@rebasepro/server-postgres 0.10.1-canary.d8d45b2 → 0.10.1-canary.ed8caed

package/dist/index.es.js

@@ -2,8 +2,8 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./chunk-DSJWtz9O.js";
-import { a as isSchemaAdmin, i as isSQLAdmin, l as isPostgresCollectionConfig, m as Vector, n as getDataSourceCapabilities, o as ANONYMOUS_USER_ID, r as isChannelBusInstance } from "./src-B0v4IKaI.js";
-import { C as createRelationRefWithData, D as mergeDeep, E as getPolicyNamesForRule, O as camelCase, S as createRelationRef, T as updateDateAutoValues, _ as getTableVarName, a as getJunctionCollectionConfig, b as getDeclaredPrimaryKeys, c as getEffectiveSecurityRules, d as securityRuleToConditions, f as findAnonymousGrants, g as getTableName$1, h as getEnumVarName, i as CollectionRegistry, k as toSnakeCase, l as buildPropertyCallbacks, m as getColumnName, n as detectJunctionTables, o as getJunctionSecurityRules, p as findRelation, r as buildSdkData, s as resolveJunctionSpecs, t as classifyTable, u as policyToPostgres, v as resolveCollectionRelations, w as normalizeToEntityRelation, x as parseIdValues, y as buildCompositeId } from "./src-DmsRg8MR.js";
+import { a as isSchemaAdmin, i as isSQLAdmin, l as isPostgresCollectionConfig, m as Vector, n as getDataSourceCapabilities, o as ANONYMOUS_USER_ID, r as isChannelBusInstance } from "./src-CBgtrPhJ.js";
+import { C as createRelationRefWithData, D as mergeDeep, E as getPolicyNamesForRule, O as camelCase, S as createRelationRef, T as updateDateAutoValues, _ as getTableVarName, a as getJunctionCollectionConfig, b as getDeclaredPrimaryKeys, c as getEffectiveSecurityRules, d as securityRuleToConditions, f as findAnonymousGrants, g as getTableName$1, h as getEnumVarName, i as CollectionRegistry, k as toSnakeCase, l as buildPropertyCallbacks, m as getColumnName, n as detectJunctionTables, o as getJunctionSecurityRules, p as findRelation, r as buildSdkData, s as resolveJunctionSpecs, t as classifyTable, u as policyToPostgres, v as resolveCollectionRelations, w as normalizeToEntityRelation, x as parseIdValues, y as buildCompositeId } from "./src-lcfUP4xg.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
@@ -392,6 +392,85 @@ function unwrapRelationFilterValue(value) {
 * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;
 */
 var DrizzleConditionBuilder = class {
+	/**
+	* Express "reachable from this parent through this relation" as a plain
+	* `WHERE` condition on the target table.
+	*
+	* This is the primitive that lets a relation be a *filter* rather than an
+	* addressing scheme. A nested listing used to be served by its own query
+	* builder — `fetchEntitiesUsingJoins`, which grew joins the root pipeline
+	* did not have and lost the options the root pipeline did have (offset,
+	* filter, orderBy, include). Reduced to a condition, the same listing runs
+	* through the ordinary collection query, so it inherits all of them and
+	* there is one read path instead of two.
+	*
+	* The shapes:
+	*   - inverse FK  → `target.<fk> = :parentId`, a column comparison.
+	*   - `through`   → `EXISTS (SELECT 1 FROM junction …)`, correlated on the
+	*                   target's key, so the junction never multiplies rows the
+	*                   way an `INNER JOIN` would.
+	*   - `joinPath`  → the same `EXISTS`, with the path's steps joined inside
+	*                   it and the final step correlating to the outer row.
+	*/
+	static buildRelationScopeCondition(relation, parent, parentId, targetTable, targetIdColumn, registry) {
+		if (relation.joinPath && relation.joinPath.length > 0) {
+			const { table, idColumn } = parent();
+			return this.buildJoinPathScopeCondition(relation.joinPath, table, idColumn, parentId, targetIdColumn, registry);
+		}
+		if (relation.through) {
+			const junctionTable = registry.getTable(relation.through.table);
+			if (!junctionTable) throw new Error(`Junction table not found: ${relation.through.table}`);
+			const sourceCol = junctionTable[relation.through.sourceColumn];
+			const targetCol = junctionTable[relation.through.targetColumn];
+			if (!sourceCol || !targetCol) throw new Error(`Junction columns '${relation.through.sourceColumn}'/'${relation.through.targetColumn}' not found in '${relation.through.table}'`);
+			return sql`EXISTS (SELECT 1 FROM ${junctionTable} WHERE ${targetCol} = ${targetIdColumn} AND ${sourceCol} = ${parentId})`;
+		}
+		if (relation.foreignKeyOnTarget) {
+			const fkColumn = targetTable[relation.foreignKeyOnTarget];
+			if (!fkColumn) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'. A many-to-many relation needs \`through\` instead.`);
+			return eq(fkColumn, parentId);
+		}
+		if (relation.localKey) {
+			const { table, idColumn } = parent();
+			return sql`${targetIdColumn} = (SELECT ${sql.identifier(relation.localKey)} FROM ${table} WHERE ${idColumn} = ${parentId})`;
+		}
+		throw new Error(`Relation '${relation.relationName}' declares no \`foreignKeyOnTarget\`, \`through\`, \`joinPath\` or \`localKey\`, so there is no way to tell which target rows belong to a parent.`);
+	}
+	/**
+	* `EXISTS` for an explicit `joinPath`.
