@rebasepro/server-postgres 0.14.1-canary.g7e666eb → 0.14.1

package/src/PostgresBootstrapper.ts

@@ -137,6 +137,52 @@ export function resolveDriftCheckName(
         ?? col.slug;
 }
 
+/**
+ * Why the tables this backend serves are not in the database — the part of the
+ * drift warning that has to be true rather than merely plausible.
+ *
+ * The three answers need three different actions, and only the caller knows
+ * which one applies. This warning used to assert the first ("this runtime
+ * applies the collection schema at boot unless REBASE_MIGRATE_ON_BOOT=none")
+ * and then point at that variable and at driver-version skew. For an app whose
+ * boot path contained no provisioning step at all, every word of that was a
+ * dead end: nothing read the variable, and the driver was current. The advice
+ * cost an investigation, which is a strictly worse outcome than saying less.
+ *
+ * Exported for its own test: the surrounding check needs a live pool and a real
+ * database, and this is the part that was wrong.
+ */
+export function describeSchemaDriftCause(
+    provisioning: { attempted: boolean; reason?: string } | undefined
+): string[] {
+    // A caller too old to send the signal gets no claim either way — just where
+    // to look. Guessing is what got this wrong the first time.
+    if (provisioning === undefined) {
+        return [
+            "  This runtime could not determine whether a schema-creation step ran",
+            "  before this check (the caller predates that signal).",
+            "    • Look for a \"Collection schema:\" line above. No such line at all",
+            "      means nothing tried to create these tables in this process."
+        ];
+    }
+    if (provisioning.attempted) {
+        return [
+            "  A schema-creation step DID run this boot and these tables are still",
+            "  missing, so it did not create them — check the \"schema:\" lines above",
+            "  for what it did instead, and for DDL errors.",
+            "    • A collection routed to another engine or data source is not",
+            "      created here; that is reported separately at boot.",
+            "    • Otherwise this is a bug worth reporting, with those lines."
+        ];
+    }
+    return [
+        "  No schema-creation step ran this boot:",
+        `    ${provisioning.reason ?? "no reason was given."}`,
+        "  Resolve that reason — the drift is its consequence, not a separate",
+        "  problem, and re-running a migration tool will not change it."
+    ];
+}
+
 /**
  * Is this the local database `rebase init` scaffolds — i.e. the one case where
  * "you are connected as a superuser" is not news?
@@ -200,17 +246,53 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
         configureUnknownFilterFields(pgConfig.unknownFilterFields);
     }
 
+    /**
+     * The handle the schema/policy hooks issue their DDL through.
+     *
+     * Both hooks run BEFORE `initializeDriver`, so `driverResult` is a stand-in
+     * the caller may not have: the bundle path can synthesize one from the
+     * connection its coordinator opened, but an application that built this
+     * adapter itself never handed the framework a connection — it handed it to
+     * *us*, as `pgConfig.connection`. Falling back to that is what lets a
+     * self-built adapter provision at all; requiring the argument is what left
+     * those apps with no tables and a 500 on every data route.
+     *
+     * Either handle is equivalent here. The driver's `schemaAwareDb` differs
+     * only by the drizzle schema object registered on it — relevant to the query
+     * builder, not to `execute(sql.raw(...))` — and every statement these hooks
+     * emit is schema-qualified DDL, so neither depends on `search_path`.
+     */
+    const provisioningQueryable = (driverResult?: InitializedDriver) => {
+        const internals = driverResult?.internals as PostgresDriverInternals | undefined;
+        const db = internals?.db ?? (pgConfig.connection as PostgresDriverInternals["db"] | undefined);
+        if (!db) {
+            throw new Error(
+                "Cannot provision the collection schema: this Postgres adapter was created without a " +
+                "`connection`, and no initialized driver was supplied to fall back on. Pass `connection` " +
+                "to `createPostgresAdapter` (see `createPostgresDatabaseConnection`)."
+            );
+        }
+        return {
+            async query<T>(text: string): Promise<{ rows: T[] }> {
+                const result = await db.execute(sql.raw(text));
+                const rows = (result as unknown as { rows?: T[] }).rows;
+                return { rows: rows ?? (Array.isArray(result) ? (result as T[]) : []) };
+            }
+        };
+    };
+
     return {
         type: "postgres",
 
         async initializeDriver(config: unknown): Promise<InitializedDriver> {
             // config is passed from coordinator, we merge it with our internal pgConfig if needed
             // Currently config from init.ts is `{ collections, collectionRegistry, mode }`
-            const { collections, collectionRegistry, introspectCollections, baas } = config as {
+            const { collections, collectionRegistry, introspectCollections, baas, schemaProvisioning } = config as {
                 collections?: CollectionConfig[];
                 collectionRegistry?: unknown;
                 introspectCollections?: boolean;
                 baas?: { unprotectedTables?: "exclude" | "serve" };
+                schemaProvisioning?: { attempted: boolean; reason?: string };
             };
             // Secure by default: a table with no RLS is not served.
             const unprotectedTables = baas?.unprotectedTables ?? "exclude";
@@ -695,30 +777,29 @@ foundIn: (tablesByName.get(checkName) ?? []).filter(s => s !== schemaName) });
                             "  (`?options=-c%20search_path%3Dpublic`).",
                             ""
                         ];
-                        // This runtime creates collection tables (and their RLS)
-                        // at boot unless REBASE_MIGRATE_ON_BOOT=none, so a drift
-                        // this late means that step was disabled, could not run,
-                        // or failed — the guidance names a path for both a managed
-                        // tenant (whose in-cluster database `pnpm db:push` cannot
-                        // reach) and a self-host. Naming only the pnpm scripts, as
-                        // this once did, told a managed operator to run a command
-                        // that structurally cannot touch their database.
+                        // What to tell the operator depends entirely on whether a
+                        // create step ran in this process, and the caller is the
+                        // only thing that knows. This warning used to assert that
+                        // it had ("this runtime applies the collection schema at
+                        // boot unless REBASE_MIGRATE_ON_BOOT=none") and send
+                        // people to that variable and to driver-version skew. For
+                        // an app whose boot path contained no provisioning step,
+                        // both were dead ends: nothing read that variable, and the
+                        // driver was current. Say which case this is instead of
+                        // guessing, and say nothing when the caller is too old to
+                        // tell us.
+                        const cause = describeSchemaDriftCause(schemaProvisioning);
                         logger.warn([
                             "",
                             "⚠️  SCHEMA DRIFT — the database is missing tables this backend serves:",
                             ...lines,
                             "",
                             ...misplacedHelp,
-                            "  This runtime applies the collection schema at boot unless",
-                            "  REBASE_MIGRATE_ON_BOOT=none. Check the \"Collection schema\" / \"policies\"",
-                            "  log lines above — this drift means that step was off, skipped, or failed.",
-                            "    • Managed cloud: redeploy with REBASE_MIGRATE_ON_BOOT unset or",
-                            "      \"ensure\"; the runtime applies the schema to the tenant DB.",
-                            "      If the log above says the driver does not implement collection-table",
-                            "      creation, THIS driver is too old to do it. A driver is installed from",
-                            "      your bundle's dependencies, not supplied by the platform image, so a",
-                            "      newer runtime will not update it: bump \"@rebasepro/server-postgres\"",
-                            "      in your project's package.json and redeploy.",
+                            ...cause,
+                            "",
+                            "  To apply this project's schema:",
+                            "    • Managed cloud: the runtime creates tables and RLS at boot. `rebase db",
+                            "      push` cannot reach a tenant's in-cluster database — redeploy instead.",
                             "    • Self-host: run `rebase db push` (dev) or `rebase db migrate` (prod)",
                             "      against DATABASE_URL.",
                             ""
@@ -862,23 +943,16 @@ schemaHealthCheck: () => probeAuthSchema(db, resolveAuthSchema(authCollection))
          */
         async ensureCollectionSchema(
             collections: unknown[],
-            driverResult: InitializedDriver,
+            driverResult?: InitializedDriver,
             log?: (message: string) => void
         ): Promise<{ applied: number }> {
-            const internals = driverResult.internals as PostgresDriverInternals;
             const { ensureCollectionTables } = await import("./schema/ensure-collection-tables");
             // Runs through the drizzle handle the driver already bootstrapped
             // with, so it uses exactly the connection and privileges that were
             // proven to work. Every statement is DDL or a catalogue read with no
             // bindable values (schema names are identifiers), and the module
             // validates them before they reach a string.
-            const queryable = {
-                async query<T>(text: string): Promise<{ rows: T[] }> {
-                    const result = await internals.db.execute(sql.raw(text));
-                    const rows = (result as unknown as { rows?: T[] }).rows;
-                    return { rows: rows ?? (Array.isArray(result) ? (result as T[]) : []) };
-                }
-            };
+            const queryable = provisioningQueryable(driverResult);
             const plan = await ensureCollectionTables(
                 queryable,
                 collections as Parameters<typeof ensureCollectionTables>[1],
@@ -917,18 +991,11 @@ schemaHealthCheck: () => probeAuthSchema(db, resolveAuthSchema(authCollection))
          */
         async ensureCollectionPolicies(
             collections: unknown[],
-            driverResult: InitializedDriver,
+            driverResult?: InitializedDriver,
             log?: (message: string) => void
         ): Promise<{ applied: number }> {
-            const internals = driverResult.internals as PostgresDriverInternals;
             const { ensureCollectionPolicies } = await import("./schema/ensure-collection-policies");
-            const queryable = {
-                async query<T>(text: string): Promise<{ rows: T[] }> {
-                    const result = await internals.db.execute(sql.raw(text));
-                    const rows = (result as unknown as { rows?: T[] }).rows;
-                    return { rows: rows ?? (Array.isArray(result) ? (result as T[]) : []) };
-                }
-            };
+            const queryable = provisioningQueryable(driverResult);
             const outcome = await ensureCollectionPolicies(
                 queryable,
                 collections as CollectionConfig[],
@@ -982,10 +1049,7 @@ schemaHealthCheck: () => probeAuthSchema(db, resolveAuthSchema(authCollection))
             try {
                 const { dropLegacyAuthSchema } = await import("./schema/rls-bootstrap-sql");
                 await dropLegacyAuthSchema(
-                    async (text) => {
-                        const res = await internals.db.execute(sql.raw(text));
-                        return (res.rows ?? []) as Record<string, unknown>[];
-                    },
+                    async (text) => (await queryable.query<Record<string, unknown>>(text)).rows,
                     { info: (m) => logger.info(m), warn: (m) => logger.warn(m) }
                 );
             } catch (err) {

package/src/schema/drizzle-ddl.ts

@@ -0,0 +1,33 @@
+/**
+ * The server's DDL bootstrapper, over a Drizzle handle.
+ *
+ * `createDdlBootstrapper` in `@rebasepro/server` wants a plain
+ * `(sql: string) => Promise<rows>`; the driver's internal stores hold a Drizzle
+ * database. This is the adapter between them, and it exists so the retry policy
+ * has exactly one definition. A second copy of the SQLSTATE list living in the
+ * driver is how the two drift apart, and the drift is invisible: both versions
+ * work perfectly on every single-instance deployment.
+ */
+import { sql } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { createDdlBootstrapper, type DdlBootstrapper } from "@rebasepro/server";
+
+/**
+ * A {@link DdlBootstrapper} that runs its statements through `db.execute`.
+ *
+ * @param db    the Drizzle handle the calling store already holds
+ * @param scope log prefix identifying the caller, e.g. `"channel-presence"`
+ */
+export function drizzleDdlBootstrapper(
+    db: NodePgDatabase<Record<string, unknown>>,
+    scope: string
+): DdlBootstrapper {
+    return createDdlBootstrapper(async (statement: string) => {
+        // `sql.raw`, because everything reaching this path is DDL assembled from
+        // identifiers that were validated before they got here — there is no
+        // parameter to bind, and Drizzle's tagged template would treat the whole
+        // statement as one.
+        const result = await db.execute(sql.raw(statement));
+        return (result as unknown as { rows?: Record<string, unknown>[] }).rows ?? [];
+    }, scope);
+}

package/src/schema/ensure-collection-tables.test.ts

@@ -250,3 +250,102 @@ describe("applying the plan", () => {
         expect(plan.actions).toEqual([]);
     });
 });
+
+/**
+ * Two instances booting into the same fresh database.
+ *
+ * These inject the error at the statement level rather than driving two real
+ * boots, and that is deliberate: the end state after a real race is usually
+ * correct anyway — one instance always finishes — so a test that only asserts
+ * the end state passes against the broken code as well as the fixed code. The
+ * defect was never "the table is missing"; it was that the throw abandoned
+ * every remaining action, so the loser skipped work it had not attempted yet.
+ */
+describe("a simultaneous boot", () => {
+    /** A driver error shaped the way node-postgres reports one, through drizzle. */
+    function pgError(code: string, extra: Record<string, unknown> = {}): Error {
+        const inner = Object.assign(new Error(`pg error ${code}`), { code, ...extra });
+        // Drizzle wraps the driver error; nothing useful is ever on the top level.
+        return Object.assign(new Error("Failed query"), { cause: inner });
+    }
+
+    /** Records every statement, and fails the first match of `failOn` once. */
+    function racingClient(
+        failOn: RegExp,
+        error: Error,
+        options: { forever?: boolean } = {}
+    ): { client: Queryable; executed: string[] } {
+        const executed: string[] = [];
+        let thrown = false;
+        return {
+            executed,
+            client: {
+                async query<T>(sql: string): Promise<{ rows: T[] }> {
+                    executed.push(sql);
+                    if (failOn.test(sql) && (options.forever || !thrown)) {
+                        thrown = true;
+                        throw error;
+                    }
+                    return { rows: [] as T[] };
+                }
+            }
+        };
+    }
+
+    it("carries on to the remaining actions when it loses a CREATE TABLE race", async () => {
+        // 42P07 duplicate_table: a peer created it between our catalog read and
+        // our write. The table exists; everything after it still has to run.
+        const { client, executed } = racingClient(/^CREATE TABLE/, pgError("42P07"), { forever: true });
+
+        const plan = await ensureCollectionTables(client, [posts]);
+
+        expect(plan.actions.length).toBeGreaterThan(0);
+        // The proof: statements that come *after* the losing one were attempted.
+        expect(executed.some(s => s.startsWith("ALTER TABLE"))).toBe(true);
+    });
+
+    it("treats a catalog unique violation as the object already existing", async () => {
+        // The one measured in practice: `CREATE TYPE` has no IF NOT EXISTS, so
+        // the loser gets 23505 on pg_type's own index.
+        const { client, executed } = racingClient(
+            /^CREATE TYPE/,
+            pgError("23505", { constraint: "pg_type_typname_nsp_index" }),
+            { forever: true }
+        );
+
+        await ensureCollectionTables(client, [posts]);
+
+        expect(executed.some(s => s.startsWith("CREATE TABLE"))).toBe(true);
+    });
+
+    it("retries a deadlock and then succeeds", async () => {
+        // 40P01: two boots taking catalog locks in step. Unlike a duplicate, the
+        // statement did nothing at all, so it must actually be run again.
+        const { client, executed } = racingClient(/^CREATE TABLE/, pgError("40P01"));
+
+        await ensureCollectionTables(client, [posts]);
+
+        expect(executed.filter(s => s.startsWith("CREATE TABLE")).length).toBeGreaterThan(1);
+    });
+
+    it("still fails loudly on a unique violation from the customer's own data", async () => {
+        // A named constraint, not a `pg_` catalog index — this is a real problem
+        // with real rows and must not be swallowed as "someone beat me to it".
+        // It is still retried first, because 23505 is in the retryable set and
+        // this shape cannot be told from a race until the constraint name is
+        // read; what matters is that it ends in a throw rather than a shrug.
+        const { client } = racingClient(
+            /^CREATE TABLE/,
+            pgError("23505", { constraint: "posts_slug_key" }),
+            { forever: true }
+        );
+
+        await expect(ensureCollectionTables(client, [posts])).rejects.toThrow(/public\.posts/);
+    });
+
+    it("still fails loudly on a permission error", async () => {
+        const { client } = racingClient(/^CREATE TABLE/, pgError("42501"), { forever: true });
+
+        await expect(ensureCollectionTables(client, [posts])).rejects.toThrow(/public\.posts/);
+    });
+});

package/src/schema/ensure-collection-tables.ts

@@ -27,7 +27,7 @@
  */
 import { type CollectionConfig, type Property, isPostgresCollectionConfig } from "@rebasepro/types";
 import { getTableName, relationalCollections } from "@rebasepro/common";
-import { logger } from "@rebasepro/server";
+import { logger, isConcurrentDdlRace, isDuplicateObjectRace } from "@rebasepro/server";
 import {
     assertSearchIsPostgresOnly,
     buildSearchColumnSpec,
@@ -800,8 +800,11 @@ export async function ensureCollectionTables(
 
     for (const action of plan.actions) {
         try {
-            await client.query(action.sql);
-            log?.(`${action.kind}: ${action.target}`);
+            if (await applyAction(client, action)) {
+                log?.(`${action.kind}: ${action.target}`);
+            } else {
+                log?.(`${action.kind}: ${action.target} (already created by a peer)`);
+            }
         } catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             // A foreign key is the only action that can fail on the customer's
@@ -825,3 +828,62 @@ export async function ensureCollectionTables(
     }
     return { ...plan, failures };
 }
+
+/** Attempts per action, including the first. Matches the server's bootstraps. */
+const DDL_ATTEMPTS = 4;
+
+/**
+ * Run one planned statement, surviving a simultaneous boot.
+ *
+ * Every statement in a plan is written to be idempotent, and that is not the
+ * same as being safe to run concurrently: `CREATE … IF NOT EXISTS` reads the
+ * catalog and then writes to it as two steps, so peers starting together both
+ * see "absent" and the loser gets a duplicate key on a *catalog* index. Measured
+ * against Postgres 18: five instances, 8 of 10 calls lost. `CREATE TYPE` is
+ * worse, because Postgres has no `IF NOT EXISTS` for it at all.
+ *
+ * What made that fatal here rather than merely noisy is the loop this sits in.
+ * A losing statement threw, and the throw abandoned **every remaining action in
+ * the plan** — so a replica that lost one race came up missing tables it never
+ * attempted, and the boot log blamed the one statement that failed.
+ *
+ * @returns `true` if this process applied the statement, `false` if a peer had
+ *   already created the object. The distinction is only for the log; both mean
+ *   the object is now there.
+ * @throws the original error for anything that is not a race — a syntax error, a
+ *   permission failure, a unique constraint the customer's own rows violate.
+ */
+async function applyAction(
+    client: Queryable,
+    action: EnsureAction
+): Promise<boolean> {
+    for (let attempt = 1; ; attempt++) {
+        try {
+            await client.query(action.sql);
+            return true;
+        } catch (err) {
+            // Already there. Not "retry" — the end state this statement wanted
+            // is the end state the database is in, so carry on to the next
+            // action rather than spending three more attempts proving it.
+            if (isDuplicateObjectRace(err)) {
+                logger.debug(
+                    `[schema] ${action.kind} ${action.target}: already created by another instance`
+                );
+                return false;
+            }
+            // Retryable but not yet satisfied — a deadlock between two boots
+            // taking catalog locks in step. The statement did nothing; run it
+            // again after a jittered pause so peers that collided once do not
+            // collide again in lockstep.
+            if (isConcurrentDdlRace(err) && attempt < DDL_ATTEMPTS) {
+                logger.debug(
+                    `[schema] ${action.kind} ${action.target}: lost a race with another instance ` +
+                    `(attempt ${attempt}/${DDL_ATTEMPTS}) — retrying`
+                );
+                await new Promise(resolve => setTimeout(resolve, 40 * attempt * (1 + Math.random())));
+                continue;
+            }
+            throw err;
+        }
+    }
+}

package/src/services/FetchService.ts

@@ -1,4 +1,4 @@
-import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, isNotNull, isNull, lt, or, SQL, TableRelationalConfig, TablesRelationalConfig } from "drizzle-orm";
+import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, isNotNull, isNull, lt, or, sql, SQL, TableRelationalConfig, TablesRelationalConfig } from "drizzle-orm";
 import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
 import { CollectionConfig, FilterValues, OrderByTuple, ResolvedRelation, LogicalCondition, isManyToMany } from "@rebasepro/types";
 import type { VectorSearchParams } from "@rebasepro/types";
@@ -1326,6 +1326,131 @@ relatedTo: hop });
         return Number(result[0]?.count || 0);
     }
 
+    /**
+     * `count`/`sum`/`avg`/`min`/`max`, optionally grouped.
+     *
+     * The gap this fills is narrow and constant: every dashboard wants "revenue
+     * by status" and "orders per day", and without it the options were a custom
+     * function holding hand-written SQL, or fetching every row and reducing in
+     * JavaScript — which is wrong at any size that matters, and silently wrong
+     * under a `limit`.
+     *
+     * It runs through the same request-scoped handle as every other read, so
+     * **RLS applies to the rows being aggregated**. That is the property worth
+     * protecting here: an aggregate is an effective way to read data you cannot
+     * select, and `count(*)` over a table whose policies would return nothing
+     * has to be zero.
+     */
+    async aggregate<M extends Record<string, unknown>>(
+        collectionPath: string,
+        options: {
+            aggregates: { fn: "count" | "sum" | "avg" | "min" | "max"; field?: string; alias: string }[];
+            groupBy?: string[];
+            filter?: FilterValues<Extract<keyof M, string>>;
+            logical?: LogicalCondition;
+            searchString?: string;
+            limit?: number;
+        }
+    ): Promise<Record<string, unknown>[]> {
+        const collection = getCollectionByPath(collectionPath, this.registry);
+        const table = getTableForCollection(collection, this.registry);
+        const columns = getTableColumns(table);
+
+        const columnFor = (field: string, forWhat: string): AnyPgColumn => {
+            const column = columns[field as keyof typeof columns] as AnyPgColumn | undefined;
+            if (!column) {
+                throw ApiError.badRequest(
+                    `Unknown field '${field}' in ${forWhat}. Valid fields: ${Object.keys(columns).sort().join(", ")}`,
+                    "UNKNOWN_AGGREGATE_FIELD"
+                );
+            }
+            return column;
+        };
+
+        const selection: Record<string, SQL> = {};
+
+        for (const aggregate of options.aggregates) {
+            if (aggregate.fn === "count" && !aggregate.field) {
+                selection[aggregate.alias] = sql`count(*)`;
+                continue;
+            }
+            const column = columnFor(aggregate.field as string, `${aggregate.fn}()`);
+            switch (aggregate.fn) {
+                case "count": selection[aggregate.alias] = sql`count(${column})`; break;
+                // Cast through numeric so what comes back is a string this
+                // method parses, rather than a float whose precision depends on
+                // the column type — `avg` over an integer column is otherwise
+                // one shape here and another there.
+                case "sum": selection[aggregate.alias] = sql`sum(${column})::numeric`; break;
+                case "avg": selection[aggregate.alias] = sql`avg(${column})::numeric`; break;
+                case "min": selection[aggregate.alias] = sql`min(${column})`; break;
+                case "max": selection[aggregate.alias] = sql`max(${column})`; break;
+            }
+        }
+
+        const groupColumns = (options.groupBy ?? []).map(field => ({
+            field,
+            column: columnFor(field, "groupBy")
+        }));
+        for (const group of groupColumns) {
+            selection[group.field] = sql`${group.column}`;
+        }
+
+        let query = this.db.select(selection).from(table).$dynamic();
+
+        const conditions: SQL[] = [];
+        if (options.searchString) {
+            const searchConditions = DrizzleConditionBuilder.buildSearchConditions(
+                options.searchString, collection.properties, table, collection
+            );
+            // No searchable field means no row matches — the same impossible
+            // WHERE the listing uses, rather than an unfiltered aggregate.
+            if (searchConditions.length === 0) return [];
+            conditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions) as SQL);
+        }
+        if (options.filter) {
+            conditions.push(...this.buildFilterConditions(options.filter, table, collectionPath));
+        }
+        if (options.logical) {
+            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(
+                options.logical, table, collectionPath, this.filterContext(collectionPath, table)
+            );
+            if (logicalCondition) conditions.push(logicalCondition);
+        }
+        if (conditions.length > 0) {
+            const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(conditions);
+            if (finalCondition) query = query.where(finalCondition);
+        }
+
+        if (groupColumns.length > 0) {
+            query = query.groupBy(...groupColumns.map(g => g.column));
+            // Bounded for the same reason a listing is: grouping by a
+            // high-cardinality column is a whole table's worth of rows in one
+            // response.
+            if (options.limit) query = query.limit(options.limit);
+        }
+
+        const rows = await query as Record<string, unknown>[];
+
+        // `count`, `sum` and `avg` arrive as strings: Postgres returns bigint
+        // and numeric that way because they do not fit a JS number in general.
+        // They do fit for every aggregate anyone puts on a dashboard, and a
+        // caller handed `"12"` where they expected `12` has to find that out
+        // for themselves. Parsed once, here.
+        const numericAliases = new Set(
+            options.aggregates.filter(a => a.fn === "count" || a.fn === "sum" || a.fn === "avg").map(a => a.alias)
+        );
+        return rows.map(row => {
+            const out: Record<string, unknown> = { ...row };
+            for (const alias of numericAliases) {
+                if (out[alias] === null || out[alias] === undefined) continue;
+                const parsed = Number(out[alias]);
+                if (!Number.isNaN(parsed)) out[alias] = parsed;
+            }
+            return out;
+        });
+    }
+
     /**
      * Check if a field value is unique
      */

package/src/services/channel-history.ts

@@ -35,6 +35,7 @@ import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { ChannelHistoryEntry, ChannelRetentionRule } from "@rebasepro/types";
 import { logger } from "@rebasepro/server";
 import { revokeInternalTableSql } from "@rebasepro/common";
+import { drizzleDdlBootstrapper } from "../schema/drizzle-ddl";
 
 /** How many messages a replay returns when the caller does not say. */
 const DEFAULT_REPLAY_LIMIT = 200;
@@ -167,12 +168,19 @@ export class ChannelHistoryStore {
     async ensureTables(): Promise<void> {
         if (!this.enabled || this.tablesReady) return;
 
-        await this.db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
+        // Contained, retrying steps rather than one straight sequence — see the
+        // note on `ChannelPresenceStore.ensureTables`. The failure mode here is
+        // the same and the stakes are the same: the two `REVOKE`s at the end are
+        // what keep retained broadcasts off the end-user role, and a lost create
+        // race used to skip them.
+        const ddl = drizzleDdlBootstrapper(this.db, "channel-history");
+
+        await ddl.ensureObject("rebase schema", "CREATE SCHEMA IF NOT EXISTS rebase");
 
         // The primary key is exactly the replay query's access path
         // (`channel = $1 AND seq > $2 ORDER BY seq`), so it needs no further
         // index of its own.
-        await this.db.execute(sql`
+        await ddl.ensureObject("channel_messages table", `
             CREATE TABLE IF NOT EXISTS rebase.channel_messages (
                 channel TEXT NOT NULL,
                 seq BIGINT NOT NULL,
@@ -185,14 +193,14 @@ export class ChannelHistoryStore {
         `);
 
         // Only for the TTL arm of pruning; the limit arm rides the primary key.
-        await this.db.execute(sql`
+        await ddl.ensureObject("channel_messages created_at index", `
             CREATE INDEX IF NOT EXISTS idx_channel_messages_created
             ON rebase.channel_messages (created_at)
         `);
 
         // Never pruned — see the note at the top of this file. One row per
         // channel that has ever retained a message.
-        await this.db.execute(sql`
+        await ddl.ensureObject("channel_cursors table", `
             CREATE TABLE IF NOT EXISTS rebase.channel_cursors (
                 channel TEXT PRIMARY KEY,
                 last_seq BIGINT NOT NULL
@@ -209,8 +217,32 @@ export class ChannelHistoryStore {
         // `docs/channel-authorization.md`. The driver's schema-wide
         // grant reaches these (created here, after it ran), so take the
         // privilege back.
-        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")));
-        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")));
+        //
+        // Driven off a probe of what exists rather than off who won each create.
+        const [messagesReady, cursorsReady] = await Promise.all([
+            ddl.isReadable("rebase.channel_messages"),
+            ddl.isReadable("rebase.channel_cursors")
+        ]);
+        if (messagesReady) {
+            await ddl.step("channel_messages revoke", () =>
+                this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")))
+            );
+        }
+        if (cursorsReady) {
+            await ddl.step("channel_cursors revoke", () =>
+                this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")))
+            );
+        }
+
+        if (!messagesReady || !cursorsReady) {
+            // Left un-ready on purpose so the next call retries. Announcing
+            // "ready" here is what would turn a half-created schema into replays
+            // that answer empty forever.
+            logger.warn(
+                "[ChannelHistory] Retained-channel tables are not both present; history is not ready yet."
+            );
+            return;
+        }
 
         this.tablesReady = true;
         logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);