@rebasepro/server-postgres 0.10.1-canary.8d27c46 → 0.10.1-canary.af2af91

package/dist/utils/drizzle-conditions.d.ts

@@ -18,6 +18,47 @@ export interface DrizzleDynamicQuery {
  * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;
  */
 export declare class DrizzleConditionBuilder {
+    /**
+     * Express "reachable from this parent through this relation" as a plain
+     * `WHERE` condition on the target table.
+     *
+     * This is the primitive that lets a relation be a *filter* rather than an
+     * addressing scheme. A nested listing used to be served by its own query
+     * builder — `fetchEntitiesUsingJoins`, which grew joins the root pipeline
+     * did not have and lost the options the root pipeline did have (offset,
+     * filter, orderBy, include). Reduced to a condition, the same listing runs
+     * through the ordinary collection query, so it inherits all of them and
+     * there is one read path instead of two.
+     *
+     * The shapes:
+     *   - inverse FK  → `target.<fk> = :parentId`, a column comparison.
+     *   - `through`   → `EXISTS (SELECT 1 FROM junction …)`, correlated on the
+     *                   target's key, so the junction never multiplies rows the
+     *                   way an `INNER JOIN` would.
+     *   - `joinPath`  → the same `EXISTS`, with the path's steps joined inside
+     *                   it and the final step correlating to the outer row.
+     */
+    static buildRelationScopeCondition(relation: Relation, 
+    /**
+     * Lazy: only `joinPath` and `localKey` relations need the parent's own
+     * table. An inverse foreign key and a junction are both expressible
+     * from the parent's *id* alone, and requiring the table for them would
+     * make a child listing fail on a parent whose table isn't registered.
+     */
+    parent: () => {
+        table: PgTable<any>;
+        idColumn: AnyPgColumn;
+    }, parentId: string | number, targetTable: PgTable<any>, targetIdColumn: AnyPgColumn, registry: PostgresCollectionRegistry): SQL;
+    /**
+     * `EXISTS` for an explicit `joinPath`.
+     *
+     * The path is declared source → target. The subquery replays every step but
+     * the last from inside, and turns the last one into the correlation with the
+     * outer target row — so the target table is never named twice and needs no
+     * alias. Each intermediate table is aliased positionally, which keeps a path
+     * that revisits a table (a self-referencing many-to-many) unambiguous.
+     */
+    private static buildJoinPathScopeCondition;
     /**
      * Build filter conditions from FilterValues
      */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.10.1-canary.8d27c46",
+  "version": "0.10.1-canary.af2af91",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -47,11 +47,11 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.10.1-canary.8d27c46",
-    "@rebasepro/types": "0.10.1-canary.8d27c46",
-    "@rebasepro/server": "0.10.1-canary.8d27c46",
-    "@rebasepro/common": "0.10.1-canary.8d27c46",
-    "@rebasepro/utils": "0.10.1-canary.8d27c46"
+    "@rebasepro/codegen": "0.10.1-canary.af2af91",
+    "@rebasepro/server": "0.10.1-canary.af2af91",
+    "@rebasepro/types": "0.10.1-canary.af2af91",
+    "@rebasepro/utils": "0.10.1-canary.af2af91",
+    "@rebasepro/common": "0.10.1-canary.af2af91"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.11",

package/src/PostgresBootstrapper.ts

@@ -37,6 +37,7 @@ import { buildCollectionsFromSchema, introspectSchema, readRlsStatus } from "./s
 import { buildDrizzleTablesFromSchema, buildDrizzleRelationsFromSchema } from "./schema/dynamic-tables";
 import { detectConnectionPosture, ensureAppRole, validatePolicyPgRoles, warnOnAnonymousGrants, REBASE_USER_ROLE, type RawSqlRunner } from "./security/rls-enforcement";
 import { provisionTriggerCdc, type CdcTableRef } from "./services/cdc/trigger-cdc";
+import { collectJunctionLinks } from "./services/cdc/junction-tables";
 import { createChannelBus, resolveChannelBusSetting } from "./services/channel-bus";
 import { isChannelBusInstance } from "@rebasepro/types";
 
@@ -233,8 +234,8 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                         `  The database server is not running or is not accepting\n` +
                         `  connections. Common fixes:\n` +
                         `\n` +
+                        `    • docker compose up -d db          (the service a Rebase scaffold ships)\n` +
                         `    • brew services start postgresql@18\n` +
-                        `    • docker compose up -d postgres\n` +
                         `    • Verify DATABASE_URL in your .env file\n` +
                         `\n` +
                         `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
@@ -417,6 +418,14 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                             table: getCollectionTableName(c)
                         }))
                         .filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table));
+                    // Junction tables back no collection, so the list above misses
+                    // them — and a link or unlink is a write nobody would hear
+                    // about. Their rows are the contents of a child list, which is
+                    // as much a change as a write to the rows themselves.
+                    for (const link of collectJunctionLinks(registry)) {
+                        cdcTables.push({ schema: link.schema,
+table: link.table });
+                    }
                     // Provisioning throws only when the connection can't create the
                     // trigger function (insufficient privilege); enableCdc throws when
                     // the LISTEN connection can't be established. Either → fall back.