+	*
+	* The path is declared source → target. The subquery replays every step but
+	* the last from inside, and turns the last one into the correlation with the
+	* outer target row — so the target table is never named twice and needs no
+	* alias. Each intermediate table is aliased positionally, which keeps a path
+	* that revisits a table (a self-referencing many-to-many) unambiguous.
+	*/
+	static buildJoinPathScopeCondition(joinPath, parentTable, parentIdColumn, parentId, targetIdColumn, registry) {
+		const sourceAlias = "__rel_src";
+		const aliasFor = (index) => `__rel_j${index}`;
+		const fromRef = (stepIndex, column) => sql`${sql.identifier(stepIndex === 0 ? sourceAlias : aliasFor(stepIndex - 1))}.${sql.identifier(getColumnName(column))}`;
+		const pairs = (step) => {
+			const from = Array.isArray(step.on.from) ? step.on.from : [step.on.from];
+			const to = Array.isArray(step.on.to) ? step.on.to : [step.on.to];
+			if (from.length !== to.length) throw new Error(`Join step on '${step.table}' has ${from.length} \`from\` columns and ${to.length} \`to\` columns`);
+			return from.map((f, i) => ({
+				from: f,
+				to: to[i]
+			}));
+		};
+		const inner = joinPath.slice(0, -1);
+		const last = joinPath[joinPath.length - 1];
+		const joins = inner.map((step, index) => {
+			const table = registry.getTable(step.table);
+			if (!table) throw new Error(`Join table not found: ${step.table}`);
+			const on = pairs(step).map(({ from, to }) => sql`${fromRef(index, from)} = ${sql.identifier(aliasFor(index))}.${sql.identifier(getColumnName(to))}`);
+			return sql`JOIN ${table} AS ${sql.identifier(aliasFor(index))} ON ${sql.join(on, sql` AND `)}`;
+		});
+		const lastPairs = pairs(last);
+		const correlation = lastPairs.length === 1 ? sql`${fromRef(inner.length, lastPairs[0].from)} = ${targetIdColumn}` : sql.join(lastPairs.map(({ from, to }) => sql`${fromRef(inner.length, from)} = ${sql.identifier(getColumnName(to))}`), sql` AND `);
+		const joinsSql = joins.length > 0 ? sql` ${sql.join(joins, sql` `)}` : sql``;
+		return sql`EXISTS (SELECT 1 FROM ${parentTable} AS ${sql.identifier(sourceAlias)}${joinsSql} WHERE ${sql.identifier(sourceAlias)}.${sql.identifier(parentIdColumn.name)} = ${parentId} AND ${correlation})`;
+	}
 	/**
 	* Build filter conditions from FilterValues
 	*/
@@ -1551,6 +1630,18 @@ var RelationService = class {
 			const available = Object.keys(resolvedRelations).join(", ") || "(none)";
 			throw new Error(`Relation '${relationKey}' not found in collection '${parentCollectionPath}'. Available relations: [${available}]`);
 		}
+		return this.countRelatedRows(parentCollection, parentId, relation, []);
+	}
+	/**
+	* Count the target rows a parent reaches through `relation`, narrowed by
+	* `additionalFilters` (conditions on the target table).
+	*
+	* Shared by the public count and by {@link isRelated}, so "how many children
+	* does this parent have" and "is this row one of them" are answered by the
+	* same join — a membership test that reconstructed the join separately would
+	* be free to disagree with the listing it is supposed to gate.
+	*/
+	async countRelatedRows(parentCollection, parentId, relation, additionalFilters) {
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
 		const targetIdField = targetTable[requirePrimaryKeys(targetCollection, this.registry)[0].fieldName];
@@ -1561,11 +1652,54 @@ var RelationService = class {
 		if (!parentTable) throw new Error("Parent table not found");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
 		let query = this.db.select({ count: sql`count(distinct ${targetIdField})` }).from(targetTable).$dynamic();
-		query = DrizzleConditionBuilder.buildRelationCountQuery(query, relation, parsedParentId, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
+		query = DrizzleConditionBuilder.buildRelationCountQuery(query, relation, parsedParentId, targetTable, parentTable, parentIdCol, targetIdField, this.registry, additionalFilters);
 		const result = await query;
 		return Number(result[0]?.count || 0);
 	}
 	/**
+	* Whether `targetId` is actually reachable from the parent named in `hop`.
