@rebasepro/server-postgres 0.9.1-canary.1d2d8b5 → 0.9.1-canary.5809e39

package/dist/index.es.js

@@ -6,12 +6,12 @@ import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, or, relations, sql } from "drizzle-orm";
 import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
-import { createHash, randomUUID } from "crypto";
 import fs, { promises } from "fs";
 import path from "path";
 import chokidar from "chokidar";
 import { WebSocket, WebSocketServer } from "ws";
 import { EventEmitter } from "events";
+import { randomUUID } from "crypto";
 import { inspect } from "util";
 import os from "os";
 import { fileURLToPath } from "node:url";
@@ -71,16 +71,51 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 var connection_exports = /* @__PURE__ */ __exportAll({
 	createDirectDatabaseConnection: () => createDirectDatabaseConnection,
 	createPostgresDatabaseConnection: () => createPostgresDatabaseConnection,
-	createReadReplicaConnection: () => createReadReplicaConnection
+	createReadReplicaConnection: () => createReadReplicaConnection,
+	guardPoolAgainstDirtyRelease: () => guardPoolAgainstDirtyRelease
 });
 var DEFAULT_POOL = {
 	max: 20,
 	idleTimeoutMillis: 3e4,
 	connectionTimeoutMillis: 1e4,
-	queryTimeout: 3e4,
+	queryTimeout: 6e4,
 	statementTimeout: 3e4,
 	keepAlive: true
 };
+/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
+var TX_IDLE = "I";
+/**
+* Destroy pool clients that are released while still inside a transaction.
+*
+* pg-pool returns a client to the idle list whenever `release()` is called
+* without an error — even if the connection is still mid-transaction (status
+* `T`/`E`). That happens in practice: drizzle's pool transaction releases in
+* a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
+* (e.g. it was queued behind a statement that hit the client-side
+* query_timeout), the client goes back dirty. The next checkout then runs
+* its statements inside the zombie transaction — with the previous request's
+* `app.*` RLS GUCs still applied, which turns unrelated queries into
+* RLS-scoped ones (observed in production as registration failing with
+* SQLSTATE 42501 under a leaked anonymous context).
+*
+* pg-pool emits `release` before it consults its private `_expired` set, so
+* marking the client expired here makes `_release()` destroy it instead of
+* pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
+* private APIs — feature-detect and fall back to loud logging so an upstream
+* change degrades to observability, never to silent corruption.
+*/
+function guardPoolAgainstDirtyRelease(pool, label) {
+	pool.on("release", (err, client) => {
+		if (err) return;
+		const txStatus = client?._txStatus;
+		if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
+		const expired = pool._expired;
+		if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
+			expired.add(client);
+			logger.error(`[${label}] Client released back to the pool while still in a transaction (status '${txStatus}') — destroying it so the open transaction and its session state (RLS GUCs) cannot leak into the next request.`);
+		} else logger.error(`[${label}] Client released mid-transaction (status '${txStatus}') but the pool's internal expiry set is unavailable (pg-pool internals changed?). The connection may leak its open transaction into subsequent requests.`);
+	});
+}
 /**
 * Create a Drizzle-backed Postgres connection with a production-grade
 * connection pool.
@@ -112,6 +147,7 @@ function createPostgresDatabaseConnection(connectionString, schema, poolConfig)
 		logger.error("[pg-pool] Unexpected pool error", { detail: err.message });
 		if (err.message.includes("ETIMEDOUT")) logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -144,6 +180,7 @@ function createDirectDatabaseConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -173,6 +210,7 @@ function createReadReplicaConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -1502,6 +1540,140 @@ function removeFunctions(o) {
 	return o;
 }
 //#endregion
+//#region ../utils/src/sha1.ts
+/**
+* Minimal SHA-1 implementation that runs in both Node and the browser.
+*
+* This exists because generated Postgres policy names embed a SHA-1 digest of
+* the security rule. The DDL generator runs on the server (where `node:crypto`
+* is available) but the Studio has to derive the same names in the browser to
+* tell a policy it generated apart from one it did not. `node:crypto` cannot be
+* bundled for the browser, so the shared derivation needs a portable digest.
+*
+* SHA-1 is used purely to name things deterministically — never for security.
+* The output is byte-identical to `createHash("sha1").update(str).digest("hex")`,
+* which `sha1.test.ts` pins against `node:crypto` directly.
+*/
+/** Rotate a 32-bit word left by `n` bits. */
+function rotl(value, n) {
+	return value << n | value >>> 32 - n;
+}
+/**
+* SHA-1 digest of a string, hex-encoded.
+*
+* The input is encoded as UTF-8, matching Node's default handling of strings
+* passed to `hash.update(str)`.
+*/
+function sha1Hex(input) {
+	const bytes = Array.from(new TextEncoder().encode(input));
+	const bitLength = bytes.length * 8;
+	bytes.push(128);
+	while (bytes.length % 64 !== 56) bytes.push(0);
+	const hi = Math.floor(bitLength / 4294967296);
+	const lo = bitLength >>> 0;
+	bytes.push(hi >>> 24 & 255, hi >>> 16 & 255, hi >>> 8 & 255, hi & 255);
+	bytes.push(lo >>> 24 & 255, lo >>> 16 & 255, lo >>> 8 & 255, lo & 255);
+	let h0 = 1732584193;
+	let h1 = 4023233417;
+	let h2 = 2562383102;
+	let h3 = 271733878;
+	let h4 = 3285377520;
+	const w = new Array(80);
+	for (let offset = 0; offset < bytes.length; offset += 64) {
+		for (let i = 0; i < 16; i++) {
+			const j = offset + i * 4;
+			w[i] = bytes[j] << 24 | bytes[j + 1] << 16 | bytes[j + 2] << 8 | bytes[j + 3] | 0;
+		}
+		for (let i = 16; i < 80; i++) w[i] = rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
+		let a = h0;
+		let b = h1;
+		let c = h2;
+		let d = h3;
+		let e = h4;
+		for (let i = 0; i < 80; i++) {
+			let f;
+			let k;
+			if (i < 20) {
+				f = b & c | ~b & d;
+				k = 1518500249;
+			} else if (i < 40) {
+				f = b ^ c ^ d;
+				k = 1859775393;
+			} else if (i < 60) {
+				f = b & c | b & d | c & d;
+				k = 2400959708;
+			} else {
+				f = b ^ c ^ d;
+				k = 3395469782;
+			}
+			const temp = rotl(a, 5) + f + e + k + w[i] | 0;
+			e = d;
+			d = c;
+			c = rotl(b, 30);
+			b = a;
+			a = temp;
+		}
+		h0 = h0 + a | 0;
+		h1 = h1 + b | 0;
+		h2 = h2 + c | 0;
+		h3 = h3 + d | 0;
+		h4 = h4 + e | 0;
+	}
+	return [
+		h0,
+		h1,
+		h2,
+		h3,
+		h4
+	].map((word) => (word >>> 0).toString(16).padStart(8, "0")).join("");
+}
+//#endregion
+//#region ../utils/src/policy-names.ts
+/**
+* Naming of the Postgres policies generated from a collection's security rules.
+*
+* A rule without an explicit `name` is compiled to `<table>_<op>_<hash>`, where
+* the hash covers the rule's semantics. The Studio needs the same names to tell
+* "this policy came from your code" apart from "someone wrote this in SQL" —
+* without them it treats generated policies as foreign and offers to import
+* them back into the codebase they came from.
+*
+* This is the single definition of that naming. The DDL and Drizzle generators
+* both derive names from here, so a change cannot silently rename every policy
+* in every deployed database while the UI keeps matching the old ones.
+*/
+/** Stable digest of the parts of a rule that determine what the policy does. */
+function getPolicyNameHash(rule) {
+	return sha1Hex(JSON.stringify({
+		a: rule.access,
+		m: rule.mode,
+		op: rule.operation,
+		ops: rule.operations?.slice().sort(),
+		own: rule.ownerField,
+		rol: rule.roles?.slice().sort(),
+		pg: rule.pgRoles?.slice().sort(),
+		u: rule.using,
+		w: rule.withCheck,
+		c: rule.condition,
+		ch: rule.check
+	})).substring(0, 7);
+}
+/** The operations a rule expands to — `operations` wins over `operation`. */
+function getPolicyOperations(rule) {
+	return rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+}
+/**
+* Every Postgres policy name a single rule compiles to — one per operation.
+*
+* @param rule      The security rule as written in the collection config.
+* @param tableName The rule's table (see `getTableName` in `@rebasepro/common`).
+*/
+function getPolicyNamesForRule(rule, tableName) {
+	const ops = getPolicyOperations(rule);
+	const ruleHash = getPolicyNameHash(rule);
+	return ops.map((op, opIdx) => rule.name ? ops.length > 1 ? `${rule.name}_${op}` : rule.name : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`);
+}
+//#endregion
 //#region ../utils/src/names.ts
 /**
 * Generates a foreign key column name from a given string, typically a collection slug or name.
@@ -1626,6 +1798,109 @@ function createRelationRefWithData(id, path, data) {
 		data
 	};
 }
+/**
+* Derive a row's address from its key columns.
+*
+* Single key → the value as a string. Composite → each part joined by
+* {@link COMPOSITE_ID_SEPARATOR}, in primary-key order, which is what
+* {@link parseIdValues} expects to invert.
+*/
+function buildCompositeId(values, primaryKeys) {
+	if (primaryKeys.length === 0) return "";
+	if (primaryKeys.length === 1) return String(values[primaryKeys[0].fieldName] ?? "");
+	return primaryKeys.map((pk) => String(values[pk.fieldName] ?? "")).join(":::");
+}
+/**
+* Invert {@link buildCompositeId}: turn an address back into key columns, each
+* coerced to the type its column actually round-trips as.
+*
+* This is the boundary where a URL segment becomes a query parameter, so a
+* malformed address must throw rather than silently produce a query that
+* matches the wrong row (or none).
+*/
+function parseIdValues(idValue, primaryKeys) {
+	const result = {};
+	if (primaryKeys.length === 0) return result;
+	if (primaryKeys.length === 1) {
+		const pk = primaryKeys[0];
+		if (pk.type === "number" && !pk.isUUID) {
+			const parsed = typeof idValue === "number" ? idValue : parseInt(String(idValue), 10);
+			if (isNaN(parsed)) throw new Error(`Invalid numeric ID: ${idValue}`);
+			result[pk.fieldName] = parsed;
+		} else result[pk.fieldName] = String(idValue);
+		return result;
+	}
+	const parts = String(idValue).split(":::");
+	if (parts.length !== primaryKeys.length) throw new Error(`Composite ID parts mismatch. Expected ${primaryKeys.length}, got ${parts.length} for ID: ${idValue}`);
+	for (let i = 0; i < primaryKeys.length; i++) {
+		const pk = primaryKeys[i];
+		const val = parts[i];
+		if (pk.type === "number" && !pk.isUUID) {
+			const parsed = parseInt(val, 10);
+			if (isNaN(parsed)) throw new Error(`Invalid numeric ID component: ${val}`);
+			result[pk.fieldName] = parsed;
+		} else result[pk.fieldName] = val;
+	}
+	return result;
+}
+/**
+* The primary keys of a collection, as declared by its properties.
+*
+* This is the only tier both sides can read, because it is the only one written
+* in the config: the postgres driver can also infer keys from the Drizzle
+* schema, which the browser never sees and is never sent — the admin compiles
+* the collection files into its own bundle rather than being served them. A key
+* that lives only in the Drizzle schema is therefore invisible here, and the
+* server says so at boot (`warnOnKeysTheAdminCannotResolve`) naming the `isId`
+* to add.
+*
+* Returns an empty array when a collection declares none, which callers must
+* treat as "not addressable" rather than defaulting to `id`: guessing a key
+* that is not the real one produces confidently wrong addresses.
+*/
+function getDeclaredPrimaryKeys(collection) {
+	const properties = collection.properties;
+	if (!properties) return [];
+	const keys = [];
+	for (const [fieldName, propRaw] of Object.entries(properties)) {
+		const prop = propRaw;
+		if (!prop || typeof prop !== "object") continue;
+		if (!("isId" in prop) || !prop.isId) continue;
+		keys.push({
+			fieldName,
+			type: prop.type === "number" ? "number" : "string",
+			isUUID: prop.isId === "uuid"
+		});
+	}
+	return keys;
+}
+/**
+* The keys to address a collection's rows with, resolved the way the driver
+* resolves them — minus the tier the browser cannot reach.
+*
+* The postgres driver tries, in order: properties marked `isId`; the primary
+* keys of the Drizzle schema; and finally a column literally named `id`. Only
+* the first and last are visible in a `CollectionConfig`, which is what both
+* sides share.
+*
+* So the two agree except on a collection that declares no `isId` and whose key
+* is known only to Drizzle. There, the driver reads the real key, and this
+* either resolves nothing (reported to the console by the caller) or — if the
+* table happens to have an unrelated `id` property — resolves `id`, which is
+* the wrong key and cannot be detected from here: the addresses look right and
+* route wrong. Only the config can settle it, so the server names both cases
+* at boot (`warnOnKeysTheAdminCannotResolve`) with the `isId` to add.
+*/
+function resolvePrimaryKeys(collection) {
+	const declared = getDeclaredPrimaryKeys(collection);
+	if (declared.length > 0) return declared;
+	const idProp = collection.properties?.id;
+	if (idProp && typeof idProp === "object") return [{
+		fieldName: "id",
+		type: idProp.type === "number" ? "number" : "string"
+	}];
+	return [];
+}
 //#endregion
 //#region ../common/src/util/enums.ts
 function enumToObjectEntries(enumValues) {
@@ -2284,6 +2559,307 @@ var buildPropertyCallbacks = (properties) => {
 	};
 	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
 };
+//#endregion
+//#region ../common/src/util/auth-default-policies.ts
+/**
+* Default RLS policies injected by the schema generator.
