@rebasepro/server-postgres 0.9.1-canary.1d2d8b5 → 0.9.1-canary.58368ce

package/dist/index.es.js

@@ -6,12 +6,12 @@ import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, or, relations, sql } from "drizzle-orm";
 import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
-import { createHash, randomUUID } from "crypto";
 import fs, { promises } from "fs";
 import path from "path";
 import chokidar from "chokidar";
 import { WebSocket, WebSocketServer } from "ws";
 import { EventEmitter } from "events";
+import { randomUUID } from "crypto";
 import { inspect } from "util";
 import os from "os";
 import { fileURLToPath } from "node:url";
@@ -1502,6 +1502,140 @@ function removeFunctions(o) {
 	return o;
 }
 //#endregion
+//#region ../utils/src/sha1.ts
+/**
+* Minimal SHA-1 implementation that runs in both Node and the browser.
+*
+* This exists because generated Postgres policy names embed a SHA-1 digest of
+* the security rule. The DDL generator runs on the server (where `node:crypto`
+* is available) but the Studio has to derive the same names in the browser to
+* tell a policy it generated apart from one it did not. `node:crypto` cannot be
+* bundled for the browser, so the shared derivation needs a portable digest.
+*
+* SHA-1 is used purely to name things deterministically — never for security.
+* The output is byte-identical to `createHash("sha1").update(str).digest("hex")`,
+* which `sha1.test.ts` pins against `node:crypto` directly.
+*/
+/** Rotate a 32-bit word left by `n` bits. */
+function rotl(value, n) {
+	return value << n | value >>> 32 - n;
+}
+/**
+* SHA-1 digest of a string, hex-encoded.
+*
+* The input is encoded as UTF-8, matching Node's default handling of strings
+* passed to `hash.update(str)`.
+*/
+function sha1Hex(input) {
+	const bytes = Array.from(new TextEncoder().encode(input));
+	const bitLength = bytes.length * 8;
+	bytes.push(128);
+	while (bytes.length % 64 !== 56) bytes.push(0);
+	const hi = Math.floor(bitLength / 4294967296);
+	const lo = bitLength >>> 0;
+	bytes.push(hi >>> 24 & 255, hi >>> 16 & 255, hi >>> 8 & 255, hi & 255);
+	bytes.push(lo >>> 24 & 255, lo >>> 16 & 255, lo >>> 8 & 255, lo & 255);
+	let h0 = 1732584193;
+	let h1 = 4023233417;
+	let h2 = 2562383102;
+	let h3 = 271733878;
+	let h4 = 3285377520;
+	const w = new Array(80);
+	for (let offset = 0; offset < bytes.length; offset += 64) {
+		for (let i = 0; i < 16; i++) {
+			const j = offset + i * 4;
+			w[i] = bytes[j] << 24 | bytes[j + 1] << 16 | bytes[j + 2] << 8 | bytes[j + 3] | 0;
+		}
+		for (let i = 16; i < 80; i++) w[i] = rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
+		let a = h0;
+		let b = h1;
+		let c = h2;
+		let d = h3;
+		let e = h4;
+		for (let i = 0; i < 80; i++) {
+			let f;
+			let k;
+			if (i < 20) {
+				f = b & c | ~b & d;
+				k = 1518500249;
+			} else if (i < 40) {
+				f = b ^ c ^ d;
+				k = 1859775393;
+			} else if (i < 60) {
+				f = b & c | b & d | c & d;
+				k = 2400959708;
+			} else {
+				f = b ^ c ^ d;
+				k = 3395469782;
+			}
+			const temp = rotl(a, 5) + f + e + k + w[i] | 0;
+			e = d;
+			d = c;
+			c = rotl(b, 30);
+			b = a;
+			a = temp;
+		}
+		h0 = h0 + a | 0;
+		h1 = h1 + b | 0;
+		h2 = h2 + c | 0;
+		h3 = h3 + d | 0;
+		h4 = h4 + e | 0;
+	}
+	return [
+		h0,
+		h1,
+		h2,
+		h3,
+		h4
+	].map((word) => (word >>> 0).toString(16).padStart(8, "0")).join("");
+}
+//#endregion
+//#region ../utils/src/policy-names.ts
+/**
+* Naming of the Postgres policies generated from a collection's security rules.
+*
+* A rule without an explicit `name` is compiled to `<table>_<op>_<hash>`, where
+* the hash covers the rule's semantics. The Studio needs the same names to tell
+* "this policy came from your code" apart from "someone wrote this in SQL" —
+* without them it treats generated policies as foreign and offers to import
+* them back into the codebase they came from.
+*
+* This is the single definition of that naming. The DDL and Drizzle generators
+* both derive names from here, so a change cannot silently rename every policy
+* in every deployed database while the UI keeps matching the old ones.
+*/
+/** Stable digest of the parts of a rule that determine what the policy does. */
+function getPolicyNameHash(rule) {
+	return sha1Hex(JSON.stringify({
+		a: rule.access,
+		m: rule.mode,
+		op: rule.operation,
+		ops: rule.operations?.slice().sort(),
+		own: rule.ownerField,
+		rol: rule.roles?.slice().sort(),
+		pg: rule.pgRoles?.slice().sort(),
+		u: rule.using,
+		w: rule.withCheck,
+		c: rule.condition,
+		ch: rule.check
+	})).substring(0, 7);
+}
+/** The operations a rule expands to — `operations` wins over `operation`. */
+function getPolicyOperations(rule) {
+	return rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+}
+/**
+* Every Postgres policy name a single rule compiles to — one per operation.
+*
+* @param rule      The security rule as written in the collection config.
+* @param tableName The rule's table (see `getTableName` in `@rebasepro/common`).
+*/
+function getPolicyNamesForRule(rule, tableName) {
+	const ops = getPolicyOperations(rule);
+	const ruleHash = getPolicyNameHash(rule);
+	return ops.map((op, opIdx) => rule.name ? ops.length > 1 ? `${rule.name}_${op}` : rule.name : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`);
+}
+//#endregion
 //#region ../utils/src/names.ts
 /**
 * Generates a foreign key column name from a given string, typically a collection slug or name.
@@ -1626,6 +1760,109 @@ function createRelationRefWithData(id, path, data) {
 		data
 	};
 }
+/**
+* Derive a row's address from its key columns.
+*
+* Single key → the value as a string. Composite → each part joined by
+* {@link COMPOSITE_ID_SEPARATOR}, in primary-key order, which is what
+* {@link parseIdValues} expects to invert.
+*/
+function buildCompositeId(values, primaryKeys) {
+	if (primaryKeys.length === 0) return "";
+	if (primaryKeys.length === 1) return String(values[primaryKeys[0].fieldName] ?? "");
+	return primaryKeys.map((pk) => String(values[pk.fieldName] ?? "")).join(":::");
+}
+/**
+* Invert {@link buildCompositeId}: turn an address back into key columns, each
+* coerced to the type its column actually round-trips as.
+*
+* This is the boundary where a URL segment becomes a query parameter, so a
+* malformed address must throw rather than silently produce a query that
+* matches the wrong row (or none).
+*/
+function parseIdValues(idValue, primaryKeys) {
+	const result = {};
+	if (primaryKeys.length === 0) return result;
+	if (primaryKeys.length === 1) {
+		const pk = primaryKeys[0];
+		if (pk.type === "number" && !pk.isUUID) {
+			const parsed = typeof idValue === "number" ? idValue : parseInt(String(idValue), 10);
+			if (isNaN(parsed)) throw new Error(`Invalid numeric ID: ${idValue}`);
+			result[pk.fieldName] = parsed;
+		} else result[pk.fieldName] = String(idValue);
+		return result;
+	}
+	const parts = String(idValue).split(":::");
+	if (parts.length !== primaryKeys.length) throw new Error(`Composite ID parts mismatch. Expected ${primaryKeys.length}, got ${parts.length} for ID: ${idValue}`);
+	for (let i = 0; i < primaryKeys.length; i++) {
+		const pk = primaryKeys[i];
+		const val = parts[i];
+		if (pk.type === "number" && !pk.isUUID) {
+			const parsed = parseInt(val, 10);
+			if (isNaN(parsed)) throw new Error(`Invalid numeric ID component: ${val}`);
+			result[pk.fieldName] = parsed;
+		} else result[pk.fieldName] = val;
+	}
+	return result;
+}
+/**
+* The primary keys of a collection, as declared by its properties.
+*
+* This is the only tier both sides can read, because it is the only one written
+* in the config: the postgres driver can also infer keys from the Drizzle
+* schema, which the browser never sees and is never sent — the admin compiles
+* the collection files into its own bundle rather than being served them. A key
+* that lives only in the Drizzle schema is therefore invisible here, and the
+* server says so at boot (`warnOnKeysTheAdminCannotResolve`) naming the `isId`
+* to add.
+*
+* Returns an empty array when a collection declares none, which callers must
+* treat as "not addressable" rather than defaulting to `id`: guessing a key
+* that is not the real one produces confidently wrong addresses.
+*/
+function getDeclaredPrimaryKeys(collection) {
+	const properties = collection.properties;
+	if (!properties) return [];
+	const keys = [];
+	for (const [fieldName, propRaw] of Object.entries(properties)) {
+		const prop = propRaw;
+		if (!prop || typeof prop !== "object") continue;
+		if (!("isId" in prop) || !prop.isId) continue;
+		keys.push({
+			fieldName,
+			type: prop.type === "number" ? "number" : "string",
+			isUUID: prop.isId === "uuid"
+		});
+	}
+	return keys;
+}
+/**
+* The keys to address a collection's rows with, resolved the way the driver
+* resolves them — minus the tier the browser cannot reach.
+*
+* The postgres driver tries, in order: properties marked `isId`; the primary
+* keys of the Drizzle schema; and finally a column literally named `id`. Only
+* the first and last are visible in a `CollectionConfig`, which is what both
+* sides share.
+*
+* So the two agree except on a collection that declares no `isId` and whose key
+* is known only to Drizzle. There, the driver reads the real key, and this
+* either resolves nothing (reported to the console by the caller) or — if the
+* table happens to have an unrelated `id` property — resolves `id`, which is
+* the wrong key and cannot be detected from here: the addresses look right and
+* route wrong. Only the config can settle it, so the server names both cases
+* at boot (`warnOnKeysTheAdminCannotResolve`) with the `isId` to add.
+*/
+function resolvePrimaryKeys(collection) {
+	const declared = getDeclaredPrimaryKeys(collection);
+	if (declared.length > 0) return declared;
+	const idProp = collection.properties?.id;
+	if (idProp && typeof idProp === "object") return [{
+		fieldName: "id",
+		type: idProp.type === "number" ? "number" : "string"
+	}];
+	return [];
+}
 //#endregion
 //#region ../common/src/util/enums.ts
 function enumToObjectEntries(enumValues) {
@@ -2284,6 +2521,307 @@ var buildPropertyCallbacks = (properties) => {
 	};
 	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
 };
+//#endregion
+//#region ../common/src/util/auth-default-policies.ts
+/**
+* Default RLS policies injected by the schema generator.
+*
+* Rebase's enforcement model is unified: authenticated (user-context) requests
+* run under the restricted `rebase_user` role, so Postgres RLS binds *every*
+* statement — reads and writes. A collection's `securityRules` are the whole
+* authorization model. The server context (auth flows, migrations,
+* `dataAsAdmin`) runs as the owner and bypasses RLS.
+*
+* Because RLS default-denies, every collection is **locked by default**: with
+* no rules, only the server context and admins can touch it. The generator
+* injects that safe baseline:
+*
+* **For every collection**
+*  1. A permissive **server-or-admin SELECT** grant.
+*  2. A permissive **server-or-admin write** grant (insert/update/delete).
+*
+* Author `securityRules` are permissive and OR together, so explicit rules only
+* *broaden* access from this locked baseline (e.g. "users read/write their own
+* rows").
+*
+* **For auth collections additionally**
+*  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
+*     their own row (profile, session bootstrap) without every app re-declaring
+*     it.
+*  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
+*     every other policy, so a write is rejected unless the caller is an admin
+*     (or the server context) — even if the author also wrote a permissive rule
+*     such as "a user may edit their own row". Without this, a permissive owner
+*     rule would let a user change their own `roles`.
+*
+* The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
+* — the built-in flows that run without a user (signup, migrations) set no user
+* GUC — which also lets the owner connection satisfy these policies even under
+* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
+* `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
+*
+* Opt out with `disableDefaultPolicies: true` to take full responsibility for
+* the collection's RLS.
+*/
+var SERVER_OR_ADMIN_EXPR$1 = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/** Write operations that must be admin-gated by default on auth collections. */
+var DEFAULT_GUARDED_OPS = [
+	"insert",
+	"update",
+	"delete"
+];
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection) {
+	const auth = collection.auth;
+	return auth === true || typeof auth === "object" && auth?.enabled === true;
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName$1(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/**
+* Returns the security rules that should be applied to a collection: the
+* author's explicit `securityRules` plus the framework defaults described in
+* the module doc (baseline server/admin read for all collections; self-read
+* and the admin write gate for auth collections).
+*
+* Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+*/
+function getEffectiveSecurityRules(collection) {
+	const explicit = [...(isPostgresCollectionConfig(collection) ? collection.securityRules : void 0) ?? []];
+	if (collection.disableDefaultPolicies) return explicit;
+	const tableName = getTableName$1(collection);
+	const injected = [];
+	injected.push({
+		name: `${tableName}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR$1
+	});
+	injected.push({
+		name: `${tableName}_default_admin_write`,
+		operations: [...DEFAULT_GUARDED_OPS],
+		condition: SERVER_OR_ADMIN_EXPR$1,
+		check: SERVER_OR_ADMIN_EXPR$1
+	});
+	if (isAuthCollection(collection)) {
+		injected.push({
+			name: `${tableName}_default_self_read`,
+			operations: ["select"],
+			condition: policy.compare(policy.field(getIdPropertyName$1(collection)), "eq", policy.authUid())
+		});
+		injected.push({
+			name: `${tableName}_require_admin_write`,
+			mode: "restrictive",
+			operations: [...DEFAULT_GUARDED_OPS],
+			condition: SERVER_OR_ADMIN_EXPR$1,
+			check: SERVER_OR_ADMIN_EXPR$1
+		});
+	}
+	return [...explicit, ...injected];
+}
+//#endregion
+//#region ../common/src/util/junction-policies.ts
+var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/**
+* Walk every collection's resolved relations and aggregate the junction tables
+* they declare. Two collections may declare the same junction from opposite
+* sides (posts→tags and tags→posts through `posts_tags`); both become
+* `declaringSides` of one spec, so derived write grants consider both.
+*/
+function resolveJunctionSpecs(collections) {
+	const specs = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const resolved = resolveCollectionRelations(collection);
+		for (const relation of Object.values(resolved)) {
+			if (!relation.through) continue;
+			const targetCollection = typeof relation.target === "function" ? relation.target() : void 0;
+			if (!targetCollection) continue;
+			const rawName = relation.through.table;
+			const table = rawName.includes(".") ? rawName.split(".").pop() : rawName;
+			const schema = "public";
+			const source = {
+				collection,
+				junctionColumn: relation.through.sourceColumn,
+				relation
+			};
+			const target = {
+				collection: targetCollection,
+				junctionColumn: relation.through.targetColumn
+			};
+			const existing = specs.get(table);
+			if (!existing) specs.set(table, {
+				table,
+				schema,
+				endpoints: [source, target],
+				declaringSides: [source]
+			});
+			else if (!existing.declaringSides.some((s) => s.collection === collection)) existing.declaringSides.push(source);
+		}
+	}
+	return specs;
+}
+/**
+* A synthetic CollectionConfig standing in for the junction during policy
+* compilation and naming. Its two FK columns carry explicit `columnName`s so
+* `outerField` operands resolve to the exact columns the CREATE TABLE emitted,
+* whatever their casing.
+*/
+function getJunctionCollectionConfig(spec) {
+	const properties = {};
+	for (const endpoint of spec.endpoints) properties[endpoint.junctionColumn] = {
+		type: "string",
+		columnName: endpoint.junctionColumn
+	};
+	return {
+		slug: spec.table,
+		name: spec.table,
+		table: spec.table,
+		schema: spec.schema,
+		properties
+	};
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/** `EXISTS (SELECT 1 FROM endpoint WHERE endpoint.pk = junction.fk [AND extra])`. */
+function existsEndpoint(endpoint, extra) {
+	const correlation = policy.compare(policy.field(getIdPropertyName(endpoint.collection)), "eq", policy.outerField(endpoint.junctionColumn));
+	return policy.existsIn({
+		collection: endpoint.collection.slug,
+		where: extra ? policy.and(correlation, extra) : correlation
+	});
+}
+/**
+* Whether a parent-rule expression keeps its meaning when moved inside the
+* junction's `EXISTS` subquery — and the re-scoped copy if it does.
+*
+* Returns `null` when the rule cannot be embedded faithfully: `raw` SQL
+* anywhere (its `{column}` placeholders would bind to the junction), or an
+* `outerField` inside a nested `existsIn` (it would bind to the junction while
+* the author meant the parent, and no operand can express "the middle scope").
+* Top-level `outerField`s are rewritten to `field`, which is what they meant.
+*/
+function embedParentExpression(expr, depth = 0) {
+	switch (expr.kind) {
+		case "raw": return null;
+		case "and":
+		case "or": {
+			const parts = [];
+			for (const child of expr.operands) {
+				const embedded = embedParentExpression(child, depth);
+				if (!embedded) return null;
+				parts.push(embedded);
+			}
+			return expr.kind === "and" ? policy.and(...parts) : policy.or(...parts);
+		}
+		case "not": {
+			const embedded = embedParentExpression(expr.operand, depth);
+			return embedded ? policy.not(embedded) : null;
+		}
+		case "existsIn": {
+			const where = embedParentExpression(expr.where, depth + 1);
+			return where ? policy.existsIn({
+				collection: expr.collection,
+				where
+			}) : null;
+		}
+		case "compare": {
+			const left = embedOperand(expr.left, depth);
+			const right = embedOperand(expr.right, depth);
+			if (!left || !right) return null;
+			return {
+				...expr,
+				left,
+				right
+			};
+		}
+		default: return expr;
+	}
+}
+/** Re-scope an operand, or return `null` if its binding cannot be preserved. */
+function embedOperand(operand, depth) {
+	if (operand.kind === "outerField") {
+		if (depth === 0) return policy.field(operand.name);
+		return null;
+	}
+	return operand;
+}
+/** Does the rule cover the `update` operation? */
+function coversUpdate(rule) {
+	return getPolicyOperations(rule).some((op) => op === "update" || op === "all");
+}
+/**
+* The full derived policy set for a junction table: the locked server/admin
+* baseline, the endpoint-visibility read grant, inherited write grants, and
+* inherited restrictive gates. Returns `[]` when every declaring collection set
+* `disableDefaultPolicies` — the junction is then the author's to police, and
+* stays locked (RLS is still enabled) until they write policies for it.
+*/
+function getJunctionSecurityRules(spec) {
+	if (spec.declaringSides.every((side) => side.collection.disableDefaultPolicies)) return [];
+	const rules = [];
+	rules.push({
+		name: `${spec.table}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_admin_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: SERVER_OR_ADMIN_EXPR,
+		check: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_edge_read`,
+		operations: ["select"],
+		condition: policy.and(existsEndpoint(spec.endpoints[0]), existsEndpoint(spec.endpoints[1]))
+	});
+	const writeGrants = [];
+	for (const side of spec.declaringSides) {
+		const updateRules = ((isPostgresCollectionConfig(side.collection) ? side.collection.securityRules : void 0) ?? []).filter(coversUpdate);
+		const permissive = updateRules.filter((r) => r.mode !== "restrictive");
+		const restrictive = updateRules.filter((r) => r.mode === "restrictive");
+		const embeddedGates = [];
+		let gatesEmbeddable = true;
+		for (const gate of restrictive) {
+			const using = securityRuleToConditions(gate).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (!embedded) {
+				gatesEmbeddable = false;
+				break;
+			}
+			embeddedGates.push(embedded);
+		}
+		if (!gatesEmbeddable) continue;
+		const grants = [];
+		for (const rule of permissive) {
+			const using = securityRuleToConditions(rule).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (embedded) grants.push(embedded);
+		}
+		if (grants.length === 0) continue;
+		const condition = embeddedGates.length > 0 ? policy.and(policy.or(...grants), ...embeddedGates) : policy.or(...grants);
+		writeGrants.push(existsEndpoint(side, condition));
+	}
+	if (writeGrants.length > 0) rules.push({
+		name: `${spec.table}_default_edge_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants),
+		check: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants)
+	});
+	return rules;
+}
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(root, factory) {
 		if (typeof define === "function" && define.amd) define(factory);
@@ -3553,18 +4091,45 @@ function deserializeFilter(query) {
 }
 //#endregion
 //#region ../common/src/data/buildRebaseData.ts
+function createPrimaryKeyResolver(options) {
+	const cache = /* @__PURE__ */ new Map();
+	const warned = /* @__PURE__ */ new Set();
+	return function primaryKeysFor(slug) {
+		const cached = cache.get(slug);
+		if (cached) return cached;
+		const collection = options?.resolveCollection?.(slug);
+		if (!collection) return [];
+		const keys = resolvePrimaryKeys(collection);
+		if (keys.length > 0) {
+			cache.set(slug, keys);
+			return keys;
+		}
+		if (!warned.has(slug)) {
+			warned.add(slug);
+			console.warn(`[rebase] Collection '${slug}' declares no primary key, so its rows have no address: detail links, caching and relations will not work for it. Mark the key property with \`isId\` in its collection config — the server logs which column to mark at boot, if its schema knows the key.`);
+		}
+		return keys;
+	};
+}
 /**
-* Convert a flat REST record (e.g. from RestFetchService) to Entity<M> format.
-* Mirrors the client SDK's rowToEntity conversion.
+* Give a flat row the Entity view-model the admin renders.
+*
+* The address is *derived here* — it is not a column, and the row it came from
+* does not contain one. Rows carry exactly what the table has, with the types
+* Postgres returned; the id is this layer's invention, and this is the only
+* place it is minted.
+*
+* `primaryKeys` empty falls back to a literal `id` on the row: drivers other
+* than postgres still serve rows with one, and this keeps them working.
 */
-function rowToEntity(row, slug) {
+function rowToEntity(row, slug, primaryKeys = []) {
 	return {
-		id: row.id,
+		id: primaryKeys.length > 0 ? buildCompositeId(row, primaryKeys) : row.id,
 		path: slug,
 		values: row
 	};
 }
-function createDriverAccessor(driver, slug) {
+function createDriverAccessor(driver, slug, getPks = () => []) {
 	const accessor = {
 		async find(params) {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
@@ -3597,7 +4162,7 @@ function createDriverAccessor(driver, slug) {
 				hasMore = offset + rows.length < total;
 			}
 			return {
-				data: rows.map((row) => rowToEntity(row, slug)),
+				data: rows.map((row) => rowToEntity(row, slug, getPks())),
 				meta: {
 					total,
 					limit,
@@ -3611,7 +4176,7 @@ function createDriverAccessor(driver, slug) {
 				path: slug,
 				id
 			});
-			return row ? rowToEntity(row, slug) : void 0;
+			return row ? rowToEntity(row, slug, getPks()) : void 0;
 		},
 		async create(data, id) {
 			return rowToEntity(await driver.save({
@@ -3619,15 +4184,22 @@ function createDriverAccessor(driver, slug) {
 				values: data,
 				id,
 				status: "new"
-			}), slug);
+			}), slug, getPks());
 		},
+		createMany: driver.saveMany ? async (data, options) => {
+			return (await driver.saveMany({
+				path: slug,
+				rows: data,
+				upsert: options?.upsert
+			})).map((row) => rowToEntity(row, slug, getPks()));
+		} : void 0,
 		async update(id, data) {
 			return rowToEntity(await driver.save({
 				path: slug,
 				values: data,
 				id,
 				status: "existing"
-			}), slug);
+			}), slug, getPks());
 		},
 		async delete(id) {
 			return driver.delete({ row: {
@@ -3656,7 +4228,7 @@ function createDriverAccessor(driver, slug) {
 				searchString: params?.searchString,
 				onUpdate: (entities) => {
 					onUpdate({
-						data: entities.map((row) => rowToEntity(row, slug)),
+						data: entities.map((row) => rowToEntity(row, slug, getPks())),
 						meta: {
 							total: entities.length,
 							limit,
@@ -3672,7 +4244,7 @@ function createDriverAccessor(driver, slug) {
 			return driver.listenOne({
 				path: slug,
 				id,
-				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug) : void 0),
+				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug, getPks()) : void 0),
 				onError
 			});
 		} : void 0,
@@ -3711,12 +4283,13 @@ function createDriverAccessor(driver, slug) {
 * await data.products.create({ name: "Camera", price: 299 });
 * const { data: items } = await data.products.find({ where: { status: ["==", "published"] } });
 */
-function buildRebaseData(driver) {
+function buildRebaseData(driver, options) {
 	const cache = /* @__PURE__ */ new Map();
+	const primaryKeysFor = createPrimaryKeyResolver(options);
 	function getAccessor(slug) {
 		let accessor = cache.get(slug);
 		if (!accessor) {
-			accessor = createDriverAccessor(driver, slug);
+			accessor = createDriverAccessor(driver, slug, () => primaryKeysFor(slug));
 			cache.set(slug, accessor);
 		}
 		return accessor;
@@ -3729,8 +4302,9 @@ function buildRebaseData(driver) {
 	} });
 }
 /**
-* Unwrap a Entity into a flat row. `rowToEntity` stores the whole flat row
-* (id included) under `.values`, so this is just that payload.
+* Unwrap a Entity back into the flat row it was built from. `rowToEntity` keeps
+* the row untouched under `.values` and derives `.id` alongside it, so dropping
+* the wrapper is the whole operation — the address was never part of the row.
 */
 function entityToRow(entity) {
 	return entity.values;
@@ -3817,6 +4391,12 @@ function toSdkCollectionClient(snap) {
 		async create(data, id) {
 			return entityToRow(await snap.create(data, id));
 		},
+		async createMany(data, options) {
+			if (!Array.isArray(data)) throw new TypeError("createMany expects an array of records.");
+			if (data.length === 0) return [];
+			if (!snap.createMany) throw new Error("Bulk writes are not supported by this collection's data source. Fall back to create() per record.");
+			return (await snap.createMany(data, options)).map(entityToRow);
+		},
 		async update(id, data) {
 			return entityToRow(await snap.update(id, data));
 		},
@@ -4006,35 +4586,84 @@ function getPrimaryKeys(collection, registry) {
 	}
 	return keys;
 }
-function parseIdValues(idValue, primaryKeys) {
-	const result = {};
-	if (primaryKeys.length === 0) return result;
-	if (primaryKeys.length === 1) {
-		const pk = primaryKeys[0];
-		if (pk.type === "number" && !pk.isUUID) {
-			const parsed = typeof idValue === "number" ? idValue : parseInt(String(idValue), 10);
-			if (isNaN(parsed)) throw new Error(`Invalid numeric ID: ${idValue}`);
-			result[pk.fieldName] = parsed;
-		} else result[pk.fieldName] = String(idValue);
-		return result;
-	}
-	const parts = String(idValue).split(":::");
-	if (parts.length !== primaryKeys.length) throw new Error(`Composite ID parts mismatch. Expected ${primaryKeys.length}, got ${parts.length} for ID: ${idValue}`);
-	for (let i = 0; i < primaryKeys.length; i++) {
-		const pk = primaryKeys[i];
-		const val = parts[i];
-		if (pk.type === "number" && !pk.isUUID) {
-			const parsed = parseInt(val, 10);
-			if (isNaN(parsed)) throw new Error(`Invalid numeric ID component: ${val}`);
-			result[pk.fieldName] = parsed;
-		} else result[pk.fieldName] = val;
+/**
+* Collections whose key the *browser* cannot resolve, and what it will do
+* instead.
+*
+* The two sides resolve keys from different evidence. This driver reads, in
+* order: properties marked `isId`, the primary keys of the Drizzle schema, then
+* a column literally named `id`. The admin shares the `CollectionConfig` — it
+* compiles the same collection files into its bundle — but never the Drizzle
+* schema, so the middle tier is invisible to it.
+*
+* Nothing can normalize this at runtime: the server does not serve the admin
+* its collections, so a key resolved here cannot be handed over there. The
+* config files are the only thing both sides read, so the fix is an edit to
+* them, and the most this can do is say exactly which edit.
+*
+* Two shapes, and the second is the dangerous one:
+*
+* - No `isId`, no `id` property → the admin resolves no address, warns in the
+*   console, and rows cannot be opened or linked.
+* - No `isId`, but an `id` property that is *not* the key → the admin addresses
+*   rows by `id` while this driver reads the address as the real key. Nothing
+*   errors: the addresses look right and route wrong.
+*/
+function findUnresolvableKeyCollections(collections, registry) {
+	const findings = [];
+	for (const collection of collections) {
+		if (getDeclaredPrimaryKeys(collection).length > 0) continue;
+		let keys;
+		try {
+			keys = getPrimaryKeys(collection, registry);
+		} catch {
+			continue;
+		}
+		if (keys.length === 0) continue;
+		if (keys.length === 1 && keys[0].fieldName === "id") continue;
+		findings.push({
+			collection,
+			keys,
+			shadowedByIdProperty: Boolean(collection.properties?.id)
+		});
 	}
-	return result;
+	return findings;
 }
-function buildCompositeId(values, primaryKeys) {
-	if (primaryKeys.length === 0) return "";
-	if (primaryKeys.length === 1) return String(values[primaryKeys[0].fieldName] ?? "");
-	return primaryKeys.map((pk) => String(values[pk.fieldName] ?? "")).join(":::");
+/**
+* Report the collections from {@link findUnresolvableKeyCollections} at boot,
+* with the edit that fixes each one.
+*
+* Grouped by failure, not by collection: the shadowed case is a routing bug and
+* the silent case is a missing feature, and they deserve different urgency.
+*/
+function warnOnKeysTheAdminCannotResolve(collections, registry) {
+	const findings = findUnresolvableKeyCollections(collections, registry);
+	if (findings.length === 0) return;
+	const edit = (f) => `${f.collection.slug}: mark ${f.keys.map((k) => `\`${k.fieldName}\``).join(" and ")} with \`isId: ${f.keys[0].isUUID ? "\"uuid\"" : f.keys[0].type === "number" ? "\"increment\"" : "true"}\``;
+	const shadowed = findings.filter((f) => f.shadowedByIdProperty);
+	const silent = findings.filter((f) => !f.shadowedByIdProperty);
+	if (shadowed.length > 0) logger.warn("⚠️ These collections declare no `isId`, and their key is only in the drizzle schema — but they do have a property called `id`. The admin has no way to know `id` is not the key, so it will address rows by it while this server reads the address as the real key: the links look right and route wrong. Nothing will error.\n\n" + shadowed.map((f) => `  • ${edit(f)}`).join("\n") + "\n");
+	if (silent.length > 0) logger.warn("⚠️ These collections declare no `isId`, and their key is only in the drizzle schema, which the admin never sees. It will resolve no address for their rows, so detail links, caching and relations will not work for them:\n\n" + silent.map((f) => `  • ${edit(f)}`).join("\n") + "\n");
+}
+/**
+* The address of a row: derived from the collection's primary keys, because a
+* row does not carry one — it is exactly its columns.
+*
+* Falls back to a literal `id` column, which covers the two cases where the
+* keys cannot be resolved: a row that reached us from somewhere other than the
+* postgres driver, and a collection whose table the registry cannot look up
+* (`getPrimaryKeys` throws for an unregistered table rather than returning
+* nothing). Returns `""` when there is no key and no `id` — callers decide what
+* that means, since "unaddressable" is a different answer in a notification
+* (broadcast a wildcard) than in a save (fail).
+*/
+function deriveRowAddress(row, collection, registry) {
+	try {
+		const composite = buildCompositeId(row, getPrimaryKeys(collection, registry));
+		if (composite && composite.split(":::").some((part) => part !== "")) return composite;
+	} catch {}
+	if (row.id !== void 0 && row.id !== null) return String(row.id);
+	return "";
 }
 //#endregion
 //#region src/utils/drizzle-conditions.ts
@@ -4657,12 +5286,10 @@ function serializeDataToServer(row, properties, collection, registry) {
 					continue;
 				} else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) {
 					const serializedValue = serializePropertyToServer(effectiveValue, property);
-					const pks = getPrimaryKeys(collection, registry);
 					inverseRelationUpdates.push({
 						relationKey: key,
 						relation,
-						newValue: serializedValue,
-						currentId: row.id || buildCompositeId(row, pks)
+						newValue: serializedValue
 					});
 					continue;
 				} else if (relation.direction === "inverse" && relation.joinPath && relation.joinPath.length > 0) {
@@ -4672,15 +5299,11 @@ function serializeDataToServer(row, properties, collection, registry) {
 						relation,
 						newTargetId: serializedValue
 					});
-					else {
-						const pks = getPrimaryKeys(collection, registry);
-						inverseRelationUpdates.push({
-							relationKey: key,
-							relation,
-							newValue: serializedValue,
-							currentId: row.id || buildCompositeId(row, pks)
-						});
-					}
+					else inverseRelationUpdates.push({
+						relationKey: key,
+						relation,
+						newValue: serializedValue
+					});
 					continue;
 				} else if (relation.cardinality === "one" && relation.direction === "owning" && relation.joinPath && relation.joinPath.length > 0) {
 					const serializedValue = serializePropertyToServer(effectiveValue, property);
@@ -5132,10 +5755,9 @@ var RelationService = class {
 			const rows = [];
 			for (const row of results) {
 				const targetRow = row[targetTableName] || row;
-				const id = targetRow[idInfo[0].fieldName];
 				const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
 				rows.push({
-					id: id?.toString() || "",
+					id: buildCompositeId(targetRow, idInfo),
 					path: targetCollection.slug,
 					values: parsedValues
 				});
@@ -5157,10 +5779,9 @@ var RelationService = class {
 		const rows = [];
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
-			const id = targetRow[idInfo[0].fieldName];
 			const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
 			rows.push({
-				id: id?.toString() || "",
+				id: buildCompositeId(targetRow, idInfo),
 				path: targetCollection.slug,
 				values: parsedValues
 			});
@@ -5200,7 +5821,8 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdInfo = getPrimaryKeys(targetCollection, this.registry)[0];
+		const targetPks = getPrimaryKeys(targetCollection, this.registry);
+		const targetIdInfo = targetPks[0];
 		const targetIdField = targetTable[targetIdInfo.fieldName];
 		const parentPks = getPrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
@@ -5237,7 +5859,7 @@ var RelationService = class {
 				const parentId = parentRow[parentIdInfo.fieldName];
 				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
 				resultMap.set(String(parentId), {
-					id: String(targetRow[targetIdInfo.fieldName]),
+					id: buildCompositeId(targetRow, targetPks),
 					path: targetCollection.slug,
 					values: parsedValues
 				});
@@ -5276,7 +5898,7 @@ var RelationService = class {
 				if (targetRow) {
 					const parsedValues = await parseDataFromServer(targetRow, targetCollection);
 					resultMap.set(parentIdStr, {
-						id: String(targetRow[targetIdInfo.fieldName]),
+						id: buildCompositeId(targetRow, targetPks),
 						path: targetCollection.slug,
 						values: parsedValues
 					});
@@ -5297,7 +5919,7 @@ var RelationService = class {
 			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
 				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
 				resultMap.set(String(parentId), {
-					id: String(targetRow[targetIdInfo.fieldName]),
+					id: buildCompositeId(targetRow, targetPks),
 					path: targetCollection.slug,
 					values: parsedValues
 				});
@@ -5315,8 +5937,8 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdInfo = getPrimaryKeys(targetCollection, this.registry)[0];
-		const targetIdField = targetTable[targetIdInfo.fieldName];
+		const targetPks = getPrimaryKeys(targetCollection, this.registry);
+		const targetIdField = targetTable[targetPks[0].fieldName];
 		const parentPks = getPrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
@@ -5351,7 +5973,7 @@ var RelationService = class {
 				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
 				const arr = resultMap.get(parentId) || [];
 				arr.push({
-					id: String(targetRow[targetIdInfo.fieldName]),
+					id: buildCompositeId(targetRow, targetPks),
 					path: targetCollection.slug,
 					values: parsedValues
 				});
@@ -5381,7 +6003,7 @@ var RelationService = class {
 				const parsedValues = await parseDataFromServer(targetData, targetCollection);
 				const arr = resultMap.get(parentId) || [];
 				arr.push({
-					id: String(targetData[targetIdInfo.fieldName]),
+					id: buildCompositeId(targetData, targetPks),
 					path: targetCollection.slug,
 					values: parsedValues
 				});
@@ -5405,7 +6027,7 @@ var RelationService = class {
 				const key = String(parentId);
 				const arr = resultMap.get(key) || [];
 				arr.push({
-					id: String(targetRow[targetIdInfo.fieldName]),
+					id: buildCompositeId(targetRow, targetPks),
 					path: targetCollection.slug,
 					values: parsedValues
 				});
@@ -5853,14 +6475,32 @@ var FetchService = class {
 		return null;
 	}
 	/**
+	* The address a relation ref points at.
+	*
+	* The whole key, not its first column: a composite-keyed target addressed
+	* by `tenant_id` alone points at every row that shares it. And a target
+	* whose key cannot be resolved at all used to throw here — reading
+	* `targetPks[0]` of an empty array — taking down the parent's fetch over a
+	* relation it may not even have asked for; the first column is a guess, but
+	* a ref that resolves to nothing beats no rows at all.
+	*/
+	relationTargetAddress(targetRow, targetCollection) {
+		const address = deriveRowAddress(targetRow, targetCollection, this.registry);
+		if (address) return address;
+		const firstColumn = targetRow[Object.keys(targetRow)[0]];
+		return String(firstColumn ?? "");
+	}
+	/**
 	* Convert a db.query result row (with nested relation objects) to a flat row.
 	* Handles:
-	* - Placing `id` at the top level as a string
 	* - Type normalization (dates, numbers, NaN) via normalizeDbValues
 	* - Converting nested relation objects to { id, path, __type: "relation" } for CMS
 	* - Flattening junction-table many-to-many results
+	*
+	* The row's own address is not among them: it is derived by the consumer
+	* from the collection's primary keys.
 	*/
-	drizzleResultToRow(row, collection, _collectionPath, idInfo, _databaseId, idInfoArray) {
+	drizzleResultToRow(row, collection) {
 		const resolvedRelations = resolveCollectionRelations(collection);
 		const normalizedValues = normalizeDbValues(row, collection);
 		for (const [key, relation] of Object.entries(resolvedRelations)) {
@@ -5869,14 +6509,13 @@ var FetchService = class {
 			if (relation.cardinality === "many" && Array.isArray(relData)) {
 				const targetCollection = relation.target();
 				const targetPath = targetCollection.slug;
-				const targetIdField = getPrimaryKeys(targetCollection, this.registry)[0].fieldName;
 				normalizedValues[key] = relData.map((item) => {
 					let targetRow = item;
 					if (this.isJunctionRelation(relation, collection)) {
 						const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
 						if (nestedKey) targetRow = item[nestedKey];
 					}
-					const relId = String(targetRow[targetIdField] ?? targetRow.id ?? targetRow[Object.keys(targetRow)[0]]);
+					const relId = this.relationTargetAddress(targetRow, targetCollection);
 					return createRelationRefWithData(relId, targetPath, {
 						id: relId,
 						path: targetPath,
@@ -5886,9 +6525,8 @@ var FetchService = class {
 			} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) {
 				const targetCollection = relation.target();
 				const targetPath = targetCollection.slug;
-				const targetIdField = getPrimaryKeys(targetCollection, this.registry)[0].fieldName;
 				const relObj = relData;
-				const relId = String(relObj[targetIdField] ?? relObj.id ?? relObj[Object.keys(relObj)[0]]);
+				const relId = this.relationTargetAddress(relObj, targetCollection);
 				normalizedValues[key] = createRelationRefWithData(relId, targetPath, {
 					id: relId,
 					path: targetPath,
@@ -5896,10 +6534,7 @@ var FetchService = class {
 				});
 			}
 		}
-		return {
-			...normalizedValues,
-			id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
-		};
+		return normalizedValues;
 	}
 	/**
 	* Post-fetch joinPath relations for a single flat row.
@@ -5922,31 +6557,6 @@ var FetchService = class {
 		await Promise.all(promises);
 	}
 	/**
-	* Post-fetch joinPath relations for a batch of flat rows.
-	* Uses batch fetching to avoid N+1 queries for list views.
-	*/
-	async resolveJoinPathRelationsBatch(rows, collection, collectionPath, idInfo, _databaseId) {
-		if (rows.length === 0) return;
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0);
-		if (joinPathRelations.length === 0) return;
-		for (const [key, relation] of joinPathRelations) try {
-			const rowIds = rows.map((r) => {
-				return parseIdValues(String(r.id), [idInfo])[idInfo.fieldName];
-			});
-			const resultMap = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation);
-			for (const row of rows) {
-				const id = parseIdValues(String(row.id), [idInfo])[idInfo.fieldName];
-				const relatedRow = resultMap.get(String(id));
-				if (relatedRow) {
-					if (relation.cardinality === "one") row[key] = createRelationRefWithData(relatedRow.id, relatedRow.path, relatedRow);
-				}
-			}
-		} catch (e) {
-			logger.warn(`Could not batch resolve joinPath relation '${key}'`, { error: e });
-		}
-	}
-	/**
 	* Resolves joinPath relations for raw REST rows and directly injects them.
 	* Uses RelationService to query the database and maps results back to the flattened objects.
 	*/
@@ -5958,67 +6568,48 @@ var FetchService = class {
 		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0 && propertyKeys.has(key) && shouldInclude(key));
 		if (joinPathRelations.length === 0) return;
 		const idInfo = idInfoArray[0];
+		const parentIdOf = (row) => row[idInfo.fieldName];
 		for (const [key, relation] of joinPathRelations) try {
-			const rowIds = rows.map((r) => {
-				return parseIdValues(String(r.id), idInfoArray)[idInfo.fieldName];
-			});
+			const addressable = rows.filter((r) => parentIdOf(r) !== void 0 && parentIdOf(r) !== null);
+			if (addressable.length === 0) continue;
+			const rowIds = addressable.map((r) => parentIdOf(r));
 			if (relation.cardinality === "one") {
 				const resultMap = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation);
-				for (const row of rows) {
-					const id = parseIdValues(String(row.id), idInfoArray)[idInfo.fieldName];
-					const relatedRow = resultMap.get(String(id));
-					if (relatedRow) row[key] = {
-						...relatedRow.values,
-						id: relatedRow.id
-					};
-					else row[key] = null;
+				for (const row of addressable) {
+					const relatedRow = resultMap.get(String(parentIdOf(row)));
+					row[key] = relatedRow ? { ...relatedRow.values } : null;
 				}
 			} else if (relation.cardinality === "many") {
 				const resultMap = await this.relationService.batchFetchRelatedEntitiesMany(collectionPath, rowIds, key, relation);
-				for (const row of rows) {
-					const id = parseIdValues(String(row.id), idInfoArray)[idInfo.fieldName];
-					row[key] = (resultMap.get(String(id)) || []).map((e) => ({
-						...e.values,
-						id: e.id
-					}));
-				}
+				for (const row of addressable) row[key] = (resultMap.get(String(parentIdOf(row))) || []).map((e) => ({ ...e.values }));
 			}
 		} catch (e) {
 			logger.warn(`Could not batch resolve joinPath relation '${key}' for REST`, { error: e });
 		}
 	}
 	/**
-	* Convert a db.query result row to a flat REST-style object with populated relations.
+	* Convert a db.query result row to a flat REST-style row with populated relations.
+	*
+	* Every column is copied through under its own name, with the value Postgres
+	* returned. This used to open with a synthesized `id` and then skip the key
+	* column, which renamed it (a `sku` primary key was served as `id`, and `sku`
+	* did not appear at all) and restringified it (`42` → `"42"`). Consumers that
+	* need an address derive it from the collection's primary keys.
 	*/
-	drizzleResultToRestRow(row, collection, idInfo, idInfoArray) {
-		const flat = { id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName]) };
+	drizzleResultToRestRow(row, collection) {
+		const flat = {};
 		const resolvedRelations = resolveCollectionRelations(collection);
 		for (const [k, v] of Object.entries(row)) {
-			if (k === idInfo.fieldName) continue;
 			const relation = findRelation(resolvedRelations, k);
 			if (Array.isArray(v) && relation) flat[k] = v.map((item) => {
 				if (this.isJunctionRelation(relation, collection)) {
 					const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-					if (nestedKey) {
-						const nested = item[nestedKey];
-						return {
-							...nested,
-							id: String(nested.id ?? nested[Object.keys(nested)[0]])
-						};
-					}
+					if (nestedKey) return { ...item[nestedKey] };
 				}
-				return {
-					...item,
-					id: String(item.id ?? item[Object.keys(item)[0]])
-				};
+				return { ...item };
 			});
-			else if (typeof v === "object" && v !== null && !Array.isArray(v) && relation) {
-				const relObj = v;
-				flat[k] = {
-					...relObj,
-					id: String(relObj.id ?? relObj[Object.keys(relObj)[0]])
-				};
-			} else flat[k] = v;
+			else if (typeof v === "object" && v !== null && !Array.isArray(v) && relation) flat[k] = { ...v };
+			else flat[k] = v;
 		}
 		return flat;
 	}
@@ -6106,7 +6697,7 @@ var FetchService = class {
 				with: withConfig
 			});
 			if (!row) return void 0;
-			const flatRow = this.drizzleResultToRow(row, collection, collectionPath, idInfo, databaseId, idInfoArray);
+			const flatRow = this.drizzleResultToRow(row, collection);
 			await this.resolveJoinPathRelations(flatRow, collection, collectionPath, parsedId, databaseId);
 			return flatRow;
 		} catch (e) {
@@ -6158,7 +6749,7 @@ var FetchService = class {
 		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
 		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0);
-			return (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRow(row, collection, collectionPath, idInfo, options.databaseId, idInfoArray));
+			return (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRow(row, collection));
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
 				logger.error(`[FetchService] Relation inference error for collection '${collectionPath}': ${e.message}`);
@@ -6229,8 +6820,7 @@ var FetchService = class {
 		const parsedRows = await Promise.all(results.map(async (rawRow) => {
 			return {
 				rawRow,
-				values: await parseDataFromServer(rawRow, collection),
-				id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(rawRow, idInfoArray) : String(rawRow[idInfo.fieldName])
+				values: await parseDataFromServer(rawRow, collection)
 			};
 		}));
 		if (!skipRelations) {
@@ -6270,10 +6860,7 @@ var FetchService = class {
 				logger.warn(`Could not batch load many relation property: ${key}`, { error: e });
 			}
 		}
-		return parsedRows.map((item) => ({
-			...item.values,
-			id: item.id
-		}));
+		return parsedRows.map((item) => item.values);
 	}
 	/**
 	* Fetch a collection of rows
@@ -6304,10 +6891,7 @@ var FetchService = class {
 			const relationKey = pathSegments[i];
 			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
 			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
-			if (i === pathSegments.length - 1) return (await this.relationService.fetchRelatedEntities(currentCollection.slug, currentId, relationKey, options)).map((row) => ({
-				...row.values,
-				id: row.id
-			}));
+			if (i === pathSegments.length - 1) return (await this.relationService.fetchRelatedEntities(currentCollection.slug, currentId, relationKey, options)).map((row) => ({ ...row.values }));
 			if (i + 1 < pathSegments.length) {
 				const nextEntityId = pathSegments[i + 1];
 				currentCollection = relation.target();
@@ -6404,7 +6988,7 @@ var FetchService = class {
 		if (qb && !options.searchString && !options.vectorSearch) try {
 			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig);
-			const restRows = (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRestRow(row, collection, idInfo, idInfoArray));
+			const restRows = (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRestRow(row, collection));
 			await this.resolveJoinPathRelationsBatchRest(restRows, collection, collectionPath, idInfoArray, include);
 			return restRows;
 		} catch (e) {
@@ -6415,10 +6999,7 @@ var FetchService = class {
 			logger.warn(`[fetchCollectionForRest] db.query.findMany failed for ${collectionPath}, falling back`, { error: e });
 		}
 		const rows = await this.fetchRowsWithConditionsRaw(collectionPath, options);
-		if (!include || include.length === 0) return rows.map((row) => ({
-			...row,
-			id: idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
-		}));
+		if (!include || include.length === 0) return rows;
 		const resolvedRelations = resolveCollectionRelations(collection);
 		const propertyKeys = new Set(Object.keys(collection.properties || {}));
 		const shouldInclude = (key) => include[0] === "*" || include.includes(key);
@@ -6430,10 +7011,7 @@ var FetchService = class {
 				for (const row of rows) {
 					const eid = row[idInfo.fieldName];
 					const related = batchResults.get(String(eid));
-					if (related) row[key] = {
-						...related.values,
-						id: related.id
-					};
+					if (related) row[key] = { ...related.values };
 				}
 			} catch (e) {
 				logger.warn(`[include] Failed to batch load one-to-one '${key}'`, { error: e });
@@ -6451,10 +7029,7 @@ var FetchService = class {
 				logger.warn(`[include] Failed to batch load many '${key}'`, { error: e });
 			}
 		}
-		return rows.map((row) => ({
-			...row,
-			id: idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
-		}));
+		return rows;
 	}
 	/**
 	* Fetch a single row with optional relation includes for REST API.
