@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g18cfeb7

package/dist/index.es.js

@@ -2,11 +2,12 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
-import { A as toSnakeCase, C as normalizeToEntityRelation, D as getPolicyNamesForRule, F as Vector, N as hasForeignKeyOnTarget, O as mergeDeep, P as isManyToMany, S as createRelationRefWithData, T as generateForeignKeyName, _ as buildCompositeId, a as getJunctionSecurityRules, b as parseIdValues, c as policyToPostgres, d as findRelation, f as getColumnName, g as resolveCollectionRelations, h as getTableVarName, i as getJunctionCollectionConfig, k as camelCase, l as securityRuleToConditions, m as getTableName$1, n as CollectionRegistry, o as resolveJunctionSpecs, p as getEnumVarName, r as resolveStringColumnLength, s as getEffectiveSecurityRules, t as buildSdkData, u as findAnonymousGrants, v as getDeclaredPrimaryKeys, w as updateDateAutoValues, x as createRelationRef, y as isAddressableId } from "./src-DlPBctw_.js";
-import { n as isPostgresCollectionConfig, r as isRelationalCollectionConfig } from "./src-DoU9yPqq.js";
-import { t as ANONYMOUS_USER_ID } from "./policy-CeA1JcxP.js";
-import { t as createPostgresWebSocket } from "./websocket-B2LsrINK.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-CD8o_1Sl.js";
+import { A as generateForeignKeyName, B as hasForeignKeyOnTarget, C as getDeclaredPrimaryKeys, D as createRelationRefWithData, E as createRelationRef, F as camelCase, H as Vector, I as toSnakeCase, M as getPolicyNamesForRule, N as isPrototypePollutingKey, O as normalizeToEntityRelation, P as mergeDeep, S as buildCompositeId, T as parseIdValues, V as isManyToMany, _ as getColumnName, a as buildSdkData, b as getTableVarName, c as resolveStringColumnLength, d as resolveJunctionSpecs, f as getEffectiveSecurityRules, g as findRelation, h as findAnonymousGrants, j as legacyForeignKeyName, k as updateDateAutoValues, l as getJunctionCollectionConfig, m as securityRuleToConditions, o as CollectionRegistry, p as policyToPostgres, r as authUsersColumnSql, s as relationalCollections, t as AUTH_USERS_COLUMNS, u as getJunctionSecurityRules, v as getEnumVarName, w as isAddressableId, x as resolveCollectionRelations, y as getTableName$1, z as resolveClientListLimit } from "./auth-users-columns-Do9mw5Y5.js";
+import { c as isPostgresCollectionConfig, l as isRelationalCollectionConfig, n as REBASE_SCHEMA, o as usesLegacyRlsFunctions } from "./src-C_wvdMnl.js";
+import { t as ANONYMOUS_USER_ID } from "./policy-CPkCqVTz.js";
+import { t as createPostgresWebSocket } from "./websocket-D0TBU3ia.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-Bww-Lg0s.js";
+import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-Bpv3nUZo.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
@@ -30,25 +31,6 @@ import { randomUUID } from "crypto";
 function isChannelBusInstance(setting) {
 	return typeof setting?.publish === "function";
 }
-/**
-* Resolve a client-supplied list `limit` into a safe, always-defined value.
-*
-* - A provided limit is coerced to an integer and clamped to `[1, maxLimit]`,
-*   so `0`, negatives, and absurd values can never bypass the cap.
-* - An absent / blank / non-numeric limit falls back to the mode default:
-*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
-*
-* The return is never `undefined` — no ingress that routes its client limit
-* through this can produce an unbounded read.
-*/
-function resolveClientListLimit(rawLimit, opts = {}) {
-	const maxLimit = opts.maxLimit ?? 1e3;
-	if (rawLimit != null && String(rawLimit).trim() !== "") {
-		const parsed = typeof rawLimit === "number" ? rawLimit : parseInt(String(rawLimit), 10);
-		if (Number.isFinite(parsed)) return Math.min(Math.max(1, Math.floor(parsed)), maxLimit);
-	}
-	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
-}
 //#endregion
 //#region ../common/src/util/email.ts
 /**
@@ -152,6 +134,142 @@ var buildPropertyCallbacks = (properties) => {
 	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
 };
 //#endregion
+//#region ../common/src/util/internal-tables.ts
+/**
+* The tables Rebase creates for its own bookkeeping, and the SQL that keeps the
+* end-user role away from them.
+*
+* ## Why this exists
+*
+* Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role
+* provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table
+* in the schemas a project uses — including `rebase`, because a project's own
+* collections are allowed to live there (the scaffold puts `users` there). It
+* also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the
+* migrating role inherits the same grant.
+*
+* Every framework-internal table is created later: auth's tables come up during
+* `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first
+* job registers, `idempotency_keys` on the first request that carries a key. So
+* they all inherited full DML for the end-user role — and none of them enables
+* row-level security, because none of them is a collection with
+* `securityRules`. Measured on a freshly provisioned database, `SET ROLE
+* rebase_user` could read `rebase.refresh_tokens` (session token hashes),
+* `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and
+* `rebase.api_keys` (including its `admin` flag), and insert into
+* `rebase.app_config`.
+*
+* Nothing routes a user-context query at those tables today, so this was not
+* reachable over the API. That is the wrong thing to depend on: the documented
+* model is that RLS is the authorization boundary, and these tables sat outside
+* it. The boundary is now a privilege boundary instead — the role simply cannot
+* address them.
