@rebasepro/server-postgres 0.9.1-canary.58368ce → 0.9.1-canary.682a9cf

package/dist/index.es.js

@@ -71,16 +71,51 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 var connection_exports = /* @__PURE__ */ __exportAll({
 	createDirectDatabaseConnection: () => createDirectDatabaseConnection,
 	createPostgresDatabaseConnection: () => createPostgresDatabaseConnection,
-	createReadReplicaConnection: () => createReadReplicaConnection
+	createReadReplicaConnection: () => createReadReplicaConnection,
+	guardPoolAgainstDirtyRelease: () => guardPoolAgainstDirtyRelease
 });
 var DEFAULT_POOL = {
 	max: 20,
 	idleTimeoutMillis: 3e4,
 	connectionTimeoutMillis: 1e4,
-	queryTimeout: 3e4,
+	queryTimeout: 6e4,
 	statementTimeout: 3e4,
 	keepAlive: true
 };
+/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
+var TX_IDLE = "I";
+/**
+* Destroy pool clients that are released while still inside a transaction.
+*
+* pg-pool returns a client to the idle list whenever `release()` is called
+* without an error — even if the connection is still mid-transaction (status
+* `T`/`E`). That happens in practice: drizzle's pool transaction releases in
+* a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
+* (e.g. it was queued behind a statement that hit the client-side
+* query_timeout), the client goes back dirty. The next checkout then runs
+* its statements inside the zombie transaction — with the previous request's
+* `app.*` RLS GUCs still applied, which turns unrelated queries into
+* RLS-scoped ones (observed in production as registration failing with
+* SQLSTATE 42501 under a leaked anonymous context).
+*
+* pg-pool emits `release` before it consults its private `_expired` set, so
+* marking the client expired here makes `_release()` destroy it instead of
+* pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
+* private APIs — feature-detect and fall back to loud logging so an upstream
+* change degrades to observability, never to silent corruption.
+*/
+function guardPoolAgainstDirtyRelease(pool, label) {
+	pool.on("release", (err, client) => {
+		if (err) return;
+		const txStatus = client?._txStatus;
+		if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
+		const expired = pool._expired;
+		if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
+			expired.add(client);
+			logger.error(`[${label}] Client released back to the pool while still in a transaction (status '${txStatus}') — destroying it so the open transaction and its session state (RLS GUCs) cannot leak into the next request.`);
+		} else logger.error(`[${label}] Client released mid-transaction (status '${txStatus}') but the pool's internal expiry set is unavailable (pg-pool internals changed?). The connection may leak its open transaction into subsequent requests.`);
+	});
+}
 /**
 * Create a Drizzle-backed Postgres connection with a production-grade
 * connection pool.
@@ -112,6 +147,7 @@ function createPostgresDatabaseConnection(connectionString, schema, poolConfig)
 		logger.error("[pg-pool] Unexpected pool error", { detail: err.message });
 		if (err.message.includes("ETIMEDOUT")) logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -144,6 +180,7 @@ function createDirectDatabaseConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -173,6 +210,7 @@ function createReadReplicaConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -4549,8 +4587,26 @@ function getTableForCollection(collection, registry) {
 	if (!table) throw new Error(`Table not found for collection '${collection.slug}' (table: ${tableName})`);
 	return table;
 }
+/**
+* The key columns a collection's rows are addressed by.
+*
+* Three tiers, in order: properties marked `isId`, the primary keys of the
+* drizzle schema, and finally a column literally named `id`. Only the first is
+* visible to the browser, which is why a key known only to drizzle is reported
+* at boot — see {@link warnOnKeysTheAdminCannotResolve}.
+*
+* Returns `[]` when nothing resolves, rather than throwing. It used to open by
+* resolving the table, which throws when there is none — so the `isId` tier,
+* which needs no table at all, was unreachable for exactly the collections
+* most likely to have no table registered. Every caller that wanted "no keys"
+* to mean "no keys" had to spell that out in a try/catch.
+*
+* Callers that cannot proceed without a key must say so themselves, naming the
+* collection: an empty array here means "this collection has no address", which
+* is a different answer in a notification (broadcast a wildcard) than in a save
+* (fail).
+*/
 function getPrimaryKeys(collection, registry) {
-	const table = getTableForCollection(collection, registry);
 	if (collection.properties) {
 		const idProps = Object.entries(collection.properties).filter(([_, prop]) => "isId" in prop && Boolean(prop.isId)).map(([key, prop]) => ({
 			fieldName: key,
@@ -4559,6 +4615,8 @@ function getPrimaryKeys(collection, registry) {
 		}));
 		if (idProps.length > 0) return idProps;
 	}
+	const table = registry.getTable(getTableName$1(collection));
+	if (!table) return [];
 	const keys = [];
 	for (const [key, colRaw] of Object.entries(table)) {
 		const col = colRaw;
@@ -4587,6 +4645,21 @@ function getPrimaryKeys(collection, registry) {
 	return keys;
 }
 /**
+* The key columns, for callers that cannot do their job without one.
+*
+* {@link getPrimaryKeys} answers "what keys, if any" and returns `[]` for a
+* collection with no address. Most of this driver, though, is building a WHERE
+* clause and has no meaning without a key — for those, an empty array is not an
+* answer, and indexing `[0]` into it produces `Cannot read properties of
+* undefined` three frames from where the real problem is. This says what is
+* wrong and which collection it is wrong about.
+*/
+function requirePrimaryKeys(collection, registry) {
+	const keys = getPrimaryKeys(collection, registry);
+	if (keys.length === 0) throw new Error(`Collection '${collection.slug}' has no primary key, so its rows cannot be addressed. Mark the key property with \`isId\` in its config, or register a table whose schema declares one.`);
+	return keys;
+}
+/**
 * Collections whose key the *browser* cannot resolve, and what it will do
 * instead.
 *
@@ -4613,12 +4686,7 @@ function findUnresolvableKeyCollections(collections, registry) {
 	const findings = [];
 	for (const collection of collections) {
 		if (getDeclaredPrimaryKeys(collection).length > 0) continue;
-		let keys;
-		try {
-			keys = getPrimaryKeys(collection, registry);
-		} catch {
-			continue;
-		}
+		const keys = getPrimaryKeys(collection, registry);
 		if (keys.length === 0) continue;
 		if (keys.length === 1 && keys[0].fieldName === "id") continue;
 		findings.push({
@@ -4649,19 +4717,14 @@ function warnOnKeysTheAdminCannotResolve(collections, registry) {
 * The address of a row: derived from the collection's primary keys, because a
 * row does not carry one — it is exactly its columns.
 *
-* Falls back to a literal `id` column, which covers the two cases where the
-* keys cannot be resolved: a row that reached us from somewhere other than the
-* postgres driver, and a collection whose table the registry cannot look up
-* (`getPrimaryKeys` throws for an unregistered table rather than returning
-* nothing). Returns `""` when there is no key and no `id` — callers decide what
-* that means, since "unaddressable" is a different answer in a notification
-* (broadcast a wildcard) than in a save (fail).
+* Falls back to a literal `id` column, for a row that reached us from somewhere
+* other than this driver. Returns `""` when there is no key and no `id` —
+* callers decide what that means, since "unaddressable" is a different answer
+* in a notification (broadcast a wildcard) than in a save (fail).
 */
 function deriveRowAddress(row, collection, registry) {
-	try {
-		const composite = buildCompositeId(row, getPrimaryKeys(collection, registry));
-		if (composite && composite.split(":::").some((part) => part !== "")) return composite;
-	} catch {}
+	const composite = buildCompositeId(row, getPrimaryKeys(collection, registry));
+	if (composite && composite.split(":::").some((part) => part !== "")) return composite;
 	if (row.id !== void 0 && row.id !== null) return String(row.id);
 	return "";
 }
@@ -5203,6 +5266,7 @@ var DrizzleConditionBuilder = class {
 	static buildVectorSearchConditions(table, vectorSearch) {
 		const column = table[vectorSearch.property];
 		if (!column) throw new Error(`Vector column '${vectorSearch.property}' not found in table`);
+		if (!Array.isArray(vectorSearch.vector) || vectorSearch.vector.length === 0 || !vectorSearch.vector.every((n) => typeof n === "number" && Number.isFinite(n))) throw new Error("Vector search requires a non-empty array of finite numbers");
 		const vectorLiteral = `'[${vectorSearch.vector.join(",")}]'::vector`;
 		const distanceFn = vectorSearch.distance || "cosine";
 		let operator;
@@ -5703,6 +5767,63 @@ var RelationService = class {
 		this.registry = registry;
 	}
 	/**
+	* One target row, as the {@link RelatedRow} everything here returns.
+	*
+	* Eight sites built this by hand, which is how the address came to be the
+	* target's first key column in all eight — one edit, eight places to miss.
+	*
+	* `resolveNested` is the one thing they did not agree on, and the
+	* disagreement was invisible: the single-parent fetches pass `db` and
+	* `registry` to `parseDataFromServer`, so the target's *own* relations get
+	* resolved too, while the batch paths deliberately do not — a query per
+	* target row is the N+1 the batching exists to avoid. Naming the parameter
+	* makes that a decision rather than a difference between two call sites
+	* nobody was comparing.
+	*/
+	async toRelatedRow(targetRow, targetCollection, targetPks, options) {
+		const values = options?.resolveNested ? await parseDataFromServer(targetRow, targetCollection, this.db, this.registry) : await parseDataFromServer(targetRow, targetCollection);
+		return {
+			id: buildCompositeId(targetRow, targetPks),
+			path: targetCollection.slug,
+			values
+		};
+	}
+	/**
+	* A WHERE matching any of `parentIds`, by the whole key.
+	*
+	* A single key is an `IN (…)`. A composite one cannot be: matching
+	* `tenant_id IN (1, 1)` collects every row of tenant 1, so two parents that
+	* share their first column each receive the other's relations. It becomes
+	* an OR of ANDs — one exact address per parent — which Postgres indexes the
+	* same way it would a multi-column key lookup.
+	*/
+	parentKeyCondition(parentTable, parentPks, parentIds) {
+		const columnFor = (fieldName) => {
+			const col = parentTable[fieldName];
+			if (!col) throw new Error(`Key column '${fieldName}' not found in parent table`);
+			return col;
+		};
+		if (parentPks.length === 1) {
+			const values = parentIds.map((id) => parseIdValues(id, parentPks)[parentPks[0].fieldName]);
+			return inArray(columnFor(parentPks[0].fieldName), values);
+		}
+		return or(...parentIds.map((id) => {
+			const values = parseIdValues(id, parentPks);
+			return and(...parentPks.map((pk) => eq(columnFor(pk.fieldName), values[pk.fieldName])));
+		}));
+	}
+	/**
+	* Reject a relation that cannot express a composite-keyed parent.
+	*
+	* `localKey` and `foreignKeyOnTarget` are single column names: one column
+	* cannot reference a two-column key, so such a relation has no correct
+	* reading. Left alone it would silently match on the first key column and
+	* hand a tenant's rows to its neighbour — say so instead.
+	*/
+	assertSingleKeyAddressable(parentCollection, parentPks, via) {
+		if (parentPks.length > 1) throw new Error(`Relation on '${parentCollection.slug}' uses '${via}', a single foreign-key column, but '${parentCollection.slug}' is keyed on ${parentPks.map((k) => `'${k.fieldName}'`).join(" + ")}. One column cannot reference a composite key — express this relation with \`joinPath\`, whose \`on.from\`/\`on.to\` take every key column.`);
+	}
+	/**
 	* Fetch rows related to a parent row through a specific relation
 	*/
 	async fetchRelatedEntities(parentCollectionPath, parentId, relationKey, options = {}) {
@@ -5721,9 +5842,9 @@ var RelationService = class {
 	async fetchEntitiesUsingJoins(parentCollection, parentId, relation, options = {}) {
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const idInfo = getPrimaryKeys(targetCollection, this.registry);
+		const idInfo = requirePrimaryKeys(targetCollection, this.registry);
 		const idField = targetTable[idInfo[0].fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
@@ -5747,7 +5868,7 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
+			const parentIdField = parentTable[requirePrimaryKeys(parentCollection, this.registry)[0].fieldName];
 			query = query.where(eq(parentIdField, parsedParentId));
 			if (options.limit) query = query.limit(options.limit);
 			const results = await query;
@@ -5755,12 +5876,7 @@ var RelationService = class {
 			const rows = [];
 			for (const row of results) {
 				const targetRow = row[targetTableName] || row;
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
-				rows.push({
-					id: buildCompositeId(targetRow, idInfo),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				rows.push(await this.toRelatedRow(targetRow, targetCollection, idInfo, { resolveNested: true }));
 			}
 			return rows;
 		}
@@ -5779,12 +5895,7 @@ var RelationService = class {
 		const rows = [];
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
-			const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
-			rows.push({
-				id: buildCompositeId(targetRow, idInfo),
-				path: targetCollection.slug,
-				values: parsedValues
-			});
+			rows.push(await this.toRelatedRow(targetRow, targetCollection, idInfo, { resolveNested: true }));
 		}
 		return rows;
 	}
@@ -5801,8 +5912,8 @@ var RelationService = class {
 		}
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdField = targetTable[getPrimaryKeys(targetCollection, this.registry)[0].fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const targetIdField = targetTable[requirePrimaryKeys(targetCollection, this.registry)[0].fieldName];
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
@@ -5821,10 +5932,10 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetPks = getPrimaryKeys(targetCollection, this.registry);
+		const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 		const targetIdInfo = targetPks[0];
 		const targetIdField = targetTable[targetIdInfo.fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
@@ -5848,25 +5959,19 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
-			query = query.where(inArray(parentIdField, parsedParentIds));
+			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const row of results) {
 				const parentRow = row[getTableName$1(parentCollection)] || row;
 				const targetRow = row[targetTableName] || row;
-				const parentId = parentRow[parentIdInfo.fieldName];
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-				resultMap.set(String(parentId), {
-					id: buildCompositeId(targetRow, targetPks),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				resultMap.set(buildCompositeId(parentRow, parentPks), await this.toRelatedRow(targetRow, targetCollection, targetPks));
 			}
 			return resultMap;
 		}
 		if (relation.direction === "owning" && relation.localKey) {
+			this.assertSingleKeyAddressable(parentCollection, parentPks, relation.localKey);
 			const localKeyCol = parentTable[relation.localKey];
 			if (!localKeyCol) throw new Error(`Local key column '${relation.localKey}' not found in parent table`);
 			const fkRows = await this.db.select({
@@ -5895,17 +6000,11 @@ var RelationService = class {
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const [parentIdStr, fkValue] of parentToFk) {
 				const targetRow = targetById.get(String(fkValue));
-				if (targetRow) {
-					const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-					resultMap.set(parentIdStr, {
-						id: buildCompositeId(targetRow, targetPks),
-						path: targetCollection.slug,
-						values: parsedValues
-					});
-				}
+				if (targetRow) resultMap.set(parentIdStr, await this.toRelatedRow(targetRow, targetCollection, targetPks));
 			}
 			return resultMap;
 		}
+		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -5916,14 +6015,7 @@ var RelationService = class {
 			let parentId;
 			if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
 			else if (relation.direction === "inverse" && relation.cardinality === "one" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
-			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-				resultMap.set(String(parentId), {
-					id: buildCompositeId(targetRow, targetPks),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
-			}
+			if (parentId !== void 0 && parentIdSet.has(String(parentId))) resultMap.set(String(parentId), await this.toRelatedRow(targetRow, targetCollection, targetPks));
 		}
 		return resultMap;
 	}
@@ -5937,9 +6029,9 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetPks = getPrimaryKeys(targetCollection, this.registry);
+		const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 		const targetIdField = targetTable[targetPks[0].fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
@@ -5961,27 +6053,22 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
-			query = query.where(inArray(parentIdField, parsedParentIds));
+			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const row of results) {
 				const parentRow = row[getTableName$1(parentCollection)] || row;
 				const targetRow = row[targetTableName] || row;
-				const parentId = String(parentRow[parentIdInfo.fieldName]);
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
+				const parentId = buildCompositeId(parentRow, parentPks);
 				const arr = resultMap.get(parentId) || [];
-				arr.push({
-					id: buildCompositeId(targetRow, targetPks),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
 				resultMap.set(parentId, arr);
 			}
 			return resultMap;
 		}
 		if (relation.through && relation.cardinality === "many" && relation.direction === "owning") {
+			this.assertSingleKeyAddressable(parentCollection, parentPks, `${relation.through.table}.${relation.through.sourceColumn}`);
 			const junctionTable = this.registry.getTable(relation.through.table);
 			if (!junctionTable) {
 				logger.warn(`[batchFetchRelatedEntitiesMany] Junction table '${relation.through.table}' not found`);
@@ -6000,17 +6087,13 @@ var RelationService = class {
 				const junctionData = row[relation.through.table] || row;
 				const targetData = row[targetTableName] || row;
 				const parentId = String(junctionData[relation.through.sourceColumn]);
-				const parsedValues = await parseDataFromServer(targetData, targetCollection);
 				const arr = resultMap.get(parentId) || [];
-				arr.push({
-					id: buildCompositeId(targetData, targetPks),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetData, targetCollection, targetPks));
 				resultMap.set(parentId, arr);
 			}
 			return resultMap;
 		}
+		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -6023,14 +6106,9 @@ var RelationService = class {
 			else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
 			else if (relation.direction === "inverse" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
 			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
 				const key = String(parentId);
 				const arr = resultMap.get(key) || [];
-				arr.push({
-					id: buildCompositeId(targetRow, targetPks),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
 				resultMap.set(key, arr);
 			}
 		}
@@ -6078,12 +6156,12 @@ var RelationService = class {
 					logger.warn(`Could not determine junction table for relation '${key}' in collection '${collection.slug}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
 				if (targetEntityIds.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedParentId,
@@ -6103,12 +6181,12 @@ var RelationService = class {
 					logger.warn(`Junction columns not found for relation '${key}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
 				if (targetEntityIds.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedParentId,
@@ -6119,7 +6197,7 @@ var RelationService = class {
 			} else if (relation.through && relation.cardinality === "many" && relation.direction === "inverse") logger.warn(`[updateRelationsUsingJoins] Inverse M2M relation '${key}' in collection '${collection.slug}' should be saved from the owning side. Skipping.`);
 			else if (relation.cardinality === "many" && relation.direction === "inverse" && relation.foreignKeyOnTarget) {
 				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
 				const targetIdCol = targetTable[targetIdInfo.fieldName];
 				const fkCol = targetTable[relation.foreignKeyOnTarget];
@@ -6127,7 +6205,7 @@ var RelationService = class {
 					logger.warn(`Invalid inverse-many config for relation '${key}' in collection '${collection.slug}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				if (targetEntityIds.length > 0) {
@@ -6147,9 +6225,9 @@ var RelationService = class {
 			try {
 				const targetCollection = relation.target();
 				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
-				const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
 				if (relation.direction === "inverse" && relation.joinPath && relation.joinPath.length > 0) {
 					await this.updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue);
@@ -6230,12 +6308,12 @@ var RelationService = class {
 					logger.warn(`Could not determine junction columns for inverse joinPath relation '${relation.relationName}'`);
 					return;
 				}
-				const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
 				const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
 				if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = newValue.map((rel) => typeof rel === "object" && rel !== null ? rel.id : rel).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedSourceId,
@@ -6243,7 +6321,7 @@ var RelationService = class {
 					}));
 					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
 				} else if (newValue && !Array.isArray(newValue)) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const parsedTargetId = parseIdValues(typeof newValue === "object" && newValue !== null ? newValue.id : newValue, targetPks)[targetIdInfo.fieldName];
 					const newLink = {
@@ -6274,12 +6352,12 @@ var RelationService = class {
 				logger.warn(`Junction columns not found for relation '${relation.relationName}'`);
 				return;
 			}
-			const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+			const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 			const sourceIdInfo = sourcePks[0];
 			const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
 			await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
 			if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
 				const newLinks = newValue.map((rel) => rel.id).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 					[sourceJunctionColumn.name]: parsedSourceId,
@@ -6300,12 +6378,12 @@ var RelationService = class {
 			const { relation, newTargetId } = upd;
 			const targetCollection = relation.target();
 			const targetTable = getTableForCollection(targetCollection, this.registry);
-			const targetPks = getPrimaryKeys(targetCollection, this.registry);
+			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 			const targetIdInfo = targetPks[0];
 			const targetIdCol = targetTable[targetIdInfo.fieldName];
 			const { targetFKColName, parentSourceColName } = this.resolveJoinPathWriteMapping(parentCollection, relation);
 			const parentTable = getTableForCollection(parentCollection, this.registry);
-			const parentPks = getPrimaryKeys(parentCollection, this.registry);
+			const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 			const parentIdInfo = parentPks[0];
 			const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 			const parentIdCol = parentTable[parentIdInfo.fieldName];
@@ -6376,7 +6454,7 @@ var RelationService = class {
 				logger.warn(`Junction columns not found for relation '${relationKey}'`);
 				return;
 			}
-			const targetPks = getPrimaryKeys(targetCollection, this.registry);
+			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 			const targetIdInfo = targetPks[0];
 			const parsedNewEntityId = parseIdValues(newEntityId, targetPks)[targetIdInfo.fieldName];
 			const junctionData = {
@@ -6392,6 +6470,150 @@ var RelationService = class {
 	}
 };
 //#endregion
+//#region src/services/row-pipeline.ts
+/**
+* Whether a many-relation reaches its target through a junction table.
+*
+* Also used to build the drizzle `with` config, which is why it is exported:
+* the query has to nest one level deeper for a junction, and the row walk has
+* to unwrap that same level back out.
+*/
+function isJunctionRelation(relation) {
+	if (relation.through) return true;
+	if (relation.joinPath && relation.joinPath.length > 1) return true;
+	return false;
+}
+/**
+* Reach the target row inside a junction row.
+*
+* A junction row looks like `{ post_id: 1, tag_id: { id: 5, name: "ts" } }` —
+* the foreign keys, and the target nested under one of them. The target is the
+* only object among them, so that is how it is found. A junction row that has
+* not been nested (no `with` on the join) has no object and is returned as-is.
+*/
+function unwrapJunctionRow(item) {
+	const nestedKey = Object.keys(item).find((key) => typeof item[key] === "object" && item[key] !== null && !Array.isArray(item[key]));
+	return nestedKey ? item[nestedKey] : item;
+}
+/**
+* Give back the number a `number` property was declared to be.
+*
+* Postgres returns NUMERIC as a string and drizzle keeps it that way, since a
+* numeric can hold more precision than a double. But the collection declared
+* this property `number` and the OpenAPI spec this server publishes says
+* `type: number`, so serving `"9.99"` breaks its own contract — and breaks it
+* asymmetrically, because a create answers with the number and the read that
+* follows answers with the string. Any client that multiplies a price works
+* until the first refresh.
+*
+* Declaring a property `number` already accepts double precision — that is what
+* the admin has always parsed it to. Columns REST serves that no property
+* declares are left exactly as the database returned them.
+*/
+function coerceDeclaredNumber(value, property) {
+	if (property?.type !== "number" || typeof value !== "string") return value;
+	const parsed = parseFloat(value);
+	return isNaN(parsed) ? null : parsed;
+}
+/** Apply {@link coerceDeclaredNumber} across a row, leaving every other column alone. */
+function coerceDeclaredNumbers(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	const out = {};
+	for (const [key, value] of Object.entries(row)) out[key] = coerceDeclaredNumber(value, properties[key]);
+	return out;
+}
+/** Render one target row in the requested style. */
+/**
+* Drop every column the collection marked `excludeFromApi`.
+*
+* Password hashes and verification tokens have to be readable server-side but
+* must never reach a client — and "never" has to mean every exit from this
+* pipeline, including relation targets, or a secret leaks through whichever
+* path was overlooked. Keyed by both the property name and its column name,
+* since a row can arrive keyed either way depending on the caller.
+*/
+function stripExcluded(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	for (const [key, property] of Object.entries(properties)) {
+		if (!property?.excludeFromApi) continue;
+		delete row[key];
+		if (property.columnName) delete row[property.columnName];
+	}
+	return row;
+}
+function renderTarget(targetRow, targetCollection, style, registry) {
+	if (style === "inline") return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
+	const address = relationTargetAddress(targetRow, targetCollection, registry);
+	const path = targetCollection.slug;
+	return createRelationRefWithData(address, path, {
+		id: address,
+		path,
+		values: normalizeDbValues(targetRow, targetCollection)
+	});
+}
+/**
+* The address a relation ref points at.
+*
+* The whole key, not its first column: a composite-keyed target addressed by
+* `tenant_id` alone points at every row that shares it. A target whose key
+* cannot be resolved at all used to throw here — reading `[0]` of an empty
+* array — taking down the parent's fetch over a relation it may not even have
+* asked for. The first column is a guess, but a ref that resolves to nothing
+* beats no rows at all.
+*/
+function relationTargetAddress(targetRow, targetCollection, registry) {
+	const address = deriveRowAddress(targetRow, targetCollection, registry);
+	if (address) return address;
+	return String(targetRow[Object.keys(targetRow)[0]] ?? "");
+}
+/**
+* The row the admin renders: every column, with relations as references.
+*
+* Values are normalized (dates, numbers, NaN) because the admin's view-model
+* expects real types. The row's own address is *not* among the columns — it is
+* derived by the consumer from the collection's primary keys.
+*/
+function toCmsRow(row, collection, registry) {
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const normalized = normalizeDbValues(row, collection);
+	for (const [key, relation] of Object.entries(resolvedRelations)) {
+		const relData = row[relation.relationName || key];
+		if (relData === void 0 || relData === null) continue;
+		if (relation.cardinality === "many" && Array.isArray(relData)) {
+			const targetCollection = relation.target();
+			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, targetCollection, "ref", registry));
+		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
+	}
+	return stripExcluded(normalized, collection);
+}
+/**
+* The row REST serves: every column under its own name, with the value Postgres
+* returned, and relations inlined as the target's columns.
+*
+* Values are the ones the database returned, except where that contradicts the
+* declared type: a `number` property is served as a number (see
+* {@link coerceDeclaredNumber}). Dates stay as the database returned them —
+* JSON has its own opinions about dates that the admin's view-model does not
+* share.
+*
+* Keyed by the row rather than by the relation list — a REST fetch only loads
+* the relations `include` asked for, so the row is the authority on which are
+* actually there.
+*/
+function toRestRow(row, collection, registry) {
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const flat = {};
+	for (const [key, value] of Object.entries(row)) {
+		const relation = findRelation(resolvedRelations, key);
+		if (relation && Array.isArray(value)) flat[key] = value.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, relation.target(), "inline", registry));
+		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
+		else flat[key] = coerceDeclaredNumber(value, collection.properties?.[key]);
+	}
+	return stripExcluded(flat, collection);
+}
+//#endregion
 //#region src/services/FetchService.ts
 /**
 * Service for handling all row read operations.
@@ -6450,7 +6672,7 @@ var FetchService = class {
 			if (!shouldInclude(key)) continue;
 			const drizzleRelName = relation.relationName || key;
 			if (relation.joinPath && relation.joinPath.length > 0) continue;
-			if (relation.cardinality === "many" && this.isJunctionRelation(relation, collection)) {
+			if (relation.cardinality === "many" && isJunctionRelation(relation)) {
 				const targetFkName = this.getJunctionTargetRelationName(relation, collection);
 				if (targetFkName) withConfig[drizzleRelName] = { with: { [targetFkName]: true } };
 				else withConfig[drizzleRelName] = true;
@@ -6459,14 +6681,6 @@ var FetchService = class {
 		return withConfig;
 	}
 	/**
-	* Detect if a many-to-many relation uses a junction table in the Drizzle schema.
-	*/
-	isJunctionRelation(relation, _collection) {
-		if (relation.through) return true;
-		if (relation.joinPath && relation.joinPath.length > 1) return true;
-		return false;
-	}
-	/**
 	* Get the Drizzle relation name on the junction table that points to the actual target row.
 	* For example, for posts_tags junction, this returns "tag_id" (the relation pointing to tags).
 	*/
@@ -6475,68 +6689,6 @@ var FetchService = class {
 		return null;
 	}
 	/**
-	* The address a relation ref points at.
-	*
-	* The whole key, not its first column: a composite-keyed target addressed
-	* by `tenant_id` alone points at every row that shares it. And a target
-	* whose key cannot be resolved at all used to throw here — reading
-	* `targetPks[0]` of an empty array — taking down the parent's fetch over a
-	* relation it may not even have asked for; the first column is a guess, but
-	* a ref that resolves to nothing beats no rows at all.
-	*/
-	relationTargetAddress(targetRow, targetCollection) {
-		const address = deriveRowAddress(targetRow, targetCollection, this.registry);
-		if (address) return address;
-		const firstColumn = targetRow[Object.keys(targetRow)[0]];
-		return String(firstColumn ?? "");
-	}
-	/**
-	* Convert a db.query result row (with nested relation objects) to a flat row.
-	* Handles:
-	* - Type normalization (dates, numbers, NaN) via normalizeDbValues
-	* - Converting nested relation objects to { id, path, __type: "relation" } for CMS
-	* - Flattening junction-table many-to-many results
-	*
-	* The row's own address is not among them: it is derived by the consumer
-	* from the collection's primary keys.
-	*/
-	drizzleResultToRow(row, collection) {
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const normalizedValues = normalizeDbValues(row, collection);
-		for (const [key, relation] of Object.entries(resolvedRelations)) {
-			const relData = row[relation.relationName || key];
-			if (relData === void 0 || relData === null) continue;
-			if (relation.cardinality === "many" && Array.isArray(relData)) {
-				const targetCollection = relation.target();
-				const targetPath = targetCollection.slug;
-				normalizedValues[key] = relData.map((item) => {
-					let targetRow = item;
-					if (this.isJunctionRelation(relation, collection)) {
-						const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-						if (nestedKey) targetRow = item[nestedKey];
-					}
-					const relId = this.relationTargetAddress(targetRow, targetCollection);
-					return createRelationRefWithData(relId, targetPath, {
-						id: relId,
-						path: targetPath,
-						values: normalizeDbValues(targetRow, targetCollection)
-					});
-				});
-			} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) {
-				const targetCollection = relation.target();
-				const targetPath = targetCollection.slug;
-				const relObj = relData;
-				const relId = this.relationTargetAddress(relObj, targetCollection);
-				normalizedValues[key] = createRelationRefWithData(relId, targetPath, {
-					id: relId,
-					path: targetPath,
-					values: normalizeDbValues(relObj, targetCollection)
-				});
-			}
-		}
-		return normalizedValues;
-	}
-	/**
 	* Post-fetch joinPath relations for a single flat row.
 	* joinPath relations cannot be expressed via Drizzle's `with` config,
 	* so they must be loaded separately after the primary query.
@@ -6567,8 +6719,10 @@ var FetchService = class {
 		const shouldInclude = (key) => !include || include.length === 0 || include[0] === "*" || include.includes(key);
 		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0 && propertyKeys.has(key) && shouldInclude(key));
 		if (joinPathRelations.length === 0) return;
-		const idInfo = idInfoArray[0];
-		const parentIdOf = (row) => row[idInfo.fieldName];
+		const parentIdOf = (row) => {
+			const address = buildCompositeId(row, idInfoArray);
+			return address && address.split(":::").some((part) => part !== "") ? address : void 0;
+		};
 		for (const [key, relation] of joinPathRelations) try {
 			const addressable = rows.filter((r) => parentIdOf(r) !== void 0 && parentIdOf(r) !== null);
 			if (addressable.length === 0) continue;
@@ -6588,32 +6742,6 @@ var FetchService = class {
 		}
 	}
 	/**
-	* Convert a db.query result row to a flat REST-style row with populated relations.
-	*
-	* Every column is copied through under its own name, with the value Postgres
-	* returned. This used to open with a synthesized `id` and then skip the key
-	* column, which renamed it (a `sku` primary key was served as `id`, and `sku`
-	* did not appear at all) and restringified it (`42` → `"42"`). Consumers that
-	* need an address derive it from the collection's primary keys.
-	*/
-	drizzleResultToRestRow(row, collection) {
-		const flat = {};
-		const resolvedRelations = resolveCollectionRelations(collection);
-		for (const [k, v] of Object.entries(row)) {
-			const relation = findRelation(resolvedRelations, k);
-			if (Array.isArray(v) && relation) flat[k] = v.map((item) => {
-				if (this.isJunctionRelation(relation, collection)) {
-					const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-					if (nestedKey) return { ...item[nestedKey] };
-				}
-				return { ...item };
-			});
-			else if (typeof v === "object" && v !== null && !Array.isArray(v) && relation) flat[k] = { ...v };
-			else flat[k] = v;
-		}
-		return flat;
-	}
-	/**
 	* Build db.query-compatible options from standard fetch options.
 	* Handles filter, search, orderBy, limit, and cursor-based pagination.
 	*/
@@ -6683,7 +6811,7 @@ var FetchService = class {
 	async fetchOne(collectionPath, id, databaseId) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
@@ -6697,7 +6825,7 @@ var FetchService = class {
 				with: withConfig
 			});
 			if (!row) return void 0;
-			const flatRow = this.drizzleResultToRow(row, collection);
+			const flatRow = toCmsRow(row, collection, this.registry);
 			await this.resolveJoinPathRelations(flatRow, collection, collectionPath, parsedId, databaseId);
 			return flatRow;
 		} catch (e) {
@@ -6739,7 +6867,7 @@ var FetchService = class {
 	async fetchRowsWithConditions(collectionPath, options = {}) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
@@ -6749,7 +6877,7 @@ var FetchService = class {
 		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
 		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0);
-			return (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRow(row, collection));
+			return (await qb.findMany(queryOpts)).map((row) => toCmsRow(row, collection, this.registry));
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
 				logger.error(`[FetchService] Relation inference error for collection '${collectionPath}': ${e.message}`);
@@ -6810,8 +6938,10 @@ var FetchService = class {
 	}
 	/**
 	* Fallback path used when db.query is unavailable.
-	* The primary path uses drizzleResultToRow which handles relation
-	* mapping without N+1 queries.
+	*
+	* The primary path runs the results through `toCmsRow`, which maps
+	* relations from what drizzle already nested — no query per row. This one
+	* has no nesting to read, so it resolves relations itself, in batches.
 	*
 	* Process raw database results into flat rows with relations.
 	*/
@@ -6953,7 +7083,7 @@ var FetchService = class {
 		if (value === void 0 || value === null) return true;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const field = table[fieldName];
@@ -6980,7 +7110,7 @@ var FetchService = class {
 	async fetchCollectionForRest(collectionPath, options = {}, include) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const tableName = getTableName(table);
@@ -6988,7 +7118,7 @@ var FetchService = class {
 		if (qb && !options.searchString && !options.vectorSearch) try {
 			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig);
-			const restRows = (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRestRow(row, collection));
+			const restRows = (await qb.findMany(queryOpts)).map((row) => toRestRow(row, collection, this.registry));
 			await this.resolveJoinPathRelationsBatchRest(restRows, collection, collectionPath, idInfoArray, include);
 			return restRows;
 		} catch (e) {
@@ -7037,7 +7167,7 @@ var FetchService = class {
 	async fetchOneForRest(collectionPath, id, include, databaseId) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
@@ -7050,7 +7180,7 @@ var FetchService = class {
 				...withConfig ? { with: withConfig } : {}
 			});
 			if (!row) return null;
-			const restRow = this.drizzleResultToRestRow(row, collection);
+			const restRow = toRestRow(row, collection, this.registry);
 			await this.resolveJoinPathRelationsBatchRest([restRow], collection, collectionPath, idInfoArray, include);
 			return restRow;
 		} catch (e) {
@@ -7095,7 +7225,7 @@ var FetchService = class {
 	async fetchRowsWithConditionsRaw(collectionPath, options = {}) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idField = table[getPrimaryKeys(collection, this.registry)[0].fieldName];
+		const idField = table[requirePrimaryKeys(collection, this.registry)[0].fieldName];
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
 		let query = vectorMeta ? this.db.select({
@@ -7584,7 +7714,7 @@ var PersistService = class {
 		} catch (error) {
 			throw this.toUserFriendlyError(error, collection.slug);
 		}
-		const finalEntity = await this.fetchService.fetchOne(collection.slug, savedId, databaseId);
+		const finalEntity = await this.fetchService.fetchOneForRest(collection.slug, savedId, void 0, databaseId);
 		if (!finalEntity) throw new Error("Could not fetch row after save.");
 		return finalEntity;
 	}
@@ -8503,12 +8633,14 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
 		let previousValuesForHistory;
-		if (status === "existing" && id) {
-			const existing = await this.dataService.fetchOne(path, id, resolvedCollection?.databaseId);
+		if (status === "existing" && id) try {
+			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
 			if (existing) {
 				const { id: _existingId, ...existingValues } = existing;
 				previousValuesForHistory = existingValues;
 			}
+		} catch (err) {
+			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
 		}
 		if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
 			if (globalCallbacks?.beforeSave) {
@@ -9121,6 +9253,7 @@ var DatabasePoolManager = class {
 		pool.on("error", (err) => {
 			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
 		});
+		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 		this.pools.set(databaseName, pool);
 		return pool;
 	}
@@ -20681,14 +20814,22 @@ async function ensureAuthTablesExist(db, collection) {
                 $$ LANGUAGE sql STABLE
             `);
 		});
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
-        `);
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
-        `);
+		for (const columnDef of [
+			"display_name VARCHAR(255)",
+			"photo_url VARCHAR(500)",
+			"roles TEXT[] DEFAULT '{}' NOT NULL",
+			"password_hash VARCHAR(255)",
+			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
+			"email_verification_token VARCHAR(255)",
+			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
+			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
+			"metadata JSONB DEFAULT '{}' NOT NULL",
+			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
+			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
+		]) await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+            `);
 		try {
 			if ((await db.execute(sql`
                 SELECT EXISTS (
@@ -20759,6 +20900,34 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE INDEX IF NOT EXISTS idx_recovery_codes_user
             ON ${sql.raw(recoveryCodesTableName)}(user_id)
         `);
+		try {
+			const authTablePairs = [
+				[usersSchema, resolvedTable],
+				[authSchema, "user_identities"],
+				[authSchema, "refresh_tokens"],
+				[authSchema, "password_reset_tokens"],
+				[authSchema, "app_config"],
+				[authSchema, "mfa_factors"],
+				[authSchema, "mfa_challenges"],
+				[authSchema, "recovery_codes"]
+			];
+			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
+                    SELECT 1
+                    FROM pg_class c
+                    JOIN pg_namespace n ON n.oid = c.relnamespace
+                    WHERE n.nspname = ${schemaName}
+                      AND c.relname = ${tableName}
+                      AND c.relforcerowsecurity
+                `)).rows.length > 0) {
+				await db.execute(sql`
+                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
+                        NO FORCE ROW LEVEL SECURITY
+                    `);
+				logger.warn(`🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" (legacy RLS model — it binds the owner connection and breaks privileged auth writes)`);
+			}
+		} catch (rlsReconcileError) {
+			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
+		}
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
 		logger.error("❌ Failed to create auth tables", { error });
@@ -20806,6 +20975,31 @@ var UserService = class {
 		const name = getTableName(this.usersTable);
 		return `"${getTableConfig(this.usersTable).schema || "public"}"."${name}"`;
 	}
+	/**
+	* Run a privileged auth write with an explicitly cleared RLS context.
+	*
+	* The auth services run on the base/owner connection, which by design
+	* carries a NULL `app.user_id` so the `auth.uid() IS NULL` server-escape
+	* in the default policies applies. That NULL is normally guaranteed by
+	* `set_config(..., is_local = true)` resetting at transaction end — but a
+	* GUC that survives on a pooled connection (or a connection role that
+	* doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
+	* turns the trusted write into an RLS-scoped one and denies it with
+	* SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
+	* single chokepoint, makes the server context deterministic instead of
+	* trusting whatever state the pool hands us. `auth.uid()` reads '' as
+	* NULL via NULLIF, so '' is the server context.
+	*/
+	async withServerContext(fn) {
+		return await this.db.transaction(async (tx) => {
+			await tx.execute(sql`
+                SELECT set_config('app.user_id', '', true),
+                       set_config('app.user_roles', '', true),
+                       set_config('app.jwt', '', true)
+            `);
+			return await fn(tx);
+		});
+	}
 	mapRowToUser(row) {
 		if (!row) return row;
 		const id = row.id ?? row.uid;
@@ -20903,7 +21097,7 @@ var UserService = class {
 	}
 	async createUser(data) {
 		const payload = this.mapPayload(data);
-		const [row] = await this.db.insert(this.usersTable).values(payload).returning();
+		const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
 		return this.mapRowToUser(row);
 	}
 	async getUserById(id) {
@@ -20942,12 +21136,12 @@ var UserService = class {
 		}));
 	}
 	async linkUserIdentity(userId, provider, providerId, profileData) {
-		await this.db.insert(this.userIdentitiesTable).values({
+		await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
 			userId,
 			provider,
 			providerId,
 			profileData: profileData || null
-		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] });
+		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] }));
 	}
 	async updateUser(id, data) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -20955,13 +21149,13 @@ var UserService = class {
 		const payload = this.mapPayload(data);
 		const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 		payload[updatedAtKey] = /* @__PURE__ */ new Date();
-		const [row] = await this.db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning();
+		const [row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
 		return row ? this.mapRowToUser(row) : null;
 	}
 	async deleteUser(id) {
 		const idCol = getColumn(this.usersTable, "id");
 		if (!idCol) return;
-		await this.db.delete(this.usersTable).where(eq(idCol, id));
+		await this.withServerContext(async (db) => db.delete(this.usersTable).where(eq(idCol, id)));
 	}
 	async listUsers() {
 		return (await this.db.select().from(this.usersTable)).map((row) => this.mapRowToUser(row));
@@ -21015,10 +21209,10 @@ var UserService = class {
 		if (!idCol) return;
 		const passwordHashColKey = getColumnKey(this.usersTable, "passwordHash", "password_hash") || "passwordHash";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[passwordHashColKey]: passwordHash,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification status
@@ -21029,11 +21223,11 @@ var UserService = class {
 		const emailVerifiedColKey = getColumnKey(this.usersTable, "emailVerified", "email_verified") || "emailVerified";
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerifiedColKey]: verified,
 			[emailVerificationTokenColKey]: null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification token
@@ -21044,11 +21238,11 @@ var UserService = class {
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const emailVerificationSentAtColKey = getColumnKey(this.usersTable, "emailVerificationSentAt", "email_verification_sent_at") || "emailVerificationSentAt";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerificationTokenColKey]: token,
 			[emailVerificationSentAtColKey]: token ? /* @__PURE__ */ new Date() : null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Find user by email verification token
@@ -21093,22 +21287,22 @@ var UserService = class {
 	async setUserRoles(userId, roleIds) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const rolesArray = `{${roleIds.join(",")}}`;
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = ${rolesArray}::text[], updated_at = NOW()
             WHERE id = ${userId}
-        `);
+        `));
 	}
 	/**
 	* Assign a specific role to new user (appends if not present)
 	*/
 	async assignDefaultRole(userId, roleId) {
 		const usersTableName = this.getQualifiedUsersTableName();
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = array_append(roles, ${roleId}), updated_at = NOW()
             WHERE id = ${userId} AND NOT (${roleId} = ANY(roles))
-        `);
+        `));
 	}
 	/**
 	* Get user with their roles
@@ -22578,6 +22772,7 @@ function createPostgresBootstrapper(pgConfig) {
 			const wantsCdc = cdcMode !== "off";
 			const explicitCdc = cdcMode === "trigger" || cdcMode === "wal";
 			let cdcEnabled = false;
+			let provisionCdcForTables;
 			if (wantsCdc && !directUrl) {
 				const reason = "no direct database connection is available for the realtime LISTEN client (set DATABASE_DIRECT_URL)";
 				if (explicitCdc) logger.warn(`⚠️ [CDC] REALTIME_CDC=${cdcMode} but ${reason} — using app-level realtime.`);
@@ -22594,6 +22789,9 @@ function createPostgresBootstrapper(pgConfig) {
 					})).filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table)));
 					await realtimeService.enableCdc(directUrl);
 					cdcEnabled = true;
+					provisionCdcForTables = async (tables) => {
+						await provisionTriggerCdc(cdcRunSql, tables);
+					};
 					logger.info(`📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). All writes now emit realtime events regardless of origin.`);
 				} catch (err) {
 					if (explicitCdc) logger.warn("⚠️ [CDC] Could not enable database-level change capture — falling back to app-level realtime.", { error: err });
@@ -22618,13 +22816,14 @@ function createPostgresBootstrapper(pgConfig) {
 					const dbTables = new Set(result.rows.map((r) => r.table_schema === "public" ? r.table_name : `${r.table_schema}.${r.table_name}`));
 					const missing = [];
 					for (const col of registeredCollections) {
+						if (col.auth?.enabled) continue;
 						const schemaName = "schema" in col && col.schema ? col.schema : "public";
 						const tableName = registry.hasTableForCollection(col.table ?? col.slug) ? col.table ?? col.slug : col.slug;
 						const checkName = registry.getTableNames().find((k) => k === tableName || k === col.slug) ?? tableName;
 						const fullCheckName = schemaName === "public" ? checkName : `${schemaName}.${checkName}`;
 						if (!dbTables.has(fullCheckName)) missing.push({
 							slug: col.slug,
-							table: checkName
+							table: fullCheckName
 						});
 					}
 					if (missing.length > 0) {
@@ -22658,7 +22857,8 @@ function createPostgresBootstrapper(pgConfig) {
 					registry,
 					realtimeService,
 					driver,
-					poolManager
+					poolManager,
+					provisionCdcForTables
 				}
 			};
 		},
@@ -22670,6 +22870,18 @@ function createPostgresBootstrapper(pgConfig) {
 			const registry = internals.registry;
 			const authCollection = authConfig.collection;
 			await ensureAuthTablesExist(db, authCollection);
+			if (authCollection && internals.provisionCdcForTables) {
+				const authSchema = "schema" in authCollection && typeof authCollection.schema === "string" ? authCollection.schema : "rebase";
+				const authTable = "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug;
+				if (authTable) try {
+					await internals.provisionCdcForTables([{
+						schema: authSchema,
+						table: authTable
+					}]);
+				} catch (err) {
+					logger.warn(`⚠️ [CDC] Could not attach change-capture to the auth table "${authSchema}.${authTable}" — writes to it won't emit database-level events.`, { detail: err instanceof Error ? err.message : String(err) });
+				}
+			}
 			let emailService;
 			if (authConfig.email) emailService = createEmailService(authConfig.email);
 			const tableName = authCollection ? "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug : void 0;
@@ -22740,6 +22952,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map