@rebasepro/server-postgres 0.9.1-canary.742f831 → 0.9.1-canary.7dddf96

package/dist/index.es.js

@@ -71,51 +71,16 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 var connection_exports = /* @__PURE__ */ __exportAll({
 	createDirectDatabaseConnection: () => createDirectDatabaseConnection,
 	createPostgresDatabaseConnection: () => createPostgresDatabaseConnection,
-	createReadReplicaConnection: () => createReadReplicaConnection,
-	guardPoolAgainstDirtyRelease: () => guardPoolAgainstDirtyRelease
+	createReadReplicaConnection: () => createReadReplicaConnection
 });
 var DEFAULT_POOL = {
 	max: 20,
 	idleTimeoutMillis: 3e4,
 	connectionTimeoutMillis: 1e4,
-	queryTimeout: 6e4,
+	queryTimeout: 3e4,
 	statementTimeout: 3e4,
 	keepAlive: true
 };
-/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
-var TX_IDLE = "I";
-/**
-* Destroy pool clients that are released while still inside a transaction.
-*
-* pg-pool returns a client to the idle list whenever `release()` is called
-* without an error — even if the connection is still mid-transaction (status
-* `T`/`E`). That happens in practice: drizzle's pool transaction releases in
-* a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
-* (e.g. it was queued behind a statement that hit the client-side
-* query_timeout), the client goes back dirty. The next checkout then runs
-* its statements inside the zombie transaction — with the previous request's
-* `app.*` RLS GUCs still applied, which turns unrelated queries into
-* RLS-scoped ones (observed in production as registration failing with
-* SQLSTATE 42501 under a leaked anonymous context).
-*
-* pg-pool emits `release` before it consults its private `_expired` set, so
-* marking the client expired here makes `_release()` destroy it instead of
-* pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
-* private APIs — feature-detect and fall back to loud logging so an upstream
-* change degrades to observability, never to silent corruption.
-*/
-function guardPoolAgainstDirtyRelease(pool, label) {
-	pool.on("release", (err, client) => {
-		if (err) return;
-		const txStatus = client?._txStatus;
-		if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
-		const expired = pool._expired;
-		if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
-			expired.add(client);
-			logger.error(`[${label}] Client released back to the pool while still in a transaction (status '${txStatus}') — destroying it so the open transaction and its session state (RLS GUCs) cannot leak into the next request.`);
-		} else logger.error(`[${label}] Client released mid-transaction (status '${txStatus}') but the pool's internal expiry set is unavailable (pg-pool internals changed?). The connection may leak its open transaction into subsequent requests.`);
-	});
-}
 /**
 * Create a Drizzle-backed Postgres connection with a production-grade
 * connection pool.
@@ -147,7 +112,6 @@ function createPostgresDatabaseConnection(connectionString, schema, poolConfig)
 		logger.error("[pg-pool] Unexpected pool error", { detail: err.message });
 		if (err.message.includes("ETIMEDOUT")) logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
 	});
-	guardPoolAgainstDirtyRelease(pool, "pg-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -180,7 +144,6 @@ function createDirectDatabaseConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
 	});
-	guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -210,7 +173,6 @@ function createReadReplicaConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
 	});
-	guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -4587,26 +4549,8 @@ function getTableForCollection(collection, registry) {
 	if (!table) throw new Error(`Table not found for collection '${collection.slug}' (table: ${tableName})`);
 	return table;
 }
-/**
-* The key columns a collection's rows are addressed by.
-*
-* Three tiers, in order: properties marked `isId`, the primary keys of the
-* drizzle schema, and finally a column literally named `id`. Only the first is
-* visible to the browser, which is why a key known only to drizzle is reported
-* at boot — see {@link warnOnKeysTheAdminCannotResolve}.
-*
-* Returns `[]` when nothing resolves, rather than throwing. It used to open by
-* resolving the table, which throws when there is none — so the `isId` tier,
-* which needs no table at all, was unreachable for exactly the collections
-* most likely to have no table registered. Every caller that wanted "no keys"
-* to mean "no keys" had to spell that out in a try/catch.
-*
-* Callers that cannot proceed without a key must say so themselves, naming the
-* collection: an empty array here means "this collection has no address", which
-* is a different answer in a notification (broadcast a wildcard) than in a save
-* (fail).
-*/
 function getPrimaryKeys(collection, registry) {
+	const table = getTableForCollection(collection, registry);
 	if (collection.properties) {
 		const idProps = Object.entries(collection.properties).filter(([_, prop]) => "isId" in prop && Boolean(prop.isId)).map(([key, prop]) => ({
 			fieldName: key,
@@ -4615,8 +4559,6 @@ function getPrimaryKeys(collection, registry) {
 		}));
 		if (idProps.length > 0) return idProps;
 	}
-	const table = registry.getTable(getTableName$1(collection));
-	if (!table) return [];
 	const keys = [];
 	for (const [key, colRaw] of Object.entries(table)) {
 		const col = colRaw;
@@ -4645,21 +4587,6 @@ function getPrimaryKeys(collection, registry) {
 	return keys;
 }
 /**
-* The key columns, for callers that cannot do their job without one.
-*
-* {@link getPrimaryKeys} answers "what keys, if any" and returns `[]` for a
-* collection with no address. Most of this driver, though, is building a WHERE
-* clause and has no meaning without a key — for those, an empty array is not an
-* answer, and indexing `[0]` into it produces `Cannot read properties of
-* undefined` three frames from where the real problem is. This says what is
-* wrong and which collection it is wrong about.
-*/
-function requirePrimaryKeys(collection, registry) {
-	const keys = getPrimaryKeys(collection, registry);
-	if (keys.length === 0) throw new Error(`Collection '${collection.slug}' has no primary key, so its rows cannot be addressed. Mark the key property with \`isId\` in its config, or register a table whose schema declares one.`);
-	return keys;
-}
-/**
 * Collections whose key the *browser* cannot resolve, and what it will do
 * instead.
 *
@@ -4686,7 +4613,12 @@ function findUnresolvableKeyCollections(collections, registry) {
 	const findings = [];
 	for (const collection of collections) {
 		if (getDeclaredPrimaryKeys(collection).length > 0) continue;
-		const keys = getPrimaryKeys(collection, registry);
+		let keys;
+		try {
+			keys = getPrimaryKeys(collection, registry);
+		} catch {
+			continue;
+		}
 		if (keys.length === 0) continue;
 		if (keys.length === 1 && keys[0].fieldName === "id") continue;
 		findings.push({
@@ -4717,14 +4649,19 @@ function warnOnKeysTheAdminCannotResolve(collections, registry) {
 * The address of a row: derived from the collection's primary keys, because a
 * row does not carry one — it is exactly its columns.