+*
+* Rebase's enforcement model is unified: authenticated (user-context) requests
+* run under the restricted `rebase_user` role, so Postgres RLS binds *every*
+* statement — reads and writes. A collection's `securityRules` are the whole
+* authorization model. The server context (auth flows, migrations,
+* `dataAsAdmin`) runs as the owner and bypasses RLS.
+*
+* Because RLS default-denies, every collection is **locked by default**: with
+* no rules, only the server context and admins can touch it. The generator
+* injects that safe baseline:
+*
+* **For every collection**
+*  1. A permissive **server-or-admin SELECT** grant.
+*  2. A permissive **server-or-admin write** grant (insert/update/delete).
+*
+* Author `securityRules` are permissive and OR together, so explicit rules only
+* *broaden* access from this locked baseline (e.g. "users read/write their own
+* rows").
+*
+* **For auth collections additionally**
+*  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
+*     their own row (profile, session bootstrap) without every app re-declaring
+*     it.
+*  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
+*     every other policy, so a write is rejected unless the caller is an admin
+*     (or the server context) — even if the author also wrote a permissive rule
+*     such as "a user may edit their own row". Without this, a permissive owner
+*     rule would let a user change their own `roles`.
+*
+* The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
+* — the built-in flows that run without a user (signup, migrations) set no user
+* GUC — which also lets the owner connection satisfy these policies even under
+* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
+* `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
+*
+* Opt out with `disableDefaultPolicies: true` to take full responsibility for
+* the collection's RLS.
+*/
+var SERVER_OR_ADMIN_EXPR$1 = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/** Write operations that must be admin-gated by default on auth collections. */
+var DEFAULT_GUARDED_OPS = [
+	"insert",
+	"update",
+	"delete"
+];
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection) {
+	const auth = collection.auth;
+	return auth === true || typeof auth === "object" && auth?.enabled === true;
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName$1(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/**
+* Returns the security rules that should be applied to a collection: the
+* author's explicit `securityRules` plus the framework defaults described in
+* the module doc (baseline server/admin read for all collections; self-read
+* and the admin write gate for auth collections).
+*
+* Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+*/
+function getEffectiveSecurityRules(collection) {
+	const explicit = [...(isPostgresCollectionConfig(collection) ? collection.securityRules : void 0) ?? []];
+	if (collection.disableDefaultPolicies) return explicit;
+	const tableName = getTableName$1(collection);
+	const injected = [];
+	injected.push({
+		name: `${tableName}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR$1
+	});
+	injected.push({
+		name: `${tableName}_default_admin_write`,
+		operations: [...DEFAULT_GUARDED_OPS],
+		condition: SERVER_OR_ADMIN_EXPR$1,
+		check: SERVER_OR_ADMIN_EXPR$1
+	});
+	if (isAuthCollection(collection)) {
+		injected.push({
+			name: `${tableName}_default_self_read`,
+			operations: ["select"],
+			condition: policy.compare(policy.field(getIdPropertyName$1(collection)), "eq", policy.authUid())
+		});
+		injected.push({
+			name: `${tableName}_require_admin_write`,
+			mode: "restrictive",
+			operations: [...DEFAULT_GUARDED_OPS],
+			condition: SERVER_OR_ADMIN_EXPR$1,
+			check: SERVER_OR_ADMIN_EXPR$1
+		});
+	}
+	return [...explicit, ...injected];
+}
+//#endregion
+//#region ../common/src/util/junction-policies.ts
+var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/**
+* Walk every collection's resolved relations and aggregate the junction tables
+* they declare. Two collections may declare the same junction from opposite
+* sides (posts→tags and tags→posts through `posts_tags`); both become
+* `declaringSides` of one spec, so derived write grants consider both.
+*/
+function resolveJunctionSpecs(collections) {
+	const specs = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const resolved = resolveCollectionRelations(collection);
+		for (const relation of Object.values(resolved)) {
+			if (!relation.through) continue;
+			const targetCollection = typeof relation.target === "function" ? relation.target() : void 0;
+			if (!targetCollection) continue;
+			const rawName = relation.through.table;
+			const table = rawName.includes(".") ? rawName.split(".").pop() : rawName;
+			const schema = "public";
+			const source = {
+				collection,
+				junctionColumn: relation.through.sourceColumn,
+				relation
+			};
+			const target = {
+				collection: targetCollection,
+				junctionColumn: relation.through.targetColumn
+			};
+			const existing = specs.get(table);
+			if (!existing) specs.set(table, {
+				table,
+				schema,
+				endpoints: [source, target],
+				declaringSides: [source]
+			});
+			else if (!existing.declaringSides.some((s) => s.collection === collection)) existing.declaringSides.push(source);
+		}
+	}
+	return specs;
+}
+/**
+* A synthetic CollectionConfig standing in for the junction during policy
+* compilation and naming. Its two FK columns carry explicit `columnName`s so
+* `outerField` operands resolve to the exact columns the CREATE TABLE emitted,
+* whatever their casing.
+*/
+function getJunctionCollectionConfig(spec) {
+	const properties = {};
+	for (const endpoint of spec.endpoints) properties[endpoint.junctionColumn] = {
+		type: "string",
+		columnName: endpoint.junctionColumn
+	};
+	return {
+		slug: spec.table,
+		name: spec.table,
+		table: spec.table,
+		schema: spec.schema,
+		properties
+	};
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/** `EXISTS (SELECT 1 FROM endpoint WHERE endpoint.pk = junction.fk [AND extra])`. */
+function existsEndpoint(endpoint, extra) {
+	const correlation = policy.compare(policy.field(getIdPropertyName(endpoint.collection)), "eq", policy.outerField(endpoint.junctionColumn));
+	return policy.existsIn({
+		collection: endpoint.collection.slug,
+		where: extra ? policy.and(correlation, extra) : correlation
+	});
+}
+/**
+* Whether a parent-rule expression keeps its meaning when moved inside the
+* junction's `EXISTS` subquery — and the re-scoped copy if it does.
+*
+* Returns `null` when the rule cannot be embedded faithfully: `raw` SQL
+* anywhere (its `{column}` placeholders would bind to the junction), or an
+* `outerField` inside a nested `existsIn` (it would bind to the junction while
+* the author meant the parent, and no operand can express "the middle scope").
+* Top-level `outerField`s are rewritten to `field`, which is what they meant.
+*/
+function embedParentExpression(expr, depth = 0) {
+	switch (expr.kind) {
+		case "raw": return null;
+		case "and":
+		case "or": {
+			const parts = [];
+			for (const child of expr.operands) {
+				const embedded = embedParentExpression(child, depth);
+				if (!embedded) return null;
+				parts.push(embedded);
+			}
+			return expr.kind === "and" ? policy.and(...parts) : policy.or(...parts);
+		}
+		case "not": {
+			const embedded = embedParentExpression(expr.operand, depth);
+			return embedded ? policy.not(embedded) : null;
+		}
+		case "existsIn": {
+			const where = embedParentExpression(expr.where, depth + 1);
+			return where ? policy.existsIn({
+				collection: expr.collection,
+				where
+			}) : null;
+		}
+		case "compare": {
+			const left = embedOperand(expr.left, depth);
+			const right = embedOperand(expr.right, depth);
+			if (!left || !right) return null;
+			return {
+				...expr,
+				left,
+				right
+			};
+		}
+		default: return expr;
+	}
+}
+/** Re-scope an operand, or return `null` if its binding cannot be preserved. */
+function embedOperand(operand, depth) {
+	if (operand.kind === "outerField") {
+		if (depth === 0) return policy.field(operand.name);
+		return null;
+	}
+	return operand;
+}
+/** Does the rule cover the `update` operation? */
+function coversUpdate(rule) {
+	return getPolicyOperations(rule).some((op) => op === "update" || op === "all");
+}
+/**
+* The full derived policy set for a junction table: the locked server/admin
+* baseline, the endpoint-visibility read grant, inherited write grants, and
+* inherited restrictive gates. Returns `[]` when every declaring collection set
+* `disableDefaultPolicies` — the junction is then the author's to police, and
+* stays locked (RLS is still enabled) until they write policies for it.
+*/
+function getJunctionSecurityRules(spec) {
+	if (spec.declaringSides.every((side) => side.collection.disableDefaultPolicies)) return [];
+	const rules = [];
+	rules.push({
+		name: `${spec.table}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_admin_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: SERVER_OR_ADMIN_EXPR,
+		check: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_edge_read`,
+		operations: ["select"],
+		condition: policy.and(existsEndpoint(spec.endpoints[0]), existsEndpoint(spec.endpoints[1]))
+	});
+	const writeGrants = [];
+	for (const side of spec.declaringSides) {
+		const updateRules = ((isPostgresCollectionConfig(side.collection) ? side.collection.securityRules : void 0) ?? []).filter(coversUpdate);
+		const permissive = updateRules.filter((r) => r.mode !== "restrictive");
+		const restrictive = updateRules.filter((r) => r.mode === "restrictive");
+		const embeddedGates = [];
+		let gatesEmbeddable = true;
+		for (const gate of restrictive) {
+			const using = securityRuleToConditions(gate).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (!embedded) {
+				gatesEmbeddable = false;
+				break;
+			}
+			embeddedGates.push(embedded);
+		}
+		if (!gatesEmbeddable) continue;
+		const grants = [];
+		for (const rule of permissive) {
+			const using = securityRuleToConditions(rule).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (embedded) grants.push(embedded);
+		}
+		if (grants.length === 0) continue;
+		const condition = embeddedGates.length > 0 ? policy.and(policy.or(...grants), ...embeddedGates) : policy.or(...grants);
+		writeGrants.push(existsEndpoint(side, condition));
+	}
+	if (writeGrants.length > 0) rules.push({
+		name: `${spec.table}_default_edge_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants),
+		check: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants)
+	});
+	return rules;
+}
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(root, factory) {
 		if (typeof define === "function" && define.amd) define(factory);
@@ -3553,18 +4129,45 @@ function deserializeFilter(query) {
 }
 //#endregion
 //#region ../common/src/data/buildRebaseData.ts
+function createPrimaryKeyResolver(options) {
+	const cache = /* @__PURE__ */ new Map();
+	const warned = /* @__PURE__ */ new Set();
+	return function primaryKeysFor(slug) {
+		const cached = cache.get(slug);
+		if (cached) return cached;
+		const collection = options?.resolveCollection?.(slug);
+		if (!collection) return [];
+		const keys = resolvePrimaryKeys(collection);
+		if (keys.length > 0) {
+			cache.set(slug, keys);
+			return keys;
+		}
+		if (!warned.has(slug)) {
+			warned.add(slug);
+			console.warn(`[rebase] Collection '${slug}' declares no primary key, so its rows have no address: detail links, caching and relations will not work for it. Mark the key property with \`isId\` in its collection config — the server logs which column to mark at boot, if its schema knows the key.`);
+		}
+		return keys;
+	};
+}
 /**
-* Convert a flat REST record (e.g. from RestFetchService) to Entity<M> format.
-* Mirrors the client SDK's rowToEntity conversion.
+* Give a flat row the Entity view-model the admin renders.
+*
+* The address is *derived here* — it is not a column, and the row it came from
+* does not contain one. Rows carry exactly what the table has, with the types
+* Postgres returned; the id is this layer's invention, and this is the only
+* place it is minted.
+*
+* `primaryKeys` empty falls back to a literal `id` on the row: drivers other
+* than postgres still serve rows with one, and this keeps them working.
 */
-function rowToEntity(row, slug) {
+function rowToEntity(row, slug, primaryKeys = []) {
 	return {
-		id: row.id,
+		id: primaryKeys.length > 0 ? buildCompositeId(row, primaryKeys) : row.id,
 		path: slug,
 		values: row
 	};
 }
-function createDriverAccessor(driver, slug) {
+function createDriverAccessor(driver, slug, getPks = () => []) {
 	const accessor = {
 		async find(params) {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
@@ -3597,7 +4200,7 @@ function createDriverAccessor(driver, slug) {
 				hasMore = offset + rows.length < total;
 			}
 			return {
-				data: rows.map((row) => rowToEntity(row, slug)),
+				data: rows.map((row) => rowToEntity(row, slug, getPks())),
 				meta: {
 					total,
 					limit,
@@ -3611,7 +4214,7 @@ function createDriverAccessor(driver, slug) {
 				path: slug,
 				id
 			});
-			return row ? rowToEntity(row, slug) : void 0;
+			return row ? rowToEntity(row, slug, getPks()) : void 0;
 		},
 		async create(data, id) {
 			return rowToEntity(await driver.save({
@@ -3619,15 +4222,22 @@ function createDriverAccessor(driver, slug) {
 				values: data,
 				id,
 				status: "new"
-			}), slug);
+			}), slug, getPks());
 		},
+		createMany: driver.saveMany ? async (data, options) => {
+			return (await driver.saveMany({
+				path: slug,
+				rows: data,
+				upsert: options?.upsert
+			})).map((row) => rowToEntity(row, slug, getPks()));
+		} : void 0,
 		async update(id, data) {
 			return rowToEntity(await driver.save({
 				path: slug,
 				values: data,
 				id,
 				status: "existing"
-			}), slug);
+			}), slug, getPks());
 		},
 		async delete(id) {
 			return driver.delete({ row: {
@@ -3656,7 +4266,7 @@ function createDriverAccessor(driver, slug) {
 				searchString: params?.searchString,
 				onUpdate: (entities) => {
 					onUpdate({
-						data: entities.map((row) => rowToEntity(row, slug)),
+						data: entities.map((row) => rowToEntity(row, slug, getPks())),
 						meta: {
 							total: entities.length,
 							limit,
@@ -3672,7 +4282,7 @@ function createDriverAccessor(driver, slug) {
 			return driver.listenOne({
 				path: slug,
 				id,
-				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug) : void 0),
+				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug, getPks()) : void 0),
 				onError
 			});
 		} : void 0,
@@ -3711,12 +4321,13 @@ function createDriverAccessor(driver, slug) {
 * await data.products.create({ name: "Camera", price: 299 });
 * const { data: items } = await data.products.find({ where: { status: ["==", "published"] } });
 */
-function buildRebaseData(driver) {
+function buildRebaseData(driver, options) {
 	const cache = /* @__PURE__ */ new Map();
+	const primaryKeysFor = createPrimaryKeyResolver(options);
 	function getAccessor(slug) {
 		let accessor = cache.get(slug);
 		if (!accessor) {
-			accessor = createDriverAccessor(driver, slug);
+			accessor = createDriverAccessor(driver, slug, () => primaryKeysFor(slug));
 			cache.set(slug, accessor);
 		}
 		return accessor;
@@ -3729,8 +4340,9 @@ function buildRebaseData(driver) {
 	} });
 }
 /**
-* Unwrap a Entity into a flat row. `rowToEntity` stores the whole flat row
-* (id included) under `.values`, so this is just that payload.
