@rebasepro/server-postgres 0.16.0 → 0.16.1-canary.g041c925

package/dist/index.es.js

@@ -1,14 +1,14 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
+import { a as createReadReplicaConnection, c as poolMaxCeiling, i as createPostgresDatabaseConnection, o as guardPoolAgainstDirtyRelease, r as createDirectDatabaseConnection, s as pinSearchPath, t as cappedPoolMax } from "./connection-GOKU3Hu5.js";
 import { n as resolveClientListLimit, t as ListLimitError } from "./data_driver-ULAyJEi9.js";
-import { $ as mergeDeep, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as isPrototypePollutingKey, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as toWireKey, Z as getPolicyNamesForRule, _ as OrderBySpecError, at as isManyToMany, b as CollectionRegistry, et as camelCase, g as buildSdkData, h as visibleColumnProjection, it as hasForeignKeyOnTarget, j as findRelation, l as buildSearchColumnSpec, ot as Vector, q as generateForeignKeyName, r as authUsersColumnSql, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as toSnakeCase, u as hiddenColumnsOption, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./auth-users-columns-CgyPWQ18.js";
-import { c as isPostgresCollectionConfig, f as ALL_WHERE_FILTER_OPS, g as encodeRelationAggregateSort, l as isRelationalCollectionConfig, v as parseRelationAggregateSort } from "./src-BBFsDaeA.js";
-import { t as createPostgresWebSocket } from "./websocket-BVgDVO-V.js";
-import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-Ch0T6OwW.js";
-import { A as parseDbNameFromUrl, C as buildRowSecurityPgOptions, D as joinStorageKey, E as globalsFileForDump, F as withDatabaseName, M as resolveConnectionString, N as serverVersionNumToMajor, O as parseBackupDestination, P as splitGlobalsStatements, S as buildPgRestoreListArgs, T as diagnoseRowSecurityDumpFailure, _ as selectBackupsToPrune, a as detectToolMajor, b as buildPgDumpallGlobalsArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as require_source, h as validateDump, i as createDump, j as parsePgToolMajor, k as parseBackupTimestamp, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildBackupFilename, w as checkToolServerCompatibility, x as buildPgRestoreArgs, y as buildPgDumpArgs } from "./backup-service-BZoixhVl.js";
-import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-B5Sajku6.js";
+import { $ as camelCase, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as mergeDeep, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as getPolicyNamesForRule, Y as toWireKey, Z as isPrototypePollutingKey, _ as OrderBySpecError, a as generatePostgresDdl, at as Vector, b as CollectionRegistry, d as authUsersColumnSql, et as toSnakeCase, f as SEARCH_UNACCENT_FN, g as buildSdkData, h as visibleColumnProjection, i as readSchemaFactsFor, it as isManyToMany, j as findRelation, l as resolveColumnName$1, m as hiddenColumnsOption, n as planCollectionSchemaEnsure, o as generatePostgresPoliciesDdl, p as buildSearchColumnSpec, q as generateForeignKeyName, rt as hasForeignKeyOnTarget, s as generatePostgresSearchDdl, u as AUTH_USERS_COLUMNS, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./ensure-collection-tables-CvW6tbI7.js";
+import { c as isPostgresCollectionConfig, f as ALL_WHERE_FILTER_OPS, g as encodeRelationAggregateSort, l as isRelationalCollectionConfig, v as parseRelationAggregateSort } from "./src-DolrXONo.js";
+import { n as PUBLIC_TYPES, r as createPostgresWebSocket, t as ADMIN_ONLY_TYPES } from "./websocket-7Dp77lTh.js";
+import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-eSahD7ec.js";
+import { A as parseDbNameFromUrl, C as buildRowSecurityPgOptions, D as joinStorageKey, E as globalsFileForDump, F as withDatabaseName, M as resolveConnectionString, N as serverVersionNumToMajor, O as parseBackupDestination, P as splitGlobalsStatements, S as buildPgRestoreListArgs, T as diagnoseRowSecurityDumpFailure, _ as selectBackupsToPrune, a as detectToolMajor, b as buildPgDumpallGlobalsArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as require_source, h as validateDump, i as createDump, j as parsePgToolMajor, k as parseBackupTimestamp, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildBackupFilename, w as checkToolServerCompatibility, x as buildPgRestoreArgs, y as buildPgDumpArgs } from "./backup-service-FN6V3rVi.js";
+import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-DAwWHs81.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createDdlBootstrapper, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
@@ -16,10 +16,17 @@ import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, in
 import { PgArray, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs, { promises } from "fs";
 import path from "path";
-import chokidar from "chokidar";
 import { WebSocket } from "ws";
 import { EventEmitter } from "events";
 import { randomUUID } from "crypto";
+//#region ../types/src/types/schema_editing.ts
+var DEFAULT_COMMIT_PATHS = {
+	schemaFile: "backend/src/schema.generated.ts",
+	ddlFile: "drizzle/schema.sql",
+	policiesFile: "drizzle/policies.sql",
+	searchFile: "drizzle/search.sql"
+};
+//#endregion
 //#region ../types/src/types/channel_bus.ts
 /**
 * Whether `setting` is an already-constructed transport rather than a request
@@ -5563,1916 +5570,2274 @@ var BranchService = class {
 	}
 };
 //#endregion
-//#region src/PostgresBackendDriver.ts
-var PostgresBackendDriver = class PostgresBackendDriver {
-	db;
-	registry;
-	poolManager;
-	key = "postgres";
-	initialised = true;
-	dataService;
-	realtimeService;
-	historyService;
-	branchService;
-	user;
-	data;
-	client;
-	/**
-	* Auto-set to `true` when a SET LOCAL ROLE fails with insufficient
-	* privileges, so subsequent queries skip the doomed attempt.
-	* Mirrors the static `DISABLE_DB_ROLE_SWITCHING` env var but is
-	* learned at runtime.
-	*/
-	_roleSwitchingDisabled = false;
-	/**
-	* Restricted role that authenticated (user-context) requests run as (via
-	* `SET LOCAL ROLE`) so RLS binds every statement — reads *and* writes. Set
-	* by the bootstrapper after posture detection: defined when the connection
-	* would otherwise bypass RLS (superuser / BYPASSRLS / table owner),
-	* undefined when RLS already applies natively. The base (server-context)
-	* driver never switches — it is the trusted owner plane (auth flows,
-	* migrations, `dataAsAdmin`).
-	*/
-	rlsUserRole;
-	/**
-	* When true, realtime notifications are deferred until after the
-	* wrapping transaction commits.  Set by `withAuth` → `withTransaction`.
-	*/
-	_deferNotifications = false;
-	_pendingNotifications = [];
-	constructor(db, realtimeService, registry, user, poolManager, historyService) {
-		this.db = db;
-		this.registry = registry;
-		this.poolManager = poolManager;
-		this.dataService = new DataService(db, registry);
-		this.realtimeService = realtimeService;
-		this.historyService = historyService;
-		this.user = user;
-		this.data = buildSdkData(this);
-		if (poolManager) this.branchService = new BranchService(db, poolManager);
-	}
-	/**
-	* Typed admin capabilities (SQLAdmin + SchemaAdmin + BranchAdmin).
-	* Implemented as a getter so method references are resolved at call-time,
-	* allowing test spies applied after construction to take effect.
-	*/
-	get admin() {
-		return {
-			executeSql: (...args) => this.executeSql(...args),
-			fetchAvailableDatabases: () => this.fetchAvailableDatabases(),
-			fetchAvailableRoles: () => this.fetchAvailableRoles(),
-			fetchApplicationRoles: () => this.fetchApplicationRoles(),
-			fetchCurrentDatabase: () => this.fetchCurrentDatabase(),
-			fetchUnmappedTables: (...args) => this.fetchUnmappedTables(...args),
-			fetchTableMetadata: (...args) => this.fetchTableMetadata(...args),
-			...this.branchService ? {
-				createBranch: this.branchService.createBranch.bind(this.branchService),
-				deleteBranch: this.branchService.deleteBranch.bind(this.branchService),
-				listBranches: this.branchService.listBranches.bind(this.branchService),
-				getBranchInfo: this.branchService.getBranchInfo.bind(this.branchService)
-			} : {}
-		};
+//#region src/schema/generate-drizzle-schema-logic.ts
+/**
+* Resolve the SQL column name for a property.
+* Uses the explicit `columnName` when set (e.g. from introspection),
+* falling back to `toSnakeCase(propName)` for manually-authored collections.
+*/
+var JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+/**
+* A string literal for the generated schema file.
+*
+* Column names, table names and enum values are all written into this file as
+* literals, and none of them is constrained to be quote-free: a Postgres
+* identifier only has to be quoted, and `O'Brien` is an ordinary enum value.
+* Interpolating them raw ended the literal early — for enum values, inside
+* single quotes, where an apostrophe is not an edge case.
+*/
+var quote$1 = (value) => JSON.stringify(value);
+/** An object key: verbatim when it is an identifier, quoted otherwise. */
+var propKey = (name) => JS_IDENTIFIER.test(name) ? name : quote$1(name);
+/**
+* A property access on a generated table variable.
+*
+* `users.full name` is not an expression; `users["full name"]` is, and Drizzle
+* treats the two identically.
+*/
+var member = (object, key) => JS_IDENTIFIER.test(key) ? `${object}.${key}` : `${object}[${quote$1(key)}]`;
+var resolveColumnName = (propName, prop) => {
+	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+	return toSnakeCase(propName);
+};
+var getPrimaryKeyProp = (collection) => {
+	if (collection.properties) {
+		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
+		if (idPropEntry) {
+			const prop = idPropEntry[1];
+			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
+			return {
+				name: idPropEntry[0],
+				type: prop.type === "number" ? "number" : "string",
+				isUuid
+			};
+		}
 	}
-	/**
-	* REST-optimised fetch service (include-aware eager-loading).
-	* Delegates to the underlying FetchService (include-aware eager loading),
-	* then runs the afterRead pipeline on the results. The raw FetchService does
-	* NOT run callbacks, so masking must be applied here — otherwise every
-	* REST/SDK read leaks unmasked data (see {@link applyAfterReadForRest}).
-	*/
-	get restFetchService() {
-		const raw = this.dataService.getFetchService();
-		return {
-			fetchCollectionForRest: async (collectionPath, options, include) => {
-				const rows = await raw.fetchCollectionForRest(collectionPath, options, include);
-				return this.applyAfterReadForRest(rows, collectionPath);
-			},
-			fetchOneForRest: async (collectionPath, id, include, databaseId) => {
-				const row = await raw.fetchOneForRest(collectionPath, id, include, databaseId);
-				if (!row) return row;
-				const [masked] = await this.applyAfterReadForRest([row], collectionPath);
-				return masked;
+	const idProp = collection.properties?.["id"];
+	if (idProp?.type === "number") return {
+		name: "id",
+		type: "number",
+		isUuid: false
+	};
+	return {
+		name: "id",
+		type: "string",
+		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
+	};
+};
+/**
+* Given a raw DB column name (e.g. "client_id"), the Drizzle property key that
+* maps to it.
+*
+* One line, because the rule is shared: the Drizzle object key is the wire
+* name, and {@link fieldKeyForColumn} is the one definition of what a column is
+* named on the wire. This used to be a private copy that fell back to the
+* column verbatim, which is how a derived foreign key ended up served as
+* `author_id` beside a hand-authored `displayName`.
+*/
+var resolvePropertyKeyForColumn = (collection, column) => fieldKeyForColumn(collection, column);
+var isNumericId = (collection) => {
+	return getPrimaryKeyProp(collection).type === "number";
+};
+var getPrimaryKeyName = (collection) => {
+	return getPrimaryKeyProp(collection).name;
+};
+var isIdProperty$1 = (propName, prop, collection) => {
+	if ("isId" in prop && Boolean(prop.isId)) return true;
+	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
+};
+/**
+* The Drizzle column declaration a property compiles to, or `null` when the
+* property puts no column on *this* table (an inverse relation, whose column
+* lives on the target). Exported so it can be checked against its DDL twin
+* `getSqlColumnType` directly — the two disagreeing is what left `geopoint`
+* with a database column and no Drizzle key.
+*/
+var getDrizzleColumn = (propName, prop, collection, collections) => {
+	const colName = resolveColumnName(propName, prop);
+	let columnDefinition;
+	switch (prop.type) {
+		case "string": {
+			const stringProp = prop;
+			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}(${quote$1(colName)})`;
+			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
+			else if (stringProp.columnType === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
+			else if (stringProp.columnType === "char") columnDefinition = `char(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
+			else if (stringProp.columnType === "varchar") columnDefinition = `varchar(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
+			else columnDefinition = `text(${quote$1(colName)})`;
+			if (isIdProperty$1(propName, prop, collection)) columnDefinition += ".primaryKey()";
+			if ("isId" in stringProp && stringProp.isId !== "manual" && stringProp.isId !== true) {
+				if (stringProp.isId === "uuid") columnDefinition += ".defaultRandom()";
+				else if (stringProp.isId === "cuid") columnDefinition += ".default(sql`cuid()`)";
+				else if (typeof stringProp.isId === "string") {
+					const sqlContent = stringProp.isId.startsWith("sql`") && stringProp.isId.endsWith("`") ? stringProp.isId.substring(4, stringProp.isId.length - 1) : stringProp.isId;
+					columnDefinition += `.default(sql\`${sqlContent}\`)`;
+				}
 			}
-		};
-	}
-	/**
-	* Build the context handed to every collection callback.
-	*
-	* Note `data: this.data` — `this` is whichever driver is running the
-	* operation, so the callback's data plane inherits that driver's privilege.
-	* On a user request `AuthenticatedPostgresBackendDriver.withTransaction`
-	* constructs a fresh base driver bound to the RLS-scoped transaction and
-	* runs the operation on it, so `this.data` speaks through that connection
-	* and policies apply. On server-context work `this` is the base driver on
-	* the owner connection, and they do not. Pinned by the
-	* `"scopes context.data to the caller"` case in the `rls-enforcement` e2e
-	* suite, because it is the kind of property that is easy to break from a
-	* distance and impossible to notice.
-	*
-	* Previously returned through `as unknown as RebaseCallContext`, which
-	* disabled checking for the whole object and let `driver` — documented in
-	* the callbacks guide — sit on the runtime context while absent from the
-	* contract. Both are declared now, so this is a plain typed return.
-	*/
-	buildCallContext() {
-		return {
-			user: this.user,
-			driver: this,
-			data: this.data,
-			client: this.client,
-			storageSource: this.client?.storage
-		};
-	}
-	resolveCollectionCallbacks(collection, path) {
-		if (!collection && !path) return {
-			collection: void 0,
-			callbacks: void 0,
-			globalCallbacks: void 0,
-			propertyCallbacks: void 0
-		};
-		const registryCollection = this.registry?.getCollectionByPath(path);
-		const resolvedCollection = registryCollection ? {
-			...collection,
-			...registryCollection
-		} : collection;
-		const callbacks = resolvedCollection?.callbacks;
-		const globalCallbacks = this.registry?.getGlobalCallbacks();
-		const properties = resolvedCollection?.properties;
-		let propertyCallbacks;
-		if (properties) propertyCallbacks = buildPropertyCallbacks(properties);
-		return {
-			collection: resolvedCollection,
-			callbacks,
-			globalCallbacks,
-			propertyCallbacks
-		};
-	}
-	/**
-	* Run the three-tier afterRead pipeline (global → collection → property) on a
-	* single row for a collection whose callbacks have already been resolved.
-	*/
-	async applyAfterReadToRow(row, path, resolved, contextForCallback) {
-		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = resolved;
-		let out = row;
-		if (globalCallbacks?.afterRead) out = await globalCallbacks.afterRead({
-			collection: resolvedCollection,
-			path,
-			row: out,
-			context: contextForCallback
-		}) ?? out;
-		if (callbacks?.afterRead) out = await callbacks.afterRead({
-			collection: resolvedCollection,
-			path,
-			row: out,
-			context: contextForCallback
-		}) ?? out;
-		if (propertyCallbacks?.afterRead) out = await propertyCallbacks.afterRead({
-			collection: resolvedCollection,
-			path,
-			row: out,
-			context: contextForCallback
-		}) ?? out;
-		return out;
-	}
-	static hasAfterRead(resolved) {
-		return !!(resolved.globalCallbacks?.afterRead || resolved.callbacks?.afterRead || resolved.propertyCallbacks?.afterRead);
-	}
-	/**
-	* Apply afterRead to REST/SDK read results.
-	*
-	* The REST / `include` path fetches rows through the raw fetch service, which
-	* does NOT run callbacks — so without this, `afterRead` transforms (e.g. PII
-	* masking) are silently skipped on every SDK/REST read, leaking raw data.
-	* This choke point guarantees afterRead runs there too, matching the driver's
-	* fetchCollection/fetchOne paths.
-	*
-	* It also masks embedded relation data one level deep by running the TARGET
-	* collection's afterRead (so `post.author.email` is masked by the authors
-	* collection, not left raw).
-	*/
-	async applyAfterReadForRest(rows, path) {
-		if (!rows || rows.length === 0) return rows;
-		const resolved = this.resolveCollectionCallbacks(void 0, path);
-		const contextForCallback = this.buildCallContext();
-		const hasOwn = PostgresBackendDriver.hasAfterRead(resolved);
-		const relationTargets = {};
-		if (resolved.collection) try {
-			const rels = resolveCollectionRelations(resolved.collection);
-			for (const [key, rel] of Object.entries(rels)) {
-				const targetPath = (typeof rel.target === "function" ? rel.target() : void 0)?.slug;
-				if (!targetPath) continue;
-				const targetResolved = this.resolveCollectionCallbacks(void 0, targetPath);
-				if (PostgresBackendDriver.hasAfterRead(targetResolved)) relationTargets[key] = {
-					path: targetPath,
-					resolved: targetResolved
-				};
+			if (stringProp.validation?.unique) columnDefinition += ".unique()";
+			break;
+		}
+		case "number": {
+			const numProp = prop;
+			const isId = isIdProperty$1(propName, prop, collection);
+			let baseType = numProp.validation?.integer || isId ? `integer(${quote$1(colName)})` : `numeric(${quote$1(colName)})`;
+			if (numProp.columnType) if (numProp.columnType === "double precision") baseType = `doublePrecision(${quote$1(colName)})`;
+			else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") baseType = `${numProp.columnType}(${quote$1(colName)}, { mode: "number" })`;
+			else baseType = `${numProp.columnType}(${quote$1(colName)})`;
+			if ("isId" in numProp && numProp.isId === "increment") columnDefinition = `${baseType}.generatedByDefaultAsIdentity()`;
+			else if ("isId" in numProp && typeof numProp.isId === "string" && numProp.isId !== "manual") {
+				columnDefinition = baseType;
+				const sqlContent = numProp.isId.startsWith("sql`") && numProp.isId.endsWith("`") ? numProp.isId.substring(4, numProp.isId.length - 1) : numProp.isId;
+				columnDefinition += `.default(sql\`${sqlContent}\`)`;
+			} else columnDefinition = baseType;
+			if (isId) columnDefinition += ".primaryKey()";
+			if (numProp.validation?.unique) columnDefinition += ".unique()";
+			break;
+		}
+		case "boolean":
+			columnDefinition = `boolean(${quote$1(colName)})`;
+			break;
+		case "date": {
+			const dateProp = prop;
+			if (dateProp.columnType === "date") columnDefinition = `date(${quote$1(colName)}, { mode: 'string' })`;
+			else if (dateProp.columnType === "time") columnDefinition = `time(${quote$1(colName)})`;
+			else columnDefinition = `timestamp(${quote$1(colName)}, { withTimezone: true, mode: 'string' })`;
+			if (dateProp.autoValue === "on_create" || dateProp.autoValue === "on_update") columnDefinition += ".default(sql`now()`)";
+			break;
+		}
+		case "map":
+			if (prop.columnType === "json") columnDefinition = `json(${quote$1(colName)})`;
+			else columnDefinition = `jsonb(${quote$1(colName)})`;
+			break;
+		case "geopoint":
+			columnDefinition = `jsonb(${quote$1(colName)})`;
+			break;
+		case "array": {
+			const arrayProp = prop;
+			let colType = arrayProp.columnType;
+			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
+				const ofProp = arrayProp.of;
+				if (ofProp.type === "string") colType = "text[]";
+				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
+				else if (ofProp.type === "boolean") colType = "boolean[]";
 			}
-		} catch {}
-		const relKeys = Object.keys(relationTargets);
-		if (!hasOwn && relKeys.length === 0) return rows;
-		const maskEmbedded = async (value, target) => {
-			if (Array.isArray(value)) return Promise.all(value.map((v) => maskEmbedded(v, target)));
-			if (!value || typeof value !== "object") return value;
-			const obj = value;
-			if (obj.__type === "relation" && obj.data && typeof obj.data === "object") return {
-				...obj,
-				data: await this.applyAfterReadToRow(obj.data, target.path, target.resolved, contextForCallback)
-			};
-			if (obj.__type === "reference") return obj;
-			return this.applyAfterReadToRow(obj, target.path, target.resolved, contextForCallback);
-		};
-		return Promise.all(rows.map(async (row) => {
-			let out = hasOwn ? await this.applyAfterReadToRow(row, path, resolved, contextForCallback) : row;
-			for (const key of relKeys) {
-				if (out[key] === void 0 || out[key] === null) continue;
-				out = {
-					...out,
-					[key]: await maskEmbedded(out[key], relationTargets[key])
-				};
+			if (colType === "json") columnDefinition = `json(${quote$1(colName)})`;
+			else if (colType === "text[]") columnDefinition = `text(${quote$1(colName)}).array()`;
+			else if (colType === "integer[]") columnDefinition = `integer(${quote$1(colName)}).array()`;
+			else if (colType === "boolean[]") columnDefinition = `boolean(${quote$1(colName)}).array()`;
+			else if (colType === "numeric[]") columnDefinition = `numeric(${quote$1(colName)}).array()`;
+			else columnDefinition = `jsonb(${quote$1(colName)})`;
+			break;
+		}
+		case "vector": {
+			const vp = prop;
+			columnDefinition = `vector(${quote$1(colName)}, { dimensions: ${vp.dimensions} })`;
+			break;
+		}
+		case "binary":
+			columnDefinition = `customType({ dataType() { return 'bytea'; } })(${quote$1(colName)})`;
+			break;
+		case "relation": {
+			const refProp = prop;
+			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+			if (!relation || relation.kind !== "belongsTo") return null;
+			const fkFieldKey = fieldKeyForColumn(collection, relation.localKey);
+			if (collection.properties[fkFieldKey] && propName !== fkFieldKey) return null;
+			let targetCollection;
+			try {
+				targetCollection = relation.target();
+			} catch {
+				return null;
 			}
-			return out;
-		}));
-	}
-	async fetchCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, vectorSearch }) {
-		const rows = await this.dataService.fetchCollection(path, {
-			filter,
-			orderBy,
-			order,
-			limit,
-			offset,
-			startAfter,
-			databaseId: collection?.databaseId,
-			searchString,
-			vectorSearch
-		});
-		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
-		if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
-			const contextForCallback = this.buildCallContext();
-			return Promise.all(rows.map(async (row) => {
-				let fetched = row;
-				if (globalCallbacks?.afterRead) fetched = await globalCallbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: fetched,
-					context: contextForCallback
-				});
-				if (callbacks?.afterRead) fetched = await callbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: fetched,
-					context: contextForCallback
-				}) ?? fetched;
-				if (propertyCallbacks?.afterRead) fetched = await propertyCallbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: fetched,
-					context: contextForCallback
-				});
-				return fetched;
-			}));
+			const fkColumnName = relation.localKey;
+			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			const targetIdField = pkProp.name;
+			const baseColumn = pkProp.type === "number" ? `integer(${quote$1(fkColumnName)})` : pkProp.isUuid ? `uuid(${quote$1(fkColumnName)})` : `text(${quote$1(fkColumnName)})`;
+			const onUpdate = relation.onUpdate ? `onUpdate: "${relation.onUpdate}"` : "";
+			const required = prop.validation?.required;
+			const refOptionsParts = [onUpdate, `onDelete: \"${relation.onDelete ?? (required ? "cascade" : "set null")}\"`].filter(Boolean);
+			const refOptions = refOptionsParts.length > 0 ? `{ ${refOptionsParts.join(", ")} }` : "";
+			let columnDef = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}${refOptions ? `, ${refOptions}` : ""})`;
+			if (required) columnDef += ".notNull()";
+			return `    ${propKey(fkFieldKey)}: ${columnDef}`;
 		}
-		return rows;
-	}
-	listenCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, onUpdate, onError }) {
-		const subscriptionId = this.generateSubscriptionId();
-		const callbackWrapper = (rows) => {
-			onUpdate(rows);
-		};
-		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
-			clientId: "driver",
-			type: "collection",
-			path,
-			collectionRequest: {
-				filter,
-				orderBy,
-				order,
-				limit,
-				offset,
-				startAfter,
-				databaseId: collection?.databaseId,
-				searchString
+		case "reference": {
+			const refProp = prop;
+			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName$1(c) === refProp.path);
+			if (!targetCollection) {
+				columnDefinition = `text(${quote$1(colName)})`;
+				break;
 			}
-		});
-		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
-		this.fetchCollection({
-			path,
-			collection,
-			filter,
-			limit,
-			offset,
-			startAfter,
-			orderBy,
-			searchString,
-			order
-		}).then((rows) => {
-			callbackWrapper(rows);
-		}).catch((error) => {
-			if (onError) onError(error);
-		});
-		return () => {
-			this.realtimeService.removeSubscriptionCallback(subscriptionId);
-			this.realtimeService.subscriptions.delete(subscriptionId);
-		};
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
+			const targetIdField = pkProp.name;
+			const baseColumn = pkProp.type === "number" ? `integer(${quote$1(colName)})` : pkProp.isUuid ? `uuid(${quote$1(colName)})` : `text(${quote$1(colName)})`;
+			const required = prop.validation?.required;
+			const refOptions = `{ onDelete: "${required ? "cascade" : "set null"}" }`;
+			columnDefinition = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}, ${refOptions})`;
+			if (required) columnDefinition += ".notNull()";
+			return `    ${propKey(propName)}: ${columnDefinition}`;
+		}
+		default: throw new Error(`No Postgres column mapping for property '${propName}' of type '${prop.type}' in collection '${collection.slug}'. Add a case to \`getDrizzleColumn\` (and to \`getSqlColumnType\`, which must agree).`);
 	}
-	async fetchOne({ path, id, databaseId, collection }) {
-		let row = await this.dataService.fetchOne(path, id, databaseId || collection?.databaseId);
-		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
-		if (row && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
-			const contextForCallback = this.buildCallContext();
-			if (globalCallbacks?.afterRead) row = await globalCallbacks.afterRead({
-				collection: resolvedCollection,
-				path,
-				row,
-				context: contextForCallback
-			});
-			if (callbacks?.afterRead) row = await callbacks.afterRead({
-				collection: resolvedCollection,
-				path,
-				row,
-				context: contextForCallback
-			}) ?? row;
-			if (propertyCallbacks?.afterRead) row = await propertyCallbacks.afterRead({
-				collection: resolvedCollection,
-				path,
-				row,
-				context: contextForCallback
-			});
-		}
-		return row;
+	if (prop.validation?.required) columnDefinition += ".notNull()";
+	return `    ${propKey(propName)}: ${columnDefinition}`;
+};
+/**
+* Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
+*
+* The clause is SQL being written into a TypeScript file, so it has to survive
+* being read back as a template literal. Three characters do not:
+*
+* - `` ` `` closes the template early, and the rest of the clause becomes code.