package/src/services/FetchService.ts

@@ -19,6 +19,7 @@ import { RelationalQueryBuilder } from "drizzle-orm/pg-core/query-builders/query
 import { DrizzleClient } from "../interfaces";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
 import { toCmsRow, toRestRow, isJunctionRelation } from "./row-pipeline";
+import { isNestedPath, resolveNestedPath, type NestedPathHop } from "./nested-path";
 import { logger } from "@rebasepro/server";
 
 /** Type-safe accessor for Drizzle's relational query API via dynamic table name */
@@ -279,7 +280,8 @@ export class FetchService {
             logical?: LogicalCondition;
         },
         collectionPath: string,
-        withConfig?: Record<string, unknown>
+        withConfig?: Record<string, unknown>,
+        scopeCondition?: SQL
     ): Record<string, unknown> {
         const queryOpts: Record<string, unknown> = {};
 
@@ -288,6 +290,8 @@ export class FetchService {
         // Build where conditions
         const allConditions: SQL[] = [];
 
+        if (scopeCondition) allConditions.push(scopeCondition);
+
         if (options.searchString) {
             const collection = getCollectionByPath(collectionPath, this.registry);
             const searchConditions = DrizzleConditionBuilder.buildSearchConditions(
@@ -391,6 +395,59 @@ export class FetchService {
         return [];
     }
 
+    /**
+     * Compile "rows reachable from this parent" into a `WHERE` condition on the
+     * target table, so a nested listing can run as an ordinary collection query.
+     */
+    private buildRelationScope(hop: NestedPathHop): SQL {
+        const parentPks = requirePrimaryKeys(hop.parentCollection, this.registry);
+        const parentIdInfo = parentPks[0];
+        const parsedParentId = parseIdValues(hop.parentId, parentPks)[parentIdInfo.fieldName];
+
+        const parent = () => {
+            const table = getTableForCollection(hop.parentCollection, this.registry);
+            const idColumn = table[parentIdInfo.fieldName as keyof typeof table] as AnyPgColumn;
+            if (!idColumn) {
+                throw new Error(`ID field '${parentIdInfo.fieldName}' not found in table for collection '${hop.parentCollection.slug}'`);
+            }
+            return { table,
+idColumn };
+        };
+
+        const targetTable = getTableForCollection(hop.targetCollection, this.registry);
+        const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
+        const targetIdColumn = targetTable[targetPks[0].fieldName as keyof typeof targetTable] as AnyPgColumn;
+        if (!targetIdColumn) {
+            throw new Error(`ID field '${targetPks[0].fieldName}' not found in table for collection '${hop.targetCollection.slug}'`);
+        }
+
+        return DrizzleConditionBuilder.buildRelationScopeCondition(
+            hop.relation,
+            parent,
+            parsedParentId as string | number,
+            targetTable,
+            targetIdColumn,
+            this.registry
+        );
+    }
+
+    /**
+     * Whether `id` is actually reachable at `collectionPath`.
+     *
+     * Trivially true for a root path. For a nested one it is a real question:
+     * the path resolves to the target collection, and matching on the primary
+     * key alone made the parent segment decorative — `authors/1/posts/43`
+     * returned post 43 whoever wrote it, and the REST layer's delete then
+     * deleted it. A row that is not under this parent is reported as absent,
+     * which is what a caller addressing it through the parent should see.
+     */
+    private async isAddressableUnder(collectionPath: string, id: string | number): Promise<boolean> {
+        if (!isNestedPath(collectionPath)) return true;
+        const hop = resolveNestedPath(collectionPath, this.registry);
+        if (!hop) return true;
+        return this.relationService.isRelated(hop, id);
+    }
+
     /**
      * Fetch a single row by ID
      */
@@ -399,6 +456,8 @@ export class FetchService {
         id: string | number,
         databaseId?: string
     ): Promise<Record<string, unknown> | undefined> {
+        if (!await this.isAddressableUnder(collectionPath, id)) return undefined;
+
         const collection = getCollectionByPath(collectionPath, this.registry);
         const table = getTableForCollection(collection, this.registry);
         const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -516,8 +575,11 @@ export class FetchService {
             databaseId?: string;
             vectorSearch?: VectorSearchParams;
             logical?: LogicalCondition;
+            /** Narrow to the rows reachable from a parent through a relation. */
+            relatedTo?: NestedPathHop;
         } = {}
     ): Promise<Record<string, unknown>[]> {
+        const scopeCondition = options.relatedTo ? this.buildRelationScope(options.relatedTo) : undefined;
         const collection = getCollectionByPath(collectionPath, this.registry);
         const table = getTableForCollection(collection, this.registry);
         const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -545,7 +607,7 @@ export class FetchService {
         if (qb && !options.searchString && !hasRelations && !options.vectorSearch) {
             try {
                 const queryOpts = this.buildDrizzleQueryOptions<M>(
-                    table, idField, idInfo, options, collectionPath, undefined
+                    table, idField, idInfo, options, collectionPath, undefined, scopeCondition
                 );
 