+* Unwrap a Entity back into the flat row it was built from. `rowToEntity` keeps
+* the row untouched under `.values` and derives `.id` alongside it, so dropping
+* the wrapper is the whole operation — the address was never part of the row.
 */
 function entityToRow(entity) {
 	return entity.values;
@@ -3817,6 +4429,12 @@ function toSdkCollectionClient(snap) {
 		async create(data, id) {
 			return entityToRow(await snap.create(data, id));
 		},
+		async createMany(data, options) {
+			if (!Array.isArray(data)) throw new TypeError("createMany expects an array of records.");
+			if (data.length === 0) return [];
+			if (!snap.createMany) throw new Error("Bulk writes are not supported by this collection's data source. Fall back to create() per record.");
+			return (await snap.createMany(data, options)).map(entityToRow);
+		},
 		async update(id, data) {
 			return entityToRow(await snap.update(id, data));
 		},
@@ -3969,8 +4587,26 @@ function getTableForCollection(collection, registry) {
 	if (!table) throw new Error(`Table not found for collection '${collection.slug}' (table: ${tableName})`);
 	return table;
 }
+/**
+* The key columns a collection's rows are addressed by.
+*
+* Three tiers, in order: properties marked `isId`, the primary keys of the
+* drizzle schema, and finally a column literally named `id`. Only the first is
+* visible to the browser, which is why a key known only to drizzle is reported
+* at boot — see {@link warnOnKeysTheAdminCannotResolve}.
+*
+* Returns `[]` when nothing resolves, rather than throwing. It used to open by
+* resolving the table, which throws when there is none — so the `isId` tier,
+* which needs no table at all, was unreachable for exactly the collections
+* most likely to have no table registered. Every caller that wanted "no keys"
+* to mean "no keys" had to spell that out in a try/catch.
+*
+* Callers that cannot proceed without a key must say so themselves, naming the
+* collection: an empty array here means "this collection has no address", which
+* is a different answer in a notification (broadcast a wildcard) than in a save
+* (fail).
+*/
 function getPrimaryKeys(collection, registry) {
-	const table = getTableForCollection(collection, registry);
 	if (collection.properties) {
 		const idProps = Object.entries(collection.properties).filter(([_, prop]) => "isId" in prop && Boolean(prop.isId)).map(([key, prop]) => ({
 			fieldName: key,
@@ -3979,6 +4615,8 @@ function getPrimaryKeys(collection, registry) {
 		}));
 		if (idProps.length > 0) return idProps;
 	}
+	const table = registry.getTable(getTableName$1(collection));
+	if (!table) return [];
 	const keys = [];
 	for (const [key, colRaw] of Object.entries(table)) {
 		const col = colRaw;
@@ -4006,35 +4644,89 @@ function getPrimaryKeys(collection, registry) {
 	}
 	return keys;
 }
-function parseIdValues(idValue, primaryKeys) {
-	const result = {};
-	if (primaryKeys.length === 0) return result;
-	if (primaryKeys.length === 1) {
-		const pk = primaryKeys[0];
-		if (pk.type === "number" && !pk.isUUID) {
-			const parsed = typeof idValue === "number" ? idValue : parseInt(String(idValue), 10);
-			if (isNaN(parsed)) throw new Error(`Invalid numeric ID: ${idValue}`);
-			result[pk.fieldName] = parsed;
-		} else result[pk.fieldName] = String(idValue);
-		return result;
-	}
-	const parts = String(idValue).split(":::");
-	if (parts.length !== primaryKeys.length) throw new Error(`Composite ID parts mismatch. Expected ${primaryKeys.length}, got ${parts.length} for ID: ${idValue}`);
-	for (let i = 0; i < primaryKeys.length; i++) {
-		const pk = primaryKeys[i];
-		const val = parts[i];
-		if (pk.type === "number" && !pk.isUUID) {
-			const parsed = parseInt(val, 10);
-			if (isNaN(parsed)) throw new Error(`Invalid numeric ID component: ${val}`);
-			result[pk.fieldName] = parsed;
-		} else result[pk.fieldName] = val;
+/**
+* The key columns, for callers that cannot do their job without one.
+*
+* {@link getPrimaryKeys} answers "what keys, if any" and returns `[]` for a
+* collection with no address. Most of this driver, though, is building a WHERE
+* clause and has no meaning without a key — for those, an empty array is not an
+* answer, and indexing `[0]` into it produces `Cannot read properties of
+* undefined` three frames from where the real problem is. This says what is
+* wrong and which collection it is wrong about.
+*/
+function requirePrimaryKeys(collection, registry) {
+	const keys = getPrimaryKeys(collection, registry);
+	if (keys.length === 0) throw new Error(`Collection '${collection.slug}' has no primary key, so its rows cannot be addressed. Mark the key property with \`isId\` in its config, or register a table whose schema declares one.`);
+	return keys;
+}
+/**
+* Collections whose key the *browser* cannot resolve, and what it will do
+* instead.
+*
+* The two sides resolve keys from different evidence. This driver reads, in
+* order: properties marked `isId`, the primary keys of the Drizzle schema, then
+* a column literally named `id`. The admin shares the `CollectionConfig` — it
+* compiles the same collection files into its bundle — but never the Drizzle
+* schema, so the middle tier is invisible to it.
+*
+* Nothing can normalize this at runtime: the server does not serve the admin
+* its collections, so a key resolved here cannot be handed over there. The
+* config files are the only thing both sides read, so the fix is an edit to
+* them, and the most this can do is say exactly which edit.
+*
+* Two shapes, and the second is the dangerous one:
+*
+* - No `isId`, no `id` property → the admin resolves no address, warns in the
+*   console, and rows cannot be opened or linked.
+* - No `isId`, but an `id` property that is *not* the key → the admin addresses
+*   rows by `id` while this driver reads the address as the real key. Nothing
+*   errors: the addresses look right and route wrong.
+*/
+function findUnresolvableKeyCollections(collections, registry) {
+	const findings = [];
+	for (const collection of collections) {
+		if (getDeclaredPrimaryKeys(collection).length > 0) continue;
+		const keys = getPrimaryKeys(collection, registry);
+		if (keys.length === 0) continue;
+		if (keys.length === 1 && keys[0].fieldName === "id") continue;
+		findings.push({
+			collection,
+			keys,
+			shadowedByIdProperty: Boolean(collection.properties?.id)
+		});
 	}
-	return result;
+	return findings;
 }
-function buildCompositeId(values, primaryKeys) {
-	if (primaryKeys.length === 0) return "";
-	if (primaryKeys.length === 1) return String(values[primaryKeys[0].fieldName] ?? "");
-	return primaryKeys.map((pk) => String(values[pk.fieldName] ?? "")).join(":::");
+/**
+* Report the collections from {@link findUnresolvableKeyCollections} at boot,
+* with the edit that fixes each one.
+*
+* Grouped by failure, not by collection: the shadowed case is a routing bug and
+* the silent case is a missing feature, and they deserve different urgency.
+*/
+function warnOnKeysTheAdminCannotResolve(collections, registry) {
+	const findings = findUnresolvableKeyCollections(collections, registry);
+	if (findings.length === 0) return;
+	const edit = (f) => `${f.collection.slug}: mark ${f.keys.map((k) => `\`${k.fieldName}\``).join(" and ")} with \`isId: ${f.keys[0].isUUID ? "\"uuid\"" : f.keys[0].type === "number" ? "\"increment\"" : "true"}\``;
+	const shadowed = findings.filter((f) => f.shadowedByIdProperty);
+	const silent = findings.filter((f) => !f.shadowedByIdProperty);
+	if (shadowed.length > 0) logger.warn("⚠️ These collections declare no `isId`, and their key is only in the drizzle schema — but they do have a property called `id`. The admin has no way to know `id` is not the key, so it will address rows by it while this server reads the address as the real key: the links look right and route wrong. Nothing will error.\n\n" + shadowed.map((f) => `  • ${edit(f)}`).join("\n") + "\n");
+	if (silent.length > 0) logger.warn("⚠️ These collections declare no `isId`, and their key is only in the drizzle schema, which the admin never sees. It will resolve no address for their rows, so detail links, caching and relations will not work for them:\n\n" + silent.map((f) => `  • ${edit(f)}`).join("\n") + "\n");
+}
+/**
+* The address of a row: derived from the collection's primary keys, because a
+* row does not carry one — it is exactly its columns.
+*
+* Falls back to a literal `id` column, for a row that reached us from somewhere
+* other than this driver. Returns `""` when there is no key and no `id` —
+* callers decide what that means, since "unaddressable" is a different answer
+* in a notification (broadcast a wildcard) than in a save (fail).
+*/
+function deriveRowAddress(row, collection, registry) {
+	const composite = buildCompositeId(row, getPrimaryKeys(collection, registry));
+	if (composite && composite.split(":::").some((part) => part !== "")) return composite;
+	if (row.id !== void 0 && row.id !== null) return String(row.id);
+	return "";
 }
 //#endregion
 //#region src/utils/drizzle-conditions.ts
@@ -4574,6 +5266,7 @@ var DrizzleConditionBuilder = class {
 	static buildVectorSearchConditions(table, vectorSearch) {
 		const column = table[vectorSearch.property];
 		if (!column) throw new Error(`Vector column '${vectorSearch.property}' not found in table`);
+		if (!Array.isArray(vectorSearch.vector) || vectorSearch.vector.length === 0 || !vectorSearch.vector.every((n) => typeof n === "number" && Number.isFinite(n))) throw new Error("Vector search requires a non-empty array of finite numbers");
 		const vectorLiteral = `'[${vectorSearch.vector.join(",")}]'::vector`;
 		const distanceFn = vectorSearch.distance || "cosine";
 		let operator;
@@ -4657,12 +5350,10 @@ function serializeDataToServer(row, properties, collection, registry) {
 					continue;
 				} else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) {
 					const serializedValue = serializePropertyToServer(effectiveValue, property);
-					const pks = getPrimaryKeys(collection, registry);
 					inverseRelationUpdates.push({
 						relationKey: key,
 						relation,
-						newValue: serializedValue,
-						currentId: row.id || buildCompositeId(row, pks)
+						newValue: serializedValue
 					});
 					continue;
 				} else if (relation.direction === "inverse" && relation.joinPath && relation.joinPath.length > 0) {
@@ -4672,15 +5363,11 @@ function serializeDataToServer(row, properties, collection, registry) {
 						relation,
 						newTargetId: serializedValue
 					});
-					else {
-						const pks = getPrimaryKeys(collection, registry);
-						inverseRelationUpdates.push({
-							relationKey: key,
-							relation,
-							newValue: serializedValue,
-							currentId: row.id || buildCompositeId(row, pks)
-						});
-					}
+					else inverseRelationUpdates.push({
+						relationKey: key,
+						relation,
+						newValue: serializedValue
+					});
 					continue;
 				} else if (relation.cardinality === "one" && relation.direction === "owning" && relation.joinPath && relation.joinPath.length > 0) {
 					const serializedValue = serializePropertyToServer(effectiveValue, property);
@@ -5080,6 +5767,63 @@ var RelationService = class {
 		this.registry = registry;
 	}
 	/**
+	* One target row, as the {@link RelatedRow} everything here returns.
+	*
+	* Eight sites built this by hand, which is how the address came to be the
+	* target's first key column in all eight — one edit, eight places to miss.
+	*
+	* `resolveNested` is the one thing they did not agree on, and the
+	* disagreement was invisible: the single-parent fetches pass `db` and
+	* `registry` to `parseDataFromServer`, so the target's *own* relations get
+	* resolved too, while the batch paths deliberately do not — a query per
+	* target row is the N+1 the batching exists to avoid. Naming the parameter
+	* makes that a decision rather than a difference between two call sites
+	* nobody was comparing.
+	*/
+	async toRelatedRow(targetRow, targetCollection, targetPks, options) {
+		const values = options?.resolveNested ? await parseDataFromServer(targetRow, targetCollection, this.db, this.registry) : await parseDataFromServer(targetRow, targetCollection);
+		return {
+			id: buildCompositeId(targetRow, targetPks),
+			path: targetCollection.slug,
+			values
+		};
+	}
+	/**
+	* A WHERE matching any of `parentIds`, by the whole key.
