@rebasepro/server 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/init/docs.d.ts

@@ -1,6 +1,6 @@
 import { Hono } from "hono";
 import { CollectionConfig } from "@rebasepro/types";
-import { HonoEnv } from "../api/types";
+import { HonoEnv } from "../api/types.js";
 /**
  * Serve the OpenAPI document, and Swagger UI outside production.
  *

package/dist/init/middlewares.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { HonoEnv } from "../api/types";
+import { HonoEnv } from "../api/types.js";
 interface MiddlewareConfig {
     maxBodySize?: number;
     compression?: boolean;

package/dist/init/shutdown.d.ts

@@ -9,6 +9,10 @@ interface ShutdownConfig {
     jobQueue?: {
         stop(): Promise<void>;
     };
+    /** Structural, same reason. */
+    rlsAudit?: {
+        stop(): void;
+    };
     realtimeServices: Record<string, RealtimeProvider>;
 }
 /**

package/dist/init/storage.d.ts

@@ -1,4 +1,4 @@
-import { BackendStorageConfig, StorageController, StorageRegistry } from "../storage";
+import { BackendStorageConfig, StorageController, StorageRegistry } from "../storage/index.js";
 export declare function initializeStorage(storageConfig: BackendStorageConfig | StorageController | Record<string, BackendStorageConfig | StorageController> | undefined, isProduction: boolean): Promise<{
     storageRegistry?: StorageRegistry;
     storageController?: StorageController;

package/dist/init/surfaces.d.ts

@@ -59,6 +59,16 @@ export interface RuntimeOwnership {
     cronScheduler: boolean;
     /** Start the durable job queue's workers. Only relevant when `jobs.enabled`. */
     jobWorkers: boolean;
+    /**
+     * Run the scheduled row-level-security audit. Only relevant when
+     * `rlsAudit.enabled`.
+     *
+     * Unlike the two above, this one is not claim-protected — every process that
+     * owns it introspects the catalog on its own timer. That is read-only and
+     * harmless, just wasteful, so a split deployment should give it to one
+     * process the same way it gives it cron.
+     */
+    rlsAudit: boolean;
 }
 /** A fully-resolved answer for every owned singleton. */
 export type ResolvedOwnership = RuntimeOwnership;

