@rebasepro/server-postgres 0.13.1-canary.gc77922a → 0.13.1-canary.gca63148

package/dist/index.es.js

@@ -2,11 +2,12 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
-import { A as toSnakeCase, C as normalizeToEntityRelation, D as getPolicyNamesForRule, E as legacyForeignKeyName, F as Vector, N as hasForeignKeyOnTarget, O as mergeDeep, P as isManyToMany, S as createRelationRefWithData, T as generateForeignKeyName, _ as buildCompositeId, a as getJunctionSecurityRules, b as parseIdValues, c as policyToPostgres, d as findRelation, f as getColumnName, g as resolveCollectionRelations, h as getTableVarName, i as getJunctionCollectionConfig, k as camelCase, l as securityRuleToConditions, m as getTableName$1, n as CollectionRegistry, o as resolveJunctionSpecs, p as getEnumVarName, r as resolveStringColumnLength, s as getEffectiveSecurityRules, t as buildSdkData, u as findAnonymousGrants, v as getDeclaredPrimaryKeys, w as updateDateAutoValues, x as createRelationRef, y as isAddressableId } from "./src-DlPBctw_.js";
-import { n as isPostgresCollectionConfig, r as isRelationalCollectionConfig } from "./src-DoU9yPqq.js";
-import { t as ANONYMOUS_USER_ID } from "./policy-CeA1JcxP.js";
-import { t as createPostgresWebSocket } from "./websocket-B2LsrINK.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-CD8o_1Sl.js";
+import { A as resolveCollectionRelations, B as legacyForeignKeyName, C as securityRuleToConditions, D as getEnumVarName, E as getColumnName, F as createRelationRef, G as camelCase, H as getPolicyNamesForRule, I as createRelationRefWithData, K as toSnakeCase, L as normalizeToEntityRelation, M as getDeclaredPrimaryKeys, N as isAddressableId, O as getTableName$1, P as parseIdValues, Q as Vector, R as updateDateAutoValues, S as policyToPostgres, T as findRelation, U as isPrototypePollutingKey, W as mergeDeep, X as hasForeignKeyOnTarget, Y as resolveClientListLimit, Z as isManyToMany, _ as resolveStringColumnLength, b as resolveJunctionSpecs, c as buildSearchColumnSpec, g as relationalCollections, h as CollectionRegistry, j as buildCompositeId, k as getTableVarName, l as hiddenColumnsOption, m as buildSdkData, o as SEARCH_UNACCENT_FN, p as visibleColumnProjection, r as authUsersColumnSql, t as AUTH_USERS_COLUMNS, v as getJunctionCollectionConfig, w as findAnonymousGrants, x as getEffectiveSecurityRules, y as getJunctionSecurityRules, z as generateForeignKeyName } from "./auth-users-columns-BQttUZE2.js";
+import { c as isPostgresCollectionConfig, l as isRelationalCollectionConfig, n as REBASE_SCHEMA, o as usesLegacyRlsFunctions } from "./src-C_wvdMnl.js";
+import { t as ANONYMOUS_USER_ID } from "./policy-CPkCqVTz.js";
+import { t as createPostgresWebSocket } from "./websocket-D0TBU3ia.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-Bww-Lg0s.js";
+import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-Bpv3nUZo.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
@@ -30,25 +31,6 @@ import { randomUUID } from "crypto";
 function isChannelBusInstance(setting) {
 	return typeof setting?.publish === "function";
 }
-/**
-* Resolve a client-supplied list `limit` into a safe, always-defined value.
-*
-* - A provided limit is coerced to an integer and clamped to `[1, maxLimit]`,
-*   so `0`, negatives, and absurd values can never bypass the cap.
-* - An absent / blank / non-numeric limit falls back to the mode default:
-*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
-*
-* The return is never `undefined` — no ingress that routes its client limit
-* through this can produce an unbounded read.
-*/
-function resolveClientListLimit(rawLimit, opts = {}) {
-	const maxLimit = opts.maxLimit ?? 1e3;
-	if (rawLimit != null && String(rawLimit).trim() !== "") {
-		const parsed = typeof rawLimit === "number" ? rawLimit : parseInt(String(rawLimit), 10);
-		if (Number.isFinite(parsed)) return Math.min(Math.max(1, Math.floor(parsed)), maxLimit);
-	}
-	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
-}
 //#endregion
 //#region ../common/src/util/email.ts
 /**
@@ -152,6 +134,142 @@ var buildPropertyCallbacks = (properties) => {
 	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
 };
 //#endregion
+//#region ../common/src/util/internal-tables.ts
+/**
+* The tables Rebase creates for its own bookkeeping, and the SQL that keeps the
+* end-user role away from them.
+*
+* ## Why this exists
+*
+* Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role
+* provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table
+* in the schemas a project uses — including `rebase`, because a project's own
+* collections are allowed to live there (the scaffold puts `users` there). It
+* also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the
+* migrating role inherits the same grant.
+*
+* Every framework-internal table is created later: auth's tables come up during
+* `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first
+* job registers, `idempotency_keys` on the first request that carries a key. So
+* they all inherited full DML for the end-user role — and none of them enables
+* row-level security, because none of them is a collection with
+* `securityRules`. Measured on a freshly provisioned database, `SET ROLE
+* rebase_user` could read `rebase.refresh_tokens` (session token hashes),
+* `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and
+* `rebase.api_keys` (including its `admin` flag), and insert into
+* `rebase.app_config`.
+*
+* Nothing routes a user-context query at those tables today, so this was not
+* reachable over the API. That is the wrong thing to depend on: the documented
+* model is that RLS is the authorization boundary, and these tables sat outside
+* it. The boundary is now a privilege boundary instead — the role simply cannot
+* address them.
+*
+* ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY
+*
+* RLS with no policy denies every row, which is the same outcome, but it is the
+* *weaker* statement: it leaves the grant in place, so a later policy — or a
+* `FORCE` flag cleared by some future migration — reopens the table. There is no
+* row of `refresh_tokens` any end user should ever reach, so the honest encoding
+* is "this role has no privilege here at all". It also keeps the owner
+* connection (which auth actually runs on) completely unaffected.
+*
+* ## Keeping it true
+*
+* `packages/rls-check` scans the `rebase` schema — it used to skip it as a
+* "platform" schema — and its `rls-disabled` check fires on exactly the
+* condition this module removes: RLS off *and* a DML grant to a reachable role.
+* So a table added here without a revoke is caught by `pnpm rls:check`, not by
+* someone re-reading this file.
+*/
+/**
+* The Postgres role authenticated requests run as.
+*
+* Defined here rather than in the Postgres driver because both the driver (which
+* provisions the role) and this module (which revokes on its behalf) need it,
+* and a second spelling of a role name is a silent no-op waiting to happen.
+*/
+var REBASE_USER_ROLE = "rebase_user";
+/**
+* Framework-internal table names, unqualified.
+*
+* Deliberately NOT including `users`: the auth user table is also a collection,
+* with `securityRules`, RLS enabled and policies applied. Users read their own
+* row through it — revoking there would break sign-in.
