@rebasepro/server-postgres 0.10.1-canary.d8d45b2 → 0.10.1-canary.ed78a2c

package/dist/index.es.js

@@ -2,8 +2,8 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./chunk-DSJWtz9O.js";
-import { a as isSchemaAdmin, i as isSQLAdmin, l as isPostgresCollectionConfig, m as Vector, n as getDataSourceCapabilities, o as ANONYMOUS_USER_ID, r as isChannelBusInstance } from "./src-B0v4IKaI.js";
-import { C as createRelationRefWithData, D as mergeDeep, E as getPolicyNamesForRule, O as camelCase, S as createRelationRef, T as updateDateAutoValues, _ as getTableVarName, a as getJunctionCollectionConfig, b as getDeclaredPrimaryKeys, c as getEffectiveSecurityRules, d as securityRuleToConditions, f as findAnonymousGrants, g as getTableName$1, h as getEnumVarName, i as CollectionRegistry, k as toSnakeCase, l as buildPropertyCallbacks, m as getColumnName, n as detectJunctionTables, o as getJunctionSecurityRules, p as findRelation, r as buildSdkData, s as resolveJunctionSpecs, t as classifyTable, u as policyToPostgres, v as resolveCollectionRelations, w as normalizeToEntityRelation, x as parseIdValues, y as buildCompositeId } from "./src-DmsRg8MR.js";
+import { a as isSchemaAdmin, c as hasForeignKeyOnTarget, d as isPostgresCollectionConfig, g as Vector, i as isSQLAdmin, l as isManyToMany, o as ANONYMOUS_USER_ID, r as isChannelBusInstance } from "./src-D5xBTl32.js";
+import { C as createRelationRefWithData, D as mergeDeep, E as getPolicyNamesForRule, O as camelCase, S as createRelationRef, T as updateDateAutoValues, _ as getTableVarName, a as getJunctionCollectionConfig, b as getDeclaredPrimaryKeys, c as getEffectiveSecurityRules, d as securityRuleToConditions, f as findAnonymousGrants, g as getTableName$1, h as getEnumVarName, i as CollectionRegistry, k as toSnakeCase, l as buildPropertyCallbacks, m as getColumnName, n as detectJunctionTables, o as getJunctionSecurityRules, p as findRelation, r as buildSdkData, s as resolveJunctionSpecs, t as classifyTable, u as policyToPostgres, v as resolveCollectionRelations, w as normalizeToEntityRelation, x as parseIdValues, y as buildCompositeId } from "./src-3VmUJ8Xn.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
@@ -392,6 +392,93 @@ function unwrapRelationFilterValue(value) {
 * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;
 */
 var DrizzleConditionBuilder = class {
+	/**
+	* Express "reachable from this parent through this relation" as a plain
+	* `WHERE` condition on the target table.
+	*
+	* This is the primitive that lets a relation be a *filter* rather than an
+	* addressing scheme. A nested listing used to be served by its own query
+	* builder — `fetchEntitiesUsingJoins`, which grew joins the root pipeline
+	* did not have and lost the options the root pipeline did have (offset,
+	* filter, orderBy, include). Reduced to a condition, the same listing runs
+	* through the ordinary collection query, so it inherits all of them and
+	* there is one read path instead of two.
+	*
+	* The shapes:
+	*   - inverse FK  → `target.<fk> = :parentId`, a column comparison.
+	*   - `through`   → `EXISTS (SELECT 1 FROM junction …)`, correlated on the
+	*                   target's key, so the junction never multiplies rows the
+	*                   way an `INNER JOIN` would.
+	*   - `joinPath`  → the same `EXISTS`, with the path's steps joined inside
+	*                   it and the final step correlating to the outer row.
+	*/
+	static buildRelationScopeCondition(relation, parent, parentId, targetTable, targetIdColumn, registry) {
+		switch (relation.kind) {
+			case "via": {
+				const { table, idColumn } = parent();
+				return this.buildJoinPathScopeCondition(relation.joinPath, table, idColumn, parentId, targetTable, registry);
+			}
+			case "manyToMany": {
+				const { table: junctionName, sourceColumn, targetColumn } = relation.through;
+				const junctionTable = registry.getTable(junctionName);
+				if (!junctionTable) throw new Error(`Junction table not found: ${junctionName}`);
+				const sourceCol = junctionTable[sourceColumn];
+				const targetCol = junctionTable[targetColumn];
+				if (!sourceCol || !targetCol) throw new Error(`Junction columns '${sourceColumn}'/'${targetColumn}' not found in '${junctionName}'`);
+				return sql`EXISTS (SELECT 1 FROM ${junctionTable} WHERE ${targetCol} = ${targetIdColumn} AND ${sourceCol} = ${parentId})`;
+			}
+			case "hasOne":
+			case "hasMany": {
+				const fkColumn = targetTable[relation.foreignKeyOnTarget];
+				if (!fkColumn) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'.`);
+				return eq(fkColumn, parentId);
+			}
+			case "belongsTo": {
+				const { table, idColumn } = parent();
+				return sql`${targetIdColumn} = (SELECT ${sql.identifier(relation.localKey)} FROM ${table} WHERE ${idColumn} = ${parentId})`;
+			}
+			default: throw new Error(`Unknown relation kind: ${JSON.stringify(relation)}`);
+		}
+	}
+	/**
+	* `EXISTS` for an explicit `joinPath`.
+	*
+	* The path is declared source → target. The subquery replays every step but
+	* the last from inside, and turns the last one into the correlation with the
+	* outer target row — so the target table is never named twice and needs no
+	* alias. Each intermediate table is aliased positionally, which keeps a path
+	* that revisits a table (a self-referencing many-to-many) unambiguous.
+	*/
+	static buildJoinPathScopeCondition(joinPath, parentTable, parentIdColumn, parentId, targetTable, registry) {
+		const sourceAlias = "__rel_src";
+		const aliasFor = (index) => `__rel_j${index}`;
+		const fromRef = (stepIndex, column) => sql`${sql.identifier(stepIndex === 0 ? sourceAlias : aliasFor(stepIndex - 1))}.${sql.identifier(getColumnName(column))}`;
+		const pairs = (step) => {
+			const from = Array.isArray(step.on.from) ? step.on.from : [step.on.from];
+			const to = Array.isArray(step.on.to) ? step.on.to : [step.on.to];
+			if (from.length !== to.length) throw new Error(`Join step on '${step.table}' has ${from.length} \`from\` columns and ${to.length} \`to\` columns`);
+			return from.map((f, i) => ({
+				from: f,
+				to: to[i]
+			}));
+		};
+		const inner = joinPath.slice(0, -1);
+		const last = joinPath[joinPath.length - 1];
+		const joins = inner.map((step, index) => {
+			const table = registry.getTable(step.table);
+			if (!table) throw new Error(`Join table not found: ${step.table}`);
+			const on = pairs(step).map(({ from, to }) => sql`${fromRef(index, from)} = ${sql.identifier(aliasFor(index))}.${sql.identifier(getColumnName(to))}`);
+			return sql`JOIN ${table} AS ${sql.identifier(aliasFor(index))} ON ${sql.join(on, sql` AND `)}`;
+		});
+		const targetColumn = (name) => {
+			const column = targetTable[getColumnName(name)];
+			if (!column) throw new Error(`Join step column '${name}' not found in the target table of this joinPath`);
+			return column;
+		};
+		const correlation = sql.join(pairs(last).map(({ from, to }) => sql`${fromRef(inner.length, from)} = ${targetColumn(to)}`), sql` AND `);
+		const joinsSql = joins.length > 0 ? sql` ${sql.join(joins, sql` `)}` : sql``;
+		return sql`EXISTS (SELECT 1 FROM ${parentTable} AS ${sql.identifier(sourceAlias)}${joinsSql} WHERE ${sql.identifier(sourceAlias)}.${sql.identifier(parentIdColumn.name)} = ${parentId} AND ${correlation})`;
+	}
 	/**
 	* Build filter conditions from FilterValues
 	*/
@@ -489,58 +576,43 @@ var DrizzleConditionBuilder = class {
 	/**
 	* Build relation-based conditions for different relation types
 	*/
+	/**
+	* Joins and where-conditions that reach a relation's target rows.
+	*
+	* One case per kind. This used to be a chain of six `else if`s over
+	* `cardinality`/`direction`/`through`, ending in
+	* `findCorrespondingJunctionTable` — a search through the *target's* own
+	* relations to work out whether an "inverse many" was a one-to-many or the
+	* far side of a junction. That search is gone: the kind says which it is.
+	*
+	* The owning/inverse split for junctions is gone too. Both variants built
+	* the identical condition — `through` is always written from the declaring
+	* side's point of view — so the second was a distinction without a
+	* difference and one of the places the two could drift apart.
+	*/
 	static buildRelationConditions(relation, parentId, targetTable, parentTable, parentIdColumn, targetIdColumn, registry) {
-		console.debug("🔍 [buildRelationConditions] Building conditions for relation:", {
-			relationName: relation.relationName,
-			cardinality: relation.cardinality,
-			direction: relation.direction,
-			hasThrough: !!relation.through,
-			hasForeignKeyOnTarget: !!relation.foreignKeyOnTarget,
-			inverseRelationName: relation.inverseRelationName,
-			parentId
-		});
 		const joinConditions = [];
 		const whereConditions = [];
-		if (relation.joinPath && relation.joinPath.length > 0) {
-			console.debug("🔍 [buildRelationConditions] Using joinPath logic");
-			const { joins, finalCondition } = this.buildJoinPathConditions(relation.joinPath, targetTable, parentTable, parentIdColumn, parentId, registry);
-			joinConditions.push(...joins);
-			whereConditions.push(finalCondition);
-		} else if (relation.through && relation.cardinality === "many" && relation.direction === "owning") {
-			console.debug("🔍 [buildRelationConditions] Using owning many-to-many with explicit through");
-			const junctionResult = this.buildJunctionTableConditions(relation.through, targetIdColumn, parentId, registry);
-			joinConditions.push(junctionResult.join);
-			whereConditions.push(junctionResult.condition);
-		} else if (relation.through && relation.cardinality === "many" && relation.direction === "inverse") {
-			console.debug("🔍 [buildRelationConditions] Using inverse many-to-many with explicit through");
-			const junctionResult = this.buildInverseJunctionTableConditions(relation.through, targetIdColumn, parentId, registry);
-			joinConditions.push(junctionResult.join);
-			whereConditions.push(junctionResult.condition);
-		} else if (relation.cardinality === "many" && relation.direction === "inverse" && !relation.through) {
-			console.debug("🔍 [buildRelationConditions] Handling inverse many relationship without explicit through");
-			const junctionInfo = this.findCorrespondingJunctionTable(relation, registry);
-			if (junctionInfo) {
-				console.debug("🔍 [buildRelationConditions] Found junction info for inverse many-to-many, building junction conditions");
-				const junctionResult = this.buildInverseJunctionTableConditions(junctionInfo, targetIdColumn, parentId, registry);
+		switch (relation.kind) {
+			case "via": {
+				const { joins, finalCondition } = this.buildJoinPathConditions(relation.joinPath, targetTable, parentTable, parentIdColumn, parentId, registry);
+				joinConditions.push(...joins);
+				whereConditions.push(finalCondition);
+				break;
+			}
+			case "manyToMany": {
+				const junctionResult = this.buildJunctionTableConditions(relation.through, targetIdColumn, parentId, registry);
 				joinConditions.push(junctionResult.join);
 				whereConditions.push(junctionResult.condition);
-			} else if (relation.foreignKeyOnTarget) {
-				console.debug("🔍 [buildRelationConditions] No junction table found, treating as inverse one-to-many with foreign key on target");
-				const simpleCondition = this.buildSimpleRelationCondition(relation, targetTable, parentTable, parentId);
-				whereConditions.push(simpleCondition);
-			} else {
-				logger.error("🔍 [buildRelationConditions] Failed to find junction table info and no foreign key specified");
-				throw new Error(`Cannot resolve inverse many relation '${relation.relationName}'. Either specify 'through' property, ensure corresponding owning relation exists with junction table configuration, or specify 'foreignKeyOnTarget' for one-to-many relationships.`);
+				break;
 			}
-		} else {
-			console.debug("🔍 [buildRelationConditions] Using simple relation logic - THIS IS WHERE THE ERROR MIGHT OCCUR");
-			const simpleCondition = this.buildSimpleRelationCondition(relation, targetTable, parentTable, parentId);
-			whereConditions.push(simpleCondition);
+			case "hasOne":
+			case "hasMany":
+			case "belongsTo":
+				whereConditions.push(this.buildSimpleRelationCondition(relation, targetTable, parentTable, parentId));
+				break;
+			default: throw new Error(`Unknown relation kind: ${JSON.stringify(relation)}`);
 		}
-		console.debug("🔍 [buildRelationConditions] Final result:", {
-			joinConditionsCount: joinConditions.length,
-			whereConditionsCount: whereConditions.length
-		});
 		return {
 			joinConditions,
 			whereConditions
@@ -680,48 +752,24 @@ var DrizzleConditionBuilder = class {
 		};
 	}
 	/**
-	* Build conditions for inverse junction table (many-to-many) relations
-	*/
-	static buildInverseJunctionTableConditions(through, targetIdColumn, parentId, registry) {
-		const junctionTable = registry.getTable(through.table);
-		if (!junctionTable) throw new Error(`Junction table not found: ${through.table}`);
-		const junctionSourceCol = junctionTable[through.sourceColumn];
-		const junctionTargetCol = junctionTable[through.targetColumn];
-		if (!junctionSourceCol) throw new Error(`Source column '${through.sourceColumn}' not found in junction table '${through.table}'`);
-		if (!junctionTargetCol) throw new Error(`Target column '${through.targetColumn}' not found in junction table '${through.table}'`);
-		const condition = Array.isArray(parentId) ? inArray(junctionSourceCol, parentId) : eq(junctionSourceCol, parentId);
-		return {
-			join: {
-				table: junctionTable,
-				condition: eq(targetIdColumn, junctionTargetCol)
-			},
-			condition
-		};
-	}
-	/**
-	* Build conditions for simple relations (owning/inverse without join paths)
+	* The condition for a relation whose link is a single column.
