@rebasepro/server-postgres 0.12.1-canary.g4e7bcbf → 0.12.1-canary.g52d71ee

package/dist/utils/connection-string.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Connection-string rewrites for the tools Rebase shells out to.
+ *
+ * Pure and dependency-free: `pg-tools` builds argument vectors without a live
+ * server, and these have to be usable from there.
+ */
+/**
+ * Make a connection string safe to hand to a libpq program.
+ *
+ * `sslmode=no-verify` is a node-postgres convention — encrypt, but do not check
+ * the certificate — and libpq does not have it. It does not degrade or warn:
+ *
+ *     psql: error: invalid sslmode value: "no-verify"
+ *
+ * which means a `DATABASE_URL` that works perfectly for the app makes `psql`,
+ * `pg_dump`, `pg_restore` and Atlas all refuse to start, with an error that
+ * points at the value rather than at the convention it comes from. It has cost
+ * this project time more than once.
+ *
+ * `require` is the honest translation: libpq's `require` encrypts and does not
+ * verify the certificate either, which is exactly what `no-verify` asks for.
+ * Nothing is relaxed by the rewrite — `verify-ca` and `verify-full` are left
+ * alone, so a connection string that asked for verification still gets it.
+ *
+ * Only `sslmode` is touched, and only when it is a value libpq would reject.
+ * Anything unparseable is returned as given: a connection that works
+ * unverified beats one this corrupted.
+ */
+export declare function forLibpq(connectionString: string): string;

package/dist/utils/drizzle-conditions.d.ts

@@ -87,10 +87,11 @@ export declare class DrizzleConditionBuilder {
      */
     static buildRelationScopeCondition(relation: ResolvedRelation, 
     /**
-     * Lazy: only `via` and `belongsTo` need the parent's own table. A
-     * foreign key on the target and a junction are both expressible from
-     * the parent's *id* alone, and requiring the table for them would make
-     * a child listing fail on a parent whose table isn't registered.
+     * Lazy: `via`, `belongsTo`, and a foreign key that points at a
+     * `sourceKey` need the parent's own table. A junction and a plain
+     * foreign key are expressible from the parent's *id* alone, and
+     * requiring the table for them would make a child listing fail on a
+     * parent whose table isn't registered.
      */
     parent: () => {
         table: PgTable<any>;

package/dist/utils/pg-error-utils.d.ts

@@ -24,6 +24,22 @@ export interface PostgresError extends Error {
  * error code (5-char alphanumeric, e.g. `42P01`).
  */
 export declare function extractPgError(error: unknown): PostgresError | null;
+/**
+ * Whether the failure came back from Postgres rather than from building the
+ * query — which decides whether a fallback query is worth issuing.
+ *
+ * Reads here run inside a transaction (that is where `SET LOCAL ROLE` binds
+ * RLS). Once a statement raises, that transaction is aborted, and every later
+ * statement on it returns `25P02` — "current transaction is aborted, commands
+ * ignored until end of transaction block". So a retry after a database error
+ * cannot succeed, and it replaces a precise diagnosis ("invalid input syntax
+ * for type uuid") with a generic one. Rethrow instead.
+ *
+ * A query the driver could not even build — a missing reciprocal relation, say
+ * — never reached Postgres, leaves the transaction usable, and is exactly what
+ * the fallback paths exist for.
+ */
+export declare function reachedDatabase(error: unknown): boolean;
 /**
  * Walk the error cause chain and return the deepest meaningful message.
  */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.12.1-canary.g4e7bcbf",
+  "version": "0.12.1-canary.g52d71ee",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -47,11 +47,11 @@
     "execa": "^9.6.1",
     "pg": "^8.22.0",
     "ws": "^8.21.1",
-    "@rebasepro/codegen": "0.12.1-canary.g4e7bcbf",
-    "@rebasepro/common": "0.12.1-canary.g4e7bcbf",
-    "@rebasepro/types": "0.12.1-canary.g4e7bcbf",
-    "@rebasepro/utils": "0.12.1-canary.g4e7bcbf",
-    "@rebasepro/server": "0.12.1-canary.g4e7bcbf"
+    "@rebasepro/server": "0.12.1-canary.g52d71ee",
+    "@rebasepro/utils": "0.12.1-canary.g52d71ee",
+    "@rebasepro/codegen": "0.12.1-canary.g52d71ee",
+    "@rebasepro/common": "0.12.1-canary.g52d71ee",
+    "@rebasepro/types": "0.12.1-canary.g52d71ee"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.12",