package/dist/init.d.ts

@@ -1,17 +1,42 @@
-import { AuthAdapter, BackendBootstrapper, BootstrappedAuth, DatabaseAdapter, DataDriver, DataSourceDefinition, CollectionCallbacks, AnyCollectionConfig, HealthCheckResult, HistoryConfig, InitializedDriver, RealtimeProvider } from "@rebasepro/types";
-import { BackendCollectionRegistry } from "./collections/BackendCollectionRegistry";
-import { DriverRegistry } from "./services/driver-registry";
+import { AuthAdapter, BackendBootstrapper, BootstrappedAuth, DatabaseAdapter, DataDriver, CollectionCallbacks, AnyCollectionConfig, HealthCheckResult, HistoryConfig, InitializedDriver, RealtimeProvider } from "@rebasepro/types";
+import { BackendCollectionRegistry } from "./collections/BackendCollectionRegistry.js";
+import { DriverRegistry } from "./services/driver-registry.js";
 import { Server } from "http";
 import { Hono } from "hono";
-import { HonoEnv } from "./api/types";
-import { type RuntimeOwnershipOptions, type RuntimeSurfaceOptions } from "./init/surfaces";
-import type { JwtSigningKeyConfig } from "./auth/jwt-keys";
-import type { JobQueueOptions } from "./jobs/types";
-import { BackendStorageConfig, StorageController, StorageRegistry } from "./storage";
-import { type DataRateLimitConfig } from "./auth/rate-limiter";
-import { EmailConfig } from "./email";
-import type { OAuthProvider } from "./auth/interfaces";
-import type { AuthHooks } from "./auth/auth-hooks";
+import { HonoEnv } from "./api/types.js";
+import type { SchemaEditPolicy, RemoteRepositoryConfig } from "./schema-edit/schema-edit-permissions.js";
+/**
+ * Who may change this project's schema through a running backend.
+ *
+ * An alias rather than its own shape: the policy is defined next to the code
+ * that enforces it, and a second declaration here would be a second place for
+ * it to drift.
+ *
+ * @see `packages/server/src/schema-edit/schema-edit-permissions.ts`
+ */
+export interface LiveSchemaConfig extends SchemaEditPolicy {
+    /**
+     * A repository to commit to when the source is not on this machine.
+     *
+     * A bundle deployment ships compiled output, so there is nothing for the
+     * collection editor to rewrite locally. Configure this and the change is
+     * read from the repository, rewritten, and committed back through the Git
+     * Data API — no clone, no working tree.
+     *
+     * Absent, live schema editing needs the project mounted and says so.
+     */
+    repository?: RemoteRepositoryConfig;
+}
+import { type RlsAuditConfig } from "./rls-audit/index.js";
+import type { CaptchaConfig } from "./auth/captcha.js";
+import { type RuntimeOwnershipOptions, type RuntimeSurfaceOptions } from "./init/surfaces.js";
+import type { JwtSigningKeyConfig } from "./auth/jwt-keys.js";
+import type { JobQueueOptions } from "./jobs/types.js";
+import { BackendStorageConfig, StorageController, StorageRegistry } from "./storage/index.js";
+import { type DataRateLimitConfig } from "./auth/rate-limiter.js";
+import { EmailConfig } from "./email/index.js";
+import type { OAuthProvider } from "./auth/interfaces.js";
+import type { AuthHooks } from "./auth/auth-hooks.js";
 export interface RebaseAuthConfig {
     /**
      * The collection that represents auth users.
@@ -87,6 +112,22 @@ export interface RebaseAuthConfig {
      * by any signed-in user. Available on the client as `auth.findUserByEmail`.
      */
     allowUserLookup?: boolean;
+    /**
+     * Bot protection on the auth routes that cost something to hit.
+     *
+     * Off unless `enabled`. Rate limiting bounds one caller; a botnet of a
+     * thousand addresses sending one request each never touches a per-IP window,
+     * and `/register` and `/forgot-password` both send mail — so the bill for an
+     * unprotected form is paid in reputation on a sending domain.
+     *
+     * ```ts
+     * auth: { captcha: { enabled: true, provider: "turnstile", secret: process.env.TURNSTILE_SECRET } }
+     * ```
+     *
+     * Verification fails closed: if the provider cannot be reached, the request
+     * is refused. See `auth/captcha.ts` for why that is the safe direction.
+     */
+    captcha?: CaptchaConfig;
     /**
      * A static secret key for server-to-server / script authentication.
      *
@@ -218,6 +259,18 @@ export interface RebaseAuthConfig {
      * Requires email to be configured.
      */
     magicLink?: boolean;
+    /**
+     * Enable email one-time codes — six digits, typed in, instead of a link.
+     *
+     * A magic link opens the session on whichever device holds the mailbox,
+     * which is the wrong device whenever those are two different machines: a
+     * television, a terminal, a second browser. A code crosses that gap because
+     * a person carries it.
+     *
+     * `POST /auth/otp` sends one; `POST /auth/otp/verify` trades it for a