+	*
+	* Two cases. It had five: two of them existed only to throw ("should not be
+	* called directly", "lacks proper configuration"), and one guessed a column
+	* name by appending `_id` to `inverseRelationName` when no foreign key had
+	* been resolved. All three were reachable only because the old type let a
+	* relation arrive here under-specified. It cannot now.
 	*/
 	static buildSimpleRelationCondition(relation, targetTable, parentTable, parentId) {
-		if (relation.direction === "owning" && relation.localKey) {
-			const targetIdCol = Object.values(targetTable).find((col) => col.primary);
-			if (!targetIdCol) {
-				const idCol = Object.values(targetTable).find((col) => col.name === "id");
-				if (!idCol) throw new Error("No primary key or \"id\" column found in target table");
-				return Array.isArray(parentId) ? inArray(idCol, parentId) : eq(idCol, parentId);
-			}
-			return Array.isArray(parentId) ? inArray(targetIdCol, parentId) : eq(targetIdCol, parentId);
-		} else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) {
-			const foreignKeyCol = targetTable[relation.foreignKeyOnTarget];
-			if (!foreignKeyCol) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in target table. This might be a many-to-many relationship that requires a junction table. Consider using 'through' property or ensure the corresponding owning relation exists with junction table configuration.`);
-			return Array.isArray(parentId) ? inArray(foreignKeyCol, parentId) : eq(foreignKeyCol, parentId);
-		} else if (relation.direction === "inverse" && relation.cardinality === "many" && relation.inverseRelationName) throw new Error(`Inverse many-to-many relation '${relation.relationName}' requires a junction table. Either specify 'through' property or ensure the corresponding owning relation exists with junction table configuration.`);
-		else if (relation.direction === "inverse" && relation.cardinality === "one" && relation.inverseRelationName) {
-			const inferredForeignKeyName = `${relation.inverseRelationName}_id`;
-			const foreignKeyCol = targetTable[inferredForeignKeyName];
-			if (!foreignKeyCol) throw new Error(`Auto-inferred foreign key column '${inferredForeignKeyName}' not found in target table for inverse relation '${relation.relationName}'. Please specify 'foreignKeyOnTarget' explicitly.`);
-			console.debug(`🔍 [DrizzleConditionBuilder] Auto-inferred foreign key '${inferredForeignKeyName}' for inverse relation '${relation.relationName}'`);
-			return Array.isArray(parentId) ? inArray(foreignKeyCol, parentId) : eq(foreignKeyCol, parentId);
-		} else throw new Error(`Relation '${relation.relationName}' lacks proper configuration. For many-to-many relations, use 'through' property. For simple relations, use 'localKey' or 'foreignKeyOnTarget'.`);
+		const match = (column) => Array.isArray(parentId) ? inArray(column, parentId) : eq(column, parentId);
+		if (relation.kind === "belongsTo") {
+			const targetIdCol = Object.values(targetTable).find((col) => col.primary) ?? Object.values(targetTable).find((col) => col.name === "id");
+			if (!targetIdCol) throw new Error(`No primary key or "id" column in the target table of relation '${relation.relationName}'.`);
+			return match(targetIdCol);
+		}
+		const foreignKeyCol = targetTable[relation.foreignKeyOnTarget];
+		if (!foreignKeyCol) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'. A link through a junction is \`kind: "manyToMany"\`.`);
+		return match(foreignKeyCol);
 	}
 	/**
 	* Combine multiple conditions with AND operator
@@ -776,16 +824,23 @@ var DrizzleConditionBuilder = class {
 		return query;
 	}
 	/**
-	* Build count query for relations with proper joins and conditions
+	* A count over a relation's target rows.
+	*
+	* The junction case counts `distinct` because the caller's query joins the
+	* junction; the owning/inverse pair that used to sit here built the same
+	* query twice.
 	*/
 	static buildRelationCountQuery(baseCountQuery, relation, parentId, targetTable, parentTable, parentIdColumn, targetIdColumn, registry, additionalFilters) {
-		if (relation.joinPath && relation.joinPath.length > 0) return this.buildJoinPathCountQuery(baseCountQuery, relation.joinPath, targetTable, parentTable, parentIdColumn, parentId, registry, additionalFilters);
-		else if (relation.through && relation.cardinality === "many" && relation.direction === "owning") return this.buildJunctionCountQuery(baseCountQuery, relation.through, targetIdColumn, parentId, registry, additionalFilters);
-		else if (relation.through && relation.cardinality === "many" && relation.direction === "inverse") return this.buildInverseJunctionCountQuery(baseCountQuery, relation.through, targetIdColumn, parentId, registry, additionalFilters);
-		else {
-			const allConditions = [this.buildSimpleRelationCondition(relation, targetTable, parentTable, parentId)];
-			if (additionalFilters) allConditions.push(...additionalFilters);
-			return baseCountQuery.where(and(...allConditions));
+		switch (relation.kind) {
+			case "via": return this.buildJoinPathCountQuery(baseCountQuery, relation.joinPath, targetTable, parentTable, parentIdColumn, parentId, registry, additionalFilters);
+			case "manyToMany": return this.buildJunctionCountQuery(baseCountQuery, relation.through, targetIdColumn, parentId, registry, additionalFilters);
+			case "belongsTo":
+			case "hasOne":
+			case "hasMany": {
+				const allConditions = [this.buildSimpleRelationCondition(relation, targetTable, parentTable, parentId), ...additionalFilters ?? []];
+				return baseCountQuery.where(and(...allConditions));
+			}
+			default: throw new Error(`Unknown relation kind: ${JSON.stringify(relation)}`);
 		}
 	}
 	/**
@@ -826,20 +881,6 @@ var DrizzleConditionBuilder = class {
 		return baseCountQuery.innerJoin(junctionTable, eq(targetIdColumn, junctionTargetCol)).where(and(...baseConditions));
 	}
 	/**
-	* Build inverse junction table conditions for count queries
-	*/
-	static buildInverseJunctionCountQuery(baseCountQuery, through, targetIdColumn, parentId, registry, additionalFilters) {
-		const junctionTable = registry.getTable(through.table);
-		if (!junctionTable) throw new Error(`Junction table not found: ${through.table}`);
-		const junctionSourceCol = junctionTable[through.sourceColumn];
-		const junctionTargetCol = junctionTable[through.targetColumn];
-		if (!junctionSourceCol) throw new Error(`Source column '${through.sourceColumn}' not found in junction table '${through.table}'`);
-		if (!junctionTargetCol) throw new Error(`Target column '${through.targetColumn}' not found in junction table '${through.table}'`);
-		const baseConditions = [eq(junctionSourceCol, parentId)];
-		if (additionalFilters && additionalFilters.length > 0) baseConditions.push(...additionalFilters);
-		return baseCountQuery.innerJoin(junctionTable, eq(targetIdColumn, junctionTargetCol)).where(and(...baseConditions));
-	}
-	/**
 	* Helper method to extract table names from columns
 	*/
 	static getTableNamesFromColumns(columns) {
@@ -854,49 +895,6 @@ var DrizzleConditionBuilder = class {
 		return [getColumnName(columns)];
 	}
 	/**
-	* Find the corresponding junction table for an inverse many-to-many relation
-	*/
-	static findCorrespondingJunctionTable(relation, registry) {
-		try {
-			console.debug(`🔍 [findCorrespondingJunctionTable] Looking for junction table for inverse relation '${relation.relationName}' with inverseRelationName '${relation.inverseRelationName}'`);
-			if (!relation.inverseRelationName) {
-				console.debug("🔍 [findCorrespondingJunctionTable] No inverseRelationName specified");
-				return null;
-			}
-			const targetCollection = relation.target();
-			console.debug(`🔍 [findCorrespondingJunctionTable] Target collection: ${targetCollection.slug}`);
-			const targetCollectionRelations = resolveCollectionRelations(targetCollection);
-			console.debug("🔍 [findCorrespondingJunctionTable] Target collection relations:", Object.keys(targetCollectionRelations));
-			const correspondingRelation = targetCollectionRelations[relation.inverseRelationName];
-			if (!correspondingRelation) {
-				console.debug(`🔍 [findCorrespondingJunctionTable] No relation found with key '${relation.inverseRelationName}' on target collection`);
-				return null;
-			}
-			console.debug("🔍 [findCorrespondingJunctionTable] Found relation:", {
-				relationName: correspondingRelation.relationName,
-				cardinality: correspondingRelation.cardinality,
-				direction: correspondingRelation.direction,
-				hasThrough: !!correspondingRelation.through
-			});
-			if (correspondingRelation.cardinality !== "many" || correspondingRelation.direction !== "owning" || !correspondingRelation.through) {
-				console.debug("🔍 [findCorrespondingJunctionTable] Relation is not an owning many-to-many with junction table");
-				return null;
-			}
-			console.debug("🔍 [findCorrespondingJunctionTable] Found matching owning relation with junction table!");
-			const through = correspondingRelation.through;
-			const result = {
-				table: through.table,
-				sourceColumn: through.targetColumn,
-				targetColumn: through.sourceColumn
-			};
-			console.debug("🔍 [findCorrespondingJunctionTable] Returning junction info:", result);
-			return result;
-		} catch (error) {
-			logger.error(`🔍 [findCorrespondingJunctionTable] Error finding corresponding junction table for relation '${relation.relationName}'`, { error });
-			return null;
-		}
-	}
-	/**
 	* Build vector similarity search expressions for pgvector.
