@rebasepro/server-postgres 0.10.1-canary.8d27c46 → 0.10.1-canary.af2af91

package/dist/index.es.js

@@ -3,7 +3,7 @@ import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./chunk-DSJWtz9O.js";
 import { a as isSchemaAdmin, i as isSQLAdmin, l as isPostgresCollectionConfig, m as Vector, n as getDataSourceCapabilities, o as ANONYMOUS_USER_ID, r as isChannelBusInstance } from "./src-CBgtrPhJ.js";
-import { C as createRelationRefWithData, D as mergeDeep, E as getPolicyNamesForRule, O as camelCase, S as createRelationRef, T as updateDateAutoValues, _ as getTableVarName, a as getJunctionCollectionConfig, b as getDeclaredPrimaryKeys, c as getEffectiveSecurityRules, d as securityRuleToConditions, f as findAnonymousGrants, g as getTableName$1, h as getEnumVarName, i as CollectionRegistry, k as toSnakeCase, l as buildPropertyCallbacks, m as getColumnName, n as detectJunctionTables, o as getJunctionSecurityRules, p as findRelation, r as buildSdkData, s as resolveJunctionSpecs, t as classifyTable, u as policyToPostgres, v as resolveCollectionRelations, w as normalizeToEntityRelation, x as parseIdValues, y as buildCompositeId } from "./src-DG6ZsQQ3.js";
+import { C as createRelationRefWithData, D as mergeDeep, E as getPolicyNamesForRule, O as camelCase, S as createRelationRef, T as updateDateAutoValues, _ as getTableVarName, a as getJunctionCollectionConfig, b as getDeclaredPrimaryKeys, c as getEffectiveSecurityRules, d as securityRuleToConditions, f as findAnonymousGrants, g as getTableName$1, h as getEnumVarName, i as CollectionRegistry, k as toSnakeCase, l as buildPropertyCallbacks, m as getColumnName, n as detectJunctionTables, o as getJunctionSecurityRules, p as findRelation, r as buildSdkData, s as resolveJunctionSpecs, t as classifyTable, u as policyToPostgres, v as resolveCollectionRelations, w as normalizeToEntityRelation, x as parseIdValues, y as buildCompositeId } from "./src-lcfUP4xg.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
@@ -392,6 +392,89 @@ function unwrapRelationFilterValue(value) {
 * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;
 */
 var DrizzleConditionBuilder = class {
+	/**
+	* Express "reachable from this parent through this relation" as a plain
+	* `WHERE` condition on the target table.
+	*
+	* This is the primitive that lets a relation be a *filter* rather than an
+	* addressing scheme. A nested listing used to be served by its own query
+	* builder — `fetchEntitiesUsingJoins`, which grew joins the root pipeline
+	* did not have and lost the options the root pipeline did have (offset,
+	* filter, orderBy, include). Reduced to a condition, the same listing runs
+	* through the ordinary collection query, so it inherits all of them and
+	* there is one read path instead of two.
+	*
+	* The shapes:
+	*   - inverse FK  → `target.<fk> = :parentId`, a column comparison.
+	*   - `through`   → `EXISTS (SELECT 1 FROM junction …)`, correlated on the
+	*                   target's key, so the junction never multiplies rows the
+	*                   way an `INNER JOIN` would.
+	*   - `joinPath`  → the same `EXISTS`, with the path's steps joined inside
+	*                   it and the final step correlating to the outer row.
+	*/
+	static buildRelationScopeCondition(relation, parent, parentId, targetTable, targetIdColumn, registry) {
+		if (relation.joinPath && relation.joinPath.length > 0) {
+			const { table, idColumn } = parent();
+			return this.buildJoinPathScopeCondition(relation.joinPath, table, idColumn, parentId, targetTable, registry);
+		}
+		if (relation.through) {
+			const junctionTable = registry.getTable(relation.through.table);
+			if (!junctionTable) throw new Error(`Junction table not found: ${relation.through.table}`);
+			const sourceCol = junctionTable[relation.through.sourceColumn];
+			const targetCol = junctionTable[relation.through.targetColumn];
+			if (!sourceCol || !targetCol) throw new Error(`Junction columns '${relation.through.sourceColumn}'/'${relation.through.targetColumn}' not found in '${relation.through.table}'`);
+			return sql`EXISTS (SELECT 1 FROM ${junctionTable} WHERE ${targetCol} = ${targetIdColumn} AND ${sourceCol} = ${parentId})`;
+		}
+		if (relation.foreignKeyOnTarget) {
+			const fkColumn = targetTable[relation.foreignKeyOnTarget];
+			if (!fkColumn) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'. A many-to-many relation needs \`through\` instead.`);
+			return eq(fkColumn, parentId);
+		}
+		if (relation.localKey) {
+			const { table, idColumn } = parent();
+			return sql`${targetIdColumn} = (SELECT ${sql.identifier(relation.localKey)} FROM ${table} WHERE ${idColumn} = ${parentId})`;
+		}
+		throw new Error(`Relation '${relation.relationName}' declares no \`foreignKeyOnTarget\`, \`through\`, \`joinPath\` or \`localKey\`, so there is no way to tell which target rows belong to a parent.`);
+	}
+	/**
+	* `EXISTS` for an explicit `joinPath`.