+*
+* `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`
+* because `db migrate apply` passes `--revisions-schema rebase`.
+*/
+var REBASE_INTERNAL_TABLES = [
+	"user_identities",
+	"refresh_tokens",
+	"password_reset_tokens",
+	"magic_link_tokens",
+	"mfa_factors",
+	"mfa_challenges",
+	"recovery_codes",
+	"app_config",
+	"schema_meta",
+	"api_keys",
+	"cron_logs",
+	"cron_claims",
+	"idempotency_keys",
+	"entity_history",
+	"branches",
+	"channel_messages",
+	"channel_cursors",
+	"channel_presence",
+	"atlas_schema_revisions"
+];
+/** Postgres identifiers this module is willing to interpolate. */
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+/**
+* A single statement that takes every privilege on `schema.table` away from the
+* end-user role.
+*
+* Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which
+* happen in practice:
+*
+*  - the role does not exist when the connection is unprivileged (Rebase then
+*    relies on native RLS rather than a role switch), and a bare `REVOKE` on a
+*    missing role is an error, not a no-op;
+*  - the table may not exist yet — `cron_logs` never appears in a project with
+*    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.
+*
+* One command, so it is safe on handles that speak the extended query protocol
+* and reject multi-statement strings.
+*/
+function revokeInternalTableSql(schema, table) {
+	if (!SAFE_IDENTIFIER.test(schema)) throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);
+	if (!SAFE_IDENTIFIER.test(table)) throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);
+	const qualified = `"${schema}"."${table}"`;
+	return `
+        DO $rebase_revoke$
+        BEGIN
+            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')
+               AND to_regclass('${qualified}') IS NOT NULL THEN
+                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';
+            END IF;
+        END
+        $rebase_revoke$;
+    `.trim();
+}
+/**
+* Revoke on every internal table in `schema`, one statement at a time.
+*
+* Best-effort per table: a connection that does not own one of them (a
+* pre-provisioned database, a platform-managed ledger) cannot revoke on it, and
+* that must not take down a boot. The caller decides how loud to be — `onError`
+* exists so the driver can warn without this module importing a logger.
+*/
+async function revokeInternalTableAccess(execute, schema, options) {
+	for (const table of options?.tables ?? REBASE_INTERNAL_TABLES) try {
+		await execute(revokeInternalTableSql(schema, table));
+	} catch (error) {
+		options?.onError?.(table, error);
+	}
+}
+//#endregion
 //#region ../common/src/table-classification.ts
 /** Schemas that are always considered Rebase-internal. */
 var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
@@ -436,6 +554,12 @@ function deriveRowAddress(row, collection, registry) {
 //#endregion
 //#region src/utils/drizzle-conditions.ts
 /**
+* Postgres's own default for `pg_trgm.word_similarity_threshold`. Named here
+* because the fuzzy predicate has to know when the index-backed operator agrees
+* with the collection's declared threshold and when it would narrow too far.
+*/
+var PG_TRGM_WORD_SIMILARITY_DEFAULT = .6;
+/**
 * Process-wide default, set once when the driver is constructed.
 *
 * The condition builder is a set of *static* methods reached from a dozen
@@ -493,7 +617,7 @@ function toMembershipList(value) {
 * @example
 * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;
 */
-var DrizzleConditionBuilder = class {
+var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 	/**
 	* Express "reachable from this parent through this relation" as a plain
 	* `WHERE` condition on the target table.
@@ -1119,10 +1243,28 @@ var DrizzleConditionBuilder = class {
 		return or(...conditions);
 	}
 	/**
-	* Build search conditions for text fields
+	* Build search conditions for text fields.
+	*
+	* Two shapes, chosen by whether the collection declared a `search` block:
+	*
+	* - **Declared** — one `@@ websearch_to_tsquery` against the generated
+	*   `tsvector` column. Stems, drops stopwords, AND-es the terms, reaches
+	*   inside JSONB and arrays, and uses the GIN index.
+	* - **Not declared** — the original `ILIKE '%term%'` OR-ed across top-level
+	*   string properties, unchanged.
+	*
+	* The second is the default and stays the default. A collection that has
+	* not opted in compiles to exactly the SQL it compiled to before this
+	* branch existed, which is the only reason it is safe to have added it.
+	*
+	* `collection` is optional so that the callers which genuinely have no
+	* collection in hand — nested paths, derived views — keep working; without
+	* one there is no `search` block to read and the ILIKE path is correct.
 	*/
-	static buildSearchConditions(searchString, properties, table) {
+	static buildSearchConditions(searchString, properties, table, collection) {
 		const searchConditions = [];
+		const ftsCondition = collection ? DrizzleConditionBuilder.buildFullTextCondition(searchString, table, collection) : void 0;
+		if (ftsCondition) return [ftsCondition];
 		for (const [key, prop] of Object.entries(properties)) {
 			const p = prop;
 			if (p.type === "string" && !p.enum && p.isId !== "uuid") {
@@ -1135,6 +1277,117 @@ var DrizzleConditionBuilder = class {
 		return searchConditions;
 	}
 	/**
+	* The `@@` predicate for a collection that declared a `search` block, or
+	* undefined for one that did not.
+	*
+	* The query is normalized exactly as the indexed content was — same text
+	* search configuration, same accent folding. Skipping that on the query
+	* side is the subtle way to get a search that matches nothing: the column
+	* would hold `gestion` while the query asked for `gestión`.
+	*
+	* `websearch_to_tsquery` rather than `plainto_tsquery` because it is the
+	* one that behaves the way a search box looks like it should — quoted
+	* phrases, `or`, and a leading `-` to exclude — and because it never throws
+	* on user input, which `to_tsquery` does on so much as a stray parenthesis.
+	*/
+	static buildFullTextCondition(searchString, table, collection) {
+		let spec;
+		try {
+			spec = buildSearchColumnSpec(collection);
+		} catch {
+			return;
+		}
+		if (!spec) return void 0;
+		const column = table[spec.column];
+		if (!column) return;
+		const exact = sql`${column} @@ ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)}`;
+		if (!spec.fuzzy) return exact;
+		const fuzzyColumn = table[spec.fuzzy.column];
+		if (!fuzzyColumn) return exact;
+		const needle = spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`;
+		const similar = sql`public.word_similarity(${needle}, ${fuzzyColumn}) >= ${spec.fuzzy.threshold}`;
+		return sql`(${exact} OR ${spec.fuzzy.threshold > PG_TRGM_WORD_SIMILARITY_DEFAULT ? sql`(${needle} OPERATOR(public.<%) ${fuzzyColumn} AND ${similar})` : similar})`;
+	}
+	/**
+	* `websearch_to_tsquery(<config>, <normalized search string>)`.
+	*
+	* Split out because the ranking expression needs the identical query — a
+	* row ranked against a different tsquery than it was matched against is a
+	* ranking of something else.
+	*/
+	static normalizedTsQuery(searchString, spec) {
+		const normalized = spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`;
+		return sql`websearch_to_tsquery(${spec.language}, ${normalized})`;
+	}
+	/**
+	* A JSONB array of `{ field, snippet }` naming which declared fields matched
+	* and showing the text around each hit — what backs `_matches`.