+	*
+	* A single key is an `IN (…)`. A composite one cannot be: matching
+	* `tenant_id IN (1, 1)` collects every row of tenant 1, so two parents that
+	* share their first column each receive the other's relations. It becomes
+	* an OR of ANDs — one exact address per parent — which Postgres indexes the
+	* same way it would a multi-column key lookup.
+	*/
+	parentKeyCondition(parentTable, parentPks, parentIds) {
+		const columnFor = (fieldName) => {
+			const col = parentTable[fieldName];
+			if (!col) throw new Error(`Key column '${fieldName}' not found in parent table`);
+			return col;
+		};
+		if (parentPks.length === 1) {
+			const values = parentIds.map((id) => parseIdValues(id, parentPks)[parentPks[0].fieldName]);
+			return inArray(columnFor(parentPks[0].fieldName), values);
+		}
+		return or(...parentIds.map((id) => {
+			const values = parseIdValues(id, parentPks);
+			return and(...parentPks.map((pk) => eq(columnFor(pk.fieldName), values[pk.fieldName])));
+		}));
+	}
+	/**
+	* Reject a relation that cannot express a composite-keyed parent.
+	*
+	* `localKey` and `foreignKeyOnTarget` are single column names: one column
+	* cannot reference a two-column key, so such a relation has no correct
+	* reading. Left alone it would silently match on the first key column and
+	* hand a tenant's rows to its neighbour — say so instead.
+	*/
+	assertSingleKeyAddressable(parentCollection, parentPks, via) {
+		if (parentPks.length > 1) throw new Error(`Relation on '${parentCollection.slug}' uses '${via}', a single foreign-key column, but '${parentCollection.slug}' is keyed on ${parentPks.map((k) => `'${k.fieldName}'`).join(" + ")}. One column cannot reference a composite key — express this relation with \`joinPath\`, whose \`on.from\`/\`on.to\` take every key column.`);
+	}
+	/**
 	* Fetch rows related to a parent row through a specific relation
 	*/
 	async fetchRelatedEntities(parentCollectionPath, parentId, relationKey, options = {}) {
@@ -5098,9 +5842,9 @@ var RelationService = class {
 	async fetchEntitiesUsingJoins(parentCollection, parentId, relation, options = {}) {
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const idInfo = getPrimaryKeys(targetCollection, this.registry);
+		const idInfo = requirePrimaryKeys(targetCollection, this.registry);
 		const idField = targetTable[idInfo[0].fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
@@ -5124,7 +5868,7 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
+			const parentIdField = parentTable[requirePrimaryKeys(parentCollection, this.registry)[0].fieldName];
 			query = query.where(eq(parentIdField, parsedParentId));
 			if (options.limit) query = query.limit(options.limit);
 			const results = await query;
@@ -5132,13 +5876,7 @@ var RelationService = class {
 			const rows = [];
 			for (const row of results) {
 				const targetRow = row[targetTableName] || row;
-				const id = targetRow[idInfo[0].fieldName];
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
-				rows.push({
-					id: id?.toString() || "",
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				rows.push(await this.toRelatedRow(targetRow, targetCollection, idInfo, { resolveNested: true }));
 			}
 			return rows;
 		}
@@ -5157,13 +5895,7 @@ var RelationService = class {
 		const rows = [];
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
-			const id = targetRow[idInfo[0].fieldName];
-			const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
-			rows.push({
-				id: id?.toString() || "",
-				path: targetCollection.slug,
-				values: parsedValues
-			});
+			rows.push(await this.toRelatedRow(targetRow, targetCollection, idInfo, { resolveNested: true }));
 		}
 		return rows;
 	}
@@ -5180,8 +5912,8 @@ var RelationService = class {
 		}
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdField = targetTable[getPrimaryKeys(targetCollection, this.registry)[0].fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const targetIdField = targetTable[requirePrimaryKeys(targetCollection, this.registry)[0].fieldName];
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
@@ -5200,9 +5932,10 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdInfo = getPrimaryKeys(targetCollection, this.registry)[0];
+		const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+		const targetIdInfo = targetPks[0];
 		const targetIdField = targetTable[targetIdInfo.fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
@@ -5226,25 +5959,19 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
-			query = query.where(inArray(parentIdField, parsedParentIds));
+			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const row of results) {
 				const parentRow = row[getTableName$1(parentCollection)] || row;
 				const targetRow = row[targetTableName] || row;
-				const parentId = parentRow[parentIdInfo.fieldName];
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-				resultMap.set(String(parentId), {
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				resultMap.set(buildCompositeId(parentRow, parentPks), await this.toRelatedRow(targetRow, targetCollection, targetPks));
 			}
 			return resultMap;
 		}
 		if (relation.direction === "owning" && relation.localKey) {
+			this.assertSingleKeyAddressable(parentCollection, parentPks, relation.localKey);
 			const localKeyCol = parentTable[relation.localKey];
 			if (!localKeyCol) throw new Error(`Local key column '${relation.localKey}' not found in parent table`);
 			const fkRows = await this.db.select({
@@ -5273,17 +6000,11 @@ var RelationService = class {
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const [parentIdStr, fkValue] of parentToFk) {
 				const targetRow = targetById.get(String(fkValue));
-				if (targetRow) {
-					const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-					resultMap.set(parentIdStr, {
-						id: String(targetRow[targetIdInfo.fieldName]),
-						path: targetCollection.slug,
-						values: parsedValues
-					});
-				}
+				if (targetRow) resultMap.set(parentIdStr, await this.toRelatedRow(targetRow, targetCollection, targetPks));
 			}
 			return resultMap;
 		}
+		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -5294,14 +6015,7 @@ var RelationService = class {
 			let parentId;
 			if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
 			else if (relation.direction === "inverse" && relation.cardinality === "one" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
-			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-				resultMap.set(String(parentId), {
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
-			}
+			if (parentId !== void 0 && parentIdSet.has(String(parentId))) resultMap.set(String(parentId), await this.toRelatedRow(targetRow, targetCollection, targetPks));
 		}
 		return resultMap;
 	}
@@ -5315,9 +6029,9 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdInfo = getPrimaryKeys(targetCollection, this.registry)[0];
-		const targetIdField = targetTable[targetIdInfo.fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+		const targetIdField = targetTable[targetPks[0].fieldName];
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
@@ -5339,27 +6053,22 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
-			query = query.where(inArray(parentIdField, parsedParentIds));
+			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const row of results) {
 				const parentRow = row[getTableName$1(parentCollection)] || row;
 				const targetRow = row[targetTableName] || row;
-				const parentId = String(parentRow[parentIdInfo.fieldName]);
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
+				const parentId = buildCompositeId(parentRow, parentPks);
 				const arr = resultMap.get(parentId) || [];
-				arr.push({
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
 				resultMap.set(parentId, arr);
 			}
 			return resultMap;
 		}
 		if (relation.through && relation.cardinality === "many" && relation.direction === "owning") {
+			this.assertSingleKeyAddressable(parentCollection, parentPks, `${relation.through.table}.${relation.through.sourceColumn}`);
 			const junctionTable = this.registry.getTable(relation.through.table);
 			if (!junctionTable) {
 				logger.warn(`[batchFetchRelatedEntitiesMany] Junction table '${relation.through.table}' not found`);
@@ -5378,17 +6087,13 @@ var RelationService = class {
 				const junctionData = row[relation.through.table] || row;
 				const targetData = row[targetTableName] || row;
 				const parentId = String(junctionData[relation.through.sourceColumn]);
-				const parsedValues = await parseDataFromServer(targetData, targetCollection);
 				const arr = resultMap.get(parentId) || [];
-				arr.push({
-					id: String(targetData[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetData, targetCollection, targetPks));
 				resultMap.set(parentId, arr);
 			}
 			return resultMap;
 		}
+		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -5401,14 +6106,9 @@ var RelationService = class {
 			else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
 			else if (relation.direction === "inverse" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
 			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
 				const key = String(parentId);
 				const arr = resultMap.get(key) || [];
-				arr.push({
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
 				resultMap.set(key, arr);
 			}
 		}
@@ -5456,12 +6156,12 @@ var RelationService = class {
 					logger.warn(`Could not determine junction table for relation '${key}' in collection '${collection.slug}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
 				if (targetEntityIds.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedParentId,
@@ -5481,12 +6181,12 @@ var RelationService = class {
 					logger.warn(`Junction columns not found for relation '${key}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
 				if (targetEntityIds.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedParentId,
@@ -5497,7 +6197,7 @@ var RelationService = class {
 			} else if (relation.through && relation.cardinality === "many" && relation.direction === "inverse") logger.warn(`[updateRelationsUsingJoins] Inverse M2M relation '${key}' in collection '${collection.slug}' should be saved from the owning side. Skipping.`);
 			else if (relation.cardinality === "many" && relation.direction === "inverse" && relation.foreignKeyOnTarget) {
 				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
 				const targetIdCol = targetTable[targetIdInfo.fieldName];
 				const fkCol = targetTable[relation.foreignKeyOnTarget];
@@ -5505,7 +6205,7 @@ var RelationService = class {
 					logger.warn(`Invalid inverse-many config for relation '${key}' in collection '${collection.slug}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				if (targetEntityIds.length > 0) {
@@ -5525,9 +6225,9 @@ var RelationService = class {
 			try {
 				const targetCollection = relation.target();
 				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
-				const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
 				if (relation.direction === "inverse" && relation.joinPath && relation.joinPath.length > 0) {
 					await this.updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue);
@@ -5608,12 +6308,12 @@ var RelationService = class {
 					logger.warn(`Could not determine junction columns for inverse joinPath relation '${relation.relationName}'`);
 					return;
 				}
-				const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
 				const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
 				if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = newValue.map((rel) => typeof rel === "object" && rel !== null ? rel.id : rel).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedSourceId,
@@ -5621,7 +6321,7 @@ var RelationService = class {
 					}));
 					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
 				} else if (newValue && !Array.isArray(newValue)) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const parsedTargetId = parseIdValues(typeof newValue === "object" && newValue !== null ? newValue.id : newValue, targetPks)[targetIdInfo.fieldName];
 					const newLink = {
@@ -5652,12 +6352,12 @@ var RelationService = class {
 				logger.warn(`Junction columns not found for relation '${relation.relationName}'`);
 				return;
 			}
-			const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+			const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 			const sourceIdInfo = sourcePks[0];
 			const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
 			await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
 			if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
 				const newLinks = newValue.map((rel) => rel.id).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 					[sourceJunctionColumn.name]: parsedSourceId,
@@ -5678,12 +6378,12 @@ var RelationService = class {
 			const { relation, newTargetId } = upd;
 			const targetCollection = relation.target();
 			const targetTable = getTableForCollection(targetCollection, this.registry);
-			const targetPks = getPrimaryKeys(targetCollection, this.registry);
+			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 			const targetIdInfo = targetPks[0];
 			const targetIdCol = targetTable[targetIdInfo.fieldName];
 			const { targetFKColName, parentSourceColName } = this.resolveJoinPathWriteMapping(parentCollection, relation);
 			const parentTable = getTableForCollection(parentCollection, this.registry);
-			const parentPks = getPrimaryKeys(parentCollection, this.registry);
+			const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 			const parentIdInfo = parentPks[0];
 			const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 			const parentIdCol = parentTable[parentIdInfo.fieldName];
@@ -5754,7 +6454,7 @@ var RelationService = class {
 				logger.warn(`Junction columns not found for relation '${relationKey}'`);
 				return;
 			}
-			const targetPks = getPrimaryKeys(targetCollection, this.registry);
+			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 			const targetIdInfo = targetPks[0];
 			const parsedNewEntityId = parseIdValues(newEntityId, targetPks)[targetIdInfo.fieldName];
 			const junctionData = {
@@ -5770,6 +6470,150 @@ var RelationService = class {
 	}
 };
 //#endregion
+//#region src/services/row-pipeline.ts
+/**
+* Whether a many-relation reaches its target through a junction table.
+*
+* Also used to build the drizzle `with` config, which is why it is exported:
+* the query has to nest one level deeper for a junction, and the row walk has
+* to unwrap that same level back out.
+*/
+function isJunctionRelation(relation) {
+	if (relation.through) return true;
+	if (relation.joinPath && relation.joinPath.length > 1) return true;
+	return false;
+}
+/**
+* Reach the target row inside a junction row.
+*
+* A junction row looks like `{ post_id: 1, tag_id: { id: 5, name: "ts" } }` —
+* the foreign keys, and the target nested under one of them. The target is the
+* only object among them, so that is how it is found. A junction row that has
+* not been nested (no `with` on the join) has no object and is returned as-is.
+*/
+function unwrapJunctionRow(item) {
+	const nestedKey = Object.keys(item).find((key) => typeof item[key] === "object" && item[key] !== null && !Array.isArray(item[key]));
+	return nestedKey ? item[nestedKey] : item;
+}
+/**
+* Give back the number a `number` property was declared to be.
+*
+* Postgres returns NUMERIC as a string and drizzle keeps it that way, since a
+* numeric can hold more precision than a double. But the collection declared
+* this property `number` and the OpenAPI spec this server publishes says
+* `type: number`, so serving `"9.99"` breaks its own contract — and breaks it
+* asymmetrically, because a create answers with the number and the read that
+* follows answers with the string. Any client that multiplies a price works
+* until the first refresh.
+*
+* Declaring a property `number` already accepts double precision — that is what
+* the admin has always parsed it to. Columns REST serves that no property
+* declares are left exactly as the database returned them.