+	*
+	* The path is declared source → target. The subquery replays every step but
+	* the last from inside, and turns the last one into the correlation with the
+	* outer target row — so the target table is never named twice and needs no
+	* alias. Each intermediate table is aliased positionally, which keeps a path
+	* that revisits a table (a self-referencing many-to-many) unambiguous.
+	*/
+	static buildJoinPathScopeCondition(joinPath, parentTable, parentIdColumn, parentId, targetTable, registry) {
+		const sourceAlias = "__rel_src";
+		const aliasFor = (index) => `__rel_j${index}`;
+		const fromRef = (stepIndex, column) => sql`${sql.identifier(stepIndex === 0 ? sourceAlias : aliasFor(stepIndex - 1))}.${sql.identifier(getColumnName(column))}`;
+		const pairs = (step) => {
+			const from = Array.isArray(step.on.from) ? step.on.from : [step.on.from];
+			const to = Array.isArray(step.on.to) ? step.on.to : [step.on.to];
+			if (from.length !== to.length) throw new Error(`Join step on '${step.table}' has ${from.length} \`from\` columns and ${to.length} \`to\` columns`);
+			return from.map((f, i) => ({
+				from: f,
+				to: to[i]
+			}));
+		};
+		const inner = joinPath.slice(0, -1);
+		const last = joinPath[joinPath.length - 1];
+		const joins = inner.map((step, index) => {
+			const table = registry.getTable(step.table);
+			if (!table) throw new Error(`Join table not found: ${step.table}`);
+			const on = pairs(step).map(({ from, to }) => sql`${fromRef(index, from)} = ${sql.identifier(aliasFor(index))}.${sql.identifier(getColumnName(to))}`);
+			return sql`JOIN ${table} AS ${sql.identifier(aliasFor(index))} ON ${sql.join(on, sql` AND `)}`;
+		});
+		const targetColumn = (name) => {
+			const column = targetTable[getColumnName(name)];
+			if (!column) throw new Error(`Join step column '${name}' not found in the target table of this joinPath`);
+			return column;
+		};
+		const correlation = sql.join(pairs(last).map(({ from, to }) => sql`${fromRef(inner.length, from)} = ${targetColumn(to)}`), sql` AND `);
+		const joinsSql = joins.length > 0 ? sql` ${sql.join(joins, sql` `)}` : sql``;
+		return sql`EXISTS (SELECT 1 FROM ${parentTable} AS ${sql.identifier(sourceAlias)}${joinsSql} WHERE ${sql.identifier(sourceAlias)}.${sql.identifier(parentIdColumn.name)} = ${parentId} AND ${correlation})`;
+	}
 	/**
 	* Build filter conditions from FilterValues
 	*/
@@ -1551,6 +1634,18 @@ var RelationService = class {
 			const available = Object.keys(resolvedRelations).join(", ") || "(none)";
 			throw new Error(`Relation '${relationKey}' not found in collection '${parentCollectionPath}'. Available relations: [${available}]`);
 		}
+		return this.countRelatedRows(parentCollection, parentId, relation, []);
+	}
+	/**
+	* Count the target rows a parent reaches through `relation`, narrowed by
+	* `additionalFilters` (conditions on the target table).
+	*
+	* Shared by the public count and by {@link isRelated}, so "how many children
+	* does this parent have" and "is this row one of them" are answered by the
+	* same join — a membership test that reconstructed the join separately would
+	* be free to disagree with the listing it is supposed to gate.
+	*/
+	async countRelatedRows(parentCollection, parentId, relation, additionalFilters) {
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
 		const targetIdField = targetTable[requirePrimaryKeys(targetCollection, this.registry)[0].fieldName];
@@ -1561,11 +1656,54 @@ var RelationService = class {
 		if (!parentTable) throw new Error("Parent table not found");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
 		let query = this.db.select({ count: sql`count(distinct ${targetIdField})` }).from(targetTable).$dynamic();
-		query = DrizzleConditionBuilder.buildRelationCountQuery(query, relation, parsedParentId, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
+		query = DrizzleConditionBuilder.buildRelationCountQuery(query, relation, parsedParentId, targetTable, parentTable, parentIdCol, targetIdField, this.registry, additionalFilters);
 		const result = await query;
 		return Number(result[0]?.count || 0);
 	}
 	/**
+	* Whether `targetId` is actually reachable from the parent named in `hop`.
+	*
+	* A nested address like `authors/1/posts/43` used to resolve to the target
+	* collection and then match on the primary key alone, so the parent segment
+	* decided nothing: the row came back, and was updated or deleted, whoever it
+	* belonged to. Reads, updates and deletes now all gate on this.
