@rebasepro/server-postgres 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/websocket.d.ts

@@ -1,5 +1,5 @@
-import { RealtimeService } from "./services/realtimeService";
-import { PostgresBackendDriver } from "./PostgresBackendDriver";
+import { RealtimeService } from "./services/realtimeService.js";
+import { PostgresBackendDriver } from "./PostgresBackendDriver.js";
 import type { AuthAdapter } from "@rebasepro/types";
 import { Server } from "http";
 /** Minimal subset of RebaseAuthConfig used by the WebSocket layer. */
@@ -14,5 +14,32 @@ interface WsAuthConfig {
      */
     serviceKey?: string;
 }
+/**
+ * WebSocket message types that require an admin session.
+ *
+ * Exported so the test can READ it. It used to be private, and the test that
+ * exists to make "a privileged verb added without a role check" impossible held
+ * a hand-typed copy of the same nine strings — so it agreed with itself, and
+ * `FETCH_APPLICATION_ROLES` was added to neither. That verb runs
+ * `SELECT DISTINCT unnest(roles)` over the users table through `executeSql`,
+ * which is the owner connection and not subject to RLS, so any authenticated
+ * non-admin could enumerate every role in the project — and any anonymous
+ * socket could, on a deployment with `requireAuth: false`.
+ *
+ * The list is no longer the whole guarantee. `PUBLIC_TYPES` below is its
+ * counterpart, and a test asserts that every `case` this file handles appears
+ * in exactly one of the two — so a verb added to neither fails rather than
+ * defaulting to reachable.
+ */
+export declare const ADMIN_ONLY_TYPES: Set<string>;
+/**
+ * Message types deliberately reachable by a non-admin session.
+ *
+ * Data operations, gated per row by RLS and per request by the same write
+ * checks the REST layer applies — not by this list. It exists so that "which
+ * bucket is this verb in" is a question with an answer for every verb, and
+ * adding one without answering it is a test failure.
+ */
+export declare const PUBLIC_TYPES: Set<string>;
 export declare function createPostgresWebSocket(server: Server, realtimeService: RealtimeService, driver: PostgresBackendDriver, authConfig?: WsAuthConfig, authAdapter?: AuthAdapter): void;
 export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.16.0",
+  "version": "0.16.1-canary.g0d7af95",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -47,11 +47,11 @@
     "execa": "^9.6.1",
     "pg": "^8.22.0",
     "ws": "^8.21.1",
-    "@rebasepro/common": "0.16.0",
-    "@rebasepro/server": "0.16.0",
-    "@rebasepro/types": "0.16.0",
-    "@rebasepro/codegen": "0.16.0",
-    "@rebasepro/utils": "0.16.0"
+    "@rebasepro/codegen": "0.16.1-canary.g0d7af95",
+    "@rebasepro/server": "0.16.1-canary.g0d7af95",
+    "@rebasepro/types": "0.16.1-canary.g0d7af95",
+    "@rebasepro/common": "0.16.1-canary.g0d7af95",
+    "@rebasepro/utils": "0.16.1-canary.g0d7af95"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.12",
@@ -77,7 +77,7 @@
   ],
   "scripts": {
     "watch": "vite build --watch",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../scripts/assert-build-output.mjs",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../tooling/scripts/add-dts-extensions.mjs dist && node ../../tooling/scripts/assert-build-output.mjs",
     "test:lint": "eslint \"src/**\" --quiet",
     "test": "jest",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",