 	*
 	* Returns:
@@ -973,7 +971,7 @@ function serializeDataToServer(row, properties, collection, registry) {
 	const joinPathRelationUpdates = [];
 	const foreignKeys = /* @__PURE__ */ new Set();
 	Object.values(resolvedRelations).forEach((relation) => {
-		if (relation.localKey) foreignKeys.add(relation.localKey);
+		if (relation.kind === "belongsTo") foreignKeys.add(relation.localKey);
 	});
 	for (const [key, value] of Object.entries(row)) {
 		const property = properties[key];
@@ -985,11 +983,11 @@ function serializeDataToServer(row, properties, collection, registry) {
 		if (property.type === "relation" && collection) {
 			const relation = findRelation(resolvedRelations, key);
 			if (relation) {
-				if (relation.direction === "owning" && relation.localKey) {
+				if (relation.kind === "belongsTo") {
 					const serializedValue = serializePropertyToServer(effectiveValue, property);
 					if (serializedValue !== void 0) result[relation.localKey] = serializedValue;
 					continue;
-				} else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) {
+				} else if (hasForeignKeyOnTarget(relation)) {
 					const serializedValue = serializePropertyToServer(effectiveValue, property);
 					inverseRelationUpdates.push({
 						relationKey: key,
@@ -997,7 +995,7 @@ function serializeDataToServer(row, properties, collection, registry) {
 						newValue: serializedValue
 					});
 					continue;
-				} else if (relation.direction === "inverse" && relation.joinPath && relation.joinPath.length > 0) {
+				} else if (relation.kind === "via") {
 					const serializedValue = serializePropertyToServer(effectiveValue, property);
 					if (relation.cardinality === "one") joinPathRelationUpdates.push({
 						relationKey: key,
@@ -1010,14 +1008,6 @@ function serializeDataToServer(row, properties, collection, registry) {
 						newValue: serializedValue
 					});
 					continue;
-				} else if (relation.cardinality === "one" && relation.direction === "owning" && relation.joinPath && relation.joinPath.length > 0) {
-					const serializedValue = serializePropertyToServer(effectiveValue, property);
-					joinPathRelationUpdates.push({
-						relationKey: key,
-						relation,
-						newTargetId: serializedValue
-					});
-					continue;
 				}
 			}
 		}
@@ -1103,7 +1093,7 @@ async function parseDataFromServer(data, collection, db, registry) {
 	for (const [propKey, property] of Object.entries(properties)) if (property.type === "relation" && !(propKey in result)) {
 		const relation = findRelation(resolvedRelations, propKey);
 		if (relation) {
-			if (relation.direction === "owning" && relation.localKey && relation.localKey in data) {
+			if (relation.kind === "belongsTo" && relation.localKey in data) {
 				const fkValue = data[relation.localKey];
 				if (fkValue !== null && fkValue !== void 0) try {
 					const targetCollection = relation.target();
@@ -1111,7 +1101,7 @@ async function parseDataFromServer(data, collection, db, registry) {
 				} catch (e) {
 					logger.warn(`Could not resolve target collection for relation property: ${propKey}`, { error: e });
 				}
-			} else if (relation.direction === "inverse" && relation.foreignKeyOnTarget && db && registry) try {
+			} else if (hasForeignKeyOnTarget(relation) && db && registry) try {
 				const targetCollection = relation.target();
 				const targetTable = registry.getTable(getTableName$1(targetCollection));
 				const currentId = buildCompositeId(data, getPrimaryKeys(collection, registry));
@@ -1132,7 +1122,7 @@ async function parseDataFromServer(data, collection, db, registry) {
 			} catch (e) {
 				logger.warn(`Could not resolve inverse relation property: ${propKey}`, { error: e });
 			}
-			else if (relation.direction === "inverse" && relation.joinPath && db && registry) try {
+			else if (relation.kind === "via" && db && registry) try {
 				const targetCollection = relation.target();
 				const pks = getPrimaryKeys(collection, registry);
 				const currentId = buildCompositeId(data, pks);
@@ -1249,11 +1239,10 @@ function parsePropertyFromServer(value, property, collection, propertyKey) {
 		}
 		case "relation":
 			if (typeof value === "string" || typeof value === "number") {
-				let relationDef = property.relation;
+				let relationDef = property.resolvedRelation;
 				if (!relationDef && propertyKey) relationDef = findRelation(resolveCollectionRelations(collection), propertyKey);
-				if (!relationDef) relationDef = collection.relations?.find((rel) => rel.relationName === property.relationName);
 				if (!relationDef) {
-					logger.warn(`Relation not defined in property for key: ${propertyKey || "unknown"}`);
+					logger.warn(`ResolvedRelation not defined in property for key: ${propertyKey || "unknown"}`);
 					return value;
 				}
 				try {
@@ -1353,7 +1342,7 @@ function normalizeScalarValues(data, properties, collection, resolvedRelations,
 	const result = {};
 	const internalFKColumns = /* @__PURE__ */ new Set();
 	Object.values(resolvedRelations).forEach((relation) => {
-		if (relation.localKey && !properties[relation.localKey]) internalFKColumns.add(relation.localKey);
+		if (relation.kind === "belongsTo" && !properties[relation.localKey]) internalFKColumns.add(relation.localKey);
 	});
 	for (const [key, value] of Object.entries(data)) {
 		if (internalFKColumns.has(key)) {
@@ -1491,7 +1480,7 @@ var RelationService = class {
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
-		if (relation.joinPath && relation.joinPath.length > 0) {
+		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
 			let currentTable = parentTable;
 			for (const join of relation.joinPath) {
@@ -1551,6 +1540,18 @@ var RelationService = class {
 			const available = Object.keys(resolvedRelations).join(", ") || "(none)";
 			throw new Error(`Relation '${relationKey}' not found in collection '${parentCollectionPath}'. Available relations: [${available}]`);
 		}
+		return this.countRelatedRows(parentCollection, parentId, relation, []);
+	}
+	/**
+	* Count the target rows a parent reaches through `relation`, narrowed by
+	* `additionalFilters` (conditions on the target table).
+	*
+	* Shared by the public count and by {@link isRelated}, so "how many children
+	* does this parent have" and "is this row one of them" are answered by the
+	* same join — a membership test that reconstructed the join separately would
+	* be free to disagree with the listing it is supposed to gate.
+	*/
+	async countRelatedRows(parentCollection, parentId, relation, additionalFilters) {
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
 		const targetIdField = targetTable[requirePrimaryKeys(targetCollection, this.registry)[0].fieldName];
@@ -1561,11 +1562,54 @@ var RelationService = class {
 		if (!parentTable) throw new Error("Parent table not found");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
 		let query = this.db.select({ count: sql`count(distinct ${targetIdField})` }).from(targetTable).$dynamic();
-		query = DrizzleConditionBuilder.buildRelationCountQuery(query, relation, parsedParentId, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
+		query = DrizzleConditionBuilder.buildRelationCountQuery(query, relation, parsedParentId, targetTable, parentTable, parentIdCol, targetIdField, this.registry, additionalFilters);
 		const result = await query;
 		return Number(result[0]?.count || 0);
 	}
 	/**
+	* Whether `targetId` is actually reachable from the parent named in `hop`.
+	*
+	* A nested address like `authors/1/posts/43` used to resolve to the target
+	* collection and then match on the primary key alone, so the parent segment
+	* decided nothing: the row came back, and was updated or deleted, whoever it
+	* belonged to. Reads, updates and deletes now all gate on this.
+	*/
+	async isRelated(hop, targetId) {
+		const targetTable = getTableForCollection(hop.targetCollection, this.registry);
+		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
+		const parsedTargetId = parseIdValues(targetId, targetPks);
+		const identity = targetPks.map((pk) => {
+			const column = targetTable[pk.fieldName];
+			if (!column) throw new Error(`ID field '${pk.fieldName}' not found in table for collection '${hop.targetCollection.slug}'`);
+			return eq(column, parsedTargetId[pk.fieldName]);
+		});
+		return await this.countRelatedRows(hop.parentCollection, hop.parentId, hop.relation, identity) > 0;
+	}
+	/**
+	* Remove the junction row linking a parent to `targetId`, leaving the target
+	* row itself alone.
+	*
+	* This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
+	* target is shared, so deleting the row would remove the tag from every other
+	* post that uses it. It used to do exactly that — resolve the path to the
+	* `tags` table and delete by primary key.
+	*/
+	async unlinkRelatedEntity(tx, hop, targetId) {
+		if (!isManyToMany(hop.relation)) throw new Error(`Relation '${hop.relationKey}' has no junction table to unlink through`);
+		const through = hop.relation.through;
+		const junctionTable = this.registry.getTable(through.table);
+		if (!junctionTable) throw new Error(`Junction table not found: ${through.table}`);
+		const sourceJunctionColumn = junctionTable[through.sourceColumn];
+		const targetJunctionColumn = junctionTable[through.targetColumn];
+		if (!sourceJunctionColumn || !targetJunctionColumn) throw new Error(`Junction columns not found for relation '${hop.relationKey}' on table '${through.table}'`);
+		const parentPks = requirePrimaryKeys(hop.parentCollection, this.registry);
+		const parsedParentId = parseIdValues(hop.parentId, parentPks)[parentPks[0].fieldName];
+		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
+		const parsedTargetId = parseIdValues(targetId, targetPks)[targetPks[0].fieldName];
+		await tx.delete(junctionTable).where(and(eq(sourceJunctionColumn, parsedParentId), eq(targetJunctionColumn, parsedTargetId)));
+		logger.info(`Unlinked '${hop.relationKey}' ${parsedTargetId} from ${hop.parentCollection.slug} ${parsedParentId}`);
+	}
+	/**
 	* Batch fetch related rows for multiple parent rows to avoid N+1 queries
 	*/
 	async batchFetchRelatedEntities(parentCollectionPath, parentIds, _relationKey, relation) {
@@ -1582,7 +1626,7 @@ var RelationService = class {
 		if (!parentTable) throw new Error("Parent table not found");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
 		const parsedParentIds = parentIds.map((id) => parseIdValues(id, parentPks)[parentIdInfo.fieldName]);
-		if (relation.joinPath && relation.joinPath.length > 0) {
+		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
 			let currentTable = parentTable;
 			for (const join of relation.joinPath) {
@@ -1611,7 +1655,7 @@ var RelationService = class {
 			}
 			return resultMap;
 		}
-		if (relation.direction === "owning" && relation.localKey) {
+		if (relation.kind === "belongsTo") {
 			this.assertSingleKeyAddressable(parentCollection, parentPks, relation.localKey);
 			const localKeyCol = parentTable[relation.localKey];
 			if (!localKeyCol) throw new Error(`Local key column '${relation.localKey}' not found in parent table`);
@@ -1645,7 +1689,7 @@ var RelationService = class {
 			}
 			return resultMap;
 		}
-		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
+		this.assertSingleKeyAddressable(parentCollection, parentPks, hasForeignKeyOnTarget(relation) ? relation.foreignKeyOnTarget : relation.relationName);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -1654,8 +1698,7 @@ var RelationService = class {
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
 			let parentId;
-			if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
-			else if (relation.direction === "inverse" && relation.cardinality === "one" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
+			if (hasForeignKeyOnTarget(relation)) parentId = targetRow[relation.foreignKeyOnTarget];
 			if (parentId !== void 0 && parentIdSet.has(String(parentId))) resultMap.set(String(parentId), await this.toRelatedRow(targetRow, targetCollection, targetPks));
 		}
 		return resultMap;
@@ -1678,7 +1721,7 @@ var RelationService = class {
 		if (!parentTable) throw new Error("Parent table not found");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
 		const parsedParentIds = parentIds.map((id) => parseIdValues(id, parentPks)[parentIdInfo.fieldName]);
-		if (relation.joinPath && relation.joinPath.length > 0) {
+		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
 			let currentTable = parentTable;
 			for (const join of relation.joinPath) {
@@ -1708,7 +1751,7 @@ var RelationService = class {
 			}
 			return resultMap;
 		}
-		if (relation.through && relation.cardinality === "many" && relation.direction === "owning") {
+		if (relation.kind === "manyToMany") {
 			this.assertSingleKeyAddressable(parentCollection, parentPks, `${relation.through.table}.${relation.through.sourceColumn}`);
 			const junctionTable = this.registry.getTable(relation.through.table);
 			if (!junctionTable) {
@@ -1734,7 +1777,7 @@ var RelationService = class {
 			}
 			return resultMap;
 		}
-		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
+		this.assertSingleKeyAddressable(parentCollection, parentPks, hasForeignKeyOnTarget(relation) ? relation.foreignKeyOnTarget : relation.relationName);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -1743,9 +1786,7 @@ var RelationService = class {
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
 			let parentId;
-			if (relation.through && relation.direction === "inverse") parentId = (row[relation.through.table] || row)[relation.through.targetColumn];
-			else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
-			else if (relation.direction === "inverse" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
+			if (hasForeignKeyOnTarget(relation)) parentId = targetRow[relation.foreignKeyOnTarget];
 			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
 				const key = String(parentId);
 				const arr = resultMap.get(key) || [];
@@ -1765,7 +1806,7 @@ var RelationService = class {
 			if (!relation || relation.cardinality !== "many") continue;
 			const targetEntityIds = value && Array.isArray(value) ? value.map((rel) => rel.id) : [];
 			const targetCollection = relation.target();
-			if (relation.joinPath && relation.joinPath.length > 0) {
+			if (relation.kind === "via") {
 				const parentTableName = getTableName$1(collection);
 				const targetTableName = getTableName$1(targetCollection);
 				let junctionTable = void 0;
@@ -1810,7 +1851,7 @@ var RelationService = class {
 					}));
 					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
 				}
-			} else if (relation.through && relation.cardinality === "many" && relation.direction === "owning") {
+			} else if (relation.kind === "manyToMany") {
 				const junctionTable = this.registry.getTable(relation.through.table);
 				if (!junctionTable) {
 					logger.warn(`Junction table '${relation.through.table}' not found for relation '${key}' in collection '${collection.slug}'`);
@@ -1835,8 +1876,7 @@ var RelationService = class {
 					}));
 					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
 				}
-			} else if (relation.through && relation.cardinality === "many" && relation.direction === "inverse") logger.warn(`[updateRelationsUsingJoins] Inverse M2M relation '${key}' in collection '${collection.slug}' should be saved from the owning side. Skipping.`);
-			else if (relation.cardinality === "many" && relation.direction === "inverse" && relation.foreignKeyOnTarget) {
+			} else if (relation.cardinality === "many" && hasForeignKeyOnTarget(relation)) {
 				const targetTable = getTableForCollection(targetCollection, this.registry);
 				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
@@ -1870,28 +1910,20 @@ var RelationService = class {
 				const targetIdInfo = targetPks[0];
 				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
-				if (relation.direction === "inverse" && relation.joinPath && relation.joinPath.length > 0) {
+				if (relation.kind === "via") {
 					await this.updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue);
 					continue;
 				}
-				if (relation.cardinality === "many" && relation.direction === "inverse") {
-					const targetCollectionRelations = resolveCollectionRelations(targetCollection);
-					let junctionInfo = null;
-					for (const [relationKey, targetRelation] of Object.entries(targetCollectionRelations)) if (targetRelation.cardinality === "many" && targetRelation.direction === "owning" && targetRelation.through && (targetRelation.relationName === relation.inverseRelationName || relationKey === relation.inverseRelationName)) {
-						junctionInfo = {
-							table: targetRelation.through.table,
-							sourceColumn: targetRelation.through.targetColumn,
-							targetColumn: targetRelation.through.sourceColumn
-						};
-						break;
-					}
-					if (junctionInfo) {
-						await this.updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, junctionInfo);
-						continue;
-					}
+				if (isManyToMany(relation)) {
+					await this.updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, {
+						table: relation.through.table,
+						sourceColumn: relation.through.sourceColumn,
+						targetColumn: relation.through.targetColumn
+					});
+					continue;
 				}
-				if (!relation.foreignKeyOnTarget) {
-					logger.warn(`Inverse relation '${relation.relationName}' is missing foreignKeyOnTarget property. Skipping.`);
+				if (!hasForeignKeyOnTarget(relation)) {
+					logger.warn(`Relation '${relation.relationName}' has no column on the target to write. Skipping.`);
 					continue;
 				}
 				const foreignKeyColumn = targetTable[relation.foreignKeyOnTarget];
@@ -1917,10 +1949,6 @@ var RelationService = class {
 	*/
 	async updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue) {
 		try {
-			if (!relation.joinPath || relation.joinPath.length === 0) {
-				logger.warn(`Inverse relation '${relation.relationName}' missing joinPath`);
-				return;
-			}
 			const sourceTableName = getTableName$1(sourceCollection);
 			const targetTableName = getTableName$1(targetCollection);
 			const intermediateTables = relation.joinPath.map((step) => step.table).filter((table) => table !== sourceTableName && table !== targetTableName);
@@ -2102,8 +2130,8 @@ var RelationService = class {
 				[sourceJunctionColumn.name]: parentId,
 				[targetJunctionColumn.name]: parsedNewEntityId
 			};
-			await tx.insert(junctionTable).values(junctionData);
-			logger.info(`Created junction table entry for many-to-many relation '${relationKey}': ${JSON.stringify(junctionData)}`);
+			await tx.insert(junctionTable).values(junctionData).onConflictDoNothing();
+			logger.info(`Linked '${relationKey}' ${parsedNewEntityId} to ${parentId}`);
 		} catch (error) {
 			logger.error(`Failed to create junction table entry for relation '${relationKey}'`, { error });
 			throw error;
@@ -2120,9 +2148,8 @@ var RelationService = class {
 * to unwrap that same level back out.
