@rebasepro/server-postgres 0.14.0 → 0.14.1

package/dist/index.es.js

@@ -3,16 +3,16 @@ import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
 import { n as resolveClientListLimit, t as ListLimitError } from "./data_driver-ULAyJEi9.js";
-import { A as getEnumVarName, B as createRelationRefWithData, C as getEffectiveSecurityRules, D as fieldKeyForColumn, F as getDeclaredPrimaryKeys, G as legacyForeignKeyName, H as updateDateAutoValues, I as isAddressableId, J as getPolicyNamesForRule, L as parseIdValues, M as getTableVarName, N as resolveCollectionRelations, O as findRelation, P as buildCompositeId, Q as toSnakeCase, R as sortCollectionsBySlug, S as resolveJunctionSpecs, T as securityRuleToConditions, U as firstFreeKey, V as normalizeToEntityRelation, W as generateForeignKeyName, X as mergeDeep, Y as isPrototypePollutingKey, Z as camelCase, _ as CollectionRegistry, b as getJunctionCollectionConfig, g as buildSdkData, h as visibleColumnProjection, j as getTableName$1, k as getColumnName, l as buildSearchColumnSpec, nt as isManyToMany, q as toWireKey, r as authUsersColumnSql, rt as Vector, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as hasForeignKeyOnTarget, u as hiddenColumnsOption, v as relationalCollections, w as policyToPostgres, x as getJunctionSecurityRules, y as resolveStringColumnLength, z as createRelationRef } from "./auth-users-columns-BfQHf9JE.js";
+import { $ as mergeDeep, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as isPrototypePollutingKey, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as toWireKey, Z as getPolicyNamesForRule, _ as OrderBySpecError, at as isManyToMany, b as CollectionRegistry, et as camelCase, g as buildSdkData, h as visibleColumnProjection, it as hasForeignKeyOnTarget, j as findRelation, l as buildSearchColumnSpec, ot as Vector, q as generateForeignKeyName, r as authUsersColumnSql, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as toSnakeCase, u as hiddenColumnsOption, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./auth-users-columns-C-FDnL_e.js";
 import { c as isPostgresCollectionConfig, f as ALL_WHERE_FILTER_OPS, l as isRelationalCollectionConfig } from "./src-DCdn3Val.js";
-import { t as createPostgresWebSocket } from "./websocket-C8ZqVBiV.js";
-import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-BJ_3wxwg.js";
+import { t as createPostgresWebSocket } from "./websocket-D2jXv0Ds.js";
+import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-gUNDfm7l.js";
 import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-BH0Dzo_h.js";
 import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-69hYT8nr.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
-import { ApiError, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
-import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, notInArray, or, relations, sql } from "drizzle-orm";
+import { ApiError, createDdlBootstrapper, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
+import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isNotNull, isNull, isTable, lt, notInArray, or, relations, sql } from "drizzle-orm";
 import { PgArray, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs, { promises } from "fs";
 import path from "path";
@@ -602,6 +602,31 @@ function getUnknownFilterFieldsMode() {
 	return defaultUnknownFilterFieldsMode;
 }
 /**
+* Split `metadata->address->>city` into its column and its path.
+*
+* The arrows are PostgREST's spelling and Postgres's own, so the filter reads
+* the same as the SQL it becomes — and, more usefully, the same as what someone
+* would have written by hand in the SQL console while working out what to ask
+* for. A field with no arrow is not a JSON path and returns `undefined`, which
+* leaves every existing filter on exactly the path it took before.
+*
+* Both arrows are accepted and mean the same thing here: the extraction is
+* always compiled to `->>` (text) at the leaf, because that is the only form a
+* comparison can be made against. `->` is allowed because people write it out
+* of habit, and refusing it would be pedantry about a distinction this layer
+* erases anyway.
+*/
+function parseJsonFieldPath(field) {
+	if (!field.includes("->")) return void 0;
+	const segments = field.split(/->>?/).map((s) => s.trim()).filter(Boolean);
+	if (segments.length < 2) return void 0;
+	const [columnKey, ...path] = segments;
+	return {
+		columnKey,
+		path
+	};
+}
+/**
 * Filter values may arrive as relation wire objects — `EntityRelation`
 * instances or their JSON form `{ __type: "relation", id, path }` — e.g. when
 * the admin filters a relation column. SQL comparisons need the raw id, so
@@ -762,6 +787,19 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 			kind: "column",
 			column: direct
 		};
+		const jsonPath = parseJsonFieldPath(field);
+		if (jsonPath) {
+			const base = columnAt(jsonPath.columnKey);
+			if (base) {
+				const meta = getColumnMeta(base);
+				if (meta.dataType !== "json" && meta.columnType !== "PgJsonb" && meta.columnType !== "PgJson") throw ApiError.badRequest(`Cannot filter inside "${jsonPath.columnKey}" — it is not a json or jsonb column.`, "INVALID_FILTER_FIELD");
+				return {
+					kind: "json",
+					column: base,
+					path: jsonPath.path
+				};
+			}
+		}
 		if (collection) {
 			const relation = resolveCollectionRelations(collection)[field];
 			if (relation?.kind === "belongsTo") {
@@ -841,7 +879,71 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 	}
 	/** Dispatch a resolved filter field onto the shape it actually compiles to. */
 	static compileFilterTarget(target, op, value, field, collectionPath) {
-		return target.kind === "column" ? this.buildSingleFilterCondition(target.column, op, value) : this.buildRelationFilterCondition(target.relation, op, value, target.sourceIdColumn, target.registry, field, collectionPath);
+		if (target.kind === "column") return this.buildSingleFilterCondition(target.column, op, value);
+		if (target.kind === "json") return this.buildJsonPathCondition(target.column, target.path, op, value);
+		return this.buildRelationFilterCondition(target.relation, op, value, target.sourceIdColumn, target.registry, field, collectionPath);
+	}
+	/**
+	* A comparison against a value extracted from a json/jsonb column.