+*/
+function coerceDeclaredNumber(value, property) {
+	if (property?.type !== "number" || typeof value !== "string") return value;
+	const parsed = parseFloat(value);
+	return isNaN(parsed) ? null : parsed;
+}
+/** Apply {@link coerceDeclaredNumber} across a row, leaving every other column alone. */
+function coerceDeclaredNumbers(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	const out = {};
+	for (const [key, value] of Object.entries(row)) out[key] = coerceDeclaredNumber(value, properties[key]);
+	return out;
+}
+/** Render one target row in the requested style. */
+/**
+* Drop every column the collection marked `excludeFromApi`.
+*
+* Password hashes and verification tokens have to be readable server-side but
+* must never reach a client — and "never" has to mean every exit from this
+* pipeline, including relation targets, or a secret leaks through whichever
+* path was overlooked. Keyed by both the property name and its column name,
+* since a row can arrive keyed either way depending on the caller.
+*/
+function stripExcluded(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	for (const [key, property] of Object.entries(properties)) {
+		if (!property?.excludeFromApi) continue;
+		delete row[key];
+		if (property.columnName) delete row[property.columnName];
+	}
+	return row;
+}
+function renderTarget(targetRow, targetCollection, style, registry) {
+	if (style === "inline") return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
+	const address = relationTargetAddress(targetRow, targetCollection, registry);
+	const path = targetCollection.slug;
+	return createRelationRefWithData(address, path, {
+		id: address,
+		path,
+		values: normalizeDbValues(targetRow, targetCollection)
+	});
+}
+/**
+* The address a relation ref points at.
+*
+* The whole key, not its first column: a composite-keyed target addressed by
+* `tenant_id` alone points at every row that shares it. A target whose key
+* cannot be resolved at all used to throw here — reading `[0]` of an empty
+* array — taking down the parent's fetch over a relation it may not even have
+* asked for. The first column is a guess, but a ref that resolves to nothing
+* beats no rows at all.
+*/
+function relationTargetAddress(targetRow, targetCollection, registry) {
+	const address = deriveRowAddress(targetRow, targetCollection, registry);
+	if (address) return address;
+	return String(targetRow[Object.keys(targetRow)[0]] ?? "");
+}
+/**
+* The row the admin renders: every column, with relations as references.
+*
+* Values are normalized (dates, numbers, NaN) because the admin's view-model
+* expects real types. The row's own address is *not* among the columns — it is
+* derived by the consumer from the collection's primary keys.
+*/
+function toCmsRow(row, collection, registry) {
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const normalized = normalizeDbValues(row, collection);
+	for (const [key, relation] of Object.entries(resolvedRelations)) {
+		const relData = row[relation.relationName || key];
+		if (relData === void 0 || relData === null) continue;
+		if (relation.cardinality === "many" && Array.isArray(relData)) {
+			const targetCollection = relation.target();
+			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, targetCollection, "ref", registry));
+		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
+	}
+	return stripExcluded(normalized, collection);
+}
+/**
+* The row REST serves: every column under its own name, with the value Postgres
+* returned, and relations inlined as the target's columns.
+*
+* Values are the ones the database returned, except where that contradicts the
+* declared type: a `number` property is served as a number (see
+* {@link coerceDeclaredNumber}). Dates stay as the database returned them —
+* JSON has its own opinions about dates that the admin's view-model does not
+* share.
+*
+* Keyed by the row rather than by the relation list — a REST fetch only loads
+* the relations `include` asked for, so the row is the authority on which are
+* actually there.
+*/
+function toRestRow(row, collection, registry) {
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const flat = {};
+	for (const [key, value] of Object.entries(row)) {
+		const relation = findRelation(resolvedRelations, key);
+		if (relation && Array.isArray(value)) flat[key] = value.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, relation.target(), "inline", registry));
+		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
+		else flat[key] = coerceDeclaredNumber(value, collection.properties?.[key]);
+	}
+	return stripExcluded(flat, collection);
+}
+//#endregion
 //#region src/services/FetchService.ts
 /**
 * Service for handling all row read operations.
@@ -5828,7 +6672,7 @@ var FetchService = class {
 			if (!shouldInclude(key)) continue;
 			const drizzleRelName = relation.relationName || key;
 			if (relation.joinPath && relation.joinPath.length > 0) continue;
-			if (relation.cardinality === "many" && this.isJunctionRelation(relation, collection)) {
+			if (relation.cardinality === "many" && isJunctionRelation(relation)) {
 				const targetFkName = this.getJunctionTargetRelationName(relation, collection);
 				if (targetFkName) withConfig[drizzleRelName] = { with: { [targetFkName]: true } };
 				else withConfig[drizzleRelName] = true;
@@ -5837,14 +6681,6 @@ var FetchService = class {
 		return withConfig;
 	}
 	/**
-	* Detect if a many-to-many relation uses a junction table in the Drizzle schema.
-	*/
-	isJunctionRelation(relation, _collection) {
-		if (relation.through) return true;
-		if (relation.joinPath && relation.joinPath.length > 1) return true;
-		return false;
-	}
-	/**
 	* Get the Drizzle relation name on the junction table that points to the actual target row.
 	* For example, for posts_tags junction, this returns "tag_id" (the relation pointing to tags).
 	*/
@@ -5853,55 +6689,6 @@ var FetchService = class {
 		return null;
 	}
 	/**
-	* Convert a db.query result row (with nested relation objects) to a flat row.
-	* Handles:
-	* - Placing `id` at the top level as a string
-	* - Type normalization (dates, numbers, NaN) via normalizeDbValues
-	* - Converting nested relation objects to { id, path, __type: "relation" } for CMS
-	* - Flattening junction-table many-to-many results
-	*/
-	drizzleResultToRow(row, collection, _collectionPath, idInfo, _databaseId, idInfoArray) {
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const normalizedValues = normalizeDbValues(row, collection);
-		for (const [key, relation] of Object.entries(resolvedRelations)) {
-			const relData = row[relation.relationName || key];
-			if (relData === void 0 || relData === null) continue;
-			if (relation.cardinality === "many" && Array.isArray(relData)) {
-				const targetCollection = relation.target();
-				const targetPath = targetCollection.slug;
-				const targetIdField = getPrimaryKeys(targetCollection, this.registry)[0].fieldName;
-				normalizedValues[key] = relData.map((item) => {
-					let targetRow = item;
-					if (this.isJunctionRelation(relation, collection)) {
-						const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-						if (nestedKey) targetRow = item[nestedKey];
-					}
-					const relId = String(targetRow[targetIdField] ?? targetRow.id ?? targetRow[Object.keys(targetRow)[0]]);
-					return createRelationRefWithData(relId, targetPath, {
-						id: relId,
-						path: targetPath,
-						values: normalizeDbValues(targetRow, targetCollection)
-					});
-				});
-			} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) {
-				const targetCollection = relation.target();
-				const targetPath = targetCollection.slug;
-				const targetIdField = getPrimaryKeys(targetCollection, this.registry)[0].fieldName;
-				const relObj = relData;
-				const relId = String(relObj[targetIdField] ?? relObj.id ?? relObj[Object.keys(relObj)[0]]);
-				normalizedValues[key] = createRelationRefWithData(relId, targetPath, {
-					id: relId,
-					path: targetPath,
-					values: normalizeDbValues(relObj, targetCollection)
-				});
-			}
-		}
-		return {
-			...normalizedValues,
-			id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
-		};
-	}
-	/**
 	* Post-fetch joinPath relations for a single flat row.
 	* joinPath relations cannot be expressed via Drizzle's `with` config,
 	* so they must be loaded separately after the primary query.
@@ -5922,31 +6709,6 @@ var FetchService = class {
 		await Promise.all(promises);
 	}
 	/**
-	* Post-fetch joinPath relations for a batch of flat rows.
-	* Uses batch fetching to avoid N+1 queries for list views.
-	*/
-	async resolveJoinPathRelationsBatch(rows, collection, collectionPath, idInfo, _databaseId) {
-		if (rows.length === 0) return;
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0);
-		if (joinPathRelations.length === 0) return;
-		for (const [key, relation] of joinPathRelations) try {
-			const rowIds = rows.map((r) => {
-				return parseIdValues(String(r.id), [idInfo])[idInfo.fieldName];
-			});
-			const resultMap = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation);
-			for (const row of rows) {
-				const id = parseIdValues(String(row.id), [idInfo])[idInfo.fieldName];
-				const relatedRow = resultMap.get(String(id));
-				if (relatedRow) {
-					if (relation.cardinality === "one") row[key] = createRelationRefWithData(relatedRow.id, relatedRow.path, relatedRow);
-				}
-			}
-		} catch (e) {
-			logger.warn(`Could not batch resolve joinPath relation '${key}'`, { error: e });
-		}
-	}
-	/**
 	* Resolves joinPath relations for raw REST rows and directly injects them.
 	* Uses RelationService to query the database and maps results back to the flattened objects.
 	*/
@@ -5957,72 +6719,29 @@ var FetchService = class {
 		const shouldInclude = (key) => !include || include.length === 0 || include[0] === "*" || include.includes(key);
 		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0 && propertyKeys.has(key) && shouldInclude(key));
 		if (joinPathRelations.length === 0) return;
-		const idInfo = idInfoArray[0];
+		const parentIdOf = (row) => {
+			const address = buildCompositeId(row, idInfoArray);
+			return address && address.split(":::").some((part) => part !== "") ? address : void 0;
+		};
 		for (const [key, relation] of joinPathRelations) try {
-			const rowIds = rows.map((r) => {
-				return parseIdValues(String(r.id), idInfoArray)[idInfo.fieldName];
-			});
+			const addressable = rows.filter((r) => parentIdOf(r) !== void 0 && parentIdOf(r) !== null);
+			if (addressable.length === 0) continue;
+			const rowIds = addressable.map((r) => parentIdOf(r));
 			if (relation.cardinality === "one") {
 				const resultMap = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation);
-				for (const row of rows) {
-					const id = parseIdValues(String(row.id), idInfoArray)[idInfo.fieldName];
-					const relatedRow = resultMap.get(String(id));
-					if (relatedRow) row[key] = {
-						...relatedRow.values,
-						id: relatedRow.id
-					};
-					else row[key] = null;
+				for (const row of addressable) {
+					const relatedRow = resultMap.get(String(parentIdOf(row)));
+					row[key] = relatedRow ? { ...relatedRow.values } : null;
 				}
 			} else if (relation.cardinality === "many") {
 				const resultMap = await this.relationService.batchFetchRelatedEntitiesMany(collectionPath, rowIds, key, relation);
-				for (const row of rows) {
-					const id = parseIdValues(String(row.id), idInfoArray)[idInfo.fieldName];
-					row[key] = (resultMap.get(String(id)) || []).map((e) => ({
-						...e.values,
-						id: e.id
-					}));
-				}
+				for (const row of addressable) row[key] = (resultMap.get(String(parentIdOf(row))) || []).map((e) => ({ ...e.values }));
 			}
 		} catch (e) {
 			logger.warn(`Could not batch resolve joinPath relation '${key}' for REST`, { error: e });
 		}
 	}
 	/**
-	* Convert a db.query result row to a flat REST-style object with populated relations.
-	*/
-	drizzleResultToRestRow(row, collection, idInfo, idInfoArray) {
-		const flat = { id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName]) };
-		const resolvedRelations = resolveCollectionRelations(collection);
-		for (const [k, v] of Object.entries(row)) {
-			if (k === idInfo.fieldName) continue;
-			const relation = findRelation(resolvedRelations, k);
-			if (Array.isArray(v) && relation) flat[k] = v.map((item) => {
-				if (this.isJunctionRelation(relation, collection)) {
-					const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-					if (nestedKey) {
-						const nested = item[nestedKey];
-						return {
-							...nested,
-							id: String(nested.id ?? nested[Object.keys(nested)[0]])
-						};
-					}
-				}
-				return {
-					...item,
-					id: String(item.id ?? item[Object.keys(item)[0]])
-				};
-			});
-			else if (typeof v === "object" && v !== null && !Array.isArray(v) && relation) {
-				const relObj = v;
-				flat[k] = {
-					...relObj,
-					id: String(relObj.id ?? relObj[Object.keys(relObj)[0]])
-				};
-			} else flat[k] = v;
-		}
-		return flat;
-	}
-	/**
 	* Build db.query-compatible options from standard fetch options.
 	* Handles filter, search, orderBy, limit, and cursor-based pagination.
 	*/
@@ -6092,7 +6811,7 @@ var FetchService = class {
 	async fetchOne(collectionPath, id, databaseId) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
@@ -6106,7 +6825,7 @@ var FetchService = class {
 				with: withConfig
 			});
 			if (!row) return void 0;
-			const flatRow = this.drizzleResultToRow(row, collection, collectionPath, idInfo, databaseId, idInfoArray);
+			const flatRow = toCmsRow(row, collection, this.registry);
 			await this.resolveJoinPathRelations(flatRow, collection, collectionPath, parsedId, databaseId);
 			return flatRow;
 		} catch (e) {
@@ -6148,7 +6867,7 @@ var FetchService = class {
 	async fetchRowsWithConditions(collectionPath, options = {}) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
@@ -6158,7 +6877,7 @@ var FetchService = class {
 		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
 		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0);
-			return (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRow(row, collection, collectionPath, idInfo, options.databaseId, idInfoArray));
+			return (await qb.findMany(queryOpts)).map((row) => toCmsRow(row, collection, this.registry));
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
 				logger.error(`[FetchService] Relation inference error for collection '${collectionPath}': ${e.message}`);
@@ -6219,8 +6938,10 @@ var FetchService = class {
 	}
 	/**
 	* Fallback path used when db.query is unavailable.
-	* The primary path uses drizzleResultToRow which handles relation
-	* mapping without N+1 queries.
+	*
+	* The primary path runs the results through `toCmsRow`, which maps
+	* relations from what drizzle already nested — no query per row. This one
+	* has no nesting to read, so it resolves relations itself, in batches.