 *
-* Falls back to a literal `id` column, for a row that reached us from somewhere
-* other than this driver. Returns `""` when there is no key and no `id` —
-* callers decide what that means, since "unaddressable" is a different answer
-* in a notification (broadcast a wildcard) than in a save (fail).
+* Falls back to a literal `id` column, which covers the two cases where the
+* keys cannot be resolved: a row that reached us from somewhere other than the
+* postgres driver, and a collection whose table the registry cannot look up
+* (`getPrimaryKeys` throws for an unregistered table rather than returning
+* nothing). Returns `""` when there is no key and no `id` — callers decide what
+* that means, since "unaddressable" is a different answer in a notification
+* (broadcast a wildcard) than in a save (fail).
 */
 function deriveRowAddress(row, collection, registry) {
-	const composite = buildCompositeId(row, getPrimaryKeys(collection, registry));
-	if (composite && composite.split(":::").some((part) => part !== "")) return composite;
+	try {
+		const composite = buildCompositeId(row, getPrimaryKeys(collection, registry));
+		if (composite && composite.split(":::").some((part) => part !== "")) return composite;
+	} catch {}
 	if (row.id !== void 0 && row.id !== null) return String(row.id);
 	return "";
 }
@@ -5266,7 +5203,6 @@ var DrizzleConditionBuilder = class {
 	static buildVectorSearchConditions(table, vectorSearch) {
 		const column = table[vectorSearch.property];
 		if (!column) throw new Error(`Vector column '${vectorSearch.property}' not found in table`);
-		if (!Array.isArray(vectorSearch.vector) || vectorSearch.vector.length === 0 || !vectorSearch.vector.every((n) => typeof n === "number" && Number.isFinite(n))) throw new Error("Vector search requires a non-empty array of finite numbers");
 		const vectorLiteral = `'[${vectorSearch.vector.join(",")}]'::vector`;
 		const distanceFn = vectorSearch.distance || "cosine";
 		let operator;
@@ -5767,63 +5703,6 @@ var RelationService = class {
 		this.registry = registry;
 	}
 	/**
-	* One target row, as the {@link RelatedRow} everything here returns.
-	*
-	* Eight sites built this by hand, which is how the address came to be the
-	* target's first key column in all eight — one edit, eight places to miss.
-	*
-	* `resolveNested` is the one thing they did not agree on, and the
-	* disagreement was invisible: the single-parent fetches pass `db` and
-	* `registry` to `parseDataFromServer`, so the target's *own* relations get
-	* resolved too, while the batch paths deliberately do not — a query per
-	* target row is the N+1 the batching exists to avoid. Naming the parameter
-	* makes that a decision rather than a difference between two call sites
-	* nobody was comparing.
-	*/
-	async toRelatedRow(targetRow, targetCollection, targetPks, options) {
-		const values = options?.resolveNested ? await parseDataFromServer(targetRow, targetCollection, this.db, this.registry) : await parseDataFromServer(targetRow, targetCollection);
-		return {
-			id: buildCompositeId(targetRow, targetPks),
-			path: targetCollection.slug,
-			values
-		};
-	}
-	/**
-	* A WHERE matching any of `parentIds`, by the whole key.
-	*
-	* A single key is an `IN (…)`. A composite one cannot be: matching
-	* `tenant_id IN (1, 1)` collects every row of tenant 1, so two parents that
-	* share their first column each receive the other's relations. It becomes
-	* an OR of ANDs — one exact address per parent — which Postgres indexes the
-	* same way it would a multi-column key lookup.
-	*/
-	parentKeyCondition(parentTable, parentPks, parentIds) {
-		const columnFor = (fieldName) => {
-			const col = parentTable[fieldName];
-			if (!col) throw new Error(`Key column '${fieldName}' not found in parent table`);
-			return col;
-		};
-		if (parentPks.length === 1) {
-			const values = parentIds.map((id) => parseIdValues(id, parentPks)[parentPks[0].fieldName]);
-			return inArray(columnFor(parentPks[0].fieldName), values);
-		}
-		return or(...parentIds.map((id) => {
-			const values = parseIdValues(id, parentPks);
-			return and(...parentPks.map((pk) => eq(columnFor(pk.fieldName), values[pk.fieldName])));
-		}));
-	}
-	/**
-	* Reject a relation that cannot express a composite-keyed parent.
-	*
-	* `localKey` and `foreignKeyOnTarget` are single column names: one column
-	* cannot reference a two-column key, so such a relation has no correct
-	* reading. Left alone it would silently match on the first key column and
-	* hand a tenant's rows to its neighbour — say so instead.
