@rebasepro/server-postgres 0.14.1-canary.g7e666eb → 0.14.1

package/dist/index.es.js

@@ -11,7 +11,7 @@ import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBac
 import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-69hYT8nr.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
-import { ApiError, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
+import { ApiError, createDdlBootstrapper, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isNotNull, isNull, isTable, lt, notInArray, or, relations, sql } from "drizzle-orm";
 import { PgArray, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs, { promises } from "fs";
@@ -602,6 +602,31 @@ function getUnknownFilterFieldsMode() {
 	return defaultUnknownFilterFieldsMode;
 }
 /**
+* Split `metadata->address->>city` into its column and its path.
+*
+* The arrows are PostgREST's spelling and Postgres's own, so the filter reads
+* the same as the SQL it becomes — and, more usefully, the same as what someone
+* would have written by hand in the SQL console while working out what to ask
+* for. A field with no arrow is not a JSON path and returns `undefined`, which
+* leaves every existing filter on exactly the path it took before.
+*
+* Both arrows are accepted and mean the same thing here: the extraction is
+* always compiled to `->>` (text) at the leaf, because that is the only form a
+* comparison can be made against. `->` is allowed because people write it out
+* of habit, and refusing it would be pedantry about a distinction this layer
+* erases anyway.
+*/
+function parseJsonFieldPath(field) {
+	if (!field.includes("->")) return void 0;
+	const segments = field.split(/->>?/).map((s) => s.trim()).filter(Boolean);
+	if (segments.length < 2) return void 0;
+	const [columnKey, ...path] = segments;
+	return {
+		columnKey,
+		path
+	};
+}
+/**
 * Filter values may arrive as relation wire objects — `EntityRelation`
 * instances or their JSON form `{ __type: "relation", id, path }` — e.g. when
 * the admin filters a relation column. SQL comparisons need the raw id, so
@@ -762,6 +787,19 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 			kind: "column",
 			column: direct
 		};
+		const jsonPath = parseJsonFieldPath(field);
+		if (jsonPath) {
+			const base = columnAt(jsonPath.columnKey);
+			if (base) {
+				const meta = getColumnMeta(base);
+				if (meta.dataType !== "json" && meta.columnType !== "PgJsonb" && meta.columnType !== "PgJson") throw ApiError.badRequest(`Cannot filter inside "${jsonPath.columnKey}" — it is not a json or jsonb column.`, "INVALID_FILTER_FIELD");
+				return {
+					kind: "json",
+					column: base,
+					path: jsonPath.path
+				};
+			}
+		}
 		if (collection) {
 			const relation = resolveCollectionRelations(collection)[field];
 			if (relation?.kind === "belongsTo") {
@@ -841,7 +879,71 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 	}
 	/** Dispatch a resolved filter field onto the shape it actually compiles to. */
 	static compileFilterTarget(target, op, value, field, collectionPath) {
-		return target.kind === "column" ? this.buildSingleFilterCondition(target.column, op, value) : this.buildRelationFilterCondition(target.relation, op, value, target.sourceIdColumn, target.registry, field, collectionPath);
+		if (target.kind === "column") return this.buildSingleFilterCondition(target.column, op, value);
+		if (target.kind === "json") return this.buildJsonPathCondition(target.column, target.path, op, value);
+		return this.buildRelationFilterCondition(target.relation, op, value, target.sourceIdColumn, target.registry, field, collectionPath);
+	}
+	/**
+	* A comparison against a value extracted from a json/jsonb column.
+	*
+	* The path is walked with `->` and the leaf taken with `->>`, so what comes
+	* out is always **text**. That is the whole of the type story, and it is
+	* the part worth being explicit about, because the alternatives are all
+	* worse:
+	*
+	*  - text comparison alone makes `["<", 100]` compare lexically, where
+	*    `"9"` is greater than `"100"`;
+	*  - casting unconditionally makes every filter on a non-numeric value a
+	*    runtime `invalid input syntax for type numeric` — a 500 on a row whose
+	*    JSON simply holds a string.
+	*
+	* So the *filter value* decides. A number on an ordering comparison casts
+	* both sides to numeric; everything else compares as text, with booleans
+	* rendered the way `->>` renders them (`"true"` / `"false"`). A row whose
+	* JSON holds a non-numeric value at a path being compared numerically is
+	* excluded rather than fatal, which is what `IS NOT NULL`-style filtering
+	* means everywhere else in this file.
+	*
+	* The path segments are bound as parameters, never interpolated: they come
+	* from a query string, and `->>` takes a text parameter perfectly well.
+	*/
+	static buildJsonPathCondition(column, path, op, value) {
+		let expr = sql`${column}`;
+		for (const key of path.slice(0, -1)) expr = sql`${expr} -> ${key}`;
+		const leaf = sql`${expr} ->> ${path[path.length - 1]}`;
+		if (typeof value === "number" && (op === ">" || op === ">=" || op === "<" || op === "<=")) {
+			const numeric = sql`CASE WHEN ${leaf} ~ '^-?[0-9]+(\\.[0-9]+)?$' THEN (${leaf})::numeric END`;
+			switch (op) {
+				case ">": return sql`${numeric} > ${value}`;
+				case ">=": return sql`${numeric} >= ${value}`;
+				case "<": return sql`${numeric} < ${value}`;
+				case "<=": return sql`${numeric} <= ${value}`;
+			}
+		}
+		const asText = (v) => typeof v === "boolean" ? String(v) : String(v);
+		switch (op) {
+			case "==": return value === null || value === void 0 ? sql`${leaf} IS NULL` : sql`${leaf} = ${asText(value)}`;
+			case "!=": return value === null || value === void 0 ? sql`${leaf} IS NOT NULL` : sql`${leaf} != ${asText(value)}`;
+			case ">": return sql`${leaf} > ${asText(value)}`;
+			case ">=": return sql`${leaf} >= ${asText(value)}`;
+			case "<": return sql`${leaf} < ${asText(value)}`;
+			case "<=": return sql`${leaf} <= ${asText(value)}`;
+			case "like": return sql`${leaf} LIKE ${asText(value)}`;
+			case "ilike": return sql`${leaf} ILIKE ${asText(value)}`;
+			case "not-like": return sql`${leaf} NOT LIKE ${asText(value)}`;
+			case "not-ilike": return sql`${leaf} NOT ILIKE ${asText(value)}`;
+			case "is-null": return sql`${leaf} IS NULL`;
+			case "is-not-null": return sql`${leaf} IS NOT NULL`;
+			case "in":
+			case "not-in": {
+				if (value === null || value === void 0) return op === "in" ? sql`${leaf} IS NULL` : sql`${leaf} IS NOT NULL`;
+				const values = toMembershipList(value).map(asText);
+				if (values.length === 0) return op === "in" ? sql`FALSE` : sql`TRUE`;
+				const list = sql.join(values.map((v) => sql`${v}`), sql`, `);
+				return op === "in" ? sql`${leaf} IN (${list})` : sql`${leaf} NOT IN (${list})`;
+			}
+			default: throw ApiError.badRequest(`Operator "${op}" is not supported on a JSON path. Use it on the column itself.`, "INVALID_FILTER_OPERATOR");
+		}
 	}
 	/**
 	* A filter on a relation that owns no column on this row — `EXISTS` over
@@ -3830,6 +3932,92 @@ var FetchService = class FetchService {
 		return Number(result[0]?.count || 0);
 	}
 	/**
+	* `count`/`sum`/`avg`/`min`/`max`, optionally grouped.
+	*
+	* The gap this fills is narrow and constant: every dashboard wants "revenue
+	* by status" and "orders per day", and without it the options were a custom
+	* function holding hand-written SQL, or fetching every row and reducing in
+	* JavaScript — which is wrong at any size that matters, and silently wrong
+	* under a `limit`.
+	*
+	* It runs through the same request-scoped handle as every other read, so
+	* **RLS applies to the rows being aggregated**. That is the property worth
+	* protecting here: an aggregate is an effective way to read data you cannot
+	* select, and `count(*)` over a table whose policies would return nothing
+	* has to be zero.
+	*/
+	async aggregate(collectionPath, options) {
+		const collection = getCollectionByPath(collectionPath, this.registry);
+		const table = getTableForCollection(collection, this.registry);
+		const columns = getTableColumns(table);
+		const columnFor = (field, forWhat) => {
+			const column = columns[field];
+			if (!column) throw ApiError.badRequest(`Unknown field '${field}' in ${forWhat}. Valid fields: ${Object.keys(columns).sort().join(", ")}`, "UNKNOWN_AGGREGATE_FIELD");
+			return column;
+		};
+		const selection = {};
+		for (const aggregate of options.aggregates) {
+			if (aggregate.fn === "count" && !aggregate.field) {
+				selection[aggregate.alias] = sql`count(*)`;
+				continue;
+			}
+			const column = columnFor(aggregate.field, `${aggregate.fn}()`);
+			switch (aggregate.fn) {
+				case "count":
+					selection[aggregate.alias] = sql`count(${column})`;
+					break;
+				case "sum":
+					selection[aggregate.alias] = sql`sum(${column})::numeric`;
+					break;
+				case "avg":
+					selection[aggregate.alias] = sql`avg(${column})::numeric`;
+					break;
+				case "min":
+					selection[aggregate.alias] = sql`min(${column})`;
+					break;
+				case "max":
+					selection[aggregate.alias] = sql`max(${column})`;
+					break;
+			}
+		}
+		const groupColumns = (options.groupBy ?? []).map((field) => ({
+			field,
+			column: columnFor(field, "groupBy")
+		}));
+		for (const group of groupColumns) selection[group.field] = sql`${group.column}`;
+		let query = this.db.select(selection).from(table).$dynamic();
+		const conditions = [];
+		if (options.searchString) {
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
+			if (searchConditions.length === 0) return [];
+			conditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
+		}
+		if (options.filter) conditions.push(...this.buildFilterConditions(options.filter, table, collectionPath));
+		if (options.logical) {
+			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
+			if (logicalCondition) conditions.push(logicalCondition);
+		}
+		if (conditions.length > 0) {
+			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(conditions);
+			if (finalCondition) query = query.where(finalCondition);
+		}
+		if (groupColumns.length > 0) {
+			query = query.groupBy(...groupColumns.map((g) => g.column));
+			if (options.limit) query = query.limit(options.limit);
+		}
+		const rows = await query;
+		const numericAliases = new Set(options.aggregates.filter((a) => a.fn === "count" || a.fn === "sum" || a.fn === "avg").map((a) => a.alias));
+		return rows.map((row) => {
+			const out = { ...row };
+			for (const alias of numericAliases) {
+				if (out[alias] === null || out[alias] === void 0) continue;
+				const parsed = Number(out[alias]);
+				if (!Number.isNaN(parsed)) out[alias] = parsed;
+			}
+			return out;
+		});
+	}
+	/**
 	* Check if a field value is unique
 	*/
 	async checkUniqueField(collectionPath, fieldName, value, excludeEntityId, _databaseId) {
@@ -7305,6 +7493,29 @@ var CdcListener = class {
 	}
 };
 //#endregion
+//#region src/schema/drizzle-ddl.ts
+/**
+* The server's DDL bootstrapper, over a Drizzle handle.
+*
+* `createDdlBootstrapper` in `@rebasepro/server` wants a plain
+* `(sql: string) => Promise<rows>`; the driver's internal stores hold a Drizzle
+* database. This is the adapter between them, and it exists so the retry policy
+* has exactly one definition. A second copy of the SQLSTATE list living in the
+* driver is how the two drift apart, and the drift is invisible: both versions
+* work perfectly on every single-instance deployment.
+*/
+/**
+* A {@link DdlBootstrapper} that runs its statements through `db.execute`.
+*
+* @param db    the Drizzle handle the calling store already holds
+* @param scope log prefix identifying the caller, e.g. `"channel-presence"`
+*/
+function drizzleDdlBootstrapper(db, scope) {
+	return createDdlBootstrapper(async (statement) => {
+		return (await db.execute(sql.raw(statement))).rows ?? [];
+	}, scope);
+}
+//#endregion
 //#region src/services/channel-history.ts
 /**
 * Ordered, replayable per-channel message history.
@@ -7440,8 +7651,9 @@ var ChannelHistoryStore = class {
 	*/
 	async ensureTables() {
 		if (!this.enabled || this.tablesReady) return;
-		await this.db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
-		await this.db.execute(sql`
+		const ddl = drizzleDdlBootstrapper(this.db, "channel-history");
+		await ddl.ensureObject("rebase schema", "CREATE SCHEMA IF NOT EXISTS rebase");
+		await ddl.ensureObject("channel_messages table", `
             CREATE TABLE IF NOT EXISTS rebase.channel_messages (
                 channel TEXT NOT NULL,
                 seq BIGINT NOT NULL,
@@ -7452,18 +7664,23 @@ var ChannelHistoryStore = class {
                 PRIMARY KEY (channel, seq)
             )
         `);
-		await this.db.execute(sql`
+		await ddl.ensureObject("channel_messages created_at index", `
             CREATE INDEX IF NOT EXISTS idx_channel_messages_created
             ON rebase.channel_messages (created_at)
         `);
-		await this.db.execute(sql`
+		await ddl.ensureObject("channel_cursors table", `
             CREATE TABLE IF NOT EXISTS rebase.channel_cursors (
                 channel TEXT PRIMARY KEY,
                 last_seq BIGINT NOT NULL
             )
         `);
-		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")));
-		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")));
+		const [messagesReady, cursorsReady] = await Promise.all([ddl.isReadable("rebase.channel_messages"), ddl.isReadable("rebase.channel_cursors")]);
+		if (messagesReady) await ddl.step("channel_messages revoke", () => this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages"))));
+		if (cursorsReady) await ddl.step("channel_cursors revoke", () => this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors"))));
+		if (!messagesReady || !cursorsReady) {
+			logger.warn("[ChannelHistory] Retained-channel tables are not both present; history is not ready yet.");
+			return;
+		}
 		this.tablesReady = true;
 		logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
 	}
@@ -7629,11 +7846,27 @@ var ChannelPresenceStore = class {
 		this.db = db;
 		this.instanceId = instanceId;
 	}
-	/** Create the roster table. Idempotent. */
+	/**
+	* Create the roster table. Idempotent, and safe to run on every instance at
+	* once.
+	*
+	* Written as separate contained steps rather than one straight sequence for
+	* a reason that only bites with more than one replica, which is exactly the
+	* deployment shape this table exists to serve: `CREATE … IF NOT EXISTS`
+	* reads the catalog and then writes to it non-atomically, so peers booting
+	* together collide, and the loser used to abandon everything after it —
+	* including the trailing `REVOKE`. That revoke is the only thing keeping the
+	* roster off the end-user role, so losing a boot race silently left the
+	* whole channel roster readable by every signed-in user.
+	*
+	* `tablesReady` is now set from a probe of what exists, not from having been
+	* the instance that created it.
+	*/
 	async ensureTables() {
 		if (this.tablesReady) return;
-		await this.db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
-		await this.db.execute(sql`
+		const ddl = drizzleDdlBootstrapper(this.db, "channel-presence");
+		await ddl.ensureObject("rebase schema", "CREATE SCHEMA IF NOT EXISTS rebase");
+		await ddl.ensureObject("channel_presence table", `
             CREATE TABLE IF NOT EXISTS rebase.channel_presence (
                 channel TEXT NOT NULL,
                 client_id TEXT NOT NULL,
@@ -7643,12 +7876,14 @@ var ChannelPresenceStore = class {
                 PRIMARY KEY (channel, client_id)
             )
         `);
-		await this.db.execute(sql`
+		await ddl.ensureObject("channel_presence last_seen index", `
             CREATE INDEX IF NOT EXISTS idx_channel_presence_last_seen
             ON rebase.channel_presence (last_seen)
         `);
-		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence")));
-		this.tablesReady = true;
+		if (await ddl.isReadable("rebase.channel_presence")) {
+			await ddl.step("channel_presence revoke", () => this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence"))));
+			this.tablesReady = true;
+		}
 	}
 	/** Record (or refresh) a client's presence. */
 	async track(channel, clientId, state) {
@@ -8983,7 +9218,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (this.memoryBusWarned) return;
 		if (this.bus.kind !== "memory" || !this.foreignInstanceSeen) return;
 		this.memoryBusWarned = true;
-		logger.warn("⚠️ [ChannelBus] Channels are in use with the in-memory bus, but notifications from another instance have been seen — this deployment runs more than one process. Broadcast and presence reach only the clients connected to this one. Set `realtime.bus` (or REBASE_REALTIME_BUS=postgres) to make channels cross-instance.");
+		logger.warn("⚠️ [ChannelBus] Channels are in use with the in-memory bus, but notifications from another instance have been seen — this deployment runs more than one process. Broadcast and presence reach only the clients connected to this one. Set `realtime.bus` (or REALTIME_CHANNEL_BUS=postgres) to make channels cross-instance.");
 	}
 	/** Leave a broadcast channel */
 	leaveChannel(clientId, channel) {
@@ -12848,6 +13083,43 @@ function resolveDriftCheckName(col, registeredTableNames) {
 	return (isRelationalCollectionConfig(col) ? col.table : void 0) ?? registeredTableNames.find((k) => k === col.slug) ?? col.slug;
 }
 /**
+* Why the tables this backend serves are not in the database — the part of the
+* drift warning that has to be true rather than merely plausible.
+*
+* The three answers need three different actions, and only the caller knows
+* which one applies. This warning used to assert the first ("this runtime
+* applies the collection schema at boot unless REBASE_MIGRATE_ON_BOOT=none")
+* and then point at that variable and at driver-version skew. For an app whose
+* boot path contained no provisioning step at all, every word of that was a
+* dead end: nothing read the variable, and the driver was current. The advice
+* cost an investigation, which is a strictly worse outcome than saying less.
+*
+* Exported for its own test: the surrounding check needs a live pool and a real
+* database, and this is the part that was wrong.
+*/
+function describeSchemaDriftCause(provisioning) {
+	if (provisioning === void 0) return [
+		"  This runtime could not determine whether a schema-creation step ran",
+		"  before this check (the caller predates that signal).",
+		"    • Look for a \"Collection schema:\" line above. No such line at all",
+		"      means nothing tried to create these tables in this process."
+	];
+	if (provisioning.attempted) return [
+		"  A schema-creation step DID run this boot and these tables are still",
+		"  missing, so it did not create them — check the \"schema:\" lines above",
+		"  for what it did instead, and for DDL errors.",
+		"    • A collection routed to another engine or data source is not",
+		"      created here; that is reported separately at boot.",
+		"    • Otherwise this is a bug worth reporting, with those lines."
+	];
+	return [
+		"  No schema-creation step ran this boot:",
+		`    ${provisioning.reason ?? "no reason was given."}`,
+		"  Resolve that reason — the drift is its consequence, not a separate",
+		"  problem, and re-running a migration tool will not change it."
+	];
+}
+/**
 * Is this the local database `rebase init` scaffolds — i.e. the one case where
 * "you are connected as a superuser" is not news?
 *
@@ -12897,10 +13169,34 @@ function isScaffoldedLocalDatabase(connectionString) {
 */
 function createPostgresBootstrapper(pgConfig) {
 	if (pgConfig.unknownFilterFields) configureUnknownFilterFields(pgConfig.unknownFilterFields);
+	/**
+	* The handle the schema/policy hooks issue their DDL through.
+	*
+	* Both hooks run BEFORE `initializeDriver`, so `driverResult` is a stand-in
+	* the caller may not have: the bundle path can synthesize one from the
+	* connection its coordinator opened, but an application that built this
+	* adapter itself never handed the framework a connection — it handed it to
+	* *us*, as `pgConfig.connection`. Falling back to that is what lets a
+	* self-built adapter provision at all; requiring the argument is what left
+	* those apps with no tables and a 500 on every data route.
+	*
+	* Either handle is equivalent here. The driver's `schemaAwareDb` differs
+	* only by the drizzle schema object registered on it — relevant to the query
+	* builder, not to `execute(sql.raw(...))` — and every statement these hooks
+	* emit is schema-qualified DDL, so neither depends on `search_path`.
+	*/
+	const provisioningQueryable = (driverResult) => {
+		const db = (driverResult?.internals)?.db ?? pgConfig.connection;
+		if (!db) throw new Error("Cannot provision the collection schema: this Postgres adapter was created without a `connection`, and no initialized driver was supplied to fall back on. Pass `connection` to `createPostgresAdapter` (see `createPostgresDatabaseConnection`).");
+		return { async query(text) {
+			const result = await db.execute(sql.raw(text));
+			return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
+		} };
+	};
 	return {
 		type: "postgres",
 		async initializeDriver(config) {
-			const { collections, collectionRegistry, introspectCollections, baas } = config;
+			const { collections, collectionRegistry, introspectCollections, baas, schemaProvisioning } = config;
 			const unprotectedTables = baas?.unprotectedTables ?? "exclude";
 			const connection = pgConfig.connection;
 			const rawClient = connection && typeof connection === "object" && "$client" in connection ? connection.$client : connection;
@@ -13117,22 +13413,18 @@ function createPostgresBootstrapper(pgConfig) {
 							"  (`?options=-c%20search_path%3Dpublic`).",
 							""
 						];
+						const cause = describeSchemaDriftCause(schemaProvisioning);
 						logger.warn([
 							"",
 							"⚠️  SCHEMA DRIFT — the database is missing tables this backend serves:",
 							...lines,
 							"",
 							...misplacedHelp,
-							"  This runtime applies the collection schema at boot unless",
-							"  REBASE_MIGRATE_ON_BOOT=none. Check the \"Collection schema\" / \"policies\"",
-							"  log lines above — this drift means that step was off, skipped, or failed.",
-							"    • Managed cloud: redeploy with REBASE_MIGRATE_ON_BOOT unset or",
-							"      \"ensure\"; the runtime applies the schema to the tenant DB.",
-							"      If the log above says the driver does not implement collection-table",
-							"      creation, THIS driver is too old to do it. A driver is installed from",
-							"      your bundle's dependencies, not supplied by the platform image, so a",
-							"      newer runtime will not update it: bump \"@rebasepro/server-postgres\"",
-							"      in your project's package.json and redeploy.",
+							...cause,
+							"",
+							"  To apply this project's schema:",
+							"    • Managed cloud: the runtime creates tables and RLS at boot. `rebase db",
+							"      push` cannot reach a tenant's in-cluster database — redeploy instead.",
 							"    • Self-host: run `rebase db push` (dev) or `rebase db migrate` (prod)",
 							"      against DATABASE_URL.",
 							""
@@ -13220,12 +13512,8 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-B1qKdXA4.js");
-			const plan = await ensureCollectionTables({ async query(text) {
-				const result = await internals.db.execute(sql.raw(text));
-				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
-			} }, collections, log);
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-DT2eq859.js");
+			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(failure.kind === "comment-column" ? `🔍 [schema] Could not record the search fingerprint on "${failure.target}" — search works, but a later change to the \`search\` block will not be detected: ${failure.error}` : `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
 			return { applied: plan.actions.length - plan.failures.length };
 		},
@@ -13245,12 +13533,9 @@ function createPostgresBootstrapper(pgConfig) {
 		* stays RLS-enabled, so it denies rather than leaks.
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const internals = driverResult.internals;
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-BedO2aNX.js");
-			const outcome = await ensureCollectionPolicies({ async query(text) {
-				const result = await internals.db.execute(sql.raw(text));
-				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
-			} }, collections, log);
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-DoHwhVf8.js");
+			const queryable = provisioningQueryable(driverResult);
+			const outcome = await ensureCollectionPolicies(queryable, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
 			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — RLS is on, so it denies until this is resolved: ${failure.error}`);
 			const unrevoked = outcome.unsecured.filter((u) => !u.grantWithdrawn);
@@ -13258,9 +13543,7 @@ function createPostgresBootstrapper(pgConfig) {
 			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
 				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-69hYT8nr.js").then((n) => n.n);
-				await dropLegacyAuthSchema(async (text) => {
-					return (await internals.db.execute(sql.raw(text))).rows ?? [];
-				}, {
+				await dropLegacyAuthSchema(async (text) => (await queryable.query(text)).rows, {
 					info: (m) => logger.info(m),
 					warn: (m) => logger.warn(m)
 				});
@@ -13314,6 +13597,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, describeSchemaDriftCause, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map