@rebasepro/server-postgres 0.21.1-canary.g8c5a265 → 0.21.1

package/dist/index.es.js

@@ -3,20 +3,20 @@ __createRequire(import.meta.url);
 import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
 import { a as createDirectDatabaseConnection, c as guardPoolAgainstDirtyRelease, l as pinSearchPath, o as createPostgresDatabaseConnection, r as cappedPoolMax, s as createReadReplicaConnection, t as DatabasePoolManager, u as poolMaxCeiling } from "./databasePoolManager-Bj5FbeAs.js";
 import { f as hiddenColumnsOption, l as SEARCH_UNACCENT_FN, m as searchColumnNames, o as sharedRelationName, u as buildSearchColumnSpec, x as visibleColumnProjection } from "./plan-schema-Hgl62S-w.js";
-import { d as extractPgError, f as isRoleSwitchingPermissionError, g as sanitizeErrorForClient, h as reachedDatabase, i as diagnoseDbError, l as classifyConnectFailure, m as pgErrorToFriendlyMessage, n as deepestErrorMessage, o as isEconnrefused, p as isRowLevelSecurityDenial, s as parseHostInfo, u as extractCauseMessage } from "./cli-errors-C3g_kHBw.js";
-import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-W3DMfcZZ.js";
+import { d as extractPgError, f as isRoleSwitchingPermissionError, g as sanitizeErrorForClient, h as reachedDatabase, i as diagnoseDbError, l as classifyConnectFailure, m as pgErrorToFriendlyMessage, n as deepestErrorMessage, o as isEconnrefused, p as isRowLevelSecurityDenial, s as parseHostInfo, u as extractCauseMessage } from "./cli-errors-Dka89exj.js";
+import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-CucnFcSE.js";
 import { c as warnOnLegacyRlsFunctions, i as ensureAppRole, l as warnOnRoleSchemaCollision, n as applyAuthContext, o as validatePolicyPgRoles, r as detectConnectionPosture, s as warnOnAnonymousGrants, t as REBASE_USER_ROLE } from "./rls-enforcement-C6Xk0lA6.js";
 import { l as resolveColumnName } from "./column-plan-helpers-CpILzHJS.js";
 import { i as isAuthCollection, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
 import { a as generatePostgresVectorDdl, i as generatePostgresTriggersDdl, n as generatePostgresPoliciesDdl, r as generatePostgresSearchDdl, t as generatePostgresDdl } from "./generate-postgres-ddl-logic-CR2xcS7e.js";
-import { t as generateSchema } from "./generate-drizzle-schema-logic-Dfyf_MRu.js";
-import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-Bkvehxdm.js";
-import { t as main } from "./generate-drizzle-schema-vSK-VdYT.js";
+import { t as generateSchema } from "./generate-drizzle-schema-logic-DFa9qy9u.js";
+import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-Cr2ye5JC.js";
+import { t as main } from "./generate-drizzle-schema-D2MDdJt-.js";
 import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-BNLwvxuy.js";
 import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-BnEvEJPr.js";
 import { c as identifyJoinTables, d as singularize, h as humanize, i as buildTablesMap, m as mapPgType, r as buildEnumMap, s as getIconForTable } from "./introspect-db-logic-C6LQdTxj.js";
 import { Client } from "pg";
-import { ApiError, assertFieldOpsValid, assertWriteRequestValid, createDdlBootstrapper, createEmailService, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveBatchRefs, resolveRequireAuth, safeCompare, splitFieldOps } from "@rebasepro/server";
+import { ApiError, assertFieldOpsValid, assertWriteRequestValid, createDdlBootstrapper, createEmailService, declaredErrorAnswer, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveBatchRefs, resolveRequireAuth, safeCompare, splitFieldOps } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isNotNull, isNull, isTable, lt, not, notInArray, or, relations, sql } from "drizzle-orm";
 import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, JUNCTION_PIVOT_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, declaredDatabaseExtensions, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, parseEnvBoolean, parseRelationAggregateSort, resolveClientListLimit } from "@rebasepro/types";
 import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, REBASE_USER_ROLE as REBASE_USER_ROLE$1, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createRelationRef, createRelationRefWithData, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, firstSqlRow, getColumnName, getDeclaredPrimaryKeys, getJunctionCollectionConfig, getJunctionConfigForRelation, getTableName as getTableName$1, getTenantConfig, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseOrderBySpecStrict, requireCallbackClient, requireCallbackCollection, resolveCollectionRelations, resolveJunctionSpecs, resolveTenantWrite, revokeInternalTableSql, sqlRows, tenantBypassRoles, toCallbackError, toFilterTuples, updateDateAutoValues, updateUserAutoValues } from "@rebasepro/common";
@@ -6092,6 +6092,35 @@ function assertActingUserForAutoValues(properties, status, uid, path) {
 		});
 	}
 }
+/**
+* A listener's `onError`, in the shape the realtime service calls it with.
