@rebasepro/server-postgres 0.14.1 → 0.14.2-canary.g27a129e

package/dist/index.es.js

@@ -3,12 +3,12 @@ import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
 import { n as resolveClientListLimit, t as ListLimitError } from "./data_driver-ULAyJEi9.js";
-import { $ as mergeDeep, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as isPrototypePollutingKey, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as toWireKey, Z as getPolicyNamesForRule, _ as OrderBySpecError, at as isManyToMany, b as CollectionRegistry, et as camelCase, g as buildSdkData, h as visibleColumnProjection, it as hasForeignKeyOnTarget, j as findRelation, l as buildSearchColumnSpec, ot as Vector, q as generateForeignKeyName, r as authUsersColumnSql, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as toSnakeCase, u as hiddenColumnsOption, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./auth-users-columns-C-FDnL_e.js";
-import { c as isPostgresCollectionConfig, f as ALL_WHERE_FILTER_OPS, l as isRelationalCollectionConfig } from "./src-DCdn3Val.js";
-import { t as createPostgresWebSocket } from "./websocket-D2jXv0Ds.js";
-import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-gUNDfm7l.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-BH0Dzo_h.js";
-import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-69hYT8nr.js";
+import { $ as mergeDeep, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as isPrototypePollutingKey, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as toWireKey, Z as getPolicyNamesForRule, _ as OrderBySpecError, at as isManyToMany, b as CollectionRegistry, et as camelCase, g as buildSdkData, h as visibleColumnProjection, it as hasForeignKeyOnTarget, j as findRelation, l as buildSearchColumnSpec, ot as Vector, q as generateForeignKeyName, r as authUsersColumnSql, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as toSnakeCase, u as hiddenColumnsOption, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./auth-users-columns-JJ8ngvy5.js";
+import { c as isPostgresCollectionConfig, f as ALL_WHERE_FILTER_OPS, g as encodeRelationAggregateSort, l as isRelationalCollectionConfig, v as parseRelationAggregateSort } from "./src-BBFsDaeA.js";
+import { t as createPostgresWebSocket } from "./websocket-BVgDVO-V.js";
+import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-BDBfuTD4.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-czK-OAuG.js";
+import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-B5Sajku6.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createDdlBootstrapper, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
@@ -552,6 +552,22 @@ var targetOf = (relation) => {
 		return;
 	}
 };
+/**
+* The SQL each aggregate sort function compiles to.
+*
+* A lookup rather than interpolation, and `sql.raw` applied to five constants
+* written out here rather than to anything derived from a request. The key is
+* already validated by `parseRelationAggregateSort` — this is the second lock
+* on the same door, so that a future caller reaching the builder directly
+* cannot put a string from the wire where a function name goes.
+*/
+var AGGREGATE_SQL = {
+	min: sql.raw("min"),
+	max: sql.raw("max"),
+	count: sql.raw("count"),
+	sum: sql.raw("sum"),
+	avg: sql.raw("avg")
+};
 /** Column types `ILIKE '%…%'` is defined on. */
 var ILIKE_SQL_TYPES = /^(text|varchar|character varying|char|character|bpchar|citext)\b/;
 /**
@@ -616,6 +632,27 @@ function getUnknownFilterFieldsMode() {
 * of habit, and refusing it would be pedantry about a distinction this layer
 * erases anyway.
 */
+/**
+* Split `applications.status` into the relation and the column it addresses.
+*
+* One dot, and only the first one: a relation name cannot contain a dot, and
+* everything after it is handed to the target as a single column key. A second
+* dot would be a second hop — `talents.applications.job.title` — which is a
+* different feature (it needs a chain of subqueries, and a chain has to decide
+* what "some" means at every level), so it is refused rather than silently read
+* as a column named `job.title` that no table has.
+*
+* Returns `undefined` for a field with no dot, which leaves every existing
+* filter on exactly the path it took before.
+*/
+function parseRelationFieldPath(field) {
+	const dot = field.indexOf(".");
+	if (dot <= 0 || dot === field.length - 1) return void 0;
+	return {
+		relationKey: field.slice(0, dot),
+		fieldKey: field.slice(dot + 1)
+	};
+}
 function parseJsonFieldPath(field) {
 	if (!field.includes("->")) return void 0;
 	const segments = field.split(/->>?/).map((s) => s.trim()).filter(Boolean);
@@ -819,6 +856,11 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 					sourceIdColumn: correlationColumn
 				};
 			}
+			const relationField = parseRelationFieldPath(field);
+			if (relationField && registry && sourceIdColumn) {
+				const target = this.resolveRelationFieldTarget(table, relationField, collection, registry, sourceIdColumn, field, collectionPath);
+				if (target) return target;
+			}
 		}
 		for (const guess of [
 			`${field}Id`,
@@ -847,6 +889,59 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		});
 	}
 	/**
+	* `applications.status` — the relation, and the column of the target it
+	* addresses.
+	*
+	* `undefined` when the first segment names no relation: the field simply is
+	* not a relation path, and resolution carries on to the guesses and then to
+	* the unknown-field answer, which is where a typo belongs. A segment that
+	* *does* name a relation is a different matter — the author plainly meant
+	* this shape — so everything after that point throws rather than returning,
+	* naming what went wrong. Falling through would report "unknown filter
+	* field 'applications.status'" and list the columns of the wrong table.
+	*
+	* `via` is refused for the reason it is absent from
+	* `filterableRelationKinds`: its join path is authored source → target with
+	* no stated inverse, so there is nothing to correlate a subquery back to.
+	*/
+	static resolveRelationFieldTarget(table, path, collection, registry, sourceIdColumn, field, collectionPath) {
+		const relation = resolveCollectionRelations(collection)[path.relationKey];
+		if (!relation) return void 0;
+		if (relation.kind === "via") throw ApiError.badRequest(`Cannot filter by '${field}' on collection '${collectionPath}': '${path.relationKey}' is a \`via\` relation, whose join path is authored one way only, so there is nothing to correlate a subquery back to.`, "UNSUPPORTED_RELATION_FILTER", {
+			field,
+			collection: collectionPath,
+			relation: path.relationKey,
+			kind: relation.kind
+		});
+		const targetCollection = targetOf(relation);
+		const targetTable = targetCollection && registry.getTable(getTableName$1(targetCollection));
+		if (!targetCollection || !targetTable) throw new Error(`Table not found for the target of relation '${relation.relationName}' on '${collectionPath}', so '${field}' has nothing to filter against.`);
+		const targetColumn = relationColumn(targetTable, targetCollection, path.fieldKey) ?? (path.fieldKey in targetTable ? targetTable[path.fieldKey] : void 0);
+		if (!targetColumn) {
+			let validFields = [];
+			try {
+				validFields = Object.keys(getTableColumns(targetTable)).sort();
+			} catch {}
+			throw ApiError.badRequest(`Unknown field '${path.fieldKey}' on '${targetCollection.slug}', the target of relation '${path.relationKey}' on collection '${collectionPath}'` + (validFields.length > 0 ? `. Valid fields: ${validFields.join(", ")}` : ""), "UNKNOWN_FILTER_FIELD", {
+				field,
+				collection: collectionPath,
+				relation: path.relationKey,
+				targetCollection: targetCollection.slug,
+				...validFields.length > 0 && { validFields }
+			});
+		}
+		const correlationColumn = relation.kind === "belongsTo" ? relationColumn(table, collection, relation.localKey) : hasForeignKeyOnTarget(relation) && relation.sourceKey ? relationColumn(table, collection, relation.sourceKey) : sourceIdColumn;
+		if (!correlationColumn) throw new Error(`Relation '${relation.relationName}' on '${collectionPath}' names a key that is not a column there, so '${field}' has nothing to correlate against.`);
+		return {
+			kind: "relation-field",
+			relation,
+			registry,
+			sourceIdColumn: correlationColumn,
+			targetTable,
+			targetColumn
+		};
+	}
+	/**
 	* Build filter conditions from FilterValues
 	*/
 	static buildFilterConditions(filter, table, collectionPath, options = {}) {
@@ -881,6 +976,7 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 	static compileFilterTarget(target, op, value, field, collectionPath) {
 		if (target.kind === "column") return this.buildSingleFilterCondition(target.column, op, value);
 		if (target.kind === "json") return this.buildJsonPathCondition(target.column, target.path, op, value);
+		if (target.kind === "relation-field") return this.buildRelationFieldCondition(target, op, value, field, collectionPath);
 		return this.buildRelationFilterCondition(target.relation, op, value, target.sourceIdColumn, target.registry, field, collectionPath);
 	}
 	/**
@@ -1095,6 +1191,297 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 			});
 		}
 	}
+	/**
+	* A filter on a *column of the related row* — `applications.status`.
+	*
+	* The same `EXISTS` {@link buildRelationFilterCondition} builds, with the
+	* predicate moved off the target's id and onto one of its columns:
+	*
+	*     EXISTS (SELECT 1 FROM talent_applications AS t
+	*             WHERE t.talent_id = talents.id
+	*               AND t.status IN ('applied', 'reviewing', 'interview'))
+	*
+	* which is the shape every "who is waiting" queue is written in. Without
+	* it the only way to ask is to fetch every row and filter in the browser,
+	* and a filter the client applies after paging is not a filter — the page
+	* was already chosen without it.
+	*
+	* A many-to-many needs one more table than the id filter does. That one
+	* stops at the junction, because the junction already holds the value it
+	* compares; a column of the target is a table further out, so the subquery
+	* joins the target to the junction and correlates from the junction. The
+	* join is inside `EXISTS`, so it cannot multiply the outer rows the way a
+	* top-level join through a junction would.
+	*
+	* `belongsTo` is included even though its foreign key is a column here:
+	* `author.name` is a column of another table either way, and refusing the
+	* one relation kind that reads most naturally would be a rule about
+	* implementation rather than about meaning.
+	*
+	* Under RLS the subquery runs as the reader, so it sees the target rows
+	* that reader's policies allow and no others. On the positive direction
+	* that is exactly right. On the negative — `!=`, `not-in`, and any
+	* `NOT EXISTS` — "no related row satisfies this" and "no related row this
+	* reader can see satisfies this" are the same sentence, so a target table
+	* with row-level security and no `SELECT` policy for `rebase_user` makes
+	* every row look unmatched and the negative filter over-reports. Nothing is
+	* leaked: the outer table's own policies still decide which rows exist. The
+	* cause is a missing policy on the target rather than anything here, and it
+	* is the same caveat the id-filter path carries.
+	*/
+	static buildRelationFieldCondition(target, op, value, field, collectionPath) {
+		const alias = "__rel_field";
+		const { relation, targetTable, targetColumn } = target;
+		const ref = sql`${sql.identifier(alias)}.${sql.identifier(targetColumn.name)}`;
+		const { predicate, negate } = this.buildRelationColumnPredicate(ref, targetColumn, op, value, field, collectionPath);
+		let from;
+		let correlation;
+		if (relation.kind === "manyToMany") {
+			const { table: junctionName, sourceColumn, targetColumn: junctionTargetColumn } = relation.through;
+			const junctionTable = target.registry.getTable(junctionName);
+			if (!junctionTable) throw new Error(`Junction table not found: ${junctionName}`);
+			const sourceCol = junctionTable[sourceColumn];
+			const targetCol = junctionTable[junctionTargetColumn];
+			if (!sourceCol || !targetCol) throw new Error(`Junction columns '${sourceColumn}'/'${junctionTargetColumn}' not found in '${junctionName}'`);
+			const targetKey = this.primaryKeyColumn(targetTable);
+			if (!targetKey) throw new Error(`No primary key or "id" column in the target table of relation '${relation.relationName}', so '${field}' has nothing to join the junction against.`);
+			const junctionAlias = "__rel_field_junction";
+			from = sql`${targetTable} AS ${sql.identifier(alias)} INNER JOIN ${junctionTable} AS ${sql.identifier(junctionAlias)} ON ${sql.identifier(junctionAlias)}.${sql.identifier(targetCol.name)} = ${sql.identifier(alias)}.${sql.identifier(targetKey.name)}`;
+			correlation = sql`${sql.identifier(junctionAlias)}.${sql.identifier(sourceCol.name)} = ${target.sourceIdColumn}`;
+		} else if (relation.kind === "belongsTo") {
+			const targetKey = this.primaryKeyColumn(targetTable);
+			if (!targetKey) throw new Error(`No primary key or "id" column in the target table of relation '${relation.relationName}', so '${field}' has nothing to correlate against.`);
+			from = sql`${targetTable} AS ${sql.identifier(alias)}`;
+			correlation = sql`${sql.identifier(alias)}.${sql.identifier(targetKey.name)} = ${target.sourceIdColumn}`;
+		} else {
+			const foreignKey = relationColumn(targetTable, targetOf(relation), relation.foreignKeyOnTarget);
+			if (!foreignKey) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'.`);
+			from = sql`${targetTable} AS ${sql.identifier(alias)}`;
+			correlation = sql`${sql.identifier(alias)}.${sql.identifier(foreignKey.name)} = ${target.sourceIdColumn}`;
+		}
+		const where = predicate ? sql`${correlation} AND ${predicate}` : correlation;
+		const exists = sql`EXISTS (SELECT 1 FROM ${from} WHERE ${where})`;
+		return negate ? sql`NOT ${exists}` : exists;
+	}
+	/**
+	* The inner predicate of a relation *column* filter, and whether the
+	* `EXISTS` wrapping it is negated.
+	*
+	* The negation rule is the one {@link buildRelationFilterPredicate} states
+	* and holds for exactly the same reason, one column over. A negative
+	* operator is `NOT EXISTS` of the **positive** predicate, never `EXISTS` of
+	* a negated one: `EXISTS (… AND status != 'hired')` asks "does some
+	* application differ from hired", which is true of nearly every candidate
+	* with more than one application and answers nothing anybody asked.
+	* `NOT EXISTS (… AND status = 'hired')` asks "is there no hired
+	* application", which is what unticking a value means — and it makes `==`
+	* and `!=` partition the rows, the way a filter implies they do.
+	*
+	* `is-null` and `is-not-null` are the exception, and deliberately not a
+	* complementary pair here. On a column they compile to `EXISTS (… AND col
+	* IS NULL)` and `EXISTS (… AND col IS NOT NULL)` — "has a related row whose
+	* column is unset" and "has one where it is set" — which is the plain
+	* reading of `applications.status is-not-null` and the useful one. They are
+	* both true of a candidate with two applications, one of each. Making
+	* `is-not-null` the negation instead would make it "no application has an
+	* unset status", which is true of a candidate with no applications at all
+	* and so answers a queue with the very rows the queue exists to exclude.
+	*
+	* Unlike the id path, every operator is available: the compared value is an
+	* ordinary column, so `>=` on a date and `ilike` on a name mean here what
+	* they mean anywhere else. Only an operator that does not exist is refused,
+	* and it throws rather than returning `null` — a dropped condition widens
+	* the read, which is the whole reason this file fails closed.
+	*/
+	static buildRelationColumnPredicate(ref, column, op, value, field, collectionPath) {
+		value = unwrapRelationFilterValue(value);
+		const isNullish = value === null || value === void 0;
+		const equals = () => sql`${ref} = ${value}`;
+		const inList = () => {
+			const values = toMembershipList(value);
+			return values.length === 0 ? sql`FALSE` : sql`${ref} IN (${sql.join(values.map((v) => sql`${v}`), sql`, `)})`;
+		};
+		const isNull = () => sql`${ref} IS NULL`;
+		const contains = () => {
+			const meta = getColumnMeta(column);
+			const isNativeArray = meta.dataType === "array" || meta.columnType === "PgArray";
+			if (op === "array-contains-any") {
+				if (Array.isArray(value) && value.length === 0) return sql`FALSE`;
+				if (Array.isArray(value) && value.length > 0) return isNativeArray ? sql`${ref} && ARRAY[${sql.join(value.map((v) => sql`${v}`), sql`, `)}]` : sql`${ref} ?| array[${sql.join(value.map((v) => sql`${String(v)}`), sql`, `)}]`;
+			}
+			return isNativeArray ? sql`${ref} @> ARRAY[${value}]` : sql`${ref} @> ${JSON.stringify([value])}`;
+		};
+		switch (op) {
+			case "==": return {
+				predicate: isNullish ? isNull() : equals(),
+				negate: false
+			};
+			case "!=": return {
+				predicate: isNullish ? isNull() : equals(),
+				negate: true
+			};
+			case ">": return {
+				predicate: sql`${ref} > ${value}`,
+				negate: false
+			};
+			case ">=": return {
+				predicate: sql`${ref} >= ${value}`,
+				negate: false
+			};
+			case "<": return {
+				predicate: sql`${ref} < ${value}`,
+				negate: false
+			};
+			case "<=": return {
+				predicate: sql`${ref} <= ${value}`,
+				negate: false
+			};
+			case "in": return {
+				predicate: isNullish ? isNull() : inList(),
+				negate: false
+			};
+			case "not-in": return {
+				predicate: isNullish ? isNull() : inList(),
+				negate: true
+			};
+			case "like": return {
+				predicate: sql`${ref} LIKE ${String(value)}`,
+				negate: false
+			};
+			case "not-like": return {
+				predicate: sql`${ref} LIKE ${String(value)}`,
+				negate: true
+			};
+			case "ilike":
+			case "not-ilike":
+				if (!supportsILike(column)) throw ApiError.badRequest(`Operator '${op}' cannot be applied to '${field}' on collection '${collectionPath}': '${column.name}' is ${column.getSQLType?.() ?? "not a text column"}, and case-insensitive matching is only defined on text.`, "UNSUPPORTED_RELATION_FILTER_OPERATOR", {
+					field,
+					collection: collectionPath,
+					operator: op
+				});
+				return {
+					predicate: sql`${ref} ILIKE ${String(value)}`,
+					negate: op === "not-ilike"
+				};
+			case "is-null": return {
+				predicate: isNull(),
+				negate: false
+			};
+			case "is-not-null": return {
+				predicate: sql`${ref} IS NOT NULL`,
+				negate: false
+			};
+			case "array-contains":
+			case "array-contains-any": return {
+				predicate: contains(),
+				negate: false
+			};
+			default: throw ApiError.badRequest(`Unknown filter operator '${op}'. Valid operators: ${ALL_WHERE_FILTER_OPS.join(", ")}.`, "UNKNOWN_FILTER_OPERATOR", {
+				operator: op,
+				validOperators: ALL_WHERE_FILTER_OPS
+			});
+		}
+	}
+	/**
+	* An aggregate over the rows a relation reaches, as a scalar expression —
+	* what `orderBy: [{ relation: "applications", field: "created_at", agg:
+	* "min" }, "asc"]` compiles to.
+	*
+	*     (SELECT min(t.created_at) FROM talent_applications AS t
+	*      WHERE t.talent_id = talents.id)
+	*
+	* A correlated scalar subquery rather than a `LEFT JOIN LATERAL`: the join
+	* would have to be threaded into a query the relational query builder
+	* assembles, while a scalar expression drops straight into `ORDER BY` and
+	* into the keyset comparison behind cursor paging — which has to be the
+	* *same* expression, or paging and ordering disagree and rows are skipped.
+	*
+	* `correlateTo` is what the subquery is pinned against. Left out, it is the
+	* outer row's key column and the expression is correlated in the ordinary
+	* way. Given a literal — the cursor row's id — the subquery stops being
+	* correlated at all, so Postgres evaluates it once for the whole statement
+	* rather than per row. That is how a cursor pages over an aggregate it has
+	* no stored value for: the value is recomputed from the id it does have.
+	*
+	* Over zero related rows `count` is 0 and every other function is NULL,
+	* which is what puts "nobody waiting" at a defined end of the order rather
+	* than wherever a missing value would land. See `buildOrderExpressions` for
+	* where that end is pinned.
+	*
+	* Under RLS the subquery runs as the reader, so a related row the reader
+	* cannot see does not contribute — an aggregate is over the rows that
+	* reader can see, which is the only total it could honestly report.
+	*/
+	static buildRelationAggregateExpression(spec, table, collection, registry, sourceIdColumn, collectionPath, correlateTo) {
+		const relation = resolveCollectionRelations(collection)[spec.relation];
+		if (!relation) throw ApiError.badRequest(`Cannot sort by '${encodeRelationAggregateSort(spec)}' on collection '${collectionPath}': '${spec.relation}' is not a relation there.`, "UNKNOWN_ORDER_BY_FIELD", {
+			field: encodeRelationAggregateSort(spec),
+			collection: collectionPath,
+			relation: spec.relation
+		});
+		if (relation.kind === "via") throw ApiError.badRequest(`Cannot sort by '${encodeRelationAggregateSort(spec)}' on collection '${collectionPath}': \`via\` relations are authored one way only, so there is nothing to correlate a subquery back to.`, "ORDER_BY_FIELD_NOT_SORTABLE", {
+			field: encodeRelationAggregateSort(spec),
+			collection: collectionPath,
+			kind: relation.kind
+		});
+		const targetCollection = targetOf(relation);
+		const targetTable = targetCollection && registry.getTable(getTableName$1(targetCollection));
+		if (!targetCollection || !targetTable) throw new Error(`Table not found for the target of relation '${relation.relationName}' on '${collectionPath}', so there is nothing to aggregate.`);
+		const alias = "__rel_agg";
+		let aggregand = sql`*`;
+		if (spec.field) {
+			const column = relationColumn(targetTable, targetCollection, spec.field) ?? (spec.field in targetTable ? targetTable[spec.field] : void 0);
+			if (!column) {
+				let validFields = [];
+				try {
+					validFields = Object.keys(getTableColumns(targetTable)).sort();
+				} catch {}
+				throw ApiError.badRequest(`Unknown field '${spec.field}' on '${targetCollection.slug}', the target of relation '${spec.relation}' on collection '${collectionPath}'` + (validFields.length > 0 ? `. Valid fields: ${validFields.join(", ")}` : ""), "UNKNOWN_ORDER_BY_FIELD", {
+					field: encodeRelationAggregateSort(spec),
+					collection: collectionPath,
+					relation: spec.relation,
+					targetCollection: targetCollection.slug,
+					...validFields.length > 0 && { validFields }
+				});
+			}
+			aggregand = sql`${sql.identifier(alias)}.${sql.identifier(column.name)}`;
+		} else if (spec.agg !== "count") throw ApiError.badRequest(`'${spec.agg}' needs a field to aggregate — only 'count' means something on its own.`, "ORDER_BY_FIELD_NOT_SORTABLE", {
+			field: encodeRelationAggregateSort(spec),
+			collection: collectionPath
+		});
+		const source = correlateTo === void 0 ? sql`${sourceIdColumn}` : sql`${correlateTo}`;
+		let from;
+		let correlation;
+		if (relation.kind === "manyToMany") {
+			const { table: junctionName, sourceColumn, targetColumn } = relation.through;
+			const junctionTable = registry.getTable(junctionName);
+			if (!junctionTable) throw new Error(`Junction table not found: ${junctionName}`);
+			const sourceCol = junctionTable[sourceColumn];
+			const targetCol = junctionTable[targetColumn];
+			if (!sourceCol || !targetCol) throw new Error(`Junction columns '${sourceColumn}'/'${targetColumn}' not found in '${junctionName}'`);
+			const targetKey = this.primaryKeyColumn(targetTable);
+			if (!targetKey) throw new Error(`No primary key or "id" column in the target table of relation '${relation.relationName}'.`);
+			const junctionAlias = "__rel_agg_junction";
+			from = sql`${targetTable} AS ${sql.identifier(alias)} INNER JOIN ${junctionTable} AS ${sql.identifier(junctionAlias)} ON ${sql.identifier(junctionAlias)}.${sql.identifier(targetCol.name)} = ${sql.identifier(alias)}.${sql.identifier(targetKey.name)}`;
+			correlation = sql`${sql.identifier(junctionAlias)}.${sql.identifier(sourceCol.name)} = ${source}`;
+		} else if (relation.kind === "belongsTo") {
+			const targetKey = this.primaryKeyColumn(targetTable);
+			const localKey = relationColumn(table, collection, relation.localKey);
+			if (!targetKey || !localKey) throw new Error(`Relation '${relation.relationName}' on '${collectionPath}' names a key that is not a column, so there is nothing to aggregate against.`);
+			from = sql`${targetTable} AS ${sql.identifier(alias)}`;
+			const owner = correlateTo === void 0 ? sql`${localKey}` : sql`(SELECT ${sql.identifier(localKey.name)} FROM ${table} WHERE ${sourceIdColumn} = ${correlateTo})`;
+			correlation = sql`${sql.identifier(alias)}.${sql.identifier(targetKey.name)} = ${owner}`;
+		} else {
+			const foreignKey = relationColumn(targetTable, targetCollection, relation.foreignKeyOnTarget);
+			if (!foreignKey) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'.`);
+			const sourceKeyColumn = relation.sourceKey ? relationColumn(table, collection, relation.sourceKey) : sourceIdColumn;
+			if (!sourceKeyColumn) throw new Error(`\`sourceKey: "${relation.sourceKey}"\` on relation '${relation.relationName}' is not a column on '${collectionPath}'.`);
+			const pinned = correlateTo === void 0 ? sql`${sourceKeyColumn}` : relation.sourceKey ? sql`(SELECT ${sql.identifier(sourceKeyColumn.name)} FROM ${table} WHERE ${sourceIdColumn} = ${correlateTo})` : sql`${correlateTo}`;
+			from = sql`${targetTable} AS ${sql.identifier(alias)}`;
+			correlation = sql`${sql.identifier(alias)}.${sql.identifier(foreignKey.name)} = ${pinned}`;
+		}
+		return sql`(SELECT ${AGGREGATE_SQL[spec.agg]}(${aggregand}) FROM ${from} WHERE ${correlation})`;
+	}
 	/** The column a table's rows are keyed by: its primary key, else `id`. */
 	static primaryKeyColumn(table) {
 		return Object.values(table).find((col) => col.primary) ?? Object.values(table).find((col) => col.name === "id");
@@ -3155,6 +3542,37 @@ function isRoleSwitchingPermissionError(error) {
 	return msg.includes("set role") || msg.includes("member of role");
 }
 /**
+* Was this `42501` the *caller* being refused by a policy, rather than the
+* server lacking a privilege?
+*
+* Both arrive as `insufficient_privilege`, and they are opposite kinds of
+* problem. A row-level-security refusal is a working access-control system
+* doing its job: the caller asked for something their policies do not permit,
+* which is a 403 and nobody's bug. A missing `GRANT` is the deployment being
+* wrong — the connection role cannot touch the table at all, no policy is
+* involved, and nothing the caller changes about the request will help.
+*
+* Postgres distinguishes them in the message, so this does too:
+*
+*     new row violates row-level security policy for table "notes"  → the caller
+*     permission denied for table notes                             → the server
+*
+* Only writes reach this. A read that RLS excludes is not an error — the rows
+* are filtered and the caller gets an empty page — so the erroring case is
+* specifically an `INSERT`/`UPDATE` whose row fails a policy's `WITH CHECK`.
+*
+* Matched on the message because that is the only thing carrying the
+* distinction; the SQLSTATE is identical either way. Narrow by design: anything
+* not naming row-level security stays the server's problem, since reporting a
+* genuine privilege misconfiguration as "forbidden" would send an operator
+* hunting for a policy bug that does not exist.
+*/
+function isRowLevelSecurityDenial(error) {
+	const pgError = extractPgError(error);
+	if (!pgError || pgError.code !== "42501") return false;
+	return pgError.message.toLowerCase().includes("row-level security policy");
+}
+/**
 * Translate a raw PostgreSQL error into a user-friendly message.
 *
 * @param pgError  - The extracted PostgreSQL error (from {@link extractPgError})
@@ -3209,8 +3627,11 @@ function pgErrorToFriendlyMessage(pgError, context) {
 			message: `Table not found for "${context}": ${pgMessage}. Check if your schema is up to date (run migrations).${suffix}`,
 			code
 		};
-		case "42501": return {
-			message: `Permission denied on "${tableRef}". Check your database credentials and RLS policies.${suffix}`,
+		case "42501": return pgMessage.toLowerCase().includes("row-level security policy") ? {
+			message: `Not permitted to write this row in "${tableRef}": it does not satisfy the row-level security policy.${suffix}`,
+			code
+		} : {
+			message: `Permission denied on "${tableRef}": the database role this server connects as lacks privileges on it.${suffix}`,
 			code
 		};
 		case "28000": return {
@@ -3376,6 +3797,30 @@ var FetchService = class FetchService {
 		return this.resolveOrderByField(table, orderBy, collection);
 	}
 	/**
+	* The aggregate a sort key names, as an expression, or `undefined` if the
+	* key is not one.
+	*
+	* `cursorId` builds the same expression pinned to the cursor row — see
+	* {@link DrizzleConditionBuilder.buildRelationAggregateExpression}.
+	*
+	* A key that *parses* as an aggregate but names no relation, or a column
+	* the target does not have, throws rather than falling through to the
+	* column path. Falling through would report `min(applications.created_at)`
+	* as an unknown column and list the columns of the wrong table.
+	*/
+	resolveAggregateOrderTarget(table, orderBy, collection, collectionPath, cursorId) {
+		const spec = parseRelationAggregateSort(orderBy);
+		if (!spec) return void 0;
+		if (!collection || !collectionPath) throw ApiError.badRequest(`Cannot sort by '${orderBy}': an aggregate sort needs the collection it is written against, and this query carries none.`, "ORDER_BY_FIELD_NOT_SORTABLE", { field: orderBy });
+		const primaryKeys = getPrimaryKeys(collection, this.registry);
+		const idColumn = primaryKeys.length === 1 ? table[primaryKeys[0].fieldName] : void 0;
+		if (!idColumn) throw ApiError.badRequest(`Cannot sort by '${orderBy}' on collection '${collectionPath}': the subquery correlates on a single key column, and this collection has none or has a composite one.`, "ORDER_BY_FIELD_NOT_SORTABLE", {
+			field: orderBy,
+			collection: collectionPath
+		});
+		return DrizzleConditionBuilder.buildRelationAggregateExpression(spec, table, collection, this.registry, idColumn, collectionPath, cursorId);
+	}
+	/**
 	* Resolve every sort key to the expression it orders by, in order of
 	* significance.
 	*
@@ -3384,9 +3829,19 @@ var FetchService = class FetchService {
 	* unknown-field mode, where dropping is the configured answer, and dropping
 	* one key of several still honours the ones that did resolve.
 	*/
-	resolveOrderKeys(table, keys, collection, searchString) {
+	resolveOrderKeys(table, keys, collection, searchString, collectionPath, cursorId) {
 		const resolved = [];
 		for (const [field, direction] of keys) {
+			const aggregate = this.resolveAggregateOrderTarget(table, field, collection, collectionPath);
+			if (aggregate) {
+				resolved.push({
+					field,
+					direction,
+					target: aggregate,
+					...cursorId !== void 0 && { cursorTarget: this.resolveAggregateOrderTarget(table, field, collection, collectionPath, cursorId) }
+				});
+				continue;
+			}
 			const target = this.resolveOrderTarget(table, field, collection, searchString);
 			if (target) resolved.push({
 				field,
@@ -3406,9 +3861,18 @@ var FetchService = class FetchService {
 	* to agree: they did not, and an ascending sort paged with `id >` against an
 	* `ORDER BY … , id DESC`, so rows sharing a sort value were dropped from
 	* every page after the first.
+	*
+	* Where the NULLs go is written out rather than inherited. Postgres already
+	* defaults to `NULLS LAST` ascending and `NULLS FIRST` descending, so this
+	* changes no query — but {@link buildKeysetComparison} encodes that exact
+	* placement, and an invariant two functions depend on should be stated in
+	* both rather than assumed in one. It matters most for the keys that are
+	* *always* nullable: an aggregate over a relation is NULL for every row the
+	* relation reaches nothing from, which is precisely the "nobody waiting"
+	* end of a queue.
 	*/
 	buildOrderExpressions(keys, idField) {
-		const expressions = keys.map(({ direction, target }) => direction === "asc" ? asc(target) : desc(target));
+		const expressions = keys.map(({ direction, target }) => direction === "asc" ? sql`${target} ASC NULLS LAST` : sql`${target} DESC NULLS FIRST`);
 		expressions.push(desc(idField));
 		return expressions;
 	}
@@ -3596,12 +4060,12 @@ var FetchService = class FetchService {
 		if (keys) {
 			if (keys.some(([field]) => field === FetchService.SCORE_FIELD)) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with `orderBy: \"_score\"`. Relevance is computed per query rather than stored, so it cannot key a cursor. Use `limit`/`offset` for relevance-ordered pages, or order by a column.", "SCORE_CURSOR_UNSUPPORTED", { field: FetchService.SCORE_FIELD });
 			const collection = collectionPath ? getCollectionByPath(collectionPath, this.registry) : void 0;
-			const resolved = this.resolveOrderKeys(table, keys, collection);
 			const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
+			const resolved = this.resolveOrderKeys(table, keys, collection, void 0, collectionPath, startAfterId ?? void 0);
 			if (resolved.length > 0 && startAfterId !== void 0) {
 				const cursorValues = cursor.values;
-				const values = resolved.map(({ field }) => cursorValues && field in cursorValues ? cursorValues[field] : cursor[field]);
-				if (values.every((value) => value !== void 0)) return [this.buildKeysetComparison(resolved, values, idField, startAfterId)];
+				const values = resolved.map(({ field, cursorTarget }) => cursorTarget ? null : cursorValues && field in cursorValues ? cursorValues[field] : cursor[field]);
+				if (values.every((value, i) => resolved[i].cursorTarget || value !== void 0)) return [this.buildKeysetComparison(resolved, values, idField, startAfterId)];
 			}
 		} else {
 			const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
@@ -3624,10 +4088,11 @@ var FetchService = class FetchService {
 	*/
 	buildKeysetComparison(keys, values, idField, cursorId, index = 0) {
 		if (index >= keys.length) return lt(idField, cursorId);
-		const { direction } = keys[index];
+		const { direction, cursorTarget } = keys[index];
 		const target = keys[index].target;
 		const value = values[index];
 		const rest = this.buildKeysetComparison(keys, values, idField, cursorId, index + 1);
+		if (cursorTarget) return direction === "asc" ? or(and(isNull(cursorTarget), isNull(target), rest), and(isNotNull(cursorTarget), or(sql`${target} > ${cursorTarget}`, isNull(target), and(sql`${target} = ${cursorTarget}`, rest)))) : or(and(isNull(cursorTarget), or(isNotNull(target), and(isNull(target), rest))), and(isNotNull(cursorTarget), or(sql`${target} < ${cursorTarget}`, and(sql`${target} = ${cursorTarget}`, rest))));
 		if (value === null) return direction === "asc" ? and(isNull(target), rest) : or(isNotNull(target), and(isNull(target), rest));
 		return direction === "asc" ? or(gt(target, value), isNull(target), and(eq(target, value), rest)) : or(lt(target, value), and(eq(target, value), rest));
 	}
@@ -4766,6 +5231,7 @@ var PersistService = class {
 		if (pgError) {
 			const { message, code } = pgErrorToFriendlyMessage(pgError, collectionSlug);
 			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`) : ApiError.badRequest(message, `PG_${code}`);
+			if (isRowLevelSecurityDenial(error)) return ApiError.forbidden(message, "WRITE_DENIED");
 			return new Error(message);
 		}
 		const causeMessage = extractCauseMessage(error);
@@ -10094,7 +10560,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-BH0Dzo_h.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-czK-OAuG.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -13512,7 +13978,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-DT2eq859.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-BHUjQ-z4.js");
 			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(failure.kind === "comment-column" ? `🔍 [schema] Could not record the search fingerprint on "${failure.target}" — search works, but a later change to the \`search\` block will not be detected: ${failure.error}` : `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
 			return { applied: plan.actions.length - plan.failures.length };
@@ -13533,7 +13999,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* stays RLS-enabled, so it denies rather than leaks.
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-DoHwhVf8.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-D5PtQLyR.js");
 			const queryable = provisioningQueryable(driverResult);
 			const outcome = await ensureCollectionPolicies(queryable, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
@@ -13542,7 +14008,7 @@ function createPostgresBootstrapper(pgConfig) {
 			for (const u of outcome.unsecured.filter((u) => u.grantWithdrawn)) logger.error(`🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. Its privileges have been revoked from ${REBASE_USER_ROLE}, so the table is unreachable rather than unprotected. Reads and writes to that collection will fail until RLS can be enabled.`);
 			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
-				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-69hYT8nr.js").then((n) => n.n);
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-B5Sajku6.js").then((n) => n.n);
 				await dropLegacyAuthSchema(async (text) => (await queryable.query(text)).rows, {
 					info: (m) => logger.info(m),
 					warn: (m) => logger.warn(m)
@@ -13557,7 +14023,7 @@ function createPostgresBootstrapper(pgConfig) {
 		},
 		mountRoutes(app, basePath, driverResult) {},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			const { createPostgresWebSocket } = await import("./websocket-D2jXv0Ds.js").then((n) => n.n);
+			const { createPostgresWebSocket } = await import("./websocket-BVgDVO-V.js").then((n) => n.n);
 			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
 		}
 	};