@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g06dbe5b

package/dist/index.es.js

@@ -2,16 +2,17 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
-import { A as toSnakeCase, C as normalizeToEntityRelation, D as getPolicyNamesForRule, F as Vector, N as hasForeignKeyOnTarget, O as mergeDeep, P as isManyToMany, S as createRelationRefWithData, T as generateForeignKeyName, _ as buildCompositeId, a as getJunctionSecurityRules, b as parseIdValues, c as policyToPostgres, d as findRelation, f as getColumnName, g as resolveCollectionRelations, h as getTableVarName, i as getJunctionCollectionConfig, k as camelCase, l as securityRuleToConditions, m as getTableName$1, n as CollectionRegistry, o as resolveJunctionSpecs, p as getEnumVarName, r as resolveStringColumnLength, s as getEffectiveSecurityRules, t as buildSdkData, u as findAnonymousGrants, v as getDeclaredPrimaryKeys, w as updateDateAutoValues, x as createRelationRef, y as isAddressableId } from "./src-DlPBctw_.js";
-import { n as isPostgresCollectionConfig, r as isRelationalCollectionConfig } from "./src-DoU9yPqq.js";
-import { t as ANONYMOUS_USER_ID } from "./policy-CeA1JcxP.js";
-import { t as createPostgresWebSocket } from "./websocket-B2LsrINK.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-CD8o_1Sl.js";
+import { n as resolveClientListLimit, r as ANONYMOUS_USER_ID, t as ListLimitError } from "./data_driver-ULAyJEi9.js";
+import { $ as isManyToMany, A as getTableName$1, B as normalizeToEntityRelation, C as getEffectiveSecurityRules, D as findRelation, E as findAnonymousGrants, F as isAddressableId, G as getPolicyNamesForRule, H as generateForeignKeyName, I as parseIdValues, J as camelCase, K as isPrototypePollutingKey, L as sortCollectionsBySlug, M as resolveCollectionRelations, N as buildCompositeId, O as getColumnName, P as getDeclaredPrimaryKeys, Q as hasForeignKeyOnTarget, R as createRelationRef, S as resolveJunctionSpecs, T as securityRuleToConditions, U as legacyForeignKeyName, V as updateDateAutoValues, Y as toSnakeCase, _ as CollectionRegistry, b as getJunctionCollectionConfig, et as Vector, g as buildSdkData, h as visibleColumnProjection, j as getTableVarName, k as getEnumVarName, l as buildSearchColumnSpec, q as mergeDeep, r as authUsersColumnSql, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, u as hiddenColumnsOption, v as relationalCollections, w as policyToPostgres, x as getJunctionSecurityRules, y as resolveStringColumnLength, z as createRelationRefWithData } from "./auth-users-columns-CBEOeYqa.js";
+import { c as isPostgresCollectionConfig, l as isRelationalCollectionConfig, n as REBASE_SCHEMA, o as usesLegacyRlsFunctions } from "./src-C_wvdMnl.js";
+import { t as createPostgresWebSocket } from "./websocket-D1qbmLZ2.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-Bww-Lg0s.js";
+import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-Bpv3nUZo.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, or, relations, sql } from "drizzle-orm";
-import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
+import { PgArray, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs, { promises } from "fs";
 import path from "path";
 import chokidar from "chokidar";
@@ -30,25 +31,6 @@ import { randomUUID } from "crypto";
 function isChannelBusInstance(setting) {
 	return typeof setting?.publish === "function";
 }
-/**
-* Resolve a client-supplied list `limit` into a safe, always-defined value.
-*
-* - A provided limit is coerced to an integer and clamped to `[1, maxLimit]`,
-*   so `0`, negatives, and absurd values can never bypass the cap.
-* - An absent / blank / non-numeric limit falls back to the mode default:
-*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
-*
-* The return is never `undefined` — no ingress that routes its client limit
-* through this can produce an unbounded read.
-*/
-function resolveClientListLimit(rawLimit, opts = {}) {
-	const maxLimit = opts.maxLimit ?? 1e3;
-	if (rawLimit != null && String(rawLimit).trim() !== "") {
-		const parsed = typeof rawLimit === "number" ? rawLimit : parseInt(String(rawLimit), 10);
-		if (Number.isFinite(parsed)) return Math.min(Math.max(1, Math.floor(parsed)), maxLimit);
-	}
-	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
-}
 //#endregion
 //#region ../common/src/util/email.ts
 /**
@@ -152,6 +134,163 @@ var buildPropertyCallbacks = (properties) => {
 	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
 };
 //#endregion
+//#region ../common/src/util/internal-tables.ts
+/**
+* The tables Rebase creates for its own bookkeeping, and the SQL that keeps the
+* end-user role away from them.
+*
+* ## Why this exists
+*
+* Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role
+* provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table
+* in the schemas a project uses — including `rebase`, because a project's own
+* collections are allowed to live there (the scaffold puts `users` there). It
+* also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the
+* migrating role inherits the same grant.
+*
+* Every framework-internal table is created later: auth's tables come up during
+* `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first
+* job registers, `idempotency_keys` on the first request that carries a key. So
+* they all inherited full DML for the end-user role — and none of them enables
+* row-level security, because none of them is a collection with
+* `securityRules`. Measured on a freshly provisioned database, `SET ROLE
+* rebase_user` could read `rebase.refresh_tokens` (session token hashes),
+* `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and
+* `rebase.api_keys` (including its `admin` flag), and insert into
+* `rebase.app_config`.
+*
+* Nothing routes a user-context query at those tables today, so this was not
+* reachable over the API. That is the wrong thing to depend on: the documented
+* model is that RLS is the authorization boundary, and these tables sat outside
+* it. The boundary is now a privilege boundary instead — the role simply cannot
+* address them.
+*
+* ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY
+*
+* RLS with no policy denies every row, which is the same outcome, but it is the
+* *weaker* statement: it leaves the grant in place, so a later policy — or a
+* `FORCE` flag cleared by some future migration — reopens the table. There is no
+* row of `refresh_tokens` any end user should ever reach, so the honest encoding
+* is "this role has no privilege here at all". It also keeps the owner
+* connection (which auth actually runs on) completely unaffected.
+*
+* ## Keeping it true
+*
+* `packages/rls-check` scans the `rebase` schema — it used to skip it as a
+* "platform" schema — and its `rls-disabled` check fires on exactly the
+* condition this module removes: RLS off *and* a DML grant to a reachable role.
+* So a table added here without a revoke is caught by `pnpm rls:check`, not by
+* someone re-reading this file.
+*/
+/**
+* The Postgres role authenticated requests run as.
+*
+* Defined here rather than in the Postgres driver because both the driver (which
+* provisions the role) and this module (which revokes on its behalf) need it,
+* and a second spelling of a role name is a silent no-op waiting to happen.
+*/
+var REBASE_USER_ROLE = "rebase_user";
+/**
+* Framework-internal table names, unqualified.
+*
+* Deliberately NOT including `users`: the auth user table is also a collection,
+* with `securityRules`, RLS enabled and policies applied. Users read their own
+* row through it — revoking there would break sign-in.
+*
+* `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`
+* because `db migrate apply` passes `--revisions-schema rebase`.
+*/
+var REBASE_INTERNAL_TABLES = [
+	"user_identities",
+	"refresh_tokens",
+	"password_reset_tokens",
+	"magic_link_tokens",
+	"mfa_factors",
+	"mfa_challenges",
+	"recovery_codes",
+	"app_config",
+	"schema_meta",
+	"api_keys",
+	"cron_logs",
+	"cron_claims",
+	"idempotency_keys",
+	"entity_history",
+	"branches",
+	"channel_messages",
+	"channel_cursors",
+	"channel_presence",
+	"atlas_schema_revisions"
+];
+/** Postgres identifiers this module is willing to interpolate. */
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+/**
+* A single statement that takes every privilege on `schema.table` away from the
+* end-user role.
+*
+* Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which
+* happen in practice:
+*
+*  - the role does not exist when the connection is unprivileged (Rebase then
+*    relies on native RLS rather than a role switch), and a bare `REVOKE` on a
+*    missing role is an error, not a no-op;
+*  - the table may not exist yet — `cron_logs` never appears in a project with
+*    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.
+*
+* One command, so it is safe on handles that speak the extended query protocol
+* and reject multi-statement strings.
+*/
+function revokeInternalTableSql(schema, table) {
+	if (!SAFE_IDENTIFIER.test(schema)) throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);
+	if (!SAFE_IDENTIFIER.test(table)) throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);
+	const qualified = `"${schema}"."${table}"`;
+	return `
+        DO $rebase_revoke$
+        BEGIN
+            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')
+               AND to_regclass('${qualified}') IS NOT NULL THEN
+                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';
+            END IF;
+        END
+        $rebase_revoke$;
+    `.trim();
+}
+/**
+* Revoke on every internal table in `schema`, one statement at a time.
+*
+* Best-effort per table: a connection that does not own one of them (a
+* pre-provisioned database, a platform-managed ledger) cannot revoke on it, and
+* that must not take down a boot. The caller decides how loud to be — `onError`
+* exists so the driver can warn without this module importing a logger.
+*/
+async function revokeInternalTableAccess(execute, schema, options) {
+	for (const table of options?.tables ?? REBASE_INTERNAL_TABLES) try {
+		await execute(revokeInternalTableSql(schema, table));
+	} catch (error) {
+		options?.onError?.(table, error);
+	}
+}
+//#endregion
+//#region ../common/src/data/filter-conditions.ts
+/**
+* Read one field's filter as the list of conditions it stands for.
+*
+* Accepts both declared shapes and normalises them to a list:
+*
+* ```ts
+* toFilterTuples(["==", "active"])          // [["==", "active"]]
+* toFilterTuples([[">=", 18], ["<", 65]])   // [[">=", 18], ["<", 65]]
+* ```
+*
+* A falsy, non-array or empty param has no conditions in it — the empty list,
+* so a caller iterating adds nothing rather than compiling a tuple of
+* `undefined`s and logging about an operator nobody sent.
+*/
+function toFilterTuples(filterParam) {
+	if (!filterParam || !Array.isArray(filterParam) || filterParam.length === 0) return [];
+	if (Array.isArray(filterParam[0])) return filterParam;
+	return [filterParam];
+}
+//#endregion
 //#region ../common/src/table-classification.ts
 /** Schemas that are always considered Rebase-internal. */
 var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
@@ -257,6 +396,38 @@ function getCollectionByPath(collectionPath, registry) {
 	}
 	return collection;
 }
+/**
+* Reject a write naming something that is not a column of the table.
+*
+* Drizzle builds INSERT from `Object.entries(table[Symbol.Columns])` and UPDATE
+* from `Object.keys(tableColumns)`, so a key the table does not carry is not
+* rejected by anything — it is *left out of the statement*. The insert answers
+* 201 having stored nothing under that name; the update, if the key was the
+* only one, builds `update "posts" set  where …` and Postgres raises a syntax
+* error (SQLSTATE 42601), which is neither class 22 nor 23 and so surfaces as a
+* 500 for what is a caller's typo.
+*
+* That makes this the last honest place to check, and the only one every write
+* passes through. `assertKnownWriteFields` in the REST layer checks the same
+* thing against the *config* and is skipped on four paths — `strictWrites:
+* false`, a collection declaring no properties, an auth adapter that owns the
+* body's shape, and a nested route whose target cannot be walked — and it never
+* sees an in-process `rebase.data` write at all.
+*
+* It also gives `strictWrites: false` a truthful implementation. The flag is
+* documented for "a column that really does exist which the config never
+* declared", and skipping the config check alone could not deliver that: the
+* value was dropped a layer later regardless. Skipping the config check and
+* keeping this one does exactly what the flag says — the column must exist,
+* the property need not.
+*/
+function assertWritableColumns(values, table, collectionPath) {
+	const columns = getTableColumns(table);
+	if (!columns || Object.keys(columns).length === 0) return;
+	const unknown = Object.keys(values).filter((key) => !(key in columns));
+	if (unknown.length === 0) return;
+	throw ApiError.badRequest(`'${collectionPath}' has no column${unknown.length > 1 ? "s" : ""} ${unknown.map((key) => `'${key}'`).join(", ")}, so the value${unknown.length > 1 ? "s" : ""} would have been dropped before the statement was built.`, "VALIDATION_UNKNOWN_FIELDS");
+}
 function getTableForCollection(collection, registry) {
 	const tableName = getTableName$1(collection);
 	const table = registry.getTable(tableName);
@@ -436,6 +607,71 @@ function deriveRowAddress(row, collection, registry) {
 //#endregion
 //#region src/utils/drizzle-conditions.ts
 /**
+* Postgres's own default for `pg_trgm.word_similarity_threshold`. Named here
+* because the fuzzy predicate has to know when the index-backed operator agrees
+* with the collection's declared threshold and when it would narrow too far.
+*/
+var PG_TRGM_WORD_SIMILARITY_DEFAULT = .6;
+/**
+* A user's search term, made safe to drop inside a `%…%` LIKE pattern.
+*
+* The term is already a bind parameter, so this is not about injection. It is
+* about the two things a LIKE metacharacter does when it arrives from a search
+* box:
+*
+*  1. **It changes the query.** `%` and `_` are wildcards, so searching for
+*     `50%` returned every row and `a_c` matched `abc`. Nothing the caller
+*     could type would find a literal `%`.
+*  2. **It is a cost the caller chooses.** Postgres matches LIKE by
+*     backtracking: each `%` re-tries every remaining offset, so
+*     `?searchString=a%a%a%a%a%a%a%b` is polynomial with an attacker-chosen
+*     exponent — evaluated per row, OR-ed across every string property of the
+*     collection, on a sequential scan (a leading `%` cannot use an index), and
+*     the page limit does not bound it because the scan happens first.
+*
+* This is the server-side half of the pattern `like-pattern-redos.test.ts`
+* hardened the offline evaluator against; that test's own note ("the same
+* translation in the Mongo driver hands the expression to the database, where
+* it occupies a server thread instead") describes this call site.
+*
+* Backslash is the default `ESCAPE` character for LIKE, and the pattern is
+* bound rather than interpolated, so a single backslash here reaches the
+* matcher as one. Escaping the escape character first is what keeps a term
+* ending in `\` from swallowing the closing `%`.
+*
+* Note this is a *substring search*, not the `like` filter operator: a caller
+* who wants wildcards has `?title=like.foo%` for that, where the pattern is the
+* documented input.
+*/
+var escapeLikePattern = (value) => value.replace(/[\\%_]/g, (ch) => `\\${ch}`);
+/** Column types `ILIKE '%…%'` is defined on. */
+var ILIKE_SQL_TYPES = /^(text|varchar|character varying|char|character|bpchar|citext)\b/;
+/**
+* Can this column be matched with `ILIKE`?
+*
+* Asked of the column's *declared SQL type*, never with `instanceof`. The
+* previous version tested `column instanceof PgVarchar || … PgText || … PgChar`,
+* and `instanceof` compares class identity: it is only true when the column was
+* constructed by the very same copy of `drizzle-orm` that this module imported.
+*
+* An application's generated schema builds its tables with the app's own
+* `drizzle-orm`, and this driver declares its own dependency on one. When the
+* two ranges do not overlap — an app scaffolded against `^0.44` with a driver
+* asking for `^0.45` — a strict installer gives the driver a second copy, every
+* check returns false, no condition is produced, and the caller compiles that
+* into an impossible `WHERE`. The result is a 200 with an empty page for every
+* search on every collection without a `search` block: the failure looks
+* exactly like "nothing matched". Observed in production, not theorised.