-	*/
-	assertSingleKeyAddressable(parentCollection, parentPks, via) {
-		if (parentPks.length > 1) throw new Error(`Relation on '${parentCollection.slug}' uses '${via}', a single foreign-key column, but '${parentCollection.slug}' is keyed on ${parentPks.map((k) => `'${k.fieldName}'`).join(" + ")}. One column cannot reference a composite key — express this relation with \`joinPath\`, whose \`on.from\`/\`on.to\` take every key column.`);
-	}
-	/**
 	* Fetch rows related to a parent row through a specific relation
 	*/
 	async fetchRelatedEntities(parentCollectionPath, parentId, relationKey, options = {}) {
@@ -5842,9 +5721,9 @@ var RelationService = class {
 	async fetchEntitiesUsingJoins(parentCollection, parentId, relation, options = {}) {
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const idInfo = requirePrimaryKeys(targetCollection, this.registry);
+		const idInfo = getPrimaryKeys(targetCollection, this.registry);
 		const idField = targetTable[idInfo[0].fieldName];
-		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
+		const parentPks = getPrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
@@ -5868,7 +5747,7 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[requirePrimaryKeys(parentCollection, this.registry)[0].fieldName];
+			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
 			query = query.where(eq(parentIdField, parsedParentId));
 			if (options.limit) query = query.limit(options.limit);
 			const results = await query;
@@ -5876,7 +5755,12 @@ var RelationService = class {
 			const rows = [];
 			for (const row of results) {
 				const targetRow = row[targetTableName] || row;
-				rows.push(await this.toRelatedRow(targetRow, targetCollection, idInfo, { resolveNested: true }));
+				const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
+				rows.push({
+					id: buildCompositeId(targetRow, idInfo),
+					path: targetCollection.slug,
+					values: parsedValues
+				});
 			}
 			return rows;
 		}
@@ -5895,7 +5779,12 @@ var RelationService = class {
 		const rows = [];
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
-			rows.push(await this.toRelatedRow(targetRow, targetCollection, idInfo, { resolveNested: true }));
+			const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
+			rows.push({
+				id: buildCompositeId(targetRow, idInfo),
+				path: targetCollection.slug,
+				values: parsedValues
+			});
 		}
 		return rows;
 	}
@@ -5912,8 +5801,8 @@ var RelationService = class {
 		}
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdField = targetTable[requirePrimaryKeys(targetCollection, this.registry)[0].fieldName];
-		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
+		const targetIdField = targetTable[getPrimaryKeys(targetCollection, this.registry)[0].fieldName];
+		const parentPks = getPrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
@@ -5932,10 +5821,10 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+		const targetPks = getPrimaryKeys(targetCollection, this.registry);
 		const targetIdInfo = targetPks[0];
 		const targetIdField = targetTable[targetIdInfo.fieldName];
-		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
+		const parentPks = getPrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
@@ -5959,19 +5848,25 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
+			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
+			query = query.where(inArray(parentIdField, parsedParentIds));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const row of results) {
 				const parentRow = row[getTableName$1(parentCollection)] || row;
 				const targetRow = row[targetTableName] || row;
-				resultMap.set(buildCompositeId(parentRow, parentPks), await this.toRelatedRow(targetRow, targetCollection, targetPks));
+				const parentId = parentRow[parentIdInfo.fieldName];
+				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
+				resultMap.set(String(parentId), {
+					id: buildCompositeId(targetRow, targetPks),
+					path: targetCollection.slug,
+					values: parsedValues
+				});
 			}
 			return resultMap;
 		}
 		if (relation.direction === "owning" && relation.localKey) {
-			this.assertSingleKeyAddressable(parentCollection, parentPks, relation.localKey);
 			const localKeyCol = parentTable[relation.localKey];
 			if (!localKeyCol) throw new Error(`Local key column '${relation.localKey}' not found in parent table`);
 			const fkRows = await this.db.select({
@@ -6000,11 +5895,17 @@ var RelationService = class {
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const [parentIdStr, fkValue] of parentToFk) {
 				const targetRow = targetById.get(String(fkValue));
-				if (targetRow) resultMap.set(parentIdStr, await this.toRelatedRow(targetRow, targetCollection, targetPks));
+				if (targetRow) {
+					const parsedValues = await parseDataFromServer(targetRow, targetCollection);
+					resultMap.set(parentIdStr, {
+						id: buildCompositeId(targetRow, targetPks),
+						path: targetCollection.slug,
+						values: parsedValues
+					});
+				}
 			}
 			return resultMap;
 		}
-		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -6015,7 +5916,14 @@ var RelationService = class {
 			let parentId;
 			if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
 			else if (relation.direction === "inverse" && relation.cardinality === "one" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
-			if (parentId !== void 0 && parentIdSet.has(String(parentId))) resultMap.set(String(parentId), await this.toRelatedRow(targetRow, targetCollection, targetPks));
+			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
+				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
+				resultMap.set(String(parentId), {
+					id: buildCompositeId(targetRow, targetPks),
+					path: targetCollection.slug,
+					values: parsedValues
+				});
+			}
 		}
 		return resultMap;
 	}
@@ -6029,9 +5937,9 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+		const targetPks = getPrimaryKeys(targetCollection, this.registry);
 		const targetIdField = targetTable[targetPks[0].fieldName];
-		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
+		const parentPks = getPrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
@@ -6053,22 +5961,27 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
+			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
+			query = query.where(inArray(parentIdField, parsedParentIds));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const row of results) {
 				const parentRow = row[getTableName$1(parentCollection)] || row;
 				const targetRow = row[targetTableName] || row;
-				const parentId = buildCompositeId(parentRow, parentPks);
+				const parentId = String(parentRow[parentIdInfo.fieldName]);
+				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
 				const arr = resultMap.get(parentId) || [];
-				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
+				arr.push({
+					id: buildCompositeId(targetRow, targetPks),
+					path: targetCollection.slug,
+					values: parsedValues
+				});
 				resultMap.set(parentId, arr);
 			}
 			return resultMap;
 		}
 		if (relation.through && relation.cardinality === "many" && relation.direction === "owning") {
-			this.assertSingleKeyAddressable(parentCollection, parentPks, `${relation.through.table}.${relation.through.sourceColumn}`);
 			const junctionTable = this.registry.getTable(relation.through.table);
 			if (!junctionTable) {
 				logger.warn(`[batchFetchRelatedEntitiesMany] Junction table '${relation.through.table}' not found`);
@@ -6087,13 +6000,17 @@ var RelationService = class {
 				const junctionData = row[relation.through.table] || row;
 				const targetData = row[targetTableName] || row;
 				const parentId = String(junctionData[relation.through.sourceColumn]);
+				const parsedValues = await parseDataFromServer(targetData, targetCollection);
 				const arr = resultMap.get(parentId) || [];
-				arr.push(await this.toRelatedRow(targetData, targetCollection, targetPks));
+				arr.push({
+					id: buildCompositeId(targetData, targetPks),
+					path: targetCollection.slug,
+					values: parsedValues
+				});
 				resultMap.set(parentId, arr);
 			}
 			return resultMap;
 		}
-		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -6106,9 +6023,14 @@ var RelationService = class {
 			else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
 			else if (relation.direction === "inverse" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
 			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
+				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
 				const key = String(parentId);
 				const arr = resultMap.get(key) || [];
-				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
+				arr.push({