+	*
+	* A nested address like `authors/1/posts/43` used to resolve to the target
+	* collection and then match on the primary key alone, so the parent segment
+	* decided nothing: the row came back, and was updated or deleted, whoever it
+	* belonged to. Reads, updates and deletes now all gate on this.
+	*/
+	async isRelated(hop, targetId) {
+		const targetTable = getTableForCollection(hop.targetCollection, this.registry);
+		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
+		const parsedTargetId = parseIdValues(targetId, targetPks);
+		const identity = targetPks.map((pk) => {
+			const column = targetTable[pk.fieldName];
+			if (!column) throw new Error(`ID field '${pk.fieldName}' not found in table for collection '${hop.targetCollection.slug}'`);
+			return eq(column, parsedTargetId[pk.fieldName]);
+		});
+		return await this.countRelatedRows(hop.parentCollection, hop.parentId, hop.relation, identity) > 0;
+	}
+	/**
+	* Remove the junction row linking a parent to `targetId`, leaving the target
+	* row itself alone.
+	*
+	* This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
+	* target is shared, so deleting the row would remove the tag from every other
+	* post that uses it. It used to do exactly that — resolve the path to the
+	* `tags` table and delete by primary key.
+	*/
+	async unlinkRelatedEntity(tx, hop, targetId) {
+		const through = hop.relation.through;
+		if (!through) throw new Error(`Relation '${hop.relationKey}' has no junction table to unlink through`);
+		const junctionTable = this.registry.getTable(through.table);
+		if (!junctionTable) throw new Error(`Junction table not found: ${through.table}`);
+		const sourceJunctionColumn = junctionTable[through.sourceColumn];
+		const targetJunctionColumn = junctionTable[through.targetColumn];
+		if (!sourceJunctionColumn || !targetJunctionColumn) throw new Error(`Junction columns not found for relation '${hop.relationKey}' on table '${through.table}'`);
+		const parentPks = requirePrimaryKeys(hop.parentCollection, this.registry);
+		const parsedParentId = parseIdValues(hop.parentId, parentPks)[parentPks[0].fieldName];
+		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
+		const parsedTargetId = parseIdValues(targetId, targetPks)[targetPks[0].fieldName];
+		await tx.delete(junctionTable).where(and(eq(sourceJunctionColumn, parsedParentId), eq(targetJunctionColumn, parsedTargetId)));
+		logger.info(`Unlinked '${hop.relationKey}' ${parsedTargetId} from ${hop.parentCollection.slug} ${parsedParentId}`);
+	}
+	/**
 	* Batch fetch related rows for multiple parent rows to avoid N+1 queries
 	*/
 	async batchFetchRelatedEntities(parentCollectionPath, parentIds, _relationKey, relation) {
@@ -2102,8 +2236,8 @@ var RelationService = class {
 				[sourceJunctionColumn.name]: parentId,
 				[targetJunctionColumn.name]: parsedNewEntityId
 			};
-			await tx.insert(junctionTable).values(junctionData);
-			logger.info(`Created junction table entry for many-to-many relation '${relationKey}': ${JSON.stringify(junctionData)}`);
+			await tx.insert(junctionTable).values(junctionData).onConflictDoNothing();
+			logger.info(`Linked '${relationKey}' ${parsedNewEntityId} to ${parentId}`);
 		} catch (error) {
 			logger.error(`Failed to create junction table entry for relation '${relationKey}'`, { error });
 			throw error;
@@ -2255,6 +2389,79 @@ function toRestRow(row, collection, registry) {
 	return stripExcluded(flat, collection);
 }
 //#endregion
+//#region src/services/nested-path.ts
+/**
+* True when `path` addresses rows through a relation rather than a root
+* collection.
+*
+* Any separator at all counts — a root collection slug never contains one — so
+* a malformed path like `collection/id` is a *broken* nested path and gets
+* reported as one by {@link resolveNestedPath}, rather than being looked up as
+* a root collection whose slug happens to contain a slash.
+*/
+function isNestedPath(path) {
+	return path.includes("/");
+}
+function splitPathSegments(path) {
+	return path.split("/").filter((s) => s && s !== "undefined");
+}
+/**
+* Walk a nested collection path down to the relation it ends in.
+*
+* Returns `undefined` for a plain root-collection path so callers can keep the
+* root case on its existing code path. Throws when the path is malformed, or
+* when a segment names a relation that does not exist — the same errors the
+* individual walks used to raise, with the available names attached.