+	*
+	* The path is walked with `->` and the leaf taken with `->>`, so what comes
+	* out is always **text**. That is the whole of the type story, and it is
+	* the part worth being explicit about, because the alternatives are all
+	* worse:
+	*
+	*  - text comparison alone makes `["<", 100]` compare lexically, where
+	*    `"9"` is greater than `"100"`;
+	*  - casting unconditionally makes every filter on a non-numeric value a
+	*    runtime `invalid input syntax for type numeric` — a 500 on a row whose
+	*    JSON simply holds a string.
+	*
+	* So the *filter value* decides. A number on an ordering comparison casts
+	* both sides to numeric; everything else compares as text, with booleans
+	* rendered the way `->>` renders them (`"true"` / `"false"`). A row whose
+	* JSON holds a non-numeric value at a path being compared numerically is
+	* excluded rather than fatal, which is what `IS NOT NULL`-style filtering
+	* means everywhere else in this file.
+	*
+	* The path segments are bound as parameters, never interpolated: they come
+	* from a query string, and `->>` takes a text parameter perfectly well.
+	*/
+	static buildJsonPathCondition(column, path, op, value) {
+		let expr = sql`${column}`;
+		for (const key of path.slice(0, -1)) expr = sql`${expr} -> ${key}`;
+		const leaf = sql`${expr} ->> ${path[path.length - 1]}`;
+		if (typeof value === "number" && (op === ">" || op === ">=" || op === "<" || op === "<=")) {
+			const numeric = sql`CASE WHEN ${leaf} ~ '^-?[0-9]+(\\.[0-9]+)?$' THEN (${leaf})::numeric END`;
+			switch (op) {
+				case ">": return sql`${numeric} > ${value}`;
+				case ">=": return sql`${numeric} >= ${value}`;
+				case "<": return sql`${numeric} < ${value}`;
+				case "<=": return sql`${numeric} <= ${value}`;
+			}
+		}
+		const asText = (v) => typeof v === "boolean" ? String(v) : String(v);
+		switch (op) {
+			case "==": return value === null || value === void 0 ? sql`${leaf} IS NULL` : sql`${leaf} = ${asText(value)}`;
+			case "!=": return value === null || value === void 0 ? sql`${leaf} IS NOT NULL` : sql`${leaf} != ${asText(value)}`;
+			case ">": return sql`${leaf} > ${asText(value)}`;
+			case ">=": return sql`${leaf} >= ${asText(value)}`;
+			case "<": return sql`${leaf} < ${asText(value)}`;
+			case "<=": return sql`${leaf} <= ${asText(value)}`;
+			case "like": return sql`${leaf} LIKE ${asText(value)}`;
+			case "ilike": return sql`${leaf} ILIKE ${asText(value)}`;
+			case "not-like": return sql`${leaf} NOT LIKE ${asText(value)}`;
+			case "not-ilike": return sql`${leaf} NOT ILIKE ${asText(value)}`;
+			case "is-null": return sql`${leaf} IS NULL`;
+			case "is-not-null": return sql`${leaf} IS NOT NULL`;
+			case "in":
+			case "not-in": {
+				if (value === null || value === void 0) return op === "in" ? sql`${leaf} IS NULL` : sql`${leaf} IS NOT NULL`;
+				const values = toMembershipList(value).map(asText);
+				if (values.length === 0) return op === "in" ? sql`FALSE` : sql`TRUE`;
+				const list = sql.join(values.map((v) => sql`${v}`), sql`, `);
+				return op === "in" ? sql`${leaf} IN (${list})` : sql`${leaf} NOT IN (${list})`;
+			}
+			default: throw ApiError.badRequest(`Operator "${op}" is not supported on a JSON path. Use it on the column itself.`, "INVALID_FILTER_OPERATOR");
+		}
 	}
 	/**
 	* A filter on a relation that owns no column on this row — `EXISTS` over
@@ -3273,6 +3375,43 @@ var FetchService = class FetchService {
 		}
 		return this.resolveOrderByField(table, orderBy, collection);
 	}
+	/**
+	* Resolve every sort key to the expression it orders by, in order of
+	* significance.
+	*
+	* A key that resolves to nothing is dropped rather than skipping the rest:
+	* `resolveOrderByField` only *returns* undefined under the lenient
+	* unknown-field mode, where dropping is the configured answer, and dropping
+	* one key of several still honours the ones that did resolve.
+	*/
+	resolveOrderKeys(table, keys, collection, searchString) {
+		const resolved = [];
+		for (const [field, direction] of keys) {
+			const target = this.resolveOrderTarget(table, field, collection, searchString);
+			if (target) resolved.push({
+				field,
+				direction,
+				target
+			});
+		}
+		return resolved;
+	}
+	/**
+	* The full `ORDER BY`: the caller's keys, then the id.
+	*
+	* The id is always last and always descending. It is not decoration — it is
+	* what makes the ordering *total*, and a cursor over a non-total order
+	* repeats and skips rows among the ties. Every keyset comparison built by
+	* {@link buildCursorConditions} ends on the same `id DESC`, and the two have
+	* to agree: they did not, and an ascending sort paged with `id >` against an
+	* `ORDER BY … , id DESC`, so rows sharing a sort value were dropped from
+	* every page after the first.
+	*/
+	buildOrderExpressions(keys, idField) {
+		const expressions = keys.map(({ direction, target }) => direction === "asc" ? asc(target) : desc(target));
+		expressions.push(desc(idField));
+		return expressions;
+	}
 	resolveOrderByField(table, orderBy, collection) {
 		const columnAt = (key) => (key in table ? table[key] : void 0) || void 0;
 		const direct = columnAt(orderBy);
@@ -3434,14 +3573,9 @@ var FetchService = class FetchService {
 			if (cursorConditions.length > 0) allConditions.push(...cursorConditions);
 		}
 		if (allConditions.length > 0) queryOpts.where = and(...allConditions);
-		const orderExpressions = [];
-		if (options.orderBy) {
-			const collection = getCollectionByPath(collectionPath, this.registry);
-			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
-			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
-		}
-		orderExpressions.push(desc(idField));
-		if (orderExpressions.length > 0) queryOpts.orderBy = orderExpressions;
+		const orderKeys = normalizeDriverOrderBy(options.orderBy, options.order);
+		const resolvedOrder = orderKeys ? this.resolveOrderKeys(table, orderKeys, getCollectionByPath(collectionPath, this.registry), options.searchString) : [];
+		queryOpts.orderBy = this.buildOrderExpressions(resolvedOrder, idField);
 		const limitValue = options.searchString ? options.limit || 50 : options.limit;
 		if (limitValue) queryOpts.limit = limitValue;
 		if (options.offset && options.offset > 0) queryOpts.offset = options.offset;
@@ -3449,19 +3583,25 @@ var FetchService = class FetchService {
 	}
 	/**
 	* Extract cursor pagination conditions from startAfter options.
