@rebasepro/server-postgres 0.16.0 → 0.16.1-canary.g2d1aec8

package/dist/index.es.js

@@ -3,10 +3,10 @@ import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
 import { n as resolveClientListLimit, t as ListLimitError } from "./data_driver-ULAyJEi9.js";
-import { $ as mergeDeep, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as isPrototypePollutingKey, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as toWireKey, Z as getPolicyNamesForRule, _ as OrderBySpecError, at as isManyToMany, b as CollectionRegistry, et as camelCase, g as buildSdkData, h as visibleColumnProjection, it as hasForeignKeyOnTarget, j as findRelation, l as buildSearchColumnSpec, ot as Vector, q as generateForeignKeyName, r as authUsersColumnSql, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as toSnakeCase, u as hiddenColumnsOption, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./auth-users-columns-CgyPWQ18.js";
+import { $ as camelCase, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as mergeDeep, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as getPolicyNamesForRule, Y as toWireKey, Z as isPrototypePollutingKey, _ as OrderBySpecError, a as generatePostgresDdl, at as Vector, b as CollectionRegistry, d as authUsersColumnSql, et as toSnakeCase, f as SEARCH_UNACCENT_FN, g as buildSdkData, h as visibleColumnProjection, i as readSchemaFactsFor, it as isManyToMany, j as findRelation, l as resolveColumnName$1, m as hiddenColumnsOption, n as planCollectionSchemaEnsure, o as generatePostgresPoliciesDdl, p as buildSearchColumnSpec, q as generateForeignKeyName, rt as hasForeignKeyOnTarget, s as generatePostgresSearchDdl, u as AUTH_USERS_COLUMNS, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./ensure-collection-tables-jYsvOLZF.js";
 import { c as isPostgresCollectionConfig, f as ALL_WHERE_FILTER_OPS, g as encodeRelationAggregateSort, l as isRelationalCollectionConfig, v as parseRelationAggregateSort } from "./src-BBFsDaeA.js";
 import { t as createPostgresWebSocket } from "./websocket-BVgDVO-V.js";
-import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-Ch0T6OwW.js";
+import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-CsD7nZDn.js";
 import { A as parseDbNameFromUrl, C as buildRowSecurityPgOptions, D as joinStorageKey, E as globalsFileForDump, F as withDatabaseName, M as resolveConnectionString, N as serverVersionNumToMajor, O as parseBackupDestination, P as splitGlobalsStatements, S as buildPgRestoreListArgs, T as diagnoseRowSecurityDumpFailure, _ as selectBackupsToPrune, a as detectToolMajor, b as buildPgDumpallGlobalsArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as require_source, h as validateDump, i as createDump, j as parsePgToolMajor, k as parseBackupTimestamp, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildBackupFilename, w as checkToolServerCompatibility, x as buildPgRestoreArgs, y as buildPgDumpArgs } from "./backup-service-BZoixhVl.js";
 import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-B5Sajku6.js";
 import { Client, Pool } from "pg";
@@ -20,6 +20,14 @@ import chokidar from "chokidar";
 import { WebSocket } from "ws";
 import { EventEmitter } from "events";
 import { randomUUID } from "crypto";
+//#region ../types/src/types/schema_editing.ts
+var DEFAULT_COMMIT_PATHS = {
+	schemaFile: "backend/src/schema.generated.ts",
+	ddlFile: "drizzle/schema.sql",
+	policiesFile: "drizzle/policies.sql",
+	searchFile: "drizzle/search.sql"
+};
+//#endregion
 //#region ../types/src/types/channel_bus.ts
 /**
 * Whether `setting` is an already-constructed transport rather than a request
@@ -5563,1916 +5571,2274 @@ var BranchService = class {
 	}
 };
 //#endregion
-//#region src/PostgresBackendDriver.ts
-var PostgresBackendDriver = class PostgresBackendDriver {
-	db;
-	registry;
-	poolManager;
-	key = "postgres";
-	initialised = true;
-	dataService;
-	realtimeService;
-	historyService;
-	branchService;
-	user;
-	data;
-	client;
-	/**
-	* Auto-set to `true` when a SET LOCAL ROLE fails with insufficient
-	* privileges, so subsequent queries skip the doomed attempt.
-	* Mirrors the static `DISABLE_DB_ROLE_SWITCHING` env var but is
-	* learned at runtime.
-	*/
-	_roleSwitchingDisabled = false;
-	/**
-	* Restricted role that authenticated (user-context) requests run as (via
-	* `SET LOCAL ROLE`) so RLS binds every statement — reads *and* writes. Set
-	* by the bootstrapper after posture detection: defined when the connection
-	* would otherwise bypass RLS (superuser / BYPASSRLS / table owner),
-	* undefined when RLS already applies natively. The base (server-context)
-	* driver never switches — it is the trusted owner plane (auth flows,
-	* migrations, `dataAsAdmin`).
-	*/
-	rlsUserRole;
-	/**
-	* When true, realtime notifications are deferred until after the
-	* wrapping transaction commits.  Set by `withAuth` → `withTransaction`.
-	*/
-	_deferNotifications = false;
-	_pendingNotifications = [];
-	constructor(db, realtimeService, registry, user, poolManager, historyService) {
-		this.db = db;
-		this.registry = registry;
-		this.poolManager = poolManager;
-		this.dataService = new DataService(db, registry);
-		this.realtimeService = realtimeService;
-		this.historyService = historyService;
-		this.user = user;
-		this.data = buildSdkData(this);
-		if (poolManager) this.branchService = new BranchService(db, poolManager);
-	}
-	/**
-	* Typed admin capabilities (SQLAdmin + SchemaAdmin + BranchAdmin).
-	* Implemented as a getter so method references are resolved at call-time,
-	* allowing test spies applied after construction to take effect.
-	*/
-	get admin() {
-		return {
-			executeSql: (...args) => this.executeSql(...args),
-			fetchAvailableDatabases: () => this.fetchAvailableDatabases(),
-			fetchAvailableRoles: () => this.fetchAvailableRoles(),
-			fetchApplicationRoles: () => this.fetchApplicationRoles(),
-			fetchCurrentDatabase: () => this.fetchCurrentDatabase(),
-			fetchUnmappedTables: (...args) => this.fetchUnmappedTables(...args),
-			fetchTableMetadata: (...args) => this.fetchTableMetadata(...args),
-			...this.branchService ? {
-				createBranch: this.branchService.createBranch.bind(this.branchService),
-				deleteBranch: this.branchService.deleteBranch.bind(this.branchService),
-				listBranches: this.branchService.listBranches.bind(this.branchService),
-				getBranchInfo: this.branchService.getBranchInfo.bind(this.branchService)
-			} : {}
-		};
+//#region src/schema/generate-drizzle-schema-logic.ts
+/**
+* Resolve the SQL column name for a property.
+* Uses the explicit `columnName` when set (e.g. from introspection),
+* falling back to `toSnakeCase(propName)` for manually-authored collections.
+*/
+var JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+/**
+* A string literal for the generated schema file.
+*
+* Column names, table names and enum values are all written into this file as
+* literals, and none of them is constrained to be quote-free: a Postgres
+* identifier only has to be quoted, and `O'Brien` is an ordinary enum value.
+* Interpolating them raw ended the literal early — for enum values, inside
+* single quotes, where an apostrophe is not an edge case.
+*/
+var quote$1 = (value) => JSON.stringify(value);
+/** An object key: verbatim when it is an identifier, quoted otherwise. */
+var propKey = (name) => JS_IDENTIFIER.test(name) ? name : quote$1(name);
+/**
+* A property access on a generated table variable.
+*
+* `users.full name` is not an expression; `users["full name"]` is, and Drizzle
+* treats the two identically.
+*/
+var member = (object, key) => JS_IDENTIFIER.test(key) ? `${object}.${key}` : `${object}[${quote$1(key)}]`;
+var resolveColumnName = (propName, prop) => {
+	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+	return toSnakeCase(propName);
+};
+var getPrimaryKeyProp = (collection) => {
+	if (collection.properties) {
+		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
+		if (idPropEntry) {
+			const prop = idPropEntry[1];
+			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
+			return {
+				name: idPropEntry[0],
+				type: prop.type === "number" ? "number" : "string",
+				isUuid
+			};
+		}
 	}
-	/**
-	* REST-optimised fetch service (include-aware eager-loading).
-	* Delegates to the underlying FetchService (include-aware eager loading),
-	* then runs the afterRead pipeline on the results. The raw FetchService does
-	* NOT run callbacks, so masking must be applied here — otherwise every
-	* REST/SDK read leaks unmasked data (see {@link applyAfterReadForRest}).
-	*/
-	get restFetchService() {
-		const raw = this.dataService.getFetchService();
-		return {
-			fetchCollectionForRest: async (collectionPath, options, include) => {
-				const rows = await raw.fetchCollectionForRest(collectionPath, options, include);
-				return this.applyAfterReadForRest(rows, collectionPath);
-			},
-			fetchOneForRest: async (collectionPath, id, include, databaseId) => {
-				const row = await raw.fetchOneForRest(collectionPath, id, include, databaseId);
-				if (!row) return row;
-				const [masked] = await this.applyAfterReadForRest([row], collectionPath);
-				return masked;
+	const idProp = collection.properties?.["id"];
+	if (idProp?.type === "number") return {
+		name: "id",
+		type: "number",
+		isUuid: false
+	};
+	return {
+		name: "id",
+		type: "string",
+		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
+	};
+};
+/**
+* Given a raw DB column name (e.g. "client_id"), the Drizzle property key that
+* maps to it.
+*
+* One line, because the rule is shared: the Drizzle object key is the wire
+* name, and {@link fieldKeyForColumn} is the one definition of what a column is
+* named on the wire. This used to be a private copy that fell back to the
+* column verbatim, which is how a derived foreign key ended up served as
+* `author_id` beside a hand-authored `displayName`.
+*/
+var resolvePropertyKeyForColumn = (collection, column) => fieldKeyForColumn(collection, column);
+var isNumericId = (collection) => {
+	return getPrimaryKeyProp(collection).type === "number";
+};
+var getPrimaryKeyName = (collection) => {
+	return getPrimaryKeyProp(collection).name;
+};
+var isIdProperty$1 = (propName, prop, collection) => {
+	if ("isId" in prop && Boolean(prop.isId)) return true;
+	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
+};
+/**
+* The Drizzle column declaration a property compiles to, or `null` when the
+* property puts no column on *this* table (an inverse relation, whose column
+* lives on the target). Exported so it can be checked against its DDL twin
+* `getSqlColumnType` directly — the two disagreeing is what left `geopoint`
+* with a database column and no Drizzle key.
+*/
+var getDrizzleColumn = (propName, prop, collection, collections) => {
+	const colName = resolveColumnName(propName, prop);
+	let columnDefinition;
+	switch (prop.type) {
+		case "string": {
+			const stringProp = prop;
+			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}(${quote$1(colName)})`;
+			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
+			else if (stringProp.columnType === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
+			else if (stringProp.columnType === "char") columnDefinition = `char(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
+			else if (stringProp.columnType === "varchar") columnDefinition = `varchar(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
+			else columnDefinition = `text(${quote$1(colName)})`;
+			if (isIdProperty$1(propName, prop, collection)) columnDefinition += ".primaryKey()";
+			if ("isId" in stringProp && stringProp.isId !== "manual" && stringProp.isId !== true) {
+				if (stringProp.isId === "uuid") columnDefinition += ".defaultRandom()";
+				else if (stringProp.isId === "cuid") columnDefinition += ".default(sql`cuid()`)";
+				else if (typeof stringProp.isId === "string") {
+					const sqlContent = stringProp.isId.startsWith("sql`") && stringProp.isId.endsWith("`") ? stringProp.isId.substring(4, stringProp.isId.length - 1) : stringProp.isId;
+					columnDefinition += `.default(sql\`${sqlContent}\`)`;
+				}
 			}
-		};
-	}
-	/**
-	* Build the context handed to every collection callback.
-	*
-	* Note `data: this.data` — `this` is whichever driver is running the
-	* operation, so the callback's data plane inherits that driver's privilege.
-	* On a user request `AuthenticatedPostgresBackendDriver.withTransaction`
-	* constructs a fresh base driver bound to the RLS-scoped transaction and
-	* runs the operation on it, so `this.data` speaks through that connection
-	* and policies apply. On server-context work `this` is the base driver on
-	* the owner connection, and they do not. Pinned by the
-	* `"scopes context.data to the caller"` case in the `rls-enforcement` e2e
-	* suite, because it is the kind of property that is easy to break from a
-	* distance and impossible to notice.
-	*
-	* Previously returned through `as unknown as RebaseCallContext`, which
-	* disabled checking for the whole object and let `driver` — documented in
-	* the callbacks guide — sit on the runtime context while absent from the
-	* contract. Both are declared now, so this is a plain typed return.
-	*/
-	buildCallContext() {
-		return {
-			user: this.user,
-			driver: this,
-			data: this.data,
-			client: this.client,
-			storageSource: this.client?.storage
-		};
-	}
-	resolveCollectionCallbacks(collection, path) {
-		if (!collection && !path) return {
-			collection: void 0,
-			callbacks: void 0,
-			globalCallbacks: void 0,
-			propertyCallbacks: void 0
-		};
-		const registryCollection = this.registry?.getCollectionByPath(path);
-		const resolvedCollection = registryCollection ? {
-			...collection,
-			...registryCollection
-		} : collection;
-		const callbacks = resolvedCollection?.callbacks;
-		const globalCallbacks = this.registry?.getGlobalCallbacks();
-		const properties = resolvedCollection?.properties;
-		let propertyCallbacks;
-		if (properties) propertyCallbacks = buildPropertyCallbacks(properties);
-		return {
-			collection: resolvedCollection,
-			callbacks,
-			globalCallbacks,
-			propertyCallbacks
-		};
-	}
-	/**
-	* Run the three-tier afterRead pipeline (global → collection → property) on a
-	* single row for a collection whose callbacks have already been resolved.
-	*/
-	async applyAfterReadToRow(row, path, resolved, contextForCallback) {
-		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = resolved;
-		let out = row;
-		if (globalCallbacks?.afterRead) out = await globalCallbacks.afterRead({
-			collection: resolvedCollection,
-			path,
-			row: out,
-			context: contextForCallback
-		}) ?? out;
-		if (callbacks?.afterRead) out = await callbacks.afterRead({
-			collection: resolvedCollection,
-			path,
-			row: out,
-			context: contextForCallback
-		}) ?? out;
-		if (propertyCallbacks?.afterRead) out = await propertyCallbacks.afterRead({
-			collection: resolvedCollection,
-			path,
-			row: out,
-			context: contextForCallback
-		}) ?? out;
-		return out;
-	}
-	static hasAfterRead(resolved) {
-		return !!(resolved.globalCallbacks?.afterRead || resolved.callbacks?.afterRead || resolved.propertyCallbacks?.afterRead);
-	}
-	/**
-	* Apply afterRead to REST/SDK read results.
-	*
-	* The REST / `include` path fetches rows through the raw fetch service, which
-	* does NOT run callbacks — so without this, `afterRead` transforms (e.g. PII
-	* masking) are silently skipped on every SDK/REST read, leaking raw data.
-	* This choke point guarantees afterRead runs there too, matching the driver's
-	* fetchCollection/fetchOne paths.
-	*
-	* It also masks embedded relation data one level deep by running the TARGET
-	* collection's afterRead (so `post.author.email` is masked by the authors
-	* collection, not left raw).
-	*/
-	async applyAfterReadForRest(rows, path) {
-		if (!rows || rows.length === 0) return rows;
-		const resolved = this.resolveCollectionCallbacks(void 0, path);
-		const contextForCallback = this.buildCallContext();
-		const hasOwn = PostgresBackendDriver.hasAfterRead(resolved);
-		const relationTargets = {};
-		if (resolved.collection) try {
-			const rels = resolveCollectionRelations(resolved.collection);
-			for (const [key, rel] of Object.entries(rels)) {
-				const targetPath = (typeof rel.target === "function" ? rel.target() : void 0)?.slug;
-				if (!targetPath) continue;
-				const targetResolved = this.resolveCollectionCallbacks(void 0, targetPath);
-				if (PostgresBackendDriver.hasAfterRead(targetResolved)) relationTargets[key] = {
-					path: targetPath,
-					resolved: targetResolved
-				};
+			if (stringProp.validation?.unique) columnDefinition += ".unique()";
+			break;
+		}
+		case "number": {
+			const numProp = prop;
+			const isId = isIdProperty$1(propName, prop, collection);
+			let baseType = numProp.validation?.integer || isId ? `integer(${quote$1(colName)})` : `numeric(${quote$1(colName)})`;
+			if (numProp.columnType) if (numProp.columnType === "double precision") baseType = `doublePrecision(${quote$1(colName)})`;
+			else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") baseType = `${numProp.columnType}(${quote$1(colName)}, { mode: "number" })`;
+			else baseType = `${numProp.columnType}(${quote$1(colName)})`;
+			if ("isId" in numProp && numProp.isId === "increment") columnDefinition = `${baseType}.generatedByDefaultAsIdentity()`;
+			else if ("isId" in numProp && typeof numProp.isId === "string" && numProp.isId !== "manual") {
+				columnDefinition = baseType;
+				const sqlContent = numProp.isId.startsWith("sql`") && numProp.isId.endsWith("`") ? numProp.isId.substring(4, numProp.isId.length - 1) : numProp.isId;
+				columnDefinition += `.default(sql\`${sqlContent}\`)`;
+			} else columnDefinition = baseType;
+			if (isId) columnDefinition += ".primaryKey()";
+			if (numProp.validation?.unique) columnDefinition += ".unique()";
+			break;
+		}
+		case "boolean":
+			columnDefinition = `boolean(${quote$1(colName)})`;
+			break;
+		case "date": {
+			const dateProp = prop;
+			if (dateProp.columnType === "date") columnDefinition = `date(${quote$1(colName)}, { mode: 'string' })`;
+			else if (dateProp.columnType === "time") columnDefinition = `time(${quote$1(colName)})`;
+			else columnDefinition = `timestamp(${quote$1(colName)}, { withTimezone: true, mode: 'string' })`;
+			if (dateProp.autoValue === "on_create" || dateProp.autoValue === "on_update") columnDefinition += ".default(sql`now()`)";
+			break;
+		}
+		case "map":
+			if (prop.columnType === "json") columnDefinition = `json(${quote$1(colName)})`;
+			else columnDefinition = `jsonb(${quote$1(colName)})`;
+			break;
+		case "geopoint":
+			columnDefinition = `jsonb(${quote$1(colName)})`;
+			break;
+		case "array": {
+			const arrayProp = prop;
+			let colType = arrayProp.columnType;
+			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
+				const ofProp = arrayProp.of;
+				if (ofProp.type === "string") colType = "text[]";
+				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
+				else if (ofProp.type === "boolean") colType = "boolean[]";
 			}
-		} catch {}
-		const relKeys = Object.keys(relationTargets);
-		if (!hasOwn && relKeys.length === 0) return rows;
-		const maskEmbedded = async (value, target) => {
-			if (Array.isArray(value)) return Promise.all(value.map((v) => maskEmbedded(v, target)));
-			if (!value || typeof value !== "object") return value;
-			const obj = value;
-			if (obj.__type === "relation" && obj.data && typeof obj.data === "object") return {
-				...obj,
-				data: await this.applyAfterReadToRow(obj.data, target.path, target.resolved, contextForCallback)
-			};
-			if (obj.__type === "reference") return obj;
-			return this.applyAfterReadToRow(obj, target.path, target.resolved, contextForCallback);
-		};
-		return Promise.all(rows.map(async (row) => {
-			let out = hasOwn ? await this.applyAfterReadToRow(row, path, resolved, contextForCallback) : row;
-			for (const key of relKeys) {
-				if (out[key] === void 0 || out[key] === null) continue;
-				out = {
-					...out,
-					[key]: await maskEmbedded(out[key], relationTargets[key])
-				};
+			if (colType === "json") columnDefinition = `json(${quote$1(colName)})`;
+			else if (colType === "text[]") columnDefinition = `text(${quote$1(colName)}).array()`;
+			else if (colType === "integer[]") columnDefinition = `integer(${quote$1(colName)}).array()`;
+			else if (colType === "boolean[]") columnDefinition = `boolean(${quote$1(colName)}).array()`;
+			else if (colType === "numeric[]") columnDefinition = `numeric(${quote$1(colName)}).array()`;
+			else columnDefinition = `jsonb(${quote$1(colName)})`;
+			break;
+		}
+		case "vector": {
+			const vp = prop;
+			columnDefinition = `vector(${quote$1(colName)}, { dimensions: ${vp.dimensions} })`;
+			break;
+		}
+		case "binary":
+			columnDefinition = `customType({ dataType() { return 'bytea'; } })(${quote$1(colName)})`;
+			break;
+		case "relation": {
+			const refProp = prop;
+			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+			if (!relation || relation.kind !== "belongsTo") return null;
+			const fkFieldKey = fieldKeyForColumn(collection, relation.localKey);
+			if (collection.properties[fkFieldKey] && propName !== fkFieldKey) return null;
+			let targetCollection;
+			try {
+				targetCollection = relation.target();
+			} catch {
+				return null;
 			}
-			return out;
-		}));
-	}
-	async fetchCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, vectorSearch }) {
-		const rows = await this.dataService.fetchCollection(path, {
-			filter,
-			orderBy,
-			order,
-			limit,
-			offset,
-			startAfter,
-			databaseId: collection?.databaseId,
-			searchString,
-			vectorSearch
-		});
-		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
-		if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
-			const contextForCallback = this.buildCallContext();
-			return Promise.all(rows.map(async (row) => {
-				let fetched = row;
-				if (globalCallbacks?.afterRead) fetched = await globalCallbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: fetched,
-					context: contextForCallback
-				});
-				if (callbacks?.afterRead) fetched = await callbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: fetched,
-					context: contextForCallback
-				}) ?? fetched;
-				if (propertyCallbacks?.afterRead) fetched = await propertyCallbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: fetched,
-					context: contextForCallback
-				});
-				return fetched;
-			}));
+			const fkColumnName = relation.localKey;
+			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			const targetIdField = pkProp.name;
+			const baseColumn = pkProp.type === "number" ? `integer("${fkColumnName}")` : pkProp.isUuid ? `uuid("${fkColumnName}")` : `text("${fkColumnName}")`;
+			const onUpdate = relation.onUpdate ? `onUpdate: "${relation.onUpdate}"` : "";
+			const required = prop.validation?.required;
+			const refOptionsParts = [onUpdate, `onDelete: \"${relation.onDelete ?? (required ? "cascade" : "set null")}\"`].filter(Boolean);
+			const refOptions = refOptionsParts.length > 0 ? `{ ${refOptionsParts.join(", ")} }` : "";
+			let columnDef = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}${refOptions ? `, ${refOptions}` : ""})`;
+			if (required) columnDef += ".notNull()";
+			return `    ${propKey(fkFieldKey)}: ${columnDef}`;
 		}
-		return rows;
-	}
-	listenCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, onUpdate, onError }) {
-		const subscriptionId = this.generateSubscriptionId();
-		const callbackWrapper = (rows) => {
-			onUpdate(rows);
-		};
-		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
-			clientId: "driver",
-			type: "collection",
-			path,
-			collectionRequest: {
-				filter,
-				orderBy,
-				order,
-				limit,
-				offset,
-				startAfter,
-				databaseId: collection?.databaseId,
-				searchString
+		case "reference": {
+			const refProp = prop;
+			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName$1(c) === refProp.path);
+			if (!targetCollection) {
+				columnDefinition = `text(${quote$1(colName)})`;
+				break;
 			}
-		});
-		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
-		this.fetchCollection({
-			path,
-			collection,
-			filter,
-			limit,
-			offset,
-			startAfter,
-			orderBy,
-			searchString,
-			order
-		}).then((rows) => {
-			callbackWrapper(rows);
-		}).catch((error) => {
-			if (onError) onError(error);
-		});
-		return () => {
-			this.realtimeService.removeSubscriptionCallback(subscriptionId);
-			this.realtimeService.subscriptions.delete(subscriptionId);
-		};
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
+			const targetIdField = pkProp.name;
+			const baseColumn = pkProp.type === "number" ? `integer(${quote$1(colName)})` : pkProp.isUuid ? `uuid(${quote$1(colName)})` : `text(${quote$1(colName)})`;
+			const required = prop.validation?.required;
+			const refOptions = `{ onDelete: "${required ? "cascade" : "set null"}" }`;
+			columnDefinition = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}, ${refOptions})`;
+			if (required) columnDefinition += ".notNull()";
+			return `    ${propKey(propName)}: ${columnDefinition}`;
+		}
+		default: throw new Error(`No Postgres column mapping for property '${propName}' of type '${prop.type}' in collection '${collection.slug}'. Add a case to \`getDrizzleColumn\` (and to \`getSqlColumnType\`, which must agree).`);
 	}
-	async fetchOne({ path, id, databaseId, collection }) {
-		let row = await this.dataService.fetchOne(path, id, databaseId || collection?.databaseId);
-		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
-		if (row && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
-			const contextForCallback = this.buildCallContext();
-			if (globalCallbacks?.afterRead) row = await globalCallbacks.afterRead({
-				collection: resolvedCollection,
-				path,
-				row,
-				context: contextForCallback
-			});
-			if (callbacks?.afterRead) row = await callbacks.afterRead({
-				collection: resolvedCollection,
-				path,
-				row,
-				context: contextForCallback
-			}) ?? row;
-			if (propertyCallbacks?.afterRead) row = await propertyCallbacks.afterRead({
-				collection: resolvedCollection,
-				path,
-				row,
-				context: contextForCallback
-			});
-		}
-		return row;
+	if (prop.validation?.required) columnDefinition += ".notNull()";
+	return `    ${propKey(propName)}: ${columnDefinition}`;
+};
+/**
+* Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
+*
+* The clause is SQL being written into a TypeScript file, so it has to survive
+* being read back as a template literal. Three characters do not:
+*
+* - `` ` `` closes the template early, and the rest of the clause becomes code.
