@rebasepro/server-postgres 0.12.1-canary.gdfba2a1 → 0.12.1-canary.ge1bb178

package/dist/index.es.js

@@ -1,11 +1,12 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, r as createPostgresDatabaseConnection } from "./connection-B5Wndbr1.js";
-import { C as updateDateAutoValues, D as camelCase, E as mergeDeep, M as hasForeignKeyOnTarget, N as isManyToMany, O as toSnakeCase, P as Vector, S as normalizeToEntityRelation, T as getPolicyNamesForRule, _ as buildCompositeId, a as getJunctionSecurityRules, b as createRelationRef, c as policyToPostgres, d as findRelation, f as getColumnName, g as resolveCollectionRelations, h as getTableVarName, i as getJunctionCollectionConfig, j as ANONYMOUS_USER_ID, l as securityRuleToConditions, m as getTableName$1, n as CollectionRegistry, o as resolveJunctionSpecs, p as getEnumVarName, r as resolveStringColumnLength, s as getEffectiveSecurityRules, t as buildSdkData, u as findAnonymousGrants, v as getDeclaredPrimaryKeys, w as generateForeignKeyName, x as createRelationRefWithData, y as parseIdValues } from "./src-DihrDFuP.js";
+import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
+import { C as updateDateAutoValues, D as mergeDeep, E as getPolicyNamesForRule, M as hasForeignKeyOnTarget, N as isManyToMany, O as camelCase, P as Vector, S as normalizeToEntityRelation, _ as buildCompositeId, a as getJunctionSecurityRules, b as createRelationRef, c as policyToPostgres, d as findRelation, f as getColumnName, g as resolveCollectionRelations, h as getTableVarName, i as getJunctionCollectionConfig, k as toSnakeCase, l as securityRuleToConditions, m as getTableName$1, n as CollectionRegistry, o as resolveJunctionSpecs, p as getEnumVarName, r as resolveStringColumnLength, s as getEffectiveSecurityRules, t as buildSdkData, u as findAnonymousGrants, v as getDeclaredPrimaryKeys, w as generateForeignKeyName, x as createRelationRefWithData, y as parseIdValues } from "./src-CzbghKwf.js";
 import { n as isPostgresCollectionConfig, r as isRelationalCollectionConfig } from "./src-DoU9yPqq.js";
-import { t as createPostgresWebSocket } from "./websocket-BKcGvILX.js";
-import { A as serverVersionNumToMajor, C as globalsFileForDump, D as parseDbNameFromUrl, E as parseBackupTimestamp, M as withDatabaseName, O as parsePgToolMajor, S as checkToolServerCompatibility, T as parseBackupDestination, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as splitGlobalsStatements, k as resolveConnectionString, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as joinStorageKey, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-DH9kPg-E.js";
+import { t as ANONYMOUS_USER_ID } from "./policy-CeA1JcxP.js";
+import { t as createPostgresWebSocket } from "./websocket-B2LsrINK.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-CD8o_1Sl.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
@@ -49,6 +50,39 @@ function resolveClientListLimit(rawLimit, opts = {}) {
 	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
 }
 //#endregion
+//#region ../common/src/util/email.ts
+/**
+* Email normalization — one implementation, because the database enforces it.
+*
+* `ensureAuthTablesExist` puts a `UNIQUE INDEX ON users (lower(email))` on the
+* auth table. That index decides what "the same address" means, and it does not
+* trim: to Postgres, `' foo@bar.com'` and `'foo@bar.com'` are two addresses and
+* both may exist. So every write that reaches the column has to agree with
+* every read, exactly, or the two disagree in the one direction that matters —
+* a row that exists and cannot be found.
+*
+* That is not hypothetical. The lookup path trimmed and the admin create paths
+* did not, so a user created through `POST /api/data/users` or
+* `POST /api/auth/admin/users` with a stray space was stored untrimmed,
+* survived the unique index alongside the real address, and was unreachable by
+* login forever after. The HTTP auth routes were unaffected only because Zod's
+* `.email()` happens to reject surrounding whitespace — a guard on a different
+* layer, for a different reason, that the admin paths do not sit behind.
+*
+* It lives in `common` because `server`, `server-postgres` and `server-mongo`
+* all write this column and must agree exactly, and `common` is the only
+* package all three already depend on.
+*/
+/**
+* Canonical form of an email address: trimmed, lower-cased.
+*
+* Non-strings pass through untouched, so this is safe to apply to a value out
+* of a partial update payload whose type is not known yet.
+*/
+function normalizeEmail(email) {
+	return typeof email === "string" ? email.trim().toLowerCase() : email;
+}
+//#endregion
 //#region ../common/src/util/callbacks.ts
 /**
 * Helper function to recursively check if there are any callbacks in the properties.
@@ -281,6 +315,35 @@ function requirePrimaryKeys(collection, registry) {
 	return keys;
 }
 /**
+* The column on the *source* table that a `hasOne`/`hasMany` link points at.
+*
+* `sourceKey` is authored when the two sides join on a natural key — an
+* external identity id, a SKU — and left off when they join on the row id,
+* which is the overwhelming majority. That makes `undefined` the only optional
+* field on a resolved relation, so it gets exactly one reader: this function.
+* Every consumer that needs the column asks here, and none of them re-derives
+* "or else the primary key" for itself. That is the whole point — the fallback
+* chains this codebase removed from relation resolution were dangerous because
+* they were *duplicated* and could disagree, not because they existed.
+*/
+function sourceKeyField(relation, sourceCollection, registry) {
+	if (relation.sourceKey) return relation.sourceKey;
+	return requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
+}
+/**
+* Whether this link joins on something other than the source's primary key.
+*
+* Callers that hold a parent *id* — which is most of them, since an id is what
+* a URL carries — must translate it to the source key's value before it can be
+* compared with the target's foreign key. Those that hold the parent *row*, or
+* that build a correlated subquery over the source table, can read the column
+* directly and skip the lookup.
+*/
+function joinsOnNaturalKey(relation, sourceCollection, registry) {
+	if (!relation.sourceKey) return false;
+	return relation.sourceKey !== requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
+}
+/**
 * Collections whose key the *browser* cannot resolve, and what it will do
 * instead.
 *
@@ -451,7 +514,9 @@ var DrizzleConditionBuilder = class {
 			case "hasMany": {
 				const fkColumn = targetTable[relation.foreignKeyOnTarget];
 				if (!fkColumn) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'.`);
-				return eq(fkColumn, parentId);
+				if (!relation.sourceKey) return eq(fkColumn, parentId);
+				const { table, idColumn } = parent();
+				return sql`${fkColumn} = (SELECT ${sql.identifier(relation.sourceKey)} FROM ${table} WHERE ${idColumn} = ${parentId})`;
 			}
 			case "belongsTo": {
 				const { table, idColumn } = parent();
@@ -541,12 +606,16 @@ var DrizzleConditionBuilder = class {
 					column: foreignKey
 				};
 			}
-			if (relation && (hasForeignKeyOnTarget(relation) || isManyToMany(relation)) && registry && sourceIdColumn) return {
-				kind: "relation",
-				relation,
-				registry,
-				sourceIdColumn
-			};
+			if (relation && (hasForeignKeyOnTarget(relation) || isManyToMany(relation)) && registry && sourceIdColumn) {
+				const correlationColumn = hasForeignKeyOnTarget(relation) && relation.sourceKey ? columnAt(relation.sourceKey) : sourceIdColumn;
+				if (!correlationColumn) throw new Error(`\`sourceKey: "${relation.sourceKey}"\` on relation '${relation.relationName}' is not a column on '${collectionPath}', so a filter on that relation has nothing to correlate against.`);
+				return {
+					kind: "relation",
+					relation,
+					registry,
+					sourceIdColumn: correlationColumn
+				};
+			}
 		}
 		for (const guess of [`${field}_id`, generateForeignKeyName(field)]) {
 			const foreignKey = columnAt(guess);
@@ -1345,8 +1414,9 @@ async function parseDataFromServer(data, collection, db, registry) {
 			} else if (hasForeignKeyOnTarget(relation) && db && registry) try {
 				const targetCollection = relation.target();
 				const targetTable = registry.getTable(getTableName$1(targetCollection));
-				const currentId = buildCompositeId(data, getPrimaryKeys(collection, registry));
-				if (targetTable && currentId) {
+				const pks = getPrimaryKeys(collection, registry);
+				const currentId = relation.sourceKey ? data[relation.sourceKey] : buildCompositeId(data, pks);
+				if (targetTable && currentId !== void 0 && currentId !== null && currentId !== "") {
 					const foreignKeyColumn = targetTable[relation.foreignKeyOnTarget];
 					if (foreignKeyColumn) {
 						const relatedRows = await db.select().from(targetTable).where(eq(foreignKeyColumn, currentId)).limit(relation.cardinality === "one" ? 1 : 100);
@@ -1614,6 +1684,33 @@ function normalizeDbValues(data, collection) {
 //#endregion
 //#region src/services/RelationService.ts
 /**
+* The ids in a to-many relation write, whatever shape the caller sent.
+*
+* A membership list is written as either the related rows (`[{ id: 1 }]`, what
+* the admin UI sends back after reading them) or as bare keys (`[1]`, `["t-1"]`,
+* what anyone writing the API by hand sends). Only the first was read, via a
+* blind `.map(rel => rel.id)`, and a bare key therefore became `undefined`:
+* on a numeric-keyed target that surfaced as `Invalid numeric ID: undefined`,
+* and on a string-keyed one it did not surface at all — `String(undefined)`
+* wrote a junction row pointing at the literal `"undefined"`, which no read
+* would ever match. Both shapes are accepted here, in one place, because both
+* call sites had the same assumption.
+*
+* An element that carries no key is refused rather than skipped: dropping it
+* would silently write a shorter membership list than the caller asked for.
+*/
+function relationTargetIds(value, relationName, collectionSlug) {
+	if (!Array.isArray(value)) return [];
+	return value.map((element, index) => {
+		if (typeof element === "string" || typeof element === "number") return element;
+		if (element && typeof element === "object") {
+			const id = element.id;
+			if (typeof id === "string" || typeof id === "number") return id;
+		}
+		throw new Error(`Cannot write relation "${relationName}" on "${collectionSlug}": element ${index} carries no id. Pass either the related rows (\`[{ id: … }]\`) or their keys (\`[1, 2]\`), not ${element === null ? "null" : typeof element}.`);
+	});
+}
+/**
 * Typed wrapper for Drizzle dynamic query innerJoin.
 * Drizzle's `$dynamic()` queries lose the `innerJoin` method from
 * their static type, but it exists at runtime. This helper bridges
@@ -1691,8 +1788,67 @@ var RelationService = class {
 	* reading. Left alone it would silently match on the first key column and
 	* hand a tenant's rows to its neighbour — say so instead.
 	*/
-	assertSingleKeyAddressable(parentCollection, parentPks, via) {
-		if (parentPks.length > 1) throw new Error(`Relation on '${parentCollection.slug}' uses '${via}', a single foreign-key column, but '${parentCollection.slug}' is keyed on ${parentPks.map((k) => `'${k.fieldName}'`).join(" + ")}. One column cannot reference a composite key — express this relation with \`joinPath\`, whose \`on.from\`/\`on.to\` take every key column.`);
+	assertSingleKeyAddressable(parentCollection, parentPks, via, relation) {
+		if (relation && hasForeignKeyOnTarget(relation) && relation.sourceKey) return;
+		if (parentPks.length > 1) throw new Error(`Relation on '${parentCollection.slug}' uses '${via}', a single foreign-key column, but '${parentCollection.slug}' is keyed on ${parentPks.map((k) => `'${k.fieldName}'`).join(" + ")}. One column cannot reference a composite key — give the relation a \`sourceKey\` naming a single unique column to point at, or express it with \`joinPath\`, whose \`on.from\`/\`on.to\` take every key column.`);
+	}
+	/**
+	* What the target's foreign key holds, for each of these parent rows.
+	*
+	* Ordinarily the parent's id, and then this is free. When the relation
+	* declares a `sourceKey` the two are different values, and the mapping
+	* between them lives in the source table — so it costs one SELECT, issued
+	* once for the whole batch rather than per parent.
+	*
+	* Both directions come back because both are needed and deriving one from
+	* the other by hand is how a batch loader ends up attributing a child to the
+	* wrong parent: reads translate id → key to build the WHERE, and then
+	* translate key → id to attribute each row that comes back.
+	*/
+	/**
+	* The value a related row's foreign key must hold to belong to this parent.
+	*
+	* `undefined` when the parent's source key is null — which is not an error
+	* here, only in the callers that were about to write it. Exposed for
+	* {@link PersistService}, which stamps this onto a child created under a
+	* nested path and would otherwise write the id and lose the row.