+*
+* ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY
+*
+* RLS with no policy denies every row, which is the same outcome, but it is the
+* *weaker* statement: it leaves the grant in place, so a later policy — or a
+* `FORCE` flag cleared by some future migration — reopens the table. There is no
+* row of `refresh_tokens` any end user should ever reach, so the honest encoding
+* is "this role has no privilege here at all". It also keeps the owner
+* connection (which auth actually runs on) completely unaffected.
+*
+* ## Keeping it true
+*
+* `packages/rls-check` scans the `rebase` schema — it used to skip it as a
+* "platform" schema — and its `rls-disabled` check fires on exactly the
+* condition this module removes: RLS off *and* a DML grant to a reachable role.
+* So a table added here without a revoke is caught by `pnpm rls:check`, not by
+* someone re-reading this file.
+*/
+/**
+* The Postgres role authenticated requests run as.
+*
+* Defined here rather than in the Postgres driver because both the driver (which
+* provisions the role) and this module (which revokes on its behalf) need it,
+* and a second spelling of a role name is a silent no-op waiting to happen.
+*/
+var REBASE_USER_ROLE = "rebase_user";
+/**
+* Framework-internal table names, unqualified.
+*
+* Deliberately NOT including `users`: the auth user table is also a collection,
+* with `securityRules`, RLS enabled and policies applied. Users read their own
+* row through it — revoking there would break sign-in.
+*
+* `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`
+* because `db migrate apply` passes `--revisions-schema rebase`.
+*/
+var REBASE_INTERNAL_TABLES = [
+	"user_identities",
+	"refresh_tokens",
+	"password_reset_tokens",
+	"magic_link_tokens",
+	"mfa_factors",
+	"mfa_challenges",
+	"recovery_codes",
+	"app_config",
+	"schema_meta",
+	"api_keys",
+	"cron_logs",
+	"cron_claims",
+	"idempotency_keys",
+	"entity_history",
+	"branches",
+	"channel_messages",
+	"channel_cursors",
+	"channel_presence",
+	"atlas_schema_revisions"
+];
+/** Postgres identifiers this module is willing to interpolate. */
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+/**
+* A single statement that takes every privilege on `schema.table` away from the
+* end-user role.
+*
+* Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which
+* happen in practice:
+*
+*  - the role does not exist when the connection is unprivileged (Rebase then
+*    relies on native RLS rather than a role switch), and a bare `REVOKE` on a
+*    missing role is an error, not a no-op;
+*  - the table may not exist yet — `cron_logs` never appears in a project with
+*    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.
+*
+* One command, so it is safe on handles that speak the extended query protocol
+* and reject multi-statement strings.
+*/
+function revokeInternalTableSql(schema, table) {
+	if (!SAFE_IDENTIFIER.test(schema)) throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);
+	if (!SAFE_IDENTIFIER.test(table)) throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);
+	const qualified = `"${schema}"."${table}"`;
+	return `
+        DO $rebase_revoke$
+        BEGIN
+            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')
+               AND to_regclass('${qualified}') IS NOT NULL THEN
+                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';
+            END IF;
+        END
+        $rebase_revoke$;
+    `.trim();
+}
+/**
+* Revoke on every internal table in `schema`, one statement at a time.
+*
+* Best-effort per table: a connection that does not own one of them (a
+* pre-provisioned database, a platform-managed ledger) cannot revoke on it, and
+* that must not take down a boot. The caller decides how loud to be — `onError`
+* exists so the driver can warn without this module importing a logger.
+*/
+async function revokeInternalTableAccess(execute, schema, options) {
+	for (const table of options?.tables ?? REBASE_INTERNAL_TABLES) try {
+		await execute(revokeInternalTableSql(schema, table));
+	} catch (error) {
+		options?.onError?.(table, error);
+	}
+}
+//#endregion
 //#region ../common/src/table-classification.ts
 /** Schemas that are always considered Rebase-internal. */
 var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
@@ -1276,7 +1394,11 @@ function sanitizeAndConvertDates(obj) {
 	if (obj instanceof Date) return obj.toISOString();
 	if (typeof obj === "object") {
 		const newObj = {};
-		for (const key in obj) if (Object.prototype.hasOwnProperty.call(obj, key)) newObj[key] = sanitizeAndConvertDates(obj[key]);
+		for (const key in obj) {
+			if (!Object.prototype.hasOwnProperty.call(obj, key)) continue;
+			if (isPrototypePollutingKey(key)) continue;
+			newObj[key] = sanitizeAndConvertDates(obj[key]);
+		}
 		return newObj;
 	}
 	if (typeof obj === "string") {
@@ -1305,6 +1427,7 @@ function serializeDataToServer(row, properties, collection, registry) {
 		if (relation.kind === "belongsTo") foreignKeys.add(relation.localKey);
 	});
 	for (const [key, value] of Object.entries(row)) {
+		if (isPrototypePollutingKey(key)) continue;
 		const property = properties[key];
 		const effectiveValue = foreignKeys.has(key) && value === "" ? null : value;
 		if (!property) {
@@ -3796,51 +3919,6 @@ var FetchService = class {
 		return !!this.getQueryBuilder(tableName);
 	}
 	/**
-	* Attempt to use Drizzle's relational query API (db.query.<table>.findMany)
-	* for efficient JOIN-based relation loading.
-	* Returns null if the API is not available or the query fails.
-	* Note: Primary path now uses `buildWithConfig` + `buildDrizzleQueryOptions`.