+*
+* `getSQLType()` is a value the column reports about itself, so it crosses
+* module instances the way a class identity cannot. It also happens to fix
+* `citext`, which the `instanceof` list never covered.
+*/
+var supportsILike = (column) => {
+	const sqlType = typeof column?.getSQLType === "function" ? column.getSQLType().toLowerCase() : "";
+	return ILIKE_SQL_TYPES.test(sqlType);
+};
+/**
 * Process-wide default, set once when the driver is constructed.
 *
 * The condition builder is a set of *static* methods reached from a dozen
@@ -493,7 +729,7 @@ function toMembershipList(value) {
 * @example
 * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;
 */
-var DrizzleConditionBuilder = class {
+var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 	/**
 	* Express "reachable from this parent through this relation" as a plain
 	* `WHERE` condition on the target table.
@@ -669,8 +905,7 @@ var DrizzleConditionBuilder = class {
 			if (!filterParam) continue;
 			const target = this.resolveFilterTarget(table, field, collectionPath, mode, options);
 			if (!target) continue;
-			const paramsList = Array.isArray(filterParam) && filterParam.length > 0 && Array.isArray(filterParam[0]) ? filterParam : [filterParam];
-			for (const [op, value] of paramsList) {
+			for (const [op, value] of toFilterTuples(filterParam)) {
 				const condition = this.compileFilterTarget(target, op, value, field, collectionPath);
 				if (condition) conditions.push(condition);
 			}
@@ -1119,22 +1354,153 @@ var DrizzleConditionBuilder = class {
 		return or(...conditions);
 	}
 	/**
-	* Build search conditions for text fields
+	* Build search conditions for text fields.
+	*
+	* Two shapes, chosen by whether the collection declared a `search` block:
+	*
+	* - **Declared** — one `@@ websearch_to_tsquery` against the generated
+	*   `tsvector` column. Stems, drops stopwords, AND-es the terms, reaches
+	*   inside JSONB and arrays, and uses the GIN index.
+	* - **Not declared** — the original `ILIKE '%term%'` OR-ed across top-level
+	*   string properties, with the term escaped (see {@link escapeLikePattern})
+	*   so it is matched as the literal text the user typed.
+	*
+	* The second is the default and stays the default. A collection that has
+	* not opted in compiles to exactly the SQL it compiled to before this
+	* branch existed, which is the only reason it is safe to have added it.
+	*
+	* `collection` is optional so that the callers which genuinely have no
+	* collection in hand — nested paths, derived views — keep working; without
+	* one there is no `search` block to read and the ILIKE path is correct.
 	*/
-	static buildSearchConditions(searchString, properties, table) {
+	static buildSearchConditions(searchString, properties, table, collection) {
 		const searchConditions = [];
+		const ftsCondition = collection ? DrizzleConditionBuilder.buildFullTextCondition(searchString, table, collection) : void 0;
+		if (ftsCondition) return [ftsCondition];
+		let declaredStringProperties = 0;
 		for (const [key, prop] of Object.entries(properties)) {
 			const p = prop;
 			if (p.type === "string" && !p.enum && p.isId !== "uuid") {
+				declaredStringProperties++;
 				const fieldColumn = table[key];
-				if (fieldColumn) {
-					if (fieldColumn instanceof PgVarchar || fieldColumn instanceof PgText || fieldColumn instanceof PgChar || fieldColumn && typeof fieldColumn === "object" && !("columnType" in fieldColumn)) searchConditions.push(ilike(fieldColumn, `%${searchString}%`));
-				}
+				if (fieldColumn && supportsILike(fieldColumn)) searchConditions.push(ilike(fieldColumn, `%${escapeLikePattern(searchString)}%`));
 			}
 		}
+		if (declaredStringProperties > 0 && searchConditions.length === 0) logger.warn(`[search] "${collection?.slug ?? "collection"}" declares ${declaredStringProperties} string property(ies) but none compiled to a searchable column, so this search can only return nothing. Check that the generated schema's column types are text/varchar/char.`);
 		return searchConditions;
 	}
 	/**
+	* The `@@` predicate for a collection that declared a `search` block, or
+	* undefined for one that did not.
+	*
+	* The query is normalized exactly as the indexed content was — same text
+	* search configuration, same accent folding. Skipping that on the query
+	* side is the subtle way to get a search that matches nothing: the column
+	* would hold `gestion` while the query asked for `gestión`.
+	*
+	* `websearch_to_tsquery` rather than `plainto_tsquery` because it is the
+	* one that behaves the way a search box looks like it should — quoted
+	* phrases, `or`, and a leading `-` to exclude — and because it never throws
+	* on user input, which `to_tsquery` does on so much as a stray parenthesis.
+	*/
+	static buildFullTextCondition(searchString, table, collection) {
+		let spec;
+		try {
+			spec = buildSearchColumnSpec(collection);
+		} catch {
+			return;
+		}
+		if (!spec) return void 0;
+		const column = table[spec.column];
+		if (!column) return;
+		const exact = sql`${column} @@ ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)}`;
+		if (!spec.fuzzy) return exact;
+		const fuzzyColumn = table[spec.fuzzy.column];
+		if (!fuzzyColumn) return exact;
+		const needle = spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`;
+		const similar = sql`public.word_similarity(${needle}, ${fuzzyColumn}) >= ${spec.fuzzy.threshold}`;
+		return sql`(${exact} OR ${spec.fuzzy.threshold > PG_TRGM_WORD_SIMILARITY_DEFAULT ? sql`(${needle} OPERATOR(public.<%) ${fuzzyColumn} AND ${similar})` : similar})`;
+	}
+	/**
+	* `websearch_to_tsquery(<config>, <normalized search string>)`.
+	*
+	* Split out because the ranking expression needs the identical query — a
+	* row ranked against a different tsquery than it was matched against is a
+	* ranking of something else.
+	*/
+	static normalizedTsQuery(searchString, spec) {
+		const normalized = spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`;
+		return sql`websearch_to_tsquery(${spec.language}, ${normalized})`;
+	}
+	/**
+	* A JSONB array of `{ field, snippet }` naming which declared fields matched
+	* and showing the text around each hit — what backs `_matches`.
+	*
+	* A ranked list answers "which rows", never "why this row". For a talent
+	* pool that difference is the product: a candidate surfacing for
+	* "iso 14001" on a *certification* is a different candidate from one whose
+	* bio happens to mention the standard, and the score cannot tell them apart.
+	*
+	* Built as a correlated subquery over a `VALUES` list of the declared
+	* fields, rather than one `CASE` per field, so the shape does not change
+	* with the number of fields and the empty result is a plain `[]`.
+	*
+	* `ts_headline` runs over the same normalized text that was indexed. Over
+	* the *original* text it would find nothing to mark whenever `unaccent` is
+	* on — the query's lexemes are folded and the document's are not — and
+	* would return the text silently unhighlighted. Folded-but-marked beats
+	* pretty-but-inert.
+	*
+	* Undefined when the collection has not opted in, when the column is not on
+	* the table yet, or when the caller did not ask: this costs a `ts_headline`
+	* per field per row and `ts_headline` re-parses the document.
+	*/
+	static buildSearchMatchesExpression(searchString, table, collection) {
+		let spec;
+		try {
+			spec = buildSearchColumnSpec(collection);
+		} catch {
+			return;
+		}
+		if (!spec || spec.fields.length === 0) return void 0;
+		if (!table[spec.column]) return void 0;
+		const query = DrizzleConditionBuilder.normalizedTsQuery(searchString, spec);
+		const config = sql`${spec.language}`;
+		const rows = spec.fields.map((f, i) => sql`(${i}, ${f.path}, ${sql.raw(f.textSql)})`);
+		return sql`(
+            SELECT coalesce(jsonb_agg(s.m ORDER BY f.ord), '[]'::jsonb)
+            FROM (VALUES ${sql.join(rows, sql`, `)}) AS f(ord, path, txt)
+            CROSS JOIN LATERAL (
+                SELECT jsonb_build_object(
+                    'field', f.path,
+                    'snippet', ts_headline(${config}::regconfig, f.txt, ${query},
+                        'StartSel=<mark>,StopSel=</mark>,MaxWords=14,MinWords=1,MaxFragments=1,FragmentDelimiter= … ')
+                ) AS m
+                WHERE to_tsvector(${config}::regconfig, f.txt) @@ ${query}
+            ) s
+        )`;
+	}
+	/**
+	* `ts_rank(<column>, <query>)` for the collection, or undefined when it has
+	* not opted in. This is what backs `orderBy: ["_score", "desc"]`.
+	*/
+	static buildSearchRankExpression(searchString, table, collection) {
+		let spec;
+		try {
+			spec = buildSearchColumnSpec(collection);
+		} catch {
+			return;
+		}
+		if (!spec) return void 0;
+		const column = table[spec.column];
+		if (!column) return void 0;
+		const rank = sql`ts_rank(${column}, ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)})`;
+		if (!spec.fuzzy) return rank;
+		const fuzzyColumn = table[spec.fuzzy.column];
+		if (!fuzzyColumn) return rank;
+		return sql`(${rank} + public.word_similarity(${spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`}, ${fuzzyColumn}))`;
+	}
+	/**
 	* Build a unique field check condition
 	*/
 	static buildUniqueFieldCondition(fieldColumn, value, idColumn, excludeId) {
@@ -1232,10 +1598,19 @@ var DrizzleConditionBuilder = class {
 	* - `orderBy`: SQL expression to ORDER BY distance (ascending = closest first)
 	* - `filter`: optional WHERE clause for distance threshold
 	* - `distanceSelect`: SQL expression for selecting the distance as `_distance`
+	*
+	* `property` is `?vector_search=` off the querystring, so it is an untrusted
+	* *name*, and it used to be looked up straight in the drizzle table object.
+	* Two ways that went wrong, both answering 500 to a malformed request:
+	* `?vector_search=title` built `"title" <=> '[1,2]'::vector`, which the
+	* database rejects with "operator does not exist"; and a table object also
+	* carries non-column keys (`_`, methods), which passed the `if (!column)`
+	* guard and compiled to nonsense. The name is resolved against the table's
+	* actual columns and required to be a `vector` — anything else is the
+	* caller's mistake and gets a 400 that says so.
 	*/
 	static buildVectorSearchConditions(table, vectorSearch) {
-		const column = table[vectorSearch.property];
-		if (!column) throw new Error(`Vector column '${vectorSearch.property}' not found in table`);
+		const column = DrizzleConditionBuilder.resolveVectorColumn(table, vectorSearch.property);
 		if (!Array.isArray(vectorSearch.vector) || vectorSearch.vector.length === 0 || !vectorSearch.vector.every((n) => typeof n === "number" && Number.isFinite(n))) throw new Error("Vector search requires a non-empty array of finite numbers");
 		const vectorLiteral = `'[${vectorSearch.vector.join(",")}]'::vector`;
 		const distanceFn = vectorSearch.distance || "cosine";
@@ -1257,7 +1632,33 @@ var DrizzleConditionBuilder = class {
 			distanceSelect: sql`(${column} ${sql.raw(operator)} ${sql.raw(vectorLiteral)})`
 		};
 	}
+	/**
+	* The `vector` column a request named, or a 400 explaining what it named.
+	*
+	* `getTableColumns` rather than a key lookup: it returns only the columns,
+	* so `_`, `getSQL` and every other property of a drizzle table stop looking
+	* like candidates. The type check is on the *physical* column
+	* (`vector(1536)`) rather than on the declared property, so it holds for an
+	* introspected collection too, where the property carries no Rebase type.
+	*/
+	static resolveVectorColumn(table, property) {
+		const columns = getTableColumns(table);
+		const column = columns?.[property];
+		if (!column) {
+			const known = Object.entries(columns ?? {}).filter(([, c]) => isVectorColumn(c)).map(([name]) => name);
+			throw ApiError.badRequest(`Unknown vector property "${property}". ` + (known.length > 0 ? `This collection's vector properties are: ${known.join(", ")}.` : "This collection declares no `vector` property to search."), "UNKNOWN_VECTOR_PROPERTY");
+		}
+		if (!isVectorColumn(column)) throw ApiError.badRequest(`Property "${property}" is not a vector column (it is \`${columnSqlType(column) || "unknown"}\`), so it has no distance operator. Name the property declared as \`{ type: "vector" }\`.`, "UNKNOWN_VECTOR_PROPERTY");
+		return column;
+	}
+};
+/** The column's SQL type, for a value that may not be a drizzle column at all. */
+var columnSqlType = (column) => {
+	const getSQLType = column?.getSQLType;
+	return typeof getSQLType === "function" ? getSQLType.call(column).toLowerCase() : "";
 };
+/** True for `vector(1536)` and its pgvector siblings, whatever the width. */
+var isVectorColumn = (column) => /^(vector|halfvec|sparsevec)\b/.test(columnSqlType(column));
 /**
 * Alias for DrizzleConditionBuilder for consistent naming with other database implementations.
 * This allows code to use PostgresConditionBuilder alongside future MongoConditionBuilder, etc.
@@ -1276,7 +1677,11 @@ function sanitizeAndConvertDates(obj) {
 	if (obj instanceof Date) return obj.toISOString();
 	if (typeof obj === "object") {
 		const newObj = {};
-		for (const key in obj) if (Object.prototype.hasOwnProperty.call(obj, key)) newObj[key] = sanitizeAndConvertDates(obj[key]);
+		for (const key in obj) {
+			if (!Object.prototype.hasOwnProperty.call(obj, key)) continue;
+			if (isPrototypePollutingKey(key)) continue;
+			newObj[key] = sanitizeAndConvertDates(obj[key]);
+		}
 		return newObj;
 	}
 	if (typeof obj === "string") {
@@ -1305,6 +1710,8 @@ function serializeDataToServer(row, properties, collection, registry) {
 		if (relation.kind === "belongsTo") foreignKeys.add(relation.localKey);
 	});
 	for (const [key, value] of Object.entries(row)) {
+		if (isPrototypePollutingKey(key)) continue;
+		if (value === void 0) continue;
 		const property = properties[key];
 		const effectiveValue = foreignKeys.has(key) && value === "" ? null : value;
 		if (!property) {
@@ -1315,11 +1722,11 @@ function serializeDataToServer(row, properties, collection, registry) {
 			const relation = findRelation(resolvedRelations, key);
 			if (relation) {
 				if (relation.kind === "belongsTo") {
-					const serializedValue = serializePropertyToServer(effectiveValue, property);
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
 					if (serializedValue !== void 0) result[relation.localKey] = serializedValue;
 					continue;
 				} else if (hasForeignKeyOnTarget(relation)) {
-					const serializedValue = serializePropertyToServer(effectiveValue, property);
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
 					inverseRelationUpdates.push({
 						relationKey: key,
 						relation,
@@ -1327,7 +1734,7 @@ function serializeDataToServer(row, properties, collection, registry) {
 					});
 					continue;
 				} else if (relation.kind === "via") {
-					const serializedValue = serializePropertyToServer(effectiveValue, property);
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
 					if (relation.cardinality === "one") joinPathRelationUpdates.push({
 						relationKey: key,
 						relation,
@@ -1342,7 +1749,7 @@ function serializeDataToServer(row, properties, collection, registry) {
 				}
 			}
 		}
-		result[key] = serializePropertyToServer(effectiveValue, property);
+		result[key] = serializePropertyToServer(effectiveValue, property, key);
 	}
 	return {
 		scalarData: result,
@@ -1351,19 +1758,39 @@ function serializeDataToServer(row, properties, collection, registry) {
 	};
 }
 /**
-* Serialize a single property value for database storage
+* How to name a rejected value in an error, without quoting it back.