+* - `${` opens an interpolation — the file stops compiling, or worse, compiles
+*   against whatever identifier happens to be in scope.
+* - `\` is an escape, and Drizzle's `sql` tag reads the *cooked* strings, not
+*   `.raw`. So a policy written as `email ~ '^admin\.user@corp\.com$'` reaches
+*   the database as `^admin.user@corp.com$`, where every `\.` now matches any
+*   character. A `USING` clause is a security boundary and that one silently
+*   widened it — the SQL file emitted by the DDL generator kept the backslashes
+*   while this path dropped them, so the two disagreed about who could read the
+*   table.
+*
+* Escaping here rather than in the compiler: the clause is correct SQL, and it
+* is only this destination that has an opinion about backslashes.
+*/
+var wrapSql = (clause) => `sql\`${clause.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${")}\``;
+var generatePolicyCode = (collection, rule, index, resolveCollection) => {
+	const tableName = getTableName$1(collection);
+	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+	const policyNames = getPolicyNamesForRule(rule, tableName);
+	return ops.map((op, opIdx) => {
+		return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
+	}).join("");
+};
+/**
+* Generates a single pgPolicy() call for one specific operation.
+*/
+var generateSinglePolicyCode = (collection, rule, operation, policyName, resolveCollection) => {
+	const mode = rule.mode ?? "permissive";
+	const needsUsing = operation !== "insert";
+	const needsWithCheck = operation !== "select" && operation !== "delete";
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	let usingClause = needsUsing && usingExpr ? wrapSql(policyToPostgres(usingExpr, collection, { resolveCollection })) : null;
+	let withCheckClause = needsWithCheck && withCheckExpr ? wrapSql(policyToPostgres(withCheckExpr, collection, { resolveCollection })) : null;
+	if (!usingClause && needsUsing) usingClause = "sql`false`";
+	if (!withCheckClause && needsWithCheck) withCheckClause = "sql`false`";
+	const parts = [];
+	parts.push(`as: "${mode}"`);
+	parts.push(`for: "${operation}"`);
+	const toRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
+	parts.push(`to: [${toRoles.map((r) => `"${r}"`).join(", ")}]`);
+	if (usingClause) parts.push(`using: ${usingClause}`);
+	if (withCheckClause) parts.push(`withCheck: ${withCheckClause}`);
+	return `    pgPolicy(${quote$1(policyName)}, { ${parts.join(", ")} }),\n`;
+};
+/**
+* Computes a deterministic shared relation name for Drizzle.
+*
+* Drizzle requires both sides of a relation (owning + inverse) to use the
+* exact same `relationName` string so it can pair them. Each collection
+* definition may use a different local `relationName`, so we need a canonical
+* form that both sides can independently compute.
+*
+* Strategy: `{owningTable}_{foreignKey}`
+*   - owning  side → `{thisTable}_{localKey}`           e.g. "jobs_company_id"
+*   - inverse side → `{targetTable}_{foreignKeyOnTarget}` e.g. "jobs_company_id"
+*
+* For M2M with junction tables the owning relation name is already shared via
+* the junction table wiring, so we keep it as-is.
+*
+* Falls back to the local relation name when the counterpart can't be resolved.
+*/
+var computeSharedRelationName = (rel, sourceCollection, _collections) => {
+	const fallback = rel.relationName ?? toSnakeCase(rel.target().slug);
+	if (rel.kind === "belongsTo") {
+		const normalisedKey = resolvePropertyKeyForColumn(sourceCollection, rel.localKey);
+		return `${getTableName$1(sourceCollection)}_${normalisedKey}`;
 	}
-	listenOne({ path, id, collection, onUpdate, onError }) {
-		const subscriptionId = this.generateSubscriptionId();
-		const callbackWrapper = (row) => {
-			if (row) onUpdate(row);
-		};
-		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
-			clientId: "driver",
-			type: "single",
-			path,
-			id
-		});
-		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
-		this.fetchOne({
-			path,
-			id,
-			collection
-		}).then((row) => {
-			if (row) onUpdate(row);
-		}).catch((error) => {
-			if (onError) onError(error);
-		});
-		return () => {
-			this.realtimeService.removeSubscriptionCallback(subscriptionId);
-			this.realtimeService.subscriptions.delete(subscriptionId);
-		};
+	if (rel.kind === "hasMany" || rel.kind === "hasOne") try {
+		const targetCollection = rel.target();
+		const normalisedFK = resolvePropertyKeyForColumn(targetCollection, rel.foreignKeyOnTarget);
+		return `${getTableName$1(targetCollection)}_${normalisedFK}`;
+	} catch {
+		return fallback;
 	}
-	async save({ path, id, values, collection, status, upsert }) {
-		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
-		let updatedValues = values;
-		const contextForCallback = this.buildCallContext();
-		let previousValuesForHistory;
-		if (status === "existing" && id) try {
-			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
-			if (existing) {
-				const { id: _existingId, ...existingValues } = existing;
-				previousValuesForHistory = existingValues;
+	return fallback;
+};
+var generateSchema = async (allCollections, stripPolicies = false) => {
+	const collections = sortCollectionsBySlug(relationalCollections(allCollections));
+	let schemaContent = "// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\n\n";
+	const hasUuid = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "string" && (p.autoValue === "uuid" || p.isId === "uuid")));
+	const hasVector = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "vector"));
+	const hasBinary = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "binary"));
+	const hasSearch = collections.some((c) => buildSearchColumnSpec(c) !== void 0);
+	const pgCoreImports = [
+		"primaryKey",
+		"pgTable",
+		"integer",
+		"varchar",
+		"text",
+		"char",
+		"boolean",
+		"timestamp",
+		"date",
+		"time",
+		"jsonb",
+		"json",
+		"pgEnum",
+		"numeric",
+		"real",
+		"doublePrecision",
+		"bigint",
+		"serial",
+		"bigserial",
+		"pgPolicy"
+	];
+	if (hasUuid) pgCoreImports.push("uuid");
+	if (hasVector) pgCoreImports.push("vector");
+	if (hasBinary || hasSearch) pgCoreImports.push("customType");
+	const uniqueSchemas = Array.from(new Set(collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)));
+	if (uniqueSchemas.length > 0) pgCoreImports.push("pgSchema");
+	schemaContent += `import { ${pgCoreImports.join(", ")} } from 'drizzle-orm/pg-core';\n`;
+	schemaContent += "import { relations as drizzleRelations, sql } from 'drizzle-orm';\n\n";
+	uniqueSchemas.forEach((schema) => {
+		schemaContent += `export const ${schema}Schema = pgSchema("${schema}");\n`;
+	});
+	if (uniqueSchemas.length > 0) schemaContent += "\n";
+	const exportedTableVars = [];
+	const exportedEnumVars = [];
+	const exportedRelationVars = [];
+	const allTablesToGenerate = /* @__PURE__ */ new Map();
+	collections.forEach((collection) => {
+		const collectionPath = getTableName$1(collection);
+		Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
+			if ("enum" in prop && (prop.type === "string" || prop.type === "number") && prop.enum) {
+				const enumVarName = getEnumVarName(collectionPath, propName);
+				const enumDbName = `${collectionPath}_${resolveColumnName(propName, prop)}`;
+				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
+				if (values.length > 0) {
+					schemaContent += `export const ${enumVarName} = pgEnum(${quote$1(enumDbName)}, [${values.map((v) => quote$1(v)).join(", ")}]);\n`;
+					if (!exportedEnumVars.includes(enumVarName)) exportedEnumVars.push(enumVarName);
+				}
 			}
-		} catch (err) {
-			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
+		});
+	});
+	schemaContent += "\n";
+	const junctionSpecs = resolveJunctionSpecs(collections);
+	for (const collection of collections) {
+		const tableName = getTableName$1(collection);
+		if (tableName) allTablesToGenerate.set(tableName, { collection });
+		const resolvedRelations = resolveCollectionRelations(collection);
+		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
+			const junctionTableName = relation.through.table;
+			if (!allTablesToGenerate.has(junctionTableName)) allTablesToGenerate.set(junctionTableName, {
+				collection: {
+					table: junctionTableName,
+					properties: {}
+				},
+				isJunction: true,
+				relation,
+				sourceCollection: collection
+			});
 		}
-		if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
-			if (globalCallbacks?.beforeSave) {
-				const result = await globalCallbacks.beforeSave({
-					collection: resolvedCollection,
-					path,
-					id,
-					values: updatedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
+	}
+	for (const [tableName, { collection, isJunction, relation, sourceCollection }] of allTablesToGenerate.entries()) {
+		const tableVarName = getTableVarName(tableName);
+		if (isJunction && relation && sourceCollection && isManyToMany(relation)) {
+			const targetCollection = relation.target();
+			const tableCreator = "pgTable";
+			const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+			const { sourceColumn, targetColumn } = relation.through;
+			const refOptions = `{ onDelete: \"${relation.onDelete ?? "cascade"}\" }`;
+			const sourceColType = isNumericId(sourceCollection) ? "integer" : getPrimaryKeyProp(sourceCollection).isUuid ? "uuid" : "text";
+			const targetColType = isNumericId(targetCollection) ? "integer" : getPrimaryKeyProp(targetCollection).isUuid ? "uuid" : "text";
+			const sourceId = getPrimaryKeyName(sourceCollection);
+			const targetId = getPrimaryKeyName(targetCollection);
+			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
+			schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
+			schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(targetCollection))}.${targetId}, ${refOptions}),\n`;
+			schemaContent += "}, (table) => ([\n";
+			schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
+			const junctionSpec = junctionSpecs.get(baseTableName);
+			if (!stripPolicies && junctionSpec) {
+				const junctionCollection = getJunctionCollectionConfig(junctionSpec);
+				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
+				getJunctionSecurityRules(junctionSpec).forEach((rule, idx) => {
+					schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
 				});
-				if (result) updatedValues = mergeDeep(updatedValues, result);
 			}
-			if (callbacks?.beforeSave) {
-				const result = await callbacks.beforeSave({
-					collection: resolvedCollection,
-					path,
-					id,
-					values: updatedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
-				});
-				if (result) updatedValues = mergeDeep(updatedValues, result);
+			schemaContent += "])).enableRLS();\n\n";
+		} else if (!isJunction) {
+			const schema = isPostgresCollectionConfig(collection) ? collection.schema : void 0;
+			const tableCreator = schema ? `${schema}Schema.table` : "pgTable";
+			const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
+			const columns = /* @__PURE__ */ new Set();
+			Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
+				const columnString = getDrizzleColumn(propName, prop, collection, collections);
+				if (columnString) columns.add(columnString);
+			});
+			const searchSpec = buildSearchColumnSpec(collection);
+			if (searchSpec) {
+				columns.add(`    ${searchSpec.column}: customType({ dataType() { return 'tsvector'; } })("${searchSpec.column}").generatedAlwaysAs(sql\`${searchSpec.expression}\`)`);
+				if (searchSpec.fuzzy) columns.add(`    ${searchSpec.fuzzy.column}: text("${searchSpec.fuzzy.column}").generatedAlwaysAs(sql\`${searchSpec.fuzzy.expression}\`)`);
 			}
-			if (propertyCallbacks?.beforeSave) {
-				const result = await propertyCallbacks.beforeSave({
-					collection: resolvedCollection,
-					path,
-					id,
-					values: updatedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
+			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: text(\"id\").primaryKey()");
+			schemaContent += `${Array.from(columns).join(",\n")}`;
+			const securityRules = getEffectiveSecurityRules(collection);
+			if (!stripPolicies && securityRules.length > 0) {
+				schemaContent += "\n}, (table) => ([\n";
+				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
+				securityRules.forEach((rule, idx) => {
+					schemaContent += generatePolicyCode(collection, rule, idx, resolveCollection);
 				});
-				if (result) updatedValues = mergeDeep(updatedValues, result);
-			}
+				schemaContent += "])).enableRLS();\n\n";
+			} else schemaContent += "\n}).enableRLS();\n\n";
 		}
-		if (resolvedCollection?.properties) updatedValues = updateDateAutoValues({
-			inputValues: updatedValues,
-			properties: resolvedCollection.properties,
-			status: status ?? "new",
-			timestampNowValue: /* @__PURE__ */ new Date()
-		});
-		try {
-			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, { upsert });
-			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
-				if (globalCallbacks?.afterRead) savedRow = await globalCallbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: savedRow,
-					context: contextForCallback
-				});
-				if (callbacks?.afterRead) savedRow = await callbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: savedRow,
-					context: contextForCallback
-				}) ?? savedRow;
-				if (propertyCallbacks?.afterRead) savedRow = await propertyCallbacks.afterRead({
-					collection: resolvedCollection,
-					path,
-					row: savedRow,
-					context: contextForCallback
-				});
+		if (!exportedTableVars.includes(tableVarName)) exportedTableVars.push(tableVarName);
+	}
+	for (const [tableName, { collection, isJunction }] of allTablesToGenerate.entries()) {
+		const tableVarName = getTableVarName(tableName);
+		const tableRelations = [];
+		if (isJunction) {
+			const relationInfo = Array.from(allTablesToGenerate.values()).find((v) => v.isJunction && getTableName$1(v.collection) === tableName);
+			if (relationInfo && relationInfo.relation && relationInfo.sourceCollection && isManyToMany(relationInfo.relation)) {
+				const { relation, sourceCollection } = relationInfo;
+				const targetCollection = relation.target();
+				const sourceTableVar = getTableVarName(getTableName$1(sourceCollection));
+				const targetTableVar = getTableVarName(getTableName$1(targetCollection));
+				const sourceId = getPrimaryKeyName(sourceCollection);
+				const targetId = getPrimaryKeyName(targetCollection);
+				if (!relation?.through) throw new Error("Internal, the relation should have a through property. Relations passed to this script should sanitized first with sanitizeRelation().");
+				const owningRelationName = relation.relationName ?? toSnakeCase(getTableName$1(targetCollection));
+				let inverseRelationName = null;
+				try {
+					const targetRelations = resolveCollectionRelations(targetCollection);
+					for (const [, targetRel] of Object.entries(targetRelations)) if (targetRel.kind !== "belongsTo" && targetRel.cardinality === "many" && targetRel.relationName === owningRelationName) {
+						inverseRelationName = targetRel.relationName ?? null;
+						break;
+					}
+				} catch {}
+				tableRelations.push(`    ${quote$1(relation.through.sourceColumn)}: one(${sourceTableVar}, {\n        fields: [${member(tableVarName, relation.through.sourceColumn)}],\n        references: [${member(sourceTableVar, sourceId)}],\n        relationName: ${quote$1(owningRelationName)}\n    })`);
+				const targetRelationName = inverseRelationName ? inverseRelationName : `${tableName}_${relation.through.targetColumn}`;
+				tableRelations.push(`    ${quote$1(relation.through.targetColumn)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, relation.through.targetColumn)}],\n        references: [${member(targetTableVar, targetId)}],\n        relationName: ${quote$1(targetRelationName)}\n    })`);
 			}
-			const savedId = deriveRowAddress(savedRow, resolvedCollection ?? collection, this.registry);
-			const savedValues = savedRow;
-			if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
-				if (globalCallbacks?.afterSave) await globalCallbacks.afterSave({
-					collection: resolvedCollection,
-					path,
-					id: savedId,
-					values: savedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
-				});
-				if (callbacks?.afterSave) await callbacks.afterSave({
-					collection: resolvedCollection,
-					path,
-					id: savedId,
-					values: savedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
-				});
-				if (propertyCallbacks?.afterSave) await propertyCallbacks.afterSave({
-					collection: resolvedCollection,
-					path,
-					id: savedId,
-					values: savedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					context: contextForCallback
-				});
+		} else {
+			const resolvedRelations = resolveCollectionRelations(collection);
+			const emittedRelationNames = /* @__PURE__ */ new Set();
+			for (const [relationKey, rel] of Object.entries(resolvedRelations)) try {
+				const target = rel.target();
+				const targetTableVar = getTableVarName(getTableName$1(target));
+				const drizzleRelationName = computeSharedRelationName(rel, collection, collections);
+				const deduplicationKey = `${drizzleRelationName}::${rel.kind}`;
+				if (emittedRelationNames.has(deduplicationKey)) continue;
+				emittedRelationNames.add(deduplicationKey);
+				switch (rel.kind) {
+					case "belongsTo": {
+						const localFieldKey = resolvePropertyKeyForColumn(collection, rel.localKey);
+						tableRelations.push(`    ${quote$1(relationKey)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, localFieldKey)}],\n        references: [${member(targetTableVar, getPrimaryKeyName(target))}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
+						break;
+					}
+					case "hasOne":
+						tableRelations.push(`    "${relationKey}": one(${targetTableVar}, {\n        relationName: \"${drizzleRelationName}\"\n    })`);
+						break;
+					case "hasMany":
+						tableRelations.push(`    "${relationKey}": many(${targetTableVar}, { relationName: \"${drizzleRelationName}\" })`);
+						break;
+					case "manyToMany": {
+						const junctionTableVar = getTableVarName(rel.through.table);
+						tableRelations.push(`    "${relationKey}": many(${junctionTableVar}, { relationName: \"${drizzleRelationName}\" })`);
+						break;
+					}
+					case "via": break;
+				}
+			} catch (e) {
+				logger.warn(`Could not generate relation ${relationKey} for ${collection.name}`, { error: e });
 			}
-			if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
-				tableName: path,
-				id: savedId,
-				action: status === "new" ? "create" : "update",
-				values: savedValues,
-				previousValues: previousValuesForHistory,
-				updatedBy: this.user?.uid
+			for (const otherCollection of collections) {
+				if (otherCollection.slug === collection.slug) continue;
+				const otherRelations = resolveCollectionRelations(otherCollection);
+				for (const [otherKey, otherRel] of Object.entries(otherRelations)) if (hasForeignKeyOnTarget(otherRel)) try {
+					if (otherRel.target().slug === collection.slug) {
+						const drizzleRelationName = computeSharedRelationName(otherRel, otherCollection, collections);
+						const deduplicationKey = `${drizzleRelationName}::belongsTo`;
+						if (!emittedRelationNames.has(deduplicationKey)) {
+							const otherTableVar = getTableVarName(getTableName$1(otherCollection));
+							const drizzleFieldKey = resolvePropertyKeyForColumn(collection, otherRel.foreignKeyOnTarget);
+							const referencedKey = otherRel.sourceKey ? resolvePropertyKeyForColumn(otherCollection, otherRel.sourceKey) : getPrimaryKeyName(otherCollection);
+							const synthKey = `_synth_${otherTableVar}_${drizzleFieldKey}`;
+							tableRelations.push(`    ${quote$1(synthKey)}: one(${otherTableVar}, {\n        fields: [${member(tableVarName, drizzleFieldKey)}],\n        references: [${member(otherTableVar, referencedKey)}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
+							emittedRelationNames.add(deduplicationKey);
+						}
+					}
+				} catch (e) {}
+			}
+		}
+		if (tableRelations.length > 0) {
+			const relVarName = `${tableVarName}Relations`;
+			schemaContent += `export const ${relVarName} = drizzleRelations(${tableVarName}, ({ one, many }) => ({\n${tableRelations.join(",\n")}\n}));\n\n`;
+			if (!exportedRelationVars.includes(relVarName)) exportedRelationVars.push(relVarName);
+		}
+	}
+	const tablesExport = `export const tables = { ${exportedTableVars.join(", ")} };\n`;
+	const enumsExport = `export const enums = { ${exportedEnumVars.join(", ")} };\n`;
+	const relationsExport = `export const relations = { ${exportedRelationVars.join(", ")} };\n\n`;
+	schemaContent += tablesExport + enumsExport + relationsExport;
+	return schemaContent;
+};
+//#endregion
+//#region src/schema/classify-change.ts
+var VERDICT_RANK = {
+	safe: 0,
+	diverges: 1,
+	"needs-migration": 2
+};
+var bySlug = (collections) => {
+	const map = /* @__PURE__ */ new Map();
+	for (const collection of collections) if (collection.slug) map.set(collection.slug, collection);
+	return map;
+};
+var propertiesOf = (collection) => collection.properties ?? {};
+/** Enum values a string property declares, or undefined when it is not an enum. */
+var enumValuesOf = (prop) => {
+	const values = prop.enum;
+	if (!Array.isArray(values)) return void 0;
+	return values.map((value) => typeof value === "string" ? value : String(value?.id ?? value));
+};
+var isRequired = (prop) => prop.validation?.required === true;
+var isIdProperty = (prop) => Boolean(prop.isId);
+/**
+* A change to any of these alters the physical column, which the ensure path
+* cannot do. Compared as a tuple so a change to *any* of them is caught without
+* this module having to re-derive the SQL type — which is the DDL generator's
+* job, and duplicating it here is how the two would drift.