+* - `${` opens an interpolation — the file stops compiling, or worse, compiles
+*   against whatever identifier happens to be in scope.
+* - `\` is an escape, and Drizzle's `sql` tag reads the *cooked* strings, not
+*   `.raw`. So a policy written as `email ~ '^admin\.user@corp\.com$'` reaches
+*   the database as `^admin.user@corp.com$`, where every `\.` now matches any
+*   character. A `USING` clause is a security boundary and that one silently
+*   widened it — the SQL file emitted by the DDL generator kept the backslashes
+*   while this path dropped them, so the two disagreed about who could read the
+*   table.
+*
+* Escaping here rather than in the compiler: the clause is correct SQL, and it
+* is only this destination that has an opinion about backslashes.
+*/
+var wrapSql = (clause) => `sql\`${clause.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${")}\``;
+var generatePolicyCode = (collection, rule, index, resolveCollection) => {
+	const tableName = getTableName$1(collection);
+	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+	const policyNames = getPolicyNamesForRule(rule, tableName);
+	return ops.map((op, opIdx) => {
+		return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
+	}).join("");
+};
+/**
+* Generates a single pgPolicy() call for one specific operation.
+*/
+var generateSinglePolicyCode = (collection, rule, operation, policyName, resolveCollection) => {
+	const mode = rule.mode ?? "permissive";
+	const needsUsing = operation !== "insert";
+	const needsWithCheck = operation !== "select" && operation !== "delete";
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	let usingClause = needsUsing && usingExpr ? wrapSql(policyToPostgres(usingExpr, collection, { resolveCollection })) : null;
+	let withCheckClause = needsWithCheck && withCheckExpr ? wrapSql(policyToPostgres(withCheckExpr, collection, { resolveCollection })) : null;
+	if (!usingClause && needsUsing) usingClause = "sql`false`";
+	if (!withCheckClause && needsWithCheck) withCheckClause = "sql`false`";
+	const parts = [];
+	parts.push(`as: "${mode}"`);
+	parts.push(`for: "${operation}"`);
+	const toRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
+	parts.push(`to: [${toRoles.map((r) => `"${r}"`).join(", ")}]`);
+	if (usingClause) parts.push(`using: ${usingClause}`);
+	if (withCheckClause) parts.push(`withCheck: ${withCheckClause}`);
+	return `    pgPolicy(${quote$1(policyName)}, { ${parts.join(", ")} }),\n`;
+};
+/**
+* Computes a deterministic shared relation name for Drizzle.
+*
+* Drizzle requires both sides of a relation (owning + inverse) to use the
+* exact same `relationName` string so it can pair them. Each collection
+* definition may use a different local `relationName`, so we need a canonical
+* form that both sides can independently compute.
+*
+* Strategy: `{owningTable}_{foreignKey}`
+*   - owning  side → `{thisTable}_{localKey}`           e.g. "jobs_company_id"
+*   - inverse side → `{targetTable}_{foreignKeyOnTarget}` e.g. "jobs_company_id"
+*
+* For M2M with junction tables the owning relation name is already shared via
+* the junction table wiring, so we keep it as-is.
+*
+* Falls back to the local relation name when the counterpart can't be resolved.
+*/
+var computeSharedRelationName = (rel, sourceCollection, _collections) => {
+	const fallback = rel.relationName ?? toSnakeCase(rel.target().slug);
+	if (rel.kind === "belongsTo") {
+		const normalisedKey = resolvePropertyKeyForColumn(sourceCollection, rel.localKey);
+		return `${getTableName$1(sourceCollection)}_${normalisedKey}`;
 	}
-	listenOne({ path, id, collection, onUpdate, onError }) {
-		const subscriptionId = this.generateSubscriptionId();
-		const callbackWrapper = (row) => {
-			if (row) onUpdate(row);
-		};
-		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
-			clientId: "driver",
-			type: "single",
-			path,
-			id
-		});
-		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
-		this.fetchOne({
-			path,
-			id,
-			collection
-		}).then((row) => {
-			if (row) onUpdate(row);
-		}).catch((error) => {
-			if (onError) onError(error);
-		});
-		return () => {
-			this.realtimeService.removeSubscriptionCallback(subscriptionId);
-			this.realtimeService.subscriptions.delete(subscriptionId);
-		};
+	if (rel.kind === "hasMany" || rel.kind === "hasOne") try {
+		const targetCollection = rel.target();
+		const normalisedFK = resolvePropertyKeyForColumn(targetCollection, rel.foreignKeyOnTarget);
+		return `${getTableName$1(targetCollection)}_${normalisedFK}`;
+	} catch {
+		return fallback;
 	}
-	async save({ path, id, values, collection, status, upsert }) {
-		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
-		let updatedValues = values;
-		const contextForCallback = this.buildCallContext();
-		let previousValuesForHistory;
-		if (status === "existing" && id) try {
-			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
-			if (existing) {
-				const { id: _existingId, ...existingValues } = existing;
-				previousValuesForHistory = existingValues;
+	return fallback;
+};
+var generateSchema = async (allCollections, stripPolicies = false) => {
+	const collections = sortCollectionsBySlug(relationalCollections(allCollections));
+	let schemaContent = "// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\n\n";
+	const hasUuid = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "string" && (p.autoValue === "uuid" || p.isId === "uuid")));
+	const hasVector = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "vector"));
+	const hasBinary = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "binary"));
+	const hasSearch = collections.some((c) => buildSearchColumnSpec(c) !== void 0);
+	const pgCoreImports = [
+		"primaryKey",
+		"pgTable",
+		"integer",
+		"varchar",
+		"text",
+		"char",
+		"boolean",
+		"timestamp",
+		"date",
+		"time",
+		"jsonb",
+		"json",
+		"pgEnum",
+		"numeric",
+		"real",
+		"doublePrecision",
+		"bigint",
+		"serial",
+		"bigserial",
+		"pgPolicy"
+	];
+	if (hasUuid) pgCoreImports.push("uuid");
+	if (hasVector) pgCoreImports.push("vector");
+	if (hasBinary || hasSearch) pgCoreImports.push("customType");
+	const uniqueSchemas = Array.from(new Set(collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)));
+	if (uniqueSchemas.length > 0) pgCoreImports.push("pgSchema");
+	schemaContent += `import { ${pgCoreImports.join(", ")} } from 'drizzle-orm/pg-core';\n`;
+	schemaContent += "import { relations as drizzleRelations, sql } from 'drizzle-orm';\n\n";
+	uniqueSchemas.forEach((schema) => {
+		schemaContent += `export const ${schema}Schema = pgSchema("${schema}");\n`;
+	});
+	if (uniqueSchemas.length > 0) schemaContent += "\n";
+	const exportedTableVars = [];
+	const exportedEnumVars = [];
+	const exportedRelationVars = [];
+	const allTablesToGenerate = /* @__PURE__ */ new Map();
+	collections.forEach((collection) => {
+		const collectionPath = getTableName$1(collection);
+		Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
+			if ("enum" in prop && (prop.type === "string" || prop.type === "number") && prop.enum) {
+				const enumVarName = getEnumVarName(collectionPath, propName);
+				const enumDbName = `${collectionPath}_${resolveColumnName(propName, prop)}`;
+				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
+				if (values.length > 0) {
+					schemaContent += `export const ${enumVarName} = pgEnum(${quote$1(enumDbName)}, [${values.map((v) => quote$1(v)).join(", ")}]);\n`;
+					if (!exportedEnumVars.includes(enumVarName)) exportedEnumVars.push(enumVarName);
+				}
 			}
-		} catch (err) {
-			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
+		});
+	});
+	schemaContent += "\n";
+	const junctionSpecs = resolveJunctionSpecs(collections);
+	for (const collection of collections) {
+		const tableName = getTableName$1(collection);
+		if (tableName) allTablesToGenerate.set(tableName, { collection });
+		const resolvedRelations = resolveCollectionRelations(collection);
+		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
+			const junctionTableName = relation.through.table;
+			if (!allTablesToGenerate.has(junctionTableName)) allTablesToGenerate.set(junctionTableName, {
+				collection: {
+					table: junctionTableName,
+					properties: {}
+				},
+				isJunction: true,
+				relation,
+				sourceCollection: collection
+			});
 		}
-		if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
-			if (globalCallbacks?.beforeSave) {
-				const result = await globalCallbacks.beforeSave({
-					collection: resolvedCollection,
-					path,
-					id,
-					values: updatedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
+	}
+	for (const [tableName, { collection, isJunction, relation, sourceCollection }] of allTablesToGenerate.entries()) {
+		const tableVarName = getTableVarName(tableName);
+		if (isJunction && relation && sourceCollection && isManyToMany(relation)) {
+			const targetCollection = relation.target();
+			const tableCreator = "pgTable";
+			const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+			const { sourceColumn, targetColumn } = relation.through;
+			const refOptions = `{ onDelete: \"${relation.onDelete ?? "cascade"}\" }`;
+			const sourceColType = isNumericId(sourceCollection) ? "integer" : getPrimaryKeyProp(sourceCollection).isUuid ? "uuid" : "text";
+			const targetColType = isNumericId(targetCollection) ? "integer" : getPrimaryKeyProp(targetCollection).isUuid ? "uuid" : "text";
+			const sourceId = getPrimaryKeyName(sourceCollection);
+			const targetId = getPrimaryKeyName(targetCollection);
+			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
+			schemaContent += `    ${propKey(sourceColumn)}: ${sourceColType}(${quote$1(sourceColumn)}).notNull().references(() => ${member(getTableVarName(getTableName$1(sourceCollection)), sourceId)}, ${refOptions}),\n`;
+			schemaContent += `    ${propKey(targetColumn)}: ${targetColType}(${quote$1(targetColumn)}).notNull().references(() => ${member(getTableVarName(getTableName$1(targetCollection)), targetId)}, ${refOptions}),\n`;
+			schemaContent += "}, (table) => ([\n";
+			schemaContent += `    primaryKey({ columns: [${member("table", sourceColumn)}, ${member("table", targetColumn)}] }),\n`;
+			const junctionSpec = junctionSpecs.get(baseTableName);
+			if (!stripPolicies && junctionSpec) {
+				const junctionCollection = getJunctionCollectionConfig(junctionSpec);
+				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
+				getJunctionSecurityRules(junctionSpec).forEach((rule, idx) => {
+					schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
 				});
-				if (result) updatedValues = mergeDeep(updatedValues, result);
 			}
-			if (callbacks?.beforeSave) {
-				const result = await callbacks.beforeSave({
-					collection: resolvedCollection,
-					path,
-					id,
-					values: updatedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
-				});
-				if (result) updatedValues = mergeDeep(updatedValues, result);
+			schemaContent += "])).enableRLS();\n\n";
+		} else if (!isJunction) {
+			const schema = isPostgresCollectionConfig(collection) ? collection.schema : void 0;
+			const tableCreator = schema ? `${schema}Schema.table` : "pgTable";
+			const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
+			const columns = /* @__PURE__ */ new Set();
+			Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
+				const columnString = getDrizzleColumn(propName, prop, collection, collections);
+				if (columnString) columns.add(columnString);
+			});
+			const searchSpec = buildSearchColumnSpec(collection);
+			if (searchSpec) {
+				columns.add(`    ${propKey(searchSpec.column)}: customType({ dataType() { return 'tsvector'; } })(${quote$1(searchSpec.column)}).generatedAlwaysAs(sql\`${searchSpec.expression}\`)`);
+				if (searchSpec.fuzzy) columns.add(`    ${propKey(searchSpec.fuzzy.column)}: text(${quote$1(searchSpec.fuzzy.column)}).generatedAlwaysAs(sql\`${searchSpec.fuzzy.expression}\`)`);
 			}
-			if (propertyCallbacks?.beforeSave) {
-				const result = await propertyCallbacks.beforeSave({
-					collection: resolvedCollection,
-					path,
-					id,
-					values: updatedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
+			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: text(\"id\").primaryKey()");
+			schemaContent += `${Array.from(columns).join(",\n")}`;
+			const securityRules = getEffectiveSecurityRules(collection);
+			if (!stripPolicies && securityRules.length > 0) {
+				schemaContent += "\n}, (table) => ([\n";
+				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
+				securityRules.forEach((rule, idx) => {
+					schemaContent += generatePolicyCode(collection, rule, idx, resolveCollection);
 				});
-				if (result) updatedValues = mergeDeep(updatedValues, result);
-			}
+				schemaContent += "])).enableRLS();\n\n";
+			} else schemaContent += "\n}).enableRLS();\n\n";
 		}
-		if (resolvedCollection?.properties) updatedValues = updateDateAutoValues({
-			inputValues: updatedValues,
-			properties: resolvedCollection.properties,
-			status: status ?? "new",
-			timestampNowValue: /* @__PURE__ */ new Date()
-		});
-		try {
-			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, { upsert });
-			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
-				if (globalCallbacks?.afterRead) savedRow = await globalCallbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: savedRow,
-					context: contextForCallback
-				});
-				if (callbacks?.afterRead) savedRow = await callbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: savedRow,
-					context: contextForCallback
-				}) ?? savedRow;
-				if (propertyCallbacks?.afterRead) savedRow = await propertyCallbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: savedRow,
-					context: contextForCallback
-				});
+		if (!exportedTableVars.includes(tableVarName)) exportedTableVars.push(tableVarName);
+	}
+	for (const [tableName, { collection, isJunction }] of allTablesToGenerate.entries()) {
+		const tableVarName = getTableVarName(tableName);
+		const tableRelations = [];
+		if (isJunction) {
+			const relationInfo = Array.from(allTablesToGenerate.values()).find((v) => v.isJunction && getTableName$1(v.collection) === tableName);
+			if (relationInfo && relationInfo.relation && relationInfo.sourceCollection && isManyToMany(relationInfo.relation)) {
+				const { relation, sourceCollection } = relationInfo;
+				const targetCollection = relation.target();
+				const sourceTableVar = getTableVarName(getTableName$1(sourceCollection));
+				const targetTableVar = getTableVarName(getTableName$1(targetCollection));
+				const sourceId = getPrimaryKeyName(sourceCollection);
+				const targetId = getPrimaryKeyName(targetCollection);
+				if (!relation?.through) throw new Error("Internal, the relation should have a through property. Relations passed to this script should sanitized first with sanitizeRelation().");
+				const owningRelationName = relation.relationName ?? toSnakeCase(getTableName$1(targetCollection));
+				let inverseRelationName = null;
+				try {
+					const targetRelations = resolveCollectionRelations(targetCollection);
+					for (const [, targetRel] of Object.entries(targetRelations)) if (targetRel.kind !== "belongsTo" && targetRel.cardinality === "many" && targetRel.relationName === owningRelationName) {
+						inverseRelationName = targetRel.relationName ?? null;
+						break;
+					}
+				} catch {}
+				tableRelations.push(`    ${quote$1(relation.through.sourceColumn)}: one(${sourceTableVar}, {\n        fields: [${member(tableVarName, relation.through.sourceColumn)}],\n        references: [${member(sourceTableVar, sourceId)}],\n        relationName: ${quote$1(owningRelationName)}\n    })`);
+				const targetRelationName = inverseRelationName ? inverseRelationName : `${tableName}_${relation.through.targetColumn}`;
+				tableRelations.push(`    ${quote$1(relation.through.targetColumn)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, relation.through.targetColumn)}],\n        references: [${member(targetTableVar, targetId)}],\n        relationName: ${quote$1(targetRelationName)}\n    })`);
 			}
-			const savedId = deriveRowAddress(savedRow, resolvedCollection ?? collection, this.registry);
-			const savedValues = savedRow;
-			if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
-				if (globalCallbacks?.afterSave) await globalCallbacks.afterSave({
-					collection: resolvedCollection,
-					path,
-					id: savedId,
-					values: savedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
-				});
-				if (callbacks?.afterSave) await callbacks.afterSave({
-					collection: resolvedCollection,
-					path,
-					id: savedId,
-					values: savedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
-				});
-				if (propertyCallbacks?.afterSave) await propertyCallbacks.afterSave({
-					collection: resolvedCollection,
-					path,
-					id: savedId,
-					values: savedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
-				});
+		} else {
+			const resolvedRelations = resolveCollectionRelations(collection);
+			const emittedRelationNames = /* @__PURE__ */ new Set();
+			for (const [relationKey, rel] of Object.entries(resolvedRelations)) try {
+				const target = rel.target();
+				const targetTableVar = getTableVarName(getTableName$1(target));
+				const drizzleRelationName = computeSharedRelationName(rel, collection, collections);
+				const deduplicationKey = `${drizzleRelationName}::${rel.kind}`;
+				if (emittedRelationNames.has(deduplicationKey)) continue;
+				emittedRelationNames.add(deduplicationKey);
+				switch (rel.kind) {
+					case "belongsTo": {
+						const localFieldKey = resolvePropertyKeyForColumn(collection, rel.localKey);
+						tableRelations.push(`    ${quote$1(relationKey)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, localFieldKey)}],\n        references: [${member(targetTableVar, getPrimaryKeyName(target))}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
+						break;
+					}
+					case "hasOne":
+						tableRelations.push(`    ${quote$1(relationKey)}: one(${targetTableVar}, {\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
+						break;
+					case "hasMany":
+						tableRelations.push(`    ${quote$1(relationKey)}: many(${targetTableVar}, { relationName: ${quote$1(drizzleRelationName)} })`);
+						break;
+					case "manyToMany": {
+						const junctionTableVar = getTableVarName(rel.through.table);
+						tableRelations.push(`    ${quote$1(relationKey)}: many(${junctionTableVar}, { relationName: ${quote$1(drizzleRelationName)} })`);
+						break;
+					}
+					case "via": break;
+				}
+			} catch (e) {
+				logger.warn(`Could not generate relation ${relationKey} for ${collection.name}`, { error: e });
 			}
-			if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
-				tableName: path,
-				id: savedId,
-				action: status === "new" ? "create" : "update",
-				values: savedValues,
-				previousValues: previousValuesForHistory,
-				updatedBy: this.user?.uid
+			for (const otherCollection of collections) {
+				if (otherCollection.slug === collection.slug) continue;
+				const otherRelations = resolveCollectionRelations(otherCollection);
+				for (const [otherKey, otherRel] of Object.entries(otherRelations)) if (hasForeignKeyOnTarget(otherRel)) try {
+					if (otherRel.target().slug === collection.slug) {
+						const drizzleRelationName = computeSharedRelationName(otherRel, otherCollection, collections);
+						const deduplicationKey = `${drizzleRelationName}::belongsTo`;
+						if (!emittedRelationNames.has(deduplicationKey)) {
+							const otherTableVar = getTableVarName(getTableName$1(otherCollection));
+							const drizzleFieldKey = resolvePropertyKeyForColumn(collection, otherRel.foreignKeyOnTarget);
+							const referencedKey = otherRel.sourceKey ? resolvePropertyKeyForColumn(otherCollection, otherRel.sourceKey) : getPrimaryKeyName(otherCollection);
+							const synthKey = `_synth_${otherTableVar}_${drizzleFieldKey}`;
+							tableRelations.push(`    ${quote$1(synthKey)}: one(${otherTableVar}, {\n        fields: [${member(tableVarName, drizzleFieldKey)}],\n        references: [${member(otherTableVar, referencedKey)}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
+							emittedRelationNames.add(deduplicationKey);
+						}
+					}
+				} catch (e) {}
+			}
+		}
+		if (tableRelations.length > 0) {
+			const relVarName = `${tableVarName}Relations`;
+			schemaContent += `export const ${relVarName} = drizzleRelations(${tableVarName}, ({ one, many }) => ({\n${tableRelations.join(",\n")}\n}));\n\n`;
+			if (!exportedRelationVars.includes(relVarName)) exportedRelationVars.push(relVarName);
+		}
+	}
+	const tablesExport = `export const tables = { ${exportedTableVars.join(", ")} };\n`;
+	const enumsExport = `export const enums = { ${exportedEnumVars.join(", ")} };\n`;
+	const relationsExport = `export const relations = { ${exportedRelationVars.join(", ")} };\n\n`;
+	schemaContent += tablesExport + enumsExport + relationsExport;
+	return schemaContent;
+};
+//#endregion
+//#region src/schema/classify-change.ts
+var VERDICT_RANK = {
+	safe: 0,
+	diverges: 1,
+	"needs-migration": 2
+};
+var bySlug = (collections) => {
+	const map = /* @__PURE__ */ new Map();
+	for (const collection of collections) if (collection.slug) map.set(collection.slug, collection);
+	return map;
+};
+var propertiesOf = (collection) => collection.properties ?? {};
+/** Enum values a string property declares, or undefined when it is not an enum. */
+var enumValuesOf = (prop) => {
+	const values = prop.enum;
+	if (!Array.isArray(values)) return void 0;
+	return values.map((value) => typeof value === "string" ? value : String(value?.id ?? value));
+};
+var isRequired = (prop) => prop.validation?.required === true;
+var isIdProperty = (prop) => Boolean(prop.isId);
+/**
+* A change to any of these alters the physical column, which the ensure path
+* cannot do. Compared as a tuple so a change to *any* of them is caught without
+* this module having to re-derive the SQL type — which is the DDL generator's
+* job, and duplicating it here is how the two would drift.