 */
 function isJunctionRelation(relation) {
-	if (relation.through) return true;
-	if (relation.joinPath && relation.joinPath.length > 1) return true;
-	return false;
+	if (isManyToMany(relation)) return true;
+	return relation.kind === "via" && relation.joinPath.length > 1;
 }
 /**
 * Reach the target row inside a junction row.
@@ -2255,6 +2282,82 @@ function toRestRow(row, collection, registry) {
 	return stripExcluded(flat, collection);
 }
 //#endregion
+//#region src/services/nested-path.ts
+/**
+* True when `path` addresses rows through a relation rather than a root
+* collection.
+*
+* Any separator at all counts — a root collection slug never contains one — so
+* a malformed path like `collection/id` is a *broken* nested path and gets
+* reported as one by {@link resolveNestedPath}, rather than being looked up as
+* a root collection whose slug happens to contain a slash.
+*/
+function isNestedPath(path) {
+	return path.includes("/");
+}
+function splitPathSegments(path) {
+	return path.split("/").filter((s) => s && s !== "undefined");
+}
+/**
+* Walk a nested collection path down to the relation it ends in.
+*
+* Returns `undefined` for a plain root-collection path so callers can keep the
+* root case on its existing code path. Throws when the path is malformed, or
+* when a segment names a relation that does not exist — the same errors the
+* individual walks used to raise, with the available names attached.
+*/
+function resolveNestedPath(path, registry) {
+	if (!isNestedPath(path)) return void 0;
+	const segments = splitPathSegments(path);
+	if (segments.length < 3 || segments.length % 2 === 0) throw new Error(`Invalid relation path: ${path}. Expected format: collection/id/relation`);
+	let parentCollection = getCollectionByPath(segments[0], registry);
+	let parentId = segments[1];
+	for (let i = 2; i < segments.length; i += 2) {
+		const relationKey = segments[i];
+		const resolvedRelations = resolveCollectionRelations(parentCollection);
+		const relation = findRelation(resolvedRelations, relationKey);
+		if (!relation) {
+			const available = Object.keys(resolvedRelations).join(", ") || "(none)";
+			throw new Error(`Relation '${relationKey}' not found in collection '${parentCollection.slug}'. Available relations: [${available}]`);
+		}
+		const targetCollection = relation.target();
+		if (i === segments.length - 1) return {
+			parentCollection,
+			parentId,
+			relationKey,
+			relation,
+			targetCollection
+		};
+		parentCollection = targetCollection;
+		parentId = segments[i + 1];
+	}
+	throw new Error(`Unable to resolve path: ${path}`);
+}
+/**
+* A relation reached through a junction table — many-to-many, or a multi-hop
+* `joinPath`. The target row is shared with other parents, so writing "through"
+* such a path addresses the *link*, not the row.
+*/
+function isJunctionBackedRelation(relation) {
+	return relation.shared;
+}
+/**
+* Reject a nested write whose final segment is a to-one relation.
+*
+* There is no column on the target row that records a to-one parent — the
+* foreign key lives on the *parent* table. The write path used to fall through
+* to `relation.localKey` here and stamp the parent's own FK column onto the
+* target row, which either raised an opaque "column does not exist" or, when a
+* column of that name happened to exist on the target, silently wrote the wrong
+* one.
+*/
+function assertWritableThrough(hop, path) {
+	const { relation } = hop;
+	if (relation.writable && relation.cardinality === "many") return;
+	if (!relation.writable) throw ApiError.badRequest(`"${path}" ends in '${hop.relationKey}', a \`via\` relation. Rebase will not infer how to write through an arbitrary join chain — write the row at "${hop.targetCollection.slug}" directly.`, "RELATION_NOT_WRITABLE");
+	throw ApiError.badRequest(`"${path}" ends in the to-one relation '${hop.relationKey}', which cannot be written through: the foreign key for a to-one relation lives on '${hop.parentCollection.slug}', not on '${hop.targetCollection.slug}'. Write the target row at "${hop.targetCollection.slug}" and set '${hop.relationKey}' on the parent instead.`, "RELATION_NOT_WRITABLE");
+}
+//#endregion
 //#region src/services/FetchService.ts
 /**
 * Service for handling all row read operations.
@@ -2291,7 +2394,7 @@ var FetchService = class {
 		let orderByField = table[orderBy];
 		if (!orderByField && collection) {
 			const property = collection.properties[orderBy];
-			if (property && property.type === "relation" && "relation" in property && property.relation?.direction === "owning") orderByField = table[`${orderBy}_id`];
+			if (property && property.type === "relation" && "relation" in property && property.resolvedRelation?.kind === "belongsTo") orderByField = table[`${orderBy}_id`];
 		}
 		return orderByField;
 	}
@@ -2312,7 +2415,7 @@ var FetchService = class {
 		for (const [key, relation] of Object.entries(resolvedRelations)) {
 			if (!shouldInclude(key)) continue;
 			const drizzleRelName = relation.relationName || key;
-			if (relation.joinPath && relation.joinPath.length > 0) continue;
+			if (relation.kind === "via") continue;
 			if (relation.cardinality === "many" && isJunctionRelation(relation)) {
 				const targetFkName = this.getJunctionTargetRelationName(relation, collection);
 				if (targetFkName) withConfig[drizzleRelName] = { with: { [targetFkName]: true } };
@@ -2326,7 +2429,7 @@ var FetchService = class {
 	* For example, for posts_tags junction, this returns "tag_id" (the relation pointing to tags).
 	*/
 	getJunctionTargetRelationName(relation, _collection) {
-		if (relation.through) return relation.through.targetColumn.replace(/_id$/, "_id");
+		if (isManyToMany(relation)) return relation.through.targetColumn.replace(/_id$/, "_id");
 		return null;
 	}
 	/**
@@ -2336,7 +2439,7 @@ var FetchService = class {
 	*/
 	async resolveJoinPathRelations(row, collection, collectionPath, parsedId, _databaseId) {
 		const resolvedRelations = resolveCollectionRelations(collection);
-		const promises = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0).map(async ([key, relation]) => {
+		const promises = Object.entries(resolvedRelations).filter(([key, relation]) => relation.kind === "via").map(async ([key, relation]) => {
 			try {
 				const relatedRows = await this.relationService.fetchRelatedEntities(collectionPath, parsedId, key, { limit: relation.cardinality === "one" ? 1 : void 0 });
 				if (relation.cardinality === "one" && relatedRows.length > 0) {
@@ -2358,7 +2461,7 @@ var FetchService = class {
 		const resolvedRelations = resolveCollectionRelations(collection);
 		const propertyKeys = new Set(Object.keys(collection.properties || {}));
 		const shouldInclude = (key) => !include || include.length === 0 || include[0] === "*" || include.includes(key);
-		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0 && propertyKeys.has(key) && shouldInclude(key));
+		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.kind === "via" && propertyKeys.has(key) && shouldInclude(key));
 		if (joinPathRelations.length === 0) return;
 		const parentIdOf = (row) => {
 			const address = buildCompositeId(row, idInfoArray);
@@ -2386,10 +2489,11 @@ var FetchService = class {
 	* Build db.query-compatible options from standard fetch options.
 	* Handles filter, search, orderBy, limit, and cursor-based pagination.
 	*/
-	buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig) {
+	buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig, scopeCondition) {
 		const queryOpts = {};
 		if (withConfig) queryOpts.with = withConfig;
 		const allConditions = [];
+		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
 			const collection = getCollectionByPath(collectionPath, this.registry);
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
@@ -2447,9 +2551,49 @@ var FetchService = class {
 		return [];
 	}
 	/**
+	* Compile "rows reachable from this parent" into a `WHERE` condition on the
+	* target table, so a nested listing can run as an ordinary collection query.
+	*/
+	buildRelationScope(hop) {
+		const parentPks = requirePrimaryKeys(hop.parentCollection, this.registry);
+		const parentIdInfo = parentPks[0];
+		const parsedParentId = parseIdValues(hop.parentId, parentPks)[parentIdInfo.fieldName];
+		const parent = () => {
+			const table = getTableForCollection(hop.parentCollection, this.registry);
+			const idColumn = table[parentIdInfo.fieldName];
+			if (!idColumn) throw new Error(`ID field '${parentIdInfo.fieldName}' not found in table for collection '${hop.parentCollection.slug}'`);
+			return {
+				table,
+				idColumn
+			};
+		};
+		const targetTable = getTableForCollection(hop.targetCollection, this.registry);
+		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
+		const targetIdColumn = targetTable[targetPks[0].fieldName];
+		if (!targetIdColumn) throw new Error(`ID field '${targetPks[0].fieldName}' not found in table for collection '${hop.targetCollection.slug}'`);
+		return DrizzleConditionBuilder.buildRelationScopeCondition(hop.relation, parent, parsedParentId, targetTable, targetIdColumn, this.registry);
+	}
+	/**
+	* Whether `id` is actually reachable at `collectionPath`.
+	*
+	* Trivially true for a root path. For a nested one it is a real question:
+	* the path resolves to the target collection, and matching on the primary
+	* key alone made the parent segment decorative — `authors/1/posts/43`
+	* returned post 43 whoever wrote it, and the REST layer's delete then
+	* deleted it. A row that is not under this parent is reported as absent,
+	* which is what a caller addressing it through the parent should see.