 	*
 	* Process raw database results into flat rows with relations.
 	*/
@@ -6229,8 +6950,7 @@ var FetchService = class {
 		const parsedRows = await Promise.all(results.map(async (rawRow) => {
 			return {
 				rawRow,
-				values: await parseDataFromServer(rawRow, collection),
-				id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(rawRow, idInfoArray) : String(rawRow[idInfo.fieldName])
+				values: await parseDataFromServer(rawRow, collection)
 			};
 		}));
 		if (!skipRelations) {
@@ -6270,10 +6990,7 @@ var FetchService = class {
 				logger.warn(`Could not batch load many relation property: ${key}`, { error: e });
 			}
 		}
-		return parsedRows.map((item) => ({
-			...item.values,
-			id: item.id
-		}));
+		return parsedRows.map((item) => item.values);
 	}
 	/**
 	* Fetch a collection of rows
@@ -6304,10 +7021,7 @@ var FetchService = class {
 			const relationKey = pathSegments[i];
 			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
 			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
-			if (i === pathSegments.length - 1) return (await this.relationService.fetchRelatedEntities(currentCollection.slug, currentId, relationKey, options)).map((row) => ({
-				...row.values,
-				id: row.id
-			}));
+			if (i === pathSegments.length - 1) return (await this.relationService.fetchRelatedEntities(currentCollection.slug, currentId, relationKey, options)).map((row) => ({ ...row.values }));
 			if (i + 1 < pathSegments.length) {
 				const nextEntityId = pathSegments[i + 1];
 				currentCollection = relation.target();
@@ -6369,7 +7083,7 @@ var FetchService = class {
 		if (value === void 0 || value === null) return true;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const field = table[fieldName];
@@ -6396,7 +7110,7 @@ var FetchService = class {
 	async fetchCollectionForRest(collectionPath, options = {}, include) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const tableName = getTableName(table);
@@ -6404,7 +7118,7 @@ var FetchService = class {
 		if (qb && !options.searchString && !options.vectorSearch) try {
 			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig);
-			const restRows = (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRestRow(row, collection, idInfo, idInfoArray));
+			const restRows = (await qb.findMany(queryOpts)).map((row) => toRestRow(row, collection, this.registry));
 			await this.resolveJoinPathRelationsBatchRest(restRows, collection, collectionPath, idInfoArray, include);
 			return restRows;
 		} catch (e) {
@@ -6415,10 +7129,7 @@ var FetchService = class {
 			logger.warn(`[fetchCollectionForRest] db.query.findMany failed for ${collectionPath}, falling back`, { error: e });
 		}
 		const rows = await this.fetchRowsWithConditionsRaw(collectionPath, options);
-		if (!include || include.length === 0) return rows.map((row) => ({
-			...row,
-			id: idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
-		}));
+		if (!include || include.length === 0) return rows;
 		const resolvedRelations = resolveCollectionRelations(collection);
 		const propertyKeys = new Set(Object.keys(collection.properties || {}));
 		const shouldInclude = (key) => include[0] === "*" || include.includes(key);
@@ -6430,10 +7141,7 @@ var FetchService = class {
 				for (const row of rows) {
 					const eid = row[idInfo.fieldName];
 					const related = batchResults.get(String(eid));
-					if (related) row[key] = {
-						...related.values,
-						id: related.id
-					};
+					if (related) row[key] = { ...related.values };
 				}
 			} catch (e) {
 				logger.warn(`[include] Failed to batch load one-to-one '${key}'`, { error: e });
@@ -6451,10 +7159,7 @@ var FetchService = class {
 				logger.warn(`[include] Failed to batch load many '${key}'`, { error: e });
 			}
 		}
-		return rows.map((row) => ({
-			...row,
-			id: idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
-		}));
+		return rows;
 	}
 	/**
 	* Fetch a single row with optional relation includes for REST API.
@@ -6462,7 +7167,7 @@ var FetchService = class {
 	async fetchOneForRest(collectionPath, id, include, databaseId) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
@@ -6475,7 +7180,7 @@ var FetchService = class {
 				...withConfig ? { with: withConfig } : {}
 			});
 			if (!row) return null;
-			const restRow = this.drizzleResultToRestRow(row, collection, idInfo, idInfoArray);
+			const restRow = toRestRow(row, collection, this.registry);
 			await this.resolveJoinPathRelationsBatchRest([restRow], collection, collectionPath, idInfoArray, include);
 			return restRow;
 		} catch (e) {
@@ -6487,11 +7192,7 @@ var FetchService = class {
 		}
 		const result = await this.db.select().from(table).where(eq(idField, parsedId)).limit(1);
 		if (result.length === 0) return null;
-		const raw = result[0];
-		const flatEntity = {
-			...raw,
-			id: idInfoArray.length > 1 ? buildCompositeId(raw, idInfoArray) : String(raw[idInfo.fieldName])
-		};
+		const flatEntity = { ...result[0] };
 		if (!include || include.length === 0) return flatEntity;
 		const resolvedRelations = resolveCollectionRelations(collection);
 		const propertyKeys = new Set(Object.keys(collection.properties || {}));
@@ -6524,7 +7225,7 @@ var FetchService = class {
 	async fetchRowsWithConditionsRaw(collectionPath, options = {}) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idField = table[getPrimaryKeys(collection, this.registry)[0].fieldName];
+		const idField = table[requirePrimaryKeys(collection, this.registry)[0].fieldName];
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
 		let query = vectorMeta ? this.db.select({
@@ -6603,32 +7304,15 @@ var FetchService = class {
 				if (orderByField) queryOpts.orderBy = options.order === "asc" ? asc(orderByField) : desc(orderByField);
 			}
 			return (await queryTarget.findMany(queryOpts)).map((row) => {
-				const flat = { id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName]) };
-				for (const [k, v] of Object.entries(row)) {
-					if (k === idInfo.fieldName) continue;
-					if (Array.isArray(v)) flat[k] = v.map((item) => {
-						const keys = Object.keys(item);
-						const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-						if (nestedObj && keys.length <= 3) {
-							const nested = item[nestedObj];
-							return {
-								...nested,
-								id: String(nested.id ?? nested[Object.keys(nested)[0]])
-							};
-						}
-						return {
-							...item,
-							id: String(item.id ?? item[Object.keys(item)[0]])
-						};
-					});
-					else if (typeof v === "object" && v !== null) {
-						const relObj = v;
-						flat[k] = {
-							...relObj,
-							id: String(relObj.id ?? relObj[Object.keys(relObj)[0]])
-						};
-					} else flat[k] = v;
-				}
+				const flat = {};
+				for (const [k, v] of Object.entries(row)) if (Array.isArray(v)) flat[k] = v.map((item) => {
+					const keys = Object.keys(item);
+					const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
+					if (nestedObj && keys.length <= 3) return { ...item[nestedObj] };
+					return { ...item };
+				});
+				else if (typeof v === "object" && v !== null) flat[k] = { ...v };
+				else flat[k] = v;
 				return flat;
 			});
 		} catch (e) {
@@ -6889,8 +7573,14 @@ var PersistService = class {
 	}
 	/**
 	* Save an row (create or update)
+	*
+	* With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
+	* UPDATE against the primary key rather than a plain UPDATE. That is one
+	* statement, so it cannot lose a race the way a read-then-write can, and it
+	* does not care whether the row already exists — which is what a re-runnable
+	* import needs.
 	*/
-	async save(collectionPath, values, id, databaseId) {
+	async save(collectionPath, values, id, databaseId, options) {
 		let effectiveCollectionPath = collectionPath;
 		const effectiveValues = { ...values };
 		let junctionTableInfo;
@@ -6981,7 +7671,7 @@ var PersistService = class {
 			const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
 			savedId = await this.db.transaction(async (tx) => {
 				let currentId;
-				if (id) {
+				if (id && !options?.upsert) {
 					currentId = id;
 					const idValues = parseIdValues(id, idInfoArray);
 					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
@@ -6996,9 +7686,24 @@ var PersistService = class {
 					}
 				} else {
 					const dataForInsert = { ...entityData };
+					if (id && options?.upsert) Object.assign(dataForInsert, parseIdValues(id, idInfoArray));
 					for (const info of idInfoArray) if (dataForInsert[info.fieldName] === "" || dataForInsert[info.fieldName] === null || dataForInsert[info.fieldName] === void 0) delete dataForInsert[info.fieldName];
-					const resultRow = (await tx.insert(table).values(dataForInsert).returning(returningKeys))[0];
-					currentId = buildCompositeId(resultRow, idInfoArray);
+					const insertQuery = tx.insert(table).values(dataForInsert);
+					const hasFullKey = idInfoArray.length > 0 && idInfoArray.every((info) => dataForInsert[info.fieldName] !== void 0);
+					let result;
+					if (options?.upsert && hasFullKey) {
+						const target = idInfoArray.map((info) => table[info.fieldName]);
+						const set = { ...dataForInsert };
+						for (const info of idInfoArray) delete set[info.fieldName];
+						result = Object.keys(set).length > 0 ? await insertQuery.onConflictDoUpdate({
+							target,
+							set
+						}).returning(returningKeys) : await insertQuery.onConflictDoNothing({ target }).returning(returningKeys);
+					} else result = await insertQuery.returning(returningKeys);
+					const resultRow = result[0];
+					if (!resultRow) if (id) currentId = id;
+					else throw ApiError.forbidden(`Not allowed to write to "${effectiveCollectionPath}": the row was rejected by a row-level security policy.`, "WRITE_DENIED");
+					else currentId = buildCompositeId(resultRow, idInfoArray);
 					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
 				}
 				if (inverseRelationUpdates.length > 0) await this.relationService.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
@@ -7009,7 +7714,7 @@ var PersistService = class {
 		} catch (error) {
 			throw this.toUserFriendlyError(error, collection.slug);
 		}
-		const finalEntity = await this.fetchService.fetchOne(collection.slug, savedId, databaseId);
+		const finalEntity = await this.fetchService.fetchOneForRest(collection.slug, savedId, void 0, databaseId);
 		if (!finalEntity) throw new Error("Could not fetch row after save.");
 		return finalEntity;
 	}
@@ -7107,8 +7812,8 @@ var DataService = class {
 	/**
 	* Save an row (create or update)
 	*/
-	async save(collectionPath, values, id, databaseId) {
-		return this.persistService.save(collectionPath, values, id, databaseId);
+	async save(collectionPath, values, id, databaseId, options) {
+		return this.persistService.save(collectionPath, values, id, databaseId, options);
 	}
 	/**
 	* Delete an row by ID
@@ -7176,6 +7881,26 @@ var DataService = class {
 */
 /** Internal prefix applied to branch database names to avoid collisions. */
 var BRANCH_DB_PREFIX = "rb_";
+/** `duplicate_database` — the target database name is already taken. */
+var PG_DUPLICATE_DATABASE = "42P04";
+/** `object_in_use` — the database still has connections attached. */
+var PG_OBJECT_IN_USE = "55006";
+/**
+* Describe a failed branch DDL statement in terms a user can act on.
+*
+* Drizzle reports failures as `Failed query: <sql> params:` and hides the real
+* PostgreSQL error in the `cause` chain, so matching on `err.message` never sees
+* the actual problem. Match on the PG error code instead — it survives wrapping
+* and, unlike the message text, is not locale-dependent.
+*/
+function describeBranchDdlError(err, fallbackContext) {
+	const pgError = extractPgError(err);
+	if (pgError?.code === PG_DUPLICATE_DATABASE) return /* @__PURE__ */ new Error(`Database "${fallbackContext}" already exists on the server. Choose a different branch name.`);
+	if (pgError?.code === PG_OBJECT_IN_USE) return /* @__PURE__ */ new Error(`Cannot complete the operation: the database "${fallbackContext}" has active connections. Close other clients or connections and try again.`);
+	const detail = pgError?.message ?? extractCauseMessage(err);
+	if (detail) return new Error(detail);
+	return err instanceof Error ? err : new Error(String(err));
+}
 /** Fully-qualified metadata table in the rebase schema. */
 var BRANCHES_TABLE = "rebase.branches";
 /**
@@ -7244,10 +7969,8 @@ var BranchService = class {
 		try {
 			await this.db.execute(sql.raw(`CREATE DATABASE "${safeDbName}" TEMPLATE "${safeSourceDb}"`));
 		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			if (msg.includes("already exists")) throw new Error(`Database "${dbName}" already exists on the server. Choose a different branch name.`);
-			if (msg.includes("being accessed by other users")) throw new Error(`Cannot create branch: the source database "${sourceDb}" has active connections. Close other clients or connections and try again.`);
-			throw err;
+			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot create branch: the source database "${sourceDb}" has active connections. Close other clients or connections and try again.`);
+			throw describeBranchDdlError(err, dbName);
 		}
 		const now = /* @__PURE__ */ new Date();
 		await this.db.execute(sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at) 
@@ -7272,8 +7995,8 @@ var BranchService = class {
 		try {
 			await this.db.execute(sql.raw(`DROP DATABASE "${safeDbName}"`));
 		} catch (err) {
-			if ((err instanceof Error ? err.message : String(err)).includes("being accessed by other users")) throw new Error(`Cannot delete branch "${sanitizedName}": the database has active connections. Close other clients and try again.`);
-			throw err;
+			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot delete branch "${sanitizedName}": the database has active connections. Close other clients and try again.`);
+			throw describeBranchDdlError(err, dbName);
 		}
 		await this.db.execute(sql`DELETE FROM rebase.branches WHERE name = ${sanitizedName}`);
 	}
@@ -7905,17 +8628,19 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			this.realtimeService.subscriptions.delete(subscriptionId);
 		};
 	}
-	async save({ path, id, values, collection, status }) {
+	async save({ path, id, values, collection, status, upsert }) {
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
 		let previousValuesForHistory;
-		if (status === "existing" && id) {
-			const existing = await this.dataService.fetchOne(path, id, resolvedCollection?.databaseId);
+		if (status === "existing" && id) try {
+			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
 			if (existing) {
 				const { id: _existingId, ...existingValues } = existing;
 				previousValuesForHistory = existingValues;
 			}
+		} catch (err) {
+			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
 		}
 		if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
 			if (globalCallbacks?.beforeSave) {
@@ -7962,7 +8687,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			timestampNowValue: /* @__PURE__ */ new Date()
 		});
 		try {
-			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId);
+			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, { upsert });
 			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
 				if (globalCallbacks?.afterRead) savedRow = await globalCallbacks.afterRead({
 					collection: resolvedCollection,
@@ -7983,8 +8708,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 					context: contextForCallback
 				});
 			}
-			const savedId = savedRow.id;
-			const { id: _savedId, ...savedValues } = savedRow;
+			const savedId = deriveRowAddress(savedRow, resolvedCollection ?? collection, this.registry);
+			const savedValues = savedRow;
 			if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
 				if (globalCallbacks?.afterSave) await globalCallbacks.afterSave({
 					collection: resolvedCollection,
@@ -8016,7 +8741,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			}
 			if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
 				tableName: path,
-				id: savedId.toString(),
+				id: savedId,
 				action: status === "new" ? "create" : "update",
 				values: savedValues,
 				previousValues: previousValuesForHistory,
@@ -8024,11 +8749,11 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			});
 			if (this._deferNotifications) this._pendingNotifications.push({
 				path,
-				id: savedId.toString(),
+				id: savedId,
 				row: savedRow,
 				databaseId: resolvedCollection?.databaseId
 			});
-			else await this.realtimeService.notifyUpdate(path, savedId.toString(), savedRow, resolvedCollection?.databaseId);
+			else await this.realtimeService.notifyUpdate(path, savedId, savedRow, resolvedCollection?.databaseId);
 			return savedRow;
 		} catch (error) {
 			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
@@ -8063,12 +8788,52 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			throw error;
 		}
 	}
+	/**
+	* Write many rows through the same pipeline as {@link save}.
+	*
+	* The batch runs in one transaction of its own, so a failure part-way leaves
+	* nothing behind — the point of a batch is that a re-run starts from a known
+	* state. When this driver is already inside a transaction (the authenticated
+	* path, via `withTransaction`) the nested call becomes a savepoint, which is
+	* still atomic and still commits once.
+	*
+	* Rows are applied in order, so a batch that touches the same key twice ends
+	* with the last write winning, exactly as separate calls would.
+	*/
+	async saveMany({ path, rows, collection, upsert }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < rows.length; i++) {
+				const values = rows[i];
+				const id = values?.id;
+				try {
+					saved.push(await txDriver.save({
+						path,
+						values,
+						collection,
+						status: "new",
+						upsert
+					}));
+				} catch (error) {
+					const label = id !== void 0 ? `id ${JSON.stringify(id)}` : "no id";
+					throw Object.assign(new Error(`Row ${i} of ${rows.length} (${label}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return saved;
+		});
+	}
 	async delete({ row, collection }) {
 		const targetPath = row.path;
-		const targetRow = {
-			id: row.id,
-			...row.values ?? {}
-		};
+		const targetRow = { ...row.values ?? {} };
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, targetPath);
 		const contextForCallback = this.buildCallContext();
 		if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
@@ -8427,6 +9192,18 @@ var AuthenticatedPostgresBackendDriver = class {
 	async save(props) {
 		return this.withTransaction((delegate) => delegate.save(props));
 	}
+	/**
+	* One transaction for the whole batch, rather than one per row.
+	*
+	* This is the point of the method: `save` opens a transaction per call, so
+	* importing 10k rows through it means 10k transactions (and, over HTTP, 10k
+	* round trips). Here the RLS context is established once and every row lands
+	* or none does. Realtime notifications are already deferred to commit by
+	* `withTransaction`, so a batch does not flood subscribers mid-flight.
+	*/
+	async saveMany(props) {
+		return this.withTransaction((delegate) => delegate.saveMany(props));
+	}
 	async delete(props) {
 		return this.withTransaction((delegate) => delegate.delete(props));
 	}
@@ -8476,6 +9253,7 @@ var DatabasePoolManager = class {
 		pool.on("error", (err) => {
 			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
 		});
+		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 		this.pools.set(databaseName, pool);
 		return pool;
 	}
@@ -8673,105 +9451,6 @@ var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user:
 	references: [users.id]
 }) }));
 //#endregion
-//#region src/schema/auth-default-policies.ts
-/**
-* Default RLS policies injected by the schema generator.
-*
-* Rebase's enforcement model is unified: authenticated (user-context) requests
-* run under the restricted `rebase_user` role, so Postgres RLS binds *every*
-* statement — reads and writes. A collection's `securityRules` are the whole
-* authorization model. The server context (auth flows, migrations,
-* `dataAsAdmin`) runs as the owner and bypasses RLS.
-*
-* Because RLS default-denies, every collection is **locked by default**: with
-* no rules, only the server context and admins can touch it. The generator
-* injects that safe baseline:
-*
-* **For every collection**
-*  1. A permissive **server-or-admin SELECT** grant.
-*  2. A permissive **server-or-admin write** grant (insert/update/delete).
-*
-* Author `securityRules` are permissive and OR together, so explicit rules only
-* *broaden* access from this locked baseline (e.g. "users read/write their own
-* rows").
-*
-* **For auth collections additionally**
-*  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
-*     their own row (profile, session bootstrap) without every app re-declaring
-*     it.
-*  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
-*     every other policy, so a write is rejected unless the caller is an admin
-*     (or the server context) — even if the author also wrote a permissive rule
-*     such as "a user may edit their own row". Without this, a permissive owner
-*     rule would let a user change their own `roles`.
-*
-* The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
-* — the built-in flows that run without a user (signup, migrations) set no user
-* GUC — which also lets the owner connection satisfy these policies even under
-* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
-* `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
-*
-* Opt out with `disableDefaultPolicies: true` to take full responsibility for
-* the collection's RLS.
-*/
-var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
-/** Write operations that must be admin-gated by default on auth collections. */
-var DEFAULT_GUARDED_OPS = [
-	"insert",
-	"update",
-	"delete"
-];
-/** Whether a collection is flagged as an authentication collection. */
-function isAuthCollection(collection) {
-	const auth = collection.auth;
-	return auth === true || typeof auth === "object" && auth?.enabled === true;
-}
-/** The property marked as the row id (falls back to `id`). */
-function getIdPropertyName(collection) {
-	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
-	return "id";
-}
-/**
-* Returns the security rules that should be applied to a collection: the
-* author's explicit `securityRules` plus the framework defaults described in
-* the module doc (baseline server/admin read for all collections; self-read
-* and the admin write gate for auth collections).
-*
-* Collections that opt out via `disableDefaultPolicies` are returned unchanged.
-*/
-function getEffectiveSecurityRules(collection) {
-	const explicit = [...(isPostgresCollectionConfig(collection) ? collection.securityRules : void 0) ?? []];
-	if (collection.disableDefaultPolicies) return explicit;
-	const tableName = getTableName$1(collection);
-	const injected = [];
-	injected.push({
-		name: `${tableName}_default_admin_read`,
-		operations: ["select"],
-		condition: SERVER_OR_ADMIN_EXPR
-	});
-	injected.push({
-		name: `${tableName}_default_admin_write`,
-		operations: [...DEFAULT_GUARDED_OPS],
-		condition: SERVER_OR_ADMIN_EXPR,
-		check: SERVER_OR_ADMIN_EXPR
-	});
-	if (isAuthCollection(collection)) {
-		injected.push({
-			name: `${tableName}_default_self_read`,
-			operations: ["select"],
-			condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
-		});
-		injected.push({
-			name: `${tableName}_require_admin_write`,
-			mode: "restrictive",
-			operations: [...DEFAULT_GUARDED_OPS],
-			condition: SERVER_OR_ADMIN_EXPR,
-			check: SERVER_OR_ADMIN_EXPR
-		});
-	}
-	return [...explicit, ...injected];
-}
-//#endregion
 //#region src/schema/generate-drizzle-schema-logic.ts
 /**
 * Resolve the SQL column name for a property.
@@ -8969,31 +9648,12 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 * Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
 */
 var wrapSql = (clause) => `sql\`${clause}\``;
-/**
-* Generates a deterministic hash based on the rule configuration.
-*/
-var getPolicyNameHash = (rule) => {
-	const data = JSON.stringify({
-		a: rule.access,
-		m: rule.mode,
-		op: rule.operation,
-		ops: rule.operations?.slice().sort(),
-		own: rule.ownerField,
-		rol: rule.roles?.slice().sort(),
-		pg: rule.pgRoles?.slice().sort(),
-		u: rule.using,
-		w: rule.withCheck,
-		c: rule.condition,
-		ch: rule.check
-	});
-	return createHash("sha1").update(data).digest("hex").substring(0, 7);
-};
 var generatePolicyCode = (collection, rule, index, resolveCollection) => {
 	const tableName = getTableName$1(collection);
 	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
-	const ruleHash = getPolicyNameHash(rule);
+	const policyNames = getPolicyNamesForRule(rule, tableName);
 	return ops.map((op, opIdx) => {
-		return generateSinglePolicyCode(collection, rule, op, rule.name ? ops.length > 1 ? `${rule.name}_${op}` : rule.name : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`, resolveCollection);
+		return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
 	}).join("");
 };
 /**
@@ -9122,6 +9782,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 		});
 	});
 	schemaContent += "\n";
+	const junctionSpecs = resolveJunctionSpecs(collections);
 	for (const collection of collections) {
 		const tableName = getTableName$1(collection);
 		if (tableName) allTablesToGenerate.set(tableName, { collection });
@@ -9155,9 +9816,17 @@ var generateSchema = async (collections, stripPolicies = false) => {
 			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
 			schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
 			schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(targetCollection))}.${targetId}, ${refOptions}),\n`;
-			schemaContent += "}, (table) => ({\n";
-			schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
-			schemaContent += "}));\n\n";
+			schemaContent += "}, (table) => ([\n";
+			schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
+			const junctionSpec = junctionSpecs.get(baseTableName);
+			if (!stripPolicies && junctionSpec) {
+				const junctionCollection = getJunctionCollectionConfig(junctionSpec);
+				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
+				getJunctionSecurityRules(junctionSpec).forEach((rule, idx) => {
+					schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
+				});
+			}
+			schemaContent += "])).enableRLS();\n\n";
 		} else if (!isJunction) {
 			const schema = isPostgresCollectionConfig(collection) ? collection.schema : void 0;
 			const tableCreator = schema ? `${schema}Schema.table` : "pgTable";
@@ -9848,7 +10517,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				startAfter: request.startAfter,
 				searchString: request.searchString
 			}, authContext);
-			this.sendCollectionUpdate(clientId, subscriptionId, rows);
+			this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
 			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -9949,7 +10618,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			if (subscription.type === "single" && notifyPath === originalPath) if (row && row?._rebase_invalidated) this.debouncedSingleRefetch(subscriptionId, notifyPath, id, subscription);
 			else this.sendSingleUpdate(subscription.clientId, subscriptionId, row);
 			else if (subscription.type === "collection" && subscription.collectionRequest) {
-				if (!row || !row?._rebase_invalidated) this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row);
+				if (!row || !row?._rebase_invalidated) this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row, notifyPath);
 				this.debouncedCollectionRefetch(subscriptionId, notifyPath, subscription);
 			}
 		} catch (error) {
@@ -9979,7 +10648,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			if (!this._subscriptions.has(subscriptionId)) return;
 			try {
 				const rows = await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest, subscription.authContext);
-				this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows);
+				this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath);
 			} catch (error) {
 				const sanitized = sanitizeErrorForClient(error, notifyPath);
 				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -10193,11 +10862,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		return await this.dataService.fetchOne(notifyPath, id);
 	}
-	sendCollectionUpdate(clientId, subscriptionId, rows) {
+	sendCollectionUpdate(clientId, subscriptionId, rows, path) {
 		const message = {
 			type: "collection_update",
 			subscriptionId,
-			rows
+			rows,
+			pks: this.primaryKeysForPath(path)
 		};
 		this.sendMessage(clientId, message);
 	}
@@ -10212,16 +10882,33 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	/**
 	* Send a lightweight row-level patch to a collection subscriber.
 	* The client can merge this into its cached data for instant feedback.
+	*
+	* The key columns ride along: the patch names a row by address, and the
+	* client has to find that row among the ones it cached — which carry
+	* columns and no address. The SDK holds no collection config to derive one
+	* from, so this is the only place the mapping can come from.