+*
+* The value may be anything the caller sent, including a secret in the wrong
+* field, so the message describes its shape rather than echoing it — an echoed
+* value ends up in logs and in error-reporting services.
+*/
+function describeValue(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return "an array";
+	if (value instanceof Date) return "a date";
+	const type = typeof value;
+	return type === "object" ? "an object" : `a ${type}`;
+}
+/**
+* Serialize a single property value for database storage.
+*
+* `propertyKey` is only ever used to phrase errors and warnings. Without it the
+* one trace a bad value left was `Expected array value for array property, got
+* string` — no collection, no property, no value, which in the log of a
+* thousand-row import names nothing at all.
 */
-function serializePropertyToServer(value, property) {
+function serializePropertyToServer(value, property, propertyKey) {
 	if (value === null || value === void 0) return value;
+	const fieldLabel = propertyKey ? `'${propertyKey}'` : `a '${property.type}' field`;
 	switch (property.type) {
 		case "relation":
-			if (Array.isArray(value)) return value.map((v) => serializePropertyToServer(v, property));
+			if (Array.isArray(value)) return value.map((v) => serializePropertyToServer(v, property, propertyKey));
 			else if (typeof value === "object" && value !== null && "id" in value) return value.id;
 			if (value === "") return null;
 			return value;
 		case "array":
 			if (Array.isArray(value)) {
-				if (property.of) return value.map((item) => serializePropertyToServer(item, property.of));
+				if (property.of) return value.map((item) => serializePropertyToServer(item, property.of, propertyKey));
 				else if (property.oneOf) {
 					const typeField = property.oneOf.typeField ?? "type";
 					const valueField = property.oneOf.valueField ?? "value";
@@ -1376,20 +1803,28 @@ function serializePropertyToServer(value, property) {
 						if (!type || !childProperty) return e;
 						return {
 							[typeField]: type,
-							[valueField]: serializePropertyToServer(rec[valueField], childProperty)
+							[valueField]: serializePropertyToServer(rec[valueField], childProperty, propertyKey)
 						};
 					});
 				}
 				return value;
 			}
-			logger.warn(`Expected array value for array property, got ${typeof value}. Coercing to empty array.`);
-			return [];
+			throw ApiError.badRequest(`${fieldLabel} expects an array, but received ${describeValue(value)}.`, "VALIDATION_INVALID_VALUE");
+		case "geopoint": {
+			if (typeof value !== "object" || Array.isArray(value)) throw ApiError.badRequest(`${fieldLabel} expects a geopoint object with \`latitude\` and \`longitude\`, but received ${describeValue(value)}.`, "VALIDATION_INVALID_VALUE");
+			const point = value;
+			if (typeof point.latitude !== "number" || typeof point.longitude !== "number") throw ApiError.badRequest(`${fieldLabel} expects a geopoint object with numeric \`latitude\` and \`longitude\`.`, "VALIDATION_INVALID_VALUE");
+			return {
+				latitude: point.latitude,
+				longitude: point.longitude
+			};
+		}
 		case "map":
 			if (typeof value === "object" && property.properties) {
 				const result = {};
 				for (const [subKey, subValue] of Object.entries(value)) {
 					const subProperty = property.properties[subKey];
-					if (subProperty) result[subKey] = serializePropertyToServer(subValue, subProperty);
+					if (subProperty) result[subKey] = serializePropertyToServer(subValue, subProperty, propertyKey ? `${propertyKey}.${subKey}` : subKey);
 					else result[subKey] = subValue;
 				}
 				return result;
@@ -1627,6 +2062,7 @@ function parsePropertyFromServer(value, property, collection, propertyKey) {
 				return isNaN(parsed) ? null : parsed;
 			}
 			return value;
+		case "geopoint": return value;
 		case "vector": {
 			let nums = [];
 			if (typeof value === "string") nums = value.slice(1, -1).split(",").map(Number);
@@ -1670,6 +2106,18 @@ function parsePropertyFromServer(value, property, collection, propertyKey) {
 *                       from the result (used by `normalizeDbValues` where
 *                       Drizzle's relational API already hydrates them).
 */
+/**
+* Keys a query computes and attaches to a row, rather than reads from a column.
+*
+* An explicit set rather than a `_` prefix rule: a user's column may perfectly
+* well be called `_internal`, and passing it through here would put a value on
+* the row that no property describes and nothing downstream knows how to type.
+*/
+var QUERY_METADATA_KEYS = /* @__PURE__ */ new Set([
+	"_score",
+	"_distance",
+	"_matches"
+]);
 function normalizeScalarValues(data, properties, collection, resolvedRelations, options) {
 	const result = {};
 	const internalFKColumns = /* @__PURE__ */ new Set();
@@ -1681,6 +2129,10 @@ function normalizeScalarValues(data, properties, collection, resolvedRelations,
 			result[key] = value === null ? null : typeof value === "number" ? value : String(value);
 			continue;
 		}
+		if (QUERY_METADATA_KEYS.has(key)) {
+			result[key] = value;
+			continue;
+		}
 		const property = properties[key];
 		if (!property) continue;
 		if (options.skipRelations && property.type === "relation") continue;
@@ -1933,7 +2385,7 @@ var RelationService = class {
 		let query = this.db.select().from(targetTable).$dynamic();
 		const additionalFilters = [];
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, targetCollection.properties, targetTable);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, targetCollection.properties, targetTable, targetCollection);
 			if (searchConditions.length === 0) return [];
 			const searchCombined = DrizzleConditionBuilder.combineConditionsWithOr(searchConditions);
 			if (searchCombined) additionalFilters.push(searchCombined);
@@ -2233,6 +2685,55 @@ var RelationService = class {
 		return resultMap;
 	}
 	/**
+	* Bring one row's junction links in line with the ids a save carried,
+	* by diffing against what is stored rather than replacing the lot.
+	*
+	* The old shape was `DELETE every link for this parent` followed by
+	* `INSERT what the client sent`, which makes a save of the parent a full
+	* replacement of the membership set from a list the browser assembled out
+	* of a read it did earlier. Three things follow from that, and the diff
+	* closes all three:
+	*
+	*  - **Lost update.** Two editors with post 7 open: A adds tag X and saves;
+	*    B saves any field and the whole set is rewritten from B's older list,
+	*    dropping X with nothing to show for it. A diff only names the ids that
+	*    actually changed, so edits to disjoint tags no longer collide.
+	*  - **Partial read, partial delete.** The read that fills the form runs
+	*    under RLS, so a user who may edit the parent but cannot *see* some of
+	*    the linked rows gets a shorter list — and writing it back deleted the
+	*    links they were never shown. The DELETE now names ids instead of
+	*    "everything for this parent", and the select that produces them runs
+	*    in this same transaction under the same policies, so a link the caller
+	*    cannot read is in neither list and survives the save.
+	*  - **Junction payload columns.** A junction carrying its own columns
+	*    (`position`, `role`, `created_at`) lost them on every save, because
+	*    every row was re-inserted with only the two keys. Untouched links are
+	*    now left alone.
+	*
+	* The insert is `ON CONFLICT DO NOTHING` so that two sessions adding the
+	* same link concurrently is a no-op rather than a unique violation.
+	*/
+	async syncJunctionLinks(tx, junctionTable, sourceJunctionColumn, targetJunctionColumn, parsedParentId, parsedTargetIds) {
+		const existingRows = await tx.select({ targetId: targetJunctionColumn }).from(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
+		const existingById = /* @__PURE__ */ new Map();
+		for (const row of existingRows) {
+			if (row.targetId === null || row.targetId === void 0) continue;
+			existingById.set(String(row.targetId), row.targetId);
+		}
+		const wantedById = /* @__PURE__ */ new Map();
+		for (const targetId of parsedTargetIds) {
+			if (targetId === null || targetId === void 0) continue;
+			wantedById.set(String(targetId), targetId);
+		}
+		const removed = [...existingById.entries()].filter(([key]) => !wantedById.has(key)).map(([, value]) => value);
+		const added = [...wantedById.entries()].filter(([key]) => !existingById.has(key)).map(([, value]) => value);
+		if (removed.length > 0) await tx.delete(junctionTable).where(and(eq(sourceJunctionColumn, parsedParentId), inArray(targetJunctionColumn, removed)));
+		if (added.length > 0) await tx.insert(junctionTable).values(added.map((targetId) => ({
+			[sourceJunctionColumn.name]: parsedParentId,
+			[targetJunctionColumn.name]: targetId
+		}))).onConflictDoNothing();
+	}
+	/**
 	* Update many-to-many and junction relations
 	*/
 	async updateRelationsUsingJoins(tx, collection, id, relationValues) {
@@ -2277,16 +2778,13 @@ var RelationService = class {
 				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
-				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
+				let parsedTargetIds = [];
 				if (targetEntityIds.length > 0) {
 					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
-					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-						[sourceJunctionColumn.name]: parsedParentId,
-						[targetJunctionColumn.name]: targetId
-					}));
-					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
+					parsedTargetIds = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
 				}
+				await this.syncJunctionLinks(tx, junctionTable, sourceJunctionColumn, targetJunctionColumn, parsedParentId, parsedTargetIds);
 			} else if (relation.kind === "manyToMany") {
 				const junctionTable = this.registry.getTable(relation.through.table);
 				if (!junctionTable) {
@@ -2302,16 +2800,13 @@ var RelationService = class {
 				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
-				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
+				let parsedTargetIds = [];
 				if (targetEntityIds.length > 0) {
 					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
-					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-						[sourceJunctionColumn.name]: parsedParentId,
-						[targetJunctionColumn.name]: targetId
-					}));
-					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
+					parsedTargetIds = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
 				}
+				await this.syncJunctionLinks(tx, junctionTable, sourceJunctionColumn, targetJunctionColumn, parsedParentId, parsedTargetIds);
 			} else if (relation.cardinality === "many" && hasForeignKeyOnTarget(relation)) {
 				const targetTable = getTableForCollection(targetCollection, this.registry);
 				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
@@ -2415,25 +2910,17 @@ var RelationService = class {
 				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
 				const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
-				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
+				let parsedTargetIds = [];
 				if (newValue && Array.isArray(newValue) && newValue.length > 0) {
 					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
-					const newLinks = relationTargetIds(newValue, relation.relationName, sourceCollection.slug).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-						[sourceJunctionColumn.name]: parsedSourceId,
-						[targetJunctionColumn.name]: targetId
-					}));
-					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
+					parsedTargetIds = relationTargetIds(newValue, relation.relationName, sourceCollection.slug).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
 				} else if (newValue && !Array.isArray(newValue)) {
 					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
-					const parsedTargetId = parseIdValues(typeof newValue === "object" && newValue !== null ? newValue.id : newValue, targetPks)[targetIdInfo.fieldName];
-					const newLink = {
-						[sourceJunctionColumn.name]: parsedSourceId,
-						[targetJunctionColumn.name]: parsedTargetId
-					};
-					await tx.insert(junctionTable).values(newLink);
+					parsedTargetIds = [parseIdValues(typeof newValue === "object" && newValue !== null ? newValue.id : newValue, targetPks)[targetIdInfo.fieldName]];
 				}
+				await this.syncJunctionLinks(tx, junctionTable, sourceJunctionColumn, targetJunctionColumn, parsedSourceId, parsedTargetIds);
 			}
 		} catch (error) {
 			logger.error(`Failed to update inverse joinPath relation '${relation.relationName}'`, { error });
@@ -2459,16 +2946,14 @@ var RelationService = class {
 			const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 			const sourceIdInfo = sourcePks[0];
 			const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
-			await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
-			if (newValue && Array.isArray(newValue) && newValue.length > 0) {
+			const targetEntityIds = Array.isArray(newValue) ? relationTargetIds(newValue, relation.relationName, sourceCollection.slug) : [];
+			let parsedTargetIds = [];
+			if (targetEntityIds.length > 0) {
 				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
-				const newLinks = relationTargetIds(newValue, relation.relationName, sourceCollection.slug).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-					[sourceJunctionColumn.name]: parsedSourceId,
-					[targetJunctionColumn.name]: targetId
-				}));
-				if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
+				parsedTargetIds = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
 			}
+			await this.syncJunctionLinks(tx, junctionTable, sourceJunctionColumn, targetJunctionColumn, parsedSourceId, parsedTargetIds);
 		} catch (error) {
 			logger.error(`Failed to update many-to-many inverse relation '${relation.relationName}'`, { error });
 			throw error;
@@ -3019,8 +3504,7 @@ function sanitizeErrorForClient(error, context) {
 			column: pgError.column,
 			table: pgError.table,
 			constraint: pgError.constraint,
-			dataType: pgError.dataType,
-			drizzleMessage: error instanceof Error ? error.message : String(error)
+			dataType: pgError.dataType
 		});
 		return pgErrorToFriendlyMessage(pgError, context);
 	}
@@ -3039,7 +3523,7 @@ function sanitizeErrorForClient(error, context) {
 * Service for handling all row read operations.
 * Handles fetching, searching, counting, and filtering rows.
 */
-var FetchService = class {
+var FetchService = class FetchService {
 	db;
 	registry;
 	relationService;
@@ -3112,6 +3596,24 @@ var FetchService = class {
 	* and skips rows rather than erroring. The guesses stay, last, for a
 	* caller that hands over no collection to resolve against.
 	*/
+	/**
+	* The ORDER BY target, which may be relevance rather than a column.
+	*
+	* `_score` is only meaningful for a collection that declared a `search`
+	* block *and* for a request that carried a search string — ranking rows
+	* against no query ranks them all at zero. Outside those two conditions it
+	* is an unknown field and gets the same 400 as any other typo, which is the
+	* behaviour that matters: a sort that is silently dropped returns 200 with
+	* rows in arbitrary order, and paging over that repeats and skips rows.