+*/
+var physicalShapeOf = (prop) => JSON.stringify([
+	prop.type,
+	prop.columnType ?? null,
+	prop.dimensions ?? null,
+	prop.isId ?? null,
+	prop.validation?.max ?? null
+]);
+/** Whether the table behind a collection exists and is empty. */
+var tableIsEmpty = (collection, facts) => {
+	if (!facts?.populatedTables) return false;
+	const key = qualifiedTable(collection);
+	if (!facts.tables.has(key)) return true;
+	return !facts.populatedTables.has(key);
+};
+var qualifiedTable = (collection) => {
+	return `${collection.schema ?? "public"}.${getTableName$1(collection)}`;
+};
+/**
+* Classify the difference between two collection sets.
+*
+* `before` is what the running database was built from; `after` is what the
+* editor is proposing. Order within each array is irrelevant.
+*
+* `facts` is what the database actually looks like. Supplied by the live
+* editor; omitted by callers reasoning about collections in the abstract, who
+* get the conservative reading.
+*/
+function classifyCollectionChanges(before, after, facts) {
+	const previous = bySlug(before);
+	const next = bySlug(after);
+	const changes = [];
+	for (const [slug, collection] of next) {
+		if (!previous.has(slug)) {
+			changes.push({
+				kind: "add-collection",
+				verdict: "safe",
+				collection: slug,
+				detail: `New collection "${slug}" — creates table "${getTableName$1(collection)}".`
 			});
-			if (this._deferNotifications) this._pendingNotifications.push({
-				path,
-				id: savedId,
-				row: savedRow,
-				databaseId: resolvedCollection?.databaseId
+			continue;
+		}
+		classifyProperties(previous.get(slug), collection, changes, facts);
+	}
+	for (const [slug, collection] of previous) {
+		if (next.has(slug)) continue;
+		changes.push({
+			kind: "remove-collection",
+			verdict: "needs-migration",
+			collection: slug,
+			detail: `Collection "${slug}" was removed, which would drop table "${getTableName$1(collection)}" and everything in it.`,
+			remedy: "The ensure path never drops anything, so this cannot be applied here. Remove the collection in a migration you have read, or keep it and stop serving it."
+		});
+	}
+	const verdict = changes.reduce((worst, change) => VERDICT_RANK[change.verdict] > VERDICT_RANK[worst] ? change.verdict : worst, "safe");
+	return {
+		changes,
+		verdict,
+		applicable: verdict === "safe"
+	};
+}
+function classifyProperties(before, after, changes, facts) {
+	const slug = after.slug ?? "";
+	const previous = propertiesOf(before);
+	const next = propertiesOf(after);
+	const empty = tableIsEmpty(after, facts);
+	for (const [name, prop] of Object.entries(next)) {
+		const old = previous[name];
+		if (!old) {
+			if (isRequired(prop) && !empty) changes.push({
+				kind: "add-property",
+				verdict: "diverges",
+				collection: slug,
+				property: name,
+				detail: `"${name}" is required, but "${getTableName$1(after)}" already holds rows, so NOT NULL would be checked against data that has no value for it yet. The column would arrive nullable.`,
+				remedy: "Add it optional, backfill every row, then make it required — the editor will apply the constraint once no row violates it."
 			});
-			else await this.realtimeService.notifyUpdate(path, savedId, savedRow, resolvedCollection?.databaseId);
-			return savedRow;
-		} catch (error) {
-			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
-				if (globalCallbacks?.afterSaveError) await globalCallbacks.afterSaveError({
-					collection: resolvedCollection,
-					path,
-					id: id || "unknown",
-					values: updatedValues,
-					previousValues: void 0,
-					status,
-					context: contextForCallback
-				});
-				if (callbacks?.afterSaveError) await callbacks.afterSaveError({
-					collection: resolvedCollection,
-					path,
-					id: id || "unknown",
-					values: updatedValues,
-					previousValues: void 0,
-					status,
-					context: contextForCallback
-				});
-				if (propertyCallbacks?.afterSaveError) await propertyCallbacks.afterSaveError({
-					collection: resolvedCollection,
-					path,
-					id: id || "unknown",
-					values: updatedValues,
-					previousValues: void 0,
-					status,
-					context: contextForCallback
+			else {
+				const column = resolveColumnName$1(name, prop);
+				changes.push({
+					kind: "add-property",
+					verdict: "safe",
+					collection: slug,
+					property: name,
+					detail: isRequired(prop) ? `New required property "${name}" — adds column "${column}" NOT NULL, which "${getTableName$1(after)}" can take because it holds no rows.` : `New optional property "${name}" — adds column "${column}".`
 				});
 			}
-			throw error;
+			continue;
 		}
+		classifyProperty(slug, after, name, old, prop, changes, facts);
+	}
+	for (const [name, prop] of Object.entries(previous)) {
+		if (next[name]) continue;
+		changes.push({
+			kind: "remove-property",
+			verdict: "needs-migration",
+			collection: slug,
+			property: name,
+			detail: `"${name}" was removed, which would drop column "${resolveColumnName$1(name, prop)}" and its data.`,
+			remedy: "The ensure path never drops a column. Remove it in a migration you have read, or leave the column and stop exposing the property."
+		});
 	}
-	/**
-	* Write many rows through the same pipeline as {@link save}.
-	*
-	* The batch runs in one transaction of its own, so a failure part-way leaves
-	* nothing behind — the point of a batch is that a re-run starts from a known
-	* state. When this driver is already inside a transaction (the authenticated
-	* path, via `withTransaction`) the nested call becomes a savepoint, which is
-	* still atomic and still commits once.
-	*
-	* Rows are applied in order, so a batch that touches the same key twice ends
-	* with the last write winning, exactly as separate calls would.
-	*/
-	async saveMany({ path, rows, collection, upsert }) {
-		return this.db.transaction(async (tx) => {
-			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-			txDriver.dataService = new DataService(tx, this.registry);
-			txDriver.client = this.client;
-			txDriver._deferNotifications = this._deferNotifications;
-			txDriver._pendingNotifications = this._pendingNotifications;
-			const saved = [];
-			for (let i = 0; i < rows.length; i++) {
-				const values = rows[i];
-				const id = values?.id;
-				try {
-					saved.push(await txDriver.save({
-						path,
-						values,
-						collection,
-						status: "new",
-						upsert
-					}));
-				} catch (error) {
-					const label = id !== void 0 ? `id ${JSON.stringify(id)}` : "no id";
-					throw Object.assign(new Error(`Row ${i} of ${rows.length} (${label}) failed: ${error?.message ?? error}`, { cause: error }), {
-						statusCode: error?.statusCode,
-						code: error?.code,
-						name: error?.name
-					});
-				}
-			}
-			return saved;
+}
+function classifyProperty(slug, collection, name, before, after, changes, facts) {
+	const beforeColumn = resolveColumnName$1(name, before);
+	const afterColumn = resolveColumnName$1(name, after);
+	if (beforeColumn !== afterColumn) changes.push({
+		kind: "rename-column",
+		verdict: "needs-migration",
+		collection: slug,
+		property: name,
+		detail: `"${name}" changes column from "${beforeColumn}" to "${afterColumn}".`,
+		remedy: "The ensure path only renames a column through its legacy-name path, which this is not. Rename it in a migration, or the old column stays and the new one is created empty beside it."
+	});
+	if (isIdProperty(before) !== isIdProperty(after)) {
+		changes.push({
+			kind: "change-primary-key",
+			verdict: "needs-migration",
+			collection: slug,
+			property: name,
+			detail: `"${name}" changes whether it is the primary key.`,
+			remedy: "A primary key change rewrites the table and every foreign key into it. Migration only."
+		});
+		return;
+	}
+	if (physicalShapeOf(before) !== physicalShapeOf(after)) changes.push({
+		kind: "change-property-type",
+		verdict: "needs-migration",
+		collection: slug,
+		property: name,
+		detail: `"${name}" changes physical type — ${before.type} to ${after.type}.`,
+		remedy: "There is no ALTER COLUMN TYPE in the ensure path, and a cast can fail on data that is already there. Change it in a migration."
+	});
+	if (!isRequired(before) && isRequired(after)) {
+		const empty = tableIsEmpty(collection, facts);
+		changes.push(empty ? {
+			kind: "change-required",
+			verdict: "safe",
+			collection: slug,
+			property: name,
+			detail: `"${name}" became required — sets NOT NULL on "${afterColumn}", which "${getTableName$1(collection)}" can take because it holds no rows.`
+		} : {
+			kind: "change-required",
+			verdict: "diverges",
+			collection: slug,
+			property: name,
+			detail: `"${name}" became required, but "${getTableName$1(collection)}" holds rows and SET NOT NULL is checked against every one of them. The database would keep accepting nulls.`,
+			remedy: `Backfill first — UPDATE the rows where "${afterColumn}" IS NULL — then apply this again.`
+		});
+	}
+	if (isRequired(before) && !isRequired(after)) changes.push({
+		kind: "change-required",
+		verdict: "safe",
+		collection: slug,
+		property: name,
+		detail: `"${name}" is no longer required — drops NOT NULL from "${afterColumn}".`
+	});
+	classifyEnum(slug, collection, name, before, after, changes, facts);
+}
+function classifyEnum(slug, collection, name, before, after, changes, facts) {
+	const oldValues = enumValuesOf(before);
+	const newValues = enumValuesOf(after);
+	if (!oldValues || !newValues) return;
+	const added = newValues.filter((value) => !oldValues.includes(value));
+	const removed = oldValues.filter((value) => !newValues.includes(value));
+	if (added.length > 0) {
+		const seesTheType = facts?.enumValues !== void 0;
+		changes.push(seesTheType ? {
+			kind: "add-enum-value",
+			verdict: "safe",
+			collection: slug,
+			property: name,
+			detail: `"${name}" gains ${added.map((v) => `"${v}"`).join(", ")} — ALTER TYPE … ADD VALUE.`
+		} : {
+			kind: "add-enum-value",
+			verdict: "diverges",
+			collection: slug,
+			property: name,
+			detail: `"${name}" gains ${added.map((v) => `"${v}"`).join(", ")}, and the values this type already has are not known here, so whether they would land cannot be said.`,
+			remedy: "Plan this against the database it is destined for."
 		});
 	}
+	if (removed.length > 0) changes.push({
+		kind: "remove-enum-value",
+		verdict: "needs-migration",
+		collection: slug,
+		property: name,
+		detail: `"${name}" drops ${removed.map((v) => `"${v}"`).join(", ")}.`,
+		remedy: "Postgres cannot remove a value from an enum type. Recreate the type in a migration, after rewriting every row still using the value."
+	});
+}
+//#endregion
+//#region src/schema/generate-schema-commit.ts
+/**
+* Everything a schema change has to write, as file contents.
+*
+* A live schema editor that only edits the collection source produces a repo
+* that does not build: `backend/src/schema.generated.ts` is a committed
+* artifact, and a stale one has broken every deploy at least once. So the unit
+* of a schema change is not a file, it is a **commit** — and this module
+* produces one, without touching a disk, a database or a network.
+*
+* Pure on purpose. The risky half of "commit, then apply" is generating a
+* correct commit; keeping it a function from collections to file contents is
+* what lets that half be tested by building a database from the result and
+* comparing it to the one the change describes.
+*
+* ## Where the migration comes from, and why not from Atlas
+*
+* `rebase db generate` mints migrations by running Atlas over the generated
+* `schema.sql`. Atlas is an external binary, it wants a dev database, and it
+* maintains an `atlas.sum` integrity file whose hash this module would have to
+* reproduce byte-for-byte to stay valid.
+*
+* None of that is necessary here, because of what the editor is allowed to do.
+* `classify-change.ts` refuses anything the boot-time ensure path cannot
+* express, which leaves only additive statements — and those are computable as
+* a plain difference between two ensure plans:
+*
+*     plan(after, nothing) − plan(before, nothing)
+*
+* Both plans are pure functions of the collections, every statement is
+* idempotent, and the difference is exactly what the change adds. No diff
+* engine, no database, no binary.
+*
+* The statements are *returned* rather than written into a migration file. A
+* project provisioned by boot-ensure needs no migration at all — its
+* collections are the schema — while a project provisioned by migrations needs
+* the file to carry an Atlas hash, which only Atlas can mint. Writing a
+* migration this module cannot make valid would be worse than handing the
+* statements to a caller who knows which kind of project it is.
+*/
+var SchemaCommitError = class extends Error {
+	classified;
+	constructor(message, classified) {
+		super(message);
+		this.classified = classified;
+		this.name = "SchemaCommitError";
+	}
+};
+/** An `ExistingSchema` describing a database that has nothing in it. */
+var nothing = () => ({
+	tables: /* @__PURE__ */ new Map(),
+	enums: /* @__PURE__ */ new Set()
+});
+/** A commit message that says what changed rather than that something did. */
+function commitMessage(classified) {
+	const { changes } = classified;
+	if (changes.length === 0) return "chore(schema): no change";
+	const collections = [...new Set(changes.map((change) => change.collection))].sort();
+	const added = changes.filter((c) => c.kind === "add-collection").map((c) => c.collection);
+	const properties = changes.filter((c) => c.kind === "add-property");
+	let subject;
+	if (added.length === 1 && changes.length === 1) subject = `add the ${added[0]} collection`;
+	else if (properties.length === 1 && changes.length === 1) subject = `add ${properties[0].property} to ${properties[0].collection}`;
+	else if (collections.length === 1) subject = `${changes.length} change(s) to ${collections[0]}`;
+	else subject = `${changes.length} change(s) across ${collections.length} collections`;
+	const body = changes.map((change) => `- ${change.detail}`).join("\n");
+	return `feat(schema): ${subject}\n\n${body}\n`;
+}
+/**
+* Build the commit.
+*
+* Refuses when the change is not applicable — a commit describing a schema the
+* ensure path will not produce is a commit that makes the repository lie about
+* the database. The classification travels on the error so a caller can show
+* exactly which change was the problem.
+*/
+async function generateSchemaCommit(input) {
+	const paths = {
+		...DEFAULT_COMMIT_PATHS,
+		...input.paths
+	};
+	const existing = input.existing ?? nothing();
+	const options = { constraints: "converge" };
+	const classified = classifyCollectionChanges(input.before, input.after, input.existing);
+	if (!classified.applicable) throw new SchemaCommitError(`This change cannot be applied to a running database:\n` + classified.changes.filter((change) => change.verdict !== "safe").map((change) => `  • ${change.detail}${change.remedy ? `\n    ${change.remedy}` : ""}`).join("\n"), classified);
+	const [schema, ddl, policies, search] = await Promise.all([
+		generateSchema(input.after),
+		generatePostgresDdl(input.after),
+		Promise.resolve(generatePostgresPoliciesDdl(input.after)),
+		Promise.resolve(generatePostgresSearchDdl(input.after))
+	]);
+	const generated = [
+		{
+			path: paths.schemaFile,
+			contents: schema
+		},
+		{
+			path: paths.ddlFile,
+			contents: ddl
+		},
+		{
+			path: paths.policiesFile,
+			contents: policies
+		},
+		{
+			path: paths.searchFile,
+			contents: search
+		}
+	];
+	const previous = planCollectionSchemaEnsure(input.before, existing, options);
+	const next = planCollectionSchemaEnsure(input.after, existing, options);
+	const already = new Set(previous.statements);
+	return {
+		files: [...input.sourceFiles ?? [], ...generated],
+		statements: next.statements.filter((statement) => !already.has(statement)),
+		classified,
+		message: commitMessage(classified),
+		withheldConstraints: next.withheldConstraints
+	};
+}
+//#endregion
+//#region src/PostgresBackendDriver.ts
+var PostgresBackendDriver = class PostgresBackendDriver {
+	db;
+	registry;
+	poolManager;
+	key = "postgres";
+	initialised = true;
+	dataService;
+	realtimeService;
+	historyService;
+	branchService;
+	user;
+	data;
+	client;
 	/**
-	* Update many rows through the same pipeline as {@link save}, in one
-	* transaction.
-	*
-	* Structurally the mirror of {@link saveMany} — same tx-bound sub-driver,
-	* same deferred notifications, same per-row error labelling — but it calls
-	* `save` with an explicit `id` and `status: "existing"`, which is precisely
-	* what `saveMany` cannot do: that one passes `status: "new"` and keeps the
-	* key inside `values`, so it inserts or upserts and can never target a
-	* particular row.
-	*
-	* All-or-nothing, so an id matching no row aborts the batch. A partial
-	* update is the outcome with no good recovery: the caller cannot tell which
-	* half landed without re-reading everything.
+	* Auto-set to `true` when a SET LOCAL ROLE fails with insufficient
+	* privileges, so subsequent queries skip the doomed attempt.
+	* Mirrors the static `DISABLE_DB_ROLE_SWITCHING` env var but is
+	* learned at runtime.
 	*/
-	async updateMany({ path, updates, collection }) {
-		return this.db.transaction(async (tx) => {
-			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-			txDriver.dataService = new DataService(tx, this.registry);
-			txDriver.client = this.client;
-			txDriver._deferNotifications = this._deferNotifications;
-			txDriver._pendingNotifications = this._pendingNotifications;
-			const saved = [];
-			for (let i = 0; i < updates.length; i++) {
-				const { id, values } = updates[i];
-				try {
-					if (!await txDriver.fetchOne({
-						path,
-						id: String(id),
-						collection
-					})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
-						statusCode: 404,
-						code: "NOT_FOUND"
-					});
-					saved.push(await txDriver.save({
-						path,
-						id: String(id),
-						values,
-						collection,
-						status: "existing"
-					}));
-				} catch (error) {
-					throw Object.assign(new Error(`Update ${i} of ${updates.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
-						statusCode: error?.statusCode,
-						code: error?.code,
-						name: error?.name
-					});
-				}
-			}
-			return saved;
-		});
+	_roleSwitchingDisabled = false;
+	/**
+	* Restricted role that authenticated (user-context) requests run as (via
+	* `SET LOCAL ROLE`) so RLS binds every statement — reads *and* writes. Set
+	* by the bootstrapper after posture detection: defined when the connection
+	* would otherwise bypass RLS (superuser / BYPASSRLS / table owner),
+	* undefined when RLS already applies natively. The base (server-context)
+	* driver never switches — it is the trusted owner plane (auth flows,
+	* migrations, `dataAsAdmin`).
+	*/
+	rlsUserRole;
+	/**
+	* When true, realtime notifications are deferred until after the
+	* wrapping transaction commits.  Set by `withAuth` → `withTransaction`.
+	*/
+	_deferNotifications = false;
+	_pendingNotifications = [];
+	constructor(db, realtimeService, registry, user, poolManager, historyService) {
+		this.db = db;
+		this.registry = registry;
+		this.poolManager = poolManager;
+		this.dataService = new DataService(db, registry);
+		this.realtimeService = realtimeService;
+		this.historyService = historyService;
+		this.user = user;
+		this.data = buildSdkData(this);
+		if (poolManager) this.branchService = new BranchService(db, poolManager);
 	}
 	/**
-	* Delete many rows in one transaction, running the full delete pipeline —
-	* `beforeDelete`, the delete, `afterDelete` — for each.
+	* Typed admin capabilities (SQLAdmin + SchemaAdmin + BranchAdmin).
+	* Implemented as a getter so method references are resolved at call-time,
+	* allowing test spies applied after construction to take effect.
+	*/
+	get admin() {
+		return {
+			executeSql: (...args) => this.executeSql(...args),
+			fetchAvailableDatabases: () => this.fetchAvailableDatabases(),
+			fetchAvailableRoles: () => this.fetchAvailableRoles(),
+			fetchApplicationRoles: () => this.fetchApplicationRoles(),
+			fetchCurrentDatabase: () => this.fetchCurrentDatabase(),
+			fetchUnmappedTables: (...args) => this.fetchUnmappedTables(...args),
+			fetchTableMetadata: (...args) => this.fetchTableMetadata(...args),
+			planSchemaChange: async (before, after, options) => generateSchemaCommit({
+				before,
+				after,
+				paths: options?.paths,
+				existing: await readSchemaFactsFor(this.schemaFactsQueryable(), after)
+			}),
+			...this.branchService ? {
+				createBranch: this.branchService.createBranch.bind(this.branchService),
+				deleteBranch: this.branchService.deleteBranch.bind(this.branchService),
+				listBranches: this.branchService.listBranches.bind(this.branchService),
+				getBranchInfo: this.branchService.getBranchInfo.bind(this.branchService)
+			} : {}
+		};
+	}
+	/**
+	* The catalogue-reading shim the schema planner wants.
 	*
-	* Looping the single-row {@link delete} rather than emitting one
-	* `DELETE ... WHERE id = ANY($1)` is the deliberate choice: a single
-	* statement would be faster and would skip every callback, so a collection
-	* relying on `beforeDelete` to veto or on `afterDelete` to clean up
-	* dependents would behave differently depending on how many rows the caller
-	* happened to delete at once. Same pipeline, one transaction.
+	* Text in, rows out — every statement it issues is a catalogue read keyed by
+	* schema name, and schema names are identifiers rather than bindable values,
+	* so there is nothing to parameterise. Runs on the driver's own handle, which
+	* is the connection whose privileges are already known to work.
 	*/
-	async deleteMany({ path, ids, collection }) {
-		await this.db.transaction(async (tx) => {
-			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-			txDriver.dataService = new DataService(tx, this.registry);
-			txDriver.client = this.client;
-			txDriver._deferNotifications = this._deferNotifications;
-			txDriver._pendingNotifications = this._pendingNotifications;
-			for (let i = 0; i < ids.length; i++) {
-				const id = ids[i];
-				try {
-					const existing = await txDriver.fetchOne({
-						path,
-						id: String(id),
-						collection
-					});
-					if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
-						statusCode: 404,
-						code: "NOT_FOUND"
-					});
-					await txDriver.delete({
-						row: {
-							id: String(id),
-							path,
-							values: existing
-						},
-						collection
-					});
-				} catch (error) {
-					throw Object.assign(new Error(`Delete ${i} of ${ids.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
-						statusCode: error?.statusCode,
-						code: error?.code,
-						name: error?.name
-					});
-				}
+	schemaFactsQueryable() {
+		return { query: async (text) => {
+			const result = await this.db.execute(sql.raw(text));
+			return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
+		} };
+	}
+	/**
+	* REST-optimised fetch service (include-aware eager-loading).
+	* Delegates to the underlying FetchService (include-aware eager loading),
+	* then runs the afterRead pipeline on the results. The raw FetchService does
+	* NOT run callbacks, so masking must be applied here — otherwise every
+	* REST/SDK read leaks unmasked data (see {@link applyAfterReadForRest}).
+	*/
+	get restFetchService() {
+		const raw = this.dataService.getFetchService();
+		return {
+			fetchCollectionForRest: async (collectionPath, options, include) => {
+				const rows = await raw.fetchCollectionForRest(collectionPath, options, include);
+				return this.applyAfterReadForRest(rows, collectionPath);
+			},
+			fetchOneForRest: async (collectionPath, id, include, databaseId) => {
+				const row = await raw.fetchOneForRest(collectionPath, id, include, databaseId);
+				if (!row) return row;
+				const [masked] = await this.applyAfterReadForRest([row], collectionPath);
+				return masked;
 			}
-		});
+		};
 	}
-	async delete({ row, collection }) {
-		const targetPath = row.path;
-		const targetRow = { ...row.values ?? {} };
-		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, targetPath);
+	/**
+	* Build the context handed to every collection callback.
+	*
+	* Note `data: this.data` — `this` is whichever driver is running the
+	* operation, so the callback's data plane inherits that driver's privilege.
+	* On a user request `AuthenticatedPostgresBackendDriver.withTransaction`
+	* constructs a fresh base driver bound to the RLS-scoped transaction and
+	* runs the operation on it, so `this.data` speaks through that connection
+	* and policies apply. On server-context work `this` is the base driver on
+	* the owner connection, and they do not. Pinned by the
+	* `"scopes context.data to the caller"` case in the `rls-enforcement` e2e
+	* suite, because it is the kind of property that is easy to break from a
+	* distance and impossible to notice.
+	*
+	* Previously returned through `as unknown as RebaseCallContext`, which
+	* disabled checking for the whole object and let `driver` — documented in
+	* the callbacks guide — sit on the runtime context while absent from the
+	* contract. Both are declared now, so this is a plain typed return.
+	*/
+	buildCallContext() {
+		return {
+			user: this.user,
+			driver: this,
+			data: this.data,
+			client: this.client,
+			storageSource: this.client?.storage
+		};
+	}
+	resolveCollectionCallbacks(collection, path) {
+		if (!collection && !path) return {
+			collection: void 0,
+			callbacks: void 0,
+			globalCallbacks: void 0,
+			propertyCallbacks: void 0
+		};
+		const registryCollection = this.registry?.getCollectionByPath(path);
+		const resolvedCollection = registryCollection ? {
+			...collection,
+			...registryCollection
+		} : collection;
+		const callbacks = resolvedCollection?.callbacks;
+		const globalCallbacks = this.registry?.getGlobalCallbacks();
+		const properties = resolvedCollection?.properties;
+		let propertyCallbacks;
+		if (properties) propertyCallbacks = buildPropertyCallbacks(properties);
+		return {
+			collection: resolvedCollection,
+			callbacks,
+			globalCallbacks,
+			propertyCallbacks
+		};
+	}
+	/**
+	* Run the three-tier afterRead pipeline (global → collection → property) on a
+	* single row for a collection whose callbacks have already been resolved.
+	*/
+	async applyAfterReadToRow(row, path, resolved, contextForCallback) {
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = resolved;
+		let out = row;
+		if (globalCallbacks?.afterRead) out = await globalCallbacks.afterRead({
+			collection: resolvedCollection,
+			path,
+			row: out,
+			context: contextForCallback
+		}) ?? out;
+		if (callbacks?.afterRead) out = await callbacks.afterRead({
+			collection: resolvedCollection,
+			path,
+			row: out,
+			context: contextForCallback
+		}) ?? out;
+		if (propertyCallbacks?.afterRead) out = await propertyCallbacks.afterRead({
+			collection: resolvedCollection,
+			path,
+			row: out,
+			context: contextForCallback
+		}) ?? out;
+		return out;
+	}
+	static hasAfterRead(resolved) {
+		return !!(resolved.globalCallbacks?.afterRead || resolved.callbacks?.afterRead || resolved.propertyCallbacks?.afterRead);
+	}
+	/**
+	* Apply afterRead to REST/SDK read results.
+	*
+	* The REST / `include` path fetches rows through the raw fetch service, which
+	* does NOT run callbacks — so without this, `afterRead` transforms (e.g. PII
+	* masking) are silently skipped on every SDK/REST read, leaking raw data.
+	* This choke point guarantees afterRead runs there too, matching the driver's
+	* fetchCollection/fetchOne paths.
+	*
+	* It also masks embedded relation data one level deep by running the TARGET
+	* collection's afterRead (so `post.author.email` is masked by the authors
+	* collection, not left raw).
+	*/
+	async applyAfterReadForRest(rows, path) {
+		if (!rows || rows.length === 0) return rows;
+		const resolved = this.resolveCollectionCallbacks(void 0, path);
 		const contextForCallback = this.buildCallContext();
-		if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
-			let preventDefault = false;
-			if (globalCallbacks?.beforeDelete) {
-				if (await globalCallbacks.beforeDelete({
-					collection: resolvedCollection,
+		const hasOwn = PostgresBackendDriver.hasAfterRead(resolved);
+		const relationTargets = {};
+		if (resolved.collection) try {
+			const rels = resolveCollectionRelations(resolved.collection);
+			for (const [key, rel] of Object.entries(rels)) {
+				const targetPath = (typeof rel.target === "function" ? rel.target() : void 0)?.slug;
+				if (!targetPath) continue;
+				const targetResolved = this.resolveCollectionCallbacks(void 0, targetPath);
+				if (PostgresBackendDriver.hasAfterRead(targetResolved)) relationTargets[key] = {
 					path: targetPath,
-					id: row.id,
-					row: targetRow,
-					context: contextForCallback
-				}) === false) preventDefault = true;
+					resolved: targetResolved
+				};
 			}
-			if (callbacks?.beforeDelete) {
-				if (await callbacks.beforeDelete({
+		} catch {}
+		const relKeys = Object.keys(relationTargets);
+		if (!hasOwn && relKeys.length === 0) return rows;
+		const maskEmbedded = async (value, target) => {
+			if (Array.isArray(value)) return Promise.all(value.map((v) => maskEmbedded(v, target)));
+			if (!value || typeof value !== "object") return value;
+			const obj = value;
+			if (obj.__type === "relation" && obj.data && typeof obj.data === "object") return {
+				...obj,
+				data: await this.applyAfterReadToRow(obj.data, target.path, target.resolved, contextForCallback)
+			};
+			if (obj.__type === "reference") return obj;
+			return this.applyAfterReadToRow(obj, target.path, target.resolved, contextForCallback);
+		};
+		return Promise.all(rows.map(async (row) => {
+			let out = hasOwn ? await this.applyAfterReadToRow(row, path, resolved, contextForCallback) : row;
+			for (const key of relKeys) {
+				if (out[key] === void 0 || out[key] === null) continue;
+				out = {
+					...out,
+					[key]: await maskEmbedded(out[key], relationTargets[key])
+				};
+			}
+			return out;
+		}));
+	}
+	async fetchCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, vectorSearch }) {
+		const rows = await this.dataService.fetchCollection(path, {
+			filter,
+			orderBy,
+			order,
+			limit,
+			offset,
+			startAfter,
+			databaseId: collection?.databaseId,
+			searchString,
+			vectorSearch
+		});
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
+		if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
+			const contextForCallback = this.buildCallContext();
+			return Promise.all(rows.map(async (row) => {
+				let fetched = row;
+				if (globalCallbacks?.afterRead) fetched = await globalCallbacks.afterRead({
 					collection: resolvedCollection,
-					path: targetPath,
-					id: row.id,
-					row: targetRow,
+					path,
+					row: fetched,
 					context: contextForCallback
-				}) === false) preventDefault = true;
-			}
-			if (propertyCallbacks?.beforeDelete) {
-				if (await propertyCallbacks.beforeDelete({
+				});
+				if (callbacks?.afterRead) fetched = await callbacks.afterRead({
 					collection: resolvedCollection,
-					path: targetPath,
-					id: row.id,
-					row: targetRow,
+					path,
+					row: fetched,
 					context: contextForCallback
-				}) === false) preventDefault = true;
-			}
-			if (preventDefault) return;
+				}) ?? fetched;
+				if (propertyCallbacks?.afterRead) fetched = await propertyCallbacks.afterRead({
+					collection: resolvedCollection,
+					path,
+					row: fetched,
+					context: contextForCallback
+				});
+				return fetched;
+			}));
 		}
-		await this.dataService.delete(targetPath, row.id, resolvedCollection?.databaseId);
-		if (globalCallbacks?.afterDelete || callbacks?.afterDelete || propertyCallbacks?.afterDelete) {
-			if (globalCallbacks?.afterDelete) await globalCallbacks.afterDelete({
+		return rows;
+	}
+	listenCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, onUpdate, onError }) {
+		const subscriptionId = this.generateSubscriptionId();
+		const callbackWrapper = (rows) => {
+			onUpdate(rows);
+		};
+		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
+			clientId: "driver",
+			type: "collection",
+			path,
+			collectionRequest: {
+				filter,
+				orderBy,
+				order,
+				limit,
+				offset,
+				startAfter,
+				databaseId: collection?.databaseId,
+				searchString
+			}
+		});
+		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
+		this.fetchCollection({
+			path,
+			collection,
+			filter,
+			limit,
+			offset,
+			startAfter,
+			orderBy,
+			searchString,
+			order
+		}).then((rows) => {
+			callbackWrapper(rows);
+		}).catch((error) => {
+			if (onError) onError(error);
+		});
+		return () => {
+			this.realtimeService.removeSubscriptionCallback(subscriptionId);
+			this.realtimeService.subscriptions.delete(subscriptionId);
+		};
+	}
+	async fetchOne({ path, id, databaseId, collection }) {
+		let row = await this.dataService.fetchOne(path, id, databaseId || collection?.databaseId);
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
+		if (row && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
+			const contextForCallback = this.buildCallContext();
+			if (globalCallbacks?.afterRead) row = await globalCallbacks.afterRead({
 				collection: resolvedCollection,
-				path: targetPath,
-				id: row.id,
-				row: targetRow,
+				path,
+				row,
 				context: contextForCallback
 			});
-			if (callbacks?.afterDelete) await callbacks.afterDelete({
+			if (callbacks?.afterRead) row = await callbacks.afterRead({
 				collection: resolvedCollection,
-				path: targetPath,
-				id: row.id,
-				row: targetRow,
+				path,
+				row,
 				context: contextForCallback
-			});
-			if (propertyCallbacks?.afterDelete) await propertyCallbacks.afterDelete({
+			}) ?? row;
+			if (propertyCallbacks?.afterRead) row = await propertyCallbacks.afterRead({
 				collection: resolvedCollection,
-				path: targetPath,
-				id: row.id,
-				row: targetRow,
+				path,
+				row,
 				context: contextForCallback
 			});
 		}
-		if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
-			tableName: targetPath,
-			id: row.id.toString(),
-			action: "delete",
-			values: row.values ?? {},
-			updatedBy: this.user?.uid
-		});
-		if (this._deferNotifications) this._pendingNotifications.push({
-			path: targetPath,
-			id: row.id.toString(),
-			row: null,
-			databaseId: resolvedCollection?.databaseId
-		});
-		else await this.realtimeService.notifyUpdate(targetPath, row.id.toString(), null, resolvedCollection?.databaseId);
-	}
-	async deleteAll(path) {
-		await this.dataService.deleteAll(path);
-		await this.realtimeService.notifyUpdate(path, "*", null);
-	}
-	async checkUniqueField(path, name, value, id, collection) {
-		return this.dataService.checkUniqueField(path, name, value, id, collection?.databaseId);
+		return row;
 	}
-	async count({ path, collection, filter, logical, searchString, vectorSearch }) {
-		return this.dataService.count(path, {
-			filter,
-			logical,
-			searchString,
-			vectorSearch
+	listenOne({ path, id, collection, onUpdate, onError }) {
+		const subscriptionId = this.generateSubscriptionId();
+		const callbackWrapper = (row) => {
+			if (row) onUpdate(row);
+		};
+		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
+			clientId: "driver",
+			type: "single",
+			path,
+			id
 		});
+		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
+		this.fetchOne({
+			path,
+			id,
+			collection
+		}).then((row) => {
+			if (row) onUpdate(row);
+		}).catch((error) => {
+			if (onError) onError(error);
+		});
+		return () => {
+			this.realtimeService.removeSubscriptionCallback(subscriptionId);
+			this.realtimeService.subscriptions.delete(subscriptionId);
+		};
 	}
-	getTargetDb(databaseName) {
-		if (!databaseName || databaseName === this.poolManager?.defaultDatabaseName) return this.db;
-		if (!this.poolManager) throw new Error("Cross-database execution requires adminConnectionString to be configured in the backend.");
-		return this.poolManager.getDrizzle(databaseName);
-	}
-	async executeSql(sqlText, options) {
-		if (!options?.database && !options?.role) return this.dataService.executeSql(sqlText, options?.params);
-		const targetDb = this.getTargetDb(options?.database);
-		try {
-			let needsRoleSwitch = false;
-			if (options?.role && process.env.DISABLE_DB_ROLE_SWITCHING !== "true" && !this._roleSwitchingDisabled) try {
-				const currentRole = ((await targetDb.execute(sql.raw("SELECT current_user AS role"))).rows?.[0])?.role;
-				needsRoleSwitch = !!currentRole && currentRole !== options.role;
-			} catch {
-				needsRoleSwitch = true;
+	async save({ path, id, values, collection, status, upsert }) {
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
+		let updatedValues = values;
+		const contextForCallback = this.buildCallContext();
+		let previousValuesForHistory;
+		if (status === "existing" && id) try {
+			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
+			if (existing) {
+				const { id: _existingId, ...existingValues } = existing;
+				previousValuesForHistory = existingValues;
 			}
-			if (needsRoleSwitch && options?.role) {
-				const safeRole = options.role.replace(/"/g, "\"\"");
-				try {
-					return await targetDb.transaction(async (tx) => {
-						await tx.execute(sql.raw(`SET LOCAL ROLE "${safeRole}"`));
-						let result;
-						if (options?.params && options.params.length > 0) {
-							const parts = sqlText.split(/\$(\d+)/);
-							const chunks = [];
-							for (let i = 0; i < parts.length; i++) if (i % 2 === 0) {
-								if (parts[i].length > 0) chunks.push(sql.raw(parts[i]));
-							} else chunks.push(sql.param(options.params[Number(parts[i]) - 1]));
-							result = await tx.execute(sql.join(chunks, sql.raw("")));
-						} else result = await tx.execute(sql.raw(sqlText));
-						return result.rows;
-					});
-				} catch (roleError) {
-					if (isRoleSwitchingPermissionError(roleError)) {
-						logger.warn(`[PostgresBackendDriver] SET LOCAL ROLE "${safeRole}" failed — the connection user lacks permission. Falling back to executing without role switching. To suppress this warning, set DISABLE_DB_ROLE_SWITCHING=true in your .env file.`);
-						this._roleSwitchingDisabled = true;
-					} else throw roleError;
-				}
+		} catch (err) {
+			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
+		}
+		if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
+			if (globalCallbacks?.beforeSave) {
+				const result = await globalCallbacks.beforeSave({
+					collection: resolvedCollection,
+					path,
+					id,
+					values: updatedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+				if (result) updatedValues = mergeDeep(updatedValues, result);
 			}
-			let result;
-			if (options?.params && options.params.length > 0) {
-				const parts = sqlText.split(/\$(\d+)/);
-				const chunks = [];
-				for (let i = 0; i < parts.length; i++) if (i % 2 === 0) {
-					if (parts[i].length > 0) chunks.push(sql.raw(parts[i]));
-				} else chunks.push(sql.param(options.params[Number(parts[i]) - 1]));
-				result = await targetDb.execute(sql.join(chunks, sql.raw("")));
-			} else result = await targetDb.execute(sql.raw(sqlText));
-			return result.rows;
-		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
-			if (msg.includes("pg_hba.conf") || msg.includes("no encryption") || msg.includes("connection refused")) {
-				const dbName = options?.database || "unknown";
-				throw new Error(`Cannot connect to database "${dbName}": the server rejected the connection. This database may require SSL or is not accessible from this host.`);
+			if (callbacks?.beforeSave) {
+				const result = await callbacks.beforeSave({
+					collection: resolvedCollection,
+					path,
+					id,
+					values: updatedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+				if (result) updatedValues = mergeDeep(updatedValues, result);
 			}
-			throw error;
-		}
-	}
-	async fetchAvailableDatabases() {
-		const databases = (await this.executeSql(`SELECT datname FROM pg_database 
-             WHERE datistemplate = false 
-             AND datname NOT IN ('postgres', 'cloudsqladmin', '_cloudsqladmin')
-             ORDER BY datname;`)).map((r) => r.datname);
-		const currentDb = this.poolManager?.defaultDatabaseName;
-		if (currentDb && !databases.includes(currentDb)) databases.unshift(currentDb);
-		else if (currentDb) {
-			const idx = databases.indexOf(currentDb);
-			if (idx > 0) {
-				databases.splice(idx, 1);
-				databases.unshift(currentDb);
+			if (propertyCallbacks?.beforeSave) {
+				const result = await propertyCallbacks.beforeSave({
+					collection: resolvedCollection,
+					path,
+					id,
+					values: updatedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+				if (result) updatedValues = mergeDeep(updatedValues, result);
 			}
 		}
-		return databases;
-	}
-	async fetchAvailableRoles() {
-		return (await this.executeSql("SELECT rolname FROM pg_roles WHERE pg_has_role(current_user, rolname, 'member') ORDER BY rolname;")).map((r) => r.rolname);
-	}
-	/**
-	* Application-level roles actually in use in this project.
-	*
-	* Distinct from {@link fetchAvailableRoles}, which returns native
-	* PostgreSQL roles from `pg_roles` (`postgres`, `rebase_user`, …). Those
-	* are the roles the SQL editor can `SET ROLE` to. *These* are the strings
-	* held in the users table's `roles` column, injected per-transaction as
-	* `rebase.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
-	* into a `SecurityRule.roles` field produces a condition no user can ever
-	* satisfy, so the two must not be conflated.
-	*
-	* Roles have no registry table — they were migrated out of
-	* `rebase.user_roles` onto an inline `roles TEXT[]` column — so the live
-	* set is derived from what is assigned. A role that is declared in a policy
-	* but held by nobody yet cannot be discovered here; callers that need it
-	* should union in the roles they already know about.
-	*/
-	async fetchApplicationRoles() {
-		const located = await this.executeSql(`
-            SELECT table_schema, table_name
-            FROM information_schema.columns
-            WHERE column_name = 'roles'
-              AND data_type = 'ARRAY'
-              AND table_name = 'users'
-              AND table_schema NOT IN ('information_schema', 'pg_catalog')
-            ORDER BY (table_schema = 'rebase') DESC, table_schema
-            LIMIT 1;
-        `);
-		if (located.length === 0) return [];
-		const schema = located[0].table_schema;
-		const table = located[0].table_name;
-		const qualified = `"${schema.replace(/"/g, "\"\"")}"."${table.replace(/"/g, "\"\"")}"`;
-		return (await this.executeSql(`
-            SELECT DISTINCT unnest(roles) AS role
-            FROM ${qualified}
-            WHERE roles IS NOT NULL
-            ORDER BY role;
-        `)).map((r) => r.role).filter((r) => typeof r === "string" && r.length > 0);
-	}
-	async fetchCurrentDatabase() {
-		return this.poolManager?.defaultDatabaseName;
-	}
-	/**
-	* Fetch public tables that are not yet mapped to a collection.
-	* Excludes internal tables (_rebase_*, _auth_*, auth tables, etc.)
-	* and junction/connection tables used for many-to-many relations.
-	*/
-	async fetchUnmappedTables(mappedPaths) {
-		const allTables = (await this.executeSql(`
-            SELECT table_name
-            FROM information_schema.tables
-            WHERE table_schema = 'public'
-              AND table_type = 'BASE TABLE'
-            ORDER BY table_name;
-        `)).map((r) => r.table_name).filter((name) => classifyTable(name, "public") !== "rebase-internal");
-		let junctionTables = /* @__PURE__ */ new Set();
+		if (resolvedCollection?.properties) updatedValues = updateDateAutoValues({
+			inputValues: updatedValues,
+			properties: resolvedCollection.properties,
+			status: status ?? "new",
+			timestampNowValue: /* @__PURE__ */ new Date()
+		});
 		try {
-			junctionTables = await detectJunctionTables(this.executeSql.bind(this));
-		} catch (e) {
-			logger.warn("Could not detect junction tables", { error: e });
-		}
-		const filteredTables = allTables.filter((name) => !junctionTables.has(name));
-		if (!mappedPaths || mappedPaths.length === 0) return filteredTables;
-		const mappedSet = new Set(mappedPaths.map((p) => p.toLowerCase()));
-		return filteredTables.filter((name) => !mappedSet.has(name.toLowerCase()));
-	}
-	/**
-	* Fetch metadata for a given table from information_schema (columns, policies, constraints).
-	*/
-	async fetchTableMetadata(tableName) {
-		const safeName = tableName.replace(/[^a-zA-Z0-9_]/g, "");
-		const columns = (await this.db.execute(sql`
-            SELECT column_name, data_type, udt_name, is_nullable, column_default, character_maximum_length
-            FROM information_schema.columns
-            WHERE table_schema = 'public'
-              AND table_name = ${safeName}
-            ORDER BY ordinal_position
-        `)).rows;
-		const enumColumns = columns.filter((c) => c.data_type === "USER-DEFINED");
-		if (enumColumns.length > 0) for (const col of enumColumns) try {
-			col.enum_values = (await this.db.execute(sql`
-                        SELECT e.enumlabel
-                        FROM pg_type t
-                        JOIN pg_enum e ON t.oid = e.enumtypid
-                        WHERE t.typname = ${col.udt_name}
-                        ORDER BY e.enumsortorder
-                    `)).rows.map((e) => e.enumlabel);
-		} catch {
-			col.enum_values = [];
+			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, { upsert });
+			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
+				if (globalCallbacks?.afterRead) savedRow = await globalCallbacks.afterRead({
+					collection: resolvedCollection,
+					path,
+					row: savedRow,
+					context: contextForCallback
+				});
+				if (callbacks?.afterRead) savedRow = await callbacks.afterRead({
+					collection: resolvedCollection,
+					path,
+					row: savedRow,
+					context: contextForCallback
+				}) ?? savedRow;
+				if (propertyCallbacks?.afterRead) savedRow = await propertyCallbacks.afterRead({
+					collection: resolvedCollection,
+					path,
+					row: savedRow,
+					context: contextForCallback
+				});
+			}
+			const savedId = deriveRowAddress(savedRow, resolvedCollection ?? collection, this.registry);
+			const savedValues = savedRow;
+			if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
+				if (globalCallbacks?.afterSave) await globalCallbacks.afterSave({
+					collection: resolvedCollection,
+					path,
+					id: savedId,
+					values: savedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+				if (callbacks?.afterSave) await callbacks.afterSave({
+					collection: resolvedCollection,
+					path,
+					id: savedId,
+					values: savedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+				if (propertyCallbacks?.afterSave) await propertyCallbacks.afterSave({
+					collection: resolvedCollection,
+					path,
+					id: savedId,
+					values: savedValues,
+					previousValues: previousValuesForHistory,
+					status,
+					context: contextForCallback
+				});
+			}
+			if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
+				tableName: path,
+				id: savedId,
+				action: status === "new" ? "create" : "update",
+				values: savedValues,
+				previousValues: previousValuesForHistory,
+				updatedBy: this.user?.uid
+			});
+			if (this._deferNotifications) this._pendingNotifications.push({
+				path,
+				id: savedId,
+				row: savedRow,
+				databaseId: resolvedCollection?.databaseId
+			});
+			else await this.realtimeService.notifyUpdate(path, savedId, savedRow, resolvedCollection?.databaseId);
+			return savedRow;
+		} catch (error) {
+			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
+				if (globalCallbacks?.afterSaveError) await globalCallbacks.afterSaveError({
+					collection: resolvedCollection,
+					path,
+					id: id || "unknown",
+					values: updatedValues,
+					previousValues: void 0,
+					status,
+					context: contextForCallback
+				});
+				if (callbacks?.afterSaveError) await callbacks.afterSaveError({
+					collection: resolvedCollection,
+					path,
+					id: id || "unknown",
+					values: updatedValues,
+					previousValues: void 0,
+					status,
+					context: contextForCallback
+				});
+				if (propertyCallbacks?.afterSaveError) await propertyCallbacks.afterSaveError({
+					collection: resolvedCollection,
+					path,
+					id: id || "unknown",
+					values: updatedValues,
+					previousValues: void 0,
+					status,
+					context: contextForCallback
+				});
+			}
+			throw error;
 		}
-		return {
-			columns,
-			foreignKeys: (await this.db.execute(sql`
-            SELECT
-                kcu.column_name as column_name,
-                ccu.table_name AS foreign_table_name,
-                ccu.column_name AS foreign_column_name
-            FROM 
-                information_schema.table_constraints AS tc 
-                JOIN information_schema.key_column_usage AS kcu
-                  ON tc.constraint_name = kcu.constraint_name
-                  AND tc.table_schema = kcu.table_schema
-                JOIN information_schema.constraint_column_usage AS ccu
-                  ON ccu.constraint_name = tc.constraint_name
-                  AND ccu.table_schema = tc.table_schema
-            WHERE tc.constraint_type = 'FOREIGN KEY' AND tc.table_name = ${safeName};
-        `)).rows,
-			junctions: (await this.db.execute(sql`
-            SELECT 
-                tc1.table_name as junction_table_name,
-                kcu1.column_name as source_column_name,
-                ccu2.table_name as target_table_name,
-                kcu2.column_name as target_column_name
-            FROM information_schema.table_constraints tc1
-            JOIN information_schema.key_column_usage kcu1 ON tc1.constraint_name = kcu1.constraint_name
-            JOIN information_schema.constraint_column_usage ccu1 ON ccu1.constraint_name = tc1.constraint_name
-            JOIN information_schema.table_constraints tc2 ON tc1.table_name = tc2.table_name AND tc2.constraint_type = 'FOREIGN KEY'
-            JOIN information_schema.key_column_usage kcu2 ON tc2.constraint_name = kcu2.constraint_name
-            JOIN information_schema.constraint_column_usage ccu2 ON ccu2.constraint_name = tc2.constraint_name
-            WHERE tc1.constraint_type = 'FOREIGN KEY' 
-              AND ccu1.table_name = ${safeName}
-              AND ccu2.table_name != ${safeName};
-        `)).rows,
-			policies: (await this.db.execute(sql`
-            SELECT 
-                polname as policy_name, 
-                polcmd as cmd, 
-                polroles::regrole[]::text[] as roles, 
-                pg_get_expr(polqual, polrelid) as qual, 
-                pg_get_expr(polwithcheck, polrelid) as with_check
-            FROM pg_policy
-            WHERE polrelid = (SELECT oid FROM pg_class WHERE relname = ${safeName} AND relnamespace = 'public'::regnamespace);
-        `)).rows
-		};
-	}
-	generateSubscriptionId() {
-		return `sub_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 	}
 	/**
-	* Create a new delegate instance with authenticated context.
-	* Starts a transaction and sets the current_user_id and current_user_roles
-	* configuration parameters for PostgreSQL Row Level Security.
+	* Write many rows through the same pipeline as {@link save}.
+	*
+	* The batch runs in one transaction of its own, so a failure part-way leaves
+	* nothing behind — the point of a batch is that a re-run starts from a known
+	* state. When this driver is already inside a transaction (the authenticated
+	* path, via `withTransaction`) the nested call becomes a savepoint, which is
+	* still atomic and still commits once.
+	*
+	* Rows are applied in order, so a batch that touches the same key twice ends
+	* with the last write winning, exactly as separate calls would.
 	*/
-	async withAuth(user) {
-		return new AuthenticatedPostgresBackendDriver(this, user);
-	}
-};
-var AuthenticatedPostgresBackendDriver = class {
-	delegate;
-	key = "postgres";
-	initialised = true;
-	user;
-	data;
-	constructor(delegate, user) {
-		this.delegate = delegate;
-		this.user = user;
-		this.data = buildSdkData(this);
-		this.admin = delegate.admin;
+	async saveMany({ path, rows, collection, upsert }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < rows.length; i++) {
+				const values = rows[i];
+				const id = values?.id;
+				try {
+					saved.push(await txDriver.save({
+						path,
+						values,
+						collection,
+						status: "new",
+						upsert
+					}));
+				} catch (error) {
+					const label = id !== void 0 ? `id ${JSON.stringify(id)}` : "no id";
+					throw Object.assign(new Error(`Row ${i} of ${rows.length} (${label}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return saved;
+		});
 	}
 	/**
-	* Typed admin capabilities — delegates to the base driver.
+	* Update many rows through the same pipeline as {@link save}, in one
+	* transaction.
+	*
+	* Structurally the mirror of {@link saveMany} — same tx-bound sub-driver,
+	* same deferred notifications, same per-row error labelling — but it calls
+	* `save` with an explicit `id` and `status: "existing"`, which is precisely
+	* what `saveMany` cannot do: that one passes `status: "new"` and keeps the
+	* key inside `values`, so it inserts or upserts and can never target a
+	* particular row.
+	*
+	* All-or-nothing, so an id matching no row aborts the batch. A partial
+	* update is the outcome with no good recovery: the caller cannot tell which
+	* half landed without re-reading everything.
 	*/
-	admin;
-	get restFetchService() {
-		return {
-			fetchCollectionForRest: async (collectionPath, options, include) => {
-				return this.withTransaction(async (delegate) => {
-					return delegate.restFetchService.fetchCollectionForRest(collectionPath, options, include);
-				}, { accessMode: "read only" });
-			},
-			fetchOneForRest: async (collectionPath, id, include, databaseId) => {
-				return this.withTransaction(async (delegate) => {
-					return delegate.restFetchService.fetchOneForRest(collectionPath, id, include, databaseId);
-				}, { accessMode: "read only" });
-			}
-		};
-	}
-	async withTransaction(operation, options) {
-		const pendingNotifications = [];
-		const result = await this.delegate.db.transaction(async (tx) => {
-			let uid = this.user?.uid;
-			if (!uid) {
-				logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
-				uid = "anonymous";
+	async updateMany({ path, updates, collection }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < updates.length; i++) {
+				const { id, values } = updates[i];
+				try {
+					if (!await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					saved.push(await txDriver.save({
+						path,
+						id: String(id),
+						values,
+						collection,
+						status: "existing"
+					}));
+				} catch (error) {
+					throw Object.assign(new Error(`Update ${i} of ${updates.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
 			}
-			const userRoles = this.user?.roles ?? [];
-			if (!this.user?.roles) logger.warn("[DataDriver] User roles are missing for authenticated delegate. Using empty array. User object", { detail: this.user });
-			await applyAuthContext(tx, {
-				uid,
-				roles: userRoles
-			}, this.delegate.rlsUserRole);
-			const txEntityService = new DataService(tx, this.delegate.registry);
-			const txDelegate = new PostgresBackendDriver(tx, this.delegate.realtimeService, this.delegate.registry, this.user, this.delegate.poolManager, this.delegate.historyService);
-			txDelegate.dataService = txEntityService;
-			txDelegate._deferNotifications = true;
-			txDelegate._pendingNotifications = pendingNotifications;
-			txDelegate.client = this.delegate.client;
-			return await operation(txDelegate);
-		}, options);
-		for (const notification of pendingNotifications) try {
-			await this.delegate.realtimeService.notifyUpdate(notification.path, notification.id, notification.row, notification.databaseId);
-		} catch (e) {
-			logger.error("[DataDriver] Error flushing deferred notification", { error: e });
-		}
-		return result;
-	}
-	async fetchCollection(props) {
-		return this.withTransaction((delegate) => delegate.fetchCollection(props), { accessMode: "read only" });
-	}
-	/**
-	* Injects the authenticated user's context into the most recently
-	* registered realtime subscription so RLS-aware polling can apply.
-	*/
-	injectAuthContext(unsubscribe) {
-		const authContext = {
-			uid: this.user?.uid || "anonymous",
-			roles: this.user?.roles ?? []
-		};
-		const entries = Array.from(this.delegate.realtimeService.subscriptions.entries());
-		const lastSub = entries[entries.length - 1]?.[1];
-		if (lastSub && lastSub.clientId === "driver") lastSub.authContext = authContext;
-		return unsubscribe;
-	}
-	listenCollection(props) {
-		return this.injectAuthContext(this.delegate.listenCollection(props));
-	}
-	async fetchOne(props) {
-		return this.withTransaction((delegate) => delegate.fetchOne(props), { accessMode: "read only" });
-	}
-	listenOne(props) {
-		return this.injectAuthContext(this.delegate.listenOne(props));
-	}
-	async save(props) {
-		return this.withTransaction((delegate) => delegate.save(props));
+			return saved;
+		});
 	}
 	/**
-	* One transaction for the whole batch, rather than one per row.
+	* Delete many rows in one transaction, running the full delete pipeline —
+	* `beforeDelete`, the delete, `afterDelete` — for each.
 	*
-	* This is the point of the method: `save` opens a transaction per call, so
-	* importing 10k rows through it means 10k transactions (and, over HTTP, 10k
-	* round trips). Here the RLS context is established once and every row lands
-	* or none does. Realtime notifications are already deferred to commit by
-	* `withTransaction`, so a batch does not flood subscribers mid-flight.
+	* Looping the single-row {@link delete} rather than emitting one
+	* `DELETE ... WHERE id = ANY($1)` is the deliberate choice: a single
+	* statement would be faster and would skip every callback, so a collection
+	* relying on `beforeDelete` to veto or on `afterDelete` to clean up
+	* dependents would behave differently depending on how many rows the caller
+	* happened to delete at once. Same pipeline, one transaction.
 	*/
-	async saveMany(props) {
-		return this.withTransaction((delegate) => delegate.saveMany(props));
+	async deleteMany({ path, ids, collection }) {
+		await this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			for (let i = 0; i < ids.length; i++) {
+				const id = ids[i];
+				try {
+					const existing = await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					});
+					if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					await txDriver.delete({
+						row: {
+							id: String(id),
+							path,
+							values: existing
+						},
+						collection
+					});
+				} catch (error) {
+					throw Object.assign(new Error(`Delete ${i} of ${ids.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+		});
 	}
-	async delete(props) {
-		return this.withTransaction((delegate) => delegate.delete(props));
+	async delete({ row, collection }) {
+		const targetPath = row.path;
+		const targetRow = { ...row.values ?? {} };
+		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, targetPath);
+		const contextForCallback = this.buildCallContext();
+		if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
+			let preventDefault = false;
+			if (globalCallbacks?.beforeDelete) {
+				if (await globalCallbacks.beforeDelete({
+					collection: resolvedCollection,
+					path: targetPath,
+					id: row.id,
+					row: targetRow,
+					context: contextForCallback
+				}) === false) preventDefault = true;
+			}
+			if (callbacks?.beforeDelete) {
+				if (await callbacks.beforeDelete({
+					collection: resolvedCollection,
+					path: targetPath,
+					id: row.id,
+					row: targetRow,
+					context: contextForCallback
+				}) === false) preventDefault = true;
+			}
+			if (propertyCallbacks?.beforeDelete) {
+				if (await propertyCallbacks.beforeDelete({
+					collection: resolvedCollection,
+					path: targetPath,
+					id: row.id,
+					row: targetRow,
+					context: contextForCallback
+				}) === false) preventDefault = true;
+			}
+			if (preventDefault) return;
+		}
+		await this.dataService.delete(targetPath, row.id, resolvedCollection?.databaseId);
+		if (globalCallbacks?.afterDelete || callbacks?.afterDelete || propertyCallbacks?.afterDelete) {
+			if (globalCallbacks?.afterDelete) await globalCallbacks.afterDelete({
+				collection: resolvedCollection,
+				path: targetPath,
+				id: row.id,
+				row: targetRow,
+				context: contextForCallback
+			});
+			if (callbacks?.afterDelete) await callbacks.afterDelete({
+				collection: resolvedCollection,
+				path: targetPath,
+				id: row.id,
+				row: targetRow,
+				context: contextForCallback
+			});
+			if (propertyCallbacks?.afterDelete) await propertyCallbacks.afterDelete({
+				collection: resolvedCollection,
+				path: targetPath,
+				id: row.id,
+				row: targetRow,
+				context: contextForCallback
+			});
+		}
+		if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
+			tableName: targetPath,
+			id: row.id.toString(),
+			action: "delete",
+			values: row.values ?? {},
+			updatedBy: this.user?.uid
+		});
+		if (this._deferNotifications) this._pendingNotifications.push({
+			path: targetPath,
+			id: row.id.toString(),
+			row: null,
+			databaseId: resolvedCollection?.databaseId
+		});
+		else await this.realtimeService.notifyUpdate(targetPath, row.id.toString(), null, resolvedCollection?.databaseId);
 	}
 	async deleteAll(path) {
-		return this.withTransaction((delegate) => delegate.deleteAll(path));
+		await this.dataService.deleteAll(path);
+		await this.realtimeService.notifyUpdate(path, "*", null);
 	}
 	async checkUniqueField(path, name, value, id, collection) {
-		return this.withTransaction((delegate) => delegate.checkUniqueField(path, name, value, id, collection), { accessMode: "read only" });
-	}
-	async count(props) {
-		return this.withTransaction((delegate) => delegate.count(props), { accessMode: "read only" });
+		return this.dataService.checkUniqueField(path, name, value, id, collection?.databaseId);
 	}
-};
-//#endregion
-//#region src/databasePoolManager.ts
-var DatabasePoolManager = class {
-	pools = /* @__PURE__ */ new Map();
-	drizzleInstances = /* @__PURE__ */ new Map();
-	defaultDatabaseName;
-	rootConnectionString;
-	constructor(adminConnectionString) {
-		this.rootConnectionString = adminConnectionString;
-		try {
-			const url = new URL(adminConnectionString);
-			this.defaultDatabaseName = url.pathname.slice(1);
-		} catch (e) {
-			throw new Error(`Invalid adminConnectionString provided: ${e}`);
-		}
+	async count({ path, collection, filter, logical, searchString, vectorSearch }) {
+		return this.dataService.count(path, {
+			filter,
+			logical,
+			searchString,
+			vectorSearch
+		});
 	}
-	getDrizzle(databaseName) {
-		const existing = this.drizzleInstances.get(databaseName);
-		if (existing) return existing;
-		const db = drizzle(this.getPool(databaseName));
-		this.drizzleInstances.set(databaseName, db);
-		return db;
+	getTargetDb(databaseName) {
+		if (!databaseName || databaseName === this.poolManager?.defaultDatabaseName) return this.db;
+		if (!this.poolManager) throw new Error("Cross-database execution requires adminConnectionString to be configured in the backend.");
+		return this.poolManager.getDrizzle(databaseName);
 	}
-	getPool(databaseName) {
-		if (this.pools.has(databaseName)) return this.pools.get(databaseName);
-		const url = new URL(this.rootConnectionString);
-		url.pathname = `/${databaseName}`;
-		const pool = new Pool({
-			connectionString: pinSearchPath(url.toString()),
-			max: 10,
-			idleTimeoutMillis: 1e4,
-			allowExitOnIdle: true
-		});
-		pool.on("error", (err) => {
-			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
-		});
-		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
-		this.pools.set(databaseName, pool);
-		return pool;
-	}
-	/**
-	* Disconnect and remove the pool for a specific database.
-	* Required before `CREATE DATABASE ... TEMPLATE` or `DROP DATABASE`,
-	* which need exclusive access to the target database.