+	*/
+	async isAddressableUnder(collectionPath, id) {
+		if (!isNestedPath(collectionPath)) return true;
+		const hop = resolveNestedPath(collectionPath, this.registry);
+		if (!hop) return true;
+		return this.relationService.isRelated(hop, id);
+	}
+	/**
 	* Fetch a single row by ID
 	*/
 	async fetchOne(collectionPath, id, databaseId) {
+		if (!await this.isAddressableUnder(collectionPath, id)) return void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2471,7 +2615,7 @@ var FetchService = class {
 			return flatRow;
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
-				logger.error(`[FetchService] Relation inference error for collection '${collectionPath}': ${e.message}`);
+				logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
 				logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
 			}
 			logger.warn(`[FetchService] db.query.findFirst failed for ${collectionPath}, falling back to db.select`, { error: e });
@@ -2506,6 +2650,7 @@ var FetchService = class {
 	* Unified method to fetch rows with optional search functionality
 	*/
 	async fetchRowsWithConditions(collectionPath, options = {}) {
+		const scopeCondition = options.relatedTo ? this.buildRelationScope(options.relatedTo) : void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2517,11 +2662,11 @@ var FetchService = class {
 		const withConfig = this.buildWithConfig(collection);
 		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
 		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
-			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0);
+			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0, scopeCondition);
 			return (await qb.findMany(queryOpts)).map((row) => toCmsRow(row, collection, this.registry));
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
-				logger.error(`[FetchService] Relation inference error for collection '${collectionPath}': ${e.message}`);
+				logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
 				logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
 			}
 			logger.warn(`[FetchService] db.query.findMany failed for ${collectionPath}, falling back to db.select`, { error: e });
@@ -2533,6 +2678,7 @@ var FetchService = class {
 			_distance: vectorMeta.distanceSelect
 		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
+		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
 			if (searchConditions.length === 0) return [];
@@ -2637,7 +2783,11 @@ var FetchService = class {
 	* Fetch a collection of rows
 	*/
 	async fetchCollection(collectionPath, options = {}) {
-		if (collectionPath.includes("/")) return this.fetchCollectionFromPath(collectionPath, options);
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		if (hop) return this.fetchRowsWithConditions(hop.targetCollection.slug, {
+			...options,
+			relatedTo: hop
+		});
 		return this.fetchRowsWithConditions(collectionPath, options);
 	}
 	/**
@@ -2650,43 +2800,23 @@ var FetchService = class {
 		});
 	}
 	/**
-	* Fetch collection from multi-segment path
-	*/
-	async fetchCollectionFromPath(path, options = {}) {
-		const pathSegments = path.split("/").filter((p) => p && p !== "undefined");
-		if (pathSegments.length < 3 || pathSegments.length % 2 === 0) throw new Error(`Invalid relation path: ${path}. Expected format: collection/id/relation`);
-		const rootCollectionPath = pathSegments[0];
-		let currentCollection = getCollectionByPath(rootCollectionPath, this.registry);
-		let currentId = pathSegments[1];
-		for (let i = 2; i < pathSegments.length; i += 2) {
-			const relationKey = pathSegments[i];
-			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
-			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
-			if (i === pathSegments.length - 1) return (await this.relationService.fetchRelatedEntities(currentCollection.slug, currentId, relationKey, options)).map((row) => ({ ...row.values }));
-			if (i + 1 < pathSegments.length) {
-				const nextEntityId = pathSegments[i + 1];
-				currentCollection = relation.target();
-				currentId = nextEntityId;
-			}
-		}
-		throw new Error(`Unable to resolve path: ${path}`);
-	}
-	/**
 	* Count rows in a collection
 	*/
 	async count(collectionPath, options = {}) {
-		if (collectionPath.includes("/")) return this.countEntitiesFromPath(collectionPath, options);
-		const collection = getCollectionByPath(collectionPath, this.registry);
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		const effectivePath = hop ? hop.targetCollection.slug : collectionPath;
+		const collection = getCollectionByPath(effectivePath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		let query = this.db.select({ count: count() }).from(table).$dynamic();
 		const allConditions = [];
+		if (hop) allConditions.push(this.buildRelationScope(hop));
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
 			if (searchConditions.length === 0) return 0;
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
 		if (options.filter) {
-			const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
+			const filterConditions = this.buildFilterConditions(options.filter, table, effectivePath);
 			if (filterConditions.length > 0) allConditions.push(...filterConditions);
 		}
 		if (allConditions.length > 0) {
@@ -2697,27 +2827,6 @@ var FetchService = class {
 		return Number(result[0]?.count || 0);
 	}
 	/**
-	* Count rows from multi-segment path
-	*/
-	async countEntitiesFromPath(path, options = {}) {
-		const pathSegments = path.split("/").filter((p) => p && p !== "undefined");
-		if (pathSegments.length < 3 || pathSegments.length % 2 === 0) throw new Error(`Invalid relation path: ${path}`);
-		const rootCollectionPath = pathSegments[0];
-		let currentCollection = getCollectionByPath(rootCollectionPath, this.registry);
-		let currentId = pathSegments[1];
-		for (let i = 2; i < pathSegments.length; i += 2) {
-			const relationKey = pathSegments[i];
-			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
-			if (!relation) throw new Error(`Relation '${relationKey}' not found`);
-			if (i === pathSegments.length - 1) return this.relationService.countRelatedEntities(currentCollection.slug, currentId, relationKey, options);
-			if (i + 1 < pathSegments.length) {
-				currentCollection = relation.target();
-				currentId = pathSegments[i + 1];
-			}
-		}
-		throw new Error(`Unable to count for path: ${path}`);
-	}
-	/**
 	* Check if a field value is unique
 	*/
 	async checkUniqueField(collectionPath, fieldName, value, excludeEntityId, _databaseId) {
@@ -2749,6 +2858,14 @@ var FetchService = class {
 	* @param include - Array of relation keys to populate, or ["*"] for all
 	*/
 	async fetchCollectionForRest(collectionPath, options = {}, include) {
+		if (isNestedPath(collectionPath)) {
+			const hop = resolveNestedPath(collectionPath, this.registry);
+			if (hop) return this.fetchCollectionForRest(hop.targetCollection.slug, {
+				...options,
+				relatedTo: hop
+			}, include);
+		}
+		const scopeCondition = options.relatedTo ? this.buildRelationScope(options.relatedTo) : void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2758,13 +2875,13 @@ var FetchService = class {
 		const qb = this.getQueryBuilder(tableName);
 		if (qb && !options.searchString && !options.vectorSearch) try {
 			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
-			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig);
+			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig, scopeCondition);
 			const restRows = (await qb.findMany(queryOpts)).map((row) => toRestRow(row, collection, this.registry));
 			await this.resolveJoinPathRelationsBatchRest(restRows, collection, collectionPath, idInfoArray, include);
 			return restRows;
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
-				logger.error(`[FetchService] Relation inference error for collection '${collectionPath}': ${e.message}`);
+				logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
 				logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
 			}
 			logger.warn(`[fetchCollectionForRest] db.query.findMany failed for ${collectionPath}, falling back`, { error: e });
@@ -2806,6 +2923,7 @@ var FetchService = class {
 	* Fetch a single row with optional relation includes for REST API.
 	*/
 	async fetchOneForRest(collectionPath, id, include, databaseId) {
+		if (!await this.isAddressableUnder(collectionPath, id)) return null;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2826,7 +2944,7 @@ var FetchService = class {
 			return restRow;
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
-				logger.error(`[FetchService] Relation inference error for collection '${collectionPath}': ${e.message}`);
+				logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
 				logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
 			}
 			logger.warn(`[fetchOneForRest] db.query.findFirst failed for ${collectionPath}, falling back`, { error: e });
@@ -2874,6 +2992,7 @@ var FetchService = class {
 			_distance: vectorMeta.distanceSelect
 		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
+		if (options.relatedTo) allConditions.push(this.buildRelationScope(options.relatedTo));
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
 			if (searchConditions.length === 0) return [];
@@ -2973,7 +3092,7 @@ var FetchService = class {
 		if (parentIds.length === 0) return /* @__PURE__ */ new Map();
 		const relation = resolveCollectionRelations(getCollectionByPath(parentCollectionPath, this.registry))[relationKey];
 		if (!relation) {
-			logger.warn(`[batchFetchManyRelatedRows] Relation '${relationKey}' not found, skipping`);
+			logger.warn(`[batchFetchManyRelatedRows] ResolvedRelation '${relationKey}' not found, skipping`);
 			return /* @__PURE__ */ new Map();
 		}
 		const entityMap = await this.relationService.batchFetchRelatedEntitiesMany(parentCollectionPath, parentIds, relationKey, relation);
@@ -3193,6 +3312,16 @@ var PersistService = class {
 	* Delete an row by ID
 	*/
 	async delete(collectionPath, id, _databaseId) {
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		if (hop) {
+			assertWritableThrough(hop, collectionPath);
+			if (!await this.relationService.isRelated(hop, id)) throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to delete.`);
+			if (isJunctionBackedRelation(hop.relation)) {
+				if (!isManyToMany(hop.relation)) throw ApiError.badRequest(`"${collectionPath}" reaches '${hop.targetCollection.slug}' through a multi-hop joinPath, so there is no single link to remove. Delete the row at "${hop.targetCollection.slug}" directly if that is what you meant.`, "RELATION_NOT_UNLINKABLE");
+				await this.relationService.unlinkRelatedEntity(this.db, hop, id);
+				return;
+			}
+		}
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = getPrimaryKeys(collection, this.registry);
@@ -3213,6 +3342,26 @@ var PersistService = class {
 		await this.db.delete(table);
 	}
 	/**
+	* The column on the *target* table that records the parent, for a create
+	* under a nested one-to-many path.
+	*
+	* Returns `undefined` when the link is not a column at all (a multi-hop
+	* `joinPath`), so the caller writes the row without stamping anything.
+	*
+	* `relation.localKey` is deliberately not consulted: it names a column on
+	* the *source* table. Falling back to it here — which is what this used to
+	* do, and first — stamped the parent's own foreign key onto the child row.
+	*/
+	resolveParentForeignKeyColumn(hop) {
+		const { relation } = hop;
+		switch (relation.kind) {
+			case "hasOne":
+			case "hasMany": return relation.foreignKeyOnTarget;
+			case "via": return relation.joinPath.length === 1 ? DrizzleConditionBuilder.getColumnNamesFromColumns(relation.joinPath[0].on.to)[0] : void 0;
+			default: return;
+		}
+	}
+	/**
 	* Save an row (create or update)
 	*
 	* With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
@@ -3225,60 +3374,29 @@ var PersistService = class {
 		let effectiveCollectionPath = collectionPath;
 		const effectiveValues = { ...values };
 		let junctionTableInfo;
-		if (collectionPath.includes("/")) {
-			const segments = collectionPath.split("/").filter(Boolean);
-			if (segments.length >= 3 && segments.length % 2 === 1) {
-				const rootSegment = segments[0];
-				let currentCollection = getCollectionByPath(rootSegment, this.registry);
-				let currentId = segments[1];
-				for (let i = 2; i < segments.length; i += 2) {
-					const relationKey = segments[i];
-					const resolvedRelations = resolveCollectionRelations(currentCollection);
-					const relation = findRelation(resolvedRelations, relationKey);
-					if (!relation) {
-						const available = Object.keys(resolvedRelations).join(", ") || "(none)";
-						throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'. Available relations: [${available}]`);
-					}
-					if (i === segments.length - 1) {
-						const targetCollection = relation.target();
-						effectiveCollectionPath = targetCollection.slug;
-						if (relation.cardinality === "many" && relation.through) {
-							const parentIdInfoArray = getPrimaryKeys(currentCollection, this.registry);
-							const parentIdInfo = parentIdInfoArray[0];
-							const parsedParentId = parseIdValues(currentId, parentIdInfoArray)[parentIdInfo.fieldName];
-							junctionTableInfo = {
-								parentCollection: currentCollection,
-								parentId: parsedParentId,
-								relation,
-								relationKey
-							};
-							break;
-						}
-						let targetColumnName;
-						if (relation.localKey) targetColumnName = relation.localKey;
-						else if (relation.foreignKeyOnTarget) targetColumnName = relation.foreignKeyOnTarget;
-						else if (relation.joinPath && relation.joinPath.length === 1) {
-							const targetTableName = getTableName$1(targetCollection);
-							const relevantJoinStep = relation.joinPath.find((joinStep) => joinStep.table === targetTableName);
-							if (relevantJoinStep) targetColumnName = DrizzleConditionBuilder.getColumnNamesFromColumns(relevantJoinStep.on.to)[0];
-							else {
-								logger.warn(`Could not find specific join step for target table ${targetTableName} in relation '${relationKey}'.`);
-								targetColumnName = DrizzleConditionBuilder.getColumnNamesFromColumns(relation.joinPath[0].on.to)[0];
-							}
-						} else if (relation.joinPath && relation.joinPath.length > 1) break;
-						else throw new Error(`Relation '${relationKey}' lacks configuration for path-based saving.`);
-						const parentIdInfoArray = getPrimaryKeys(currentCollection, this.registry);
-						const parentIdInfo = parentIdInfoArray[0];
-						const parsedParentId = parseIdValues(currentId, parentIdInfoArray)[parentIdInfo.fieldName];
-						const existingValue = effectiveValues[targetColumnName];
-						if (existingValue !== void 0 && existingValue !== null && existingValue !== parsedParentId) logger.warn(`Overriding provided value '${existingValue}' for FK '${targetColumnName}' with path parent id '${parsedParentId}'.`);
-						effectiveValues[targetColumnName] = parsedParentId;
-						break;
-					} else {
-						const nextEntityId = segments[i + 1];
-						currentCollection = relation.target();
-						currentId = nextEntityId;
-					}
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		if (hop) {
+			assertWritableThrough(hop, collectionPath);
+			effectiveCollectionPath = hop.targetCollection.slug;
+			const parentIdForWrite = () => {
+				const parentPks = getPrimaryKeys(hop.parentCollection, this.registry);
+				return parseIdValues(hop.parentId, parentPks)[parentPks[0].fieldName];
+			};
+			if (isManyToMany(hop.relation)) junctionTableInfo = {
+				parentCollection: hop.parentCollection,