+					id: buildCompositeId(targetRow, targetPks),
+					path: targetCollection.slug,
+					values: parsedValues
+				});
 				resultMap.set(key, arr);
 			}
 		}
@@ -6156,12 +6078,12 @@ var RelationService = class {
 					logger.warn(`Could not determine junction table for relation '${key}' in collection '${collection.slug}'`);
 					continue;
 				}
-				const parentPks = requirePrimaryKeys(collection, this.registry);
+				const parentPks = getPrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
 				if (targetEntityIds.length > 0) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+					const targetPks = getPrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedParentId,
@@ -6181,12 +6103,12 @@ var RelationService = class {
 					logger.warn(`Junction columns not found for relation '${key}'`);
 					continue;
 				}
-				const parentPks = requirePrimaryKeys(collection, this.registry);
+				const parentPks = getPrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
 				if (targetEntityIds.length > 0) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+					const targetPks = getPrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedParentId,
@@ -6197,7 +6119,7 @@ var RelationService = class {
 			} else if (relation.through && relation.cardinality === "many" && relation.direction === "inverse") logger.warn(`[updateRelationsUsingJoins] Inverse M2M relation '${key}' in collection '${collection.slug}' should be saved from the owning side. Skipping.`);
 			else if (relation.cardinality === "many" && relation.direction === "inverse" && relation.foreignKeyOnTarget) {
 				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+				const targetPks = getPrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
 				const targetIdCol = targetTable[targetIdInfo.fieldName];
 				const fkCol = targetTable[relation.foreignKeyOnTarget];
@@ -6205,7 +6127,7 @@ var RelationService = class {
 					logger.warn(`Invalid inverse-many config for relation '${key}' in collection '${collection.slug}'`);
 					continue;
 				}
-				const parentPks = requirePrimaryKeys(collection, this.registry);
+				const parentPks = getPrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				if (targetEntityIds.length > 0) {
@@ -6225,9 +6147,9 @@ var RelationService = class {
 			try {
 				const targetCollection = relation.target();
 				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+				const targetPks = getPrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
-				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
+				const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
 				if (relation.direction === "inverse" && relation.joinPath && relation.joinPath.length > 0) {
 					await this.updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue);
@@ -6308,12 +6230,12 @@ var RelationService = class {
 					logger.warn(`Could not determine junction columns for inverse joinPath relation '${relation.relationName}'`);
 					return;
 				}
-				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
+				const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
 				const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
 				if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+					const targetPks = getPrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = newValue.map((rel) => typeof rel === "object" && rel !== null ? rel.id : rel).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedSourceId,
@@ -6321,7 +6243,7 @@ var RelationService = class {
 					}));
 					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
 				} else if (newValue && !Array.isArray(newValue)) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+					const targetPks = getPrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const parsedTargetId = parseIdValues(typeof newValue === "object" && newValue !== null ? newValue.id : newValue, targetPks)[targetIdInfo.fieldName];
 					const newLink = {
@@ -6352,12 +6274,12 @@ var RelationService = class {
 				logger.warn(`Junction columns not found for relation '${relation.relationName}'`);
 				return;
 			}
-			const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
+			const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
 			const sourceIdInfo = sourcePks[0];
 			const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
 			await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
 			if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+				const targetPks = getPrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
 				const newLinks = newValue.map((rel) => rel.id).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 					[sourceJunctionColumn.name]: parsedSourceId,
@@ -6378,12 +6300,12 @@ var RelationService = class {
 			const { relation, newTargetId } = upd;
 			const targetCollection = relation.target();
 			const targetTable = getTableForCollection(targetCollection, this.registry);
-			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+			const targetPks = getPrimaryKeys(targetCollection, this.registry);
 			const targetIdInfo = targetPks[0];
 			const targetIdCol = targetTable[targetIdInfo.fieldName];
 			const { targetFKColName, parentSourceColName } = this.resolveJoinPathWriteMapping(parentCollection, relation);
 			const parentTable = getTableForCollection(parentCollection, this.registry);
-			const parentPks = requirePrimaryKeys(parentCollection, this.registry);
+			const parentPks = getPrimaryKeys(parentCollection, this.registry);
 			const parentIdInfo = parentPks[0];
 			const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 			const parentIdCol = parentTable[parentIdInfo.fieldName];
@@ -6454,7 +6376,7 @@ var RelationService = class {
 				logger.warn(`Junction columns not found for relation '${relationKey}'`);
 				return;
 			}
-			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+			const targetPks = getPrimaryKeys(targetCollection, this.registry);
 			const targetIdInfo = targetPks[0];
 			const parsedNewEntityId = parseIdValues(newEntityId, targetPks)[targetIdInfo.fieldName];
 			const junctionData = {
@@ -6470,150 +6392,6 @@ var RelationService = class {
 	}
 };
 //#endregion
-//#region src/services/row-pipeline.ts
-/**
-* Whether a many-relation reaches its target through a junction table.
-*
-* Also used to build the drizzle `with` config, which is why it is exported:
-* the query has to nest one level deeper for a junction, and the row walk has
-* to unwrap that same level back out.
-*/
-function isJunctionRelation(relation) {
-	if (relation.through) return true;
-	if (relation.joinPath && relation.joinPath.length > 1) return true;
-	return false;
-}
-/**
-* Reach the target row inside a junction row.
-*
-* A junction row looks like `{ post_id: 1, tag_id: { id: 5, name: "ts" } }` —
-* the foreign keys, and the target nested under one of them. The target is the
-* only object among them, so that is how it is found. A junction row that has
-* not been nested (no `with` on the join) has no object and is returned as-is.
-*/
-function unwrapJunctionRow(item) {
-	const nestedKey = Object.keys(item).find((key) => typeof item[key] === "object" && item[key] !== null && !Array.isArray(item[key]));
-	return nestedKey ? item[nestedKey] : item;
-}
-/**
-* Give back the number a `number` property was declared to be.
-*
-* Postgres returns NUMERIC as a string and drizzle keeps it that way, since a
-* numeric can hold more precision than a double. But the collection declared
-* this property `number` and the OpenAPI spec this server publishes says
-* `type: number`, so serving `"9.99"` breaks its own contract — and breaks it
-* asymmetrically, because a create answers with the number and the read that
-* follows answers with the string. Any client that multiplies a price works
-* until the first refresh.
-*
-* Declaring a property `number` already accepts double precision — that is what
-* the admin has always parsed it to. Columns REST serves that no property
-* declares are left exactly as the database returned them.
-*/
-function coerceDeclaredNumber(value, property) {
-	if (property?.type !== "number" || typeof value !== "string") return value;
-	const parsed = parseFloat(value);
-	return isNaN(parsed) ? null : parsed;
-}
-/** Apply {@link coerceDeclaredNumber} across a row, leaving every other column alone. */
-function coerceDeclaredNumbers(row, collection) {
-	const properties = collection.properties;
-	if (!properties) return row;
-	const out = {};
-	for (const [key, value] of Object.entries(row)) out[key] = coerceDeclaredNumber(value, properties[key]);
-	return out;
-}
-/** Render one target row in the requested style. */
-/**
-* Drop every column the collection marked `excludeFromApi`.