+	*/
+	static SCORE_FIELD = "_score";
+	resolveOrderTarget(table, orderBy, collection, searchString) {
+		if (orderBy === FetchService.SCORE_FIELD && collection && searchString) {
+			const rank = DrizzleConditionBuilder.buildSearchRankExpression(searchString, table, collection);
+			if (rank) return rank;
+		}
+		return this.resolveOrderByField(table, orderBy, collection);
+	}
 	resolveOrderByField(table, orderBy, collection) {
 		const columnAt = (key) => (key in table ? table[key] : void 0) || void 0;
 		const direct = columnAt(orderBy);
@@ -3239,12 +3741,14 @@ var FetchService = class {
 	*/
 	buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig, scopeCondition) {
 		const queryOpts = {};
+		const hidden = hiddenColumnsOption(getTableColumns(table), this.registry.getCollectionByPath(collectionPath) ?? void 0);
+		if (hidden) queryOpts.columns = hidden;
 		if (withConfig) queryOpts.with = withConfig;
 		const allConditions = [];
 		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
 			const collection = getCollectionByPath(collectionPath, this.registry);
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) {
 				queryOpts.where = and(eq(idField, -99999999));
 				return queryOpts;
@@ -3267,7 +3771,7 @@ var FetchService = class {
 		const orderExpressions = [];
 		if (options.orderBy) {
 			const collection = getCollectionByPath(collectionPath, this.registry);
-			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
 			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
 		}
 		orderExpressions.push(desc(idField));
@@ -3284,6 +3788,7 @@ var FetchService = class {
 		if (!options.startAfter) return [];
 		const cursor = options.startAfter;
 		if (options.orderBy) {
+			if (options.orderBy === FetchService.SCORE_FIELD) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with `orderBy: \"_score\"`. Relevance is computed per query rather than stored, so it cannot key a cursor. Use `limit`/`offset` for relevance-ordered pages, or order by a column.", "SCORE_CURSOR_UNSUPPORTED", { field: FetchService.SCORE_FIELD });
 			const collection = collectionPath ? getCollectionByPath(collectionPath, this.registry) : void 0;
 			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
 			if (orderByField) {
@@ -3354,9 +3859,11 @@ var FetchService = class {
 		const qb = this.getQueryBuilder(tableName);
 		if (qb) try {
 			const withConfig = this.buildWithConfig(collection);
+			const hidden = hiddenColumnsOption(getTableColumns(table), collection);
 			const row = await qb.findFirst({
 				where: eq(idField, parsedId),
-				with: withConfig
+				with: withConfig,
+				...hidden ? { columns: hidden } : {}
 			});
 			if (!row) return void 0;
 			const flatRow = toFlatRow(row, collection, this.registry);
@@ -3370,7 +3877,8 @@ var FetchService = class {
 			if (reachedDatabase(e)) throw e;
 			logger.warn(`[FetchService] db.query.findFirst failed for ${collectionPath}, falling back to db.select`, { error: e });
 		}
-		const result = await this.db.select().from(table).where(eq(idField, parsedId)).limit(1);
+		const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
+		const result = await this.db.select(visibleOne).from(table).where(eq(idField, parsedId)).limit(1);
 		if (result.length === 0) return void 0;
 		const raw = result[0];
 		const values = await parseDataFromServer(raw, collection, this.db, this.registry);
@@ -3426,14 +3934,21 @@ var FetchService = class {
 		}
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
+		const visible = visibleColumnProjection(getTableColumns(table), collection);
+		const rankSelect = options.searchString ? DrizzleConditionBuilder.buildSearchRankExpression(options.searchString, table, collection) : void 0;
+		const matchesSelect = options.searchString && options.searchExplain ? DrizzleConditionBuilder.buildSearchMatchesExpression(options.searchString, table, collection) : void 0;
 		let query = vectorMeta ? this.db.select({
-			table_row: table,
+			table_row: visible ?? table,
 			_distance: vectorMeta.distanceSelect
-		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
+		}).from(table).$dynamic() : rankSelect ? this.db.select({
+			table_row: visible ?? table,
+			_score: rankSelect,
+			...matchesSelect ? { _matches: matchesSelect } : {}
+		}).from(table).$dynamic() : visible ? this.db.select(visible).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
 		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return [];
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
@@ -3453,7 +3968,7 @@ var FetchService = class {
 		const orderExpressions = [];
 		if (vectorMeta) orderExpressions.push(asc(vectorMeta.orderBy));
 		else if (options.orderBy) {
-			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
 			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
 		}
 		orderExpressions.push(desc(idField));
@@ -3473,6 +3988,10 @@ var FetchService = class {
 		const results = vectorMeta ? rawResults.map((r) => ({
 			...r.table_row,
 			_distance: typeof r._distance === "number" ? r._distance : parseFloat(String(r._distance))
+		})) : rankSelect ? rawResults.map((r) => ({
+			...r.table_row,
+			_score: typeof r._score === "number" ? r._score : parseFloat(String(r._score)),
+			...matchesSelect ? { _matches: r._matches ?? [] } : {}
 		})) : rawResults;
 		return this.processRowResults(results, collection, collectionPath, idInfo, options.databaseId, false, idInfoArray);
 	}
@@ -3564,7 +4083,7 @@ var FetchService = class {
 		const allConditions = [];
 		if (hop) allConditions.push(this.buildRelationScope(hop));
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return 0;
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
@@ -3709,7 +4228,8 @@ var FetchService = class {
 			if (reachedDatabase(e)) throw e;
 			logger.warn(`[fetchOneForRest] db.query.findFirst failed for ${collectionPath}, falling back`, { error: e });
 		}
-		const result = await this.db.select().from(table).where(eq(idField, parsedId)).limit(1);
+		const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
+		const result = await this.db.select(visibleOne).from(table).where(eq(idField, parsedId)).limit(1);
 		if (result.length === 0) return null;
 		const flatEntity = { ...result[0] };
 		if (!include || include.length === 0) return flatEntity;
@@ -3747,14 +4267,21 @@ var FetchService = class {
 		const idField = table[requirePrimaryKeys(collection, this.registry)[0].fieldName];
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
+		const visible = visibleColumnProjection(getTableColumns(table), collection);
+		const rankSelect = options.searchString ? DrizzleConditionBuilder.buildSearchRankExpression(options.searchString, table, collection) : void 0;
+		const matchesSelect = options.searchString && options.searchExplain ? DrizzleConditionBuilder.buildSearchMatchesExpression(options.searchString, table, collection) : void 0;
 		let query = vectorMeta ? this.db.select({
-			table_row: table,
+			table_row: visible ?? table,
 			_distance: vectorMeta.distanceSelect
-		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
+		}).from(table).$dynamic() : rankSelect ? this.db.select({
+			table_row: visible ?? table,
+			_score: rankSelect,
+			...matchesSelect ? { _matches: matchesSelect } : {}
+		}).from(table).$dynamic() : visible ? this.db.select(visible).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
 		if (options.relatedTo) allConditions.push(this.buildRelationScope(options.relatedTo));
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return [];
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
@@ -3762,6 +4289,10 @@ var FetchService = class {
 			const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
 			if (filterConditions.length > 0) allConditions.push(...filterConditions);
 		}
+		if (options.logical) {
+			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
+			if (logicalCondition) allConditions.push(logicalCondition);
+		}
 		if (vectorMeta?.filter) allConditions.push(vectorMeta.filter);
 		if (allConditions.length > 0) {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
@@ -3770,7 +4301,7 @@ var FetchService = class {
 		const orderExpressions = [];
 		if (vectorMeta) orderExpressions.push(asc(vectorMeta.orderBy));
 		else if (options.orderBy) {
-			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
 			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
 		}
 		orderExpressions.push(desc(idField));
@@ -3783,6 +4314,11 @@ var FetchService = class {
 			...r.table_row,
 			_distance: typeof r._distance === "number" ? r._distance : parseFloat(String(r._distance))
 		}));
+		if (rankSelect) return rawResults.map((r) => ({
+			...r.table_row,
+			_score: typeof r._score === "number" ? r._score : parseFloat(String(r._score)),
+			...matchesSelect ? { _matches: r._matches ?? [] } : {}
+		}));
 		return rawResults;
 	}
 	/**
@@ -3796,51 +4332,6 @@ var FetchService = class {
 		return !!this.getQueryBuilder(tableName);
 	}
 	/**
-	* Attempt to use Drizzle's relational query API (db.query.<table>.findMany)
-	* for efficient JOIN-based relation loading.
-	* Returns null if the API is not available or the query fails.
-	* Note: Primary path now uses `buildWithConfig` + `buildDrizzleQueryOptions`.
-	*/
-	async fetchWithDrizzleQuery(collectionPath, collection, options, include, idInfo, idInfoArray) {
-		try {
-			const table = getTableForCollection(collection, this.registry);
-			const tableName = getTableName(table);
-			const queryTarget = this.getQueryBuilder(tableName);
-			if (!queryTarget?.findMany) return null;
-			const resolvedRelations = resolveCollectionRelations(collection);
-			const withConfig = {};
-			for (const [key, relation] of Object.entries(resolvedRelations)) if (include[0] === "*" || include.includes(key)) {
-				const drizzleRelName = relation.relationName || key;
-				withConfig[drizzleRelName] = true;
-			}
-			const queryOpts = { with: withConfig };
-			if (options.limit) queryOpts.limit = options.limit;
-			if (options.filter) {
-				const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
-				if (filterConditions.length > 0) queryOpts.where = and(...filterConditions);
-			}
-			if (options.orderBy) {
-				const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
-				if (orderByField) queryOpts.orderBy = options.order === "asc" ? asc(orderByField) : desc(orderByField);
-			}
-			return (await queryTarget.findMany(queryOpts)).map((row) => {
-				const flat = {};
-				for (const [k, v] of Object.entries(row)) if (Array.isArray(v)) flat[k] = v.map((item) => {
-					const keys = Object.keys(item);
-					const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-					if (nestedObj && keys.length <= 3) return { ...item[nestedObj] };
-					return { ...item };
-				});
-				else if (typeof v === "object" && v !== null) flat[k] = { ...v };
-				else flat[k] = v;
-				return flat;
-			});
-		} catch (e) {
-			logger.warn(`[include] Drizzle relational query failed for '${collectionPath}', falling back`, { error: e });
-			return null;
-		}
-	}
-	/**
 	* Fallback path used when db.query is unavailable.
 	* The primary path uses db.query.findMany with `with` config, which
 	* loads all relations in a single query.
@@ -4023,6 +4514,7 @@ var PersistService = class {
 			const inverseRelationUpdates = serializedResult.inverseRelationUpdates;
 			const joinPathRelationUpdates = serializedResult.joinPathRelationUpdates;
 			const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
+			assertWritableColumns(entityData, table, effectiveCollectionPath);
 			savedId = await this.db.transaction(async (tx) => {
 				let currentId;
 				if (id && !options?.upsert) {
@@ -4049,6 +4541,7 @@ var PersistService = class {
 						const target = idInfoArray.map((info) => table[info.fieldName]);
 						const set = { ...dataForInsert };
 						for (const info of idInfoArray) delete set[info.fieldName];
+						for (const [propName, prop] of Object.entries(collection.properties ?? {})) if (prop.type === "date" && prop.autoValue === "on_create") delete set[propName];
 						result = Object.keys(set).length > 0 ? await insertQuery.onConflictDoUpdate({
 							target,
 							set
@@ -4091,7 +4584,8 @@ var PersistService = class {
 		if (error instanceof ApiError || error?.name === "ApiError") return error;
 		const pgError = extractPgError(error);
 		if (pgError) {
-			const { message } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+			const { message, code } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`) : ApiError.badRequest(message, `PG_${code}`);
 			return new Error(message);
 		}
 		const causeMessage = extractCauseMessage(error);
@@ -4316,6 +4810,7 @@ var BranchService = class {
                 metadata     JSONB DEFAULT '{}'
             );
         `));
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "branches")));
 	}
 	/**
 	* Create a new branch database by templating the source database.
@@ -4423,43 +4918,49 @@ var BranchService = class {
 };
 //#endregion
 //#region src/security/rls-enforcement.ts
+var quoteIdent$1 = (name) => `"${name.replace(/"/g, "\"\"")}"`;
+/** DML the user role holds on managed tables (RLS still filters per row). */
+var USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
 /**
-* Unified RLS enforcement — the "user context vs server context" model.
-*
-* Every operation runs in one of two contexts:
+* Warn when the connection role shares its name with an existing schema.
 *
-*  - **User context** — a request authenticated (or anonymous) via
-*    `driver.withAuth(user)`. Runs as the restricted `rebase_user` role: a
-*    non-owner, NOSUPERUSER, NOBYPASSRLS role, so Postgres RLS binds *every*
-*    statement (SELECT, INSERT, UPDATE, DELETE). The collection's
-*    `securityRules` are the whole authorization model; app-layer callbacks
-*    are validation/side-effects, not a security boundary.
+* Postgres resolves unqualified names through `search_path`, which defaults to
+* `"$user", public` — and `$user` is the connection ROLE. When a schema of that
+* name exists it sits ahead of `public`, so every unqualified statement
+* silently operates on it instead:
 *
-*  - **Server context** — the base (owner) connection: auth flows, migrations,
-*    background jobs, and the explicit `rebase.dataAsAdmin` accessor. As table
-*    owner it bypasses RLS. This is the trusted plane, equivalent to
-*    Supabase's `service_role`.
+*     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts
 *
-* This module provides the three pieces:
+* Nothing errors. You get a second table of the same name in the wrong schema,
+* and reads that pin `public` cannot see it — which reads as "missing table" and
+* sends people to re-run a push that creates a *third* copy. The bootstrapper
+* has a whole branch dedicated to recognising the symptom after the fact.
 *
-*  1. {@link detectConnectionPosture} — is the connection subject to RLS at
-*     all? (superuser / BYPASSRLS / table owner ⇒ no)
-*  2. {@link ensureAppRole} — idempotently provision `rebase_user` with
-*     SELECT/INSERT/UPDATE/DELETE grants (+ default privileges so future
-*     tables stay covered).
-*  3. {@link applyAuthContext} — per-transaction: set the `app.*` GUCs the
-*     policies read (`auth.uid()` etc.) and `SET LOCAL ROLE rebase_user` so
-*     RLS binds. Transaction-scoped, so it composes with poolers.
+* Rebase shipped straight into this: it creates a schema named `rebase` while
+* every template named the database role `rebase` too. The scaffold uses
+* `rebase_app` now, and every pool Rebase opens pins `search_path=public`
+* (`pinSearchPath`), which covers the paths the framework controls. This covers
+* the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,
+* a hand-written migration — because the hazard is a property of the two NAMES,
+* not of any one connection.
 *
-* Provisioning runs from the framework's own bootstrap/migrate (which already
-* self-creates the `auth` schema and functions) — enforcement is default-on,
-* not an operator opt-in.
+* A warning rather than a boot failure: the database works, the framework's own
+* traffic is pinned, and refusing to start over a naming choice a user may have
+* inherited would be worse than the risk.
 */
-/** The restricted role every authenticated (user-context) request runs as. */
-var REBASE_USER_ROLE = "rebase_user";
-var quoteIdent$1 = (name) => `"${name.replace(/"/g, "\"\"")}"`;
-/** DML the user role holds on managed tables (RLS still filters per row). */
-var USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
+async function warnOnRoleSchemaCollision(run) {
+	try {
+		const rows = await run(`
+            SELECT current_user AS role,
+                   EXISTS (
+                       SELECT 1 FROM pg_namespace n WHERE n.nspname = current_user
+                   ) AS collides
+        `);
+		if (rows[0]?.collides !== true) return;
+		const role = String(rows[0]?.role ?? "the connection role");
+		logger.warn(`⚠️  The database role "${role}" has the same name as a schema. Postgres resolves unqualified names through \`search_path\`, which defaults to \`"$user", public\` — so "${role}" is searched BEFORE public, and any unqualified \`CREATE TABLE\`/\`SELECT\` from a tool that does not pin the path (psql, pg_dump, drizzle-kit, a hand-written migration) silently lands in "${role}" instead. Rebase's own connections pin \`search_path=public\`, so the server is unaffected. To remove the hazard entirely, connect as a role whose name is not also a schema — the scaffold uses "rebase_app".`);
+	} catch {}
+}
 async function detectConnectionPosture(run) {
 	const row = (await run(`
         SELECT current_user            AS role,
@@ -4535,6 +5036,9 @@ async function ensureAppRole(run, schemas) {
 		await run(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
 		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);
 		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);
+		await revokeInternalTableAccess(async (text) => {
+			await run(text);
+		}, schema, { onError: (table, error) => logger.warn(`🔐 [rls] Could not revoke "${REBASE_USER_ROLE}" access to "${schema}"."${table}" — it stays reachable by authenticated requests: ` + (error instanceof Error ? error.message : String(error))) });
 	}
 	logger.info(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
 }
@@ -4620,6 +5124,40 @@ function warnOnAnonymousGrants(collections) {
 	logger.warn(`Security rules that read as a lockdown but grant access to anonymous requests. Every caller from a client carries a user id ('${ANONYMOUS_USER_ID}' when nobody is signed in), so these clauses are true for everyone:\n\n` + problems.join("\n\n") + "\n");
 }
 /**
+* Name the collections whose raw policy SQL still calls the pre-1.0 helpers.
+*
+* The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the
+* database, so nothing is broken and no policy is wrong — which is exactly why
+* this has to be said out loud. A silent rewrite that works forever is not a
+* migration, it is a second supported spelling nobody wrote down, and the next
+* person to read those rules will copy the old one.
+*
+* Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,
+* `policy.rolesOverlap(...)`) compile from the model and were never affected.
+*/
+function warnOnLegacyRlsFunctions(collections) {
+	const sites = [];
+	for (const collection of collections) for (const rule of collection.securityRules ?? []) {
+		const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+		if (![usingExpr, withCheckExpr].filter((e) => e !== null).some(containsLegacyRlsCall)) continue;
+		const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
+		if (!sites.includes(site)) sites.push(site);
+	}
+	if (sites.length === 0) return;
+	logger.warn(`These security rules call the pre-1.0 RLS helpers (\`auth.uid()\`, \`auth.roles()\`, \`auth.jwt()\`). They still work — the compiler rewrites them — but the functions now live in the \`rebase\` schema, and the \`auth\` one is Supabase's. Update the raw SQL in these rules to \`${REBASE_SCHEMA}.uid()\` and friends, or switch them to the structured helpers (\`policy.authUid()\`, \`policy.rolesOverlap()\`), which never had to be spelled by hand:\n\n` + sites.map((s) => `  • ${s}`).join("\n") + "\n");
+}
+/** Whether any `raw` expression in the tree calls a pre-1.0 helper. */
+function containsLegacyRlsCall(expr) {
+	switch (expr.kind) {
+		case "raw": return usesLegacyRlsFunctions(expr.sql);
+		case "and":
+		case "or": return expr.operands.some(containsLegacyRlsCall);
+		case "not": return containsLegacyRlsCall(expr.operand);
+		case "existsIn": return containsLegacyRlsCall(expr.where);
+		default: return false;
+	}
+}
+/**
 * Reject `pgRoles` that this server can never satisfy.
 *
 * `pgRoles` sets the `TO` clause of a generated policy, so a policy naming a
@@ -4749,6 +5287,25 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			}
 		};
 	}
+	/**
+	* Build the context handed to every collection callback.
+	*
+	* Note `data: this.data` — `this` is whichever driver is running the
+	* operation, so the callback's data plane inherits that driver's privilege.
+	* On a user request `AuthenticatedPostgresBackendDriver.withTransaction`
+	* constructs a fresh base driver bound to the RLS-scoped transaction and
+	* runs the operation on it, so `this.data` speaks through that connection
+	* and policies apply. On server-context work `this` is the base driver on
+	* the owner connection, and they do not. Pinned by the
+	* `"scopes context.data to the caller"` case in the `rls-enforcement` e2e
+	* suite, because it is the kind of property that is easy to break from a
+	* distance and impossible to notice.
+	*
+	* Previously returned through `as unknown as RebaseCallContext`, which
+	* disabled checking for the whole object and let `driver` — documented in
+	* the callbacks guide — sit on the runtime context while absent from the
+	* contract. Both are declared now, so this is a plain typed return.
+	*/
 	buildCallContext() {
 		return {
 			user: this.user,
@@ -5204,6 +5761,106 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			return saved;
 		});
 	}
+	/**
+	* Update many rows through the same pipeline as {@link save}, in one
+	* transaction.
+	*
+	* Structurally the mirror of {@link saveMany} — same tx-bound sub-driver,
+	* same deferred notifications, same per-row error labelling — but it calls
+	* `save` with an explicit `id` and `status: "existing"`, which is precisely
+	* what `saveMany` cannot do: that one passes `status: "new"` and keeps the
+	* key inside `values`, so it inserts or upserts and can never target a
+	* particular row.
+	*
+	* All-or-nothing, so an id matching no row aborts the batch. A partial
+	* update is the outcome with no good recovery: the caller cannot tell which
+	* half landed without re-reading everything.
+	*/
+	async updateMany({ path, updates, collection }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < updates.length; i++) {
+				const { id, values } = updates[i];
+				try {
+					if (!await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					saved.push(await txDriver.save({
+						path,
+						id: String(id),
+						values,
+						collection,
+						status: "existing"
+					}));
+				} catch (error) {
+					throw Object.assign(new Error(`Update ${i} of ${updates.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return saved;
+		});
+	}
+	/**
+	* Delete many rows in one transaction, running the full delete pipeline —
+	* `beforeDelete`, the delete, `afterDelete` — for each.
+	*
+	* Looping the single-row {@link delete} rather than emitting one
+	* `DELETE ... WHERE id = ANY($1)` is the deliberate choice: a single
+	* statement would be faster and would skip every callback, so a collection
+	* relying on `beforeDelete` to veto or on `afterDelete` to clean up
+	* dependents would behave differently depending on how many rows the caller
+	* happened to delete at once. Same pipeline, one transaction.
+	*/
+	async deleteMany({ path, ids, collection }) {
+		await this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			for (let i = 0; i < ids.length; i++) {
+				const id = ids[i];
+				try {
+					const existing = await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					});
+					if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					await txDriver.delete({
+						row: {
+							id: String(id),
+							path,
+							values: existing
+						},
+						collection
+					});
+				} catch (error) {
+					throw Object.assign(new Error(`Delete ${i} of ${ids.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+		});
+	}
 	async delete({ row, collection }) {
 		const targetPath = row.path;
 		const targetRow = { ...row.values ?? {} };
@@ -5781,6 +6438,13 @@ function createAuthSchema(usersSchemaName = "rebase") {
 		* that rotates immediately after it.
 		*/
 		sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
+		/**
+		* The assurance level the sign-in was established at — `aal2` only
+		* where a second factor was actually presented. Carried across
+		* rotations, because refresh is not a new authentication and has
+		* nothing else to read the level from.
+		*/
+		aal: text("aal"),
 		userAgent: text("user_agent"),
 		ipAddress: text("ip_address"),
 		createdAt: timestamp("created_at").defaultNow().notNull()
@@ -5826,6 +6490,13 @@ function createAuthSchema(usersSchemaName = "rebase") {
 		secretEncrypted: text("secret_encrypted").notNull(),
 		friendlyName: text("friendly_name"),
 		verified: boolean("verified").default(false).notNull(),
+		/**
+		* The highest TOTP time step ever accepted for this factor. RFC 6238
+		* §5.2 forbids accepting an OTP twice, and the ±1 step window that
+		* exists for clock drift is also a 90-second replay window: without
+		* this, one observed code buys a fresh session for a minute and a half.
+		*/
+		lastUsedCounter: bigint("last_used_counter", { mode: "number" }),
 		createdAt: timestamp("created_at").defaultNow().notNull(),
 		updatedAt: timestamp("updated_at").defaultNow().notNull()
 	});
@@ -5843,6 +6514,8 @@ function createAuthSchema(usersSchemaName = "rebase") {
 			createdAt: timestamp("created_at").defaultNow().notNull(),
 			verifiedAt: timestamp("verified_at"),
 			ipAddress: text("ip_address"),
+			/** Failed guesses recorded against this challenge; bounded by the route. */
+			attempts: integer("attempts").default(0).notNull(),
 			expiresAt: timestamp("expires_at").notNull()
 		}),
 		recoveryCodes: tableCreator("recovery_codes", {
@@ -5919,6 +6592,26 @@ var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user:
 * Uses the explicit `columnName` when set (e.g. from introspection),
 * falling back to `toSnakeCase(propName)` for manually-authored collections.
 */
+var JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+/**
+* A string literal for the generated schema file.
+*
+* Column names, table names and enum values are all written into this file as
+* literals, and none of them is constrained to be quote-free: a Postgres
+* identifier only has to be quoted, and `O'Brien` is an ordinary enum value.
+* Interpolating them raw ended the literal early — for enum values, inside
+* single quotes, where an apostrophe is not an edge case.
+*/
+var quote$1 = (value) => JSON.stringify(value);
+/** An object key: verbatim when it is an identifier, quoted otherwise. */
+var propKey = (name) => JS_IDENTIFIER.test(name) ? name : quote$1(name);
+/**
+* A property access on a generated table variable.
+*
+* `users.full name` is not an expression; `users["full name"]` is, and Drizzle
+* treats the two identically.
+*/
+var member = (object, key) => JS_IDENTIFIER.test(key) ? `${object}.${key}` : `${object}[${quote$1(key)}]`;
 var resolveColumnName = (propName, prop) => {
 	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
 	return toSnakeCase(propName);
@@ -5979,18 +6672,25 @@ var isIdProperty = (propName, prop, collection) => {
 	if ("isId" in prop && Boolean(prop.isId)) return true;
 	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
 };
+/**
+* The Drizzle column declaration a property compiles to, or `null` when the
+* property puts no column on *this* table (an inverse relation, whose column
+* lives on the target). Exported so it can be checked against its DDL twin
+* `getSqlColumnType` directly — the two disagreeing is what left `geopoint`
+* with a database column and no Drizzle key.
+*/
 var getDrizzleColumn = (propName, prop, collection, collections) => {
 	const colName = resolveColumnName(propName, prop);
 	let columnDefinition;
 	switch (prop.type) {
 		case "string": {
 			const stringProp = prop;
-			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}("${colName}")`;
-			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid("${colName}")`;
-			else if (stringProp.columnType === "uuid") columnDefinition = `uuid("${colName}")`;
-			else if (stringProp.columnType === "char") columnDefinition = `char("${colName}", { length: ${resolveStringColumnLength(stringProp)} })`;
-			else if (stringProp.columnType === "varchar") columnDefinition = `varchar("${colName}", { length: ${resolveStringColumnLength(stringProp)} })`;
-			else columnDefinition = `text("${colName}")`;
+			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}(${quote$1(colName)})`;
+			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
+			else if (stringProp.columnType === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
+			else if (stringProp.columnType === "char") columnDefinition = `char(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
+			else if (stringProp.columnType === "varchar") columnDefinition = `varchar(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
+			else columnDefinition = `text(${quote$1(colName)})`;
 			if (isIdProperty(propName, prop, collection)) columnDefinition += ".primaryKey()";
 			if ("isId" in stringProp && stringProp.isId !== "manual" && stringProp.isId !== true) {
 				if (stringProp.isId === "uuid") columnDefinition += ".defaultRandom()";
@@ -6006,10 +6706,10 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 		case "number": {
 			const numProp = prop;
 			const isId = isIdProperty(propName, prop, collection);
-			let baseType = numProp.validation?.integer || isId ? `integer("${colName}")` : `numeric("${colName}")`;
-			if (numProp.columnType) if (numProp.columnType === "double precision") baseType = `doublePrecision("${colName}")`;
-			else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") baseType = `${numProp.columnType}("${colName}", { mode: "number" })`;
-			else baseType = `${numProp.columnType}("${colName}")`;
+			let baseType = numProp.validation?.integer || isId ? `integer(${quote$1(colName)})` : `numeric(${quote$1(colName)})`;
+			if (numProp.columnType) if (numProp.columnType === "double precision") baseType = `doublePrecision(${quote$1(colName)})`;
+			else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") baseType = `${numProp.columnType}(${quote$1(colName)}, { mode: "number" })`;
+			else baseType = `${numProp.columnType}(${quote$1(colName)})`;
 			if ("isId" in numProp && numProp.isId === "increment") columnDefinition = `${baseType}.generatedByDefaultAsIdentity()`;
 			else if ("isId" in numProp && typeof numProp.isId === "string" && numProp.isId !== "manual") {
 				columnDefinition = baseType;
@@ -6021,19 +6721,22 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			break;
 		}
 		case "boolean":
-			columnDefinition = `boolean("${colName}")`;
+			columnDefinition = `boolean(${quote$1(colName)})`;
 			break;
 		case "date": {
 			const dateProp = prop;
-			if (dateProp.columnType === "date") columnDefinition = `date("${colName}", { mode: 'string' })`;
-			else if (dateProp.columnType === "time") columnDefinition = `time("${colName}")`;
-			else columnDefinition = `timestamp("${colName}", { withTimezone: true, mode: 'string' })`;
+			if (dateProp.columnType === "date") columnDefinition = `date(${quote$1(colName)}, { mode: 'string' })`;
+			else if (dateProp.columnType === "time") columnDefinition = `time(${quote$1(colName)})`;
+			else columnDefinition = `timestamp(${quote$1(colName)}, { withTimezone: true, mode: 'string' })`;
 			if (dateProp.autoValue === "on_create" || dateProp.autoValue === "on_update") columnDefinition += ".default(sql`now()`)";
 			break;
 		}
 		case "map":
-			if (prop.columnType === "json") columnDefinition = `json("${colName}")`;
-			else columnDefinition = `jsonb("${colName}")`;
+			if (prop.columnType === "json") columnDefinition = `json(${quote$1(colName)})`;
+			else columnDefinition = `jsonb(${quote$1(colName)})`;
+			break;
+		case "geopoint":
+			columnDefinition = `jsonb(${quote$1(colName)})`;
 			break;
 		case "array": {
 			const arrayProp = prop;
@@ -6044,19 +6747,21 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
 				else if (ofProp.type === "boolean") colType = "boolean[]";
 			}
-			if (colType === "json") columnDefinition = `json("${colName}")`;
-			else if (colType === "text[]") columnDefinition = `text("${colName}").array()`;
-			else if (colType === "integer[]") columnDefinition = `integer("${colName}").array()`;
-			else if (colType === "boolean[]") columnDefinition = `boolean("${colName}").array()`;
-			else if (colType === "numeric[]") columnDefinition = `numeric("${colName}").array()`;
-			else columnDefinition = `jsonb("${colName}")`;
+			if (colType === "json") columnDefinition = `json(${quote$1(colName)})`;
+			else if (colType === "text[]") columnDefinition = `text(${quote$1(colName)}).array()`;
+			else if (colType === "integer[]") columnDefinition = `integer(${quote$1(colName)}).array()`;
+			else if (colType === "boolean[]") columnDefinition = `boolean(${quote$1(colName)}).array()`;
+			else if (colType === "numeric[]") columnDefinition = `numeric(${quote$1(colName)}).array()`;
+			else columnDefinition = `jsonb(${quote$1(colName)})`;
 			break;
 		}
-		case "vector":
-			columnDefinition = `vector("${colName}", { dimensions: ${prop.dimensions} })`;
+		case "vector": {
+			const vp = prop;
+			columnDefinition = `vector(${quote$1(colName)}, { dimensions: ${vp.dimensions} })`;
 			break;
+		}
 		case "binary":
-			columnDefinition = `customType({ dataType() { return 'bytea'; } })("${colName}")`;
+			columnDefinition = `customType({ dataType() { return 'bytea'; } })(${quote$1(colName)})`;
 			break;
 		case "relation": {
 			const refProp = prop;
@@ -6078,30 +6783,31 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			const required = prop.validation?.required;
 			const refOptionsParts = [onUpdate, `onDelete: \"${relation.onDelete ?? (required ? "cascade" : "set null")}\"`].filter(Boolean);
 			const refOptions = refOptionsParts.length > 0 ? `{ ${refOptionsParts.join(", ")} }` : "";
-			let columnDef = `${baseColumn}.references(() => ${targetTableVar}.${targetIdField}${refOptions ? `, ${refOptions}` : ""})`;
+			let columnDef = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}${refOptions ? `, ${refOptions}` : ""})`;
 			if (required) columnDef += ".notNull()";
-			return `    ${relation.localKey}: ${columnDef}`;
+			return `    ${propKey(relation.localKey)}: ${columnDef}`;
 		}
 		case "reference": {
 			const refProp = prop;
 			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName$1(c) === refProp.path);
 			if (!targetCollection) {
-				columnDefinition = `text("${colName}")`;
+				columnDefinition = `text(${quote$1(colName)})`;
 				break;
 			}
 			const pkProp = getPrimaryKeyProp(targetCollection);
 			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
 			const targetIdField = pkProp.name;
-			const baseColumn = pkProp.type === "number" ? `integer("${colName}")` : pkProp.isUuid ? `uuid("${colName}")` : `text("${colName}")`;
+			const baseColumn = pkProp.type === "number" ? `integer(${quote$1(colName)})` : pkProp.isUuid ? `uuid(${quote$1(colName)})` : `text(${quote$1(colName)})`;
 			const required = prop.validation?.required;
-			columnDefinition = `${baseColumn}.references(() => ${targetTableVar}.${targetIdField}, ${`{ onDelete: "${required ? "cascade" : "set null"}" }`})`;
+			const refOptions = `{ onDelete: "${required ? "cascade" : "set null"}" }`;
+			columnDefinition = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}, ${refOptions})`;
 			if (required) columnDefinition += ".notNull()";
-			return `    ${propName}: ${columnDefinition}`;
+			return `    ${propKey(propName)}: ${columnDefinition}`;
 		}
-		default: return null;
+		default: throw new Error(`No Postgres column mapping for property '${propName}' of type '${prop.type}' in collection '${collection.slug}'. Add a case to \`getDrizzleColumn\` (and to \`getSqlColumnType\`, which must agree).`);
 	}
 	if (prop.validation?.required) columnDefinition += ".notNull()";
-	return `    ${propName}: ${columnDefinition}`;
+	return `    ${propKey(propName)}: ${columnDefinition}`;
 };
 /**
 * Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
@@ -6134,7 +6840,7 @@ var generateSinglePolicyCode = (collection, rule, operation, policyName, resolve
 	parts.push(`to: [${toRoles.map((r) => `"${r}"`).join(", ")}]`);
 	if (usingClause) parts.push(`using: ${usingClause}`);
 	if (withCheckClause) parts.push(`withCheck: ${withCheckClause}`);
-	return `    pgPolicy("${policyName}", { ${parts.join(", ")} }),\n`;
+	return `    pgPolicy(${quote$1(policyName)}, { ${parts.join(", ")} }),\n`;
 };
 /**
 * Computes a deterministic shared relation name for Drizzle.
@@ -6168,11 +6874,13 @@ var computeSharedRelationName = (rel, sourceCollection, _collections) => {
 	}
 	return fallback;
 };
-var generateSchema = async (collections, stripPolicies = false) => {
+var generateSchema = async (allCollections, stripPolicies = false) => {
+	const collections = sortCollectionsBySlug(relationalCollections(allCollections));
 	let schemaContent = "// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\n\n";
 	const hasUuid = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "string" && (p.autoValue === "uuid" || p.isId === "uuid")));
 	const hasVector = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "vector"));
 	const hasBinary = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "binary"));
+	const hasSearch = collections.some((c) => buildSearchColumnSpec(c) !== void 0);
 	const pgCoreImports = [
 		"primaryKey",
 		"pgTable",
@@ -6197,7 +6905,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 	];
 	if (hasUuid) pgCoreImports.push("uuid");
 	if (hasVector) pgCoreImports.push("vector");
-	if (hasBinary) pgCoreImports.push("customType");
+	if (hasBinary || hasSearch) pgCoreImports.push("customType");
 	const uniqueSchemas = Array.from(new Set(collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)));
 	if (uniqueSchemas.length > 0) pgCoreImports.push("pgSchema");
 	schemaContent += `import { ${pgCoreImports.join(", ")} } from 'drizzle-orm/pg-core';\n`;
@@ -6218,7 +6926,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 				const enumDbName = `${collectionPath}_${resolveColumnName(propName, prop)}`;
 				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
 				if (values.length > 0) {
-					schemaContent += `export const ${enumVarName} = pgEnum(\"${enumDbName}\", [${values.map((v) => `'${v}'`).join(", ")}]);\n`;
+					schemaContent += `export const ${enumVarName} = pgEnum(${quote$1(enumDbName)}, [${values.map((v) => quote$1(v)).join(", ")}]);\n`;
 					if (!exportedEnumVars.includes(enumVarName)) exportedEnumVars.push(enumVarName);
 				}
 			}
@@ -6279,6 +6987,11 @@ var generateSchema = async (collections, stripPolicies = false) => {
 				const columnString = getDrizzleColumn(propName, prop, collection, collections);
 				if (columnString) columns.add(columnString);
 			});
+			const searchSpec = buildSearchColumnSpec(collection);
+			if (searchSpec) {
+				columns.add(`    ${searchSpec.column}: customType({ dataType() { return 'tsvector'; } })("${searchSpec.column}").generatedAlwaysAs(sql\`${searchSpec.expression}\`)`);
+				if (searchSpec.fuzzy) columns.add(`    ${searchSpec.fuzzy.column}: text("${searchSpec.fuzzy.column}").generatedAlwaysAs(sql\`${searchSpec.fuzzy.expression}\`)`);
+			}
 			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: text(\"id\").primaryKey()");
 			schemaContent += `${Array.from(columns).join(",\n")}`;
 			const securityRules = getEffectiveSecurityRules(collection);
@@ -6315,9 +7028,9 @@ var generateSchema = async (collections, stripPolicies = false) => {
 						break;
 					}
 				} catch {}
-				tableRelations.push(`    "${relation.through.sourceColumn}": one(${sourceTableVar}, {\n        fields: [${tableVarName}.${relation.through.sourceColumn}],\n        references: [${sourceTableVar}.${sourceId}],\n        relationName: \"${owningRelationName}\"\n    })`);
+				tableRelations.push(`    ${quote$1(relation.through.sourceColumn)}: one(${sourceTableVar}, {\n        fields: [${member(tableVarName, relation.through.sourceColumn)}],\n        references: [${member(sourceTableVar, sourceId)}],\n        relationName: ${quote$1(owningRelationName)}\n    })`);
 				const targetRelationName = inverseRelationName ? inverseRelationName : `${tableName}_${relation.through.targetColumn}`;
-				tableRelations.push(`    "${relation.through.targetColumn}": one(${targetTableVar}, {\n        fields: [${tableVarName}.${relation.through.targetColumn}],\n        references: [${targetTableVar}.${targetId}],\n        relationName: "${targetRelationName}"\n    })`);
+				tableRelations.push(`    ${quote$1(relation.through.targetColumn)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, relation.through.targetColumn)}],\n        references: [${member(targetTableVar, targetId)}],\n        relationName: ${quote$1(targetRelationName)}\n    })`);
 			}
 		} else {
 			const resolvedRelations = resolveCollectionRelations(collection);
@@ -6332,7 +7045,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 				switch (rel.kind) {
 					case "belongsTo": {
 						const localFieldKey = resolvePropertyKeyForColumn(collection, rel.localKey);
-						tableRelations.push(`    "${relationKey}": one(${targetTableVar}, {\n        fields: [${tableVarName}.${localFieldKey}],\n        references: [${targetTableVar}.${getPrimaryKeyName(target)}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
+						tableRelations.push(`    ${quote$1(relationKey)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, localFieldKey)}],\n        references: [${member(targetTableVar, getPrimaryKeyName(target))}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
 						break;
 					}
 					case "hasOne":
@@ -6363,7 +7076,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 							const drizzleFieldKey = resolvePropertyKeyForColumn(collection, otherRel.foreignKeyOnTarget);
 							const referencedKey = otherRel.sourceKey ? resolvePropertyKeyForColumn(otherCollection, otherRel.sourceKey) : getPrimaryKeyName(otherCollection);
 							const synthKey = `_synth_${otherTableVar}_${drizzleFieldKey}`;
-							tableRelations.push(`    "${synthKey}": one(${otherTableVar}, {\n        fields: [${tableVarName}.${drizzleFieldKey}],\n        references: [${otherTableVar}.${referencedKey}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
+							tableRelations.push(`    ${quote$1(synthKey)}: one(${otherTableVar}, {\n        fields: [${member(tableVarName, drizzleFieldKey)}],\n        references: [${member(otherTableVar, referencedKey)}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
 							emittedRelationNames.add(deduplicationKey);
 						}
 					}
@@ -6982,6 +7695,8 @@ var ChannelHistoryStore = class {
                 last_seq BIGINT NOT NULL
             )
         `);
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")));
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")));
 		this.tablesReady = true;
 		logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
 	}
@@ -7165,6 +7880,7 @@ var ChannelPresenceStore = class {
             CREATE INDEX IF NOT EXISTS idx_channel_presence_last_seen
             ON rebase.channel_presence (last_seen)
         `);
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence")));
 		this.tablesReady = true;
 	}
 	/** Record (or refresh) a client's presence. */
@@ -7556,6 +8272,12 @@ var PG_NOTIFY_CHANNEL = "rebase_entity_changes";
 var RealtimeService = class RealtimeService extends EventEmitter {
 	db;
 	registry;
+	/**
+	* Declares to the multi-engine router that channel frames can be handled
+	* here. Read by `createRoutedRealtimeService`, which otherwise would have to
+	* guess — and guessed "the default provider", whichever engine that is.
+	*/
+	supportsChannels = true;
 	clients = /* @__PURE__ */ new Map();
 	channels = /* @__PURE__ */ new Map();
 	presence = /* @__PURE__ */ new Map();
@@ -7602,6 +8324,23 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* so a hot channel logs the problem once rather than once per message.
 	*/
 	oversizedBroadcastWarned = /* @__PURE__ */ new Set();
+	/**
+	* Optional narrowing on top of the membership floor — see
+	* {@link ChannelAuthorizer}. Unset by default, which leaves membership as
+	* the whole of the rule.
+	*/
+	channelAuthorizer;
+	/**
+	* Whether a notification from another instance has ever arrived.
+	*
+	* The entity LISTEN handler sees a foreign `sid` on every cross-instance
+	* change, which is proof that this deployment runs more than one pod — the
+	* one fact needed to tell "the memory bus is fine here" from "broadcast and
+	* presence silently reach a fraction of your users".
+	*/
+	foreignInstanceSeen = false;
+	/** So the multi-pod memory-bus warning is emitted once, not once per join. */
+	memoryBusWarned = false;
 	presenceInterval;
 	static PRESENCE_TIMEOUT_MS = 3e4;
 	/** How often stale roster rows from other instances are reaped. */
@@ -7695,7 +8434,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				limit: config.limit,
 				startAfter: config.startAfter,
 				databaseId: config.databaseId,
-				searchString: config.searchString
+				searchString: config.searchString,
+				searchExplain: config.searchExplain
 			}
 		});
 		if (callback) this.subscriptionCallbacks.set(subscriptionId, callback);
@@ -7775,26 +8515,13 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				await this.handleUnsubscribe(clientId, message.subscriptionId);
 				break;
 			case "join_channel":
-				this.joinChannel(clientId, payload?.channel);
-				break;
 			case "leave_channel":
-				this.leaveChannel(clientId, payload?.channel);
-				break;
 			case "broadcast":
-				this.broadcastToChannel(clientId, payload?.channel, payload?.event, payload?.payload);
-				break;
 			case "channel_history":
-				await this.handleChannelHistoryRequest(clientId, payload?.channel, payload?.sinceSeq, payload?.limit);
-				break;
 			case "presence_track":
-				this.joinChannel(clientId, payload?.channel);
-				this.trackPresence(clientId, payload?.channel, payload?.state ?? {});
-				break;
 			case "presence_untrack":
-				this.removePresence(clientId, payload?.channel);
-				break;
 			case "presence_state":
-				this.sendPresenceState(clientId, payload?.channel);
+				await this.handleChannelMessage(clientId, message.type, payload, authContext);
 				break;
 			default: this.sendError(clientId, "Unknown message type " + message.type, message.subscriptionId);
 		}
@@ -7809,30 +8536,40 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				this.sendError(clientId, msg, subscriptionId);
 				return;
 			}
-			const boundedLimit = resolveClientListLimit(request.limit, { vectorSearch: !!request.vectorSearch });
+			if (request.vectorSearch) {
+				const msg = "Realtime subscriptions do not support vector search: a subscription is re-run on every matching write, and nothing here computes distances. Use `.vectorSearch(...).find()` for the query, and subscribe without it if you need live updates.";
+				logger.warn(`[RealtimeService] ${msg}`);
+				this.sendError(clientId, msg, subscriptionId, "VECTOR_SEARCH_NOT_LIVE");
+				return;
+			}
+			let boundedLimit;
+			try {
+				boundedLimit = resolveClientListLimit(request.limit);
+			} catch (e) {
+				if (!(e instanceof ListLimitError)) throw e;
+				logger.warn(`[RealtimeService] Refused subscription to '${request.path}': ${e.message}`);
+				this.sendError(clientId, e.message, subscriptionId, "INVALID_LIMIT");
+				return;
+			}
 			this._subscriptions.set(subscriptionId, {
 				clientId,
 				type: "collection",
 				path: request.path,
 				collectionRequest: {
 					filter: request.filter,
+					logical: request.logical,
 					orderBy: request.orderBy,
 					order: request.order,
 					limit: boundedLimit,
+					offset: request.offset,
 					startAfter: request.startAfter,
 					databaseId: request.collection?.databaseId,
-					searchString: request.searchString
+					searchString: request.searchString,
+					searchExplain: request.searchExplain
 				},
 				authContext
 			});
-			const rows = await this.fetchCollectionWithAuth(request.path, {
-				filter: request.filter,
-				orderBy: request.orderBy,
-				order: request.order,
-				limit: boundedLimit,
-				startAfter: request.startAfter,
-				searchString: request.searchString
-			}, authContext);
+			const rows = await this.fetchCollectionWithAuth(request.path, this._subscriptions.get(subscriptionId).collectionRequest, authContext);
 			this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
@@ -8009,13 +8746,16 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				let fetchedEntities;
 				if (collectionRequest.searchString) fetchedEntities = await txEntityService.searchRows(notifyPath, collectionRequest.searchString, {
 					filter: collectionRequest.filter,
+					logical: collectionRequest.logical,
 					orderBy: collectionRequest.orderBy,
 					order: collectionRequest.order,
 					limit: collectionRequest.limit,
-					databaseId: collectionRequest.databaseId
+					databaseId: collectionRequest.databaseId,
+					searchExplain: collectionRequest.searchExplain
 				});
 				else fetchedEntities = await txEntityService.fetchCollection(notifyPath, {
 					filter: collectionRequest.filter,
+					logical: collectionRequest.logical,
 					orderBy: collectionRequest.orderBy,
 					order: collectionRequest.order,
 					limit: collectionRequest.limit,
@@ -8068,13 +8808,16 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		if (collectionRequest.searchString) return await this.dataService.searchRows(notifyPath, collectionRequest.searchString, {
 			filter: collectionRequest.filter,
+			logical: collectionRequest.logical,
 			orderBy: collectionRequest.orderBy,
 			order: collectionRequest.order,
 			limit: collectionRequest.limit,
-			databaseId: collectionRequest.databaseId
+			databaseId: collectionRequest.databaseId,
+			searchExplain: collectionRequest.searchExplain
 		});
 		return await this.dataService.fetchCollection(notifyPath, {
 			filter: collectionRequest.filter,
+			logical: collectionRequest.logical,
 			orderBy: collectionRequest.orderBy,
 			order: collectionRequest.order,
 			limit: collectionRequest.limit,
@@ -8258,12 +9001,148 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		return parentPaths;
 	}
+	/**
+	* Install a channel authorizer — see {@link ChannelAuthorizer}.
+	*
+	* Nothing in the framework calls this yet: it is the seam a rules API will
+	* be built on, kept deliberately separate from the membership floor so the
+	* floor holds whether or not anyone uses it.
+	*/
+	setChannelAuthorizer(authorizer) {
+		this.channelAuthorizer = authorizer;
+	}
+	/** Which action each channel frame is asking to perform. */
+	static CHANNEL_ACTIONS = {
+		join_channel: "join",
+		broadcast: "broadcast",
+		channel_history: "history",
+		presence_track: "join",
+		presence_state: "presence"
+	};
+	/**
+	* The one door every channel frame comes through.
+	*
+	* Returns synchronously — and so dispatches synchronously — unless an
+	* authorizer is installed. That matters: a client sends `join_channel`,
+	* `presence_state` and `channel_history` back to back on connect, and the
+	* socket's message handler processes each frame up to its first `await`,
+	* so a gate that always yielded would let the reads overtake the join that
+	* is about to authorize them.
+	*/
+	handleChannelMessage(clientId, type, payload, authContext) {
+		const channel = payload?.channel;
+		if (type === "leave_channel") {
+			this.leaveChannel(clientId, channel);
+			return;
+		}
+		if (type === "presence_untrack") {
+			this.removePresence(clientId, channel);
+			return;
+		}
+		const action = RealtimeService.CHANNEL_ACTIONS[type];
+		const allowed = this.authorizeChannelAction(clientId, channel, action, authContext);
+		if (allowed === false) return;
+		if (allowed === true) return this.dispatchChannelMessage(clientId, type, channel, payload);
+		return allowed.then((ok) => {
+			if (ok) return this.dispatchChannelMessage(clientId, type, channel, payload);
+		});
+	}
+	/** Perform an already-authorized channel frame. */
+	dispatchChannelMessage(clientId, type, channel, payload) {
+		switch (type) {
+			case "join_channel":
+				this.joinChannel(clientId, channel);
+				return;
+			case "broadcast":
+				this.broadcastToChannel(clientId, channel, payload?.event, payload?.payload);
+				return;
+			case "channel_history": return this.handleChannelHistoryRequest(clientId, channel, payload?.sinceSeq, payload?.limit);
+			case "presence_track":
+				this.joinChannel(clientId, channel);
+				this.trackPresence(clientId, channel, payload?.state ?? {});
+				return;
+			case "presence_state":
+				this.sendPresenceState(clientId, channel);
+				return;
+		}
+	}
+	/**
+	* Decide whether a client may perform an action on a channel.
+	*
+	* **Membership is the floor.** Reading a channel's presence roster, replaying
+	* its retained history and broadcasting into it all require that this client
+	* has joined it. That is a low bar — joining is open to anyone who can name
+	* the channel — but it is not the bar that was there before, which was none
+	* at all: `channel_history` and `presence_state` answered any socket about
+	* any channel, and a broadcast fanned out to members the sender had never
+	* joined. Two internal tables (`rebase.channel_presence`,
+	* `rebase.channel_messages`) are held outside RLS on the strength of this
+	* check, so it fails closed: an authorizer that throws refuses the frame.
+	*
+	* Anything richer than membership belongs in a {@link ChannelAuthorizer};
+	* this method is where it is consulted, and the only place.
+	*/
+	authorizeChannelAction(clientId, channel, action, authContext) {
+		if (action !== "join" && !this.channels.get(channel)?.has(clientId)) {
+			this.denyChannelAction(clientId, channel, action, "not a member of the channel");
+			return false;
+		}
+		const authorizer = this.channelAuthorizer;
+		if (!authorizer) return true;
+		let verdict;
+		try {
+			verdict = authorizer({
+				channel,
+				action,
+				clientId,
+				user: authContext
+			});
+		} catch (error) {
+			logger.error(`❌ [Channels] Authorizer threw for ${action} on "${channel}" — refusing`, { error });
+			this.denyChannelAction(clientId, channel, action, "channel authorization failed");
+			return false;
+		}
+		if (typeof verdict === "boolean") {
+			if (!verdict) this.denyChannelAction(clientId, channel, action, "refused by the channel authorizer");
+			return verdict;
+		}
+		return verdict.then((ok) => {
+			if (!ok) this.denyChannelAction(clientId, channel, action, "refused by the channel authorizer");
+			return ok;
+		}, (error) => {
+			logger.error(`❌ [Channels] Authorizer rejected for ${action} on "${channel}" — refusing`, { error });
+			this.denyChannelAction(clientId, channel, action, "channel authorization failed");
+			return false;
+		});
+	}
+	/** Tell the client why its channel frame went nowhere, and say so in the log. */
+	denyChannelAction(clientId, channel, action, reason) {
+		this.debugLog(`🚫 [Channels] Refused ${action} on "${channel}" for ${clientId}: ${reason}`);
+		this.sendError(clientId, `Refused ${action} on channel "${channel}": ${reason}`, void 0, "CHANNEL_FORBIDDEN");
+	}
 	/** Join a broadcast channel */
 	joinChannel(clientId, channel) {
 		if (!this.channels.has(channel)) this.channels.set(channel, /* @__PURE__ */ new Set());
 		this.channels.get(channel).add(clientId);
+		this.warnIfMemoryBusOnMultiplePods();
 		this.debugLog(`📡 [Broadcast] Client ${clientId} joined channel: ${channel}`);
 	}
+	/**
+	* Say something the first time channels are used on a deployment that is
+	* demonstrably multi-pod while the bus is still the in-memory default.
+	*
+	* Every other warning in this subsystem covers a *configured* bus failing —
+	* the case where the operator already knew a bus mattered. The common
+	* misconfiguration is the opposite one: scaled to two replicas, never
+	* touched `realtime.bus`, and broadcast and presence quietly serve a
+	* fraction of the room. The evidence is already in the process, so use it.
+	*/
+	warnIfMemoryBusOnMultiplePods() {
+		if (this.memoryBusWarned) return;
+		if (this.bus.kind !== "memory" || !this.foreignInstanceSeen) return;
+		this.memoryBusWarned = true;
+		logger.warn("⚠️ [ChannelBus] Channels are in use with the in-memory bus, but notifications from another instance have been seen — this deployment runs more than one process. Broadcast and presence reach only the clients connected to this one. Set `realtime.bus` (or REBASE_REALTIME_BUS=postgres) to make channels cross-instance.");
+	}
 	/** Leave a broadcast channel */
 	leaveChannel(clientId, channel) {
 		const members = this.channels.get(channel);
@@ -8941,6 +9820,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				try {
 					const { sid, p, eid, db } = JSON.parse(msg.payload);
 					if (sid === this.instanceId) return;
+					this.foreignInstanceSeen = true;
 					this.debugLog(`📡 [RealtimeService] Received cross-instance notification: path=${p}, id=${eid}, from=${sid}`);
 					let refetchedRow = null;
 					try {
@@ -9131,7 +10011,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-CD8o_1Sl.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-Bww-Lg0s.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -9203,6 +10083,54 @@ var quote = (xs) => Array.from(xs).map((s) => `\`${s}\``).join(", ");
 /** `on.from` / `on.to` accept a single column or a composite tuple. */
 var asColumns = (value) => Array.isArray(value) ? value : [value];
 /**
+* Distinguish "this column name is wrong" from "the generated schema is old".
+*
+* They present identically here — a relation asks for a column the registered
+* table does not have — but they are opposite problems with opposite fixes, and
+* getting them the wrong way round is how the 0.12 → 0.13 upgrade bricked
+* projects.
+*
+* The registered table is not the database. It comes from the project's
+* checked-in `backend/src/schema.generated.ts`, and 0.13 changed the rule that
+* derives foreign-key names: `categories` yields `category_id` where it used to
+* yield `categorie_id`. Boot-ensure renames the database column to match, so by
+* the time this runs the *database* is correct and the *generated module* is the
+* stale one. Reporting "not a column" then points at the wrong artifact, and the
+* generic fix — "set `through.targetColumn` to one of: …", listing the legacy
+* name because that is what the stale module still has — talks the reader into
+* pinning a column that no longer exists.
+*
+* So when the wanted name is what the current rule derives, and the table
+* carries what the *previous* rule would have derived from the same source, say
+* that instead.
+*
+* @param wanted   the column the relation asks for
+* @param available every column the registered table has
+* @param sources  names the default could have been derived from (a slug, a
+*                 relation name) — checking against these rather than guessing
+*                 backwards from `wanted` keeps the match exact
+*/
+function staleCodegenRename(wanted, available, sources) {
+	for (const source of sources) {
+		if (!source) continue;
+		const current = generateForeignKeyName(source);
+		const legacy = legacyForeignKeyName(source);
+		if (current !== wanted || legacy === current) continue;
+		if (available.has(legacy) && !available.has(current)) return {
+			legacy,
+			current
+		};
+	}
+	return null;
+}
+/** The shared explanation, so every relation kind reports it identically. */
+function staleCodegenDefect(table, { legacy, current }) {
+	return {
+		problem: `the generated Drizzle schema still declares \`${legacy}\` on \`${table}\`, but this release derives \`${current}\` — the generated schema predates the foreign-key naming fix and no longer describes the database`,
+		fix: `regenerate it with \`rebase schema generate\` (or \`pnpm run schema:generate\`). The database column has already been renamed for you at boot, so nothing else is needed. To keep \`${legacy}\` instead, name it explicitly on the relation and regenerate.`
+	};
+}
+/**
 * Relations whose names do not resolve against the registered schema.
 *
 * Fails open wherever it cannot see enough to be sure — an unregistered source
@@ -9249,19 +10177,31 @@ function findRelationDefects(collections, registry) {
 			const targetColumns = columnNames(targetTable);
 			switch (relation.kind) {
 				case "belongsTo":
-					if (!sourceColumns.has(relation.localKey)) defects.push({
-						...at,
-						problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
-						fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
-					});
+					if (!sourceColumns.has(relation.localKey)) {
+						const stale = staleCodegenRename(relation.localKey, sourceColumns, [relation.relationName, targetCollection.slug]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(sourceTableName, stale)
+						} : {
+							...at,
+							problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
+							fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
+						});
+					}
 					break;
 				case "hasOne":
 				case "hasMany":
-					if (!targetColumns.has(relation.foreignKeyOnTarget)) defects.push({
-						...at,
-						problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
-						fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
-					});
+					if (!targetColumns.has(relation.foreignKeyOnTarget)) {
+						const stale = staleCodegenRename(relation.foreignKeyOnTarget, targetColumns, [collection.slug]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(targetTableName, stale)
+						} : {
+							...at,
+							problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
+							fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
+						});
+					}
 					if (relation.sourceKey && !sourceColumns.has(relation.sourceKey)) defects.push({
 						...at,
 						problem: `\`sourceKey: "${relation.sourceKey}"\` is not a column on \`${sourceTableName}\``,
@@ -9280,11 +10220,21 @@ function findRelationDefects(collections, registry) {
 						break;
 					}
 					const junctionColumns = columnNames(junction);
-					for (const [label, column] of [["sourceColumn", sourceColumn], ["targetColumn", targetColumn]]) if (!junctionColumns.has(column)) defects.push({
-						...at,
-						problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
-						fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
-					});
+					const derivedFrom = {
+						sourceColumn: [collection.slug],
+						targetColumn: [targetCollection.slug]
+					};
+					for (const [label, column] of [["sourceColumn", sourceColumn], ["targetColumn", targetColumn]]) if (!junctionColumns.has(column)) {
+						const stale = staleCodegenRename(column, junctionColumns, [...derivedFrom[label]]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(table, stale)
+						} : {
+							...at,
+							problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
+							fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
+						});
+					}
 					break;
 				}
 				case "via": {
@@ -9356,7 +10306,16 @@ function assertRelationsResolve(collections, registry) {
 	const defects = findRelationDefects(collections, registry);
 	if (defects.length === 0) return;
 	const lines = defects.map((d) => `  • ${d.collection}.${d.relationName} (${d.kind})\n      ${d.problem}\n      fix: ${d.fix}`);
-	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against the database schema.\n\nEach of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
+	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against \`backend/src/schema.generated.ts\`.