+*/
+var physicalShapeOf = (prop) => JSON.stringify([
+	prop.type,
+	prop.columnType ?? null,
+	prop.dimensions ?? null,
+	prop.isId ?? null,
+	prop.validation?.max ?? null
+]);
+/** Whether the table behind a collection exists and is empty. */
+var tableIsEmpty = (collection, facts) => {
+	if (!facts?.populatedTables) return false;
+	const key = qualifiedTable(collection);
+	if (!facts.tables.has(key)) return true;
+	return !facts.populatedTables.has(key);
+};
+var qualifiedTable = (collection) => {
+	return `${collection.schema ?? "public"}.${getTableName$1(collection)}`;
+};
+/**
+* Classify the difference between two collection sets.
+*
+* `before` is what the running database was built from; `after` is what the
+* editor is proposing. Order within each array is irrelevant.
+*
+* `facts` is what the database actually looks like. Supplied by the live
+* editor; omitted by callers reasoning about collections in the abstract, who
+* get the conservative reading.
+*/
+function classifyCollectionChanges(before, after, facts) {
+	const previous = bySlug(before);
+	const next = bySlug(after);
+	const changes = [];
+	for (const [slug, collection] of next) {
+		if (!previous.has(slug)) {
+			changes.push({
+				kind: "add-collection",
+				verdict: "safe",
+				collection: slug,
+				detail: `New collection "${slug}" — creates table "${getTableName$1(collection)}".`
 			});
-			if (this._deferNotifications) this._pendingNotifications.push({
-				path,
-				id: savedId,
-				row: savedRow,
-				databaseId: resolvedCollection?.databaseId
+			continue;
+		}
+		classifyProperties(previous.get(slug), collection, changes, facts);
+	}
+	for (const [slug, collection] of previous) {
+		if (next.has(slug)) continue;
+		changes.push({
+			kind: "remove-collection",
+			verdict: "needs-migration",
+			collection: slug,
+			detail: `Collection "${slug}" was removed, which would drop table "${getTableName$1(collection)}" and everything in it.`,
+			remedy: "The ensure path never drops anything, so this cannot be applied here. Remove the collection in a migration you have read, or keep it and stop serving it."
+		});
+	}
+	const verdict = changes.reduce((worst, change) => VERDICT_RANK[change.verdict] > VERDICT_RANK[worst] ? change.verdict : worst, "safe");
+	return {
+		changes,
+		verdict,
+		applicable: verdict === "safe"
+	};
+}
+function classifyProperties(before, after, changes, facts) {
+	const slug = after.slug ?? "";
+	const previous = propertiesOf(before);
+	const next = propertiesOf(after);
+	const empty = tableIsEmpty(after, facts);
+	for (const [name, prop] of Object.entries(next)) {
+		const old = previous[name];
+		if (!old) {
+			if (isRequired(prop) && !empty) changes.push({
+				kind: "add-property",
+				verdict: "diverges",
+				collection: slug,
+				property: name,
+				detail: `"${name}" is required, but "${getTableName$1(after)}" already holds rows, so NOT NULL would be checked against data that has no value for it yet. The column would arrive nullable.`,
+				remedy: "Add it optional, backfill every row, then make it required — the editor will apply the constraint once no row violates it."
 			});
-			else await this.realtimeService.notifyUpdate(path, savedId, savedRow, resolvedCollection?.databaseId);
-			return savedRow;
-		} catch (error) {
-			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
-				if (globalCallbacks?.afterSaveError) await globalCallbacks.afterSaveError({
-					collection: resolvedCollection,
-					path,
-					id: id || "unknown",
-					values: updatedValues,
-					previousValues: void 0,
-					status,
-					context: contextForCallback
-				});
-				if (callbacks?.afterSaveError) await callbacks.afterSaveError({
-					collection: resolvedCollection,
-					path,
-					id: id || "unknown",
-					values: updatedValues,
-					previousValues: void 0,
-					status,
-					context: contextForCallback
-				});
-				if (propertyCallbacks?.afterSaveError) await propertyCallbacks.afterSaveError({
-					collection: resolvedCollection,
-					path,
-					id: id || "unknown",
-					values: updatedValues,
-					previousValues: void 0,
-					status,
-					context: contextForCallback
+			else {
+				const column = resolveColumnName$1(name, prop);
+				changes.push({
+					kind: "add-property",
+					verdict: "safe",
+					collection: slug,
+					property: name,
+					detail: isRequired(prop) ? `New required property "${name}" — adds column "${column}" NOT NULL, which "${getTableName$1(after)}" can take because it holds no rows.` : `New optional property "${name}" — adds column "${column}".`
 				});
 			}
-			throw error;
+			continue;
 		}
+		classifyProperty(slug, after, name, old, prop, changes, facts);
+	}
+	for (const [name, prop] of Object.entries(previous)) {
+		if (next[name]) continue;
+		changes.push({
+			kind: "remove-property",
+			verdict: "needs-migration",
+			collection: slug,
+			property: name,
+			detail: `"${name}" was removed, which would drop column "${resolveColumnName$1(name, prop)}" and its data.`,
+			remedy: "The ensure path never drops a column. Remove it in a migration you have read, or leave the column and stop exposing the property."
+		});
 	}
-	/**
-	* Write many rows through the same pipeline as {@link save}.
-	*
-	* The batch runs in one transaction of its own, so a failure part-way leaves
-	* nothing behind — the point of a batch is that a re-run starts from a known
-	* state. When this driver is already inside a transaction (the authenticated
-	* path, via `withTransaction`) the nested call becomes a savepoint, which is
-	* still atomic and still commits once.
-	*
-	* Rows are applied in order, so a batch that touches the same key twice ends
-	* with the last write winning, exactly as separate calls would.
-	*/
-	async saveMany({ path, rows, collection, upsert }) {
-		return this.db.transaction(async (tx) => {
-			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-			txDriver.dataService = new DataService(tx, this.registry);
-			txDriver.client = this.client;
-			txDriver._deferNotifications = this._deferNotifications;
-			txDriver._pendingNotifications = this._pendingNotifications;
-			const saved = [];
-			for (let i = 0; i < rows.length; i++) {
-				const values = rows[i];
-				const id = values?.id;
-				try {
-					saved.push(await txDriver.save({
-						path,
-						values,
-						collection,
-						status: "new",
-						upsert
-					}));
-				} catch (error) {
-					const label = id !== void 0 ? `id ${JSON.stringify(id)}` : "no id";
-					throw Object.assign(new Error(`Row ${i} of ${rows.length} (${label}) failed: ${error?.message ?? error}`, { cause: error }), {
-						statusCode: error?.statusCode,
-						code: error?.code,
-						name: error?.name
-					});
-				}
-			}
-			return saved;
+}
+function classifyProperty(slug, collection, name, before, after, changes, facts) {
+	const beforeColumn = resolveColumnName$1(name, before);
+	const afterColumn = resolveColumnName$1(name, after);
+	if (beforeColumn !== afterColumn) changes.push({
+		kind: "rename-column",
+		verdict: "needs-migration",
+		collection: slug,
+		property: name,
+		detail: `"${name}" changes column from "${beforeColumn}" to "${afterColumn}".`,
+		remedy: "The ensure path only renames a column through its legacy-name path, which this is not. Rename it in a migration, or the old column stays and the new one is created empty beside it."
+	});
+	if (isIdProperty(before) !== isIdProperty(after)) {
+		changes.push({
+			kind: "change-primary-key",
+			verdict: "needs-migration",
+			collection: slug,
+			property: name,
+			detail: `"${name}" changes whether it is the primary key.`,
+			remedy: "A primary key change rewrites the table and every foreign key into it. Migration only."
+		});
+		return;
+	}
+	if (physicalShapeOf(before) !== physicalShapeOf(after)) changes.push({
+		kind: "change-property-type",
+		verdict: "needs-migration",
+		collection: slug,
+		property: name,
+		detail: `"${name}" changes physical type — ${before.type} to ${after.type}.`,
+		remedy: "There is no ALTER COLUMN TYPE in the ensure path, and a cast can fail on data that is already there. Change it in a migration."
+	});
+	if (!isRequired(before) && isRequired(after)) {
+		const empty = tableIsEmpty(collection, facts);
+		changes.push(empty ? {
+			kind: "change-required",
+			verdict: "safe",
+			collection: slug,
+			property: name,
+			detail: `"${name}" became required — sets NOT NULL on "${afterColumn}", which "${getTableName$1(collection)}" can take because it holds no rows.`
+		} : {
+			kind: "change-required",
+			verdict: "diverges",
+			collection: slug,
+			property: name,
+			detail: `"${name}" became required, but "${getTableName$1(collection)}" holds rows and SET NOT NULL is checked against every one of them. The database would keep accepting nulls.`,
+			remedy: `Backfill first — UPDATE the rows where "${afterColumn}" IS NULL — then apply this again.`
 		});
 	}
+	if (isRequired(before) && !isRequired(after)) changes.push({
+		kind: "change-required",
+		verdict: "safe",
+		collection: slug,
+		property: name,
+		detail: `"${name}" is no longer required — drops NOT NULL from "${afterColumn}".`
+	});
+	classifyEnum(slug, collection, name, before, after, changes, facts);
+}
+function classifyEnum(slug, collection, name, before, after, changes, facts) {
+	const oldValues = enumValuesOf(before);
+	const newValues = enumValuesOf(after);
+	if (!oldValues || !newValues) return;
+	const added = newValues.filter((value) => !oldValues.includes(value));
+	const removed = oldValues.filter((value) => !newValues.includes(value));
+	if (added.length > 0) {
+		const seesTheType = facts?.enumValues !== void 0;
+		changes.push(seesTheType ? {
+			kind: "add-enum-value",
+			verdict: "safe",
+			collection: slug,
+			property: name,
+			detail: `"${name}" gains ${added.map((v) => `"${v}"`).join(", ")} — ALTER TYPE … ADD VALUE.`
+		} : {
+			kind: "add-enum-value",
+			verdict: "diverges",
+			collection: slug,
+			property: name,
+			detail: `"${name}" gains ${added.map((v) => `"${v}"`).join(", ")}, and the values this type already has are not known here, so whether they would land cannot be said.`,
+			remedy: "Plan this against the database it is destined for."
+		});
+	}
+	if (removed.length > 0) changes.push({
+		kind: "remove-enum-value",
+		verdict: "needs-migration",
+		collection: slug,
+		property: name,
+		detail: `"${name}" drops ${removed.map((v) => `"${v}"`).join(", ")}.`,
+		remedy: "Postgres cannot remove a value from an enum type. Recreate the type in a migration, after rewriting every row still using the value."
+	});
+}
+//#endregion
+//#region src/schema/generate-schema-commit.ts
+/**
+* Everything a schema change has to write, as file contents.
+*
+* A live schema editor that only edits the collection source produces a repo
+* that does not build: `backend/src/schema.generated.ts` is a committed
+* artifact, and a stale one has broken every deploy at least once. So the unit
+* of a schema change is not a file, it is a **commit** — and this module
+* produces one, without touching a disk, a database or a network.
+*
+* Pure on purpose. The risky half of "commit, then apply" is generating a
+* correct commit; keeping it a function from collections to file contents is
+* what lets that half be tested by building a database from the result and
+* comparing it to the one the change describes.
+*
+* ## Where the migration comes from, and why not from Atlas
+*
+* `rebase db generate` mints migrations by running Atlas over the generated
+* `schema.sql`. Atlas is an external binary, it wants a dev database, and it
+* maintains an `atlas.sum` integrity file whose hash this module would have to
+* reproduce byte-for-byte to stay valid.
+*
+* None of that is necessary here, because of what the editor is allowed to do.
+* `classify-change.ts` refuses anything the boot-time ensure path cannot
+* express, which leaves only additive statements — and those are computable as
+* a plain difference between two ensure plans:
+*
+*     plan(after, nothing) − plan(before, nothing)
+*
+* Both plans are pure functions of the collections, every statement is
+* idempotent, and the difference is exactly what the change adds. No diff
+* engine, no database, no binary.
+*
+* The statements are *returned* rather than written into a migration file. A
+* project provisioned by boot-ensure needs no migration at all — its
+* collections are the schema — while a project provisioned by migrations needs
+* the file to carry an Atlas hash, which only Atlas can mint. Writing a
+* migration this module cannot make valid would be worse than handing the
+* statements to a caller who knows which kind of project it is.
+*/
+var SchemaCommitError = class extends Error {
+	classified;
+	constructor(message, classified) {
+		super(message);
+		this.classified = classified;
+		this.name = "SchemaCommitError";
+	}
+};
+/** An `ExistingSchema` describing a database that has nothing in it. */
+var nothing = () => ({
+	tables: /* @__PURE__ */ new Map(),
+	enums: /* @__PURE__ */ new Set()
+});
+/** A commit message that says what changed rather than that something did. */
+function commitMessage(classified) {
+	const { changes } = classified;
+	if (changes.length === 0) return "chore(schema): no change";
+	const collections = [...new Set(changes.map((change) => change.collection))].sort();
+	const added = changes.filter((c) => c.kind === "add-collection").map((c) => c.collection);
+	const properties = changes.filter((c) => c.kind === "add-property");
+	let subject;
+	if (added.length === 1 && changes.length === 1) subject = `add the ${added[0]} collection`;
+	else if (properties.length === 1 && changes.length === 1) subject = `add ${properties[0].property} to ${properties[0].collection}`;
+	else if (collections.length === 1) subject = `${changes.length} change(s) to ${collections[0]}`;
+	else subject = `${changes.length} change(s) across ${collections.length} collections`;
+	const body = changes.map((change) => `- ${change.detail}`).join("\n");
+	return `feat(schema): ${subject}\n\n${body}\n`;
+}
+/**
+* Build the commit.
+*
+* Refuses when the change is not applicable — a commit describing a schema the
+* ensure path will not produce is a commit that makes the repository lie about
+* the database. The classification travels on the error so a caller can show
+* exactly which change was the problem.
+*/
+async function generateSchemaCommit(input) {
+	const paths = {
+		...DEFAULT_COMMIT_PATHS,
+		...input.paths
+	};
+	const existing = input.existing ?? nothing();
+	const options = { constraints: "converge" };
+	const classified = classifyCollectionChanges(input.before, input.after, input.existing);
+	if (!classified.applicable) throw new SchemaCommitError(`This change cannot be applied to a running database:\n` + classified.changes.filter((change) => change.verdict !== "safe").map((change) => `  • ${change.detail}${change.remedy ? `\n    ${change.remedy}` : ""}`).join("\n"), classified);
+	const [schema, ddl, policies, search] = await Promise.all([
+		generateSchema(input.after),
+		generatePostgresDdl(input.after),
+		Promise.resolve(generatePostgresPoliciesDdl(input.after)),
+		Promise.resolve(generatePostgresSearchDdl(input.after))
+	]);
+	const generated = [
+		{
+			path: paths.schemaFile,
+			contents: schema
+		},
+		{
+			path: paths.ddlFile,
+			contents: ddl
+		},
+		{
+			path: paths.policiesFile,
+			contents: policies
+		},
+		{
+			path: paths.searchFile,
+			contents: search
+		}
+	];
+	const previous = planCollectionSchemaEnsure(input.before, existing, options);
+	const next = planCollectionSchemaEnsure(input.after, existing, options);
+	const already = new Set(previous.statements);
+	return {
+		files: [...input.sourceFiles ?? [], ...generated],
+		statements: next.statements.filter((statement) => !already.has(statement)),
+		classified,
+		message: commitMessage(classified),
+		withheldConstraints: next.withheldConstraints
+	};
+}
+//#endregion
+//#region src/PostgresBackendDriver.ts
+var PostgresBackendDriver = class PostgresBackendDriver {
+	db;
+	registry;
+	poolManager;
+	key = "postgres";
+	initialised = true;
+	dataService;
+	realtimeService;
+	historyService;
+	branchService;
+	user;
+	data;
+	client;
 	/**
-	* Update many rows through the same pipeline as {@link save}, in one
-	* transaction.
-	*
-	* Structurally the mirror of {@link saveMany} — same tx-bound sub-driver,
-	* same deferred notifications, same per-row error labelling — but it calls
-	* `save` with an explicit `id` and `status: "existing"`, which is precisely
-	* what `saveMany` cannot do: that one passes `status: "new"` and keeps the
-	* key inside `values`, so it inserts or upserts and can never target a
-	* particular row.
-	*
-	* All-or-nothing, so an id matching no row aborts the batch. A partial
-	* update is the outcome with no good recovery: the caller cannot tell which
-	* half landed without re-reading everything.
+	* Auto-set to `true` when a SET LOCAL ROLE fails with insufficient
+	* privileges, so subsequent queries skip the doomed attempt.
+	* Mirrors the static `DISABLE_DB_ROLE_SWITCHING` env var but is
+	* learned at runtime.
 	*/
-	async updateMany({ path, updates, collection }) {
-		return this.db.transaction(async (tx) => {
-			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-			txDriver.dataService = new DataService(tx, this.registry);
-			txDriver.client = this.client;
-			txDriver._deferNotifications = this._deferNotifications;
-			txDriver._pendingNotifications = this._pendingNotifications;
-			const saved = [];
-			for (let i = 0; i < updates.length; i++) {
-				const { id, values } = updates[i];
-				try {
-					if (!await txDriver.fetchOne({
-						path,
-						id: String(id),
-						collection
-					})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
-						statusCode: 404,
-						code: "NOT_FOUND"
-					});
-					saved.push(await txDriver.save({
-						path,
-						id: String(id),
-						values,
-						collection,
-						status: "existing"
-					}));
-				} catch (error) {
-					throw Object.assign(new Error(`Update ${i} of ${updates.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
-						statusCode: error?.statusCode,
-						code: error?.code,
-						name: error?.name
-					});
-				}
-			}
-			return saved;
-		});
+	_roleSwitchingDisabled = false;
+	/**
+	* Restricted role that authenticated (user-context) requests run as (via
+	* `SET LOCAL ROLE`) so RLS binds every statement — reads *and* writes. Set
+	* by the bootstrapper after posture detection: defined when the connection
+	* would otherwise bypass RLS (superuser / BYPASSRLS / table owner),
+	* undefined when RLS already applies natively. The base (server-context)
+	* driver never switches — it is the trusted owner plane (auth flows,
+	* migrations, `dataAsAdmin`).
+	*/
+	rlsUserRole;
+	/**
+	* When true, realtime notifications are deferred until after the
+	* wrapping transaction commits.  Set by `withAuth` → `withTransaction`.
+	*/
+	_deferNotifications = false;
+	_pendingNotifications = [];
+	constructor(db, realtimeService, registry, user, poolManager, historyService) {
+		this.db = db;
+		this.registry = registry;
+		this.poolManager = poolManager;
+		this.dataService = new DataService(db, registry);
+		this.realtimeService = realtimeService;
+		this.historyService = historyService;
+		this.user = user;
+		this.data = buildSdkData(this);
+		if (poolManager) this.branchService = new BranchService(db, poolManager);
 	}
 	/**
-	* Delete many rows in one transaction, running the full delete pipeline —
-	* `beforeDelete`, the delete, `afterDelete` — for each.