-	*/
-	async fetchWithDrizzleQuery(collectionPath, collection, options, include, idInfo, idInfoArray) {
-		try {
-			const table = getTableForCollection(collection, this.registry);
-			const tableName = getTableName(table);
-			const queryTarget = this.getQueryBuilder(tableName);
-			if (!queryTarget?.findMany) return null;
-			const resolvedRelations = resolveCollectionRelations(collection);
-			const withConfig = {};
-			for (const [key, relation] of Object.entries(resolvedRelations)) if (include[0] === "*" || include.includes(key)) {
-				const drizzleRelName = relation.relationName || key;
-				withConfig[drizzleRelName] = true;
-			}
-			const queryOpts = { with: withConfig };
-			if (options.limit) queryOpts.limit = options.limit;
-			if (options.filter) {
-				const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
-				if (filterConditions.length > 0) queryOpts.where = and(...filterConditions);
-			}
-			if (options.orderBy) {
-				const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
-				if (orderByField) queryOpts.orderBy = options.order === "asc" ? asc(orderByField) : desc(orderByField);
-			}
-			return (await queryTarget.findMany(queryOpts)).map((row) => {
-				const flat = {};
-				for (const [k, v] of Object.entries(row)) if (Array.isArray(v)) flat[k] = v.map((item) => {
-					const keys = Object.keys(item);
-					const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-					if (nestedObj && keys.length <= 3) return { ...item[nestedObj] };
-					return { ...item };
-				});
-				else if (typeof v === "object" && v !== null) flat[k] = { ...v };
-				else flat[k] = v;
-				return flat;
-			});
-		} catch (e) {
-			logger.warn(`[include] Drizzle relational query failed for '${collectionPath}', falling back`, { error: e });
-			return null;
-		}
-	}
-	/**
 	* Fallback path used when db.query is unavailable.
 	* The primary path uses db.query.findMany with `with` config, which
 	* loads all relations in a single query.
@@ -4091,7 +4169,8 @@ var PersistService = class {
 		if (error instanceof ApiError || error?.name === "ApiError") return error;
 		const pgError = extractPgError(error);
 		if (pgError) {
-			const { message } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+			const { message, code } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`) : ApiError.badRequest(message, `PG_${code}`);
 			return new Error(message);
 		}
 		const causeMessage = extractCauseMessage(error);
@@ -4316,6 +4395,7 @@ var BranchService = class {
                 metadata     JSONB DEFAULT '{}'
             );
         `));
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "branches")));
 	}
 	/**
 	* Create a new branch database by templating the source database.
@@ -4423,43 +4503,49 @@ var BranchService = class {
 };
 //#endregion
 //#region src/security/rls-enforcement.ts
+var quoteIdent$1 = (name) => `"${name.replace(/"/g, "\"\"")}"`;
+/** DML the user role holds on managed tables (RLS still filters per row). */
+var USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
 /**
-* Unified RLS enforcement — the "user context vs server context" model.
-*
-* Every operation runs in one of two contexts:
+* Warn when the connection role shares its name with an existing schema.
 *
-*  - **User context** — a request authenticated (or anonymous) via
-*    `driver.withAuth(user)`. Runs as the restricted `rebase_user` role: a
-*    non-owner, NOSUPERUSER, NOBYPASSRLS role, so Postgres RLS binds *every*
-*    statement (SELECT, INSERT, UPDATE, DELETE). The collection's
-*    `securityRules` are the whole authorization model; app-layer callbacks
-*    are validation/side-effects, not a security boundary.
+* Postgres resolves unqualified names through `search_path`, which defaults to
+* `"$user", public` — and `$user` is the connection ROLE. When a schema of that
+* name exists it sits ahead of `public`, so every unqualified statement
+* silently operates on it instead:
 *
-*  - **Server context** — the base (owner) connection: auth flows, migrations,
-*    background jobs, and the explicit `rebase.dataAsAdmin` accessor. As table
-*    owner it bypasses RLS. This is the trusted plane, equivalent to
-*    Supabase's `service_role`.
+*     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts
 *
-* This module provides the three pieces:
+* Nothing errors. You get a second table of the same name in the wrong schema,
+* and reads that pin `public` cannot see it — which reads as "missing table" and
+* sends people to re-run a push that creates a *third* copy. The bootstrapper
+* has a whole branch dedicated to recognising the symptom after the fact.
 *
-*  1. {@link detectConnectionPosture} — is the connection subject to RLS at
-*     all? (superuser / BYPASSRLS / table owner ⇒ no)
-*  2. {@link ensureAppRole} — idempotently provision `rebase_user` with
-*     SELECT/INSERT/UPDATE/DELETE grants (+ default privileges so future
-*     tables stay covered).
-*  3. {@link applyAuthContext} — per-transaction: set the `app.*` GUCs the
-*     policies read (`auth.uid()` etc.) and `SET LOCAL ROLE rebase_user` so
-*     RLS binds. Transaction-scoped, so it composes with poolers.
+* Rebase shipped straight into this: it creates a schema named `rebase` while
+* every template named the database role `rebase` too. The scaffold uses
+* `rebase_app` now, and every pool Rebase opens pins `search_path=public`
+* (`pinSearchPath`), which covers the paths the framework controls. This covers
+* the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,
+* a hand-written migration — because the hazard is a property of the two NAMES,
+* not of any one connection.
 *
-* Provisioning runs from the framework's own bootstrap/migrate (which already
-* self-creates the `auth` schema and functions) — enforcement is default-on,
-* not an operator opt-in.