-	*/
-	async disconnectDatabase(databaseName) {
-		const pool = this.pools.get(databaseName);
-		if (pool) {
-			await pool.end();
-			this.pools.delete(databaseName);
-			this.drizzleInstances.delete(databaseName);
+	async executeSql(sqlText, options) {
+		if (!options?.database && !options?.role) return this.dataService.executeSql(sqlText, options?.params);
+		const targetDb = this.getTargetDb(options?.database);
+		try {
+			let needsRoleSwitch = false;
+			if (options?.role && process.env.DISABLE_DB_ROLE_SWITCHING !== "true" && !this._roleSwitchingDisabled) try {
+				const currentRole = ((await targetDb.execute(sql.raw("SELECT current_user AS role"))).rows?.[0])?.role;
+				needsRoleSwitch = !!currentRole && currentRole !== options.role;
+			} catch {
+				needsRoleSwitch = true;
+			}
+			if (needsRoleSwitch && options?.role) {
+				const safeRole = options.role.replace(/"/g, "\"\"");
+				try {
+					return await targetDb.transaction(async (tx) => {
+						await tx.execute(sql.raw(`SET LOCAL ROLE "${safeRole}"`));
+						let result;
+						if (options?.params && options.params.length > 0) {
+							const parts = sqlText.split(/\$(\d+)/);
+							const chunks = [];
+							for (let i = 0; i < parts.length; i++) if (i % 2 === 0) {
+								if (parts[i].length > 0) chunks.push(sql.raw(parts[i]));
+							} else chunks.push(sql.param(options.params[Number(parts[i]) - 1]));
+							result = await tx.execute(sql.join(chunks, sql.raw("")));
+						} else result = await tx.execute(sql.raw(sqlText));
+						return result.rows;
+					});
+				} catch (roleError) {
+					if (isRoleSwitchingPermissionError(roleError)) {
+						logger.warn(`[PostgresBackendDriver] SET LOCAL ROLE "${safeRole}" failed — the connection user lacks permission. Falling back to executing without role switching. To suppress this warning, set DISABLE_DB_ROLE_SWITCHING=true in your .env file.`);
+						this._roleSwitchingDisabled = true;
+					} else throw roleError;
+				}
+			}
+			let result;
+			if (options?.params && options.params.length > 0) {
+				const parts = sqlText.split(/\$(\d+)/);
+				const chunks = [];
+				for (let i = 0; i < parts.length; i++) if (i % 2 === 0) {
+					if (parts[i].length > 0) chunks.push(sql.raw(parts[i]));
+				} else chunks.push(sql.param(options.params[Number(parts[i]) - 1]));
+				result = await targetDb.execute(sql.join(chunks, sql.raw("")));
+			} else result = await targetDb.execute(sql.raw(sqlText));
+			return result.rows;
+		} catch (error) {
+			const msg = error instanceof Error ? error.message : String(error);
+			if (msg.includes("pg_hba.conf") || msg.includes("no encryption") || msg.includes("connection refused")) {
+				const dbName = options?.database || "unknown";
+				throw new Error(`Cannot connect to database "${dbName}": the server rejected the connection. This database may require SSL or is not accessible from this host.`);
+			}
+			throw error;
 		}
 	}
-	/** Check if a pool exists for a given database name. */
-	hasPool(databaseName) {
-		return this.pools.has(databaseName);
-	}
-	async shutdown() {
-		const promises = [];
-		for (const [dbName, pool] of this.pools.entries()) {
-			logger.info(`[DatabasePoolManager] Shutting down pool for ${dbName}`);
-			promises.push(pool.end());
+	async fetchAvailableDatabases() {
+		const databases = (await this.executeSql(`SELECT datname FROM pg_database 
+             WHERE datistemplate = false 
+             AND datname NOT IN ('postgres', 'cloudsqladmin', '_cloudsqladmin')
+             ORDER BY datname;`)).map((r) => r.datname);
+		const currentDb = this.poolManager?.defaultDatabaseName;
+		if (currentDb && !databases.includes(currentDb)) databases.unshift(currentDb);
+		else if (currentDb) {
+			const idx = databases.indexOf(currentDb);
+			if (idx > 0) {
+				databases.splice(idx, 1);
+				databases.unshift(currentDb);
+			}
 		}
-		await Promise.all(promises);
-		this.pools.clear();
-		this.drizzleInstances.clear();
+		return databases;
+	}
+	async fetchAvailableRoles() {
+		return (await this.executeSql("SELECT rolname FROM pg_roles WHERE pg_has_role(current_user, rolname, 'member') ORDER BY rolname;")).map((r) => r.rolname);
 	}
-};
-//#endregion
-//#region src/schema/auth-schema.ts
-/**
-* Factory function to dynamically create the auth tables bound to the specified schema names.
-*
-* This module builds queries; it does not create tables. `ensureAuthTablesExist`
-* owns the DDL, which makes everything here a *claim* about a database it cannot
-* enforce — and the claims drifted. Every column below was declared
-* `varchar(n)` while the DDL created it as `TEXT`: `user_agent` as varchar(500),
-* `ip_address` as varchar(45), `secret_encrypted` as varchar(500), every
-* `token_hash` as varchar(255). None of it was true of any database this
-* framework ever provisioned. Harmless at runtime — drizzle does not enforce a
-* length client-side, so the widths only ever misled the next reader — but a
-* schema module that describes columns that do not exist is worse than no
-* schema module. They are `text` here now because they are TEXT there.
-*/
-function createAuthSchema(usersSchemaName = "rebase") {
-	const usersSchema = usersSchemaName === "public" ? null : pgSchema(usersSchemaName);
-	const tableCreator = usersSchema ? usersSchema.table.bind(usersSchema) : pgTable;
-	/**
-	* Users table - stores both email/password and OAuth users
-	*/
-	const users = tableCreator("users", {
-		id: uuid("id").defaultRandom().primaryKey(),
-		email: text("email").notNull().unique(),
-		passwordHash: text("password_hash"),
-		displayName: text("display_name"),
-		photoUrl: text("photo_url"),
-		emailVerified: boolean("email_verified").default(false).notNull(),
-		emailVerificationToken: text("email_verification_token"),
-		emailVerificationSentAt: timestamp("email_verification_sent_at"),
-		isAnonymous: boolean("is_anonymous").default(false).notNull(),
-		roles: text("roles").array().default([]).notNull(),
-		metadata: jsonb("metadata").$type().default({}).notNull(),
-		/**
-		* Sessions that began before this instant are dead, whatever tokens
-		* they still hold. Password resets and admin revocations stamp it.
-		*
-		* Deleting the user's refresh-token rows (which we also do) is not
-		* sufficient on its own: a request already in flight can insert a
-		* freshly rotated row microseconds after the delete and survive it.
-		* This timestamp cannot be outrun that way — it is checked against
-		* `refresh_tokens.session_started_at`, which rotation carries forward.
-		*/
-		tokensValidAfter: timestamp("tokens_valid_after"),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at").defaultNow().notNull()
-	});
 	/**
-	* Refresh tokens for long-lived sessions.
+	* Application-level roles actually in use in this project.
 	*
-	* A row is one token, not one device. Every token minted from the same
-	* sign-in shares a `sessionId`, and rotation ADDS a row rather than
-	* replacing one: the superseded token stays on file, flagged `revoked`
-	* with a `rotatedAt` stamp. That record is what lets the refresh endpoint
-	* tell a client replaying a token it never got an answer for (a response
-	* lost to a redeploy, a second tab racing on boot) apart from a stranger
-	* presenting a token that was never issued. Deleting the old row on sight
-	* — the previous behaviour — made those two cases indistinguishable, and
-	* the legitimate one is overwhelmingly the common one.
+	* Distinct from {@link fetchAvailableRoles}, which returns native
+	* PostgreSQL roles from `pg_roles` (`postgres`, `rebase_user`, …). Those
+	* are the roles the SQL editor can `SET ROLE` to. *These* are the strings
+	* held in the users table's `roles` column, injected per-transaction as
+	* `rebase.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
+	* into a `SecurityRule.roles` field produces a condition no user can ever
+	* satisfy, so the two must not be conflated.
 	*
-	* There is deliberately NO unique constraint on (uid, user_agent,
-	* ip_address). Keying a session on the IP meant one row per "device",
-	* so a second browser profile behind the same NAT silently evicted the
-	* first, and a phone changing networks orphaned a row on every hop.
-	* User agent and IP are descriptive metadata for the sessions list;
-	* `sessionId` is the identity.
-	*/
-	const refreshTokens = tableCreator("refresh_tokens", {
-		id: uuid("id").defaultRandom().primaryKey(),
-		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-		sessionId: uuid("session_id").defaultRandom().notNull(),
-		tokenHash: text("token_hash").notNull().unique(),
-		expiresAt: timestamp("expires_at").notNull(),
-		revoked: boolean("revoked").default(false).notNull(),
-		rotatedAt: timestamp("rotated_at"),
-		/**
-		* When the sign-in this token descends from happened — carried across
-		* every rotation, unlike `createdAt`. `users.tokensValidAfter` is
-		* compared against this, so a revocation cannot be outrun by a token
-		* that rotates immediately after it.
-		*/
-		sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
-		/**
-		* The assurance level the sign-in was established at — `aal2` only
-		* where a second factor was actually presented. Carried across
-		* rotations, because refresh is not a new authentication and has
-		* nothing else to read the level from.
-		*/
-		aal: text("aal"),
-		userAgent: text("user_agent"),
-		ipAddress: text("ip_address"),
-		createdAt: timestamp("created_at").defaultNow().notNull()
-	}, (table) => ({ sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId) }));
-	/**
-	* Password reset tokens for forgot password flow
+	* Roles have no registry table — they were migrated out of
+	* `rebase.user_roles` onto an inline `roles TEXT[]` column — so the live
+	* set is derived from what is assigned. A role that is declared in a policy
+	* but held by nobody yet cannot be discovered here; callers that need it
+	* should union in the roles they already know about.
 	*/
-	const passwordResetTokens = tableCreator("password_reset_tokens", {
-		id: uuid("id").defaultRandom().primaryKey(),
-		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-		tokenHash: text("token_hash").notNull().unique(),
-		expiresAt: timestamp("expires_at").notNull(),
-		usedAt: timestamp("used_at"),
-		createdAt: timestamp("created_at").defaultNow().notNull()
-	});
+	async fetchApplicationRoles() {
+		const located = await this.executeSql(`
+            SELECT table_schema, table_name
+            FROM information_schema.columns
+            WHERE column_name = 'roles'
+              AND data_type = 'ARRAY'
+              AND table_name = 'users'
+              AND table_schema NOT IN ('information_schema', 'pg_catalog')
+            ORDER BY (table_schema = 'rebase') DESC, table_schema
+            LIMIT 1;
+        `);
+		if (located.length === 0) return [];
+		const schema = located[0].table_schema;
+		const table = located[0].table_name;
+		const qualified = `"${schema.replace(/"/g, "\"\"")}"."${table.replace(/"/g, "\"\"")}"`;
+		return (await this.executeSql(`
+            SELECT DISTINCT unnest(roles) AS role
+            FROM ${qualified}
+            WHERE roles IS NOT NULL
+            ORDER BY role;
+        `)).map((r) => r.role).filter((r) => typeof r === "string" && r.length > 0);
+	}
+	async fetchCurrentDatabase() {
+		return this.poolManager?.defaultDatabaseName;
+	}
 	/**
-	* App config - key/value store for custom settings
+	* Fetch public tables that are not yet mapped to a collection.
+	* Excludes internal tables (_rebase_*, _auth_*, auth tables, etc.)
+	* and junction/connection tables used for many-to-many relations.
 	*/
-	const appConfig = tableCreator("app_config", {
-		key: text("key").primaryKey(),
-		value: jsonb("value").notNull(),
-		updatedAt: timestamp("updated_at").defaultNow().notNull()
-	});
+	async fetchUnmappedTables(mappedPaths) {
+		const allTables = (await this.executeSql(`
+            SELECT table_name
+            FROM information_schema.tables
+            WHERE table_schema = 'public'
+              AND table_type = 'BASE TABLE'
+            ORDER BY table_name;
+        `)).map((r) => r.table_name).filter((name) => classifyTable(name, "public") !== "rebase-internal");
+		let junctionTables = /* @__PURE__ */ new Set();
+		try {
+			junctionTables = await detectJunctionTables(this.executeSql.bind(this));
+		} catch (e) {
+			logger.warn("Could not detect junction tables", { error: e });
+		}
+		const filteredTables = allTables.filter((name) => !junctionTables.has(name));
+		if (!mappedPaths || mappedPaths.length === 0) return filteredTables;
+		const mappedSet = new Set(mappedPaths.map((p) => p.toLowerCase()));
+		return filteredTables.filter((name) => !mappedSet.has(name.toLowerCase()));
+	}
 	/**
-	* User identities - maps external OAuth profiles back to local users
+	* Fetch metadata for a given table from information_schema (columns, policies, constraints).
 	*/
-	const userIdentities = tableCreator("user_identities", {
-		id: uuid("id").defaultRandom().primaryKey(),
-		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-		provider: text("provider").notNull(),
-		providerId: text("provider_id").notNull(),
-		profileData: jsonb("profile_data"),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at").defaultNow().notNull()
-	}, (table) => ({ uniqueProviderId: unique("unique_provider_id").on(table.provider, table.providerId) }));
+	async fetchTableMetadata(tableName) {
+		const safeName = tableName.replace(/[^a-zA-Z0-9_]/g, "");
+		const columns = (await this.db.execute(sql`
+            SELECT column_name, data_type, udt_name, is_nullable, column_default, character_maximum_length
+            FROM information_schema.columns
+            WHERE table_schema = 'public'
+              AND table_name = ${safeName}
+            ORDER BY ordinal_position
+        `)).rows;
+		const enumColumns = columns.filter((c) => c.data_type === "USER-DEFINED");
+		if (enumColumns.length > 0) for (const col of enumColumns) try {
+			col.enum_values = (await this.db.execute(sql`
+                        SELECT e.enumlabel
+                        FROM pg_type t
+                        JOIN pg_enum e ON t.oid = e.enumtypid
+                        WHERE t.typname = ${col.udt_name}
+                        ORDER BY e.enumsortorder
+                    `)).rows.map((e) => e.enumlabel);
+		} catch {
+			col.enum_values = [];
+		}
+		return {
+			columns,
+			foreignKeys: (await this.db.execute(sql`
+            SELECT
+                kcu.column_name as column_name,
+                ccu.table_name AS foreign_table_name,
+                ccu.column_name AS foreign_column_name
+            FROM 
+                information_schema.table_constraints AS tc 
+                JOIN information_schema.key_column_usage AS kcu
+                  ON tc.constraint_name = kcu.constraint_name
+                  AND tc.table_schema = kcu.table_schema
+                JOIN information_schema.constraint_column_usage AS ccu
+                  ON ccu.constraint_name = tc.constraint_name
+                  AND ccu.table_schema = tc.table_schema
+            WHERE tc.constraint_type = 'FOREIGN KEY' AND tc.table_name = ${safeName};
+        `)).rows,
+			junctions: (await this.db.execute(sql`
+            SELECT 
+                tc1.table_name as junction_table_name,
+                kcu1.column_name as source_column_name,
+                ccu2.table_name as target_table_name,
+                kcu2.column_name as target_column_name
+            FROM information_schema.table_constraints tc1
+            JOIN information_schema.key_column_usage kcu1 ON tc1.constraint_name = kcu1.constraint_name
+            JOIN information_schema.constraint_column_usage ccu1 ON ccu1.constraint_name = tc1.constraint_name
+            JOIN information_schema.table_constraints tc2 ON tc1.table_name = tc2.table_name AND tc2.constraint_type = 'FOREIGN KEY'
+            JOIN information_schema.key_column_usage kcu2 ON tc2.constraint_name = kcu2.constraint_name
+            JOIN information_schema.constraint_column_usage ccu2 ON ccu2.constraint_name = tc2.constraint_name
+            WHERE tc1.constraint_type = 'FOREIGN KEY' 
+              AND ccu1.table_name = ${safeName}
+              AND ccu2.table_name != ${safeName};
+        `)).rows,
+			policies: (await this.db.execute(sql`
+            SELECT 
+                polname as policy_name, 
+                polcmd as cmd, 
+                polroles::regrole[]::text[] as roles, 
+                pg_get_expr(polqual, polrelid) as qual, 
+                pg_get_expr(polwithcheck, polrelid) as with_check
+            FROM pg_policy
+            WHERE polrelid = (SELECT oid FROM pg_class WHERE relname = ${safeName} AND relnamespace = 'public'::regnamespace);
+        `)).rows
+		};
+	}
+	generateSubscriptionId() {
+		return `sub_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
+	}
 	/**
-	* MFA factors table - stores enrolled MFA methods
+	* Create a new delegate instance with authenticated context.
+	* Starts a transaction and sets the current_user_id and current_user_roles
+	* configuration parameters for PostgreSQL Row Level Security.
 	*/
-	const mfaFactors = tableCreator("mfa_factors", {
-		id: uuid("id").defaultRandom().primaryKey(),
-		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-		factorType: text("factor_type").notNull(),
-		secretEncrypted: text("secret_encrypted").notNull(),
-		friendlyName: text("friendly_name"),
-		verified: boolean("verified").default(false).notNull(),
-		/**
-		* The highest TOTP time step ever accepted for this factor. RFC 6238
-		* §5.2 forbids accepting an OTP twice, and the ±1 step window that
-		* exists for clock drift is also a 90-second replay window: without
-		* this, one observed code buys a fresh session for a minute and a half.
-		*/
-		lastUsedCounter: bigint("last_used_counter", { mode: "number" }),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at").defaultNow().notNull()
-	});
-	return {
-		usersSchema,
-		users,
-		refreshTokens,
-		passwordResetTokens,
-		appConfig,
-		userIdentities,
-		mfaFactors,
-		mfaChallenges: tableCreator("mfa_challenges", {
-			id: uuid("id").defaultRandom().primaryKey(),
-			factorId: uuid("factor_id").notNull().references(() => mfaFactors.id, { onDelete: "cascade" }),
-			createdAt: timestamp("created_at").defaultNow().notNull(),
-			verifiedAt: timestamp("verified_at"),
-			ipAddress: text("ip_address"),
-			/** Failed guesses recorded against this challenge; bounded by the route. */
-			attempts: integer("attempts").default(0).notNull(),
-			expiresAt: timestamp("expires_at").notNull()
-		}),
-		recoveryCodes: tableCreator("recovery_codes", {
-			id: uuid("id").defaultRandom().primaryKey(),
-			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-			codeHash: text("code_hash").notNull(),
-			usedAt: timestamp("used_at"),
-			createdAt: timestamp("created_at").defaultNow().notNull()
-		}),
-		magicLinkTokens: tableCreator("magic_link_tokens", {
-			id: uuid("id").defaultRandom().primaryKey(),
-			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-			tokenHash: text("token_hash").notNull().unique(),
-			expiresAt: timestamp("expires_at").notNull(),
-			usedAt: timestamp("used_at"),
-			createdAt: timestamp("created_at").defaultNow().notNull()
-		})
-	};
-}
-var defaultAuthSchema = createAuthSchema("rebase");
-var usersSchema = defaultAuthSchema.usersSchema;
-var users = defaultAuthSchema.users;
-var refreshTokens = defaultAuthSchema.refreshTokens;
-var passwordResetTokens = defaultAuthSchema.passwordResetTokens;
-var appConfig = defaultAuthSchema.appConfig;
-var userIdentities = defaultAuthSchema.userIdentities;
-var mfaFactors = defaultAuthSchema.mfaFactors;
-var mfaChallenges = defaultAuthSchema.mfaChallenges;
-var recoveryCodes = defaultAuthSchema.recoveryCodes;
-var magicLinkTokens = defaultAuthSchema.magicLinkTokens;
-var usersRelations = relations(users, ({ many }) => ({
-	refreshTokens: many(refreshTokens),
-	passwordResetTokens: many(passwordResetTokens),
-	userIdentities: many(userIdentities),
-	mfaFactors: many(mfaFactors),
-	recoveryCodes: many(recoveryCodes),
-	magicLinkTokens: many(magicLinkTokens)
-}));
-var refreshTokensRelations = relations(refreshTokens, ({ one }) => ({ user: one(users, {
-	fields: [refreshTokens.uid],
-	references: [users.id]
-}) }));
-var passwordResetTokensRelations = relations(passwordResetTokens, ({ one }) => ({ user: one(users, {
-	fields: [passwordResetTokens.uid],
-	references: [users.id]
-}) }));
-var userIdentitiesRelations = relations(userIdentities, ({ one }) => ({ user: one(users, {
-	fields: [userIdentities.uid],
-	references: [users.id]
-}) }));
-var mfaFactorsRelations = relations(mfaFactors, ({ one, many }) => ({
-	user: one(users, {
-		fields: [mfaFactors.uid],
-		references: [users.id]
-	}),
-	challenges: many(mfaChallenges)
-}));
-var mfaChallengesRelations = relations(mfaChallenges, ({ one }) => ({ factor: one(mfaFactors, {
-	fields: [mfaChallenges.factorId],
-	references: [mfaFactors.id]
-}) }));
-var recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({ user: one(users, {
-	fields: [recoveryCodes.uid],
-	references: [users.id]
-}) }));
-var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user: one(users, {
-	fields: [magicLinkTokens.uid],
-	references: [users.id]
-}) }));
-//#endregion
-//#region src/schema/generate-drizzle-schema-logic.ts
-/**
-* Resolve the SQL column name for a property.
-* Uses the explicit `columnName` when set (e.g. from introspection),
-* falling back to `toSnakeCase(propName)` for manually-authored collections.
-*/
-var JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
-/**
-* A string literal for the generated schema file.
-*
-* Column names, table names and enum values are all written into this file as
-* literals, and none of them is constrained to be quote-free: a Postgres
-* identifier only has to be quoted, and `O'Brien` is an ordinary enum value.
-* Interpolating them raw ended the literal early — for enum values, inside
-* single quotes, where an apostrophe is not an edge case.
-*/
-var quote$1 = (value) => JSON.stringify(value);
-/** An object key: verbatim when it is an identifier, quoted otherwise. */
-var propKey = (name) => JS_IDENTIFIER.test(name) ? name : quote$1(name);
-/**
-* A property access on a generated table variable.
-*
-* `users.full name` is not an expression; `users["full name"]` is, and Drizzle
-* treats the two identically.
-*/
-var member = (object, key) => JS_IDENTIFIER.test(key) ? `${object}.${key}` : `${object}[${quote$1(key)}]`;
-var resolveColumnName = (propName, prop) => {
-	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
-	return toSnakeCase(propName);
-};
-var getPrimaryKeyProp = (collection) => {
-	if (collection.properties) {
-		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
-		if (idPropEntry) {
-			const prop = idPropEntry[1];
-			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
-			return {
-				name: idPropEntry[0],
-				type: prop.type === "number" ? "number" : "string",
-				isUuid
-			};
-		}
+	async withAuth(user) {
+		return new AuthenticatedPostgresBackendDriver(this, user);
 	}
-	const idProp = collection.properties?.["id"];
-	if (idProp?.type === "number") return {
-		name: "id",
-		type: "number",
-		isUuid: false
-	};
-	return {
-		name: "id",
-		type: "string",
-		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
-	};
-};
-/**
-* Given a raw DB column name (e.g. "client_id"), the Drizzle property key that
-* maps to it.
-*
-* One line, because the rule is shared: the Drizzle object key is the wire
-* name, and {@link fieldKeyForColumn} is the one definition of what a column is
-* named on the wire. This used to be a private copy that fell back to the
-* column verbatim, which is how a derived foreign key ended up served as
-* `author_id` beside a hand-authored `displayName`.
-*/
-var resolvePropertyKeyForColumn = (collection, column) => fieldKeyForColumn(collection, column);
-var isNumericId = (collection) => {
-	return getPrimaryKeyProp(collection).type === "number";
-};
-var getPrimaryKeyName = (collection) => {
-	return getPrimaryKeyProp(collection).name;
-};
-var isIdProperty = (propName, prop, collection) => {
-	if ("isId" in prop && Boolean(prop.isId)) return true;
-	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
 };
-/**
-* The Drizzle column declaration a property compiles to, or `null` when the
-* property puts no column on *this* table (an inverse relation, whose column
-* lives on the target). Exported so it can be checked against its DDL twin
-* `getSqlColumnType` directly — the two disagreeing is what left `geopoint`
-* with a database column and no Drizzle key.
-*/
-var getDrizzleColumn = (propName, prop, collection, collections) => {
-	const colName = resolveColumnName(propName, prop);
-	let columnDefinition;
-	switch (prop.type) {
-		case "string": {
-			const stringProp = prop;
-			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}(${quote$1(colName)})`;
-			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
-			else if (stringProp.columnType === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
-			else if (stringProp.columnType === "char") columnDefinition = `char(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
-			else if (stringProp.columnType === "varchar") columnDefinition = `varchar(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
-			else columnDefinition = `text(${quote$1(colName)})`;
-			if (isIdProperty(propName, prop, collection)) columnDefinition += ".primaryKey()";
-			if ("isId" in stringProp && stringProp.isId !== "manual" && stringProp.isId !== true) {
-				if (stringProp.isId === "uuid") columnDefinition += ".defaultRandom()";
-				else if (stringProp.isId === "cuid") columnDefinition += ".default(sql`cuid()`)";
-				else if (typeof stringProp.isId === "string") {
-					const sqlContent = stringProp.isId.startsWith("sql`") && stringProp.isId.endsWith("`") ? stringProp.isId.substring(4, stringProp.isId.length - 1) : stringProp.isId;
-					columnDefinition += `.default(sql\`${sqlContent}\`)`;
-				}
-			}
-			if (stringProp.validation?.unique) columnDefinition += ".unique()";
-			break;
-		}
-		case "number": {
-			const numProp = prop;
-			const isId = isIdProperty(propName, prop, collection);
-			let baseType = numProp.validation?.integer || isId ? `integer(${quote$1(colName)})` : `numeric(${quote$1(colName)})`;
-			if (numProp.columnType) if (numProp.columnType === "double precision") baseType = `doublePrecision(${quote$1(colName)})`;
-			else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") baseType = `${numProp.columnType}(${quote$1(colName)}, { mode: "number" })`;
-			else baseType = `${numProp.columnType}(${quote$1(colName)})`;
-			if ("isId" in numProp && numProp.isId === "increment") columnDefinition = `${baseType}.generatedByDefaultAsIdentity()`;
-			else if ("isId" in numProp && typeof numProp.isId === "string" && numProp.isId !== "manual") {
-				columnDefinition = baseType;
-				const sqlContent = numProp.isId.startsWith("sql`") && numProp.isId.endsWith("`") ? numProp.isId.substring(4, numProp.isId.length - 1) : numProp.isId;
-				columnDefinition += `.default(sql\`${sqlContent}\`)`;
-			} else columnDefinition = baseType;
-			if (isId) columnDefinition += ".primaryKey()";
-			if (numProp.validation?.unique) columnDefinition += ".unique()";
-			break;
-		}
-		case "boolean":
-			columnDefinition = `boolean(${quote$1(colName)})`;
-			break;
-		case "date": {
-			const dateProp = prop;
-			if (dateProp.columnType === "date") columnDefinition = `date(${quote$1(colName)}, { mode: 'string' })`;
-			else if (dateProp.columnType === "time") columnDefinition = `time(${quote$1(colName)})`;
-			else columnDefinition = `timestamp(${quote$1(colName)}, { withTimezone: true, mode: 'string' })`;
-			if (dateProp.autoValue === "on_create" || dateProp.autoValue === "on_update") columnDefinition += ".default(sql`now()`)";
-			break;
-		}
-		case "map":
-			if (prop.columnType === "json") columnDefinition = `json(${quote$1(colName)})`;
-			else columnDefinition = `jsonb(${quote$1(colName)})`;
-			break;
-		case "geopoint":
-			columnDefinition = `jsonb(${quote$1(colName)})`;
-			break;
-		case "array": {
-			const arrayProp = prop;
-			let colType = arrayProp.columnType;
-			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
-				const ofProp = arrayProp.of;
-				if (ofProp.type === "string") colType = "text[]";
-				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
-				else if (ofProp.type === "boolean") colType = "boolean[]";
-			}
-			if (colType === "json") columnDefinition = `json(${quote$1(colName)})`;
-			else if (colType === "text[]") columnDefinition = `text(${quote$1(colName)}).array()`;
-			else if (colType === "integer[]") columnDefinition = `integer(${quote$1(colName)}).array()`;
-			else if (colType === "boolean[]") columnDefinition = `boolean(${quote$1(colName)}).array()`;
-			else if (colType === "numeric[]") columnDefinition = `numeric(${quote$1(colName)}).array()`;
-			else columnDefinition = `jsonb(${quote$1(colName)})`;
-			break;
-		}
-		case "vector": {
-			const vp = prop;
-			columnDefinition = `vector(${quote$1(colName)}, { dimensions: ${vp.dimensions} })`;
-			break;
-		}
-		case "binary":
-			columnDefinition = `customType({ dataType() { return 'bytea'; } })(${quote$1(colName)})`;
-			break;
-		case "relation": {
-			const refProp = prop;
-			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
-			if (!relation || relation.kind !== "belongsTo") return null;
-			const fkFieldKey = fieldKeyForColumn(collection, relation.localKey);
-			if (collection.properties[fkFieldKey] && propName !== fkFieldKey) return null;
-			let targetCollection;
-			try {
-				targetCollection = relation.target();
-			} catch {
-				return null;
+var AuthenticatedPostgresBackendDriver = class {
+	delegate;
+	key = "postgres";
+	initialised = true;
+	user;
+	data;
+	constructor(delegate, user) {
+		this.delegate = delegate;
+		this.user = user;
+		this.data = buildSdkData(this);
+		this.admin = delegate.admin;
+	}
+	/**
+	* Typed admin capabilities — delegates to the base driver.
+	*/
+	admin;
+	get restFetchService() {
+		return {
+			fetchCollectionForRest: async (collectionPath, options, include) => {
+				return this.withTransaction(async (delegate) => {
+					return delegate.restFetchService.fetchCollectionForRest(collectionPath, options, include);
+				}, { accessMode: "read only" });
+			},
+			fetchOneForRest: async (collectionPath, id, include, databaseId) => {
+				return this.withTransaction(async (delegate) => {
+					return delegate.restFetchService.fetchOneForRest(collectionPath, id, include, databaseId);
+				}, { accessMode: "read only" });
 			}
-			const fkColumnName = relation.localKey;
-			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
-			const pkProp = getPrimaryKeyProp(targetCollection);
-			const targetIdField = pkProp.name;
-			const baseColumn = pkProp.type === "number" ? `integer("${fkColumnName}")` : pkProp.isUuid ? `uuid("${fkColumnName}")` : `text("${fkColumnName}")`;
-			const onUpdate = relation.onUpdate ? `onUpdate: "${relation.onUpdate}"` : "";
-			const required = prop.validation?.required;
-			const refOptionsParts = [onUpdate, `onDelete: \"${relation.onDelete ?? (required ? "cascade" : "set null")}\"`].filter(Boolean);
-			const refOptions = refOptionsParts.length > 0 ? `{ ${refOptionsParts.join(", ")} }` : "";
-			let columnDef = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}${refOptions ? `, ${refOptions}` : ""})`;
-			if (required) columnDef += ".notNull()";
-			return `    ${propKey(fkFieldKey)}: ${columnDef}`;
-		}
-		case "reference": {
-			const refProp = prop;
-			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName$1(c) === refProp.path);
-			if (!targetCollection) {
-				columnDefinition = `text(${quote$1(colName)})`;
-				break;
+		};
+	}
+	async withTransaction(operation, options) {
+		const pendingNotifications = [];
+		const result = await this.delegate.db.transaction(async (tx) => {
+			let uid = this.user?.uid;
+			if (!uid) {
+				logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
+				uid = "anonymous";
 			}
-			const pkProp = getPrimaryKeyProp(targetCollection);
-			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
-			const targetIdField = pkProp.name;
-			const baseColumn = pkProp.type === "number" ? `integer(${quote$1(colName)})` : pkProp.isUuid ? `uuid(${quote$1(colName)})` : `text(${quote$1(colName)})`;
-			const required = prop.validation?.required;
-			const refOptions = `{ onDelete: "${required ? "cascade" : "set null"}" }`;
-			columnDefinition = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}, ${refOptions})`;
-			if (required) columnDefinition += ".notNull()";
-			return `    ${propKey(propName)}: ${columnDefinition}`;
+			const userRoles = this.user?.roles ?? [];
+			if (!this.user?.roles) logger.warn("[DataDriver] User roles are missing for authenticated delegate. Using empty array. User object", { detail: this.user });
+			await applyAuthContext(tx, {
+				uid,
+				roles: userRoles
+			}, this.delegate.rlsUserRole);
+			const txEntityService = new DataService(tx, this.delegate.registry);
+			const txDelegate = new PostgresBackendDriver(tx, this.delegate.realtimeService, this.delegate.registry, this.user, this.delegate.poolManager, this.delegate.historyService);
+			txDelegate.dataService = txEntityService;
+			txDelegate._deferNotifications = true;
+			txDelegate._pendingNotifications = pendingNotifications;
+			txDelegate.client = this.delegate.client;
+			return await operation(txDelegate);
+		}, options);
+		for (const notification of pendingNotifications) try {
+			await this.delegate.realtimeService.notifyUpdate(notification.path, notification.id, notification.row, notification.databaseId);
+		} catch (e) {
+			logger.error("[DataDriver] Error flushing deferred notification", { error: e });
 		}
-		default: throw new Error(`No Postgres column mapping for property '${propName}' of type '${prop.type}' in collection '${collection.slug}'. Add a case to \`getDrizzleColumn\` (and to \`getSqlColumnType\`, which must agree).`);
+		return result;
 	}
-	if (prop.validation?.required) columnDefinition += ".notNull()";
-	return `    ${propKey(propName)}: ${columnDefinition}`;
-};
-/**
-* Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
-*
-* The clause is SQL being written into a TypeScript file, so it has to survive
-* being read back as a template literal. Three characters do not:
-*
-* - `` ` `` closes the template early, and the rest of the clause becomes code.
-* - `${` opens an interpolation — the file stops compiling, or worse, compiles
-*   against whatever identifier happens to be in scope.
-* - `\` is an escape, and Drizzle's `sql` tag reads the *cooked* strings, not
-*   `.raw`. So a policy written as `email ~ '^admin\.user@corp\.com$'` reaches
-*   the database as `^admin.user@corp.com$`, where every `\.` now matches any
-*   character. A `USING` clause is a security boundary and that one silently
-*   widened it — the SQL file emitted by the DDL generator kept the backslashes
-*   while this path dropped them, so the two disagreed about who could read the
-*   table.
-*
-* Escaping here rather than in the compiler: the clause is correct SQL, and it
-* is only this destination that has an opinion about backslashes.
-*/
-var wrapSql = (clause) => `sql\`${clause.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${")}\``;
-var generatePolicyCode = (collection, rule, index, resolveCollection) => {
-	const tableName = getTableName$1(collection);
-	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
-	const policyNames = getPolicyNamesForRule(rule, tableName);
-	return ops.map((op, opIdx) => {
-		return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
-	}).join("");
-};
-/**
-* Generates a single pgPolicy() call for one specific operation.
-*/
-var generateSinglePolicyCode = (collection, rule, operation, policyName, resolveCollection) => {
-	const mode = rule.mode ?? "permissive";
-	const needsUsing = operation !== "insert";
-	const needsWithCheck = operation !== "select" && operation !== "delete";
-	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
-	let usingClause = needsUsing && usingExpr ? wrapSql(policyToPostgres(usingExpr, collection, { resolveCollection })) : null;
-	let withCheckClause = needsWithCheck && withCheckExpr ? wrapSql(policyToPostgres(withCheckExpr, collection, { resolveCollection })) : null;
-	if (!usingClause && needsUsing) usingClause = "sql`false`";
-	if (!withCheckClause && needsWithCheck) withCheckClause = "sql`false`";
-	const parts = [];
-	parts.push(`as: "${mode}"`);
-	parts.push(`for: "${operation}"`);
-	const toRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
-	parts.push(`to: [${toRoles.map((r) => `"${r}"`).join(", ")}]`);
-	if (usingClause) parts.push(`using: ${usingClause}`);
-	if (withCheckClause) parts.push(`withCheck: ${withCheckClause}`);
-	return `    pgPolicy(${quote$1(policyName)}, { ${parts.join(", ")} }),\n`;
-};
-/**
-* Computes a deterministic shared relation name for Drizzle.
-*
-* Drizzle requires both sides of a relation (owning + inverse) to use the
-* exact same `relationName` string so it can pair them. Each collection
-* definition may use a different local `relationName`, so we need a canonical
-* form that both sides can independently compute.
-*
-* Strategy: `{owningTable}_{foreignKey}`
-*   - owning  side → `{thisTable}_{localKey}`           e.g. "jobs_company_id"
-*   - inverse side → `{targetTable}_{foreignKeyOnTarget}` e.g. "jobs_company_id"
-*
-* For M2M with junction tables the owning relation name is already shared via
-* the junction table wiring, so we keep it as-is.
-*
-* Falls back to the local relation name when the counterpart can't be resolved.
-*/
-var computeSharedRelationName = (rel, sourceCollection, _collections) => {
-	const fallback = rel.relationName ?? toSnakeCase(rel.target().slug);
-	if (rel.kind === "belongsTo") {
-		const normalisedKey = resolvePropertyKeyForColumn(sourceCollection, rel.localKey);
-		return `${getTableName$1(sourceCollection)}_${normalisedKey}`;
+	async fetchCollection(props) {
+		return this.withTransaction((delegate) => delegate.fetchCollection(props), { accessMode: "read only" });
 	}
-	if (rel.kind === "hasMany" || rel.kind === "hasOne") try {
-		const targetCollection = rel.target();
-		const normalisedFK = resolvePropertyKeyForColumn(targetCollection, rel.foreignKeyOnTarget);
-		return `${getTableName$1(targetCollection)}_${normalisedFK}`;
-	} catch {
-		return fallback;
+	/**
+	* Injects the authenticated user's context into the most recently
+	* registered realtime subscription so RLS-aware polling can apply.
+	*/
+	injectAuthContext(unsubscribe) {
+		const authContext = {
+			uid: this.user?.uid || "anonymous",
+			roles: this.user?.roles ?? []
+		};
+		const entries = Array.from(this.delegate.realtimeService.subscriptions.entries());
+		const lastSub = entries[entries.length - 1]?.[1];
+		if (lastSub && lastSub.clientId === "driver") lastSub.authContext = authContext;
+		return unsubscribe;
+	}
+	listenCollection(props) {
+		return this.injectAuthContext(this.delegate.listenCollection(props));
+	}
+	async fetchOne(props) {
+		return this.withTransaction((delegate) => delegate.fetchOne(props), { accessMode: "read only" });
+	}
+	listenOne(props) {
+		return this.injectAuthContext(this.delegate.listenOne(props));
+	}
+	async save(props) {
+		return this.withTransaction((delegate) => delegate.save(props));
+	}
+	/**
+	* One transaction for the whole batch, rather than one per row.
+	*
+	* This is the point of the method: `save` opens a transaction per call, so
+	* importing 10k rows through it means 10k transactions (and, over HTTP, 10k
+	* round trips). Here the RLS context is established once and every row lands
+	* or none does. Realtime notifications are already deferred to commit by
+	* `withTransaction`, so a batch does not flood subscribers mid-flight.
+	*/
+	async saveMany(props) {
+		return this.withTransaction((delegate) => delegate.saveMany(props));
+	}
+	async delete(props) {
+		return this.withTransaction((delegate) => delegate.delete(props));
+	}
+	async deleteAll(path) {
+		return this.withTransaction((delegate) => delegate.deleteAll(path));
+	}
+	async checkUniqueField(path, name, value, id, collection) {
+		return this.withTransaction((delegate) => delegate.checkUniqueField(path, name, value, id, collection), { accessMode: "read only" });
+	}
+	async count(props) {
+		return this.withTransaction((delegate) => delegate.count(props), { accessMode: "read only" });
 	}
-	return fallback;
 };
-var generateSchema = async (allCollections, stripPolicies = false) => {
-	const collections = sortCollectionsBySlug(relationalCollections(allCollections));
-	let schemaContent = "// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\n\n";
-	const hasUuid = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "string" && (p.autoValue === "uuid" || p.isId === "uuid")));
-	const hasVector = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "vector"));
-	const hasBinary = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "binary"));
-	const hasSearch = collections.some((c) => buildSearchColumnSpec(c) !== void 0);
-	const pgCoreImports = [
-		"primaryKey",
-		"pgTable",
-		"integer",
-		"varchar",
-		"text",
-		"char",
-		"boolean",
-		"timestamp",
-		"date",
-		"time",
-		"jsonb",
-		"json",
-		"pgEnum",
-		"numeric",
-		"real",
-		"doublePrecision",
-		"bigint",
-		"serial",
-		"bigserial",
-		"pgPolicy"
-	];
-	if (hasUuid) pgCoreImports.push("uuid");
-	if (hasVector) pgCoreImports.push("vector");
-	if (hasBinary || hasSearch) pgCoreImports.push("customType");
-	const uniqueSchemas = Array.from(new Set(collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)));
-	if (uniqueSchemas.length > 0) pgCoreImports.push("pgSchema");
-	schemaContent += `import { ${pgCoreImports.join(", ")} } from 'drizzle-orm/pg-core';\n`;
-	schemaContent += "import { relations as drizzleRelations, sql } from 'drizzle-orm';\n\n";
-	uniqueSchemas.forEach((schema) => {
-		schemaContent += `export const ${schema}Schema = pgSchema("${schema}");\n`;
-	});
-	if (uniqueSchemas.length > 0) schemaContent += "\n";
-	const exportedTableVars = [];
-	const exportedEnumVars = [];
-	const exportedRelationVars = [];
-	const allTablesToGenerate = /* @__PURE__ */ new Map();
-	collections.forEach((collection) => {
-		const collectionPath = getTableName$1(collection);
-		Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
-			if ("enum" in prop && (prop.type === "string" || prop.type === "number") && prop.enum) {
-				const enumVarName = getEnumVarName(collectionPath, propName);
-				const enumDbName = `${collectionPath}_${resolveColumnName(propName, prop)}`;
-				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
-				if (values.length > 0) {
-					schemaContent += `export const ${enumVarName} = pgEnum(${quote$1(enumDbName)}, [${values.map((v) => quote$1(v)).join(", ")}]);\n`;
-					if (!exportedEnumVars.includes(enumVarName)) exportedEnumVars.push(enumVarName);
-				}
-			}
-		});
-	});
-	schemaContent += "\n";
-	const junctionSpecs = resolveJunctionSpecs(collections);
-	for (const collection of collections) {
-		const tableName = getTableName$1(collection);
-		if (tableName) allTablesToGenerate.set(tableName, { collection });
-		const resolvedRelations = resolveCollectionRelations(collection);
-		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
-			const junctionTableName = relation.through.table;
-			if (!allTablesToGenerate.has(junctionTableName)) allTablesToGenerate.set(junctionTableName, {
-				collection: {
-					table: junctionTableName,
-					properties: {}
-				},
-				isJunction: true,
-				relation,
-				sourceCollection: collection
-			});
+//#endregion
+//#region src/databasePoolManager.ts
+var DatabasePoolManager = class {
+	pools = /* @__PURE__ */ new Map();
+	drizzleInstances = /* @__PURE__ */ new Map();
+	defaultDatabaseName;
+	rootConnectionString;
+	constructor(adminConnectionString) {
+		this.rootConnectionString = adminConnectionString;
+		try {
+			const url = new URL(adminConnectionString);
+			this.defaultDatabaseName = url.pathname.slice(1);
+		} catch (e) {
+			throw new Error(`Invalid adminConnectionString provided: ${e}`);
 		}
 	}
-	for (const [tableName, { collection, isJunction, relation, sourceCollection }] of allTablesToGenerate.entries()) {
-		const tableVarName = getTableVarName(tableName);
-		if (isJunction && relation && sourceCollection && isManyToMany(relation)) {
-			const targetCollection = relation.target();
-			const tableCreator = "pgTable";
-			const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
-			const { sourceColumn, targetColumn } = relation.through;
-			const refOptions = `{ onDelete: \"${relation.onDelete ?? "cascade"}\" }`;
-			const sourceColType = isNumericId(sourceCollection) ? "integer" : getPrimaryKeyProp(sourceCollection).isUuid ? "uuid" : "text";
-			const targetColType = isNumericId(targetCollection) ? "integer" : getPrimaryKeyProp(targetCollection).isUuid ? "uuid" : "text";
-			const sourceId = getPrimaryKeyName(sourceCollection);
-			const targetId = getPrimaryKeyName(targetCollection);
-			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
-			schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
-			schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(targetCollection))}.${targetId}, ${refOptions}),\n`;
-			schemaContent += "}, (table) => ([\n";
-			schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
-			const junctionSpec = junctionSpecs.get(baseTableName);
-			if (!stripPolicies && junctionSpec) {
-				const junctionCollection = getJunctionCollectionConfig(junctionSpec);
-				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
-				getJunctionSecurityRules(junctionSpec).forEach((rule, idx) => {
-					schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
-				});
-			}
-			schemaContent += "])).enableRLS();\n\n";
-		} else if (!isJunction) {
-			const schema = isPostgresCollectionConfig(collection) ? collection.schema : void 0;
-			const tableCreator = schema ? `${schema}Schema.table` : "pgTable";
-			const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
-			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
-			const columns = /* @__PURE__ */ new Set();
-			Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
-				const columnString = getDrizzleColumn(propName, prop, collection, collections);
-				if (columnString) columns.add(columnString);
-			});
-			const searchSpec = buildSearchColumnSpec(collection);
-			if (searchSpec) {
-				columns.add(`    ${searchSpec.column}: customType({ dataType() { return 'tsvector'; } })("${searchSpec.column}").generatedAlwaysAs(sql\`${searchSpec.expression}\`)`);
-				if (searchSpec.fuzzy) columns.add(`    ${searchSpec.fuzzy.column}: text("${searchSpec.fuzzy.column}").generatedAlwaysAs(sql\`${searchSpec.fuzzy.expression}\`)`);
-			}
-			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: text(\"id\").primaryKey()");
-			schemaContent += `${Array.from(columns).join(",\n")}`;
-			const securityRules = getEffectiveSecurityRules(collection);
-			if (!stripPolicies && securityRules.length > 0) {
-				schemaContent += "\n}, (table) => ([\n";
-				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
-				securityRules.forEach((rule, idx) => {
-					schemaContent += generatePolicyCode(collection, rule, idx, resolveCollection);
-				});
-				schemaContent += "])).enableRLS();\n\n";
-			} else schemaContent += "\n}).enableRLS();\n\n";
-		}
-		if (!exportedTableVars.includes(tableVarName)) exportedTableVars.push(tableVarName);
+	getDrizzle(databaseName) {
+		const existing = this.drizzleInstances.get(databaseName);
+		if (existing) return existing;
+		const db = drizzle(this.getPool(databaseName));
+		this.drizzleInstances.set(databaseName, db);
+		return db;
 	}
-	for (const [tableName, { collection, isJunction }] of allTablesToGenerate.entries()) {
-		const tableVarName = getTableVarName(tableName);
-		const tableRelations = [];
-		if (isJunction) {
-			const relationInfo = Array.from(allTablesToGenerate.values()).find((v) => v.isJunction && getTableName$1(v.collection) === tableName);
-			if (relationInfo && relationInfo.relation && relationInfo.sourceCollection && isManyToMany(relationInfo.relation)) {
-				const { relation, sourceCollection } = relationInfo;
-				const targetCollection = relation.target();
-				const sourceTableVar = getTableVarName(getTableName$1(sourceCollection));
-				const targetTableVar = getTableVarName(getTableName$1(targetCollection));
-				const sourceId = getPrimaryKeyName(sourceCollection);
-				const targetId = getPrimaryKeyName(targetCollection);
-				if (!relation?.through) throw new Error("Internal, the relation should have a through property. Relations passed to this script should sanitized first with sanitizeRelation().");
-				const owningRelationName = relation.relationName ?? toSnakeCase(getTableName$1(targetCollection));
-				let inverseRelationName = null;
-				try {
-					const targetRelations = resolveCollectionRelations(targetCollection);
-					for (const [, targetRel] of Object.entries(targetRelations)) if (targetRel.kind !== "belongsTo" && targetRel.cardinality === "many" && targetRel.relationName === owningRelationName) {
-						inverseRelationName = targetRel.relationName ?? null;
-						break;
-					}
-				} catch {}
-				tableRelations.push(`    ${quote$1(relation.through.sourceColumn)}: one(${sourceTableVar}, {\n        fields: [${member(tableVarName, relation.through.sourceColumn)}],\n        references: [${member(sourceTableVar, sourceId)}],\n        relationName: ${quote$1(owningRelationName)}\n    })`);
-				const targetRelationName = inverseRelationName ? inverseRelationName : `${tableName}_${relation.through.targetColumn}`;
-				tableRelations.push(`    ${quote$1(relation.through.targetColumn)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, relation.through.targetColumn)}],\n        references: [${member(targetTableVar, targetId)}],\n        relationName: ${quote$1(targetRelationName)}\n    })`);
-			}
-		} else {
-			const resolvedRelations = resolveCollectionRelations(collection);
-			const emittedRelationNames = /* @__PURE__ */ new Set();
-			for (const [relationKey, rel] of Object.entries(resolvedRelations)) try {
-				const target = rel.target();
-				const targetTableVar = getTableVarName(getTableName$1(target));
-				const drizzleRelationName = computeSharedRelationName(rel, collection, collections);
-				const deduplicationKey = `${drizzleRelationName}::${rel.kind}`;
-				if (emittedRelationNames.has(deduplicationKey)) continue;
-				emittedRelationNames.add(deduplicationKey);
-				switch (rel.kind) {
-					case "belongsTo": {
-						const localFieldKey = resolvePropertyKeyForColumn(collection, rel.localKey);
-						tableRelations.push(`    ${quote$1(relationKey)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, localFieldKey)}],\n        references: [${member(targetTableVar, getPrimaryKeyName(target))}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
-						break;
-					}
-					case "hasOne":
-						tableRelations.push(`    "${relationKey}": one(${targetTableVar}, {\n        relationName: \"${drizzleRelationName}\"\n    })`);
-						break;
-					case "hasMany":
-						tableRelations.push(`    "${relationKey}": many(${targetTableVar}, { relationName: \"${drizzleRelationName}\" })`);
-						break;
-					case "manyToMany": {
-						const junctionTableVar = getTableVarName(rel.through.table);
-						tableRelations.push(`    "${relationKey}": many(${junctionTableVar}, { relationName: \"${drizzleRelationName}\" })`);
-						break;
-					}
-					case "via": break;
-				}
-			} catch (e) {
-				logger.warn(`Could not generate relation ${relationKey} for ${collection.name}`, { error: e });
-			}
-			for (const otherCollection of collections) {
-				if (otherCollection.slug === collection.slug) continue;
-				const otherRelations = resolveCollectionRelations(otherCollection);
-				for (const [otherKey, otherRel] of Object.entries(otherRelations)) if (hasForeignKeyOnTarget(otherRel)) try {
-					if (otherRel.target().slug === collection.slug) {
-						const drizzleRelationName = computeSharedRelationName(otherRel, otherCollection, collections);
-						const deduplicationKey = `${drizzleRelationName}::belongsTo`;
-						if (!emittedRelationNames.has(deduplicationKey)) {
-							const otherTableVar = getTableVarName(getTableName$1(otherCollection));
-							const drizzleFieldKey = resolvePropertyKeyForColumn(collection, otherRel.foreignKeyOnTarget);
-							const referencedKey = otherRel.sourceKey ? resolvePropertyKeyForColumn(otherCollection, otherRel.sourceKey) : getPrimaryKeyName(otherCollection);
-							const synthKey = `_synth_${otherTableVar}_${drizzleFieldKey}`;
-							tableRelations.push(`    ${quote$1(synthKey)}: one(${otherTableVar}, {\n        fields: [${member(tableVarName, drizzleFieldKey)}],\n        references: [${member(otherTableVar, referencedKey)}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
-							emittedRelationNames.add(deduplicationKey);
-						}
-					}
-				} catch (e) {}
-			}
+	getPool(databaseName) {
+		if (this.pools.has(databaseName)) return this.pools.get(databaseName);
+		const url = new URL(this.rootConnectionString);
+		url.pathname = `/${databaseName}`;
+		const pool = new Pool({
+			connectionString: pinSearchPath(url.toString()),
+			max: 10,
+			idleTimeoutMillis: 1e4,
+			allowExitOnIdle: true
+		});
+		pool.on("error", (err) => {
+			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
+		});
+		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
+		this.pools.set(databaseName, pool);
+		return pool;
+	}
+	/**
+	* Disconnect and remove the pool for a specific database.
+	* Required before `CREATE DATABASE ... TEMPLATE` or `DROP DATABASE`,
+	* which need exclusive access to the target database.
+	*/
+	async disconnectDatabase(databaseName) {
+		const pool = this.pools.get(databaseName);
+		if (pool) {
+			await pool.end();
+			this.pools.delete(databaseName);
+			this.drizzleInstances.delete(databaseName);
 		}
-		if (tableRelations.length > 0) {
-			const relVarName = `${tableVarName}Relations`;
-			schemaContent += `export const ${relVarName} = drizzleRelations(${tableVarName}, ({ one, many }) => ({\n${tableRelations.join(",\n")}\n}));\n\n`;
-			if (!exportedRelationVars.includes(relVarName)) exportedRelationVars.push(relVarName);
+	}
+	/** Check if a pool exists for a given database name. */
+	hasPool(databaseName) {
+		return this.pools.has(databaseName);
+	}
+	async shutdown() {
+		const promises = [];
+		for (const [dbName, pool] of this.pools.entries()) {
+			logger.info(`[DatabasePoolManager] Shutting down pool for ${dbName}`);
+			promises.push(pool.end());
 		}
+		await Promise.all(promises);
+		this.pools.clear();
+		this.drizzleInstances.clear();
 	}
-	const tablesExport = `export const tables = { ${exportedTableVars.join(", ")} };\n`;
-	const enumsExport = `export const enums = { ${exportedEnumVars.join(", ")} };\n`;
-	const relationsExport = `export const relations = { ${exportedRelationVars.join(", ")} };\n\n`;
-	schemaContent += tablesExport + enumsExport + relationsExport;
-	return schemaContent;
 };
 //#endregion
+//#region src/schema/auth-schema.ts
+/**
+* Factory function to dynamically create the auth tables bound to the specified schema names.
+*
+* This module builds queries; it does not create tables. `ensureAuthTablesExist`
+* owns the DDL, which makes everything here a *claim* about a database it cannot
+* enforce — and the claims drifted. Every column below was declared
+* `varchar(n)` while the DDL created it as `TEXT`: `user_agent` as varchar(500),
+* `ip_address` as varchar(45), `secret_encrypted` as varchar(500), every
+* `token_hash` as varchar(255). None of it was true of any database this
+* framework ever provisioned. Harmless at runtime — drizzle does not enforce a
+* length client-side, so the widths only ever misled the next reader — but a
+* schema module that describes columns that do not exist is worse than no
+* schema module. They are `text` here now because they are TEXT there.
+*/
+function createAuthSchema(usersSchemaName = "rebase") {
+	const usersSchema = usersSchemaName === "public" ? null : pgSchema(usersSchemaName);
+	const tableCreator = usersSchema ? usersSchema.table.bind(usersSchema) : pgTable;
+	/**
+	* Users table - stores both email/password and OAuth users
+	*/
+	const users = tableCreator("users", {
+		id: uuid("id").defaultRandom().primaryKey(),
+		email: text("email").notNull().unique(),
+		passwordHash: text("password_hash"),
+		displayName: text("display_name"),
+		photoUrl: text("photo_url"),
+		emailVerified: boolean("email_verified").default(false).notNull(),
+		emailVerificationToken: text("email_verification_token"),
+		emailVerificationSentAt: timestamp("email_verification_sent_at"),
+		isAnonymous: boolean("is_anonymous").default(false).notNull(),
+		roles: text("roles").array().default([]).notNull(),
+		metadata: jsonb("metadata").$type().default({}).notNull(),
+		/**
+		* Sessions that began before this instant are dead, whatever tokens
+		* they still hold. Password resets and admin revocations stamp it.
+		*
+		* Deleting the user's refresh-token rows (which we also do) is not
+		* sufficient on its own: a request already in flight can insert a
+		* freshly rotated row microseconds after the delete and survive it.
+		* This timestamp cannot be outrun that way — it is checked against
+		* `refresh_tokens.session_started_at`, which rotation carries forward.
+		*/
+		tokensValidAfter: timestamp("tokens_valid_after"),
+		createdAt: timestamp("created_at").defaultNow().notNull(),
+		updatedAt: timestamp("updated_at").defaultNow().notNull()
+	});
+	/**
+	* Refresh tokens for long-lived sessions.
+	*
+	* A row is one token, not one device. Every token minted from the same
+	* sign-in shares a `sessionId`, and rotation ADDS a row rather than
+	* replacing one: the superseded token stays on file, flagged `revoked`
+	* with a `rotatedAt` stamp. That record is what lets the refresh endpoint
+	* tell a client replaying a token it never got an answer for (a response
+	* lost to a redeploy, a second tab racing on boot) apart from a stranger
+	* presenting a token that was never issued. Deleting the old row on sight
+	* — the previous behaviour — made those two cases indistinguishable, and
+	* the legitimate one is overwhelmingly the common one.
+	*
+	* There is deliberately NO unique constraint on (uid, user_agent,
+	* ip_address). Keying a session on the IP meant one row per "device",
+	* so a second browser profile behind the same NAT silently evicted the
+	* first, and a phone changing networks orphaned a row on every hop.
+	* User agent and IP are descriptive metadata for the sessions list;
+	* `sessionId` is the identity.
+	*/
+	const refreshTokens = tableCreator("refresh_tokens", {
+		id: uuid("id").defaultRandom().primaryKey(),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+		sessionId: uuid("session_id").defaultRandom().notNull(),
+		tokenHash: text("token_hash").notNull().unique(),
+		expiresAt: timestamp("expires_at").notNull(),
+		revoked: boolean("revoked").default(false).notNull(),
+		rotatedAt: timestamp("rotated_at"),
+		/**
+		* When the sign-in this token descends from happened — carried across
+		* every rotation, unlike `createdAt`. `users.tokensValidAfter` is
+		* compared against this, so a revocation cannot be outrun by a token
+		* that rotates immediately after it.
+		*/
+		sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
+		/**
+		* The assurance level the sign-in was established at — `aal2` only
+		* where a second factor was actually presented. Carried across
+		* rotations, because refresh is not a new authentication and has
+		* nothing else to read the level from.
+		*/
+		aal: text("aal"),
+		userAgent: text("user_agent"),
+		ipAddress: text("ip_address"),
+		createdAt: timestamp("created_at").defaultNow().notNull()
+	}, (table) => ({ sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId) }));
+	/**
+	* Password reset tokens for forgot password flow
+	*/
+	const passwordResetTokens = tableCreator("password_reset_tokens", {
+		id: uuid("id").defaultRandom().primaryKey(),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+		tokenHash: text("token_hash").notNull().unique(),
+		expiresAt: timestamp("expires_at").notNull(),
+		usedAt: timestamp("used_at"),
+		createdAt: timestamp("created_at").defaultNow().notNull()
+	});
+	/**
+	* App config - key/value store for custom settings
+	*/
+	const appConfig = tableCreator("app_config", {
+		key: text("key").primaryKey(),
+		value: jsonb("value").notNull(),
+		updatedAt: timestamp("updated_at").defaultNow().notNull()
+	});
+	/**
+	* User identities - maps external OAuth profiles back to local users
+	*/
+	const userIdentities = tableCreator("user_identities", {
+		id: uuid("id").defaultRandom().primaryKey(),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+		provider: text("provider").notNull(),
+		providerId: text("provider_id").notNull(),
+		profileData: jsonb("profile_data"),
+		createdAt: timestamp("created_at").defaultNow().notNull(),
+		updatedAt: timestamp("updated_at").defaultNow().notNull()
+	}, (table) => ({ uniqueProviderId: unique("unique_provider_id").on(table.provider, table.providerId) }));
+	/**
+	* MFA factors table - stores enrolled MFA methods
+	*/
+	const mfaFactors = tableCreator("mfa_factors", {
+		id: uuid("id").defaultRandom().primaryKey(),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+		factorType: text("factor_type").notNull(),
+		secretEncrypted: text("secret_encrypted").notNull(),
+		friendlyName: text("friendly_name"),
+		verified: boolean("verified").default(false).notNull(),
+		/**
+		* The highest TOTP time step ever accepted for this factor. RFC 6238
+		* §5.2 forbids accepting an OTP twice, and the ±1 step window that
+		* exists for clock drift is also a 90-second replay window: without
+		* this, one observed code buys a fresh session for a minute and a half.
+		*/
+		lastUsedCounter: bigint("last_used_counter", { mode: "number" }),
+		createdAt: timestamp("created_at").defaultNow().notNull(),
+		updatedAt: timestamp("updated_at").defaultNow().notNull()
+	});
+	return {
+		usersSchema,
+		users,
+		refreshTokens,
+		passwordResetTokens,
+		appConfig,
+		userIdentities,
+		mfaFactors,
+		mfaChallenges: tableCreator("mfa_challenges", {
+			id: uuid("id").defaultRandom().primaryKey(),
+			factorId: uuid("factor_id").notNull().references(() => mfaFactors.id, { onDelete: "cascade" }),
+			createdAt: timestamp("created_at").defaultNow().notNull(),
+			verifiedAt: timestamp("verified_at"),
+			ipAddress: text("ip_address"),
+			/** Failed guesses recorded against this challenge; bounded by the route. */
+			attempts: integer("attempts").default(0).notNull(),
+			expiresAt: timestamp("expires_at").notNull()
+		}),
+		recoveryCodes: tableCreator("recovery_codes", {
+			id: uuid("id").defaultRandom().primaryKey(),
+			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+			codeHash: text("code_hash").notNull(),
+			usedAt: timestamp("used_at"),
+			createdAt: timestamp("created_at").defaultNow().notNull()
+		}),
+		magicLinkTokens: tableCreator("magic_link_tokens", {
+			id: uuid("id").defaultRandom().primaryKey(),
+			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+			tokenHash: text("token_hash").notNull().unique(),
+			expiresAt: timestamp("expires_at").notNull(),
+			usedAt: timestamp("used_at"),
+			createdAt: timestamp("created_at").defaultNow().notNull()
+		})
+	};
+}
+var defaultAuthSchema = createAuthSchema("rebase");
+var usersSchema = defaultAuthSchema.usersSchema;
+var users = defaultAuthSchema.users;
+var refreshTokens = defaultAuthSchema.refreshTokens;
+var passwordResetTokens = defaultAuthSchema.passwordResetTokens;
+var appConfig = defaultAuthSchema.appConfig;
+var userIdentities = defaultAuthSchema.userIdentities;
+var mfaFactors = defaultAuthSchema.mfaFactors;
+var mfaChallenges = defaultAuthSchema.mfaChallenges;
+var recoveryCodes = defaultAuthSchema.recoveryCodes;
+var magicLinkTokens = defaultAuthSchema.magicLinkTokens;
+var usersRelations = relations(users, ({ many }) => ({
+	refreshTokens: many(refreshTokens),
+	passwordResetTokens: many(passwordResetTokens),
+	userIdentities: many(userIdentities),
+	mfaFactors: many(mfaFactors),
+	recoveryCodes: many(recoveryCodes),
+	magicLinkTokens: many(magicLinkTokens)
+}));
+var refreshTokensRelations = relations(refreshTokens, ({ one }) => ({ user: one(users, {
+	fields: [refreshTokens.uid],
+	references: [users.id]
+}) }));
+var passwordResetTokensRelations = relations(passwordResetTokens, ({ one }) => ({ user: one(users, {
+	fields: [passwordResetTokens.uid],
+	references: [users.id]
+}) }));
+var userIdentitiesRelations = relations(userIdentities, ({ one }) => ({ user: one(users, {
+	fields: [userIdentities.uid],
+	references: [users.id]
+}) }));
+var mfaFactorsRelations = relations(mfaFactors, ({ one, many }) => ({
+	user: one(users, {
+		fields: [mfaFactors.uid],
+		references: [users.id]
+	}),
+	challenges: many(mfaChallenges)
+}));
+var mfaChallengesRelations = relations(mfaChallenges, ({ one }) => ({ factor: one(mfaFactors, {
+	fields: [mfaChallenges.factorId],
+	references: [mfaFactors.id]
+}) }));
+var recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({ user: one(users, {
+	fields: [recoveryCodes.uid],
+	references: [users.id]
+}) }));
+var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user: one(users, {
+	fields: [magicLinkTokens.uid],
+	references: [users.id]
+}) }));
+//#endregion
 //#region src/cli-output.ts
 /**
 * Terminal output for the `rebase db|schema|doctor` commands.
@@ -14001,7 +14367,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-BY1pHRD_.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-jYsvOLZF.js").then((n) => n.t);
 			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(failure.kind === "comment-column" ? `🔍 [schema] Could not record the search fingerprint on "${failure.target}" — search works, but a later change to the \`search\` block will not be detected: ${failure.error}` : `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
 			return { applied: plan.actions.length - plan.failures.length };
@@ -14022,7 +14388,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* stays RLS-enabled, so it denies rather than leaks.
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-BVFb2olB.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-CVfVHS6o.js");
 			const queryable = provisioningQueryable(driverResult);
 			const outcome = await ensureCollectionPolicies(queryable, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);