@rebasepro/server-postgres 0.9.1-canary.73476f2 → 0.9.1-canary.74adfbe

package/dist/index.es.js

@@ -3,15 +3,15 @@ import process from "process";
 const require = __createRequire(import.meta.url);
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
-import { createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
+import { ApiError, createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, or, relations, sql } from "drizzle-orm";
 import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
-import { createHash, randomUUID } from "crypto";
 import fs, { promises } from "fs";
 import path from "path";
 import chokidar from "chokidar";
 import { WebSocket, WebSocketServer } from "ws";
 import { EventEmitter } from "events";
+import { randomUUID } from "crypto";
 import { inspect } from "util";
 import os from "os";
 import { fileURLToPath } from "node:url";
@@ -71,16 +71,51 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 var connection_exports = /* @__PURE__ */ __exportAll({
 	createDirectDatabaseConnection: () => createDirectDatabaseConnection,
 	createPostgresDatabaseConnection: () => createPostgresDatabaseConnection,
-	createReadReplicaConnection: () => createReadReplicaConnection
+	createReadReplicaConnection: () => createReadReplicaConnection,
+	guardPoolAgainstDirtyRelease: () => guardPoolAgainstDirtyRelease
 });
 var DEFAULT_POOL = {
 	max: 20,
 	idleTimeoutMillis: 3e4,
 	connectionTimeoutMillis: 1e4,
-	queryTimeout: 3e4,
+	queryTimeout: 6e4,
 	statementTimeout: 3e4,
 	keepAlive: true
 };
+/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
+var TX_IDLE = "I";
+/**
+* Destroy pool clients that are released while still inside a transaction.
+*
+* pg-pool returns a client to the idle list whenever `release()` is called
+* without an error — even if the connection is still mid-transaction (status
+* `T`/`E`). That happens in practice: drizzle's pool transaction releases in
+* a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
+* (e.g. it was queued behind a statement that hit the client-side
+* query_timeout), the client goes back dirty. The next checkout then runs
+* its statements inside the zombie transaction — with the previous request's
+* `app.*` RLS GUCs still applied, which turns unrelated queries into
+* RLS-scoped ones (observed in production as registration failing with
+* SQLSTATE 42501 under a leaked anonymous context).
+*
+* pg-pool emits `release` before it consults its private `_expired` set, so
+* marking the client expired here makes `_release()` destroy it instead of
+* pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
+* private APIs — feature-detect and fall back to loud logging so an upstream
+* change degrades to observability, never to silent corruption.
+*/
+function guardPoolAgainstDirtyRelease(pool, label) {
+	pool.on("release", (err, client) => {
+		if (err) return;
+		const txStatus = client?._txStatus;
+		if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
+		const expired = pool._expired;
+		if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
+			expired.add(client);
+			logger.error(`[${label}] Client released back to the pool while still in a transaction (status '${txStatus}') — destroying it so the open transaction and its session state (RLS GUCs) cannot leak into the next request.`);
+		} else logger.error(`[${label}] Client released mid-transaction (status '${txStatus}') but the pool's internal expiry set is unavailable (pg-pool internals changed?). The connection may leak its open transaction into subsequent requests.`);
+	});
+}
 /**
 * Create a Drizzle-backed Postgres connection with a production-grade
 * connection pool.
@@ -112,6 +147,7 @@ function createPostgresDatabaseConnection(connectionString, schema, poolConfig)
 		logger.error("[pg-pool] Unexpected pool error", { detail: err.message });
 		if (err.message.includes("ETIMEDOUT")) logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -144,6 +180,7 @@ function createDirectDatabaseConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -173,6 +210,7 @@ function createReadReplicaConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -315,7 +353,7 @@ function getDeclaredSubcollections(collection) {
 /**
 * The id a request without a logged-in user reports as `auth.uid()`.
 *
-* A user-context request always sets `app.user_id`: blank would read back as
+* A user-context request always sets `app.uid`: blank would read back as
 * `NULL`, and `NULL` is how the trusted server context is recognised, so an
 * anonymous visitor would be promoted to server privileges. The driver
 * therefore substitutes this sentinel at the single chokepoint where the GUC
@@ -1502,6 +1540,140 @@ function removeFunctions(o) {
 	return o;
 }
 //#endregion
+//#region ../utils/src/sha1.ts
+/**
+* Minimal SHA-1 implementation that runs in both Node and the browser.
+*
+* This exists because generated Postgres policy names embed a SHA-1 digest of
+* the security rule. The DDL generator runs on the server (where `node:crypto`
+* is available) but the Studio has to derive the same names in the browser to
+* tell a policy it generated apart from one it did not. `node:crypto` cannot be
+* bundled for the browser, so the shared derivation needs a portable digest.
+*
+* SHA-1 is used purely to name things deterministically — never for security.
+* The output is byte-identical to `createHash("sha1").update(str).digest("hex")`,
+* which `sha1.test.ts` pins against `node:crypto` directly.
+*/
+/** Rotate a 32-bit word left by `n` bits. */
+function rotl(value, n) {
+	return value << n | value >>> 32 - n;
+}
+/**
+* SHA-1 digest of a string, hex-encoded.
+*
+* The input is encoded as UTF-8, matching Node's default handling of strings
+* passed to `hash.update(str)`.
+*/
+function sha1Hex(input) {
+	const bytes = Array.from(new TextEncoder().encode(input));
+	const bitLength = bytes.length * 8;
+	bytes.push(128);
+	while (bytes.length % 64 !== 56) bytes.push(0);
+	const hi = Math.floor(bitLength / 4294967296);
+	const lo = bitLength >>> 0;
+	bytes.push(hi >>> 24 & 255, hi >>> 16 & 255, hi >>> 8 & 255, hi & 255);
+	bytes.push(lo >>> 24 & 255, lo >>> 16 & 255, lo >>> 8 & 255, lo & 255);
+	let h0 = 1732584193;
+	let h1 = 4023233417;
+	let h2 = 2562383102;
+	let h3 = 271733878;
+	let h4 = 3285377520;
+	const w = new Array(80);
+	for (let offset = 0; offset < bytes.length; offset += 64) {
+		for (let i = 0; i < 16; i++) {
+			const j = offset + i * 4;
+			w[i] = bytes[j] << 24 | bytes[j + 1] << 16 | bytes[j + 2] << 8 | bytes[j + 3] | 0;
+		}
+		for (let i = 16; i < 80; i++) w[i] = rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
+		let a = h0;
+		let b = h1;
+		let c = h2;
+		let d = h3;
+		let e = h4;
+		for (let i = 0; i < 80; i++) {
+			let f;
+			let k;
+			if (i < 20) {
+				f = b & c | ~b & d;
+				k = 1518500249;
+			} else if (i < 40) {
+				f = b ^ c ^ d;
+				k = 1859775393;
+			} else if (i < 60) {
+				f = b & c | b & d | c & d;
+				k = 2400959708;
+			} else {
+				f = b ^ c ^ d;
+				k = 3395469782;
+			}
+			const temp = rotl(a, 5) + f + e + k + w[i] | 0;
+			e = d;
+			d = c;
+			c = rotl(b, 30);
+			b = a;
+			a = temp;
+		}
+		h0 = h0 + a | 0;
+		h1 = h1 + b | 0;
+		h2 = h2 + c | 0;
+		h3 = h3 + d | 0;
+		h4 = h4 + e | 0;
+	}
+	return [
+		h0,
+		h1,
+		h2,
+		h3,
+		h4
+	].map((word) => (word >>> 0).toString(16).padStart(8, "0")).join("");
+}
+//#endregion
+//#region ../utils/src/policy-names.ts
+/**
+* Naming of the Postgres policies generated from a collection's security rules.
+*
+* A rule without an explicit `name` is compiled to `<table>_<op>_<hash>`, where
+* the hash covers the rule's semantics. The Studio needs the same names to tell
+* "this policy came from your code" apart from "someone wrote this in SQL" —
+* without them it treats generated policies as foreign and offers to import
+* them back into the codebase they came from.
+*
+* This is the single definition of that naming. The DDL and Drizzle generators
+* both derive names from here, so a change cannot silently rename every policy
+* in every deployed database while the UI keeps matching the old ones.
+*/
+/** Stable digest of the parts of a rule that determine what the policy does. */
+function getPolicyNameHash(rule) {
+	return sha1Hex(JSON.stringify({
+		a: rule.access,
+		m: rule.mode,
+		op: rule.operation,
+		ops: rule.operations?.slice().sort(),
+		own: rule.ownerField,
+		rol: rule.roles?.slice().sort(),
+		pg: rule.pgRoles?.slice().sort(),
+		u: rule.using,
+		w: rule.withCheck,
+		c: rule.condition,
+		ch: rule.check
+	})).substring(0, 7);
+}
+/** The operations a rule expands to — `operations` wins over `operation`. */
+function getPolicyOperations(rule) {
+	return rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+}
+/**
+* Every Postgres policy name a single rule compiles to — one per operation.
+*
+* @param rule      The security rule as written in the collection config.
+* @param tableName The rule's table (see `getTableName` in `@rebasepro/common`).
+*/
+function getPolicyNamesForRule(rule, tableName) {
+	const ops = getPolicyOperations(rule);
+	const ruleHash = getPolicyNameHash(rule);
+	return ops.map((op, opIdx) => rule.name ? ops.length > 1 ? `${rule.name}_${op}` : rule.name : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`);
+}
+//#endregion
 //#region ../utils/src/names.ts
 /**
 * Generates a foreign key column name from a given string, typically a collection slug or name.
@@ -1626,6 +1798,109 @@ function createRelationRefWithData(id, path, data) {
 		data
 	};
 }
+/**
+* Derive a row's address from its key columns.
+*
+* Single key → the value as a string. Composite → each part joined by
+* {@link COMPOSITE_ID_SEPARATOR}, in primary-key order, which is what
+* {@link parseIdValues} expects to invert.
+*/
+function buildCompositeId(values, primaryKeys) {
+	if (primaryKeys.length === 0) return "";
+	if (primaryKeys.length === 1) return String(values[primaryKeys[0].fieldName] ?? "");
+	return primaryKeys.map((pk) => String(values[pk.fieldName] ?? "")).join(":::");
+}
+/**
+* Invert {@link buildCompositeId}: turn an address back into key columns, each
+* coerced to the type its column actually round-trips as.
+*
+* This is the boundary where a URL segment becomes a query parameter, so a
+* malformed address must throw rather than silently produce a query that
+* matches the wrong row (or none).
+*/
+function parseIdValues(idValue, primaryKeys) {
+	const result = {};
+	if (primaryKeys.length === 0) return result;
+	if (primaryKeys.length === 1) {
+		const pk = primaryKeys[0];
+		if (pk.type === "number" && !pk.isUUID) {
+			const parsed = typeof idValue === "number" ? idValue : parseInt(String(idValue), 10);
+			if (isNaN(parsed)) throw new Error(`Invalid numeric ID: ${idValue}`);
+			result[pk.fieldName] = parsed;
+		} else result[pk.fieldName] = String(idValue);
+		return result;
+	}
+	const parts = String(idValue).split(":::");
+	if (parts.length !== primaryKeys.length) throw new Error(`Composite ID parts mismatch. Expected ${primaryKeys.length}, got ${parts.length} for ID: ${idValue}`);
+	for (let i = 0; i < primaryKeys.length; i++) {
+		const pk = primaryKeys[i];
+		const val = parts[i];
+		if (pk.type === "number" && !pk.isUUID) {
+			const parsed = parseInt(val, 10);
+			if (isNaN(parsed)) throw new Error(`Invalid numeric ID component: ${val}`);
+			result[pk.fieldName] = parsed;
+		} else result[pk.fieldName] = val;
+	}
+	return result;
+}
+/**
+* The primary keys of a collection, as declared by its properties.
+*
+* This is the only tier both sides can read, because it is the only one written
+* in the config: the postgres driver can also infer keys from the Drizzle
+* schema, which the browser never sees and is never sent — the admin compiles
+* the collection files into its own bundle rather than being served them. A key
+* that lives only in the Drizzle schema is therefore invisible here, and the
+* server says so at boot (`warnOnKeysTheAdminCannotResolve`) naming the `isId`
+* to add.
+*
+* Returns an empty array when a collection declares none, which callers must
+* treat as "not addressable" rather than defaulting to `id`: guessing a key
+* that is not the real one produces confidently wrong addresses.
+*/
+function getDeclaredPrimaryKeys(collection) {
+	const properties = collection.properties;
+	if (!properties) return [];
+	const keys = [];
+	for (const [fieldName, propRaw] of Object.entries(properties)) {
+		const prop = propRaw;
+		if (!prop || typeof prop !== "object") continue;
+		if (!("isId" in prop) || !prop.isId) continue;
+		keys.push({
+			fieldName,
+			type: prop.type === "number" ? "number" : "string",
+			isUUID: prop.isId === "uuid"
+		});
+	}
+	return keys;
+}
+/**
+* The keys to address a collection's rows with, resolved the way the driver
+* resolves them — minus the tier the browser cannot reach.
+*
+* The postgres driver tries, in order: properties marked `isId`; the primary
+* keys of the Drizzle schema; and finally a column literally named `id`. Only
+* the first and last are visible in a `CollectionConfig`, which is what both
+* sides share.
+*
+* So the two agree except on a collection that declares no `isId` and whose key
+* is known only to Drizzle. There, the driver reads the real key, and this
+* either resolves nothing (reported to the console by the caller) or — if the
+* table happens to have an unrelated `id` property — resolves `id`, which is
+* the wrong key and cannot be detected from here: the addresses look right and
+* route wrong. Only the config can settle it, so the server names both cases
+* at boot (`warnOnKeysTheAdminCannotResolve`) with the `isId` to add.
+*/
+function resolvePrimaryKeys(collection) {
+	const declared = getDeclaredPrimaryKeys(collection);
+	if (declared.length > 0) return declared;
+	const idProp = collection.properties?.id;
+	if (idProp && typeof idProp === "object") return [{
+		fieldName: "id",
+		type: idProp.type === "number" ? "number" : "string"
+	}];
+	return [];
+}
 //#endregion
 //#region ../common/src/util/enums.ts
 function enumToObjectEntries(enumValues) {
@@ -1859,16 +2134,110 @@ function getSubcollections(collection) {
 * It handles:
 * - `field = 'literal'`
 * - `field != 'literal'`
-* - `field = current_setting('app.user_id')`
-* - `A AND B`
+* - `field = current_setting('app.uid')` (or the legacy `app.user_id`)
+* - `A AND B`, `A OR B` — only where the keyword is at the top level
 * - `true`
 * - `IN (...)` (as optimistic true)
 *
 * For anything it doesn't understand, it returns a `raw` expression, which
 * the evaluator treats as "unknown" (and usually optimistic true).
+*
+* **This output also round-trips back into DDL** via `policyToPostgres` (the
+* schema/policy generators), so decomposing a clause the parser only partly
+* understands is not a cosmetic mistake — it emits invalid SQL. When in doubt,
+* prefer `raw`: it is reproduced verbatim.
 */
+/** True when `keyword` starts at `i` as a standalone word. */
+function isKeywordAt(upper, i, keyword) {
+	if (!upper.startsWith(keyword, i)) return false;
+	const before = i === 0 ? " " : upper[i - 1];
+	const after = upper[i + keyword.length] ?? " ";
+	return /[\s()]/.test(before) && /[\s()]/.test(after);
+}
+/**
+* Split `sql` on a boolean keyword, but only where it sits at paren depth 0 and
+* outside a string literal. Returns null when it never does, so the caller
+* leaves the clause alone.
+*
+* This used to be `sql.split(/ AND /i)`, which tore subqueries in half: the
+* `AND` inside
+*   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = auth.uid())`
+* split the expression, and re-emitting the halves produced
+*   `(EXISTS (...) AND m.user_id = auth.uid())`
+* where `m` is no longer in scope — SQL that Postgres rejects outright with
+* "missing FROM-clause entry for table". Returning null instead keeps such a
+* clause as a `raw` expression, which round-trips verbatim.
+*/
+function splitTopLevel(sql, keyword) {
+	const upper = sql.toUpperCase();
+	const parts = [];
+	let depth = 0;
+	let inString = false;
+	let start = 0;
+	for (let i = 0; i < sql.length; i++) {
+		const ch = sql[i];
+		if (inString) {
+			if (ch === "'") if (sql[i + 1] === "'") i++;
+			else inString = false;
+			continue;
+		}
+		if (ch === "'") {
+			inString = true;
+			continue;
+		}
+		if (ch === "(") {
+			depth++;
+			continue;
+		}
+		if (ch === ")") {
+			depth--;
+			continue;
+		}
+		if (depth === 0 && isKeywordAt(upper, i, keyword)) {
+			parts.push(sql.slice(start, i));
+			i += keyword.length - 1;
+			start = i + 1;
+		}
+	}
+	if (parts.length === 0) return null;
+	parts.push(sql.slice(start));
+	const trimmedParts = parts.map((p) => p.trim()).filter((p) => p.length > 0);
+	return trimmedParts.length > 1 ? trimmedParts : null;
+}
+/** Drop redundant wrapping parens (`(a AND b)` → `a AND b`), never `(a) AND (b)`. */
+function stripOuterParens(sql) {
+	let s = sql.trim();
+	for (;;) {
+		if (!s.startsWith("(") || !s.endsWith(")")) return s;
+		let depth = 0;
+		let inString = false;
+		let wraps = true;
+		for (let i = 0; i < s.length; i++) {
+			const ch = s[i];
+			if (inString) {
+				if (ch === "'") if (s[i + 1] === "'") i++;
+				else inString = false;
+				continue;
+			}
+			if (ch === "'") {
+				inString = true;
+				continue;
+			}
+			if (ch === "(") depth++;
+			else if (ch === ")") {
+				depth--;
+				if (depth === 0 && i < s.length - 1) {
+					wraps = false;
+					break;
+				}
+			}
+		}
+		if (!wraps) return s;
+		s = s.slice(1, -1).trim();
+	}
+}
 function sqlToPolicy(sql) {
-	const trimmed = sql.trim();
+	const trimmed = stripOuterParens(sql.trim());
 	if (trimmed.toLowerCase() === "true") return policy.true();
 	if (trimmed.toLowerCase() === "false") return policy.false();
 	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
@@ -1881,14 +2250,10 @@ function sqlToPolicy(sql) {
 		const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
 		return policy.rolesContain(roles);
 	}
-	if (trimmed.toUpperCase().includes(" OR ")) {
-		const parts = trimmed.split(/ OR /i);
-		return policy.or(...parts.map(sqlToPolicy));
-	}
-	if (trimmed.toUpperCase().includes(" AND ")) {
-		const parts = trimmed.split(/ AND /i);
-		return policy.and(...parts.map(sqlToPolicy));
-	}
+	const orParts = splitTopLevel(trimmed, "OR");
+	if (orParts) return policy.or(...orParts.map(sqlToPolicy));
+	const andParts = splitTopLevel(trimmed, "AND");
+	if (andParts) return policy.and(...andParts.map(sqlToPolicy));
 	const match = trimmed.match(/^(.+?)\s*(!?=)\s*(.+)$/);
 	if (match) {
 		const [, leftStr, op, rightStr] = match;
@@ -1970,7 +2335,7 @@ function findAnonymousGrants(expr) {
 	return found;
 }
 function parseOperand(str) {
-	if (/current_setting\s*\(\s*'app\.user_id'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return policy.authUid();
+	if (/current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return policy.authUid();
 	const stringMatch = str.match(/^'(.+)'$/);
 	if (stringMatch) return policy.literal(stringMatch[1]);
 	if (/^\w+$/.test(str)) return policy.field(str);
@@ -2194,6 +2559,307 @@ var buildPropertyCallbacks = (properties) => {
 	};
 	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
 };
+//#endregion
+//#region ../common/src/util/auth-default-policies.ts
+/**
+* Default RLS policies injected by the schema generator.
+*
+* Rebase's enforcement model is unified: authenticated (user-context) requests
+* run under the restricted `rebase_user` role, so Postgres RLS binds *every*
+* statement — reads and writes. A collection's `securityRules` are the whole
+* authorization model. The server context (auth flows, migrations,
+* `dataAsAdmin`) runs as the owner and bypasses RLS.
+*
+* Because RLS default-denies, every collection is **locked by default**: with
+* no rules, only the server context and admins can touch it. The generator
+* injects that safe baseline:
+*
+* **For every collection**
+*  1. A permissive **server-or-admin SELECT** grant.
+*  2. A permissive **server-or-admin write** grant (insert/update/delete).
+*
+* Author `securityRules` are permissive and OR together, so explicit rules only
+* *broaden* access from this locked baseline (e.g. "users read/write their own
+* rows").
+*
+* **For auth collections additionally**
+*  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
+*     their own row (profile, session bootstrap) without every app re-declaring
+*     it.
+*  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
+*     every other policy, so a write is rejected unless the caller is an admin
+*     (or the server context) — even if the author also wrote a permissive rule
+*     such as "a user may edit their own row". Without this, a permissive owner
+*     rule would let a user change their own `roles`.
+*
+* The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
+* — the built-in flows that run without a user (signup, migrations) set no user
+* GUC — which also lets the owner connection satisfy these policies even under
+* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
+* `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
+*
+* Opt out with `disableDefaultPolicies: true` to take full responsibility for
+* the collection's RLS.
+*/
+var SERVER_OR_ADMIN_EXPR$1 = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/** Write operations that must be admin-gated by default on auth collections. */
+var DEFAULT_GUARDED_OPS = [
+	"insert",
+	"update",
+	"delete"
+];
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection) {
+	const auth = collection.auth;
+	return auth === true || typeof auth === "object" && auth?.enabled === true;
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName$1(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/**
+* Returns the security rules that should be applied to a collection: the
+* author's explicit `securityRules` plus the framework defaults described in
+* the module doc (baseline server/admin read for all collections; self-read
+* and the admin write gate for auth collections).
+*
+* Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+*/
+function getEffectiveSecurityRules(collection) {
+	const explicit = [...(isPostgresCollectionConfig(collection) ? collection.securityRules : void 0) ?? []];
+	if (collection.disableDefaultPolicies) return explicit;
+	const tableName = getTableName$1(collection);
+	const injected = [];
+	injected.push({
+		name: `${tableName}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR$1
+	});
+	injected.push({
+		name: `${tableName}_default_admin_write`,
+		operations: [...DEFAULT_GUARDED_OPS],
+		condition: SERVER_OR_ADMIN_EXPR$1,
+		check: SERVER_OR_ADMIN_EXPR$1
+	});
+	if (isAuthCollection(collection)) {
+		injected.push({
+			name: `${tableName}_default_self_read`,
+			operations: ["select"],
+			condition: policy.compare(policy.field(getIdPropertyName$1(collection)), "eq", policy.authUid())
+		});
+		injected.push({
+			name: `${tableName}_require_admin_write`,
+			mode: "restrictive",
+			operations: [...DEFAULT_GUARDED_OPS],
+			condition: SERVER_OR_ADMIN_EXPR$1,
+			check: SERVER_OR_ADMIN_EXPR$1
+		});
+	}
+	return [...explicit, ...injected];
+}
+//#endregion
+//#region ../common/src/util/junction-policies.ts
+var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/**
+* Walk every collection's resolved relations and aggregate the junction tables
+* they declare. Two collections may declare the same junction from opposite
+* sides (posts→tags and tags→posts through `posts_tags`); both become
+* `declaringSides` of one spec, so derived write grants consider both.
+*/
+function resolveJunctionSpecs(collections) {
+	const specs = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const resolved = resolveCollectionRelations(collection);
+		for (const relation of Object.values(resolved)) {
+			if (!relation.through) continue;
+			const targetCollection = typeof relation.target === "function" ? relation.target() : void 0;
+			if (!targetCollection) continue;
+			const rawName = relation.through.table;
+			const table = rawName.includes(".") ? rawName.split(".").pop() : rawName;
+			const schema = "public";
+			const source = {
+				collection,
+				junctionColumn: relation.through.sourceColumn,
+				relation
+			};
+			const target = {
+				collection: targetCollection,
+				junctionColumn: relation.through.targetColumn
+			};
+			const existing = specs.get(table);
+			if (!existing) specs.set(table, {
+				table,
+				schema,
+				endpoints: [source, target],
+				declaringSides: [source]
+			});
+			else if (!existing.declaringSides.some((s) => s.collection === collection)) existing.declaringSides.push(source);
+		}
+	}
+	return specs;
+}
+/**
+* A synthetic CollectionConfig standing in for the junction during policy
+* compilation and naming. Its two FK columns carry explicit `columnName`s so
+* `outerField` operands resolve to the exact columns the CREATE TABLE emitted,
+* whatever their casing.
+*/
+function getJunctionCollectionConfig(spec) {
+	const properties = {};
+	for (const endpoint of spec.endpoints) properties[endpoint.junctionColumn] = {
+		type: "string",
+		columnName: endpoint.junctionColumn
+	};
+	return {
+		slug: spec.table,
+		name: spec.table,
+		table: spec.table,
+		schema: spec.schema,
+		properties
+	};
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/** `EXISTS (SELECT 1 FROM endpoint WHERE endpoint.pk = junction.fk [AND extra])`. */
+function existsEndpoint(endpoint, extra) {
+	const correlation = policy.compare(policy.field(getIdPropertyName(endpoint.collection)), "eq", policy.outerField(endpoint.junctionColumn));
+	return policy.existsIn({
+		collection: endpoint.collection.slug,
+		where: extra ? policy.and(correlation, extra) : correlation
+	});
+}
+/**
+* Whether a parent-rule expression keeps its meaning when moved inside the
+* junction's `EXISTS` subquery — and the re-scoped copy if it does.
+*
+* Returns `null` when the rule cannot be embedded faithfully: `raw` SQL
+* anywhere (its `{column}` placeholders would bind to the junction), or an
+* `outerField` inside a nested `existsIn` (it would bind to the junction while
+* the author meant the parent, and no operand can express "the middle scope").
+* Top-level `outerField`s are rewritten to `field`, which is what they meant.
+*/
+function embedParentExpression(expr, depth = 0) {
+	switch (expr.kind) {
+		case "raw": return null;
+		case "and":
+		case "or": {
+			const parts = [];
+			for (const child of expr.operands) {
+				const embedded = embedParentExpression(child, depth);
+				if (!embedded) return null;
+				parts.push(embedded);
+			}
+			return expr.kind === "and" ? policy.and(...parts) : policy.or(...parts);
+		}
+		case "not": {
+			const embedded = embedParentExpression(expr.operand, depth);
+			return embedded ? policy.not(embedded) : null;
+		}
+		case "existsIn": {
+			const where = embedParentExpression(expr.where, depth + 1);
+			return where ? policy.existsIn({
+				collection: expr.collection,
+				where
+			}) : null;
+		}
+		case "compare": {
+			const left = embedOperand(expr.left, depth);
+			const right = embedOperand(expr.right, depth);
+			if (!left || !right) return null;
+			return {
+				...expr,
+				left,
+				right
+			};
+		}
+		default: return expr;
+	}
+}
+/** Re-scope an operand, or return `null` if its binding cannot be preserved. */
+function embedOperand(operand, depth) {
+	if (operand.kind === "outerField") {
+		if (depth === 0) return policy.field(operand.name);
+		return null;
+	}
+	return operand;
+}
+/** Does the rule cover the `update` operation? */
+function coversUpdate(rule) {
+	return getPolicyOperations(rule).some((op) => op === "update" || op === "all");
+}
+/**
+* The full derived policy set for a junction table: the locked server/admin
+* baseline, the endpoint-visibility read grant, inherited write grants, and
+* inherited restrictive gates. Returns `[]` when every declaring collection set
+* `disableDefaultPolicies` — the junction is then the author's to police, and
+* stays locked (RLS is still enabled) until they write policies for it.
+*/
+function getJunctionSecurityRules(spec) {
+	if (spec.declaringSides.every((side) => side.collection.disableDefaultPolicies)) return [];
+	const rules = [];
+	rules.push({
+		name: `${spec.table}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_admin_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: SERVER_OR_ADMIN_EXPR,
+		check: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_edge_read`,
+		operations: ["select"],
+		condition: policy.and(existsEndpoint(spec.endpoints[0]), existsEndpoint(spec.endpoints[1]))
+	});
+	const writeGrants = [];
+	for (const side of spec.declaringSides) {
+		const updateRules = ((isPostgresCollectionConfig(side.collection) ? side.collection.securityRules : void 0) ?? []).filter(coversUpdate);
+		const permissive = updateRules.filter((r) => r.mode !== "restrictive");
+		const restrictive = updateRules.filter((r) => r.mode === "restrictive");
+		const embeddedGates = [];
+		let gatesEmbeddable = true;
+		for (const gate of restrictive) {
+			const using = securityRuleToConditions(gate).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (!embedded) {
+				gatesEmbeddable = false;
+				break;
+			}
+			embeddedGates.push(embedded);
+		}
+		if (!gatesEmbeddable) continue;
+		const grants = [];
+		for (const rule of permissive) {
+			const using = securityRuleToConditions(rule).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (embedded) grants.push(embedded);
+		}
+		if (grants.length === 0) continue;
+		const condition = embeddedGates.length > 0 ? policy.and(policy.or(...grants), ...embeddedGates) : policy.or(...grants);
+		writeGrants.push(existsEndpoint(side, condition));
+	}
+	if (writeGrants.length > 0) rules.push({
+		name: `${spec.table}_default_edge_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants),
+		check: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants)
+	});
+	return rules;
+}
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(root, factory) {
 		if (typeof define === "function" && define.amd) define(factory);
@@ -3463,18 +4129,45 @@ function deserializeFilter(query) {
 }
 //#endregion
 //#region ../common/src/data/buildRebaseData.ts
+function createPrimaryKeyResolver(options) {
+	const cache = /* @__PURE__ */ new Map();
+	const warned = /* @__PURE__ */ new Set();
+	return function primaryKeysFor(slug) {
+		const cached = cache.get(slug);
+		if (cached) return cached;
+		const collection = options?.resolveCollection?.(slug);
+		if (!collection) return [];
+		const keys = resolvePrimaryKeys(collection);
+		if (keys.length > 0) {
+			cache.set(slug, keys);
+			return keys;
+		}
+		if (!warned.has(slug)) {
+			warned.add(slug);
+			console.warn(`[rebase] Collection '${slug}' declares no primary key, so its rows have no address: detail links, caching and relations will not work for it. Mark the key property with \`isId\` in its collection config — the server logs which column to mark at boot, if its schema knows the key.`);
+		}
+		return keys;
+	};
+}
 /**
-* Convert a flat REST record (e.g. from RestFetchService) to Entity<M> format.
-* Mirrors the client SDK's rowToEntity conversion.
+* Give a flat row the Entity view-model the admin renders.
+*
+* The address is *derived here* — it is not a column, and the row it came from
+* does not contain one. Rows carry exactly what the table has, with the types
+* Postgres returned; the id is this layer's invention, and this is the only
+* place it is minted.
+*
+* `primaryKeys` empty falls back to a literal `id` on the row: drivers other
+* than postgres still serve rows with one, and this keeps them working.
 */
-function rowToEntity(row, slug) {
+function rowToEntity(row, slug, primaryKeys = []) {
 	return {
-		id: row.id,
+		id: primaryKeys.length > 0 ? buildCompositeId(row, primaryKeys) : row.id,
 		path: slug,
 		values: row
 	};
 }
-function createDriverAccessor(driver, slug) {
+function createDriverAccessor(driver, slug, getPks = () => []) {
 	const accessor = {
 		async find(params) {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
@@ -3507,7 +4200,7 @@ function createDriverAccessor(driver, slug) {
 				hasMore = offset + rows.length < total;
 			}
 			return {
-				data: rows.map((row) => rowToEntity(row, slug)),
+				data: rows.map((row) => rowToEntity(row, slug, getPks())),
 				meta: {
 					total,
 					limit,
@@ -3521,7 +4214,7 @@ function createDriverAccessor(driver, slug) {
 				path: slug,
 				id
 			});
-			return row ? rowToEntity(row, slug) : void 0;
+			return row ? rowToEntity(row, slug, getPks()) : void 0;
 		},
 		async create(data, id) {
 			return rowToEntity(await driver.save({
@@ -3529,15 +4222,22 @@ function createDriverAccessor(driver, slug) {
 				values: data,
 				id,
 				status: "new"
-			}), slug);
+			}), slug, getPks());
 		},
+		createMany: driver.saveMany ? async (data, options) => {
+			return (await driver.saveMany({
+				path: slug,
+				rows: data,
+				upsert: options?.upsert
+			})).map((row) => rowToEntity(row, slug, getPks()));
+		} : void 0,
 		async update(id, data) {
 			return rowToEntity(await driver.save({
 				path: slug,
 				values: data,
 				id,
 				status: "existing"
-			}), slug);
+			}), slug, getPks());
 		},
 		async delete(id) {
 			return driver.delete({ row: {
@@ -3566,7 +4266,7 @@ function createDriverAccessor(driver, slug) {
 				searchString: params?.searchString,
 				onUpdate: (entities) => {
 					onUpdate({
-						data: entities.map((row) => rowToEntity(row, slug)),
+						data: entities.map((row) => rowToEntity(row, slug, getPks())),
 						meta: {
 							total: entities.length,
 							limit,
@@ -3582,7 +4282,7 @@ function createDriverAccessor(driver, slug) {
 			return driver.listenOne({
 				path: slug,
 				id,
-				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug) : void 0),
+				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug, getPks()) : void 0),
 				onError
 			});
 		} : void 0,
@@ -3621,12 +4321,13 @@ function createDriverAccessor(driver, slug) {
 * await data.products.create({ name: "Camera", price: 299 });
 * const { data: items } = await data.products.find({ where: { status: ["==", "published"] } });
 */
-function buildRebaseData(driver) {
+function buildRebaseData(driver, options) {
 	const cache = /* @__PURE__ */ new Map();
+	const primaryKeysFor = createPrimaryKeyResolver(options);
 	function getAccessor(slug) {
 		let accessor = cache.get(slug);
 		if (!accessor) {
-			accessor = createDriverAccessor(driver, slug);
+			accessor = createDriverAccessor(driver, slug, () => primaryKeysFor(slug));
 			cache.set(slug, accessor);
 		}
 		return accessor;
@@ -3639,8 +4340,9 @@ function buildRebaseData(driver) {
 	} });
 }
 /**
-* Unwrap a Entity into a flat row. `rowToEntity` stores the whole flat row
-* (id included) under `.values`, so this is just that payload.
+* Unwrap a Entity back into the flat row it was built from. `rowToEntity` keeps
+* the row untouched under `.values` and derives `.id` alongside it, so dropping
+* the wrapper is the whole operation — the address was never part of the row.
 */
 function entityToRow(entity) {
 	return entity.values;
@@ -3727,6 +4429,12 @@ function toSdkCollectionClient(snap) {
 		async create(data, id) {
 			return entityToRow(await snap.create(data, id));
 		},
+		async createMany(data, options) {
+			if (!Array.isArray(data)) throw new TypeError("createMany expects an array of records.");
+			if (data.length === 0) return [];
+			if (!snap.createMany) throw new Error("Bulk writes are not supported by this collection's data source. Fall back to create() per record.");
+			return (await snap.createMany(data, options)).map(entityToRow);
+		},
 		async update(id, data) {
 			return entityToRow(await snap.update(id, data));
 		},
@@ -3879,8 +4587,26 @@ function getTableForCollection(collection, registry) {
 	if (!table) throw new Error(`Table not found for collection '${collection.slug}' (table: ${tableName})`);
 	return table;
 }
+/**
+* The key columns a collection's rows are addressed by.
+*
+* Three tiers, in order: properties marked `isId`, the primary keys of the
+* drizzle schema, and finally a column literally named `id`. Only the first is
+* visible to the browser, which is why a key known only to drizzle is reported
+* at boot — see {@link warnOnKeysTheAdminCannotResolve}.
+*
+* Returns `[]` when nothing resolves, rather than throwing. It used to open by
+* resolving the table, which throws when there is none — so the `isId` tier,
+* which needs no table at all, was unreachable for exactly the collections
+* most likely to have no table registered. Every caller that wanted "no keys"
+* to mean "no keys" had to spell that out in a try/catch.
+*
+* Callers that cannot proceed without a key must say so themselves, naming the
+* collection: an empty array here means "this collection has no address", which
+* is a different answer in a notification (broadcast a wildcard) than in a save
+* (fail).
+*/
 function getPrimaryKeys(collection, registry) {
-	const table = getTableForCollection(collection, registry);
 	if (collection.properties) {
 		const idProps = Object.entries(collection.properties).filter(([_, prop]) => "isId" in prop && Boolean(prop.isId)).map(([key, prop]) => ({
 			fieldName: key,
@@ -3889,6 +4615,8 @@ function getPrimaryKeys(collection, registry) {
 		}));
 		if (idProps.length > 0) return idProps;
 	}
+	const table = registry.getTable(getTableName$1(collection));
+	if (!table) return [];
 	const keys = [];
 	for (const [key, colRaw] of Object.entries(table)) {
 		const col = colRaw;
@@ -3916,35 +4644,89 @@ function getPrimaryKeys(collection, registry) {
 	}
 	return keys;
 }
-function parseIdValues(idValue, primaryKeys) {
-	const result = {};
-	if (primaryKeys.length === 0) return result;
-	if (primaryKeys.length === 1) {
-		const pk = primaryKeys[0];
-		if (pk.type === "number" && !pk.isUUID) {
-			const parsed = typeof idValue === "number" ? idValue : parseInt(String(idValue), 10);
-			if (isNaN(parsed)) throw new Error(`Invalid numeric ID: ${idValue}`);
-			result[pk.fieldName] = parsed;
-		} else result[pk.fieldName] = String(idValue);
-		return result;
-	}
-	const parts = String(idValue).split(":::");
-	if (parts.length !== primaryKeys.length) throw new Error(`Composite ID parts mismatch. Expected ${primaryKeys.length}, got ${parts.length} for ID: ${idValue}`);
-	for (let i = 0; i < primaryKeys.length; i++) {
-		const pk = primaryKeys[i];
-		const val = parts[i];
-		if (pk.type === "number" && !pk.isUUID) {
-			const parsed = parseInt(val, 10);
-			if (isNaN(parsed)) throw new Error(`Invalid numeric ID component: ${val}`);
-			result[pk.fieldName] = parsed;
-		} else result[pk.fieldName] = val;
+/**
+* The key columns, for callers that cannot do their job without one.
+*
+* {@link getPrimaryKeys} answers "what keys, if any" and returns `[]` for a
+* collection with no address. Most of this driver, though, is building a WHERE
+* clause and has no meaning without a key — for those, an empty array is not an
+* answer, and indexing `[0]` into it produces `Cannot read properties of
+* undefined` three frames from where the real problem is. This says what is
+* wrong and which collection it is wrong about.
+*/
+function requirePrimaryKeys(collection, registry) {
+	const keys = getPrimaryKeys(collection, registry);
+	if (keys.length === 0) throw new Error(`Collection '${collection.slug}' has no primary key, so its rows cannot be addressed. Mark the key property with \`isId\` in its config, or register a table whose schema declares one.`);
+	return keys;
+}
+/**
+* Collections whose key the *browser* cannot resolve, and what it will do
+* instead.
+*
+* The two sides resolve keys from different evidence. This driver reads, in
+* order: properties marked `isId`, the primary keys of the Drizzle schema, then
+* a column literally named `id`. The admin shares the `CollectionConfig` — it
+* compiles the same collection files into its bundle — but never the Drizzle
+* schema, so the middle tier is invisible to it.
+*
+* Nothing can normalize this at runtime: the server does not serve the admin
+* its collections, so a key resolved here cannot be handed over there. The
+* config files are the only thing both sides read, so the fix is an edit to
+* them, and the most this can do is say exactly which edit.
+*
+* Two shapes, and the second is the dangerous one:
+*
+* - No `isId`, no `id` property → the admin resolves no address, warns in the
+*   console, and rows cannot be opened or linked.
+* - No `isId`, but an `id` property that is *not* the key → the admin addresses
+*   rows by `id` while this driver reads the address as the real key. Nothing
+*   errors: the addresses look right and route wrong.
+*/
+function findUnresolvableKeyCollections(collections, registry) {
+	const findings = [];
+	for (const collection of collections) {
+		if (getDeclaredPrimaryKeys(collection).length > 0) continue;
+		const keys = getPrimaryKeys(collection, registry);
+		if (keys.length === 0) continue;
+		if (keys.length === 1 && keys[0].fieldName === "id") continue;
+		findings.push({
+			collection,
+			keys,
+			shadowedByIdProperty: Boolean(collection.properties?.id)
+		});
 	}
-	return result;
+	return findings;
 }
-function buildCompositeId(values, primaryKeys) {
-	if (primaryKeys.length === 0) return "";
-	if (primaryKeys.length === 1) return String(values[primaryKeys[0].fieldName] ?? "");
-	return primaryKeys.map((pk) => String(values[pk.fieldName] ?? "")).join(":::");
+/**
+* Report the collections from {@link findUnresolvableKeyCollections} at boot,
+* with the edit that fixes each one.
+*
+* Grouped by failure, not by collection: the shadowed case is a routing bug and
+* the silent case is a missing feature, and they deserve different urgency.
+*/
+function warnOnKeysTheAdminCannotResolve(collections, registry) {
+	const findings = findUnresolvableKeyCollections(collections, registry);
+	if (findings.length === 0) return;
+	const edit = (f) => `${f.collection.slug}: mark ${f.keys.map((k) => `\`${k.fieldName}\``).join(" and ")} with \`isId: ${f.keys[0].isUUID ? "\"uuid\"" : f.keys[0].type === "number" ? "\"increment\"" : "true"}\``;
+	const shadowed = findings.filter((f) => f.shadowedByIdProperty);
+	const silent = findings.filter((f) => !f.shadowedByIdProperty);
+	if (shadowed.length > 0) logger.warn("⚠️ These collections declare no `isId`, and their key is only in the drizzle schema — but they do have a property called `id`. The admin has no way to know `id` is not the key, so it will address rows by it while this server reads the address as the real key: the links look right and route wrong. Nothing will error.\n\n" + shadowed.map((f) => `  • ${edit(f)}`).join("\n") + "\n");
+	if (silent.length > 0) logger.warn("⚠️ These collections declare no `isId`, and their key is only in the drizzle schema, which the admin never sees. It will resolve no address for their rows, so detail links, caching and relations will not work for them:\n\n" + silent.map((f) => `  • ${edit(f)}`).join("\n") + "\n");
+}
+/**
+* The address of a row: derived from the collection's primary keys, because a
+* row does not carry one — it is exactly its columns.
+*
+* Falls back to a literal `id` column, for a row that reached us from somewhere
+* other than this driver. Returns `""` when there is no key and no `id` —
+* callers decide what that means, since "unaddressable" is a different answer
+* in a notification (broadcast a wildcard) than in a save (fail).
+*/
+function deriveRowAddress(row, collection, registry) {
+	const composite = buildCompositeId(row, getPrimaryKeys(collection, registry));
+	if (composite && composite.split(":::").some((part) => part !== "")) return composite;
+	if (row.id !== void 0 && row.id !== null) return String(row.id);
+	return "";
 }
 //#endregion
 //#region src/utils/drizzle-conditions.ts
@@ -4484,6 +5266,7 @@ var DrizzleConditionBuilder = class {
 	static buildVectorSearchConditions(table, vectorSearch) {
 		const column = table[vectorSearch.property];
 		if (!column) throw new Error(`Vector column '${vectorSearch.property}' not found in table`);
+		if (!Array.isArray(vectorSearch.vector) || vectorSearch.vector.length === 0 || !vectorSearch.vector.every((n) => typeof n === "number" && Number.isFinite(n))) throw new Error("Vector search requires a non-empty array of finite numbers");
 		const vectorLiteral = `'[${vectorSearch.vector.join(",")}]'::vector`;
 		const distanceFn = vectorSearch.distance || "cosine";
 		let operator;
@@ -4567,12 +5350,10 @@ function serializeDataToServer(row, properties, collection, registry) {
 					continue;
 				} else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) {
 					const serializedValue = serializePropertyToServer(effectiveValue, property);
-					const pks = getPrimaryKeys(collection, registry);
 					inverseRelationUpdates.push({
 						relationKey: key,
 						relation,
-						newValue: serializedValue,
-						currentId: row.id || buildCompositeId(row, pks)
+						newValue: serializedValue
 					});
 					continue;
 				} else if (relation.direction === "inverse" && relation.joinPath && relation.joinPath.length > 0) {
@@ -4582,15 +5363,11 @@ function serializeDataToServer(row, properties, collection, registry) {
 						relation,
 						newTargetId: serializedValue
 					});
-					else {
-						const pks = getPrimaryKeys(collection, registry);
-						inverseRelationUpdates.push({
-							relationKey: key,
-							relation,
-							newValue: serializedValue,
-							currentId: row.id || buildCompositeId(row, pks)
-						});
-					}
+					else inverseRelationUpdates.push({
+						relationKey: key,
+						relation,
+						newValue: serializedValue
+					});
 					continue;
 				} else if (relation.cardinality === "one" && relation.direction === "owning" && relation.joinPath && relation.joinPath.length > 0) {
 					const serializedValue = serializePropertyToServer(effectiveValue, property);
@@ -4990,6 +5767,63 @@ var RelationService = class {
 		this.registry = registry;
 	}
 	/**
+	* One target row, as the {@link RelatedRow} everything here returns.
+	*
+	* Eight sites built this by hand, which is how the address came to be the
+	* target's first key column in all eight — one edit, eight places to miss.
+	*
+	* `resolveNested` is the one thing they did not agree on, and the
+	* disagreement was invisible: the single-parent fetches pass `db` and
+	* `registry` to `parseDataFromServer`, so the target's *own* relations get
+	* resolved too, while the batch paths deliberately do not — a query per
+	* target row is the N+1 the batching exists to avoid. Naming the parameter
+	* makes that a decision rather than a difference between two call sites
+	* nobody was comparing.
+	*/
+	async toRelatedRow(targetRow, targetCollection, targetPks, options) {
+		const values = options?.resolveNested ? await parseDataFromServer(targetRow, targetCollection, this.db, this.registry) : await parseDataFromServer(targetRow, targetCollection);
+		return {
+			id: buildCompositeId(targetRow, targetPks),
+			path: targetCollection.slug,
+			values
+		};
+	}
+	/**
+	* A WHERE matching any of `parentIds`, by the whole key.