+				parentId: parentIdForWrite(),
+				relation: hop.relation,
+				relationKey: hop.relationKey
+			};
+			else if (id !== void 0) {
+				if (!await this.relationService.isRelated(hop, id)) throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to update.`);
+			} else {
+				const targetColumnName = this.resolveParentForeignKeyColumn(hop);
+				if (targetColumnName) {
+					const parsedParentId = parentIdForWrite();
+					const existingValue = effectiveValues[targetColumnName];
+					if (existingValue !== void 0 && existingValue !== null && existingValue !== parsedParentId) logger.warn(`Overriding provided value '${existingValue}' for FK '${targetColumnName}' with path parent id '${parsedParentId}'.`);
+					effectiveValues[targetColumnName] = parsedParentId;
 				}
 			}
 		}
@@ -3349,7 +3467,7 @@ var PersistService = class {
 				}
 				if (inverseRelationUpdates.length > 0) await this.relationService.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
 				if (Object.keys(relationValues).length > 0) await this.relationService.updateRelationsUsingJoins(tx, collection, currentId, relationValues);
-				if (junctionTableInfo && !id) await this.relationService.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
+				if (junctionTableInfo) await this.relationService.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
 				return currentId;
 			});
 		} catch (error) {
@@ -5246,9 +5364,9 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}("${colName}")`;
 			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid("${colName}")`;
 			else if (stringProp.columnType === "uuid") columnDefinition = `uuid("${colName}")`;
-			else if (stringProp.columnType === "text" || stringProp.ui?.markdown || stringProp.ui?.multiline) columnDefinition = `text("${colName}")`;
 			else if (stringProp.columnType === "char") columnDefinition = `char("${colName}")`;
-			else columnDefinition = `varchar("${colName}")`;
+			else if (stringProp.columnType === "varchar") columnDefinition = `varchar("${colName}")`;
+			else columnDefinition = `text("${colName}")`;
 			if (isIdProperty(propName, prop, collection)) columnDefinition += ".primaryKey()";
 			if ("isId" in stringProp && stringProp.isId !== "manual" && stringProp.isId !== true) {
 				if (stringProp.isId === "uuid") columnDefinition += ".defaultRandom()";
@@ -5317,12 +5435,8 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			break;
 		case "relation": {
 			const refProp = prop;
-			const relation = findRelation(resolveCollectionRelations(collection), refProp.relationName ?? propName);
-			if (!relation || relation.direction !== "owning" || relation.cardinality !== "one") return null;
-			if (!relation.localKey) {
-				logger.warn(`Could not generate column for owning relation '${relation.relationName}' on '${collection.name}': 'localKey' is not defined.`);
-				return null;
-			}
+			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+			if (!relation || relation.kind !== "belongsTo") return null;
 			if (collection.properties[relation.localKey] && propName !== relation.localKey) return null;
 			let targetCollection;
 			try {
@@ -5334,7 +5448,7 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
 			const pkProp = getPrimaryKeyProp(targetCollection);
 			const targetIdField = pkProp.name;
-			const baseColumn = pkProp.type === "number" ? `integer("${fkColumnName}")` : pkProp.isUuid ? `uuid("${fkColumnName}")` : `varchar("${fkColumnName}")`;
+			const baseColumn = pkProp.type === "number" ? `integer("${fkColumnName}")` : pkProp.isUuid ? `uuid("${fkColumnName}")` : `text("${fkColumnName}")`;
 			const onUpdate = relation.onUpdate ? `onUpdate: "${relation.onUpdate}"` : "";
 			const required = prop.validation?.required;
 			const refOptionsParts = [onUpdate, `onDelete: \"${relation.onDelete ?? (required ? "cascade" : "set null")}\"`].filter(Boolean);
@@ -5347,13 +5461,13 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			const refProp = prop;
 			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName$1(c) === refProp.path);
 			if (!targetCollection) {
-				columnDefinition = `varchar("${colName}")`;
+				columnDefinition = `text("${colName}")`;
 				break;
 			}
 			const pkProp = getPrimaryKeyProp(targetCollection);
 			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
 			const targetIdField = pkProp.name;
-			const baseColumn = pkProp.type === "number" ? `integer("${colName}")` : pkProp.isUuid ? `uuid("${colName}")` : `varchar("${colName}")`;
+			const baseColumn = pkProp.type === "number" ? `integer("${colName}")` : pkProp.isUuid ? `uuid("${colName}")` : `text("${colName}")`;
 			const required = prop.validation?.required;
 			columnDefinition = `${baseColumn}.references(() => ${targetTableVar}.${targetIdField}, ${`{ onDelete: "${required ? "cascade" : "set null"}" }`})`;
 			if (required) columnDefinition += ".notNull()";
@@ -5416,33 +5530,17 @@ var generateSinglePolicyCode = (collection, rule, operation, policyName, resolve
 */
 var computeSharedRelationName = (rel, sourceCollection, _collections) => {
 	const fallback = rel.relationName ?? toSnakeCase(rel.target().slug);
-	if (rel.direction === "owning" && rel.cardinality === "one" && rel.localKey) {
+	if (rel.kind === "belongsTo") {
 		const normalisedKey = resolvePropertyKeyForColumn(sourceCollection, rel.localKey);
 		return `${getTableName$1(sourceCollection)}_${normalisedKey}`;
 	}
-	if (rel.direction === "inverse" && rel.cardinality === "many" && rel.foreignKeyOnTarget) try {
+	if (rel.kind === "hasMany" || rel.kind === "hasOne") try {
 		const targetCollection = rel.target();
 		const normalisedFK = resolvePropertyKeyForColumn(targetCollection, rel.foreignKeyOnTarget);
 		return `${getTableName$1(targetCollection)}_${normalisedFK}`;
 	} catch {
 		return fallback;
 	}
-	if (rel.direction === "inverse" && rel.cardinality === "one") {
-		if (rel.foreignKeyOnTarget) try {
-			const targetCollection = rel.target();
-			const normalisedFK = resolvePropertyKeyForColumn(targetCollection, rel.foreignKeyOnTarget);
-			return `${getTableName$1(targetCollection)}_${normalisedFK}`;
-		} catch {
-			return fallback;
-		}
-		try {
-			const targetCollection = rel.target();
-			const targetResolvedRelations = resolveCollectionRelations(targetCollection);
-			const correspondingRelation = Object.values(targetResolvedRelations).find((targetRel) => targetRel.direction === "owning" && targetRel.cardinality === "one" && targetRel.localKey && targetRel.target().slug === sourceCollection.slug);
-			if (correspondingRelation && correspondingRelation.localKey) return `${getTableName$1(targetCollection)}_${correspondingRelation.localKey}`;
-		} catch {}
-		return fallback;
-	}
 	return fallback;
 };
 var generateSchema = async (collections, stripPolicies = false) => {
@@ -5507,7 +5605,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 		const tableName = getTableName$1(collection);
 		if (tableName) allTablesToGenerate.set(tableName, { collection });
 		const resolvedRelations = resolveCollectionRelations(collection);
-		for (const relation of Object.values(resolvedRelations)) if (relation.through) {
+		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
 			const junctionTableName = relation.through.table;
 			if (!allTablesToGenerate.has(junctionTableName)) allTablesToGenerate.set(junctionTableName, {
 				collection: {
@@ -5522,15 +5620,15 @@ var generateSchema = async (collections, stripPolicies = false) => {
 	}
 	for (const [tableName, { collection, isJunction, relation, sourceCollection }] of allTablesToGenerate.entries()) {
 		const tableVarName = getTableVarName(tableName);
-		if (isJunction && relation && sourceCollection && relation.through) {
+		if (isJunction && relation && sourceCollection && isManyToMany(relation)) {
 			const targetCollection = relation.target();
 			const schema = (isPostgresCollectionConfig(targetCollection) ? targetCollection.schema : void 0) || (isPostgresCollectionConfig(sourceCollection) ? sourceCollection.schema : void 0);
 			const tableCreator = schema ? `${schema}Schema.table` : "pgTable";
 			const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
 			const { sourceColumn, targetColumn } = relation.through;
 			const refOptions = `{ onDelete: \"${relation.onDelete ?? "cascade"}\" }`;
-			const sourceColType = isNumericId(sourceCollection) ? "integer" : getPrimaryKeyProp(sourceCollection).isUuid ? "uuid" : "varchar";
-			const targetColType = isNumericId(targetCollection) ? "integer" : getPrimaryKeyProp(targetCollection).isUuid ? "uuid" : "varchar";
+			const sourceColType = isNumericId(sourceCollection) ? "integer" : getPrimaryKeyProp(sourceCollection).isUuid ? "uuid" : "text";
+			const targetColType = isNumericId(targetCollection) ? "integer" : getPrimaryKeyProp(targetCollection).isUuid ? "uuid" : "text";
 			const sourceId = getPrimaryKeyName(sourceCollection);
 			const targetId = getPrimaryKeyName(targetCollection);
 			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
@@ -5557,7 +5655,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 				const columnString = getDrizzleColumn(propName, prop, collection, collections);
 				if (columnString) columns.add(columnString);
 			});
-			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: varchar(\"id\").primaryKey()");
+			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: text(\"id\").primaryKey()");
 			schemaContent += `${Array.from(columns).join(",\n")}`;
 			const securityRules = getEffectiveSecurityRules(collection);
 			if (!stripPolicies && securityRules.length > 0) {
@@ -5576,7 +5674,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 		const tableRelations = [];
 		if (isJunction) {
 			const relationInfo = Array.from(allTablesToGenerate.values()).find((v) => v.isJunction && getTableName$1(v.collection) === tableName);
-			if (relationInfo && relationInfo.relation && relationInfo.sourceCollection && relationInfo.relation.through) {
+			if (relationInfo && relationInfo.relation && relationInfo.sourceCollection && isManyToMany(relationInfo.relation)) {
 				const { relation, sourceCollection } = relationInfo;
 				const targetCollection = relation.target();
 				const sourceTableVar = getTableVarName(getTableName$1(sourceCollection));
@@ -5588,7 +5686,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 				let inverseRelationName = null;
 				try {
 					const targetRelations = resolveCollectionRelations(targetCollection);
-					for (const [, targetRel] of Object.entries(targetRelations)) if (targetRel.direction === "inverse" && targetRel.cardinality === "many" && targetRel.inverseRelationName === owningRelationName) {
+					for (const [, targetRel] of Object.entries(targetRelations)) if (targetRel.kind !== "belongsTo" && targetRel.cardinality === "many" && targetRel.relationName === owningRelationName) {
 						inverseRelationName = targetRel.relationName ?? null;
 						break;
 					}
@@ -5604,27 +5702,25 @@ var generateSchema = async (collections, stripPolicies = false) => {
 				const target = rel.target();
 				const targetTableVar = getTableVarName(getTableName$1(target));
 				const drizzleRelationName = computeSharedRelationName(rel, collection, collections);
-				const deduplicationKey = `${drizzleRelationName}::${rel.direction}`;
+				const deduplicationKey = `${drizzleRelationName}::${rel.kind}`;
 				if (emittedRelationNames.has(deduplicationKey)) continue;
 				emittedRelationNames.add(deduplicationKey);
-				if (rel.cardinality === "one") {
-					if (rel.direction === "owning" && rel.localKey) tableRelations.push(`    "${relationKey}": one(${targetTableVar}, {\n        fields: [${tableVarName}.${rel.localKey}],\n        references: [${targetTableVar}.${getPrimaryKeyName(target)}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
-					else if (rel.direction === "inverse") tableRelations.push(`    "${relationKey}": one(${targetTableVar}, {\n        relationName: \"${drizzleRelationName}\"\n    })`);
-				} else if (rel.cardinality === "many") {
-					if (rel.direction === "inverse" && rel.foreignKeyOnTarget) tableRelations.push(`    "${relationKey}": many(${targetTableVar}, { relationName: \"${drizzleRelationName}\" })`);
-					else if (rel.through) {
+				switch (rel.kind) {
+					case "belongsTo":
+						tableRelations.push(`    "${relationKey}": one(${targetTableVar}, {\n        fields: [${tableVarName}.${rel.localKey}],\n        references: [${targetTableVar}.${getPrimaryKeyName(target)}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
+						break;
+					case "hasOne":
+						tableRelations.push(`    "${relationKey}": one(${targetTableVar}, {\n        relationName: \"${drizzleRelationName}\"\n    })`);
+						break;
+					case "hasMany":
+						tableRelations.push(`    "${relationKey}": many(${targetTableVar}, { relationName: \"${drizzleRelationName}\" })`);
+						break;
+					case "manyToMany": {
 						const junctionTableVar = getTableVarName(rel.through.table);
 						tableRelations.push(`    "${relationKey}": many(${junctionTableVar}, { relationName: \"${drizzleRelationName}\" })`);
-					} else if (rel.direction === "inverse" && rel.inverseRelationName) try {
-						const targetResolvedRelations = resolveCollectionRelations(rel.target());
-						const correspondingRelation = Object.values(targetResolvedRelations).find((targetRel) => targetRel.direction === "owning" && targetRel.cardinality === "many" && targetRel.through && targetRel.relationName === rel.inverseRelationName);
-						if (correspondingRelation && correspondingRelation.through) {
-							const junctionTableVar = getTableVarName(correspondingRelation.through.table);
-							tableRelations.push(`    "${relationKey}": many(${junctionTableVar}, { relationName: \"${drizzleRelationName}\" })`);
-						} else logger.warn(`Could not find corresponding owning many-to-many relation for inverse relation '${relationKey}' on '${collection.name}'`);
-					} catch (e) {
-						logger.warn(`Could not resolve inverse many-to-many relation '${relationKey}'`, { error: e });
+						break;
 					}
+					case "via": break;
 				}
 			} catch (e) {
 				logger.warn(`Could not generate relation ${relationKey} for ${collection.name}`, { error: e });
@@ -5632,10 +5728,10 @@ var generateSchema = async (collections, stripPolicies = false) => {
 			for (const otherCollection of collections) {
 				if (otherCollection.slug === collection.slug) continue;
 				const otherRelations = resolveCollectionRelations(otherCollection);
-				for (const [otherKey, otherRel] of Object.entries(otherRelations)) if (otherRel.direction === "inverse" && otherRel.foreignKeyOnTarget) try {
+				for (const [otherKey, otherRel] of Object.entries(otherRelations)) if (hasForeignKeyOnTarget(otherRel)) try {
 					if (otherRel.target().slug === collection.slug) {
 						const drizzleRelationName = computeSharedRelationName(otherRel, otherCollection, collections);
-						const deduplicationKey = `${drizzleRelationName}::owning`;
+						const deduplicationKey = `${drizzleRelationName}::belongsTo`;
 						if (!emittedRelationNames.has(deduplicationKey)) {
 							const otherTableVar = getTableVarName(getTableName$1(otherCollection));
 							const drizzleFieldKey = resolvePropertyKeyForColumn(collection, otherRel.foreignKeyOnTarget);
@@ -5737,6 +5833,58 @@ var main = () => {
 };
 if (import.meta.url.endsWith(process.argv[1])) main();
 //#endregion
+//#region src/services/cdc/junction-tables.ts
+/**
+* Every junction table reachable from a registered collection, once per
+* relation that uses it.