+*
+* Registered with the subscription so a failed refetch reaches it. Before, only
+* the initial fetch did: a refetch after a change failed into a log line, and
+* the listener kept its last rows as if they were current. The error arrives as
+* thrown, not masked the way a socket frame is: this is trusted server code.
+*/
+function fetchErrorListener(onError) {
+	if (!onError) return void 0;
+	return (error) => onError(error instanceof Error ? error : new Error(String(error)));
+}
+/**
+* The principal a user's reads run as, for the transaction a request opens and
+* for a subscription alike.
+*
+* One definition because there were two. The subscription's copy was built by
+* hand after the fact and left out `isAnonymous`, so a guest's refetches ran as
+* an account: a policy that excludes guests filtered the first read and not the
+* ones after a change.
+*/
+function authContextOf(user) {
+	return {
+		uid: user?.uid || ANONYMOUS_USER_ID,
+		roles: user?.roles ?? [],
+		isAnonymous: user?.isAnonymous === true,
+		...user?.claims ? { claims: user.claims } : {}
+	};
+}
 var PostgresBackendDriver = class PostgresBackendDriver {
 	db;
 	registry;
@@ -6410,46 +6439,31 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		}
 		return rows;
 	}
-	listenCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, onUpdate, onError }) {
+	/**
+	* Listen to a collection: the rows now, then again after every change.
+	*
+	* The realtime service runs every read, the first one included, as
+	* `authContext` — which {@link AuthenticatedPostgresBackendDriver} supplies,
+	* and which defaults to this driver's own user (a driver bound to a
+	* request's transaction has one). With neither, the reads run as the
+	* anonymous user, as the refetches always did.
+	*/
+	listenCollection({ path, collection, startAfter, onUpdate, onError, vectorSearch: _vectorSearch, page: _page, withDeleted: _withDeleted, ...query }, authContext = this.user ? authContextOf(this.user) : void 0) {
 		const subscriptionId = this.generateSubscriptionId();
-		const callbackWrapper = (rows) => {
-			onUpdate(rows);
-		};
-		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
-			clientId: "driver",
+		this.realtimeService.startDataDriverSubscription(subscriptionId, {
 			type: "collection",
 			path,
 			collectionRequest: {
-				filter,
-				orderBy,
-				order,
-				limit,
-				offset,
+				...query,
 				startAfter,
-				databaseId: collection?.databaseId,
-				searchString
-			}
-		});
-		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
-		this.fetchCollection({
-			path,
-			collection,
-			filter,
-			limit,
-			offset,
-			startAfter,
-			orderBy,
-			searchString,
-			order
-		}).then((rows) => {
-			callbackWrapper(rows);
-		}).catch((error) => {
-			if (onError) onError(error);
+				databaseId: collection?.databaseId
+			},
+			authContext,
+			onError: fetchErrorListener(onError)
+		}, (rows) => {
+			if (Array.isArray(rows)) onUpdate(rows);
 		});
-		return () => {
-			this.realtimeService.removeSubscriptionCallback(subscriptionId);
-			this.realtimeService.subscriptions.delete(subscriptionId);
-		};
+		return () => this.realtimeService.unsubscribe(subscriptionId);
 	}
 	async fetchOne({ path, id, databaseId, collection, withDeleted }) {
 		let row = await this.dataService.fetchOne(path, id, databaseId || collection?.databaseId, withDeleted);
@@ -6478,31 +6492,23 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		}
 		return row;
 	}
-	listenOne({ path, id, collection, onUpdate, onError }) {
+	/**
+	* Listen to one row: the row now, then again after every change, and
+	* `null` when it is not there — deleted, never created, or not readable by
+	* the subscriber. Reads as {@link listenCollection} does.
