@rebasepro/server-postgres 0.21.2-canary.g1ea48be → 0.22.0

package/dist/index.es.js

@@ -2,25 +2,25 @@ import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
 import { a as createDirectDatabaseConnection, c as guardPoolAgainstDirtyRelease, l as pinSearchPath, o as createPostgresDatabaseConnection, r as cappedPoolMax, s as createReadReplicaConnection, t as DatabasePoolManager, u as poolMaxCeiling } from "./databasePoolManager-Bj5FbeAs.js";
-import { f as hiddenColumnsOption, l as SEARCH_UNACCENT_FN, m as searchColumnNames, o as sharedRelationName, u as buildSearchColumnSpec, x as visibleColumnProjection } from "./plan-schema-Hgl62S-w.js";
+import { f as hiddenColumnsOption, l as SEARCH_UNACCENT_FN, m as searchColumnNames, o as sharedRelationName, u as buildSearchColumnSpec, x as visibleColumnProjection } from "./plan-schema-CboAIwLN.js";
 import { d as extractPgError, f as isRoleSwitchingPermissionError, g as sanitizeErrorForClient, h as reachedDatabase, i as diagnoseDbError, l as classifyConnectFailure, m as pgErrorToFriendlyMessage, n as deepestErrorMessage, o as isEconnrefused, p as isRowLevelSecurityDenial, s as parseHostInfo, u as extractCauseMessage } from "./cli-errors-Dka89exj.js";
 import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-CucnFcSE.js";
 import { c as warnOnLegacyRlsFunctions, i as ensureAppRole, l as warnOnRoleSchemaCollision, n as applyAuthContext, o as validatePolicyPgRoles, r as detectConnectionPosture, s as warnOnAnonymousGrants, t as REBASE_USER_ROLE } from "./rls-enforcement-C6Xk0lA6.js";
 import { l as resolveColumnName } from "./column-plan-helpers-CpILzHJS.js";
 import { i as isAuthCollection, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
-import { a as generatePostgresVectorDdl, i as generatePostgresTriggersDdl, n as generatePostgresPoliciesDdl, r as generatePostgresSearchDdl, t as generatePostgresDdl } from "./generate-postgres-ddl-logic-CR2xcS7e.js";
-import { t as generateSchema } from "./generate-drizzle-schema-logic-DFa9qy9u.js";
-import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-Cr2ye5JC.js";
-import { t as main } from "./generate-drizzle-schema-D2MDdJt-.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-BNLwvxuy.js";
-import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-BnEvEJPr.js";
+import { a as generatePostgresVectorDdl, i as generatePostgresTriggersDdl, n as generatePostgresPoliciesDdl, r as generatePostgresSearchDdl, t as generatePostgresDdl } from "./generate-postgres-ddl-logic-D7imhYV8.js";
+import { t as generateSchema } from "./generate-drizzle-schema-logic-BcMl7VSy.js";
+import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-CpAgy51F.js";
+import { t as main } from "./generate-drizzle-schema-B537GIvz.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-CaMOS76G.js";
+import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-Cr5B4UmH.js";
 import { c as identifyJoinTables, d as singularize, h as humanize, i as buildTablesMap, m as mapPgType, r as buildEnumMap, s as getIconForTable } from "./introspect-db-logic-C6LQdTxj.js";
 import { Client } from "pg";
 import { ApiError, assertFieldOpsValid, assertWriteRequestValid, createDdlBootstrapper, createEmailService, declaredErrorAnswer, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveBatchRefs, resolveRequireAuth, safeCompare, splitFieldOps } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isNotNull, isNull, isTable, lt, not, notInArray, or, relations, sql } from "drizzle-orm";
 import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, JUNCTION_PIVOT_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, declaredDatabaseExtensions, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, parseEnvBoolean, parseRelationAggregateSort, resolveClientListLimit } from "@rebasepro/types";
 import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, REBASE_USER_ROLE as REBASE_USER_ROLE$1, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createRelationRef, createRelationRefWithData, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, firstSqlRow, getColumnName, getDeclaredPrimaryKeys, getJunctionCollectionConfig, getJunctionConfigForRelation, getTableName as getTableName$1, getTenantConfig, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseOrderBySpecStrict, requireCallbackClient, requireCallbackCollection, resolveCollectionRelations, resolveJunctionSpecs, resolveTenantWrite, revokeInternalTableSql, sqlRows, tenantBypassRoles, toCallbackError, toFilterTuples, updateDateAutoValues, updateUserAutoValues } from "@rebasepro/common";
-import { camelCase, firstFreeKey, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, mergeDeep, toSnakeCase, toWireKey, unref } from "@rebasepro/utils";
+import { camelCase, firstFreeKey, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, mergeDeep, splitSearchTerms, toSnakeCase, toWireKey, unref } from "@rebasepro/utils";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { PgArray, PgNumeric, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs from "fs";
@@ -408,6 +408,15 @@ function deriveRowAddress(row, collection, registry) {
 */
 var PG_TRGM_WORD_SIMILARITY_DEFAULT = .6;
 /**
+* What a substring-only hit contributes to `_score` under
+* {@link SearchMode} `"hybrid"`.
+*
+* Below the smallest `ts_rank` a real lexeme match can produce (a single
+* D-weighted hit is 0.1 × 0.0607927 ≈ 0.006), so a row found by the indexed
+* half always outranks one found only by substring.
