@rebasepro/server-postgres 0.9.1-canary.ad25bc0 → 0.9.1-canary.ad870eb

package/dist/index.es.js

@@ -3,15 +3,15 @@ import process from "process";
 const require = __createRequire(import.meta.url);
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
-import { ApiError, createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
+import { createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, or, relations, sql } from "drizzle-orm";
 import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
+import { createHash, randomUUID } from "crypto";
 import fs, { promises } from "fs";
 import path from "path";
 import chokidar from "chokidar";
 import { WebSocket, WebSocketServer } from "ws";
 import { EventEmitter } from "events";
-import { randomUUID } from "crypto";
 import { inspect } from "util";
 import os from "os";
 import { fileURLToPath } from "node:url";
@@ -1502,140 +1502,6 @@ function removeFunctions(o) {
 	return o;
 }
 //#endregion
-//#region ../utils/src/sha1.ts
-/**
-* Minimal SHA-1 implementation that runs in both Node and the browser.
-*
-* This exists because generated Postgres policy names embed a SHA-1 digest of
-* the security rule. The DDL generator runs on the server (where `node:crypto`
-* is available) but the Studio has to derive the same names in the browser to
-* tell a policy it generated apart from one it did not. `node:crypto` cannot be
-* bundled for the browser, so the shared derivation needs a portable digest.
-*
-* SHA-1 is used purely to name things deterministically — never for security.
-* The output is byte-identical to `createHash("sha1").update(str).digest("hex")`,
-* which `sha1.test.ts` pins against `node:crypto` directly.
-*/
-/** Rotate a 32-bit word left by `n` bits. */
-function rotl(value, n) {
-	return value << n | value >>> 32 - n;
-}
-/**
-* SHA-1 digest of a string, hex-encoded.
-*
-* The input is encoded as UTF-8, matching Node's default handling of strings
-* passed to `hash.update(str)`.
-*/
-function sha1Hex(input) {
-	const bytes = Array.from(new TextEncoder().encode(input));
-	const bitLength = bytes.length * 8;
-	bytes.push(128);
-	while (bytes.length % 64 !== 56) bytes.push(0);
-	const hi = Math.floor(bitLength / 4294967296);
-	const lo = bitLength >>> 0;
-	bytes.push(hi >>> 24 & 255, hi >>> 16 & 255, hi >>> 8 & 255, hi & 255);
-	bytes.push(lo >>> 24 & 255, lo >>> 16 & 255, lo >>> 8 & 255, lo & 255);
-	let h0 = 1732584193;
-	let h1 = 4023233417;
-	let h2 = 2562383102;
-	let h3 = 271733878;
-	let h4 = 3285377520;
-	const w = new Array(80);
-	for (let offset = 0; offset < bytes.length; offset += 64) {
-		for (let i = 0; i < 16; i++) {
-			const j = offset + i * 4;
-			w[i] = bytes[j] << 24 | bytes[j + 1] << 16 | bytes[j + 2] << 8 | bytes[j + 3] | 0;
-		}
-		for (let i = 16; i < 80; i++) w[i] = rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
-		let a = h0;
-		let b = h1;
-		let c = h2;
-		let d = h3;
-		let e = h4;
-		for (let i = 0; i < 80; i++) {
-			let f;
-			let k;
-			if (i < 20) {
-				f = b & c | ~b & d;
-				k = 1518500249;
-			} else if (i < 40) {
-				f = b ^ c ^ d;
-				k = 1859775393;
-			} else if (i < 60) {
-				f = b & c | b & d | c & d;
-				k = 2400959708;
-			} else {
-				f = b ^ c ^ d;
-				k = 3395469782;
-			}
-			const temp = rotl(a, 5) + f + e + k + w[i] | 0;
-			e = d;
-			d = c;
-			c = rotl(b, 30);
-			b = a;
-			a = temp;
-		}
-		h0 = h0 + a | 0;
-		h1 = h1 + b | 0;
-		h2 = h2 + c | 0;
-		h3 = h3 + d | 0;
-		h4 = h4 + e | 0;
-	}
-	return [
-		h0,
-		h1,
-		h2,
-		h3,
-		h4
-	].map((word) => (word >>> 0).toString(16).padStart(8, "0")).join("");
-}
-//#endregion
-//#region ../utils/src/policy-names.ts
-/**
-* Naming of the Postgres policies generated from a collection's security rules.
-*
-* A rule without an explicit `name` is compiled to `<table>_<op>_<hash>`, where
-* the hash covers the rule's semantics. The Studio needs the same names to tell
-* "this policy came from your code" apart from "someone wrote this in SQL" —
-* without them it treats generated policies as foreign and offers to import
-* them back into the codebase they came from.
-*
-* This is the single definition of that naming. The DDL and Drizzle generators
-* both derive names from here, so a change cannot silently rename every policy
-* in every deployed database while the UI keeps matching the old ones.
-*/
-/** Stable digest of the parts of a rule that determine what the policy does. */
-function getPolicyNameHash(rule) {
-	return sha1Hex(JSON.stringify({
-		a: rule.access,
-		m: rule.mode,
-		op: rule.operation,
-		ops: rule.operations?.slice().sort(),
-		own: rule.ownerField,
-		rol: rule.roles?.slice().sort(),
-		pg: rule.pgRoles?.slice().sort(),
-		u: rule.using,
-		w: rule.withCheck,
-		c: rule.condition,
-		ch: rule.check
-	})).substring(0, 7);
-}
-/** The operations a rule expands to — `operations` wins over `operation`. */
-function getPolicyOperations(rule) {
-	return rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
-}
-/**
-* Every Postgres policy name a single rule compiles to — one per operation.
-*
-* @param rule      The security rule as written in the collection config.
-* @param tableName The rule's table (see `getTableName` in `@rebasepro/common`).
-*/
-function getPolicyNamesForRule(rule, tableName) {
-	const ops = getPolicyOperations(rule);
-	const ruleHash = getPolicyNameHash(rule);
-	return ops.map((op, opIdx) => rule.name ? ops.length > 1 ? `${rule.name}_${op}` : rule.name : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`);
-}
-//#endregion
 //#region ../utils/src/names.ts
 /**
 * Generates a foreign key column name from a given string, typically a collection slug or name.
@@ -1760,98 +1626,6 @@ function createRelationRefWithData(id, path, data) {
 		data
 	};
 }
-/**
-* Derive a row's address from its key columns.
-*
-* Single key → the value as a string. Composite → each part joined by
-* {@link COMPOSITE_ID_SEPARATOR}, in primary-key order, which is what
-* {@link parseIdValues} expects to invert.