+	*
+	* A ranked list answers "which rows", never "why this row". For a talent
+	* pool that difference is the product: a candidate surfacing for
+	* "iso 14001" on a *certification* is a different candidate from one whose
+	* bio happens to mention the standard, and the score cannot tell them apart.
+	*
+	* Built as a correlated subquery over a `VALUES` list of the declared
+	* fields, rather than one `CASE` per field, so the shape does not change
+	* with the number of fields and the empty result is a plain `[]`.
+	*
+	* `ts_headline` runs over the same normalized text that was indexed. Over
+	* the *original* text it would find nothing to mark whenever `unaccent` is
+	* on — the query's lexemes are folded and the document's are not — and
+	* would return the text silently unhighlighted. Folded-but-marked beats
+	* pretty-but-inert.
+	*
+	* Undefined when the collection has not opted in, when the column is not on
+	* the table yet, or when the caller did not ask: this costs a `ts_headline`
+	* per field per row and `ts_headline` re-parses the document.
+	*/
+	static buildSearchMatchesExpression(searchString, table, collection) {
+		let spec;
+		try {
+			spec = buildSearchColumnSpec(collection);
+		} catch {
+			return;
+		}
+		if (!spec || spec.fields.length === 0) return void 0;
+		if (!table[spec.column]) return void 0;
+		const query = DrizzleConditionBuilder.normalizedTsQuery(searchString, spec);
+		const config = sql`${spec.language}`;
+		const rows = spec.fields.map((f, i) => sql`(${i}, ${f.path}, ${sql.raw(f.textSql)})`);
+		return sql`(
+            SELECT coalesce(jsonb_agg(s.m ORDER BY f.ord), '[]'::jsonb)
+            FROM (VALUES ${sql.join(rows, sql`, `)}) AS f(ord, path, txt)
+            CROSS JOIN LATERAL (
+                SELECT jsonb_build_object(
+                    'field', f.path,
+                    'snippet', ts_headline(${config}::regconfig, f.txt, ${query},
+                        'StartSel=<mark>,StopSel=</mark>,MaxWords=14,MinWords=1,MaxFragments=1,FragmentDelimiter= … ')
+                ) AS m
+                WHERE to_tsvector(${config}::regconfig, f.txt) @@ ${query}
+            ) s
+        )`;
+	}
+	/**
+	* `ts_rank(<column>, <query>)` for the collection, or undefined when it has
+	* not opted in. This is what backs `orderBy: ["_score", "desc"]`.
+	*/
+	static buildSearchRankExpression(searchString, table, collection) {
+		let spec;
+		try {
+			spec = buildSearchColumnSpec(collection);
+		} catch {
+			return;
+		}
+		if (!spec) return void 0;
+		const column = table[spec.column];
+		if (!column) return void 0;
+		const rank = sql`ts_rank(${column}, ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)})`;
+		if (!spec.fuzzy) return rank;
+		const fuzzyColumn = table[spec.fuzzy.column];
+		if (!fuzzyColumn) return rank;
+		return sql`(${rank} + public.word_similarity(${spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`}, ${fuzzyColumn}))`;
+	}
+	/**
 	* Build a unique field check condition
 	*/
 	static buildUniqueFieldCondition(fieldColumn, value, idColumn, excludeId) {
@@ -1276,7 +1529,11 @@ function sanitizeAndConvertDates(obj) {
 	if (obj instanceof Date) return obj.toISOString();
 	if (typeof obj === "object") {
 		const newObj = {};
-		for (const key in obj) if (Object.prototype.hasOwnProperty.call(obj, key)) newObj[key] = sanitizeAndConvertDates(obj[key]);
+		for (const key in obj) {
+			if (!Object.prototype.hasOwnProperty.call(obj, key)) continue;
+			if (isPrototypePollutingKey(key)) continue;
+			newObj[key] = sanitizeAndConvertDates(obj[key]);
+		}
 		return newObj;
 	}
 	if (typeof obj === "string") {
@@ -1305,6 +1562,7 @@ function serializeDataToServer(row, properties, collection, registry) {
 		if (relation.kind === "belongsTo") foreignKeys.add(relation.localKey);
 	});
 	for (const [key, value] of Object.entries(row)) {
+		if (isPrototypePollutingKey(key)) continue;
 		const property = properties[key];
 		const effectiveValue = foreignKeys.has(key) && value === "" ? null : value;
 		if (!property) {
@@ -1670,6 +1928,18 @@ function parsePropertyFromServer(value, property, collection, propertyKey) {
 *                       from the result (used by `normalizeDbValues` where
 *                       Drizzle's relational API already hydrates them).
 */
+/**
+* Keys a query computes and attaches to a row, rather than reads from a column.
+*
+* An explicit set rather than a `_` prefix rule: a user's column may perfectly
+* well be called `_internal`, and passing it through here would put a value on
+* the row that no property describes and nothing downstream knows how to type.
+*/
+var QUERY_METADATA_KEYS = /* @__PURE__ */ new Set([
+	"_score",
+	"_distance",
+	"_matches"
+]);
 function normalizeScalarValues(data, properties, collection, resolvedRelations, options) {
 	const result = {};
 	const internalFKColumns = /* @__PURE__ */ new Set();
@@ -1681,6 +1951,10 @@ function normalizeScalarValues(data, properties, collection, resolvedRelations,
 			result[key] = value === null ? null : typeof value === "number" ? value : String(value);
 			continue;
 		}
+		if (QUERY_METADATA_KEYS.has(key)) {
+			result[key] = value;
+			continue;
+		}
 		const property = properties[key];
 		if (!property) continue;
 		if (options.skipRelations && property.type === "relation") continue;
@@ -1933,7 +2207,7 @@ var RelationService = class {
 		let query = this.db.select().from(targetTable).$dynamic();
 		const additionalFilters = [];
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, targetCollection.properties, targetTable);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, targetCollection.properties, targetTable, targetCollection);
 			if (searchConditions.length === 0) return [];
 			const searchCombined = DrizzleConditionBuilder.combineConditionsWithOr(searchConditions);
 			if (searchCombined) additionalFilters.push(searchCombined);
@@ -3039,7 +3313,7 @@ function sanitizeErrorForClient(error, context) {
 * Service for handling all row read operations.
 * Handles fetching, searching, counting, and filtering rows.
 */
-var FetchService = class {
+var FetchService = class FetchService {
 	db;
 	registry;
 	relationService;
@@ -3112,6 +3386,24 @@ var FetchService = class {
 	* and skips rows rather than erroring. The guesses stay, last, for a
 	* caller that hands over no collection to resolve against.
 	*/
+	/**
+	* The ORDER BY target, which may be relevance rather than a column.
+	*
+	* `_score` is only meaningful for a collection that declared a `search`
+	* block *and* for a request that carried a search string — ranking rows
+	* against no query ranks them all at zero. Outside those two conditions it
+	* is an unknown field and gets the same 400 as any other typo, which is the
+	* behaviour that matters: a sort that is silently dropped returns 200 with
+	* rows in arbitrary order, and paging over that repeats and skips rows.