+	*/
+	async isRelated(hop, targetId) {
+		const targetTable = getTableForCollection(hop.targetCollection, this.registry);
+		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
+		const parsedTargetId = parseIdValues(targetId, targetPks);
+		const identity = targetPks.map((pk) => {
+			const column = targetTable[pk.fieldName];
+			if (!column) throw new Error(`ID field '${pk.fieldName}' not found in table for collection '${hop.targetCollection.slug}'`);
+			return eq(column, parsedTargetId[pk.fieldName]);
+		});
+		return await this.countRelatedRows(hop.parentCollection, hop.parentId, hop.relation, identity) > 0;
+	}
+	/**
+	* Remove the junction row linking a parent to `targetId`, leaving the target
+	* row itself alone.
+	*
+	* This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
+	* target is shared, so deleting the row would remove the tag from every other
+	* post that uses it. It used to do exactly that — resolve the path to the
+	* `tags` table and delete by primary key.
+	*/
+	async unlinkRelatedEntity(tx, hop, targetId) {
+		const through = hop.relation.through;
+		if (!through) throw new Error(`Relation '${hop.relationKey}' has no junction table to unlink through`);
+		const junctionTable = this.registry.getTable(through.table);
+		if (!junctionTable) throw new Error(`Junction table not found: ${through.table}`);
+		const sourceJunctionColumn = junctionTable[through.sourceColumn];
+		const targetJunctionColumn = junctionTable[through.targetColumn];
+		if (!sourceJunctionColumn || !targetJunctionColumn) throw new Error(`Junction columns not found for relation '${hop.relationKey}' on table '${through.table}'`);
+		const parentPks = requirePrimaryKeys(hop.parentCollection, this.registry);
+		const parsedParentId = parseIdValues(hop.parentId, parentPks)[parentPks[0].fieldName];
+		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
+		const parsedTargetId = parseIdValues(targetId, targetPks)[targetPks[0].fieldName];
+		await tx.delete(junctionTable).where(and(eq(sourceJunctionColumn, parsedParentId), eq(targetJunctionColumn, parsedTargetId)));
+		logger.info(`Unlinked '${hop.relationKey}' ${parsedTargetId} from ${hop.parentCollection.slug} ${parsedParentId}`);
+	}
+	/**
 	* Batch fetch related rows for multiple parent rows to avoid N+1 queries
 	*/
 	async batchFetchRelatedEntities(parentCollectionPath, parentIds, _relationKey, relation) {
@@ -2102,8 +2240,8 @@ var RelationService = class {
 				[sourceJunctionColumn.name]: parentId,
 				[targetJunctionColumn.name]: parsedNewEntityId
 			};
-			await tx.insert(junctionTable).values(junctionData);
-			logger.info(`Created junction table entry for many-to-many relation '${relationKey}': ${JSON.stringify(junctionData)}`);
+			await tx.insert(junctionTable).values(junctionData).onConflictDoNothing();
+			logger.info(`Linked '${relationKey}' ${parsedNewEntityId} to ${parentId}`);
 		} catch (error) {
 			logger.error(`Failed to create junction table entry for relation '${relationKey}'`, { error });
 			throw error;
@@ -2255,6 +2393,79 @@ function toRestRow(row, collection, registry) {
 	return stripExcluded(flat, collection);
 }
 //#endregion
+//#region src/services/nested-path.ts
+/**
+* True when `path` addresses rows through a relation rather than a root
+* collection.
+*
+* Any separator at all counts — a root collection slug never contains one — so
+* a malformed path like `collection/id` is a *broken* nested path and gets
+* reported as one by {@link resolveNestedPath}, rather than being looked up as
+* a root collection whose slug happens to contain a slash.
+*/
+function isNestedPath(path) {
+	return path.includes("/");
+}
+function splitPathSegments(path) {
+	return path.split("/").filter((s) => s && s !== "undefined");
+}
+/**
+* Walk a nested collection path down to the relation it ends in.
+*
+* Returns `undefined` for a plain root-collection path so callers can keep the
+* root case on its existing code path. Throws when the path is malformed, or
+* when a segment names a relation that does not exist — the same errors the
+* individual walks used to raise, with the available names attached.
+*/
+function resolveNestedPath(path, registry) {
+	if (!isNestedPath(path)) return void 0;
+	const segments = splitPathSegments(path);
+	if (segments.length < 3 || segments.length % 2 === 0) throw new Error(`Invalid relation path: ${path}. Expected format: collection/id/relation`);
+	let parentCollection = getCollectionByPath(segments[0], registry);
+	let parentId = segments[1];
+	for (let i = 2; i < segments.length; i += 2) {
+		const relationKey = segments[i];
+		const resolvedRelations = resolveCollectionRelations(parentCollection);
+		const relation = findRelation(resolvedRelations, relationKey);
+		if (!relation) {
+			const available = Object.keys(resolvedRelations).join(", ") || "(none)";
+			throw new Error(`Relation '${relationKey}' not found in collection '${parentCollection.slug}'. Available relations: [${available}]`);
+		}
+		const targetCollection = relation.target();
+		if (i === segments.length - 1) return {
+			parentCollection,
+			parentId,
+			relationKey,
+			relation,
+			targetCollection
+		};
+		parentCollection = targetCollection;
+		parentId = segments[i + 1];
+	}
+	throw new Error(`Unable to resolve path: ${path}`);
+}
+/**
+* A relation reached through a junction table — many-to-many, or a multi-hop
+* `joinPath`. The target row is shared with other parents, so writing "through"
+* such a path addresses the *link*, not the row.