+* A warning rather than a boot failure: the database works, the framework's own
+* traffic is pinned, and refusing to start over a naming choice a user may have
+* inherited would be worse than the risk.
 */
-/** The restricted role every authenticated (user-context) request runs as. */
-var REBASE_USER_ROLE = "rebase_user";
-var quoteIdent$1 = (name) => `"${name.replace(/"/g, "\"\"")}"`;
-/** DML the user role holds on managed tables (RLS still filters per row). */
-var USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
+async function warnOnRoleSchemaCollision(run) {
+	try {
+		const rows = await run(`
+            SELECT current_user AS role,
+                   EXISTS (
+                       SELECT 1 FROM pg_namespace n WHERE n.nspname = current_user
+                   ) AS collides
+        `);
+		if (rows[0]?.collides !== true) return;
+		const role = String(rows[0]?.role ?? "the connection role");
+		logger.warn(`⚠️  The database role "${role}" has the same name as a schema. Postgres resolves unqualified names through \`search_path\`, which defaults to \`"$user", public\` — so "${role}" is searched BEFORE public, and any unqualified \`CREATE TABLE\`/\`SELECT\` from a tool that does not pin the path (psql, pg_dump, drizzle-kit, a hand-written migration) silently lands in "${role}" instead. Rebase's own connections pin \`search_path=public\`, so the server is unaffected. To remove the hazard entirely, connect as a role whose name is not also a schema — the scaffold uses "rebase_app".`);
+	} catch {}
+}
 async function detectConnectionPosture(run) {
 	const row = (await run(`
         SELECT current_user            AS role,
@@ -4535,6 +4621,9 @@ async function ensureAppRole(run, schemas) {
 		await run(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
 		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);
 		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);
+		await revokeInternalTableAccess(async (text) => {
+			await run(text);
+		}, schema, { onError: (table, error) => logger.warn(`🔐 [rls] Could not revoke "${REBASE_USER_ROLE}" access to "${schema}"."${table}" — it stays reachable by authenticated requests: ` + (error instanceof Error ? error.message : String(error))) });
 	}
 	logger.info(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
 }
@@ -4620,6 +4709,40 @@ function warnOnAnonymousGrants(collections) {
 	logger.warn(`Security rules that read as a lockdown but grant access to anonymous requests. Every caller from a client carries a user id ('${ANONYMOUS_USER_ID}' when nobody is signed in), so these clauses are true for everyone:\n\n` + problems.join("\n\n") + "\n");
 }
 /**
+* Name the collections whose raw policy SQL still calls the pre-1.0 helpers.
+*
+* The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the
+* database, so nothing is broken and no policy is wrong — which is exactly why
+* this has to be said out loud. A silent rewrite that works forever is not a
+* migration, it is a second supported spelling nobody wrote down, and the next
+* person to read those rules will copy the old one.
+*
+* Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,
+* `policy.rolesOverlap(...)`) compile from the model and were never affected.
+*/
+function warnOnLegacyRlsFunctions(collections) {
+	const sites = [];
+	for (const collection of collections) for (const rule of collection.securityRules ?? []) {
+		const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+		if (![usingExpr, withCheckExpr].filter((e) => e !== null).some(containsLegacyRlsCall)) continue;
+		const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
+		if (!sites.includes(site)) sites.push(site);
+	}
+	if (sites.length === 0) return;
+	logger.warn(`These security rules call the pre-1.0 RLS helpers (\`auth.uid()\`, \`auth.roles()\`, \`auth.jwt()\`). They still work — the compiler rewrites them — but the functions now live in the \`rebase\` schema, and the \`auth\` one is Supabase's. Update the raw SQL in these rules to \`${REBASE_SCHEMA}.uid()\` and friends, or switch them to the structured helpers (\`policy.authUid()\`, \`policy.rolesOverlap()\`), which never had to be spelled by hand:\n\n` + sites.map((s) => `  • ${s}`).join("\n") + "\n");
+}
+/** Whether any `raw` expression in the tree calls a pre-1.0 helper. */
+function containsLegacyRlsCall(expr) {
+	switch (expr.kind) {
+		case "raw": return usesLegacyRlsFunctions(expr.sql);
+		case "and":
+		case "or": return expr.operands.some(containsLegacyRlsCall);
+		case "not": return containsLegacyRlsCall(expr.operand);
+		case "existsIn": return containsLegacyRlsCall(expr.where);
+		default: return false;
+	}
+}
+/**
 * Reject `pgRoles` that this server can never satisfy.
 *
 * `pgRoles` sets the `TO` clause of a generated policy, so a policy naming a
@@ -4749,6 +4872,25 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			}
 		};
 	}
+	/**
+	* Build the context handed to every collection callback.
+	*
+	* Note `data: this.data` — `this` is whichever driver is running the
+	* operation, so the callback's data plane inherits that driver's privilege.
+	* On a user request `AuthenticatedPostgresBackendDriver.withTransaction`
+	* constructs a fresh base driver bound to the RLS-scoped transaction and
+	* runs the operation on it, so `this.data` speaks through that connection
+	* and policies apply. On server-context work `this` is the base driver on
+	* the owner connection, and they do not. Pinned by the
+	* `"scopes context.data to the caller"` case in the `rls-enforcement` e2e
+	* suite, because it is the kind of property that is easy to break from a
+	* distance and impossible to notice.