+*/
+function resolveNestedPath(path, registry) {
+	if (!isNestedPath(path)) return void 0;
+	const segments = splitPathSegments(path);
+	if (segments.length < 3 || segments.length % 2 === 0) throw new Error(`Invalid relation path: ${path}. Expected format: collection/id/relation`);
+	let parentCollection = getCollectionByPath(segments[0], registry);
+	let parentId = segments[1];
+	for (let i = 2; i < segments.length; i += 2) {
+		const relationKey = segments[i];
+		const resolvedRelations = resolveCollectionRelations(parentCollection);
+		const relation = findRelation(resolvedRelations, relationKey);
+		if (!relation) {
+			const available = Object.keys(resolvedRelations).join(", ") || "(none)";
+			throw new Error(`Relation '${relationKey}' not found in collection '${parentCollection.slug}'. Available relations: [${available}]`);
+		}
+		const targetCollection = relation.target();
+		if (i === segments.length - 1) return {
+			parentCollection,
+			parentId,
+			relationKey,
+			relation,
+			targetCollection
+		};
+		parentCollection = targetCollection;
+		parentId = segments[i + 1];
+	}
+	throw new Error(`Unable to resolve path: ${path}`);
+}
+/**
+* A relation reached through a junction table — many-to-many, or a multi-hop
+* `joinPath`. The target row is shared with other parents, so writing "through"
+* such a path addresses the *link*, not the row.
+*/
+function isJunctionBackedRelation(relation) {
+	return Boolean(relation.through) || Boolean(relation.joinPath && relation.joinPath.length > 1);
+}
+/**
+* Reject a nested write whose final segment is a to-one relation.
+*
+* There is no column on the target row that records a to-one parent — the
+* foreign key lives on the *parent* table. The write path used to fall through
+* to `relation.localKey` here and stamp the parent's own FK column onto the
+* target row, which either raised an opaque "column does not exist" or, when a
+* column of that name happened to exist on the target, silently wrote the wrong
+* one.
+*/
+function assertWritableThrough(hop, path) {
+	if (hop.relation.cardinality !== "many") throw ApiError.badRequest(`"${path}" ends in the to-one relation '${hop.relationKey}', which cannot be written through: the foreign key for a to-one relation lives on '${hop.parentCollection.slug}', not on '${hop.targetCollection.slug}'. Write the target row at "${hop.targetCollection.slug}" and set '${hop.relationKey}' on the parent instead.`, "RELATION_NOT_WRITABLE");
+}
+//#endregion
 //#region src/services/FetchService.ts
 /**
 * Service for handling all row read operations.
@@ -2386,10 +2593,11 @@ var FetchService = class {
 	* Build db.query-compatible options from standard fetch options.
 	* Handles filter, search, orderBy, limit, and cursor-based pagination.
 	*/
-	buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig) {
+	buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig, scopeCondition) {
 		const queryOpts = {};
 		if (withConfig) queryOpts.with = withConfig;
 		const allConditions = [];
+		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
 			const collection = getCollectionByPath(collectionPath, this.registry);
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
@@ -2447,9 +2655,49 @@ var FetchService = class {
 		return [];
 	}
 	/**
+	* Compile "rows reachable from this parent" into a `WHERE` condition on the
+	* target table, so a nested listing can run as an ordinary collection query.
+	*/
+	buildRelationScope(hop) {
+		const parentPks = requirePrimaryKeys(hop.parentCollection, this.registry);
+		const parentIdInfo = parentPks[0];
+		const parsedParentId = parseIdValues(hop.parentId, parentPks)[parentIdInfo.fieldName];
+		const parent = () => {
+			const table = getTableForCollection(hop.parentCollection, this.registry);
+			const idColumn = table[parentIdInfo.fieldName];
+			if (!idColumn) throw new Error(`ID field '${parentIdInfo.fieldName}' not found in table for collection '${hop.parentCollection.slug}'`);
+			return {
+				table,
+				idColumn
+			};
+		};
+		const targetTable = getTableForCollection(hop.targetCollection, this.registry);
+		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
+		const targetIdColumn = targetTable[targetPks[0].fieldName];
+		if (!targetIdColumn) throw new Error(`ID field '${targetPks[0].fieldName}' not found in table for collection '${hop.targetCollection.slug}'`);
+		return DrizzleConditionBuilder.buildRelationScopeCondition(hop.relation, parent, parsedParentId, targetTable, targetIdColumn, this.registry);
+	}
+	/**
+	* Whether `id` is actually reachable at `collectionPath`.
+	*
+	* Trivially true for a root path. For a nested one it is a real question:
+	* the path resolves to the target collection, and matching on the primary
+	* key alone made the parent segment decorative — `authors/1/posts/43`
+	* returned post 43 whoever wrote it, and the REST layer's delete then
+	* deleted it. A row that is not under this parent is reported as absent,
+	* which is what a caller addressing it through the parent should see.