+     * session. Requires email to be configured, as magic link does.
+     */
+    emailOtp?: boolean;
     /**
      * Opt-in httpOnly cookie mode for refresh tokens.
      *
@@ -231,7 +284,7 @@ export interface RebaseAuthConfig {
      * **Requires** `credentials: "include"` on client-side fetch calls to
      * auth endpoints, and CORS must allow credentials (no `origin: "*"`).
      */
-    cookieAuth?: import("./auth").CookieAuthConfig;
+    cookieAuth?: import("./auth/index.js").CookieAuthConfig;
 }
 /** @see RebaseBackendConfig.baas */
 export interface BaasOptions {
@@ -278,6 +331,15 @@ export interface RebaseBackendConfig {
      * `collectionsDir` to write to.
      */
     schemaEditor?: boolean;
+    /**
+     * Live schema editing — changing the database and committing the change.
+     *
+     * Distinct from `schemaEditor`, which only rewrites collection source.
+     * There is nothing to switch on here: the surface mounts whenever there is
+     * a `collectionsDir`, and refuses in its own words when it cannot act. What
+     * this configures is *who* may act.
+     */
+    liveSchema?: LiveSchemaConfig;
     /** Options that only apply when collections are derived from the database. */
     baas?: BaasOptions;
     /**
@@ -303,7 +365,6 @@ export interface RebaseBackendConfig {
      * still owns their schema/registry but does **not** generate server data
      * routes for them. Server-mediated sources (the default) need no entry.
      */
-    dataSources?: DataSourceDefinition[];
     /**
      * Database bootstrappers.
      */
@@ -350,7 +411,6 @@ export interface RebaseBackendConfig {
      * only need explicit entries for "direct" transport sources (e.g.
      * external storage) that the backend does not proxy.
      */
-    storageSources?: import("@rebasepro/types").StorageSourceDefinition[];
     /**
      * Per-object access control for storage — the analogue of a collection's
      * security rules, and the thing `requireAuth` / `publicRead` cannot
@@ -375,7 +435,31 @@ export interface RebaseBackendConfig {
      * {@link storagePublicRead}, or {@link storageInsecureAllowAnyAuthenticated}
      * is set — see `assertStorageAccessControlConfigured`.
      */
-    storageAuthorize?: import("./storage/types").StorageAuthorize;
+    storageAuthorize?: import("./storage/types.js").StorageAuthorize;
+    /**
+     * Per-object access control, declared rather than coded.
+     *
+     * Storage is not under row-level security, so without this or
+     * {@link storageAuthorize} any authenticated caller may read, overwrite,
+     * delete or list any key they can name — the keys share one flat namespace.
+     *
+     * ```ts
+     * storagePolicies: [
+     *     { path: "public/**", operations: ["read"], allow: "public" },
+     *     { path: "users/:uid/**", allow: ({ params, user }) => user?.uid === params.uid }
+     * ]
+     * ```
+     *
+     * **A key matched by no policy is refused.** Every widening is an explicit
+     * line, and a mistake here denies rather than grants.
+     *
+     * `storageAuthorize` still runs when no policy matched, so ownership that
+     * lives in a row — which no path pattern can express — stays expressible.
+     * Neither can narrow the other: each only says yes.
+     *
+     * Satisfies the production boot guard on its own.
+     */
+    storagePolicies?: import("./storage/policies.js").StoragePolicy[];
     /**
      * Allow unauthenticated read access to stored files (default: false).
      *
@@ -385,6 +469,59 @@ export interface RebaseBackendConfig {
      * production storage boot guard (see {@link storageAuthorize}).
      */
     storagePublicRead?: boolean;
+    /**
+     * Keep derived image renditions — the results of `?width=`, `?format=` and
+     * friends — in the storage source rather than only in this process's
+     * memory.
+     *
+     * Without it a transform is recomputed by every instance, and again by all
+     * of them after every deploy: the cache is per-process and does not survive
+     * a restart. With it, the first instance to compute a variant writes it
+     * under a reserved prefix in the same bucket as the source, and every
+     * instance reads it from there.
+     *
+     * ```ts
+     * storageRenditionCache: { enabled: true }
+     * ```
+     *
+     * Off by default because turning it on makes a `GET` write to your bucket:
+     * it costs per object, and on read-only credentials it cannot work. When a
+     * write does fail the request still succeeds — the transform is served from
+     * memory and the failure is logged once.
+     *
+     * Renditions are keyed by the source object's version, so replacing an
+     * image serves the new one immediately; the superseded rendition is left
+     * behind. Set a lifecycle rule on `_rebase/renditions/` to collect them.