+*
+* A junction is listed once per *direction* when both sides declare it, because
+* each direction addresses a different child list: `posts/1/tags` and
+* `tags/t/posts` both change when one link is written.
+*/
+function collectJunctionLinks(registry) {
+	const links = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const collection of registry.getCollections()) {
+		let relations;
+		try {
+			relations = resolveCollectionRelations(collection);
+		} catch {
+			continue;
+		}
+		for (const [relationKey, relation] of Object.entries(relations)) {
+			if (!isManyToMany(relation)) continue;
+			const through = relation.through;
+			const key = `${collection.slug}::${relationKey}::${through.table}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			links.push({
+				schema: collection.schema ?? "public",
+				table: through.table,
+				parentCollection: collection,
+				relationKey,
+				sourceColumn: through.sourceColumn,
+				targetColumn: through.targetColumn
+			});
+		}
+	}
+	return links;
+}
+/**
+* Index {@link collectJunctionLinks} by table, under both the qualified and the
+* bare name — a change event carries whatever the trigger reports, and a
+* collection need not declare a schema.
+*/
+function buildJunctionLinkMap(registry) {
+	const map = /* @__PURE__ */ new Map();
+	for (const link of collectJunctionLinks(registry)) for (const key of [`${link.schema}.${link.table}`, link.table]) {
+		const existing = map.get(key);
+		if (existing) existing.push(link);
+		else map.set(key, [link]);
+	}
+	return map;
+}
+//#endregion
 //#region src/services/cdc/trigger-cdc.ts
 /**
 * Trigger-based Change Data Capture (CDC).
@@ -6861,6 +7009,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	cdcListener;
 	/** Whether database-level CDC is the active cross-instance change source. */
 	cdcActive = false;
+	/** Junction table → the child lists its rows belong to, built when CDC starts. */
+	junctionLinkMap;
 	/** Reverse lookup: `schema.table` (and bare `table`) → collection, built when CDC starts. */
 	cdcTableMap;
 	/**
@@ -7977,6 +8127,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			return;
 		}
 		this.cdcTableMap = this.buildCdcTableMap();
+		this.junctionLinkMap = buildJunctionLinkMap(this.registry);
 		this.cdcListener = new CdcListener(connectionString, (event) => this.handleCdcEvent(event));
 		try {
 			await this.cdcListener.start();
@@ -7984,6 +8135,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			await this.cdcListener.stop().catch(() => {});
 			this.cdcListener = void 0;
 			this.cdcTableMap = void 0;
+			this.junctionLinkMap = void 0;
 			throw err;
 		}
 		this.cdcActive = true;
@@ -7997,6 +8149,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			this.cdcListener = void 0;
 		}
 		this.cdcTableMap = void 0;
+		this.junctionLinkMap = void 0;
 		this.recentAppEmits.clear();
 	}
 	/**
@@ -8033,6 +8186,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	async handleCdcEvent(event) {
 		const collection = this.resolveCollectionForTable(event.schema, event.table);
 		if (!collection) {
+			if (await this.handleJunctionCdcEvent(event)) return;
 			this.debugLog(`📡 [CDC] Ignoring change on unmapped table ${event.schema}.${event.table}`);
 			return;
 		}
@@ -8042,6 +8196,38 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		const row = event.op === "DELETE" ? null : { _rebase_invalidated: true };
 		await this.notifyUpdate(path, id, row, databaseId, false, "cdc");
 	}
+	/**
+	* Deliver a change on a many-to-many junction table as a change to the child
+	* lists it belongs to.
+	*
+	* Linking a tag to a post writes only `posts_tags`. That table backs no
+	* collection, so change capture dropped the event as unmapped and the
+	* subscribers of `posts/1/tags` never heard about it — every other write in
+	* the system was realtime, and this one silently was not. The junction row
+	* carries both ids, so it names its own paths exactly.
+	*
+	* Notifies the nested path rather than either endpoint collection, because
+	* invalidation walks *parent* paths and never child ones: telling `tags` it
+	* changed would not reach a subscription on `posts/1/tags`.
+	*
+	* Returns whether the table was recognised as a junction.
+	*/
+	async handleJunctionCdcEvent(event) {
+		const links = this.junctionLinkMap?.get(`${event.schema}.${event.table}`) ?? this.junctionLinkMap?.get(event.table);
+		if (!links?.length) return false;
+		for (const link of links) {
+			const sourceId = event.row?.[link.sourceColumn];
+			const targetId = event.row?.[link.targetColumn];
+			if (sourceId === void 0 || sourceId === null || targetId === void 0 || targetId === null) {
+				this.debugLog(`📡 [CDC] Junction row on ${event.table} is missing '${link.sourceColumn}'/'${link.targetColumn}' — skipping.`);
+				continue;
+			}
+			const path = `${link.parentCollection.slug}/${String(sourceId)}/${link.relationKey}`;
+			const row = event.op === "DELETE" ? null : { _rebase_invalidated: true };
+			await this.notifyUpdate(path, String(targetId), row, link.parentCollection.databaseId, false, "cdc");
+		}
+		return true;
+	}
 	/** Compute the canonical (possibly composite) id string from a captured row. */
 	extractIdFromCdcRow(collection, row) {
 		return deriveRowAddress(row, collection, this.registry) || "*";
@@ -8761,8 +8947,8 @@ var PostgresCollectionRegistry = class extends CollectionRegistry {
 	*/
 	getRelationKeysForCollection(collectionPath) {
 		const collection = this.getCollectionByPath(collectionPath);
-		if (!collection || !getDataSourceCapabilities(collection.engine).supportsRelations || !collection.relations) return [];
-		return collection.relations.map((r) => r.relationName || r.localKey || "").filter(Boolean);
+		if (!collection) return [];
+		return Object.keys(resolveCollectionRelations(collection));
 	}
 };
 //#endregion
@@ -17713,6 +17899,178 @@ function formatBytes(bytes) {
 	return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
 }
 //#endregion
+//#region src/collections/validate-relations.ts
+/**
+* Every name a column answers to: the key in the drizzle schema and the real
+* column name in Postgres. A relation may legitimately be written with either,
+* and reporting a working relation as broken is worse than not checking.
+*/
+function columnNames(table) {
+	const names = /* @__PURE__ */ new Set();
+	for (const [key, col] of Object.entries(getTableColumns(table))) {
+		names.add(key);
+		const dbName = col?.name;
+		if (dbName) names.add(dbName);
+	}
+	return names;
+}
+var quote = (xs) => Array.from(xs).map((s) => `\`${s}\``).join(", ");
+/** `on.from` / `on.to` accept a single column or a composite tuple. */
+var asColumns = (value) => Array.isArray(value) ? value : [value];
+/**
+* Relations whose names do not resolve against the registered schema.
+*
+* Fails open wherever it cannot see enough to be sure — an unregistered source
+* table, a target belonging to another backend — because a false alarm here
+* costs more than a missed one: it would block boot on a working app.
+*/
+function findRelationDefects(collections, registry) {
+	const defects = [];
+	const registeredSlugs = new Set(registry.getCollections().map((c) => c.slug));
+	for (const collection of collections) {
+		const sourceTableName = getTableName$1(collection);
+		const sourceTable = registry.getTable(sourceTableName);
+		if (!sourceTable) continue;
+		const sourceColumns = columnNames(sourceTable);
+		const relations = resolveCollectionRelations(collection);
+		for (const relation of Object.values(relations)) {
+			const at = {
+				collection: collection.slug,
+				relationName: relation.relationName,
+				kind: relation.kind
+			};
+			let targetCollection;
+			try {
+				targetCollection = relation.target();
+			} catch (e) {
+				defects.push({
+					...at,
+					problem: `its \`target()\` threw: ${e instanceof Error ? e.message : String(e)}`,
+					fix: "a target thunk usually throws because of a circular import — make sure it is `() => otherCollection` and not evaluated at module load"
+				});
+				continue;
+			}
+			if (!registeredSlugs.has(targetCollection.slug)) continue;
+			const targetTableName = getTableName$1(targetCollection);
+			const targetTable = registry.getTable(targetTableName);
+			if (!targetTable) {
+				defects.push({
+					...at,
+					problem: `it points at collection \`${targetCollection.slug}\`, which has no table \`${targetTableName}\` in the schema`,
+					fix: `create the \`${targetTableName}\` table, or correct \`table\` on the \`${targetCollection.slug}\` collection`
+				});
+				continue;
+			}
+			const targetColumns = columnNames(targetTable);
+			switch (relation.kind) {
+				case "belongsTo":
+					if (!sourceColumns.has(relation.localKey)) defects.push({
+						...at,
+						problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
+						fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
+					});
+					break;
+				case "hasOne":
+				case "hasMany":
+					if (!targetColumns.has(relation.foreignKeyOnTarget)) defects.push({
+						...at,
+						problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
+						fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
+					});
+					break;
+				case "manyToMany": {
+					const { table, sourceColumn, targetColumn } = relation.through;
+					const junction = registry.getTable(table);
+					if (!junction) {
+						defects.push({
+							...at,
+							problem: `its junction table \`${table}\` does not exist`,
+							fix: `create \`${table}\`, or name the real one with \`through: { table: "..." }\`. Note that an omitted \`through.table\` is derived from the two table names sorted and joined, so renaming a table changes it`
+						});
+						break;
+					}
+					const junctionColumns = columnNames(junction);
+					for (const [label, column] of [["sourceColumn", sourceColumn], ["targetColumn", targetColumn]]) if (!junctionColumns.has(column)) defects.push({
+						...at,
+						problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
+						fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
+					});
+					break;
+				}
+				case "via": {
+					if (relation.joinPath.length === 0) {
+						defects.push({
+							...at,
+							problem: "its `joinPath` is empty, so it joins nothing",
+							fix: "add at least one step, ending at the target's table"
+						});
+						break;
+					}
+					let prevName = sourceTableName;
+					let prevColumns = sourceColumns;
+					let broken = false;
+					for (const [i, step] of relation.joinPath.entries()) {
+						const stepTable = registry.getTable(step.table);
+						if (!stepTable) {
+							defects.push({
+								...at,
+								problem: `step ${i + 1} of its \`joinPath\` joins \`${step.table}\`, which is not a table in the schema`,
+								fix: `correct \`joinPath[${i}].table\``
+							});
+							broken = true;
+							break;
+						}
+						const stepColumns = columnNames(stepTable);
+						for (const column of asColumns(step.on.from)) if (!prevColumns.has(column)) defects.push({
+							...at,
+							problem: `step ${i + 1} joins \`${prevName}.${column}\` → \`${step.table}\`, but \`${column}\` is not a column on \`${prevName}\``,
+							fix: `\`joinPath[${i}].on.from\` names columns on ${i === 0 ? "this collection's table" : `the previous step's table (\`${prevName}\`)`}: ${quote(prevColumns)}`
+						});
+						for (const column of asColumns(step.on.to)) if (!stepColumns.has(column)) defects.push({
+							...at,
+							problem: `step ${i + 1} joins into \`${step.table}.${column}\`, but \`${column}\` is not a column on \`${step.table}\``,
+							fix: `\`joinPath[${i}].on.to\` names columns on \`${step.table}\`: ${quote(stepColumns)}`
+						});
+						if (asColumns(step.on.from).length !== asColumns(step.on.to).length) defects.push({
+							...at,
+							problem: `step ${i + 1} compares ${asColumns(step.on.from).length} column(s) against ${asColumns(step.on.to).length}`,
+							fix: `\`from\` and \`to\` must name the same number of columns in \`joinPath[${i}]\``
+						});
+						prevName = step.table;
+						prevColumns = stepColumns;
+					}
+					if (!broken && prevName !== targetTableName) defects.push({
+						...at,
+						problem: `its \`joinPath\` ends at \`${prevName}\`, but it targets \`${targetCollection.slug}\` (table \`${targetTableName}\`)`,
+						fix: `make the last step join \`${targetTableName}\`, or point \`target\` at the collection backed by \`${prevName}\``
+					});
+					break;
+				}
+				default: throw new Error(`Unhandled relation kind: ${JSON.stringify(relation)}`);
+			}
+		}
+	}
+	return defects;
+}
+/**
+* Fail boot on any relation that cannot resolve, listing all of them at once.