+	*/
+	async isAddressableUnder(collectionPath, id) {
+		if (!isNestedPath(collectionPath)) return true;
+		const hop = resolveNestedPath(collectionPath, this.registry);
+		if (!hop) return true;
+		return this.relationService.isRelated(hop, id);
+	}
+	/**
 	* Fetch a single row by ID
 	*/
 	async fetchOne(collectionPath, id, databaseId) {
+		if (!await this.isAddressableUnder(collectionPath, id)) return void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2506,6 +2754,7 @@ var FetchService = class {
 	* Unified method to fetch rows with optional search functionality
 	*/
 	async fetchRowsWithConditions(collectionPath, options = {}) {
+		const scopeCondition = options.relatedTo ? this.buildRelationScope(options.relatedTo) : void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2517,7 +2766,7 @@ var FetchService = class {
 		const withConfig = this.buildWithConfig(collection);
 		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
 		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
-			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0);
+			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0, scopeCondition);
 			return (await qb.findMany(queryOpts)).map((row) => toCmsRow(row, collection, this.registry));
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
@@ -2533,6 +2782,7 @@ var FetchService = class {
 			_distance: vectorMeta.distanceSelect
 		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
+		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
 			if (searchConditions.length === 0) return [];
@@ -2637,7 +2887,11 @@ var FetchService = class {
 	* Fetch a collection of rows
 	*/
 	async fetchCollection(collectionPath, options = {}) {
-		if (collectionPath.includes("/")) return this.fetchCollectionFromPath(collectionPath, options);
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		if (hop) return this.fetchRowsWithConditions(hop.targetCollection.slug, {
+			...options,
+			relatedTo: hop
+		});
 		return this.fetchRowsWithConditions(collectionPath, options);
 	}
 	/**
@@ -2650,43 +2904,23 @@ var FetchService = class {
 		});
 	}
 	/**
-	* Fetch collection from multi-segment path
-	*/
-	async fetchCollectionFromPath(path, options = {}) {
-		const pathSegments = path.split("/").filter((p) => p && p !== "undefined");
-		if (pathSegments.length < 3 || pathSegments.length % 2 === 0) throw new Error(`Invalid relation path: ${path}. Expected format: collection/id/relation`);
-		const rootCollectionPath = pathSegments[0];
-		let currentCollection = getCollectionByPath(rootCollectionPath, this.registry);
-		let currentId = pathSegments[1];
-		for (let i = 2; i < pathSegments.length; i += 2) {
-			const relationKey = pathSegments[i];
-			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
-			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
-			if (i === pathSegments.length - 1) return (await this.relationService.fetchRelatedEntities(currentCollection.slug, currentId, relationKey, options)).map((row) => ({ ...row.values }));
-			if (i + 1 < pathSegments.length) {
-				const nextEntityId = pathSegments[i + 1];
-				currentCollection = relation.target();
-				currentId = nextEntityId;
-			}
-		}
-		throw new Error(`Unable to resolve path: ${path}`);
-	}
-	/**
 	* Count rows in a collection
 	*/
 	async count(collectionPath, options = {}) {
-		if (collectionPath.includes("/")) return this.countEntitiesFromPath(collectionPath, options);
-		const collection = getCollectionByPath(collectionPath, this.registry);
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		const effectivePath = hop ? hop.targetCollection.slug : collectionPath;
+		const collection = getCollectionByPath(effectivePath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		let query = this.db.select({ count: count() }).from(table).$dynamic();
 		const allConditions = [];
+		if (hop) allConditions.push(this.buildRelationScope(hop));
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
 			if (searchConditions.length === 0) return 0;
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
 		if (options.filter) {
-			const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
+			const filterConditions = this.buildFilterConditions(options.filter, table, effectivePath);
 			if (filterConditions.length > 0) allConditions.push(...filterConditions);
 		}
 		if (allConditions.length > 0) {
@@ -2697,27 +2931,6 @@ var FetchService = class {
 		return Number(result[0]?.count || 0);
 	}
 	/**
-	* Count rows from multi-segment path
