@rebasepro/server-postgres 0.0.1-canary.fc811d7 → 0.9.1-canary.0de22e0

package/dist/services/realtimeService.d.ts

@@ -4,12 +4,13 @@ import { DataDriver, WebSocketMessage } from "@rebasepro/types";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { RealtimeProvider, CollectionSubscriptionConfig, SingleSubscriptionConfig } from "../interfaces";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
+import type { ChannelRetentionRule } from "@rebasepro/types";
 /**
  * Auth context stored per-subscription so real-time refetches respect RLS.
  * Mirrors the session variables set by PostgresBackendDriver.withAuth().
  */
 export interface SubscriptionAuthContext {
-    userId: string;
+    uid: string;
     roles: string[];
 }
 /**
@@ -24,6 +25,26 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
     private clients;
     private channels;
     private presence;
+    /**
+     * Ordered, replayable history for channels that opt into it.
+     *
+     * Undefined until {@link configureChannelHistory} is called, and inert even
+     * then unless retention rules were supplied — so presence and ephemeral
+     * notification channels never touch it. See `channel-history.ts`.
+     */
+    private channelHistory?;
+    /**
+     * One promise chain per retained channel, so that assigning a sequence
+     * number and fanning the message out happen in the same order for every
+     * message on that channel.
+     *
+     * Without it, two concurrent broadcasts can be numbered 4 and 5 by the
+     * database and still reach subscribers as 5 then 4 — live order and replay
+     * order would disagree, which is exactly the divergence sequence numbers
+     * are supposed to rule out. Keyed by channel, so unrelated channels never
+     * wait on each other.
+     */
+    private channelSendQueues;
     private presenceInterval?;
     private static readonly PRESENCE_TIMEOUT_MS;
     private dataService;
@@ -177,8 +198,15 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
     /**
      * Send a lightweight row-level patch to a collection subscriber.
      * The client can merge this into its cached data for instant feedback.
+     *
+     * The key columns ride along: the patch names a row by address, and the
+     * client has to find that row among the ones it cached — which carry
+     * columns and no address. The SDK holds no collection config to derive one
+     * from, so this is the only place the mapping can come from.
      */
     private sendCollectionPatch;
+    /** The key columns of the collection at `path`, if they can be resolved. */
+    private primaryKeysForPath;
     private sendError;
     private sendMessage;
     /**
@@ -190,8 +218,54 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
     joinChannel(clientId: string, channel: string): void;
     /** Leave a broadcast channel */
     leaveChannel(clientId: string, channel: string): void;
-    /** Broadcast a message to all clients in a channel except sender */
+    /**
+     * Broadcast a message to all clients in a channel except the sender.
+     *
+     * On a channel with no retention rule this is what it always was: a
+     * synchronous fan-out to whoever is connected, with no sequence number, no
+     * SQL and no await — the body below runs to completion before returning.
+     *
+     * On a retained channel the message is durably numbered first and only then
+     * delivered, through a per-channel queue so that delivery order matches
+     * sequence order. That ordering is the whole point: a client that catches up
+     * with `sinceSeq` has to arrive at the same state as one that never
+     * disconnected.
+     */
     broadcastToChannel(clientId: string, channel: string, event: string, payload: unknown): void;
+    /**
+     * Number a broadcast, store it, then deliver it.
+     *
+     * A message that cannot be stored is **not** delivered. Delivering it would
+     * put it in front of live subscribers while leaving it absent from every
+     * future replay — the two views of the channel would disagree permanently,
+     * and no later message could repair the gap. Failing loudly to the sender
+     * instead lets it retry, which for an operation stream is the only outcome
+     * that keeps clients convergent.
+     */
+    private persistAndFanOut;
+    /** Deliver a broadcast frame to every member of a channel but the sender. */
+    private fanOutBroadcast;
+    /**
+     * Install retention rules and create the tables they need.
+     *
+     * Safe to call with no rules (and safe not to call at all): the store stays
+     * inert, no schema is created, and broadcast keeps its original
+     * fire-and-forget path.
+     */
+    configureChannelHistory(rules: ChannelRetentionRule[] | undefined): Promise<void>;
+    /** Whether any channel is configured to retain messages. */
+    isChannelHistoryEnabled(): boolean;
+    /**
+     * Answer a client's catch-up request.
+     *
+     * A channel with no retention rule is answered with `retained: false`
+     * rather than an empty list, so the client can tell "you missed nothing"
+     * apart from "this channel never keeps anything" — the second means its
+     * reconnect strategy has to be a full resync, and silence would leave it
+     * guessing.
+     */
+    private handleChannelHistoryRequest;
+    private sendChannelHistory;
     /** Track presence in a channel */
     trackPresence(clientId: string, channel: string, state: Record<string, unknown>): void;
     /** Remove presence from a channel */