+*
+* Deliberately fatal rather than a warning. Every one of these produces an
+* empty result at query time and nothing else — an empty tab, an empty
+* `include`, a subcollection that looks like it has no rows. A server that
+* refuses to start is recoverable in a minute; a relation that quietly answers
+* "nothing" is the kind of bug found in production, weeks later, by a user
+* asking where their data went.
+*/
+function assertRelationsResolve(collections, registry) {
+	const defects = findRelationDefects(collections, registry);
+	if (defects.length === 0) return;
+	const lines = defects.map((d) => `  • ${d.collection}.${d.relationName} (${d.kind})\n      ${d.problem}\n      fix: ${d.fix}`);
+	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against the database schema.\n\nEach of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
+
+` + lines.join("\n\n") + "\n");
+}
+//#endregion
 //#region src/collections/buildRegistry.ts
 /**
 * Build the collection registry for a driver.
@@ -17737,8 +18095,163 @@ function buildCollectionRegistry(schema) {
 	if (schema.enums) registry.registerEnums(schema.enums);
 	if (schema.relations) registry.registerRelations(schema.relations);
 	warnOnKeysTheAdminCannotResolve(registry.getCollections(), registry);
+	assertRelationsResolve(registry.getCollections(), registry);
 	return registry;
 }
+/** Key under which the version is stored in the auth schema's meta table. */
+var VERSION_KEY = "auth_schema_version";
+/**
+* Columns `refresh_tokens` must have for the current runtime's auth write path
+* to work. Checked by the health probe so a database that drifted *below* this
+* runtime is reported as unhealthy rather than discovered one failed login at a
+* time. Kept in step with the migration in `ensureAuthTablesExist`.
+*/
+var REQUIRED_REFRESH_TOKEN_COLUMNS = [
+	"session_id",
+	"revoked",
+	"rotated_at",
+	"session_started_at"
+];
+/**
+* A constraint whose *presence* means the database is still at version 1, in a
+* shape this runtime's rotation logic cannot write to: it makes two live tokens
+* of one rotating session collide.
+*/
+var RETIRED_REFRESH_TOKEN_CONSTRAINT = "unique_device_session";
+/**
+* Thrown when the database was migrated by a runtime newer than this one.
+*
+* Distinct class rather than a bare `Error` because `ensureAuthTablesExist`
+* wraps its migrations in a catch that deliberately swallows failures and
+* continues — every other problem there is better survived than crashed on.
+* This one is not, so the catch rethrows on this type specifically.
+*/
+var AuthSchemaVersionError = class extends Error {
+	databaseVersion;
+	runtimeVersion;
+	constructor(databaseVersion, runtimeVersion) {
+		super(`Auth schema version mismatch: the database is at version ${databaseVersion}, but this runtime understands version ${runtimeVersion}.\n\nA newer version of the framework has already migrated this database. Running this older runtime against it would boot cleanly and then fail every login and token refresh, because the auth schema it expects no longer exists.
+
+Refusing to start. Deploy a framework version at or above the one that migrated this database, or restore the database from a backup taken before the upgrade.`);
+		this.name = "AuthSchemaVersionError";
+		this.databaseVersion = databaseVersion;
+		this.runtimeVersion = runtimeVersion;
+	}
+};
+/**
+* The schema the auth tables live in, derived exactly as `ensureAuthTablesExist`
+* derives it. Shared so the two cannot drift: a stamp written to one schema and
+* read from another would read as "never stamped" forever.
+*/
+function resolveAuthSchema(collection) {
+	if (!collection) return "rebase";
+	const usersSchema = "schema" in collection && typeof collection.schema === "string" ? collection.schema : "public";
+	return usersSchema === "public" ? "rebase" : usersSchema;
+}
+/**
+* Read the stamped version, or `null` when the database has never been stamped.
+*
+* `null` is not an error and must not be treated as one: every database
+* provisioned before this file existed is unstamped, and so is every fresh one.
+* Uses `to_regclass` rather than selecting straight from the table so a missing
+* schema or table is a `null` rather than a thrown 42P01.
+*/
+async function readAuthSchemaVersion(db, authSchema) {
+	const qualified = `"${authSchema}"."schema_meta"`;
+	if (!(await db.execute(sql`SELECT to_regclass(${qualified}) IS NOT NULL AS present`)).rows[0]?.present) return null;
+	const raw = (await db.execute(sql`
+        SELECT value FROM ${sql.raw(qualified)} WHERE key = ${VERSION_KEY}
+    `)).rows[0]?.value;
+	if (raw === void 0) return null;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isFinite(parsed) ? parsed : null;
+}
+/**
+* Refuse to run against a database a newer runtime has already migrated.
+*
+* Deliberately one-directional. A database *older* than this runtime is the
+* normal upgrade path — the migrations in `ensureAuthTablesExist` are about to
+* bring it forward, so it is not an error. Only the reverse is unrecoverable.
+*/
+async function assertAuthSchemaCompatible(db, authSchema) {
+	const databaseVersion = await readAuthSchemaVersion(db, authSchema);
+	if (databaseVersion !== null && databaseVersion > 2) throw new AuthSchemaVersionError(databaseVersion, 2);
+}
+/**
+* Record that this runtime's migrations have been applied.
+*
+* Called at the end of `ensureAuthTablesExist`, so a boot that failed partway
+* through leaves the older stamp in place and the next boot migrates again.
+*/
+async function stampAuthSchemaVersion(db, authSchema) {
+	const qualified = `"${authSchema}"."schema_meta"`;
+	await db.execute(sql`
+        CREATE TABLE IF NOT EXISTS ${sql.raw(qualified)} (
+            key TEXT PRIMARY KEY,
+            value TEXT NOT NULL,
+            updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
+        )
+    `);
+	await db.execute(sql`
+        INSERT INTO ${sql.raw(qualified)} (key, value)
+        VALUES (${VERSION_KEY}, ${String(2)})
+        ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()
+    `);
+}
+/**
+* Check that the auth schema is one this runtime can actually write to.
+*
+* Two independent checks, because either alone has a blind spot:
+*
+*  - The **stamp** catches a runtime older than the database. It is the precise
+*    signal, but it is blind on every database provisioned before stamping
+*    existed — which today is all of them.
+*  - The **structure** catches a database older than the runtime, and works on
+*    unstamped databases. It is what makes this useful immediately rather than
+*    one upgrade cycle from now.
+*
+* Never throws: a probe that fails to run reports unhealthy with the reason, so
+* a broken check surfaces as a degraded health response rather than a 500 from
+* the health endpoint itself.
+*/
+async function probeAuthSchema(db, authSchema) {
+	const problems = [];
+	let databaseVersion = null;
+	try {
+		databaseVersion = await readAuthSchemaVersion(db, authSchema);
+		if (databaseVersion !== null && databaseVersion > 2) problems.push(`database is at auth schema version ${databaseVersion}, this runtime understands 2 — it was migrated by a newer framework version`);
+		const refreshTokens = `"${authSchema}"."refresh_tokens"`;
+		if (!(await db.execute(sql`SELECT to_regclass(${refreshTokens}) IS NOT NULL AS present`)).rows[0]?.present) return {
+			healthy: problems.length === 0,
+			databaseVersion,
+			runtimeVersion: 2,
+			problems
+		};
+		const columns = await db.execute(sql`
+            SELECT column_name FROM information_schema.columns
+            WHERE table_schema = ${authSchema} AND table_name = 'refresh_tokens'
+        `);
+		const found = new Set(columns.rows.map((row) => row.column_name));
+		const missing = REQUIRED_REFRESH_TOKEN_COLUMNS.filter((column) => !found.has(column));
+		if (missing.length > 0) problems.push(`refresh_tokens is missing ${missing.join(", ")} — the auth migrations have not been applied to this database, so token rotation will fail`);
+		if ((await db.execute(sql`
+            SELECT 1 FROM pg_constraint c
+            JOIN pg_class t ON t.oid = c.conrelid
+            JOIN pg_namespace n ON n.oid = t.relnamespace
+            WHERE n.nspname = ${authSchema}
+              AND t.relname = 'refresh_tokens'
+              AND c.conname = ${RETIRED_REFRESH_TOKEN_CONSTRAINT}
+        `)).rows.length > 0) problems.push(`refresh_tokens still carries ${RETIRED_REFRESH_TOKEN_CONSTRAINT} — concurrent token rotation for one session will fail on it`);
+	} catch (error) {
+		problems.push(`auth schema probe failed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	return {
+		healthy: problems.length === 0,
+		databaseVersion,
+		runtimeVersion: 2,
+		problems
+	};
+}
 //#endregion
 //#region src/auth/ensure-tables.ts
 /**
@@ -17750,6 +18263,7 @@ function buildCollectionRegistry(schema) {
 */
 async function ensureAuthTablesExist(db, collection) {
 	logger.info("🔍 Checking auth tables...");
+	await assertAuthSchemaCompatible(db, resolveAuthSchema(collection));
 	try {
 		let usersTableName = "\"rebase\".\"users\"";
 		let userIdType = "TEXT";
@@ -18130,8 +18644,10 @@ async function ensureAuthTablesExist(db, collection) {
 		} catch (rlsReconcileError) {
 			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
 		}
+		await stampAuthSchemaVersion(db, authSchema);
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
+		if (error instanceof AuthSchemaVersionError) throw error;
 		logger.error("❌ Failed to create auth tables", { error });
 		logger.warn("⚠️ Continuing without creating auth tables.");
 	}
@@ -20026,7 +20542,7 @@ function createPostgresBootstrapper(pgConfig) {
 					} catch {}
 					const message = `
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  ❌  Cannot connect to PostgreSQL at ${hostInfo}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  The database server is not running or is not accepting\n  connections. Common fixes:\n\n    • brew services start postgresql@18\n    • docker compose up -d postgres\n    • Verify DATABASE_URL in your .env file\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+  ❌  Cannot connect to PostgreSQL at ${hostInfo}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  The database server is not running or is not accepting\n  connections. Common fixes:\n\n    • docker compose up -d db          (the service a Rebase scaffold ships)\n    • brew services start postgresql@18\n    • Verify DATABASE_URL in your .env file\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
 					logger.error(message);
 					throw new Error(`Cannot connect to PostgreSQL at ${hostInfo}: connection refused. Is the database running?`);
 				}
@@ -20111,10 +20627,15 @@ function createPostgresBootstrapper(pgConfig) {
 					const cdcRunSql = async (text) => {
 						return (await schemaAwareDb.execute(sql.raw(text))).rows ?? [];
 					};
-					await provisionTriggerCdc(cdcRunSql, registry.getCollections().map((c) => ({
+					const cdcTables = registry.getCollections().map((c) => ({
 						schema: c.schema ?? "public",
 						table: getTableName$1(c)
-					})).filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table)));
+					})).filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table));
+					for (const link of collectJunctionLinks(registry)) cdcTables.push({
+						schema: link.schema,
+						table: link.table
+					});
+					await provisionTriggerCdc(cdcRunSql, cdcTables);
 					await realtimeService.enableCdc(directUrl);
 					cdcEnabled = true;
 					provisionCdcForTables = async (tables) => {
@@ -20224,7 +20745,8 @@ function createPostgresBootstrapper(pgConfig) {
 				userService,
 				roleService: userService,
 				emailService,
-				authRepository
+				authRepository,
+				schemaHealthCheck: () => probeAuthSchema(db, resolveAuthSchema(authCollection))
 			};
 		},
 		async initializeHistory(config, driverResult) {
@@ -20252,7 +20774,7 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CNlIONzj.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-DGMYK0fr.js");
 			return { applied: (await ensureCollectionTables({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };