@rebasepro/server-postgres 0.9.1-canary.ad25bc0 → 0.9.1-canary.b10dcdf

package/dist/index.es.js

@@ -71,16 +71,51 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 var connection_exports = /* @__PURE__ */ __exportAll({
 	createDirectDatabaseConnection: () => createDirectDatabaseConnection,
 	createPostgresDatabaseConnection: () => createPostgresDatabaseConnection,
-	createReadReplicaConnection: () => createReadReplicaConnection
+	createReadReplicaConnection: () => createReadReplicaConnection,
+	guardPoolAgainstDirtyRelease: () => guardPoolAgainstDirtyRelease
 });
 var DEFAULT_POOL = {
 	max: 20,
 	idleTimeoutMillis: 3e4,
 	connectionTimeoutMillis: 1e4,
-	queryTimeout: 3e4,
+	queryTimeout: 6e4,
 	statementTimeout: 3e4,
 	keepAlive: true
 };
+/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
+var TX_IDLE = "I";
+/**
+* Destroy pool clients that are released while still inside a transaction.
+*
+* pg-pool returns a client to the idle list whenever `release()` is called
+* without an error — even if the connection is still mid-transaction (status
+* `T`/`E`). That happens in practice: drizzle's pool transaction releases in
+* a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
+* (e.g. it was queued behind a statement that hit the client-side
+* query_timeout), the client goes back dirty. The next checkout then runs
+* its statements inside the zombie transaction — with the previous request's
+* `app.*` RLS GUCs still applied, which turns unrelated queries into
+* RLS-scoped ones (observed in production as registration failing with
+* SQLSTATE 42501 under a leaked anonymous context).
+*
+* pg-pool emits `release` before it consults its private `_expired` set, so
+* marking the client expired here makes `_release()` destroy it instead of
+* pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
+* private APIs — feature-detect and fall back to loud logging so an upstream
+* change degrades to observability, never to silent corruption.
+*/
+function guardPoolAgainstDirtyRelease(pool, label) {
+	pool.on("release", (err, client) => {
+		if (err) return;
+		const txStatus = client?._txStatus;
+		if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
+		const expired = pool._expired;
+		if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
+			expired.add(client);
+			logger.error(`[${label}] Client released back to the pool while still in a transaction (status '${txStatus}') — destroying it so the open transaction and its session state (RLS GUCs) cannot leak into the next request.`);
+		} else logger.error(`[${label}] Client released mid-transaction (status '${txStatus}') but the pool's internal expiry set is unavailable (pg-pool internals changed?). The connection may leak its open transaction into subsequent requests.`);
+	});
+}
 /**
 * Create a Drizzle-backed Postgres connection with a production-grade
 * connection pool.
@@ -112,6 +147,7 @@ function createPostgresDatabaseConnection(connectionString, schema, poolConfig)
 		logger.error("[pg-pool] Unexpected pool error", { detail: err.message });
 		if (err.message.includes("ETIMEDOUT")) logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -144,6 +180,7 @@ function createDirectDatabaseConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -173,6 +210,7 @@ function createReadReplicaConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -1808,12 +1846,17 @@ function parseIdValues(idValue, primaryKeys) {
 /**
 * The primary keys of a collection, as declared by its properties.
 *
-* The driver can also infer keys from the Drizzle schema, which the browser
-* cannot see — so the server normalizes what it resolved onto the config it
-* serves (see `stampPrimaryKeys`), and this reads that back. Returns an empty
-* array when a collection declares none, which callers must treat as "not
-* addressable" rather than defaulting to `id`: guessing a key that is not the
-* real one produces confidently wrong addresses.
+* This is the only tier both sides can read, because it is the only one written
+* in the config: the postgres driver can also infer keys from the Drizzle
+* schema, which the browser never sees and is never sent — the admin compiles
+* the collection files into its own bundle rather than being served them. A key
+* that lives only in the Drizzle schema is therefore invisible here, and the
+* server says so at boot (`warnOnKeysTheAdminCannotResolve`) naming the `isId`
+* to add.
+*
+* Returns an empty array when a collection declares none, which callers must
+* treat as "not addressable" rather than defaulting to `id`: guessing a key
+* that is not the real one produces confidently wrong addresses.
 */
 function getDeclaredPrimaryKeys(collection) {
 	const properties = collection.properties;
@@ -1838,9 +1881,15 @@ function getDeclaredPrimaryKeys(collection) {
 * The postgres driver tries, in order: properties marked `isId`; the primary
 * keys of the Drizzle schema; and finally a column literally named `id`. Only
 * the first and last are visible in a `CollectionConfig`, which is what both
-* sides share — so a collection whose key is *only* known to Drizzle, and is
-* not named `id`, resolves to nothing here. That is reported rather than
-* guessed: inventing a key produces addresses that look right and route wrong.
+* sides share.
+*
+* So the two agree except on a collection that declares no `isId` and whose key
+* is known only to Drizzle. There, the driver reads the real key, and this
+* either resolves nothing (reported to the console by the caller) or — if the
+* table happens to have an unrelated `id` property — resolves `id`, which is
+* the wrong key and cannot be detected from here: the addresses look right and
+* route wrong. Only the config can settle it, so the server names both cases
+* at boot (`warnOnKeysTheAdminCannotResolve`) with the `isId` to add.
 */
 function resolvePrimaryKeys(collection) {
 	const declared = getDeclaredPrimaryKeys(collection);
@@ -2552,7 +2601,7 @@ var buildPropertyCallbacks = (properties) => {
 * Opt out with `disableDefaultPolicies: true` to take full responsibility for
 * the collection's RLS.
 */
-var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+var SERVER_OR_ADMIN_EXPR$1 = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 /** Write operations that must be admin-gated by default on auth collections. */
 var DEFAULT_GUARDED_OPS = [
 	"insert",
@@ -2565,7 +2614,7 @@ function isAuthCollection(collection) {
 	return auth === true || typeof auth === "object" && auth?.enabled === true;
 }
 /** The property marked as the row id (falls back to `id`). */
-function getIdPropertyName(collection) {
+function getIdPropertyName$1(collection) {
 	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
 	return "id";
 }
@@ -2585,30 +2634,232 @@ function getEffectiveSecurityRules(collection) {
 	injected.push({
 		name: `${tableName}_default_admin_read`,
 		operations: ["select"],
-		condition: SERVER_OR_ADMIN_EXPR
+		condition: SERVER_OR_ADMIN_EXPR$1
 	});
 	injected.push({
 		name: `${tableName}_default_admin_write`,
 		operations: [...DEFAULT_GUARDED_OPS],
-		condition: SERVER_OR_ADMIN_EXPR,
-		check: SERVER_OR_ADMIN_EXPR
+		condition: SERVER_OR_ADMIN_EXPR$1,
+		check: SERVER_OR_ADMIN_EXPR$1
 	});
 	if (isAuthCollection(collection)) {
 		injected.push({
 			name: `${tableName}_default_self_read`,
 			operations: ["select"],
-			condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
+			condition: policy.compare(policy.field(getIdPropertyName$1(collection)), "eq", policy.authUid())
 		});
 		injected.push({
 			name: `${tableName}_require_admin_write`,
 			mode: "restrictive",
 			operations: [...DEFAULT_GUARDED_OPS],
-			condition: SERVER_OR_ADMIN_EXPR,
-			check: SERVER_OR_ADMIN_EXPR
+			condition: SERVER_OR_ADMIN_EXPR$1,
+			check: SERVER_OR_ADMIN_EXPR$1
 		});
 	}
 	return [...explicit, ...injected];
 }
+//#endregion
+//#region ../common/src/util/junction-policies.ts
+var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/**
+* Walk every collection's resolved relations and aggregate the junction tables
+* they declare. Two collections may declare the same junction from opposite
+* sides (posts→tags and tags→posts through `posts_tags`); both become
+* `declaringSides` of one spec, so derived write grants consider both.
+*/
+function resolveJunctionSpecs(collections) {
+	const specs = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const resolved = resolveCollectionRelations(collection);
+		for (const relation of Object.values(resolved)) {
+			if (!relation.through) continue;
+			const targetCollection = typeof relation.target === "function" ? relation.target() : void 0;
+			if (!targetCollection) continue;
+			const rawName = relation.through.table;
+			const table = rawName.includes(".") ? rawName.split(".").pop() : rawName;
+			const schema = "public";
+			const source = {
+				collection,
+				junctionColumn: relation.through.sourceColumn,
+				relation
+			};
+			const target = {
+				collection: targetCollection,
+				junctionColumn: relation.through.targetColumn
+			};
+			const existing = specs.get(table);
+			if (!existing) specs.set(table, {
+				table,
+				schema,
+				endpoints: [source, target],
+				declaringSides: [source]
+			});
+			else if (!existing.declaringSides.some((s) => s.collection === collection)) existing.declaringSides.push(source);
+		}
+	}
+	return specs;
+}
+/**
+* A synthetic CollectionConfig standing in for the junction during policy
+* compilation and naming. Its two FK columns carry explicit `columnName`s so
+* `outerField` operands resolve to the exact columns the CREATE TABLE emitted,
+* whatever their casing.
+*/
+function getJunctionCollectionConfig(spec) {
+	const properties = {};
+	for (const endpoint of spec.endpoints) properties[endpoint.junctionColumn] = {
+		type: "string",
+		columnName: endpoint.junctionColumn
+	};
+	return {
+		slug: spec.table,
+		name: spec.table,
+		table: spec.table,
+		schema: spec.schema,
+		properties
+	};
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/** `EXISTS (SELECT 1 FROM endpoint WHERE endpoint.pk = junction.fk [AND extra])`. */
+function existsEndpoint(endpoint, extra) {
+	const correlation = policy.compare(policy.field(getIdPropertyName(endpoint.collection)), "eq", policy.outerField(endpoint.junctionColumn));
+	return policy.existsIn({
+		collection: endpoint.collection.slug,
+		where: extra ? policy.and(correlation, extra) : correlation
+	});
+}
+/**
+* Whether a parent-rule expression keeps its meaning when moved inside the
+* junction's `EXISTS` subquery — and the re-scoped copy if it does.
+*
+* Returns `null` when the rule cannot be embedded faithfully: `raw` SQL
+* anywhere (its `{column}` placeholders would bind to the junction), or an
+* `outerField` inside a nested `existsIn` (it would bind to the junction while
+* the author meant the parent, and no operand can express "the middle scope").
+* Top-level `outerField`s are rewritten to `field`, which is what they meant.
+*/
+function embedParentExpression(expr, depth = 0) {
+	switch (expr.kind) {
+		case "raw": return null;
+		case "and":
+		case "or": {
+			const parts = [];
+			for (const child of expr.operands) {
+				const embedded = embedParentExpression(child, depth);
+				if (!embedded) return null;
+				parts.push(embedded);
+			}
+			return expr.kind === "and" ? policy.and(...parts) : policy.or(...parts);
+		}
+		case "not": {
+			const embedded = embedParentExpression(expr.operand, depth);
+			return embedded ? policy.not(embedded) : null;
+		}
+		case "existsIn": {
+			const where = embedParentExpression(expr.where, depth + 1);
+			return where ? policy.existsIn({
+				collection: expr.collection,
+				where
+			}) : null;
+		}
+		case "compare": {
+			const left = embedOperand(expr.left, depth);
+			const right = embedOperand(expr.right, depth);
+			if (!left || !right) return null;
+			return {
+				...expr,
+				left,
+				right
+			};
+		}
+		default: return expr;
+	}
+}
+/** Re-scope an operand, or return `null` if its binding cannot be preserved. */
+function embedOperand(operand, depth) {
+	if (operand.kind === "outerField") {
+		if (depth === 0) return policy.field(operand.name);
+		return null;
+	}
+	return operand;
+}
+/** Does the rule cover the `update` operation? */
+function coversUpdate(rule) {
+	return getPolicyOperations(rule).some((op) => op === "update" || op === "all");
+}
+/**
+* The full derived policy set for a junction table: the locked server/admin
+* baseline, the endpoint-visibility read grant, inherited write grants, and
+* inherited restrictive gates. Returns `[]` when every declaring collection set
+* `disableDefaultPolicies` — the junction is then the author's to police, and
+* stays locked (RLS is still enabled) until they write policies for it.
+*/
+function getJunctionSecurityRules(spec) {
+	if (spec.declaringSides.every((side) => side.collection.disableDefaultPolicies)) return [];
+	const rules = [];
+	rules.push({
+		name: `${spec.table}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_admin_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: SERVER_OR_ADMIN_EXPR,
+		check: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_edge_read`,
+		operations: ["select"],
+		condition: policy.and(existsEndpoint(spec.endpoints[0]), existsEndpoint(spec.endpoints[1]))
+	});
+	const writeGrants = [];
+	for (const side of spec.declaringSides) {
+		const updateRules = ((isPostgresCollectionConfig(side.collection) ? side.collection.securityRules : void 0) ?? []).filter(coversUpdate);
+		const permissive = updateRules.filter((r) => r.mode !== "restrictive");
+		const restrictive = updateRules.filter((r) => r.mode === "restrictive");
+		const embeddedGates = [];
+		let gatesEmbeddable = true;
+		for (const gate of restrictive) {
+			const using = securityRuleToConditions(gate).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (!embedded) {
+				gatesEmbeddable = false;
+				break;
+			}
+			embeddedGates.push(embedded);
+		}
+		if (!gatesEmbeddable) continue;
+		const grants = [];
+		for (const rule of permissive) {
+			const using = securityRuleToConditions(rule).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (embedded) grants.push(embedded);
+		}
+		if (grants.length === 0) continue;
+		const condition = embeddedGates.length > 0 ? policy.and(policy.or(...grants), ...embeddedGates) : policy.or(...grants);
+		writeGrants.push(existsEndpoint(side, condition));
+	}
+	if (writeGrants.length > 0) rules.push({
+		name: `${spec.table}_default_edge_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants),
+		check: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants)
+	});
+	return rules;
+}
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(root, factory) {
 		if (typeof define === "function" && define.amd) define(factory);
@@ -3893,7 +4144,7 @@ function createPrimaryKeyResolver(options) {
 		}
 		if (!warned.has(slug)) {
 			warned.add(slug);
-			console.warn(`[rebase] Collection '${slug}' declares no primary key, so its rows have no address: detail links, caching and relations will not work for it. Mark the key property with \`isId\` in its collection config.`);
+			console.warn(`[rebase] Collection '${slug}' declares no primary key, so its rows have no address: detail links, caching and relations will not work for it. Mark the key property with \`isId\` in its collection config — the server logs which column to mark at boot, if its schema knows the key.`);
 		}
 		return keys;
 	};
@@ -4336,8 +4587,26 @@ function getTableForCollection(collection, registry) {
 	if (!table) throw new Error(`Table not found for collection '${collection.slug}' (table: ${tableName})`);
 	return table;
 }
+/**
+* The key columns a collection's rows are addressed by.
+*
+* Three tiers, in order: properties marked `isId`, the primary keys of the
+* drizzle schema, and finally a column literally named `id`. Only the first is
+* visible to the browser, which is why a key known only to drizzle is reported
+* at boot — see {@link warnOnKeysTheAdminCannotResolve}.
+*
+* Returns `[]` when nothing resolves, rather than throwing. It used to open by
+* resolving the table, which throws when there is none — so the `isId` tier,
+* which needs no table at all, was unreachable for exactly the collections
+* most likely to have no table registered. Every caller that wanted "no keys"
+* to mean "no keys" had to spell that out in a try/catch.
+*
+* Callers that cannot proceed without a key must say so themselves, naming the
+* collection: an empty array here means "this collection has no address", which
+* is a different answer in a notification (broadcast a wildcard) than in a save
+* (fail).
+*/
 function getPrimaryKeys(collection, registry) {
-	const table = getTableForCollection(collection, registry);
 	if (collection.properties) {
 		const idProps = Object.entries(collection.properties).filter(([_, prop]) => "isId" in prop && Boolean(prop.isId)).map(([key, prop]) => ({
 			fieldName: key,
@@ -4346,6 +4615,8 @@ function getPrimaryKeys(collection, registry) {
 		}));
 		if (idProps.length > 0) return idProps;
 	}
+	const table = registry.getTable(getTableName$1(collection));
+	if (!table) return [];
 	const keys = [];
 	for (const [key, colRaw] of Object.entries(table)) {
 		const col = colRaw;
@@ -4373,6 +4644,90 @@ function getPrimaryKeys(collection, registry) {
 	}
 	return keys;
 }
+/**
+* The key columns, for callers that cannot do their job without one.
+*
+* {@link getPrimaryKeys} answers "what keys, if any" and returns `[]` for a
+* collection with no address. Most of this driver, though, is building a WHERE
+* clause and has no meaning without a key — for those, an empty array is not an
+* answer, and indexing `[0]` into it produces `Cannot read properties of
+* undefined` three frames from where the real problem is. This says what is
+* wrong and which collection it is wrong about.
+*/
+function requirePrimaryKeys(collection, registry) {
+	const keys = getPrimaryKeys(collection, registry);
+	if (keys.length === 0) throw new Error(`Collection '${collection.slug}' has no primary key, so its rows cannot be addressed. Mark the key property with \`isId\` in its config, or register a table whose schema declares one.`);
+	return keys;
+}
+/**
+* Collections whose key the *browser* cannot resolve, and what it will do
+* instead.
+*
+* The two sides resolve keys from different evidence. This driver reads, in
+* order: properties marked `isId`, the primary keys of the Drizzle schema, then
+* a column literally named `id`. The admin shares the `CollectionConfig` — it
+* compiles the same collection files into its bundle — but never the Drizzle
+* schema, so the middle tier is invisible to it.
+*
+* Nothing can normalize this at runtime: the server does not serve the admin
+* its collections, so a key resolved here cannot be handed over there. The
+* config files are the only thing both sides read, so the fix is an edit to
+* them, and the most this can do is say exactly which edit.
+*
+* Two shapes, and the second is the dangerous one:
+*
+* - No `isId`, no `id` property → the admin resolves no address, warns in the
+*   console, and rows cannot be opened or linked.
+* - No `isId`, but an `id` property that is *not* the key → the admin addresses
+*   rows by `id` while this driver reads the address as the real key. Nothing
+*   errors: the addresses look right and route wrong.
+*/
+function findUnresolvableKeyCollections(collections, registry) {
+	const findings = [];
+	for (const collection of collections) {
+		if (getDeclaredPrimaryKeys(collection).length > 0) continue;
+		const keys = getPrimaryKeys(collection, registry);
+		if (keys.length === 0) continue;
+		if (keys.length === 1 && keys[0].fieldName === "id") continue;
+		findings.push({
+			collection,
+			keys,
+			shadowedByIdProperty: Boolean(collection.properties?.id)
+		});
+	}
+	return findings;
+}
+/**
+* Report the collections from {@link findUnresolvableKeyCollections} at boot,
+* with the edit that fixes each one.
+*
+* Grouped by failure, not by collection: the shadowed case is a routing bug and
+* the silent case is a missing feature, and they deserve different urgency.
+*/
+function warnOnKeysTheAdminCannotResolve(collections, registry) {
+	const findings = findUnresolvableKeyCollections(collections, registry);
+	if (findings.length === 0) return;
+	const edit = (f) => `${f.collection.slug}: mark ${f.keys.map((k) => `\`${k.fieldName}\``).join(" and ")} with \`isId: ${f.keys[0].isUUID ? "\"uuid\"" : f.keys[0].type === "number" ? "\"increment\"" : "true"}\``;
+	const shadowed = findings.filter((f) => f.shadowedByIdProperty);
+	const silent = findings.filter((f) => !f.shadowedByIdProperty);
+	if (shadowed.length > 0) logger.warn("⚠️ These collections declare no `isId`, and their key is only in the drizzle schema — but they do have a property called `id`. The admin has no way to know `id` is not the key, so it will address rows by it while this server reads the address as the real key: the links look right and route wrong. Nothing will error.\n\n" + shadowed.map((f) => `  • ${edit(f)}`).join("\n") + "\n");
+	if (silent.length > 0) logger.warn("⚠️ These collections declare no `isId`, and their key is only in the drizzle schema, which the admin never sees. It will resolve no address for their rows, so detail links, caching and relations will not work for them:\n\n" + silent.map((f) => `  • ${edit(f)}`).join("\n") + "\n");
+}
+/**
+* The address of a row: derived from the collection's primary keys, because a
+* row does not carry one — it is exactly its columns.
+*
+* Falls back to a literal `id` column, for a row that reached us from somewhere
+* other than this driver. Returns `""` when there is no key and no `id` —
+* callers decide what that means, since "unaddressable" is a different answer
+* in a notification (broadcast a wildcard) than in a save (fail).
+*/
+function deriveRowAddress(row, collection, registry) {
+	const composite = buildCompositeId(row, getPrimaryKeys(collection, registry));
+	if (composite && composite.split(":::").some((part) => part !== "")) return composite;
+	if (row.id !== void 0 && row.id !== null) return String(row.id);
+	return "";
+}
 //#endregion
 //#region src/utils/drizzle-conditions.ts
 /**
@@ -4911,6 +5266,7 @@ var DrizzleConditionBuilder = class {
 	static buildVectorSearchConditions(table, vectorSearch) {
 		const column = table[vectorSearch.property];
 		if (!column) throw new Error(`Vector column '${vectorSearch.property}' not found in table`);
+		if (!Array.isArray(vectorSearch.vector) || vectorSearch.vector.length === 0 || !vectorSearch.vector.every((n) => typeof n === "number" && Number.isFinite(n))) throw new Error("Vector search requires a non-empty array of finite numbers");
 		const vectorLiteral = `'[${vectorSearch.vector.join(",")}]'::vector`;
 		const distanceFn = vectorSearch.distance || "cosine";
 		let operator;
@@ -4994,12 +5350,10 @@ function serializeDataToServer(row, properties, collection, registry) {
 					continue;
 				} else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) {
 					const serializedValue = serializePropertyToServer(effectiveValue, property);
-					const pks = getPrimaryKeys(collection, registry);
 					inverseRelationUpdates.push({
 						relationKey: key,
 						relation,
-						newValue: serializedValue,
-						currentId: row.id || buildCompositeId(row, pks)
+						newValue: serializedValue
 					});
 					continue;
 				} else if (relation.direction === "inverse" && relation.joinPath && relation.joinPath.length > 0) {
@@ -5009,15 +5363,11 @@ function serializeDataToServer(row, properties, collection, registry) {
 						relation,
 						newTargetId: serializedValue
 					});
-					else {
-						const pks = getPrimaryKeys(collection, registry);
-						inverseRelationUpdates.push({
-							relationKey: key,
-							relation,
-							newValue: serializedValue,
-							currentId: row.id || buildCompositeId(row, pks)
-						});
-					}
+					else inverseRelationUpdates.push({
+						relationKey: key,
+						relation,
+						newValue: serializedValue
+					});
 					continue;
 				} else if (relation.cardinality === "one" && relation.direction === "owning" && relation.joinPath && relation.joinPath.length > 0) {
 					const serializedValue = serializePropertyToServer(effectiveValue, property);
@@ -5417,6 +5767,63 @@ var RelationService = class {
 		this.registry = registry;
 	}
 	/**
+	* One target row, as the {@link RelatedRow} everything here returns.
+	*
+	* Eight sites built this by hand, which is how the address came to be the
+	* target's first key column in all eight — one edit, eight places to miss.
+	*
+	* `resolveNested` is the one thing they did not agree on, and the
+	* disagreement was invisible: the single-parent fetches pass `db` and
+	* `registry` to `parseDataFromServer`, so the target's *own* relations get
+	* resolved too, while the batch paths deliberately do not — a query per
+	* target row is the N+1 the batching exists to avoid. Naming the parameter
+	* makes that a decision rather than a difference between two call sites
+	* nobody was comparing.
+	*/
+	async toRelatedRow(targetRow, targetCollection, targetPks, options) {
+		const values = options?.resolveNested ? await parseDataFromServer(targetRow, targetCollection, this.db, this.registry) : await parseDataFromServer(targetRow, targetCollection);
+		return {
+			id: buildCompositeId(targetRow, targetPks),
+			path: targetCollection.slug,
+			values
+		};
+	}
+	/**
+	* A WHERE matching any of `parentIds`, by the whole key.
+	*
+	* A single key is an `IN (…)`. A composite one cannot be: matching
+	* `tenant_id IN (1, 1)` collects every row of tenant 1, so two parents that
+	* share their first column each receive the other's relations. It becomes
+	* an OR of ANDs — one exact address per parent — which Postgres indexes the
+	* same way it would a multi-column key lookup.
+	*/
+	parentKeyCondition(parentTable, parentPks, parentIds) {
+		const columnFor = (fieldName) => {
+			const col = parentTable[fieldName];
+			if (!col) throw new Error(`Key column '${fieldName}' not found in parent table`);
+			return col;
+		};
+		if (parentPks.length === 1) {
+			const values = parentIds.map((id) => parseIdValues(id, parentPks)[parentPks[0].fieldName]);
+			return inArray(columnFor(parentPks[0].fieldName), values);
+		}
+		return or(...parentIds.map((id) => {
+			const values = parseIdValues(id, parentPks);
+			return and(...parentPks.map((pk) => eq(columnFor(pk.fieldName), values[pk.fieldName])));
+		}));
+	}
+	/**
+	* Reject a relation that cannot express a composite-keyed parent.
+	*
+	* `localKey` and `foreignKeyOnTarget` are single column names: one column
+	* cannot reference a two-column key, so such a relation has no correct
+	* reading. Left alone it would silently match on the first key column and
+	* hand a tenant's rows to its neighbour — say so instead.
+	*/
+	assertSingleKeyAddressable(parentCollection, parentPks, via) {
+		if (parentPks.length > 1) throw new Error(`Relation on '${parentCollection.slug}' uses '${via}', a single foreign-key column, but '${parentCollection.slug}' is keyed on ${parentPks.map((k) => `'${k.fieldName}'`).join(" + ")}. One column cannot reference a composite key — express this relation with \`joinPath\`, whose \`on.from\`/\`on.to\` take every key column.`);
+	}
+	/**
 	* Fetch rows related to a parent row through a specific relation
 	*/
 	async fetchRelatedEntities(parentCollectionPath, parentId, relationKey, options = {}) {
@@ -5435,9 +5842,9 @@ var RelationService = class {
 	async fetchEntitiesUsingJoins(parentCollection, parentId, relation, options = {}) {
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const idInfo = getPrimaryKeys(targetCollection, this.registry);
+		const idInfo = requirePrimaryKeys(targetCollection, this.registry);
 		const idField = targetTable[idInfo[0].fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
@@ -5461,7 +5868,7 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
+			const parentIdField = parentTable[requirePrimaryKeys(parentCollection, this.registry)[0].fieldName];
 			query = query.where(eq(parentIdField, parsedParentId));
 			if (options.limit) query = query.limit(options.limit);
 			const results = await query;
@@ -5469,13 +5876,7 @@ var RelationService = class {
 			const rows = [];
 			for (const row of results) {
 				const targetRow = row[targetTableName] || row;
-				const id = targetRow[idInfo[0].fieldName];
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
-				rows.push({
-					id: id?.toString() || "",
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				rows.push(await this.toRelatedRow(targetRow, targetCollection, idInfo, { resolveNested: true }));
 			}
 			return rows;
 		}
@@ -5494,13 +5895,7 @@ var RelationService = class {
 		const rows = [];
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
-			const id = targetRow[idInfo[0].fieldName];
-			const parsedValues = await parseDataFromServer(targetRow, targetCollection, this.db, this.registry);
-			rows.push({
-				id: id?.toString() || "",
-				path: targetCollection.slug,
-				values: parsedValues
-			});
+			rows.push(await this.toRelatedRow(targetRow, targetCollection, idInfo, { resolveNested: true }));
 		}
 		return rows;
 	}
@@ -5517,8 +5912,8 @@ var RelationService = class {
 		}
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdField = targetTable[getPrimaryKeys(targetCollection, this.registry)[0].fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const targetIdField = targetTable[requirePrimaryKeys(targetCollection, this.registry)[0].fieldName];
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
@@ -5537,9 +5932,10 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdInfo = getPrimaryKeys(targetCollection, this.registry)[0];
+		const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+		const targetIdInfo = targetPks[0];
 		const targetIdField = targetTable[targetIdInfo.fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
@@ -5563,25 +5959,19 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
-			query = query.where(inArray(parentIdField, parsedParentIds));
+			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const row of results) {
 				const parentRow = row[getTableName$1(parentCollection)] || row;
 				const targetRow = row[targetTableName] || row;
-				const parentId = parentRow[parentIdInfo.fieldName];
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-				resultMap.set(String(parentId), {
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				resultMap.set(buildCompositeId(parentRow, parentPks), await this.toRelatedRow(targetRow, targetCollection, targetPks));
 			}
 			return resultMap;
 		}
 		if (relation.direction === "owning" && relation.localKey) {
+			this.assertSingleKeyAddressable(parentCollection, parentPks, relation.localKey);
 			const localKeyCol = parentTable[relation.localKey];
 			if (!localKeyCol) throw new Error(`Local key column '${relation.localKey}' not found in parent table`);
 			const fkRows = await this.db.select({
@@ -5610,17 +6000,11 @@ var RelationService = class {
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const [parentIdStr, fkValue] of parentToFk) {
 				const targetRow = targetById.get(String(fkValue));
-				if (targetRow) {
-					const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-					resultMap.set(parentIdStr, {
-						id: String(targetRow[targetIdInfo.fieldName]),
-						path: targetCollection.slug,
-						values: parsedValues
-					});
-				}
+				if (targetRow) resultMap.set(parentIdStr, await this.toRelatedRow(targetRow, targetCollection, targetPks));
 			}
 			return resultMap;
 		}
+		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -5631,14 +6015,7 @@ var RelationService = class {
 			let parentId;
 			if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
 			else if (relation.direction === "inverse" && relation.cardinality === "one" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
-			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
-				resultMap.set(String(parentId), {
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
-			}
+			if (parentId !== void 0 && parentIdSet.has(String(parentId))) resultMap.set(String(parentId), await this.toRelatedRow(targetRow, targetCollection, targetPks));
 		}
 		return resultMap;
 	}
@@ -5652,9 +6029,9 @@ var RelationService = class {
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
 		const targetTable = getTableForCollection(targetCollection, this.registry);
-		const targetIdInfo = getPrimaryKeys(targetCollection, this.registry)[0];
-		const targetIdField = targetTable[targetIdInfo.fieldName];
-		const parentPks = getPrimaryKeys(parentCollection, this.registry);
+		const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+		const targetIdField = targetTable[targetPks[0].fieldName];
+		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
 		const parentTable = this.registry.getTable(getTableName$1(parentCollection));
 		if (!parentTable) throw new Error("Parent table not found");
@@ -5676,27 +6053,22 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			const parentIdField = parentTable[getPrimaryKeys(parentCollection, this.registry)[0].fieldName];
-			query = query.where(inArray(parentIdField, parsedParentIds));
+			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
 			for (const row of results) {
 				const parentRow = row[getTableName$1(parentCollection)] || row;
 				const targetRow = row[targetTableName] || row;
-				const parentId = String(parentRow[parentIdInfo.fieldName]);
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
+				const parentId = buildCompositeId(parentRow, parentPks);
 				const arr = resultMap.get(parentId) || [];
-				arr.push({
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
 				resultMap.set(parentId, arr);
 			}
 			return resultMap;
 		}
 		if (relation.through && relation.cardinality === "many" && relation.direction === "owning") {
+			this.assertSingleKeyAddressable(parentCollection, parentPks, `${relation.through.table}.${relation.through.sourceColumn}`);
 			const junctionTable = this.registry.getTable(relation.through.table);
 			if (!junctionTable) {
 				logger.warn(`[batchFetchRelatedEntitiesMany] Junction table '${relation.through.table}' not found`);
@@ -5715,17 +6087,13 @@ var RelationService = class {
 				const junctionData = row[relation.through.table] || row;
 				const targetData = row[targetTableName] || row;
 				const parentId = String(junctionData[relation.through.sourceColumn]);
-				const parsedValues = await parseDataFromServer(targetData, targetCollection);
 				const arr = resultMap.get(parentId) || [];
-				arr.push({
-					id: String(targetData[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetData, targetCollection, targetPks));
 				resultMap.set(parentId, arr);
 			}
 			return resultMap;
 		}
+		this.assertSingleKeyAddressable(parentCollection, parentPks, relation.foreignKeyOnTarget ?? `${relation.inverseRelationName}_id`);
 		let query = this.db.select().from(targetTable).$dynamic();
 		query = applyDynamicRelationQuery(query, query, relation, parsedParentIds, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
 		const results = await query;
@@ -5738,14 +6106,9 @@ var RelationService = class {
 			else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) parentId = targetRow[relation.foreignKeyOnTarget];
 			else if (relation.direction === "inverse" && relation.inverseRelationName) parentId = targetRow[`${relation.inverseRelationName}_id`];
 			if (parentId !== void 0 && parentIdSet.has(String(parentId))) {
-				const parsedValues = await parseDataFromServer(targetRow, targetCollection);
 				const key = String(parentId);
 				const arr = resultMap.get(key) || [];
-				arr.push({
-					id: String(targetRow[targetIdInfo.fieldName]),
-					path: targetCollection.slug,
-					values: parsedValues
-				});
+				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
 				resultMap.set(key, arr);
 			}
 		}
@@ -5793,12 +6156,12 @@ var RelationService = class {
 					logger.warn(`Could not determine junction table for relation '${key}' in collection '${collection.slug}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
 				if (targetEntityIds.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedParentId,
@@ -5818,12 +6181,12 @@ var RelationService = class {
 					logger.warn(`Junction columns not found for relation '${key}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
 				if (targetEntityIds.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedParentId,
@@ -5834,7 +6197,7 @@ var RelationService = class {
 			} else if (relation.through && relation.cardinality === "many" && relation.direction === "inverse") logger.warn(`[updateRelationsUsingJoins] Inverse M2M relation '${key}' in collection '${collection.slug}' should be saved from the owning side. Skipping.`);
 			else if (relation.cardinality === "many" && relation.direction === "inverse" && relation.foreignKeyOnTarget) {
 				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
 				const targetIdCol = targetTable[targetIdInfo.fieldName];
 				const fkCol = targetTable[relation.foreignKeyOnTarget];
@@ -5842,7 +6205,7 @@ var RelationService = class {
 					logger.warn(`Invalid inverse-many config for relation '${key}' in collection '${collection.slug}'`);
 					continue;
 				}
-				const parentPks = getPrimaryKeys(collection, this.registry);
+				const parentPks = requirePrimaryKeys(collection, this.registry);
 				const parentIdInfo = parentPks[0];
 				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
 				if (targetEntityIds.length > 0) {
@@ -5862,9 +6225,9 @@ var RelationService = class {
 			try {
 				const targetCollection = relation.target();
 				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
-				const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
 				if (relation.direction === "inverse" && relation.joinPath && relation.joinPath.length > 0) {
 					await this.updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue);
@@ -5945,12 +6308,12 @@ var RelationService = class {
 					logger.warn(`Could not determine junction columns for inverse joinPath relation '${relation.relationName}'`);
 					return;
 				}
-				const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 				const sourceIdInfo = sourcePks[0];
 				const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
 				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
 				if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const newLinks = newValue.map((rel) => typeof rel === "object" && rel !== null ? rel.id : rel).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 						[sourceJunctionColumn.name]: parsedSourceId,
@@ -5958,7 +6321,7 @@ var RelationService = class {
 					}));
 					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
 				} else if (newValue && !Array.isArray(newValue)) {
-					const targetPks = getPrimaryKeys(targetCollection, this.registry);
+					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 					const targetIdInfo = targetPks[0];
 					const parsedTargetId = parseIdValues(typeof newValue === "object" && newValue !== null ? newValue.id : newValue, targetPks)[targetIdInfo.fieldName];
 					const newLink = {
@@ -5989,12 +6352,12 @@ var RelationService = class {
 				logger.warn(`Junction columns not found for relation '${relation.relationName}'`);
 				return;
 			}
-			const sourcePks = getPrimaryKeys(sourceCollection, this.registry);
+			const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
 			const sourceIdInfo = sourcePks[0];
 			const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
 			await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
 			if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-				const targetPks = getPrimaryKeys(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 				const targetIdInfo = targetPks[0];
 				const newLinks = newValue.map((rel) => rel.id).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
 					[sourceJunctionColumn.name]: parsedSourceId,
@@ -6015,12 +6378,12 @@ var RelationService = class {
 			const { relation, newTargetId } = upd;
 			const targetCollection = relation.target();
 			const targetTable = getTableForCollection(targetCollection, this.registry);
-			const targetPks = getPrimaryKeys(targetCollection, this.registry);
+			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 			const targetIdInfo = targetPks[0];
 			const targetIdCol = targetTable[targetIdInfo.fieldName];
 			const { targetFKColName, parentSourceColName } = this.resolveJoinPathWriteMapping(parentCollection, relation);
 			const parentTable = getTableForCollection(parentCollection, this.registry);
-			const parentPks = getPrimaryKeys(parentCollection, this.registry);
+			const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 			const parentIdInfo = parentPks[0];
 			const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
 			const parentIdCol = parentTable[parentIdInfo.fieldName];
@@ -6091,7 +6454,7 @@ var RelationService = class {
 				logger.warn(`Junction columns not found for relation '${relationKey}'`);
 				return;
 			}
-			const targetPks = getPrimaryKeys(targetCollection, this.registry);
+			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
 			const targetIdInfo = targetPks[0];
 			const parsedNewEntityId = parseIdValues(newEntityId, targetPks)[targetIdInfo.fieldName];
 			const junctionData = {
@@ -6107,6 +6470,131 @@ var RelationService = class {
 	}
 };
 //#endregion
+//#region src/services/row-pipeline.ts
+/**
+* Whether a many-relation reaches its target through a junction table.
+*
+* Also used to build the drizzle `with` config, which is why it is exported:
+* the query has to nest one level deeper for a junction, and the row walk has
+* to unwrap that same level back out.
+*/
+function isJunctionRelation(relation) {
+	if (relation.through) return true;
+	if (relation.joinPath && relation.joinPath.length > 1) return true;
+	return false;
+}
+/**
+* Reach the target row inside a junction row.
+*
+* A junction row looks like `{ post_id: 1, tag_id: { id: 5, name: "ts" } }` —
+* the foreign keys, and the target nested under one of them. The target is the
+* only object among them, so that is how it is found. A junction row that has
+* not been nested (no `with` on the join) has no object and is returned as-is.
+*/
+function unwrapJunctionRow(item) {
+	const nestedKey = Object.keys(item).find((key) => typeof item[key] === "object" && item[key] !== null && !Array.isArray(item[key]));
+	return nestedKey ? item[nestedKey] : item;
+}
+/**
+* Give back the number a `number` property was declared to be.
+*
+* Postgres returns NUMERIC as a string and drizzle keeps it that way, since a
+* numeric can hold more precision than a double. But the collection declared
+* this property `number` and the OpenAPI spec this server publishes says
+* `type: number`, so serving `"9.99"` breaks its own contract — and breaks it
+* asymmetrically, because a create answers with the number and the read that
+* follows answers with the string. Any client that multiplies a price works
+* until the first refresh.
+*
+* Declaring a property `number` already accepts double precision — that is what
+* the admin has always parsed it to. Columns REST serves that no property
+* declares are left exactly as the database returned them.
+*/
+function coerceDeclaredNumber(value, property) {
+	if (property?.type !== "number" || typeof value !== "string") return value;
+	const parsed = parseFloat(value);
+	return isNaN(parsed) ? null : parsed;
+}
+/** Apply {@link coerceDeclaredNumber} across a row, leaving every other column alone. */
+function coerceDeclaredNumbers(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	const out = {};
+	for (const [key, value] of Object.entries(row)) out[key] = coerceDeclaredNumber(value, properties[key]);
+	return out;
+}
+/** Render one target row in the requested style. */
+function renderTarget(targetRow, targetCollection, style, registry) {
+	if (style === "inline") return coerceDeclaredNumbers({ ...targetRow }, targetCollection);
+	const address = relationTargetAddress(targetRow, targetCollection, registry);
+	const path = targetCollection.slug;
+	return createRelationRefWithData(address, path, {
+		id: address,
+		path,
+		values: normalizeDbValues(targetRow, targetCollection)
+	});
+}
+/**
+* The address a relation ref points at.
+*
+* The whole key, not its first column: a composite-keyed target addressed by
+* `tenant_id` alone points at every row that shares it. A target whose key
+* cannot be resolved at all used to throw here — reading `[0]` of an empty
+* array — taking down the parent's fetch over a relation it may not even have
+* asked for. The first column is a guess, but a ref that resolves to nothing
+* beats no rows at all.
+*/
+function relationTargetAddress(targetRow, targetCollection, registry) {
+	const address = deriveRowAddress(targetRow, targetCollection, registry);
+	if (address) return address;
+	return String(targetRow[Object.keys(targetRow)[0]] ?? "");
+}
+/**
+* The row the admin renders: every column, with relations as references.
+*
+* Values are normalized (dates, numbers, NaN) because the admin's view-model
+* expects real types. The row's own address is *not* among the columns — it is
+* derived by the consumer from the collection's primary keys.
+*/
+function toCmsRow(row, collection, registry) {
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const normalized = normalizeDbValues(row, collection);
+	for (const [key, relation] of Object.entries(resolvedRelations)) {
+		const relData = row[relation.relationName || key];
+		if (relData === void 0 || relData === null) continue;
+		if (relation.cardinality === "many" && Array.isArray(relData)) {
+			const targetCollection = relation.target();
+			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, targetCollection, "ref", registry));
+		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
+	}
+	return normalized;
+}
+/**
+* The row REST serves: every column under its own name, with the value Postgres
+* returned, and relations inlined as the target's columns.
+*
+* Values are the ones the database returned, except where that contradicts the
+* declared type: a `number` property is served as a number (see
+* {@link coerceDeclaredNumber}). Dates stay as the database returned them —
+* JSON has its own opinions about dates that the admin's view-model does not
+* share.
+*
+* Keyed by the row rather than by the relation list — a REST fetch only loads
+* the relations `include` asked for, so the row is the authority on which are
+* actually there.
+*/
+function toRestRow(row, collection, registry) {
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const flat = {};
+	for (const [key, value] of Object.entries(row)) {
+		const relation = findRelation(resolvedRelations, key);
+		if (relation && Array.isArray(value)) flat[key] = value.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, relation.target(), "inline", registry));
+		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
+		else flat[key] = coerceDeclaredNumber(value, collection.properties?.[key]);
+	}
+	return flat;
+}
+//#endregion
 //#region src/services/FetchService.ts
 /**
 * Service for handling all row read operations.
@@ -6165,7 +6653,7 @@ var FetchService = class {
 			if (!shouldInclude(key)) continue;
 			const drizzleRelName = relation.relationName || key;
 			if (relation.joinPath && relation.joinPath.length > 0) continue;
-			if (relation.cardinality === "many" && this.isJunctionRelation(relation, collection)) {
+			if (relation.cardinality === "many" && isJunctionRelation(relation)) {
 				const targetFkName = this.getJunctionTargetRelationName(relation, collection);
 				if (targetFkName) withConfig[drizzleRelName] = { with: { [targetFkName]: true } };
 				else withConfig[drizzleRelName] = true;
@@ -6174,14 +6662,6 @@ var FetchService = class {
 		return withConfig;
 	}
 	/**
-	* Detect if a many-to-many relation uses a junction table in the Drizzle schema.
-	*/
-	isJunctionRelation(relation, _collection) {
-		if (relation.through) return true;
-		if (relation.joinPath && relation.joinPath.length > 1) return true;
-		return false;
-	}
-	/**
 	* Get the Drizzle relation name on the junction table that points to the actual target row.
 	* For example, for posts_tags junction, this returns "tag_id" (the relation pointing to tags).
 	*/
@@ -6190,54 +6670,6 @@ var FetchService = class {
 		return null;
 	}
 	/**
-	* Convert a db.query result row (with nested relation objects) to a flat row.
-	* Handles:
-	* - Type normalization (dates, numbers, NaN) via normalizeDbValues
-	* - Converting nested relation objects to { id, path, __type: "relation" } for CMS
-	* - Flattening junction-table many-to-many results
-	*
-	* The row's own address is not among them: it is derived by the consumer
-	* from the collection's primary keys.
-	*/
-	drizzleResultToRow(row, collection) {
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const normalizedValues = normalizeDbValues(row, collection);
-		for (const [key, relation] of Object.entries(resolvedRelations)) {
-			const relData = row[relation.relationName || key];
-			if (relData === void 0 || relData === null) continue;
-			if (relation.cardinality === "many" && Array.isArray(relData)) {
-				const targetCollection = relation.target();
-				const targetPath = targetCollection.slug;
-				const targetIdField = getPrimaryKeys(targetCollection, this.registry)[0].fieldName;
-				normalizedValues[key] = relData.map((item) => {
-					let targetRow = item;
-					if (this.isJunctionRelation(relation, collection)) {
-						const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-						if (nestedKey) targetRow = item[nestedKey];
-					}
-					const relId = String(targetRow[targetIdField] ?? targetRow.id ?? targetRow[Object.keys(targetRow)[0]]);
-					return createRelationRefWithData(relId, targetPath, {
-						id: relId,
-						path: targetPath,
-						values: normalizeDbValues(targetRow, targetCollection)
-					});
-				});
-			} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) {
-				const targetCollection = relation.target();
-				const targetPath = targetCollection.slug;
-				const targetIdField = getPrimaryKeys(targetCollection, this.registry)[0].fieldName;
-				const relObj = relData;
-				const relId = String(relObj[targetIdField] ?? relObj.id ?? relObj[Object.keys(relObj)[0]]);
-				normalizedValues[key] = createRelationRefWithData(relId, targetPath, {
-					id: relId,
-					path: targetPath,
-					values: normalizeDbValues(relObj, targetCollection)
-				});
-			}
-		}
-		return normalizedValues;
-	}
-	/**
 	* Post-fetch joinPath relations for a single flat row.
 	* joinPath relations cannot be expressed via Drizzle's `with` config,
 	* so they must be loaded separately after the primary query.
@@ -6258,31 +6690,6 @@ var FetchService = class {
 		await Promise.all(promises);
 	}
 	/**
-	* Post-fetch joinPath relations for a batch of flat rows.
-	* Uses batch fetching to avoid N+1 queries for list views.
-	*/
-	async resolveJoinPathRelationsBatch(rows, collection, collectionPath, idInfo, _databaseId) {
-		if (rows.length === 0) return;
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0);
-		if (joinPathRelations.length === 0) return;
-		for (const [key, relation] of joinPathRelations) try {
-			const rowIds = rows.map((r) => {
-				return parseIdValues(String(r.id), [idInfo])[idInfo.fieldName];
-			});
-			const resultMap = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation);
-			for (const row of rows) {
-				const id = parseIdValues(String(row.id), [idInfo])[idInfo.fieldName];
-				const relatedRow = resultMap.get(String(id));
-				if (relatedRow) {
-					if (relation.cardinality === "one") row[key] = createRelationRefWithData(relatedRow.id, relatedRow.path, relatedRow);
-				}
-			}
-		} catch (e) {
-			logger.warn(`Could not batch resolve joinPath relation '${key}'`, { error: e });
-		}
-	}
-	/**
 	* Resolves joinPath relations for raw REST rows and directly injects them.
 	* Uses RelationService to query the database and maps results back to the flattened objects.
 	*/
@@ -6293,63 +6700,29 @@ var FetchService = class {
 		const shouldInclude = (key) => !include || include.length === 0 || include[0] === "*" || include.includes(key);
 		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.joinPath && relation.joinPath.length > 0 && propertyKeys.has(key) && shouldInclude(key));
 		if (joinPathRelations.length === 0) return;
-		const idInfo = idInfoArray[0];
+		const parentIdOf = (row) => {
+			const address = buildCompositeId(row, idInfoArray);
+			return address && address.split(":::").some((part) => part !== "") ? address : void 0;
+		};
 		for (const [key, relation] of joinPathRelations) try {
-			const rowIds = rows.map((r) => {
-				return parseIdValues(String(r.id), idInfoArray)[idInfo.fieldName];
-			});
+			const addressable = rows.filter((r) => parentIdOf(r) !== void 0 && parentIdOf(r) !== null);
+			if (addressable.length === 0) continue;
+			const rowIds = addressable.map((r) => parentIdOf(r));
 			if (relation.cardinality === "one") {
 				const resultMap = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation);
-				for (const row of rows) {
-					const id = parseIdValues(String(row.id), idInfoArray)[idInfo.fieldName];
-					const relatedRow = resultMap.get(String(id));
-					if (relatedRow) row[key] = {
-						...relatedRow.values,
-						id: relatedRow.id
-					};
-					else row[key] = null;
+				for (const row of addressable) {
+					const relatedRow = resultMap.get(String(parentIdOf(row)));
+					row[key] = relatedRow ? { ...relatedRow.values } : null;
 				}
 			} else if (relation.cardinality === "many") {
 				const resultMap = await this.relationService.batchFetchRelatedEntitiesMany(collectionPath, rowIds, key, relation);
-				for (const row of rows) {
-					const id = parseIdValues(String(row.id), idInfoArray)[idInfo.fieldName];
-					row[key] = (resultMap.get(String(id)) || []).map((e) => ({
-						...e.values,
-						id: e.id
-					}));
-				}
+				for (const row of addressable) row[key] = (resultMap.get(String(parentIdOf(row))) || []).map((e) => ({ ...e.values }));
 			}
 		} catch (e) {
 			logger.warn(`Could not batch resolve joinPath relation '${key}' for REST`, { error: e });
 		}
 	}
 	/**
-	* Convert a db.query result row to a flat REST-style row with populated relations.
-	*
-	* Every column is copied through under its own name, with the value Postgres
-	* returned. This used to open with a synthesized `id` and then skip the key
-	* column, which renamed it (a `sku` primary key was served as `id`, and `sku`
-	* did not appear at all) and restringified it (`42` → `"42"`). Consumers that
-	* need an address derive it from the collection's primary keys.
-	*/
-	drizzleResultToRestRow(row, collection) {
-		const flat = {};
-		const resolvedRelations = resolveCollectionRelations(collection);
-		for (const [k, v] of Object.entries(row)) {
-			const relation = findRelation(resolvedRelations, k);
-			if (Array.isArray(v) && relation) flat[k] = v.map((item) => {
-				if (this.isJunctionRelation(relation, collection)) {
-					const nestedKey = Object.keys(item).find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-					if (nestedKey) return { ...item[nestedKey] };
-				}
-				return { ...item };
-			});
-			else if (typeof v === "object" && v !== null && !Array.isArray(v) && relation) flat[k] = { ...v };
-			else flat[k] = v;
-		}
-		return flat;
-	}
-	/**
 	* Build db.query-compatible options from standard fetch options.
 	* Handles filter, search, orderBy, limit, and cursor-based pagination.
 	*/
@@ -6419,7 +6792,7 @@ var FetchService = class {
 	async fetchOne(collectionPath, id, databaseId) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
@@ -6433,7 +6806,7 @@ var FetchService = class {
 				with: withConfig
 			});
 			if (!row) return void 0;
-			const flatRow = this.drizzleResultToRow(row, collection);
+			const flatRow = toCmsRow(row, collection, this.registry);
 			await this.resolveJoinPathRelations(flatRow, collection, collectionPath, parsedId, databaseId);
 			return flatRow;
 		} catch (e) {
@@ -6475,7 +6848,7 @@ var FetchService = class {
 	async fetchRowsWithConditions(collectionPath, options = {}) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
@@ -6485,7 +6858,7 @@ var FetchService = class {
 		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
 		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0);
-			return (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRow(row, collection));
+			return (await qb.findMany(queryOpts)).map((row) => toCmsRow(row, collection, this.registry));
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
 				logger.error(`[FetchService] Relation inference error for collection '${collectionPath}': ${e.message}`);
@@ -6546,8 +6919,10 @@ var FetchService = class {
 	}
 	/**
 	* Fallback path used when db.query is unavailable.
-	* The primary path uses drizzleResultToRow which handles relation
-	* mapping without N+1 queries.
+	*
+	* The primary path runs the results through `toCmsRow`, which maps
+	* relations from what drizzle already nested — no query per row. This one
+	* has no nesting to read, so it resolves relations itself, in batches.
 	*
 	* Process raw database results into flat rows with relations.
 	*/
@@ -6627,10 +7002,7 @@ var FetchService = class {
 			const relationKey = pathSegments[i];
 			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
 			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
-			if (i === pathSegments.length - 1) return (await this.relationService.fetchRelatedEntities(currentCollection.slug, currentId, relationKey, options)).map((row) => ({
-				...row.values,
-				id: row.id
-			}));
+			if (i === pathSegments.length - 1) return (await this.relationService.fetchRelatedEntities(currentCollection.slug, currentId, relationKey, options)).map((row) => ({ ...row.values }));
 			if (i + 1 < pathSegments.length) {
 				const nextEntityId = pathSegments[i + 1];
 				currentCollection = relation.target();
@@ -6692,7 +7064,7 @@ var FetchService = class {
 		if (value === void 0 || value === null) return true;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const field = table[fieldName];
@@ -6719,7 +7091,7 @@ var FetchService = class {
 	async fetchCollectionForRest(collectionPath, options = {}, include) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const tableName = getTableName(table);
@@ -6727,7 +7099,7 @@ var FetchService = class {
 		if (qb && !options.searchString && !options.vectorSearch) try {
 			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
 			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig);
-			const restRows = (await qb.findMany(queryOpts)).map((row) => this.drizzleResultToRestRow(row, collection));
+			const restRows = (await qb.findMany(queryOpts)).map((row) => toRestRow(row, collection, this.registry));
 			await this.resolveJoinPathRelationsBatchRest(restRows, collection, collectionPath, idInfoArray, include);
 			return restRows;
 		} catch (e) {
@@ -6776,7 +7148,7 @@ var FetchService = class {
 	async fetchOneForRest(collectionPath, id, include, databaseId) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
 		const idField = table[idInfo.fieldName];
 		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
@@ -6789,7 +7161,7 @@ var FetchService = class {
 				...withConfig ? { with: withConfig } : {}
 			});
 			if (!row) return null;
-			const restRow = this.drizzleResultToRestRow(row, collection);
+			const restRow = toRestRow(row, collection, this.registry);
 			await this.resolveJoinPathRelationsBatchRest([restRow], collection, collectionPath, idInfoArray, include);
 			return restRow;
 		} catch (e) {
@@ -6834,7 +7206,7 @@ var FetchService = class {
 	async fetchRowsWithConditionsRaw(collectionPath, options = {}) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idField = table[getPrimaryKeys(collection, this.registry)[0].fieldName];
+		const idField = table[requirePrimaryKeys(collection, this.registry)[0].fieldName];
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
 		let query = vectorMeta ? this.db.select({
@@ -7323,7 +7695,7 @@ var PersistService = class {
 		} catch (error) {
 			throw this.toUserFriendlyError(error, collection.slug);
 		}
-		const finalEntity = await this.fetchService.fetchOne(collection.slug, savedId, databaseId);
+		const finalEntity = await this.fetchService.fetchOneForRest(collection.slug, savedId, void 0, databaseId);
 		if (!finalEntity) throw new Error("Could not fetch row after save.");
 		return finalEntity;
 	}
@@ -8242,12 +8614,14 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
 		let previousValuesForHistory;
-		if (status === "existing" && id) {
-			const existing = await this.dataService.fetchOne(path, id, resolvedCollection?.databaseId);
+		if (status === "existing" && id) try {
+			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
 			if (existing) {
 				const { id: _existingId, ...existingValues } = existing;
 				previousValuesForHistory = existingValues;
 			}
+		} catch (err) {
+			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
 		}
 		if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
 			if (globalCallbacks?.beforeSave) {
@@ -8315,8 +8689,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 					context: contextForCallback
 				});
 			}
-			const savedId = savedRow.id;
-			const { id: _savedId, ...savedValues } = savedRow;
+			const savedId = deriveRowAddress(savedRow, resolvedCollection ?? collection, this.registry);
+			const savedValues = savedRow;
 			if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
 				if (globalCallbacks?.afterSave) await globalCallbacks.afterSave({
 					collection: resolvedCollection,
@@ -8348,7 +8722,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			}
 			if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
 				tableName: path,
-				id: savedId.toString(),
+				id: savedId,
 				action: status === "new" ? "create" : "update",
 				values: savedValues,
 				previousValues: previousValuesForHistory,
@@ -8356,11 +8730,11 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			});
 			if (this._deferNotifications) this._pendingNotifications.push({
 				path,
-				id: savedId.toString(),
+				id: savedId,
 				row: savedRow,
 				databaseId: resolvedCollection?.databaseId
 			});
-			else await this.realtimeService.notifyUpdate(path, savedId.toString(), savedRow, resolvedCollection?.databaseId);
+			else await this.realtimeService.notifyUpdate(path, savedId, savedRow, resolvedCollection?.databaseId);
 			return savedRow;
 		} catch (error) {
 			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
@@ -8440,10 +8814,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	}
 	async delete({ row, collection }) {
 		const targetPath = row.path;
-		const targetRow = {
-			id: row.id,
-			...row.values ?? {}
-		};
+		const targetRow = { ...row.values ?? {} };
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, targetPath);
 		const contextForCallback = this.buildCallContext();
 		if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
@@ -8863,6 +9234,7 @@ var DatabasePoolManager = class {
 		pool.on("error", (err) => {
 			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
 		});
+		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 		this.pools.set(databaseName, pool);
 		return pool;
 	}
@@ -9391,6 +9763,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 		});
 	});
 	schemaContent += "\n";
+	const junctionSpecs = resolveJunctionSpecs(collections);
 	for (const collection of collections) {
 		const tableName = getTableName$1(collection);
 		if (tableName) allTablesToGenerate.set(tableName, { collection });
@@ -9424,9 +9797,17 @@ var generateSchema = async (collections, stripPolicies = false) => {
 			schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
 			schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
 			schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName$1(targetCollection))}.${targetId}, ${refOptions}),\n`;
-			schemaContent += "}, (table) => ({\n";
-			schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
-			schemaContent += "}));\n\n";
+			schemaContent += "}, (table) => ([\n";
+			schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
+			const junctionSpec = junctionSpecs.get(baseTableName);
+			if (!stripPolicies && junctionSpec) {
+				const junctionCollection = getJunctionCollectionConfig(junctionSpec);
+				const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName$1(c) === slug);
+				getJunctionSecurityRules(junctionSpec).forEach((rule, idx) => {
+					schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
+				});
+			}
+			schemaContent += "])).enableRLS();\n\n";
 		} else if (!isJunction) {
 			const schema = isPostgresCollectionConfig(collection) ? collection.schema : void 0;
 			const tableCreator = schema ? `${schema}Schema.table` : "pgTable";
@@ -10117,7 +10498,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				startAfter: request.startAfter,
 				searchString: request.searchString
 			}, authContext);
-			this.sendCollectionUpdate(clientId, subscriptionId, rows);
+			this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
 			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -10218,7 +10599,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			if (subscription.type === "single" && notifyPath === originalPath) if (row && row?._rebase_invalidated) this.debouncedSingleRefetch(subscriptionId, notifyPath, id, subscription);
 			else this.sendSingleUpdate(subscription.clientId, subscriptionId, row);
 			else if (subscription.type === "collection" && subscription.collectionRequest) {
-				if (!row || !row?._rebase_invalidated) this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row);
+				if (!row || !row?._rebase_invalidated) this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row, notifyPath);
 				this.debouncedCollectionRefetch(subscriptionId, notifyPath, subscription);
 			}
 		} catch (error) {
@@ -10248,7 +10629,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			if (!this._subscriptions.has(subscriptionId)) return;
 			try {
 				const rows = await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest, subscription.authContext);
-				this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows);
+				this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath);
 			} catch (error) {
 				const sanitized = sanitizeErrorForClient(error, notifyPath);
 				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -10462,11 +10843,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		return await this.dataService.fetchOne(notifyPath, id);
 	}
-	sendCollectionUpdate(clientId, subscriptionId, rows) {
+	sendCollectionUpdate(clientId, subscriptionId, rows, path) {
 		const message = {
 			type: "collection_update",
 			subscriptionId,
-			rows
+			rows,
+			pks: this.primaryKeysForPath(path)
 		};
 		this.sendMessage(clientId, message);
 	}
@@ -10481,16 +10863,33 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	/**
 	* Send a lightweight row-level patch to a collection subscriber.
 	* The client can merge this into its cached data for instant feedback.
+	*
+	* The key columns ride along: the patch names a row by address, and the
+	* client has to find that row among the ones it cached — which carry
+	* columns and no address. The SDK holds no collection config to derive one
+	* from, so this is the only place the mapping can come from.
 	*/
-	sendCollectionPatch(clientId, subscriptionId, id, row) {
+	sendCollectionPatch(clientId, subscriptionId, id, row, notifyPath) {
 		const message = {
 			type: "collection_patch",
 			subscriptionId,
 			id,
-			row
+			row,
+			pks: this.primaryKeysForPath(notifyPath)
 		};
 		this.sendMessage(clientId, message);
 	}
+	/** The key columns of the collection at `path`, if they can be resolved. */
+	primaryKeysForPath(path) {
+		try {
+			const collection = this.registry.getCollectionByPath(path);
+			if (!collection) return void 0;
+			const keys = getPrimaryKeys(collection, this.registry);
+			return keys.length > 0 ? keys : void 0;
+		} catch {
+			return;
+		}
+	}
 	sendError(clientId, error, subscriptionId, code) {
 		const message = {
 			type: "error",
@@ -10738,12 +11137,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	}
 	/** Compute the canonical (possibly composite) id string from a captured row. */
 	extractIdFromCdcRow(collection, row) {
-		try {
-			const composite = buildCompositeId(row, getPrimaryKeys(collection, this.registry));
-			if (composite && composite !== ":::") return composite;
-		} catch {}
-		if (row.id !== void 0 && row.id !== null) return String(row.id);
-		return "*";
+		return deriveRowAddress(row, collection, this.registry) || "*";
 	}
 	dedupKey(path, id, databaseId) {
 		return `${databaseId ?? ""}::${path}::${id}`;
@@ -20203,6 +20597,33 @@ function formatBytes(bytes) {
 	return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
 }
 //#endregion
+//#region src/collections/buildRegistry.ts
+/**
+* Build the collection registry for a driver.
+*
+* The order matters and is the reason this is one function rather than a run of
+* statements in the bootstrapper. Keys are resolved from the drizzle schema, so
+* anything that inspects them has to run *after* the tables are registered —
+* and `warnOnKeysTheAdminCannotResolve` fails open if it does not, because a
+* collection whose table it cannot look up is one it has nothing to say about.
+* Warned too early, it would skip every collection and report nothing, which
+* reads exactly like having nothing to report.
+*/
+function buildCollectionRegistry(schema) {
+	const registry = new PostgresCollectionRegistry();
+	if (schema.collections) {
+		registry.registerMultiple(schema.collections);
+		logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
+	}
+	if (schema.tables) Object.values(schema.tables).forEach((table) => {
+		if (isTable(table)) registry.registerTable(table, getTableName(table));
+	});
+	if (schema.enums) registry.registerEnums(schema.enums);
+	if (schema.relations) registry.registerRelations(schema.relations);
+	warnOnKeysTheAdminCannotResolve(registry.getCollections(), registry);
+	return registry;
+}
+//#endregion
 //#region src/auth/ensure-tables.ts
 /**
 * Auto-create auth tables if they don't exist.
@@ -20374,14 +20795,22 @@ async function ensureAuthTablesExist(db, collection) {
                 $$ LANGUAGE sql STABLE
             `);
 		});
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
-        `);
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
-        `);
+		for (const columnDef of [
+			"display_name VARCHAR(255)",
+			"photo_url VARCHAR(500)",
+			"roles TEXT[] DEFAULT '{}' NOT NULL",
+			"password_hash VARCHAR(255)",
+			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
+			"email_verification_token VARCHAR(255)",
+			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
+			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
+			"metadata JSONB DEFAULT '{}' NOT NULL",
+			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
+			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
+		]) await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+            `);
 		try {
 			if ((await db.execute(sql`
                 SELECT EXISTS (
@@ -20452,6 +20881,34 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE INDEX IF NOT EXISTS idx_recovery_codes_user
             ON ${sql.raw(recoveryCodesTableName)}(user_id)
         `);
+		try {
+			const authTablePairs = [
+				[usersSchema, resolvedTable],
+				[authSchema, "user_identities"],
+				[authSchema, "refresh_tokens"],
+				[authSchema, "password_reset_tokens"],
+				[authSchema, "app_config"],
+				[authSchema, "mfa_factors"],
+				[authSchema, "mfa_challenges"],
+				[authSchema, "recovery_codes"]
+			];
+			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
+                    SELECT 1
+                    FROM pg_class c
+                    JOIN pg_namespace n ON n.oid = c.relnamespace
+                    WHERE n.nspname = ${schemaName}
+                      AND c.relname = ${tableName}
+                      AND c.relforcerowsecurity
+                `)).rows.length > 0) {
+				await db.execute(sql`
+                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
+                        NO FORCE ROW LEVEL SECURITY
+                    `);
+				logger.warn(`🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" (legacy RLS model — it binds the owner connection and breaks privileged auth writes)`);
+			}
+		} catch (rlsReconcileError) {
+			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
+		}
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
 		logger.error("❌ Failed to create auth tables", { error });
@@ -20499,6 +20956,31 @@ var UserService = class {
 		const name = getTableName(this.usersTable);
 		return `"${getTableConfig(this.usersTable).schema || "public"}"."${name}"`;
 	}
+	/**
+	* Run a privileged auth write with an explicitly cleared RLS context.