+	*/
+	static SCORE_FIELD = "_score";
+	resolveOrderTarget(table, orderBy, collection, searchString) {
+		if (orderBy === FetchService.SCORE_FIELD && collection && searchString) {
+			const rank = DrizzleConditionBuilder.buildSearchRankExpression(searchString, table, collection);
+			if (rank) return rank;
+		}
+		return this.resolveOrderByField(table, orderBy, collection);
+	}
 	resolveOrderByField(table, orderBy, collection) {
 		const columnAt = (key) => (key in table ? table[key] : void 0) || void 0;
 		const direct = columnAt(orderBy);
@@ -3239,12 +3531,14 @@ var FetchService = class {
 	*/
 	buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig, scopeCondition) {
 		const queryOpts = {};
+		const hidden = hiddenColumnsOption(getTableColumns(table), this.registry.getCollectionByPath(collectionPath) ?? void 0);
+		if (hidden) queryOpts.columns = hidden;
 		if (withConfig) queryOpts.with = withConfig;
 		const allConditions = [];
 		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
 			const collection = getCollectionByPath(collectionPath, this.registry);
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) {
 				queryOpts.where = and(eq(idField, -99999999));
 				return queryOpts;
@@ -3267,7 +3561,7 @@ var FetchService = class {
 		const orderExpressions = [];
 		if (options.orderBy) {
 			const collection = getCollectionByPath(collectionPath, this.registry);
-			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
 			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
 		}
 		orderExpressions.push(desc(idField));
@@ -3284,6 +3578,7 @@ var FetchService = class {
 		if (!options.startAfter) return [];
 		const cursor = options.startAfter;
 		if (options.orderBy) {
+			if (options.orderBy === FetchService.SCORE_FIELD) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with `orderBy: \"_score\"`. Relevance is computed per query rather than stored, so it cannot key a cursor. Use `limit`/`offset` for relevance-ordered pages, or order by a column.", "SCORE_CURSOR_UNSUPPORTED", { field: FetchService.SCORE_FIELD });
 			const collection = collectionPath ? getCollectionByPath(collectionPath, this.registry) : void 0;
 			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
 			if (orderByField) {
@@ -3354,9 +3649,11 @@ var FetchService = class {
 		const qb = this.getQueryBuilder(tableName);
 		if (qb) try {
 			const withConfig = this.buildWithConfig(collection);
+			const hidden = hiddenColumnsOption(getTableColumns(table), collection);
 			const row = await qb.findFirst({
 				where: eq(idField, parsedId),
-				with: withConfig
+				with: withConfig,
+				...hidden ? { columns: hidden } : {}
 			});
 			if (!row) return void 0;
 			const flatRow = toFlatRow(row, collection, this.registry);
@@ -3370,7 +3667,8 @@ var FetchService = class {
 			if (reachedDatabase(e)) throw e;
 			logger.warn(`[FetchService] db.query.findFirst failed for ${collectionPath}, falling back to db.select`, { error: e });
 		}
-		const result = await this.db.select().from(table).where(eq(idField, parsedId)).limit(1);
+		const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
+		const result = await this.db.select(visibleOne).from(table).where(eq(idField, parsedId)).limit(1);
 		if (result.length === 0) return void 0;
 		const raw = result[0];
 		const values = await parseDataFromServer(raw, collection, this.db, this.registry);
@@ -3426,14 +3724,21 @@ var FetchService = class {
 		}
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
+		const visible = visibleColumnProjection(getTableColumns(table), collection);
+		const rankSelect = options.searchString ? DrizzleConditionBuilder.buildSearchRankExpression(options.searchString, table, collection) : void 0;
+		const matchesSelect = options.searchString && options.searchExplain ? DrizzleConditionBuilder.buildSearchMatchesExpression(options.searchString, table, collection) : void 0;
 		let query = vectorMeta ? this.db.select({
-			table_row: table,
+			table_row: visible ?? table,
 			_distance: vectorMeta.distanceSelect
-		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
+		}).from(table).$dynamic() : rankSelect ? this.db.select({
+			table_row: visible ?? table,
+			_score: rankSelect,
+			...matchesSelect ? { _matches: matchesSelect } : {}
+		}).from(table).$dynamic() : visible ? this.db.select(visible).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
 		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return [];
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
@@ -3453,7 +3758,7 @@ var FetchService = class {
 		const orderExpressions = [];
 		if (vectorMeta) orderExpressions.push(asc(vectorMeta.orderBy));
 		else if (options.orderBy) {
-			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
 			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
 		}
 		orderExpressions.push(desc(idField));
@@ -3473,6 +3778,10 @@ var FetchService = class {
 		const results = vectorMeta ? rawResults.map((r) => ({
 			...r.table_row,
 			_distance: typeof r._distance === "number" ? r._distance : parseFloat(String(r._distance))
+		})) : rankSelect ? rawResults.map((r) => ({
+			...r.table_row,
+			_score: typeof r._score === "number" ? r._score : parseFloat(String(r._score)),
+			...matchesSelect ? { _matches: r._matches ?? [] } : {}
 		})) : rawResults;
 		return this.processRowResults(results, collection, collectionPath, idInfo, options.databaseId, false, idInfoArray);
 	}
@@ -3564,7 +3873,7 @@ var FetchService = class {
 		const allConditions = [];
 		if (hop) allConditions.push(this.buildRelationScope(hop));
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return 0;
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
@@ -3709,7 +4018,8 @@ var FetchService = class {
 			if (reachedDatabase(e)) throw e;
 			logger.warn(`[fetchOneForRest] db.query.findFirst failed for ${collectionPath}, falling back`, { error: e });
 		}
-		const result = await this.db.select().from(table).where(eq(idField, parsedId)).limit(1);
+		const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
+		const result = await this.db.select(visibleOne).from(table).where(eq(idField, parsedId)).limit(1);
 		if (result.length === 0) return null;
 		const flatEntity = { ...result[0] };
 		if (!include || include.length === 0) return flatEntity;
@@ -3747,14 +4057,21 @@ var FetchService = class {
 		const idField = table[requirePrimaryKeys(collection, this.registry)[0].fieldName];
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
+		const visible = visibleColumnProjection(getTableColumns(table), collection);
+		const rankSelect = options.searchString ? DrizzleConditionBuilder.buildSearchRankExpression(options.searchString, table, collection) : void 0;
+		const matchesSelect = options.searchString && options.searchExplain ? DrizzleConditionBuilder.buildSearchMatchesExpression(options.searchString, table, collection) : void 0;
 		let query = vectorMeta ? this.db.select({
-			table_row: table,
+			table_row: visible ?? table,
 			_distance: vectorMeta.distanceSelect
-		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
+		}).from(table).$dynamic() : rankSelect ? this.db.select({
+			table_row: visible ?? table,
+			_score: rankSelect,
+			...matchesSelect ? { _matches: matchesSelect } : {}
+		}).from(table).$dynamic() : visible ? this.db.select(visible).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
 		if (options.relatedTo) allConditions.push(this.buildRelationScope(options.relatedTo));
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return [];
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
@@ -3770,7 +4087,7 @@ var FetchService = class {
 		const orderExpressions = [];
 		if (vectorMeta) orderExpressions.push(asc(vectorMeta.orderBy));
 		else if (options.orderBy) {
-			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
 			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
 		}
 		orderExpressions.push(desc(idField));
@@ -3783,6 +4100,11 @@ var FetchService = class {
 			...r.table_row,
 			_distance: typeof r._distance === "number" ? r._distance : parseFloat(String(r._distance))
 		}));
+		if (rankSelect) return rawResults.map((r) => ({
+			...r.table_row,
+			_score: typeof r._score === "number" ? r._score : parseFloat(String(r._score)),
+			...matchesSelect ? { _matches: r._matches ?? [] } : {}
+		}));
 		return rawResults;
 	}
 	/**
@@ -4046,7 +4368,8 @@ var PersistService = class {
 		if (error instanceof ApiError || error?.name === "ApiError") return error;
 		const pgError = extractPgError(error);
 		if (pgError) {
-			const { message } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+			const { message, code } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`) : ApiError.badRequest(message, `PG_${code}`);
 			return new Error(message);
 		}
 		const causeMessage = extractCauseMessage(error);
@@ -4271,6 +4594,7 @@ var BranchService = class {
                 metadata     JSONB DEFAULT '{}'
             );
         `));
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "branches")));
 	}
 	/**
 	* Create a new branch database by templating the source database.
@@ -4378,43 +4702,49 @@ var BranchService = class {
 };
 //#endregion
 //#region src/security/rls-enforcement.ts
+var quoteIdent$1 = (name) => `"${name.replace(/"/g, "\"\"")}"`;
+/** DML the user role holds on managed tables (RLS still filters per row). */
+var USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
 /**
-* Unified RLS enforcement — the "user context vs server context" model.
-*
-* Every operation runs in one of two contexts:
+* Warn when the connection role shares its name with an existing schema.
 *
-*  - **User context** — a request authenticated (or anonymous) via
-*    `driver.withAuth(user)`. Runs as the restricted `rebase_user` role: a
-*    non-owner, NOSUPERUSER, NOBYPASSRLS role, so Postgres RLS binds *every*
-*    statement (SELECT, INSERT, UPDATE, DELETE). The collection's
-*    `securityRules` are the whole authorization model; app-layer callbacks
-*    are validation/side-effects, not a security boundary.
+* Postgres resolves unqualified names through `search_path`, which defaults to
+* `"$user", public` — and `$user` is the connection ROLE. When a schema of that
+* name exists it sits ahead of `public`, so every unqualified statement
+* silently operates on it instead:
 *
-*  - **Server context** — the base (owner) connection: auth flows, migrations,
-*    background jobs, and the explicit `rebase.dataAsAdmin` accessor. As table
-*    owner it bypasses RLS. This is the trusted plane, equivalent to
-*    Supabase's `service_role`.
+*     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts
 *
-* This module provides the three pieces:
+* Nothing errors. You get a second table of the same name in the wrong schema,
+* and reads that pin `public` cannot see it — which reads as "missing table" and
+* sends people to re-run a push that creates a *third* copy. The bootstrapper
+* has a whole branch dedicated to recognising the symptom after the fact.
 *
-*  1. {@link detectConnectionPosture} — is the connection subject to RLS at
-*     all? (superuser / BYPASSRLS / table owner ⇒ no)
-*  2. {@link ensureAppRole} — idempotently provision `rebase_user` with
-*     SELECT/INSERT/UPDATE/DELETE grants (+ default privileges so future
-*     tables stay covered).
-*  3. {@link applyAuthContext} — per-transaction: set the `app.*` GUCs the
-*     policies read (`auth.uid()` etc.) and `SET LOCAL ROLE rebase_user` so
-*     RLS binds. Transaction-scoped, so it composes with poolers.
+* Rebase shipped straight into this: it creates a schema named `rebase` while
+* every template named the database role `rebase` too. The scaffold uses
+* `rebase_app` now, and every pool Rebase opens pins `search_path=public`
+* (`pinSearchPath`), which covers the paths the framework controls. This covers
+* the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,
+* a hand-written migration — because the hazard is a property of the two NAMES,
+* not of any one connection.
 *
-* Provisioning runs from the framework's own bootstrap/migrate (which already
-* self-creates the `auth` schema and functions) — enforcement is default-on,
-* not an operator opt-in.
+* A warning rather than a boot failure: the database works, the framework's own
+* traffic is pinned, and refusing to start over a naming choice a user may have
+* inherited would be worse than the risk.
 */
-/** The restricted role every authenticated (user-context) request runs as. */
-var REBASE_USER_ROLE = "rebase_user";
-var quoteIdent$1 = (name) => `"${name.replace(/"/g, "\"\"")}"`;
-/** DML the user role holds on managed tables (RLS still filters per row). */
-var USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
+async function warnOnRoleSchemaCollision(run) {
+	try {
+		const rows = await run(`
+            SELECT current_user AS role,
+                   EXISTS (
+                       SELECT 1 FROM pg_namespace n WHERE n.nspname = current_user
+                   ) AS collides
+        `);
+		if (rows[0]?.collides !== true) return;
+		const role = String(rows[0]?.role ?? "the connection role");
+		logger.warn(`⚠️  The database role "${role}" has the same name as a schema. Postgres resolves unqualified names through \`search_path\`, which defaults to \`"$user", public\` — so "${role}" is searched BEFORE public, and any unqualified \`CREATE TABLE\`/\`SELECT\` from a tool that does not pin the path (psql, pg_dump, drizzle-kit, a hand-written migration) silently lands in "${role}" instead. Rebase's own connections pin \`search_path=public\`, so the server is unaffected. To remove the hazard entirely, connect as a role whose name is not also a schema — the scaffold uses "rebase_app".`);
+	} catch {}
+}
 async function detectConnectionPosture(run) {
 	const row = (await run(`
         SELECT current_user            AS role,
@@ -4490,6 +4820,9 @@ async function ensureAppRole(run, schemas) {
 		await run(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
 		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);
 		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);
+		await revokeInternalTableAccess(async (text) => {
+			await run(text);
+		}, schema, { onError: (table, error) => logger.warn(`🔐 [rls] Could not revoke "${REBASE_USER_ROLE}" access to "${schema}"."${table}" — it stays reachable by authenticated requests: ` + (error instanceof Error ? error.message : String(error))) });
 	}
 	logger.info(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
 }
@@ -4575,6 +4908,40 @@ function warnOnAnonymousGrants(collections) {
 	logger.warn(`Security rules that read as a lockdown but grant access to anonymous requests. Every caller from a client carries a user id ('${ANONYMOUS_USER_ID}' when nobody is signed in), so these clauses are true for everyone:\n\n` + problems.join("\n\n") + "\n");
 }
 /**
+* Name the collections whose raw policy SQL still calls the pre-1.0 helpers.
+*
+* The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the
+* database, so nothing is broken and no policy is wrong — which is exactly why
+* this has to be said out loud. A silent rewrite that works forever is not a
+* migration, it is a second supported spelling nobody wrote down, and the next
+* person to read those rules will copy the old one.
+*
+* Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,
+* `policy.rolesOverlap(...)`) compile from the model and were never affected.
+*/
+function warnOnLegacyRlsFunctions(collections) {
+	const sites = [];
+	for (const collection of collections) for (const rule of collection.securityRules ?? []) {
+		const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+		if (![usingExpr, withCheckExpr].filter((e) => e !== null).some(containsLegacyRlsCall)) continue;
+		const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
+		if (!sites.includes(site)) sites.push(site);
+	}
+	if (sites.length === 0) return;
+	logger.warn(`These security rules call the pre-1.0 RLS helpers (\`auth.uid()\`, \`auth.roles()\`, \`auth.jwt()\`). They still work — the compiler rewrites them — but the functions now live in the \`rebase\` schema, and the \`auth\` one is Supabase's. Update the raw SQL in these rules to \`${REBASE_SCHEMA}.uid()\` and friends, or switch them to the structured helpers (\`policy.authUid()\`, \`policy.rolesOverlap()\`), which never had to be spelled by hand:\n\n` + sites.map((s) => `  • ${s}`).join("\n") + "\n");
+}
+/** Whether any `raw` expression in the tree calls a pre-1.0 helper. */
+function containsLegacyRlsCall(expr) {
+	switch (expr.kind) {
+		case "raw": return usesLegacyRlsFunctions(expr.sql);
+		case "and":
+		case "or": return expr.operands.some(containsLegacyRlsCall);
+		case "not": return containsLegacyRlsCall(expr.operand);
+		case "existsIn": return containsLegacyRlsCall(expr.where);
+		default: return false;
+	}
+}
+/**
 * Reject `pgRoles` that this server can never satisfy.
 *
 * `pgRoles` sets the `TO` clause of a generated policy, so a policy naming a
@@ -4704,6 +5071,25 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			}
 		};
 	}
+	/**
+	* Build the context handed to every collection callback.
+	*
+	* Note `data: this.data` — `this` is whichever driver is running the
+	* operation, so the callback's data plane inherits that driver's privilege.
+	* On a user request `AuthenticatedPostgresBackendDriver.withTransaction`
+	* constructs a fresh base driver bound to the RLS-scoped transaction and
+	* runs the operation on it, so `this.data` speaks through that connection
+	* and policies apply. On server-context work `this` is the base driver on
+	* the owner connection, and they do not. Pinned by the
+	* `"scopes context.data to the caller"` case in the `rls-enforcement` e2e
+	* suite, because it is the kind of property that is easy to break from a
+	* distance and impossible to notice.
+	*
+	* Previously returned through `as unknown as RebaseCallContext`, which
+	* disabled checking for the whole object and let `driver` — documented in
+	* the callbacks guide — sit on the runtime context while absent from the
+	* contract. Both are declared now, so this is a plain typed return.
+	*/
 	buildCallContext() {
 		return {
 			user: this.user,
@@ -5159,6 +5545,106 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			return saved;
 		});
 	}
+	/**
+	* Update many rows through the same pipeline as {@link save}, in one
+	* transaction.
+	*
+	* Structurally the mirror of {@link saveMany} — same tx-bound sub-driver,
+	* same deferred notifications, same per-row error labelling — but it calls
+	* `save` with an explicit `id` and `status: "existing"`, which is precisely
+	* what `saveMany` cannot do: that one passes `status: "new"` and keeps the
+	* key inside `values`, so it inserts or upserts and can never target a
+	* particular row.
+	*
+	* All-or-nothing, so an id matching no row aborts the batch. A partial
+	* update is the outcome with no good recovery: the caller cannot tell which
+	* half landed without re-reading everything.
+	*/
+	async updateMany({ path, updates, collection }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < updates.length; i++) {
+				const { id, values } = updates[i];
+				try {
+					if (!await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					saved.push(await txDriver.save({
+						path,
+						id: String(id),
+						values,
+						collection,
+						status: "existing"
+					}));
+				} catch (error) {
+					throw Object.assign(new Error(`Update ${i} of ${updates.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return saved;
+		});
+	}
+	/**
+	* Delete many rows in one transaction, running the full delete pipeline —
+	* `beforeDelete`, the delete, `afterDelete` — for each.
+	*
+	* Looping the single-row {@link delete} rather than emitting one
+	* `DELETE ... WHERE id = ANY($1)` is the deliberate choice: a single
+	* statement would be faster and would skip every callback, so a collection
+	* relying on `beforeDelete` to veto or on `afterDelete` to clean up
+	* dependents would behave differently depending on how many rows the caller
+	* happened to delete at once. Same pipeline, one transaction.
+	*/
+	async deleteMany({ path, ids, collection }) {
+		await this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			for (let i = 0; i < ids.length; i++) {
+				const id = ids[i];
+				try {
+					const existing = await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					});
+					if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					await txDriver.delete({
+						row: {
+							id: String(id),
+							path,
+							values: existing
+						},
+						collection
+					});
+				} catch (error) {
+					throw Object.assign(new Error(`Delete ${i} of ${ids.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+		});
+	}
 	async delete({ row, collection }) {
 		const targetPath = row.path;
 		const targetRow = { ...row.values ?? {} };
@@ -6123,11 +6609,13 @@ var computeSharedRelationName = (rel, sourceCollection, _collections) => {
 	}
 	return fallback;
 };
-var generateSchema = async (collections, stripPolicies = false) => {
+var generateSchema = async (allCollections, stripPolicies = false) => {
+	const collections = relationalCollections(allCollections);
 	let schemaContent = "// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\n\n";
 	const hasUuid = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "string" && (p.autoValue === "uuid" || p.isId === "uuid")));
 	const hasVector = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "vector"));
 	const hasBinary = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "binary"));
+	const hasSearch = collections.some((c) => buildSearchColumnSpec(c) !== void 0);
 	const pgCoreImports = [
 		"primaryKey",
 		"pgTable",
@@ -6152,7 +6640,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 	];
 	if (hasUuid) pgCoreImports.push("uuid");
 	if (hasVector) pgCoreImports.push("vector");
-	if (hasBinary) pgCoreImports.push("customType");
+	if (hasBinary || hasSearch) pgCoreImports.push("customType");
 	const uniqueSchemas = Array.from(new Set(collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)));
 	if (uniqueSchemas.length > 0) pgCoreImports.push("pgSchema");
 	schemaContent += `import { ${pgCoreImports.join(", ")} } from 'drizzle-orm/pg-core';\n`;
@@ -6234,6 +6722,11 @@ var generateSchema = async (collections, stripPolicies = false) => {
 				const columnString = getDrizzleColumn(propName, prop, collection, collections);
 				if (columnString) columns.add(columnString);
 			});
+			const searchSpec = buildSearchColumnSpec(collection);
+			if (searchSpec) {
+				columns.add(`    ${searchSpec.column}: customType({ dataType() { return 'tsvector'; } })("${searchSpec.column}").generatedAlwaysAs(sql\`${searchSpec.expression}\`)`);
+				if (searchSpec.fuzzy) columns.add(`    ${searchSpec.fuzzy.column}: text("${searchSpec.fuzzy.column}").generatedAlwaysAs(sql\`${searchSpec.fuzzy.expression}\`)`);
+			}
 			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: text(\"id\").primaryKey()");
 			schemaContent += `${Array.from(columns).join(",\n")}`;
 			const securityRules = getEffectiveSecurityRules(collection);
@@ -6937,6 +7430,8 @@ var ChannelHistoryStore = class {
                 last_seq BIGINT NOT NULL
             )
         `);
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")));
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")));
 		this.tablesReady = true;
 		logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
 	}
@@ -7120,6 +7615,7 @@ var ChannelPresenceStore = class {
             CREATE INDEX IF NOT EXISTS idx_channel_presence_last_seen
             ON rebase.channel_presence (last_seen)
         `);
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence")));
 		this.tablesReady = true;
 	}
 	/** Record (or refresh) a client's presence. */
@@ -7771,23 +8267,18 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				path: request.path,
 				collectionRequest: {
 					filter: request.filter,
+					logical: request.logical,
 					orderBy: request.orderBy,
 					order: request.order,
 					limit: boundedLimit,
+					offset: request.offset,
 					startAfter: request.startAfter,
 					databaseId: request.collection?.databaseId,
 					searchString: request.searchString
 				},
 				authContext
 			});
-			const rows = await this.fetchCollectionWithAuth(request.path, {
-				filter: request.filter,
-				orderBy: request.orderBy,
-				order: request.order,
-				limit: boundedLimit,
-				startAfter: request.startAfter,
-				searchString: request.searchString
-			}, authContext);
+			const rows = await this.fetchCollectionWithAuth(request.path, this._subscriptions.get(subscriptionId).collectionRequest, authContext);
 			this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
@@ -7971,6 +8462,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				});
 				else fetchedEntities = await txEntityService.fetchCollection(notifyPath, {
 					filter: collectionRequest.filter,
+					logical: collectionRequest.logical,
 					orderBy: collectionRequest.orderBy,
 					order: collectionRequest.order,
 					limit: collectionRequest.limit,
@@ -9086,7 +9578,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-CD8o_1Sl.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-Bww-Lg0s.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -9381,7 +9873,16 @@ function assertRelationsResolve(collections, registry) {
 	const defects = findRelationDefects(collections, registry);
 	if (defects.length === 0) return;
 	const lines = defects.map((d) => `  • ${d.collection}.${d.relationName} (${d.kind})\n      ${d.problem}\n      fix: ${d.fix}`);
-	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against the database schema.\n\nEach of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
+	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against \`backend/src/schema.generated.ts\`.
+
+Each of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
+
+If the database was migrated recently — an upgrade, a \`db push\`, a restore — this file is
+probably older than the schema it describes. Regenerate it before changing anything else:
+
+    rebase schema generate
+
+If it is already current, then the collection is what disagrees with it:
 
 ` + lines.join("\n\n") + "\n");
 }
@@ -9592,7 +10093,7 @@ async function ensureAuthTablesExist(db, collection) {
 			if (idProp) {
 				const isId = "isId" in idProp ? idProp.isId : void 0;
 				if (isId === "uuid") userIdType = "UUID";
-				else if (isId === "autoincrement") userIdType = "INTEGER";
+				else if (isId === "increment") userIdType = "INTEGER";
 			}
 		}
 		try {
@@ -9625,43 +10126,42 @@ async function ensureAuthTablesExist(db, collection) {
 		const emailLengthConstraint = `"${authIdentifier("email_length_check")}"`;
 		const emailLowerUniqueIndex = authIdentifier("email_lower_key");
 		const verificationTokenIndex = authIdentifier("email_verification_token_idx");
+		const usersColumnDdl = AUTH_USERS_COLUMNS.map((spec) => spec.column === "email" ? `${spec.column} ${authUsersColumnSql(spec)} CONSTRAINT ${emailLengthConstraint} CHECK (length(email) <= 320)` : `${spec.column} ${authUsersColumnSql(spec)}`).join(",\n                ");
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(usersTableName)} (
                 id ${sql.raw(userIdType)} PRIMARY KEY ${sql.raw(idDefault)},
-                email TEXT NOT NULL CONSTRAINT ${sql.raw(emailLengthConstraint)} CHECK (length(email) <= 320),
-                display_name TEXT,
-                photo_url TEXT,
-                roles TEXT[] DEFAULT '{}' NOT NULL,
-                password_hash TEXT,
-                email_verified BOOLEAN DEFAULT FALSE NOT NULL,
-                email_verification_token TEXT,
-                email_verification_sent_at TIMESTAMP WITH TIME ZONE,
-                is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
-                metadata JSONB DEFAULT '{}' NOT NULL,
-                tokens_valid_after TIMESTAMP WITH TIME ZONE,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
-                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
+                ${sql.raw(usersColumnDdl)}
             )
         `);
-		await db.execute(sql`
-            CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
-            BEGIN
-                IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
-                    NEW.uid := NEW.user_id;
-                ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
-                    NEW.user_id := NEW.uid;
-                END IF;
-                RETURN NEW;
-            END $$ LANGUAGE plpgsql
-        `);
-		for (const authTable of [
+		const legacyFkTables = [
 			"user_identities",
 			"refresh_tokens",
 			"password_reset_tokens",
 			"magic_link_tokens",
 			"mfa_factors",
 			"recovery_codes"
-		]) {
+		];
+		const legacyFkTableList = legacyFkTables.map((t) => `'${t}'`).join(", ");
+		const legacyUserIdPresent = await db.execute(sql`
+            SELECT 1
+            FROM information_schema.columns
+            WHERE table_schema = ${authSchema}
+              AND table_name IN (${sql.raw(legacyFkTableList)})
+              AND column_name = 'user_id'
+            LIMIT 1
+        `);
+		if (legacyUserIdPresent.rows.length > 0) await db.execute(sql`
+                CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
+                BEGIN
+                    IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
+                        NEW.uid := NEW.user_id;
+                    ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
+                        NEW.user_id := NEW.uid;
+                    END IF;
+                    RETURN NEW;
+                END $$ LANGUAGE plpgsql
+            `);
+		for (const authTable of legacyUserIdPresent.rows.length > 0 ? legacyFkTables : []) {
 			const qualified = `"${authSchema}"."${authTable}"`;
 			await db.execute(sql`
                 DO $$
@@ -9782,54 +10282,50 @@ async function ensureAuthTablesExist(db, collection) {
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
         `);
-		await db.execute(sql`CREATE SCHEMA IF NOT EXISTS auth`);
 		await db.transaction(async (tx) => {
 			await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$
-                    SELECT COALESCE(
-                        NULLIF(current_setting('app.uid', true), ''),
-                        NULLIF(current_setting('app.user_id', true), '')
-                    );
-                $$ LANGUAGE sql STABLE
-            `);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb AS $$
-                    SELECT COALESCE(
-                        NULLIF(current_setting('app.jwt', true), ''),
-                        '{}'
-                    )::jsonb;
-                $$ LANGUAGE sql STABLE
-            `);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.roles() RETURNS text AS $$
-                    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');
-                $$ LANGUAGE sql STABLE
-            `);
+			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await tx.execute(sql.raw(statement));
 		});
-		for (const columnDef of [
-			"display_name TEXT",
-			"photo_url TEXT",
-			"roles TEXT[] DEFAULT '{}' NOT NULL",
-			"password_hash TEXT",
-			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
-			"email_verification_token TEXT",
-			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
-			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
-			"metadata JSONB DEFAULT '{}' NOT NULL",
-			"tokens_valid_after TIMESTAMP WITH TIME ZONE",
-			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
-			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
-		]) await db.execute(sql`
+		for (const spec of AUTH_USERS_COLUMNS) {
+			if (spec.column === "email") continue;
+			await db.execute(sql`
                 ALTER TABLE ${sql.raw(usersTableName)}
-                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(`${spec.column} ${authUsersColumnSql(spec)}`)}
             `);
-		const usersColumns = await db.execute(sql`
-            SELECT column_name, data_type
+		}
+		const usersColumnRows = (await db.execute(sql`
+            SELECT column_name, data_type, is_nullable, column_default
             FROM information_schema.columns
             WHERE table_schema = ${usersSchema} AND table_name = ${resolvedTable}
-        `);
-		const usersColumnTypes = new Map(usersColumns.rows.map((row) => [row.column_name, row.data_type]));
+        `)).rows;
+		const usersColumnTypes = new Map(usersColumnRows.map((row) => [row.column_name, row.data_type]));
+		const usersColumnState = new Map(usersColumnRows.map((row) => [row.column_name, row]));
+		for (const spec of AUTH_USERS_COLUMNS) {
+			const state = usersColumnState.get(spec.column);
+			if (!state) continue;
+			if (spec.default !== void 0 && state.column_default === null) {
+				await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET DEFAULT ${sql.raw(spec.default)}
+                `);
+				logger.info(`🔧 Restored the default on ${usersTableName}.${spec.column}`);
+			}
+			if (!spec.notNull || state.is_nullable !== "YES") continue;
+			if (spec.default !== void 0) await db.execute(sql`
+                    UPDATE ${sql.raw(usersTableName)}
+                    SET ${sql.raw(`"${spec.column}"`)} = ${sql.raw(spec.default)}
+                    WHERE ${sql.raw(`"${spec.column}"`)} IS NULL
+                `);
+			try {
+				await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET NOT NULL
+                `);
+				logger.info(`🔧 Restored NOT NULL on ${usersTableName}.${spec.column}`);
+			} catch (err) {
+				logger.warn(`⚠️ ${usersTableName}.${spec.column} should be NOT NULL but still holds NULLs, so the constraint was not applied. Fill or remove those rows and restart: ` + (err instanceof Error ? err.message : String(err)));
+			}
+		}
 		for (const column of [
 			"email",
 			"display_name",
@@ -10011,10 +10507,12 @@ async function ensureAuthTablesExist(db, collection) {
 				[authSchema, "user_identities"],
 				[authSchema, "refresh_tokens"],
 				[authSchema, "password_reset_tokens"],
+				[authSchema, "magic_link_tokens"],
 				[authSchema, "app_config"],
 				[authSchema, "mfa_factors"],
 				[authSchema, "mfa_challenges"],
-				[authSchema, "recovery_codes"]
+				[authSchema, "recovery_codes"],
+				[authSchema, "schema_meta"]
 			];
 			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
                     SELECT 1
@@ -10034,6 +10532,9 @@ async function ensureAuthTablesExist(db, collection) {
 			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
 		}
 		await stampAuthSchemaVersion(db, authSchema);
+		await revokeInternalTableAccess(async (text) => {
+			await db.execute(sql.raw(text));
+		}, authSchema, { onError: (table, err) => logger.warn(`🔐 Could not revoke authenticated-role access to "${authSchema}"."${table}": ` + (err instanceof Error ? err.message : String(err))) });
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
 		if (error instanceof AuthSchemaVersionError) throw error;
@@ -11362,6 +11863,7 @@ async function ensureHistoryTableExists(db) {
             CREATE INDEX IF NOT EXISTS idx_history_time
             ON rebase.entity_history(table_name, entity_id, updated_at DESC)
         `);
+		await db.execute(sql.raw(revokeInternalTableSql("rebase", "entity_history")));
 		logger.info("✅ Entity history table ready");
 	} catch (error) {
 		logger.error("❌ Failed to create row history table", { error });
@@ -12083,12 +12585,12 @@ function createPostgresBootstrapper(pgConfig) {
 				const runSql = async (text) => {
 					return (await schemaAwareDb.execute(sql.raw(text))).rows ?? [];
 				};
+				await warnOnRoleSchemaCollision(runSql);
 				const posture = await detectConnectionPosture(runSql);
 				if (posture.privileged) {
 					await ensureAppRole(runSql, [
 						"public",
 						"rebase",
-						"auth",
 						...registry.getCollections().map((c) => c.schema).filter((s) => typeof s === "string")
 					]);
 					driver.rlsUserRole = REBASE_USER_ROLE;
@@ -12098,6 +12600,7 @@ function createPostgresBootstrapper(pgConfig) {
 				} else logger.info(`🔐 RLS enforcement: connection role "${posture.role}" is subject to RLS natively; no role switch needed.`);
 				await validatePolicyPgRoles(runSql, registry.getCollections(), driver.rlsUserRole ?? posture.role);
 				warnOnAnonymousGrants(registry.getCollections());
+				warnOnLegacyRlsFunctions(registry.getCollections());
 			}
 			if (driver.branchService) try {
 				await driver.branchService.ensureBranchMetadataTable();
@@ -12313,7 +12816,7 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CBQdOETu.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-CyMBc7wo.js");
 			const plan = await ensureCollectionTables({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
@@ -12338,13 +12841,24 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-ViG8XiPn.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-C8H7ig-m.js");
 			const outcome = await ensureCollectionPolicies({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
 			} }, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
 			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — it stays locked (denies) until this is resolved: ${failure.error}`);
+			try {
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-Bpv3nUZo.js").then((n) => n.n);
+				await dropLegacyAuthSchema(async (text) => {
+					return (await internals.db.execute(sql.raw(text))).rows ?? [];
+				}, {
+					info: (m) => logger.info(m),
+					warn: (m) => logger.warn(m)
+				});
+			} catch (err) {
+				logger.info("Left the legacy `auth` schema in place: " + (err instanceof Error ? err.message : String(err)));
+			}
 			return { applied: outcome.policiesApplied };
 		},
 		getAdmin(driverResult) {
@@ -12352,7 +12866,7 @@ function createPostgresBootstrapper(pgConfig) {
 		},
 		mountRoutes(app, basePath, driverResult) {},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			const { createPostgresWebSocket } = await import("./websocket-B2LsrINK.js").then((n) => n.n);
+			const { createPostgresWebSocket } = await import("./websocket-D0TBU3ia.js").then((n) => n.n);
 			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
 		}
 	};