package/dist/services/row-pipeline.d.ts

@@ -0,0 +1,63 @@
+import { CollectionConfig, Relation } from "@rebasepro/types";
+import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
+/**
+ * Turning a drizzle result into a row we serve.
+ *
+ * There are two shapes, and they are the same walk. Both take a row whose
+ * relation fields hold nested objects, both unwrap junction rows to reach the
+ * target behind them, and both leave every other column alone. They differ only
+ * in what they put where the relation was:
+ *
+ * - `"ref"` — a `{ id, path, __type: "relation" }` reference carrying the
+ *   target's values. This is what the admin renders.
+ * - `"inline"` — the target's own columns, flat. This is what REST serves.
+ *
+ * They used to be two functions that happened to agree, and the agreement was
+ * not enforced by anything: the row-identity bug had to be fixed five times
+ * across differently-shaped copies of this walk, and one of the copies was
+ * dead code nobody had noticed. Whatever the next cross-cutting change is, it
+ * is one edit here.
+ */
+export type RelationStyle = "ref" | "inline";
+/**
+ * Whether a many-relation reaches its target through a junction table.
+ *
+ * Also used to build the drizzle `with` config, which is why it is exported:
+ * the query has to nest one level deeper for a junction, and the row walk has
+ * to unwrap that same level back out.
+ */
+export declare function isJunctionRelation(relation: Relation): boolean;
+/**
+ * The address a relation ref points at.
+ *
+ * The whole key, not its first column: a composite-keyed target addressed by
+ * `tenant_id` alone points at every row that shares it. A target whose key
+ * cannot be resolved at all used to throw here — reading `[0]` of an empty
+ * array — taking down the parent's fetch over a relation it may not even have
+ * asked for. The first column is a guess, but a ref that resolves to nothing
+ * beats no rows at all.
+ */
+export declare function relationTargetAddress(targetRow: Record<string, unknown>, targetCollection: CollectionConfig, registry: PostgresCollectionRegistry): string;
+/**
+ * The row the admin renders: every column, with relations as references.
+ *
+ * Values are normalized (dates, numbers, NaN) because the admin's view-model
+ * expects real types. The row's own address is *not* among the columns — it is
+ * derived by the consumer from the collection's primary keys.
+ */
+export declare function toCmsRow(row: Record<string, unknown>, collection: CollectionConfig, registry: PostgresCollectionRegistry): Record<string, unknown>;
+/**
+ * The row REST serves: every column under its own name, with the value Postgres
+ * returned, and relations inlined as the target's columns.
+ *
+ * Values are the ones the database returned, except where that contradicts the
+ * declared type: a `number` property is served as a number (see
+ * {@link coerceDeclaredNumber}). Dates stay as the database returned them —
+ * JSON has its own opinions about dates that the admin's view-model does not
+ * share.
+ *
+ * Keyed by the row rather than by the relation list — a REST fetch only loads
+ * the relations `include` asked for, so the row is the authority on which are
+ * actually there.
+ */
+export declare function toRestRow(row: Record<string, unknown>, collection: CollectionConfig, registry: PostgresCollectionRegistry): Record<string, unknown>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.0.1-canary.fc811d7",
+  "version": "0.9.1-canary.0de22e0",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -13,7 +13,7 @@
     "url": "https://github.com/rebasepro/rebase.git",
     "directory": "packages/server-postgres"
   },
-  "main": "./dist/index.umd.js",
+  "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
   "types": "./dist/index.d.ts",
   "source": "src/index.ts",
@@ -29,39 +29,11 @@
     "backend",
     "rebase"
   ],
-  "jest": {
-    "transform": {
-      "^.+\\.tsx?$": "ts-jest"
-    },
-    "testRegex": "(/__tests__/.*|(\\.|/)(test|spec))\\.tsx?$",
-    "testPathIgnorePatterns": [
-      "/node_modules/",
-      "test/e2e/"
-    ],
-    "moduleFileExtensions": [
-      "ts",
-      "tsx",
-      "js",
-      "jsx",
-      "json",
-      "node"
-    ],
-    "moduleNameMapper": {
-      "^chalk$": "<rootDir>/test/mocks/chalk.cjs",
-      "^@rebasepro/client$": "<rootDir>/../client/src/index.ts",
-      "^@rebasepro/common$": "<rootDir>/../common/src/index.ts",
-      "^@rebasepro/types$": "<rootDir>/../types/src/index.ts",
-      "^@rebasepro/utils$": "<rootDir>/../utils/src/index.ts",
-      "^@rebasepro/server$": "<rootDir>/../server/src/index.ts",
-      "^(\\.{1,2}/.*)\\.js$": "$1"
-    }
-  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "development": "./dist/index.es.js",
-      "import": "./dist/index.es.js",
-      "require": "./dist/index.umd.js"
+      "import": "./dist/index.es.js"
     },
     "./package.json": "./package.json"
   },
@@ -73,21 +45,23 @@
     "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
     "execa": "^9.6.1",
-    "hono": "^4.12.25",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/common": "0.0.1-canary.fc811d7",
-    "@rebasepro/server": "0.0.1-canary.fc811d7",
-    "@rebasepro/codegen": "0.0.1-canary.fc811d7",
-    "@rebasepro/types": "0.0.1-canary.fc811d7",
-    "@rebasepro/utils": "0.0.1-canary.fc811d7"
+    "@rebasepro/codegen": "0.9.1-canary.0de22e0",
+    "@rebasepro/server": "0.9.1-canary.0de22e0",
+    "@rebasepro/common": "0.9.1-canary.0de22e0",
+    "@rebasepro/utils": "0.9.1-canary.0de22e0",
+    "@rebasepro/types": "0.9.1-canary.0de22e0"
   },
   "devDependencies": {
+    "@hono/node-server": "^2.0.9",
+    "@jest/globals": "^30.4.1",
     "@types/jest": "^30.0.0",
     "@types/node": "^25.9.3",
     "@types/pg": "^8.20.0",
     "@types/ws": "^8.18.1",
     "@vitejs/plugin-react": "^6.0.2",
+    "hono": "^4.12.25",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11",
     "typescript": "^6.0.3",
@@ -104,10 +78,11 @@
   ],
   "scripts": {
     "watch": "vite build --watch",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../scripts/assert-build-output.mjs",
     "test:lint": "eslint \"src/**\" --quiet",
-    "test": "jest --passWithNoTests",
+    "test": "jest",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"
+    "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f",
+    "smoke:baas": "tsx scripts/smoke-baas.ts"
   }
 }