-	*/
-	async countEntitiesFromPath(path, options = {}) {
-		const pathSegments = path.split("/").filter((p) => p && p !== "undefined");
-		if (pathSegments.length < 3 || pathSegments.length % 2 === 0) throw new Error(`Invalid relation path: ${path}`);
-		const rootCollectionPath = pathSegments[0];
-		let currentCollection = getCollectionByPath(rootCollectionPath, this.registry);
-		let currentId = pathSegments[1];
-		for (let i = 2; i < pathSegments.length; i += 2) {
-			const relationKey = pathSegments[i];
-			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
-			if (!relation) throw new Error(`Relation '${relationKey}' not found`);
-			if (i === pathSegments.length - 1) return this.relationService.countRelatedEntities(currentCollection.slug, currentId, relationKey, options);
-			if (i + 1 < pathSegments.length) {
-				currentCollection = relation.target();
-				currentId = pathSegments[i + 1];
-			}
-		}
-		throw new Error(`Unable to count for path: ${path}`);
-	}
-	/**
 	* Check if a field value is unique
 	*/
 	async checkUniqueField(collectionPath, fieldName, value, excludeEntityId, _databaseId) {
@@ -2749,6 +2962,14 @@ var FetchService = class {
 	* @param include - Array of relation keys to populate, or ["*"] for all
 	*/
 	async fetchCollectionForRest(collectionPath, options = {}, include) {
+		if (isNestedPath(collectionPath)) {
+			const hop = resolveNestedPath(collectionPath, this.registry);
+			if (hop) return this.fetchCollectionForRest(hop.targetCollection.slug, {
+				...options,
+				relatedTo: hop
+			}, include);
+		}
+		const scopeCondition = options.relatedTo ? this.buildRelationScope(options.relatedTo) : void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2758,7 +2979,7 @@ var FetchService = class {
 		const qb = this.getQueryBuilder(tableName);
 		if (qb && !options.searchString && !options.vectorSearch) try {
 			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
-			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig);
+			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig, scopeCondition);
 			const restRows = (await qb.findMany(queryOpts)).map((row) => toRestRow(row, collection, this.registry));
 			await this.resolveJoinPathRelationsBatchRest(restRows, collection, collectionPath, idInfoArray, include);
 			return restRows;
@@ -2806,6 +3027,7 @@ var FetchService = class {
 	* Fetch a single row with optional relation includes for REST API.
 	*/
 	async fetchOneForRest(collectionPath, id, include, databaseId) {
+		if (!await this.isAddressableUnder(collectionPath, id)) return null;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
@@ -2874,6 +3096,7 @@ var FetchService = class {
 			_distance: vectorMeta.distanceSelect
 		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
+		if (options.relatedTo) allConditions.push(this.buildRelationScope(options.relatedTo));
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
 			if (searchConditions.length === 0) return [];
@@ -3193,6 +3416,16 @@ var PersistService = class {
 	* Delete an row by ID
 	*/
 	async delete(collectionPath, id, _databaseId) {
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		if (hop) {
+			assertWritableThrough(hop, collectionPath);
+			if (!await this.relationService.isRelated(hop, id)) throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to delete.`);
+			if (isJunctionBackedRelation(hop.relation)) {
+				if (!hop.relation.through) throw ApiError.badRequest(`"${collectionPath}" reaches '${hop.targetCollection.slug}' through a multi-hop joinPath, so there is no single link to remove. Delete the row at "${hop.targetCollection.slug}" directly if that is what you meant.`, "RELATION_NOT_UNLINKABLE");
+				await this.relationService.unlinkRelatedEntity(this.db, hop, id);
+				return;
+			}
+		}
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = getPrimaryKeys(collection, this.registry);
@@ -3213,6 +3446,29 @@ var PersistService = class {
 		await this.db.delete(table);
 	}
 	/**
+	* The column on the *target* table that records the parent, for a create
+	* under a nested one-to-many path.
+	*
+	* Returns `undefined` when the link is not a column at all (a multi-hop
+	* `joinPath`), so the caller writes the row without stamping anything.
+	*
+	* `relation.localKey` is deliberately not consulted: it names a column on
+	* the *source* table. Falling back to it here — which is what this used to
+	* do, and first — stamped the parent's own foreign key onto the child row.