-*/
-function buildCompositeId(values, primaryKeys) {
-	if (primaryKeys.length === 0) return "";
-	if (primaryKeys.length === 1) return String(values[primaryKeys[0].fieldName] ?? "");
-	return primaryKeys.map((pk) => String(values[pk.fieldName] ?? "")).join(":::");
-}
-/**
-* Invert {@link buildCompositeId}: turn an address back into key columns, each
-* coerced to the type its column actually round-trips as.
-*
-* This is the boundary where a URL segment becomes a query parameter, so a
-* malformed address must throw rather than silently produce a query that
-* matches the wrong row (or none).
-*/
-function parseIdValues(idValue, primaryKeys) {
-	const result = {};
-	if (primaryKeys.length === 0) return result;
-	if (primaryKeys.length === 1) {
-		const pk = primaryKeys[0];
-		if (pk.type === "number" && !pk.isUUID) {
-			const parsed = typeof idValue === "number" ? idValue : parseInt(String(idValue), 10);
-			if (isNaN(parsed)) throw new Error(`Invalid numeric ID: ${idValue}`);
-			result[pk.fieldName] = parsed;
-		} else result[pk.fieldName] = String(idValue);
-		return result;
-	}
-	const parts = String(idValue).split(":::");
-	if (parts.length !== primaryKeys.length) throw new Error(`Composite ID parts mismatch. Expected ${primaryKeys.length}, got ${parts.length} for ID: ${idValue}`);
-	for (let i = 0; i < primaryKeys.length; i++) {
-		const pk = primaryKeys[i];
-		const val = parts[i];
-		if (pk.type === "number" && !pk.isUUID) {
-			const parsed = parseInt(val, 10);
-			if (isNaN(parsed)) throw new Error(`Invalid numeric ID component: ${val}`);
-			result[pk.fieldName] = parsed;
-		} else result[pk.fieldName] = val;
-	}
-	return result;
-}
-/**
-* The primary keys of a collection, as declared by its properties.
-*
-* The driver can also infer keys from the Drizzle schema, which the browser
-* cannot see — so the server normalizes what it resolved onto the config it
-* serves (see `stampPrimaryKeys`), and this reads that back. Returns an empty
-* array when a collection declares none, which callers must treat as "not
-* addressable" rather than defaulting to `id`: guessing a key that is not the
-* real one produces confidently wrong addresses.
-*/
-function getDeclaredPrimaryKeys(collection) {
-	const properties = collection.properties;
-	if (!properties) return [];
-	const keys = [];
-	for (const [fieldName, propRaw] of Object.entries(properties)) {
-		const prop = propRaw;
-		if (!prop || typeof prop !== "object") continue;
-		if (!("isId" in prop) || !prop.isId) continue;
-		keys.push({
-			fieldName,
-			type: prop.type === "number" ? "number" : "string",
-			isUUID: prop.isId === "uuid"
-		});
-	}
-	return keys;
-}
-/**
-* The keys to address a collection's rows with, resolved the way the driver
-* resolves them — minus the tier the browser cannot reach.
-*
-* The postgres driver tries, in order: properties marked `isId`; the primary
-* keys of the Drizzle schema; and finally a column literally named `id`. Only
-* the first and last are visible in a `CollectionConfig`, which is what both
-* sides share — so a collection whose key is *only* known to Drizzle, and is
-* not named `id`, resolves to nothing here. That is reported rather than
-* guessed: inventing a key produces addresses that look right and route wrong.
-*/
-function resolvePrimaryKeys(collection) {
-	const declared = getDeclaredPrimaryKeys(collection);
-	if (declared.length > 0) return declared;
-	const idProp = collection.properties?.id;
-	if (idProp && typeof idProp === "object") return [{
-		fieldName: "id",
-		type: idProp.type === "number" ? "number" : "string"
-	}];
-	return [];
-}
 //#endregion
 //#region ../common/src/util/enums.ts
 function enumToObjectEntries(enumValues) {
@@ -2086,109 +1860,15 @@ function getSubcollections(collection) {
 * - `field = 'literal'`
 * - `field != 'literal'`
 * - `field = current_setting('app.user_id')`
-* - `A AND B`, `A OR B` — only where the keyword is at the top level
+* - `A AND B`
 * - `true`
 * - `IN (...)` (as optimistic true)
 *
 * For anything it doesn't understand, it returns a `raw` expression, which
 * the evaluator treats as "unknown" (and usually optimistic true).
-*
-* **This output also round-trips back into DDL** via `policyToPostgres` (the
-* schema/policy generators), so decomposing a clause the parser only partly
-* understands is not a cosmetic mistake — it emits invalid SQL. When in doubt,
-* prefer `raw`: it is reproduced verbatim.
-*/
-/** True when `keyword` starts at `i` as a standalone word. */
-function isKeywordAt(upper, i, keyword) {
-	if (!upper.startsWith(keyword, i)) return false;
-	const before = i === 0 ? " " : upper[i - 1];
-	const after = upper[i + keyword.length] ?? " ";
-	return /[\s()]/.test(before) && /[\s()]/.test(after);
-}
-/**
-* Split `sql` on a boolean keyword, but only where it sits at paren depth 0 and
-* outside a string literal. Returns null when it never does, so the caller
-* leaves the clause alone.
-*
-* This used to be `sql.split(/ AND /i)`, which tore subqueries in half: the
-* `AND` inside
-*   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = auth.uid())`
-* split the expression, and re-emitting the halves produced
-*   `(EXISTS (...) AND m.user_id = auth.uid())`
-* where `m` is no longer in scope — SQL that Postgres rejects outright with
-* "missing FROM-clause entry for table". Returning null instead keeps such a
-* clause as a `raw` expression, which round-trips verbatim.
 */
-function splitTopLevel(sql, keyword) {
-	const upper = sql.toUpperCase();
-	const parts = [];
-	let depth = 0;
-	let inString = false;
-	let start = 0;
-	for (let i = 0; i < sql.length; i++) {
-		const ch = sql[i];
-		if (inString) {
-			if (ch === "'") if (sql[i + 1] === "'") i++;
-			else inString = false;
-			continue;
-		}
-		if (ch === "'") {
-			inString = true;
-			continue;
-		}
-		if (ch === "(") {
-			depth++;
-			continue;
-		}
-		if (ch === ")") {
-			depth--;
-			continue;
-		}
-		if (depth === 0 && isKeywordAt(upper, i, keyword)) {
-			parts.push(sql.slice(start, i));
-			i += keyword.length - 1;
-			start = i + 1;
-		}
-	}
-	if (parts.length === 0) return null;
-	parts.push(sql.slice(start));
-	const trimmedParts = parts.map((p) => p.trim()).filter((p) => p.length > 0);
-	return trimmedParts.length > 1 ? trimmedParts : null;
-}
-/** Drop redundant wrapping parens (`(a AND b)` → `a AND b`), never `(a) AND (b)`. */
-function stripOuterParens(sql) {
-	let s = sql.trim();
-	for (;;) {
-		if (!s.startsWith("(") || !s.endsWith(")")) return s;
-		let depth = 0;
-		let inString = false;
-		let wraps = true;
-		for (let i = 0; i < s.length; i++) {
-			const ch = s[i];
-			if (inString) {
-				if (ch === "'") if (s[i + 1] === "'") i++;
-				else inString = false;
-				continue;
-			}
-			if (ch === "'") {
-				inString = true;
-				continue;
-			}
-			if (ch === "(") depth++;
-			else if (ch === ")") {
-				depth--;
-				if (depth === 0 && i < s.length - 1) {
-					wraps = false;
-					break;
-				}
-			}
-		}
-		if (!wraps) return s;
-		s = s.slice(1, -1).trim();
-	}
-}
 function sqlToPolicy(sql) {
-	const trimmed = stripOuterParens(sql.trim());
+	const trimmed = sql.trim();
 	if (trimmed.toLowerCase() === "true") return policy.true();
 	if (trimmed.toLowerCase() === "false") return policy.false();
 	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
@@ -2201,10 +1881,14 @@ function sqlToPolicy(sql) {
 		const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
 		return policy.rolesContain(roles);
 	}
-	const orParts = splitTopLevel(trimmed, "OR");
-	if (orParts) return policy.or(...orParts.map(sqlToPolicy));
-	const andParts = splitTopLevel(trimmed, "AND");
-	if (andParts) return policy.and(...andParts.map(sqlToPolicy));
+	if (trimmed.toUpperCase().includes(" OR ")) {
+		const parts = trimmed.split(/ OR /i);
+		return policy.or(...parts.map(sqlToPolicy));
+	}
+	if (trimmed.toUpperCase().includes(" AND ")) {
+		const parts = trimmed.split(/ AND /i);
+		return policy.and(...parts.map(sqlToPolicy));
+	}
 	const match = trimmed.match(/^(.+?)\s*(!?=)\s*(.+)$/);
 	if (match) {
 		const [, leftStr, op, rightStr] = match;
@@ -2510,105 +2194,6 @@ var buildPropertyCallbacks = (properties) => {
 	};
 	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
 };
-//#endregion
-//#region ../common/src/util/auth-default-policies.ts
-/**
-* Default RLS policies injected by the schema generator.
-*
-* Rebase's enforcement model is unified: authenticated (user-context) requests
-* run under the restricted `rebase_user` role, so Postgres RLS binds *every*
-* statement — reads and writes. A collection's `securityRules` are the whole
-* authorization model. The server context (auth flows, migrations,
-* `dataAsAdmin`) runs as the owner and bypasses RLS.
-*
-* Because RLS default-denies, every collection is **locked by default**: with
-* no rules, only the server context and admins can touch it. The generator
-* injects that safe baseline:
-*
-* **For every collection**
-*  1. A permissive **server-or-admin SELECT** grant.
-*  2. A permissive **server-or-admin write** grant (insert/update/delete).
-*
-* Author `securityRules` are permissive and OR together, so explicit rules only
-* *broaden* access from this locked baseline (e.g. "users read/write their own
-* rows").
-*
-* **For auth collections additionally**
-*  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
-*     their own row (profile, session bootstrap) without every app re-declaring
-*     it.
-*  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
-*     every other policy, so a write is rejected unless the caller is an admin
-*     (or the server context) — even if the author also wrote a permissive rule
-*     such as "a user may edit their own row". Without this, a permissive owner
-*     rule would let a user change their own `roles`.
-*
-* The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
-* — the built-in flows that run without a user (signup, migrations) set no user
-* GUC — which also lets the owner connection satisfy these policies even under
-* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
-* `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
-*
-* Opt out with `disableDefaultPolicies: true` to take full responsibility for
-* the collection's RLS.
-*/
-var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
-/** Write operations that must be admin-gated by default on auth collections. */
-var DEFAULT_GUARDED_OPS = [
-	"insert",
-	"update",
-	"delete"
-];
-/** Whether a collection is flagged as an authentication collection. */
-function isAuthCollection(collection) {
-	const auth = collection.auth;
-	return auth === true || typeof auth === "object" && auth?.enabled === true;
-}
-/** The property marked as the row id (falls back to `id`). */
-function getIdPropertyName(collection) {
-	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
-	return "id";
-}
-/**
-* Returns the security rules that should be applied to a collection: the
-* author's explicit `securityRules` plus the framework defaults described in
-* the module doc (baseline server/admin read for all collections; self-read
-* and the admin write gate for auth collections).
-*
-* Collections that opt out via `disableDefaultPolicies` are returned unchanged.
-*/
-function getEffectiveSecurityRules(collection) {
-	const explicit = [...(isPostgresCollectionConfig(collection) ? collection.securityRules : void 0) ?? []];
-	if (collection.disableDefaultPolicies) return explicit;
-	const tableName = getTableName$1(collection);
-	const injected = [];
-	injected.push({
-		name: `${tableName}_default_admin_read`,
-		operations: ["select"],
-		condition: SERVER_OR_ADMIN_EXPR
-	});
-	injected.push({
-		name: `${tableName}_default_admin_write`,
-		operations: [...DEFAULT_GUARDED_OPS],
-		condition: SERVER_OR_ADMIN_EXPR,
-		check: SERVER_OR_ADMIN_EXPR
-	});
-	if (isAuthCollection(collection)) {
-		injected.push({
-			name: `${tableName}_default_self_read`,
-			operations: ["select"],
-			condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
-		});
-		injected.push({
-			name: `${tableName}_require_admin_write`,
-			mode: "restrictive",
-			operations: [...DEFAULT_GUARDED_OPS],
-			condition: SERVER_OR_ADMIN_EXPR,
-			check: SERVER_OR_ADMIN_EXPR
-		});
-	}
-	return [...explicit, ...injected];
-}
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(root, factory) {
 		if (typeof define === "function" && define.amd) define(factory);
@@ -3878,45 +3463,18 @@ function deserializeFilter(query) {
 }
 //#endregion
 //#region ../common/src/data/buildRebaseData.ts
-function createPrimaryKeyResolver(options) {
-	const cache = /* @__PURE__ */ new Map();
-	const warned = /* @__PURE__ */ new Set();
-	return function primaryKeysFor(slug) {
-		const cached = cache.get(slug);
-		if (cached) return cached;
-		const collection = options?.resolveCollection?.(slug);
-		if (!collection) return [];
-		const keys = resolvePrimaryKeys(collection);
-		if (keys.length > 0) {
-			cache.set(slug, keys);
-			return keys;
-		}
-		if (!warned.has(slug)) {
-			warned.add(slug);
-			console.warn(`[rebase] Collection '${slug}' declares no primary key, so its rows have no address: detail links, caching and relations will not work for it. Mark the key property with \`isId\` in its collection config.`);
-		}
-		return keys;
-	};
-}
 /**
-* Give a flat row the Entity view-model the admin renders.
-*
-* The address is *derived here* — it is not a column, and the row it came from
-* does not contain one. Rows carry exactly what the table has, with the types
-* Postgres returned; the id is this layer's invention, and this is the only
-* place it is minted.
-*
-* `primaryKeys` empty falls back to a literal `id` on the row: drivers other
-* than postgres still serve rows with one, and this keeps them working.
+* Convert a flat REST record (e.g. from RestFetchService) to Entity<M> format.
+* Mirrors the client SDK's rowToEntity conversion.
 */
-function rowToEntity(row, slug, primaryKeys = []) {
+function rowToEntity(row, slug) {
 	return {
-		id: primaryKeys.length > 0 ? buildCompositeId(row, primaryKeys) : row.id,
+		id: row.id,
 		path: slug,
 		values: row
 	};
 }
-function createDriverAccessor(driver, slug, getPks = () => []) {
+function createDriverAccessor(driver, slug) {
 	const accessor = {
 		async find(params) {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
@@ -3949,7 +3507,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				hasMore = offset + rows.length < total;
 			}
 			return {
-				data: rows.map((row) => rowToEntity(row, slug, getPks())),
+				data: rows.map((row) => rowToEntity(row, slug)),
 				meta: {
 					total,
 					limit,
@@ -3963,7 +3521,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				path: slug,
 				id
 			});
-			return row ? rowToEntity(row, slug, getPks()) : void 0;
+			return row ? rowToEntity(row, slug) : void 0;
 		},
 		async create(data, id) {
 			return rowToEntity(await driver.save({
@@ -3971,22 +3529,15 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				values: data,
 				id,
 				status: "new"
-			}), slug, getPks());
+			}), slug);
 		},
-		createMany: driver.saveMany ? async (data, options) => {
-			return (await driver.saveMany({
-				path: slug,
-				rows: data,
-				upsert: options?.upsert
-			})).map((row) => rowToEntity(row, slug, getPks()));
-		} : void 0,
 		async update(id, data) {
 			return rowToEntity(await driver.save({
 				path: slug,
 				values: data,
 				id,
 				status: "existing"
-			}), slug, getPks());
+			}), slug);
 		},
 		async delete(id) {
 			return driver.delete({ row: {
@@ -4015,7 +3566,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				searchString: params?.searchString,
 				onUpdate: (entities) => {
 					onUpdate({
-						data: entities.map((row) => rowToEntity(row, slug, getPks())),
+						data: entities.map((row) => rowToEntity(row, slug)),
 						meta: {
 							total: entities.length,
 							limit,
@@ -4031,7 +3582,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 			return driver.listenOne({
 				path: slug,
 				id,
-				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug, getPks()) : void 0),
+				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug) : void 0),
 				onError
 			});
 		} : void 0,
@@ -4070,13 +3621,12 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 * await data.products.create({ name: "Camera", price: 299 });
 * const { data: items } = await data.products.find({ where: { status: ["==", "published"] } });
 */
-function buildRebaseData(driver, options) {
+function buildRebaseData(driver) {
 	const cache = /* @__PURE__ */ new Map();
-	const primaryKeysFor = createPrimaryKeyResolver(options);
 	function getAccessor(slug) {
 		let accessor = cache.get(slug);
 		if (!accessor) {
-			accessor = createDriverAccessor(driver, slug, () => primaryKeysFor(slug));
+			accessor = createDriverAccessor(driver, slug);
 			cache.set(slug, accessor);
 		}
 		return accessor;
@@ -4089,9 +3639,8 @@ function buildRebaseData(driver, options) {
 	} });
 }
 /**
-* Unwrap a Entity back into the flat row it was built from. `rowToEntity` keeps
-* the row untouched under `.values` and derives `.id` alongside it, so dropping
-* the wrapper is the whole operation — the address was never part of the row.
+* Unwrap a Entity into a flat row. `rowToEntity` stores the whole flat row
+* (id included) under `.values`, so this is just that payload.
 */
 function entityToRow(entity) {
 	return entity.values;
@@ -4178,12 +3727,6 @@ function toSdkCollectionClient(snap) {
 		async create(data, id) {
 			return entityToRow(await snap.create(data, id));
 		},
-		async createMany(data, options) {
-			if (!Array.isArray(data)) throw new TypeError("createMany expects an array of records.");
-			if (data.length === 0) return [];
-			if (!snap.createMany) throw new Error("Bulk writes are not supported by this collection's data source. Fall back to create() per record.");
-			return (await snap.createMany(data, options)).map(entityToRow);
-		},
 		async update(id, data) {
 			return entityToRow(await snap.update(id, data));
 		},
@@ -4373,6 +3916,36 @@ function getPrimaryKeys(collection, registry) {
 	}
 	return keys;
 }
+function parseIdValues(idValue, primaryKeys) {
+	const result = {};
+	if (primaryKeys.length === 0) return result;
+	if (primaryKeys.length === 1) {
+		const pk = primaryKeys[0];
+		if (pk.type === "number" && !pk.isUUID) {
+			const parsed = typeof idValue === "number" ? idValue : parseInt(String(idValue), 10);
+			if (isNaN(parsed)) throw new Error(`Invalid numeric ID: ${idValue}`);
+			result[pk.fieldName] = parsed;
+		} else result[pk.fieldName] = String(idValue);
+		return result;
+	}
+	const parts = String(idValue).split(":::");
+	if (parts.length !== primaryKeys.length) throw new Error(`Composite ID parts mismatch. Expected ${primaryKeys.length}, got ${parts.length} for ID: ${idValue}`);
+	for (let i = 0; i < primaryKeys.length; i++) {
+		const pk = primaryKeys[i];
+		const val = parts[i];
+		if (pk.type === "number" && !pk.isUUID) {
+			const parsed = parseInt(val, 10);
+			if (isNaN(parsed)) throw new Error(`Invalid numeric ID component: ${val}`);
+			result[pk.fieldName] = parsed;
+		} else result[pk.fieldName] = val;
+	}
+	return result;
+}
+function buildCompositeId(values, primaryKeys) {
+	if (primaryKeys.length === 0) return "";
+	if (primaryKeys.length === 1) return String(values[primaryKeys[0].fieldName] ?? "");
+	return primaryKeys.map((pk) => String(values[pk.fieldName] ?? "")).join(":::");
+}
 //#endregion
 //#region src/utils/drizzle-conditions.ts
 /**
@@ -6192,14 +5765,12 @@ var FetchService = class {
 	/**
 	* Convert a db.query result row (with nested relation objects) to a flat row.
 	* Handles:
+	* - Placing `id` at the top level as a string
 	* - Type normalization (dates, numbers, NaN) via normalizeDbValues
 	* - Converting nested relation objects to { id, path, __type: "relation" } for CMS
 	* - Flattening junction-table many-to-many results
-	*
-	* The row's own address is not among them: it is derived by the consumer
-	* from the collection's primary keys.
 	*/
-	drizzleResultToRow(row, collection) {
+	drizzleResultToRow(row, collection, _collectionPath, idInfo, _databaseId, idInfoArray) {
 		const resolvedRelations = resolveCollectionRelations(collection);
 		const normalizedValues = normalizeDbValues(row, collection);
 		for (const [key, relation] of Object.entries(resolvedRelations)) {
@@ -6235,7 +5806,10 @@ var FetchService = class {
 				});
 			}
 		}
-		return normalizedValues;
+		return {
+			...normalizedValues,
+			id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
+		};
 	}
 	/**
 	* Post-fetch joinPath relations for a single flat row.
@@ -6324,28 +5898,37 @@ var FetchService = class {
 		}
 	}
 	/**
-	* Convert a db.query result row to a flat REST-style row with populated relations.
-	*
-	* Every column is copied through under its own name, with the value Postgres
-	* returned. This used to open with a synthesized `id` and then skip the key
-	* column, which renamed it (a `sku` primary key was served as `id`, and `sku`
-	* did not appear at all) and restringified it (`42` → `"42"`). Consumers that
-	* need an address derive it from the collection's primary keys.
+	* Convert a db.query result row to a flat REST-style object with populated relations.
 	*/
-	drizzleResultToRestRow(row, collection) {
-		const flat = {};
+	drizzleResultToRestRow(row, collection, idInfo, idInfoArray) {
+		const flat = { id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName]) };
 		const resolvedRelations = resolveCollectionRelations(collection);
 		for (const [k, v] of Object.entries(row)) {
+			if (k === idInfo.fieldName) continue;
 			const relation = findRelation(resolvedRelations, k);
 			if (Array.isArray(v) && relation) flat[k] = v.map((item) => {
 				if (this.isJunctionRelation(relation, collection)) {
 					const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-					if (nestedKey) return { ...item[nestedKey] };
+					if (nestedKey) {
+						const nested = item[nestedKey];
+						return {
+							...nested,
+							id: String(nested.id ?? nested[Object.keys(nested)[0]])
+						};
+					}
 				}
-				return { ...item };
+				return {
+					...item,
+					id: String(item.id ?? item[Object.keys(item)[0]])
+				};
 			});
-			else if (typeof v === "object" && v !== null && !Array.isArray(v) && relation) flat[k] = { ...v };
-			else flat[k] = v;
+			else if (typeof v === "object" && v !== null && !Array.isArray(v) && relation) {
+				const relObj = v;
+				flat[k] = {
+					...relObj,
+					id: String(relObj.id ?? relObj[Object.keys(relObj)[0]])
+				};
+			} else flat[k] = v;
 		}
 		return flat;
 	}
@@ -6433,7 +6016,7 @@ var FetchService = class {
 				with: withConfig
 			});
 			if (!row) return void 0;
-			const flatRow = this.drizzleResultToRow(row, collection);
+			const flatRow = this.drizzleResultToRow(row, collection, collectionPath, idInfo, databaseId, idInfoArray);
 			await this.resolveJoinPathRelations(flatRow, collection, collectionPath, parsedId, databaseId);
 			return flatRow;
 		} catch (e) {
@@ -6485,7 +6068,7 @@ var FetchService = class {
 		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
 		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0);
-			return (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRow(row, collection));
+			return (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRow(row, collection, collectionPath, idInfo, options.databaseId, idInfoArray));
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
 				logger.error(`[FetchService] Relation inference error for collection '${collectionPath}': ${e.message}`);
@@ -6556,7 +6139,8 @@ var FetchService = class {
 		const parsedRows = await Promise.all(results.map(async (rawRow) => {
 			return {
 				rawRow,
-				values: await parseDataFromServer(rawRow, collection)
+				values: await parseDataFromServer(rawRow, collection),
+				id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(rawRow, idInfoArray) : String(rawRow[idInfo.fieldName])
 			};
 		}));
 		if (!skipRelations) {
@@ -6596,7 +6180,10 @@ var FetchService = class {
 				logger.warn(`Could not batch load many relation property: ${key}`, { error: e });
 			}
 		}
-		return parsedRows.map((item) => item.values);
+		return parsedRows.map((item) => ({
+			...item.values,
+			id: item.id
+		}));
 	}
 	/**
 	* Fetch a collection of rows
@@ -6727,7 +6314,7 @@ var FetchService = class {
 		if (qb && !options.searchString && !options.vectorSearch) try {
 			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig);
-			const restRows = (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRestRow(row, collection));
+			const restRows = (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRestRow(row, collection, idInfo, idInfoArray));
 			await this.resolveJoinPathRelationsBatchRest(restRows, collection, collectionPath, idInfoArray, include);
 			return restRows;
 		} catch (e) {
@@ -6738,7 +6325,10 @@ var FetchService = class {
 			logger.warn(`[fetchCollectionForRest] db.query.findMany failed for ${collectionPath}, falling back`, { error: e });
 		}
 		const rows = await this.fetchRowsWithConditionsRaw(collectionPath, options);
-		if (!include || include.length === 0) return rows;
+		if (!include || include.length === 0) return rows.map((row) => ({
+			...row,
+			id: idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
+		}));
 		const resolvedRelations = resolveCollectionRelations(collection);
 		const propertyKeys = new Set(Object.keys(collection.properties || {}));
 		const shouldInclude = (key) => include[0] === "*" || include.includes(key);
@@ -6750,7 +6340,10 @@ var FetchService = class {
 				for (const row of rows) {
 					const eid = row[idInfo.fieldName];
 					const related = batchResults.get(String(eid));
-					if (related) row[key] = { ...related.values };
+					if (related) row[key] = {
+						...related.values,
+						id: related.id
+					};
 				}
 			} catch (e) {
 				logger.warn(`[include] Failed to batch load one-to-one '${key}'`, { error: e });
@@ -6768,7 +6361,10 @@ var FetchService = class {
 				logger.warn(`[include] Failed to batch load many '${key}'`, { error: e });
 			}
 		}
-		return rows;
+		return rows.map((row) => ({
+			...row,
+			id: idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName])
+		}));
 	}
 	/**
 	* Fetch a single row with optional relation includes for REST API.