+*/
+var HYBRID_SUBSTRING_SCORE = .001;
+/**
 * A user's search term, made safe to drop inside a `%…%` LIKE pattern.
 *
 * The term is already a bind parameter, so this is not about injection. It is
@@ -1693,13 +1702,20 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 	* - **Declared** — one `@@ websearch_to_tsquery` against the generated
 	*   `tsvector` column. Stems, drops stopwords, AND-es the terms, reaches
 	*   inside JSONB and arrays, and uses the GIN index.
-	* - **Not declared** — the original `ILIKE '%term%'` OR-ed across top-level
-	*   string properties, with the term escaped (see {@link escapeLikePattern})
-	*   so it is matched as the literal text the user typed.
+	* - **Not declared** — `ILIKE '%term%'` per term, OR-ed across top-level
+	*   string properties and AND-ed across the terms, with each term escaped
+	*   (see {@link escapeLikePattern}) so it is matched as the literal text
+	*   the user typed.
 	*
-	* The second is the default and stays the default. A collection that has
-	* not opted in compiles to exactly the SQL it compiled to before this
-	* branch existed, which is the only reason it is safe to have added it.
+	* The second is the default and stays the default, and it AND-es terms for
+	* the same reason `websearch_to_tsquery` does: a person typing two words
+	* into a search box means both, and a name lives in two columns. Matching
+	* the whole string per column instead — which is what this did — cannot
+	* find `sebastian melendez` on a row with `first_name`/`last_name`, and
+	* could not find `sebastian ` at all.
+	*
+	* Returns at most one condition. Every caller ORs what it gets back, which
+	* is right across columns and wrong across terms, so the AND is built here.
 	*
 	* `collection` is optional so that the callers which genuinely have no
 	* collection in hand — nested paths, derived views — keep working; without
@@ -1711,16 +1727,24 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		if (ftsCondition) return [ftsCondition];
 		let declaredStringProperties = 0;
 		const viewer = currentFieldViewer();
+		const searchableColumns = [];
 		for (const [key, prop] of Object.entries(properties)) {
 			const p = prop;
 			if (!canReadField(prop, viewer)) continue;
 			if (p.type === "string" && !p.enum && p.isId !== "uuid") {
 				declaredStringProperties++;
 				const fieldColumn = table[key];
-				if (fieldColumn && supportsILike(fieldColumn)) searchConditions.push(ilike(fieldColumn, `%${escapeLikePattern(searchString)}%`));
+				if (fieldColumn && supportsILike(fieldColumn)) searchableColumns.push(fieldColumn);
 			}
 		}
-		if (declaredStringProperties > 0 && searchConditions.length === 0) logger.warn(`[search] "${collection?.slug ?? "collection"}" declares ${declaredStringProperties} string property(ies) but none compiled to a searchable column, so this search can only return nothing. Check that the generated schema's column types are text/varchar/char.`);
+		if (declaredStringProperties > 0 && searchableColumns.length === 0) logger.warn(`[search] "${collection?.slug ?? "collection"}" declares ${declaredStringProperties} string property(ies) but none compiled to a searchable column, so this search can only return nothing. Check that the generated schema's column types are text/varchar/char.`);
+		if (searchableColumns.length === 0) return [];
+		const terms = splitSearchTerms(searchString);
+		const perTerm = (terms.length > 0 ? terms : [searchString]).map((term) => {
+			const pattern = `%${escapeLikePattern(term)}%`;
+			return DrizzleConditionBuilder.combineConditionsWithOr(searchableColumns.map((column) => ilike(column, pattern)));
+		});
+		searchConditions.push(DrizzleConditionBuilder.combineConditionsWithAnd(perTerm));
 		return searchConditions;
 	}
 	/**
@@ -1748,12 +1772,66 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		const column = table[spec.column];
 		if (!column) return;
 		const exact = sql`${column} @@ ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)}`;
-		if (!spec.fuzzy) return exact;
+		const substring = spec.mode === "hybrid" ? DrizzleConditionBuilder.buildFoldedSubstringCondition(searchString, spec) : void 0;
+		const matched = substring ? sql`(${exact} OR ${substring})` : exact;
+		if (!spec.fuzzy) return matched;
 		const fuzzyColumn = table[spec.fuzzy.column];
-		if (!fuzzyColumn) return exact;
+		if (!fuzzyColumn) return matched;
 		const needle = spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`;
 		const similar = sql`public.word_similarity(${needle}, ${fuzzyColumn}) >= ${spec.fuzzy.threshold}`;
-		return sql`(${exact} OR ${spec.fuzzy.threshold > PG_TRGM_WORD_SIMILARITY_DEFAULT ? sql`(${needle} OPERATOR(public.<%) ${fuzzyColumn} AND ${similar})` : similar})`;
+		return sql`(${matched} OR ${spec.fuzzy.threshold > PG_TRGM_WORD_SIMILARITY_DEFAULT ? sql`(${needle} OPERATOR(public.<%) ${fuzzyColumn} AND ${similar})` : similar})`;
+	}
+	/**
+	* The substring half of {@link SearchMode} `"hybrid"`: every term found
+	* somewhere in the declared fields, with accents folded on both sides.
+	*
+	* Terms are AND-ed and fields OR-ed, exactly as the ILIKE default does and
+	* for the same reason — a person typing two words means both, and a name
+	* lives in two columns (`splitSearchTerms`). What it does *not* share with
+	* the default is its reach: these are the declared `search.fields`, so it
+	* folds accents, joins `text[]` and walks into JSONB through the same
+	* IMMUTABLE helpers the generated column uses.
+	*
+	* The needle is folded with the same function as the document, so
+	* `munoz` and `Muñoz` meet in the middle rather than one side being
+	* normalized and the other not — the subtle way to build a search that
+	* matches nothing.
+	*
+	* Interpolated as raw SQL because the field expressions are generated (they
+	* name columns and helper functions, which are identifiers, not values);
+	* the *term* is a bind parameter, escaped for LIKE first — see
+	* {@link escapeLikePattern} for what that escape is for.
+	*/
+	static buildFoldedSubstringCondition(searchString, spec) {
+		if (spec.fields.length === 0) return void 0;
+		const perTerm = DrizzleConditionBuilder.foldedNeedles(searchString).map((needle) => DrizzleConditionBuilder.combineConditionsWithOr(spec.fields.map((f) => sql`${sql.raw(f.foldedTextSql)} ILIKE ${needle}`)));
+		return DrizzleConditionBuilder.combineConditionsWithAnd(perTerm);
+	}
+	/**
+	* Whether one text expression holds **any** term of the search string.
+	*
+	* The per-field question, where {@link buildFoldedSubstringCondition} asks
+	* the per-row one: `OR` across terms rather than `AND`, because a two-word
+	* query satisfied across two fields has each field carrying one term. Used
+	* by `_matches` to name the fields that caused a substring hit.
+	*/
+	static foldedSubstringOf(searchString, text) {
+		return DrizzleConditionBuilder.combineConditionsWithOr(DrizzleConditionBuilder.foldedNeedles(searchString).map((needle) => sql`${text} ILIKE ${needle}`));
+	}
+	/**
+	* One accent-folded `%term%` bind parameter per search term.
+	*
+	* The needle is folded with the same function as the document, so `munoz`
+	* and `Muñoz` meet in the middle instead of one side being normalized and
+	* the other not — the subtle way to build a search that matches nothing.
+	*
+	* A string with no terms at all is only whitespace, and stays the single
+	* literal pattern it is on the ILIKE path rather than becoming "no rows",
+	* so both paths answer a stray space the same way.
+	*/
+	static foldedNeedles(searchString) {
+		const terms = splitSearchTerms(searchString);
+		return (terms.length > 0 ? terms : [searchString]).map((term) => sql`${sql.raw(SEARCH_UNACCENT_FN)}(${`%${escapeLikePattern(term)}%`})`);
 	}
 	/**
 	* `websearch_to_tsquery(<config>, <normalized search string>)`.
@@ -1800,17 +1878,18 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		if (!table[spec.column]) return void 0;
 		const query = DrizzleConditionBuilder.normalizedTsQuery(searchString, spec);
 		const config = sql`${spec.language}`;
-		const rows = spec.fields.map((f, i) => sql`(${i}, ${f.path}, ${sql.raw(f.textSql)})`);
+		const rows = spec.fields.map((f, i) => sql`(${i}, ${f.path}, ${sql.raw(f.textSql)}, ${sql.raw(f.foldedTextSql)})`);
+		const matchedField = spec.mode === "hybrid" ? sql`(to_tsvector(${config}::regconfig, f.txt) @@ ${query} OR ${DrizzleConditionBuilder.foldedSubstringOf(searchString, sql`f.folded`)})` : sql`to_tsvector(${config}::regconfig, f.txt) @@ ${query}`;
 		return sql`(
             SELECT coalesce(jsonb_agg(s.m ORDER BY f.ord), '[]'::jsonb)
-            FROM (VALUES ${sql.join(rows, sql`, `)}) AS f(ord, path, txt)
+            FROM (VALUES ${sql.join(rows, sql`, `)}) AS f(ord, path, txt, folded)
             CROSS JOIN LATERAL (
                 SELECT jsonb_build_object(
                     'field', f.path,
                     'snippet', ts_headline(${config}::regconfig, f.txt, ${query},
                         'StartSel=<mark>,StopSel=</mark>,MaxWords=14,MinWords=1,MaxFragments=1,FragmentDelimiter= … ')
                 ) AS m
-                WHERE to_tsvector(${config}::regconfig, f.txt) @@ ${query}
+                WHERE ${matchedField}
             ) s
         )`;
 	}
@@ -1828,7 +1907,11 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		if (!spec) return void 0;
 		const column = table[spec.column];
 		if (!column) return void 0;
-		const rank = sql`ts_rank(${column}, ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)})`;
+		const base = sql`ts_rank(${column}, ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)})`;
+		const rank = spec.mode === "hybrid" ? (() => {
+			const substring = DrizzleConditionBuilder.buildFoldedSubstringCondition(searchString, spec);
+			return substring ? sql`(${base} + CASE WHEN ${substring} THEN ${sql.raw(`${HYBRID_SUBSTRING_SCORE}::real`)} ELSE 0 END)` : base;
+		})() : base;
 		if (!spec.fuzzy) return rank;
 		const fuzzyColumn = table[spec.fuzzy.column];
 		if (!fuzzyColumn) return rank;
@@ -2488,6 +2571,124 @@ function andSoftDelete(where, collection, table, withDeleted) {
 	return where ? and(where, condition) : condition;
 }
 //#endregion
+//#region src/services/read-scope.ts
+/**
+* `beforeQuery`: the one place a collection callback can change *which* rows a
+* read asks for.
+*
+* `afterRead` runs over rows that have already been fetched, so until this
+* existed an application developer who needed the read itself narrowed — a
+* tenant scope, a visibility window, a per-role row filter — had two options:
+* patch this driver, or `rebase eject`.
+*
+* Two properties are load-bearing, and both belong to the *shape* of the thing
+* rather than to how carefully each call site was written.
+*
+* ## It can only narrow
+*
+* A hook returns a {@link QueryNarrowing} — a declarative filter, optionally a
+* logical group — which is AND-ed into the query the caller sent. `AND(q, c)`
+* is a subset of `q` for every `c`, so there is no `c` a hook can return that
+* widens a read. The obvious alternative shape, `(query) => query`, can: a
+* hook that drops a condition on the way through runs the query without it,
+* and on an RLS data plane a dropped condition returns everything the policies
+* happen to allow. That is the same reasoning behind
+* `UnknownFilterFieldsMode` defaulting to `"error"`, and it is why that mode is
+* **forced** to `"error"` for a hook's own filter here whatever the
+* process-wide setting is: a scope condition naming a renamed column has to
+* refuse the request, never be dropped from it.
+*
+* ## It cannot be skipped
+*
+* The hooks are resolved *by the read path itself*, out of the registry that
+* read already holds — not handed to it by a caller who might forget. So a
+* read that compiles a WHERE compiles this one too, or it throws.
+*
+* The one thing a read path cannot derive is the identity the hook runs as:
+* `FetchService`, `RelationService` and `DataService` carry no user. That
+* arrives as a {@link ReadCallContextProvider}, threaded from the driver that
+* constructed them — the driver is the only object that knows both the caller
+* and the connection, and it constructs a service per transaction anyway, so
+* there is exactly one place per instance to pass it.
+*
+* Absence is the interesting case, and it fails closed: a service built with no
+* provider refuses any read of a collection that declares `beforeQuery`, with
+* a message naming the collection. So a future construction site that forgets
+* the provider breaks loudly on the first scoped collection instead of quietly
+* serving every row — which is the failure mode this whole module exists to
+* rule out. A deployment with no `beforeQuery` anywhere never reaches any of
+* this: the check is one map lookup and the compiled SQL is byte-identical.
+*
+* @module
+*/
+/**
+* The `beforeQuery` hooks that apply to one collection, in the order they run.
+*
+* Global first, then the collection's own — the same order `afterRead` and
+* `beforeSave` use. The order changes nothing about the outcome here (both are
+* AND-ed in, so neither can relax the other) and is kept because a hook that
+* logs or measures should see the same sequence everywhere.
+*
+* There is no property tier: a property callback shapes one value on a row, and
+* a row filter is not a value.
+*/
+function resolveBeforeQuery(registry, collection) {
+	const hooks = [];
+	const global = registry?.getGlobalCallbacks();
+	if (global?.beforeQuery) hooks.push(global.beforeQuery);
+	const own = collection?.callbacks;
+	if (own?.beforeQuery) hooks.push(own.beforeQuery);
+	return hooks;
+}
+/**
+* The conditions every `beforeQuery` hook for this collection asks to add.
+*
+* Returned as a list rather than pre-combined so a caller pushes them onto the
+* same `allConditions` array its own filter goes into. Every caller AND-es
+* that array, which is what makes these additive — the hook is not trusted to
+* narrow, it is only ever given a way to.
+*/
+async function beforeQueryConditions(env, collection, path, table, description, filterContext) {
+	const hooks = resolveBeforeQuery(env.registry, collection);
+	if (hooks.length === 0) return [];
+	if (!collection) throw new Error(`[beforeQuery] "${path}" resolves to no registered collection, so a global \`beforeQuery\` cannot be compiled against it. Register the collection, or narrow the hook to the collections it applies to.`);
+	if (!env.callContext) throw new Error(`[beforeQuery] "${collection.slug}" declares a \`beforeQuery\` hook, and this read was compiled by a service that was built without a call-context provider, so the hook could not run. Serving the read unnarrowed is not an option — a hook that does not run widens the result set. Construct the service through the driver (which passes one), or pass a provider explicitly.`);
+	const context = env.callContext();
+	const unknownFields = "error";
+	const options = {
+		...filterContext,
+		unknownFields
+	};
+	const conditions = [];
+	for (const hook of hooks) {
+		const narrowing = await hook({
+			collection,
+			path,
+			operation: description.operation,
+			query: description.query,
+			context
+		});
+		if (!narrowing) continue;
+		if (!narrowing.filter && !narrowing.logical) throw new Error(`[beforeQuery] "${collection.slug}" returned an object with neither \`filter\` nor \`logical\`. Return nothing (or \`undefined\`) to add no conditions; an empty object reads as a scope that was meant to be built and was not.`);
+		if (narrowing.filter) conditions.push(...DrizzleConditionBuilder.buildFilterConditions(narrowing.filter, table, path, options));
+		if (narrowing.logical) {
+			const logical = DrizzleConditionBuilder.buildLogicalConditions(narrowing.logical, table, path, options);
+			if (logical) conditions.push(logical);
+		}
+	}
+	return conditions;
+}
+/**
+* {@link beforeQueryConditions}, pre-combined, for the read paths that hold a
+* single `SQL` rather than a list of them — a single get, a relation loader.
+*/
+async function beforeQueryCondition(env, collection, path, table, description, filterContext) {
+	const conditions = await beforeQueryConditions(env, collection, path, table, description, filterContext);
+	if (conditions.length === 0) return void 0;
+	if (conditions.length === 1) return conditions[0];
+	return and(...conditions);
+}
+//#endregion
 //#region src/services/RelationService.ts
 /**
 * Typed wrapper for Drizzle dynamic query innerJoin.
@@ -2522,6 +2723,17 @@ function narrowed(base, narrow) {
 	return narrow ? and(base, narrow) : base;
 }
 /**
+* Two optional conditions, AND-ed: either, both, or neither.
+*
+* The include's own `where` and the target collection's `beforeQuery` arrive
+* separately and are both optional, and they have to reach the loaders as one
+* condition because that is the shape every relation kind threads through.
+*/
+function narrowBoth(a, b) {
+	if (a && b) return and(a, b);
+	return a ?? b;
+}
+/**
 * The registry has no table for a collection a relation just asked about.
 *
 * "Parent table not found" was the whole message, four times over, and it names
@@ -2538,9 +2750,43 @@ function unregisteredTable(collectionSlug, table, role) {
 var RelationService = class {
 	db;
 	registry;
-	constructor(db, registry) {
+	callContext;
+	constructor(db, registry, callContext) {
 		this.db = db;
 		this.registry = registry;
+		this.callContext = callContext;
+	}
+	/**
+	* The **target** collection's `beforeQuery` narrowing, for rows reached
+	* through a relation.
+	*
+	* The target's, not the parent's, because these are the target's rows: a
+	* scope on `comments` has to hold whether they are listed at
+	* `/comments` or loaded as `post.comments`. Without this an `include` is a
+	* way around every row filter a collection declares — the exact hole
+	* `stripUnreadable` was once missing from the relation-ref branch.
+	*
+	* Folded into the `narrow` condition the loaders already thread through
+	* every relation kind, so a `via` join, a junction, a foreign key and the
+	* dynamic relation builder all apply it or none of them do.
+	*/
+	narrowTargetRead(parentCollection, relation, parentId) {
+		const targetCollection = relation.target();
+		const targetTable = getTableForCollection(targetCollection, this.registry);
+		return beforeQueryCondition({
+			registry: this.registry,
+			callContext: this.callContext
+		}, targetCollection, targetCollection.slug, targetTable, {
+			operation: "relation",
+			query: { relatedTo: {
+				parentSlug: parentCollection.slug,
+				parentId,
+				relationName: relation.relationName
+			} }
+		}, {
+			collection: targetCollection,
+			registry: this.registry
+		});
 	}
 	/**
 	* One target row, as the {@link RelatedRow} everything here returns.
@@ -2711,6 +2957,7 @@ var RelationService = class {
 		const parentTable = this.registry.getTable(parentTableName);
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
+		const relatedNarrowing = await this.narrowTargetRead(parentCollection, relation, parentId);
 		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
 			let currentTable = parentTable;
@@ -2730,7 +2977,7 @@ var RelationService = class {
 				currentTable = joinTable;
 			}
 			const parentIdField = parentTable[requirePrimaryKeys(parentCollection, this.registry)[0].fieldName];
-			query = query.where(eq(parentIdField, parsedParentId));
+			query = query.where(narrowed(eq(parentIdField, parsedParentId), relatedNarrowing));
 			if (options.limit) query = query.limit(options.limit);
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
@@ -2747,6 +2994,7 @@ var RelationService = class {
 		const additionalFilters = [];
 		const relatedSoftDelete = softDeleteCondition(targetCollection, targetTable);
 		if (relatedSoftDelete) additionalFilters.push(relatedSoftDelete);
+		if (relatedNarrowing) additionalFilters.push(relatedNarrowing);
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, targetCollection.properties, targetTable, targetCollection);
 			if (searchConditions.length === 0) return [];
@@ -2801,6 +3049,8 @@ var RelationService = class {
 		if (matchValue === void 0) return 0;
 		const countSoftDelete = softDeleteCondition(targetCollection, targetTable);
 		if (countSoftDelete) additionalFilters = [...additionalFilters, countSoftDelete];
+		const countNarrowing = await this.narrowTargetRead(parentCollection, relation, parentId);
+		if (countNarrowing) additionalFilters = [...additionalFilters, countNarrowing];
 		let query = this.db.select({ count: sql`count(distinct ${targetIdField})` }).from(targetTable).$dynamic();
 		query = DrizzleConditionBuilder.buildRelationCountQuery(query, relation, matchValue, targetTable, parentTable, parentIdCol, targetIdField, this.registry, additionalFilters);
 		const result = await query;
@@ -2848,7 +3098,7 @@ var RelationService = class {
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
 		const parsedParentIds = parentIds.map((id) => parseIdValues(id, parentPks)[parentIdInfo.fieldName]);
-		const narrowTarget = andSoftDelete(narrow, targetCollection, targetTable);
+		const narrowTarget = andSoftDelete(narrowBoth(narrow, await this.narrowTargetRead(parentCollection, relation)), targetCollection, targetTable);
 		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
 			let currentTable = parentTable;
@@ -2952,7 +3202,7 @@ var RelationService = class {
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
 		const parsedParentIds = parentIds.map((id) => parseIdValues(id, parentPks)[parentIdInfo.fieldName]);
-		const narrowTarget = andSoftDelete(narrow, targetCollection, targetTable);
+		const narrowTarget = andSoftDelete(narrowBoth(narrow, await this.narrowTargetRead(parentCollection, relation)), targetCollection, targetTable);
 		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
 			let currentTable = parentTable;
@@ -3652,11 +3902,13 @@ function numericAggregateAliases(aggregates, properties) {
 var FetchService = class FetchService {
 	db;
 	registry;
+	callContext;
 	relationService;
-	constructor(db, registry) {
+	constructor(db, registry, callContext) {
 		this.db = db;
 		this.registry = registry;
-		this.relationService = new RelationService(db, registry);
+		this.callContext = callContext;
+		this.relationService = new RelationService(db, registry, callContext);
 	}
 	/**
 	* Get the relational query builder for a given table name.
@@ -3690,6 +3942,63 @@ var FetchService = class FetchService {
 		};
 	}
 	/**
+	* The conditions this collection's `beforeQuery` hooks ask to add, for a
+	* read that is about to be compiled.
+	*
+	* Resolved here, from the registry this service already holds, rather than
+	* handed in by a caller — so a read path that builds a WHERE cannot serve
+	* one of these collections without the hook. `[]` when nothing is declared,
+	* which leaves the compiled SQL byte-identical.
+	*
+	* Every caller pushes the result onto the same `allConditions` array its
+	* own filter goes into, and every one of those arrays is AND-ed. That is
+	* what keeps a hook additive: it is not trusted to narrow, it is only ever
+	* given a way to.
+	*/
+	narrowRead(collectionPath, collection, table, operation, query) {
+		return beforeQueryConditions({
+			registry: this.registry,
+			callContext: this.callContext
+		}, collection, collectionPath, table, {
+			operation,
+			query
+		}, this.filterContext(collectionPath, table));
+	}
+	/** {@link narrowRead}, pre-combined, for the reads that hold one `SQL`. */
+	narrowReadCondition(collectionPath, collection, table, operation, query) {
+		return beforeQueryCondition({
+			registry: this.registry,
+			callContext: this.callContext
+		}, collection, collectionPath, table, {
+			operation,
+			query
+		}, this.filterContext(collectionPath, table));
+	}
+	/**
+	* The read the hooks are shown, from the options a read path was given.
+	*
+	* Transport is left out on purpose — a `databaseId`, an `include` tree, a
+	* `withDeleted` flag are not part of "which rows". What is in is what a
+	* scope might reasonably branch on.
+	*/
+	static describeRead(options) {
+		const orderBy = normalizeDriverOrderBy(options.orderBy, options.order);
+		return {
+			filter: options.filter,
+			logical: options.logical,
+			searchString: options.searchString,
+			limit: options.limit,
+			offset: options.offset,
+			orderBy: orderBy && orderBy.length > 0 ? orderBy : void 0,
+			fields: options.fields,
+			relatedTo: options.relatedTo ? {
+				parentSlug: options.relatedTo.parentCollection.slug,
+				parentId: options.relatedTo.parentId,
+				relationName: options.relatedTo.relation.relationName
+			} : void 0
+		};
+	}
+	/**
 	* The table column this collection's rows are keyed by, or `undefined`.
 	*
 	* `getPrimaryKeys` rather than `requirePrimaryKeys`: a collection with no
@@ -4282,13 +4591,15 @@ var FetchService = class FetchService {
 		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
 		if (!idCanAddressTable(id, table, idInfoArray)) return void 0;
 		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
+		const narrowing = await this.narrowReadCondition(collectionPath, collection, table, "get", {});
+		const identity = narrowing ? and(eq(idField, parsedId), narrowing) : eq(idField, parsedId);
 		const tableName = getTableName(table);
 		const qb = this.getQueryBuilder(tableName);
 		if (qb) try {
 			const withConfig = this.buildWithConfig(collection);
 			const hidden = hiddenColumnsOption(getTableColumns(table), collection);
 			const row = await qb.findFirst({
-				where: andSoftDelete(eq(idField, parsedId), collection, table, withDeleted),
+				where: andSoftDelete(identity, collection, table, withDeleted),
 				with: withConfig,
 				...hidden ? { columns: hidden } : {}
 			});
@@ -4305,7 +4616,7 @@ var FetchService = class FetchService {
 			logger.warn(`[FetchService] db.query.findFirst failed for ${collectionPath}, falling back to db.select`, { error: e });
 		}
 		const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
-		const result = await this.db.select(visibleOne).from(table).where(andSoftDelete(eq(idField, parsedId), collection, table, withDeleted)).limit(1);
+		const result = await this.db.select(visibleOne).from(table).where(andSoftDelete(identity, collection, table, withDeleted)).limit(1);
 		if (result.length === 0) return void 0;
 		const raw = result[0];
 		const values = await parseDataFromServer(raw, collection, this.db, this.registry);
@@ -4406,6 +4717,10 @@ var FetchService = class FetchService {
 			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, effectivePath, this.filterContext(effectivePath, table));
 			if (logicalCondition) allConditions.push(logicalCondition);
 		}
+		allConditions.push(...await this.narrowRead(effectivePath, collection, table, "count", FetchService.describeRead({
+			...options,
+			relatedTo: hop
+		})));
 		if (options.vectorSearch) {
 			const vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
 			if (vectorMeta.filter) allConditions.push(vectorMeta.filter);
@@ -4484,6 +4799,7 @@ var FetchService = class FetchService {
 			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
 			if (logicalCondition) conditions.push(logicalCondition);
 		}
+		conditions.push(...await this.narrowRead(collectionPath, collection, table, "aggregate", FetchService.describeRead(options)));
 		if (conditions.length > 0) {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(conditions);
 			if (finalCondition) query = query.where(finalCondition);
@@ -4505,7 +4821,15 @@ var FetchService = class FetchService {
 		});
 	}
 	/**
-	* Check if a field value is unique
+	* Check if a field value is unique.
+	*
+	* Deliberately **not** narrowed by `beforeQuery`, and it is the only read
+	* here that is not. The question is whether the value exists anywhere in
+	* the table, not whether it exists among the rows this caller can see:
+	* narrowed, it would answer "unique" for a value a hidden row already
+	* holds, and the insert would then be rejected by the unique constraint
+	* with a message about a row the caller has no way to find. Uniqueness is a
+	* property of the table.
 	*/
 	async checkUniqueField(collectionPath, fieldName, value, excludeEntityId, _databaseId) {
 		if (value === void 0 || value === null) return true;
@@ -4583,7 +4907,9 @@ var FetchService = class FetchService {
 		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
 		const withDeleted = options?.withDeleted;
 		const projection = this.columnProjection(table, collection, options?.fields, idInfoArray);
-		const result = await this.db.select(projection).from(table).where(andSoftDelete(eq(idField, parsedId), collection, table, withDeleted)).limit(1);
+		const narrowing = await this.narrowReadCondition(collectionPath, collection, table, "get", FetchService.describeRead({ fields: options?.fields }));
+		const identity = narrowing ? and(eq(idField, parsedId), narrowing) : eq(idField, parsedId);
+		const result = await this.db.select(projection).from(table).where(andSoftDelete(identity, collection, table, withDeleted)).limit(1);
 		if (result.length === 0) return null;
 		const row = toRestRow(result[0], collection, this.registry);
 		const normalizedInclude = normalizeInclude(include);
@@ -4634,6 +4960,7 @@ var FetchService = class FetchService {
 			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
 			if (logicalCondition) allConditions.push(logicalCondition);
 		}
+		allConditions.push(...await this.narrowRead(collectionPath, collection, table, "list", FetchService.describeRead(options)));
 		if (vectorMeta?.filter) allConditions.push(vectorMeta.filter);
 		if (allConditions.length > 0) {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
@@ -4738,11 +5065,13 @@ function serializePivot(pivot, payload, label) {
 var RelationWriteService = class {
 	db;
 	registry;
+	callContext;
 	reads;
-	constructor(db, registry) {
+	constructor(db, registry, callContext) {
 		this.db = db;
 		this.registry = registry;
-		this.reads = new RelationService(db, registry);
+		this.callContext = callContext;
+		this.reads = new RelationService(db, registry, callContext);
 	}
 	/**
 	* Remove the junction row linking a parent to `targetId`, leaving the target
@@ -5109,17 +5438,19 @@ function compileFieldOps(table, fieldOps, context) {
 var PersistService = class {
 	db;
 	registry;
+	callContext;
 	/** Reads: whether a row is under a parent, the key a link joins on. */
 	relationService;
 	/** Writes: junction membership, foreign-key stamping, links. */
 	relationWrites;
 	fetchService;
-	constructor(db, registry) {
+	constructor(db, registry, callContext) {
 		this.db = db;
 		this.registry = registry;
-		this.relationService = new RelationService(db, registry);
-		this.relationWrites = new RelationWriteService(db, registry);
-		this.fetchService = new FetchService(db, registry);
+		this.callContext = callContext;
+		this.relationService = new RelationService(db, registry, callContext);
+		this.relationWrites = new RelationWriteService(db, registry, callContext);
+		this.fetchService = new FetchService(db, registry, callContext);
 	}
 	/**
 	* Set the columns of one many-to-many link, without touching the membership.
@@ -5413,13 +5744,15 @@ var PersistService = class {
 var DataService = class {
 	db;
 	registry;
+	callContext;
 	fetchService;
 	persistService;
-	constructor(db, registry) {
+	constructor(db, registry, callContext) {
 		this.db = db;
 		this.registry = registry;
-		this.fetchService = new FetchService(db, registry);
-		this.persistService = new PersistService(db, registry);
+		this.callContext = callContext;
+		this.fetchService = new FetchService(db, registry, callContext);
+		this.persistService = new PersistService(db, registry, callContext);
 	}
 	/**
 	* Fetch a single row by ID
@@ -6173,7 +6506,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		this.db = db;
 		this.registry = registry;
 		this.poolManager = poolManager;
-		this.dataService = new DataService(db, registry);
+		this.dataService = new DataService(db, registry, () => this.buildCallContext());
 		this.realtimeService = realtimeService;
 		this.historyService = historyService;
 		this.user = user;
@@ -6803,7 +7136,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	*/
 	bindToTransaction(tx) {
 		const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-		txDriver.dataService = new DataService(tx, this.registry);
+		txDriver.dataService = new DataService(tx, this.registry, () => txDriver.buildCallContext());
 		txDriver.client = this.client;
 		txDriver._deferNotifications = this._deferNotifications;
 		txDriver._pendingNotifications = this._pendingNotifications;
@@ -6825,7 +7158,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	*/
 	callContextWithin(tx, user) {
 		const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, user, this.poolManager, this.historyService);
-		txDriver.dataService = new DataService(tx, this.registry);
+		txDriver.dataService = new DataService(tx, this.registry, () => txDriver.buildCallContext());
 		txDriver.client = this.client;
 		return txDriver.buildCallContext();
 	}
@@ -7411,7 +7744,8 @@ var AuthenticatedPostgresBackendDriver = class {
 			if (!this.user?.uid) logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
 			if (!this.user?.roles) logger.warn("[DataDriver] User roles are missing for authenticated delegate. Using empty array. User object", { detail: this.user });
 			await applyAuthContext(tx, authContextOf(this.user), this.delegate.rlsUserRole);
-			const txEntityService = new DataService(tx, this.delegate.registry);
+			let hookContext;
+			const txEntityService = new DataService(tx, this.delegate.registry, () => hookContext ??= this.delegate.callContextWithin(tx, this.user));
 			const txDelegate = new PostgresBackendDriver(tx, this.delegate.realtimeService, this.delegate.registry, this.user, this.delegate.poolManager, this.delegate.historyService);
 			txDelegate.dataService = txEntityService;
 			txDelegate._deferNotifications = true;
@@ -9566,7 +9900,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					isAnonymous: activeAuth.isAnonymous === true,
 					claims: activeAuth.claims
 				}, this.rlsUserRole);
-				const fetchedEntities = await new DataService(tx, this.registry).fetchCollectionForRest(notifyPath, {
+				let hookContext;
+				const fetchedEntities = await new DataService(tx, this.registry, () => hookContext ??= callbackContextWithin(this.driver, tx, activeAuth)).fetchCollectionForRest(notifyPath, {
 					filter: collectionRequest.filter,
 					logical: collectionRequest.logical,
 					orderBy: collectionRequest.orderBy,
@@ -9665,7 +10000,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 						isAnonymous: activeAuth.isAnonymous === true,
 						claims: activeAuth.claims
 					}, this.rlsUserRole);
-					return countOnce(new DataService(tx, this.registry));
+					let hookContext;
+					return countOnce(new DataService(tx, this.registry, () => hookContext ??= callbackContextWithin(this.driver, tx, activeAuth)));
 				});
 			} else total = await countOnce(this.dataService);
 		} catch (error) {
@@ -9744,7 +10080,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					isAnonymous: activeAuth.isAnonymous === true,
 					claims: activeAuth.claims
 				}, this.rlsUserRole);
-				let processedEntity = await new DataService(tx, this.registry).fetchOneForRest(notifyPath, id, void 0, collection?.databaseId) ?? void 0;
+				let hookContext;
+				let processedEntity = await new DataService(tx, this.registry, () => hookContext ??= callbackContextWithin(this.driver, tx, activeAuth)).fetchOneForRest(notifyPath, id, void 0, collection?.databaseId) ?? void 0;
 				if (processedEntity) {
 					const registryCollection = this.registry.getCollectionByPath(notifyPath);
 					const resolvedCollection = collection ? {
@@ -11592,7 +11929,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-BNLwvxuy.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-CaMOS76G.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -14745,7 +15082,7 @@ function createPostgresBootstrapper(pgConfig) {
 	* handful of `CREATE OR REPLACE FUNCTION`.
 	*/
 	const provisionRlsRuntime = async (queryable) => {
-		const { RLS_BOOTSTRAP_STATEMENTS } = await import("./rls-bootstrap-sql-BHA6jLtj.js").then((n) => n.i);
+		const { RLS_BOOTSTRAP_STATEMENTS } = await import("./rls-bootstrap-sql-H3rCFi3F.js").then((n) => n.i);
 		await queryable.query("SELECT pg_advisory_lock(hashtext('rebase_auth_functions_init'))");
 		try {
 			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await queryable.query(statement);
@@ -15139,7 +15476,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-Cr2ye5JC.js").then((n) => n.n);
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-CpAgy51F.js").then((n) => n.n);
 			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(describeEnsureFailure(failure));
 			return { applied: plan.actions.length - plan.failures.length };
@@ -15173,7 +15510,7 @@ function createPostgresBootstrapper(pgConfig) {
 			await provisionRlsRuntime(provisioningQueryable(driverResult));
 		},
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-B4IDFtQ-.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-Dzd-2S81.js");
 			const queryable = provisioningQueryable(driverResult);
 			const { rows } = await queryable.query("SELECT to_regprocedure('rebase.roles()') IS NOT NULL AS present");
 			if (!rows[0]?.present) await provisionRlsRuntime(queryable);
@@ -15184,7 +15521,7 @@ function createPostgresBootstrapper(pgConfig) {
 			for (const u of outcome.unsecured.filter((u) => u.grantWithdrawn)) logger.error(`🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. Its privileges have been revoked from ${REBASE_USER_ROLE}, so the table is unreachable rather than unprotected. Reads and writes to that collection will fail until RLS can be enabled.`);
 			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
-				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-BHA6jLtj.js").then((n) => n.i);
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-H3rCFi3F.js").then((n) => n.i);
 				await dropLegacyAuthSchema(async (text) => (await queryable.query(text)).rows, {
 					info: (m) => logger.info(m),
 					warn: (m) => logger.warn(m)