+	*/
+	resolveParentForeignKeyColumn(hop) {
+		const { relation, relationKey, targetCollection } = hop;
+		if (relation.foreignKeyOnTarget) return relation.foreignKeyOnTarget;
+		if (relation.joinPath && relation.joinPath.length === 1) {
+			const joinStep = relation.joinPath[0];
+			const targetTableName = getTableName$1(targetCollection);
+			if (joinStep.table !== targetTableName) logger.warn(`Join step for relation '${relationKey}' targets '${joinStep.table}', not the target table '${targetTableName}'.`);
+			return DrizzleConditionBuilder.getColumnNamesFromColumns(joinStep.on.to)[0];
+		}
+		if (relation.joinPath && relation.joinPath.length > 1) return;
+		throw ApiError.badRequest(`Relation '${relationKey}' on '${hop.parentCollection.slug}' cannot be written through: it declares no \`foreignKeyOnTarget\` (the column on '${targetCollection.slug}' that records the parent) and no \`joinPath\`.`, "RELATION_NOT_WRITABLE");
+	}
+	/**
 	* Save an row (create or update)
 	*
 	* With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
@@ -3225,60 +3481,29 @@ var PersistService = class {
 		let effectiveCollectionPath = collectionPath;
 		const effectiveValues = { ...values };
 		let junctionTableInfo;
-		if (collectionPath.includes("/")) {
-			const segments = collectionPath.split("/").filter(Boolean);
-			if (segments.length >= 3 && segments.length % 2 === 1) {
-				const rootSegment = segments[0];
-				let currentCollection = getCollectionByPath(rootSegment, this.registry);
-				let currentId = segments[1];
-				for (let i = 2; i < segments.length; i += 2) {
-					const relationKey = segments[i];
-					const resolvedRelations = resolveCollectionRelations(currentCollection);
-					const relation = findRelation(resolvedRelations, relationKey);
-					if (!relation) {
-						const available = Object.keys(resolvedRelations).join(", ") || "(none)";
-						throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'. Available relations: [${available}]`);
-					}
-					if (i === segments.length - 1) {
-						const targetCollection = relation.target();
-						effectiveCollectionPath = targetCollection.slug;
-						if (relation.cardinality === "many" && relation.through) {
-							const parentIdInfoArray = getPrimaryKeys(currentCollection, this.registry);
-							const parentIdInfo = parentIdInfoArray[0];
-							const parsedParentId = parseIdValues(currentId, parentIdInfoArray)[parentIdInfo.fieldName];
-							junctionTableInfo = {
-								parentCollection: currentCollection,
-								parentId: parsedParentId,
-								relation,
-								relationKey
-							};
-							break;
-						}
-						let targetColumnName;
-						if (relation.localKey) targetColumnName = relation.localKey;
-						else if (relation.foreignKeyOnTarget) targetColumnName = relation.foreignKeyOnTarget;
-						else if (relation.joinPath && relation.joinPath.length === 1) {
-							const targetTableName = getTableName$1(targetCollection);
-							const relevantJoinStep = relation.joinPath.find((joinStep) => joinStep.table === targetTableName);
-							if (relevantJoinStep) targetColumnName = DrizzleConditionBuilder.getColumnNamesFromColumns(relevantJoinStep.on.to)[0];
-							else {
-								logger.warn(`Could not find specific join step for target table ${targetTableName} in relation '${relationKey}'.`);
-								targetColumnName = DrizzleConditionBuilder.getColumnNamesFromColumns(relation.joinPath[0].on.to)[0];
-							}
-						} else if (relation.joinPath && relation.joinPath.length > 1) break;
-						else throw new Error(`Relation '${relationKey}' lacks configuration for path-based saving.`);
-						const parentIdInfoArray = getPrimaryKeys(currentCollection, this.registry);
-						const parentIdInfo = parentIdInfoArray[0];
-						const parsedParentId = parseIdValues(currentId, parentIdInfoArray)[parentIdInfo.fieldName];
-						const existingValue = effectiveValues[targetColumnName];
-						if (existingValue !== void 0 && existingValue !== null && existingValue !== parsedParentId) logger.warn(`Overriding provided value '${existingValue}' for FK '${targetColumnName}' with path parent id '${parsedParentId}'.`);
-						effectiveValues[targetColumnName] = parsedParentId;
-						break;
-					} else {
-						const nextEntityId = segments[i + 1];
-						currentCollection = relation.target();
-						currentId = nextEntityId;
-					}
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		if (hop) {
+			assertWritableThrough(hop, collectionPath);
+			effectiveCollectionPath = hop.targetCollection.slug;
+			const parentIdForWrite = () => {
+				const parentPks = getPrimaryKeys(hop.parentCollection, this.registry);
+				return parseIdValues(hop.parentId, parentPks)[parentPks[0].fieldName];
+			};
+			if (hop.relation.through) junctionTableInfo = {
+				parentCollection: hop.parentCollection,
+				parentId: parentIdForWrite(),
+				relation: hop.relation,
+				relationKey: hop.relationKey
+			};
+			else if (id !== void 0) {
+				if (!await this.relationService.isRelated(hop, id)) throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to update.`);
+			} else {
+				const targetColumnName = this.resolveParentForeignKeyColumn(hop);
+				if (targetColumnName) {
+					const parsedParentId = parentIdForWrite();
+					const existingValue = effectiveValues[targetColumnName];