+	* Typed admin capabilities (SQLAdmin + SchemaAdmin + BranchAdmin).
+	* Implemented as a getter so method references are resolved at call-time,
+	* allowing test spies applied after construction to take effect.
+	*/
+	get admin() {
+		return {
+			executeSql: (...args) => this.executeSql(...args),
+			fetchAvailableDatabases: () => this.fetchAvailableDatabases(),
+			fetchAvailableRoles: () => this.fetchAvailableRoles(),
+			fetchApplicationRoles: () => this.fetchApplicationRoles(),
+			fetchCurrentDatabase: () => this.fetchCurrentDatabase(),
+			fetchUnmappedTables: (...args) => this.fetchUnmappedTables(...args),
+			fetchTableMetadata: (...args) => this.fetchTableMetadata(...args),
+			planSchemaChange: async (before, after, options) => generateSchemaCommit({
+				before,
+				after,
+				paths: options?.paths,
+				existing: await readSchemaFactsFor(this.schemaFactsQueryable(), after)
+			}),
+			...this.branchService ? {
+				createBranch: this.branchService.createBranch.bind(this.branchService),
+				deleteBranch: this.branchService.deleteBranch.bind(this.branchService),
+				listBranches: this.branchService.listBranches.bind(this.branchService),
+				getBranchInfo: this.branchService.getBranchInfo.bind(this.branchService)
+			} : {}
+		};
+	}
+	/**
+	* The catalogue-reading shim the schema planner wants.
 	*
-	* Looping the single-row {@link delete} rather than emitting one
-	* `DELETE ... WHERE id = ANY($1)` is the deliberate choice: a single
-	* statement would be faster and would skip every callback, so a collection
-	* relying on `beforeDelete` to veto or on `afterDelete` to clean up
-	* dependents would behave differently depending on how many rows the caller
-	* happened to delete at once. Same pipeline, one transaction.
+	* Text in, rows out — every statement it issues is a catalogue read keyed by
+	* schema name, and schema names are identifiers rather than bindable values,
+	* so there is nothing to parameterise. Runs on the driver's own handle, which
+	* is the connection whose privileges are already known to work.
 	*/
-	async deleteMany({ path, ids, collection }) {
-		await this.db.transaction(async (tx) => {
-			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-			txDriver.dataService = new DataService(tx, this.registry);
-			txDriver.client = this.client;
-			txDriver._deferNotifications = this._deferNotifications;
-			txDriver._pendingNotifications = this._pendingNotifications;
-			for (let i = 0; i < ids.length; i++) {
-				const id = ids[i];
-				try {
-					const existing = await txDriver.fetchOne({
-						path,
-						id: String(id),
-						collection
-					});
-					if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
-						statusCode: 404,
-						code: "NOT_FOUND"
-					});
-					await txDriver.delete({
-						row: {
-							id: String(id),
-							path,
-							values: existing
-						},
-						collection
-					});
-				} catch (error) {
-					throw Object.assign(new Error(`Delete ${i} of ${ids.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
-						statusCode: error?.statusCode,
-						code: error?.code,
-						name: error?.name
-					});
-				}
+	schemaFactsQueryable() {
+		return { query: async (text) => {
+			const result = await this.db.execute(sql.raw(text));
+			return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
+		} };
+	}
+	/**
+	* REST-optimised fetch service (include-aware eager-loading).
+	* Delegates to the underlying FetchService (include-aware eager loading),
+	* then runs the afterRead pipeline on the results. The raw FetchService does
+	* NOT run callbacks, so masking must be applied here — otherwise every
+	* REST/SDK read leaks unmasked data (see {@link applyAfterReadForRest}).
+	*/
+	get restFetchService() {
+		const raw = this.dataService.getFetchService();
+		return {
+			fetchCollectionForRest: async (collectionPath, options, include) => {
+				const rows = await raw.fetchCollectionForRest(collectionPath, options, include);
+				return this.applyAfterReadForRest(rows, collectionPath);
+			},
+			fetchOneForRest: async (collectionPath, id, include, databaseId) => {
+				const row = await raw.fetchOneForRest(collectionPath, id, include, databaseId);
+				if (!row) return row;
+				const [masked] = await this.applyAfterReadForRest([row], collectionPath);
+				return masked;
 			}
-		});
+		};
 	}
-	async delete({ row, collection }) {
-		const targetPath = row.path;
-		const targetRow = { ...row.values ?? {} };
-		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, targetPath);
-		const contextForCallback = this.buildCallContext();
-		if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
-			let preventDefault = false;
-			if (globalCallbacks?.beforeDelete) {
-				if (await globalCallbacks.beforeDelete({
-					collection: resolvedCollection,
-					path: targetPath,
-					id: row.id,
-					row: targetRow,
-					context: contextForCallback
-				}) === false) preventDefault = true;
+	/**
+	* Build the context handed to every collection callback.
+	*
+	* Note `data: this.data` — `this` is whichever driver is running the
+	* operation, so the callback's data plane inherits that driver's privilege.
+	* On a user request `AuthenticatedPostgresBackendDriver.withTransaction`
+	* constructs a fresh base driver bound to the RLS-scoped transaction and
+	* runs the operation on it, so `this.data` speaks through that connection
+	* and policies apply. On server-context work `this` is the base driver on
+	* the owner connection, and they do not. Pinned by the
+	* `"scopes context.data to the caller"` case in the `rls-enforcement` e2e
+	* suite, because it is the kind of property that is easy to break from a
+	* distance and impossible to notice.
+	*
+	* Previously returned through `as unknown as RebaseCallContext`, which
+	* disabled checking for the whole object and let `driver` — documented in
+	* the callbacks guide — sit on the runtime context while absent from the
+	* contract. Both are declared now, so this is a plain typed return.
+	*/
+	buildCallContext() {
+		return {
+			user: this.user,
+			driver: this,
+			data: this.data,
+			client: this.client,
+			storageSource: this.client?.storage
+		};
+	}
+	resolveCollectionCallbacks(collection, path) {
+		if (!collection && !path) return {
+			collection: void 0,
+			callbacks: void 0,
+			globalCallbacks: void 0,
+			propertyCallbacks: void 0
+		};
+		const registryCollection = this.registry?.getCollectionByPath(path);
+		const resolvedCollection = registryCollection ? {
+			...collection,
+			...registryCollection
+		} : collection;
+		const callbacks = resolvedCollection?.callbacks;
+		const globalCallbacks = this.registry?.getGlobalCallbacks();
+		const properties = resolvedCollection?.properties;
+		let propertyCallbacks;
+		if (properties) propertyCallbacks = buildPropertyCallbacks(properties);
+		return {
+			collection: resolvedCollection,
+			callbacks,
+			globalCallbacks,
+			propertyCallbacks
+		};
+	}
+	/**
+	* Run the three-tier afterRead pipeline (global → collection → property) on a
+	* single row for a collection whose callbacks have already been resolved.
+	*/
+	async applyAfterReadToRow(row, path, resolved, contextForCallback) {
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = resolved;
+		let out = row;
+		if (globalCallbacks?.afterRead) out = await globalCallbacks.afterRead({
+			collection: resolvedCollection,
+			path,
+			row: out,
+			context: contextForCallback
+		}) ?? out;
+		if (callbacks?.afterRead) out = await callbacks.afterRead({
+			collection: resolvedCollection,
+			path,
+			row: out,
+			context: contextForCallback
+		}) ?? out;
+		if (propertyCallbacks?.afterRead) out = await propertyCallbacks.afterRead({
+			collection: resolvedCollection,
+			path,
+			row: out,
+			context: contextForCallback
+		}) ?? out;
+		return out;
+	}
+	static hasAfterRead(resolved) {
+		return !!(resolved.globalCallbacks?.afterRead || resolved.callbacks?.afterRead || resolved.propertyCallbacks?.afterRead);
+	}
+	/**
+	* Apply afterRead to REST/SDK read results.
+	*
+	* The REST / `include` path fetches rows through the raw fetch service, which
+	* does NOT run callbacks — so without this, `afterRead` transforms (e.g. PII
+	* masking) are silently skipped on every SDK/REST read, leaking raw data.
+	* This choke point guarantees afterRead runs there too, matching the driver's
+	* fetchCollection/fetchOne paths.
+	*
+	* It also masks embedded relation data one level deep by running the TARGET
+	* collection's afterRead (so `post.author.email` is masked by the authors
+	* collection, not left raw).
+	*/
+	async applyAfterReadForRest(rows, path) {
+		if (!rows || rows.length === 0) return rows;
+		const resolved = this.resolveCollectionCallbacks(void 0, path);
+		const contextForCallback = this.buildCallContext();
+		const hasOwn = PostgresBackendDriver.hasAfterRead(resolved);
+		const relationTargets = {};
+		if (resolved.collection) try {
+			const rels = resolveCollectionRelations(resolved.collection);
+			for (const [key, rel] of Object.entries(rels)) {
+				const targetPath = (typeof rel.target === "function" ? rel.target() : void 0)?.slug;
+				if (!targetPath) continue;
+				const targetResolved = this.resolveCollectionCallbacks(void 0, targetPath);
+				if (PostgresBackendDriver.hasAfterRead(targetResolved)) relationTargets[key] = {
+					path: targetPath,
+					resolved: targetResolved
+				};
 			}
-			if (callbacks?.beforeDelete) {
-				if (await callbacks.beforeDelete({
+		} catch {}
+		const relKeys = Object.keys(relationTargets);
+		if (!hasOwn && relKeys.length === 0) return rows;
+		const maskEmbedded = async (value, target) => {
+			if (Array.isArray(value)) return Promise.all(value.map((v) => maskEmbedded(v, target)));
+			if (!value || typeof value !== "object") return value;
+			const obj = value;
+			if (obj.__type === "relation" && obj.data && typeof obj.data === "object") return {
+				...obj,
+				data: await this.applyAfterReadToRow(obj.data, target.path, target.resolved, contextForCallback)
+			};
+			if (obj.__type === "reference") return obj;
+			return this.applyAfterReadToRow(obj, target.path, target.resolved, contextForCallback);
+		};
+		return Promise.all(rows.map(async (row) => {
+			let out = hasOwn ? await this.applyAfterReadToRow(row, path, resolved, contextForCallback) : row;
+			for (const key of relKeys) {
+				if (out[key] === void 0 || out[key] === null) continue;
+				out = {
+					...out,
+					[key]: await maskEmbedded(out[key], relationTargets[key])
+				};
+			}
+			return out;
+		}));
+	}
+	async fetchCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, vectorSearch }) {
+		const rows = await this.dataService.fetchCollection(path, {
+			filter,
+			orderBy,
+			order,
+			limit,
+			offset,
+			startAfter,
+			databaseId: collection?.databaseId,
+			searchString,
+			vectorSearch
+		});
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
+		if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
+			const contextForCallback = this.buildCallContext();
+			return Promise.all(rows.map(async (row) => {
+				let fetched = row;
+				if (globalCallbacks?.afterRead) fetched = await globalCallbacks.afterRead({
 					collection: resolvedCollection,
-					path: targetPath,
-					id: row.id,
-					row: targetRow,
+					path,
+					row: fetched,
 					context: contextForCallback
-				}) === false) preventDefault = true;
-			}
-			if (propertyCallbacks?.beforeDelete) {
-				if (await propertyCallbacks.beforeDelete({
+				});
+				if (callbacks?.afterRead) fetched = await callbacks.afterRead({
 					collection: resolvedCollection,
-					path: targetPath,
-					id: row.id,
-					row: targetRow,
+					path,
+					row: fetched,
 					context: contextForCallback
-				}) === false) preventDefault = true;
-			}
-			if (preventDefault) return;
+				}) ?? fetched;
+				if (propertyCallbacks?.afterRead) fetched = await propertyCallbacks.afterRead({
+					collection: resolvedCollection,
+					path,
+					row: fetched,
+					context: contextForCallback
+				});
+				return fetched;
+			}));
 		}
-		await this.dataService.delete(targetPath, row.id, resolvedCollection?.databaseId);
-		if (globalCallbacks?.afterDelete || callbacks?.afterDelete || propertyCallbacks?.afterDelete) {
-			if (globalCallbacks?.afterDelete) await globalCallbacks.afterDelete({
+		return rows;
+	}
+	listenCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, onUpdate, onError }) {
+		const subscriptionId = this.generateSubscriptionId();
+		const callbackWrapper = (rows) => {
+			onUpdate(rows);
+		};
+		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
+			clientId: "driver",
+			type: "collection",
+			path,
+			collectionRequest: {
+				filter,
+				orderBy,
+				order,
+				limit,
+				offset,
+				startAfter,
+				databaseId: collection?.databaseId,
+				searchString
+			}
+		});
+		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
+		this.fetchCollection({
+			path,
+			collection,
+			filter,
+			limit,
+			offset,
+			startAfter,
+			orderBy,
+			searchString,
+			order
+		}).then((rows) => {
+			callbackWrapper(rows);
+		}).catch((error) => {
+			if (onError) onError(error);
+		});
+		return () => {
+			this.realtimeService.removeSubscriptionCallback(subscriptionId);
+			this.realtimeService.subscriptions.delete(subscriptionId);
+		};
+	}
+	async fetchOne({ path, id, databaseId, collection }) {
+		let row = await this.dataService.fetchOne(path, id, databaseId || collection?.databaseId);
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
+		if (row && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
+			const contextForCallback = this.buildCallContext();
+			if (globalCallbacks?.afterRead) row = await globalCallbacks.afterRead({
 				collection: resolvedCollection,
-				path: targetPath,
-				id: row.id,
-				row: targetRow,
+				path,
+				row,
 				context: contextForCallback
 			});
-			if (callbacks?.afterDelete) await callbacks.afterDelete({
+			if (callbacks?.afterRead) row = await callbacks.afterRead({
 				collection: resolvedCollection,
-				path: targetPath,
-				id: row.id,
-				row: targetRow,
+				path,
+				row,
 				context: contextForCallback
-			});
-			if (propertyCallbacks?.afterDelete) await propertyCallbacks.afterDelete({
+			}) ?? row;
+			if (propertyCallbacks?.afterRead) row = await propertyCallbacks.afterRead({
 				collection: resolvedCollection,
-				path: targetPath,
-				id: row.id,
-				row: targetRow,
+				path,
+				row,
 				context: contextForCallback
 			});
 		}
-		if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
-			tableName: targetPath,
-			id: row.id.toString(),
-			action: "delete",
-			values: row.values ?? {},
-			updatedBy: this.user?.uid
+		return row;
+	}
+	listenOne({ path, id, collection, onUpdate, onError }) {
+		const subscriptionId = this.generateSubscriptionId();
+		const callbackWrapper = (row) => {
+			if (row) onUpdate(row);
+		};
+		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
+			clientId: "driver",
+			type: "single",
+			path,
+			id
 		});
-		if (this._deferNotifications) this._pendingNotifications.push({
-			path: targetPath,
-			id: row.id.toString(),
-			row: null,
-			databaseId: resolvedCollection?.databaseId
+		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
+		this.fetchOne({
+			path,
+			id,
+			collection
+		}).then((row) => {
+			if (row) onUpdate(row);
+		}).catch((error) => {
+			if (onError) onError(error);
 		});
-		else await this.realtimeService.notifyUpdate(targetPath, row.id.toString(), null, resolvedCollection?.databaseId);
-	}
-	async deleteAll(path) {
-		await this.dataService.deleteAll(path);
-		await this.realtimeService.notifyUpdate(path, "*", null);
-	}
-	async checkUniqueField(path, name, value, id, collection) {
-		return this.dataService.checkUniqueField(path, name, value, id, collection?.databaseId);
+		return () => {
+			this.realtimeService.removeSubscriptionCallback(subscriptionId);
+			this.realtimeService.subscriptions.delete(subscriptionId);
+		};
 	}
-	async count({ path, collection, filter, logical, searchString, vectorSearch }) {
-		return this.dataService.count(path, {
-			filter,
-			logical,
-			searchString,
-			vectorSearch
+	async save({ path, id, values, collection, status, upsert }) {
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
+		let updatedValues = values;
+		const contextForCallback = this.buildCallContext();
+		let previousValuesForHistory;
+		if (status === "existing" && id) try {
+			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
+			if (existing) {
+				const { id: _existingId, ...existingValues } = existing;
+				previousValuesForHistory = existingValues;
+			}
+		} catch (err) {
+			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
+		}
+		if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
+			if (globalCallbacks?.beforeSave) {
+				const result = await globalCallbacks.beforeSave({
+					collection: resolvedCollection,
+					path,
+					id,
+					values: updatedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+				if (result) updatedValues = mergeDeep(updatedValues, result);
+			}
+			if (callbacks?.beforeSave) {
+				const result = await callbacks.beforeSave({
+					collection: resolvedCollection,
+					path,
+					id,
+					values: updatedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+				if (result) updatedValues = mergeDeep(updatedValues, result);
+			}
+			if (propertyCallbacks?.beforeSave) {
+				const result = await propertyCallbacks.beforeSave({
+					collection: resolvedCollection,
+					path,
+					id,
+					values: updatedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+				if (result) updatedValues = mergeDeep(updatedValues, result);
+			}
+		}
+		if (resolvedCollection?.properties) updatedValues = updateDateAutoValues({
+			inputValues: updatedValues,
+			properties: resolvedCollection.properties,
+			status: status ?? "new",
+			timestampNowValue: /* @__PURE__ */ new Date()
 		});
-	}
-	getTargetDb(databaseName) {
-		if (!databaseName || databaseName === this.poolManager?.defaultDatabaseName) return this.db;
-		if (!this.poolManager) throw new Error("Cross-database execution requires adminConnectionString to be configured in the backend.");
-		return this.poolManager.getDrizzle(databaseName);
-	}
-	async executeSql(sqlText, options) {
-		if (!options?.database && !options?.role) return this.dataService.executeSql(sqlText, options?.params);
-		const targetDb = this.getTargetDb(options?.database);
 		try {
-			let needsRoleSwitch = false;
-			if (options?.role && process.env.DISABLE_DB_ROLE_SWITCHING !== "true" && !this._roleSwitchingDisabled) try {
-				const currentRole = ((await targetDb.execute(sql.raw("SELECT current_user AS role"))).rows?.[0])?.role;
-				needsRoleSwitch = !!currentRole && currentRole !== options.role;
-			} catch {
-				needsRoleSwitch = true;
+			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, { upsert });
+			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
+				if (globalCallbacks?.afterRead) savedRow = await globalCallbacks.afterRead({
+					collection: resolvedCollection,
+					path,
+					row: savedRow,
+					context: contextForCallback
+				});
+				if (callbacks?.afterRead) savedRow = await callbacks.afterRead({
+					collection: resolvedCollection,
+					path,
+					row: savedRow,
+					context: contextForCallback
+				}) ?? savedRow;
+				if (propertyCallbacks?.afterRead) savedRow = await propertyCallbacks.afterRead({
+					collection: resolvedCollection,
+					path,
+					row: savedRow,
+					context: contextForCallback
+				});
 			}
-			if (needsRoleSwitch && options?.role) {
-				const safeRole = options.role.replace(/"/g, "\"\"");
-				try {
-					return await targetDb.transaction(async (tx) => {
-						await tx.execute(sql.raw(`SET LOCAL ROLE "${safeRole}"`));
-						let result;
-						if (options?.params && options.params.length > 0) {
-							const parts = sqlText.split(/\$(\d+)/);
-							const chunks = [];
-							for (let i = 0; i < parts.length; i++) if (i % 2 === 0) {
-								if (parts[i].length > 0) chunks.push(sql.raw(parts[i]));
-							} else chunks.push(sql.param(options.params[Number(parts[i]) - 1]));
-							result = await tx.execute(sql.join(chunks, sql.raw("")));
-						} else result = await tx.execute(sql.raw(sqlText));
-						return result.rows;
-					});
-				} catch (roleError) {
-					if (isRoleSwitchingPermissionError(roleError)) {
-						logger.warn(`[PostgresBackendDriver] SET LOCAL ROLE "${safeRole}" failed — the connection user lacks permission. Falling back to executing without role switching. To suppress this warning, set DISABLE_DB_ROLE_SWITCHING=true in your .env file.`);
-						this._roleSwitchingDisabled = true;
-					} else throw roleError;
-				}
+			const savedId = deriveRowAddress(savedRow, resolvedCollection ?? collection, this.registry);
+			const savedValues = savedRow;
+			if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
+				if (globalCallbacks?.afterSave) await globalCallbacks.afterSave({
+					collection: resolvedCollection,
+					path,
+					id: savedId,
+					values: savedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+				if (callbacks?.afterSave) await callbacks.afterSave({
+					collection: resolvedCollection,
+					path,
+					id: savedId,
+					values: savedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+				if (propertyCallbacks?.afterSave) await propertyCallbacks.afterSave({
+					collection: resolvedCollection,
+					path,
+					id: savedId,
+					values: savedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
 			}
-			let result;
-			if (options?.params && options.params.length > 0) {
-				const parts = sqlText.split(/\$(\d+)/);
-				const chunks = [];
-				for (let i = 0; i < parts.length; i++) if (i % 2 === 0) {
-					if (parts[i].length > 0) chunks.push(sql.raw(parts[i]));
-				} else chunks.push(sql.param(options.params[Number(parts[i]) - 1]));
-				result = await targetDb.execute(sql.join(chunks, sql.raw("")));
-			} else result = await targetDb.execute(sql.raw(sqlText));
-			return result.rows;
+			if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
+				tableName: path,
+				id: savedId,
+				action: status === "new" ? "create" : "update",
+				values: savedValues,
+				previousValues: previousValuesForHistory,
+				updatedBy: this.user?.uid
+			});
+			if (this._deferNotifications) this._pendingNotifications.push({
+				path,
+				id: savedId,
+				row: savedRow,
+				databaseId: resolvedCollection?.databaseId
+			});
+			else await this.realtimeService.notifyUpdate(path, savedId, savedRow, resolvedCollection?.databaseId);
+			return savedRow;
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
-			if (msg.includes("pg_hba.conf") || msg.includes("no encryption") || msg.includes("connection refused")) {
-				const dbName = options?.database || "unknown";
-				throw new Error(`Cannot connect to database "${dbName}": the server rejected the connection. This database may require SSL or is not accessible from this host.`);
+			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
+				if (globalCallbacks?.afterSaveError) await globalCallbacks.afterSaveError({
+					collection: resolvedCollection,
+					path,
+					id: id || "unknown",
+					values: updatedValues,
+					previousValues: void 0,
+					status,
+					context: contextForCallback
+				});
+				if (callbacks?.afterSaveError) await callbacks.afterSaveError({
+					collection: resolvedCollection,
+					path,
+					id: id || "unknown",
+					values: updatedValues,
+					previousValues: void 0,
+					status,
+					context: contextForCallback
+				});
+				if (propertyCallbacks?.afterSaveError) await propertyCallbacks.afterSaveError({
+					collection: resolvedCollection,
+					path,
+					id: id || "unknown",
+					values: updatedValues,
+					previousValues: void 0,
+					status,
+					context: contextForCallback
+				});
 			}
 			throw error;
 		}
 	}
-	async fetchAvailableDatabases() {
-		const databases = (await this.executeSql(`SELECT datname FROM pg_database 
-             WHERE datistemplate = false 
-             AND datname NOT IN ('postgres', 'cloudsqladmin', '_cloudsqladmin')
-             ORDER BY datname;`)).map((r) => r.datname);
-		const currentDb = this.poolManager?.defaultDatabaseName;
-		if (currentDb && !databases.includes(currentDb)) databases.unshift(currentDb);
-		else if (currentDb) {
-			const idx = databases.indexOf(currentDb);
-			if (idx > 0) {
-				databases.splice(idx, 1);
-				databases.unshift(currentDb);
-			}
-		}
-		return databases;
-	}
-	async fetchAvailableRoles() {
-		return (await this.executeSql("SELECT rolname FROM pg_roles WHERE pg_has_role(current_user, rolname, 'member') ORDER BY rolname;")).map((r) => r.rolname);
-	}
 	/**
-	* Application-level roles actually in use in this project.
+	* Write many rows through the same pipeline as {@link save}.
 	*
-	* Distinct from {@link fetchAvailableRoles}, which returns native
-	* PostgreSQL roles from `pg_roles` (`postgres`, `rebase_user`, …). Those
-	* are the roles the SQL editor can `SET ROLE` to. *These* are the strings
-	* held in the users table's `roles` column, injected per-transaction as
-	* `rebase.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
-	* into a `SecurityRule.roles` field produces a condition no user can ever
-	* satisfy, so the two must not be conflated.
+	* The batch runs in one transaction of its own, so a failure part-way leaves
+	* nothing behind — the point of a batch is that a re-run starts from a known
+	* state. When this driver is already inside a transaction (the authenticated
+	* path, via `withTransaction`) the nested call becomes a savepoint, which is
+	* still atomic and still commits once.
 	*
-	* Roles have no registry table — they were migrated out of
-	* `rebase.user_roles` onto an inline `roles TEXT[]` column — so the live
-	* set is derived from what is assigned. A role that is declared in a policy
-	* but held by nobody yet cannot be discovered here; callers that need it
-	* should union in the roles they already know about.
-	*/
-	async fetchApplicationRoles() {
-		const located = await this.executeSql(`
-            SELECT table_schema, table_name
-            FROM information_schema.columns
-            WHERE column_name = 'roles'
-              AND data_type = 'ARRAY'
-              AND table_name = 'users'
-              AND table_schema NOT IN ('information_schema', 'pg_catalog')
-            ORDER BY (table_schema = 'rebase') DESC, table_schema
-            LIMIT 1;
-        `);
-		if (located.length === 0) return [];
-		const schema = located[0].table_schema;
-		const table = located[0].table_name;
-		const qualified = `"${schema.replace(/"/g, "\"\"")}"."${table.replace(/"/g, "\"\"")}"`;
-		return (await this.executeSql(`
-            SELECT DISTINCT unnest(roles) AS role
-            FROM ${qualified}
-            WHERE roles IS NOT NULL
-            ORDER BY role;
-        `)).map((r) => r.role).filter((r) => typeof r === "string" && r.length > 0);
-	}
-	async fetchCurrentDatabase() {
-		return this.poolManager?.defaultDatabaseName;
-	}
-	/**
-	* Fetch public tables that are not yet mapped to a collection.
-	* Excludes internal tables (_rebase_*, _auth_*, auth tables, etc.)
-	* and junction/connection tables used for many-to-many relations.
+	* Rows are applied in order, so a batch that touches the same key twice ends
+	* with the last write winning, exactly as separate calls would.
 	*/
-	async fetchUnmappedTables(mappedPaths) {
-		const allTables = (await this.executeSql(`
-            SELECT table_name
-            FROM information_schema.tables
-            WHERE table_schema = 'public'
-              AND table_type = 'BASE TABLE'
-            ORDER BY table_name;
-        `)).map((r) => r.table_name).filter((name) => classifyTable(name, "public") !== "rebase-internal");
-		let junctionTables = /* @__PURE__ */ new Set();
-		try {
-			junctionTables = await detectJunctionTables(this.executeSql.bind(this));
-		} catch (e) {
-			logger.warn("Could not detect junction tables", { error: e });
-		}
-		const filteredTables = allTables.filter((name) => !junctionTables.has(name));
-		if (!mappedPaths || mappedPaths.length === 0) return filteredTables;
-		const mappedSet = new Set(mappedPaths.map((p) => p.toLowerCase()));
-		return filteredTables.filter((name) => !mappedSet.has(name.toLowerCase()));
+	async saveMany({ path, rows, collection, upsert }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < rows.length; i++) {
+				const values = rows[i];
+				const id = values?.id;
+				try {
+					saved.push(await txDriver.save({
+						path,
+						values,
+						collection,
+						status: "new",
+						upsert
+					}));
+				} catch (error) {
+					const label = id !== void 0 ? `id ${JSON.stringify(id)}` : "no id";
+					throw Object.assign(new Error(`Row ${i} of ${rows.length} (${label}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return saved;
+		});
 	}
 	/**
-	* Fetch metadata for a given table from information_schema (columns, policies, constraints).
+	* Update many rows through the same pipeline as {@link save}, in one
+	* transaction.
+	*
+	* Structurally the mirror of {@link saveMany} — same tx-bound sub-driver,
+	* same deferred notifications, same per-row error labelling — but it calls
+	* `save` with an explicit `id` and `status: "existing"`, which is precisely
+	* what `saveMany` cannot do: that one passes `status: "new"` and keeps the
+	* key inside `values`, so it inserts or upserts and can never target a
+	* particular row.
+	*
+	* All-or-nothing, so an id matching no row aborts the batch. A partial
+	* update is the outcome with no good recovery: the caller cannot tell which
+	* half landed without re-reading everything.
 	*/
-	async fetchTableMetadata(tableName) {
-		const safeName = tableName.replace(/[^a-zA-Z0-9_]/g, "");
-		const columns = (await this.db.execute(sql`
-            SELECT column_name, data_type, udt_name, is_nullable, column_default, character_maximum_length
-            FROM information_schema.columns
-            WHERE table_schema = 'public'
-              AND table_name = ${safeName}
-            ORDER BY ordinal_position
-        `)).rows;
-		const enumColumns = columns.filter((c) => c.data_type === "USER-DEFINED");
-		if (enumColumns.length > 0) for (const col of enumColumns) try {
-			col.enum_values = (await this.db.execute(sql`
-                        SELECT e.enumlabel
-                        FROM pg_type t
-                        JOIN pg_enum e ON t.oid = e.enumtypid
-                        WHERE t.typname = ${col.udt_name}
-                        ORDER BY e.enumsortorder
-                    `)).rows.map((e) => e.enumlabel);
-		} catch {
-			col.enum_values = [];
-		}
-		return {
-			columns,
-			foreignKeys: (await this.db.execute(sql`
-            SELECT
-                kcu.column_name as column_name,
-                ccu.table_name AS foreign_table_name,
-                ccu.column_name AS foreign_column_name
-            FROM 
-                information_schema.table_constraints AS tc 
-                JOIN information_schema.key_column_usage AS kcu
-                  ON tc.constraint_name = kcu.constraint_name
-                  AND tc.table_schema = kcu.table_schema
-                JOIN information_schema.constraint_column_usage AS ccu
-                  ON ccu.constraint_name = tc.constraint_name
-                  AND ccu.table_schema = tc.table_schema
-            WHERE tc.constraint_type = 'FOREIGN KEY' AND tc.table_name = ${safeName};
-        `)).rows,
-			junctions: (await this.db.execute(sql`
-            SELECT 
-                tc1.table_name as junction_table_name,
-                kcu1.column_name as source_column_name,
-                ccu2.table_name as target_table_name,
-                kcu2.column_name as target_column_name
-            FROM information_schema.table_constraints tc1
-            JOIN information_schema.key_column_usage kcu1 ON tc1.constraint_name = kcu1.constraint_name
-            JOIN information_schema.constraint_column_usage ccu1 ON ccu1.constraint_name = tc1.constraint_name
-            JOIN information_schema.table_constraints tc2 ON tc1.table_name = tc2.table_name AND tc2.constraint_type = 'FOREIGN KEY'
-            JOIN information_schema.key_column_usage kcu2 ON tc2.constraint_name = kcu2.constraint_name
-            JOIN information_schema.constraint_column_usage ccu2 ON ccu2.constraint_name = tc2.constraint_name
-            WHERE tc1.constraint_type = 'FOREIGN KEY' 
-              AND ccu1.table_name = ${safeName}
-              AND ccu2.table_name != ${safeName};
-        `)).rows,
-			policies: (await this.db.execute(sql`
-            SELECT 
-                polname as policy_name, 
-                polcmd as cmd, 
-                polroles::regrole[]::text[] as roles, 
-                pg_get_expr(polqual, polrelid) as qual, 
-                pg_get_expr(polwithcheck, polrelid) as with_check
-            FROM pg_policy
-            WHERE polrelid = (SELECT oid FROM pg_class WHERE relname = ${safeName} AND relnamespace = 'public'::regnamespace);
-        `)).rows
-		};
-	}
-	generateSubscriptionId() {
-		return `sub_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
+	async updateMany({ path, updates, collection }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < updates.length; i++) {
+				const { id, values } = updates[i];
+				try {
+					if (!await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					saved.push(await txDriver.save({
+						path,
+						id: String(id),
+						values,
+						collection,
+						status: "existing"
+					}));
+				} catch (error) {
+					throw Object.assign(new Error(`Update ${i} of ${updates.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return saved;
+		});
 	}
 	/**
-	* Create a new delegate instance with authenticated context.
-	* Starts a transaction and sets the current_user_id and current_user_roles
-	* configuration parameters for PostgreSQL Row Level Security.
+	* Delete many rows in one transaction, running the full delete pipeline —
+	* `beforeDelete`, the delete, `afterDelete` — for each.
+	*
+	* Looping the single-row {@link delete} rather than emitting one
+	* `DELETE ... WHERE id = ANY($1)` is the deliberate choice: a single
+	* statement would be faster and would skip every callback, so a collection
+	* relying on `beforeDelete` to veto or on `afterDelete` to clean up
+	* dependents would behave differently depending on how many rows the caller
+	* happened to delete at once. Same pipeline, one transaction.
 	*/
-	async withAuth(user) {
-		return new AuthenticatedPostgresBackendDriver(this, user);
-	}
-};
-var AuthenticatedPostgresBackendDriver = class {
-	delegate;
-	key = "postgres";
-	initialised = true;
-	user;
-	data;
-	constructor(delegate, user) {
-		this.delegate = delegate;
-		this.user = user;
-		this.data = buildSdkData(this);
-		this.admin = delegate.admin;
-	}
-	/**
-	* Typed admin capabilities — delegates to the base driver.
-	*/
-	admin;
-	get restFetchService() {
-		return {
-			fetchCollectionForRest: async (collectionPath, options, include) => {
-				return this.withTransaction(async (delegate) => {
-					return delegate.restFetchService.fetchCollectionForRest(collectionPath, options, include);
-				}, { accessMode: "read only" });
-			},
-			fetchOneForRest: async (collectionPath, id, include, databaseId) => {
-				return this.withTransaction(async (delegate) => {
-					return delegate.restFetchService.fetchOneForRest(collectionPath, id, include, databaseId);
-				}, { accessMode: "read only" });
+	async deleteMany({ path, ids, collection }) {
+		await this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			for (let i = 0; i < ids.length; i++) {
+				const id = ids[i];
+				try {
+					const existing = await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					});
+					if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					await txDriver.delete({
+						row: {
+							id: String(id),
+							path,
+							values: existing
+						},
+						collection
+					});
+				} catch (error) {
+					throw Object.assign(new Error(`Delete ${i} of ${ids.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
 			}
-		};
+		});
 	}
-	async withTransaction(operation, options) {
-		const pendingNotifications = [];
-		const result = await this.delegate.db.transaction(async (tx) => {
-			let uid = this.user?.uid;
-			if (!uid) {
-				logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
-				uid = "anonymous";
+	async delete({ row, collection }) {
+		const targetPath = row.path;
+		const targetRow = { ...row.values ?? {} };
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, targetPath);
+		const contextForCallback = this.buildCallContext();
+		if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
+			let preventDefault = false;
+			if (globalCallbacks?.beforeDelete) {
+				if (await globalCallbacks.beforeDelete({
+					collection: resolvedCollection,
+					path: targetPath,
+					id: row.id,
+					row: targetRow,
+					context: contextForCallback
+				}) === false) preventDefault = true;
 			}
-			const userRoles = this.user?.roles ?? [];
-			if (!this.user?.roles) logger.warn("[DataDriver] User roles are missing for authenticated delegate. Using empty array. User object", { detail: this.user });
-			await applyAuthContext(tx, {
-				uid,
-				roles: userRoles
-			}, this.delegate.rlsUserRole);
-			const txEntityService = new DataService(tx, this.delegate.registry);
-			const txDelegate = new PostgresBackendDriver(tx, this.delegate.realtimeService, this.delegate.registry, this.user, this.delegate.poolManager, this.delegate.historyService);
-			txDelegate.dataService = txEntityService;
-			txDelegate._deferNotifications = true;
-			txDelegate._pendingNotifications = pendingNotifications;
-			txDelegate.client = this.delegate.client;
-			return await operation(txDelegate);
-		}, options);
-		for (const notification of pendingNotifications) try {
-			await this.delegate.realtimeService.notifyUpdate(notification.path, notification.id, notification.row, notification.databaseId);
-		} catch (e) {
-			logger.error("[DataDriver] Error flushing deferred notification", { error: e });
+			if (callbacks?.beforeDelete) {
+				if (await callbacks.beforeDelete({
+					collection: resolvedCollection,
+					path: targetPath,
+					id: row.id,
+					row: targetRow,
+					context: contextForCallback
+				}) === false) preventDefault = true;
+			}
+			if (propertyCallbacks?.beforeDelete) {
+				if (await propertyCallbacks.beforeDelete({
+					collection: resolvedCollection,
+					path: targetPath,
+					id: row.id,
+					row: targetRow,
+					context: contextForCallback
+				}) === false) preventDefault = true;
+			}
+			if (preventDefault) return;
 		}
-		return result;
-	}
-	async fetchCollection(props) {
-		return this.withTransaction((delegate) => delegate.fetchCollection(props), { accessMode: "read only" });
-	}
-	/**
-	* Injects the authenticated user's context into the most recently
-	* registered realtime subscription so RLS-aware polling can apply.
-	*/
-	injectAuthContext(unsubscribe) {
-		const authContext = {
-			uid: this.user?.uid || "anonymous",
-			roles: this.user?.roles ?? []
-		};
-		const entries = Array.from(this.delegate.realtimeService.subscriptions.entries());
-		const lastSub = entries[entries.length - 1]?.[1];
-		if (lastSub && lastSub.clientId === "driver") lastSub.authContext = authContext;
-		return unsubscribe;
-	}
-	listenCollection(props) {
-		return this.injectAuthContext(this.delegate.listenCollection(props));
-	}
-	async fetchOne(props) {
-		return this.withTransaction((delegate) => delegate.fetchOne(props), { accessMode: "read only" });
-	}
-	listenOne(props) {
-		return this.injectAuthContext(this.delegate.listenOne(props));
-	}
-	async save(props) {
-		return this.withTransaction((delegate) => delegate.save(props));
-	}
-	/**
-	* One transaction for the whole batch, rather than one per row.
-	*
-	* This is the point of the method: `save` opens a transaction per call, so
-	* importing 10k rows through it means 10k transactions (and, over HTTP, 10k
-	* round trips). Here the RLS context is established once and every row lands
-	* or none does. Realtime notifications are already deferred to commit by
-	* `withTransaction`, so a batch does not flood subscribers mid-flight.
-	*/
-	async saveMany(props) {
-		return this.withTransaction((delegate) => delegate.saveMany(props));
-	}
-	async delete(props) {
-		return this.withTransaction((delegate) => delegate.delete(props));
+		await this.dataService.delete(targetPath, row.id, resolvedCollection?.databaseId);
+		if (globalCallbacks?.afterDelete || callbacks?.afterDelete || propertyCallbacks?.afterDelete) {
+			if (globalCallbacks?.afterDelete) await globalCallbacks.afterDelete({
+				collection: resolvedCollection,
+				path: targetPath,
+				id: row.id,
+				row: targetRow,
+				context: contextForCallback
+			});
+			if (callbacks?.afterDelete) await callbacks.afterDelete({
+				collection: resolvedCollection,
+				path: targetPath,
+				id: row.id,
+				row: targetRow,
+				context: contextForCallback
+			});
+			if (propertyCallbacks?.afterDelete) await propertyCallbacks.afterDelete({
+				collection: resolvedCollection,
+				path: targetPath,
+				id: row.id,
+				row: targetRow,
+				context: contextForCallback
+			});
+		}
+		if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
+			tableName: targetPath,
+			id: row.id.toString(),
+			action: "delete",
+			values: row.values ?? {},
+			updatedBy: this.user?.uid
+		});
+		if (this._deferNotifications) this._pendingNotifications.push({
+			path: targetPath,
+			id: row.id.toString(),
+			row: null,
+			databaseId: resolvedCollection?.databaseId
+		});
+		else await this.realtimeService.notifyUpdate(targetPath, row.id.toString(), null, resolvedCollection?.databaseId);
 	}
 	async deleteAll(path) {
-		return this.withTransaction((delegate) => delegate.deleteAll(path));
+		await this.dataService.deleteAll(path);
+		await this.realtimeService.notifyUpdate(path, "*", null);
 	}
 	async checkUniqueField(path, name, value, id, collection) {
-		return this.withTransaction((delegate) => delegate.checkUniqueField(path, name, value, id, collection), { accessMode: "read only" });
-	}
-	async count(props) {
-		return this.withTransaction((delegate) => delegate.count(props), { accessMode: "read only" });
-	}
-};
-//#endregion
-//#region src/databasePoolManager.ts
-var DatabasePoolManager = class {
-	pools = /* @__PURE__ */ new Map();
-	drizzleInstances = /* @__PURE__ */ new Map();
-	defaultDatabaseName;
-	rootConnectionString;
-	constructor(adminConnectionString) {
-		this.rootConnectionString = adminConnectionString;
-		try {
-			const url = new URL(adminConnectionString);
-			this.defaultDatabaseName = url.pathname.slice(1);
-		} catch (e) {
-			throw new Error(`Invalid adminConnectionString provided: ${e}`);
-		}
-	}
-	getDrizzle(databaseName) {
-		const existing = this.drizzleInstances.get(databaseName);
-		if (existing) return existing;
-		const db = drizzle(this.getPool(databaseName));
-		this.drizzleInstances.set(databaseName, db);
-		return db;
+		return this.dataService.checkUniqueField(path, name, value, id, collection?.databaseId);
 	}
-	getPool(databaseName) {
-		if (this.pools.has(databaseName)) return this.pools.get(databaseName);
-		const url = new URL(this.rootConnectionString);
-		url.pathname = `/${databaseName}`;
-		const pool = new Pool({
-			connectionString: pinSearchPath(url.toString()),
-			max: 10,
-			idleTimeoutMillis: 1e4,
-			allowExitOnIdle: true
-		});
-		pool.on("error", (err) => {
-			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
+	async count({ path, collection, filter, logical, searchString, vectorSearch }) {
+		return this.dataService.count(path, {
+			filter,
+			logical,
+			searchString,
+			vectorSearch
 		});
-		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
-		this.pools.set(databaseName, pool);
-		return pool;
 	}
-	/**
-	* Disconnect and remove the pool for a specific database.
-	* Required before `CREATE DATABASE ... TEMPLATE` or `DROP DATABASE`,
-	* which need exclusive access to the target database.
-	*/
-	async disconnectDatabase(databaseName) {
-		const pool = this.pools.get(databaseName);
-		if (pool) {
-			await pool.end();
-			this.pools.delete(databaseName);
-			this.drizzleInstances.delete(databaseName);
-		}
+	getTargetDb(databaseName) {
+		if (!databaseName || databaseName === this.poolManager?.defaultDatabaseName) return this.db;
+		if (!this.poolManager) throw new Error("Cross-database execution requires adminConnectionString to be configured in the backend.");
+		return this.poolManager.getDrizzle(databaseName);
 	}
-	/** Check if a pool exists for a given database name. */
-	hasPool(databaseName) {
-		return this.pools.has(databaseName);
+	async executeSql(sqlText, options) {
+		if (!options?.database && !options?.role) return this.dataService.executeSql(sqlText, options?.params);
+		const targetDb = this.getTargetDb(options?.database);
+		try {
+			let needsRoleSwitch = false;
+			if (options?.role && process.env.DISABLE_DB_ROLE_SWITCHING !== "true" && !this._roleSwitchingDisabled) try {
+				const currentRole = ((await targetDb.execute(sql.raw("SELECT current_user AS role"))).rows?.[0])?.role;
+				needsRoleSwitch = !!currentRole && currentRole !== options.role;
+			} catch {
+				needsRoleSwitch = true;
+			}
+			if (needsRoleSwitch && options?.role) {
+				const safeRole = options.role.replace(/"/g, "\"\"");
+				try {
+					return await targetDb.transaction(async (tx) => {
+						await tx.execute(sql.raw(`SET LOCAL ROLE "${safeRole}"`));
+						let result;
+						if (options?.params && options.params.length > 0) {
+							const parts = sqlText.split(/\$(\d+)/);
+							const chunks = [];
+							for (let i = 0; i < parts.length; i++) if (i % 2 === 0) {
+								if (parts[i].length > 0) chunks.push(sql.raw(parts[i]));
+							} else chunks.push(sql.param(options.params[Number(parts[i]) - 1]));
+							result = await tx.execute(sql.join(chunks, sql.raw("")));
+						} else result = await tx.execute(sql.raw(sqlText));
+						return result.rows;
+					});
+				} catch (roleError) {
+					if (isRoleSwitchingPermissionError(roleError)) {
+						logger.warn(`[PostgresBackendDriver] SET LOCAL ROLE "${safeRole}" failed — the connection user lacks permission. Falling back to executing without role switching. To suppress this warning, set DISABLE_DB_ROLE_SWITCHING=true in your .env file.`);
+						this._roleSwitchingDisabled = true;
+					} else throw roleError;
+				}
+			}
+			let result;
+			if (options?.params && options.params.length > 0) {
+				const parts = sqlText.split(/\$(\d+)/);
+				const chunks = [];
+				for (let i = 0; i < parts.length; i++) if (i % 2 === 0) {
+					if (parts[i].length > 0) chunks.push(sql.raw(parts[i]));
+				} else chunks.push(sql.param(options.params[Number(parts[i]) - 1]));
+				result = await targetDb.execute(sql.join(chunks, sql.raw("")));
+			} else result = await targetDb.execute(sql.raw(sqlText));
+			return result.rows;
+		} catch (error) {
+			const msg = error instanceof Error ? error.message : String(error);
+			if (msg.includes("pg_hba.conf") || msg.includes("no encryption") || msg.includes("connection refused")) {
+				const dbName = options?.database || "unknown";
+				throw new Error(`Cannot connect to database "${dbName}": the server rejected the connection. This database may require SSL or is not accessible from this host.`);
+			}
+			throw error;
+		}
 	}
-	async shutdown() {
-		const promises = [];
-		for (const [dbName, pool] of this.pools.entries()) {
-			logger.info(`[DatabasePoolManager] Shutting down pool for ${dbName}`);
-			promises.push(pool.end());
+	async fetchAvailableDatabases() {
+		const databases = (await this.executeSql(`SELECT datname FROM pg_database 
+             WHERE datistemplate = false 
+             AND datname NOT IN ('postgres', 'cloudsqladmin', '_cloudsqladmin')
+             ORDER BY datname;`)).map((r) => r.datname);
+		const currentDb = this.poolManager?.defaultDatabaseName;
+		if (currentDb && !databases.includes(currentDb)) databases.unshift(currentDb);
+		else if (currentDb) {
+			const idx = databases.indexOf(currentDb);
+			if (idx > 0) {
+				databases.splice(idx, 1);
+				databases.unshift(currentDb);
+			}
 		}
-		await Promise.all(promises);
-		this.pools.clear();
-		this.drizzleInstances.clear();
+		return databases;
+	}
+	async fetchAvailableRoles() {
+		return (await this.executeSql("SELECT rolname FROM pg_roles WHERE pg_has_role(current_user, rolname, 'member') ORDER BY rolname;")).map((r) => r.rolname);
 	}
-};
-//#endregion
-//#region src/schema/auth-schema.ts
-/**
-* Factory function to dynamically create the auth tables bound to the specified schema names.
-*
-* This module builds queries; it does not create tables. `ensureAuthTablesExist`
-* owns the DDL, which makes everything here a *claim* about a database it cannot
-* enforce — and the claims drifted. Every column below was declared
-* `varchar(n)` while the DDL created it as `TEXT`: `user_agent` as varchar(500),
-* `ip_address` as varchar(45), `secret_encrypted` as varchar(500), every
-* `token_hash` as varchar(255). None of it was true of any database this
-* framework ever provisioned. Harmless at runtime — drizzle does not enforce a
-* length client-side, so the widths only ever misled the next reader — but a
-* schema module that describes columns that do not exist is worse than no
-* schema module. They are `text` here now because they are TEXT there.
-*/
-function createAuthSchema(usersSchemaName = "rebase") {
-	const usersSchema = usersSchemaName === "public" ? null : pgSchema(usersSchemaName);
-	const tableCreator = usersSchema ? usersSchema.table.bind(usersSchema) : pgTable;
-	/**
-	* Users table - stores both email/password and OAuth users
-	*/
-	const users = tableCreator("users", {
-		id: uuid("id").defaultRandom().primaryKey(),
-		email: text("email").notNull().unique(),
-		passwordHash: text("password_hash"),
-		displayName: text("display_name"),
-		photoUrl: text("photo_url"),
-		emailVerified: boolean("email_verified").default(false).notNull(),
-		emailVerificationToken: text("email_verification_token"),
-		emailVerificationSentAt: timestamp("email_verification_sent_at"),
-		isAnonymous: boolean("is_anonymous").default(false).notNull(),
-		roles: text("roles").array().default([]).notNull(),
-		metadata: jsonb("metadata").$type().default({}).notNull(),
-		/**
-		* Sessions that began before this instant are dead, whatever tokens
-		* they still hold. Password resets and admin revocations stamp it.
-		*
-		* Deleting the user's refresh-token rows (which we also do) is not
-		* sufficient on its own: a request already in flight can insert a
-		* freshly rotated row microseconds after the delete and survive it.
-		* This timestamp cannot be outrun that way — it is checked against
-		* `refresh_tokens.session_started_at`, which rotation carries forward.
-		*/
-		tokensValidAfter: timestamp("tokens_valid_after"),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at").defaultNow().notNull()
-	});
 	/**
-	* Refresh tokens for long-lived sessions.
+	* Application-level roles actually in use in this project.
 	*
-	* A row is one token, not one device. Every token minted from the same
-	* sign-in shares a `sessionId`, and rotation ADDS a row rather than
-	* replacing one: the superseded token stays on file, flagged `revoked`
-	* with a `rotatedAt` stamp. That record is what lets the refresh endpoint
-	* tell a client replaying a token it never got an answer for (a response
-	* lost to a redeploy, a second tab racing on boot) apart from a stranger
-	* presenting a token that was never issued. Deleting the old row on sight
-	* — the previous behaviour — made those two cases indistinguishable, and
-	* the legitimate one is overwhelmingly the common one.
+	* Distinct from {@link fetchAvailableRoles}, which returns native
+	* PostgreSQL roles from `pg_roles` (`postgres`, `rebase_user`, …). Those
+	* are the roles the SQL editor can `SET ROLE` to. *These* are the strings
+	* held in the users table's `roles` column, injected per-transaction as
+	* `rebase.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
+	* into a `SecurityRule.roles` field produces a condition no user can ever
+	* satisfy, so the two must not be conflated.
 	*
-	* There is deliberately NO unique constraint on (uid, user_agent,
-	* ip_address). Keying a session on the IP meant one row per "device",
-	* so a second browser profile behind the same NAT silently evicted the
-	* first, and a phone changing networks orphaned a row on every hop.
-	* User agent and IP are descriptive metadata for the sessions list;
-	* `sessionId` is the identity.
+	* Roles have no registry table — they were migrated out of
+	* `rebase.user_roles` onto an inline `roles TEXT[]` column — so the live
+	* set is derived from what is assigned. A role that is declared in a policy
+	* but held by nobody yet cannot be discovered here; callers that need it
+	* should union in the roles they already know about.
 	*/
-	const refreshTokens = tableCreator("refresh_tokens", {
-		id: uuid("id").defaultRandom().primaryKey(),
-		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-		sessionId: uuid("session_id").defaultRandom().notNull(),
-		tokenHash: text("token_hash").notNull().unique(),
-		expiresAt: timestamp("expires_at").notNull(),
-		revoked: boolean("revoked").default(false).notNull(),
-		rotatedAt: timestamp("rotated_at"),
-		/**
-		* When the sign-in this token descends from happened — carried across
-		* every rotation, unlike `createdAt`. `users.tokensValidAfter` is
-		* compared against this, so a revocation cannot be outrun by a token
-		* that rotates immediately after it.
-		*/
-		sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
-		/**
-		* The assurance level the sign-in was established at — `aal2` only
-		* where a second factor was actually presented. Carried across
-		* rotations, because refresh is not a new authentication and has
-		* nothing else to read the level from.
-		*/
-		aal: text("aal"),
-		userAgent: text("user_agent"),
-		ipAddress: text("ip_address"),
-		createdAt: timestamp("created_at").defaultNow().notNull()
-	}, (table) => ({ sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId) }));
+	async fetchApplicationRoles() {
+		const located = await this.executeSql(`
+            SELECT table_schema, table_name
+            FROM information_schema.columns
+            WHERE column_name = 'roles'
+              AND data_type = 'ARRAY'
+              AND table_name = 'users'
+              AND table_schema NOT IN ('information_schema', 'pg_catalog')
+            ORDER BY (table_schema = 'rebase') DESC, table_schema
+            LIMIT 1;
+        `);
+		if (located.length === 0) return [];
+		const schema = located[0].table_schema;
+		const table = located[0].table_name;
+		const qualified = `"${schema.replace(/"/g, "\"\"")}"."${table.replace(/"/g, "\"\"")}"`;
+		return (await this.executeSql(`
+            SELECT DISTINCT unnest(roles) AS role
+            FROM ${qualified}
+            WHERE roles IS NOT NULL
+            ORDER BY role;
+        `)).map((r) => r.role).filter((r) => typeof r === "string" && r.length > 0);
+	}
+	async fetchCurrentDatabase() {
+		return this.poolManager?.defaultDatabaseName;
+	}
 	/**
-	* Password reset tokens for forgot password flow
+	* Fetch public tables that are not yet mapped to a collection.
+	* Excludes internal tables (_rebase_*, _auth_*, auth tables, etc.)
+	* and junction/connection tables used for many-to-many relations.
 	*/
-	const passwordResetTokens = tableCreator("password_reset_tokens", {
-		id: uuid("id").defaultRandom().primaryKey(),
-		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-		tokenHash: text("token_hash").notNull().unique(),
-		expiresAt: timestamp("expires_at").notNull(),
-		usedAt: timestamp("used_at"),
-		createdAt: timestamp("created_at").defaultNow().notNull()
-	});
+	async fetchUnmappedTables(mappedPaths) {
+		const allTables = (await this.executeSql(`
+            SELECT table_name
+            FROM information_schema.tables
+            WHERE table_schema = 'public'
+              AND table_type = 'BASE TABLE'
+            ORDER BY table_name;
+        `)).map((r) => r.table_name).filter((name) => classifyTable(name, "public") !== "rebase-internal");
+		let junctionTables = /* @__PURE__ */ new Set();
+		try {
+			junctionTables = await detectJunctionTables(this.executeSql.bind(this));
+		} catch (e) {
+			logger.warn("Could not detect junction tables", { error: e });
+		}
+		const filteredTables = allTables.filter((name) => !junctionTables.has(name));
+		if (!mappedPaths || mappedPaths.length === 0) return filteredTables;
+		const mappedSet = new Set(mappedPaths.map((p) => p.toLowerCase()));
+		return filteredTables.filter((name) => !mappedSet.has(name.toLowerCase()));
+	}
 	/**
-	* App config - key/value store for custom settings
+	* Fetch metadata for a given table from information_schema (columns, policies, constraints).
 	*/
-	const appConfig = tableCreator("app_config", {
-		key: text("key").primaryKey(),
-		value: jsonb("value").notNull(),
-		updatedAt: timestamp("updated_at").defaultNow().notNull()
-	});
-	/**
-	* User identities - maps external OAuth profiles back to local users
-	*/
-	const userIdentities = tableCreator("user_identities", {
-		id: uuid("id").defaultRandom().primaryKey(),
-		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-		provider: text("provider").notNull(),
-		providerId: text("provider_id").notNull(),
-		profileData: jsonb("profile_data"),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at").defaultNow().notNull()
-	}, (table) => ({ uniqueProviderId: unique("unique_provider_id").on(table.provider, table.providerId) }));
-	/**
-	* MFA factors table - stores enrolled MFA methods
-	*/
-	const mfaFactors = tableCreator("mfa_factors", {
-		id: uuid("id").defaultRandom().primaryKey(),
-		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-		factorType: text("factor_type").notNull(),
-		secretEncrypted: text("secret_encrypted").notNull(),
-		friendlyName: text("friendly_name"),
-		verified: boolean("verified").default(false).notNull(),
-		/**
-		* The highest TOTP time step ever accepted for this factor. RFC 6238
-		* §5.2 forbids accepting an OTP twice, and the ±1 step window that
-		* exists for clock drift is also a 90-second replay window: without
-		* this, one observed code buys a fresh session for a minute and a half.
-		*/
-		lastUsedCounter: bigint("last_used_counter", { mode: "number" }),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at").defaultNow().notNull()
-	});
-	return {
-		usersSchema,
-		users,
-		refreshTokens,
-		passwordResetTokens,
-		appConfig,
-		userIdentities,
-		mfaFactors,
-		mfaChallenges: tableCreator("mfa_challenges", {
-			id: uuid("id").defaultRandom().primaryKey(),
-			factorId: uuid("factor_id").notNull().references(() => mfaFactors.id, { onDelete: "cascade" }),
-			createdAt: timestamp("created_at").defaultNow().notNull(),
-			verifiedAt: timestamp("verified_at"),
-			ipAddress: text("ip_address"),
-			/** Failed guesses recorded against this challenge; bounded by the route. */
-			attempts: integer("attempts").default(0).notNull(),
-			expiresAt: timestamp("expires_at").notNull()
-		}),
-		recoveryCodes: tableCreator("recovery_codes", {
-			id: uuid("id").defaultRandom().primaryKey(),
-			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-			codeHash: text("code_hash").notNull(),
-			usedAt: timestamp("used_at"),
-			createdAt: timestamp("created_at").defaultNow().notNull()
-		}),
-		magicLinkTokens: tableCreator("magic_link_tokens", {
-			id: uuid("id").defaultRandom().primaryKey(),
-			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-			tokenHash: text("token_hash").notNull().unique(),
-			expiresAt: timestamp("expires_at").notNull(),
-			usedAt: timestamp("used_at"),
-			createdAt: timestamp("created_at").defaultNow().notNull()
-		})
-	};
-}
-var defaultAuthSchema = createAuthSchema("rebase");
-var usersSchema = defaultAuthSchema.usersSchema;
-var users = defaultAuthSchema.users;
-var refreshTokens = defaultAuthSchema.refreshTokens;
-var passwordResetTokens = defaultAuthSchema.passwordResetTokens;
-var appConfig = defaultAuthSchema.appConfig;
-var userIdentities = defaultAuthSchema.userIdentities;
-var mfaFactors = defaultAuthSchema.mfaFactors;
-var mfaChallenges = defaultAuthSchema.mfaChallenges;
-var recoveryCodes = defaultAuthSchema.recoveryCodes;
-var magicLinkTokens = defaultAuthSchema.magicLinkTokens;
-var usersRelations = relations(users, ({ many }) => ({
-	refreshTokens: many(refreshTokens),
-	passwordResetTokens: many(passwordResetTokens),
-	userIdentities: many(userIdentities),
-	mfaFactors: many(mfaFactors),
-	recoveryCodes: many(recoveryCodes),
-	magicLinkTokens: many(magicLinkTokens)
-}));
-var refreshTokensRelations = relations(refreshTokens, ({ one }) => ({ user: one(users, {
-	fields: [refreshTokens.uid],
-	references: [users.id]
-}) }));
-var passwordResetTokensRelations = relations(passwordResetTokens, ({ one }) => ({ user: one(users, {
-	fields: [passwordResetTokens.uid],
-	references: [users.id]
-}) }));
-var userIdentitiesRelations = relations(userIdentities, ({ one }) => ({ user: one(users, {
-	fields: [userIdentities.uid],
-	references: [users.id]
-}) }));
-var mfaFactorsRelations = relations(mfaFactors, ({ one, many }) => ({
-	user: one(users, {
-		fields: [mfaFactors.uid],
-		references: [users.id]
-	}),
-	challenges: many(mfaChallenges)
-}));
-var mfaChallengesRelations = relations(mfaChallenges, ({ one }) => ({ factor: one(mfaFactors, {
-	fields: [mfaChallenges.factorId],
-	references: [mfaFactors.id]
-}) }));
-var recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({ user: one(users, {
-	fields: [recoveryCodes.uid],
-	references: [users.id]
-}) }));
-var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user: one(users, {
-	fields: [magicLinkTokens.uid],
-	references: [users.id]
-}) }));
-//#endregion
-//#region src/schema/generate-drizzle-schema-logic.ts
-/**
-* Resolve the SQL column name for a property.
-* Uses the explicit `columnName` when set (e.g. from introspection),
-* falling back to `toSnakeCase(propName)` for manually-authored collections.
-*/
-var JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
-/**
-* A string literal for the generated schema file.
-*
-* Column names, table names and enum values are all written into this file as
-* literals, and none of them is constrained to be quote-free: a Postgres
-* identifier only has to be quoted, and `O'Brien` is an ordinary enum value.
-* Interpolating them raw ended the literal early — for enum values, inside
-* single quotes, where an apostrophe is not an edge case.
-*/
-var quote$1 = (value) => JSON.stringify(value);
-/** An object key: verbatim when it is an identifier, quoted otherwise. */
-var propKey = (name) => JS_IDENTIFIER.test(name) ? name : quote$1(name);
-/**
-* A property access on a generated table variable.
-*
-* `users.full name` is not an expression; `users["full name"]` is, and Drizzle
-* treats the two identically.
-*/
-var member = (object, key) => JS_IDENTIFIER.test(key) ? `${object}.${key}` : `${object}[${quote$1(key)}]`;
-var resolveColumnName = (propName, prop) => {
-	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
-	return toSnakeCase(propName);
-};
-var getPrimaryKeyProp = (collection) => {
-	if (collection.properties) {
-		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
-		if (idPropEntry) {
-			const prop = idPropEntry[1];
-			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
-			return {
-				name: idPropEntry[0],
-				type: prop.type === "number" ? "number" : "string",
-				isUuid
-			};
-		}
-	}
-	const idProp = collection.properties?.["id"];
-	if (idProp?.type === "number") return {
-		name: "id",
-		type: "number",
-		isUuid: false
-	};
-	return {
-		name: "id",
-		type: "string",
-		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
-	};
-};
-/**
-* Given a raw DB column name (e.g. "client_id"), the Drizzle property key that
-* maps to it.
-*
-* One line, because the rule is shared: the Drizzle object key is the wire
-* name, and {@link fieldKeyForColumn} is the one definition of what a column is
-* named on the wire. This used to be a private copy that fell back to the
-* column verbatim, which is how a derived foreign key ended up served as
-* `author_id` beside a hand-authored `displayName`.
-*/
-var resolvePropertyKeyForColumn = (collection, column) => fieldKeyForColumn(collection, column);
-var isNumericId = (collection) => {
-	return getPrimaryKeyProp(collection).type === "number";
-};
-var getPrimaryKeyName = (collection) => {
-	return getPrimaryKeyProp(collection).name;
-};
-var isIdProperty = (propName, prop, collection) => {
-	if ("isId" in prop && Boolean(prop.isId)) return true;
-	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
-};
-/**
-* The Drizzle column declaration a property compiles to, or `null` when the
-* property puts no column on *this* table (an inverse relation, whose column
-* lives on the target). Exported so it can be checked against its DDL twin
-* `getSqlColumnType` directly — the two disagreeing is what left `geopoint`
-* with a database column and no Drizzle key.
-*/
-var getDrizzleColumn = (propName, prop, collection, collections) => {
-	const colName = resolveColumnName(propName, prop);
-	let columnDefinition;
-	switch (prop.type) {
-		case "string": {
-			const stringProp = prop;
-			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}(${quote$1(colName)})`;
-			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
-			else if (stringProp.columnType === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
-			else if (stringProp.columnType === "char") columnDefinition = `char(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
-			else if (stringProp.columnType === "varchar") columnDefinition = `varchar(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
-			else columnDefinition = `text(${quote$1(colName)})`;
-			if (isIdProperty(propName, prop, collection)) columnDefinition += ".primaryKey()";
-			if ("isId" in stringProp && stringProp.isId !== "manual" && stringProp.isId !== true) {
-				if (stringProp.isId === "uuid") columnDefinition += ".defaultRandom()";
-				else if (stringProp.isId === "cuid") columnDefinition += ".default(sql`cuid()`)";
-				else if (typeof stringProp.isId === "string") {
-					const sqlContent = stringProp.isId.startsWith("sql`") && stringProp.isId.endsWith("`") ? stringProp.isId.substring(4, stringProp.isId.length - 1) : stringProp.isId;
-					columnDefinition += `.default(sql\`${sqlContent}\`)`;
-				}
-			}
-			if (stringProp.validation?.unique) columnDefinition += ".unique()";
-			break;
-		}
-		case "number": {
-			const numProp = prop;
-			const isId = isIdProperty(propName, prop, collection);
-			let baseType = numProp.validation?.integer || isId ? `integer(${quote$1(colName)})` : `numeric(${quote$1(colName)})`;
-			if (numProp.columnType) if (numProp.columnType === "double precision") baseType = `doublePrecision(${quote$1(colName)})`;
-			else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") baseType = `${numProp.columnType}(${quote$1(colName)}, { mode: "number" })`;
-			else baseType = `${numProp.columnType}(${quote$1(colName)})`;
-			if ("isId" in numProp && numProp.isId === "increment") columnDefinition = `${baseType}.generatedByDefaultAsIdentity()`;
-			else if ("isId" in numProp && typeof numProp.isId === "string" && numProp.isId !== "manual") {
-				columnDefinition = baseType;
-				const sqlContent = numProp.isId.startsWith("sql`") && numProp.isId.endsWith("`") ? numProp.isId.substring(4, numProp.isId.length - 1) : numProp.isId;
-				columnDefinition += `.default(sql\`${sqlContent}\`)`;
-			} else columnDefinition = baseType;
-			if (isId) columnDefinition += ".primaryKey()";
-			if (numProp.validation?.unique) columnDefinition += ".unique()";
-			break;
-		}
-		case "boolean":
-			columnDefinition = `boolean(${quote$1(colName)})`;
-			break;
-		case "date": {
-			const dateProp = prop;
-			if (dateProp.columnType === "date") columnDefinition = `date(${quote$1(colName)}, { mode: 'string' })`;
-			else if (dateProp.columnType === "time") columnDefinition = `time(${quote$1(colName)})`;
-			else columnDefinition = `timestamp(${quote$1(colName)}, { withTimezone: true, mode: 'string' })`;
-			if (dateProp.autoValue === "on_create" || dateProp.autoValue === "on_update") columnDefinition += ".default(sql`now()`)";
-			break;
-		}
-		case "map":
-			if (prop.columnType === "json") columnDefinition = `json(${quote$1(colName)})`;
-			else columnDefinition = `jsonb(${quote$1(colName)})`;
-			break;
-		case "geopoint":
-			columnDefinition = `jsonb(${quote$1(colName)})`;
-			break;
-		case "array": {
-			const arrayProp = prop;
-			let colType = arrayProp.columnType;
-			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
-				const ofProp = arrayProp.of;
-				if (ofProp.type === "string") colType = "text[]";
-				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
-				else if (ofProp.type === "boolean") colType = "boolean[]";
-			}
-			if (colType === "json") columnDefinition = `json(${quote$1(colName)})`;
-			else if (colType === "text[]") columnDefinition = `text(${quote$1(colName)}).array()`;
-			else if (colType === "integer[]") columnDefinition = `integer(${quote$1(colName)}).array()`;
-			else if (colType === "boolean[]") columnDefinition = `boolean(${quote$1(colName)}).array()`;
-			else if (colType === "numeric[]") columnDefinition = `numeric(${quote$1(colName)}).array()`;
-			else columnDefinition = `jsonb(${quote$1(colName)})`;
-			break;
-		}
-		case "vector": {
-			const vp = prop;
-			columnDefinition = `vector(${quote$1(colName)}, { dimensions: ${vp.dimensions} })`;
-			break;
-		}
-		case "binary":
-			columnDefinition = `customType({ dataType() { return 'bytea'; } })(${quote$1(colName)})`;
-			break;
-		case "relation": {
-			const refProp = prop;
-			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
-			if (!relation || relation.kind !== "belongsTo") return null;
-			const fkFieldKey = fieldKeyForColumn(collection, relation.localKey);
-			if (collection.properties[fkFieldKey] && propName !== fkFieldKey) return null;
-			let targetCollection;
-			try {
-				targetCollection = relation.target();
-			} catch {
-				return null;
-			}
-			const fkColumnName = relation.localKey;
-			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
-			const pkProp = getPrimaryKeyProp(targetCollection);
-			const targetIdField = pkProp.name;
-			const baseColumn = pkProp.type === "number" ? `integer("${fkColumnName}")` : pkProp.isUuid ? `uuid("${fkColumnName}")` : `text("${fkColumnName}")`;
-			const onUpdate = relation.onUpdate ? `onUpdate: "${relation.onUpdate}"` : "";
-			const required = prop.validation?.required;
-			const refOptionsParts = [onUpdate, `onDelete: \"${relation.onDelete ?? (required ? "cascade" : "set null")}\"`].filter(Boolean);
-			const refOptions = refOptionsParts.length > 0 ? `{ ${refOptionsParts.join(", ")} }` : "";
-			let columnDef = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}${refOptions ? `, ${refOptions}` : ""})`;
-			if (required) columnDef += ".notNull()";
-			return `    ${propKey(fkFieldKey)}: ${columnDef}`;
+	async fetchTableMetadata(tableName) {
+		const safeName = tableName.replace(/[^a-zA-Z0-9_]/g, "");
+		const columns = (await this.db.execute(sql`
+            SELECT column_name, data_type, udt_name, is_nullable, column_default, character_maximum_length
+            FROM information_schema.columns
+            WHERE table_schema = 'public'
+              AND table_name = ${safeName}
+            ORDER BY ordinal_position
+        `)).rows;
+		const enumColumns = columns.filter((c) => c.data_type === "USER-DEFINED");
+		if (enumColumns.length > 0) for (const col of enumColumns) try {
+			col.enum_values = (await this.db.execute(sql`
+                        SELECT e.enumlabel
+                        FROM pg_type t
+                        JOIN pg_enum e ON t.oid = e.enumtypid
+                        WHERE t.typname = ${col.udt_name}
+                        ORDER BY e.enumsortorder
+                    `)).rows.map((e) => e.enumlabel);
+		} catch {
+			col.enum_values = [];
 		}
-		case "reference": {
-			const refProp = prop;
-			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName$1(c) === refProp.path);
-			if (!targetCollection) {
-				columnDefinition = `text(${quote$1(colName)})`;
-				break;
+		return {
+			columns,
+			foreignKeys: (await this.db.execute(sql`
+            SELECT
+                kcu.column_name as column_name,
+                ccu.table_name AS foreign_table_name,
+                ccu.column_name AS foreign_column_name
+            FROM 
+                information_schema.table_constraints AS tc 
+                JOIN information_schema.key_column_usage AS kcu
+                  ON tc.constraint_name = kcu.constraint_name
+                  AND tc.table_schema = kcu.table_schema
+                JOIN information_schema.constraint_column_usage AS ccu
+                  ON ccu.constraint_name = tc.constraint_name
+                  AND ccu.table_schema = tc.table_schema
+            WHERE tc.constraint_type = 'FOREIGN KEY' AND tc.table_name = ${safeName};
+        `)).rows,
+			junctions: (await this.db.execute(sql`
+            SELECT 
+                tc1.table_name as junction_table_name,
+                kcu1.column_name as source_column_name,
+                ccu2.table_name as target_table_name,
+                kcu2.column_name as target_column_name
+            FROM information_schema.table_constraints tc1
+            JOIN information_schema.key_column_usage kcu1 ON tc1.constraint_name = kcu1.constraint_name
+            JOIN information_schema.constraint_column_usage ccu1 ON ccu1.constraint_name = tc1.constraint_name
+            JOIN information_schema.table_constraints tc2 ON tc1.table_name = tc2.table_name AND tc2.constraint_type = 'FOREIGN KEY'
+            JOIN information_schema.key_column_usage kcu2 ON tc2.constraint_name = kcu2.constraint_name
+            JOIN information_schema.constraint_column_usage ccu2 ON ccu2.constraint_name = tc2.constraint_name
+            WHERE tc1.constraint_type = 'FOREIGN KEY' 
+              AND ccu1.table_name = ${safeName}
+              AND ccu2.table_name != ${safeName};
+        `)).rows,
+			policies: (await this.db.execute(sql`
+            SELECT 
+                polname as policy_name, 
+                polcmd as cmd, 
+                polroles::regrole[]::text[] as roles, 
+                pg_get_expr(polqual, polrelid) as qual, 
+                pg_get_expr(polwithcheck, polrelid) as with_check
+            FROM pg_policy
+            WHERE polrelid = (SELECT oid FROM pg_class WHERE relname = ${safeName} AND relnamespace = 'public'::regnamespace);
+        `)).rows
+		};
+	}
+	generateSubscriptionId() {
+		return `sub_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
+	}
+	/**
+	* Create a new delegate instance with authenticated context.
+	* Starts a transaction and sets the current_user_id and current_user_roles
+	* configuration parameters for PostgreSQL Row Level Security.
+	*/
+	async withAuth(user) {
+		return new AuthenticatedPostgresBackendDriver(this, user);
+	}
+};
+var AuthenticatedPostgresBackendDriver = class {
+	delegate;
+	key = "postgres";
+	initialised = true;
+	user;
+	data;
+	constructor(delegate, user) {
+		this.delegate = delegate;
+		this.user = user;
+		this.data = buildSdkData(this);
+		this.admin = delegate.admin;
+	}
+	/**
+	* Typed admin capabilities — delegates to the base driver.
+	*/
+	admin;
+	get restFetchService() {
+		return {
+			fetchCollectionForRest: async (collectionPath, options, include) => {
+				return this.withTransaction(async (delegate) => {
+					return delegate.restFetchService.fetchCollectionForRest(collectionPath, options, include);
+				}, { accessMode: "read only" });
+			},
+			fetchOneForRest: async (collectionPath, id, include, databaseId) => {
+				return this.withTransaction(async (delegate) => {
+					return delegate.restFetchService.fetchOneForRest(collectionPath, id, include, databaseId);
+				}, { accessMode: "read only" });
 			}
-			const pkProp = getPrimaryKeyProp(targetCollection);
-			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
-			const targetIdField = pkProp.name;
-			const baseColumn = pkProp.type === "number" ? `integer(${quote$1(colName)})` : pkProp.isUuid ? `uuid(${quote$1(colName)})` : `text(${quote$1(colName)})`;
-			const required = prop.validation?.required;
-			const refOptions = `{ onDelete: "${required ? "cascade" : "set null"}" }`;
-			columnDefinition = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}, ${refOptions})`;
-			if (required) columnDefinition += ".notNull()";
-			return `    ${propKey(propName)}: ${columnDefinition}`;
+		};
+	}
+	async withTransaction(operation, options) {
+		const pendingNotifications = [];
+		const result = await this.delegate.db.transaction(async (tx) => {
+			let uid = this.user?.uid;
+			if (!uid) {
+				logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
+				uid = "anonymous";
+			}
+			const userRoles = this.user?.roles ?? [];
+			if (!this.user?.roles) logger.warn("[DataDriver] User roles are missing for authenticated delegate. Using empty array. User object", { detail: this.user });
+			await applyAuthContext(tx, {
+				uid,
+				roles: userRoles
+			}, this.delegate.rlsUserRole);
+			const txEntityService = new DataService(tx, this.delegate.registry);
+			const txDelegate = new PostgresBackendDriver(tx, this.delegate.realtimeService, this.delegate.registry, this.user, this.delegate.poolManager, this.delegate.historyService);
+			txDelegate.dataService = txEntityService;
+			txDelegate._deferNotifications = true;
+			txDelegate._pendingNotifications = pendingNotifications;
+			txDelegate.client = this.delegate.client;
+			return await operation(txDelegate);
+		}, options);
+		for (const notification of pendingNotifications) try {
+			await this.delegate.realtimeService.notifyUpdate(notification.path, notification.id, notification.row, notification.databaseId);
+		} catch (e) {
+			logger.error("[DataDriver] Error flushing deferred notification", { error: e });
 		}
-		default: throw new Error(`No Postgres column mapping for property '${propName}' of type '${prop.type}' in collection '${collection.slug}'. Add a case to \`getDrizzleColumn\` (and to \`getSqlColumnType\`, which must agree).`);
+		return result;
 	}
-	if (prop.validation?.required) columnDefinition += ".notNull()";
-	return `    ${propKey(propName)}: ${columnDefinition}`;
-};
-/**
-* Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
-*
-* The clause is SQL being written into a TypeScript file, so it has to survive
-* being read back as a template literal. Three characters do not:
-*
-* - `` ` `` closes the template early, and the rest of the clause becomes code.
-* - `${` opens an interpolation — the file stops compiling, or worse, compiles
-*   against whatever identifier happens to be in scope.
-* - `\` is an escape, and Drizzle's `sql` tag reads the *cooked* strings, not
-*   `.raw`. So a policy written as `email ~ '^admin\.user@corp\.com$'` reaches
-*   the database as `^admin.user@corp.com$`, where every `\.` now matches any
-*   character. A `USING` clause is a security boundary and that one silently
-*   widened it — the SQL file emitted by the DDL generator kept the backslashes
-*   while this path dropped them, so the two disagreed about who could read the
-*   table.
-*
-* Escaping here rather than in the compiler: the clause is correct SQL, and it
-* is only this destination that has an opinion about backslashes.
-*/
-var wrapSql = (clause) => `sql\`${clause.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${")}\``;
-var generatePolicyCode = (collection, rule, index, resolveCollection) => {
-	const tableName = getTableName$1(collection);
-	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
-	const policyNames = getPolicyNamesForRule(rule, tableName);
-	return ops.map((op, opIdx) => {
-		return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
-	}).join("");
-};
-/**
-* Generates a single pgPolicy() call for one specific operation.
-*/
-var generateSinglePolicyCode = (collection, rule, operation, policyName, resolveCollection) => {
-	const mode = rule.mode ?? "permissive";
-	const needsUsing = operation !== "insert";
-	const needsWithCheck = operation !== "select" && operation !== "delete";
-	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
-	let usingClause = needsUsing && usingExpr ? wrapSql(policyToPostgres(usingExpr, collection, { resolveCollection })) : null;
-	let withCheckClause = needsWithCheck && withCheckExpr ? wrapSql(policyToPostgres(withCheckExpr, collection, { resolveCollection })) : null;
-	if (!usingClause && needsUsing) usingClause = "sql`false`";
-	if (!withCheckClause && needsWithCheck) withCheckClause = "sql`false`";
-	const parts = [];
-	parts.push(`as: "${mode}"`);
-	parts.push(`for: "${operation}"`);
-	const toRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
-	parts.push(`to: [${toRoles.map((r) => `"${r}"`).join(", ")}]`);
-	if (usingClause) parts.push(`using: ${usingClause}`);
-	if (withCheckClause) parts.push(`withCheck: ${withCheckClause}`);
-	return `    pgPolicy(${quote$1(policyName)}, { ${parts.join(", ")} }),\n`;
-};
-/**
-* Computes a deterministic shared relation name for Drizzle.
-*
-* Drizzle requires both sides of a relation (owning + inverse) to use the
-* exact same `relationName` string so it can pair them. Each collection
-* definition may use a different local `relationName`, so we need a canonical
-* form that both sides can independently compute.
-*
-* Strategy: `{owningTable}_{foreignKey}`
-*   - owning  side → `{thisTable}_{localKey}`           e.g. "jobs_company_id"
-*   - inverse side → `{targetTable}_{foreignKeyOnTarget}` e.g. "jobs_company_id"
-*
-* For M2M with junction tables the owning relation name is already shared via
-* the junction table wiring, so we keep it as-is.
-*
-* Falls back to the local relation name when the counterpart can't be resolved.
-*/
-var computeSharedRelationName = (rel, sourceCollection, _collections) => {
-	const fallback = rel.relationName ?? toSnakeCase(rel.target().slug);
-	if (rel.kind === "belongsTo") {
-		const normalisedKey = resolvePropertyKeyForColumn(sourceCollection, rel.localKey);
-		return `${getTableName$1(sourceCollection)}_${normalisedKey}`;
+	async fetchCollection(props) {
+		return this.withTransaction((delegate) => delegate.fetchCollection(props), { accessMode: "read only" });
+	}
+	/**
+	* Injects the authenticated user's context into the most recently
+	* registered realtime subscription so RLS-aware polling can apply.
+	*/
+	injectAuthContext(unsubscribe) {
+		const authContext = {
+			uid: this.user?.uid || "anonymous",
+			roles: this.user?.roles ?? []
+		};
+		const entries = Array.from(this.delegate.realtimeService.subscriptions.entries());
+		const lastSub = entries[entries.length - 1]?.[1];
+		if (lastSub && lastSub.clientId === "driver") lastSub.authContext = authContext;
+		return unsubscribe;
+	}
+	listenCollection(props) {
+		return this.injectAuthContext(this.delegate.listenCollection(props));
+	}
+	async fetchOne(props) {
+		return this.withTransaction((delegate) => delegate.fetchOne(props), { accessMode: "read only" });
+	}
+	listenOne(props) {
+		return this.injectAuthContext(this.delegate.listenOne(props));
+	}
+	async save(props) {
+		return this.withTransaction((delegate) => delegate.save(props));
+	}
+	/**
+	* One transaction for the whole batch, rather than one per row.
+	*
+	* This is the point of the method: `save` opens a transaction per call, so
+	* importing 10k rows through it means 10k transactions (and, over HTTP, 10k
+	* round trips). Here the RLS context is established once and every row lands
+	* or none does. Realtime notifications are already deferred to commit by
+	* `withTransaction`, so a batch does not flood subscribers mid-flight.
+	*/
+	async saveMany(props) {
+		return this.withTransaction((delegate) => delegate.saveMany(props));
+	}
+	async delete(props) {
+		return this.withTransaction((delegate) => delegate.delete(props));
 	}
-	if (rel.kind === "hasMany" || rel.kind === "hasOne") try {
-		const targetCollection = rel.target();
-		const normalisedFK = resolvePropertyKeyForColumn(targetCollection, rel.foreignKeyOnTarget);
-		return `${getTableName$1(targetCollection)}_${normalisedFK}`;
-	} catch {
-		return fallback;
+	async deleteAll(path) {
+		return this.withTransaction((delegate) => delegate.deleteAll(path));
+	}
+	async checkUniqueField(path, name, value, id, collection) {
+		return this.withTransaction((delegate) => delegate.checkUniqueField(path, name, value, id, collection), { accessMode: "read only" });
+	}
+	async count(props) {
+		return this.withTransaction((delegate) => delegate.count(props), { accessMode: "read only" });
 	}
-	return fallback;
 };
-var generateSchema = async (allCollections, stripPolicies = false) => {
-	const collections = sortCollectionsBySlug(relationalCollections(allCollections));
-	let schemaContent = "// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\n\n";
-	const hasUuid = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "string" && (p.autoValue === "uuid" || p.isId === "uuid")));
-	const hasVector = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "vector"));
-	const hasBinary = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "binary"));
-	const hasSearch = collections.some((c) => buildSearchColumnSpec(c) !== void 0);
-	const pgCoreImports = [
-		"primaryKey",
-		"pgTable",
-		"integer",
-		"varchar",
-		"text",
-		"char",
-		"boolean",
-		"timestamp",
-		"date",
-		"time",
-		"jsonb",
-		"json",
-		"pgEnum",
-		"numeric",
-		"real",
-		"doublePrecision",
-		"bigint",
-		"serial",
-		"bigserial",
-		"pgPolicy"
-	];
-	if (hasUuid) pgCoreImports.push("uuid");
-	if (hasVector) pgCoreImports.push("vector");
-	if (hasBinary || hasSearch) pgCoreImports.push("customType");
-	const uniqueSchemas = Array.from(new Set(collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)));
-	if (uniqueSchemas.length > 0) pgCoreImports.push("pgSchema");
-	schemaContent += `import { ${pgCoreImports.join(", ")} } from 'drizzle-orm/pg-core';\n`;
-	schemaContent += "import { relations as drizzleRelations, sql } from 'drizzle-orm';\n\n";
-	uniqueSchemas.forEach((schema) => {
-		schemaContent += `export const ${schema}Schema = pgSchema("${schema}");\n`;
-	});
-	if (uniqueSchemas.length > 0) schemaContent += "\n";
-	const exportedTableVars = [];
-	const exportedEnumVars = [];
-	const exportedRelationVars = [];
-	const allTablesToGenerate = /* @__PURE__ */ new Map();
-	collections.forEach((collection) => {
-		const collectionPath = getTableName$1(collection);
-		Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
-			if ("enum" in prop && (prop.type === "string" || prop.type === "number") && prop.enum) {
-				const enumVarName = getEnumVarName(collectionPath, propName);
-				const enumDbName = `${collectionPath}_${resolveColumnName(propName, prop)}`;
-				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
-				if (values.length > 0) {
-					schemaContent += `export const ${enumVarName} = pgEnum(${quote$1(enumDbName)}, [${values.map((v) => quote$1(v)).join(", ")}]);\n`;
-					if (!exportedEnumVars.includes(enumVarName)) exportedEnumVars.push(enumVarName);
-				}
-			}
-		});
-	});
-	schemaContent += "\n";
-	const junctionSpecs = resolveJunctionSpecs(collections);
-	for (const collection of collections) {
-		const tableName = getTableName$1(collection);
-		if (tableName) allTablesToGenerate.set(tableName, { collection });
-		const resolvedRelations = resolveCollectionRelations(collection);
-		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
-			const junctionTableName = relation.through.table;
-			if (!allTablesToGenerate.has(junctionTableName)) allTablesToGenerate.set(junctionTableName, {
-				collection: {
-					table: junctionTableName,
-					properties: {}
-				},
-				isJunction: true,
-				relation,
-				sourceCollection: collection
-			});
+//#endregion
+//#region src/databasePoolManager.ts
+var DatabasePoolManager = class {
+	pools = /* @__PURE__ */ new Map();
+	drizzleInstances = /* @__PURE__ */ new Map();
+	defaultDatabaseName;
+	rootConnectionString;
+	constructor(adminConnectionString) {
+		this.rootConnectionString = adminConnectionString;
+		try {
+			const url = new URL(adminConnectionString);
+			this.defaultDatabaseName = url.pathname.slice(1);
+		} catch (e) {
+			throw new Error(`Invalid adminConnectionString provided: ${e}`);
 		}
 	}
-	for (const [tableName, { collection, isJunction, relation, sourceCollection }] of allTablesToGenerate.entries()) {
-		const tableVarName = getTableVarName(tableName);
-		if (isJunction && relation && sourceCollection && isManyToMany(relation)) {
-			const targetCollection = relation.target();
-			const tableCreator = "pgTable";
-			const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
-			const { sourceColumn, targetColumn } = relation.through;
-			const refOptions = `{ onDelete: \"${relation.onDelete ?? "cascade"}\" }`;
-			const sourceColType = isNumericId(sourceCollection) ? "integer" : getPrimaryKeyProp(sourceCollection).isUuid ? "uuid" : "text";
-			const targetColType = isNumericId(targetCollection) ? "integer" : getPrimaryKeyProp(targetCollection).isUuid ? "uuid" : "text";
-			const sourceId = getPrimaryKeyName(sourceCollection);
-			const targetId = getPrimaryKeyName(targetCollection);
-			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
-			schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
-			schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(targetCollection))}.${targetId}, ${refOptions}),\n`;
-			schemaContent += "}, (table) => ([\n";
-			schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
-			const junctionSpec = junctionSpecs.get(baseTableName);
-			if (!stripPolicies && junctionSpec) {
-				const junctionCollection = getJunctionCollectionConfig(junctionSpec);
-				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
-				getJunctionSecurityRules(junctionSpec).forEach((rule, idx) => {
-					schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
-				});
-			}
-			schemaContent += "])).enableRLS();\n\n";
-		} else if (!isJunction) {
-			const schema = isPostgresCollectionConfig(collection) ? collection.schema : void 0;
-			const tableCreator = schema ? `${schema}Schema.table` : "pgTable";
-			const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
-			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
-			const columns = /* @__PURE__ */ new Set();
-			Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
-				const columnString = getDrizzleColumn(propName, prop, collection, collections);
-				if (columnString) columns.add(columnString);
-			});
-			const searchSpec = buildSearchColumnSpec(collection);
-			if (searchSpec) {
-				columns.add(`    ${searchSpec.column}: customType({ dataType() { return 'tsvector'; } })("${searchSpec.column}").generatedAlwaysAs(sql\`${searchSpec.expression}\`)`);
-				if (searchSpec.fuzzy) columns.add(`    ${searchSpec.fuzzy.column}: text("${searchSpec.fuzzy.column}").generatedAlwaysAs(sql\`${searchSpec.fuzzy.expression}\`)`);
-			}
-			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: text(\"id\").primaryKey()");
-			schemaContent += `${Array.from(columns).join(",\n")}`;
-			const securityRules = getEffectiveSecurityRules(collection);
-			if (!stripPolicies && securityRules.length > 0) {
-				schemaContent += "\n}, (table) => ([\n";
-				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
-				securityRules.forEach((rule, idx) => {
-					schemaContent += generatePolicyCode(collection, rule, idx, resolveCollection);
-				});
-				schemaContent += "])).enableRLS();\n\n";
-			} else schemaContent += "\n}).enableRLS();\n\n";
-		}
-		if (!exportedTableVars.includes(tableVarName)) exportedTableVars.push(tableVarName);
+	getDrizzle(databaseName) {
+		const existing = this.drizzleInstances.get(databaseName);
+		if (existing) return existing;
+		const db = drizzle(this.getPool(databaseName));
+		this.drizzleInstances.set(databaseName, db);
+		return db;
 	}
-	for (const [tableName, { collection, isJunction }] of allTablesToGenerate.entries()) {
-		const tableVarName = getTableVarName(tableName);
-		const tableRelations = [];
-		if (isJunction) {
-			const relationInfo = Array.from(allTablesToGenerate.values()).find((v) => v.isJunction && getTableName$1(v.collection) === tableName);
-			if (relationInfo && relationInfo.relation && relationInfo.sourceCollection && isManyToMany(relationInfo.relation)) {
-				const { relation, sourceCollection } = relationInfo;
-				const targetCollection = relation.target();
-				const sourceTableVar = getTableVarName(getTableName$1(sourceCollection));
-				const targetTableVar = getTableVarName(getTableName$1(targetCollection));
-				const sourceId = getPrimaryKeyName(sourceCollection);
-				const targetId = getPrimaryKeyName(targetCollection);
-				if (!relation?.through) throw new Error("Internal, the relation should have a through property. Relations passed to this script should sanitized first with sanitizeRelation().");
-				const owningRelationName = relation.relationName ?? toSnakeCase(getTableName$1(targetCollection));
-				let inverseRelationName = null;
-				try {
-					const targetRelations = resolveCollectionRelations(targetCollection);
-					for (const [, targetRel] of Object.entries(targetRelations)) if (targetRel.kind !== "belongsTo" && targetRel.cardinality === "many" && targetRel.relationName === owningRelationName) {
-						inverseRelationName = targetRel.relationName ?? null;
-						break;
-					}
-				} catch {}
-				tableRelations.push(`    ${quote$1(relation.through.sourceColumn)}: one(${sourceTableVar}, {\n        fields: [${member(tableVarName, relation.through.sourceColumn)}],\n        references: [${member(sourceTableVar, sourceId)}],\n        relationName: ${quote$1(owningRelationName)}\n    })`);
-				const targetRelationName = inverseRelationName ? inverseRelationName : `${tableName}_${relation.through.targetColumn}`;
-				tableRelations.push(`    ${quote$1(relation.through.targetColumn)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, relation.through.targetColumn)}],\n        references: [${member(targetTableVar, targetId)}],\n        relationName: ${quote$1(targetRelationName)}\n    })`);
-			}
-		} else {
-			const resolvedRelations = resolveCollectionRelations(collection);
-			const emittedRelationNames = /* @__PURE__ */ new Set();
-			for (const [relationKey, rel] of Object.entries(resolvedRelations)) try {
-				const target = rel.target();
-				const targetTableVar = getTableVarName(getTableName$1(target));
-				const drizzleRelationName = computeSharedRelationName(rel, collection, collections);
-				const deduplicationKey = `${drizzleRelationName}::${rel.kind}`;
-				if (emittedRelationNames.has(deduplicationKey)) continue;
-				emittedRelationNames.add(deduplicationKey);
-				switch (rel.kind) {
-					case "belongsTo": {
-						const localFieldKey = resolvePropertyKeyForColumn(collection, rel.localKey);
-						tableRelations.push(`    ${quote$1(relationKey)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, localFieldKey)}],\n        references: [${member(targetTableVar, getPrimaryKeyName(target))}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
-						break;
-					}
-					case "hasOne":
-						tableRelations.push(`    "${relationKey}": one(${targetTableVar}, {\n        relationName: \"${drizzleRelationName}\"\n    })`);
-						break;
-					case "hasMany":
-						tableRelations.push(`    "${relationKey}": many(${targetTableVar}, { relationName: \"${drizzleRelationName}\" })`);
-						break;
-					case "manyToMany": {
-						const junctionTableVar = getTableVarName(rel.through.table);
-						tableRelations.push(`    "${relationKey}": many(${junctionTableVar}, { relationName: \"${drizzleRelationName}\" })`);
-						break;
-					}
-					case "via": break;
-				}
-			} catch (e) {
-				logger.warn(`Could not generate relation ${relationKey} for ${collection.name}`, { error: e });
-			}
-			for (const otherCollection of collections) {
-				if (otherCollection.slug === collection.slug) continue;
-				const otherRelations = resolveCollectionRelations(otherCollection);
-				for (const [otherKey, otherRel] of Object.entries(otherRelations)) if (hasForeignKeyOnTarget(otherRel)) try {
-					if (otherRel.target().slug === collection.slug) {
-						const drizzleRelationName = computeSharedRelationName(otherRel, otherCollection, collections);
-						const deduplicationKey = `${drizzleRelationName}::belongsTo`;
-						if (!emittedRelationNames.has(deduplicationKey)) {
-							const otherTableVar = getTableVarName(getTableName$1(otherCollection));
-							const drizzleFieldKey = resolvePropertyKeyForColumn(collection, otherRel.foreignKeyOnTarget);
-							const referencedKey = otherRel.sourceKey ? resolvePropertyKeyForColumn(otherCollection, otherRel.sourceKey) : getPrimaryKeyName(otherCollection);
-							const synthKey = `_synth_${otherTableVar}_${drizzleFieldKey}`;
-							tableRelations.push(`    ${quote$1(synthKey)}: one(${otherTableVar}, {\n        fields: [${member(tableVarName, drizzleFieldKey)}],\n        references: [${member(otherTableVar, referencedKey)}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
-							emittedRelationNames.add(deduplicationKey);
-						}
-					}
-				} catch (e) {}
-			}
+	getPool(databaseName) {
+		if (this.pools.has(databaseName)) return this.pools.get(databaseName);
+		const url = new URL(this.rootConnectionString);
+		url.pathname = `/${databaseName}`;
+		const pool = new Pool({
+			connectionString: pinSearchPath(url.toString()),
+			max: cappedPoolMax(10),
+			idleTimeoutMillis: 1e4,
+			allowExitOnIdle: true
+		});
+		pool.on("error", (err) => {
+			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
+		});
+		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
+		this.pools.set(databaseName, pool);
+		return pool;
+	}
+	/**
+	* Disconnect and remove the pool for a specific database.