+	*
+	* "Every row that sorts after this one", written out as a comparison over
+	* the same keys the `ORDER BY` uses and ending on the same `id DESC`. With
+	* one key that is the familiar `k > v OR (k = v AND id < cursorId)`; with
+	* several it nests, each key's tie handing the decision to the next.
 	*/
 	buildCursorConditions(table, idField, idInfo, options, collectionPath) {
 		if (!options.startAfter) return [];
 		const cursor = options.startAfter;
-		if (options.orderBy) {
-			if (options.orderBy === FetchService.SCORE_FIELD) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with `orderBy: \"_score\"`. Relevance is computed per query rather than stored, so it cannot key a cursor. Use `limit`/`offset` for relevance-ordered pages, or order by a column.", "SCORE_CURSOR_UNSUPPORTED", { field: FetchService.SCORE_FIELD });
+		const keys = normalizeDriverOrderBy(options.orderBy, options.order);
+		if (keys) {
+			if (keys.some(([field]) => field === FetchService.SCORE_FIELD)) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with `orderBy: \"_score\"`. Relevance is computed per query rather than stored, so it cannot key a cursor. Use `limit`/`offset` for relevance-ordered pages, or order by a column.", "SCORE_CURSOR_UNSUPPORTED", { field: FetchService.SCORE_FIELD });
 			const collection = collectionPath ? getCollectionByPath(collectionPath, this.registry) : void 0;
-			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
-			if (orderByField) {
-				const startAfterOrderValue = cursor.values?.[options.orderBy] ?? cursor[options.orderBy];
-				const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
-				if (startAfterOrderValue !== void 0 && startAfterId !== void 0) if (options.order === "asc") return [or(gt(orderByField, startAfterOrderValue), and(eq(orderByField, startAfterOrderValue), gt(idField, startAfterId)))];
-				else return [or(lt(orderByField, startAfterOrderValue), and(eq(orderByField, startAfterOrderValue), lt(idField, startAfterId)))];
+			const resolved = this.resolveOrderKeys(table, keys, collection);
+			const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
+			if (resolved.length > 0 && startAfterId !== void 0) {
+				const cursorValues = cursor.values;
+				const values = resolved.map(({ field }) => cursorValues && field in cursorValues ? cursorValues[field] : cursor[field]);
+				if (values.every((value) => value !== void 0)) return [this.buildKeysetComparison(resolved, values, idField, startAfterId)];
 			}
 		} else {
 			const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
@@ -3470,6 +3610,28 @@ var FetchService = class FetchService {
 		return [];
 	}
 	/**
+	* "Sorts strictly after the cursor row", over `keys` and then the id.
+	*
+	* Built by recursion rather than as a row-value comparison — `(a, b) > (x, y)`
+	* would be shorter, but it is only correct when every key runs the same
+	* direction, and `roles ASC, created_at DESC` is exactly the case this
+	* exists to serve.
+	*
+	* NULLs are compared by the rule Postgres sorts them under (last ascending,
+	* first descending) rather than by `>`/`<`, which answer *unknown* against
+	* NULL and therefore match nothing. Ordering by a nullable column and paging
+	* used to drop every row whose sort value was NULL from page two onward.
+	*/
+	buildKeysetComparison(keys, values, idField, cursorId, index = 0) {
+		if (index >= keys.length) return lt(idField, cursorId);
+		const { direction } = keys[index];
+		const target = keys[index].target;
+		const value = values[index];
+		const rest = this.buildKeysetComparison(keys, values, idField, cursorId, index + 1);
+		if (value === null) return direction === "asc" ? and(isNull(target), rest) : or(isNotNull(target), and(isNull(target), rest));
+		return direction === "asc" ? or(gt(target, value), isNull(target), and(eq(target, value), rest)) : or(lt(target, value), and(eq(target, value), rest));
+	}
+	/**
 	* Compile "rows reachable from this parent" into a `WHERE` condition on the
 	* target table, so a nested listing can run as an ordinary collection query.
 	*/
@@ -3632,14 +3794,8 @@ var FetchService = class FetchService {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
 			if (finalCondition) query = query.where(finalCondition);
 		}
-		const orderExpressions = [];
-		if (vectorMeta) orderExpressions.push(asc(vectorMeta.orderBy));
-		else if (options.orderBy) {
-			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
-			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
-		}
-		orderExpressions.push(desc(idField));
-		if (orderExpressions.length > 0) query = query.orderBy(...orderExpressions);
+		const orderExpressions = vectorMeta ? [asc(vectorMeta.orderBy), desc(idField)] : this.buildOrderExpressions(this.resolveOrderKeys(table, normalizeDriverOrderBy(options.orderBy, options.order) ?? [], collection, options.searchString), idField);
+		query = query.orderBy(...orderExpressions);
 		if (options.startAfter) {
 			const cursorConditions = this.buildCursorConditions(table, idField, idInfo, options, collectionPath);
 			if (cursorConditions.length > 0) {
@@ -3764,6 +3920,10 @@ var FetchService = class FetchService {
 			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, effectivePath, this.filterContext(effectivePath, table));
 			if (logicalCondition) allConditions.push(logicalCondition);
 		}
+		if (options.vectorSearch) {
+			const vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
+			if (vectorMeta.filter) allConditions.push(vectorMeta.filter);
+		}
 		if (allConditions.length > 0) {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
 			if (finalCondition) query = query.where(finalCondition);
@@ -3772,6 +3932,92 @@ var FetchService = class FetchService {
 		return Number(result[0]?.count || 0);
 	}
 	/**
+	* `count`/`sum`/`avg`/`min`/`max`, optionally grouped.