+					if (existingValue !== void 0 && existingValue !== null && existingValue !== parsedParentId) logger.warn(`Overriding provided value '${existingValue}' for FK '${targetColumnName}' with path parent id '${parsedParentId}'.`);
+					effectiveValues[targetColumnName] = parsedParentId;
 				}
 			}
 		}
@@ -3349,7 +3574,7 @@ var PersistService = class {
 				}
 				if (inverseRelationUpdates.length > 0) await this.relationService.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
 				if (Object.keys(relationValues).length > 0) await this.relationService.updateRelationsUsingJoins(tx, collection, currentId, relationValues);
-				if (junctionTableInfo && !id) await this.relationService.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
+				if (junctionTableInfo) await this.relationService.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
 				return currentId;
 			});
 		} catch (error) {
@@ -5246,9 +5471,9 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}("${colName}")`;
 			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid("${colName}")`;
 			else if (stringProp.columnType === "uuid") columnDefinition = `uuid("${colName}")`;
-			else if (stringProp.columnType === "text" || stringProp.ui?.markdown || stringProp.ui?.multiline) columnDefinition = `text("${colName}")`;
 			else if (stringProp.columnType === "char") columnDefinition = `char("${colName}")`;
-			else columnDefinition = `varchar("${colName}")`;
+			else if (stringProp.columnType === "varchar") columnDefinition = `varchar("${colName}")`;
+			else columnDefinition = `text("${colName}")`;
 			if (isIdProperty(propName, prop, collection)) columnDefinition += ".primaryKey()";
 			if ("isId" in stringProp && stringProp.isId !== "manual" && stringProp.isId !== true) {
 				if (stringProp.isId === "uuid") columnDefinition += ".defaultRandom()";
@@ -5334,7 +5559,7 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
 			const pkProp = getPrimaryKeyProp(targetCollection);
 			const targetIdField = pkProp.name;
-			const baseColumn = pkProp.type === "number" ? `integer("${fkColumnName}")` : pkProp.isUuid ? `uuid("${fkColumnName}")` : `varchar("${fkColumnName}")`;
+			const baseColumn = pkProp.type === "number" ? `integer("${fkColumnName}")` : pkProp.isUuid ? `uuid("${fkColumnName}")` : `text("${fkColumnName}")`;
 			const onUpdate = relation.onUpdate ? `onUpdate: "${relation.onUpdate}"` : "";
 			const required = prop.validation?.required;
 			const refOptionsParts = [onUpdate, `onDelete: \"${relation.onDelete ?? (required ? "cascade" : "set null")}\"`].filter(Boolean);
@@ -5347,13 +5572,13 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			const refProp = prop;
 			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName$1(c) === refProp.path);
 			if (!targetCollection) {
-				columnDefinition = `varchar("${colName}")`;
+				columnDefinition = `text("${colName}")`;
 				break;
 			}
 			const pkProp = getPrimaryKeyProp(targetCollection);
 			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
 			const targetIdField = pkProp.name;
-			const baseColumn = pkProp.type === "number" ? `integer("${colName}")` : pkProp.isUuid ? `uuid("${colName}")` : `varchar("${colName}")`;
+			const baseColumn = pkProp.type === "number" ? `integer("${colName}")` : pkProp.isUuid ? `uuid("${colName}")` : `text("${colName}")`;
 			const required = prop.validation?.required;
 			columnDefinition = `${baseColumn}.references(() => ${targetTableVar}.${targetIdField}, ${`{ onDelete: "${required ? "cascade" : "set null"}" }`})`;
 			if (required) columnDefinition += ".notNull()";
@@ -5529,8 +5754,8 @@ var generateSchema = async (collections, stripPolicies = false) => {
 			const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
 			const { sourceColumn, targetColumn } = relation.through;
 			const refOptions = `{ onDelete: \"${relation.onDelete ?? "cascade"}\" }`;
-			const sourceColType = isNumericId(sourceCollection) ? "integer" : getPrimaryKeyProp(sourceCollection).isUuid ? "uuid" : "varchar";
-			const targetColType = isNumericId(targetCollection) ? "integer" : getPrimaryKeyProp(targetCollection).isUuid ? "uuid" : "varchar";
+			const sourceColType = isNumericId(sourceCollection) ? "integer" : getPrimaryKeyProp(sourceCollection).isUuid ? "uuid" : "text";
+			const targetColType = isNumericId(targetCollection) ? "integer" : getPrimaryKeyProp(targetCollection).isUuid ? "uuid" : "text";
 			const sourceId = getPrimaryKeyName(sourceCollection);
 			const targetId = getPrimaryKeyName(targetCollection);
 			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
@@ -5557,7 +5782,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 				const columnString = getDrizzleColumn(propName, prop, collection, collections);
 				if (columnString) columns.add(columnString);
 			});
-			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: varchar(\"id\").primaryKey()");
+			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: text(\"id\").primaryKey()");
 			schemaContent += `${Array.from(columns).join(",\n")}`;
 			const securityRules = getEffectiveSecurityRules(collection);
 			if (!stripPolicies && securityRules.length > 0) {
@@ -20252,7 +20477,7 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CNlIONzj.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-BVvtkkRm.js");
 			return { applied: (await ensureCollectionTables({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };