ResolvedDataSourceConfig, s
  * order a human would expect.
  */
 export declare function initializeDataSources(sources: ResolvedDataSourceConfig[], schema: BundleSchema | undefined, resolveFrom?: string[]): Promise<InitializedDataSource[]>;
-/**
- * @deprecated Use {@link DriverConnection}. This name collides with
- * `DatabaseConnection` from `@rebasepro/types`, which is a different shape.
- */
-export type DatabaseConnection = DriverConnection;

package/dist/boot/fetch-bundle.d.ts

@@ -0,0 +1,43 @@
+/** Where the runtime is told to fetch its bundle from. */
+export declare const BUNDLE_URL_ENV = "REBASE_BUNDLE_URL";
+/** Bearer token for that fetch. Does not expire — see the module note. */
+export declare const BUNDLE_TOKEN_ENV = "REBASE_BUNDLE_TOKEN";
+export interface FetchBundleOptions {
+    url: string;
+    token?: string;
+    /** Where to unpack. Defaults to a fresh directory under the OS temp dir. */
+    destination?: string;
+    /** Injected for tests. */
+    fetchImpl?: typeof fetch;
+    /** Injected for tests. */
+    extract?: (tarball: string, destination: string) => Promise<void>;
+    /** How long the download may take before it is abandoned. */
+    timeoutMs?: number;
+}
+/**
+ * Whether this process should fetch its bundle rather than read one from disk.
+ *
+ * An explicit `REBASE_BUNDLE` — a path — always wins. A platform that mounted a
+ * bundle AND set a URL means somebody is mid-migration between the two, and the
+ * local copy is the one that is definitely there.
+ */
+export declare function shouldFetchBundle(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Download and unpack a bundle, returning the directory it landed in.
+ *
+ * Downloads to a file rather than streaming into `tar`, deliberately. A stream
+ * that dies mid-transfer leaves `tar` having successfully extracted a prefix of
+ * the archive and exiting 0 — the half-unpacked bundle this module exists to
+ * refuse. Writing the whole tarball first means a truncated download is caught
+ * by `tar` as a corrupt archive, which is an error.
+ */
+export declare function fetchBundle(options: FetchBundleOptions): Promise<string>;
+/**
+ * Find the bundle root inside an unpacked directory.
+ *
+ * Tolerates one level of nesting, because whether a tarball has a top-level
+ * directory depends on how it was created — `tar czf x.tgz dist-bundle` and
+ * `tar czf x.tgz -C dist-bundle .` produce different shapes from the same
+ * files, and both are things a build script does.
+ */
+export declare function bundleRootIn(directory: string): string | null;

package/dist/boot/version-skew.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Locate a package by walking `node_modules` up from a directory.
+ *
+ * Lives here rather than in `driver.ts` because both the driver loader and the
+ * version check need it, and `driver.ts` already imports this module.
+ */
+export declare function findPackageDir(fromDir: string, packageName: string): string | undefined;
+/**
+ * Compare two versions, or `undefined` when either cannot be parsed.
+ *
+ * Follows semver on the one rule that matters here: a prerelease sorts *below*
+ * the release it leads to, so `0.12.1-canary.g7f1150f` < `0.12.1`. Without that
+ * rule every canary would read as newer than the stable it precedes, and the
+ * canaries are precisely where fixes land first.
+ */
+export declare function compareVersions(a: string, b: string): number | undefined;
+export interface DriverSkew {
+    /** True only when both versions parsed AND the driver is genuinely older. */
+    stale: boolean;
+    /**
+     * A clause naming both versions, ready to append to a sentence. Present
+     * whenever both versions are known — including when they agree, because
+     * "the driver is current" is the fact that redirects an investigation away
+     * from staleness and toward the real cause.
+     */
+    detail?: string;
+}
+/**
+ * Describe how a driver's version relates to the runtime asking it for work.
+ *
+ * Returns `stale: false` whenever it cannot tell — an unknown version, an
+ * unparseable one, a driver that is newer. Silence beats a confident wrong
+ * diagnosis, and the caller still prints its own local fact either way.
+ */
+export declare function describeDriverSkew(driverVersion: string | undefined, runtimeVersion: string | undefined): DriverSkew;
+/**
+ * How to get a project's schema applied, written once and owned by the runtime.
+ *
+ * This text lives in `@rebasepro/server` on purpose. The equivalent guidance in
+ * the Postgres driver's schema-drift warning can only ever be as current as the
+ * driver a tenant pinned — so the tenants who most need to be told "your driver
+ * is too old" are exactly the ones whose driver still prints the old advice.
+ * The image's copy of this package is never stale, so guidance printed from
+ * here always reflects the platform as it is today.
+ *
+ * Both audiences get a line because the runtime cannot reliably tell which one
+ * it is serving, and naming only the pnpm scripts — as this once did everywhere
+ * — tells a managed operator to run a command that structurally cannot reach
+ * their in-cluster database.
+ */
+export declare function schemaRecoveryGuidance(options?: {
+    staleDriver?: boolean;
+}): string;
+/**
+ * The installed version of a package, read from its `package.json`.
+ *
+ * Returns `undefined` rather than throwing for every failure — a missing or
+ * malformed manifest degrades the diagnosis, and must never take down a boot
+ * that would otherwise have served.
+ */
+export declare function readPackageVersion(packageDir: string): string | undefined;
+/**
+ * The version of `@rebasepro/server` this deployment is actually running.
+ *
+ * Resolved from the same roots the drivers are, and that is the point rather
+ * than a convenience. In a managed container `docker/entrypoint.mjs` replaces
+ * `/bundle/node_modules/@rebasepro/server` with a link to the image's copy, so
+ * reading the manifest *through the bundle* reports the version that will
+ * really execute — which is exactly the number the driver has to be compared
+ * against. Reading this package's own manifest by module path would report the
+ * same thing in the happy case and quietly lie in the case that matters: a
+ * bundle whose link did not happen.
+ *
+ * Returns `undefined` when the package cannot be found; every caller treats
+ * that as "cannot judge" and stays quiet.
+ */
+export declare function readRuntimeVersion(roots: string[]): string | undefined;