+*/
+function isJunctionBackedRelation(relation) {
+	return Boolean(relation.through) || Boolean(relation.joinPath && relation.joinPath.length > 1);
+}
+/**
+* Reject a nested write whose final segment is a to-one relation.
+*
+* There is no column on the target row that records a to-one parent — the
+* foreign key lives on the *parent* table. The write path used to fall through
+* to `relation.localKey` here and stamp the parent's own FK column onto the
+* target row, which either raised an opaque "column does not exist" or, when a
+* column of that name happened to exist on the target, silently wrote the wrong
+* one.
+*/
+function assertWritableThrough(hop, path) {
+	if (hop.relation.cardinality !== "many") throw ApiError.badRequest(`"${path}" ends in the to-one relation '${hop.relationKey}', which cannot be written through: the foreign key for a to-one relation lives on '${hop.parentCollection.slug}', not on '${hop.targetCollection.slug}'. Write the target row at "${hop.targetCollection.slug}" and set '${hop.relationKey}' on the parent instead.`, "RELATION_NOT_WRITABLE");
+}
+//#endregion
 //#region src/services/FetchService.ts
 /**
 * Service for handling all row read operations.
@@ -2386,10 +2597,11 @@ var FetchService = class {
 	* Build db.query-compatible options from standard fetch options.
 	* Handles filter, search, orderBy, limit, and cursor-based pagination.
 	*/
-	buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig) {
+	buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig, scopeCondition) {
 		const queryOpts = {};
 		if (withConfig) queryOpts.with = withConfig;
 		const allConditions = [];
+		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
 			const collection = getCollectionByPath(collectionPath, this.registry);
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
@@ -2447,9 +2659,49 @@ var FetchService = class {
 		return [];
 	}
 	/**
+	* Compile "rows reachable from this parent" into a `WHERE` condition on the
+	* target table, so a nested listing can run as an ordinary collection query.
+	*/
+	buildRelationScope(hop) {
+		const parentPks = requirePrimaryKeys(hop.parentCollection, this.registry);
+		const parentIdInfo = parentPks[0];
+		const parsedParentId = parseIdValues(hop.parentId, parentPks)[parentIdInfo.fieldName];
+		const parent = () => {
+			const table = getTableForCollection(hop.parentCollection, this.registry);
+			const idColumn = table[parentIdInfo.fieldName];
+			if (!idColumn) throw new Error(`ID field '${parentIdInfo.fieldName}' not found in table for collection '${hop.parentCollection.slug}'`);
+			return {
+				table,
+				idColumn
+			};
+		};
+		const targetTable = getTableForCollection(hop.targetCollection, this.registry);
+		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
+		const targetIdColumn = targetTable[targetPks[0].fieldName];
+		if (!targetIdColumn) throw new Error(`ID field '${targetPks[0].fieldName}' not found in table for collection '${hop.targetCollection.slug}'`);
+		return DrizzleConditionBuilder.buildRelationScopeCondition(hop.relation, parent, parsedParentId, targetTable, targetIdColumn, this.registry);
+	}
+	/**
+	* Whether `id` is actually reachable at `collectionPath`.
+	*
+	* Trivially true for a root path. For a nested one it is a real question:
+	* the path resolves to the target collection, and matching on the primary
+	* key alone made the parent segment decorative — `authors/1/posts/43`
+	* returned post 43 whoever wrote it, and the REST layer's delete then
+	* deleted it. A row that is not under this parent is reported as absent,
+	* which is what a caller addressing it through the parent should see.