+	*
+	* A single key is an `IN (…)`. A composite one cannot be: matching
+	* `tenant_id IN (1, 1)` collects every row of tenant 1, so two parents that
+	* share their first column each receive the other's relations. It becomes
+	* an OR of ANDs — one exact address per parent — which Postgres indexes the
+	* same way it would a multi-column key lookup.
+	*/
+	parentKeyCondition(parentTable, parentPks, parentIds) {
+		const columnFor = (fieldName) => {
+			const col = parentTable[fieldName];
+			if (!col) throw new Error(`Key column '${fieldName}' not found in parent table`);
+			return col;
+		};
+		if (parentPks.length === 1) {
+			const values = parentIds.map((id) => parseIdValues(id, parentPks)[parentPks[0].fieldName]);
+			return inArray(columnFor(parentPks[0].fieldName), values);
+		}
+		return or(...parentIds.map((id) => {
+			const values = parseIdValues(id, parentPks);
+			return and(...parentPks.map((pk) => eq(columnFor(pk.fieldName), values[pk.fieldName])));
+		}));
+	}
+	/**
+	* Reject a relation that cannot express a composite-keyed parent.
+	*
+	* `localKey` and `foreignKeyOnTarget` are single column names: one column
+	* cannot reference a two-column key, so such a relation has no correct
+	* reading. Left alone it would silently match on the first key column and
+	* hand a tenant's rows to its neighbour — say so instead.
+	*/
+	assertSingleKeyAddressable(parentCollection, parentPks, via) {
+		if (parentPks.length > 1) throw new Error(`Relation on '${parentCollection.slug}' uses '${via}', a single foreign-key column, but '${parentCollection.slug}' is keyed on ${parentPks.map((k) => `'${k.fieldName}'`).join(" + ")}. One column cannot reference a composite key — express this relation with \`joinPath\`, whose \`on.from\`/\`on.to\` take every key column.`);
+	}
+	/**
 	* Fetch rows related to a parent row through a specific relation
 	*/
 	async fetchRelatedEntities(parentCollectionPath, parentId, relationKey, options = {}) {
@@ -5008,9 +5842,9 @@ var RelationService = class {
 	async fetchEntitiesUsingJoins(parentCollection, parentId, relation, options = {}) {
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const idInfo = getPrimaryKeys(targetCollection, this.registry);
+		const idInfo = requirePrimaryKeys(targetCollection, this.registry);
 		const idField = targetTable[idInfo[0].fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
@@ -5034,7 +5868,7 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
+			const parentIdField = parentTable[requirePrimaryKeys(parentCollection, this.registry)[0].fieldName];
 			query = query.where(eq(parentIdField, parsedParentId));
 			if (options.limit) query = query.limit(options.limit);
 			const results = await query;
@@ -5042,13 +5876,7 @@ var RelationService = class {
 			const rows = [];
 			for (const row of results) {
 				const targetRow = row[targetTableName] || row;
-				const id = targetRow[idInfo[0].fieldName];
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
-				rows.push({
-					id: id?.toString() || "",
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				rows.push(await this.toRelatedRow(targetRow, targetCollection, idInfo, { resolveNested: true }));
 			}
 			return rows;
 		}
@@ -5067,13 +5895,7 @@ var RelationService = class {
 		const rows = [];
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
-			const id = targetRow[idInfo[0].fieldName];
-			const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
-			rows.push({
-				id: id?.toString() || "",
-				path: targetCollection.slug,
-				values: parsedValues
-			});
+			rows.push(await this.toRelatedRow(targetRow, targetCollection, idInfo, { resolveNested: true }));
 		}
 		return rows;
 	}
@@ -5090,8 +5912,8 @@ var RelationService = class {
 		}
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdField = targetTable[getPrimaryKeys(targetCollection, this.registry)[0].fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const targetIdField = targetTable[requirePrimaryKeys(targetCollection, this.registry)[0].fieldName];
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
@@ -5110,9 +5932,10 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdInfo = getPrimaryKeys(targetCollection, this.registry)[0];
+		const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+		const targetIdInfo = targetPks[0];
 		const targetIdField = targetTable[targetIdInfo.fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
@@ -5136,25 +5959,19 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
-			query = query.where(inArray(parentIdField, parsedParentIds));
+			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const row of results) {
 				const parentRow = row[getTableName$1(parentCollection)] || row;
 				const targetRow = row[targetTableName] || row;
-				const parentId = parentRow[parentIdInfo.fieldName];
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-				resultMap.set(String(parentId), {
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				resultMap.set(buildCompositeId(parentRow, parentPks), await this.toRelatedRow(targetRow, targetCollection, targetPks));
 			}
 			return resultMap;
 		}
 		if (relation.direction === "owning" && relation.localKey) {
+			this.assertSingleKeyAddressable(parentCollection, parentPks, relation.localKey);
 			const localKeyCol = parentTable[relation.localKey];
 			if (!localKeyCol) throw new Error(`Local key column '${relation.localKey}' not found in parent table`);
 			const fkRows = await this.db.select({
@@ -5183,17 +6000,11 @@ var RelationService = class {
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const [parentIdStr, fkValue] of parentToFk) {
 				const targetRow = targetById.get(String(fkValue));
-				if (targetRow) {
-					const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-					resultMap.set(parentIdStr, {
-						id: String(targetRow[targetIdInfo.fieldName]),
-						path: targetCollection.slug,
-						values: parsedValues
-					});
-				}
+				if (targetRow) resultMap.set(parentIdStr, await this.toRelatedRow(targetRow, targetCollection, targetPks));
 			}
 			return resultMap;
 		}
+		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -5204,14 +6015,7 @@ var RelationService = class {
 			let parentId;
 			if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
 			else if (relation.direction === "inverse" && relation.cardinality === "one" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
-			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-				resultMap.set(String(parentId), {
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
-			}
+			if (parentId !== void 0 && parentIdSet.has(String(parentId))) resultMap.set(String(parentId), await this.toRelatedRow(targetRow, targetCollection, targetPks));
 		}
 		return resultMap;
 	}
@@ -5225,9 +6029,9 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdInfo = getPrimaryKeys(targetCollection, this.registry)[0];
-		const targetIdField = targetTable[targetIdInfo.fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+		const targetIdField = targetTable[targetPks[0].fieldName];
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
@@ -5249,27 +6053,22 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
-			query = query.where(inArray(parentIdField, parsedParentIds));
+			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const row of results) {
 				const parentRow = row[getTableName$1(parentCollection)] || row;
 				const targetRow = row[targetTableName] || row;
-				const parentId = String(parentRow[parentIdInfo.fieldName]);
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
+				const parentId = buildCompositeId(parentRow, parentPks);
 				const arr = resultMap.get(parentId) || [];
-				arr.push({
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
 				resultMap.set(parentId, arr);
 			}
 			return resultMap;
 		}
 		if (relation.through && relation.cardinality === "many" && relation.direction === "owning") {
+			this.assertSingleKeyAddressable(parentCollection, parentPks, `${relation.through.table}.${relation.through.sourceColumn}`);
 			const junctionTable = this.registry.getTable(relation.through.table);
 			if (!junctionTable) {
 				logger.warn(`[batchFetchRelatedEntitiesMany] Junction table '${relation.through.table}' not found`);
@@ -5288,17 +6087,13 @@ var RelationService = class {
 				const junctionData = row[relation.through.table] || row;
 				const targetData = row[targetTableName] || row;
 				const parentId = String(junctionData[relation.through.sourceColumn]);
-				const parsedValues = await parseDataFromServer(targetData, targetCollection);
 				const arr = resultMap.get(parentId) || [];
-				arr.push({
-					id: String(targetData[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetData, targetCollection, targetPks));
 				resultMap.set(parentId, arr);
 			}
 			return resultMap;
 		}
+		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -5311,14 +6106,9 @@ var RelationService = class {
 			else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
 			else if (relation.direction === "inverse" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
 			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
 				const key = String(parentId);
 				const arr = resultMap.get(key) || [];
-				arr.push({
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
 				resultMap.set(key, arr);
 			}
 		}
@@ -5366,12 +6156,12 @@ var RelationService = class {
 					logger.warn(`Could not determine junction table for relation '${key}' in collection '${collection.slug}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
 				if (targetEntityIds.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedParentId,
@@ -5391,12 +6181,12 @@ var RelationService = class {
 					logger.warn(`Junction columns not found for relation '${key}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
 				if (targetEntityIds.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedParentId,
@@ -5407,7 +6197,7 @@ var RelationService = class {
 			} else if (relation.through && relation.cardinality === "many" && relation.direction === "inverse") logger.warn(`[updateRelationsUsingJoins] Inverse M2M relation '${key}' in collection '${collection.slug}' should be saved from the owning side. Skipping.`);
 			else if (relation.cardinality === "many" && relation.direction === "inverse" && relation.foreignKeyOnTarget) {
 				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
 				const targetIdCol = targetTable[targetIdInfo.fieldName];
 				const fkCol = targetTable[relation.foreignKeyOnTarget];
@@ -5415,7 +6205,7 @@ var RelationService = class {
 					logger.warn(`Invalid inverse-many config for relation '${key}' in collection '${collection.slug}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				if (targetEntityIds.length > 0) {
@@ -5435,9 +6225,9 @@ var RelationService = class {
 			try {
 				const targetCollection = relation.target();
 				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
-				const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
 				if (relation.direction === "inverse" && relation.joinPath && relation.joinPath.length > 0) {
 					await this.updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue);
@@ -5518,12 +6308,12 @@ var RelationService = class {
 					logger.warn(`Could not determine junction columns for inverse joinPath relation '${relation.relationName}'`);
 					return;
 				}
-				const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
 				const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
 				if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = newValue.map((rel) => typeof rel === "object" && rel !== null ? rel.id : rel).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedSourceId,
@@ -5531,7 +6321,7 @@ var RelationService = class {
 					}));
 					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
 				} else if (newValue && !Array.isArray(newValue)) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const parsedTargetId = parseIdValues(typeof newValue === "object" && newValue !== null ? newValue.id : newValue, targetPks)[targetIdInfo.fieldName];
 					const newLink = {
@@ -5562,12 +6352,12 @@ var RelationService = class {
 				logger.warn(`Junction columns not found for relation '${relation.relationName}'`);
 				return;
 			}
-			const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+			const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 			const sourceIdInfo = sourcePks[0];
 			const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
 			await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
 			if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
 				const newLinks = newValue.map((rel) => rel.id).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 					[sourceJunctionColumn.name]: parsedSourceId,
@@ -5588,12 +6378,12 @@ var RelationService = class {
 			const { relation, newTargetId } = upd;
 			const targetCollection = relation.target();
 			const targetTable = getTableForCollection(targetCollection, this.registry);
-			const targetPks = getPrimaryKeys(targetCollection, this.registry);
+			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 			const targetIdInfo = targetPks[0];
 			const targetIdCol = targetTable[targetIdInfo.fieldName];
 			const { targetFKColName, parentSourceColName } = this.resolveJoinPathWriteMapping(parentCollection, relation);
 			const parentTable = getTableForCollection(parentCollection, this.registry);
-			const parentPks = getPrimaryKeys(parentCollection, this.registry);
+			const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 			const parentIdInfo = parentPks[0];
 			const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 			const parentIdCol = parentTable[parentIdInfo.fieldName];
@@ -5664,7 +6454,7 @@ var RelationService = class {
 				logger.warn(`Junction columns not found for relation '${relationKey}'`);
 				return;
 			}
-			const targetPks = getPrimaryKeys(targetCollection, this.registry);
+			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 			const targetIdInfo = targetPks[0];
 			const parsedNewEntityId = parseIdValues(newEntityId, targetPks)[targetIdInfo.fieldName];
 			const junctionData = {
@@ -5678,7 +6468,151 @@ var RelationService = class {
 			throw error;
 		}
 	}
-};
+};
+//#endregion
+//#region src/services/row-pipeline.ts
+/**
+* Whether a many-relation reaches its target through a junction table.
+*
+* Also used to build the drizzle `with` config, which is why it is exported:
+* the query has to nest one level deeper for a junction, and the row walk has
+* to unwrap that same level back out.
+*/
+function isJunctionRelation(relation) {
+	if (relation.through) return true;
+	if (relation.joinPath && relation.joinPath.length > 1) return true;
+	return false;
+}
+/**
+* Reach the target row inside a junction row.
+*
+* A junction row looks like `{ post_id: 1, tag_id: { id: 5, name: "ts" } }` —
+* the foreign keys, and the target nested under one of them. The target is the
+* only object among them, so that is how it is found. A junction row that has
+* not been nested (no `with` on the join) has no object and is returned as-is.
+*/
+function unwrapJunctionRow(item) {
+	const nestedKey = Object.keys(item).find((key) => typeof item[key] === "object" && item[key] !== null && !Array.isArray(item[key]));
+	return nestedKey ? item[nestedKey] : item;
+}
+/**
+* Give back the number a `number` property was declared to be.
+*
+* Postgres returns NUMERIC as a string and drizzle keeps it that way, since a
+* numeric can hold more precision than a double. But the collection declared
+* this property `number` and the OpenAPI spec this server publishes says
+* `type: number`, so serving `"9.99"` breaks its own contract — and breaks it
+* asymmetrically, because a create answers with the number and the read that
+* follows answers with the string. Any client that multiplies a price works
+* until the first refresh.
+*
+* Declaring a property `number` already accepts double precision — that is what
+* the admin has always parsed it to. Columns REST serves that no property
+* declares are left exactly as the database returned them.
+*/
+function coerceDeclaredNumber(value, property) {
+	if (property?.type !== "number" || typeof value !== "string") return value;
+	const parsed = parseFloat(value);
+	return isNaN(parsed) ? null : parsed;
+}
+/** Apply {@link coerceDeclaredNumber} across a row, leaving every other column alone. */
+function coerceDeclaredNumbers(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	const out = {};
+	for (const [key, value] of Object.entries(row)) out[key] = coerceDeclaredNumber(value, properties[key]);
+	return out;
+}
+/** Render one target row in the requested style. */
+/**
+* Drop every column the collection marked `excludeFromApi`.
+*
+* Password hashes and verification tokens have to be readable server-side but
+* must never reach a client — and "never" has to mean every exit from this
+* pipeline, including relation targets, or a secret leaks through whichever
+* path was overlooked. Keyed by both the property name and its column name,
+* since a row can arrive keyed either way depending on the caller.
+*/
+function stripExcluded(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	for (const [key, property] of Object.entries(properties)) {
+		if (!property?.excludeFromApi) continue;
+		delete row[key];
+		if (property.columnName) delete row[property.columnName];
+	}
+	return row;
+}
+function renderTarget(targetRow, targetCollection, style, registry) {
+	if (style === "inline") return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
+	const address = relationTargetAddress(targetRow, targetCollection, registry);
+	const path = targetCollection.slug;
+	return createRelationRefWithData(address, path, {
+		id: address,
+		path,
+		values: normalizeDbValues(targetRow, targetCollection)
+	});
+}
+/**
+* The address a relation ref points at.
+*
+* The whole key, not its first column: a composite-keyed target addressed by
+* `tenant_id` alone points at every row that shares it. A target whose key
+* cannot be resolved at all used to throw here — reading `[0]` of an empty
+* array — taking down the parent's fetch over a relation it may not even have
+* asked for. The first column is a guess, but a ref that resolves to nothing
+* beats no rows at all.
+*/
+function relationTargetAddress(targetRow, targetCollection, registry) {
+	const address = deriveRowAddress(targetRow, targetCollection, registry);
+	if (address) return address;
+	return String(targetRow[Object.keys(targetRow)[0]] ?? "");
+}
+/**
+* The row the admin renders: every column, with relations as references.
+*
+* Values are normalized (dates, numbers, NaN) because the admin's view-model
+* expects real types. The row's own address is *not* among the columns — it is
+* derived by the consumer from the collection's primary keys.
+*/
+function toCmsRow(row, collection, registry) {
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const normalized = normalizeDbValues(row, collection);
+	for (const [key, relation] of Object.entries(resolvedRelations)) {
+		const relData = row[relation.relationName || key];
+		if (relData === void 0 || relData === null) continue;
+		if (relation.cardinality === "many" && Array.isArray(relData)) {
+			const targetCollection = relation.target();
+			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, targetCollection, "ref", registry));
+		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
+	}
+	return stripExcluded(normalized, collection);
+}
+/**
+* The row REST serves: every column under its own name, with the value Postgres
+* returned, and relations inlined as the target's columns.
+*
+* Values are the ones the database returned, except where that contradicts the
+* declared type: a `number` property is served as a number (see
+* {@link coerceDeclaredNumber}). Dates stay as the database returned them —
+* JSON has its own opinions about dates that the admin's view-model does not
+* share.
+*
+* Keyed by the row rather than by the relation list — a REST fetch only loads
+* the relations `include` asked for, so the row is the authority on which are
+* actually there.
+*/
+function toRestRow(row, collection, registry) {
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const flat = {};
+	for (const [key, value] of Object.entries(row)) {
+		const relation = findRelation(resolvedRelations, key);
+		if (relation && Array.isArray(value)) flat[key] = value.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, relation.target(), "inline", registry));
+		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
+		else flat[key] = coerceDeclaredNumber(value, collection.properties?.[key]);
+	}
+	return stripExcluded(flat, collection);
+}
 //#endregion
 //#region src/services/FetchService.ts
 /**
@@ -5738,7 +6672,7 @@ var FetchService = class {
 			if (!shouldInclude(key)) continue;
 			const drizzleRelName = relation.relationName || key;
 			if (relation.joinPath && relation.joinPath.length > 0) continue;
-			if (relation.cardinality === "many" && this.isJunctionRelation(relation, collection)) {
+			if (relation.cardinality === "many" && isJunctionRelation(relation)) {
 				const targetFkName = this.getJunctionTargetRelationName(relation, collection);
 				if (targetFkName) withConfig[drizzleRelName] = { with: { [targetFkName]: true } };
 				else withConfig[drizzleRelName] = true;
@@ -5747,14 +6681,6 @@ var FetchService = class {
 		return withConfig;
 	}
 	/**
-	* Detect if a many-to-many relation uses a junction table in the Drizzle schema.
-	*/
-	isJunctionRelation(relation, _collection) {
-		if (relation.through) return true;
-		if (relation.joinPath && relation.joinPath.length > 1) return true;
-		return false;
-	}
-	/**
 	* Get the Drizzle relation name on the junction table that points to the actual target row.
 	* For example, for posts_tags junction, this returns "tag_id" (the relation pointing to tags).
 	*/
@@ -5763,55 +6689,6 @@ var FetchService = class {
 		return null;
 	}
 	/**
-	* Convert a db.query result row (with nested relation objects) to a flat row.
-	* Handles:
-	* - Placing `id` at the top level as a string
-	* - Type normalization (dates, numbers, NaN) via normalizeDbValues
-	* - Converting nested relation objects to { id, path, __type: "relation" } for CMS
-	* - Flattening junction-table many-to-many results
-	*/
-	drizzleResultToRow(row, collection, _collectionPath, idInfo, _databaseId, idInfoArray) {
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const normalizedValues = normalizeDbValues(row, collection);
-		for (const [key, relation] of Object.entries(resolvedRelations)) {
-			const relData = row[relation.relationName || key];
-			if (relData === void 0 || relData === null) continue;
-			if (relation.cardinality === "many" && Array.isArray(relData)) {
-				const targetCollection = relation.target();
-				const targetPath = targetCollection.slug;
-				const targetIdField = getPrimaryKeys(targetCollection, this.registry)[0].fieldName;
-				normalizedValues[key] = relData.map((item) => {
-					let targetRow = item;
-					if (this.isJunctionRelation(relation, collection)) {
-						const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-						if (nestedKey) targetRow = item[nestedKey];
-					}
-					const relId = String(targetRow[targetIdField] ?? targetRow.id ?? targetRow[Object.keys(targetRow)[0]]);
-					return createRelationRefWithData(relId, targetPath, {
-						id: relId,
-						path: targetPath,
-						values: normalizeDbValues(targetRow, targetCollection)
-					});
-				});
-			} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) {
-				const targetCollection = relation.target();
-				const targetPath = targetCollection.slug;
-				const targetIdField = getPrimaryKeys(targetCollection, this.registry)[0].fieldName;
-				const relObj = relData;
-				const relId = String(relObj[targetIdField] ?? relObj.id ?? relObj[Object.keys(relObj)[0]]);
-				normalizedValues[key] = createRelationRefWithData(relId, targetPath, {
-					id: relId,
-					path: targetPath,
-					values: normalizeDbValues(relObj, targetCollection)
-				});
-			}
-		}
-		return {
-			...normalizedValues,
-			id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
-		};
-	}
-	/**
 	* Post-fetch joinPath relations for a single flat row.
 	* joinPath relations cannot be expressed via Drizzle's `with` config,
 	* so they must be loaded separately after the primary query.
@@ -5832,31 +6709,6 @@ var FetchService = class {
 		await Promise.all(promises);
 	}
 	/**
-	* Post-fetch joinPath relations for a batch of flat rows.
-	* Uses batch fetching to avoid N+1 queries for list views.
-	*/
-	async resolveJoinPathRelationsBatch(rows, collection, collectionPath, idInfo, _databaseId) {
-		if (rows.length === 0) return;
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0);
-		if (joinPathRelations.length === 0) return;
-		for (const [key, relation] of joinPathRelations) try {
-			const rowIds = rows.map((r) => {
-				return parseIdValues(String(r.id), [idInfo])[idInfo.fieldName];
-			});
-			const resultMap = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation);
-			for (const row of rows) {
-				const id = parseIdValues(String(row.id), [idInfo])[idInfo.fieldName];
-				const relatedRow = resultMap.get(String(id));
-				if (relatedRow) {
-					if (relation.cardinality === "one") row[key] = createRelationRefWithData(relatedRow.id, relatedRow.path, relatedRow);
-				}
-			}
-		} catch (e) {
-			logger.warn(`Could not batch resolve joinPath relation '${key}'`, { error: e });
-		}
-	}
-	/**
 	* Resolves joinPath relations for raw REST rows and directly injects them.
 	* Uses RelationService to query the database and maps results back to the flattened objects.
 	*/
@@ -5867,72 +6719,29 @@ var FetchService = class {
 		const shouldInclude = (key) => !include || include.length === 0 || include[0] === "*" || include.includes(key);
 		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0 && propertyKeys.has(key) && shouldInclude(key));
 		if (joinPathRelations.length === 0) return;
-		const idInfo = idInfoArray[0];
+		const parentIdOf = (row) => {
+			const address = buildCompositeId(row, idInfoArray);
+			return address && address.split(":::").some((part) => part !== "") ? address : void 0;
+		};
 		for (const [key, relation] of joinPathRelations) try {
-			const rowIds = rows.map((r) => {
-				return parseIdValues(String(r.id), idInfoArray)[idInfo.fieldName];
-			});
+			const addressable = rows.filter((r) => parentIdOf(r) !== void 0 && parentIdOf(r) !== null);
+			if (addressable.length === 0) continue;
+			const rowIds = addressable.map((r) => parentIdOf(r));
 			if (relation.cardinality === "one") {
 				const resultMap = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation);
-				for (const row of rows) {
-					const id = parseIdValues(String(row.id), idInfoArray)[idInfo.fieldName];
-					const relatedRow = resultMap.get(String(id));
-					if (relatedRow) row[key] = {
-						...relatedRow.values,
-						id: relatedRow.id
-					};
-					else row[key] = null;
+				for (const row of addressable) {
+					const relatedRow = resultMap.get(String(parentIdOf(row)));
+					row[key] = relatedRow ? { ...relatedRow.values } : null;
 				}
 			} else if (relation.cardinality === "many") {
 				const resultMap = await this.relationService.batchFetchRelatedEntitiesMany(collectionPath, rowIds, key, relation);
-				for (const row of rows) {
-					const id = parseIdValues(String(row.id), idInfoArray)[idInfo.fieldName];
-					row[key] = (resultMap.get(String(id)) || []).map((e) => ({
-						...e.values,
-						id: e.id
-					}));
-				}
+				for (const row of addressable) row[key] = (resultMap.get(String(parentIdOf(row))) || []).map((e) => ({ ...e.values }));
 			}
 		} catch (e) {
 			logger.warn(`Could not batch resolve joinPath relation '${key}' for REST`, { error: e });
 		}
 	}
 	/**
-	* Convert a db.query result row to a flat REST-style object with populated relations.
-	*/
-	drizzleResultToRestRow(row, collection, idInfo, idInfoArray) {
-		const flat = { id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName]) };
-		const resolvedRelations = resolveCollectionRelations(collection);
-		for (const [k, v] of Object.entries(row)) {
-			if (k === idInfo.fieldName) continue;
-			const relation = findRelation(resolvedRelations, k);
-			if (Array.isArray(v) && relation) flat[k] = v.map((item) => {
-				if (this.isJunctionRelation(relation, collection)) {
-					const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-					if (nestedKey) {
-						const nested = item[nestedKey];
-						return {
-							...nested,
-							id: String(nested.id ?? nested[Object.keys(nested)[0]])
-						};
-					}
-				}
-				return {
-					...item,
-					id: String(item.id ?? item[Object.keys(item)[0]])
-				};
-			});
-			else if (typeof v === "object" && v !== null && !Array.isArray(v) && relation) {
-				const relObj = v;
-				flat[k] = {
-					...relObj,
-					id: String(relObj.id ?? relObj[Object.keys(relObj)[0]])
-				};
-			} else flat[k] = v;
-		}
-		return flat;
-	}
-	/**
 	* Build db.query-compatible options from standard fetch options.
 	* Handles filter, search, orderBy, limit, and cursor-based pagination.
 	*/
@@ -6002,7 +6811,7 @@ var FetchService = class {
 	async fetchOne(collectionPath, id, databaseId) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
@@ -6016,7 +6825,7 @@ var FetchService = class {
 				with: withConfig
 			});
 			if (!row) return void 0;
-			const flatRow = this.drizzleResultToRow(row, collection, collectionPath, idInfo, databaseId, idInfoArray);
+			const flatRow = toCmsRow(row, collection, this.registry);
 			await this.resolveJoinPathRelations(flatRow, collection, collectionPath, parsedId, databaseId);
 			return flatRow;
 		} catch (e) {
@@ -6058,7 +6867,7 @@ var FetchService = class {
 	async fetchRowsWithConditions(collectionPath, options = {}) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
@@ -6068,7 +6877,7 @@ var FetchService = class {
 		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
 		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0);
-			return (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRow(row, collection, collectionPath, idInfo, options.databaseId, idInfoArray));
+			return (await qb.findMany(queryOpts)).map((row) => toCmsRow(row, collection, this.registry));
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
 				logger.error(`[FetchService] Relation inference error for collection '${collectionPath}': ${e.message}`);
@@ -6129,8 +6938,10 @@ var FetchService = class {
 	}
 	/**
 	* Fallback path used when db.query is unavailable.
-	* The primary path uses drizzleResultToRow which handles relation
-	* mapping without N+1 queries.
+	*
+	* The primary path runs the results through `toCmsRow`, which maps
+	* relations from what drizzle already nested — no query per row. This one
+	* has no nesting to read, so it resolves relations itself, in batches.
 	*
 	* Process raw database results into flat rows with relations.
 	*/
@@ -6139,8 +6950,7 @@ var FetchService = class {
 		const parsedRows = await Promise.all(results.map(async (rawRow) => {
 			return {
 				rawRow,
-				values: await parseDataFromServer(rawRow, collection),
-				id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(rawRow, idInfoArray) : String(rawRow[idInfo.fieldName])
+				values: await parseDataFromServer(rawRow, collection)
 			};
 		}));
 		if (!skipRelations) {
@@ -6180,10 +6990,7 @@ var FetchService = class {
 				logger.warn(`Could not batch load many relation property: ${key}`, { error: e });
 			}
 		}
-		return parsedRows.map((item) => ({
-			...item.values,
-			id: item.id
-		}));
+		return parsedRows.map((item) => item.values);
 	}
 	/**
 	* Fetch a collection of rows
@@ -6214,10 +7021,7 @@ var FetchService = class {
 			const relationKey = pathSegments[i];
 			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
 			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
-			if (i === pathSegments.length - 1) return (await this.relationService.fetchRelatedEntities(currentCollection.slug, currentId, relationKey, options)).map((row) => ({
-				...row.values,
-				id: row.id
-			}));
+			if (i === pathSegments.length - 1) return (await this.relationService.fetchRelatedEntities(currentCollection.slug, currentId, relationKey, options)).map((row) => ({ ...row.values }));
 			if (i + 1 < pathSegments.length) {
 				const nextEntityId = pathSegments[i + 1];
 				currentCollection = relation.target();
@@ -6279,7 +7083,7 @@ var FetchService = class {
 		if (value === void 0 || value === null) return true;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const field = table[fieldName];
@@ -6306,7 +7110,7 @@ var FetchService = class {
 	async fetchCollectionForRest(collectionPath, options = {}, include) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const tableName = getTableName(table);
@@ -6314,7 +7118,7 @@ var FetchService = class {
 		if (qb && !options.searchString && !options.vectorSearch) try {
 			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig);
-			const restRows = (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRestRow(row, collection, idInfo, idInfoArray));
+			const restRows = (await qb.findMany(queryOpts)).map((row) => toRestRow(row, collection, this.registry));
 			await this.resolveJoinPathRelationsBatchRest(restRows, collection, collectionPath, idInfoArray, include);
 			return restRows;
 		} catch (e) {
@@ -6325,10 +7129,7 @@ var FetchService = class {
 			logger.warn(`[fetchCollectionForRest] db.query.findMany failed for ${collectionPath}, falling back`, { error: e });
 		}
 		const rows = await this.fetchRowsWithConditionsRaw(collectionPath, options);
-		if (!include || include.length === 0) return rows.map((row) => ({
-			...row,
-			id: idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
-		}));
+		if (!include || include.length === 0) return rows;
 		const resolvedRelations = resolveCollectionRelations(collection);
 		const propertyKeys = new Set(Object.keys(collection.properties || {}));
 		const shouldInclude = (key) => include[0] === "*" || include.includes(key);
@@ -6340,10 +7141,7 @@ var FetchService = class {
 				for (const row of rows) {
 					const eid = row[idInfo.fieldName];
 					const related = batchResults.get(String(eid));
-					if (related) row[key] = {
-						...related.values,
-						id: related.id
-					};
+					if (related) row[key] = { ...related.values };
 				}
 			} catch (e) {
 				logger.warn(`[include] Failed to batch load one-to-one '${key}'`, { error: e });
@@ -6361,10 +7159,7 @@ var FetchService = class {
 				logger.warn(`[include] Failed to batch load many '${key}'`, { error: e });
 			}
 		}
-		return rows.map((row) => ({
-			...row,
-			id: idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
-		}));
+		return rows;
 	}
 	/**
 	* Fetch a single row with optional relation includes for REST API.
@@ -6372,7 +7167,7 @@ var FetchService = class {
 	async fetchOneForRest(collectionPath, id, include, databaseId) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
@@ -6385,7 +7180,7 @@ var FetchService = class {
 				...withConfig ? { with: withConfig } : {}
 			});
 			if (!row) return null;
-			const restRow = this.drizzleResultToRestRow(row, collection, idInfo, idInfoArray);
+			const restRow = toRestRow(row, collection, this.registry);
 			await this.resolveJoinPathRelationsBatchRest([restRow], collection, collectionPath, idInfoArray, include);
 			return restRow;
 		} catch (e) {
@@ -6397,11 +7192,7 @@ var FetchService = class {
 		}
 		const result = await this.db.select().from(table).where(eq(idField, parsedId)).limit(1);
 		if (result.length === 0) return null;
-		const raw = result[0];
-		const flatEntity = {
-			...raw,
-			id: idInfoArray.length > 1 ? buildCompositeId(raw, idInfoArray) : String(raw[idInfo.fieldName])
-		};
+		const flatEntity = { ...result[0] };
 		if (!include || include.length === 0) return flatEntity;
 		const resolvedRelations = resolveCollectionRelations(collection);
 		const propertyKeys = new Set(Object.keys(collection.properties || {}));
@@ -6434,7 +7225,7 @@ var FetchService = class {
 	async fetchRowsWithConditionsRaw(collectionPath, options = {}) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idField = table[getPrimaryKeys(collection, this.registry)[0].fieldName];
+		const idField = table[requirePrimaryKeys(collection, this.registry)[0].fieldName];
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
 		let query = vectorMeta ? this.db.select({
@@ -6513,32 +7304,15 @@ var FetchService = class {
 				if (orderByField) queryOpts.orderBy = options.order === "asc" ? asc(orderByField) : desc(orderByField);
 			}
 			return (await queryTarget.findMany(queryOpts)).map((row) => {
-				const flat = { id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName]) };
-				for (const [k, v] of Object.entries(row)) {
-					if (k === idInfo.fieldName) continue;
-					if (Array.isArray(v)) flat[k] = v.map((item) => {
-						const keys = Object.keys(item);
-						const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-						if (nestedObj && keys.length <= 3) {
-							const nested = item[nestedObj];
-							return {
-								...nested,
-								id: String(nested.id ?? nested[Object.keys(nested)[0]])
-							};
-						}
-						return {
-							...item,
-							id: String(item.id ?? item[Object.keys(item)[0]])
-						};
-					});
-					else if (typeof v === "object" && v !== null) {
-						const relObj = v;
-						flat[k] = {
-							...relObj,
-							id: String(relObj.id ?? relObj[Object.keys(relObj)[0]])
-						};
-					} else flat[k] = v;
-				}
+				const flat = {};
+				for (const [k, v] of Object.entries(row)) if (Array.isArray(v)) flat[k] = v.map((item) => {
+					const keys = Object.keys(item);
+					const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
+					if (nestedObj && keys.length <= 3) return { ...item[nestedObj] };
+					return { ...item };
+				});
+				else if (typeof v === "object" && v !== null) flat[k] = { ...v };
+				else flat[k] = v;
 				return flat;
 			});
 		} catch (e) {
@@ -6754,6 +7528,27 @@ var PersistService = class {
 		this.fetchService = new FetchService(db, registry);
 	}
 	/**
+	* Explain a write that matched no rows.
+	*
+	* Row-level security filters UPDATE and DELETE through the policy's USING
+	* clause instead of raising: a denied write is reported by Postgres exactly
+	* like a successful one that happened to match nothing. Left unchecked, a
+	* caller cannot tell "denied" from "done" — the write returns 200/204 and
+	* the row is untouched.
+	*
+	* Re-reading the target over the *same* RLS-scoped handle separates the two
+	* cases. A visible row means the policy rejected the write (403); an
+	* invisible one means there is nothing there to write for this caller (404,
+	* matching what a GET would say). The re-read is bound by the caller's own
+	* policies, so it discloses nothing a plain read wouldn't.
+	*
+	* Only reached when zero rows matched, so the happy path pays nothing.
+	*/
+	async explainZeroRowWrite(handle, table, conditions, collectionPath, id, operation) {
+		if ((await handle.select({ present: sql`1` }).from(table).where(and(...conditions)).limit(1)).length > 0) return ApiError.forbidden(`Not allowed to ${operation} "${id}" in "${collectionPath}": a row-level security policy rejected the write.`, "WRITE_DENIED");
+		return ApiError.notFound(`No row "${id}" in "${collectionPath}" to ${operation}.`);
+	}
+	/**
 	* Delete an row by ID
 	*/
 	async delete(collectionPath, id, _databaseId) {
@@ -6767,7 +7562,7 @@ var PersistService = class {
 			if (!field) throw new Error(`ID field '${info.fieldName}' not found in table for collection '${collectionPath}'`);
 			conditions.push(eq(field, parsedIdObj[info.fieldName]));
 		}
-		await this.db.delete(table).where(and(...conditions));
+		if (((await this.db.delete(table).where(and(...conditions))).rowCount ?? 0) === 0) throw await this.explainZeroRowWrite(this.db, table, conditions, collectionPath, id, "delete");
 	}
 	/**
 	* Delete all rows from a collection
@@ -6778,8 +7573,14 @@ var PersistService = class {
 	}
 	/**
 	* Save an row (create or update)
+	*
+	* With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
+	* UPDATE against the primary key rather than a plain UPDATE. That is one
+	* statement, so it cannot lose a race the way a read-then-write can, and it
+	* does not care whether the row already exists — which is what a re-runnable
+	* import needs.
 	*/
-	async save(collectionPath, values, id, databaseId) {
+	async save(collectionPath, values, id, databaseId, options) {
 		let effectiveCollectionPath = collectionPath;
 		const effectiveValues = { ...values };
 		let junctionTableInfo;
@@ -6870,7 +7671,7 @@ var PersistService = class {
 			const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
 			savedId = await this.db.transaction(async (tx) => {
 				let currentId;
-				if (id) {
+				if (id && !options?.upsert) {
 					currentId = id;
 					const idValues = parseIdValues(id, idInfoArray);
 					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
@@ -6881,13 +7682,28 @@ var PersistService = class {
 							const field = table[info.fieldName];
 							conditions.push(eq(field, idValues[info.fieldName]));
 						}
-						await updateQuery.where(and(...conditions));
+						if (((await updateQuery.where(and(...conditions))).rowCount ?? 0) === 0) throw await this.explainZeroRowWrite(tx, table, conditions, effectiveCollectionPath, currentId, "update");
 					}
 				} else {
 					const dataForInsert = { ...entityData };
+					if (id && options?.upsert) Object.assign(dataForInsert, parseIdValues(id, idInfoArray));
 					for (const info of idInfoArray) if (dataForInsert[info.fieldName] === "" || dataForInsert[info.fieldName] === null || dataForInsert[info.fieldName] === void 0) delete dataForInsert[info.fieldName];
-					const resultRow = (await tx.insert(table).values(dataForInsert).returning(returningKeys))[0];
-					currentId = buildCompositeId(resultRow, idInfoArray);
+					const insertQuery = tx.insert(table).values(dataForInsert);
+					const hasFullKey = idInfoArray.length > 0 && idInfoArray.every((info) => dataForInsert[info.fieldName] !== void 0);
+					let result;
+					if (options?.upsert && hasFullKey) {
+						const target = idInfoArray.map((info) => table[info.fieldName]);
+						const set = { ...dataForInsert };
+						for (const info of idInfoArray) delete set[info.fieldName];
+						result = Object.keys(set).length > 0 ? await insertQuery.onConflictDoUpdate({
+							target,
+							set
+						}).returning(returningKeys) : await insertQuery.onConflictDoNothing({ target }).returning(returningKeys);
+					} else result = await insertQuery.returning(returningKeys);
+					const resultRow = result[0];
+					if (!resultRow) if (id) currentId = id;
+					else throw ApiError.forbidden(`Not allowed to write to "${effectiveCollectionPath}": the row was rejected by a row-level security policy.`, "WRITE_DENIED");
+					else currentId = buildCompositeId(resultRow, idInfoArray);
 					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
 				}
 				if (inverseRelationUpdates.length > 0) await this.relationService.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
@@ -6898,7 +7714,7 @@ var PersistService = class {
 		} catch (error) {
 			throw this.toUserFriendlyError(error, collection.slug);
 		}
-		const finalEntity = await this.fetchService.fetchOne(collection.slug, savedId, databaseId);
+		const finalEntity = await this.fetchService.fetchOneForRest(collection.slug, savedId, void 0, databaseId);
 		if (!finalEntity) throw new Error("Could not fetch row after save.");
 		return finalEntity;
 	}
@@ -6918,6 +7734,7 @@ var PersistService = class {
 	* Translate raw PostgreSQL / Drizzle errors into user-friendly messages.
 	*/
 	toUserFriendlyError(error, collectionSlug) {
+		if (error instanceof ApiError || error?.name === "ApiError") return error;
 		const pgError = extractPgError(error);
 		if (pgError) {
 			const { message } = pgErrorToFriendlyMessage(pgError, collectionSlug);
@@ -6995,8 +7812,8 @@ var DataService = class {
 	/**
 	* Save an row (create or update)
 	*/
-	async save(collectionPath, values, id, databaseId) {
-		return this.persistService.save(collectionPath, values, id, databaseId);
+	async save(collectionPath, values, id, databaseId, options) {
+		return this.persistService.save(collectionPath, values, id, databaseId, options);
 	}
 	/**
 	* Delete an row by ID
@@ -7064,6 +7881,26 @@ var DataService = class {
 */
 /** Internal prefix applied to branch database names to avoid collisions. */
 var BRANCH_DB_PREFIX = "rb_";
+/** `duplicate_database` — the target database name is already taken. */
+var PG_DUPLICATE_DATABASE = "42P04";
+/** `object_in_use` — the database still has connections attached. */
+var PG_OBJECT_IN_USE = "55006";
+/**
+* Describe a failed branch DDL statement in terms a user can act on.
+*
+* Drizzle reports failures as `Failed query: <sql> params:` and hides the real
+* PostgreSQL error in the `cause` chain, so matching on `err.message` never sees
+* the actual problem. Match on the PG error code instead — it survives wrapping
+* and, unlike the message text, is not locale-dependent.
+*/
+function describeBranchDdlError(err, fallbackContext) {
+	const pgError = extractPgError(err);
+	if (pgError?.code === PG_DUPLICATE_DATABASE) return /* @__PURE__ */ new Error(`Database "${fallbackContext}" already exists on the server. Choose a different branch name.`);
+	if (pgError?.code === PG_OBJECT_IN_USE) return /* @__PURE__ */ new Error(`Cannot complete the operation: the database "${fallbackContext}" has active connections. Close other clients or connections and try again.`);
+	const detail = pgError?.message ?? extractCauseMessage(err);
+	if (detail) return new Error(detail);
+	return err instanceof Error ? err : new Error(String(err));
+}
 /** Fully-qualified metadata table in the rebase schema. */
 var BRANCHES_TABLE = "rebase.branches";
 /**
@@ -7132,10 +7969,8 @@ var BranchService = class {
 		try {
 			await this.db.execute(sql.raw(`CREATE DATABASE "${safeDbName}" TEMPLATE "${safeSourceDb}"`));
 		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			if (msg.includes("already exists")) throw new Error(`Database "${dbName}" already exists on the server. Choose a different branch name.`);
-			if (msg.includes("being accessed by other users")) throw new Error(`Cannot create branch: the source database "${sourceDb}" has active connections. Close other clients or connections and try again.`);
-			throw err;
+			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot create branch: the source database "${sourceDb}" has active connections. Close other clients or connections and try again.`);
+			throw describeBranchDdlError(err, dbName);
 		}
 		const now = /* @__PURE__ */ new Date();
 		await this.db.execute(sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at) 
@@ -7160,8 +7995,8 @@ var BranchService = class {
 		try {
 			await this.db.execute(sql.raw(`DROP DATABASE "${safeDbName}"`));
 		} catch (err) {
-			if ((err instanceof Error ? err.message : String(err)).includes("being accessed by other users")) throw new Error(`Cannot delete branch "${sanitizedName}": the database has active connections. Close other clients and try again.`);
-			throw err;
+			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot delete branch "${sanitizedName}": the database has active connections. Close other clients and try again.`);
+			throw describeBranchDdlError(err, dbName);
 		}
 		await this.db.execute(sql`DELETE FROM rebase.branches WHERE name = ${sanitizedName}`);
 	}
@@ -7347,7 +8182,7 @@ async function ensureAppRole(run, schemas) {
 * SECURITY: this function is only ever called on the **user** path (the server
 * context uses the base/owner driver and never calls it). The default policies
 * treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`
-* is `NULLIF(current_setting('app.user_id'), '')` — so an EMPTY user id would
+* is `NULLIF(current_setting('app.uid'), '')` — so an EMPTY user id would
 * be read as NULL and silently escalate a user request to server privileges.
 * Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,
 * rather than trusting every caller (e.g. realtime subscription auth) to do it.
@@ -7355,14 +8190,15 @@ async function ensureAppRole(run, schemas) {
 * semantics: it is why `auth.uid() IS NOT NULL` is true for anonymous requests.
 */
 async function applyAuthContext(tx, auth, userRole) {
-	const userId = typeof auth.userId === "string" && auth.userId.trim() !== "" ? auth.userId : ANONYMOUS_USER_ID;
+	const uid = typeof auth.uid === "string" && auth.uid.trim() !== "" ? auth.uid : ANONYMOUS_USER_ID;
 	const normalizedRoles = auth.roles.map((r) => typeof r === "string" ? r : r?.id ?? String(r));
 	await tx.execute(sql`
         SELECT
-            set_config('app.user_id', ${userId}, true),
+            set_config('app.uid', ${uid}, true),
+            set_config('app.user_id', ${uid}, true),
             set_config('app.user_roles', ${normalizedRoles.join(",")}, true),
             set_config('app.jwt', ${JSON.stringify({
-		sub: userId,
+		sub: uid,
 		roles: auth.roles
 	})}, true)
     `);
@@ -7508,6 +8344,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			executeSql: (...args) => this.executeSql(...args),
 			fetchAvailableDatabases: () => this.fetchAvailableDatabases(),
 			fetchAvailableRoles: () => this.fetchAvailableRoles(),
+			fetchApplicationRoles: () => this.fetchApplicationRoles(),
 			fetchCurrentDatabase: () => this.fetchCurrentDatabase(),
 			fetchUnmappedTables: (...args) => this.fetchUnmappedTables(...args),
 			fetchTableMetadata: (...args) => this.fetchTableMetadata(...args),
@@ -7793,17 +8630,19 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			this.realtimeService.subscriptions.delete(subscriptionId);
 		};
 	}
-	async save({ path, id, values, collection, status }) {
+	async save({ path, id, values, collection, status, upsert }) {
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
 		let previousValuesForHistory;
-		if (status === "existing" && id) {
-			const existing = await this.dataService.fetchOne(path, id, resolvedCollection?.databaseId);
+		if (status === "existing" && id) try {
+			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
 			if (existing) {
 				const { id: _existingId, ...existingValues } = existing;
 				previousValuesForHistory = existingValues;
 			}
+		} catch (err) {
+			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
 		}
 		if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
 			if (globalCallbacks?.beforeSave) {
@@ -7850,7 +8689,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			timestampNowValue: /* @__PURE__ */ new Date()
 		});
 		try {
-			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId);
+			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, { upsert });
 			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
 				if (globalCallbacks?.afterRead) savedRow = await globalCallbacks.afterRead({
 					collection: resolvedCollection,
@@ -7871,8 +8710,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 					context: contextForCallback
 				});
 			}
-			const savedId = savedRow.id;
-			const { id: _savedId, ...savedValues } = savedRow;
+			const savedId = deriveRowAddress(savedRow, resolvedCollection ?? collection, this.registry);
+			const savedValues = savedRow;
 			if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
 				if (globalCallbacks?.afterSave) await globalCallbacks.afterSave({
 					collection: resolvedCollection,
@@ -7904,7 +8743,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			}
 			if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
 				tableName: path,
-				id: savedId.toString(),
+				id: savedId,
 				action: status === "new" ? "create" : "update",
 				values: savedValues,
 				previousValues: previousValuesForHistory,
@@ -7912,11 +8751,11 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			});
 			if (this._deferNotifications) this._pendingNotifications.push({
 				path,
-				id: savedId.toString(),
+				id: savedId,
 				row: savedRow,
 				databaseId: resolvedCollection?.databaseId
 			});
-			else await this.realtimeService.notifyUpdate(path, savedId.toString(), savedRow, resolvedCollection?.databaseId);
+			else await this.realtimeService.notifyUpdate(path, savedId, savedRow, resolvedCollection?.databaseId);
 			return savedRow;
 		} catch (error) {
 			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
@@ -7951,12 +8790,52 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			throw error;
 		}
 	}
+	/**
+	* Write many rows through the same pipeline as {@link save}.
+	*
+	* The batch runs in one transaction of its own, so a failure part-way leaves
+	* nothing behind — the point of a batch is that a re-run starts from a known
+	* state. When this driver is already inside a transaction (the authenticated
+	* path, via `withTransaction`) the nested call becomes a savepoint, which is
+	* still atomic and still commits once.
+	*
+	* Rows are applied in order, so a batch that touches the same key twice ends
+	* with the last write winning, exactly as separate calls would.
+	*/
+	async saveMany({ path, rows, collection, upsert }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < rows.length; i++) {
+				const values = rows[i];
+				const id = values?.id;
+				try {
+					saved.push(await txDriver.save({
+						path,
+						values,
+						collection,
+						status: "new",
+						upsert
+					}));
+				} catch (error) {
+					const label = id !== void 0 ? `id ${JSON.stringify(id)}` : "no id";
+					throw Object.assign(new Error(`Row ${i} of ${rows.length} (${label}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return saved;
+		});
+	}
 	async delete({ row, collection }) {
 		const targetPath = row.path;
-		const targetRow = {
-			id: row.id,
-			...row.values ?? {}
-		};
+		const targetRow = { ...row.values ?? {} };
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, targetPath);
 		const contextForCallback = this.buildCallContext();
 		if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
@@ -8119,6 +8998,45 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	async fetchAvailableRoles() {
 		return (await this.executeSql("SELECT rolname FROM pg_roles WHERE pg_has_role(current_user, rolname, 'member') ORDER BY rolname;")).map((r) => r.rolname);
 	}
+	/**
+	* Application-level roles actually in use in this project.
+	*
+	* Distinct from {@link fetchAvailableRoles}, which returns native
+	* PostgreSQL roles from `pg_roles` (`postgres`, `rebase_user`, …). Those
+	* are the roles the SQL editor can `SET ROLE` to. *These* are the strings
+	* held in the users table's `roles` column, injected per-transaction as
+	* `auth.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
+	* into a `SecurityRule.roles` field produces a condition no user can ever
+	* satisfy, so the two must not be conflated.
+	*
+	* Roles have no registry table — they were migrated out of
+	* `rebase.user_roles` onto an inline `roles TEXT[]` column — so the live
+	* set is derived from what is assigned. A role that is declared in a policy
+	* but held by nobody yet cannot be discovered here; callers that need it
+	* should union in the roles they already know about.
+	*/
+	async fetchApplicationRoles() {
+		const located = await this.executeSql(`
+            SELECT table_schema, table_name
+            FROM information_schema.columns
+            WHERE column_name = 'roles'
+              AND data_type = 'ARRAY'
+              AND table_name = 'users'
+              AND table_schema NOT IN ('information_schema', 'pg_catalog')
+            ORDER BY (table_schema = 'rebase') DESC, table_schema
+            LIMIT 1;
+        `);
+		if (located.length === 0) return [];
+		const schema = located[0].table_schema;
+		const table = located[0].table_name;
+		const qualified = `"${schema.replace(/"/g, "\"\"")}"."${table.replace(/"/g, "\"\"")}"`;
+		return (await this.executeSql(`
+            SELECT DISTINCT unnest(roles) AS role
+            FROM ${qualified}
+            WHERE roles IS NOT NULL
+            ORDER BY role;
+        `)).map((r) => r.role).filter((r) => typeof r === "string" && r.length > 0);
+	}
 	async fetchCurrentDatabase() {
 		return this.poolManager?.defaultDatabaseName;
 	}
@@ -8260,15 +9178,15 @@ var AuthenticatedPostgresBackendDriver = class {
 	async withTransaction(operation, options) {
 		const pendingNotifications = [];
 		const result = await this.delegate.db.transaction(async (tx) => {
-			let userId = this.user?.uid;
-			if (!userId) {
+			let uid = this.user?.uid;
+			if (!uid) {
 				logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
-				userId = "anonymous";
+				uid = "anonymous";
 			}
 			const userRoles = this.user?.roles ?? [];
 			if (!this.user?.roles) logger.warn("[DataDriver] User roles are missing for authenticated delegate. Using empty array. User object", { detail: this.user });
 			await applyAuthContext(tx, {
-				userId,
+				uid,
 				roles: userRoles
 			}, this.delegate.rlsUserRole);
 			const txEntityService = new DataService(tx, this.delegate.registry);
@@ -8295,7 +9213,7 @@ var AuthenticatedPostgresBackendDriver = class {
 	*/
 	injectAuthContext(unsubscribe) {
 		const authContext = {
-			userId: this.user?.uid || "anonymous",
+			uid: this.user?.uid || "anonymous",
 			roles: this.user?.roles ?? []
 		};
 		const entries = Array.from(this.delegate.realtimeService.subscriptions.entries());
@@ -8315,6 +9233,18 @@ var AuthenticatedPostgresBackendDriver = class {
 	async save(props) {
 		return this.withTransaction((delegate) => delegate.save(props));
 	}
+	/**
+	* One transaction for the whole batch, rather than one per row.
+	*
+	* This is the point of the method: `save` opens a transaction per call, so
+	* importing 10k rows through it means 10k transactions (and, over HTTP, 10k
+	* round trips). Here the RLS context is established once and every row lands
+	* or none does. Realtime notifications are already deferred to commit by
+	* `withTransaction`, so a batch does not flood subscribers mid-flight.
+	*/
+	async saveMany(props) {
+		return this.withTransaction((delegate) => delegate.saveMany(props));
+	}
 	async delete(props) {
 		return this.withTransaction((delegate) => delegate.delete(props));
 	}
@@ -8364,6 +9294,7 @@ var DatabasePoolManager = class {
 		pool.on("error", (err) => {
 			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
 		});
+		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 		this.pools.set(databaseName, pool);
 		return pool;
 	}
@@ -8426,19 +9357,19 @@ function createAuthSchema(usersSchemaName = "rebase") {
 	*/
 	const refreshTokens = tableCreator("refresh_tokens", {
 		id: uuid("id").defaultRandom().primaryKey(),
-		userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 		tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
 		expiresAt: timestamp("expires_at").notNull(),
 		userAgent: varchar("user_agent", { length: 500 }),
 		ipAddress: varchar("ip_address", { length: 45 }),
 		createdAt: timestamp("created_at").defaultNow().notNull()
-	}, (table) => ({ uniqueDeviceSession: unique("unique_device_session").on(table.userId, table.userAgent, table.ipAddress) }));
+	}, (table) => ({ uniqueDeviceSession: unique("unique_device_session").on(table.uid, table.userAgent, table.ipAddress) }));
 	/**
 	* Password reset tokens for forgot password flow
 	*/
 	const passwordResetTokens = tableCreator("password_reset_tokens", {
 		id: uuid("id").defaultRandom().primaryKey(),
-		userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 		tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
 		expiresAt: timestamp("expires_at").notNull(),
 		usedAt: timestamp("used_at"),
@@ -8457,7 +9388,7 @@ function createAuthSchema(usersSchemaName = "rebase") {
 	*/
 	const userIdentities = tableCreator("user_identities", {
 		id: uuid("id").defaultRandom().primaryKey(),
-		userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 		provider: varchar("provider", { length: 50 }).notNull(),
 		providerId: varchar("provider_id", { length: 255 }).notNull(),
 		profileData: jsonb("profile_data"),
@@ -8469,7 +9400,7 @@ function createAuthSchema(usersSchemaName = "rebase") {
 	*/
 	const mfaFactors = tableCreator("mfa_factors", {
 		id: uuid("id").defaultRandom().primaryKey(),
-		userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 		factorType: varchar("factor_type", { length: 20 }).notNull(),
 		secretEncrypted: varchar("secret_encrypted", { length: 500 }).notNull(),
 		friendlyName: varchar("friendly_name", { length: 255 }),
@@ -8495,14 +9426,14 @@ function createAuthSchema(usersSchemaName = "rebase") {
 		}),
 		recoveryCodes: tableCreator("recovery_codes", {
 			id: uuid("id").defaultRandom().primaryKey(),
-			userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 			codeHash: varchar("code_hash", { length: 255 }).notNull(),
 			usedAt: timestamp("used_at"),
 			createdAt: timestamp("created_at").defaultNow().notNull()
 		}),
 		magicLinkTokens: tableCreator("magic_link_tokens", {
 			id: uuid("id").defaultRandom().primaryKey(),
-			userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+			uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
 			tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
 			expiresAt: timestamp("expires_at").notNull(),
 			usedAt: timestamp("used_at"),
@@ -8530,135 +9461,36 @@ var usersRelations = relations(users, ({ many }) => ({
 	magicLinkTokens: many(magicLinkTokens)
 }));
 var refreshTokensRelations = relations(refreshTokens, ({ one }) => ({ user: one(users, {
-	fields: [refreshTokens.userId],
-	references: [users.id]
-}) }));
-var passwordResetTokensRelations = relations(passwordResetTokens, ({ one }) => ({ user: one(users, {
-	fields: [passwordResetTokens.userId],
-	references: [users.id]
-}) }));
-var userIdentitiesRelations = relations(userIdentities, ({ one }) => ({ user: one(users, {
-	fields: [userIdentities.userId],
-	references: [users.id]
-}) }));
-var mfaFactorsRelations = relations(mfaFactors, ({ one, many }) => ({
-	user: one(users, {
-		fields: [mfaFactors.userId],
-		references: [users.id]
-	}),
-	challenges: many(mfaChallenges)
-}));
-var mfaChallengesRelations = relations(mfaChallenges, ({ one }) => ({ factor: one(mfaFactors, {
-	fields: [mfaChallenges.factorId],
-	references: [mfaFactors.id]
-}) }));
-var recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({ user: one(users, {
-	fields: [recoveryCodes.userId],
-	references: [users.id]
-}) }));
-var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user: one(users, {
-	fields: [magicLinkTokens.userId],
-	references: [users.id]
-}) }));
-//#endregion
-//#region src/schema/auth-default-policies.ts
-/**
-* Default RLS policies injected by the schema generator.
-*
-* Rebase's enforcement model is unified: authenticated (user-context) requests
-* run under the restricted `rebase_user` role, so Postgres RLS binds *every*
-* statement — reads and writes. A collection's `securityRules` are the whole
-* authorization model. The server context (auth flows, migrations,
-* `dataAsAdmin`) runs as the owner and bypasses RLS.
-*
-* Because RLS default-denies, every collection is **locked by default**: with
-* no rules, only the server context and admins can touch it. The generator
-* injects that safe baseline:
-*
-* **For every collection**
-*  1. A permissive **server-or-admin SELECT** grant.
-*  2. A permissive **server-or-admin write** grant (insert/update/delete).
-*
-* Author `securityRules` are permissive and OR together, so explicit rules only
-* *broaden* access from this locked baseline (e.g. "users read/write their own
-* rows").
-*
-* **For auth collections additionally**
-*  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
-*     their own row (profile, session bootstrap) without every app re-declaring
-*     it.
-*  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
-*     every other policy, so a write is rejected unless the caller is an admin
-*     (or the server context) — even if the author also wrote a permissive rule
-*     such as "a user may edit their own row". Without this, a permissive owner
-*     rule would let a user change their own `roles`.
-*
-* The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
-* — the built-in flows that run without a user (signup, migrations) set no user
-* GUC — which also lets the owner connection satisfy these policies even under
-* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
-* `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
-*
-* Opt out with `disableDefaultPolicies: true` to take full responsibility for
-* the collection's RLS.
-*/
-var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
-/** Write operations that must be admin-gated by default on auth collections. */
-var DEFAULT_GUARDED_OPS = [
-	"insert",
-	"update",
-	"delete"
-];
-/** Whether a collection is flagged as an authentication collection. */
-function isAuthCollection(collection) {
-	const auth = collection.auth;
-	return auth === true || typeof auth === "object" && auth?.enabled === true;
-}
-/** The property marked as the row id (falls back to `id`). */
-function getIdPropertyName(collection) {
-	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
-	return "id";
-}
-/**
-* Returns the security rules that should be applied to a collection: the
-* author's explicit `securityRules` plus the framework defaults described in
-* the module doc (baseline server/admin read for all collections; self-read
-* and the admin write gate for auth collections).
-*
-* Collections that opt out via `disableDefaultPolicies` are returned unchanged.
-*/
-function getEffectiveSecurityRules(collection) {
-	const explicit = [...(isPostgresCollectionConfig(collection) ? collection.securityRules : void 0) ?? []];
-	if (collection.disableDefaultPolicies) return explicit;
-	const tableName = getTableName$1(collection);
-	const injected = [];
-	injected.push({
-		name: `${tableName}_default_admin_read`,
-		operations: ["select"],
-		condition: SERVER_OR_ADMIN_EXPR
-	});
-	injected.push({
-		name: `${tableName}_default_admin_write`,
-		operations: [...DEFAULT_GUARDED_OPS],
-		condition: SERVER_OR_ADMIN_EXPR,
-		check: SERVER_OR_ADMIN_EXPR
-	});
-	if (isAuthCollection(collection)) {
-		injected.push({
-			name: `${tableName}_default_self_read`,
-			operations: ["select"],
-			condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
-		});
-		injected.push({
-			name: `${tableName}_require_admin_write`,
-			mode: "restrictive",
-			operations: [...DEFAULT_GUARDED_OPS],
-			condition: SERVER_OR_ADMIN_EXPR,
-			check: SERVER_OR_ADMIN_EXPR
-		});
-	}
-	return [...explicit, ...injected];
-}
+	fields: [refreshTokens.uid],
+	references: [users.id]
+}) }));
+var passwordResetTokensRelations = relations(passwordResetTokens, ({ one }) => ({ user: one(users, {
+	fields: [passwordResetTokens.uid],
+	references: [users.id]
+}) }));
+var userIdentitiesRelations = relations(userIdentities, ({ one }) => ({ user: one(users, {
+	fields: [userIdentities.uid],
+	references: [users.id]
+}) }));
+var mfaFactorsRelations = relations(mfaFactors, ({ one, many }) => ({
+	user: one(users, {
+		fields: [mfaFactors.uid],
+		references: [users.id]
+	}),
+	challenges: many(mfaChallenges)
+}));
+var mfaChallengesRelations = relations(mfaChallenges, ({ one }) => ({ factor: one(mfaFactors, {
+	fields: [mfaChallenges.factorId],
+	references: [mfaFactors.id]
+}) }));
+var recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({ user: one(users, {
+	fields: [recoveryCodes.uid],
+	references: [users.id]
+}) }));
+var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user: one(users, {
+	fields: [magicLinkTokens.uid],
+	references: [users.id]
+}) }));
 //#endregion
 //#region src/schema/generate-drizzle-schema-logic.ts
 /**
@@ -8857,31 +9689,12 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 * Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
 */
 var wrapSql = (clause) => `sql\`${clause}\``;
-/**
-* Generates a deterministic hash based on the rule configuration.
-*/
-var getPolicyNameHash = (rule) => {
-	const data = JSON.stringify({
-		a: rule.access,
-		m: rule.mode,
-		op: rule.operation,
-		ops: rule.operations?.slice().sort(),
-		own: rule.ownerField,
-		rol: rule.roles?.slice().sort(),
-		pg: rule.pgRoles?.slice().sort(),
-		u: rule.using,
-		w: rule.withCheck,
-		c: rule.condition,
-		ch: rule.check
-	});
-	return createHash("sha1").update(data).digest("hex").substring(0, 7);
-};
 var generatePolicyCode = (collection, rule, index, resolveCollection) => {
 	const tableName = getTableName$1(collection);
 	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
-	const ruleHash = getPolicyNameHash(rule);
+	const policyNames = getPolicyNamesForRule(rule, tableName);
 	return ops.map((op, opIdx) => {
-		return generateSinglePolicyCode(collection, rule, op, rule.name ? ops.length > 1 ? `${rule.name}_${op}` : rule.name : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`, resolveCollection);
+		return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
 	}).join("");
 };
 /**
@@ -9010,6 +9823,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 		});
 	});
 	schemaContent += "\n";
+	const junctionSpecs = resolveJunctionSpecs(collections);
 	for (const collection of collections) {
 		const tableName = getTableName$1(collection);
 		if (tableName) allTablesToGenerate.set(tableName, { collection });
@@ -9043,9 +9857,17 @@ var generateSchema = async (collections, stripPolicies = false) => {
 			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
 			schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
 			schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(targetCollection))}.${targetId}, ${refOptions}),\n`;
-			schemaContent += "}, (table) => ({\n";
-			schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
-			schemaContent += "}));\n\n";
+			schemaContent += "}, (table) => ([\n";
+			schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
+			const junctionSpec = junctionSpecs.get(baseTableName);
+			if (!stripPolicies && junctionSpec) {
+				const junctionCollection = getJunctionCollectionConfig(junctionSpec);
+				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
+				getJunctionSecurityRules(junctionSpec).forEach((rule, idx) => {
+					schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
+				});
+			}
+			schemaContent += "])).enableRLS();\n\n";
 		} else if (!isJunction) {
 			const schema = isPostgresCollectionConfig(collection) ? collection.schema : void 0;
 			const tableCreator = schema ? `${schema}Schema.table` : "pgTable";
@@ -9499,6 +10321,267 @@ var CdcListener = class CdcListener {
 	}
 };
 //#endregion
+//#region src/services/channel-history.ts
+/**
+* Ordered, replayable per-channel message history.
+*
+* Broadcast on its own is fire-and-forget to whoever is connected at the
+* instant it is sent: fine for presence and for "someone saved" notifications,
+* not enough for op-based collaborative editing, where a client that blinks
+* out for two seconds has to resync a whole document rather than catch up on
+* the four operations it missed. This adds the missing half — every retained
+* broadcast gets a per-channel sequence number, and a client can ask for
+* everything after the last one it saw.
+*
+* Three decisions worth stating, because each rules out a simpler-looking one:
+*
+*  - **Retention is server-side and opt-in.** A channel is created by whoever
+*    names it, so a client-supplied history depth would let any visitor commit
+*    the backend to unbounded storage. And presence channels — the common case
+*    — must not pay for this: with no rules configured nothing is written, no
+*    table is created, and `broadcast` runs exactly the code it ran before.
+*
+*  - **Sequence numbers come from the database, not from a counter in this
+*    process.** They have to survive a restart and be shared across instances;
+*    an in-memory counter would restart at 1 after a deploy and hand a
+*    reconnecting client a replay from the wrong era, silently.
+*
+*  - **The cursor row outlives the messages it numbered.** Pruning is what
+*    makes retention affordable, but pruning the cursor along with the messages
+*    would restart the sequence and make `sinceSeq` mean something different
+*    before and after — the worst kind of bug, because replay would still
+*    return rows and they would look plausible. Cursors are tiny and are kept
+*    forever; see {@link prune}, which touches only `channel_messages`.
+*/
+/** How many messages a replay returns when the caller does not say. */
+var DEFAULT_REPLAY_LIMIT = 200;
+/**
+* Hard ceiling on one replay, whatever the caller asks for.
+*
+* A reconnecting client names its own `limit`, so this is the only thing
+* standing between a stale `sinceSeq` and a single frame carrying a channel's
+* entire retained history. A client that is further behind than this is told so
+* via `latestSeq` and can decide to resync wholesale instead of paging.
+*/
+var MAX_REPLAY_LIMIT = 1e3;
+/** Minimum gap between two prunes of the same channel. */
+var PRUNE_THROTTLE_MS = 3e4;
+/**
+* Parse a retention TTL into milliseconds.
+*
+* Accepts a raw millisecond count or a short duration string (`"30s"`, `"15m"`,
+* `"24h"`, `"7d"`). Returns undefined for anything unparseable, which the
+* caller treats as "no TTL" — a misspelt duration must not silently become an
+* aggressive one.
+*/
+function parseTtlMs(ttl) {
+	if (ttl === void 0 || ttl === null) return void 0;
+	if (typeof ttl === "number") return Number.isFinite(ttl) && ttl > 0 ? ttl : void 0;
+	const match = /^\s*(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)\s*$/i.exec(ttl);
+	if (!match) {
+		logger.warn(`⚠️ [ChannelHistory] Ignoring unparseable retention ttl "${ttl}" — expected e.g. "30s", "15m", "24h", "7d".`);
+		return;
+	}
+	const value = parseFloat(match[1]);
+	const unit = match[2].toLowerCase();
+	const ms = value * (unit === "ms" ? 1 : unit === "s" ? 1e3 : unit === "m" ? 6e4 : unit === "h" ? 36e5 : 864e5);
+	return ms > 0 ? ms : void 0;
+}
+/**
+* Whether `channel` is covered by `rule`.
+*
+* Exact match, or a trailing `*` acting as a prefix. Not a general glob: this
+* decides what reaches disk, and a pattern language whose reach is not obvious
+* at a glance is the wrong tool for that job.
+*/
+function channelMatchesRule(channel, rule) {
+	const pattern = rule.match;
+	if (pattern === "*") return true;
+	if (pattern.endsWith("*")) return channel.startsWith(pattern.slice(0, -1));
+	return channel === pattern;
+}
+/**
+* Persistence and replay for retained channels.
+*
+* Inert unless constructed with at least one rule: {@link enabled} is false,
+* {@link ensureTables} does nothing, and {@link retentionFor} answers undefined
+* for every channel, so the realtime service never reaches the SQL below.
+*/
+var ChannelHistoryStore = class {
+	db;
+	rules;
+	/** Resolved rule per channel name, so the match runs once per channel. */
+	resolved = /* @__PURE__ */ new Map();
+	/** Channel → timestamp of its last prune, for {@link PRUNE_THROTTLE_MS}. */
+	lastPruned = /* @__PURE__ */ new Map();
+	tablesReady = false;
+	constructor(db, rules = []) {
+		this.db = db;
+		this.rules = rules.filter((rule) => {
+			if (!rule?.match) {
+				logger.warn("⚠️ [ChannelHistory] Ignoring a retention rule with no `match`.");
+				return false;
+			}
+			if (!(rule.limit !== void 0 || rule.ttl !== void 0)) {
+				logger.warn(`⚠️ [ChannelHistory] Retention rule "${rule.match}" sets neither \`limit\` nor \`ttl\` — ignoring it, as it would retain forever.`);
+				return false;
+			}
+			return true;
+		});
+	}
+	/** Whether any channel retains anything at all. */
+	get enabled() {
+		return this.rules.length > 0;
+	}
+	/**
+	* The retention that applies to `channel`, or undefined when none does.
+	*
+	* First matching rule wins, so callers order them most-specific first.
+	*/
+	retentionFor(channel) {
+		if (!this.enabled || !channel) return void 0;
+		const cached = this.resolved.get(channel);
+		if (cached !== void 0) return cached ?? void 0;
+		const rule = this.rules.find((r) => channelMatchesRule(channel, r));
+		const resolved = rule ? {
+			limit: rule.limit,
+			ttlMs: parseTtlMs(rule.ttl)
+		} : null;
+		this.resolved.set(channel, resolved);
+		return resolved ?? void 0;
+	}
+	/**
+	* Create the history tables. Idempotent, and a no-op when no rule is set —
+	* a deployment that never retains anything gets no schema for it.
+	*/
+	async ensureTables() {
+		if (!this.enabled || this.tablesReady) return;
+		await this.db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
+		await this.db.execute(sql`
+            CREATE TABLE IF NOT EXISTS rebase.channel_messages (
+                channel TEXT NOT NULL,
+                seq BIGINT NOT NULL,
+                event TEXT NOT NULL,
+                payload JSONB,
+                sender_id TEXT,
+                created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                PRIMARY KEY (channel, seq)
+            )
+        `);
+		await this.db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_channel_messages_created
+            ON rebase.channel_messages (created_at)
+        `);
+		await this.db.execute(sql`
+            CREATE TABLE IF NOT EXISTS rebase.channel_cursors (
+                channel TEXT PRIMARY KEY,
+                last_seq BIGINT NOT NULL
+            )
+        `);
+		this.tablesReady = true;
+		logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
+	}
+	/**
+	* Append a broadcast and return the sequence number it was given.
+	*
+	* The sequence is allocated by the same statement that stores the message,
+	* so a crash between the two is not a possibility. `ON CONFLICT DO UPDATE`
+	* takes a row lock on the channel's cursor, which is what makes concurrent
+	* broadcasts to one channel line up in a single order — and what keeps
+	* different channels from contending with each other at all.
+	*/
+	async append(channel, event, payload, senderId) {
+		const row = (await this.db.execute(sql`
+            WITH next AS (
+                INSERT INTO rebase.channel_cursors (channel, last_seq)
+                VALUES (${channel}, 1)
+                ON CONFLICT (channel)
+                DO UPDATE SET last_seq = rebase.channel_cursors.last_seq + 1
+                RETURNING last_seq
+            )
+            INSERT INTO rebase.channel_messages (channel, seq, event, payload, sender_id)
+            SELECT ${channel}, next.last_seq, ${event}, ${JSON.stringify(payload ?? null)}::jsonb, ${senderId ?? null}
+            FROM next
+            RETURNING seq, created_at
+        `)).rows[0];
+		if (!row) throw new Error(`Failed to append to channel history for "${channel}"`);
+		return {
+			seq: Number(row.seq),
+			at: row.created_at instanceof Date ? row.created_at.toISOString() : String(row.created_at)
+		};
+	}
+	/**
+	* Everything retained for `channel` after `sinceSeq`, oldest first.
+	*
+	* `latestSeq` is reported whether or not the messages were capped, so a
+	* client that is further behind than one page can tell.
+	*/
+	async replay(channel, sinceSeq = 0, limit = DEFAULT_REPLAY_LIMIT) {
+		const capped = Math.max(1, Math.min(Math.floor(limit) || DEFAULT_REPLAY_LIMIT, MAX_REPLAY_LIMIT));
+		const after = Number.isFinite(sinceSeq) && sinceSeq > 0 ? Math.floor(sinceSeq) : 0;
+		const messages = (await this.db.execute(sql`
+            SELECT seq, event, payload, sender_id, created_at
+            FROM rebase.channel_messages
+            WHERE channel = ${channel} AND seq > ${after}
+            ORDER BY seq ASC
+            LIMIT ${capped}
+        `)).rows.map((row) => ({
+			seq: Number(row.seq),
+			event: row.event,
+			payload: row.payload,
+			senderId: row.sender_id ?? void 0,
+			at: row.created_at instanceof Date ? row.created_at.toISOString() : String(row.created_at)
+		}));
+		const cursorRow = (await this.db.execute(sql`
+            SELECT last_seq FROM rebase.channel_cursors WHERE channel = ${channel}
+        `)).rows[0];
+		return {
+			messages,
+			latestSeq: cursorRow ? Number(cursorRow.last_seq) : 0
+		};
+	}
+	/**
+	* Enforce a channel's retention bounds.
+	*
+	* Throttled per channel, so a burst of operations prunes once rather than
+	* once per message — the cost then tracks elapsed time instead of write
+	* volume, which is what makes retention affordable on a hot channel.
+	*/
+	async prune(channel, retention) {
+		const now = Date.now();
+		if (now - (this.lastPruned.get(channel) ?? 0) < PRUNE_THROTTLE_MS) return 0;
+		this.lastPruned.set(channel, now);
+		let deleted = 0;
+		if (retention.ttlMs !== void 0) {
+			const result = await this.db.execute(sql`
+                DELETE FROM rebase.channel_messages
+                WHERE channel = ${channel}
+                  AND created_at < NOW() - MAKE_INTERVAL(secs => ${retention.ttlMs / 1e3})
+            `);
+			deleted += result.rowCount ?? 0;
+		}
+		if (retention.limit !== void 0 && retention.limit > 0) {
+			const result = await this.db.execute(sql`
+                DELETE FROM rebase.channel_messages
+                WHERE channel = ${channel}
+                  AND seq <= (
+                      SELECT seq FROM rebase.channel_messages
+                      WHERE channel = ${channel}
+                      ORDER BY seq DESC
+                      OFFSET ${Math.floor(retention.limit)} LIMIT 1
+                  )
+            `);
+			deleted += result.rowCount ?? 0;
+		}
+		return deleted;
+	}
+	/** Forget throttle and match caches. Called on shutdown. */
+	clear() {
+		this.resolved.clear();
+		this.lastPruned.clear();
+	}
+};
+//#endregion
 //#region src/services/realtimeService.ts
 /** Channel name used for Postgres LISTEN/NOTIFY cross-instance realtime. */
 var PG_NOTIFY_CHANNEL = "rebase_entity_changes";
@@ -9514,6 +10597,26 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	clients = /* @__PURE__ */ new Map();
 	channels = /* @__PURE__ */ new Map();
 	presence = /* @__PURE__ */ new Map();
+	/**
+	* Ordered, replayable history for channels that opt into it.
+	*
+	* Undefined until {@link configureChannelHistory} is called, and inert even
+	* then unless retention rules were supplied — so presence and ephemeral
+	* notification channels never touch it. See `channel-history.ts`.
+	*/
+	channelHistory;
+	/**
+	* One promise chain per retained channel, so that assigning a sequence
+	* number and fanning the message out happen in the same order for every
+	* message on that channel.
+	*
+	* Without it, two concurrent broadcasts can be numbered 4 and 5 by the
+	* database and still reach subscribers as 5 then 4 — live order and replay
+	* order would disagree, which is exactly the divergence sequence numbers
+	* are supposed to rule out. Keyed by channel, so unrelated channels never
+	* wait on each other.
+	*/
+	channelSendQueues = /* @__PURE__ */ new Map();
 	presenceInterval;
 	static PRESENCE_TIMEOUT_MS = 3e4;
 	dataService;
@@ -9690,6 +10793,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			case "broadcast":
 				this.broadcastToChannel(clientId, payload?.channel, payload?.event, payload?.payload);
 				break;
+			case "channel_history":
+				await this.handleChannelHistoryRequest(clientId, payload?.channel, payload?.sinceSeq, payload?.limit);
+				break;
 			case "presence_track":
 				this.joinChannel(clientId, payload?.channel);
 				this.trackPresence(clientId, payload?.channel, payload?.state ?? {});
@@ -9736,7 +10842,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				startAfter: request.startAfter,
 				searchString: request.searchString
 			}, authContext);
-			this.sendCollectionUpdate(clientId, subscriptionId, rows);
+			this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
 			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -9837,7 +10943,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			if (subscription.type === "single" && notifyPath === originalPath) if (row && row?._rebase_invalidated) this.debouncedSingleRefetch(subscriptionId, notifyPath, id, subscription);
 			else this.sendSingleUpdate(subscription.clientId, subscriptionId, row);
 			else if (subscription.type === "collection" && subscription.collectionRequest) {
-				if (!row || !row?._rebase_invalidated) this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row);
+				if (!row || !row?._rebase_invalidated) this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row, notifyPath);
 				this.debouncedCollectionRefetch(subscriptionId, notifyPath, subscription);
 			}
 		} catch (error) {
@@ -9867,7 +10973,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			if (!this._subscriptions.has(subscriptionId)) return;
 			try {
 				const rows = await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest, subscription.authContext);
-				this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows);
+				this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath);
 			} catch (error) {
 				const sanitized = sanitizeErrorForClient(error, notifyPath);
 				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -9900,12 +11006,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (this.driver) {
 			const collection = this.registry.getCollectionByPath(notifyPath);
 			const activeAuth = authContext || {
-				userId: "anon",
+				uid: "anon",
 				roles: ["anon"]
 			};
 			return await this.db.transaction(async (tx) => {
 				await applyAuthContext(tx, {
-					userId: activeAuth.userId,
+					uid: activeAuth.uid,
 					roles: activeAuth.roles
 				}, this.rlsUserRole);
 				const txEntityService = new DataService(tx, this.registry);
@@ -9937,7 +11043,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
 					const contextForCallback = {
 						user: {
-							uid: activeAuth.userId,
+							uid: activeAuth.uid,
 							roles: activeAuth.roles
 						},
 						driver: this.driver,
@@ -10029,12 +11135,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (this.driver) {
 			const collection = this.registry.getCollectionByPath(notifyPath);
 			const activeAuth = authContext || {
-				userId: "anon",
+				uid: "anon",
 				roles: ["anon"]
 			};
 			return await this.db.transaction(async (tx) => {
 				await applyAuthContext(tx, {
-					userId: activeAuth.userId,
+					uid: activeAuth.uid,
 					roles: activeAuth.roles
 				}, this.rlsUserRole);
 				let processedEntity = await new DataService(tx, this.registry).fetchOne(notifyPath, id, collection?.databaseId);
@@ -10050,7 +11156,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
 						const contextForCallback = {
 							user: {
-								uid: activeAuth.userId,
+								uid: activeAuth.uid,
 								roles: activeAuth.roles
 							},
 							driver: this.driver,
@@ -10081,11 +11187,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		return await this.dataService.fetchOne(notifyPath, id);
 	}
-	sendCollectionUpdate(clientId, subscriptionId, rows) {
+	sendCollectionUpdate(clientId, subscriptionId, rows, path) {
 		const message = {
 			type: "collection_update",
 			subscriptionId,
-			rows
+			rows,
+			pks: this.primaryKeysForPath(path)
 		};
 		this.sendMessage(clientId, message);
 	}
@@ -10100,16 +11207,33 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	/**
 	* Send a lightweight row-level patch to a collection subscriber.
 	* The client can merge this into its cached data for instant feedback.
+	*
+	* The key columns ride along: the patch names a row by address, and the
+	* client has to find that row among the ones it cached — which carry
+	* columns and no address. The SDK holds no collection config to derive one
+	* from, so this is the only place the mapping can come from.
 	*/
-	sendCollectionPatch(clientId, subscriptionId, id, row) {
+	sendCollectionPatch(clientId, subscriptionId, id, row, notifyPath) {
 		const message = {
 			type: "collection_patch",
 			subscriptionId,
 			id,
-			row
+			row,
+			pks: this.primaryKeysForPath(notifyPath)
 		};
 		this.sendMessage(clientId, message);
 	}
+	/** The key columns of the collection at `path`, if they can be resolved. */
+	primaryKeysForPath(path) {
+		try {
+			const collection = this.registry.getCollectionByPath(path);
+			if (!collection) return void 0;
+			const keys = getPrimaryKeys(collection, this.registry);
+			return keys.length > 0 ? keys : void 0;
+		} catch {
+			return;
+		}
+	}
 	sendError(clientId, error, subscriptionId, code) {
 		const message = {
 			type: "error",
@@ -10158,15 +11282,67 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		this.removePresence(clientId, channel);
 	}
-	/** Broadcast a message to all clients in a channel except sender */
+	/**
+	* Broadcast a message to all clients in a channel except the sender.
+	*
+	* On a channel with no retention rule this is what it always was: a
+	* synchronous fan-out to whoever is connected, with no sequence number, no
+	* SQL and no await — the body below runs to completion before returning.
+	*
+	* On a retained channel the message is durably numbered first and only then
+	* delivered, through a per-channel queue so that delivery order matches
+	* sequence order. That ordering is the whole point: a client that catches up
+	* with `sinceSeq` has to arrive at the same state as one that never
+	* disconnected.
+	*/
 	broadcastToChannel(clientId, channel, event, payload) {
+		const retention = this.channelHistory?.retentionFor(channel);
+		if (!retention) {
+			this.fanOutBroadcast(clientId, channel, event, payload);
+			return;
+		}
+		const next = (this.channelSendQueues.get(channel) ?? Promise.resolve()).catch(() => {}).then(() => this.persistAndFanOut(clientId, channel, event, payload, retention));
+		this.channelSendQueues.set(channel, next);
+		next.finally(() => {
+			if (this.channelSendQueues.get(channel) === next) this.channelSendQueues.delete(channel);
+		});
+	}
+	/**
+	* Number a broadcast, store it, then deliver it.
+	*
+	* A message that cannot be stored is **not** delivered. Delivering it would
+	* put it in front of live subscribers while leaving it absent from every
+	* future replay — the two views of the channel would disagree permanently,
+	* and no later message could repair the gap. Failing loudly to the sender
+	* instead lets it retry, which for an operation stream is the only outcome
+	* that keeps clients convergent.
+	*/
+	async persistAndFanOut(clientId, channel, event, payload, retention) {
+		let seq;
+		try {
+			({seq} = await this.channelHistory.append(channel, event, payload, clientId));
+		} catch (error) {
+			logger.error(`❌ [ChannelHistory] Could not persist broadcast on "${channel}" — message dropped`, { error });
+			this.sendError(clientId, `Could not persist broadcast on retained channel "${channel}"`, void 0, "CHANNEL_HISTORY_WRITE_FAILED");
+			return;
+		}
+		this.fanOutBroadcast(clientId, channel, event, payload, seq);
+		try {
+			await this.channelHistory.prune(channel, retention);
+		} catch (error) {
+			logger.warn(`⚠️ [ChannelHistory] Prune failed for "${channel}"`, { error });
+		}
+	}
+	/** Deliver a broadcast frame to every member of a channel but the sender. */
+	fanOutBroadcast(clientId, channel, event, payload, seq) {
 		const members = this.channels.get(channel);
 		if (!members) return;
 		const message = JSON.stringify({
 			type: "broadcast",
 			channel,
 			event,
-			payload
+			payload,
+			...seq !== void 0 ? { seq } : {}
 		});
 		for (const memberId of members) {
 			if (memberId === clientId) continue;
@@ -10174,6 +11350,55 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			if (ws && ws.readyState === WebSocket.OPEN) ws.send(message);
 		}
 	}
+	/**
+	* Install retention rules and create the tables they need.
+	*
+	* Safe to call with no rules (and safe not to call at all): the store stays
+	* inert, no schema is created, and broadcast keeps its original
+	* fire-and-forget path.
+	*/
+	async configureChannelHistory(rules) {
+		this.channelHistory = new ChannelHistoryStore(this.db, rules ?? []);
+		if (!this.channelHistory.enabled) return;
+		await this.channelHistory.ensureTables();
+	}
+	/** Whether any channel is configured to retain messages. */
+	isChannelHistoryEnabled() {
+		return this.channelHistory?.enabled ?? false;
+	}
+	/**
+	* Answer a client's catch-up request.
+	*
+	* A channel with no retention rule is answered with `retained: false`
+	* rather than an empty list, so the client can tell "you missed nothing"
+	* apart from "this channel never keeps anything" — the second means its
+	* reconnect strategy has to be a full resync, and silence would leave it
+	* guessing.
+	*/
+	async handleChannelHistoryRequest(clientId, channel, sinceSeq, limit) {
+		if (!channel) return;
+		if (!this.channelHistory?.retentionFor(channel)) {
+			this.sendChannelHistory(clientId, channel, [], false);
+			return;
+		}
+		try {
+			const { messages, latestSeq } = await this.channelHistory.replay(channel, sinceSeq, limit);
+			this.sendChannelHistory(clientId, channel, messages, true, latestSeq);
+		} catch (error) {
+			logger.error(`❌ [ChannelHistory] Replay failed for "${channel}"`, { error });
+			this.sendError(clientId, `Could not replay history for channel "${channel}"`, void 0, "CHANNEL_HISTORY_READ_FAILED");
+		}
+	}
+	sendChannelHistory(clientId, channel, messages, retained, latestSeq) {
+		const ws = this.clients.get(clientId);
+		if (ws && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({
+			type: "channel_history",
+			channel,
+			messages,
+			retained,
+			...latestSeq !== void 0 ? { latestSeq } : {}
+		}));
+	}
 	/** Track presence in a channel */
 	trackPresence(clientId, channel, state) {
 		if (!this.presence.has(channel)) this.presence.set(channel, /* @__PURE__ */ new Map());
@@ -10254,6 +11479,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		this.subscriptionCallbacks.clear();
 		this.channels.clear();
 		this.presence.clear();
+		await Promise.allSettled([...this.channelSendQueues.values()]);
+		this.channelSendQueues.clear();
+		this.channelHistory?.clear();
 		if (this.presenceInterval) {
 			clearInterval(this.presenceInterval);
 			this.presenceInterval = void 0;
@@ -10357,12 +11585,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	}
 	/** Compute the canonical (possibly composite) id string from a captured row. */
 	extractIdFromCdcRow(collection, row) {
-		try {
-			const composite = buildCompositeId(row, getPrimaryKeys(collection, this.registry));
-			if (composite && composite !== ":::") return composite;
-		} catch {}
-		if (row.id !== void 0 && row.id !== null) return String(row.id);
-		return "*";
+		return deriveRowAddress(row, collection, this.registry) || "*";
 	}
 	dedupKey(path, id, databaseId) {
 		return `${databaseId ?? ""}::${path}::${id}`;
@@ -10600,20 +11823,20 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					if (authAdapter) try {
 						const adapterUser = authAdapter.verifyToken ? await authAdapter.verifyToken(token) : await authAdapter.verifyRequest(new Request("http://localhost/_ws_auth", { headers: { Authorization: `Bearer ${token}` } }));
 						if (adapterUser) verifiedUser = {
-							userId: adapterUser.uid,
+							uid: adapterUser.uid,
 							roles: adapterUser.roles,
 							isAdmin: adapterUser.isAdmin
 						};
 					} catch {}
 					else if (authConfig?.serviceKey && safeCompare(token, authConfig.serviceKey)) verifiedUser = {
-						userId: "service",
+						uid: "service",
 						roles: ["admin"],
 						isAdmin: true
 					};
 					else {
 						const jwtPayload = extractUserFromToken(token);
 						if (jwtPayload) verifiedUser = {
-							userId: jwtPayload.userId,
+							uid: jwtPayload.uid,
 							roles: jwtPayload.roles ?? [],
 							isAdmin: (jwtPayload.roles ?? []).some((r) => r === "admin")
 						};
@@ -10629,11 +11852,11 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 							type: "AUTH_SUCCESS",
 							requestId,
 							payload: {
-								userId: verifiedUser.userId,
+								uid: verifiedUser.uid,
 								roles: verifiedUser.roles
 							}
 						}));
-						wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.userId}`);
+						wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.uid}`);
 					} else {
 						wsDebug(`[WS] replying AUTH_ERROR for requestId ${requestId} (invalid token)`);
 						sendError("AUTH_ERROR", "INVALID_TOKEN", "Invalid or expired token");
@@ -10671,7 +11894,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					const session = clientSessions.get(clientId);
 					if (typeof driver.withAuth === "function") try {
 						const userForAuth = session?.user ? {
-							uid: session.user.userId,
+							uid: session.user.uid,
 							displayName: null,
 							email: null,
 							photoURL: null,
@@ -10805,7 +12028,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 									sql: typeof sql === "string" ? sql.substring(0, 500) : sql,
 									options,
 									resultRows: Array.isArray(result) ? result.length : "unknown",
-									userId: auditSession?.user?.userId ?? "unknown",
+									uid: auditSession?.user?.uid ?? "unknown",
 									roles: auditSession?.user?.roles ?? [],
 									isAdmin: auditSession?.user?.isAdmin ?? false
 								}));
@@ -10850,6 +12073,21 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 							ws.send(JSON.stringify(response));
 						}
 						break;
+					case "FETCH_APPLICATION_ROLES":
+						{
+							wsDebug("👤 [WebSocket Server] Processing FETCH_APPLICATION_ROLES request");
+							const admin = (await getScopedDelegate()).admin;
+							let roles = [];
+							if (isSQLAdmin(admin) && admin.fetchApplicationRoles) roles = await admin.fetchApplicationRoles();
+							wsDebug(`👤 [WebSocket Server] Fetched ${roles.length} application roles.`);
+							const response = {
+								type: "FETCH_APPLICATION_ROLES_SUCCESS",
+								payload: { roles },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
 					case "FETCH_CURRENT_DATABASE":
 						{
 							wsDebug("📚 [WebSocket Server] Processing FETCH_CURRENT_DATABASE request");
@@ -10956,14 +12194,15 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					case "broadcast":
 					case "presence_track":
 					case "presence_untrack":
-					case "presence_state": {
+					case "presence_state":
+					case "channel_history": {
 						wsDebug("🔄 [WebSocket Server] Routing realtime message to RealtimeService:", type);
 						const session = clientSessions.get(clientId);
 						const authContext = session?.user ? {
-							userId: session.user.userId,
+							uid: session.user.uid,
 							roles: session.user.roles ?? []
 						} : {
-							userId: "anon",
+							uid: "anon",
 							roles: ["anon"]
 						};
 						await realtimeService.handleClientMessage(clientId, {
@@ -10978,7 +12217,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 			} catch (error) {
 				logger.error("💥 [WebSocket Server] Error handling message", { error });
 				if (error instanceof Error) logger.error("Stack trace", { detail: error.stack });
-				const errorMessage = process.env.NODE_ENV === "production" ? "An unexpected error occurred" : error instanceof Error ? error.message : "An unexpected error occurred";
+				const errorMessage = process.env.NODE_ENV === "production" ? "An unexpected error occurred" : extractErrorMessage(error);
 				const errorResponse = {
 					type: "ERROR",
 					requestId,
@@ -19822,6 +21061,33 @@ function formatBytes(bytes) {
 	return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
 }
 //#endregion
+//#region src/collections/buildRegistry.ts
+/**
+* Build the collection registry for a driver.
+*
+* The order matters and is the reason this is one function rather than a run of
+* statements in the bootstrapper. Keys are resolved from the drizzle schema, so
+* anything that inspects them has to run *after* the tables are registered —
+* and `warnOnKeysTheAdminCannotResolve` fails open if it does not, because a
+* collection whose table it cannot look up is one it has nothing to say about.
+* Warned too early, it would skip every collection and report nothing, which
+* reads exactly like having nothing to report.
+*/
+function buildCollectionRegistry(schema) {
+	const registry = new PostgresCollectionRegistry();
+	if (schema.collections) {
+		registry.registerMultiple(schema.collections);
+		logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
+	}
+	if (schema.tables) Object.values(schema.tables).forEach((table) => {
+		if (isTable(table)) registry.registerTable(table, getTableName(table));
+	});
+	if (schema.enums) registry.registerEnums(schema.enums);
+	if (schema.relations) registry.registerRelations(schema.relations);
+	warnOnKeysTheAdminCannotResolve(registry.getCollections(), registry);
+	return registry;
+}
+//#endregion
 //#region src/auth/ensure-tables.ts
 /**
 * Auto-create auth tables if they don't exist.
@@ -19892,9 +21158,65 @@ async function ensureAuthTablesExist(db, collection) {
             )
         `);
 		await db.execute(sql`
+            CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
+            BEGIN
+                IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
+                    NEW.uid := NEW.user_id;
+                ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
+                    NEW.user_id := NEW.uid;
+                END IF;
+                RETURN NEW;
+            END $$ LANGUAGE plpgsql
+        `);
+		for (const authTable of [
+			"user_identities",
+			"refresh_tokens",
+			"password_reset_tokens",
+			"magic_link_tokens",
+			"mfa_factors",
+			"recovery_codes"
+		]) {
+			const qualified = `"${authSchema}"."${authTable}"`;
+			await db.execute(sql`
+                DO $$
+                DECLARE
+                    has_legacy boolean;
+                    has_uid    boolean;
+                BEGIN
+                    SELECT
+                        bool_or(column_name = 'user_id'),
+                        bool_or(column_name = 'uid')
+                    INTO has_legacy, has_uid
+                    FROM information_schema.columns
+                    WHERE table_schema = ${sql.raw(`'${authSchema}'`)}
+                      AND table_name = ${sql.raw(`'${authTable}'`)};
+
+                    -- Table absent, or already uid-only (a fresh install, or
+                    -- phase 2 already run): nothing to do.
+                    IF has_legacy IS NOT TRUE THEN
+                        RETURN;
+                    END IF;
+
+                    IF has_uid IS NOT TRUE THEN
+                        EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ADD COLUMN uid ${userIdType} REFERENCES ${usersTableName}(id) ON DELETE CASCADE'`)};
+                        EXECUTE ${sql.raw(`'UPDATE ${qualified} SET uid = user_id WHERE uid IS NULL'`)};
+                        EXECUTE ${sql.raw(`'CREATE INDEX IF NOT EXISTS idx_${authTable}_uid ON ${qualified}(uid)'`)};
+                    END IF;
+
+                    -- New code inserts uid and never user_id, so the legacy
+                    -- column can no longer be NOT NULL. The trigger below
+                    -- backfills it, but the constraint is checked first.
+                    EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ALTER COLUMN user_id DROP NOT NULL'`)};
+
+                    EXECUTE ${sql.raw(`'DROP TRIGGER IF EXISTS sync_uid_user_id ON ${qualified}'`)};
+                    EXECUTE ${sql.raw(`'CREATE TRIGGER sync_uid_user_id BEFORE INSERT OR UPDATE ON ${qualified} FOR EACH ROW EXECUTE FUNCTION "${authSchema}".sync_uid_user_id()'`)};
+                END $$
+            `);
+		}
+		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(userIdentitiesTable)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 provider TEXT NOT NULL,
                 provider_id TEXT NOT NULL,
                 profile_data JSONB,
@@ -19905,18 +21227,18 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_user_identities_user 
-            ON ${sql.raw(userIdentitiesTable)}(user_id)
+            ON ${sql.raw(userIdentitiesTable)}(uid)
         `);
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 user_agent TEXT,
                 ip_address TEXT,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-                CONSTRAINT unique_device_session UNIQUE (user_id, user_agent, ip_address)
+                CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
             )
         `);
 		await db.execute(sql`
@@ -19925,12 +21247,12 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user 
-            ON ${sql.raw(refreshTokensTableName)}(user_id)
+            ON ${sql.raw(refreshTokensTableName)}(uid)
         `);
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(passwordResetTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
@@ -19943,13 +21265,13 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user 
-            ON ${sql.raw(passwordResetTokensTableName)}(user_id)
+            ON ${sql.raw(passwordResetTokensTableName)}(uid)
         `);
 		const magicLinkTokensTableName = `"${authSchema}"."magic_link_tokens"`;
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(magicLinkTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
@@ -19962,7 +21284,7 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_magic_link_tokens_user 
-            ON ${sql.raw(magicLinkTokensTableName)}(user_id)
+            ON ${sql.raw(magicLinkTokensTableName)}(uid)
         `);
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(appConfigTableName)} (
@@ -19976,7 +21298,10 @@ async function ensureAuthTablesExist(db, collection) {
 			await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
 			await tx.execute(sql`
                 CREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$
-                    SELECT NULLIF(current_setting('app.user_id', true), '');
+                    SELECT COALESCE(
+                        NULLIF(current_setting('app.uid', true), ''),
+                        NULLIF(current_setting('app.user_id', true), '')
+                    );
                 $$ LANGUAGE sql STABLE
             `);
 			await tx.execute(sql`
@@ -19993,14 +21318,22 @@ async function ensureAuthTablesExist(db, collection) {
                 $$ LANGUAGE sql STABLE
             `);
 		});
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
-        `);
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
-        `);
+		for (const columnDef of [
+			"display_name VARCHAR(255)",
+			"photo_url VARCHAR(500)",
+			"roles TEXT[] DEFAULT '{}' NOT NULL",
+			"password_hash VARCHAR(255)",
+			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
+			"email_verification_token VARCHAR(255)",
+			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
+			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
+			"metadata JSONB DEFAULT '{}' NOT NULL",
+			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
+			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
+		]) await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+            `);
 		try {
 			if ((await db.execute(sql`
                 SELECT EXISTS (
@@ -20031,7 +21364,7 @@ async function ensureAuthTablesExist(db, collection) {
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(mfaFactorsTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 factor_type TEXT NOT NULL DEFAULT 'totp',
                 secret_encrypted TEXT NOT NULL,
                 friendly_name TEXT,
@@ -20042,7 +21375,7 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_mfa_factors_user
-            ON ${sql.raw(mfaFactorsTableName)}(user_id)
+            ON ${sql.raw(mfaFactorsTableName)}(uid)
         `);
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(mfaChallengesTableName)} (
@@ -20061,7 +21394,7 @@ async function ensureAuthTablesExist(db, collection) {
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(recoveryCodesTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 code_hash TEXT NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
@@ -20069,8 +21402,36 @@ async function ensureAuthTablesExist(db, collection) {
         `);
 		await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_recovery_codes_user
-            ON ${sql.raw(recoveryCodesTableName)}(user_id)
+            ON ${sql.raw(recoveryCodesTableName)}(uid)
         `);
+		try {
+			const authTablePairs = [
+				[usersSchema, resolvedTable],
+				[authSchema, "user_identities"],
+				[authSchema, "refresh_tokens"],
+				[authSchema, "password_reset_tokens"],
+				[authSchema, "app_config"],
+				[authSchema, "mfa_factors"],
+				[authSchema, "mfa_challenges"],
+				[authSchema, "recovery_codes"]
+			];
+			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
+                    SELECT 1
+                    FROM pg_class c
+                    JOIN pg_namespace n ON n.oid = c.relnamespace
+                    WHERE n.nspname = ${schemaName}
+                      AND c.relname = ${tableName}
+                      AND c.relforcerowsecurity
+                `)).rows.length > 0) {
+				await db.execute(sql`
+                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
+                        NO FORCE ROW LEVEL SECURITY
+                    `);
+				logger.warn(`🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" (legacy RLS model — it binds the owner connection and breaks privileged auth writes)`);
+			}
+		} catch (rlsReconcileError) {
+			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
+		}
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
 		logger.error("❌ Failed to create auth tables", { error });
@@ -20118,6 +21479,32 @@ var UserService = class {
 		const name = getTableName(this.usersTable);
 		return `"${getTableConfig(this.usersTable).schema || "public"}"."${name}"`;
 	}
+	/**
+	* Run a privileged auth write with an explicitly cleared RLS context.
+	*
+	* The auth services run on the base/owner connection, which by design
+	* carries a NULL `app.uid` so the `auth.uid() IS NULL` server-escape
+	* in the default policies applies. That NULL is normally guaranteed by
+	* `set_config(..., is_local = true)` resetting at transaction end — but a
+	* GUC that survives on a pooled connection (or a connection role that
+	* doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
+	* turns the trusted write into an RLS-scoped one and denies it with
+	* SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
+	* single chokepoint, makes the server context deterministic instead of
+	* trusting whatever state the pool hands us. `auth.uid()` reads '' as
+	* NULL via NULLIF, so '' is the server context.
+	*/
+	async withServerContext(fn) {
+		return await this.db.transaction(async (tx) => {
+			await tx.execute(sql`
+                SELECT set_config('app.uid', '', true),
+                       set_config('app.user_id', '', true),
+                       set_config('app.user_roles', '', true),
+                       set_config('app.jwt', '', true)
+            `);
+			return await fn(tx);
+		});
+	}
 	mapRowToUser(row) {
 		if (!row) return row;
 		const id = row.id ?? row.uid;
@@ -20215,7 +21602,7 @@ var UserService = class {
 	}
 	async createUser(data) {
 		const payload = this.mapPayload(data);
-		const [row] = await this.db.insert(this.usersTable).values(payload).returning();
+		const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
 		return this.mapRowToUser(row);
 	}
 	async getUserById(id) {
@@ -20233,19 +21620,19 @@ var UserService = class {
 	async getUserByIdentity(provider, providerId) {
 		const userIdCol = getColumn(this.usersTable, "id");
 		if (!userIdCol) return null;
-		const result = await this.db.select({ user: this.usersTable }).from(this.usersTable).innerJoin(this.userIdentitiesTable, eq(userIdCol, this.userIdentitiesTable.userId)).where(sql`${this.userIdentitiesTable.provider} = ${provider} AND ${this.userIdentitiesTable.providerId} = ${providerId}`).limit(1);
+		const result = await this.db.select({ user: this.usersTable }).from(this.usersTable).innerJoin(this.userIdentitiesTable, eq(userIdCol, this.userIdentitiesTable.uid)).where(sql`${this.userIdentitiesTable.provider} = ${provider} AND ${this.userIdentitiesTable.providerId} = ${providerId}`).limit(1);
 		if (result.length === 0) return null;
 		return this.mapRowToUser(result[0].user);
 	}
-	async getUserIdentities(userId) {
+	async getUserIdentities(uid) {
 		const schema = getTableConfig(this.userIdentitiesTable).schema || "public";
 		return (await this.db.execute(sql`
-            SELECT id, user_id, provider, provider_id, profile_data, created_at, updated_at
+            SELECT id, uid, provider, provider_id, profile_data, created_at, updated_at
             FROM ${sql.raw(`"${schema}"."user_identities"`)}
-            WHERE user_id = ${userId}
+            WHERE uid = ${uid}
         `)).rows.map((row) => ({
 			id: row.id,
-			userId: row.user_id,
+			uid: row.uid,
 			provider: row.provider,
 			providerId: row.provider_id,
 			profileData: row.profile_data ?? null,
@@ -20253,13 +21640,13 @@ var UserService = class {
 			updatedAt: row.updated_at
 		}));
 	}
-	async linkUserIdentity(userId, provider, providerId, profileData) {
-		await this.db.insert(this.userIdentitiesTable).values({
-			userId,
+	async linkUserIdentity(uid, provider, providerId, profileData) {
+		await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
+			uid,
 			provider,
 			providerId,
 			profileData: profileData || null
-		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] });
+		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] }));
 	}
 	async updateUser(id, data) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -20267,13 +21654,13 @@ var UserService = class {
 		const payload = this.mapPayload(data);
 		const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 		payload[updatedAtKey] = /* @__PURE__ */ new Date();
-		const [row] = await this.db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning();
+		const [row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
 		return row ? this.mapRowToUser(row) : null;
 	}
 	async deleteUser(id) {
 		const idCol = getColumn(this.usersTable, "id");
 		if (!idCol) return;
-		await this.db.delete(this.usersTable).where(eq(idCol, id));
+		await this.withServerContext(async (db) => db.delete(this.usersTable).where(eq(idCol, id)));
 	}
 	async listUsers() {
 		return (await this.db.select().from(this.usersTable)).map((row) => this.mapRowToUser(row));
@@ -20327,10 +21714,10 @@ var UserService = class {
 		if (!idCol) return;
 		const passwordHashColKey = getColumnKey(this.usersTable, "passwordHash", "password_hash") || "passwordHash";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[passwordHashColKey]: passwordHash,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification status
@@ -20341,11 +21728,11 @@ var UserService = class {
 		const emailVerifiedColKey = getColumnKey(this.usersTable, "emailVerified", "email_verified") || "emailVerified";
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerifiedColKey]: verified,
 			[emailVerificationTokenColKey]: null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification token
@@ -20356,11 +21743,11 @@ var UserService = class {
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const emailVerificationSentAtColKey = getColumnKey(this.usersTable, "emailVerificationSentAt", "email_verification_sent_at") || "emailVerificationSentAt";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerificationTokenColKey]: token,
 			[emailVerificationSentAtColKey]: token ? /* @__PURE__ */ new Date() : null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Find user by email verification token
@@ -20374,10 +21761,10 @@ var UserService = class {
 	/**
 	* Get roles for a user from database (inline TEXT[] column)
 	*/
-	async getUserRoles(userId) {
+	async getUserRoles(uid) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const result = await this.db.execute(sql`
-            SELECT roles FROM ${sql.raw(usersTableName)} WHERE id = ${userId}
+            SELECT roles FROM ${sql.raw(usersTableName)} WHERE id = ${uid}
         `);
 		if (result.rows.length === 0) return [];
 		return (result.rows[0].roles ?? []).map((id) => ({
@@ -20391,10 +21778,10 @@ var UserService = class {
 	/**
 	* Get role IDs for a user
 	*/
-	async getUserRoleIds(userId) {
+	async getUserRoleIds(uid) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const result = await this.db.execute(sql`
-            SELECT roles FROM ${sql.raw(usersTableName)} WHERE id = ${userId}
+            SELECT roles FROM ${sql.raw(usersTableName)} WHERE id = ${uid}
         `);
 		if (result.rows.length === 0) return [];
 		return result.rows[0].roles ?? [];
@@ -20402,35 +21789,35 @@ var UserService = class {
 	/**
 	* Set roles for a user (replaces existing roles)
 	*/
-	async setUserRoles(userId, roleIds) {
+	async setUserRoles(uid, roleIds) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const rolesArray = `{${roleIds.join(",")}}`;
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = ${rolesArray}::text[], updated_at = NOW()
-            WHERE id = ${userId}
-        `);
+            WHERE id = ${uid}
+        `));
 	}
 	/**
 	* Assign a specific role to new user (appends if not present)
 	*/
-	async assignDefaultRole(userId, roleId) {
+	async assignDefaultRole(uid, roleId) {
 		const usersTableName = this.getQualifiedUsersTableName();
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = array_append(roles, ${roleId}), updated_at = NOW()
-            WHERE id = ${userId} AND NOT (${roleId} = ANY(roles))
-        `);
+            WHERE id = ${uid} AND NOT (${roleId} = ANY(roles))
+        `));
 	}
 	/**
 	* Get user with their roles
 	*/
-	async getUserWithRoles(userId) {
-		const user = await this.getUserById(userId);
+	async getUserWithRoles(uid) {
+		const user = await this.getUserById(uid);
 		if (!user) return null;
 		return {
 			user,
-			roles: await this.getUserRoles(userId)
+			roles: await this.getUserRoles(uid)
 		};
 	}
 };
@@ -20442,18 +21829,18 @@ var RefreshTokenService = class {
 		if (tableOrTables && (tableOrTables.refreshTokens || tableOrTables.users)) this.refreshTokensTable = tableOrTables.refreshTokens || refreshTokens;
 		else this.refreshTokensTable = tableOrTables || refreshTokens;
 	}
-	async createToken(userId, tokenHash, expiresAt, userAgent, ipAddress) {
+	async createToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
 		const safeUserAgent = userAgent || "";
 		const safeIpAddress = ipAddress || "";
 		await this.db.insert(this.refreshTokensTable).values({
-			userId,
+			uid,
 			tokenHash,
 			expiresAt,
 			userAgent: safeUserAgent,
 			ipAddress: safeIpAddress
 		}).onConflictDoUpdate({
 			target: [
-				this.refreshTokensTable.userId,
+				this.refreshTokensTable.uid,
 				this.refreshTokensTable.userAgent,
 				this.refreshTokensTable.ipAddress
 			],
@@ -20466,7 +21853,7 @@ var RefreshTokenService = class {
 	async findByHash(tokenHash) {
 		const [token] = await this.db.select({
 			id: this.refreshTokensTable.id,
-			userId: this.refreshTokensTable.userId,
+			uid: this.refreshTokensTable.uid,
 			tokenHash: this.refreshTokensTable.tokenHash,
 			expiresAt: this.refreshTokensTable.expiresAt,
 			createdAt: this.refreshTokensTable.createdAt,
@@ -20478,22 +21865,22 @@ var RefreshTokenService = class {
 	async deleteByHash(tokenHash) {
 		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 	}
-	async deleteAllForUser(userId) {
-		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.userId, userId));
+	async deleteAllForUser(uid) {
+		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid));
 	}
-	async listForUser(userId) {
+	async listForUser(uid) {
 		return await this.db.select({
 			id: this.refreshTokensTable.id,
-			userId: this.refreshTokensTable.userId,
+			uid: this.refreshTokensTable.uid,
 			tokenHash: this.refreshTokensTable.tokenHash,
 			expiresAt: this.refreshTokensTable.expiresAt,
 			createdAt: this.refreshTokensTable.createdAt,
 			userAgent: this.refreshTokensTable.userAgent,
 			ipAddress: this.refreshTokensTable.ipAddress
-		}).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.userId, userId)).orderBy(this.refreshTokensTable.createdAt);
+		}).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid)).orderBy(this.refreshTokensTable.createdAt);
 	}
-	async deleteById(id, userId) {
-		await this.db.delete(this.refreshTokensTable).where(sql`${this.refreshTokensTable.id} = ${id} AND ${this.refreshTokensTable.userId} = ${userId}`);
+	async deleteById(id, uid) {
+		await this.db.delete(this.refreshTokensTable).where(sql`${this.refreshTokensTable.id} = ${id} AND ${this.refreshTokensTable.uid} = ${uid}`);
 	}
 };
 /**
@@ -20514,14 +21901,14 @@ var PasswordResetTokenService = class {
 	/**
 	* Create a password reset token
 	*/
-	async createToken(userId, tokenHash, expiresAt) {
+	async createToken(uid, tokenHash, expiresAt) {
 		const tableName = this.getQualifiedPasswordResetTokensTableName();
 		await this.db.execute(sql`
             DELETE FROM ${sql.raw(tableName)} 
-            WHERE user_id = ${userId} AND used_at IS NULL
+            WHERE uid = ${uid} AND used_at IS NULL
         `);
 		await this.db.insert(this.passwordResetTokensTable).values({
-			userId,
+			uid,
 			tokenHash,
 			expiresAt
 		});
@@ -20531,13 +21918,13 @@ var PasswordResetTokenService = class {
 	*/
 	async findValidByHash(tokenHash) {
 		const [token] = await this.db.select({
-			userId: this.passwordResetTokensTable.userId,
+			uid: this.passwordResetTokensTable.uid,
 			expiresAt: this.passwordResetTokensTable.expiresAt
 		}).from(this.passwordResetTokensTable).where(eq(this.passwordResetTokensTable.tokenHash, tokenHash));
 		if (!token) return null;
 		const tableName = this.getQualifiedPasswordResetTokensTableName();
 		const result = await this.db.execute(sql`
-            SELECT user_id, expires_at 
+            SELECT uid, expires_at 
             FROM ${sql.raw(tableName)} 
             WHERE token_hash = ${tokenHash} 
               AND used_at IS NULL 
@@ -20546,7 +21933,7 @@ var PasswordResetTokenService = class {
 		if (result.rows.length === 0) return null;
 		const row = result.rows[0];
 		return {
-			userId: row.user_id,
+			uid: row.uid,
 			expiresAt: new Date(row.expires_at)
 		};
 	}
@@ -20559,8 +21946,8 @@ var PasswordResetTokenService = class {
 	/**
 	* Delete all tokens for a user
 	*/
-	async deleteAllForUser(userId) {
-		await this.db.delete(this.passwordResetTokensTable).where(eq(this.passwordResetTokensTable.userId, userId));
+	async deleteAllForUser(uid) {
+		await this.db.delete(this.passwordResetTokensTable).where(eq(this.passwordResetTokensTable.uid, uid));
 	}
 	/**
 	* Clean up expired tokens
@@ -20588,14 +21975,14 @@ var MagicLinkTokenService = class {
 		const name = getTableName(this.magicLinkTokensTable);
 		return `"${getTableConfig(this.magicLinkTokensTable).schema || "public"}"."${name}"`;
 	}
-	async createToken(userId, tokenHash, expiresAt) {
+	async createToken(uid, tokenHash, expiresAt) {
 		const tableName = this.getQualifiedTableName();
 		await this.db.execute(sql`
             DELETE FROM ${sql.raw(tableName)} 
-            WHERE user_id = ${userId} AND used_at IS NULL
+            WHERE uid = ${uid} AND used_at IS NULL
         `);
 		await this.db.insert(this.magicLinkTokensTable).values({
-			userId,
+			uid,
 			tokenHash,
 			expiresAt
 		});
@@ -20603,7 +21990,7 @@ var MagicLinkTokenService = class {
 	async findValidByHash(tokenHash) {
 		const tableName = this.getQualifiedTableName();
 		const result = await this.db.execute(sql`
-            SELECT user_id, expires_at 
+            SELECT uid, expires_at 
             FROM ${sql.raw(tableName)} 
             WHERE token_hash = ${tokenHash} 
               AND used_at IS NULL 
@@ -20612,7 +21999,7 @@ var MagicLinkTokenService = class {
 		if (result.rows.length === 0) return null;
 		const row = result.rows[0];
 		return {
-			userId: row.user_id,
+			uid: row.uid,
 			expiresAt: new Date(row.expires_at)
 		};
 	}
@@ -20635,8 +22022,8 @@ var PostgresTokenRepository = class {
 		this.passwordResetTokenService = new PasswordResetTokenService(db, tableOrTables);
 		this.magicLinkTokenService = new MagicLinkTokenService(db, tableOrTables);
 	}
-	async createRefreshToken(userId, tokenHash, expiresAt, userAgent, ipAddress) {
-		await this.refreshTokenService.createToken(userId, tokenHash, expiresAt, userAgent, ipAddress);
+	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
+		await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
 	}
 	async findRefreshTokenByHash(tokenHash) {
 		return this.refreshTokenService.findByHash(tokenHash);
@@ -20644,17 +22031,17 @@ var PostgresTokenRepository = class {
 	async deleteRefreshToken(tokenHash) {
 		await this.refreshTokenService.deleteByHash(tokenHash);
 	}
-	async deleteAllRefreshTokensForUser(userId) {
-		await this.refreshTokenService.deleteAllForUser(userId);
+	async deleteAllRefreshTokensForUser(uid) {
+		await this.refreshTokenService.deleteAllForUser(uid);
 	}
-	async listRefreshTokensForUser(userId) {
-		return this.refreshTokenService.listForUser(userId);
+	async listRefreshTokensForUser(uid) {
+		return this.refreshTokenService.listForUser(uid);
 	}
-	async deleteRefreshTokenById(id, userId) {
-		await this.refreshTokenService.deleteById(id, userId);
+	async deleteRefreshTokenById(id, uid) {
+		await this.refreshTokenService.deleteById(id, uid);
 	}
-	async createPasswordResetToken(userId, tokenHash, expiresAt) {
-		await this.passwordResetTokenService.createToken(userId, tokenHash, expiresAt);
+	async createPasswordResetToken(uid, tokenHash, expiresAt) {
+		await this.passwordResetTokenService.createToken(uid, tokenHash, expiresAt);
 	}
 	async findValidPasswordResetToken(tokenHash) {
 		return this.passwordResetTokenService.findValidByHash(tokenHash);
@@ -20662,14 +22049,14 @@ var PostgresTokenRepository = class {
 	async markPasswordResetTokenUsed(tokenHash) {
 		await this.passwordResetTokenService.markAsUsed(tokenHash);
 	}
-	async deleteAllPasswordResetTokensForUser(userId) {
-		await this.passwordResetTokenService.deleteAllForUser(userId);
+	async deleteAllPasswordResetTokensForUser(uid) {
+		await this.passwordResetTokenService.deleteAllForUser(uid);
 	}
 	async deleteExpiredTokens() {
 		await this.passwordResetTokenService.deleteExpired();
 	}
-	async createMagicLinkToken(userId, tokenHash, expiresAt) {
-		await this.magicLinkTokenService.createToken(userId, tokenHash, expiresAt);
+	async createMagicLinkToken(uid, tokenHash, expiresAt) {
+		await this.magicLinkTokenService.createToken(uid, tokenHash, expiresAt);
 	}
 	async findValidMagicLinkToken(tokenHash) {
 		return this.magicLinkTokenService.findValidByHash(tokenHash);
@@ -20704,11 +22091,11 @@ var PostgresAuthRepository = class {
 	async getUserByIdentity(provider, providerId) {
 		return this.userService.getUserByIdentity(provider, providerId);
 	}
-	async getUserIdentities(userId) {
-		return this.userService.getUserIdentities(userId);
+	async getUserIdentities(uid) {
+		return this.userService.getUserIdentities(uid);
 	}
-	async linkUserIdentity(userId, provider, providerId, profileData) {
-		return this.userService.linkUserIdentity(userId, provider, providerId, profileData);
+	async linkUserIdentity(uid, provider, providerId, profileData) {
+		return this.userService.linkUserIdentity(uid, provider, providerId, profileData);
 	}
 	async updateUser(id, data) {
 		return this.userService.updateUser(id, data);
@@ -20734,20 +22121,20 @@ var PostgresAuthRepository = class {
 	async getUserByVerificationToken(token) {
 		return this.userService.getUserByVerificationToken(token);
 	}
-	async getUserRoles(userId) {
-		return this.userService.getUserRoles(userId);
+	async getUserRoles(uid) {
+		return this.userService.getUserRoles(uid);
 	}
-	async getUserRoleIds(userId) {
-		return this.userService.getUserRoleIds(userId);
+	async getUserRoleIds(uid) {
+		return this.userService.getUserRoleIds(uid);
 	}
-	async setUserRoles(userId, roleIds) {
-		await this.userService.setUserRoles(userId, roleIds);
+	async setUserRoles(uid, roleIds) {
+		await this.userService.setUserRoles(uid, roleIds);
 	}
-	async assignDefaultRole(userId, roleId) {
-		await this.userService.assignDefaultRole(userId, roleId);
+	async assignDefaultRole(uid, roleId) {
+		await this.userService.assignDefaultRole(uid, roleId);
 	}
-	async getUserWithRoles(userId) {
-		return this.userService.getUserWithRoles(userId);
+	async getUserWithRoles(uid) {
+		return this.userService.getUserWithRoles(uid);
 	}
 	async getRoleById(id) {
 		return {
@@ -20802,8 +22189,8 @@ var PostgresAuthRepository = class {
 		};
 	}
 	async deleteRole(_id) {}
-	async createRefreshToken(userId, tokenHash, expiresAt, userAgent, ipAddress) {
-		await this.tokenRepository.createRefreshToken(userId, tokenHash, expiresAt, userAgent, ipAddress);
+	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
+		await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
 	}
 	async findRefreshTokenByHash(tokenHash) {
 		return this.tokenRepository.findRefreshTokenByHash(tokenHash);
@@ -20811,17 +22198,17 @@ var PostgresAuthRepository = class {
 	async deleteRefreshToken(tokenHash) {
 		await this.tokenRepository.deleteRefreshToken(tokenHash);
 	}
-	async deleteAllRefreshTokensForUser(userId) {
-		await this.tokenRepository.deleteAllRefreshTokensForUser(userId);
+	async deleteAllRefreshTokensForUser(uid) {
+		await this.tokenRepository.deleteAllRefreshTokensForUser(uid);
 	}
-	async listRefreshTokensForUser(userId) {
-		return this.tokenRepository.listRefreshTokensForUser(userId);
+	async listRefreshTokensForUser(uid) {
+		return this.tokenRepository.listRefreshTokensForUser(uid);
 	}
-	async deleteRefreshTokenById(id, userId) {
-		await this.tokenRepository.deleteRefreshTokenById(id, userId);
+	async deleteRefreshTokenById(id, uid) {
+		await this.tokenRepository.deleteRefreshTokenById(id, uid);
 	}
-	async createPasswordResetToken(userId, tokenHash, expiresAt) {
-		await this.tokenRepository.createPasswordResetToken(userId, tokenHash, expiresAt);
+	async createPasswordResetToken(uid, tokenHash, expiresAt) {
+		await this.tokenRepository.createPasswordResetToken(uid, tokenHash, expiresAt);
 	}
 	async findValidPasswordResetToken(tokenHash) {
 		return this.tokenRepository.findValidPasswordResetToken(tokenHash);
@@ -20829,14 +22216,14 @@ var PostgresAuthRepository = class {
 	async markPasswordResetTokenUsed(tokenHash) {
 		await this.tokenRepository.markPasswordResetTokenUsed(tokenHash);
 	}
-	async deleteAllPasswordResetTokensForUser(userId) {
-		await this.tokenRepository.deleteAllPasswordResetTokensForUser(userId);
+	async deleteAllPasswordResetTokensForUser(uid) {
+		await this.tokenRepository.deleteAllPasswordResetTokensForUser(uid);
 	}
 	async deleteExpiredTokens() {
 		await this.tokenRepository.deleteExpiredTokens();
 	}
-	async createMagicLinkToken(userId, tokenHash, expiresAt) {
-		await this.tokenRepository.createMagicLinkToken(userId, tokenHash, expiresAt);
+	async createMagicLinkToken(uid, tokenHash, expiresAt) {
+		await this.tokenRepository.createMagicLinkToken(uid, tokenHash, expiresAt);
 	}
 	async findValidMagicLinkToken(tokenHash) {
 		return this.tokenRepository.findValidMagicLinkToken(tokenHash);
@@ -20849,11 +22236,11 @@ var PostgresAuthRepository = class {
 		if (!this._mfaService) this._mfaService = new MfaService(this.db);
 		return this._mfaService;
 	}
-	async createMfaFactor(userId, factorType, secretEncrypted, friendlyName) {
-		return this.getMfaService().createMfaFactor(userId, factorType, secretEncrypted, friendlyName);
+	async createMfaFactor(uid, factorType, secretEncrypted, friendlyName) {
+		return this.getMfaService().createMfaFactor(uid, factorType, secretEncrypted, friendlyName);
 	}
-	async getMfaFactors(userId) {
-		return this.getMfaService().getMfaFactors(userId);
+	async getMfaFactors(uid) {
+		return this.getMfaService().getMfaFactors(uid);
 	}
 	async getMfaFactorById(factorId) {
 		return this.getMfaService().getMfaFactorById(factorId);
@@ -20861,8 +22248,8 @@ var PostgresAuthRepository = class {
 	async verifyMfaFactor(factorId) {
 		return this.getMfaService().verifyMfaFactor(factorId);
 	}
-	async deleteMfaFactor(factorId, userId) {
-		return this.getMfaService().deleteMfaFactor(factorId, userId);
+	async deleteMfaFactor(factorId, uid) {
+		return this.getMfaService().deleteMfaFactor(factorId, uid);
 	}
 	async createMfaChallenge(factorId, ipAddress) {
 		return this.getMfaService().createMfaChallenge(factorId, ipAddress);
@@ -20873,20 +22260,20 @@ var PostgresAuthRepository = class {
 	async verifyMfaChallenge(challengeId) {
 		return this.getMfaService().verifyMfaChallenge(challengeId);
 	}
-	async createRecoveryCodes(userId, codeHashes) {
-		return this.getMfaService().createRecoveryCodes(userId, codeHashes);
+	async createRecoveryCodes(uid, codeHashes) {
+		return this.getMfaService().createRecoveryCodes(uid, codeHashes);
 	}
-	async useRecoveryCode(userId, codeHash) {
-		return this.getMfaService().useRecoveryCode(userId, codeHash);
+	async useRecoveryCode(uid, codeHash) {
+		return this.getMfaService().useRecoveryCode(uid, codeHash);
 	}
-	async getUnusedRecoveryCodeCount(userId) {
-		return this.getMfaService().getUnusedRecoveryCodeCount(userId);
+	async getUnusedRecoveryCodeCount(uid) {
+		return this.getMfaService().getUnusedRecoveryCodeCount(uid);
 	}
-	async deleteAllRecoveryCodes(userId) {
-		return this.getMfaService().deleteAllRecoveryCodes(userId);
+	async deleteAllRecoveryCodes(uid) {
+		return this.getMfaService().deleteAllRecoveryCodes(uid);
 	}
-	async hasVerifiedMfaFactors(userId) {
-		return this.getMfaService().hasVerifiedMfaFactors(userId);
+	async hasVerifiedMfaFactors(uid) {
+		return this.getMfaService().hasVerifiedMfaFactors(uid);
 	}
 };
 /**
@@ -20903,16 +22290,16 @@ var MfaService = class {
 	qualify(tableName) {
 		return `"${this.schemaName}"."${tableName}"`;
 	}
-	async createMfaFactor(userId, factorType, secretEncrypted, friendlyName) {
+	async createMfaFactor(uid, factorType, secretEncrypted, friendlyName) {
 		const tableName = this.qualify("mfa_factors");
 		const row = (await this.db.execute(sql`
-            INSERT INTO ${sql.raw(tableName)} (user_id, factor_type, secret_encrypted, friendly_name)
-            VALUES (${userId}, ${factorType}, ${secretEncrypted}, ${friendlyName ?? null})
-            RETURNING id, user_id, factor_type, friendly_name, verified, created_at, updated_at
+            INSERT INTO ${sql.raw(tableName)} (uid, factor_type, secret_encrypted, friendly_name)
+            VALUES (${uid}, ${factorType}, ${secretEncrypted}, ${friendlyName ?? null})
+            RETURNING id, uid, factor_type, friendly_name, verified, created_at, updated_at
         `)).rows[0];
 		return {
 			id: row.id,
-			userId: row.user_id,
+			uid: row.uid,
 			factorType: row.factor_type,
 			friendlyName: row.friendly_name ?? void 0,
 			verified: row.verified,
@@ -20920,16 +22307,16 @@ var MfaService = class {
 			updatedAt: new Date(row.updated_at)
 		};
 	}
-	async getMfaFactors(userId) {
+	async getMfaFactors(uid) {
 		const tableName = this.qualify("mfa_factors");
 		return (await this.db.execute(sql`
-            SELECT id, user_id, factor_type, friendly_name, verified, created_at, updated_at
+            SELECT id, uid, factor_type, friendly_name, verified, created_at, updated_at
             FROM ${sql.raw(tableName)}
-            WHERE user_id = ${userId}
+            WHERE uid = ${uid}
             ORDER BY created_at
         `)).rows.map((row) => ({
 			id: row.id,
-			userId: row.user_id,
+			uid: row.uid,
 			factorType: row.factor_type,
 			friendlyName: row.friendly_name ?? void 0,
 			verified: row.verified,
@@ -20940,7 +22327,7 @@ var MfaService = class {
 	async getMfaFactorById(factorId) {
 		const tableName = this.qualify("mfa_factors");
 		const result = await this.db.execute(sql`
-            SELECT id, user_id, factor_type, secret_encrypted, friendly_name, verified, created_at, updated_at
+            SELECT id, uid, factor_type, secret_encrypted, friendly_name, verified, created_at, updated_at
             FROM ${sql.raw(tableName)}
             WHERE id = ${factorId}
         `);
@@ -20948,7 +22335,7 @@ var MfaService = class {
 		const row = result.rows[0];
 		return {
 			id: row.id,
-			userId: row.user_id,
+			uid: row.uid,
 			factorType: row.factor_type,
 			secretEncrypted: row.secret_encrypted,
 			friendlyName: row.friendly_name ?? void 0,
@@ -20965,11 +22352,11 @@ var MfaService = class {
             WHERE id = ${factorId}
         `);
 	}
-	async deleteMfaFactor(factorId, userId) {
+	async deleteMfaFactor(factorId, uid) {
 		const tableName = this.qualify("mfa_factors");
 		await this.db.execute(sql`
             DELETE FROM ${sql.raw(tableName)}
-            WHERE id = ${factorId} AND user_id = ${userId}
+            WHERE id = ${factorId} AND uid = ${uid}
         `);
 	}
 	async createMfaChallenge(factorId, ipAddress) {
@@ -21013,43 +22400,43 @@ var MfaService = class {
             WHERE id = ${challengeId}
         `);
 	}
-	async createRecoveryCodes(userId, codeHashes) {
+	async createRecoveryCodes(uid, codeHashes) {
 		const tableName = this.qualify("recovery_codes");
 		await this.db.execute(sql`
-            DELETE FROM ${sql.raw(tableName)} WHERE user_id = ${userId}
+            DELETE FROM ${sql.raw(tableName)} WHERE uid = ${uid}
         `);
 		for (const hash of codeHashes) await this.db.execute(sql`
-                INSERT INTO ${sql.raw(tableName)} (user_id, code_hash)
-                VALUES (${userId}, ${hash})
+                INSERT INTO ${sql.raw(tableName)} (uid, code_hash)
+                VALUES (${uid}, ${hash})
             `);
 	}
-	async useRecoveryCode(userId, codeHash) {
+	async useRecoveryCode(uid, codeHash) {
 		const tableName = this.qualify("recovery_codes");
 		return (await this.db.execute(sql`
             UPDATE ${sql.raw(tableName)}
             SET used_at = NOW()
-            WHERE user_id = ${userId} AND code_hash = ${codeHash} AND used_at IS NULL
+            WHERE uid = ${uid} AND code_hash = ${codeHash} AND used_at IS NULL
             RETURNING id
         `)).rows.length > 0;
 	}
-	async getUnusedRecoveryCodeCount(userId) {
+	async getUnusedRecoveryCodeCount(uid) {
 		const tableName = this.qualify("recovery_codes");
 		return (await this.db.execute(sql`
             SELECT COUNT(*)::int as count FROM ${sql.raw(tableName)}
-            WHERE user_id = ${userId} AND used_at IS NULL
+            WHERE uid = ${uid} AND used_at IS NULL
         `)).rows[0].count;
 	}
-	async deleteAllRecoveryCodes(userId) {
+	async deleteAllRecoveryCodes(uid) {
 		const tableName = this.qualify("recovery_codes");
 		await this.db.execute(sql`
-            DELETE FROM ${sql.raw(tableName)} WHERE user_id = ${userId}
+            DELETE FROM ${sql.raw(tableName)} WHERE uid = ${uid}
         `);
 	}
-	async hasVerifiedMfaFactors(userId) {
+	async hasVerifiedMfaFactors(uid) {
 		const tableName = this.qualify("mfa_factors");
 		return (await this.db.execute(sql`
             SELECT COUNT(*)::int as count FROM ${sql.raw(tableName)}
-            WHERE user_id = ${userId} AND verified = TRUE
+            WHERE uid = ${uid} AND verified = TRUE
         `)).rows[0].count > 0;
 	}
 };
@@ -21289,6 +22676,20 @@ function patchPgArrayNullSafety(tables) {
 	if (patchedCount > 0) logger.debug(`[PgArray] Patched ${patchedCount} array column(s) for null-safety`);
 }
 //#endregion
+//#region src/schema/introspect-db-naming.ts
+/**
+* Naming helpers shared by the introspection modules. These live apart from
+* `introspect-db-logic.ts` because the inference pass needs them too, and
+* importing them from there would close a cycle back through this module.
+*/
+/**
+* Convert a snake_case name to a human-readable Title Case label.
+* e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
+*/
+function humanize(snakeName) {
+	return snakeName.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+}
+//#endregion
 //#region src/schema/introspect-db-logic.ts
 var IRREGULAR_SINGULARS = {
 	people: "person",
@@ -21348,13 +22749,6 @@ function singularize(word) {
 	if (lower.endsWith("s") && !lower.endsWith("ss") && !lower.endsWith("us") && !lower.endsWith("is")) return word.slice(0, -1);
 	return word;
 }
-/**
-* Convert a snake_case name to a human-readable Title Case label.
-* e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
-*/
-function humanize(snakeName) {
-	return snakeName.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
-}
 function getIconForTable(tableName) {
 	const table = tableName.toLowerCase();
 	if (table.includes("user") || table.includes("account") || table.includes("member") || table.includes("customer") || table.includes("client") || table.includes("patient")) return "Users";
@@ -21804,21 +23198,14 @@ function createPostgresBootstrapper(pgConfig) {
 				logger.info(`🔍 [PostgresRegistry] BaaS mode: derived ${introspectedCollections.length} collections from schema "${pgSchemaName}" [${introspectedCollections.map((c) => c.slug).join(", ")}]`);
 			}
 			const activeCollections = introspectedCollections ?? collections;
-			const registry = new PostgresCollectionRegistry();
-			if (activeCollections) {
-				registry.registerMultiple(activeCollections);
-				logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
-			}
 			const schemaTables = introspectedTables ?? pgConfig.schema?.tables;
-			if (schemaTables) Object.values(schemaTables).forEach((table) => {
-				if (isTable(table)) {
-					const tableName = getTableName(table);
-					registry.registerTable(table, tableName);
-				}
-			});
-			if (pgConfig.schema?.enums) registry.registerEnums(pgConfig.schema.enums);
 			const schemaRelations = introspectedRelations ?? pgConfig.schema?.relations;
-			if (schemaRelations) registry.registerRelations(schemaRelations);
+			const registry = buildCollectionRegistry({
+				collections: activeCollections,
+				tables: schemaTables,
+				enums: pgConfig.schema?.enums,
+				relations: schemaRelations
+			});
 			if (schemaTables) patchPgArrayNullSafety(schemaTables);
 			const mergedSchema = {
 				...schemaTables,
@@ -21882,6 +23269,11 @@ function createPostgresBootstrapper(pgConfig) {
 			} catch (err) {
 				logger.warn("⚠️ Could not initialize branch metadata table", { error: err });
 			}
+			try {
+				await realtimeService.configureChannelHistory(pgConfig.realtime?.channels);
+			} catch (err) {
+				logger.warn("⚠️ Could not initialize channel history tables — retained channels will not replay", { error: err });
+			}
 			const directUrl = process.env.DATABASE_DIRECT_URL || pgConfig.connectionString;
 			const validModes = new Set([
 				"auto",
@@ -21897,6 +23289,7 @@ function createPostgresBootstrapper(pgConfig) {
 			const wantsCdc = cdcMode !== "off";
 			const explicitCdc = cdcMode === "trigger" || cdcMode === "wal";
 			let cdcEnabled = false;
+			let provisionCdcForTables;
 			if (wantsCdc && !directUrl) {
 				const reason = "no direct database connection is available for the realtime LISTEN client (set DATABASE_DIRECT_URL)";
 				if (explicitCdc) logger.warn(`⚠️ [CDC] REALTIME_CDC=${cdcMode} but ${reason} — using app-level realtime.`);
@@ -21913,6 +23306,9 @@ function createPostgresBootstrapper(pgConfig) {
 					})).filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table)));
 					await realtimeService.enableCdc(directUrl);
 					cdcEnabled = true;
+					provisionCdcForTables = async (tables) => {
+						await provisionTriggerCdc(cdcRunSql, tables);
+					};
 					logger.info(`📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). All writes now emit realtime events regardless of origin.`);
 				} catch (err) {
 					if (explicitCdc) logger.warn("⚠️ [CDC] Could not enable database-level change capture — falling back to app-level realtime.", { error: err });
@@ -21937,13 +23333,14 @@ function createPostgresBootstrapper(pgConfig) {
 					const dbTables = new Set(result.rows.map((r) => r.table_schema === "public" ? r.table_name : `${r.table_schema}.${r.table_name}`));
 					const missing = [];
 					for (const col of registeredCollections) {
+						if (col.auth?.enabled) continue;
 						const schemaName = "schema" in col && col.schema ? col.schema : "public";
 						const tableName = registry.hasTableForCollection(col.table ?? col.slug) ? col.table ?? col.slug : col.slug;
 						const checkName = registry.getTableNames().find((k) => k === tableName || k === col.slug) ?? tableName;
 						const fullCheckName = schemaName === "public" ? checkName : `${schemaName}.${checkName}`;
 						if (!dbTables.has(fullCheckName)) missing.push({
 							slug: col.slug,
-							table: checkName
+							table: fullCheckName
 						});
 					}
 					if (missing.length > 0) {
@@ -21977,7 +23374,8 @@ function createPostgresBootstrapper(pgConfig) {
 					registry,
 					realtimeService,
 					driver,
-					poolManager
+					poolManager,
+					provisionCdcForTables
 				}
 			};
 		},
@@ -21989,6 +23387,18 @@ function createPostgresBootstrapper(pgConfig) {
 			const registry = internals.registry;
 			const authCollection = authConfig.collection;
 			await ensureAuthTablesExist(db, authCollection);
+			if (authCollection && internals.provisionCdcForTables) {
+				const authSchema = "schema" in authCollection && typeof authCollection.schema === "string" ? authCollection.schema : "rebase";
+				const authTable = "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug;
+				if (authTable) try {
+					await internals.provisionCdcForTables([{
+						schema: authSchema,
+						table: authTable
+					}]);
+				} catch (err) {
+					logger.warn(`⚠️ [CDC] Could not attach change-capture to the auth table "${authSchema}.${authTable}" — writes to it won't emit database-level events.`, { detail: err instanceof Error ? err.message : String(err) });
+				}
+			}
 			let emailService;
 			if (authConfig.email) emailService = createEmailService(authConfig.email);
 			const tableName = authCollection ? "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug : void 0;
@@ -22059,6 +23469,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map