+	*
+	* Previously returned through `as unknown as RebaseCallContext`, which
+	* disabled checking for the whole object and let `driver` — documented in
+	* the callbacks guide — sit on the runtime context while absent from the
+	* contract. Both are declared now, so this is a plain typed return.
+	*/
 	buildCallContext() {
 		return {
 			user: this.user,
@@ -5204,6 +5346,106 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			return saved;
 		});
 	}
+	/**
+	* Update many rows through the same pipeline as {@link save}, in one
+	* transaction.
+	*
+	* Structurally the mirror of {@link saveMany} — same tx-bound sub-driver,
+	* same deferred notifications, same per-row error labelling — but it calls
+	* `save` with an explicit `id` and `status: "existing"`, which is precisely
+	* what `saveMany` cannot do: that one passes `status: "new"` and keeps the
+	* key inside `values`, so it inserts or upserts and can never target a
+	* particular row.
+	*
+	* All-or-nothing, so an id matching no row aborts the batch. A partial
+	* update is the outcome with no good recovery: the caller cannot tell which
+	* half landed without re-reading everything.
+	*/
+	async updateMany({ path, updates, collection }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < updates.length; i++) {
+				const { id, values } = updates[i];
+				try {
+					if (!await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					saved.push(await txDriver.save({
+						path,
+						id: String(id),
+						values,
+						collection,
+						status: "existing"
+					}));
+				} catch (error) {
+					throw Object.assign(new Error(`Update ${i} of ${updates.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return saved;
+		});
+	}
+	/**
+	* Delete many rows in one transaction, running the full delete pipeline —
+	* `beforeDelete`, the delete, `afterDelete` — for each.
+	*
+	* Looping the single-row {@link delete} rather than emitting one
+	* `DELETE ... WHERE id = ANY($1)` is the deliberate choice: a single
+	* statement would be faster and would skip every callback, so a collection
+	* relying on `beforeDelete` to veto or on `afterDelete` to clean up
+	* dependents would behave differently depending on how many rows the caller
+	* happened to delete at once. Same pipeline, one transaction.
+	*/
+	async deleteMany({ path, ids, collection }) {
+		await this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			for (let i = 0; i < ids.length; i++) {
+				const id = ids[i];
+				try {
+					const existing = await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					});
+					if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					await txDriver.delete({
+						row: {
+							id: String(id),
+							path,
+							values: existing
+						},
+						collection
+					});
+				} catch (error) {
+					throw Object.assign(new Error(`Delete ${i} of ${ids.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+		});
+	}
 	async delete({ row, collection }) {
 		const targetPath = row.path;
 		const targetRow = { ...row.values ?? {} };
@@ -6168,7 +6410,8 @@ var computeSharedRelationName = (rel, sourceCollection, _collections) => {
 	}
 	return fallback;
 };
-var generateSchema = async (collections, stripPolicies = false) => {
+var generateSchema = async (allCollections, stripPolicies = false) => {
+	const collections = relationalCollections(allCollections);
 	let schemaContent = "// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\n\n";
 	const hasUuid = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "string" && (p.autoValue === "uuid" || p.isId === "uuid")));
 	const hasVector = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "vector"));
@@ -6982,6 +7225,8 @@ var ChannelHistoryStore = class {
                 last_seq BIGINT NOT NULL
             )
         `);
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")));
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")));
 		this.tablesReady = true;
 		logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
 	}
@@ -7165,6 +7410,7 @@ var ChannelPresenceStore = class {
             CREATE INDEX IF NOT EXISTS idx_channel_presence_last_seen
             ON rebase.channel_presence (last_seen)
         `);
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence")));
 		this.tablesReady = true;
 	}
 	/** Record (or refresh) a client's presence. */
@@ -7816,23 +8062,18 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				path: request.path,
 				collectionRequest: {
 					filter: request.filter,
+					logical: request.logical,
 					orderBy: request.orderBy,
 					order: request.order,
 					limit: boundedLimit,
+					offset: request.offset,
 					startAfter: request.startAfter,
 					databaseId: request.collection?.databaseId,
 					searchString: request.searchString
 				},
 				authContext
 			});
-			const rows = await this.fetchCollectionWithAuth(request.path, {
-				filter: request.filter,
-				orderBy: request.orderBy,
-				order: request.order,
-				limit: boundedLimit,
-				startAfter: request.startAfter,
-				searchString: request.searchString
-			}, authContext);
+			const rows = await this.fetchCollectionWithAuth(request.path, this._subscriptions.get(subscriptionId).collectionRequest, authContext);
 			this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
@@ -8016,6 +8257,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				});
 				else fetchedEntities = await txEntityService.fetchCollection(notifyPath, {
 					filter: collectionRequest.filter,
+					logical: collectionRequest.logical,
 					orderBy: collectionRequest.orderBy,
 					order: collectionRequest.order,
 					limit: collectionRequest.limit,
@@ -9131,7 +9373,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-CD8o_1Sl.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-Bww-Lg0s.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -9203,6 +9445,54 @@ var quote = (xs) => Array.from(xs).map((s) => `\`${s}\``).join(", ");
 /** `on.from` / `on.to` accept a single column or a composite tuple. */
 var asColumns = (value) => Array.isArray(value) ? value : [value];
 /**
+* Distinguish "this column name is wrong" from "the generated schema is old".
+*
+* They present identically here — a relation asks for a column the registered
+* table does not have — but they are opposite problems with opposite fixes, and
+* getting them the wrong way round is how the 0.12 → 0.13 upgrade bricked
+* projects.