+	*/
+	async isAddressableUnder(collectionPath, id) {
+		if (!isNestedPath(collectionPath)) return true;
+		const hop = resolveNestedPath(collectionPath, this.registry);
+		if (!hop) return true;
+		return this.relationService.isRelated(hop, id);
+	}
+	/**
 	* Fetch a single row by ID
 	*/
 	async fetchOne(collectionPath, id, databaseId) {
+		if (!await this.isAddressableUnder(collectionPath, id)) return void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2506,6 +2758,7 @@ var FetchService = class {
 	* Unified method to fetch rows with optional search functionality
 	*/
 	async fetchRowsWithConditions(collectionPath, options = {}) {
+		const scopeCondition = options.relatedTo ? this.buildRelationScope(options.relatedTo) : void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2517,7 +2770,7 @@ var FetchService = class {
 		const withConfig = this.buildWithConfig(collection);
 		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
 		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
-			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0);
+			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0, scopeCondition);
 			return (await qb.findMany(queryOpts)).map((row) => toCmsRow(row, collection, this.registry));
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
@@ -2533,6 +2786,7 @@ var FetchService = class {
 			_distance: vectorMeta.distanceSelect
 		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
+		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
 			if (searchConditions.length === 0) return [];
@@ -2637,7 +2891,11 @@ var FetchService = class {
 	* Fetch a collection of rows
 	*/
 	async fetchCollection(collectionPath, options = {}) {
-		if (collectionPath.includes("/")) return this.fetchCollectionFromPath(collectionPath, options);
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		if (hop) return this.fetchRowsWithConditions(hop.targetCollection.slug, {
+			...options,
+			relatedTo: hop
+		});
 		return this.fetchRowsWithConditions(collectionPath, options);
 	}
 	/**
@@ -2650,43 +2908,23 @@ var FetchService = class {
 		});
 	}
 	/**
-	* Fetch collection from multi-segment path
-	*/
-	async fetchCollectionFromPath(path, options = {}) {
-		const pathSegments = path.split("/").filter((p) => p && p !== "undefined");
-		if (pathSegments.length < 3 || pathSegments.length % 2 === 0) throw new Error(`Invalid relation path: ${path}. Expected format: collection/id/relation`);
-		const rootCollectionPath = pathSegments[0];
-		let currentCollection = getCollectionByPath(rootCollectionPath, this.registry);
-		let currentId = pathSegments[1];
-		for (let i = 2; i < pathSegments.length; i += 2) {
-			const relationKey = pathSegments[i];
-			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
-			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
-			if (i === pathSegments.length - 1) return (await this.relationService.fetchRelatedEntities(currentCollection.slug, currentId, relationKey, options)).map((row) => ({ ...row.values }));
-			if (i + 1 < pathSegments.length) {
-				const nextEntityId = pathSegments[i + 1];
-				currentCollection = relation.target();
-				currentId = nextEntityId;
-			}
-		}
-		throw new Error(`Unable to resolve path: ${path}`);
-	}
-	/**
 	* Count rows in a collection
 	*/
 	async count(collectionPath, options = {}) {
-		if (collectionPath.includes("/")) return this.countEntitiesFromPath(collectionPath, options);
-		const collection = getCollectionByPath(collectionPath, this.registry);
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		const effectivePath = hop ? hop.targetCollection.slug : collectionPath;
+		const collection = getCollectionByPath(effectivePath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		let query = this.db.select({ count: count() }).from(table).$dynamic();
 		const allConditions = [];
+		if (hop) allConditions.push(this.buildRelationScope(hop));
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
 			if (searchConditions.length === 0) return 0;
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
 		if (options.filter) {
-			const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
+			const filterConditions = this.buildFilterConditions(options.filter, table, effectivePath);
 			if (filterConditions.length > 0) allConditions.push(...filterConditions);
 		}
 		if (allConditions.length > 0) {
@@ -2697,27 +2935,6 @@ var FetchService = class {
 		return Number(result[0]?.count || 0);
 	}
 	/**
-	* Count rows from multi-segment path
-	*/
-	async countEntitiesFromPath(path, options = {}) {
-		const pathSegments = path.split("/").filter((p) => p && p !== "undefined");
-		if (pathSegments.length < 3 || pathSegments.length % 2 === 0) throw new Error(`Invalid relation path: ${path}`);
-		const rootCollectionPath = pathSegments[0];
-		let currentCollection = getCollectionByPath(rootCollectionPath, this.registry);
-		let currentId = pathSegments[1];
-		for (let i = 2; i < pathSegments.length; i += 2) {
-			const relationKey = pathSegments[i];
-			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
-			if (!relation) throw new Error(`Relation '${relationKey}' not found`);
-			if (i === pathSegments.length - 1) return this.relationService.countRelatedEntities(currentCollection.slug, currentId, relationKey, options);
-			if (i + 1 < pathSegments.length) {
-				currentCollection = relation.target();
-				currentId = pathSegments[i + 1];
-			}
-		}
-		throw new Error(`Unable to count for path: ${path}`);
-	}
-	/**
 	* Check if a field value is unique
 	*/
 	async checkUniqueField(collectionPath, fieldName, value, excludeEntityId, _databaseId) {
@@ -2749,6 +2966,14 @@ var FetchService = class {
 	* @param include - Array of relation keys to populate, or ["*"] for all
 	*/
 	async fetchCollectionForRest(collectionPath, options = {}, include) {
+		if (isNestedPath(collectionPath)) {
+			const hop = resolveNestedPath(collectionPath, this.registry);
+			if (hop) return this.fetchCollectionForRest(hop.targetCollection.slug, {
+				...options,
+				relatedTo: hop
+			}, include);
+		}
+		const scopeCondition = options.relatedTo ? this.buildRelationScope(options.relatedTo) : void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2758,7 +2983,7 @@ var FetchService = class {
 		const qb = this.getQueryBuilder(tableName);
 		if (qb && !options.searchString && !options.vectorSearch) try {
 			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
-			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig);
+			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig, scopeCondition);
 			const restRows = (await qb.findMany(queryOpts)).map((row) => toRestRow(row, collection, this.registry));
 			await this.resolveJoinPathRelationsBatchRest(restRows, collection, collectionPath, idInfoArray, include);
 			return restRows;
@@ -2806,6 +3031,7 @@ var FetchService = class {
 	* Fetch a single row with optional relation includes for REST API.