+	*/
+	async parentKeyValue(parentCollection, relation, parentId, db = this.db) {
+		const { keyByParentId } = await this.resolveSourceKeys(parentCollection, relation, [parentId], db);
+		return keyByParentId.get(String(parentId));
+	}
+	async resolveSourceKeys(parentCollection, relation, parentIds, db = this.db) {
+		const keyByParentId = /* @__PURE__ */ new Map();
+		const parentIdByKey = /* @__PURE__ */ new Map();
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
+		if (!joinsOnNaturalKey(relation, parentCollection, this.registry)) {
+			for (const id of parentIds) {
+				const value = parseIdValues(id, parentPks)[parentPks[0].fieldName];
+				keyByParentId.set(String(id), value);
+				parentIdByKey.set(String(value), id);
+			}
+			return {
+				keyByParentId,
+				parentIdByKey
+			};
+		}
+		const field = sourceKeyField(relation, parentCollection, this.registry);
+		const parentTable = getTableForCollection(parentCollection, this.registry);
+		if (!parentTable[field]) throw new Error(`\`sourceKey: "${field}"\` on relation '${relation.relationName}' is not a column on '${parentCollection.slug}'. It names a column on the source table, not on the target.`);
+		const rows = await db.select().from(parentTable).where(this.parentKeyCondition(parentTable, parentPks, parentIds));
+		for (const row of rows) {
+			const keyValue = row[field];
+			if (keyValue === null || keyValue === void 0) continue;
+			const parentId = buildCompositeId(row, parentPks);
+			keyByParentId.set(String(parentId), keyValue);
+			const existing = parentIdByKey.get(String(keyValue));
+			if (existing !== void 0 && String(existing) !== String(parentId)) throw new Error(`\`sourceKey: "${field}"\` on relation '${relation.relationName}' is not unique on '${parentCollection.slug}': rows '${existing}' and '${parentId}' both hold '${keyValue}'. Add a unique constraint — a link that addresses more than one source row cannot say which one a related row belongs to.`);
+			parentIdByKey.set(String(keyValue), parentId);
+		}
+		return {
+			keyByParentId,
+			parentIdByKey
+		};
 	}
 	/**
 	* Fetch rows related to a parent row through a specific relation
@@ -1751,6 +1907,8 @@ var RelationService = class {
 			}
 			return rows;
 		}
+		const matchValue = hasForeignKeyOnTarget(relation) ? (await this.resolveSourceKeys(parentCollection, relation, [parentId])).keyByParentId.get(String(parentId)) : parsedParentId;
+		if (matchValue === void 0) return [];
 		let query = this.db.select().from(targetTable).$dynamic();
 		const additionalFilters = [];
 		if (options.searchString) {
@@ -1759,7 +1917,7 @@ var RelationService = class {
 			const searchCombined = DrizzleConditionBuilder.combineConditionsWithOr(searchConditions);
 			if (searchCombined) additionalFilters.push(searchCombined);
 		}
-		query = applyDynamicRelationQuery(query, query, relation, parsedParentId, targetTable, parentTable, parentIdCol, idField, this.registry, additionalFilters);
+		query = applyDynamicRelationQuery(query, query, relation, matchValue, targetTable, parentTable, parentIdCol, idField, this.registry, additionalFilters);
 		if (options.limit) query = query.limit(options.limit);
 		const results = await query;
 		if (!results || !Array.isArray(results)) return [];
@@ -1802,8 +1960,10 @@ var RelationService = class {
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
+		const matchValue = hasForeignKeyOnTarget(relation) ? (await this.resolveSourceKeys(parentCollection, relation, [parentId])).keyByParentId.get(String(parentId)) : parsedParentId;
+		if (matchValue === void 0) return 0;
 		let query = this.db.select({ count: sql`count(distinct ${targetIdField})` }).from(targetTable).$dynamic();
-		query = DrizzleConditionBuilder.buildRelationCountQuery(query, relation, parsedParentId, targetTable, parentTable, parentIdCol, targetIdField, this.registry, additionalFilters);
+		query = DrizzleConditionBuilder.buildRelationCountQuery(query, relation, matchValue, targetTable, parentTable, parentIdCol, targetIdField, this.registry, additionalFilters);
 		const result = await query;
 		return Number(result[0]?.count || 0);
 	}
@@ -1930,17 +2090,24 @@ var RelationService = class {
 			}
 			return resultMap;
 		}
-		this.assertSingleKeyAddressable(parentCollection, parentPks, hasForeignKeyOnTarget(relation) ? relation.foreignKeyOnTarget : relation.relationName);
+		this.assertSingleKeyAddressable(parentCollection, parentPks, hasForeignKeyOnTarget(relation) ? relation.foreignKeyOnTarget : relation.relationName, relation);
+		const { keyByParentId, parentIdByKey } = hasForeignKeyOnTarget(relation) ? await this.resolveSourceKeys(parentCollection, relation, parentIds) : {
+			keyByParentId: /* @__PURE__ */ new Map(),
+			parentIdByKey: /* @__PURE__ */ new Map()
+		};
+		const matchValues = hasForeignKeyOnTarget(relation) ? [...keyByParentId.values()] : parsedParentIds;
+		if (matchValues.length === 0) return /* @__PURE__ */ new Map();
 		let query = this.db.select().from(targetTable).$dynamic();
-		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
+		query = applyDynamicRelationQuery(query, query, relation, matchValues, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
 		const resultMap = /* @__PURE__ */ new Map();
-		const parentIdSet = new Set(parsedParentIds.map(String));
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
-			let parentId;
-			if (hasForeignKeyOnTarget(relation)) parentId = targetRow[relation.foreignKeyOnTarget];
-			if (parentId !== void 0 && parentIdSet.has(String(parentId))) resultMap.set(String(parentId), await this.toRelatedRow(targetRow, targetCollection, targetPks));
+			if (!hasForeignKeyOnTarget(relation)) continue;
+			const foreignKeyValue = targetRow[relation.foreignKeyOnTarget];
+			if (foreignKeyValue === void 0 || foreignKeyValue === null) continue;
+			const parentId = parentIdByKey.get(String(foreignKeyValue));
+			if (parentId !== void 0) resultMap.set(String(parentId), await this.toRelatedRow(targetRow, targetCollection, targetPks));
 		}
 		return resultMap;
 	}
@@ -2018,17 +2185,24 @@ var RelationService = class {
 			}
 			return resultMap;
 		}
-		this.assertSingleKeyAddressable(parentCollection, parentPks, hasForeignKeyOnTarget(relation) ? relation.foreignKeyOnTarget : relation.relationName);
+		this.assertSingleKeyAddressable(parentCollection, parentPks, hasForeignKeyOnTarget(relation) ? relation.foreignKeyOnTarget : relation.relationName, relation);
+		const { keyByParentId, parentIdByKey } = hasForeignKeyOnTarget(relation) ? await this.resolveSourceKeys(parentCollection, relation, parentIds) : {
+			keyByParentId: /* @__PURE__ */ new Map(),
+			parentIdByKey: /* @__PURE__ */ new Map()
+		};
+		const matchValues = hasForeignKeyOnTarget(relation) ? [...keyByParentId.values()] : parsedParentIds;
+		if (matchValues.length === 0) return /* @__PURE__ */ new Map();
 		let query = this.db.select().from(targetTable).$dynamic();
-		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
+		query = applyDynamicRelationQuery(query, query, relation, matchValues, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
 		const resultMap = /* @__PURE__ */ new Map();
-		const parentIdSet = new Set(parsedParentIds.map(String));
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
-			let parentId;
-			if (hasForeignKeyOnTarget(relation)) parentId = targetRow[relation.foreignKeyOnTarget];
-			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
+			if (!hasForeignKeyOnTarget(relation)) continue;
+			const foreignKeyValue = targetRow[relation.foreignKeyOnTarget];
+			if (foreignKeyValue === void 0 || foreignKeyValue === null) continue;
+			const parentId = parentIdByKey.get(String(foreignKeyValue));
+			if (parentId !== void 0) {
 				const key = String(parentId);
 				const arr = resultMap.get(key) || [];
 				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
@@ -2045,7 +2219,7 @@ var RelationService = class {
 		for (const [key, value] of Object.entries(relationValues)) {
 			const relation = findRelation(resolvedRelations, key);
 			if (!relation || relation.cardinality !== "many") continue;
-			const targetEntityIds = value && Array.isArray(value) ? value.map((rel) => rel.id) : [];
+			const targetEntityIds = relationTargetIds(value, key, collection.slug);
 			const targetCollection = relation.target();
 			if (relation.kind === "via") {
 				const parentTableName = getTableName$1(collection);
@@ -2127,14 +2301,13 @@ var RelationService = class {
 					logger.warn(`Invalid inverse-many config for relation '${key}' in collection '${collection.slug}'`);
 					continue;
 				}
-				const parentPks = requirePrimaryKeys(collection, this.registry);
-				const parentIdInfo = parentPks[0];
-				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
+				const parentKeyValue = (await this.resolveSourceKeys(collection, relation, [id], tx)).keyByParentId.get(String(id));
+				if (parentKeyValue === void 0) throw new Error(`Cannot write relation '${key}' on '${collection.slug}': row '${id}' has no value in \`sourceKey: "${sourceKeyField(relation, collection, this.registry)}"\`, so there is nothing for the related rows to point at.`);
 				if (targetEntityIds.length > 0) {
 					const parsedTargetIds = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(and(eq(fkCol, parsedParentId), sql`${targetIdCol} NOT IN (${sql.join(parsedTargetIds)})`));
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: parsedParentId }).where(inArray(targetIdCol, parsedTargetIds));
-				} else await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(fkCol, parsedParentId));
+					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(and(eq(fkCol, parentKeyValue), sql`${targetIdCol} NOT IN (${sql.join(parsedTargetIds)})`));
+					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: parentKeyValue }).where(inArray(targetIdCol, parsedTargetIds));
+				} else await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(fkCol, parentKeyValue));
 			} else logger.warn(`Many relation '${key}' in collection '${collection.slug}' lacks write configuration and will be skipped during save.`);
 		}
 	}
@@ -2149,8 +2322,7 @@ var RelationService = class {
 				const targetTable = getTableForCollection(targetCollection, this.registry);
 				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
-				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
-				const sourceIdInfo = sourcePks[0];
+				requirePrimaryKeys(sourceCollection, this.registry)[0];
 				if (relation.kind === "via") {
 					await this.updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue);
 					continue;
@@ -2172,13 +2344,14 @@ var RelationService = class {
 					logger.warn(`Foreign key column '${relation.foreignKeyOnTarget}' not found in target table for relation '${relation.relationName}'`);
 					continue;
 				}
-				const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
-				if (newValue === null || newValue === void 0) await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(foreignKeyColumn, parsedSourceId));
+				const sourceKeyValue = (await this.resolveSourceKeys(sourceCollection, relation, [sourceEntityId], tx)).keyByParentId.get(String(sourceEntityId));
+				if (sourceKeyValue === void 0) throw new Error(`Cannot write relation '${relation.relationName}' on '${sourceCollection.slug}': row '${sourceEntityId}' has no value in \`sourceKey: "${sourceKeyField(relation, sourceCollection, this.registry)}"\`, so there is nothing for the related row to point at.`);
+				if (newValue === null || newValue === void 0) await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
 				else {
 					const parsedNewTargetId = parseIdValues(newValue, targetPks)[targetIdInfo.fieldName];
 					const targetIdField = targetTable[targetIdInfo.fieldName];
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(foreignKeyColumn, parsedSourceId));
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: parsedSourceId }).where(eq(targetIdField, parsedNewTargetId));
+					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
+					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: sourceKeyValue }).where(eq(targetIdField, parsedNewTargetId));
 				}
 			} catch (e) {
 				logger.warn(`Failed to update inverse relation '${relation.relationName}'`, { error: e });
@@ -2225,7 +2398,7 @@ var RelationService = class {
 				if (newValue && Array.isArray(newValue) && newValue.length > 0) {
 					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
-					const newLinks = newValue.map((rel) => typeof rel === "object" && rel !== null ? rel.id : rel).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
+					const newLinks = relationTargetIds(newValue, relation.relationName, sourceCollection.slug).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedSourceId,
 						[targetJunctionColumn.name]: targetId
 					}));
@@ -2269,7 +2442,7 @@ var RelationService = class {
 			if (newValue && Array.isArray(newValue) && newValue.length > 0) {
 				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
-				const newLinks = newValue.map((rel) => rel.id).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
+				const newLinks = relationTargetIds(newValue, relation.relationName, sourceCollection.slug).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 					[sourceJunctionColumn.name]: parsedSourceId,
 					[targetJunctionColumn.name]: targetId
 				}));
@@ -2484,7 +2657,7 @@ function relationTargetAddress(targetRow, targetCollection, registry) {
 * expects real types. The row's own address is *not* among the columns — it is
 * derived by the consumer from the collection's primary keys.
 */
-function toCmsRow(row, collection, registry) {
+function toFlatRow(row, collection, registry) {
 	const resolvedRelations = resolveCollectionRelations(collection);
 	const normalized = normalizeDbValues(row, collection);
 	for (const [key, relation] of Object.entries(resolvedRelations)) {
@@ -2681,17 +2854,35 @@ var FetchService = class {
 		const columnAt = (key) => (key in table ? table[key] : void 0) || void 0;
 		const direct = columnAt(orderBy);
 		if (direct) return direct;
-		if (collection) {
-			const relation = resolveCollectionRelations(collection)[orderBy];
-			if (relation?.kind === "belongsTo") {
-				const foreignKey = columnAt(relation.localKey);
-				if (foreignKey) return foreignKey;
-			}
+		const declaredRelation = collection ? resolveCollectionRelations(collection)[orderBy] : void 0;
+		if (declaredRelation?.kind === "belongsTo") {
+			const foreignKey = columnAt(declaredRelation.localKey);
+			if (foreignKey) return foreignKey;
 		}
 		for (const guess of [`${orderBy}_id`, generateForeignKeyName(orderBy)]) {
 			const foreignKey = columnAt(guess);
 			if (foreignKey) return foreignKey;
 		}
+		const collectionName = collection?.slug ?? collection?.name;
+		const onCollection = collectionName ? ` on collection '${collectionName}'` : "";
+		if (declaredRelation && declaredRelation.kind !== "belongsTo") throw ApiError.badRequest(`Cannot sort by '${orderBy}'${onCollection}: it is a to-many relation (${declaredRelation.kind}), which has no single value per row to order by.`, "ORDER_BY_FIELD_NOT_SORTABLE", {
+			field: orderBy,
+			kind: declaredRelation.kind,
+			...collectionName && { collection: collectionName }
+		});
+		if (getUnknownFilterFieldsMode() === "warn") {
+			logger.warn(`Sorting by field '${orderBy}'${onCollection}, but it does not exist in the table — the ORDER BY was dropped and these rows are unsorted.`);
+			return;
+		}
+		let validFields = [];
+		try {
+			validFields = Object.keys(getTableColumns(table)).sort();
+		} catch {}
+		throw ApiError.badRequest(`Unknown orderBy field '${orderBy}'${onCollection}` + (validFields.length > 0 ? `. Valid fields: ${validFields.join(", ")}` : ""), "UNKNOWN_ORDER_BY_FIELD", {
+			field: orderBy,
+			...collectionName && { collection: collectionName },
+			...validFields.length > 0 && { validFields }
+		});
 	}
 	/**
 	* Build the `with` config for Drizzle's relational query API.
@@ -2905,7 +3096,7 @@ var FetchService = class {
 				with: withConfig
 			});
 			if (!row) return void 0;
-			const flatRow = toCmsRow(row, collection, this.registry);
+			const flatRow = toFlatRow(row, collection, this.registry);
 			await this.resolveJoinPathRelations(flatRow, collection, collectionPath, parsedId, databaseId);
 			return flatRow;
 		} catch (e) {
@@ -2960,7 +3151,7 @@ var FetchService = class {
 		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
 		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0, scopeCondition);
-			return (await qb.findMany(queryOpts)).map((row) => toCmsRow(row, collection, this.registry));
+			return (await qb.findMany(queryOpts)).map((row) => toFlatRow(row, collection, this.registry));
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
 				logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
@@ -3023,7 +3214,7 @@ var FetchService = class {
 	/**
 	* Fallback path used when db.query is unavailable.
 	*
-	* The primary path runs the results through `toCmsRow`, which maps
+	* The primary path runs the results through `toFlatRow`, which maps
 	* relations from what drizzle already nested — no query per row. This one
 	* has no nesting to read, so it resolves relations itself, in batches.
 	*
@@ -3116,6 +3307,10 @@ var FetchService = class {
 			const filterConditions = this.buildFilterConditions(options.filter, table, effectivePath);
 			if (filterConditions.length > 0) allConditions.push(...filterConditions);
 		}
+		if (options.logical) {
+			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, effectivePath, this.filterContext(effectivePath, table));
+			if (logicalCondition) allConditions.push(logicalCondition);
+		}
 		if (allConditions.length > 0) {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
 			if (finalCondition) query = query.where(finalCondition);
@@ -3453,6 +3648,38 @@ function extractCauseMessage(error) {
 	return null;
 }
 /**
+* Codes that mean "this connection will never work as configured".
+*
+* A wrong password or a database that does not exist is a settled fact about
+* the connection string, not a transient fault — retrying produces the same
+* answer forever.
+*/
+var UNRECOVERABLE_CONNECT_CODES = /* @__PURE__ */ new Set([
+	"28P01",
+	"28000",
+	"3D000",
+	"42501"
+]);
+/**
+* Describe a failed connection attempt in terms a developer can act on.
+*
+* The error a caller catches is Drizzle's wrapper: its message is
+* `Failed query: SELECT 1` and its stack runs through drizzle internals, while
+* the sentence that says what is actually wrong — "password authentication
+* failed for user …", "database … does not exist" — sits in `.cause`. Logging
+* the wrapper, as the bootstrapper used to, tells a developer with a typo in
+* their `DATABASE_URL` nothing at all.
+*/
+function classifyConnectFailure(error) {
+	const pgError = extractPgError(error);
+	const reason = pgError?.message ?? extractCauseMessage(error) ?? (error instanceof Error ? error.message : String(error));
+	return {
+		fatal: Boolean(pgError?.code && UNRECOVERABLE_CONNECT_CODES.has(pgError.code)),
+		reason,
+		code: pgError?.code
+	};
+}
+/**
 * Detect whether an error is specifically a role-switching permission failure
 * (e.g. "permission denied to set role" or "must be member of role"),
 * as opposed to a table-level permission denial.
@@ -3715,10 +3942,11 @@ var PersistService = class {
 			} else {
 				const targetColumnName = this.resolveParentForeignKeyColumn(hop);
 				if (targetColumnName) {
-					const parsedParentId = parentIdForWrite();
+					const parentKeyValue = hasForeignKeyOnTarget(hop.relation) ? await this.relationService.parentKeyValue(hop.parentCollection, hop.relation, hop.parentId) : parentIdForWrite();
+					if (parentKeyValue === void 0) throw ApiError.badRequest(`Cannot create under "${collectionPath}": the parent row has no value in \`sourceKey\`, so the new row has nothing to point at.`);
 					const existingValue = effectiveValues[targetColumnName];
-					if (existingValue !== void 0 && existingValue !== null && existingValue !== parsedParentId) logger.warn(`Overriding provided value '${existingValue}' for FK '${targetColumnName}' with path parent id '${parsedParentId}'.`);
-					effectiveValues[targetColumnName] = parsedParentId;
+					if (existingValue !== void 0 && existingValue !== null && existingValue !== parentKeyValue) logger.warn(`Overriding provided value '${existingValue}' for FK '${targetColumnName}' with path parent key '${parentKeyValue}'.`);
+					effectiveValues[targetColumnName] = parentKeyValue;
 				}
 			}
 		}
@@ -4996,9 +5224,10 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	async checkUniqueField(path, name, value, id, collection) {
 		return this.dataService.checkUniqueField(path, name, value, id, collection?.databaseId);
 	}
-	async count({ path, collection, filter, searchString }) {
+	async count({ path, collection, filter, logical, searchString }) {
 		return this.dataService.count(path, {
 			filter,
+			logical,
 			searchString
 		});
 	}
@@ -5367,7 +5596,7 @@ var DatabasePoolManager = class {
 		const url = new URL(this.rootConnectionString);
 		url.pathname = `/${databaseName}`;
 		const pool = new Pool({
-			connectionString: url.toString(),
+			connectionString: pinSearchPath(url.toString()),
 			max: 10,
 			idleTimeoutMillis: 1e4,
 			allowExitOnIdle: true
@@ -5955,8 +6184,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 		const tableVarName = getTableVarName(tableName);
 		if (isJunction && relation && sourceCollection && isManyToMany(relation)) {
 			const targetCollection = relation.target();
-			const schema = (isPostgresCollectionConfig(targetCollection) ? targetCollection.schema : void 0) || (isPostgresCollectionConfig(sourceCollection) ? sourceCollection.schema : void 0);
-			const tableCreator = schema ? `${schema}Schema.table` : "pgTable";
+			const tableCreator = "pgTable";
 			const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
 			const { sourceColumn, targetColumn } = relation.through;
 			const refOptions = `{ onDelete: \"${relation.onDelete ?? "cascade"}\" }`;
@@ -6070,8 +6298,9 @@ var generateSchema = async (collections, stripPolicies = false) => {
 						if (!emittedRelationNames.has(deduplicationKey)) {
 							const otherTableVar = getTableVarName(getTableName$1(otherCollection));
 							const drizzleFieldKey = resolvePropertyKeyForColumn(collection, otherRel.foreignKeyOnTarget);
+							const referencedKey = otherRel.sourceKey ? resolvePropertyKeyForColumn(otherCollection, otherRel.sourceKey) : getPrimaryKeyName(otherCollection);
 							const synthKey = `_synth_${otherTableVar}_${drizzleFieldKey}`;
-							tableRelations.push(`    "${synthKey}": one(${otherTableVar}, {\n        fields: [${tableVarName}.${drizzleFieldKey}],\n        references: [${otherTableVar}.${getPrimaryKeyName(otherCollection)}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
+							tableRelations.push(`    "${synthKey}": one(${otherTableVar}, {\n        fields: [${tableVarName}.${drizzleFieldKey}],\n        references: [${otherTableVar}.${referencedKey}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
 							emittedRelationNames.add(deduplicationKey);
 						}
 					}
@@ -7229,14 +7458,6 @@ function resolveChannelBusSetting(configured) {
 	return raw === "memory" ? { type: "memory" } : { type: "postgres" };
 }
 /**
-* @deprecated Use {@link resolveChannelBusSetting}, which also accepts a
-* supplied {@link ChannelBus} instance. Kept as a narrow alias so existing
-* config-only callers keep their exact types.
-*/
-function resolveChannelBusConfig(configured) {
-	return resolveChannelBusSetting(configured);
-}
-/**
 * Produce the bus a setting asks for.
 *
 * An instance is handed straight back — constructing it was the application's
@@ -7713,7 +7934,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (this.driver) {
 			const collection = this.registry.getCollectionByPath(notifyPath);
 			const activeAuth = authContext || {
-				uid: "anon",
+				uid: "anonymous",
 				roles: ["anon"]
 			};
 			return await this.db.transaction(async (tx) => {
@@ -7842,7 +8063,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (this.driver) {
 			const collection = this.registry.getCollectionByPath(notifyPath);
 			const activeAuth = authContext || {
-				uid: "anon",
+				uid: "anonymous",
 				roles: ["anon"]
 			};
 			return await this.db.transaction(async (tx) => {
@@ -8847,7 +9068,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-DH9kPg-E.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-CD8o_1Sl.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -8978,6 +9199,11 @@ function findRelationDefects(collections, registry) {
 						problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
 						fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
 					});
+					if (relation.sourceKey && !sourceColumns.has(relation.sourceKey)) defects.push({
+						...at,
+						problem: `\`sourceKey: "${relation.sourceKey}"\` is not a column on \`${sourceTableName}\``,
+						fix: targetColumns.has(relation.sourceKey) ? `it is a column on the *target* table \`${targetTableName}\` — \`sourceKey\` names the column on this collection that the target's foreign key points at, so it must be one of: ${quote(sourceColumns)}` : `add the column, or set \`sourceKey\` to one of: ${quote(sourceColumns)}`
+					});
 					break;
 				case "manyToMany": {
 					const { table, sourceColumn, targetColumn } = relation.through;
@@ -9729,21 +9955,6 @@ async function ensureAuthTablesExist(db, collection) {
 }
 //#endregion
 //#region src/auth/services.ts
-function getColumnKey(table, ...keys) {
-	if (!table) return void 0;
-	for (const key of keys) {
-		if (key in table) return key;
-		const snake = toSnakeCase(key);
-		if (snake in table) return snake;
-		const camel = camelCase(key);
-		if (camel in table) return camel;
-	}
-}
-function getColumn(table, ...keys) {
-	if (!table) return void 0;
-	const key = getColumnKey(table, ...keys);
-	return key ? table[key] : void 0;
-}
 /**
 * The single definition of what an email address looks like in storage.
 *
@@ -9758,9 +9969,25 @@ function getColumn(table, ...keys) {
 *
 * Whitespace goes too: a trailing space survives the fold and reproduces the
 * problem exactly.
+*
+* Re-exported rather than defined here: `@rebasepro/server` and
+* `@rebasepro/server-mongo` write this column too, and a second copy of this
+* rule is the defect it exists to prevent.
 */
-function normalizeEmail(email) {
-	return typeof email === "string" ? email.trim().toLowerCase() : email;
+function getColumnKey(table, ...keys) {
+	if (!table) return void 0;
+	for (const key of keys) {
+		if (key in table) return key;
+		const snake = toSnakeCase(key);
+		if (snake in table) return snake;
+		const camel = camelCase(key);
+		if (camel in table) return camel;
+	}
+}
+function getColumn(table, ...keys) {
+	if (!table) return void 0;
+	const key = getColumnKey(table, ...keys);
+	return key ? table[key] : void 0;
 }
 /**
 * PostgreSQL implementation of UserRepository.
@@ -11101,6 +11328,31 @@ function humanize(snakeName) {
 	return snakeName.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 }
 //#endregion
+//#region src/schema/introspect-db-types.ts
+/**
+* The PostgreSQL type → Rebase property type mapping.
+*
+* Split out of `introspect-db-logic` so that the structural analysis can use it
+* without importing the generator, which imports the analysis. Re-exported from
+* `introspect-db-logic` so existing callers keep their import path.
+*/
+/**
+* Map a PostgreSQL data type to a Rebase property type.
+*/
+function mapPgType(dataType) {
+	const dt = dataType.toLowerCase();
+	if (dt === "interval") return "string";
+	if (dt === "array" || dt.startsWith("_")) return "array";
+	if (dt.includes("int") || dt.includes("numeric") || dt.includes("decimal") || dt.includes("serial") || dt === "real" || dt === "float4" || dt === "float8" || dt === "double precision" || dt === "money") return "number";
+	if (dt.includes("bool")) return "boolean";
+	if (dt.includes("time") || dt.includes("date")) return "date";
+	if (dt === "json" || dt === "jsonb") return "map";
+	if (dt === "bytea") return "binary";
+	if (dt === "inet" || dt === "cidr" || dt === "macaddr" || dt === "macaddr8") return "string";
+	if (dt === "uuid") return "string";
+	return "string";
+}
+//#endregion
 //#region src/schema/introspect-db-logic.ts
 var IRREGULAR_SINGULARS = {
 	people: "person",
@@ -11116,6 +11368,36 @@ var IRREGULAR_SINGULARS = {
 	criteria: "criterion",
 	phenomena: "phenomenon"
 };
+/**
+* Plurals in "-ves" whose singular really ends in f/fe, and which of the two.
+*
+* A blanket "-ves" -> "-f" rule gets `knives` -> `knif`, and mangles every
+* ordinary "-ive" noun that happens to be plural along with it: `archives` ->
+* `archif`, `objectives` -> `objectif`. The set of English words that genuinely
+* swap f/fe for ves is small and closed, so it is listed rather than guessed —
+* anything else ending in "ves" drops the trailing 's' like any other plural.
+*
+* Matched on the whole word, not on the suffix: `olives` ends in `lives`.
+*/
+var VES_SINGULAR_ENDINGS = {
+	calves: "f",
+	dwarves: "f",
+	elves: "f",
+	halves: "f",
+	hooves: "f",
+	leaves: "f",
+	loaves: "f",
+	scarves: "f",
+	selves: "f",
+	sheaves: "f",
+	shelves: "f",
+	thieves: "f",
+	wharves: "f",
+	wolves: "f",
+	knives: "fe",
+	lives: "fe",
+	wives: "fe"
+};
 /** Words ending in 's' that are already singular. */
 var UNCOUNTABLE = /* @__PURE__ */ new Set([
 	"status",
@@ -11154,7 +11436,7 @@ function singularize(word) {
 	if (UNCOUNTABLE.has(lower)) return word;
 	if (lower.endsWith("ices") && lower.length > 5) return word.slice(0, -4) + "ex";
 	if (lower.endsWith("ies") && lower.length > 3) return word.slice(0, -3) + "y";
-	if (lower.endsWith("ves")) return word.slice(0, -3) + "f";
+	if (VES_SINGULAR_ENDINGS[lower]) return word.slice(0, -3) + VES_SINGULAR_ENDINGS[lower];
 	if (lower.endsWith("ches") || lower.endsWith("shes") || lower.endsWith("sses") || lower.endsWith("xes") || lower.endsWith("zes")) return word.slice(0, -2);
 	if (lower.endsWith("ses") && !lower.endsWith("sses")) return word.slice(0, -1);
 	if (lower.endsWith("s") && !lower.endsWith("ss") && !lower.endsWith("us") && !lower.endsWith("is")) return word.slice(0, -1);
@@ -11175,22 +11457,6 @@ function getIconForTable(tableName) {
 	if (table.includes("comment") || table.includes("review") || table.includes("feedback")) return "MessageCircle";
 	return "Database";
 }
-/**
-* Map a PostgreSQL data type to a Rebase property type.
-*/
-function mapPgType(dataType) {
-	const dt = dataType.toLowerCase();
-	if (dt === "interval") return "string";
-	if (dt === "array" || dt.startsWith("_")) return "array";
-	if (dt.includes("int") || dt.includes("numeric") || dt.includes("decimal") || dt.includes("serial") || dt === "real" || dt === "float4" || dt === "float8" || dt === "double precision" || dt === "money") return "number";
-	if (dt.includes("bool")) return "boolean";
-	if (dt.includes("time") || dt.includes("date")) return "date";
-	if (dt === "json" || dt === "jsonb") return "map";
-	if (dt === "bytea") return "binary";
-	if (dt === "inet" || dt === "cidr" || dt === "macaddr" || dt === "macaddr8") return "string";
-	if (dt === "uuid") return "string";
-	return "string";
-}
 function buildEnumMap(enumValues) {
 	const enumMap = /* @__PURE__ */ new Map();
 	for (const ev of enumValues) {
@@ -11210,6 +11476,20 @@ function buildTablesMap(tables, columns, pks, fks) {
 	});
 	return tablesMap;
 }
+/**
+* Join tables, identified by column name.
+*
+* Superseded for the CLI by `classifyTables` in `./introspect-db-structure`,
+* which asks the database instead: two single-column keys, unique together, no
+* payload column, nothing referencing the table. This rule folds away
+* `northwind.order_details` — which has the key shape and carries unit price,
+* quantity and discount — because it recognises `id`, `created_at` and
+* `updated_at` by name and calls everything else a foreign key.
+*
+* Still used by `./introspect-runtime`, which builds collections in memory from
+* a narrower set of catalog queries and has no unique-constraint or row-count
+* data to reason with.
+*/
 function identifyJoinTables(tablesMap) {
 	const joinTables = /* @__PURE__ */ new Set();
 	for (const [tableName, meta] of tablesMap.entries()) if (meta.fks.length === 2) {
@@ -11332,11 +11612,27 @@ function buildProperties(meta, enumMap) {
 	return properties;
 }
 /**
-* Owning relations, derived from this table's foreign keys. Mirrors the shape
-* `generateCollectionFile` emits, except `target` uses the slug string form
-* rather than a thunk to a module import.
-*/
-function buildRelations(meta, slugByTable) {
+* Owning relations, derived from this table's foreign keys — the same shape
+* `generateCollectionFile` writes into a collection file: a `relation` property
+* whose nested descriptor carries `kind`, a `target` thunk and the `localKey`.
+*
+* The shape is load-bearing, not cosmetic. `resolveCollectionRelations` reads
+* relations from `property.relation` and `resolveRelation` requires `target` to
+* be a thunk; this used to emit `target`/`cardinality`/`localKey` flat on the
+* property with the slug as a bare string, which satisfies neither. Nothing
+* threw — the resolver simply skipped every such property and reported that the
+* collection had no relations. So an introspected BaaS collection had its FK
+* columns removed from `properties` (they "surface as relations") and then no
+* resolvable relation to surface as, which is why writing the FK column
+* directly came back as `has no field 'product_id'`: `assertKnownWriteFields`
+* learns that column from the resolved relation's `localKey`.
+*
+* The thunk closes over the collections being built in this same pass rather
+* than importing a module, which is what a runtime introspection has instead of
+* generated files. It is called lazily, after the map is fully populated, so a
+* table may reference one introspected later.
+*/
+function buildRelations(meta, slugByTable, collectionBySlug) {
 	const relations = {};
 	for (const fk of meta.fks) {
 		const targetSlug = slugByTable.get(fk.foreign_table_name);
@@ -11346,10 +11642,11 @@ function buildRelations(meta, slugByTable) {
 		relations[key] = {
 			name: humanize(key),
 			type: "relation",
-			target: targetSlug,
-			cardinality: "one",
-			direction: "owning",
-			localKey: fk.column_name
+			relation: {
+				kind: "belongsTo",
+				target: () => collectionBySlug.get(targetSlug),
+				localKey: fk.column_name
+			}
 		};
 	}
 	return relations;
@@ -11364,6 +11661,7 @@ function buildCollectionsFromSchema({ tablesMap, enumMap, joinTables }, pgSchema
 	const slugByTable = /* @__PURE__ */ new Map();
 	for (const tableName of tablesMap.keys()) if (!joinTables.has(tableName)) slugByTable.set(tableName, tableName);
 	const collections = [];
+	const collectionBySlug = /* @__PURE__ */ new Map();
 	for (const [tableName, meta] of tablesMap) {
 		if (joinTables.has(tableName)) continue;
 		const collectionName = humanize(tableName);
@@ -11376,10 +11674,11 @@ function buildCollectionsFromSchema({ tablesMap, enumMap, joinTables }, pgSchema
 			icon: getIconForTable(tableName),
 			properties: {
 				...buildProperties(meta, enumMap),
-				...buildRelations(meta, slugByTable)
+				...buildRelations(meta, slugByTable, collectionBySlug)
 			}
 		};
 		collections.push(collection);
+		collectionBySlug.set(tableName, collection);
 	}
 	return collections;
 }
@@ -11569,6 +11868,32 @@ function isEconnrefused(err) {
 * Implements the `BackendBootstrapper` interface for PostgreSQL.
 */
 /**
+* Which table name the boot-time drift check should look for, for one collection.
+*
+* A declared `table` IS the table name, not a hint to be second-guessed. This
+* used to ask the registry whether it had indexed the declared name and fall
+* back to the SLUG when it had not — but "the registry does not know this table"
+* is exactly the condition the drift check exists to report, so the fallback
+* fired precisely when it was most harmful.
+*
+* A collection with `slug: "usage-daily", table: "usage_daily"` was reported as
+* missing table `usage-daily`: a name that does not exist, should never exist,
+* and that nobody can find by looking. Worse, the remediation the caller prints
+* says to run `rebase db push` — which would then CREATE that invented table
+* beside the correct one, the same "second copy" hazard the misplaced-schema
+* branch further down exists to prevent. Seen in production, where a correctly
+* migrated database reported drift on every boot.
+*
+* The slug is used only when nothing was declared, which is the config shape
+* where the slug genuinely is the table name.
+*
+* Exported for its own test: the caller needs a live pool and a real database,
+* and this is the part that was wrong.
+*/
+function resolveDriftCheckName(col, registeredTableNames) {
+	return (isRelationalCollectionConfig(col) ? col.table : void 0) ?? registeredTableNames.find((k) => k === col.slug) ?? col.slug;
+}
+/**
 * Default PostgreSQL bootstrapper.
 *
 * Use it to register Postgres with `initializeRebaseBackend()`:
@@ -11639,14 +11964,25 @@ function createPostgresBootstrapper(pgConfig) {
 					logger.error(message);
 					throw new Error(`Cannot connect to PostgreSQL at ${hostInfo}: connection refused. Is the database running?`);
 				}
-				logger.error("❌ Failed to connect to PostgreSQL", { error: err });
+				const { fatal, reason, code } = classifyConnectFailure(err);
+				const detail = code ? ` [${code}]` : "";
+				if (fatal) {
+					logger.error(`
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ❌  PostgreSQL refused the connection
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  ${reason}${detail}\n\n  The server is reachable, so this is the credentials or the\n  database name in DATABASE_URL — check them in your .env.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`);
+					throw new Error(`PostgreSQL refused the connection: ${reason}${detail}`);
+				}
+				logger.error(`❌ Failed to connect to PostgreSQL: ${reason}${detail}`, { error: err });
 				logger.warn("⚠️ Continuing without initial database verification. Drizzle/PG will attempt to connect on subsequent queries.");
 			}
 			const realtimeService = new RealtimeService(schemaAwareDb, registry);
 			let readDb;
 			const readUrl = process.env.DATABASE_READ_URL;
 			if (readUrl && readUrl !== pgConfig.connectionString) try {
-				const { createReadReplicaConnection } = await import("./connection-B5Wndbr1.js").then((n) => n.t);
+				const { createReadReplicaConnection } = await import("./connection-BuZ97wsr.js").then((n) => n.t);
 				readDb = createReadReplicaConnection(readUrl, mergedSchema).db;
 				logger.info("📖 [PostgresBootstrapper] Read replica connection established");
 			} catch (err) {
@@ -11748,40 +12084,61 @@ function createPostgresBootstrapper(pgConfig) {
 			try {
 				const registeredCollections = registry.getCollections();
 				if (registeredCollections.length > 0) {
-					const schemasList = Array.from(new Set(registeredCollections.map((c) => "schema" in c && c.schema ? c.schema : "public"))).map((s) => `'${s}'`).join(",");
 					const result = await schemaAwareDb.execute(sql.raw(`
                         SELECT table_name, table_schema
                         FROM information_schema.tables
-                        WHERE table_schema IN (${schemasList})
+                        WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
                           AND table_type = 'BASE TABLE'
                     `));
+					const tablesByName = /* @__PURE__ */ new Map();
+					for (const row of result.rows) {
+						const schemas = tablesByName.get(row.table_name) ?? [];
+						schemas.push(row.table_schema);
+						tablesByName.set(row.table_name, schemas);
+					}
 					const dbTables = new Set(result.rows.map((r) => r.table_schema === "public" ? r.table_name : `${r.table_schema}.${r.table_name}`));
 					const missing = [];
 					for (const col of registeredCollections) {
 						if (col.auth?.enabled) continue;
 						const schemaName = "schema" in col && col.schema ? col.schema : "public";
-						const declaredTable = isRelationalCollectionConfig(col) ? col.table : void 0;
-						const tableName = registry.hasTableForCollection(declaredTable ?? col.slug) ? declaredTable ?? col.slug : col.slug;
-						const checkName = registry.getTableNames().find((k) => k === tableName || k === col.slug) ?? tableName;
+						const checkName = resolveDriftCheckName(col, registry.getTableNames());
 						const fullCheckName = schemaName === "public" ? checkName : `${schemaName}.${checkName}`;
 						if (!dbTables.has(fullCheckName)) missing.push({
 							slug: col.slug,
-							table: fullCheckName
+							table: fullCheckName,
+							foundIn: (tablesByName.get(checkName) ?? []).filter((s) => s !== schemaName)
 						});
 					}
 					if (missing.length > 0) {
-						const lines = missing.map((m) => `    • collection "${m.slug}" → table "${m.table}"`);
+						const lines = missing.map((m) => `    • collection "${m.slug}" → table "${m.table}"` + (m.foundIn.length > 0 ? ` — but a table of that name exists in ${m.foundIn.map((s) => `"${s}"`).join(", ")}` : ""));
+						const misplaced = missing.filter((m) => m.foundIn.length > 0);
+						const misplacedHelp = misplaced.length === 0 ? [] : [
+							"  Those tables exist — in the wrong schema. Unqualified SQL run by a",
+							"  role whose name matches a schema (`rebase` is both, by default)",
+							"  resolves through search_path's \"$user\" and creates there. Move them:",
+							...misplaced.map((m) => `      ALTER TABLE "${m.foundIn[0]}"."${m.table.split(".").pop()}" SET SCHEMA "${m.table.includes(".") ? m.table.split(".")[0] : "public"}";`),
+							"  and qualify the SQL that created them, or pin search_path in DATABASE_URL",
+							"  (`?options=-c%20search_path%3Dpublic`).",
+							""
+						];
 						logger.warn([
 							"",
-							"┌──────────────────────────────────────────────────────────────┐",
-							"│  ⚠️  SCHEMA DRIFT — Missing tables in database               │",
-							"├──────────────────────────────────────────────────────────────┤",
-							...lines.map((l) => `│ ${l.padEnd(60)}│`),
-							"├──────────────────────────────────────────────────────────────┤",
-							"│  Run one of:                                                 │",
-							"│    pnpm db:push      (dev — fast, no migration files)        │",
-							"│    pnpm db:migrate   (prod — creates migration files)        │",
-							"└──────────────────────────────────────────────────────────────┘",
+							"⚠️  SCHEMA DRIFT — the database is missing tables this backend serves:",
+							...lines,
+							"",
+							...misplacedHelp,
+							"  This runtime applies the collection schema at boot unless",
+							"  REBASE_MIGRATE_ON_BOOT=none. Check the \"Collection schema\" / \"policies\"",
+							"  log lines above — this drift means that step was off, skipped, or failed.",
+							"    • Managed cloud: redeploy with REBASE_MIGRATE_ON_BOOT unset or",
+							"      \"ensure\"; the runtime applies the schema to the tenant DB.",
+							"      If the log above says the driver does not implement collection-table",
+							"      creation, THIS driver is too old to do it. A driver is installed from",
+							"      your bundle's dependencies, not supplied by the platform image, so a",
+							"      newer runtime will not update it: bump \"@rebasepro/server-postgres\"",
+							"      in your project's package.json and redeploy.",
+							"    • Self-host: run `rebase db push` (dev) or `rebase db migrate` (prod)",
+							"      against DATABASE_URL.",
 							""
 						].join("\n"));
 					}
@@ -11868,18 +12225,46 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CIHSH962.js");
-			return { applied: (await ensureCollectionTables({ async query(text) {
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-Da2oGkX2.js");
+			const plan = await ensureCollectionTables({ async query(text) {
+				const result = await internals.db.execute(sql.raw(text));
+				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
+			} }, collections, log);
+			for (const failure of plan.failures) logger.warn(`🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
+			return { applied: plan.actions.length - plan.failures.length };
+		},
+		/**
+		* Apply the collections' RLS policies — ENABLE ROW LEVEL SECURITY and the
+		* `securityRules` compiled to `CREATE POLICY` — so a freshly provisioned
+		* database serves data instead of denying every user-context read.
+		*
+		* The companion to {@link ensureCollectionSchema}: that creates the
+		* tables, this makes them servable. Boot runs it *after* auth
+		* initialization, because the generated policies call `auth.uid()` /
+		* `auth.roles()`, and `CREATE POLICY` validates those functions exist.
+		*
+		* Runs through the same drizzle handle, one statement at a time (that
+		* handle speaks the extended query protocol, which rejects multi-command
+		* strings). Failures are per-table and non-fatal: a table left un-policed
+		* stays RLS-enabled, so it denies rather than leaks.
+		*/
+		async ensureCollectionPolicies(collections, driverResult, log) {
+			const internals = driverResult.internals;
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-BrUVgjz3.js");
+			const outcome = await ensureCollectionPolicies({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
-			} }, collections, log)).actions.length };
+			} }, collections, log);
+			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
+			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — it stays locked (denies) until this is resolved: ${failure.error}`);
+			return { applied: outcome.policiesApplied };
 		},
 		getAdmin(driverResult) {
 			return driverResult.internals.driver.admin;
 		},
 		mountRoutes(app, basePath, driverResult) {},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			const { createPostgresWebSocket } = await import("./websocket-BKcGvILX.js").then((n) => n.n);
+			const { createPostgresWebSocket } = await import("./websocket-B2LsrINK.js").then((n) => n.n);
 			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
 		}
 	};
@@ -11905,9 +12290,11 @@ function createPostgresAdapter(pgConfig) {
 		async initializeHistory(config, driverResult) {
 			if (bootstrapper.initializeHistory) return bootstrapper.initializeHistory(config, driverResult);
 		},
-		initializeWebsockets(server, realtimeService, driver, config) {
-			if (bootstrapper.initializeWebsockets) return bootstrapper.initializeWebsockets(server, realtimeService, driver, config);
+		initializeWebsockets(server, realtimeService, driver, config, adapter) {
+			if (bootstrapper.initializeWebsockets) return bootstrapper.initializeWebsockets(server, realtimeService, driver, config, adapter);
 		},
+		ensureCollectionSchema: bootstrapper.ensureCollectionSchema ? (collections, driverResult, log) => bootstrapper.ensureCollectionSchema(collections, driverResult, log) : void 0,
+		ensureCollectionPolicies: bootstrapper.ensureCollectionPolicies ? (collections, driverResult, log) => bootstrapper.ensureCollectionPolicies(collections, driverResult, log) : void 0,
 		getAdmin(driverResult) {
 			if (bootstrapper.getAdmin) return bootstrapper.getAdmin(driverResult);
 		},
@@ -11917,6 +12304,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, frameByteLength, generateSchema, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusConfig, resolveChannelBusSetting, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, frameByteLength, generateSchema, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map