+     */
+    storageRenditionCache?: import("./storage/rendition-cache.js").RenditionCacheConfig;
+    /**
+     * Run something when an object lands, or when one goes.
+     *
+     * Every other write in the product can be reacted to — a row has
+     * `beforeSave` and `afterSave`, a schedule has a cron job — and an upload
+     * had nothing, so the work an upload implies had to be done by the client
+     * after the upload returned, which means it is not done at all when the
+     * client goes away between the two calls.
+     *
+     * ```ts
+     * storageTriggers: [
+     *     {
+     *         path: "uploads/:uid/**",
+     *         events: ["finalize"],
+     *         handler: async ({ key, params }) => { … }
+     *     }
+     * ]
+     * ```
+     *
+     * Same pattern language as {@link storagePolicies}. Fires for the
+     * multipart and resumable paths alike, after the object is durably
+     * written, and never for internal writes such as the image-rendition cache.
+     * Handlers are awaited and a throwing one is logged rather than failing the
+     * request — the object is already stored, so telling the client otherwise
+     * would invite it to repeat a write that succeeded. Enqueue a job for
+     * anything that must happen or is slow.
+     */
+    storageTriggers?: import("./storage/triggers.js").StorageTrigger[];
     /**
      * Opt out of the storage access-control boot guard, keeping the legacy
      * behaviour where **any** authenticated user can read, overwrite, delete or
@@ -462,7 +599,7 @@ export interface RebaseBackendConfig {
      *
      * A name that is not in the bundle fails the boot — see `selectFunctions`.
      */
-    functionsSelection?: import("./functions/selection").FunctionSelection;
+    functionsSelection?: import("./functions/selection.js").FunctionSelection;
     /**
      * Forward `/api/functions/*` to another process instead of serving it here.
      *
@@ -538,7 +675,7 @@ export interface RebaseBackendConfig {
      * Global lifecycle callbacks applied to every collection.
      *
      * Same type as per-collection `callbacks` — fires on **every** data path
-     * (REST API, WebSocket / realtime, server-side `rebase.data`).
+     * (REST API, WebSocket / realtime, server-side `rebase.dataAsAdmin`).
      *
      * Execution order: global callbacks → collection callbacks → property callbacks.
      *
@@ -572,8 +709,20 @@ export interface RebaseBackendConfig {
     schemaVersion?: string;
     /** Runtime version reported by the contract endpoint. Informational. */
     runtimeVersion?: string;
+    /**
+     * Periodic row-level-security audit of the database this server uses.
+     *
+     * Off unless `enabled` is set. `@rebasepro/rls-check` is thorough and
+     * read-only, and the reason nobody runs it is that it is a command — so this
+     * runs it on a timer and serves the result at `GET /api/admin/rls-audit`.
+     *
+     * Needs the optional peer `@rebasepro/rls-check`, which is not a hard
+     * dependency because it carries a Postgres driver and this package is
+     * engine-agnostic.
+     */
+    rlsAudit?: RlsAuditConfig;
 }
-export { isAuthAdapter } from "./auth/require-auth";
+export { isAuthAdapter } from "./auth/require-auth.js";
 /**
  * Type guard to detect whether `database` is a `DatabaseAdapter`.
  */
@@ -585,12 +734,20 @@ export interface RebaseBackendInstance {
     realtimeService: RealtimeProvider;
     auth?: BootstrappedAuth;
     history?: {
-        historyService: import("./history/history-routes").HistoryService;
+        historyService: import("./history/history-routes.js").HistoryService;
     };
+    /**
+     * Stored metrics for this deployment, when it can keep any.
+     *
+     * Absent on a driver with no SQL admin. The `/metrics/history` route turns
+     * that absence into a named 501 rather than an empty series, because an
+     * empty chart and "this deployment keeps no history" look identical.
+     */
+    metricsHistory?: import("./metrics/history-recorder.js").MetricsHistory;
     storageRegistry?: StorageRegistry;
     storageController?: StorageController;
     collectionRegistry: BackendCollectionRegistry;
-    cronScheduler?: import("./cron").CronScheduler;
+    cronScheduler?: import("./cron/index.js").CronScheduler;
     /**
      * The durable job queue, when `jobs.enabled` is set and the driver can run
      * SQL. Present on the instance because the *producers* live in application
@@ -603,7 +760,7 @@ export interface RebaseBackendInstance {
      * jobQueue?.register(WEBHOOK_DELIVERY_TASK, ctx => dispatcher.deliverQueuedJob(ctx.payload));
      * ```
      */
-    jobQueue?: import("./jobs").JobQueue;
+    jobQueue?: import("./jobs/index.js").JobQueue;
     /**
      * Attach collection callbacks AFTER initialization.
      *