package/src/PostgresBackendDriver.ts

@@ -31,7 +31,7 @@ import {
     User
 } from "@rebasepro/types";
 import { sql as drizzleSql } from "drizzle-orm";
-import { buildPropertyCallbacks, buildSdkData, resolveCollectionRelations, updateDateAutoValues } from "@rebasepro/common";
+import { buildPropertyCallbacks, buildSdkData, classifyTable, detectJunctionTables, resolveCollectionRelations, updateDateAutoValues } from "@rebasepro/common";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
 import { deriveRowAddress } from "./services/collection-helpers";
 import { HistoryService } from "./history/HistoryService";
@@ -39,7 +39,69 @@ import { mergeDeep } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
 import { isRoleSwitchingPermissionError } from "./utils/pg-error-utils";
 import { applyAuthContext } from "./security/rls-enforcement";
-import { classifyTable, detectJunctionTables } from "./utils/table-classification";
+import { generateSchemaCommit } from "./schema/generate-schema-commit";
+import { readSchemaFactsFor, type Queryable } from "./schema/ensure-collection-tables";
+
+/**
+ * Has an operator opted out of database role switching entirely?
+ *
+ * `DISABLE_DB_ROLE_SWITCHING=true` is documented (README, the configuration
+ * page, the backend skill) as "run Studio SQL Editor queries as the connection
+ * owner", for deployments whose application roles have no database role behind
+ * them. It is the only sanctioned way a statement that named a role runs
+ * without it — every other route now refuses.
+ *
+ * Exact `"true"` on purpose, matching the check this replaced. `=1` and `=yes`
+ * silently do nothing, which `docs/audits/80-config-and-env.md` already records
+ * as a finding across the env surface; fixing it here alone would make this one
+ * variable disagree with the rest.
+ */
+export function isRoleSwitchingOptedOut(): boolean {
+    return process.env.DISABLE_DB_ROLE_SWITCHING === "true";
+}
+
+/**
+ * The role a statement will actually have run as, given the role it asked for.
+ *
+ * For the audit log, which recorded `options.role` — the *requested* role — and
+ * so restated the caller's request as though it were the outcome. The two part
+ * company exactly when {@link isRoleSwitchingOptedOut} holds, because every
+ * other divergence is now an error rather than a quiet substitution.
+ */
+export function effectiveSqlRole(requestedRole?: string): string {
+    if (!requestedRole) return CONNECTION_OWNER;
+    return isRoleSwitchingOptedOut() ? CONNECTION_OWNER : requestedRole;
+}
+
+/** How {@link effectiveSqlRole} names "whatever role the connection holds". */
+export const CONNECTION_OWNER = "<connection owner>";
+
+/**
+ * A statement named a database role the connection cannot assume.
+ *
+ * Its own type because the tempting recovery — run it anyway, as the owner — is
+ * the one thing that must not happen. Callers that catch this should report it,
+ * not retry unscoped.
+ */
+export class RoleSwitchUnavailableError extends Error {
+    readonly code = "ROLE_SWITCH_UNAVAILABLE";
+    readonly role: string;
+    /** The underlying Postgres error, when the refusal came from a live attempt. */
+    readonly pgError?: unknown;
+
+    constructor(role: string, pgError?: unknown) {
+        super(
+            `Cannot execute SQL as role "${role}": this connection is not permitted to SET ROLE. ` +
+            `The statement was NOT executed — running it as the connection owner would return ` +
+            `owner-visible rows, which is a different question from the one that was asked. ` +
+            `Grant the connection user membership in "${role}", or set DISABLE_DB_ROLE_SWITCHING=true ` +
+            `to run SQL Editor queries as the connection owner.`
+        );
+        this.name = "RoleSwitchUnavailableError";
+        this.role = role;
+        this.pgError = pgError;
+    }
+}
 
 export class PostgresBackendDriver implements DataDriver {
     key = "postgres";
@@ -54,12 +116,18 @@ export class PostgresBackendDriver implements DataDriver {
     public client?: RebaseClient;
 
     /**
-     * Auto-set to `true` when a SET LOCAL ROLE fails with insufficient
-     * privileges, so subsequent queries skip the doomed attempt.
-     * Mirrors the static `DISABLE_DB_ROLE_SWITCHING` env var but is
-     * learned at runtime.
+     * Auto-set to `true` once a `SET LOCAL ROLE` has failed with insufficient
+     * privileges, so later statements refuse without spending the round trip
+     * to be refused again.
+     *
+     * Deliberately NOT a mirror of `DISABLE_DB_ROLE_SWITCHING`, which it used
+     * to be described as. The env var is an operator saying "run these as the
+     * connection owner"; this flag is the database saying "I cannot give you
+     * the role you asked for". The first is a decision and permits the
+     * fallback, the second is a failure and must not — see the SECURITY note
+     * in {@link executeSql}.
      */
-    private _roleSwitchingDisabled = false;
+    private _roleSwitchingUnavailable = false;
 
     /**
      * Restricted role that authenticated (user-context) requests run as (via
@@ -119,6 +187,26 @@ export class PostgresBackendDriver implements DataDriver {
             fetchCurrentDatabase: () => this.fetchCurrentDatabase(),
             fetchUnmappedTables: (...args: Parameters<NonNullable<DatabaseAdmin["fetchUnmappedTables"]>>) => this.fetchUnmappedTables(...args),
             fetchTableMetadata: (...args: Parameters<NonNullable<DatabaseAdmin["fetchTableMetadata"]>>) => this.fetchTableMetadata(...args),
+            // Planning a schema change is engine-specific — it renders DDL, a
+            // Drizzle schema and the declarative SQL artifacts — so it lives
+            // here and the server detects it structurally, the same way it
+            // detects SQL. Planning only: applying is `executeSql` above, and
+            // committing belongs to whatever holds the repository.
+            // Planned against what this database actually has, not against an
+            // empty one. Whether a NOT NULL can be added comes down to whether
+            // the table holds rows, and whether an enum value will land comes
+            // down to the values the type already carries — neither is knowable
+            // from the collections, and both decide whether the statements this
+            // returns are accepted or rejected by the database they name.
+            planSchemaChange: async (before, after, options) => generateSchemaCommit({
+                before: before as CollectionConfig[],
+                after: after as CollectionConfig[],
+                paths: options?.paths,
+                existing: await readSchemaFactsFor(
+                    this.schemaFactsQueryable(),
+                    after as CollectionConfig[]
+                )
+            }),
             // Branch operations (only available when poolManager is configured)
             ...(this.branchService ? {
                 createBranch: this.branchService.createBranch.bind(this.branchService),
@@ -129,6 +217,24 @@ export class PostgresBackendDriver implements DataDriver {
         };
     }
 
+    /**
+     * The catalogue-reading shim the schema planner wants.
+     *
+     * Text in, rows out — every statement it issues is a catalogue read keyed by
+     * schema name, and schema names are identifiers rather than bindable values,
+     * so there is nothing to parameterise. Runs on the driver's own handle, which
+     * is the connection whose privileges are already known to work.
+     */
+    private schemaFactsQueryable(): Queryable {
+        return {
+            query: async <T>(text: string): Promise<{ rows: T[] }> => {
+                const result = await this.db.execute(drizzleSql.raw(text));
+                const rows = (result as unknown as { rows?: T[] }).rows;
+                return { rows: rows ?? (Array.isArray(result) ? (result as T[]) : []) };
+            }
+        };
+    }
+
     /**
      * REST-optimised fetch service (include-aware eager-loading).
      * Delegates to the underlying FetchService (include-aware eager loading),
@@ -1218,6 +1324,27 @@ export class PostgresBackendDriver implements DataDriver {
         return this.poolManager.getDrizzle(databaseName);
     }
 
+    /**
+     * Build one statement, binding `$n` placeholders as real parameters.
+     *
+     * Shared by the role-switched path (inside a transaction) and the
+     * unswitched one. They held byte-identical copies of this loop, which is
+     * exactly the shape where a fix lands in one copy and not the other.
+     */
+    private buildStatement(sqlText: string, params?: unknown[]) {
+        if (!params || params.length === 0) return drizzleSql.raw(sqlText);
+        const parts = sqlText.split(/\$(\d+)/);
+        const chunks: ReturnType<typeof drizzleSql.raw | typeof drizzleSql.param>[] = [];
+        for (let i = 0; i < parts.length; i++) {
+            if (i % 2 === 0) {
+                if (parts[i].length > 0) chunks.push(drizzleSql.raw(parts[i]));
+            } else {
+                chunks.push(drizzleSql.param(params[Number(parts[i]) - 1]));
+            }
+        }
+        return drizzleSql.join(chunks, drizzleSql.raw(""));
+    }
+
     async executeSql(sqlText: string, options?: {
         database?: string,
         role?: string,
@@ -1230,77 +1357,81 @@ export class PostgresBackendDriver implements DataDriver {
         const targetDb = this.getTargetDb(options?.database);
 
         try {
-            // Determine if we actually need to switch roles.
-            // Skip SET LOCAL ROLE when the requested role matches the current session role,
-            // as it's a no-op that can fail on managed Postgres setups where the connection
-            // user doesn't have permission to SET ROLE.
+            // Does this actually need a role switch?
+            //
+            // Asking for the role the session already runs as is a no-op, not a
+            // downgrade — the statement really does execute as the requested
+            // role — so it stays allowed even where switching is unavailable.
+            // That is the ordinary Studio path: the role picker defaults to
+            // `current_user`.
             let needsRoleSwitch = false;
-            if (options?.role && process.env.DISABLE_DB_ROLE_SWITCHING !== "true" && !this._roleSwitchingDisabled) {
+            if (options?.role) {
                 try {
                     const currentRoleResult = await targetDb.execute(drizzleSql.raw("SELECT current_user AS role"));
                     const currentRole = (currentRoleResult.rows?.[0] as Record<string, unknown>)?.role as string | undefined;
                     needsRoleSwitch = !!currentRole && currentRole !== options.role;
                 } catch {
-                    // If we can't determine the current role, attempt the switch anyway
+                    // Current role unknown. Assume a switch is needed rather
+                    // than assume the session already is the requested role:
+                    // attempting and refusing beats guessing in our own favour.
                     needsRoleSwitch = true;
                 }
             }
 
             if (needsRoleSwitch && options?.role) {
-                const safeRole = options.role.replace(/"/g, "\"\"");
-                try {
-                    return await targetDb.transaction(async (tx) => {
-                        await tx.execute(drizzleSql.raw(`SET LOCAL ROLE "${safeRole}"`));
-                        let result;
-                        if (options?.params && options.params.length > 0) {
-                            const parts = sqlText.split(/\$(\d+)/);
-                            const chunks: ReturnType<typeof drizzleSql.raw | typeof drizzleSql.param>[] = [];
-                            for (let i = 0; i < parts.length; i++) {
-                                if (i % 2 === 0) {
-                                    if (parts[i].length > 0) chunks.push(drizzleSql.raw(parts[i]));
-                                } else {
-                                    chunks.push(drizzleSql.param(options.params[Number(parts[i]) - 1]));
-                                }
-                            }
-                            result = await tx.execute(drizzleSql.join(chunks, drizzleSql.raw("")));
-                        } else {
-                            result = await tx.execute(drizzleSql.raw(sqlText));
+                if (isRoleSwitchingOptedOut()) {
+                    // The one sanctioned way to run this unswitched, and a
+                    // decision somebody made rather than a failure: the env var
+                    // is documented (README, docs/getting-started/configuration)
+                    // as "run SQL Editor queries as the connection owner", for
+                    // deployments whose application roles have no database role
+                    // behind them. `effectiveSqlRole` reads the same switch, so
+                    // the audit log records the role that actually applied.
+                    logger.debug(
+                        `[PostgresBackendDriver] DISABLE_DB_ROLE_SWITCHING=true — running as the ` +
+                        `connection owner rather than "${options.role}".`
+                    );
+                } else if (this._roleSwitchingUnavailable) {
+                    // Already learned this connection cannot SET ROLE; refuse
+                    // without spending the round trip to be told again.
+                    throw new RoleSwitchUnavailableError(options.role);
+                } else {
+                    const safeRole = options.role.replace(/"/g, "\"\"");
+                    try {
+                        return await targetDb.transaction(async (tx) => {
+                            await tx.execute(drizzleSql.raw(`SET LOCAL ROLE "${safeRole}"`));
+                            const result = await tx.execute(this.buildStatement(sqlText, options?.params));
+                            return result.rows as Record<string, unknown>[];
+                        });
+                    } catch (roleError: unknown) {
+                        if (isRoleSwitchingPermissionError(roleError)) {
+                            // SECURITY: do NOT fall through and run this as the
+                            // owner.
+                            //
+                            // The caller asked for a *constrained* execution.
+                            // Owner rows are not a degraded answer to that
+                            // question, they are a confident wrong one: the only
+                            // reason to pass a role is to see what the database
+                            // looks like under RLS, and owner output makes a
+                            // protected table read as exposed. This used to warn
+                            // and continue — and latch, so a single failure
+                            // silently unscoped every later call in the process.
+                            //
+                            // `applyAuthContext` (the user request path) and
+                            // `scopeDataDriver` both fail closed. This is the
+                            // same question, so it gets the same answer.
+                            this._roleSwitchingUnavailable = true;
+                            throw new RoleSwitchUnavailableError(options.role, roleError);
                         }
-                        return result.rows as Record<string, unknown>[];
-                    });
-                } catch (roleError: unknown) {
-                    if (isRoleSwitchingPermissionError(roleError)) {
-                        logger.warn(
-                            `[PostgresBackendDriver] SET LOCAL ROLE "${safeRole}" failed — ` +
-                            `the connection user lacks permission. Falling back to executing ` +
-                            `without role switching. To suppress this warning, set ` +
-                            `DISABLE_DB_ROLE_SWITCHING=true in your .env file.`
-                        );
-                        this._roleSwitchingDisabled = true;
-                        // Fall through to execute without role switching below
-                    } else {
                         throw roleError;
                     }
                 }
             }
 
-            let result;
-            if (options?.params && options.params.length > 0) {
-                const parts = sqlText.split(/\$(\d+)/);
-                const chunks: ReturnType<typeof drizzleSql.raw | typeof drizzleSql.param>[] = [];
-                for (let i = 0; i < parts.length; i++) {
-                    if (i % 2 === 0) {
-                        if (parts[i].length > 0) chunks.push(drizzleSql.raw(parts[i]));
-                    } else {
-                        chunks.push(drizzleSql.param(options.params[Number(parts[i]) - 1]));
-                    }
-                }
-                result = await targetDb.execute(drizzleSql.join(chunks, drizzleSql.raw("")));
-            } else {
-                result = await targetDb.execute(drizzleSql.raw(sqlText));
-            }
+            const result = await targetDb.execute(this.buildStatement(sqlText, options?.params));
             return result.rows as Record<string, unknown>[];
         } catch (error: unknown) {
+            if (error instanceof RoleSwitchUnavailableError) throw error;
             const msg = error instanceof Error ? error.message : String(error);
             // Provide a user-friendly message for connection/auth errors
             if (msg.includes("pg_hba.conf") || msg.includes("no encryption") || msg.includes("connection refused")) {

package/src/backup/backup-service.ts

@@ -411,7 +411,7 @@ export async function uploadBackup(
         bucket: dest.bucket,
         metadata: { "rebase-backup": "1" }
     });
-    return { key, storageUrl: result.storageUrl ?? `${dest.kind}://${dest.bucket}/${key}` };
+    return { key, storageUrl: result.storageUrl };
 }
 
 /**

package/src/cli-helpers.ts

@@ -6,6 +6,7 @@ import { createRequire } from "module";
 import readline from "readline";
 import { pathToFileURL } from "url";
 import chalk from "chalk";
+import { isRebaseIndexName } from "./schema/collection-index";
 import { out, outWarn } from "./cli-output";
 import type { CollectionConfig, ResolvedRelation } from "@rebasepro/types";
 import { moduleDir as __helpersDirname } from "./module-dir";
@@ -306,6 +307,119 @@ export async function seedDevDatabaseSearchHelpers(
  * catalogs. Separated from {@link getTableExcludes} so its failure mode can
  * be handled explicitly (fail closed) and so tests can inject a stub.
  */
+/**
+ * Every index Postgres holds on a table Rebase manages, as
+ * `schema.table.index`.
+ *
+ * Constraint-backed indexes are left out: a `PRIMARY KEY` or a `UNIQUE` is a
+ * *constraint* to Atlas, diffed from the constraint declaration, and naming its
+ * index in an exclude would shield the constraint itself.
+ */
+export async function queryExistingIndexes(databaseUrl: string): Promise<string[]> {
+    const { Client } = await import("pg");
+    const client = new Client({ connectionString: databaseUrl });
+    await client.connect();
+    try {
+        const res = await client.query(`
+            SELECT n.nspname || '.' || t.relname || '.' || i.relname AS full_name
+            FROM pg_index x
+            JOIN pg_class i ON i.oid = x.indexrelid
+            JOIN pg_class t ON t.oid = x.indrelid
+            JOIN pg_namespace n ON n.oid = t.relnamespace
+            WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+              AND t.relkind IN ('r', 'p')
+              AND NOT EXISTS (
+                  SELECT 1 FROM pg_constraint c WHERE c.conindid = i.oid
+              );
+        `);
+        return res.rows.map((row: { full_name: string }) => row.full_name);
+    } finally {
+        await client.end();
+    }
+}
+
+/**
+ * Glob patterns keeping Atlas away from indexes that are not Rebase's.
+ *
+ * The problem this solves is live and predates the `indexes:` block. `db push`
+ * is declarative, so an index on a managed table that is absent from
+ * `schema.sql` is drift — and Atlas plans `DROP INDEX` for it. Verified
+ * against atlas v1.2.3: create one by hand, re-run an unchanged push, and the
+ * plan is a bare drop. `DROP INDEX` is not in `DESTRUCTIVE_PATTERNS`, so the
+ * auto-approved apply took it without asking. Until now the only way to have
+ * an index at all was to write it by hand, which made that the *only* outcome.
+ *
+ * Ownership rather than a prompt, because once indexes are declarable a drop
+ * is usually correct: removing one from the config should remove it from the
+ * database, quietly. What must never be dropped is an index Rebase never
+ * created — a hand-written one, or one an introspected database arrived with.
+ * {@link isRebaseIndexName} is the test, the same arrangement
+ * `isGeneratedPolicyName` uses to let policy reconciliation drop only what it
+ * generated.
+ *
+ * The named-in-the-desired-state check comes first and is what makes removal
+ * work: a declared index that the author has just deleted still matches the
+ * name pattern, is no longer in the plan, and so is *not* excluded — Atlas
+ * drops it, as intended.
+ *
+ * Three-part `schema.table.index`, never two: a two-part pattern reads as a
+ * *table* named `<index>` in a *schema* named `<table>`, matches nothing, and
+ * reports no error — the trap already recorded for the search excludes.
+ */
+export async function getForeignIndexExcludes(
+    databaseUrl: string,
+    collectionsPath: string,
+    deps: {
+        queryExistingIndexes?: (databaseUrl: string) => Promise<string[]>;
+        getManagedIndexNames?: (collectionsPath: string) => Promise<Set<string>>;
+    } = {}
+): Promise<string[]> {
+    const queryIndexes = deps.queryExistingIndexes ?? queryExistingIndexes;
+    const getManaged = deps.getManagedIndexNames ?? managedIndexNames;
+
+    const managed = await getManaged(collectionsPath);
+
+    let existing: string[];
+    try {
+        existing = await queryIndexes(databaseUrl);
+    } catch (err) {
+        // Fails CLOSED, like getTableExcludes: without the catalogue we cannot
+        // tell a foreign index from one of ours, and guessing wrong destroys
+        // an index somebody is relying on.
+        throw new ExcludeIntrospectionError(
+            `Failed to introspect the database for unmanaged indexes: ${err instanceof Error ? err.message : String(err)}`,
+            err
+        );
+    }
+
+    return existing.filter(full => {
+        const indexName = full.slice(full.lastIndexOf(".") + 1);
+        if (managed.has(indexName)) return false;   // ours, and still declared
+        return !isRebaseIndexName(indexName);       // ours, but no longer declared -> let it drop
+    });
+}
+
+/**
+ * The index names the current collections would create — search, vector and
+ * declared alike. Anything Atlas would emit is by definition not foreign.
+ */
+async function managedIndexNames(collectionsPath: string): Promise<Set<string>> {
+    const collections = await loadCollectionsForCli(collectionsPath);
+    const { resolveColumnName, searchExcludePatterns } = await import("./schema/generate-postgres-ddl-logic");
+    const { buildCollectionIndexPlan } = await import("./schema/collection-index");
+
+    const names = new Set<string>(
+        buildCollectionIndexPlan(collections, resolveColumnName).map(spec => spec.indexName)
+    );
+    // Search objects are excluded from Atlas wholesale by their own patterns;
+    // listing them here too is harmless and keeps this the single answer to
+    // "is this index one of ours".
+    for (const pattern of searchExcludePatterns(collections)) {
+        names.add(pattern.slice(pattern.lastIndexOf(".") + 1));
+    }
+    return names;
+}
+
 export async function queryExistingTables(databaseUrl: string): Promise<string[]> {
     const { Client } = await import("pg");
     const client = new Client({ connectionString: databaseUrl });
@@ -366,8 +480,9 @@ export async function getTableExcludes(
     // own revision table. Excluding both the schema object AND its contents
     // keeps Atlas from planning a `DROP SCHEMA … CASCADE` — which on a live
     // database would take the user/auth tables with it.
-    // `atlas_schema_revisions.*` is kept for backwards-compatibility with any
-    // external revision schema.
+    // `atlas_schema_revisions.*` covers a revision table living outside the
+    // `rebase` schema — an externally managed Atlas setup — which the apply
+    // must not plan changes against either.
     //
     // `auth` stays on this list even though Rebase no longer creates it, and
     // that is the point: on a database still holding the pre-1.0 schema it must

package/src/cli.ts

@@ -18,6 +18,7 @@ import {
     readSearchDdl,
     seedDevDatabaseSearchHelpers,
     getTableExcludes,
+    getForeignIndexExcludes,
     ExcludeIntrospectionError,
     promptConfirm
 } from "./cli-helpers";
@@ -872,6 +873,27 @@ async function runAtlas(
         for (const exc of excludes) {
             atlasArgs.push("--exclude", exc);
         }
+
+        // And the indexes on those tables that Rebase did not create. Same
+        // fail-closed contract as the table list above, for the same reason: a
+        // partial answer here silently drops somebody's index.
+        let indexExcludes: string[];
+        try {
+            indexExcludes = await getForeignIndexExcludes(databaseUrl, collectionsPath);
+        } catch (err) {
+            if (err instanceof ExcludeIntrospectionError) {
+                outError(chalk.red("\n✗ Aborting push: could not determine which indexes to protect."));
+                outError(chalk.gray(`  ${err.message}`));
+                outError(chalk.gray("  Refusing to apply — a partial exclude list could drop an index Rebase does not manage."));
+                const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
+                if (hint) outError(hint);
+                process.exit(1);
+            }
+            throw err;
+        }
+        for (const exc of indexExcludes) {
+            atlasArgs.push("--exclude", exc);
+        }
     }
 
     // Stream stdout live but tee stderr so we can inspect Atlas's error text

package/src/connection.ts

@@ -31,6 +31,40 @@ export interface PostgresPoolConfig {
     searchPath?: string | false;
 }
 
+/**
+ * Ceiling on pool size, from the environment.
+ *
+ * Exists for the managed development database. PGlite is a single session
+ * behind a multiplexing socket server, and two pooled clients holding
+ * overlapping transactions deadlock there — which a request-per-transaction
+ * server produces the moment two requests overlap. One connection turns that
+ * deadlock into ordinary queueing.
+ *
+ * A ceiling rather than a value, so it constrains every pool in the process
+ * without any of them having to know why. Ignored when unset or unparseable,
+ * because a malformed limit must not silently serialize a production server.
+ */
+export function poolMaxCeiling(env: NodeJS.ProcessEnv = process.env): number | null {
+    const raw = env.REBASE_DB_POOL_MAX;
+    if (typeof raw !== "string") return null;
+
+    // Plain decimal digits only. `Number` would also accept `1e3`, `0x10` and
+    // ` 4 ` — none of which anyone writes on purpose in a config value, and all
+    // of which would mean this silently did something other than it appears to.
+    if (!/^[0-9]+$/.test(raw.trim())) return null;
+
+    const parsed = Number(raw.trim());
+
+    return parsed >= 1 ? parsed : null;
+}
+
+/** Apply {@link poolMaxCeiling} to a requested pool size. */
+export function cappedPoolMax(requested: number, env: NodeJS.ProcessEnv = process.env): number {
+    const ceiling = poolMaxCeiling(env);
+
+    return ceiling === null ? requested : Math.min(requested, ceiling);
+}
+
 const DEFAULT_POOL: Required<PostgresPoolConfig> = {
     max: 20,
     searchPath: "public",
@@ -182,7 +216,7 @@ export function createPostgresDatabaseConnection(
 
     const pgPoolConfig: PoolConfig = {
         connectionString,
-        max: opts.max,
+        max: cappedPoolMax(opts.max),
         idleTimeoutMillis: opts.idleTimeoutMillis,
         connectionTimeoutMillis: opts.connectionTimeoutMillis,
         query_timeout: opts.queryTimeout,
@@ -234,7 +268,7 @@ export function createDirectDatabaseConnection(
 
     const pgPoolConfig: PoolConfig = {
         connectionString,
-        max: opts.max,
+        max: cappedPoolMax(opts.max),
         idleTimeoutMillis: opts.idleTimeoutMillis,
         connectionTimeoutMillis: opts.connectionTimeoutMillis,
         query_timeout: opts.queryTimeout,
@@ -275,7 +309,7 @@ export function createReadReplicaConnection(
 
     const pgPoolConfig: PoolConfig = {
         connectionString,
-        max: opts.max,
+        max: cappedPoolMax(opts.max),
         idleTimeoutMillis: opts.idleTimeoutMillis,
         connectionTimeoutMillis: opts.connectionTimeoutMillis,
         query_timeout: opts.queryTimeout,