+*
+* The registered table is not the database. It comes from the project's
+* checked-in `backend/src/schema.generated.ts`, and 0.13 changed the rule that
+* derives foreign-key names: `categories` yields `category_id` where it used to
+* yield `categorie_id`. Boot-ensure renames the database column to match, so by
+* the time this runs the *database* is correct and the *generated module* is the
+* stale one. Reporting "not a column" then points at the wrong artifact, and the
+* generic fix — "set `through.targetColumn` to one of: …", listing the legacy
+* name because that is what the stale module still has — talks the reader into
+* pinning a column that no longer exists.
+*
+* So when the wanted name is what the current rule derives, and the table
+* carries what the *previous* rule would have derived from the same source, say
+* that instead.
+*
+* @param wanted   the column the relation asks for
+* @param available every column the registered table has
+* @param sources  names the default could have been derived from (a slug, a
+*                 relation name) — checking against these rather than guessing
+*                 backwards from `wanted` keeps the match exact
+*/
+function staleCodegenRename(wanted, available, sources) {
+	for (const source of sources) {
+		if (!source) continue;
+		const current = generateForeignKeyName(source);
+		const legacy = legacyForeignKeyName(source);
+		if (current !== wanted || legacy === current) continue;
+		if (available.has(legacy) && !available.has(current)) return {
+			legacy,
+			current
+		};
+	}
+	return null;
+}
+/** The shared explanation, so every relation kind reports it identically. */
+function staleCodegenDefect(table, { legacy, current }) {
+	return {
+		problem: `the generated Drizzle schema still declares \`${legacy}\` on \`${table}\`, but this release derives \`${current}\` — the generated schema predates the foreign-key naming fix and no longer describes the database`,
+		fix: `regenerate it with \`rebase schema generate\` (or \`pnpm run schema:generate\`). The database column has already been renamed for you at boot, so nothing else is needed. To keep \`${legacy}\` instead, name it explicitly on the relation and regenerate.`
+	};
+}
+/**
 * Relations whose names do not resolve against the registered schema.
 *
 * Fails open wherever it cannot see enough to be sure — an unregistered source
@@ -9249,19 +9539,31 @@ function findRelationDefects(collections, registry) {
 			const targetColumns = columnNames(targetTable);
 			switch (relation.kind) {
 				case "belongsTo":
-					if (!sourceColumns.has(relation.localKey)) defects.push({
-						...at,
-						problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
-						fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
-					});
+					if (!sourceColumns.has(relation.localKey)) {
+						const stale = staleCodegenRename(relation.localKey, sourceColumns, [relation.relationName, targetCollection.slug]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(sourceTableName, stale)
+						} : {
+							...at,
+							problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
+							fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
+						});
+					}
 					break;
 				case "hasOne":
 				case "hasMany":
-					if (!targetColumns.has(relation.foreignKeyOnTarget)) defects.push({
-						...at,
-						problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
-						fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
-					});
+					if (!targetColumns.has(relation.foreignKeyOnTarget)) {
+						const stale = staleCodegenRename(relation.foreignKeyOnTarget, targetColumns, [collection.slug]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(targetTableName, stale)
+						} : {
+							...at,
+							problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
+							fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
+						});
+					}
 					if (relation.sourceKey && !sourceColumns.has(relation.sourceKey)) defects.push({
 						...at,
 						problem: `\`sourceKey: "${relation.sourceKey}"\` is not a column on \`${sourceTableName}\``,
@@ -9280,11 +9582,21 @@ function findRelationDefects(collections, registry) {
 						break;
 					}
 					const junctionColumns = columnNames(junction);
-					for (const [label, column] of [["sourceColumn", sourceColumn], ["targetColumn", targetColumn]]) if (!junctionColumns.has(column)) defects.push({
-						...at,
-						problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
-						fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
-					});
+					const derivedFrom = {
+						sourceColumn: [collection.slug],
+						targetColumn: [targetCollection.slug]
+					};
+					for (const [label, column] of [["sourceColumn", sourceColumn], ["targetColumn", targetColumn]]) if (!junctionColumns.has(column)) {
+						const stale = staleCodegenRename(column, junctionColumns, [...derivedFrom[label]]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(table, stale)
+						} : {
+							...at,
+							problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
+							fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
+						});
+					}
 					break;
 				}
 				case "via": {
@@ -9356,7 +9668,16 @@ function assertRelationsResolve(collections, registry) {
 	const defects = findRelationDefects(collections, registry);
 	if (defects.length === 0) return;
 	const lines = defects.map((d) => `  • ${d.collection}.${d.relationName} (${d.kind})\n      ${d.problem}\n      fix: ${d.fix}`);
-	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against the database schema.\n\nEach of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
+	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against \`backend/src/schema.generated.ts\`.