package/dist/internal-tables-DpxfPaEB.js

@@ -0,0 +1,97 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+//#region ../common/src/util/internal-tables.ts
+/**
+* The tables Rebase creates for its own bookkeeping, and the SQL that keeps the
+* end-user role away from them.
+*
+* ## Why this exists
+*
+* Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role
+* provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table
+* in the schemas a project uses — including `rebase`, because a project's own
+* collections are allowed to live there (the scaffold puts `users` there). It
+* also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the
+* migrating role inherits the same grant.
+*
+* Every framework-internal table is created later: auth's tables come up during
+* `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first
+* job registers, `idempotency_keys` on the first request that carries a key. So
+* they all inherited full DML for the end-user role — and none of them enables
+* row-level security, because none of them is a collection with
+* `securityRules`. Measured on a freshly provisioned database, `SET ROLE
+* rebase_user` could read `rebase.refresh_tokens` (session token hashes),
+* `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and
+* `rebase.api_keys` (including its `admin` flag), and insert into
+* `rebase.app_config`.
+*
+* Nothing routes a user-context query at those tables today, so this was not
+* reachable over the API. That is the wrong thing to depend on: the documented
+* model is that RLS is the authorization boundary, and these tables sat outside
+* it. The boundary is now a privilege boundary instead — the role simply cannot
+* address them.
+*
+* ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY
+*
+* RLS with no policy denies every row, which is the same outcome, but it is the
+* *weaker* statement: it leaves the grant in place, so a later policy — or a
+* `FORCE` flag cleared by some future migration — reopens the table. There is no
+* row of `refresh_tokens` any end user should ever reach, so the honest encoding
+* is "this role has no privilege here at all". It also keeps the owner
+* connection (which auth actually runs on) completely unaffected.
+*
+* ## Keeping it true
+*
+* `packages/rls-check` scans the `rebase` schema — it used to skip it as a
+* "platform" schema — and its `rls-disabled` check fires on exactly the
+* condition this module removes: RLS off *and* a DML grant to a reachable role.
+* So a table added here without a revoke is caught by `pnpm rls:check`, not by
+* someone re-reading this file.
+*/
+/**
+* The Postgres role authenticated requests run as.
+*
+* Defined here rather than in the Postgres driver because both the driver (which
+* provisions the role) and this module (which revokes on its behalf) need it,
+* and a second spelling of a role name is a silent no-op waiting to happen.
+*/
+var REBASE_USER_ROLE = "rebase_user";
+/** Postgres identifiers this module is willing to interpolate. */
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+/**
+* A single statement that takes every privilege on `schema.table` away from the
+* end-user role.
+*
+* Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which
+* happen in practice:
+*
+*  - the role does not exist when the connection is unprivileged (Rebase then
+*    relies on native RLS rather than a role switch), and a bare `REVOKE` on a
+*    missing role is an error, not a no-op;
+*  - the table may not exist yet — `cron_logs` never appears in a project with
+*    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.
+*
+* One command, so it is safe on handles that speak the extended query protocol
+* and reject multi-statement strings.
+*/
+function revokeInternalTableSql(schema, table) {
+	if (!SAFE_IDENTIFIER.test(schema)) throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);
+	if (!SAFE_IDENTIFIER.test(table)) throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);
+	const qualified = `"${schema}"."${table}"`;
+	return `
+        DO $rebase_revoke$
+        BEGIN
+            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')
+               AND to_regclass('${qualified}') IS NOT NULL THEN
+                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';
+            END IF;
+        END
+        $rebase_revoke$;
+    `.trim();
+}
+//#endregion
+export { revokeInternalTableSql as t };
+
+//# sourceMappingURL=internal-tables-DpxfPaEB.js.map