+
+Each of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
+
+If the database was migrated recently — an upgrade, a \`db push\`, a restore — this file is
+probably older than the schema it describes. Regenerate it before changing anything else:
+
+    rebase schema generate
+
+If it is already current, then the collection is what disagrees with it:
 
 ` + lines.join("\n\n") + "\n");
 }
@@ -9567,7 +10526,7 @@ async function ensureAuthTablesExist(db, collection) {
 			if (idProp) {
 				const isId = "isId" in idProp ? idProp.isId : void 0;
 				if (isId === "uuid") userIdType = "UUID";
-				else if (isId === "autoincrement") userIdType = "INTEGER";
+				else if (isId === "increment") userIdType = "INTEGER";
 			}
 		}
 		try {
@@ -9600,43 +10559,42 @@ async function ensureAuthTablesExist(db, collection) {
 		const emailLengthConstraint = `"${authIdentifier("email_length_check")}"`;
 		const emailLowerUniqueIndex = authIdentifier("email_lower_key");
 		const verificationTokenIndex = authIdentifier("email_verification_token_idx");
+		const usersColumnDdl = AUTH_USERS_COLUMNS.map((spec) => spec.column === "email" ? `${spec.column} ${authUsersColumnSql(spec)} CONSTRAINT ${emailLengthConstraint} CHECK (length(email) <= 320)` : `${spec.column} ${authUsersColumnSql(spec)}`).join(",\n                ");
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(usersTableName)} (
                 id ${sql.raw(userIdType)} PRIMARY KEY ${sql.raw(idDefault)},
-                email TEXT NOT NULL CONSTRAINT ${sql.raw(emailLengthConstraint)} CHECK (length(email) <= 320),
-                display_name TEXT,
-                photo_url TEXT,
-                roles TEXT[] DEFAULT '{}' NOT NULL,
-                password_hash TEXT,
-                email_verified BOOLEAN DEFAULT FALSE NOT NULL,
-                email_verification_token TEXT,
-                email_verification_sent_at TIMESTAMP WITH TIME ZONE,
-                is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
-                metadata JSONB DEFAULT '{}' NOT NULL,
-                tokens_valid_after TIMESTAMP WITH TIME ZONE,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
-                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
+                ${sql.raw(usersColumnDdl)}
             )
         `);
-		await db.execute(sql`
-            CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
-            BEGIN
-                IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
-                    NEW.uid := NEW.user_id;
-                ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
-                    NEW.user_id := NEW.uid;
-                END IF;
-                RETURN NEW;
-            END $$ LANGUAGE plpgsql
-        `);
-		for (const authTable of [
+		const legacyFkTables = [
 			"user_identities",
 			"refresh_tokens",
 			"password_reset_tokens",
 			"magic_link_tokens",
 			"mfa_factors",
 			"recovery_codes"
-		]) {
+		];
+		const legacyFkTableList = legacyFkTables.map((t) => `'${t}'`).join(", ");
+		const legacyUserIdPresent = await db.execute(sql`
+            SELECT 1
+            FROM information_schema.columns
+            WHERE table_schema = ${authSchema}
+              AND table_name IN (${sql.raw(legacyFkTableList)})
+              AND column_name = 'user_id'
+            LIMIT 1
+        `);
+		if (legacyUserIdPresent.rows.length > 0) await db.execute(sql`
+                CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
+                BEGIN
+                    IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
+                        NEW.uid := NEW.user_id;
+                    ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
+                        NEW.user_id := NEW.uid;
+                    END IF;
+                    RETURN NEW;
+                END $$ LANGUAGE plpgsql
+            `);
+		for (const authTable of legacyUserIdPresent.rows.length > 0 ? legacyFkTables : []) {
 			const qualified = `"${authSchema}"."${authTable}"`;
 			await db.execute(sql`
                 DO $$
@@ -9757,54 +10715,50 @@ async function ensureAuthTablesExist(db, collection) {
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
         `);
-		await db.execute(sql`CREATE SCHEMA IF NOT EXISTS auth`);
 		await db.transaction(async (tx) => {
 			await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$
-                    SELECT COALESCE(
-                        NULLIF(current_setting('app.uid', true), ''),
-                        NULLIF(current_setting('app.user_id', true), '')
-                    );
-                $$ LANGUAGE sql STABLE
-            `);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb AS $$
-                    SELECT COALESCE(
-                        NULLIF(current_setting('app.jwt', true), ''),
-                        '{}'
-                    )::jsonb;
-                $$ LANGUAGE sql STABLE
-            `);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.roles() RETURNS text AS $$
-                    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');
-                $$ LANGUAGE sql STABLE
-            `);
+			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await tx.execute(sql.raw(statement));
 		});
-		for (const columnDef of [
-			"display_name TEXT",
-			"photo_url TEXT",
-			"roles TEXT[] DEFAULT '{}' NOT NULL",
-			"password_hash TEXT",
-			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
-			"email_verification_token TEXT",
-			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
-			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
-			"metadata JSONB DEFAULT '{}' NOT NULL",
-			"tokens_valid_after TIMESTAMP WITH TIME ZONE",
-			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
-			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
-		]) await db.execute(sql`
+		for (const spec of AUTH_USERS_COLUMNS) {
+			if (spec.column === "email") continue;
+			await db.execute(sql`
                 ALTER TABLE ${sql.raw(usersTableName)}
-                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(`${spec.column} ${authUsersColumnSql(spec)}`)}
             `);
-		const usersColumns = await db.execute(sql`
-            SELECT column_name, data_type
+		}
+		const usersColumnRows = (await db.execute(sql`
+            SELECT column_name, data_type, is_nullable, column_default
             FROM information_schema.columns
             WHERE table_schema = ${usersSchema} AND table_name = ${resolvedTable}
-        `);
-		const usersColumnTypes = new Map(usersColumns.rows.map((row) => [row.column_name, row.data_type]));
+        `)).rows;
+		const usersColumnTypes = new Map(usersColumnRows.map((row) => [row.column_name, row.data_type]));
+		const usersColumnState = new Map(usersColumnRows.map((row) => [row.column_name, row]));
+		for (const spec of AUTH_USERS_COLUMNS) {
+			const state = usersColumnState.get(spec.column);
+			if (!state) continue;
+			if (spec.default !== void 0 && state.column_default === null) {
+				await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET DEFAULT ${sql.raw(spec.default)}
+                `);
+				logger.info(`🔧 Restored the default on ${usersTableName}.${spec.column}`);
+			}
+			if (!spec.notNull || state.is_nullable !== "YES") continue;
+			if (spec.default !== void 0) await db.execute(sql`
+                    UPDATE ${sql.raw(usersTableName)}
+                    SET ${sql.raw(`"${spec.column}"`)} = ${sql.raw(spec.default)}
+                    WHERE ${sql.raw(`"${spec.column}"`)} IS NULL
+                `);
+			try {
+				await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET NOT NULL
+                `);
+				logger.info(`🔧 Restored NOT NULL on ${usersTableName}.${spec.column}`);
+			} catch (err) {
+				logger.warn(`⚠️ ${usersTableName}.${spec.column} should be NOT NULL but still holds NULLs, so the constraint was not applied. Fill or remove those rows and restart: ` + (err instanceof Error ? err.message : String(err)));
+			}
+		}
 		for (const column of [
 			"email",
 			"display_name",
@@ -9883,6 +10837,7 @@ async function ensureAuthTablesExist(db, collection) {
 					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);
 					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);
 					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS aal TEXT`);
 					await db.execute(sql`
                         UPDATE ${sql.raw(qualified)}
                         SET session_id = gen_random_uuid()::text
@@ -9945,6 +10900,7 @@ async function ensureAuthTablesExist(db, collection) {
                 secret_encrypted TEXT NOT NULL,
                 friendly_name TEXT,
                 verified BOOLEAN DEFAULT FALSE,
+                last_used_counter BIGINT,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
@@ -9960,6 +10916,7 @@ async function ensureAuthTablesExist(db, collection) {
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
                 verified_at TIMESTAMP WITH TIME ZONE,
                 ip_address TEXT,
+                attempts INTEGER NOT NULL DEFAULT 0,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL
             )
         `);
@@ -9967,6 +10924,12 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE INDEX IF NOT EXISTS idx_mfa_challenges_factor
             ON ${sql.raw(mfaChallengesTableName)}(factor_id)
         `);
+		try {
+			await db.execute(sql`ALTER TABLE ${sql.raw(mfaFactorsTableName)} ADD COLUMN IF NOT EXISTS last_used_counter BIGINT`);
+			await db.execute(sql`ALTER TABLE ${sql.raw(mfaChallengesTableName)} ADD COLUMN IF NOT EXISTS attempts INTEGER NOT NULL DEFAULT 0`);
+		} catch (mfaMigrationError) {
+			logger.warn(`⚠️  MFA hardening columns skipped: ${mfaMigrationError instanceof Error ? mfaMigrationError.message : String(mfaMigrationError)}`);
+		}
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(recoveryCodesTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
@@ -9986,10 +10949,12 @@ async function ensureAuthTablesExist(db, collection) {
 				[authSchema, "user_identities"],
 				[authSchema, "refresh_tokens"],
 				[authSchema, "password_reset_tokens"],
+				[authSchema, "magic_link_tokens"],
 				[authSchema, "app_config"],
 				[authSchema, "mfa_factors"],
 				[authSchema, "mfa_challenges"],
-				[authSchema, "recovery_codes"]
+				[authSchema, "recovery_codes"],
+				[authSchema, "schema_meta"]
 			];
 			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
                     SELECT 1
@@ -10009,6 +10974,9 @@ async function ensureAuthTablesExist(db, collection) {
 			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
 		}
 		await stampAuthSchemaVersion(db, authSchema);
+		await revokeInternalTableAccess(async (text) => {
+			await db.execute(sql.raw(text));
+		}, authSchema, { onError: (table, err) => logger.warn(`🔐 Could not revoke authenticated-role access to "${authSchema}"."${table}": ` + (err instanceof Error ? err.message : String(err))) });
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
 		if (error instanceof AuthSchemaVersionError) throw error;
@@ -10282,7 +11250,7 @@ var UserService = class {
 		const conditions = [];
 		if (roleId) conditions.push(sql`${roleId} = ANY(${sql.raw(usersTableName)}.roles)`);
 		if (search) {
-			const pattern = `%${search}%`;
+			const pattern = `%${escapeLikePattern(search)}%`;
 			conditions.push(sql`(${sql.raw(usersTableName)}.${sql.raw(emailColumn)} ILIKE ${pattern} OR ${sql.raw(usersTableName)}.${sql.raw(displayNameColumn)} ILIKE ${pattern})`);
 		}
 		const whereClause = conditions.length > 0 ? sql`WHERE ${sql.join(conditions, sql` AND `)}` : sql``;
@@ -10458,7 +11426,8 @@ var RefreshTokenService = class {
 			"sessionId",
 			"rotatedAt",
 			"revoked",
-			"sessionStartedAt"
+			"sessionStartedAt",
+			"aal"
 		]) if (this.has(optional)) selection[optional] = this.col(optional);
 		return selection;
 	}
@@ -10472,6 +11441,7 @@ var RefreshTokenService = class {
 		};
 		if (session && this.has("sessionId")) values.sessionId = session.id;
 		if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
+		if (session?.aal && this.has("aal")) values.aal = session.aal;
 		await this.db.insert(this.refreshTokensTable).values(values);
 	}
 	async findByHash(tokenHash) {
@@ -10976,6 +11946,12 @@ var PostgresAuthRepository = class {
 	async hasVerifiedMfaFactors(uid) {
 		return this.getMfaService().hasVerifiedMfaFactors(uid);
 	}
+	async claimMfaFactorCounter(factorId, counter) {
+		return this.getMfaService().claimMfaFactorCounter(factorId, counter);
+	}
+	async recordMfaChallengeAttempt(challengeId) {
+		return this.getMfaService().recordMfaChallengeAttempt(challengeId);
+	}
 };
 /**
 * PostgreSQL implementation of MfaRepository.
@@ -11028,7 +12004,7 @@ var MfaService = class {
 	async getMfaFactorById(factorId) {
 		const tableName = this.qualify("mfa_factors");
 		const result = await this.db.execute(sql`
-            SELECT id, uid, factor_type, secret_encrypted, friendly_name, verified, created_at, updated_at
+            SELECT id, uid, factor_type, secret_encrypted, friendly_name, verified, last_used_counter, created_at, updated_at
             FROM ${sql.raw(tableName)}
             WHERE id = ${factorId}
         `);
@@ -11041,10 +12017,29 @@ var MfaService = class {
 			secretEncrypted: row.secret_encrypted,
 			friendlyName: row.friendly_name ?? void 0,
 			verified: row.verified,
+			lastUsedCounter: row.last_used_counter === null || row.last_used_counter === void 0 ? null : Number(row.last_used_counter),
 			createdAt: new Date(row.created_at),
 			updatedAt: new Date(row.updated_at)
 		};
 	}
+	/**
+	* Spend a TOTP time step, once and only once.
+	*
+	* One statement: the `WHERE` is the check, the `UPDATE` is the act, and
+	* `RETURNING` reports which of two concurrent requests carrying the same
+	* six digits won. Reading the counter and then writing it would let both
+	* pass — the exact replay this closes.
+	*/
+	async claimMfaFactorCounter(factorId, counter) {
+		const tableName = this.qualify("mfa_factors");
+		return (await this.db.execute(sql`
+            UPDATE ${sql.raw(tableName)}
+            SET last_used_counter = ${counter}, updated_at = NOW()
+            WHERE id = ${factorId}
+              AND (last_used_counter IS NULL OR last_used_counter < ${counter})
+            RETURNING id
+        `)).rows.length > 0;
+	}
 	async verifyMfaFactor(factorId) {
 		const tableName = this.qualify("mfa_factors");
 		await this.db.execute(sql`
@@ -11079,7 +12074,7 @@ var MfaService = class {
 	async getMfaChallengeById(challengeId) {
 		const tableName = this.qualify("mfa_challenges");
 		const result = await this.db.execute(sql`
-            SELECT id, factor_id, created_at, verified_at, ip_address, expires_at
+            SELECT id, factor_id, created_at, verified_at, ip_address, attempts, expires_at
             FROM ${sql.raw(tableName)}
             WHERE id = ${challengeId} AND expires_at > NOW() AND verified_at IS NULL
         `);
@@ -11090,9 +12085,28 @@ var MfaService = class {
 			factorId: row.factor_id,
 			createdAt: new Date(row.created_at),
 			verifiedAt: row.verified_at ? new Date(row.verified_at) : void 0,
-			ipAddress: row.ip_address ?? void 0
+			ipAddress: row.ip_address ?? void 0,
+			attempts: Number(row.attempts ?? 0)
 		};
 	}
+	/**
+	* Count one failed guess against a challenge and report the new total.
+	*
+	* Incremented in the database rather than in the route so that guesses
+	* arriving in parallel — the shape any real brute-force takes — cannot
+	* share a single increment.
+	*/
+	async recordMfaChallengeAttempt(challengeId) {
+		const tableName = this.qualify("mfa_challenges");
+		const result = await this.db.execute(sql`
+            UPDATE ${sql.raw(tableName)}
+            SET attempts = attempts + 1
+            WHERE id = ${challengeId}
+            RETURNING attempts
+        `);
+		if (result.rows.length === 0) return 0;
+		return Number(result.rows[0].attempts);
+	}
 	async verifyMfaChallenge(challengeId) {
 		const tableName = this.qualify("mfa_challenges");
 		await this.db.execute(sql`
@@ -11337,6 +12351,7 @@ async function ensureHistoryTableExists(db) {
             CREATE INDEX IF NOT EXISTS idx_history_time
             ON rebase.entity_history(table_name, entity_id, updated_at DESC)
         `);
+		await db.execute(sql.raw(revokeInternalTableSql("rebase", "entity_history")));
 		logger.info("✅ Entity history table ready");
 	} catch (error) {
 		logger.error("❌ Failed to create row history table", { error });
@@ -12058,12 +13073,12 @@ function createPostgresBootstrapper(pgConfig) {
 				const runSql = async (text) => {
 					return (await schemaAwareDb.execute(sql.raw(text))).rows ?? [];
 				};
+				await warnOnRoleSchemaCollision(runSql);
 				const posture = await detectConnectionPosture(runSql);
 				if (posture.privileged) {
 					await ensureAppRole(runSql, [
 						"public",
 						"rebase",
-						"auth",
 						...registry.getCollections().map((c) => c.schema).filter((s) => typeof s === "string")
 					]);
 					driver.rlsUserRole = REBASE_USER_ROLE;
@@ -12073,6 +13088,7 @@ function createPostgresBootstrapper(pgConfig) {
 				} else logger.info(`🔐 RLS enforcement: connection role "${posture.role}" is subject to RLS natively; no role switch needed.`);
 				await validatePolicyPgRoles(runSql, registry.getCollections(), driver.rlsUserRole ?? posture.role);
 				warnOnAnonymousGrants(registry.getCollections());
+				warnOnLegacyRlsFunctions(registry.getCollections());
 			}
 			if (driver.branchService) try {
 				await driver.branchService.ensureBranchMetadataTable();
@@ -12288,12 +13304,12 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CBQdOETu.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-DzeTEvMv.js");
 			const plan = await ensureCollectionTables({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
 			} }, collections, log);
-			for (const failure of plan.failures) logger.warn(`🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
+			for (const failure of plan.failures) logger.warn(failure.kind === "comment-column" ? `🔍 [schema] Could not record the search fingerprint on "${failure.target}" — search works, but a later change to the \`search\` block will not be detected: ${failure.error}` : `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
 			return { applied: plan.actions.length - plan.failures.length };
 		},
 		/**
@@ -12313,13 +13329,24 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-ViG8XiPn.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-B_JMGa5K.js");
 			const outcome = await ensureCollectionPolicies({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
 			} }, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
 			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — it stays locked (denies) until this is resolved: ${failure.error}`);
+			try {
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-Bpv3nUZo.js").then((n) => n.n);
+				await dropLegacyAuthSchema(async (text) => {
+					return (await internals.db.execute(sql.raw(text))).rows ?? [];
+				}, {
+					info: (m) => logger.info(m),
+					warn: (m) => logger.warn(m)
+				});
+			} catch (err) {
+				logger.info("Left the legacy `auth` schema in place: " + (err instanceof Error ? err.message : String(err)));
+			}
 			return { applied: outcome.policiesApplied };
 		},
 		getAdmin(driverResult) {
@@ -12327,7 +13354,7 @@ function createPostgresBootstrapper(pgConfig) {
 		},
 		mountRoutes(app, basePath, driverResult) {},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			const { createPostgresWebSocket } = await import("./websocket-B2LsrINK.js").then((n) => n.n);
+			const { createPostgresWebSocket } = await import("./websocket-D1qbmLZ2.js").then((n) => n.n);
 			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
 		}
 	};
@@ -12367,6 +13394,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, frameByteLength, generateSchema, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map