package/src/PostgresBackendDriver.ts

@@ -17,6 +17,7 @@ import {
     RebaseData,
     RebaseSdkData,
     RestFetchService,
+    SaveManyProps,
     SaveProps,
     TableColumnInfo,
     TableForeignKeyInfo,
@@ -28,6 +29,7 @@ import {
 import { sql as drizzleSql } from "drizzle-orm";
 import { buildPropertyCallbacks, buildSdkData, resolveCollectionRelations, updateDateAutoValues } from "@rebasepro/common";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
+import { deriveRowAddress } from "./services/collection-helpers";
 import { HistoryService } from "./history/HistoryService";
 import { mergeDeep } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
@@ -109,6 +111,7 @@ export class PostgresBackendDriver implements DataDriver {
             executeSql: (...args: Parameters<NonNullable<DatabaseAdmin["executeSql"]>>) => this.executeSql(...args),
             fetchAvailableDatabases: () => this.fetchAvailableDatabases(),
             fetchAvailableRoles: () => this.fetchAvailableRoles(),
+            fetchApplicationRoles: () => this.fetchApplicationRoles(),
             fetchCurrentDatabase: () => this.fetchCurrentDatabase(),
             fetchUnmappedTables: (...args: Parameters<NonNullable<DatabaseAdmin["fetchUnmappedTables"]>>) => this.fetchUnmappedTables(...args),
             fetchTableMetadata: (...args: Parameters<NonNullable<DatabaseAdmin["fetchTableMetadata"]>>) => this.fetchTableMetadata(...args),
@@ -532,7 +535,8 @@ export class PostgresBackendDriver implements DataDriver {
                                                             id,
                                                             values,
                                                             collection,
-                                                            status
+                                                            status,
+                                                            upsert
                                                         }: SaveProps<M>): Promise<Record<string, unknown>> {
 
         const {
@@ -545,13 +549,26 @@ export class PostgresBackendDriver implements DataDriver {
         let updatedValues = values;
         const contextForCallback = this.buildCallContext();
 
-        // Fetch previous values for callbacks AND history recording
+        // Fetch previous values for callbacks AND history recording. Same walk
+        // as the saved row the callbacks receive (`fetchOneForRest`), so
+        // `values` and `previousValues` compare like with like — a Date on one
+        // side and its ISO string on the other reads as a change that never
+        // happened.
         let previousValuesForHistory: Partial<M> | undefined;
         if (status === "existing" && id) {
-            const existing = await this.dataService.fetchOne<M>(path, id, resolvedCollection?.databaseId);
-            if (existing) {
-                const { id: _existingId, ...existingValues } = existing;
-                previousValuesForHistory = existingValues as Partial<M>;
+            try {
+                const existing = await this.dataService.getFetchService()
+                    .fetchOneForRest(path, id, undefined, resolvedCollection?.databaseId);
+                if (existing) {
+                    const { id: _existingId, ...existingValues } = existing;
+                    previousValuesForHistory = existingValues as Partial<M>;
+                }
+            } catch (err) {
+                // Best-effort enrichment: callbacks and history run without
+                // previous values rather than the save failing on a read the
+                // write itself does not need (e.g. a collection whose key the
+                // registry cannot resolve).
+                logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
             }
         }
 
@@ -616,7 +633,8 @@ export class PostgresBackendDriver implements DataDriver {
                 path,
                 updatedValues,
                 id,
-                resolvedCollection?.databaseId
+                resolvedCollection?.databaseId,
+                { upsert }
             );
 
             if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
@@ -649,8 +667,19 @@ export class PostgresBackendDriver implements DataDriver {
                 }
             }
 
-            const savedId = savedRow.id as string | number;
-            const { id: _savedId, ...savedValues } = savedRow;
+            // The row is exactly its columns, so its address is derived, not read
+            // off it: `savedRow.id` is undefined for every table whose key is not
+            // literally named `id`, and is ordinary data for a table that has such
+            // a column without it being the key.
+            const savedId = deriveRowAddress(
+                savedRow,
+                (resolvedCollection ?? collection) as CollectionConfig,
+                this.registry
+            );
+            // `values` are the row's columns — all of them. For an `id`-keyed table
+            // that includes `id`, which used to be stripped here because it was the
+            // synthesized address rather than the column it now is.
+            const savedValues = savedRow;
 
             if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
                 // 1. Global callbacks first
@@ -695,7 +724,7 @@ export class PostgresBackendDriver implements DataDriver {
             if (this.historyService && resolvedCollection?.history) {
                 this.historyService.recordHistory({
                     tableName: path,
-                    id: savedId.toString(),
+                    id: savedId,
                     action: status === "new" ? "create" : "update",
                     values: savedValues as Record<string, unknown>,
                     previousValues: previousValuesForHistory as Record<string, unknown> | undefined,
@@ -707,14 +736,14 @@ export class PostgresBackendDriver implements DataDriver {
             if (this._deferNotifications) {
                 this._pendingNotifications.push({
                     path,
-                    id: savedId.toString(),
+                    id: savedId,
                     row: savedRow,
                     databaseId: resolvedCollection?.databaseId
                 });
             } else {
                 await this.realtimeService.notifyUpdate(
                     path,
-                    savedId.toString(),
+                    savedId,
                     savedRow,
                     resolvedCollection?.databaseId
                 );
@@ -764,13 +793,86 @@ export class PostgresBackendDriver implements DataDriver {
         }
     }
 
+    /**
+     * Write many rows through the same pipeline as {@link save}.
+     *
+     * The batch runs in one transaction of its own, so a failure part-way leaves
+     * nothing behind — the point of a batch is that a re-run starts from a known
+     * state. When this driver is already inside a transaction (the authenticated
+     * path, via `withTransaction`) the nested call becomes a savepoint, which is
+     * still atomic and still commits once.
+     *
+     * Rows are applied in order, so a batch that touches the same key twice ends
+     * with the last write winning, exactly as separate calls would.
+     */
+    async saveMany<M extends Record<string, unknown>>({
+                                                          path,
+                                                          rows,
+                                                          collection,
+                                                          upsert
+                                                      }: SaveManyProps<M>): Promise<Record<string, unknown>[]> {
+        return this.db.transaction(async (tx) => {
+            // Bind the whole batch to the transaction handle. Without this the
+            // rows would be written through `this.db` and survive a rollback.
+            const txDriver = new PostgresBackendDriver(
+                tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService
+            );
+            txDriver.dataService = new DataService(tx, this.registry);
+            txDriver.client = this.client;
+            // Carry the caller's notification batching through, so a bulk write
+            // nested in an outer transaction still holds its events until commit.
+            txDriver._deferNotifications = this._deferNotifications;
+            txDriver._pendingNotifications = this._pendingNotifications;
+
+            const saved: Record<string, unknown>[] = [];
+
+            for (let i = 0; i < rows.length; i++) {
+                const values = rows[i];
+                const id = (values as Record<string, unknown>)?.id as string | number | undefined;
+                try {
+                    saved.push(await txDriver.save<M>({
+                        path,
+                        values,
+                        // No `id` argument, deliberately: passing one selects the
+                        // UPDATE path, and an import's rows usually carry a natural
+                        // key for a row that does not exist yet — which would 404 on
+                        // every one. Leaving the key inside `values` is what
+                        // single-row `create(data, id)` does, and it inserts.
+                        // Callers who want existing rows overwritten pass `upsert`.
+                        collection,
+                        status: "new",
+                        upsert
+                    }));
+                } catch (error) {
+                    // One bad row in ten thousand is impossible to find from a
+                    // message that only says the batch failed. Say which row, and
+                    // keep the original error as the cause so its status survives.
+                    const label = id !== undefined ? `id ${JSON.stringify(id)}` : "no id";
+                    throw Object.assign(
+                        new Error(`Row ${i} of ${rows.length} (${label}) failed: ${(error as Error)?.message ?? error}`, { cause: error }),
+                        {
+                            statusCode: (error as { statusCode?: number })?.statusCode,
+                            code: (error as { code?: string })?.code,
+                            name: (error as Error)?.name
+                        }
+                    );
+                }
+            }
+
+            return saved;
+        });
+    }
+
     async delete<M extends Record<string, unknown>>({
                                                               row,
                                                               collection
                                                           }: DeleteProps<M>): Promise<void> {
 
         const targetPath = row.path;
-        const targetRow: Record<string, unknown> = { id: row.id, ...(row.values ?? {}) };
+        // The callbacks' `row` is the row: its columns, nothing else. The address
+        // travels beside it as `id`, so merging it in here only ever invented an
+        // `id` field for tables that have no such column.
+        const targetRow: Record<string, unknown> = { ...(row.values ?? {}) };
 
         // Resolve from backend registry to restore callbacks lost during WebSocket serialization
         const {
@@ -1070,6 +1172,56 @@ export class PostgresBackendDriver implements DataDriver {
         return result.map((r: Record<string, unknown>) => r.rolname as string);
     }
 
+    /**
+     * Application-level roles actually in use in this project.
+     *
+     * Distinct from {@link fetchAvailableRoles}, which returns native
+     * PostgreSQL roles from `pg_roles` (`postgres`, `rebase_user`, …). Those
+     * are the roles the SQL editor can `SET ROLE` to. *These* are the strings
+     * held in the users table's `roles` column, injected per-transaction as
+     * `auth.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
+     * into a `SecurityRule.roles` field produces a condition no user can ever
+     * satisfy, so the two must not be conflated.
+     *
+     * Roles have no registry table — they were migrated out of
+     * `rebase.user_roles` onto an inline `roles TEXT[]` column — so the live
+     * set is derived from what is assigned. A role that is declared in a policy
+     * but held by nobody yet cannot be discovered here; callers that need it
+     * should union in the roles they already know about.
+     */
+    async fetchApplicationRoles(): Promise<string[]> {
+        // The users table lives in `rebase` for a default (public) setup, but
+        // follows the configured schema otherwise — locate it rather than
+        // assuming. The `roles` ARRAY column is what makes it the auth table.
+        const located = await this.executeSql(`
+            SELECT table_schema, table_name
+            FROM information_schema.columns
+            WHERE column_name = 'roles'
+              AND data_type = 'ARRAY'
+              AND table_name = 'users'
+              AND table_schema NOT IN ('information_schema', 'pg_catalog')
+            ORDER BY (table_schema = 'rebase') DESC, table_schema
+            LIMIT 1;
+        `);
+        if (located.length === 0) return [];
+
+        const schema = located[0].table_schema as string;
+        const table = located[0].table_name as string;
+        // Identifiers come from information_schema, not user input, but they
+        // are still interpolated — quote them so odd-but-legal names survive.
+        const qualified = `"${schema.replace(/"/g, "\"\"")}"."${table.replace(/"/g, "\"\"")}"`;
+
+        const rows = await this.executeSql(`
+            SELECT DISTINCT unnest(roles) AS role
+            FROM ${qualified}
+            WHERE roles IS NOT NULL
+            ORDER BY role;
+        `);
+        return rows
+            .map((r) => r.role as string)
+            .filter((r): r is string => typeof r === "string" && r.length > 0);
+    }
+
     async fetchCurrentDatabase(): Promise<string | undefined> {
         return this.poolManager?.defaultDatabaseName;
     }
@@ -1273,10 +1425,10 @@ export class AuthenticatedPostgresBackendDriver implements DataDriver {
         const pendingNotifications: PostgresBackendDriver["_pendingNotifications"] = [];
 
         const result = await this.delegate.db.transaction(async (tx) => {
-            let userId = this.user?.uid;
-            if (!userId) {
+            let uid = this.user?.uid;
+            if (!uid) {
                 logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
-                userId = "anonymous";
+                uid = "anonymous";
             }
 
             const userRoles = this.user?.roles ?? [];
@@ -1295,7 +1447,7 @@ export class AuthenticatedPostgresBackendDriver implements DataDriver {
             //
             // Fails closed: if the switch cannot be performed, the transaction
             // aborts rather than falling back to an RLS-bypassing connection.
-            await applyAuthContext(tx, { userId, roles: userRoles }, this.delegate.rlsUserRole);
+            await applyAuthContext(tx, { uid, roles: userRoles }, this.delegate.rlsUserRole);
 
             const txEntityService = new DataService(tx, this.delegate.registry);
             const txDelegate = new PostgresBackendDriver(tx, this.delegate.realtimeService, this.delegate.registry, this.user, this.delegate.poolManager, this.delegate.historyService);
@@ -1334,7 +1486,7 @@ export class AuthenticatedPostgresBackendDriver implements DataDriver {
      */
     private injectAuthContext(unsubscribe: () => void): () => void {
         const authContext = {
-            userId: this.user?.uid || "anonymous",
+            uid: this.user?.uid || "anonymous",
             roles: this.user?.roles ?? []
         };
         const entries = Array.from(this.delegate.realtimeService.subscriptions.entries());
@@ -1362,6 +1514,19 @@ export class AuthenticatedPostgresBackendDriver implements DataDriver {
         return this.withTransaction((delegate) => delegate.save(props));
     }
 
+    /**
+     * One transaction for the whole batch, rather than one per row.
+     *
+     * This is the point of the method: `save` opens a transaction per call, so
+     * importing 10k rows through it means 10k transactions (and, over HTTP, 10k
+     * round trips). Here the RLS context is established once and every row lands
+     * or none does. Realtime notifications are already deferred to commit by
+     * `withTransaction`, so a batch does not flood subscribers mid-flight.
+     */
+    async saveMany<M extends Record<string, unknown>>(props: SaveManyProps<M>): Promise<Record<string, unknown>[]> {
+        return this.withTransaction((delegate) => delegate.saveMany(props));
+    }
+
     async delete<M extends Record<string, unknown>>(props: DeleteProps<M>): Promise<void> {
         return this.withTransaction((delegate) => delegate.delete(props));
     }