+	*
+	* The gap this fills is narrow and constant: every dashboard wants "revenue
+	* by status" and "orders per day", and without it the options were a custom
+	* function holding hand-written SQL, or fetching every row and reducing in
+	* JavaScript — which is wrong at any size that matters, and silently wrong
+	* under a `limit`.
+	*
+	* It runs through the same request-scoped handle as every other read, so
+	* **RLS applies to the rows being aggregated**. That is the property worth
+	* protecting here: an aggregate is an effective way to read data you cannot
+	* select, and `count(*)` over a table whose policies would return nothing
+	* has to be zero.
+	*/
+	async aggregate(collectionPath, options) {
+		const collection = getCollectionByPath(collectionPath, this.registry);
+		const table = getTableForCollection(collection, this.registry);
+		const columns = getTableColumns(table);
+		const columnFor = (field, forWhat) => {
+			const column = columns[field];
+			if (!column) throw ApiError.badRequest(`Unknown field '${field}' in ${forWhat}. Valid fields: ${Object.keys(columns).sort().join(", ")}`, "UNKNOWN_AGGREGATE_FIELD");
+			return column;
+		};
+		const selection = {};
+		for (const aggregate of options.aggregates) {
+			if (aggregate.fn === "count" && !aggregate.field) {
+				selection[aggregate.alias] = sql`count(*)`;
+				continue;
+			}
+			const column = columnFor(aggregate.field, `${aggregate.fn}()`);
+			switch (aggregate.fn) {
+				case "count":
+					selection[aggregate.alias] = sql`count(${column})`;
+					break;
+				case "sum":
+					selection[aggregate.alias] = sql`sum(${column})::numeric`;
+					break;
+				case "avg":
+					selection[aggregate.alias] = sql`avg(${column})::numeric`;
+					break;
+				case "min":
+					selection[aggregate.alias] = sql`min(${column})`;
+					break;
+				case "max":
+					selection[aggregate.alias] = sql`max(${column})`;
+					break;
+			}
+		}
+		const groupColumns = (options.groupBy ?? []).map((field) => ({
+			field,
+			column: columnFor(field, "groupBy")
+		}));
+		for (const group of groupColumns) selection[group.field] = sql`${group.column}`;
+		let query = this.db.select(selection).from(table).$dynamic();
+		const conditions = [];
+		if (options.searchString) {
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
+			if (searchConditions.length === 0) return [];
+			conditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
+		}
+		if (options.filter) conditions.push(...this.buildFilterConditions(options.filter, table, collectionPath));
+		if (options.logical) {
+			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
+			if (logicalCondition) conditions.push(logicalCondition);
+		}
+		if (conditions.length > 0) {
+			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(conditions);
+			if (finalCondition) query = query.where(finalCondition);
+		}
+		if (groupColumns.length > 0) {
+			query = query.groupBy(...groupColumns.map((g) => g.column));
+			if (options.limit) query = query.limit(options.limit);
+		}
+		const rows = await query;
+		const numericAliases = new Set(options.aggregates.filter((a) => a.fn === "count" || a.fn === "sum" || a.fn === "avg").map((a) => a.alias));
+		return rows.map((row) => {
+			const out = { ...row };
+			for (const alias of numericAliases) {
+				if (out[alias] === null || out[alias] === void 0) continue;
+				const parsed = Number(out[alias]);
+				if (!Number.isNaN(parsed)) out[alias] = parsed;
+			}
+			return out;
+		});
+	}
+	/**
 	* Check if a field value is unique
 	*/
 	async checkUniqueField(collectionPath, fieldName, value, excludeEntityId, _databaseId) {
@@ -3970,14 +4216,8 @@ var FetchService = class FetchService {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
 			if (finalCondition) query = query.where(finalCondition);
 		}
-		const orderExpressions = [];
-		if (vectorMeta) orderExpressions.push(asc(vectorMeta.orderBy));
-		else if (options.orderBy) {
-			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
-			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
-		}
-		orderExpressions.push(desc(idField));
-		if (orderExpressions.length > 0) query = query.orderBy(...orderExpressions);
+		const orderExpressions = vectorMeta ? [asc(vectorMeta.orderBy), desc(idField)] : this.buildOrderExpressions(this.resolveOrderKeys(table, normalizeDriverOrderBy(options.orderBy, options.order) ?? [], collection, options.searchString), idField);
+		query = query.orderBy(...orderExpressions);
 		const limitValue = options.vectorSearch ? options.limit || 10 : options.searchString ? options.limit || 50 : options.limit;
 		if (limitValue) query = query.limit(limitValue);
 		if (options.offset && options.offset > 0) query = query.offset(options.offset);
@@ -5605,11 +5845,12 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	async checkUniqueField(path, name, value, id, collection) {
 		return this.dataService.checkUniqueField(path, name, value, id, collection?.databaseId);
 	}
-	async count({ path, collection, filter, logical, searchString }) {
+	async count({ path, collection, filter, logical, searchString, vectorSearch }) {
 		return this.dataService.count(path, {
 			filter,
 			logical,
-			searchString
+			searchString,
+			vectorSearch
 		});
 	}
 	getTargetDb(databaseName) {
@@ -6464,8 +6705,25 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 };
 /**
 * Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
+*
+* The clause is SQL being written into a TypeScript file, so it has to survive
+* being read back as a template literal. Three characters do not:
+*
+* - `` ` `` closes the template early, and the rest of the clause becomes code.
+* - `${` opens an interpolation — the file stops compiling, or worse, compiles
+*   against whatever identifier happens to be in scope.
+* - `\` is an escape, and Drizzle's `sql` tag reads the *cooked* strings, not
+*   `.raw`. So a policy written as `email ~ '^admin\.user@corp\.com$'` reaches
+*   the database as `^admin.user@corp.com$`, where every `\.` now matches any
+*   character. A `USING` clause is a security boundary and that one silently
+*   widened it — the SQL file emitted by the DDL generator kept the backslashes
+*   while this path dropped them, so the two disagreed about who could read the
+*   table.
+*
+* Escaping here rather than in the compiler: the clause is correct SQL, and it
+* is only this destination that has an opinion about backslashes.