-*
-* Password hashes and verification tokens have to be readable server-side but
-* must never reach a client — and "never" has to mean every exit from this
-* pipeline, including relation targets, or a secret leaks through whichever
-* path was overlooked. Keyed by both the property name and its column name,
-* since a row can arrive keyed either way depending on the caller.
-*/
-function stripExcluded(row, collection) {
-	const properties = collection.properties;
-	if (!properties) return row;
-	for (const [key, property] of Object.entries(properties)) {
-		if (!property?.excludeFromApi) continue;
-		delete row[key];
-		if (property.columnName) delete row[property.columnName];
-	}
-	return row;
-}
-function renderTarget(targetRow, targetCollection, style, registry) {
-	if (style === "inline") return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
-	const address = relationTargetAddress(targetRow, targetCollection, registry);
-	const path = targetCollection.slug;
-	return createRelationRefWithData(address, path, {
-		id: address,
-		path,
-		values: normalizeDbValues(targetRow, targetCollection)
-	});
-}
-/**
-* The address a relation ref points at.
-*
-* The whole key, not its first column: a composite-keyed target addressed by
-* `tenant_id` alone points at every row that shares it. A target whose key
-* cannot be resolved at all used to throw here — reading `[0]` of an empty
-* array — taking down the parent's fetch over a relation it may not even have
-* asked for. The first column is a guess, but a ref that resolves to nothing
-* beats no rows at all.
-*/
-function relationTargetAddress(targetRow, targetCollection, registry) {
-	const address = deriveRowAddress(targetRow, targetCollection, registry);
-	if (address) return address;
-	return String(targetRow[Object.keys(targetRow)[0]] ?? "");
-}
-/**
-* The row the admin renders: every column, with relations as references.
-*
-* Values are normalized (dates, numbers, NaN) because the admin's view-model
-* expects real types. The row's own address is *not* among the columns — it is
-* derived by the consumer from the collection's primary keys.
-*/
-function toCmsRow(row, collection, registry) {
-	const resolvedRelations = resolveCollectionRelations(collection);
-	const normalized = normalizeDbValues(row, collection);
-	for (const [key, relation] of Object.entries(resolvedRelations)) {
-		const relData = row[relation.relationName || key];
-		if (relData === void 0 || relData === null) continue;
-		if (relation.cardinality === "many" && Array.isArray(relData)) {
-			const targetCollection = relation.target();
-			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, targetCollection, "ref", registry));
-		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
-	}
-	return stripExcluded(normalized, collection);
-}
-/**
-* The row REST serves: every column under its own name, with the value Postgres
-* returned, and relations inlined as the target's columns.
-*
-* Values are the ones the database returned, except where that contradicts the
-* declared type: a `number` property is served as a number (see
-* {@link coerceDeclaredNumber}). Dates stay as the database returned them —
-* JSON has its own opinions about dates that the admin's view-model does not
-* share.
-*
-* Keyed by the row rather than by the relation list — a REST fetch only loads
-* the relations `include` asked for, so the row is the authority on which are
-* actually there.
-*/
-function toRestRow(row, collection, registry) {
-	const resolvedRelations = resolveCollectionRelations(collection);
-	const flat = {};
-	for (const [key, value] of Object.entries(row)) {
-		const relation = findRelation(resolvedRelations, key);
-		if (relation && Array.isArray(value)) flat[key] = value.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, relation.target(), "inline", registry));
-		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
-		else flat[key] = coerceDeclaredNumber(value, collection.properties?.[key]);
-	}
-	return stripExcluded(flat, collection);
-}
-//#endregion
 //#region src/services/FetchService.ts
 /**
 * Service for handling all row read operations.
@@ -6672,7 +6450,7 @@ var FetchService = class {
 			if (!shouldInclude(key)) continue;
 			const drizzleRelName = relation.relationName || key;
 			if (relation.joinPath && relation.joinPath.length > 0) continue;
-			if (relation.cardinality === "many" && isJunctionRelation(relation)) {
+			if (relation.cardinality === "many" && this.isJunctionRelation(relation, collection)) {
 				const targetFkName = this.getJunctionTargetRelationName(relation, collection);
 				if (targetFkName) withConfig[drizzleRelName] = { with: { [targetFkName]: true } };
 				else withConfig[drizzleRelName] = true;
@@ -6681,6 +6459,14 @@ var FetchService = class {
 		return withConfig;
 	}
 	/**
+	* Detect if a many-to-many relation uses a junction table in the Drizzle schema.
+	*/
+	isJunctionRelation(relation, _collection) {
+		if (relation.through) return true;
+		if (relation.joinPath && relation.joinPath.length > 1) return true;
+		return false;
+	}
+	/**
 	* Get the Drizzle relation name on the junction table that points to the actual target row.
 	* For example, for posts_tags junction, this returns "tag_id" (the relation pointing to tags).
 	*/
@@ -6689,6 +6475,68 @@ var FetchService = class {
 		return null;
 	}
 	/**
+	* The address a relation ref points at.
+	*
+	* The whole key, not its first column: a composite-keyed target addressed
+	* by `tenant_id` alone points at every row that shares it. And a target
+	* whose key cannot be resolved at all used to throw here — reading
+	* `targetPks[0]` of an empty array — taking down the parent's fetch over a
+	* relation it may not even have asked for; the first column is a guess, but
+	* a ref that resolves to nothing beats no rows at all.
+	*/
+	relationTargetAddress(targetRow, targetCollection) {
+		const address = deriveRowAddress(targetRow, targetCollection, this.registry);
+		if (address) return address;
+		const firstColumn = targetRow[Object.keys(targetRow)[0]];
+		return String(firstColumn ?? "");
+	}
+	/**
+	* Convert a db.query result row (with nested relation objects) to a flat row.
+	* Handles:
+	* - Type normalization (dates, numbers, NaN) via normalizeDbValues
+	* - Converting nested relation objects to { id, path, __type: "relation" } for CMS
+	* - Flattening junction-table many-to-many results
+	*
+	* The row's own address is not among them: it is derived by the consumer
+	* from the collection's primary keys.