+	* Required before `CREATE DATABASE ... TEMPLATE` or `DROP DATABASE`,
+	* which need exclusive access to the target database.
+	*/
+	async disconnectDatabase(databaseName) {
+		const pool = this.pools.get(databaseName);
+		if (pool) {
+			await pool.end();
+			this.pools.delete(databaseName);
+			this.drizzleInstances.delete(databaseName);
 		}
-		if (tableRelations.length > 0) {
-			const relVarName = `${tableVarName}Relations`;
-			schemaContent += `export const ${relVarName} = drizzleRelations(${tableVarName}, ({ one, many }) => ({\n${tableRelations.join(",\n")}\n}));\n\n`;
-			if (!exportedRelationVars.includes(relVarName)) exportedRelationVars.push(relVarName);
+	}
+	/** Check if a pool exists for a given database name. */
+	hasPool(databaseName) {
+		return this.pools.has(databaseName);
+	}
+	async shutdown() {
+		const promises = [];
+		for (const [dbName, pool] of this.pools.entries()) {
+			logger.info(`[DatabasePoolManager] Shutting down pool for ${dbName}`);
+			promises.push(pool.end());
 		}
+		await Promise.all(promises);
+		this.pools.clear();
+		this.drizzleInstances.clear();
 	}
-	const tablesExport = `export const tables = { ${exportedTableVars.join(", ")} };\n`;
-	const enumsExport = `export const enums = { ${exportedEnumVars.join(", ")} };\n`;
-	const relationsExport = `export const relations = { ${exportedRelationVars.join(", ")} };\n\n`;
-	schemaContent += tablesExport + enumsExport + relationsExport;
-	return schemaContent;
 };
 //#endregion
+//#region src/schema/auth-schema.ts
+/**
+* Factory function to dynamically create the auth tables bound to the specified schema names.
+*
+* This module builds queries; it does not create tables. `ensureAuthTablesExist`
+* owns the DDL, which makes everything here a *claim* about a database it cannot
+* enforce — and the claims drifted. Every column below was declared
+* `varchar(n)` while the DDL created it as `TEXT`: `user_agent` as varchar(500),
+* `ip_address` as varchar(45), `secret_encrypted` as varchar(500), every
+* `token_hash` as varchar(255). None of it was true of any database this
+* framework ever provisioned. Harmless at runtime — drizzle does not enforce a
+* length client-side, so the widths only ever misled the next reader — but a
+* schema module that describes columns that do not exist is worse than no
+* schema module. They are `text` here now because they are TEXT there.
+*/
+function createAuthSchema(usersSchemaName = "rebase") {
+	const usersSchema = usersSchemaName === "public" ? null : pgSchema(usersSchemaName);
+	const tableCreator = usersSchema ? usersSchema.table.bind(usersSchema) : pgTable;
+	/**
+	* Users table - stores both email/password and OAuth users
+	*/
+	const users = tableCreator("users", {
+		id: uuid("id").defaultRandom().primaryKey(),
+		email: text("email").notNull().unique(),
+		passwordHash: text("password_hash"),
+		displayName: text("display_name"),
+		photoUrl: text("photo_url"),
+		emailVerified: boolean("email_verified").default(false).notNull(),
+		emailVerificationToken: text("email_verification_token"),
+		emailVerificationSentAt: timestamp("email_verification_sent_at"),
+		isAnonymous: boolean("is_anonymous").default(false).notNull(),
+		roles: text("roles").array().default([]).notNull(),
+		metadata: jsonb("metadata").$type().default({}).notNull(),
+		/**
+		* Sessions that began before this instant are dead, whatever tokens
+		* they still hold. Password resets and admin revocations stamp it.
+		*
+		* Deleting the user's refresh-token rows (which we also do) is not
+		* sufficient on its own: a request already in flight can insert a
+		* freshly rotated row microseconds after the delete and survive it.
+		* This timestamp cannot be outrun that way — it is checked against
+		* `refresh_tokens.session_started_at`, which rotation carries forward.
+		*/
+		tokensValidAfter: timestamp("tokens_valid_after"),
+		createdAt: timestamp("created_at").defaultNow().notNull(),
+		updatedAt: timestamp("updated_at").defaultNow().notNull()
+	});
+	/**
+	* Refresh tokens for long-lived sessions.
+	*
+	* A row is one token, not one device. Every token minted from the same
+	* sign-in shares a `sessionId`, and rotation ADDS a row rather than
+	* replacing one: the superseded token stays on file, flagged `revoked`
+	* with a `rotatedAt` stamp. That record is what lets the refresh endpoint
+	* tell a client replaying a token it never got an answer for (a response
+	* lost to a redeploy, a second tab racing on boot) apart from a stranger
+	* presenting a token that was never issued. Deleting the old row on sight
+	* — the previous behaviour — made those two cases indistinguishable, and
+	* the legitimate one is overwhelmingly the common one.
+	*
+	* There is deliberately NO unique constraint on (uid, user_agent,
+	* ip_address). Keying a session on the IP meant one row per "device",
+	* so a second browser profile behind the same NAT silently evicted the
+	* first, and a phone changing networks orphaned a row on every hop.
+	* User agent and IP are descriptive metadata for the sessions list;
+	* `sessionId` is the identity.
+	*/
+	const refreshTokens = tableCreator("refresh_tokens", {
+		id: uuid("id").defaultRandom().primaryKey(),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+		sessionId: uuid("session_id").defaultRandom().notNull(),
+		tokenHash: text("token_hash").notNull().unique(),
+		expiresAt: timestamp("expires_at").notNull(),
+		revoked: boolean("revoked").default(false).notNull(),
+		rotatedAt: timestamp("rotated_at"),
+		/**
+		* When the sign-in this token descends from happened — carried across
+		* every rotation, unlike `createdAt`. `users.tokensValidAfter` is
+		* compared against this, so a revocation cannot be outrun by a token
+		* that rotates immediately after it.
+		*/
+		sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
+		/**
+		* The assurance level the sign-in was established at — `aal2` only
+		* where a second factor was actually presented. Carried across
+		* rotations, because refresh is not a new authentication and has
+		* nothing else to read the level from.
+		*/
+		aal: text("aal"),
+		userAgent: text("user_agent"),
+		ipAddress: text("ip_address"),
+		createdAt: timestamp("created_at").defaultNow().notNull()
+	}, (table) => ({ sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId) }));
+	/**
+	* Password reset tokens for forgot password flow
+	*/
+	const passwordResetTokens = tableCreator("password_reset_tokens", {
+		id: uuid("id").defaultRandom().primaryKey(),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+		tokenHash: text("token_hash").notNull().unique(),
+		expiresAt: timestamp("expires_at").notNull(),
+		usedAt: timestamp("used_at"),
+		createdAt: timestamp("created_at").defaultNow().notNull()
+	});
+	/**
+	* App config - key/value store for custom settings
+	*/
+	const appConfig = tableCreator("app_config", {
+		key: text("key").primaryKey(),
+		value: jsonb("value").notNull(),
+		updatedAt: timestamp("updated_at").defaultNow().notNull()
+	});
+	/**
+	* User identities - maps external OAuth profiles back to local users
+	*/
+	const userIdentities = tableCreator("user_identities", {
+		id: uuid("id").defaultRandom().primaryKey(),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+		provider: text("provider").notNull(),
+		providerId: text("provider_id").notNull(),
+		profileData: jsonb("profile_data"),
+		createdAt: timestamp("created_at").defaultNow().notNull(),
+		updatedAt: timestamp("updated_at").defaultNow().notNull()
+	}, (table) => ({ uniqueProviderId: unique("unique_provider_id").on(table.provider, table.providerId) }));
+	/**
+	* MFA factors table - stores enrolled MFA methods
+	*/
+	const mfaFactors = tableCreator("mfa_factors", {
+		id: uuid("id").defaultRandom().primaryKey(),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+		factorType: text("factor_type").notNull(),
+		secretEncrypted: text("secret_encrypted").notNull(),
+		friendlyName: text("friendly_name"),
+		verified: boolean("verified").default(false).notNull(),
+		/**
+		* The highest TOTP time step ever accepted for this factor. RFC 6238
+		* §5.2 forbids accepting an OTP twice, and the ±1 step window that
+		* exists for clock drift is also a 90-second replay window: without
+		* this, one observed code buys a fresh session for a minute and a half.
+		*/
+		lastUsedCounter: bigint("last_used_counter", { mode: "number" }),
+		createdAt: timestamp("created_at").defaultNow().notNull(),
+		updatedAt: timestamp("updated_at").defaultNow().notNull()
+	});
+	return {
+		usersSchema,
+		users,
+		refreshTokens,
+		passwordResetTokens,
+		appConfig,
+		userIdentities,
+		mfaFactors,
+		mfaChallenges: tableCreator("mfa_challenges", {
+			id: uuid("id").defaultRandom().primaryKey(),
+			factorId: uuid("factor_id").notNull().references(() => mfaFactors.id, { onDelete: "cascade" }),
+			createdAt: timestamp("created_at").defaultNow().notNull(),
+			verifiedAt: timestamp("verified_at"),
+			ipAddress: text("ip_address"),
+			/** Failed guesses recorded against this challenge; bounded by the route. */
+			attempts: integer("attempts").default(0).notNull(),
+			expiresAt: timestamp("expires_at").notNull()
+		}),
+		recoveryCodes: tableCreator("recovery_codes", {
+			id: uuid("id").defaultRandom().primaryKey(),
+			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+			codeHash: text("code_hash").notNull(),
+			usedAt: timestamp("used_at"),
+			createdAt: timestamp("created_at").defaultNow().notNull()
+		}),
+		magicLinkTokens: tableCreator("magic_link_tokens", {
+			id: uuid("id").defaultRandom().primaryKey(),
+			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+			tokenHash: text("token_hash").notNull().unique(),
+			expiresAt: timestamp("expires_at").notNull(),
+			usedAt: timestamp("used_at"),
+			createdAt: timestamp("created_at").defaultNow().notNull()
+		})
+	};
+}
+var defaultAuthSchema = createAuthSchema("rebase");
+var usersSchema = defaultAuthSchema.usersSchema;
+var users = defaultAuthSchema.users;
+var refreshTokens = defaultAuthSchema.refreshTokens;
+var passwordResetTokens = defaultAuthSchema.passwordResetTokens;
+var appConfig = defaultAuthSchema.appConfig;
+var userIdentities = defaultAuthSchema.userIdentities;
+var mfaFactors = defaultAuthSchema.mfaFactors;
+var mfaChallenges = defaultAuthSchema.mfaChallenges;
+var recoveryCodes = defaultAuthSchema.recoveryCodes;
+var magicLinkTokens = defaultAuthSchema.magicLinkTokens;
+var usersRelations = relations(users, ({ many }) => ({
+	refreshTokens: many(refreshTokens),
+	passwordResetTokens: many(passwordResetTokens),
+	userIdentities: many(userIdentities),
+	mfaFactors: many(mfaFactors),
+	recoveryCodes: many(recoveryCodes),
+	magicLinkTokens: many(magicLinkTokens)
+}));
+var refreshTokensRelations = relations(refreshTokens, ({ one }) => ({ user: one(users, {
+	fields: [refreshTokens.uid],
+	references: [users.id]
+}) }));
+var passwordResetTokensRelations = relations(passwordResetTokens, ({ one }) => ({ user: one(users, {
+	fields: [passwordResetTokens.uid],
+	references: [users.id]
+}) }));
+var userIdentitiesRelations = relations(userIdentities, ({ one }) => ({ user: one(users, {
+	fields: [userIdentities.uid],
+	references: [users.id]
+}) }));
+var mfaFactorsRelations = relations(mfaFactors, ({ one, many }) => ({
+	user: one(users, {
+		fields: [mfaFactors.uid],
+		references: [users.id]
+	}),
+	challenges: many(mfaChallenges)
+}));
+var mfaChallengesRelations = relations(mfaChallenges, ({ one }) => ({ factor: one(mfaFactors, {
+	fields: [mfaChallenges.factorId],
+	references: [mfaFactors.id]
+}) }));
+var recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({ user: one(users, {
+	fields: [recoveryCodes.uid],
+	references: [users.id]
+}) }));
+var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user: one(users, {
+	fields: [magicLinkTokens.uid],
+	references: [users.id]
+}) }));
+//#endregion
 //#region src/cli-output.ts
 /**
 * Terminal output for the `rebase db|schema|doctor` commands.
@@ -7563,7 +7928,7 @@ var runGeneration = async (collectionsFilePath, outputPath) => {
 		outError(`Error generating schema: ${error instanceof Error ? error.stack ?? error.message : String(error)}`);
 	}
 };
-var main = () => {
+var main = async () => {
 	const collectionsFilePathArg = process.argv.find((arg) => arg.startsWith("--collections="));
 	const collectionsFilePath = collectionsFilePathArg ? collectionsFilePathArg.split("=")[1] : process.argv[2];
 	const outputPathArg = process.argv.find((arg) => arg.startsWith("--output="));
@@ -7577,6 +7942,7 @@ var main = () => {
 	const resolvedOutputPath = outputPath ? path.resolve(process.cwd(), outputPath) : void 0;
 	if (watch) {
 		out(`Watching for changes in ${resolvedPath}...`);
+		const { default: chokidar } = await import("chokidar");
 		chokidar.watch(resolvedPath, {
 			persistent: true,
 			ignoreInitial: false
@@ -10561,7 +10927,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-BZoixhVl.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-FN6V3rVi.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -13758,7 +14124,7 @@ function createPostgresBootstrapper(pgConfig) {
 			let readDb;
 			const readUrl = process.env.DATABASE_READ_URL;
 			if (readUrl && readUrl !== pgConfig.connectionString) try {
-				const { createReadReplicaConnection } = await import("./connection-BuZ97wsr.js").then((n) => n.t);
+				const { createReadReplicaConnection } = await import("./connection-GOKU3Hu5.js").then((n) => n.n);
 				readDb = createReadReplicaConnection(readUrl, mergedSchema).db;
 				logger.info("📖 [PostgresBootstrapper] Read replica connection established");
 			} catch (err) {
@@ -14001,7 +14367,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-BY1pHRD_.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-CvW6tbI7.js").then((n) => n.t);
 			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(failure.kind === "comment-column" ? `🔍 [schema] Could not record the search fingerprint on "${failure.target}" — search works, but a later change to the \`search\` block will not be detected: ${failure.error}` : `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
 			return { applied: plan.actions.length - plan.failures.length };
@@ -14022,7 +14388,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* stays RLS-enabled, so it denies rather than leaks.
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-BVFb2olB.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-B01cv9UC.js");
 			const queryable = provisioningQueryable(driverResult);
 			const outcome = await ensureCollectionPolicies(queryable, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
@@ -14031,7 +14397,7 @@ function createPostgresBootstrapper(pgConfig) {
 			for (const u of outcome.unsecured.filter((u) => u.grantWithdrawn)) logger.error(`🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. Its privileges have been revoked from ${REBASE_USER_ROLE}, so the table is unreachable rather than unprotected. Reads and writes to that collection will fail until RLS can be enabled.`);
 			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
-				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-B5Sajku6.js").then((n) => n.n);
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-DAwWHs81.js").then((n) => n.n);
 				await dropLegacyAuthSchema(async (text) => (await queryable.query(text)).rows, {
 					info: (m) => logger.info(m),
 					warn: (m) => logger.warn(m)
@@ -14065,7 +14431,7 @@ function createPostgresBootstrapper(pgConfig) {
 		},
 		mountRoutes(app, basePath, driverResult) {},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			const { createPostgresWebSocket } = await import("./websocket-BVgDVO-V.js").then((n) => n.n);
+			const { createPostgresWebSocket } = await import("./websocket-7Dp77lTh.js").then((n) => n.i);
 			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
 		}
 	};
@@ -14107,6 +14473,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, describeSchemaDriftCause, detectToolMajor, diagnoseRowSecurityDumpFailure, discardPartialDump, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
+export { ADMIN_ONLY_TYPES, AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PUBLIC_TYPES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, cappedPoolMax, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, describeSchemaDriftCause, detectToolMajor, diagnoseRowSecurityDumpFailure, discardPartialDump, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, poolMaxCeiling, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map