 	*/
-	sendCollectionPatch(clientId, subscriptionId, id, row) {
+	sendCollectionPatch(clientId, subscriptionId, id, row, notifyPath) {
 		const message = {
 			type: "collection_patch",
 			subscriptionId,
 			id,
-			row
+			row,
+			pks: this.primaryKeysForPath(notifyPath)
 		};
 		this.sendMessage(clientId, message);
 	}
+	/** The key columns of the collection at `path`, if they can be resolved. */
+	primaryKeysForPath(path) {
+		try {
+			const collection = this.registry.getCollectionByPath(path);
+			if (!collection) return void 0;
+			const keys = getPrimaryKeys(collection, this.registry);
+			return keys.length > 0 ? keys : void 0;
+		} catch {
+			return;
+		}
+	}
 	sendError(clientId, error, subscriptionId, code) {
 		const message = {
 			type: "error",
@@ -10469,12 +11156,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	}
 	/** Compute the canonical (possibly composite) id string from a captured row. */
 	extractIdFromCdcRow(collection, row) {
-		try {
-			const composite = buildCompositeId(row, getPrimaryKeys(collection, this.registry));
-			if (composite && composite !== ":::") return composite;
-		} catch {}
-		if (row.id !== void 0 && row.id !== null) return String(row.id);
-		return "*";
+		return deriveRowAddress(row, collection, this.registry) || "*";
 	}
 	dedupKey(path, id, databaseId) {
 		return `${databaseId ?? ""}::${path}::${id}`;
@@ -11090,7 +11772,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 			} catch (error) {
 				logger.error("💥 [WebSocket Server] Error handling message", { error });
 				if (error instanceof Error) logger.error("Stack trace", { detail: error.stack });
-				const errorMessage = process.env.NODE_ENV === "production" ? "An unexpected error occurred" : error instanceof Error ? error.message : "An unexpected error occurred";
+				const errorMessage = process.env.NODE_ENV === "production" ? "An unexpected error occurred" : extractErrorMessage(error);
 				const errorResponse = {
 					type: "ERROR",
 					requestId,
@@ -19934,6 +20616,33 @@ function formatBytes(bytes) {
 	return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
 }
 //#endregion
+//#region src/collections/buildRegistry.ts
+/**
+* Build the collection registry for a driver.
+*
+* The order matters and is the reason this is one function rather than a run of
+* statements in the bootstrapper. Keys are resolved from the drizzle schema, so
+* anything that inspects them has to run *after* the tables are registered —
+* and `warnOnKeysTheAdminCannotResolve` fails open if it does not, because a
+* collection whose table it cannot look up is one it has nothing to say about.
+* Warned too early, it would skip every collection and report nothing, which
+* reads exactly like having nothing to report.
+*/
+function buildCollectionRegistry(schema) {
+	const registry = new PostgresCollectionRegistry();
+	if (schema.collections) {
+		registry.registerMultiple(schema.collections);
+		logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
+	}
+	if (schema.tables) Object.values(schema.tables).forEach((table) => {
+		if (isTable(table)) registry.registerTable(table, getTableName(table));
+	});
+	if (schema.enums) registry.registerEnums(schema.enums);
+	if (schema.relations) registry.registerRelations(schema.relations);
+	warnOnKeysTheAdminCannotResolve(registry.getCollections(), registry);
+	return registry;
+}
+//#endregion
 //#region src/auth/ensure-tables.ts
 /**
 * Auto-create auth tables if they don't exist.
@@ -20105,14 +20814,22 @@ async function ensureAuthTablesExist(db, collection) {
                 $$ LANGUAGE sql STABLE
             `);
 		});
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
-        `);
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
-        `);
+		for (const columnDef of [
+			"display_name VARCHAR(255)",
+			"photo_url VARCHAR(500)",
+			"roles TEXT[] DEFAULT '{}' NOT NULL",
+			"password_hash VARCHAR(255)",
+			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
+			"email_verification_token VARCHAR(255)",
+			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
+			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
+			"metadata JSONB DEFAULT '{}' NOT NULL",
+			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
+			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
+		]) await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+            `);
 		try {
 			if ((await db.execute(sql`
                 SELECT EXISTS (
@@ -20183,6 +20900,34 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE INDEX IF NOT EXISTS idx_recovery_codes_user
             ON ${sql.raw(recoveryCodesTableName)}(user_id)
         `);
+		try {
+			const authTablePairs = [
+				[usersSchema, resolvedTable],
+				[authSchema, "user_identities"],
+				[authSchema, "refresh_tokens"],
+				[authSchema, "password_reset_tokens"],
+				[authSchema, "app_config"],
+				[authSchema, "mfa_factors"],
+				[authSchema, "mfa_challenges"],
+				[authSchema, "recovery_codes"]
+			];
+			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
+                    SELECT 1
+                    FROM pg_class c
+                    JOIN pg_namespace n ON n.oid = c.relnamespace
+                    WHERE n.nspname = ${schemaName}
+                      AND c.relname = ${tableName}
+                      AND c.relforcerowsecurity
+                `)).rows.length > 0) {
+				await db.execute(sql`
+                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
+                        NO FORCE ROW LEVEL SECURITY
+                    `);
+				logger.warn(`🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" (legacy RLS model — it binds the owner connection and breaks privileged auth writes)`);
+			}
+		} catch (rlsReconcileError) {
+			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
+		}
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
 		logger.error("❌ Failed to create auth tables", { error });
@@ -20230,6 +20975,31 @@ var UserService = class {
 		const name = getTableName(this.usersTable);
 		return `"${getTableConfig(this.usersTable).schema || "public"}"."${name}"`;
 	}
+	/**
+	* Run a privileged auth write with an explicitly cleared RLS context.
+	*
+	* The auth services run on the base/owner connection, which by design
+	* carries a NULL `app.user_id` so the `auth.uid() IS NULL` server-escape
+	* in the default policies applies. That NULL is normally guaranteed by
+	* `set_config(..., is_local = true)` resetting at transaction end — but a
+	* GUC that survives on a pooled connection (or a connection role that
+	* doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
+	* turns the trusted write into an RLS-scoped one and denies it with
+	* SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
+	* single chokepoint, makes the server context deterministic instead of
+	* trusting whatever state the pool hands us. `auth.uid()` reads '' as
+	* NULL via NULLIF, so '' is the server context.
+	*/
+	async withServerContext(fn) {
+		return await this.db.transaction(async (tx) => {
+			await tx.execute(sql`
+                SELECT set_config('app.user_id', '', true),
+                       set_config('app.user_roles', '', true),
+                       set_config('app.jwt', '', true)
+            `);
+			return await fn(tx);
+		});
+	}
 	mapRowToUser(row) {
 		if (!row) return row;
 		const id = row.id ?? row.uid;
@@ -20327,7 +21097,7 @@ var UserService = class {
 	}
 	async createUser(data) {
 		const payload = this.mapPayload(data);
-		const [row] = await this.db.insert(this.usersTable).values(payload).returning();
+		const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
 		return this.mapRowToUser(row);
 	}
 	async getUserById(id) {
@@ -20366,12 +21136,12 @@ var UserService = class {
 		}));
 	}
 	async linkUserIdentity(userId, provider, providerId, profileData) {
-		await this.db.insert(this.userIdentitiesTable).values({
+		await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
 			userId,
 			provider,
 			providerId,
 			profileData: profileData || null
-		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] });
+		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] }));
 	}
 	async updateUser(id, data) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -20379,13 +21149,13 @@ var UserService = class {
 		const payload = this.mapPayload(data);
 		const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 		payload[updatedAtKey] = /* @__PURE__ */ new Date();
-		const [row] = await this.db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning();
+		const [row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
 		return row ? this.mapRowToUser(row) : null;
 	}
 	async deleteUser(id) {
 		const idCol = getColumn(this.usersTable, "id");
 		if (!idCol) return;
-		await this.db.delete(this.usersTable).where(eq(idCol, id));
+		await this.withServerContext(async (db) => db.delete(this.usersTable).where(eq(idCol, id)));
 	}
 	async listUsers() {
 		return (await this.db.select().from(this.usersTable)).map((row) => this.mapRowToUser(row));
@@ -20439,10 +21209,10 @@ var UserService = class {
 		if (!idCol) return;
 		const passwordHashColKey = getColumnKey(this.usersTable, "passwordHash", "password_hash") || "passwordHash";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[passwordHashColKey]: passwordHash,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification status
@@ -20453,11 +21223,11 @@ var UserService = class {
 		const emailVerifiedColKey = getColumnKey(this.usersTable, "emailVerified", "email_verified") || "emailVerified";
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerifiedColKey]: verified,
 			[emailVerificationTokenColKey]: null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification token
@@ -20468,11 +21238,11 @@ var UserService = class {
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const emailVerificationSentAtColKey = getColumnKey(this.usersTable, "emailVerificationSentAt", "email_verification_sent_at") || "emailVerificationSentAt";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerificationTokenColKey]: token,
 			[emailVerificationSentAtColKey]: token ? /* @__PURE__ */ new Date() : null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Find user by email verification token
@@ -20517,22 +21287,22 @@ var UserService = class {
 	async setUserRoles(userId, roleIds) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const rolesArray = `{${roleIds.join(",")}}`;
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = ${rolesArray}::text[], updated_at = NOW()
             WHERE id = ${userId}
-        `);
+        `));
 	}
 	/**
 	* Assign a specific role to new user (appends if not present)
 	*/
 	async assignDefaultRole(userId, roleId) {
 		const usersTableName = this.getQualifiedUsersTableName();
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = array_append(roles, ${roleId}), updated_at = NOW()
             WHERE id = ${userId} AND NOT (${roleId} = ANY(roles))
-        `);
+        `));
 	}
 	/**
 	* Get user with their roles
@@ -21916,21 +22686,14 @@ function createPostgresBootstrapper(pgConfig) {
 				logger.info(`🔍 [PostgresRegistry] BaaS mode: derived ${introspectedCollections.length} collections from schema "${pgSchemaName}" [${introspectedCollections.map((c) => c.slug).join(", ")}]`);
 			}
 			const activeCollections = introspectedCollections ?? collections;
-			const registry = new PostgresCollectionRegistry();
-			if (activeCollections) {
-				registry.registerMultiple(activeCollections);
-				logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
-			}
 			const schemaTables = introspectedTables ?? pgConfig.schema?.tables;
-			if (schemaTables) Object.values(schemaTables).forEach((table) => {
-				if (isTable(table)) {
-					const tableName = getTableName(table);
-					registry.registerTable(table, tableName);
-				}
-			});
-			if (pgConfig.schema?.enums) registry.registerEnums(pgConfig.schema.enums);
 			const schemaRelations = introspectedRelations ?? pgConfig.schema?.relations;
-			if (schemaRelations) registry.registerRelations(schemaRelations);
+			const registry = buildCollectionRegistry({
+				collections: activeCollections,
+				tables: schemaTables,
+				enums: pgConfig.schema?.enums,
+				relations: schemaRelations
+			});
 			if (schemaTables) patchPgArrayNullSafety(schemaTables);
 			const mergedSchema = {
 				...schemaTables,
@@ -22009,6 +22772,7 @@ function createPostgresBootstrapper(pgConfig) {
 			const wantsCdc = cdcMode !== "off";
 			const explicitCdc = cdcMode === "trigger" || cdcMode === "wal";
 			let cdcEnabled = false;
+			let provisionCdcForTables;
 			if (wantsCdc && !directUrl) {
 				const reason = "no direct database connection is available for the realtime LISTEN client (set DATABASE_DIRECT_URL)";
 				if (explicitCdc) logger.warn(`⚠️ [CDC] REALTIME_CDC=${cdcMode} but ${reason} — using app-level realtime.`);
@@ -22025,6 +22789,9 @@ function createPostgresBootstrapper(pgConfig) {
 					})).filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table)));
 					await realtimeService.enableCdc(directUrl);
 					cdcEnabled = true;
+					provisionCdcForTables = async (tables) => {
+						await provisionTriggerCdc(cdcRunSql, tables);
+					};
 					logger.info(`📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). All writes now emit realtime events regardless of origin.`);
 				} catch (err) {
 					if (explicitCdc) logger.warn("⚠️ [CDC] Could not enable database-level change capture — falling back to app-level realtime.", { error: err });
@@ -22049,13 +22816,14 @@ function createPostgresBootstrapper(pgConfig) {
 					const dbTables = new Set(result.rows.map((r) => r.table_schema === "public" ? r.table_name : `${r.table_schema}.${r.table_name}`));
 					const missing = [];
 					for (const col of registeredCollections) {
+						if (col.auth?.enabled) continue;
 						const schemaName = "schema" in col && col.schema ? col.schema : "public";
 						const tableName = registry.hasTableForCollection(col.table ?? col.slug) ? col.table ?? col.slug : col.slug;
 						const checkName = registry.getTableNames().find((k) => k === tableName || k === col.slug) ?? tableName;
 						const fullCheckName = schemaName === "public" ? checkName : `${schemaName}.${checkName}`;
 						if (!dbTables.has(fullCheckName)) missing.push({
 							slug: col.slug,
-							table: checkName
+							table: fullCheckName
 						});
 					}
 					if (missing.length > 0) {
@@ -22089,7 +22857,8 @@ function createPostgresBootstrapper(pgConfig) {
 					registry,
 					realtimeService,
 					driver,
-					poolManager
+					poolManager,
+					provisionCdcForTables
 				}
 			};
 		},
@@ -22101,6 +22870,18 @@ function createPostgresBootstrapper(pgConfig) {
 			const registry = internals.registry;
 			const authCollection = authConfig.collection;
 			await ensureAuthTablesExist(db, authCollection);
+			if (authCollection && internals.provisionCdcForTables) {
+				const authSchema = "schema" in authCollection && typeof authCollection.schema === "string" ? authCollection.schema : "rebase";
+				const authTable = "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug;
+				if (authTable) try {
+					await internals.provisionCdcForTables([{
+						schema: authSchema,
+						table: authTable
+					}]);
+				} catch (err) {
+					logger.warn(`⚠️ [CDC] Could not attach change-capture to the auth table "${authSchema}.${authTable}" — writes to it won't emit database-level events.`, { detail: err instanceof Error ? err.message : String(err) });
+				}
+			}
 			let emailService;
 			if (authConfig.email) emailService = createEmailService(authConfig.email);
 			const tableName = authCollection ? "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug : void 0;
@@ -22171,6 +22952,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map