+	*/
+	drizzleResultToRow(row, collection) {
+		const resolvedRelations = resolveCollectionRelations(collection);
+		const normalizedValues = normalizeDbValues(row, collection);
+		for (const [key, relation] of Object.entries(resolvedRelations)) {
+			const relData = row[relation.relationName || key];
+			if (relData === void 0 || relData === null) continue;
+			if (relation.cardinality === "many" && Array.isArray(relData)) {
+				const targetCollection = relation.target();
+				const targetPath = targetCollection.slug;
+				normalizedValues[key] = relData.map((item) => {
+					let targetRow = item;
+					if (this.isJunctionRelation(relation, collection)) {
+						const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
+						if (nestedKey) targetRow = item[nestedKey];
+					}
+					const relId = this.relationTargetAddress(targetRow, targetCollection);
+					return createRelationRefWithData(relId, targetPath, {
+						id: relId,
+						path: targetPath,
+						values: normalizeDbValues(targetRow, targetCollection)
+					});
+				});
+			} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) {
+				const targetCollection = relation.target();
+				const targetPath = targetCollection.slug;
+				const relObj = relData;
+				const relId = this.relationTargetAddress(relObj, targetCollection);
+				normalizedValues[key] = createRelationRefWithData(relId, targetPath, {
+					id: relId,
+					path: targetPath,
+					values: normalizeDbValues(relObj, targetCollection)
+				});
+			}
+		}
+		return normalizedValues;
+	}
+	/**
 	* Post-fetch joinPath relations for a single flat row.
 	* joinPath relations cannot be expressed via Drizzle's `with` config,
 	* so they must be loaded separately after the primary query.
@@ -6719,10 +6567,8 @@ var FetchService = class {
 		const shouldInclude = (key) => !include || include.length === 0 || include[0] === "*" || include.includes(key);
 		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0 && propertyKeys.has(key) && shouldInclude(key));
 		if (joinPathRelations.length === 0) return;
-		const parentIdOf = (row) => {
-			const address = buildCompositeId(row, idInfoArray);
-			return address && address.split(":::").some((part) => part !== "") ? address : void 0;
-		};
+		const idInfo = idInfoArray[0];
+		const parentIdOf = (row) => row[idInfo.fieldName];
 		for (const [key, relation] of joinPathRelations) try {
 			const addressable = rows.filter((r) => parentIdOf(r) !== void 0 && parentIdOf(r) !== null);
 			if (addressable.length === 0) continue;
@@ -6742,6 +6588,32 @@ var FetchService = class {
 		}
 	}
 	/**
+	* Convert a db.query result row to a flat REST-style row with populated relations.
+	*
+	* Every column is copied through under its own name, with the value Postgres
+	* returned. This used to open with a synthesized `id` and then skip the key
+	* column, which renamed it (a `sku` primary key was served as `id`, and `sku`
+	* did not appear at all) and restringified it (`42` → `"42"`). Consumers that
+	* need an address derive it from the collection's primary keys.
+	*/
+	drizzleResultToRestRow(row, collection) {
+		const flat = {};
+		const resolvedRelations = resolveCollectionRelations(collection);
+		for (const [k, v] of Object.entries(row)) {
+			const relation = findRelation(resolvedRelations, k);
+			if (Array.isArray(v) && relation) flat[k] = v.map((item) => {
+				if (this.isJunctionRelation(relation, collection)) {
+					const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
+					if (nestedKey) return { ...item[nestedKey] };
+				}
+				return { ...item };
+			});
+			else if (typeof v === "object" && v !== null && !Array.isArray(v) && relation) flat[k] = { ...v };
+			else flat[k] = v;
+		}
+		return flat;
+	}
+	/**
 	* Build db.query-compatible options from standard fetch options.
 	* Handles filter, search, orderBy, limit, and cursor-based pagination.
 	*/
@@ -6811,7 +6683,7 @@ var FetchService = class {
 	async fetchOne(collectionPath, id, databaseId) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = requirePrimaryKeys(collection, this.registry);
+		const idInfoArray = getPrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
@@ -6825,7 +6697,7 @@ var FetchService = class {
 				with: withConfig
 			});
 			if (!row) return void 0;
-			const flatRow = toCmsRow(row, collection, this.registry);
+			const flatRow = this.drizzleResultToRow(row, collection);
 			await this.resolveJoinPathRelations(flatRow, collection, collectionPath, parsedId, databaseId);
 			return flatRow;
 		} catch (e) {
@@ -6867,7 +6739,7 @@ var FetchService = class {
 	async fetchRowsWithConditions(collectionPath, options = {}) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = requirePrimaryKeys(collection, this.registry);
+		const idInfoArray = getPrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
@@ -6877,7 +6749,7 @@ var FetchService = class {
 		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
 		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0);
-			return (await qb.findMany(queryOpts)).map((row) => toCmsRow(row, collection, this.registry));
+			return (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRow(row, collection));
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
 				logger.error(`[FetchService] Relation inference error for collection '${collectionPath}': ${e.message}`);
@@ -6938,10 +6810,8 @@ var FetchService = class {
 	}
 	/**
 	* Fallback path used when db.query is unavailable.
-	*
-	* The primary path runs the results through `toCmsRow`, which maps
-	* relations from what drizzle already nested — no query per row. This one
-	* has no nesting to read, so it resolves relations itself, in batches.
+	* The primary path uses drizzleResultToRow which handles relation
+	* mapping without N+1 queries.
 	*
 	* Process raw database results into flat rows with relations.
 	*/
@@ -7083,7 +6953,7 @@ var FetchService = class {
 		if (value === void 0 || value === null) return true;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = requirePrimaryKeys(collection, this.registry);
+		const idInfoArray = getPrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const field = table[fieldName];
@@ -7110,7 +6980,7 @@ var FetchService = class {
 	async fetchCollectionForRest(collectionPath, options = {}, include) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = requirePrimaryKeys(collection, this.registry);
+		const idInfoArray = getPrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const tableName = getTableName(table);
@@ -7118,7 +6988,7 @@ var FetchService = class {
 		if (qb && !options.searchString && !options.vectorSearch) try {
 			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig);
-			const restRows = (await qb.findMany(queryOpts)).map((row) => toRestRow(row, collection, this.registry));
+			const restRows = (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRestRow(row, collection));
 			await this.resolveJoinPathRelationsBatchRest(restRows, collection, collectionPath, idInfoArray, include);
 			return restRows;
 		} catch (e) {
@@ -7167,7 +7037,7 @@ var FetchService = class {
 	async fetchOneForRest(collectionPath, id, include, databaseId) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = requirePrimaryKeys(collection, this.registry);
+		const idInfoArray = getPrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
@@ -7180,7 +7050,7 @@ var FetchService = class {
 				...withConfig ? { with: withConfig } : {}
 			});
 			if (!row) return null;
-			const restRow = toRestRow(row, collection, this.registry);
+			const restRow = this.drizzleResultToRestRow(row, collection);
 			await this.resolveJoinPathRelationsBatchRest([restRow], collection, collectionPath, idInfoArray, include);
 			return restRow;
 		} catch (e) {
@@ -7225,7 +7095,7 @@ var FetchService = class {
 	async fetchRowsWithConditionsRaw(collectionPath, options = {}) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idField = table[requirePrimaryKeys(collection, this.registry)[0].fieldName];
+		const idField = table[getPrimaryKeys(collection, this.registry)[0].fieldName];
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
 		let query = vectorMeta ? this.db.select({
@@ -7714,7 +7584,7 @@ var PersistService = class {
 		} catch (error) {
 			throw this.toUserFriendlyError(error, collection.slug);
 		}
-		const finalEntity = await this.fetchService.fetchOneForRest(collection.slug, savedId, void 0, databaseId);
+		const finalEntity = await this.fetchService.fetchOne(collection.slug, savedId, databaseId);
 		if (!finalEntity) throw new Error("Could not fetch row after save.");
 		return finalEntity;
 	}
@@ -8633,14 +8503,12 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
 		let previousValuesForHistory;
-		if (status === "existing" && id) try {
-			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
+		if (status === "existing" && id) {
+			const existing = await this.dataService.fetchOne(path, id, resolvedCollection?.databaseId);
 			if (existing) {
 				const { id: _existingId, ...existingValues } = existing;
 				previousValuesForHistory = existingValues;
 			}
-		} catch (err) {
-			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
 		}
 		if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
 			if (globalCallbacks?.beforeSave) {
@@ -9253,7 +9121,6 @@ var DatabasePoolManager = class {
 		pool.on("error", (err) => {
 			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
 		});
-		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 		this.pools.set(databaseName, pool);
 		return pool;
 	}
@@ -20814,22 +20681,14 @@ async function ensureAuthTablesExist(db, collection) {
                 $$ LANGUAGE sql STABLE
             `);
 		});
-		for (const columnDef of [
-			"display_name VARCHAR(255)",
-			"photo_url VARCHAR(500)",
-			"roles TEXT[] DEFAULT '{}' NOT NULL",
-			"password_hash VARCHAR(255)",
-			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
-			"email_verification_token VARCHAR(255)",
-			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
-			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
-			"metadata JSONB DEFAULT '{}' NOT NULL",
-			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
-			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
-		]) await db.execute(sql`
-                ALTER TABLE ${sql.raw(usersTableName)}
-                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
-            `);
+		await db.execute(sql`
+            ALTER TABLE ${sql.raw(usersTableName)}
+            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
+        `);
+		await db.execute(sql`
+            ALTER TABLE ${sql.raw(usersTableName)}
+            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
+        `);
 		try {
 			if ((await db.execute(sql`
                 SELECT EXISTS (
@@ -20900,34 +20759,6 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE INDEX IF NOT EXISTS idx_recovery_codes_user
             ON ${sql.raw(recoveryCodesTableName)}(user_id)
         `);
-		try {
-			const authTablePairs = [
-				[usersSchema, resolvedTable],
-				[authSchema, "user_identities"],
-				[authSchema, "refresh_tokens"],
-				[authSchema, "password_reset_tokens"],
-				[authSchema, "app_config"],
-				[authSchema, "mfa_factors"],
-				[authSchema, "mfa_challenges"],
-				[authSchema, "recovery_codes"]
-			];
-			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
-                    SELECT 1
-                    FROM pg_class c
-                    JOIN pg_namespace n ON n.oid = c.relnamespace
-                    WHERE n.nspname = ${schemaName}
-                      AND c.relname = ${tableName}
-                      AND c.relforcerowsecurity
-                `)).rows.length > 0) {
-				await db.execute(sql`
-                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
-                        NO FORCE ROW LEVEL SECURITY
-                    `);
-				logger.warn(`🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" (legacy RLS model — it binds the owner connection and breaks privileged auth writes)`);
-			}
-		} catch (rlsReconcileError) {
-			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
-		}
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
 		logger.error("❌ Failed to create auth tables", { error });
@@ -20975,31 +20806,6 @@ var UserService = class {
 		const name = getTableName(this.usersTable);
 		return `"${getTableConfig(this.usersTable).schema || "public"}"."${name}"`;
 	}
-	/**
-	* Run a privileged auth write with an explicitly cleared RLS context.
-	*
-	* The auth services run on the base/owner connection, which by design
-	* carries a NULL `app.user_id` so the `auth.uid() IS NULL` server-escape
-	* in the default policies applies. That NULL is normally guaranteed by
-	* `set_config(..., is_local = true)` resetting at transaction end — but a
-	* GUC that survives on a pooled connection (or a connection role that
-	* doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
-	* turns the trusted write into an RLS-scoped one and denies it with
-	* SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
-	* single chokepoint, makes the server context deterministic instead of
-	* trusting whatever state the pool hands us. `auth.uid()` reads '' as
-	* NULL via NULLIF, so '' is the server context.
-	*/
-	async withServerContext(fn) {
-		return await this.db.transaction(async (tx) => {
-			await tx.execute(sql`
-                SELECT set_config('app.user_id', '', true),
-                       set_config('app.user_roles', '', true),
-                       set_config('app.jwt', '', true)
-            `);
-			return await fn(tx);
-		});
-	}
 	mapRowToUser(row) {
 		if (!row) return row;
 		const id = row.id ?? row.uid;
@@ -21097,7 +20903,7 @@ var UserService = class {
 	}
 	async createUser(data) {
 		const payload = this.mapPayload(data);
-		const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
+		const [row] = await this.db.insert(this.usersTable).values(payload).returning();
 		return this.mapRowToUser(row);
 	}
 	async getUserById(id) {
@@ -21136,12 +20942,12 @@ var UserService = class {
 		}));
 	}
 	async linkUserIdentity(userId, provider, providerId, profileData) {
-		await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
+		await this.db.insert(this.userIdentitiesTable).values({
 			userId,
 			provider,
 			providerId,
 			profileData: profileData || null
-		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] }));
+		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] });
 	}
 	async updateUser(id, data) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -21149,13 +20955,13 @@ var UserService = class {
 		const payload = this.mapPayload(data);
 		const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 		payload[updatedAtKey] = /* @__PURE__ */ new Date();
-		const [row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
+		const [row] = await this.db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning();
 		return row ? this.mapRowToUser(row) : null;
 	}
 	async deleteUser(id) {
 		const idCol = getColumn(this.usersTable, "id");
 		if (!idCol) return;
-		await this.withServerContext(async (db) => db.delete(this.usersTable).where(eq(idCol, id)));
+		await this.db.delete(this.usersTable).where(eq(idCol, id));
 	}
 	async listUsers() {
 		return (await this.db.select().from(this.usersTable)).map((row) => this.mapRowToUser(row));
@@ -21209,10 +21015,10 @@ var UserService = class {
 		if (!idCol) return;
 		const passwordHashColKey = getColumnKey(this.usersTable, "passwordHash", "password_hash") || "passwordHash";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.withServerContext(async (db) => db.update(this.usersTable).set({
+		await this.db.update(this.usersTable).set({
 			[passwordHashColKey]: passwordHash,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id)));
+		}).where(eq(idCol, id));
 	}
 	/**
 	* Set email verification status
@@ -21223,11 +21029,11 @@ var UserService = class {
 		const emailVerifiedColKey = getColumnKey(this.usersTable, "emailVerified", "email_verified") || "emailVerified";
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.withServerContext(async (db) => db.update(this.usersTable).set({
+		await this.db.update(this.usersTable).set({
 			[emailVerifiedColKey]: verified,
 			[emailVerificationTokenColKey]: null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id)));
+		}).where(eq(idCol, id));
 	}
 	/**
 	* Set email verification token
@@ -21238,11 +21044,11 @@ var UserService = class {
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const emailVerificationSentAtColKey = getColumnKey(this.usersTable, "emailVerificationSentAt", "email_verification_sent_at") || "emailVerificationSentAt";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.withServerContext(async (db) => db.update(this.usersTable).set({
+		await this.db.update(this.usersTable).set({
 			[emailVerificationTokenColKey]: token,
 			[emailVerificationSentAtColKey]: token ? /* @__PURE__ */ new Date() : null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id)));
+		}).where(eq(idCol, id));
 	}
 	/**
 	* Find user by email verification token
@@ -21287,22 +21093,22 @@ var UserService = class {
 	async setUserRoles(userId, roleIds) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const rolesArray = `{${roleIds.join(",")}}`;
-		await this.withServerContext(async (db) => db.execute(sql`
+		await this.db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = ${rolesArray}::text[], updated_at = NOW()
             WHERE id = ${userId}
-        `));
+        `);
 	}
 	/**
 	* Assign a specific role to new user (appends if not present)
 	*/
 	async assignDefaultRole(userId, roleId) {
 		const usersTableName = this.getQualifiedUsersTableName();
-		await this.withServerContext(async (db) => db.execute(sql`
+		await this.db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = array_append(roles, ${roleId}), updated_at = NOW()
             WHERE id = ${userId} AND NOT (${roleId} = ANY(roles))
-        `));
+        `);
 	}
 	/**
 	* Get user with their roles
@@ -22772,7 +22578,6 @@ function createPostgresBootstrapper(pgConfig) {
 			const wantsCdc = cdcMode !== "off";
 			const explicitCdc = cdcMode === "trigger" || cdcMode === "wal";
 			let cdcEnabled = false;
-			let provisionCdcForTables;
 			if (wantsCdc && !directUrl) {
 				const reason = "no direct database connection is available for the realtime LISTEN client (set DATABASE_DIRECT_URL)";
 				if (explicitCdc) logger.warn(`⚠️ [CDC] REALTIME_CDC=${cdcMode} but ${reason} — using app-level realtime.`);
@@ -22789,9 +22594,6 @@ function createPostgresBootstrapper(pgConfig) {
 					})).filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table)));
 					await realtimeService.enableCdc(directUrl);
 					cdcEnabled = true;
-					provisionCdcForTables = async (tables) => {
-						await provisionTriggerCdc(cdcRunSql, tables);
-					};
 					logger.info(`📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). All writes now emit realtime events regardless of origin.`);
 				} catch (err) {
 					if (explicitCdc) logger.warn("⚠️ [CDC] Could not enable database-level change capture — falling back to app-level realtime.", { error: err });
@@ -22816,14 +22618,13 @@ function createPostgresBootstrapper(pgConfig) {
 					const dbTables = new Set(result.rows.map((r) => r.table_schema === "public" ? r.table_name : `${r.table_schema}.${r.table_name}`));
 					const missing = [];
 					for (const col of registeredCollections) {
-						if (col.auth?.enabled) continue;
 						const schemaName = "schema" in col && col.schema ? col.schema : "public";
 						const tableName = registry.hasTableForCollection(col.table ?? col.slug) ? col.table ?? col.slug : col.slug;
 						const checkName = registry.getTableNames().find((k) => k === tableName || k === col.slug) ?? tableName;
 						const fullCheckName = schemaName === "public" ? checkName : `${schemaName}.${checkName}`;
 						if (!dbTables.has(fullCheckName)) missing.push({
 							slug: col.slug,
-							table: fullCheckName
+							table: checkName
 						});
 					}
 					if (missing.length > 0) {
@@ -22857,8 +22658,7 @@ function createPostgresBootstrapper(pgConfig) {
 					registry,
 					realtimeService,
 					driver,
-					poolManager,
-					provisionCdcForTables
+					poolManager
 				}
 			};
 		},
@@ -22870,18 +22670,6 @@ function createPostgresBootstrapper(pgConfig) {
 			const registry = internals.registry;
 			const authCollection = authConfig.collection;
 			await ensureAuthTablesExist(db, authCollection);
-			if (authCollection && internals.provisionCdcForTables) {
-				const authSchema = "schema" in authCollection && typeof authCollection.schema === "string" ? authCollection.schema : "rebase";
-				const authTable = "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug;
-				if (authTable) try {
-					await internals.provisionCdcForTables([{
-						schema: authSchema,
-						table: authTable
-					}]);
-				} catch (err) {
-					logger.warn(`⚠️ [CDC] Could not attach change-capture to the auth table "${authSchema}.${authTable}" — writes to it won't emit database-level events.`, { detail: err instanceof Error ? err.message : String(err) });
-				}
-			}
 			let emailService;
 			if (authConfig.email) emailService = createEmailService(authConfig.email);
 			const tableName = authCollection ? "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug : void 0;
@@ -22952,6 +22740,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map