 
@@ -578,6 +640,8 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
             : this.db.select().from(table).$dynamic();
         const allConditions: SQL[] = [];
 
+        if (scopeCondition) allConditions.push(scopeCondition);
+
         if (options.searchString) {
             const searchConditions = DrizzleConditionBuilder.buildSearchConditions(
                 options.searchString, collection.properties, table
@@ -771,9 +835,13 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
             vectorSearch?: VectorSearchParams;
         } = {}
     ): Promise<Record<string, unknown>[]> {
-        // Handle multi-segment paths by resolving through relations
-        if (collectionPath.includes("/")) {
-            return this.fetchCollectionFromPath<M>(collectionPath, options);
+        // A nested path is the target collection narrowed by a relation — the
+        // same query, one condition heavier. It used to be a separate builder
+        // that honoured `limit` and nothing else.
+        const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : undefined;
+        if (hop) {
+            return this.fetchRowsWithConditions<M>(hop.targetCollection.slug, { ...options,
+relatedTo: hop });
         }
 
         return this.fetchRowsWithConditions<M>(collectionPath, options);
@@ -799,65 +867,6 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         });
     }
 
-    /**
-     * Fetch collection from multi-segment path
-     */
-    private async fetchCollectionFromPath<M extends Record<string, unknown>>(
-        path: string,
-        options: {
-            filter?: FilterValues<Extract<keyof M, string>>;
-            orderBy?: string;
-            order?: "desc" | "asc";
-            limit?: number;
-            startAfter?: Record<string, unknown>;
-            searchString?: string;
-            databaseId?: string;
-        } = {}
-    ): Promise<Record<string, unknown>[]> {
-        const pathSegments = path.split("/").filter(p => p && p !== "undefined");
-
-        if (pathSegments.length < 3 || pathSegments.length % 2 === 0) {
-            throw new Error(`Invalid relation path: ${path}. Expected format: collection/id/relation`);
-        }
-
-        const rootCollectionPath = pathSegments[0];
-        let currentCollection = getCollectionByPath(rootCollectionPath, this.registry);
-        let currentId: string | number = pathSegments[1];
-
-        for (let i = 2; i < pathSegments.length; i += 2) {
-            const relationKey = pathSegments[i];
-            const resolvedRelations = resolveCollectionRelations(currentCollection);
-            const relation = findRelation(resolvedRelations, relationKey);
-
-            if (!relation) {
-                throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
-            }
-
-            if (i === pathSegments.length - 1) {
-                const rows = await this.relationService.fetchRelatedEntities<M>(
-                    currentCollection.slug,
-                    currentId,
-                    relationKey,
-                    options
-                );
-                // Flatten RelatedRow[] to rows: the target's columns, and only
-                // those. Merging `row.id` in last overwrote a real `id` column,
-                // and the address is derivable without it — a consumer resolves
-                // this path ("posts/1/comments") to the target collection and
-                // reads the key columns, which `values` carries.
-                return rows.map(row => ({ ...row.values as Record<string, unknown> }));
-            }
-
-            if (i + 1 < pathSegments.length) {
-                const nextEntityId = pathSegments[i + 1];
-                currentCollection = relation.target();
-                currentId = nextEntityId;
-            }
-        }
-
-        throw new Error(`Unable to resolve path: ${path}`);
-    }
-
     /**
      * Count rows in a collection
      */
@@ -869,16 +878,20 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
             databaseId?: string;
         } = {}
     ): Promise<number> {
-        if (collectionPath.includes("/")) {
-            return this.countEntitiesFromPath<M>(collectionPath, options);
-        }
+        // Same narrowing as the listing — and, unlike the count it replaces,
+        // the same `filter` and `searchString` too, so `total` describes the
+        // rows that were actually served.
+        const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : undefined;
+        const effectivePath = hop ? hop.targetCollection.slug : collectionPath;
 
-        const collection = getCollectionByPath(collectionPath, this.registry);
+        const collection = getCollectionByPath(effectivePath, this.registry);
         const table = getTableForCollection(collection, this.registry);
 
         let query = this.db.select({ count: count() }).from(table).$dynamic();
         const allConditions: SQL[] = [];
 
+        if (hop) allConditions.push(this.buildRelationScope(hop));
+
         if (options.searchString) {
             const searchConditions = DrizzleConditionBuilder.buildSearchConditions(
                 options.searchString, collection.properties, table
@@ -888,7 +901,7 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         }
 
         if (options.filter) {
-            const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
+            const filterConditions = this.buildFilterConditions(options.filter, table, effectivePath);
             if (filterConditions.length > 0) allConditions.push(...filterConditions);
         }
 
@@ -901,50 +914,6 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         return Number(result[0]?.count || 0);
     }
 
-    /**
-     * Count rows from multi-segment path
-     */
-    private async countEntitiesFromPath<M extends Record<string, unknown>>(
-        path: string,
-        options: { filter?: FilterValues<Extract<keyof M, string>>; databaseId?: string } = {}
-    ): Promise<number> {
-        const pathSegments = path.split("/").filter(p => p && p !== "undefined");
-
-        if (pathSegments.length < 3 || pathSegments.length % 2 === 0) {
-            throw new Error(`Invalid relation path: ${path}`);
-        }
-
-        const rootCollectionPath = pathSegments[0];
-        let currentCollection = getCollectionByPath(rootCollectionPath, this.registry);
-        let currentId: string | number = pathSegments[1];
-
-        for (let i = 2; i < pathSegments.length; i += 2) {
-            const relationKey = pathSegments[i];
-            const resolvedRelations = resolveCollectionRelations(currentCollection);
-            const relation = findRelation(resolvedRelations, relationKey);
-
-            if (!relation) {
-                throw new Error(`Relation '${relationKey}' not found`);
-            }
-
-            if (i === pathSegments.length - 1) {
-                return this.relationService.countRelatedEntities(
-                    currentCollection.slug,
-                    currentId,
-                    relationKey,
-                    options
-                );
-            }
-
-            if (i + 1 < pathSegments.length) {
-                currentCollection = relation.target();
-                currentId = pathSegments[i + 1];
-            }
-        }
-
-        throw new Error(`Unable to count for path: ${path}`);
-    }
-
     /**
      * Check if a field value is unique
      */
@@ -1014,9 +983,25 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
             searchString?: string;
             databaseId?: string;
             vectorSearch?: VectorSearchParams;
+            /** Narrow to the rows reachable from a parent through a relation. */
+            relatedTo?: NestedPathHop;
         } = {},
         include?: string[]
     ): Promise<Record<string, unknown>[]> {
+        // Resolve a nested path here rather than at the route, so `include`,
+        // `offset` and the rest reach a child listing by the same route they
+        // reach a root one.
+        if (isNestedPath(collectionPath)) {
+            const hop = resolveNestedPath(collectionPath, this.registry);
+            if (hop) {
+                return this.fetchCollectionForRest<M>(
+                    hop.targetCollection.slug, { ...options,
+relatedTo: hop }, include
+                );
+            }
+        }
+
+        const scopeCondition = options.relatedTo ? this.buildRelationScope(options.relatedTo) : undefined;
         const collection = getCollectionByPath(collectionPath, this.registry);
         const table = getTableForCollection(collection, this.registry);
         const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -1039,7 +1024,7 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
                     : undefined;
 
                 const queryOpts = this.buildDrizzleQueryOptions<M>(
-                    table, idField, idInfo, options, collectionPath, withConfig
+                    table, idField, idInfo, options, collectionPath, withConfig, scopeCondition
                 );
 
 
@@ -1123,6 +1108,8 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         include?: string[],
         databaseId?: string
     ): Promise<Record<string, unknown> | null> {
+        if (!await this.isAddressableUnder(collectionPath, id)) return null;
+
         const collection = getCollectionByPath(collectionPath, this.registry);
         const table = getTableForCollection(collection, this.registry);
         const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -1229,6 +1216,7 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
             startAfter?: Record<string, unknown>;
             searchString?: string;
             vectorSearch?: VectorSearchParams;
+            relatedTo?: NestedPathHop;
         } = {}
     ): Promise<Record<string, unknown>[]> {
         const collection = getCollectionByPath(collectionPath, this.registry);
@@ -1248,6 +1236,8 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
             : this.db.select().from(table).$dynamic();
         const allConditions: SQL[] = [];
 
+        if (options.relatedTo) allConditions.push(this.buildRelationScope(options.relatedTo));
+
         if (options.searchString) {
             const searchConditions = DrizzleConditionBuilder.buildSearchConditions(
                 options.searchString, collection.properties, table