 */
-var wrapSql = (clause) => `sql\`${clause}\``;
+var wrapSql = (clause) => `sql\`${clause.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${")}\``;
 var generatePolicyCode = (collection, rule, index, resolveCollection) => {
 	const tableName = getTableName$1(collection);
 	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
@@ -7112,8 +7370,10 @@ var PgNotifyListener = class {
 	}
 	async connect({ initial = false } = {}) {
 		const { connectionString, channel, onPayload, logLabel } = this.options;
+		let pending;
 		try {
 			const client = new Client({ connectionString });
+			pending = client;
 			client.on("error", (err) => {
 				logger.error(`❌ ${logLabel} LISTEN client error`, { detail: err.message });
 				this.scheduleReconnect();
@@ -7131,8 +7391,12 @@ var PgNotifyListener = class {
 			await client.connect();
 			await client.query(`LISTEN ${channel}`);
 			this.client = client;
+			pending = void 0;
 			logger.debug(`📡 ${logLabel} Listening on channel "${channel}".`);
 		} catch (err) {
+			if (pending) try {
+				await pending.end();
+			} catch {}
 			if (initial) throw err;
 			logger.error(`❌ ${logLabel} Failed to connect LISTEN client`, { error: err });
 			this.scheduleReconnect();
@@ -7229,6 +7493,29 @@ var CdcListener = class {
 	}
 };
 //#endregion
+//#region src/schema/drizzle-ddl.ts
+/**
+* The server's DDL bootstrapper, over a Drizzle handle.
+*
+* `createDdlBootstrapper` in `@rebasepro/server` wants a plain
+* `(sql: string) => Promise<rows>`; the driver's internal stores hold a Drizzle
+* database. This is the adapter between them, and it exists so the retry policy
+* has exactly one definition. A second copy of the SQLSTATE list living in the
+* driver is how the two drift apart, and the drift is invisible: both versions
+* work perfectly on every single-instance deployment.
+*/
+/**
+* A {@link DdlBootstrapper} that runs its statements through `db.execute`.
+*
+* @param db    the Drizzle handle the calling store already holds
+* @param scope log prefix identifying the caller, e.g. `"channel-presence"`
+*/
+function drizzleDdlBootstrapper(db, scope) {
+	return createDdlBootstrapper(async (statement) => {
+		return (await db.execute(sql.raw(statement))).rows ?? [];
+	}, scope);
+}
+//#endregion
 //#region src/services/channel-history.ts
 /**
 * Ordered, replayable per-channel message history.
@@ -7364,8 +7651,9 @@ var ChannelHistoryStore = class {
 	*/
 	async ensureTables() {
 		if (!this.enabled || this.tablesReady) return;
-		await this.db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
-		await this.db.execute(sql`
+		const ddl = drizzleDdlBootstrapper(this.db, "channel-history");
+		await ddl.ensureObject("rebase schema", "CREATE SCHEMA IF NOT EXISTS rebase");
+		await ddl.ensureObject("channel_messages table", `
             CREATE TABLE IF NOT EXISTS rebase.channel_messages (
                 channel TEXT NOT NULL,
                 seq BIGINT NOT NULL,
@@ -7376,18 +7664,23 @@ var ChannelHistoryStore = class {
                 PRIMARY KEY (channel, seq)
             )
         `);
-		await this.db.execute(sql`
+		await ddl.ensureObject("channel_messages created_at index", `
             CREATE INDEX IF NOT EXISTS idx_channel_messages_created
             ON rebase.channel_messages (created_at)
         `);
-		await this.db.execute(sql`
+		await ddl.ensureObject("channel_cursors table", `
             CREATE TABLE IF NOT EXISTS rebase.channel_cursors (
                 channel TEXT PRIMARY KEY,
                 last_seq BIGINT NOT NULL
             )
         `);
-		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")));
-		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")));
+		const [messagesReady, cursorsReady] = await Promise.all([ddl.isReadable("rebase.channel_messages"), ddl.isReadable("rebase.channel_cursors")]);
+		if (messagesReady) await ddl.step("channel_messages revoke", () => this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages"))));
+		if (cursorsReady) await ddl.step("channel_cursors revoke", () => this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors"))));
+		if (!messagesReady || !cursorsReady) {
+			logger.warn("[ChannelHistory] Retained-channel tables are not both present; history is not ready yet.");
+			return;
+		}
 		this.tablesReady = true;
 		logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
 	}
@@ -7553,11 +7846,27 @@ var ChannelPresenceStore = class {
 		this.db = db;
 		this.instanceId = instanceId;
 	}
-	/** Create the roster table. Idempotent. */
+	/**
+	* Create the roster table. Idempotent, and safe to run on every instance at
+	* once.
+	*
+	* Written as separate contained steps rather than one straight sequence for
+	* a reason that only bites with more than one replica, which is exactly the
+	* deployment shape this table exists to serve: `CREATE … IF NOT EXISTS`
+	* reads the catalog and then writes to it non-atomically, so peers booting
+	* together collide, and the loser used to abandon everything after it —
+	* including the trailing `REVOKE`. That revoke is the only thing keeping the
+	* roster off the end-user role, so losing a boot race silently left the
+	* whole channel roster readable by every signed-in user.
+	*
+	* `tablesReady` is now set from a probe of what exists, not from having been
+	* the instance that created it.
+	*/
 	async ensureTables() {
 		if (this.tablesReady) return;
-		await this.db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
-		await this.db.execute(sql`
+		const ddl = drizzleDdlBootstrapper(this.db, "channel-presence");
+		await ddl.ensureObject("rebase schema", "CREATE SCHEMA IF NOT EXISTS rebase");
+		await ddl.ensureObject("channel_presence table", `
             CREATE TABLE IF NOT EXISTS rebase.channel_presence (
                 channel TEXT NOT NULL,
                 client_id TEXT NOT NULL,
@@ -7567,12 +7876,14 @@ var ChannelPresenceStore = class {
                 PRIMARY KEY (channel, client_id)
             )
         `);
-		await this.db.execute(sql`
+		await ddl.ensureObject("channel_presence last_seen index", `
             CREATE INDEX IF NOT EXISTS idx_channel_presence_last_seen
             ON rebase.channel_presence (last_seen)
         `);
-		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence")));
-		this.tablesReady = true;
+		if (await ddl.isReadable("rebase.channel_presence")) {
+			await ddl.step("channel_presence revoke", () => this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence"))));
+			this.tablesReady = true;
+		}
 	}
 	/** Record (or refresh) a client's presence. */
 	async track(channel, clientId, state) {
@@ -8098,9 +8409,40 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	get subscriptions() {
 		return this._subscriptions;
 	}
+	/**
+	* Claim a delivery slot for a subscription, before doing the work.
+	*
+	* Returns the check to run immediately before delivering. It refuses in
+	* three cases, all of which used to deliver:
+	*
+	* - **Out of order.** A newer refetch has already delivered, so this one is
+	*   stale — the subscriber would go back to the state before the change.
+	* - **Unsubscribed.** The subscription was cancelled while the fetch was in
+	*   flight. The `has(subscriptionId)` check the debounced refetches ran
+	*   *before* the await cannot answer this; only a check after it can.
+	* - **Replaced.** The same id can name a *different* subscription by the
+	*   time a fetch lands — a re-subscribe overwrites the map entry, and the
+	*   old filter's rows would be delivered to the new subscriber.
+	*
+	* The last two are identity, not presence: the map has to still hold *this
+	* exact object*, not merely something under this id.
+	*/
+	beginDelivery(subscriptionId, subscription) {
+		const seq = ++subscription.started;
+		return () => {
+			if (this._subscriptions.get(subscriptionId) !== subscription) return false;
+			if (seq <= subscription.delivered) return false;
+			subscription.delivered = seq;
+			return true;
+		};
+	}
 	registerDataDriverSubscription(subscriptionId, subscription) {
 		this.debugLog("📋 [RealtimeService] Registering DataDriver subscription:", subscriptionId, subscription.authContext ? "(with auth)" : "(no auth)");
-		this._subscriptions.set(subscriptionId, subscription);
+		this._subscriptions.set(subscriptionId, {
+			...subscription,
+			started: 0,
+			delivered: 0
+		});
 	}
 	addSubscriptionCallback(subscriptionId, callback) {
 		this.debugLog("📋 [RealtimeService] Adding callback for subscription:", subscriptionId);
@@ -8127,7 +8469,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				databaseId: config.databaseId,
 				searchString: config.searchString,
 				searchExplain: config.searchExplain
-			}
+			},
+			started: 0,
+			delivered: 0
 		});
 		if (callback) this.subscriptionCallbacks.set(subscriptionId, callback);
 	}
@@ -8139,7 +8483,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			clientId: config.clientId,
 			type: "single",
 			path: config.path,
-			id: config.id
+			id: config.id,
+			started: 0,
+			delivered: 0
 		});
 		if (callback) this.subscriptionCallbacks.set(subscriptionId, callback);
 	}
@@ -8242,14 +8588,23 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				this.sendError(clientId, e.message, subscriptionId, "INVALID_LIMIT");
 				return;
 			}
-			this._subscriptions.set(subscriptionId, {
+			let orderBy;
+			try {
+				orderBy = parseOrderBySpecStrict(request.orderBy, request.order);
+			} catch (e) {
+				if (!(e instanceof OrderBySpecError)) throw e;
+				logger.warn(`[RealtimeService] Refused subscription to '${request.path}': ${e.message}`);
+				this.sendError(clientId, e.message, subscriptionId, e.code);
+				return;
+			}
+			const subscription = {
 				clientId,
 				type: "collection",
 				path: request.path,
 				collectionRequest: {
 					filter: request.filter,
 					logical: request.logical,
-					orderBy: request.orderBy,
+					orderBy,
 					order: request.order,
 					limit: boundedLimit,
 					offset: request.offset,
@@ -8258,10 +8613,14 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					searchString: request.searchString,
 					searchExplain: request.searchExplain
 				},
-				authContext
-			});
-			const rows = await this.fetchCollectionWithAuth(request.path, this._subscriptions.get(subscriptionId).collectionRequest, authContext);
-			this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
+				authContext,
+				started: 0,
+				delivered: 0
+			};
+			this._subscriptions.set(subscriptionId, subscription);
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
+			const rows = await this.fetchCollectionWithAuth(request.path, subscription.collectionRequest, authContext);
+			if (canDeliver()) this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
 			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -8277,15 +8636,19 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				this.sendError(clientId, msg, subscriptionId);
 				return;
 			}
-			this._subscriptions.set(subscriptionId, {
+			const subscription = {
 				clientId,
 				type: "single",
 				path: request.path,
 				id: request.id,
-				authContext
-			});
+				authContext,
+				started: 0,
+				delivered: 0
+			};
+			this._subscriptions.set(subscriptionId, subscription);
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			const row = await this.fetchEntityWithAuth(request.path, String(request.id), authContext);
-			this.sendSingleUpdate(clientId, subscriptionId, row || null);
+			if (canDeliver()) this.sendSingleUpdate(clientId, subscriptionId, row || null);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
 			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -8416,10 +8779,11 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (existing) clearTimeout(existing);
 		this.refetchTimers.set(timerKey, setTimeout(async () => {
 			this.refetchTimers.delete(timerKey);
-			if (!this._subscriptions.has(subscriptionId)) return;
+			if (this._subscriptions.get(subscriptionId) !== subscription) return;
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			try {
 				const rows = await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest, subscription.authContext);
-				this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath);
+				if (canDeliver()) this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath);
 			} catch (error) {
 				const sanitized = sanitizeErrorForClient(error, notifyPath);
 				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -8435,9 +8799,11 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (existing) clearTimeout(existing);
 		this.refetchTimers.set(timerKey, setTimeout(async () => {
 			this.refetchTimers.delete(timerKey);
-			if (!this._subscriptions.has(subscriptionId)) return;
+			if (this._subscriptions.get(subscriptionId) !== subscription) return;
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			try {
-				callback(await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest, subscription.authContext));
+				const rows = await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest, subscription.authContext);
+				if (canDeliver()) callback(rows);
 			} catch (error) {
 				logger.error(`❌ [RealtimeService] Error in debounced driver refetch for ${subscriptionId}`, { error });
 			}
@@ -8553,10 +8919,11 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (existing) clearTimeout(existing);
 		this.refetchTimers.set(timerKey, setTimeout(async () => {
 			this.refetchTimers.delete(timerKey);
-			if (!this._subscriptions.has(subscriptionId)) return;
+			if (this._subscriptions.get(subscriptionId) !== subscription) return;
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			try {
 				const row = await this.fetchEntityWithAuth(notifyPath, id, subscription.authContext);
-				this.sendSingleUpdate(subscription.clientId, subscriptionId, row || null);
+				if (canDeliver()) this.sendSingleUpdate(subscription.clientId, subscriptionId, row || null);
 			} catch (error) {
 				const sanitized = sanitizeErrorForClient(error, notifyPath);
 				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -8572,9 +8939,11 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (existing) clearTimeout(existing);
 		this.refetchTimers.set(timerKey, setTimeout(async () => {
 			this.refetchTimers.delete(timerKey);
-			if (!this._subscriptions.has(subscriptionId)) return;
+			if (this._subscriptions.get(subscriptionId) !== subscription) return;
+			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			try {
-				callback(await this.fetchEntityWithAuth(notifyPath, id, subscription.authContext) || null);
+				const row = await this.fetchEntityWithAuth(notifyPath, id, subscription.authContext);
+				if (canDeliver()) callback(row || null);
 			} catch (error) {
 				logger.error(`❌ [RealtimeService] Error in debounced row driver refetch for ${subscriptionId}`, { error });
 			}
@@ -8849,7 +9218,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (this.memoryBusWarned) return;
 		if (this.bus.kind !== "memory" || !this.foreignInstanceSeen) return;
 		this.memoryBusWarned = true;
-		logger.warn("⚠️ [ChannelBus] Channels are in use with the in-memory bus, but notifications from another instance have been seen — this deployment runs more than one process. Broadcast and presence reach only the clients connected to this one. Set `realtime.bus` (or REBASE_REALTIME_BUS=postgres) to make channels cross-instance.");
+		logger.warn("⚠️ [ChannelBus] Channels are in use with the in-memory bus, but notifications from another instance have been seen — this deployment runs more than one process. Broadcast and presence reach only the clients connected to this one. Set `realtime.bus` (or REALTIME_CHANNEL_BUS=postgres) to make channels cross-instance.");
 	}
 	/** Leave a broadcast channel */
 	leaveChannel(clientId, channel) {
@@ -9511,8 +9880,10 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	*/
 	async connectListenClient() {
 		if (!this.listenConnectionString) return;
+		let pending;
 		try {
 			const client = new Client({ connectionString: this.listenConnectionString });
+			pending = client;
 			client.on("error", (err) => {
 				logger.error("❌ [RealtimeService] LISTEN client error", { detail: err.message });
 				this.scheduleReconnect();
@@ -9551,8 +9922,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			await client.connect();
 			await client.query(`LISTEN ${PG_NOTIFY_CHANNEL}`);
 			this.listenClient = client;
+			pending = void 0;
 			this.debugLog(`📡 [RealtimeService] LISTEN client connected on channel "${PG_NOTIFY_CHANNEL}"`);
 		} catch (err) {
+			if (pending) try {
+				await pending.end();
+			} catch {}
 			logger.error("❌ [RealtimeService] Failed to connect LISTEN client", { error: err });
 			this.scheduleReconnect();
 		}
@@ -10873,10 +11248,25 @@ var UserService = class {
 		if (metadataKey in this.usersTable) payload[metadataKey] = remainingMetadata;
 		return payload;
 	}
+	/**
+	* @see UserRepository.createUser — an email already in use is a 409.
+	*
+	* The route checks first and answers 409; this is the same answer for the
+	* requests that get past the check, which two clicks on a signup button
+	* are enough to produce. `PersistService` has mapped `23505` to a conflict
+	* for collection writes since the layer that holds the SQLSTATE was made
+	* responsible for saying whose fault a failure is; the auth writes never
+	* got the same treatment and reached the client as "Internal Server Error".
+	*/
 	async createUser(data) {
 		const payload = this.mapPayload(data);
-		const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
-		return this.mapRowToUser(row);
+		try {
+			const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
+			return this.mapRowToUser(row);
+		} catch (error) {
+			if (extractPgError(error)?.code === "23505") throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
+			throw error;
+		}
 	}
 	async getUserById(id) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -12693,6 +13083,43 @@ function resolveDriftCheckName(col, registeredTableNames) {
 	return (isRelationalCollectionConfig(col) ? col.table : void 0) ?? registeredTableNames.find((k) => k === col.slug) ?? col.slug;
 }
 /**
+* Why the tables this backend serves are not in the database — the part of the
+* drift warning that has to be true rather than merely plausible.
+*
+* The three answers need three different actions, and only the caller knows
+* which one applies. This warning used to assert the first ("this runtime
+* applies the collection schema at boot unless REBASE_MIGRATE_ON_BOOT=none")
+* and then point at that variable and at driver-version skew. For an app whose
+* boot path contained no provisioning step at all, every word of that was a
+* dead end: nothing read the variable, and the driver was current. The advice
+* cost an investigation, which is a strictly worse outcome than saying less.
+*
+* Exported for its own test: the surrounding check needs a live pool and a real
+* database, and this is the part that was wrong.
+*/
+function describeSchemaDriftCause(provisioning) {
+	if (provisioning === void 0) return [
+		"  This runtime could not determine whether a schema-creation step ran",
+		"  before this check (the caller predates that signal).",
+		"    • Look for a \"Collection schema:\" line above. No such line at all",
+		"      means nothing tried to create these tables in this process."
+	];
+	if (provisioning.attempted) return [
+		"  A schema-creation step DID run this boot and these tables are still",
+		"  missing, so it did not create them — check the \"schema:\" lines above",
+		"  for what it did instead, and for DDL errors.",
+		"    • A collection routed to another engine or data source is not",
+		"      created here; that is reported separately at boot.",
+		"    • Otherwise this is a bug worth reporting, with those lines."
+	];
+	return [
+		"  No schema-creation step ran this boot:",
+		`    ${provisioning.reason ?? "no reason was given."}`,
+		"  Resolve that reason — the drift is its consequence, not a separate",
+		"  problem, and re-running a migration tool will not change it."