@@ -6475,7 +7050,7 @@ var FetchService = class {
 				...withConfig ? { with: withConfig } : {}
 			});
 			if (!row) return null;
-			const restRow = this.drizzleResultToRestRow(row, collection, idInfo, idInfoArray);
+			const restRow = this.drizzleResultToRestRow(row, collection);
 			await this.resolveJoinPathRelationsBatchRest([restRow], collection, collectionPath, idInfoArray, include);
 			return restRow;
 		} catch (e) {
@@ -6487,11 +7062,7 @@ var FetchService = class {
 		}
 		const result = await this.db.select().from(table).where(eq(idField, parsedId)).limit(1);
 		if (result.length === 0) return null;
-		const raw = result[0];
-		const flatEntity = {
-			...raw,
-			id: idInfoArray.length > 1 ? buildCompositeId(raw, idInfoArray) : String(raw[idInfo.fieldName])
-		};
+		const flatEntity = { ...result[0] };
 		if (!include || include.length === 0) return flatEntity;
 		const resolvedRelations = resolveCollectionRelations(collection);
 		const propertyKeys = new Set(Object.keys(collection.properties || {}));
@@ -6603,32 +7174,15 @@ var FetchService = class {
 				if (orderByField) queryOpts.orderBy = options.order === "asc" ? asc(orderByField) : desc(orderByField);
 			}
 			return (await queryTarget.findMany(queryOpts)).map((row) => {
-				const flat = { id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName]) };
-				for (const [k, v] of Object.entries(row)) {
-					if (k === idInfo.fieldName) continue;
-					if (Array.isArray(v)) flat[k] = v.map((item) => {
-						const keys = Object.keys(item);
-						const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-						if (nestedObj && keys.length <= 3) {
-							const nested = item[nestedObj];
-							return {
-								...nested,
-								id: String(nested.id ?? nested[Object.keys(nested)[0]])
-							};
-						}
-						return {
-							...item,
-							id: String(item.id ?? item[Object.keys(item)[0]])
-						};
-					});
-					else if (typeof v === "object" && v !== null) {
-						const relObj = v;
-						flat[k] = {
-							...relObj,
-							id: String(relObj.id ?? relObj[Object.keys(relObj)[0]])
-						};
-					} else flat[k] = v;
-				}
+				const flat = {};
+				for (const [k, v] of Object.entries(row)) if (Array.isArray(v)) flat[k] = v.map((item) => {
+					const keys = Object.keys(item);
+					const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
+					if (nestedObj && keys.length <= 3) return { ...item[nestedObj] };
+					return { ...item };
+				});
+				else if (typeof v === "object" && v !== null) flat[k] = { ...v };
+				else flat[k] = v;
 				return flat;
 			});
 		} catch (e) {
@@ -6889,8 +7443,14 @@ var PersistService = class {
 	}
 	/**
 	* Save an row (create or update)
+	*
+	* With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
+	* UPDATE against the primary key rather than a plain UPDATE. That is one
+	* statement, so it cannot lose a race the way a read-then-write can, and it
+	* does not care whether the row already exists — which is what a re-runnable
+	* import needs.
 	*/
-	async save(collectionPath, values, id, databaseId) {
+	async save(collectionPath, values, id, databaseId, options) {
 		let effectiveCollectionPath = collectionPath;
 		const effectiveValues = { ...values };
 		let junctionTableInfo;
@@ -6981,7 +7541,7 @@ var PersistService = class {
 			const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
 			savedId = await this.db.transaction(async (tx) => {
 				let currentId;
-				if (id) {
+				if (id && !options?.upsert) {
 					currentId = id;
 					const idValues = parseIdValues(id, idInfoArray);
 					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
@@ -6996,9 +7556,24 @@ var PersistService = class {
 					}
 				} else {
 					const dataForInsert = { ...entityData };
+					if (id && options?.upsert) Object.assign(dataForInsert, parseIdValues(id, idInfoArray));
 					for (const info of idInfoArray) if (dataForInsert[info.fieldName] === "" || dataForInsert[info.fieldName] === null || dataForInsert[info.fieldName] === void 0) delete dataForInsert[info.fieldName];
-					const resultRow = (await tx.insert(table).values(dataForInsert).returning(returningKeys))[0];
-					currentId = buildCompositeId(resultRow, idInfoArray);
+					const insertQuery = tx.insert(table).values(dataForInsert);
+					const hasFullKey = idInfoArray.length > 0 && idInfoArray.every((info) => dataForInsert[info.fieldName] !== void 0);
+					let result;
+					if (options?.upsert && hasFullKey) {
+						const target = idInfoArray.map((info) => table[info.fieldName]);
+						const set = { ...dataForInsert };
+						for (const info of idInfoArray) delete set[info.fieldName];
+						result = Object.keys(set).length > 0 ? await insertQuery.onConflictDoUpdate({
+							target,
+							set
+						}).returning(returningKeys) : await insertQuery.onConflictDoNothing({ target }).returning(returningKeys);
+					} else result = await insertQuery.returning(returningKeys);
+					const resultRow = result[0];
+					if (!resultRow) if (id) currentId = id;
+					else throw ApiError.forbidden(`Not allowed to write to "${effectiveCollectionPath}": the row was rejected by a row-level security policy.`, "WRITE_DENIED");
+					else currentId = buildCompositeId(resultRow, idInfoArray);
 					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
 				}
 				if (inverseRelationUpdates.length > 0) await this.relationService.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
@@ -7107,8 +7682,8 @@ var DataService = class {
 	/**
 	* Save an row (create or update)
 	*/
-	async save(collectionPath, values, id, databaseId) {
-		return this.persistService.save(collectionPath, values, id, databaseId);
+	async save(collectionPath, values, id, databaseId, options) {
+		return this.persistService.save(collectionPath, values, id, databaseId, options);
 	}
 	/**
 	* Delete an row by ID
@@ -7176,6 +7751,26 @@ var DataService = class {
 */
 /** Internal prefix applied to branch database names to avoid collisions. */
 var BRANCH_DB_PREFIX = "rb_";
+/** `duplicate_database` — the target database name is already taken. */
+var PG_DUPLICATE_DATABASE = "42P04";
+/** `object_in_use` — the database still has connections attached. */
+var PG_OBJECT_IN_USE = "55006";
+/**
+* Describe a failed branch DDL statement in terms a user can act on.
+*
+* Drizzle reports failures as `Failed query: <sql> params:` and hides the real
+* PostgreSQL error in the `cause` chain, so matching on `err.message` never sees
+* the actual problem. Match on the PG error code instead — it survives wrapping
+* and, unlike the message text, is not locale-dependent.
+*/
+function describeBranchDdlError(err, fallbackContext) {
+	const pgError = extractPgError(err);
+	if (pgError?.code === PG_DUPLICATE_DATABASE) return /* @__PURE__ */ new Error(`Database "${fallbackContext}" already exists on the server. Choose a different branch name.`);
+	if (pgError?.code === PG_OBJECT_IN_USE) return /* @__PURE__ */ new Error(`Cannot complete the operation: the database "${fallbackContext}" has active connections. Close other clients or connections and try again.`);
+	const detail = pgError?.message ?? extractCauseMessage(err);
+	if (detail) return new Error(detail);
+	return err instanceof Error ? err : new Error(String(err));
+}
 /** Fully-qualified metadata table in the rebase schema. */
 var BRANCHES_TABLE = "rebase.branches";
 /**
@@ -7244,10 +7839,8 @@ var BranchService = class {
 		try {
 			await this.db.execute(sql.raw(`CREATE DATABASE "${safeDbName}" TEMPLATE "${safeSourceDb}"`));
 		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			if (msg.includes("already exists")) throw new Error(`Database "${dbName}" already exists on the server. Choose a different branch name.`);
-			if (msg.includes("being accessed by other users")) throw new Error(`Cannot create branch: the source database "${sourceDb}" has active connections. Close other clients or connections and try again.`);
-			throw err;
+			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot create branch: the source database "${sourceDb}" has active connections. Close other clients or connections and try again.`);
+			throw describeBranchDdlError(err, dbName);
 		}
 		const now = /* @__PURE__ */ new Date();
 		await this.db.execute(sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at) 
@@ -7272,8 +7865,8 @@ var BranchService = class {
 		try {
 			await this.db.execute(sql.raw(`DROP DATABASE "${safeDbName}"`));
 		} catch (err) {
-			if ((err instanceof Error ? err.message : String(err)).includes("being accessed by other users")) throw new Error(`Cannot delete branch "${sanitizedName}": the database has active connections. Close other clients and try again.`);
-			throw err;
+			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot delete branch "${sanitizedName}": the database has active connections. Close other clients and try again.`);
+			throw describeBranchDdlError(err, dbName);
 		}
 		await this.db.execute(sql`DELETE FROM rebase.branches WHERE name = ${sanitizedName}`);
 	}
@@ -7905,7 +8498,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			this.realtimeService.subscriptions.delete(subscriptionId);
 		};
 	}
-	async save({ path, id, values, collection, status }) {
+	async save({ path, id, values, collection, status, upsert }) {
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
@@ -7962,7 +8555,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			timestampNowValue: /* @__PURE__ */ new Date()
 		});
 		try {
-			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId);
+			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, { upsert });
 			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
 				if (globalCallbacks?.afterRead) savedRow = await globalCallbacks.afterRead({
 					collection: resolvedCollection,
@@ -7983,8 +8576,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 					context: contextForCallback
 				});
 			}
-			const savedId = savedRow.id;
-			const { id: _savedId, ...savedValues } = savedRow;
+			const savedId = deriveRowAddress(savedRow, resolvedCollection ?? collection, this.registry);
+			const savedValues = savedRow;
 			if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
 				if (globalCallbacks?.afterSave) await globalCallbacks.afterSave({
 					collection: resolvedCollection,
@@ -8016,7 +8609,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			}
 			if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
 				tableName: path,
-				id: savedId.toString(),
+				id: savedId,
 				action: status === "new" ? "create" : "update",
 				values: savedValues,
 				previousValues: previousValuesForHistory,
@@ -8024,11 +8617,11 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			});
 			if (this._deferNotifications) this._pendingNotifications.push({
 				path,
-				id: savedId.toString(),
+				id: savedId,
 				row: savedRow,
 				databaseId: resolvedCollection?.databaseId
 			});
-			else await this.realtimeService.notifyUpdate(path, savedId.toString(), savedRow, resolvedCollection?.databaseId);
+			else await this.realtimeService.notifyUpdate(path, savedId, savedRow, resolvedCollection?.databaseId);
 			return savedRow;
 		} catch (error) {
 			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
@@ -8063,12 +8656,52 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			throw error;
 		}
 	}
+	/**
+	* Write many rows through the same pipeline as {@link save}.
+	*
+	* The batch runs in one transaction of its own, so a failure part-way leaves
+	* nothing behind — the point of a batch is that a re-run starts from a known
+	* state. When this driver is already inside a transaction (the authenticated
+	* path, via `withTransaction`) the nested call becomes a savepoint, which is
+	* still atomic and still commits once.
+	*
+	* Rows are applied in order, so a batch that touches the same key twice ends
+	* with the last write winning, exactly as separate calls would.
+	*/
+	async saveMany({ path, rows, collection, upsert }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < rows.length; i++) {
+				const values = rows[i];
+				const id = values?.id;
+				try {
+					saved.push(await txDriver.save({
+						path,
+						values,
+						collection,
+						status: "new",
+						upsert
+					}));
+				} catch (error) {
+					const label = id !== void 0 ? `id ${JSON.stringify(id)}` : "no id";
+					throw Object.assign(new Error(`Row ${i} of ${rows.length} (${label}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return saved;
+		});
+	}
 	async delete({ row, collection }) {
 		const targetPath = row.path;
-		const targetRow = {
-			id: row.id,
-			...row.values ?? {}
-		};
+		const targetRow = { ...row.values ?? {} };
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, targetPath);
 		const contextForCallback = this.buildCallContext();
 		if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
@@ -8427,6 +9060,18 @@ var AuthenticatedPostgresBackendDriver = class {
 	async save(props) {
 		return this.withTransaction((delegate) => delegate.save(props));
 	}
+	/**
+	* One transaction for the whole batch, rather than one per row.
+	*
+	* This is the point of the method: `save` opens a transaction per call, so
+	* importing 10k rows through it means 10k transactions (and, over HTTP, 10k
+	* round trips). Here the RLS context is established once and every row lands
+	* or none does. Realtime notifications are already deferred to commit by
+	* `withTransaction`, so a batch does not flood subscribers mid-flight.
+	*/
+	async saveMany(props) {
+		return this.withTransaction((delegate) => delegate.saveMany(props));
+	}
 	async delete(props) {
 		return this.withTransaction((delegate) => delegate.delete(props));
 	}
@@ -8673,105 +9318,6 @@ var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user:
 	references: [users.id]
 }) }));
 //#endregion
-//#region src/schema/auth-default-policies.ts
-/**
-* Default RLS policies injected by the schema generator.
-*
-* Rebase's enforcement model is unified: authenticated (user-context) requests
-* run under the restricted `rebase_user` role, so Postgres RLS binds *every*
-* statement — reads and writes. A collection's `securityRules` are the whole
-* authorization model. The server context (auth flows, migrations,
-* `dataAsAdmin`) runs as the owner and bypasses RLS.
-*
-* Because RLS default-denies, every collection is **locked by default**: with
-* no rules, only the server context and admins can touch it. The generator
-* injects that safe baseline:
-*
-* **For every collection**
-*  1. A permissive **server-or-admin SELECT** grant.
-*  2. A permissive **server-or-admin write** grant (insert/update/delete).
-*
-* Author `securityRules` are permissive and OR together, so explicit rules only
-* *broaden* access from this locked baseline (e.g. "users read/write their own
-* rows").
-*
-* **For auth collections additionally**
-*  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
-*     their own row (profile, session bootstrap) without every app re-declaring
-*     it.
-*  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
-*     every other policy, so a write is rejected unless the caller is an admin
-*     (or the server context) — even if the author also wrote a permissive rule
-*     such as "a user may edit their own row". Without this, a permissive owner
-*     rule would let a user change their own `roles`.
-*
-* The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
-* — the built-in flows that run without a user (signup, migrations) set no user
-* GUC — which also lets the owner connection satisfy these policies even under
-* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
-* `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
-*
-* Opt out with `disableDefaultPolicies: true` to take full responsibility for
-* the collection's RLS.
-*/
-var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
-/** Write operations that must be admin-gated by default on auth collections. */
-var DEFAULT_GUARDED_OPS = [
-	"insert",
-	"update",
-	"delete"
-];
-/** Whether a collection is flagged as an authentication collection. */
-function isAuthCollection(collection) {
-	const auth = collection.auth;
-	return auth === true || typeof auth === "object" && auth?.enabled === true;
-}
-/** The property marked as the row id (falls back to `id`). */
-function getIdPropertyName(collection) {
-	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
-	return "id";
-}
-/**
-* Returns the security rules that should be applied to a collection: the
-* author's explicit `securityRules` plus the framework defaults described in
-* the module doc (baseline server/admin read for all collections; self-read
-* and the admin write gate for auth collections).
-*
-* Collections that opt out via `disableDefaultPolicies` are returned unchanged.
-*/
-function getEffectiveSecurityRules(collection) {
-	const explicit = [...(isPostgresCollectionConfig(collection) ? collection.securityRules : void 0) ?? []];
-	if (collection.disableDefaultPolicies) return explicit;
-	const tableName = getTableName$1(collection);
-	const injected = [];
-	injected.push({
-		name: `${tableName}_default_admin_read`,
-		operations: ["select"],
-		condition: SERVER_OR_ADMIN_EXPR
-	});
-	injected.push({
-		name: `${tableName}_default_admin_write`,
-		operations: [...DEFAULT_GUARDED_OPS],
-		condition: SERVER_OR_ADMIN_EXPR,
-		check: SERVER_OR_ADMIN_EXPR
-	});
-	if (isAuthCollection(collection)) {
-		injected.push({
-			name: `${tableName}_default_self_read`,
-			operations: ["select"],
-			condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
-		});
-		injected.push({
-			name: `${tableName}_require_admin_write`,
-			mode: "restrictive",
-			operations: [...DEFAULT_GUARDED_OPS],
-			condition: SERVER_OR_ADMIN_EXPR,
-			check: SERVER_OR_ADMIN_EXPR
-		});
-	}
-	return [...explicit, ...injected];
-}
-//#endregion
 //#region src/schema/generate-drizzle-schema-logic.ts
 /**
 * Resolve the SQL column name for a property.
@@ -8969,31 +9515,12 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 * Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
 */
 var wrapSql = (clause) => `sql\`${clause}\``;
-/**
-* Generates a deterministic hash based on the rule configuration.
-*/
-var getPolicyNameHash = (rule) => {
-	const data = JSON.stringify({
-		a: rule.access,
-		m: rule.mode,
-		op: rule.operation,
-		ops: rule.operations?.slice().sort(),
-		own: rule.ownerField,
-		rol: rule.roles?.slice().sort(),
-		pg: rule.pgRoles?.slice().sort(),
-		u: rule.using,
-		w: rule.withCheck,
-		c: rule.condition,
-		ch: rule.check
-	});
-	return createHash("sha1").update(data).digest("hex").substring(0, 7);
-};
 var generatePolicyCode = (collection, rule, index, resolveCollection) => {
 	const tableName = getTableName$1(collection);
 	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
-	const ruleHash = getPolicyNameHash(rule);
+	const policyNames = getPolicyNamesForRule(rule, tableName);
 	return ops.map((op, opIdx) => {
-		return generateSinglePolicyCode(collection, rule, op, rule.name ? ops.length > 1 ? `${rule.name}_${op}` : rule.name : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`, resolveCollection);
+		return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
 	}).join("");
 };
 /**
@@ -9122,6 +9649,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 		});
 	});
 	schemaContent += "\n";
+	const junctionSpecs = resolveJunctionSpecs(collections);
 	for (const collection of collections) {
 		const tableName = getTableName$1(collection);
 		if (tableName) allTablesToGenerate.set(tableName, { collection });
@@ -9155,9 +9683,17 @@ var generateSchema = async (collections, stripPolicies = false) => {
 			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
 			schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
 			schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(targetCollection))}.${targetId}, ${refOptions}),\n`;
-			schemaContent += "}, (table) => ({\n";
-			schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
-			schemaContent += "}));\n\n";
+			schemaContent += "}, (table) => ([\n";
+			schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
+			const junctionSpec = junctionSpecs.get(baseTableName);
+			if (!stripPolicies && junctionSpec) {
+				const junctionCollection = getJunctionCollectionConfig(junctionSpec);
+				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
+				getJunctionSecurityRules(junctionSpec).forEach((rule, idx) => {
+					schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
+				});
+			}
+			schemaContent += "])).enableRLS();\n\n";
 		} else if (!isJunction) {
 			const schema = isPostgresCollectionConfig(collection) ? collection.schema : void 0;
 			const tableCreator = schema ? `${schema}Schema.table` : "pgTable";
@@ -9848,7 +10384,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				startAfter: request.startAfter,
 				searchString: request.searchString
 			}, authContext);
-			this.sendCollectionUpdate(clientId, subscriptionId, rows);
+			this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
 			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -9949,7 +10485,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			if (subscription.type === "single" && notifyPath === originalPath) if (row && row?._rebase_invalidated) this.debouncedSingleRefetch(subscriptionId, notifyPath, id, subscription);
 			else this.sendSingleUpdate(subscription.clientId, subscriptionId, row);
 			else if (subscription.type === "collection" && subscription.collectionRequest) {
-				if (!row || !row?._rebase_invalidated) this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row);
+				if (!row || !row?._rebase_invalidated) this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row, notifyPath);
 				this.debouncedCollectionRefetch(subscriptionId, notifyPath, subscription);
 			}
 		} catch (error) {
@@ -9979,7 +10515,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			if (!this._subscriptions.has(subscriptionId)) return;
 			try {
 				const rows = await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest, subscription.authContext);
-				this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows);
+				this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath);
 			} catch (error) {
 				const sanitized = sanitizeErrorForClient(error, notifyPath);
 				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -10193,11 +10729,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		return await this.dataService.fetchOne(notifyPath, id);
 	}
-	sendCollectionUpdate(clientId, subscriptionId, rows) {
+	sendCollectionUpdate(clientId, subscriptionId, rows, path) {
 		const message = {
 			type: "collection_update",
 			subscriptionId,
-			rows
+			rows,
+			pks: this.primaryKeysForPath(path)
 		};
 		this.sendMessage(clientId, message);
 	}
@@ -10212,16 +10749,33 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	/**
 	* Send a lightweight row-level patch to a collection subscriber.
 	* The client can merge this into its cached data for instant feedback.
+	*
+	* The key columns ride along: the patch names a row by address, and the
+	* client has to find that row among the ones it cached — which carry
+	* columns and no address. The SDK holds no collection config to derive one
+	* from, so this is the only place the mapping can come from.
 	*/
-	sendCollectionPatch(clientId, subscriptionId, id, row) {
+	sendCollectionPatch(clientId, subscriptionId, id, row, notifyPath) {
 		const message = {
 			type: "collection_patch",
 			subscriptionId,
 			id,
-			row
+			row,
+			pks: this.primaryKeysForPath(notifyPath)
 		};
 		this.sendMessage(clientId, message);
 	}
+	/** The key columns of the collection at `path`, if they can be resolved. */
+	primaryKeysForPath(path) {
+		try {
+			const collection = this.registry.getCollectionByPath(path);
+			if (!collection) return void 0;
+			const keys = getPrimaryKeys(collection, this.registry);
+			return keys.length > 0 ? keys : void 0;
+		} catch {
+			return;
+		}
+	}
 	sendError(clientId, error, subscriptionId, code) {
 		const message = {
 			type: "error",
@@ -10469,12 +11023,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	}
 	/** Compute the canonical (possibly composite) id string from a captured row. */
 	extractIdFromCdcRow(collection, row) {
-		try {
-			const composite = buildCompositeId(row, getPrimaryKeys(collection, this.registry));
-			if (composite && composite !== ":::") return composite;
-		} catch {}
-		if (row.id !== void 0 && row.id !== null) return String(row.id);
-		return "*";
+		return deriveRowAddress(row, collection, this.registry) || "*";
 	}
 	dedupKey(path, id, databaseId) {
 		return `${databaseId ?? ""}::${path}::${id}`;
@@ -11090,7 +11639,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 			} catch (error) {
 				logger.error("💥 [WebSocket Server] Error handling message", { error });
 				if (error instanceof Error) logger.error("Stack trace", { detail: error.stack });
-				const errorMessage = process.env.NODE_ENV === "production" ? "An unexpected error occurred" : error instanceof Error ? error.message : "An unexpected error occurred";
+				const errorMessage = process.env.NODE_ENV === "production" ? "An unexpected error occurred" : extractErrorMessage(error);
 				const errorResponse = {
 					type: "ERROR",
 					requestId,
@@ -19934,6 +20483,33 @@ function formatBytes(bytes) {
 	return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
 }
 //#endregion
+//#region src/collections/buildRegistry.ts
+/**
+* Build the collection registry for a driver.
+*
+* The order matters and is the reason this is one function rather than a run of
+* statements in the bootstrapper. Keys are resolved from the drizzle schema, so
+* anything that inspects them has to run *after* the tables are registered —
+* and `warnOnKeysTheAdminCannotResolve` fails open if it does not, because a
+* collection whose table it cannot look up is one it has nothing to say about.
+* Warned too early, it would skip every collection and report nothing, which
+* reads exactly like having nothing to report.
+*/
+function buildCollectionRegistry(schema) {
+	const registry = new PostgresCollectionRegistry();
+	if (schema.collections) {
+		registry.registerMultiple(schema.collections);
+		logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
+	}
+	if (schema.tables) Object.values(schema.tables).forEach((table) => {
+		if (isTable(table)) registry.registerTable(table, getTableName(table));
+	});
+	if (schema.enums) registry.registerEnums(schema.enums);
+	if (schema.relations) registry.registerRelations(schema.relations);
+	warnOnKeysTheAdminCannotResolve(registry.getCollections(), registry);
+	return registry;
+}
+//#endregion
 //#region src/auth/ensure-tables.ts
 /**
 * Auto-create auth tables if they don't exist.
@@ -21916,21 +22492,14 @@ function createPostgresBootstrapper(pgConfig) {
 				logger.info(`🔍 [PostgresRegistry] BaaS mode: derived ${introspectedCollections.length} collections from schema "${pgSchemaName}" [${introspectedCollections.map((c) => c.slug).join(", ")}]`);
 			}
 			const activeCollections = introspectedCollections ?? collections;
-			const registry = new PostgresCollectionRegistry();
-			if (activeCollections) {
-				registry.registerMultiple(activeCollections);
-				logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
-			}
 			const schemaTables = introspectedTables ?? pgConfig.schema?.tables;
-			if (schemaTables) Object.values(schemaTables).forEach((table) => {
-				if (isTable(table)) {
-					const tableName = getTableName(table);
-					registry.registerTable(table, tableName);
-				}
-			});
-			if (pgConfig.schema?.enums) registry.registerEnums(pgConfig.schema.enums);
 			const schemaRelations = introspectedRelations ?? pgConfig.schema?.relations;
-			if (schemaRelations) registry.registerRelations(schemaRelations);
+			const registry = buildCollectionRegistry({
+				collections: activeCollections,
+				tables: schemaTables,
+				enums: pgConfig.schema?.enums,
+				relations: schemaRelations
+			});
 			if (schemaTables) patchPgArrayNullSafety(schemaTables);
 			const mergedSchema = {
 				...schemaTables,