+
+Each of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
+
+If the database was migrated recently — an upgrade, a \`db push\`, a restore — this file is
+probably older than the schema it describes. Regenerate it before changing anything else:
+
+    rebase schema generate
+
+If it is already current, then the collection is what disagrees with it:
 
 ` + lines.join("\n\n") + "\n");
 }
@@ -9567,7 +9888,7 @@ async function ensureAuthTablesExist(db, collection) {
 			if (idProp) {
 				const isId = "isId" in idProp ? idProp.isId : void 0;
 				if (isId === "uuid") userIdType = "UUID";
-				else if (isId === "autoincrement") userIdType = "INTEGER";
+				else if (isId === "increment") userIdType = "INTEGER";
 			}
 		}
 		try {
@@ -9600,43 +9921,42 @@ async function ensureAuthTablesExist(db, collection) {
 		const emailLengthConstraint = `"${authIdentifier("email_length_check")}"`;
 		const emailLowerUniqueIndex = authIdentifier("email_lower_key");
 		const verificationTokenIndex = authIdentifier("email_verification_token_idx");
+		const usersColumnDdl = AUTH_USERS_COLUMNS.map((spec) => spec.column === "email" ? `${spec.column} ${authUsersColumnSql(spec)} CONSTRAINT ${emailLengthConstraint} CHECK (length(email) <= 320)` : `${spec.column} ${authUsersColumnSql(spec)}`).join(",\n                ");
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(usersTableName)} (
                 id ${sql.raw(userIdType)} PRIMARY KEY ${sql.raw(idDefault)},
-                email TEXT NOT NULL CONSTRAINT ${sql.raw(emailLengthConstraint)} CHECK (length(email) <= 320),
-                display_name TEXT,
-                photo_url TEXT,
-                roles TEXT[] DEFAULT '{}' NOT NULL,
-                password_hash TEXT,
-                email_verified BOOLEAN DEFAULT FALSE NOT NULL,
-                email_verification_token TEXT,
-                email_verification_sent_at TIMESTAMP WITH TIME ZONE,
-                is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
-                metadata JSONB DEFAULT '{}' NOT NULL,
-                tokens_valid_after TIMESTAMP WITH TIME ZONE,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
-                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
+                ${sql.raw(usersColumnDdl)}
             )
         `);
-		await db.execute(sql`
-            CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
-            BEGIN
-                IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
-                    NEW.uid := NEW.user_id;
-                ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
-                    NEW.user_id := NEW.uid;
-                END IF;
-                RETURN NEW;
-            END $$ LANGUAGE plpgsql
-        `);
-		for (const authTable of [
+		const legacyFkTables = [
 			"user_identities",
 			"refresh_tokens",
 			"password_reset_tokens",
 			"magic_link_tokens",
 			"mfa_factors",
 			"recovery_codes"
-		]) {
+		];
+		const legacyFkTableList = legacyFkTables.map((t) => `'${t}'`).join(", ");
+		const legacyUserIdPresent = await db.execute(sql`
+            SELECT 1
+            FROM information_schema.columns
+            WHERE table_schema = ${authSchema}
+              AND table_name IN (${sql.raw(legacyFkTableList)})
+              AND column_name = 'user_id'
+            LIMIT 1
+        `);
+		if (legacyUserIdPresent.rows.length > 0) await db.execute(sql`
+                CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
+                BEGIN
+                    IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
+                        NEW.uid := NEW.user_id;
+                    ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
+                        NEW.user_id := NEW.uid;
+                    END IF;
+                    RETURN NEW;
+                END $$ LANGUAGE plpgsql
+            `);
+		for (const authTable of legacyUserIdPresent.rows.length > 0 ? legacyFkTables : []) {
 			const qualified = `"${authSchema}"."${authTable}"`;
 			await db.execute(sql`
                 DO $$
@@ -9757,54 +10077,50 @@ async function ensureAuthTablesExist(db, collection) {
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
         `);
-		await db.execute(sql`CREATE SCHEMA IF NOT EXISTS auth`);
 		await db.transaction(async (tx) => {
 			await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$
-                    SELECT COALESCE(
-                        NULLIF(current_setting('app.uid', true), ''),
-                        NULLIF(current_setting('app.user_id', true), '')
-                    );
-                $$ LANGUAGE sql STABLE
-            `);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb AS $$
-                    SELECT COALESCE(
-                        NULLIF(current_setting('app.jwt', true), ''),
-                        '{}'
-                    )::jsonb;
-                $$ LANGUAGE sql STABLE
-            `);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.roles() RETURNS text AS $$
-                    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');
-                $$ LANGUAGE sql STABLE
-            `);
+			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await tx.execute(sql.raw(statement));
 		});
-		for (const columnDef of [
-			"display_name TEXT",
-			"photo_url TEXT",
-			"roles TEXT[] DEFAULT '{}' NOT NULL",
-			"password_hash TEXT",
-			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
-			"email_verification_token TEXT",
-			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
-			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
-			"metadata JSONB DEFAULT '{}' NOT NULL",
-			"tokens_valid_after TIMESTAMP WITH TIME ZONE",
-			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
-			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
-		]) await db.execute(sql`
+		for (const spec of AUTH_USERS_COLUMNS) {
+			if (spec.column === "email") continue;
+			await db.execute(sql`
                 ALTER TABLE ${sql.raw(usersTableName)}
-                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(`${spec.column} ${authUsersColumnSql(spec)}`)}
             `);
-		const usersColumns = await db.execute(sql`
-            SELECT column_name, data_type
+		}
+		const usersColumnRows = (await db.execute(sql`
+            SELECT column_name, data_type, is_nullable, column_default
             FROM information_schema.columns
             WHERE table_schema = ${usersSchema} AND table_name = ${resolvedTable}
-        `);
-		const usersColumnTypes = new Map(usersColumns.rows.map((row) => [row.column_name, row.data_type]));
+        `)).rows;
+		const usersColumnTypes = new Map(usersColumnRows.map((row) => [row.column_name, row.data_type]));
+		const usersColumnState = new Map(usersColumnRows.map((row) => [row.column_name, row]));
+		for (const spec of AUTH_USERS_COLUMNS) {
+			const state = usersColumnState.get(spec.column);
+			if (!state) continue;
+			if (spec.default !== void 0 && state.column_default === null) {
+				await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET DEFAULT ${sql.raw(spec.default)}
+                `);
+				logger.info(`🔧 Restored the default on ${usersTableName}.${spec.column}`);
+			}
+			if (!spec.notNull || state.is_nullable !== "YES") continue;
+			if (spec.default !== void 0) await db.execute(sql`
+                    UPDATE ${sql.raw(usersTableName)}
+                    SET ${sql.raw(`"${spec.column}"`)} = ${sql.raw(spec.default)}
+                    WHERE ${sql.raw(`"${spec.column}"`)} IS NULL
+                `);
+			try {
+				await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET NOT NULL
+                `);
+				logger.info(`🔧 Restored NOT NULL on ${usersTableName}.${spec.column}`);
+			} catch (err) {
+				logger.warn(`⚠️ ${usersTableName}.${spec.column} should be NOT NULL but still holds NULLs, so the constraint was not applied. Fill or remove those rows and restart: ` + (err instanceof Error ? err.message : String(err)));
+			}
+		}
 		for (const column of [
 			"email",
 			"display_name",
@@ -9986,10 +10302,12 @@ async function ensureAuthTablesExist(db, collection) {
 				[authSchema, "user_identities"],
 				[authSchema, "refresh_tokens"],
 				[authSchema, "password_reset_tokens"],
+				[authSchema, "magic_link_tokens"],
 				[authSchema, "app_config"],
 				[authSchema, "mfa_factors"],
 				[authSchema, "mfa_challenges"],
-				[authSchema, "recovery_codes"]
+				[authSchema, "recovery_codes"],
+				[authSchema, "schema_meta"]
 			];
 			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
                     SELECT 1
@@ -10009,6 +10327,9 @@ async function ensureAuthTablesExist(db, collection) {
 			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
 		}
 		await stampAuthSchemaVersion(db, authSchema);
+		await revokeInternalTableAccess(async (text) => {
+			await db.execute(sql.raw(text));
+		}, authSchema, { onError: (table, err) => logger.warn(`🔐 Could not revoke authenticated-role access to "${authSchema}"."${table}": ` + (err instanceof Error ? err.message : String(err))) });
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
 		if (error instanceof AuthSchemaVersionError) throw error;
@@ -11337,6 +11658,7 @@ async function ensureHistoryTableExists(db) {
             CREATE INDEX IF NOT EXISTS idx_history_time
             ON rebase.entity_history(table_name, entity_id, updated_at DESC)
         `);
+		await db.execute(sql.raw(revokeInternalTableSql("rebase", "entity_history")));
 		logger.info("✅ Entity history table ready");
 	} catch (error) {
 		logger.error("❌ Failed to create row history table", { error });
@@ -12058,12 +12380,12 @@ function createPostgresBootstrapper(pgConfig) {
 				const runSql = async (text) => {
 					return (await schemaAwareDb.execute(sql.raw(text))).rows ?? [];
 				};
+				await warnOnRoleSchemaCollision(runSql);
 				const posture = await detectConnectionPosture(runSql);
 				if (posture.privileged) {
 					await ensureAppRole(runSql, [
 						"public",
 						"rebase",
-						"auth",
 						...registry.getCollections().map((c) => c.schema).filter((s) => typeof s === "string")
 					]);
 					driver.rlsUserRole = REBASE_USER_ROLE;
@@ -12073,6 +12395,7 @@ function createPostgresBootstrapper(pgConfig) {
 				} else logger.info(`🔐 RLS enforcement: connection role "${posture.role}" is subject to RLS natively; no role switch needed.`);
 				await validatePolicyPgRoles(runSql, registry.getCollections(), driver.rlsUserRole ?? posture.role);
 				warnOnAnonymousGrants(registry.getCollections());
+				warnOnLegacyRlsFunctions(registry.getCollections());
 			}
 			if (driver.branchService) try {
 				await driver.branchService.ensureBranchMetadataTable();
@@ -12288,7 +12611,7 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CBQdOETu.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-DSIxvLLD.js");
 			const plan = await ensureCollectionTables({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
@@ -12313,13 +12636,24 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-ViG8XiPn.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-DMUdRQdM.js");
 			const outcome = await ensureCollectionPolicies({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
 			} }, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
 			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — it stays locked (denies) until this is resolved: ${failure.error}`);
+			try {
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-Bpv3nUZo.js").then((n) => n.n);
+				await dropLegacyAuthSchema(async (text) => {
+					return (await internals.db.execute(sql.raw(text))).rows ?? [];
+				}, {
+					info: (m) => logger.info(m),
+					warn: (m) => logger.warn(m)
+				});
+			} catch (err) {
+				logger.info("Left the legacy `auth` schema in place: " + (err instanceof Error ? err.message : String(err)));
+			}
 			return { applied: outcome.policiesApplied };
 		},
 		getAdmin(driverResult) {
@@ -12327,7 +12661,7 @@ function createPostgresBootstrapper(pgConfig) {
 		},
 		mountRoutes(app, basePath, driverResult) {},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			const { createPostgresWebSocket } = await import("./websocket-B2LsrINK.js").then((n) => n.n);
+			const { createPostgresWebSocket } = await import("./websocket-D0TBU3ia.js").then((n) => n.n);
 			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
 		}
 	};