+	];
+}
+/**
 * Is this the local database `rebase init` scaffolds — i.e. the one case where
 * "you are connected as a superuser" is not news?
 *
@@ -12742,10 +13169,34 @@ function isScaffoldedLocalDatabase(connectionString) {
 */
 function createPostgresBootstrapper(pgConfig) {
 	if (pgConfig.unknownFilterFields) configureUnknownFilterFields(pgConfig.unknownFilterFields);
+	/**
+	* The handle the schema/policy hooks issue their DDL through.
+	*
+	* Both hooks run BEFORE `initializeDriver`, so `driverResult` is a stand-in
+	* the caller may not have: the bundle path can synthesize one from the
+	* connection its coordinator opened, but an application that built this
+	* adapter itself never handed the framework a connection — it handed it to
+	* *us*, as `pgConfig.connection`. Falling back to that is what lets a
+	* self-built adapter provision at all; requiring the argument is what left
+	* those apps with no tables and a 500 on every data route.
+	*
+	* Either handle is equivalent here. The driver's `schemaAwareDb` differs
+	* only by the drizzle schema object registered on it — relevant to the query
+	* builder, not to `execute(sql.raw(...))` — and every statement these hooks
+	* emit is schema-qualified DDL, so neither depends on `search_path`.
+	*/
+	const provisioningQueryable = (driverResult) => {
+		const db = (driverResult?.internals)?.db ?? pgConfig.connection;
+		if (!db) throw new Error("Cannot provision the collection schema: this Postgres adapter was created without a `connection`, and no initialized driver was supplied to fall back on. Pass `connection` to `createPostgresAdapter` (see `createPostgresDatabaseConnection`).");
+		return { async query(text) {
+			const result = await db.execute(sql.raw(text));
+			return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
+		} };
+	};
 	return {
 		type: "postgres",
 		async initializeDriver(config) {
-			const { collections, collectionRegistry, introspectCollections, baas } = config;
+			const { collections, collectionRegistry, introspectCollections, baas, schemaProvisioning } = config;
 			const unprotectedTables = baas?.unprotectedTables ?? "exclude";
 			const connection = pgConfig.connection;
 			const rawClient = connection && typeof connection === "object" && "$client" in connection ? connection.$client : connection;
@@ -12962,22 +13413,18 @@ function createPostgresBootstrapper(pgConfig) {
 							"  (`?options=-c%20search_path%3Dpublic`).",
 							""
 						];
+						const cause = describeSchemaDriftCause(schemaProvisioning);
 						logger.warn([
 							"",
 							"⚠️  SCHEMA DRIFT — the database is missing tables this backend serves:",
 							...lines,
 							"",
 							...misplacedHelp,
-							"  This runtime applies the collection schema at boot unless",
-							"  REBASE_MIGRATE_ON_BOOT=none. Check the \"Collection schema\" / \"policies\"",
-							"  log lines above — this drift means that step was off, skipped, or failed.",
-							"    • Managed cloud: redeploy with REBASE_MIGRATE_ON_BOOT unset or",
-							"      \"ensure\"; the runtime applies the schema to the tenant DB.",
-							"      If the log above says the driver does not implement collection-table",
-							"      creation, THIS driver is too old to do it. A driver is installed from",
-							"      your bundle's dependencies, not supplied by the platform image, so a",
-							"      newer runtime will not update it: bump \"@rebasepro/server-postgres\"",
-							"      in your project's package.json and redeploy.",
+							...cause,
+							"",
+							"  To apply this project's schema:",
+							"    • Managed cloud: the runtime creates tables and RLS at boot. `rebase db",
+							"      push` cannot reach a tenant's in-cluster database — redeploy instead.",
 							"    • Self-host: run `rebase db push` (dev) or `rebase db migrate` (prod)",
 							"      against DATABASE_URL.",
 							""
@@ -13065,12 +13512,8 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CbvaGuVn.js");
-			const plan = await ensureCollectionTables({ async query(text) {
-				const result = await internals.db.execute(sql.raw(text));
-				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
-			} }, collections, log);
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-DT2eq859.js");
+			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(failure.kind === "comment-column" ? `🔍 [schema] Could not record the search fingerprint on "${failure.target}" — search works, but a later change to the \`search\` block will not be detected: ${failure.error}` : `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
 			return { applied: plan.actions.length - plan.failures.length };
 		},
@@ -13090,12 +13533,9 @@ function createPostgresBootstrapper(pgConfig) {
 		* stays RLS-enabled, so it denies rather than leaks.
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const internals = driverResult.internals;
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-8vuu-n4r.js");
-			const outcome = await ensureCollectionPolicies({ async query(text) {
-				const result = await internals.db.execute(sql.raw(text));
-				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
-			} }, collections, log);
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-DoHwhVf8.js");
+			const queryable = provisioningQueryable(driverResult);
+			const outcome = await ensureCollectionPolicies(queryable, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
 			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — RLS is on, so it denies until this is resolved: ${failure.error}`);
 			const unrevoked = outcome.unsecured.filter((u) => !u.grantWithdrawn);
@@ -13103,9 +13543,7 @@ function createPostgresBootstrapper(pgConfig) {
 			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
 				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-69hYT8nr.js").then((n) => n.n);
-				await dropLegacyAuthSchema(async (text) => {
-					return (await internals.db.execute(sql.raw(text))).rows ?? [];
-				}, {
+				await dropLegacyAuthSchema(async (text) => (await queryable.query(text)).rows, {
 					info: (m) => logger.info(m),
 					warn: (m) => logger.warn(m)
 				});
@@ -13119,7 +13557,7 @@ function createPostgresBootstrapper(pgConfig) {
 		},
 		mountRoutes(app, basePath, driverResult) {},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			const { createPostgresWebSocket } = await import("./websocket-C8ZqVBiV.js").then((n) => n.n);
+			const { createPostgresWebSocket } = await import("./websocket-D2jXv0Ds.js").then((n) => n.n);
 			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
 		}
 	};
@@ -13159,6 +13597,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, describeSchemaDriftCause, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map