+	*
+	* The auth services run on the base/owner connection, which by design
+	* carries a NULL `app.user_id` so the `auth.uid() IS NULL` server-escape
+	* in the default policies applies. That NULL is normally guaranteed by
+	* `set_config(..., is_local = true)` resetting at transaction end — but a
+	* GUC that survives on a pooled connection (or a connection role that
+	* doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
+	* turns the trusted write into an RLS-scoped one and denies it with
+	* SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
+	* single chokepoint, makes the server context deterministic instead of
+	* trusting whatever state the pool hands us. `auth.uid()` reads '' as
+	* NULL via NULLIF, so '' is the server context.
+	*/
+	async withServerContext(fn) {
+		return await this.db.transaction(async (tx) => {
+			await tx.execute(sql`
+                SELECT set_config('app.user_id', '', true),
+                       set_config('app.user_roles', '', true),
+                       set_config('app.jwt', '', true)
+            `);
+			return await fn(tx);
+		});
+	}
 	mapRowToUser(row) {
 		if (!row) return row;
 		const id = row.id ?? row.uid;
@@ -20596,7 +21078,7 @@ var UserService = class {
 	}
 	async createUser(data) {
 		const payload = this.mapPayload(data);
-		const [row] = await this.db.insert(this.usersTable).values(payload).returning();
+		const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
 		return this.mapRowToUser(row);
 	}
 	async getUserById(id) {
@@ -20635,12 +21117,12 @@ var UserService = class {
 		}));
 	}
 	async linkUserIdentity(userId, provider, providerId, profileData) {
-		await this.db.insert(this.userIdentitiesTable).values({
+		await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
 			userId,
 			provider,
 			providerId,
 			profileData: profileData || null
-		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] });
+		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] }));
 	}
 	async updateUser(id, data) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -20648,13 +21130,13 @@ var UserService = class {
 		const payload = this.mapPayload(data);
 		const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 		payload[updatedAtKey] = /* @__PURE__ */ new Date();
-		const [row] = await this.db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning();
+		const [row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
 		return row ? this.mapRowToUser(row) : null;
 	}
 	async deleteUser(id) {
 		const idCol = getColumn(this.usersTable, "id");
 		if (!idCol) return;
-		await this.db.delete(this.usersTable).where(eq(idCol, id));
+		await this.withServerContext(async (db) => db.delete(this.usersTable).where(eq(idCol, id)));
 	}
 	async listUsers() {
 		return (await this.db.select().from(this.usersTable)).map((row) => this.mapRowToUser(row));
@@ -20708,10 +21190,10 @@ var UserService = class {
 		if (!idCol) return;
 		const passwordHashColKey = getColumnKey(this.usersTable, "passwordHash", "password_hash") || "passwordHash";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[passwordHashColKey]: passwordHash,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification status
@@ -20722,11 +21204,11 @@ var UserService = class {
 		const emailVerifiedColKey = getColumnKey(this.usersTable, "emailVerified", "email_verified") || "emailVerified";
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerifiedColKey]: verified,
 			[emailVerificationTokenColKey]: null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification token
@@ -20737,11 +21219,11 @@ var UserService = class {
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const emailVerificationSentAtColKey = getColumnKey(this.usersTable, "emailVerificationSentAt", "email_verification_sent_at") || "emailVerificationSentAt";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerificationTokenColKey]: token,
 			[emailVerificationSentAtColKey]: token ? /* @__PURE__ */ new Date() : null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Find user by email verification token
@@ -20786,22 +21268,22 @@ var UserService = class {
 	async setUserRoles(userId, roleIds) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const rolesArray = `{${roleIds.join(",")}}`;
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = ${rolesArray}::text[], updated_at = NOW()
             WHERE id = ${userId}
-        `);
+        `));
 	}
 	/**
 	* Assign a specific role to new user (appends if not present)
 	*/
 	async assignDefaultRole(userId, roleId) {
 		const usersTableName = this.getQualifiedUsersTableName();
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = array_append(roles, ${roleId}), updated_at = NOW()
             WHERE id = ${userId} AND NOT (${roleId} = ANY(roles))
-        `);
+        `));
 	}
 	/**
 	* Get user with their roles
@@ -22185,21 +22667,14 @@ function createPostgresBootstrapper(pgConfig) {
 				logger.info(`🔍 [PostgresRegistry] BaaS mode: derived ${introspectedCollections.length} collections from schema "${pgSchemaName}" [${introspectedCollections.map((c) => c.slug).join(", ")}]`);
 			}
 			const activeCollections = introspectedCollections ?? collections;
-			const registry = new PostgresCollectionRegistry();
-			if (activeCollections) {
-				registry.registerMultiple(activeCollections);
-				logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
-			}
 			const schemaTables = introspectedTables ?? pgConfig.schema?.tables;
-			if (schemaTables) Object.values(schemaTables).forEach((table) => {
-				if (isTable(table)) {
-					const tableName = getTableName(table);
-					registry.registerTable(table, tableName);
-				}
-			});
-			if (pgConfig.schema?.enums) registry.registerEnums(pgConfig.schema.enums);
 			const schemaRelations = introspectedRelations ?? pgConfig.schema?.relations;
-			if (schemaRelations) registry.registerRelations(schemaRelations);
+			const registry = buildCollectionRegistry({
+				collections: activeCollections,
+				tables: schemaTables,
+				enums: pgConfig.schema?.enums,
+				relations: schemaRelations
+			});
 			if (schemaTables) patchPgArrayNullSafety(schemaTables);
 			const mergedSchema = {
 				...schemaTables,
@@ -22278,6 +22753,7 @@ function createPostgresBootstrapper(pgConfig) {
 			const wantsCdc = cdcMode !== "off";
 			const explicitCdc = cdcMode === "trigger" || cdcMode === "wal";
 			let cdcEnabled = false;
+			let provisionCdcForTables;
 			if (wantsCdc && !directUrl) {
 				const reason = "no direct database connection is available for the realtime LISTEN client (set DATABASE_DIRECT_URL)";
 				if (explicitCdc) logger.warn(`⚠️ [CDC] REALTIME_CDC=${cdcMode} but ${reason} — using app-level realtime.`);
@@ -22294,6 +22770,9 @@ function createPostgresBootstrapper(pgConfig) {
 					})).filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table)));
 					await realtimeService.enableCdc(directUrl);
 					cdcEnabled = true;
+					provisionCdcForTables = async (tables) => {
+						await provisionTriggerCdc(cdcRunSql, tables);
+					};
 					logger.info(`📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). All writes now emit realtime events regardless of origin.`);
 				} catch (err) {
 					if (explicitCdc) logger.warn("⚠️ [CDC] Could not enable database-level change capture — falling back to app-level realtime.", { error: err });
@@ -22318,13 +22797,14 @@ function createPostgresBootstrapper(pgConfig) {
 					const dbTables = new Set(result.rows.map((r) => r.table_schema === "public" ? r.table_name : `${r.table_schema}.${r.table_name}`));
 					const missing = [];
 					for (const col of registeredCollections) {
+						if (col.auth?.enabled) continue;
 						const schemaName = "schema" in col && col.schema ? col.schema : "public";
 						const tableName = registry.hasTableForCollection(col.table ?? col.slug) ? col.table ?? col.slug : col.slug;
 						const checkName = registry.getTableNames().find((k) => k === tableName || k === col.slug) ?? tableName;
 						const fullCheckName = schemaName === "public" ? checkName : `${schemaName}.${checkName}`;
 						if (!dbTables.has(fullCheckName)) missing.push({
 							slug: col.slug,
-							table: checkName
+							table: fullCheckName
 						});
 					}
 					if (missing.length > 0) {
@@ -22358,7 +22838,8 @@ function createPostgresBootstrapper(pgConfig) {
 					registry,
 					realtimeService,
 					driver,
-					poolManager
+					poolManager,
+					provisionCdcForTables
 				}
 			};
 		},
@@ -22370,6 +22851,18 @@ function createPostgresBootstrapper(pgConfig) {
 			const registry = internals.registry;
 			const authCollection = authConfig.collection;
 			await ensureAuthTablesExist(db, authCollection);
+			if (authCollection && internals.provisionCdcForTables) {
+				const authSchema = "schema" in authCollection && typeof authCollection.schema === "string" ? authCollection.schema : "rebase";
+				const authTable = "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug;
+				if (authTable) try {
+					await internals.provisionCdcForTables([{
+						schema: authSchema,
+						table: authTable
+					}]);
+				} catch (err) {
+					logger.warn(`⚠️ [CDC] Could not attach change-capture to the auth table "${authSchema}.${authTable}" — writes to it won't emit database-level events.`, { detail: err instanceof Error ? err.message : String(err) });
+				}
+			}
 			let emailService;
 			if (authConfig.email) emailService = createEmailService(authConfig.email);
 			const tableName = authCollection ? "table" in authCollection && typeof authCollection.table === "string" ? authCollection.table : authCollection.slug : void 0;
@@ -22440,6 +22933,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map