package/dist/internal-tables-DpxfPaEB.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-tables-DpxfPaEB.js","names":[],"sources":["../../common/src/util/internal-tables.ts"],"sourcesContent":["/**\n * The tables Rebase creates for its own bookkeeping, and the SQL that keeps the\n * end-user role away from them.\n *\n * ## Why this exists\n *\n * Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role\n * provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table\n * in the schemas a project uses — including `rebase`, because a project's own\n * collections are allowed to live there (the scaffold puts `users` there). It\n * also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the\n * migrating role inherits the same grant.\n *\n * Every framework-internal table is created later: auth's tables come up during\n * `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first\n * job registers, `idempotency_keys` on the first request that carries a key. So\n * they all inherited full DML for the end-user role — and none of them enables\n * row-level security, because none of them is a collection with\n * `securityRules`. Measured on a freshly provisioned database, `SET ROLE\n * rebase_user` could read `rebase.refresh_tokens` (session token hashes),\n * `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and\n * `rebase.api_keys` (including its `admin` flag), and insert into\n * `rebase.app_config`.\n *\n * Nothing routes a user-context query at those tables today, so this was not\n * reachable over the API. That is the wrong thing to depend on: the documented\n * model is that RLS is the authorization boundary, and these tables sat outside\n * it. The boundary is now a privilege boundary instead — the role simply cannot\n * address them.\n *\n * ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY\n *\n * RLS with no policy denies every row, which is the same outcome, but it is the\n * *weaker* statement: it leaves the grant in place, so a later policy — or a\n * `FORCE` flag cleared by some future migration — reopens the table. There is no\n * row of `refresh_tokens` any end user should ever reach, so the honest encoding\n * is \"this role has no privilege here at all\". It also keeps the owner\n * connection (which auth actually runs on) completely unaffected.\n *\n * ## Keeping it true\n *\n * `packages/rls-check` scans the `rebase` schema — it used to skip it as a\n * \"platform\" schema — and its `rls-disabled` check fires on exactly the\n * condition this module removes: RLS off *and* a DML grant to a reachable role.\n * So a table added here without a revoke is caught by `pnpm rls:check`, not by\n * someone re-reading this file.\n */\n\n/**\n * The Postgres role authenticated requests run as.\n *\n * Defined here rather than in the Postgres driver because both the driver (which\n * provisions the role) and this module (which revokes on its behalf) need it,\n * and a second spelling of a role name is a silent no-op waiting to happen.\n */\nexport const REBASE_USER_ROLE = \"rebase_user\";\n\n/**\n * Framework-internal table names, unqualified.\n *\n * Deliberately NOT including `users`: the auth user table is also a collection,\n * with `securityRules`, RLS enabled and policies applied. Users read their own\n * row through it — revoking there would break sign-in.\n *\n * `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`\n * because `db migrate apply` passes `--revisions-schema rebase`.\n *\n * Every entry here must also be revoked by whatever creates it, and vice versa:\n * the creation-time revoke fires once, on the boot that first makes the table,\n * so it cannot help a database provisioned before that revoke existed. This\n * list is what the boot-time sweep in `ensureAppRole` iterates, and the sweep\n * is the only thing that can repair an already-granted table. A table revoked\n * at creation but missing here is therefore permanently stranded on any\n * database that predates its revoke — which is exactly what happened to\n * `jobs`, added here after a scan of a pre-0.14 database found it.\n */\nexport const REBASE_INTERNAL_TABLES: readonly string[] = [\n    // auth\n    \"user_identities\",\n    \"refresh_tokens\",\n    \"password_reset_tokens\",\n    \"magic_link_tokens\",\n    \"mfa_factors\",\n    \"mfa_challenges\",\n    \"recovery_codes\",\n    \"app_config\",\n    \"schema_meta\",\n    // platform services\n    \"api_keys\",\n    \"cron_logs\",\n    \"cron_claims\",\n    \"jobs\",\n    \"rate_limit_hits\",\n    \"idempotency_keys\",\n    \"entity_history\",\n    \"branches\",\n    \"metric_samples\",\n    // realtime channels — authorization for these lives in the channel rules the\n    // server evaluates before it reads or writes, never in a row policy\n    \"channel_messages\",\n    \"channel_cursors\",\n    \"channel_presence\",\n    // migration bookkeeping\n    \"atlas_schema_revisions\"\n];\n\n/** Postgres identifiers this module is willing to interpolate. */\nconst SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;\n\n/**\n * A single statement that takes every privilege on `schema.table` away from the\n * end-user role.\n *\n * Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which\n * happen in practice:\n *\n *  - the role does not exist when the connection is unprivileged (Rebase then\n *    relies on native RLS rather than a role switch), and a bare `REVOKE` on a\n *    missing role is an error, not a no-op;\n *  - the table may not exist yet — `cron_logs` never appears in a project with\n *    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.\n *\n * One command, so it is safe on handles that speak the extended query protocol\n * and reject multi-statement strings.\n */\nexport function revokeInternalTableSql(schema: string, table: string): string {\n    if (!SAFE_IDENTIFIER.test(schema)) {\n        throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);\n    }\n    if (!SAFE_IDENTIFIER.test(table)) {\n        throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);\n    }\n    const qualified = `\"${schema}\".\"${table}\"`;\n    return `\n        DO $rebase_revoke$\n        BEGIN\n            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')\n               AND to_regclass('${qualified}') IS NOT NULL THEN\n                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';\n            END IF;\n        END\n        $rebase_revoke$;\n    `.trim();\n}\n\n/**\n * Revoke on every internal table in `schema`, one statement at a time.\n *\n * Best-effort per table: a connection that does not own one of them (a\n * pre-provisioned database, a platform-managed ledger) cannot revoke on it, and\n * that must not take down a boot. The caller decides how loud to be — `onError`\n * exists so the driver can warn without this module importing a logger.\n */\nexport async function revokeInternalTableAccess(\n    execute: (sql: string) => Promise<unknown>,\n    schema: string,\n    options?: { tables?: readonly string[]; onError?: (table: string, error: unknown) => void }\n): Promise<void> {\n    for (const table of options?.tables ?? REBASE_INTERNAL_TABLES) {\n        try {\n            await execute(revokeInternalTableSql(schema, table));\n        } catch (error) {\n            options?.onError?.(table, error);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,IAAa,mBAAmB;;AAoDhC,IAAM,kBAAkB;;;;;;;;;;;;;;;;;AAkBxB,SAAgB,uBAAuB,QAAgB,OAAuB;CAC1E,IAAI,CAAC,gBAAgB,KAAK,MAAM,GAC5B,MAAM,IAAI,MAAM,qDAAqD,KAAK,UAAU,MAAM,GAAG;CAEjG,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAC3B,MAAM,IAAI,MAAM,oDAAoD,KAAK,UAAU,KAAK,GAAG;CAE/F,MAAM,YAAY,IAAI,OAAO,KAAK,MAAM;CACxC,OAAO;;;iEAGsD,iBAAiB;kCAChD,UAAU;yCACH,UAAU,QAAQ,iBAAiB;;;;MAItE,KAAK;AACX"}

package/dist/jobs/index.d.ts

@@ -1,5 +1,5 @@
-export { createJobStore } from "./job-store";
-export type { JobStore } from "./job-store";
-export { createJobQueue, defaultBackoff } from "./job-queue";
-export type { JobQueue } from "./job-queue";
-export type { EnqueueOptions, JobContext, JobHandler, JobQueueClient, JobQueueOptions, JobRecord, JobStatus } from "./types";
+export { createJobStore } from "./job-store.js";
+export type { JobStore } from "./job-store.js";
+export { createJobQueue, defaultBackoff } from "./job-queue.js";
+export type { JobQueue } from "./job-queue.js";
+export type { EnqueueOptions, JobContext, JobHandler, JobQueueClient, JobQueueOptions, JobRecord, JobStatus } from "./types.js";

package/dist/{jobs-CyOKXXlu.js → jobs-B2ELModo.js}

@@ -1,11 +1,13 @@
-import { createRequire as __createRequire } from "module";
-import process from "process";
-__createRequire(import.meta.url);
-import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
-import "./src-BPfYOeN4.js";
-import "./src-CrCxd8km.js";
-import { n as createDdlBootstrapper, o as revokeInternalTableSql, r as hasInCauseChain, s as isSQLAdmin } from "./ddl-bootstrap-Cywoj8Ta.js";
-import { t as logger } from "./logger-DfvF_8r-.js";
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import "./src-B-CmIFMr.js";
+import "./src-Cdsw7DqV.js";
+import { n as createDdlBootstrapper, o as isSQLAdmin, r as hasInCauseChain } from "./ddl-bootstrap-5YZCZ8qk.js";
+import { t as revokeInternalTableSql } from "./internal-tables-DpxfPaEB.js";
+import { t as logger } from "./logger-DS03e908.js";
 import { randomUUID } from "crypto";
 //#region src/jobs/job-store.ts
 /**
@@ -323,4 +325,4 @@ var jobs_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 export { createJobStore as i, createJobQueue as n, defaultBackoff as r, jobs_exports as t };
 
-//# sourceMappingURL=jobs-CyOKXXlu.js.map
+//# sourceMappingURL=jobs-B2ELModo.js.map