+	*/
+	listenOne({ path, id, onUpdate, onError }, authContext = this.user ? authContextOf(this.user) : void 0) {
 		const subscriptionId = this.generateSubscriptionId();
-		const callbackWrapper = (row) => {
-			if (row) onUpdate(row);
-		};
-		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
-			clientId: "driver",
+		this.realtimeService.startDataDriverSubscription(subscriptionId, {
 			type: "single",
-			path,
-			id
-		});
-		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
-		this.fetchOne({
 			path,
 			id,
-			collection
-		}).then((row) => {
-			if (row) onUpdate(row);
-		}).catch((error) => {
-			if (onError) onError(error);
+			authContext,
+			onError: fetchErrorListener(onError)
+		}, (row) => {
+			if (!Array.isArray(row)) onUpdate(row);
 		});
-		return () => {
-			this.realtimeService.removeSubscriptionCallback(subscriptionId);
-			this.realtimeService.subscriptions.delete(subscriptionId);
-		};
+		return () => this.realtimeService.unsubscribe(subscriptionId);
 	}
 	/**
 	* How many membership rows a single write will read to answer "which
@@ -7402,19 +7408,9 @@ var AuthenticatedPostgresBackendDriver = class {
 		const pendingNotifications = [];
 		const writeScope = options?.accessMode === "read only" ? void 0 : new WriteTransactionScope();
 		const result = await withFieldViewer({ roles: this.user?.roles ?? [] }, async () => await runInWriteScope(writeScope, () => this.delegate.db.transaction(async (tx) => {
-			let uid = this.user?.uid;
-			if (!uid) {
-				logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
-				uid = "anonymous";
-			}
-			const userRoles = this.user?.roles ?? [];
+			if (!this.user?.uid) logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
 			if (!this.user?.roles) logger.warn("[DataDriver] User roles are missing for authenticated delegate. Using empty array. User object", { detail: this.user });
-			await applyAuthContext(tx, {
-				uid,
-				roles: userRoles,
-				isAnonymous: this.user?.isAnonymous === true,
-				claims: this.user?.claims
-			}, this.delegate.rlsUserRole);
+			await applyAuthContext(tx, authContextOf(this.user), this.delegate.rlsUserRole);
 			const txEntityService = new DataService(tx, this.delegate.registry);
 			const txDelegate = new PostgresBackendDriver(tx, this.delegate.realtimeService, this.delegate.registry, this.user, this.delegate.poolManager, this.delegate.historyService);
 			txDelegate.dataService = txEntityService;
@@ -7444,28 +7440,21 @@ var AuthenticatedPostgresBackendDriver = class {
 		return this.withTransaction((delegate) => delegate.fetchCollection(props), { accessMode: "read only" });
 	}
 	/**
-	* Injects the authenticated user's context into the most recently
-	* registered realtime subscription so RLS-aware polling can apply.
+	* The delegate is the base driver, on the owner connection. The user's
+	* identity goes in with the subscription, so the first read runs as them
+	* like every refetch after it. It used to be stamped onto the last
+	* registered subscription once the delegate had returned — by which time
+	* the first read had been issued unscoped, and a listener was handed rows
+	* its policies deny.
 	*/
-	injectAuthContext(unsubscribe) {
-		const authContext = {
-			uid: this.user?.uid || "anonymous",
-			roles: this.user?.roles ?? [],
-			...this.user?.claims ? { claims: this.user.claims } : {}
-		};
-		const entries = Array.from(this.delegate.realtimeService.subscriptions.entries());
-		const lastSub = entries[entries.length - 1]?.[1];
-		if (lastSub && lastSub.clientId === "driver") lastSub.authContext = authContext;
-		return unsubscribe;
-	}
 	listenCollection(props) {
-		return this.injectAuthContext(this.delegate.listenCollection(props));
+		return this.delegate.listenCollection(props, authContextOf(this.user));
 	}
 	async fetchOne(props) {
 		return this.withTransaction((delegate) => delegate.fetchOne(props), { accessMode: "read only" });
 	}
 	listenOne(props) {
-		return this.injectAuthContext(this.delegate.listenOne(props));
+		return this.delegate.listenOne(props, authContextOf(this.user));
 	}
 	async save(props) {
 		return this.withTransaction((delegate) => delegate.save(props));
@@ -9100,36 +9089,67 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	*
 	* The last two are identity, not presence: the map has to still hold *this
 	* exact object*, not merely something under this id.
+	*
+	* A failure goes through the same slot, by `mayReportFailure()`: an error
+	* frame from a stale, cancelled or replaced fetch would mark a view that
+	* already shows newer rows as failed, or fail another subscription's view.
+	* It also answers yes to the delivery that already claimed the slot, since
+	* that is the send itself failing (a row that will not serialise) after the
+	* check passed and before anything reached the subscriber.
 	*/
 	beginDelivery(subscriptionId, subscription) {
 		const seq = ++subscription.started;
-		return () => {
+		const canDeliver = () => {
 			if (this._subscriptions.get(subscriptionId) !== subscription) return false;
 			if (seq <= subscription.delivered) return false;
 			subscription.delivered = seq;
 			return true;
 		};
+		const mayReportFailure = () => canDeliver() || this._subscriptions.get(subscriptionId) === subscription && subscription.delivered === seq;
+		return Object.assign(canDeliver, { mayReportFailure });
 	}
-	registerDataDriverSubscription(subscriptionId, subscription) {
-		this.debugLog("📋 [RealtimeService] Registering DataDriver subscription:", subscriptionId, subscription.authContext ? "(with auth)" : "(no auth)");
-		this._subscriptions.set(subscriptionId, {
-			...subscription,
+	/**
+	* Start an in-process listener: register it, then deliver its first rows.
+	*
+	* The first fetch runs here, as the subscriber and through a delivery slot,
+	* the way every refetch after it does. `PostgresBackendDriver.listen*` used
+	* to run it themselves, outside this service, and got all three wrong: a
+	* listener on `withAuth(user)` read its first rows on the owner connection,
+	* so it was handed rows its policies deny; a slow first fetch landed over a
+	* newer refetch, and after an unsubscribe; and a row listener never heard a
+	* `null`. The subscriber's identity is part of the request because a
+	* subscription registered first and stamped with it afterwards has a first
+	* fetch that ran before the stamp.
+	*
+	* No `authContext` reads as the anonymous user, first fetch and refetches
+	* alike — see {@link fetchCollectionWithAuth}.
+	*/
+	startDataDriverSubscription(subscriptionId, request, callback) {
+		this.debugLog("📋 [RealtimeService] Starting DataDriver subscription:", subscriptionId, request.authContext ? "(with auth)" : "(no auth)");
+		const subscription = {
+			clientId: "driver",
+			...request,
 			started: 0,
 			delivered: 0
-		});
-	}
-	addSubscriptionCallback(subscriptionId, callback) {
-		this.debugLog("📋 [RealtimeService] Adding callback for subscription:", subscriptionId);
+		};
+		this._subscriptions.set(subscriptionId, subscription);
 		this.subscriptionCallbacks.set(subscriptionId, callback);
+		this.deliverFirstToDataDriver(subscriptionId, subscription, callback);
 	}
-	removeSubscriptionCallback(subscriptionId) {
-		this.debugLog("📋 [RealtimeService] Removing callback for subscription:", subscriptionId);
-		this.subscriptionCallbacks.delete(subscriptionId);
+	async deliverFirstToDataDriver(subscriptionId, subscription, callback) {
+		const canDeliver = this.beginDelivery(subscriptionId, subscription);
+		try {
+			const data = subscription.type === "collection" ? await this.fetchCollectionWithAuth(subscription.path, subscription.collectionRequest ?? {}, subscription.authContext) : await this.fetchEntityWithAuth(subscription.path, String(subscription.id), subscription.authContext) ?? null;
+			if (canDeliver()) callback(data);
+		} catch (error) {
+			logger.error(`❌ [RealtimeService] Error in the first fetch for DataDriver subscription ${subscriptionId}`, { error });
+			this.reportDriverFetchFailure(subscriptionId, subscription, canDeliver, error);
+		}
 	}
 	/**
 	* Subscribe to collection changes (RealtimeProvider interface)
 	*/
-	subscribeToCollection(subscriptionId, config, callback) {
+	subscribeToCollection(subscriptionId, config, callback, onError) {
 		this._subscriptions.set(subscriptionId, {
 			clientId: config.clientId,
 			type: "collection",
@@ -9144,6 +9164,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				searchString: config.searchString,
 				searchExplain: config.searchExplain
 			},
+			onError,
 			started: 0,
 			delivered: 0
 		});
@@ -9152,12 +9173,13 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	/**
 	* Subscribe to single row changes (RealtimeProvider interface)
 	*/
-	subscribeToOne(subscriptionId, config, callback) {
+	subscribeToOne(subscriptionId, config, callback, onError) {
 		this._subscriptions.set(subscriptionId, {
 			clientId: config.clientId,
 			type: "single",
 			path: config.path,
 			id: config.id,
+			onError,
 			started: 0,
 			delivered: 0
 		});
@@ -9239,6 +9261,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	}
 	async handleCollectionSubscription(clientId, request, authContext) {
 		const subscriptionId = request.subscriptionId;
+		let canDeliver;
 		try {
 			if (!this.registry.getCollectionByPath(request.path)) {
 				const registered = this.registry.getCollections().map((c) => c.slug).join(", ");
@@ -9295,17 +9318,17 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				delivered: 0
 			};
 			this._subscriptions.set(subscriptionId, subscription);
-			const canDeliver = this.beginDelivery(subscriptionId, subscription);
+			canDeliver = this.beginDelivery(subscriptionId, subscription);
 			const rows = await this.fetchCollectionWithAuth(request.path, subscription.collectionRequest, authContext);
 			const meta = await this.collectionMetaWithAuth(request.path, subscription.collectionRequest, rows, authContext);
 			if (canDeliver()) this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path, meta);
 		} catch (error) {
-			const sanitized = sanitizeErrorForClient(error, request.path);
-			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
+			this.reportSocketFetchFailure(clientId, subscriptionId, request.path, error, canDeliver);
 		}
 	}
 	async handleEntitySubscription(clientId, request, authContext) {
 		const subscriptionId = request.subscriptionId;
+		let canDeliver;
 		try {
 			if (!this.registry.getCollectionByPath(request.path)) {
 				const registered = this.registry.getCollections().map((c) => c.slug).join(", ");
@@ -9324,14 +9347,31 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				delivered: 0
 			};
 			this._subscriptions.set(subscriptionId, subscription);
-			const canDeliver = this.beginDelivery(subscriptionId, subscription);
+			canDeliver = this.beginDelivery(subscriptionId, subscription);
 			const row = await this.fetchEntityWithAuth(request.path, String(request.id), authContext);
 			if (canDeliver()) this.sendSingleUpdate(clientId, subscriptionId, row || null);
 		} catch (error) {
-			const sanitized = sanitizeErrorForClient(error, request.path);
-			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
+			this.reportSocketFetchFailure(clientId, subscriptionId, request.path, error, canDeliver);
 		}
 	}
+	/**
+	* Answer a subscriber's failed fetch with an error frame, through the slot
+	* its rows would have used.
+	*
+	* The error is always logged (`sanitizeErrorForClient` does that), but the
+	* frame goes out only while this fetch holds the newest slot. A failed
+	* straggler used to send one regardless. The client routes errors by
+	* `subscriptionId`, so it called `onError` for a view already showing newer
+	* rows, or for the subscription that replaced this one under the same id.
+	*
+	* With no slot, the subscribe failed before its fetch began. That part runs
+	* synchronously, so nothing else can have answered the request yet.
+	*/
+	reportSocketFetchFailure(clientId, subscriptionId, path, error, canDeliver) {
+		const sanitized = sanitizeErrorForClient(error, path);
+		if (canDeliver && !canDeliver.mayReportFailure()) return;
+		this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
+	}
 	async handleUnsubscribe(_clientId, subscriptionId) {
 		this._subscriptions.delete(subscriptionId);
 		this.subscriptionCallbacks.delete(subscriptionId);
@@ -9464,8 +9504,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				const meta = await this.collectionMetaWithAuth(notifyPath, subscription.collectionRequest, rows, subscription.authContext);
 				if (canDeliver()) this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath, meta);
 			} catch (error) {
-				const sanitized = sanitizeErrorForClient(error, notifyPath);
-				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
+				this.reportSocketFetchFailure(subscription.clientId, subscriptionId, notifyPath, error, canDeliver);
 			}
 		}, RealtimeService.REFETCH_DEBOUNCE_MS));
 	}
@@ -9485,10 +9524,30 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				if (canDeliver()) callback(rows);
 			} catch (error) {
 				logger.error(`❌ [RealtimeService] Error in debounced driver refetch for ${subscriptionId}`, { error });
+				this.reportDriverFetchFailure(subscriptionId, subscription, canDeliver, error);
 			}
 		}, RealtimeService.REFETCH_DEBOUNCE_MS));
 	}
 	/**
+	* Tell an in-process listener its refetch failed, through the slot the
+	* rows would have used.
+	*
+	* The two driver-refetch `catch` blocks used to log and stop, so the
+	* listener heard nothing and kept its last rows as if they were current.
+	* The error goes to it as thrown: this is trusted server code, and the
+	* masking on the socket path is for clients. The slot keeps a failed
+	* straggler from reporting over newer rows, and keeps a failure away from
+	* a subscription that was cancelled or replaced while it ran.
+	*/
+	reportDriverFetchFailure(subscriptionId, subscription, canDeliver, error) {
+		if (!subscription.onError || !canDeliver()) return;
+		try {
+			subscription.onError(error);
+		} catch (listenerError) {
+			logger.error(`❌ [RealtimeService] onError threw for DataDriver subscription ${subscriptionId}`, { error: listenerError });
+		}
+	}
+	/**
 	* Fetch a collection with optional RLS auth context.
 	* When authContext is provided, the fetch runs inside a transaction
 	* with set_config calls so PostgreSQL RLS policies are enforced.
@@ -9644,8 +9703,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				const row = await this.fetchEntityWithAuth(notifyPath, id, subscription.authContext);
 				if (canDeliver()) this.sendSingleUpdate(subscription.clientId, subscriptionId, row || null);
 			} catch (error) {
-				const sanitized = sanitizeErrorForClient(error, notifyPath);
-				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
+				this.reportSocketFetchFailure(subscription.clientId, subscriptionId, notifyPath, error, canDeliver);
 			}
 		}, RealtimeService.REFETCH_DEBOUNCE_MS));
 	}
@@ -9665,6 +9723,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				if (canDeliver()) callback(row || null);
 			} catch (error) {
 				logger.error(`❌ [RealtimeService] Error in debounced row driver refetch for ${subscriptionId}`, { error });
+				this.reportDriverFetchFailure(subscriptionId, subscription, canDeliver, error);
 			}
 		}, RealtimeService.REFETCH_DEBOUNCE_MS));
 	}
@@ -10787,6 +10846,31 @@ function extractErrorMessage(error) {
 /**
 * Check if the current session belongs to an admin user.
 */
+/**
+* Who a socket reads and writes as, for its request frames and its
+* subscriptions alike.
+*
+* One answer because there were two, and they disagreed about guests. The
+* subscriptions carried the session's `isAnonymous`; the request frames wrote
+* `false` for every signed-in session, so a guest read and wrote as an account
+* through `FETCH_*`, `SAVE` and `DELETE` while its subscriptions did not. And a
+* socket with no session was a guest on the request frames (`true`) but not on
+* its subscriptions or over REST: an unauthenticated caller is not a guest
+* session.
+*/
+function sessionAuthContext(session) {
+	if (!session?.user) return {
+		uid: ANONYMOUS_USER_ID,
+		roles: ["anon"],
+		isAnonymous: false
+	};
+	return {
+		uid: session.user.uid,
+		roles: session.user.roles ?? [],
+		isAnonymous: session.user.isAnonymous === true,
+		...session.user.claims ? { claims: session.user.claims } : {}
+	};
+}
 function isAdminSession(session) {
 	if (!session?.user) return false;
 	if (session.user.isAdmin) return true;
@@ -10872,13 +10956,15 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						if (adapterUser) verifiedUser = {
 							uid: adapterUser.uid,
 							roles: adapterUser.roles,
-							isAdmin: adapterUser.isAdmin
+							isAdmin: adapterUser.isAdmin,
+							isAnonymous: adapterUser.isAnonymous === true
 						};
 					} catch {}
 					else if (authConfig?.serviceKey && safeCompare(token, authConfig.serviceKey)) verifiedUser = {
 						uid: "service",
 						roles: ["admin"],
-						isAdmin: true
+						isAdmin: true,
+						isAnonymous: false
 					};
 					else {
 						const jwtPayload = await extractUserFromToken(token);
@@ -10966,25 +11052,17 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					assertFieldOpsValid(values, collection);
 				};
 				const getScopedDelegate = async () => {
-					const session = clientSessions.get(clientId);
 					if (typeof driver.withAuth === "function") try {
-						const userForAuth = session?.user ? {
-							uid: session.user.uid,
-							displayName: null,
-							email: null,
-							photoURL: null,
-							providerId: "websocket",
-							isAnonymous: false,
-							roles: session.user.roles ?? [],
-							claims: session.user.claims
-						} : {
-							uid: ANONYMOUS_USER_ID,
+						const who = sessionAuthContext(clientSessions.get(clientId));
+						const userForAuth = {
+							uid: who.uid,
 							displayName: null,
 							email: null,
 							photoURL: null,
 							providerId: "websocket",
-							isAnonymous: true,
-							roles: ["anon"]
+							isAnonymous: who.isAnonymous === true,
+							roles: who.roles,
+							...who.claims ? { claims: who.claims } : {}
 						};
 						return await driver.withAuth(userForAuth);
 					} catch (e) {
@@ -11287,17 +11365,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					case "presence_state":
 					case "channel_history": {
 						wsDebug("🔄 [WebSocket Server] Routing realtime message to RealtimeService:", type);
-						const session = clientSessions.get(clientId);
-						const authContext = session?.user ? {
-							uid: session.user.uid,
-							roles: session.user.roles ?? [],
-							isAnonymous: session.user.isAnonymous === true,
-							claims: session.user.claims
-						} : {
-							uid: ANONYMOUS_USER_ID,
-							roles: ["anon"],
-							isAnonymous: false
-						};
+						const authContext = sessionAuthContext(clientSessions.get(clientId));
 						await realtimeService.handleClientMessage(clientId, {
 							type,
 							payload,
@@ -11333,15 +11401,18 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					}));
 					return;
 				}
-				if (error instanceof ApiError || error?.name === "ApiError") {
-					const apiError = error;
-					logger.warn(`[WebSocket Server] Refused a write: ${apiError.message}`);
+				const answer = declaredErrorAnswer(error);
+				if (answer) {
+					const line = `[WebSocket Server] Refused: ${answer.code} ${answer.message}`;
+					if (answer.expected) logger.debug(line);
+					else logger.warn(line);
 					ws.send(JSON.stringify({
 						type: "ERROR",
 						requestId,
 						payload: { error: {
-							message: apiError.message,
-							code: apiError.code
+							message: answer.message,
+							code: answer.code,
+							...answer.details !== void 0 && { details: answer.details }
 						} }
 					}));
 					return;
@@ -15068,7 +15139,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-Bkvehxdm.js").then((n) => n.n);
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-Cr2ye5JC.js").then((n) => n.n);
 			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(describeEnsureFailure(failure));
 			return { applied: plan.actions.length - plan.failures.length };
@@ -15102,7 +15173,7 @@ function createPostgresBootstrapper(pgConfig) {
 			await provisionRlsRuntime(provisioningQueryable(driverResult));
 		},
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-CQGHln-y.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-B4IDFtQ-.js");
 			const queryable = provisioningQueryable(driverResult);
 			const { rows } = await queryable.query("SELECT to_regprocedure('rebase.roles()') IS NOT NULL AS present");
 			if (!rows[0]?.present) await provisionRlsRuntime(queryable);