@@ -6789,7 +6385,7 @@ var FetchService = class {
 				...withConfig ? { with: withConfig } : {}
 			});
 			if (!row) return null;
-			const restRow = this.drizzleResultToRestRow(row, collection);
+			const restRow = this.drizzleResultToRestRow(row, collection, idInfo, idInfoArray);
 			await this.resolveJoinPathRelationsBatchRest([restRow], collection, collectionPath, idInfoArray, include);
 			return restRow;
 		} catch (e) {
@@ -6801,7 +6397,11 @@ var FetchService = class {
 		}
 		const result = await this.db.select().from(table).where(eq(idField, parsedId)).limit(1);
 		if (result.length === 0) return null;
-		const flatEntity = { ...result[0] };
+		const raw = result[0];
+		const flatEntity = {
+			...raw,
+			id: idInfoArray.length > 1 ? buildCompositeId(raw, idInfoArray) : String(raw[idInfo.fieldName])
+		};
 		if (!include || include.length === 0) return flatEntity;
 		const resolvedRelations = resolveCollectionRelations(collection);
 		const propertyKeys = new Set(Object.keys(collection.properties || {}));
@@ -6913,15 +6513,32 @@ var FetchService = class {
 				if (orderByField) queryOpts.orderBy = options.order === "asc" ? asc(orderByField) : desc(orderByField);
 			}
 			return (await queryTarget.findMany(queryOpts)).map((row) => {
-				const flat = {};
-				for (const [k, v] of Object.entries(row)) if (Array.isArray(v)) flat[k] = v.map((item) => {
-					const keys = Object.keys(item);
-					const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-					if (nestedObj && keys.length <= 3) return { ...item[nestedObj] };
-					return { ...item };
-				});
-				else if (typeof v === "object" && v !== null) flat[k] = { ...v };
-				else flat[k] = v;
+				const flat = { id: idInfoArray && idInfoArray.length > 1 ? buildCompositeId(row, idInfoArray) : String(row[idInfo.fieldName]) };
+				for (const [k, v] of Object.entries(row)) {
+					if (k === idInfo.fieldName) continue;
+					if (Array.isArray(v)) flat[k] = v.map((item) => {
+						const keys = Object.keys(item);
+						const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
+						if (nestedObj && keys.length <= 3) {
+							const nested = item[nestedObj];
+							return {
+								...nested,
+								id: String(nested.id ?? nested[Object.keys(nested)[0]])
+							};
+						}
+						return {
+							...item,
+							id: String(item.id ?? item[Object.keys(item)[0]])
+						};
+					});
+					else if (typeof v === "object" && v !== null) {
+						const relObj = v;
+						flat[k] = {
+							...relObj,
+							id: String(relObj.id ?? relObj[Object.keys(relObj)[0]])
+						};
+					} else flat[k] = v;
+				}
 				return flat;
 			});
 		} catch (e) {
@@ -7137,27 +6754,6 @@ var PersistService = class {
 		this.fetchService = new FetchService(db, registry);
 	}
 	/**
-	* Explain a write that matched no rows.
-	*
-	* Row-level security filters UPDATE and DELETE through the policy's USING
-	* clause instead of raising: a denied write is reported by Postgres exactly
-	* like a successful one that happened to match nothing. Left unchecked, a
-	* caller cannot tell "denied" from "done" — the write returns 200/204 and
-	* the row is untouched.
-	*
-	* Re-reading the target over the *same* RLS-scoped handle separates the two
-	* cases. A visible row means the policy rejected the write (403); an
-	* invisible one means there is nothing there to write for this caller (404,
-	* matching what a GET would say). The re-read is bound by the caller's own
-	* policies, so it discloses nothing a plain read wouldn't.
-	*
-	* Only reached when zero rows matched, so the happy path pays nothing.
-	*/
-	async explainZeroRowWrite(handle, table, conditions, collectionPath, id, operation) {
-		if ((await handle.select({ present: sql`1` }).from(table).where(and(...conditions)).limit(1)).length > 0) return ApiError.forbidden(`Not allowed to ${operation} "${id}" in "${collectionPath}": a row-level security policy rejected the write.`, "WRITE_DENIED");
-		return ApiError.notFound(`No row "${id}" in "${collectionPath}" to ${operation}.`);
-	}
-	/**
 	* Delete an row by ID
 	*/
 	async delete(collectionPath, id, _databaseId) {
@@ -7171,7 +6767,7 @@ var PersistService = class {
 			if (!field) throw new Error(`ID field '${info.fieldName}' not found in table for collection '${collectionPath}'`);
 			conditions.push(eq(field, parsedIdObj[info.fieldName]));
 		}
-		if (((await this.db.delete(table).where(and(...conditions))).rowCount ?? 0) === 0) throw await this.explainZeroRowWrite(this.db, table, conditions, collectionPath, id, "delete");
+		await this.db.delete(table).where(and(...conditions));
 	}
 	/**
 	* Delete all rows from a collection
@@ -7182,14 +6778,8 @@ var PersistService = class {
 	}
 	/**
 	* Save an row (create or update)
-	*
-	* With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
-	* UPDATE against the primary key rather than a plain UPDATE. That is one
-	* statement, so it cannot lose a race the way a read-then-write can, and it
-	* does not care whether the row already exists — which is what a re-runnable
-	* import needs.
 	*/
-	async save(collectionPath, values, id, databaseId, options) {
+	async save(collectionPath, values, id, databaseId) {
 		let effectiveCollectionPath = collectionPath;
 		const effectiveValues = { ...values };
 		let junctionTableInfo;
@@ -7280,7 +6870,7 @@ var PersistService = class {
 			const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
 			savedId = await this.db.transaction(async (tx) => {
 				let currentId;
-				if (id && !options?.upsert) {
+				if (id) {
 					currentId = id;
 					const idValues = parseIdValues(id, idInfoArray);
 					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
@@ -7291,28 +6881,13 @@ var PersistService = class {
 							const field = table[info.fieldName];
 							conditions.push(eq(field, idValues[info.fieldName]));
 						}
-						if (((await updateQuery.where(and(...conditions))).rowCount ?? 0) === 0) throw await this.explainZeroRowWrite(tx, table, conditions, effectiveCollectionPath, currentId, "update");
+						await updateQuery.where(and(...conditions));
 					}
 				} else {
 					const dataForInsert = { ...entityData };
-					if (id && options?.upsert) Object.assign(dataForInsert, parseIdValues(id, idInfoArray));
 					for (const info of idInfoArray) if (dataForInsert[info.fieldName] === "" || dataForInsert[info.fieldName] === null || dataForInsert[info.fieldName] === void 0) delete dataForInsert[info.fieldName];
-					const insertQuery = tx.insert(table).values(dataForInsert);
-					const hasFullKey = idInfoArray.length > 0 && idInfoArray.every((info) => dataForInsert[info.fieldName] !== void 0);
-					let result;
-					if (options?.upsert && hasFullKey) {
-						const target = idInfoArray.map((info) => table[info.fieldName]);
-						const set = { ...dataForInsert };
-						for (const info of idInfoArray) delete set[info.fieldName];
-						result = Object.keys(set).length > 0 ? await insertQuery.onConflictDoUpdate({
-							target,
-							set
-						}).returning(returningKeys) : await insertQuery.onConflictDoNothing({ target }).returning(returningKeys);
-					} else result = await insertQuery.returning(returningKeys);
-					const resultRow = result[0];
-					if (!resultRow) if (id) currentId = id;
-					else throw ApiError.forbidden(`Not allowed to write to "${effectiveCollectionPath}": the row was rejected by a row-level security policy.`, "WRITE_DENIED");
-					else currentId = buildCompositeId(resultRow, idInfoArray);
+					const resultRow = (await tx.insert(table).values(dataForInsert).returning(returningKeys))[0];
+					currentId = buildCompositeId(resultRow, idInfoArray);
 					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
 				}
 				if (inverseRelationUpdates.length > 0) await this.relationService.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
@@ -7343,7 +6918,6 @@ var PersistService = class {
 	* Translate raw PostgreSQL / Drizzle errors into user-friendly messages.
 	*/
 	toUserFriendlyError(error, collectionSlug) {
-		if (error instanceof ApiError || error?.name === "ApiError") return error;
 		const pgError = extractPgError(error);
 		if (pgError) {
 			const { message } = pgErrorToFriendlyMessage(pgError, collectionSlug);
@@ -7421,8 +6995,8 @@ var DataService = class {
 	/**
 	* Save an row (create or update)
 	*/
-	async save(collectionPath, values, id, databaseId, options) {
-		return this.persistService.save(collectionPath, values, id, databaseId, options);
+	async save(collectionPath, values, id, databaseId) {
+		return this.persistService.save(collectionPath, values, id, databaseId);
 	}
 	/**
 	* Delete an row by ID
@@ -7490,26 +7064,6 @@ var DataService = class {
 */
 /** Internal prefix applied to branch database names to avoid collisions. */
 var BRANCH_DB_PREFIX = "rb_";
-/** `duplicate_database` — the target database name is already taken. */
-var PG_DUPLICATE_DATABASE = "42P04";
-/** `object_in_use` — the database still has connections attached. */
-var PG_OBJECT_IN_USE = "55006";
-/**
-* Describe a failed branch DDL statement in terms a user can act on.
-*
-* Drizzle reports failures as `Failed query: <sql> params:` and hides the real
-* PostgreSQL error in the `cause` chain, so matching on `err.message` never sees
-* the actual problem. Match on the PG error code instead — it survives wrapping
-* and, unlike the message text, is not locale-dependent.
-*/
-function describeBranchDdlError(err, fallbackContext) {
-	const pgError = extractPgError(err);
-	if (pgError?.code === PG_DUPLICATE_DATABASE) return /* @__PURE__ */ new Error(`Database "${fallbackContext}" already exists on the server. Choose a different branch name.`);
-	if (pgError?.code === PG_OBJECT_IN_USE) return /* @__PURE__ */ new Error(`Cannot complete the operation: the database "${fallbackContext}" has active connections. Close other clients or connections and try again.`);
-	const detail = pgError?.message ?? extractCauseMessage(err);
-	if (detail) return new Error(detail);
-	return err instanceof Error ? err : new Error(String(err));
-}
 /** Fully-qualified metadata table in the rebase schema. */
 var BRANCHES_TABLE = "rebase.branches";
 /**
@@ -7578,8 +7132,10 @@ var BranchService = class {
 		try {
 			await this.db.execute(sql.raw(`CREATE DATABASE "${safeDbName}" TEMPLATE "${safeSourceDb}"`));
 		} catch (err) {
-			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot create branch: the source database "${sourceDb}" has active connections. Close other clients or connections and try again.`);
-			throw describeBranchDdlError(err, dbName);
+			const msg = err instanceof Error ? err.message : String(err);
+			if (msg.includes("already exists")) throw new Error(`Database "${dbName}" already exists on the server. Choose a different branch name.`);
+			if (msg.includes("being accessed by other users")) throw new Error(`Cannot create branch: the source database "${sourceDb}" has active connections. Close other clients or connections and try again.`);
+			throw err;
 		}
 		const now = /* @__PURE__ */ new Date();
 		await this.db.execute(sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at) 
@@ -7604,8 +7160,8 @@ var BranchService = class {
 		try {
 			await this.db.execute(sql.raw(`DROP DATABASE "${safeDbName}"`));
 		} catch (err) {
-			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot delete branch "${sanitizedName}": the database has active connections. Close other clients and try again.`);
-			throw describeBranchDdlError(err, dbName);
+			if ((err instanceof Error ? err.message : String(err)).includes("being accessed by other users")) throw new Error(`Cannot delete branch "${sanitizedName}": the database has active connections. Close other clients and try again.`);
+			throw err;
 		}
 		await this.db.execute(sql`DELETE FROM rebase.branches WHERE name = ${sanitizedName}`);
 	}
@@ -8237,7 +7793,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			this.realtimeService.subscriptions.delete(subscriptionId);
 		};
 	}
-	async save({ path, id, values, collection, status, upsert }) {
+	async save({ path, id, values, collection, status }) {
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
@@ -8294,7 +7850,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			timestampNowValue: /* @__PURE__ */ new Date()
 		});
 		try {
-			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, { upsert });
+			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId);
 			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
 				if (globalCallbacks?.afterRead) savedRow = await globalCallbacks.afterRead({
 					collection: resolvedCollection,
@@ -8395,49 +7951,6 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			throw error;
 		}
 	}
-	/**
-	* Write many rows through the same pipeline as {@link save}.
-	*
-	* The batch runs in one transaction of its own, so a failure part-way leaves
-	* nothing behind — the point of a batch is that a re-run starts from a known
-	* state. When this driver is already inside a transaction (the authenticated
-	* path, via `withTransaction`) the nested call becomes a savepoint, which is
-	* still atomic and still commits once.
-	*
-	* Rows are applied in order, so a batch that touches the same key twice ends
-	* with the last write winning, exactly as separate calls would.
-	*/
-	async saveMany({ path, rows, collection, upsert }) {
-		return this.db.transaction(async (tx) => {
-			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-			txDriver.dataService = new DataService(tx, this.registry);
-			txDriver.client = this.client;
-			txDriver._deferNotifications = this._deferNotifications;
-			txDriver._pendingNotifications = this._pendingNotifications;
-			const saved = [];
-			for (let i = 0; i < rows.length; i++) {
-				const values = rows[i];
-				const id = values?.id;
-				try {
-					saved.push(await txDriver.save({
-						path,
-						values,
-						collection,
-						status: "new",
-						upsert
-					}));
-				} catch (error) {
-					const label = id !== void 0 ? `id ${JSON.stringify(id)}` : "no id";
-					throw Object.assign(new Error(`Row ${i} of ${rows.length} (${label}) failed: ${error?.message ?? error}`, { cause: error }), {
-						statusCode: error?.statusCode,
-						code: error?.code,
-						name: error?.name
-					});
-				}
-			}
-			return saved;
-		});
-	}
 	async delete({ row, collection }) {
 		const targetPath = row.path;
 		const targetRow = {
@@ -8802,18 +8315,6 @@ var AuthenticatedPostgresBackendDriver = class {
 	async save(props) {
 		return this.withTransaction((delegate) => delegate.save(props));
 	}
-	/**
-	* One transaction for the whole batch, rather than one per row.
-	*
-	* This is the point of the method: `save` opens a transaction per call, so
-	* importing 10k rows through it means 10k transactions (and, over HTTP, 10k
-	* round trips). Here the RLS context is established once and every row lands
-	* or none does. Realtime notifications are already deferred to commit by
-	* `withTransaction`, so a batch does not flood subscribers mid-flight.
-	*/
-	async saveMany(props) {
-		return this.withTransaction((delegate) => delegate.saveMany(props));
-	}
 	async delete(props) {
 		return this.withTransaction((delegate) => delegate.delete(props));
 	}
@@ -9060,6 +8561,105 @@ var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user:
 	references: [users.id]
 }) }));
 //#endregion
+//#region src/schema/auth-default-policies.ts
+/**
+* Default RLS policies injected by the schema generator.
+*
+* Rebase's enforcement model is unified: authenticated (user-context) requests
+* run under the restricted `rebase_user` role, so Postgres RLS binds *every*
+* statement — reads and writes. A collection's `securityRules` are the whole
+* authorization model. The server context (auth flows, migrations,
+* `dataAsAdmin`) runs as the owner and bypasses RLS.
+*
+* Because RLS default-denies, every collection is **locked by default**: with
+* no rules, only the server context and admins can touch it. The generator
+* injects that safe baseline:
+*
+* **For every collection**
+*  1. A permissive **server-or-admin SELECT** grant.
+*  2. A permissive **server-or-admin write** grant (insert/update/delete).
+*
+* Author `securityRules` are permissive and OR together, so explicit rules only
+* *broaden* access from this locked baseline (e.g. "users read/write their own
+* rows").
+*
+* **For auth collections additionally**
+*  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
+*     their own row (profile, session bootstrap) without every app re-declaring
+*     it.
+*  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
+*     every other policy, so a write is rejected unless the caller is an admin
+*     (or the server context) — even if the author also wrote a permissive rule
+*     such as "a user may edit their own row". Without this, a permissive owner
+*     rule would let a user change their own `roles`.
+*
+* The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
+* — the built-in flows that run without a user (signup, migrations) set no user
+* GUC — which also lets the owner connection satisfy these policies even under
+* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
+* `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
+*
+* Opt out with `disableDefaultPolicies: true` to take full responsibility for
+* the collection's RLS.
+*/
+var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/** Write operations that must be admin-gated by default on auth collections. */
+var DEFAULT_GUARDED_OPS = [
+	"insert",
+	"update",
+	"delete"
+];
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection) {
+	const auth = collection.auth;
+	return auth === true || typeof auth === "object" && auth?.enabled === true;
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/**
+* Returns the security rules that should be applied to a collection: the
+* author's explicit `securityRules` plus the framework defaults described in
+* the module doc (baseline server/admin read for all collections; self-read
+* and the admin write gate for auth collections).
+*
+* Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+*/
+function getEffectiveSecurityRules(collection) {
+	const explicit = [...(isPostgresCollectionConfig(collection) ? collection.securityRules : void 0) ?? []];
+	if (collection.disableDefaultPolicies) return explicit;
+	const tableName = getTableName$1(collection);
+	const injected = [];
+	injected.push({
+		name: `${tableName}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR
+	});
+	injected.push({
+		name: `${tableName}_default_admin_write`,
+		operations: [...DEFAULT_GUARDED_OPS],
+		condition: SERVER_OR_ADMIN_EXPR,
+		check: SERVER_OR_ADMIN_EXPR
+	});
+	if (isAuthCollection(collection)) {
+		injected.push({
+			name: `${tableName}_default_self_read`,
+			operations: ["select"],
+			condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
+		});
+		injected.push({
+			name: `${tableName}_require_admin_write`,
+			mode: "restrictive",
+			operations: [...DEFAULT_GUARDED_OPS],
+			condition: SERVER_OR_ADMIN_EXPR,
+			check: SERVER_OR_ADMIN_EXPR
+		});
+	}
+	return [...explicit, ...injected];
+}
+//#endregion
 //#region src/schema/generate-drizzle-schema-logic.ts
 /**
 * Resolve the SQL column name for a property.
@@ -9257,12 +8857,31 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 * Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
 */
 var wrapSql = (clause) => `sql\`${clause}\``;
+/**
+* Generates a deterministic hash based on the rule configuration.
+*/
+var getPolicyNameHash = (rule) => {
+	const data = JSON.stringify({
+		a: rule.access,
+		m: rule.mode,
+		op: rule.operation,
+		ops: rule.operations?.slice().sort(),
+		own: rule.ownerField,
+		rol: rule.roles?.slice().sort(),
+		pg: rule.pgRoles?.slice().sort(),
+		u: rule.using,
+		w: rule.withCheck,
+		c: rule.condition,
+		ch: rule.check
+	});
+	return createHash("sha1").update(data).digest("hex").substring(0, 7);
+};
 var generatePolicyCode = (collection, rule, index, resolveCollection) => {
 	const tableName = getTableName$1(collection);
 	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
-	const policyNames = getPolicyNamesForRule(rule, tableName);
+	const ruleHash = getPolicyNameHash(rule);
 	return ops.map((op, opIdx) => {
-		return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
+		return generateSinglePolicyCode(collection, rule, op, rule.name ? ops.length > 1 ? `${rule.name}_${op}` : rule.name : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`, resolveCollection);
 	}).join("");
 };
 /**
@@ -11359,7 +10978,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 			} catch (error) {
 				logger.error("💥 [WebSocket Server] Error handling message", { error });
 				if (error instanceof Error) logger.error("Stack trace", { detail: error.stack });
-				const errorMessage = process.env.NODE_ENV === "production" ? "An unexpected error occurred" : extractErrorMessage(error);
+				const errorMessage = process.env.NODE_ENV === "production" ? "An unexpected error occurred" : error instanceof Error ? error.message : "An unexpected error occurred";
 				const errorResponse = {
 					type: "ERROR",
 					requestId,