package/src/auth/services.ts

@@ -68,10 +68,13 @@ function getColumn(table: RebasePgTable | undefined, ...keys: string[]): RebaseP
  *
  * Whitespace goes too: a trailing space survives the fold and reproduces the
  * problem exactly.
+ *
+ * Re-exported rather than defined here: `@rebasepro/server` and
+ * `@rebasepro/server-mongo` write this column too, and a second copy of this
+ * rule is the defect it exists to prevent.
  */
-export function normalizeEmail<T>(email: T): T | string {
-    return typeof email === "string" ? email.trim().toLowerCase() : email;
-}
+import { normalizeEmail } from "@rebasepro/common";
+export { normalizeEmail };
 
 /**
  * PostgreSQL implementation of UserRepository.

package/src/backup/backup-cli.ts

@@ -100,6 +100,8 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
             "--out": String,
             "--exclude-schema": [String],
             "--no-owner": Boolean,
+            "--enable-row-security": Boolean,
+            "--row-security-role": String,
             "-o": "--out"
         },
         { argv: rawArgs.slice(2), permissive: true }
@@ -129,6 +131,23 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
     }
     logger.info(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));
 
+    // Opt-in, and loud. With row security on, pg_dump stops refusing to read
+    // rows it cannot see and starts leaving them out — an exit-0 backup that
+    // is quietly short. Anyone choosing that should know they chose it.
+    const rowSecurity = args["--enable-row-security"]
+        ? { uid: "rebase-db-backup", roles: [args["--row-security-role"] || "admin"] }
+        : undefined;
+
+    if (rowSecurity) {
+        logger.warn("");
+        logger.warn(chalk.yellow("  ⚠  Dumping with row-level security ON."));
+        logger.warn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(", ")}], which satisfies the generated`));
+        logger.warn(chalk.gray("     `admin_full_access` policy. This backup contains exactly the rows those"));
+        logger.warn(chalk.gray("     policies admit — a table whose policies have no admin rule comes out short,"));
+        logger.warn(chalk.gray("     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS."));
+        logger.warn("");
+    }
+
     try {
         if (dest.kind === "local") {
             // Honour an explicit `…/name.dump` path; otherwise treat it as a
@@ -141,7 +160,8 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
                 fileName: explicitFile ? path.basename(dest.path) : undefined,
                 excludeSchemas: args["--exclude-schema"],
                 noOwner: args["--no-owner"],
-                inheritStdio: true
+                inheritStdio: true,
+                rowSecurity
             });
             await assertDumpValid(dump.localFile);
             logger.info("");
@@ -156,7 +176,8 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
                 dbName,
                 excludeSchemas: args["--exclude-schema"],
                 noOwner: args["--no-owner"],
-                inheritStdio: true
+                inheritStdio: true,
+                rowSecurity
             });
             try {
                 await assertDumpValid(dump.localFile);
@@ -395,6 +416,24 @@ ${chalk.green.bold("Options")}
   ${chalk.blue("--out, -o")} <dest>        Local path or s3://…/gs://… URL (default: ./backups)
   ${chalk.blue("--exclude-schema")} <s>    Exclude a schema (repeatable)
   ${chalk.blue("--no-owner")}              Omit ownership commands from the dump
+  ${chalk.blue("--enable-row-security")}   Dump as an admin subject instead of failing on RLS
+                             ${chalk.red("(may produce a partial dump — see below)")}
+  ${chalk.blue("--row-security-role")} <r> Role to read as with the flag above (default: admin)
+
+${chalk.green.bold("Row-level security")}
+  On a managed Postgres the dumping role usually owns nothing and has no
+  BYPASSRLS, so pg_dump refuses:
+
+    ERROR: query would be affected by row-level security policy for table "..."
+
+  That refusal is the safe behaviour. --enable-row-security replaces it by
+  reading as an admin subject: Rebase sets app.uid/app.user_roles so the
+  generated admin_full_access policy admits the dump. The dump then contains
+  exactly what those policies admit ${chalk.red("and no error is raised for what they do not")} —
+  a table whose policies lack an admin rule comes out short, silently.
+
+  Granting the dumping role BYPASSRLS is the option that keeps a backup
+  meaning "every row".
 
 ${chalk.green.bold("Notes")}
   Backups may contain secrets and PII. Use private storage destinations and

package/src/backup/backup-service.ts

@@ -18,6 +18,9 @@ import {
     buildBackupFilename,
     buildPgDumpArgs,
     buildPgDumpallGlobalsArgs,
+    buildRowSecurityPgOptions,
+    diagnoseRowSecurityDumpFailure,
+    type RowSecurityIdentity,
     buildPgRestoreArgs,
     buildPgRestoreListArgs,
     checkToolServerCompatibility,
@@ -140,6 +143,15 @@ export async function createDump(opts: {
     inheritStdio?: boolean;
     includeGlobals?: boolean;
     env?: Record<string, string | undefined>;
+    /**
+     * Dump with row security left on, reading as this identity.
+     *
+     * The escape hatch for a managed Postgres, where the dumping role owns
+     * nothing and has no `BYPASSRLS`. Off by default, and deliberately so: with
+     * row security on, `pg_dump` stops erroring on rows it cannot see and
+     * simply omits them. See {@link RowSecurityIdentity}.
+     */
+    rowSecurity?: RowSecurityIdentity;
 }): Promise<BackupResult> {
     const env = opts.env ?? process.env;
     const bin = resolvePgBinary("pg_dump", env);
@@ -159,13 +171,34 @@ export async function createDump(opts: {
         connectionString: opts.connectionString,
         outFile: localFile,
         excludeSchemas: opts.excludeSchemas,
-        noOwner: opts.noOwner
+        noOwner: opts.noOwner,
+        rowSecurity: opts.rowSecurity
     });
 
-    await execa(bin, args, {
-        stdio: opts.inheritStdio ? "inherit" : "pipe",
-        env: { ...(env as Record<string, string>) }
-    });
+    // `PGOPTIONS` is the only way to set a GUC on a tool that takes no SQL.
+    // Built from the same object that added `--enable-row-security`, so the
+    // flag cannot travel without the identity that makes it safe.
+    const dumpEnv: Record<string, string> = { ...(env as Record<string, string>) };
+    if (opts.rowSecurity) {
+        dumpEnv.PGOPTIONS = [env.PGOPTIONS, buildRowSecurityPgOptions(opts.rowSecurity)]
+            .filter(Boolean).join(" ");
+    }
+
+    try {
+        await execa(bin, args, {
+            stdio: opts.inheritStdio ? "inherit" : "pipe",
+            env: dumpEnv
+        });
+    } catch (error) {
+        // The RLS failure names a table and no cause. Replace it with the
+        // cause and the two ways out; anything else is re-thrown untouched.
+        const diagnosis = diagnoseRowSecurityDumpFailure(error);
+        if (!diagnosis) throw error;
+        throw new BackupToolError(
+            diagnosis,
+            "Run `rebase db backup --help` for the flag, and read what it says about partial dumps."
+        );
+    }
 
     const sizeBytes = fs.existsSync(localFile) ? fs.statSync(localFile).size : 0;
 

package/src/backup/pg-tools.ts

@@ -6,6 +6,8 @@
  * not require a database.
  */
 
+import { forLibpq } from "../utils/connection-string";
+
 /**
  * A parsed backup destination. `--out` (and the scheduled-backup config)
  * accepts either a local filesystem path or an object-storage URL.
@@ -171,6 +173,45 @@ export function joinStorageKey(prefix: string, fileName: string): string {
     return clean.length > 0 ? `${clean}/${fileName}` : fileName;
 }
 
+/**
+ * The identity `pg_dump` reads rows as, when row security is left on.
+ *
+ * Not optional, and that is the whole design. `pg_dump --enable-row-security`
+ * on its own is the dangerous command in this file: it turns the "query would
+ * be affected by row-level security policy" *error* into a dump that exits 0
+ * and is silently missing every row the dumping role's policies exclude. A
+ * backup that looks fine and restores most of your data is worse than one that
+ * refused to run.
+ *
+ * So the flag is unreachable without a subject to evaluate the policies
+ * against. Rebase's generated policies read `app.uid` and `app.user_roles`;
+ * supplying an admin role satisfies the `admin_full_access` rule and the dump
+ * sees everything that rule sees.
+ */
+export interface RowSecurityIdentity {
+    /** Written to `app.uid`. Any non-empty value — it is only an audit trail. */
+    uid: string;
+    /** Written to `app.user_roles`. Must include a role the policies admit. */
+    roles: string[];
+}
+
+/**
+ * `PGOPTIONS` carrying an identity, for a libpq tool that has no other way to
+ * set a GUC.
+ *
+ * A backslash escape rather than quoting, which is what libpq's `-c` parsing
+ * takes: a space inside a value ends the option otherwise, so a role list is
+ * comma-joined and never spaced.
+ */
+export function buildRowSecurityPgOptions(identity: RowSecurityIdentity): string {
+    const escape = (value: string) => value.replace(/([\\ ])/g, "\\$1");
+    return [
+        `-c app.uid=${escape(identity.uid)}`,
+        `-c app.user_id=${escape(identity.uid)}`,
+        `-c app.user_roles=${escape(identity.roles.join(","))}`
+    ].join(" ");
+}
+
 /**
  * Assemble the `pg_dump` argument vector. Uses the custom format (`-Fc`),
  * which is compressed and restorable selectively via `pg_restore`.
@@ -182,18 +223,70 @@ export function buildPgDumpArgs(opts: {
     excludeSchemas?: string[];
     /** Number of parallel jobs (directory format only; ignored for -Fc). */
     noOwner?: boolean;
+    /**
+     * Dump with row security on, as this identity. Omit — which is the default
+     * — and `pg_dump` errors rather than skipping rows it cannot see.
+     */
+    rowSecurity?: RowSecurityIdentity;
 }): string[] {
     const args = ["--format=custom", "--no-password", `--file=${opts.outFile}`];
     if (opts.noOwner) {
         args.push("--no-owner");
     }
+    if (opts.rowSecurity) {
+        args.push("--enable-row-security");
+    }
     for (const schema of opts.excludeSchemas ?? []) {
         args.push(`--exclude-schema=${schema}`);
     }
-    args.push(opts.connectionString);
+    args.push(forLibpq(opts.connectionString));
     return args;
 }
 
+/**
+ * Whether a `pg_dump` failure is the row-security one, and what to do about it.
+ *
+ * The error text names the table and nothing else, so the first read of it is
+ * "why would a backup be affected by RLS at all?" — the answer being that the
+ * dumping role is not the tables' owner and has no `BYPASSRLS`, which is the
+ * normal state of the `postgres` user on Cloud SQL, RDS and every other managed
+ * Postgres. Nothing about that is visible from the message.
+ *
+ * Returns `null` for any other failure, so the caller reports it unchanged.
+ */
+export function diagnoseRowSecurityDumpFailure(error: unknown): string | null {
+    const text = [
+        (error as { stderr?: unknown })?.stderr,
+        (error as { message?: unknown })?.message
+    ].map(part => (typeof part === "string" ? part : "")).join("\n");
+
+    if (!/row-level security policy/i.test(text)) return null;
+
+    const table = text.match(/for table "([^"]+)"/)?.[1];
+
+    return [
+        `pg_dump cannot read ${table ? `"${table}"` : "one of the tables"} because row-level security applies to it.`,
+        "",
+        "  The dumping role is neither the table's owner nor `BYPASSRLS`, which is the normal",
+        "  state of the `postgres` user on Cloud SQL, RDS and other managed Postgres — there is",
+        "  no superuser to hand out.",
+        "",
+        "  Two ways out:",
+        "",
+        "    • Grant the dumping role BYPASSRLS, or make it the owner, and run this again. The",
+        "      dump then contains every row, which is what a backup should mean.",
+        "",
+        "    • Re-run with --enable-row-security to dump as an admin subject instead. Rebase",
+        "      sets `app.uid`/`app.user_roles` so the generated `admin_full_access` policy",
+        "      admits the dump. Read the warning it prints: the result contains exactly the",
+        "      rows those policies admit, and any table whose policies do not include an",
+        "      admin rule comes out short — with no error.",
+        "",
+        "  Do not reach for a bare `pg_dump --enable-row-security` by hand. Without the",
+        "  settings above it succeeds and silently omits rows."
+    ].join("\n");
+}
+
 /**
  * Assemble the `pg_restore` argument vector for a custom-format dump.
  */
@@ -211,7 +304,7 @@ export function buildPgRestoreArgs(opts: {
     exitOnError?: boolean;
     noOwner?: boolean;
 }): string[] {
-    const args = ["--format=custom", "--no-password", `--dbname=${opts.connectionString}`];
+    const args = ["--format=custom", "--no-password", `--dbname=${forLibpq(opts.connectionString)}`];
     if (opts.clean) {
         args.push("--clean", "--if-exists");
     }
@@ -255,7 +348,7 @@ export function buildPgDumpallGlobalsArgs(opts: {
         "--no-role-passwords",
         "--no-password",
         `--file=${opts.outFile}`,
-        `--dbname=${opts.connectionString}`
+        `--dbname=${forLibpq(opts.connectionString)}`
     ];
 }
 

package/src/cli.ts

@@ -16,6 +16,7 @@ import {
     promptConfirm
 } from "./cli-helpers";
 import { checkDatabaseConnectivity, diagnoseDbError } from "./cli-errors";
+import { forLibpq } from "./utils/connection-string";
 import { AUTH_BOOTSTRAP_SQL } from "./schema/auth-bootstrap-sql";
 import { detectDestructiveStatements, decidePushSafety } from "./schema/destructive-sql";
 
@@ -693,19 +694,25 @@ async function runAtlas(
     const devDatabaseUrl = getDevDatabaseUrl(databaseUrl);
     await ensureDevDatabaseExists(databaseUrl, devDatabaseUrl);
 
+    // Atlas speaks libpq, which rejects the `sslmode=no-verify` that
+    // node-postgres accepts — see `forLibpq`. Rewritten only for the argv, so
+    // everything above still connects with the URL as configured.
+    const atlasUrl = forLibpq(databaseUrl);
+    const atlasDevUrl = forLibpq(devDatabaseUrl);
+
     const atlasArgs = [domain, ...args];
 
     if (domain === "schema") {
         if (args.includes("apply")) {
-            atlasArgs.push("--url", databaseUrl, "--dev-url", devDatabaseUrl);
+            atlasArgs.push("--url", atlasUrl, "--dev-url", atlasDevUrl);
         } else if (args.includes("clean") || args.includes("inspect")) {
-            atlasArgs.push("--url", databaseUrl);
+            atlasArgs.push("--url", atlasUrl);
         }
     } else if (domain === "migrate") {
         if (args.includes("diff")) {
-            atlasArgs.push("--dev-url", devDatabaseUrl);
+            atlasArgs.push("--dev-url", atlasDevUrl);
         } else if (args.includes("apply") || args.includes("status")) {
-            atlasArgs.push("--url", databaseUrl, "--revisions-schema", "rebase");
+            atlasArgs.push("--url", atlasUrl, "--revisions-schema", "rebase");
             if (args.includes("apply")) {
                 atlasArgs.push("--allow-dirty");
             }

package/src/collections/validate-relations.ts

@@ -135,6 +135,21 @@ kind: relation.kind };
                             fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
                         });
                     }
+                    // `sourceKey` is the easiest of the two to put on the wrong
+                    // side — it is the only column in a `hasMany` that lives
+                    // here rather than on the target, and naming a target column
+                    // reads perfectly well right next to `foreignKeyOnTarget`.
+                    if (relation.sourceKey && !sourceColumns.has(relation.sourceKey)) {
+                        defects.push({
+                            ...at,
+                            problem: `\`sourceKey: "${relation.sourceKey}"\` is not a column on \`${sourceTableName}\``,
+                            fix: targetColumns.has(relation.sourceKey)
+                                ? `it is a column on the *target* table \`${targetTableName}\` — \`sourceKey\` names ` +
+                                  "the column on this collection that the target's foreign key points at, so it " +
+                                  `must be one of: ${quote(sourceColumns)}`
+                                : `add the column, or set \`sourceKey\` to one of: ${quote(sourceColumns)}`
+                        });
+                    }
                     break;
                 }
 

package/src/data-transformer.ts

@@ -328,9 +328,15 @@ export async function parseDataFromServer<M extends Record<string, unknown>>(
                         const targetCollection = relation.target();
                         const targetTable = registry.getTable(getTableName(targetCollection));
                         const pks = getPrimaryKeys(collection, registry!);
-                        const currentId = buildCompositeId(data, pks);
-
-                        if (targetTable && currentId) {
+                        // What the target's foreign key holds. Ordinarily this
+                        // row's id; for a link on a natural key, the value of
+                        // the column it points at — which is on the row already,
+                        // so this costs nothing extra.
+                        const currentId = relation.sourceKey
+                            ? (data as Record<string, unknown>)[relation.sourceKey] as string | number | undefined
+                            : buildCompositeId(data, pks);
+
+                        if (targetTable && currentId !== undefined && currentId !== null && currentId !== "") {
                             const foreignKeyColumn = targetTable[relation.foreignKeyOnTarget as keyof typeof targetTable] as AnyPgColumn;
                             if (foreignKeyColumn) {
                                 // Query the target table to find row that references this row

package/src/schema/generate-drizzle-schema-logic.ts

@@ -137,6 +137,25 @@ const getDrizzleColumn = (propName: string, prop: Property, collection: Collecti
             let baseType = (numProp.validation?.integer || isId) ? `integer("${colName}")` : `numeric("${colName}")`;
             if (numProp.columnType) {
                 if (numProp.columnType === "double precision") baseType = `doublePrecision("${colName}")`;
+                // `bigint` and `bigserial` are the only pg-core builders that
+                // *require* a config argument: without `mode`, drizzle cannot
+                // know whether to hand back a `number` or a `bigint`, and the
+                // emitted call does not typecheck.
+                //
+                // This is why `schema.generated.ts` drifted. Regenerating it
+                // produced a file that would not compile, so the bigint lines
+                // were hand-patched — and every regeneration after that looked
+                // like a large, alarming diff nobody wanted to ship. The file
+                // then sat stale for long enough that a security fix to two RLS
+                // policies never reached production.
+                //
+                // `number` rather than `bigint`: these are counters and byte
+                // totals that every caller already treats as numbers, and
+                // switching the runtime type would be a breaking change to
+                // every consumer of the generated schema.
+                else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") {
+                    baseType = `${numProp.columnType}("${colName}", { mode: "number" })`;
+                }
                 else baseType = `${numProp.columnType}("${colName}")`;
             }
 
@@ -785,8 +804,14 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
                                     // name (e.g. "client_id") may differ from the property key
                                     // (e.g. "clientId") when `columnName` is set.
                                     const drizzleFieldKey = resolvePropertyKeyForColumn(collection, otherRel.foreignKeyOnTarget);
+                                    // The column the far side points at: its
+                                    // primary key, unless the link names another
+                                    // one with `sourceKey`.
+                                    const referencedKey = otherRel.sourceKey
+                                        ? resolvePropertyKeyForColumn(otherCollection, otherRel.sourceKey)
+                                        : getPrimaryKeyName(otherCollection);
                                     const synthKey = `_synth_${otherTableVar}_${drizzleFieldKey}`;
-                                    tableRelations.push(`    "${synthKey}": one(${otherTableVar}, {\n        fields: [${tableVarName}.${drizzleFieldKey}],\n        references: [${otherTableVar}.${getPrimaryKeyName(otherCollection)}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
+                                    tableRelations.push(`    "${synthKey}": one(${otherTableVar}, {\n        fields: [${tableVarName}.${drizzleFieldKey}],\n        references: [${otherTableVar}.${referencedKey}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
                                     emittedRelationNames.add(deduplicationKey);
                                 }
                             }