 	*/
 	async fetchOneForRest(collectionPath, id, include, databaseId) {
+		if (!await this.isAddressableUnder(collectionPath, id)) return null;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2874,6 +3100,7 @@ var FetchService = class {
 			_distance: vectorMeta.distanceSelect
 		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
+		if (options.relatedTo) allConditions.push(this.buildRelationScope(options.relatedTo));
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
 			if (searchConditions.length === 0) return [];
@@ -3193,6 +3420,16 @@ var PersistService = class {
 	* Delete an row by ID
 	*/
 	async delete(collectionPath, id, _databaseId) {
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		if (hop) {
+			assertWritableThrough(hop, collectionPath);
+			if (!await this.relationService.isRelated(hop, id)) throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to delete.`);
+			if (isJunctionBackedRelation(hop.relation)) {
+				if (!hop.relation.through) throw ApiError.badRequest(`"${collectionPath}" reaches '${hop.targetCollection.slug}' through a multi-hop joinPath, so there is no single link to remove. Delete the row at "${hop.targetCollection.slug}" directly if that is what you meant.`, "RELATION_NOT_UNLINKABLE");
+				await this.relationService.unlinkRelatedEntity(this.db, hop, id);
+				return;
+			}
+		}
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = getPrimaryKeys(collection, this.registry);
@@ -3213,6 +3450,29 @@ var PersistService = class {
 		await this.db.delete(table);
 	}
 	/**
+	* The column on the *target* table that records the parent, for a create
+	* under a nested one-to-many path.
+	*
+	* Returns `undefined` when the link is not a column at all (a multi-hop
+	* `joinPath`), so the caller writes the row without stamping anything.
+	*
+	* `relation.localKey` is deliberately not consulted: it names a column on
+	* the *source* table. Falling back to it here — which is what this used to
+	* do, and first — stamped the parent's own foreign key onto the child row.
+	*/
+	resolveParentForeignKeyColumn(hop) {
+		const { relation, relationKey, targetCollection } = hop;
+		if (relation.foreignKeyOnTarget) return relation.foreignKeyOnTarget;
+		if (relation.joinPath && relation.joinPath.length === 1) {
+			const joinStep = relation.joinPath[0];
+			const targetTableName = getTableName$1(targetCollection);
+			if (joinStep.table !== targetTableName) logger.warn(`Join step for relation '${relationKey}' targets '${joinStep.table}', not the target table '${targetTableName}'.`);
+			return DrizzleConditionBuilder.getColumnNamesFromColumns(joinStep.on.to)[0];
+		}
+		if (relation.joinPath && relation.joinPath.length > 1) return;
+		throw ApiError.badRequest(`Relation '${relationKey}' on '${hop.parentCollection.slug}' cannot be written through: it declares no \`foreignKeyOnTarget\` (the column on '${targetCollection.slug}' that records the parent) and no \`joinPath\`.`, "RELATION_NOT_WRITABLE");
+	}
+	/**
 	* Save an row (create or update)
 	*
 	* With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
@@ -3225,60 +3485,29 @@ var PersistService = class {
 		let effectiveCollectionPath = collectionPath;
 		const effectiveValues = { ...values };
 		let junctionTableInfo;
-		if (collectionPath.includes("/")) {
-			const segments = collectionPath.split("/").filter(Boolean);
-			if (segments.length >= 3 && segments.length % 2 === 1) {
-				const rootSegment = segments[0];
-				let currentCollection = getCollectionByPath(rootSegment, this.registry);
-				let currentId = segments[1];
-				for (let i = 2; i < segments.length; i += 2) {
-					const relationKey = segments[i];
-					const resolvedRelations = resolveCollectionRelations(currentCollection);
-					const relation = findRelation(resolvedRelations, relationKey);
-					if (!relation) {
-						const available = Object.keys(resolvedRelations).join(", ") || "(none)";
-						throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'. Available relations: [${available}]`);
-					}
-					if (i === segments.length - 1) {
-						const targetCollection = relation.target();
-						effectiveCollectionPath = targetCollection.slug;
-						if (relation.cardinality === "many" && relation.through) {
-							const parentIdInfoArray = getPrimaryKeys(currentCollection, this.registry);
-							const parentIdInfo = parentIdInfoArray[0];
-							const parsedParentId = parseIdValues(currentId, parentIdInfoArray)[parentIdInfo.fieldName];
-							junctionTableInfo = {
-								parentCollection: currentCollection,
-								parentId: parsedParentId,
-								relation,
-								relationKey
-							};
-							break;
-						}
-						let targetColumnName;
-						if (relation.localKey) targetColumnName = relation.localKey;
-						else if (relation.foreignKeyOnTarget) targetColumnName = relation.foreignKeyOnTarget;
-						else if (relation.joinPath && relation.joinPath.length === 1) {
-							const targetTableName = getTableName$1(targetCollection);
-							const relevantJoinStep = relation.joinPath.find((joinStep) => joinStep.table === targetTableName);
-							if (relevantJoinStep) targetColumnName = DrizzleConditionBuilder.getColumnNamesFromColumns(relevantJoinStep.on.to)[0];
-							else {
-								logger.warn(`Could not find specific join step for target table ${targetTableName} in relation '${relationKey}'.`);
-								targetColumnName = DrizzleConditionBuilder.getColumnNamesFromColumns(relation.joinPath[0].on.to)[0];
-							}
-						} else if (relation.joinPath && relation.joinPath.length > 1) break;
-						else throw new Error(`Relation '${relationKey}' lacks configuration for path-based saving.`);
-						const parentIdInfoArray = getPrimaryKeys(currentCollection, this.registry);
-						const parentIdInfo = parentIdInfoArray[0];
-						const parsedParentId = parseIdValues(currentId, parentIdInfoArray)[parentIdInfo.fieldName];
-						const existingValue = effectiveValues[targetColumnName];
-						if (existingValue !== void 0 && existingValue !== null && existingValue !== parsedParentId) logger.warn(`Overriding provided value '${existingValue}' for FK '${targetColumnName}' with path parent id '${parsedParentId}'.`);
-						effectiveValues[targetColumnName] = parsedParentId;
-						break;
-					} else {
-						const nextEntityId = segments[i + 1];
-						currentCollection = relation.target();
-						currentId = nextEntityId;
-					}
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		if (hop) {
+			assertWritableThrough(hop, collectionPath);
+			effectiveCollectionPath = hop.targetCollection.slug;
+			const parentIdForWrite = () => {
+				const parentPks = getPrimaryKeys(hop.parentCollection, this.registry);
+				return parseIdValues(hop.parentId, parentPks)[parentPks[0].fieldName];
+			};
+			if (hop.relation.through) junctionTableInfo = {
+				parentCollection: hop.parentCollection,
+				parentId: parentIdForWrite(),
+				relation: hop.relation,
+				relationKey: hop.relationKey
+			};
+			else if (id !== void 0) {
+				if (!await this.relationService.isRelated(hop, id)) throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to update.`);
+			} else {
+				const targetColumnName = this.resolveParentForeignKeyColumn(hop);
+				if (targetColumnName) {
+					const parsedParentId = parentIdForWrite();
+					const existingValue = effectiveValues[targetColumnName];
+					if (existingValue !== void 0 && existingValue !== null && existingValue !== parsedParentId) logger.warn(`Overriding provided value '${existingValue}' for FK '${targetColumnName}' with path parent id '${parsedParentId}'.`);
+					effectiveValues[targetColumnName] = parsedParentId;
 				}
 			}
 		}
@@ -3349,7 +3578,7 @@ var PersistService = class {
 				}
 				if (inverseRelationUpdates.length > 0) await this.relationService.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
 				if (Object.keys(relationValues).length > 0) await this.relationService.updateRelationsUsingJoins(tx, collection, currentId, relationValues);
-				if (junctionTableInfo && !id) await this.relationService.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
+				if (junctionTableInfo) await this.relationService.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
 				return currentId;
 			});
 		} catch (error) {
@@ -5737,6 +5966,58 @@ var main = () => {
 };
 if (import.meta.url.endsWith(process.argv[1])) main();
 //#endregion
+//#region src/services/cdc/junction-tables.ts
+/**
+* Every junction table reachable from a registered collection, once per
+* relation that uses it.
+*
+* A junction is listed once per *direction* when both sides declare it, because
+* each direction addresses a different child list: `posts/1/tags` and
+* `tags/t/posts` both change when one link is written.
+*/
+function collectJunctionLinks(registry) {
+	const links = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const collection of registry.getCollections()) {
+		let relations;
+		try {
+			relations = resolveCollectionRelations(collection);
+		} catch {
+			continue;
+		}
+		for (const [relationKey, relation] of Object.entries(relations)) {
+			const through = relation?.through;
+			if (!through?.table) continue;
+			const key = `${collection.slug}::${relationKey}::${through.table}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			links.push({
+				schema: collection.schema ?? "public",
+				table: through.table,
+				parentCollection: collection,
+				relationKey,
+				sourceColumn: through.sourceColumn,
+				targetColumn: through.targetColumn
+			});
+		}
+	}
+	return links;
+}
+/**
+* Index {@link collectJunctionLinks} by table, under both the qualified and the
+* bare name — a change event carries whatever the trigger reports, and a
+* collection need not declare a schema.
+*/
+function buildJunctionLinkMap(registry) {
+	const map = /* @__PURE__ */ new Map();
+	for (const link of collectJunctionLinks(registry)) for (const key of [`${link.schema}.${link.table}`, link.table]) {
+		const existing = map.get(key);
+		if (existing) existing.push(link);
+		else map.set(key, [link]);
+	}
+	return map;
+}
+//#endregion
 //#region src/services/cdc/trigger-cdc.ts
 /**
 * Trigger-based Change Data Capture (CDC).
@@ -6861,6 +7142,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	cdcListener;
 	/** Whether database-level CDC is the active cross-instance change source. */
 	cdcActive = false;
+	/** Junction table → the child lists its rows belong to, built when CDC starts. */
+	junctionLinkMap;
 	/** Reverse lookup: `schema.table` (and bare `table`) → collection, built when CDC starts. */
 	cdcTableMap;
 	/**
@@ -7977,6 +8260,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			return;
 		}
 		this.cdcTableMap = this.buildCdcTableMap();
+		this.junctionLinkMap = buildJunctionLinkMap(this.registry);
 		this.cdcListener = new CdcListener(connectionString, (event) => this.handleCdcEvent(event));
 		try {
 			await this.cdcListener.start();
@@ -7984,6 +8268,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			await this.cdcListener.stop().catch(() => {});
 			this.cdcListener = void 0;
 			this.cdcTableMap = void 0;
+			this.junctionLinkMap = void 0;
 			throw err;
 		}
 		this.cdcActive = true;
@@ -7997,6 +8282,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			this.cdcListener = void 0;
 		}
 		this.cdcTableMap = void 0;
+		this.junctionLinkMap = void 0;
 		this.recentAppEmits.clear();
 	}
 	/**
@@ -8033,6 +8319,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	async handleCdcEvent(event) {
 		const collection = this.resolveCollectionForTable(event.schema, event.table);
 		if (!collection) {
+			if (await this.handleJunctionCdcEvent(event)) return;
 			this.debugLog(`📡 [CDC] Ignoring change on unmapped table ${event.schema}.${event.table}`);
 			return;
 		}
@@ -8042,6 +8329,38 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		const row = event.op === "DELETE" ? null : { _rebase_invalidated: true };
 		await this.notifyUpdate(path, id, row, databaseId, false, "cdc");
 	}
+	/**
+	* Deliver a change on a many-to-many junction table as a change to the child
+	* lists it belongs to.
+	*
+	* Linking a tag to a post writes only `posts_tags`. That table backs no
+	* collection, so change capture dropped the event as unmapped and the
+	* subscribers of `posts/1/tags` never heard about it — every other write in
+	* the system was realtime, and this one silently was not. The junction row
+	* carries both ids, so it names its own paths exactly.
+	*
+	* Notifies the nested path rather than either endpoint collection, because
+	* invalidation walks *parent* paths and never child ones: telling `tags` it
+	* changed would not reach a subscription on `posts/1/tags`.
+	*
+	* Returns whether the table was recognised as a junction.
+	*/
+	async handleJunctionCdcEvent(event) {
+		const links = this.junctionLinkMap?.get(`${event.schema}.${event.table}`) ?? this.junctionLinkMap?.get(event.table);
+		if (!links?.length) return false;
+		for (const link of links) {
+			const sourceId = event.row?.[link.sourceColumn];
+			const targetId = event.row?.[link.targetColumn];
+			if (sourceId === void 0 || sourceId === null || targetId === void 0 || targetId === null) {
+				this.debugLog(`📡 [CDC] Junction row on ${event.table} is missing '${link.sourceColumn}'/'${link.targetColumn}' — skipping.`);
+				continue;
+			}
+			const path = `${link.parentCollection.slug}/${String(sourceId)}/${link.relationKey}`;
+			const row = event.op === "DELETE" ? null : { _rebase_invalidated: true };
+			await this.notifyUpdate(path, String(targetId), row, link.parentCollection.databaseId, false, "cdc");
+		}
+		return true;
+	}
 	/** Compute the canonical (possibly composite) id string from a captured row. */
 	extractIdFromCdcRow(collection, row) {
 		return deriveRowAddress(row, collection, this.registry) || "*";
@@ -20026,7 +20345,7 @@ function createPostgresBootstrapper(pgConfig) {
 					} catch {}
 					const message = `
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  ❌  Cannot connect to PostgreSQL at ${hostInfo}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  The database server is not running or is not accepting\n  connections. Common fixes:\n\n    • brew services start postgresql@18\n    • docker compose up -d postgres\n    • Verify DATABASE_URL in your .env file\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+  ❌  Cannot connect to PostgreSQL at ${hostInfo}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  The database server is not running or is not accepting\n  connections. Common fixes:\n\n    • docker compose up -d db          (the service a Rebase scaffold ships)\n    • brew services start postgresql@18\n    • Verify DATABASE_URL in your .env file\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
 					logger.error(message);
 					throw new Error(`Cannot connect to PostgreSQL at ${hostInfo}: connection refused. Is the database running?`);
 				}
@@ -20111,10 +20430,15 @@ function createPostgresBootstrapper(pgConfig) {
 					const cdcRunSql = async (text) => {
 						return (await schemaAwareDb.execute(sql.raw(text))).rows ?? [];
 					};
-					await provisionTriggerCdc(cdcRunSql, registry.getCollections().map((c) => ({
+					const cdcTables = registry.getCollections().map((c) => ({
 						schema: c.schema ?? "public",
 						table: getTableName$1(c)
-					})).filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table)));
+					})).filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table));
+					for (const link of collectJunctionLinks(registry)) cdcTables.push({
+						schema: link.schema,
+						table: link.table
+					});
+					await provisionTriggerCdc(cdcRunSql, cdcTables);
 					await realtimeService.enableCdc(directUrl);
 					cdcEnabled = true;
 					provisionCdcForTables = async (tables) => {
@@ -20252,7 +20576,7 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-C9gy4STB.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-BVvtkkRm.js");
 			return { applied: (await ensureCollectionTables({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };