@rebasepro/server-postgres 0.14.0 → 0.14.1-canary.g7e666eb

package/dist/index.es.js

@@ -3,16 +3,16 @@ import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
 import { n as resolveClientListLimit, t as ListLimitError } from "./data_driver-ULAyJEi9.js";
-import { A as getEnumVarName, B as createRelationRefWithData, C as getEffectiveSecurityRules, D as fieldKeyForColumn, F as getDeclaredPrimaryKeys, G as legacyForeignKeyName, H as updateDateAutoValues, I as isAddressableId, J as getPolicyNamesForRule, L as parseIdValues, M as getTableVarName, N as resolveCollectionRelations, O as findRelation, P as buildCompositeId, Q as toSnakeCase, R as sortCollectionsBySlug, S as resolveJunctionSpecs, T as securityRuleToConditions, U as firstFreeKey, V as normalizeToEntityRelation, W as generateForeignKeyName, X as mergeDeep, Y as isPrototypePollutingKey, Z as camelCase, _ as CollectionRegistry, b as getJunctionCollectionConfig, g as buildSdkData, h as visibleColumnProjection, j as getTableName$1, k as getColumnName, l as buildSearchColumnSpec, nt as isManyToMany, q as toWireKey, r as authUsersColumnSql, rt as Vector, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as hasForeignKeyOnTarget, u as hiddenColumnsOption, v as relationalCollections, w as policyToPostgres, x as getJunctionSecurityRules, y as resolveStringColumnLength, z as createRelationRef } from "./auth-users-columns-BfQHf9JE.js";
+import { $ as mergeDeep, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as isPrototypePollutingKey, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as toWireKey, Z as getPolicyNamesForRule, _ as OrderBySpecError, at as isManyToMany, b as CollectionRegistry, et as camelCase, g as buildSdkData, h as visibleColumnProjection, it as hasForeignKeyOnTarget, j as findRelation, l as buildSearchColumnSpec, ot as Vector, q as generateForeignKeyName, r as authUsersColumnSql, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as toSnakeCase, u as hiddenColumnsOption, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./auth-users-columns-C-FDnL_e.js";
 import { c as isPostgresCollectionConfig, f as ALL_WHERE_FILTER_OPS, l as isRelationalCollectionConfig } from "./src-DCdn3Val.js";
-import { t as createPostgresWebSocket } from "./websocket-C8ZqVBiV.js";
-import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-BJ_3wxwg.js";
+import { t as createPostgresWebSocket } from "./websocket-D2jXv0Ds.js";
+import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-gUNDfm7l.js";
 import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-BH0Dzo_h.js";
 import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-69hYT8nr.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
-import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, notInArray, or, relations, sql } from "drizzle-orm";
+import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isNotNull, isNull, isTable, lt, notInArray, or, relations, sql } from "drizzle-orm";
 import { PgArray, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs, { promises } from "fs";
 import path from "path";
@@ -3273,6 +3273,43 @@ var FetchService = class FetchService {
 		}
 		return this.resolveOrderByField(table, orderBy, collection);
 	}
+	/**
+	* Resolve every sort key to the expression it orders by, in order of
+	* significance.
+	*
+	* A key that resolves to nothing is dropped rather than skipping the rest:
+	* `resolveOrderByField` only *returns* undefined under the lenient
+	* unknown-field mode, where dropping is the configured answer, and dropping
+	* one key of several still honours the ones that did resolve.
+	*/
+	resolveOrderKeys(table, keys, collection, searchString) {
+		const resolved = [];
+		for (const [field, direction] of keys) {
+			const target = this.resolveOrderTarget(table, field, collection, searchString);
+			if (target) resolved.push({
+				field,
+				direction,
+				target
+			});
+		}
+		return resolved;
+	}
+	/**
+	* The full `ORDER BY`: the caller's keys, then the id.
+	*
+	* The id is always last and always descending. It is not decoration — it is
+	* what makes the ordering *total*, and a cursor over a non-total order
+	* repeats and skips rows among the ties. Every keyset comparison built by
+	* {@link buildCursorConditions} ends on the same `id DESC`, and the two have
+	* to agree: they did not, and an ascending sort paged with `id >` against an
+	* `ORDER BY … , id DESC`, so rows sharing a sort value were dropped from
+	* every page after the first.
+	*/
+	buildOrderExpressions(keys, idField) {
+		const expressions = keys.map(({ direction, target }) => direction === "asc" ? asc(target) : desc(target));
+		expressions.push(desc(idField));
+		return expressions;
+	}
 	resolveOrderByField(table, orderBy, collection) {
 		const columnAt = (key) => (key in table ? table[key] : void 0) || void 0;
 		const direct = columnAt(orderBy);
@@ -3434,14 +3471,9 @@ var FetchService = class FetchService {
 			if (cursorConditions.length > 0) allConditions.push(...cursorConditions);
 		}
 		if (allConditions.length > 0) queryOpts.where = and(...allConditions);
-		const orderExpressions = [];
-		if (options.orderBy) {
-			const collection = getCollectionByPath(collectionPath, this.registry);
-			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
-			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
-		}
-		orderExpressions.push(desc(idField));
-		if (orderExpressions.length > 0) queryOpts.orderBy = orderExpressions;
+		const orderKeys = normalizeDriverOrderBy(options.orderBy, options.order);
+		const resolvedOrder = orderKeys ? this.resolveOrderKeys(table, orderKeys, getCollectionByPath(collectionPath, this.registry), options.searchString) : [];
+		queryOpts.orderBy = this.buildOrderExpressions(resolvedOrder, idField);
 		const limitValue = options.searchString ? options.limit || 50 : options.limit;
 		if (limitValue) queryOpts.limit = limitValue;
 		if (options.offset && options.offset > 0) queryOpts.offset = options.offset;
@@ -3449,19 +3481,25 @@ var FetchService = class FetchService {
 	}
 	/**
 	* Extract cursor pagination conditions from startAfter options.
+	*
+	* "Every row that sorts after this one", written out as a comparison over
+	* the same keys the `ORDER BY` uses and ending on the same `id DESC`. With
+	* one key that is the familiar `k > v OR (k = v AND id < cursorId)`; with
+	* several it nests, each key's tie handing the decision to the next.
 	*/
 	buildCursorConditions(table, idField, idInfo, options, collectionPath) {
 		if (!options.startAfter) return [];
 		const cursor = options.startAfter;
-		if (options.orderBy) {
-			if (options.orderBy === FetchService.SCORE_FIELD) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with `orderBy: \"_score\"`. Relevance is computed per query rather than stored, so it cannot key a cursor. Use `limit`/`offset` for relevance-ordered pages, or order by a column.", "SCORE_CURSOR_UNSUPPORTED", { field: FetchService.SCORE_FIELD });
+		const keys = normalizeDriverOrderBy(options.orderBy, options.order);
+		if (keys) {
+			if (keys.some(([field]) => field === FetchService.SCORE_FIELD)) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with `orderBy: \"_score\"`. Relevance is computed per query rather than stored, so it cannot key a cursor. Use `limit`/`offset` for relevance-ordered pages, or order by a column.", "SCORE_CURSOR_UNSUPPORTED", { field: FetchService.SCORE_FIELD });
 			const collection = collectionPath ? getCollectionByPath(collectionPath, this.registry) : void 0;
-			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
-			if (orderByField) {
-				const startAfterOrderValue = cursor.values?.[options.orderBy] ?? cursor[options.orderBy];
-				const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
-				if (startAfterOrderValue !== void 0 && startAfterId !== void 0) if (options.order === "asc") return [or(gt(orderByField, startAfterOrderValue), and(eq(orderByField, startAfterOrderValue), gt(idField, startAfterId)))];
-				else return [or(lt(orderByField, startAfterOrderValue), and(eq(orderByField, startAfterOrderValue), lt(idField, startAfterId)))];
+			const resolved = this.resolveOrderKeys(table, keys, collection);
+			const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
+			if (resolved.length > 0 && startAfterId !== void 0) {
+				const cursorValues = cursor.values;
+				const values = resolved.map(({ field }) => cursorValues && field in cursorValues ? cursorValues[field] : cursor[field]);
+				if (values.every((value) => value !== void 0)) return [this.buildKeysetComparison(resolved, values, idField, startAfterId)];
 			}
 		} else {
 			const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
@@ -3470,6 +3508,28 @@ var FetchService = class FetchService {
 		return [];
 	}
 	/**
+	* "Sorts strictly after the cursor row", over `keys` and then the id.
+	*
+	* Built by recursion rather than as a row-value comparison — `(a, b) > (x, y)`
+	* would be shorter, but it is only correct when every key runs the same
+	* direction, and `roles ASC, created_at DESC` is exactly the case this
+	* exists to serve.
+	*
+	* NULLs are compared by the rule Postgres sorts them under (last ascending,
+	* first descending) rather than by `>`/`<`, which answer *unknown* against
+	* NULL and therefore match nothing. Ordering by a nullable column and paging
+	* used to drop every row whose sort value was NULL from page two onward.
+	*/
+	buildKeysetComparison(keys, values, idField, cursorId, index = 0) {
+		if (index >= keys.length) return lt(idField, cursorId);
+		const { direction } = keys[index];
+		const target = keys[index].target;
+		const value = values[index];
+		const rest = this.buildKeysetComparison(keys, values, idField, cursorId, index + 1);
+		if (value === null) return direction === "asc" ? and(isNull(target), rest) : or(isNotNull(target), and(isNull(target), rest));
+		return direction === "asc" ? or(gt(target, value), isNull(target), and(eq(target, value), rest)) : or(lt(target, value), and(eq(target, value), rest));
+	}
+	/**
 	* Compile "rows reachable from this parent" into a `WHERE` condition on the
 	* target table, so a nested listing can run as an ordinary collection query.
 	*/
@@ -3632,14 +3692,8 @@ var FetchService = class FetchService {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
 			if (finalCondition) query = query.where(finalCondition);
 		}
-		const orderExpressions = [];
-		if (vectorMeta) orderExpressions.push(asc(vectorMeta.orderBy));
-		else if (options.orderBy) {
-			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
-			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
-		}
-		orderExpressions.push(desc(idField));
-		if (orderExpressions.length > 0) query = query.orderBy(...orderExpressions);
+		const orderExpressions = vectorMeta ? [asc(vectorMeta.orderBy), desc(idField)] : this.buildOrderExpressions(this.resolveOrderKeys(table, normalizeDriverOrderBy(options.orderBy, options.order) ?? [], collection, options.searchString), idField);
+		query = query.orderBy(...orderExpressions);
 		if (options.startAfter) {
 			const cursorConditions = this.buildCursorConditions(table, idField, idInfo, options, collectionPath);
 			if (cursorConditions.length > 0) {
@@ -3764,6 +3818,10 @@ var FetchService = class FetchService {
 			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, effectivePath, this.filterContext(effectivePath, table));
 			if (logicalCondition) allConditions.push(logicalCondition);
 		}
+		if (options.vectorSearch) {
+			const vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
+			if (vectorMeta.filter) allConditions.push(vectorMeta.filter);
+		}
 		if (allConditions.length > 0) {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
 			if (finalCondition) query = query.where(finalCondition);
@@ -3970,14 +4028,8 @@ var FetchService = class FetchService {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
 			if (finalCondition) query = query.where(finalCondition);
 		}
-		const orderExpressions = [];
-		if (vectorMeta) orderExpressions.push(asc(vectorMeta.orderBy));
-		else if (options.orderBy) {
-			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
-			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
-		}
-		orderExpressions.push(desc(idField));
-		if (orderExpressions.length > 0) query = query.orderBy(...orderExpressions);
+		const orderExpressions = vectorMeta ? [asc(vectorMeta.orderBy), desc(idField)] : this.buildOrderExpressions(this.resolveOrderKeys(table, normalizeDriverOrderBy(options.orderBy, options.order) ?? [], collection, options.searchString), idField);
+		query = query.orderBy(...orderExpressions);
 		const limitValue = options.vectorSearch ? options.limit || 10 : options.searchString ? options.limit || 50 : options.limit;
 		if (limitValue) query = query.limit(limitValue);
 		if (options.offset && options.offset > 0) query = query.offset(options.offset);
@@ -5605,11 +5657,12 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	async checkUniqueField(path, name, value, id, collection) {
 		return this.dataService.checkUniqueField(path, name, value, id, collection?.databaseId);
 	}
-	async count({ path, collection, filter, logical, searchString }) {
+	async count({ path, collection, filter, logical, searchString, vectorSearch }) {
 		return this.dataService.count(path, {
 			filter,
 			logical,
-			searchString
+			searchString,
+			vectorSearch
 		});
 	}
 	getTargetDb(databaseName) {
@@ -6464,8 +6517,25 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 };
 /**
 * Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
+*
+* The clause is SQL being written into a TypeScript file, so it has to survive
+* being read back as a template literal. Three characters do not:
+*
+* - `` ` `` closes the template early, and the rest of the clause becomes code.
+* - `${` opens an interpolation — the file stops compiling, or worse, compiles
+*   against whatever identifier happens to be in scope.
+* - `\` is an escape, and Drizzle's `sql` tag reads the *cooked* strings, not
+*   `.raw`. So a policy written as `email ~ '^admin\.user@corp\.com$'` reaches
+*   the database as `^admin.user@corp.com$`, where every `\.` now matches any
+*   character. A `USING` clause is a security boundary and that one silently
+*   widened it — the SQL file emitted by the DDL generator kept the backslashes
+*   while this path dropped them, so the two disagreed about who could read the
+*   table.
+*
+* Escaping here rather than in the compiler: the clause is correct SQL, and it
+* is only this destination that has an opinion about backslashes.
 */
-var wrapSql = (clause) => `sql\`${clause}\``;
+var wrapSql = (clause) => `sql\`${clause.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${")}\``;
 var generatePolicyCode = (collection, rule, index, resolveCollection) => {
 	const tableName = getTableName$1(collection);
 	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
@@ -7112,8 +7182,10 @@ var PgNotifyListener = class {
 	}
 	async connect({ initial = false } = {}) {
 		const { connectionString, channel, onPayload, logLabel } = this.options;
+		let pending;
 		try {
 			const client = new Client({ connectionString });
+			pending = client;
 			client.on("error", (err) => {
 				logger.error(`❌ ${logLabel} LISTEN client error`, { detail: err.message });
 				this.scheduleReconnect();
@@ -7131,8 +7203,12 @@ var PgNotifyListener = class {
 			await client.connect();
 			await client.query(`LISTEN ${channel}`);
 			this.client = client;
+			pending = void 0;
 			logger.debug(`📡 ${logLabel} Listening on channel "${channel}".`);
 		} catch (err) {
+			if (pending) try {
+				await pending.end();
+			} catch {}
 			if (initial) throw err;
 			logger.error(`❌ ${logLabel} Failed to connect LISTEN client`, { error: err });
 			this.scheduleReconnect();
@@ -8098,9 +8174,40 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	get subscriptions() {
 		return this._subscriptions;
 	}
+	/**
+	* Claim a delivery slot for a subscription, before doing the work.
+	*
+	* Returns the check to run immediately before delivering. It refuses in
+	* three cases, all of which used to deliver:
+	*
+	* - **Out of order.** A newer refetch has already delivered, so this one is
+	*   stale — the subscriber would go back to the state before the change.
+	* - **Unsubscribed.** The subscription was cancelled while the fetch was in
+	*   flight. The `has(subscriptionId)` check the debounced refetches ran
+	*   *before* the await cannot answer this; only a check after it can.
+	* - **Replaced.** The same id can name a *different* subscription by the
+	*   time a fetch lands — a re-subscribe overwrites the map entry, and the
+	*   old filter's rows would be delivered to the new subscriber.
+	*
+	* The last two are identity, not presence: the map has to still hold *this
+	* exact object*, not merely something under this id.
+	*/
+	beginDelivery(subscriptionId, subscription) {
+		const seq = ++subscription.started;
+		return () => {
+			if (this._subscriptions.get(subscriptionId) !== subscription) return false;
+			if (seq <= subscription.delivered) return false;
+			subscription.delivered = seq;
+			return true;
+		};
+	}
 	registerDataDriverSubscription(subscriptionId, subscription) {
 		this.debugLog("📋 [RealtimeService] Registering DataDriver subscription:", subscriptionId, subscription.authContext ? "(with auth)" : "(no auth)");
-		this._subscriptions.set(subscriptionId, subscription);
+		this._subscriptions.set(subscriptionId, {
+			...subscription,
+			started: 0,
+			delivered: 0
+		});
 	}
 	addSubscriptionCallback(subscriptionId, callback) {
 		this.debugLog("📋 [RealtimeService] Adding callback for subscription:", subscriptionId);
@@ -8127,7 +8234,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				databaseId: config.databaseId,
 				searchString: config.searchString,
 				searchExplain: config.searchExplain
-			}
+			},
+			started: 0,
+			delivered: 0
 		});
 		if (callback) this.subscriptionCallbacks.set(subscriptionId, callback);
 	}
@@ -8139,7 +8248,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			clientId: config.clientId,
 			type: "single",
 			path: config.path,
-			id: config.id
+			id: config.id,
+			started: 0,
+			delivered: 0
 		});
 		if (callback) this.subscriptionCallbacks.set(subscriptionId, callback);
 	}
@@ -8242,14 +8353,23 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				this.sendError(clientId, e.message, subscriptionId, "INVALID_LIMIT");
 				return;
 			}
-			this._subscriptions.set(subscriptionId, {
+			let orderBy;
+			try {
+				orderBy = parseOrderBySpecStrict(request.orderBy, request.order);
+			} catch (e) {
+				if (!(e instanceof OrderBySpecError)) throw e;
+				logger.warn(`[RealtimeService] Refused subscription to '${request.path}': ${e.message}`);
+				this.sendError(clientId, e.message, subscriptionId, e.code);
+				return;
+			}
+			const subscription = {
 				clientId,
 				type: "collection",
 				path: request.path,
 				collectionRequest: {
 					filter: request.filter,
 					logical: request.logical,
-					orderBy: request.orderBy,
+					orderBy,
 					order: request.order,
 					limit: boundedLimit,
 					offset: request.offset,
@@ -8258,10 +8378,14 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					searchString: request.searchString,
 					searchExplain: request.searchExplain
 				},
-				authContext
-			});
-			const rows = await this.fetchCollectionWithAuth(request.path, this._subscriptions.get(subscriptionId).collectionRequest, authContext);
-			this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
+				authContext,
+				started: 0,
+				delivered: 0
+			};
+			this._subscriptions.set(subscriptionId, subscription);
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
+			const rows = await this.fetchCollectionWithAuth(request.path, subscription.collectionRequest, authContext);
+			if (canDeliver()) this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
 			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -8277,15 +8401,19 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				this.sendError(clientId, msg, subscriptionId);
 				return;
 			}
-			this._subscriptions.set(subscriptionId, {
+			const subscription = {
 				clientId,
 				type: "single",
 				path: request.path,
 				id: request.id,
-				authContext
-			});
+				authContext,
+				started: 0,
+				delivered: 0
+			};
+			this._subscriptions.set(subscriptionId, subscription);
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			const row = await this.fetchEntityWithAuth(request.path, String(request.id), authContext);
-			this.sendSingleUpdate(clientId, subscriptionId, row || null);
+			if (canDeliver()) this.sendSingleUpdate(clientId, subscriptionId, row || null);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
 			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -8416,10 +8544,11 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (existing) clearTimeout(existing);
 		this.refetchTimers.set(timerKey, setTimeout(async () => {
 			this.refetchTimers.delete(timerKey);
-			if (!this._subscriptions.has(subscriptionId)) return;
+			if (this._subscriptions.get(subscriptionId) !== subscription) return;
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			try {
 				const rows = await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest, subscription.authContext);
-				this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath);
+				if (canDeliver()) this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath);
 			} catch (error) {
 				const sanitized = sanitizeErrorForClient(error, notifyPath);
 				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -8435,9 +8564,11 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (existing) clearTimeout(existing);
 		this.refetchTimers.set(timerKey, setTimeout(async () => {
 			this.refetchTimers.delete(timerKey);
-			if (!this._subscriptions.has(subscriptionId)) return;
+			if (this._subscriptions.get(subscriptionId) !== subscription) return;
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			try {
-				callback(await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest, subscription.authContext));
+				const rows = await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest, subscription.authContext);
+				if (canDeliver()) callback(rows);
 			} catch (error) {
 				logger.error(`❌ [RealtimeService] Error in debounced driver refetch for ${subscriptionId}`, { error });
 			}
@@ -8553,10 +8684,11 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (existing) clearTimeout(existing);
 		this.refetchTimers.set(timerKey, setTimeout(async () => {
 			this.refetchTimers.delete(timerKey);
-			if (!this._subscriptions.has(subscriptionId)) return;
+			if (this._subscriptions.get(subscriptionId) !== subscription) return;
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			try {
 				const row = await this.fetchEntityWithAuth(notifyPath, id, subscription.authContext);
-				this.sendSingleUpdate(subscription.clientId, subscriptionId, row || null);
+				if (canDeliver()) this.sendSingleUpdate(subscription.clientId, subscriptionId, row || null);
 			} catch (error) {
 				const sanitized = sanitizeErrorForClient(error, notifyPath);
 				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -8572,9 +8704,11 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (existing) clearTimeout(existing);
 		this.refetchTimers.set(timerKey, setTimeout(async () => {
 			this.refetchTimers.delete(timerKey);
-			if (!this._subscriptions.has(subscriptionId)) return;
+			if (this._subscriptions.get(subscriptionId) !== subscription) return;
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			try {
-				callback(await this.fetchEntityWithAuth(notifyPath, id, subscription.authContext) || null);
+				const row = await this.fetchEntityWithAuth(notifyPath, id, subscription.authContext);
+				if (canDeliver()) callback(row || null);
 			} catch (error) {
 				logger.error(`❌ [RealtimeService] Error in debounced row driver refetch for ${subscriptionId}`, { error });
 			}
@@ -9511,8 +9645,10 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	*/
 	async connectListenClient() {
 		if (!this.listenConnectionString) return;
+		let pending;
 		try {
 			const client = new Client({ connectionString: this.listenConnectionString });
+			pending = client;
 			client.on("error", (err) => {
 				logger.error("❌ [RealtimeService] LISTEN client error", { detail: err.message });
 				this.scheduleReconnect();
@@ -9551,8 +9687,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			await client.connect();
 			await client.query(`LISTEN ${PG_NOTIFY_CHANNEL}`);
 			this.listenClient = client;
+			pending = void 0;
 			this.debugLog(`📡 [RealtimeService] LISTEN client connected on channel "${PG_NOTIFY_CHANNEL}"`);
 		} catch (err) {
+			if (pending) try {
+				await pending.end();
+			} catch {}
 			logger.error("❌ [RealtimeService] Failed to connect LISTEN client", { error: err });
 			this.scheduleReconnect();
 		}
@@ -10873,10 +11013,25 @@ var UserService = class {
 		if (metadataKey in this.usersTable) payload[metadataKey] = remainingMetadata;
 		return payload;
 	}
+	/**
+	* @see UserRepository.createUser — an email already in use is a 409.
+	*
+	* The route checks first and answers 409; this is the same answer for the
+	* requests that get past the check, which two clicks on a signup button
+	* are enough to produce. `PersistService` has mapped `23505` to a conflict
+	* for collection writes since the layer that holds the SQLSTATE was made
+	* responsible for saying whose fault a failure is; the auth writes never
+	* got the same treatment and reached the client as "Internal Server Error".
+	*/
 	async createUser(data) {
 		const payload = this.mapPayload(data);
-		const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
-		return this.mapRowToUser(row);
+		try {
+			const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
+			return this.mapRowToUser(row);
+		} catch (error) {
+			if (extractPgError(error)?.code === "23505") throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
+			throw error;
+		}
 	}
 	async getUserById(id) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -13066,7 +13221,7 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CbvaGuVn.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-B1qKdXA4.js");
 			const plan = await ensureCollectionTables({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
@@ -13091,7 +13246,7 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-8vuu-n4r.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-BedO2aNX.js");
 			const outcome = await ensureCollectionPolicies({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
@@ -13119,7 +13274,7 @@ function createPostgresBootstrapper(pgConfig) {
 		},
 		mountRoutes(app, basePath, driverResult) {},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			const { createPostgresWebSocket } = await import("./websocket-C8ZqVBiV.js").then((n) => n.n);
+			const { createPostgresWebSocket } = await import("./websocket-D2jXv0Ds.js").then((n) => n.n);
 			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
 		}
 	};