@rebasepro/server-postgres 0.9.1-canary.ad870eb → 0.9.1-canary.b10dcdf

package/src/services/collection-helpers.ts

@@ -2,6 +2,15 @@ import { PgTable, AnyPgColumn } from "drizzle-orm/pg-core";
 import { CollectionConfig, Property } from "@rebasepro/types";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
 import { getTableName } from "@rebasepro/common";
+import { logger } from "@rebasepro/server";
+
+// Row identity is derived on both sides of the wire — the driver parses an
+// incoming address into key columns, the admin derives one from a served row —
+// so the implementation lives in `common` and both agree by construction.
+export { buildCompositeId, parseIdValues, COMPOSITE_ID_SEPARATOR } from "@rebasepro/common";
+export type { PrimaryKeyInfo } from "@rebasepro/common";
+import { buildCompositeId, COMPOSITE_ID_SEPARATOR, getDeclaredPrimaryKeys } from "@rebasepro/common";
+import type { PrimaryKeyInfo } from "@rebasepro/common";
 
 /**
  * Shared helper functions for row operations.
@@ -49,10 +58,27 @@ export function getTableForCollection(collection: CollectionConfig, registry: Po
     return table;
 }
 
-export function getPrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): { fieldName: string; type: "string" | "number"; isUUID?: boolean }[] {
-    const table = getTableForCollection(collection, registry);
-
-    // Fallback to explicitly defined isId properties
+/**
+ * The key columns a collection's rows are addressed by.
+ *
+ * Three tiers, in order: properties marked `isId`, the primary keys of the
+ * drizzle schema, and finally a column literally named `id`. Only the first is
+ * visible to the browser, which is why a key known only to drizzle is reported
+ * at boot — see {@link warnOnKeysTheAdminCannotResolve}.
+ *
+ * Returns `[]` when nothing resolves, rather than throwing. It used to open by
+ * resolving the table, which throws when there is none — so the `isId` tier,
+ * which needs no table at all, was unreachable for exactly the collections
+ * most likely to have no table registered. Every caller that wanted "no keys"
+ * to mean "no keys" had to spell that out in a try/catch.
+ *
+ * Callers that cannot proceed without a key must say so themselves, naming the
+ * collection: an empty array here means "this collection has no address", which
+ * is a different answer in a notification (broadcast a wildcard) than in a save
+ * (fail).
+ */
+export function getPrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): PrimaryKeyInfo[] {
+    // Explicitly declared `isId` properties win, and need no table.
     if (collection.properties) {
         const idProps = Object.entries(collection.properties)
             .filter(([_, prop]) => "isId" in (prop as object) && Boolean((prop as { isId?: unknown }).isId))
@@ -67,8 +93,14 @@ export function getPrimaryKeys(collection: CollectionConfig, registry: PostgresC
         }
     }
 
+    // The remaining tiers read the drizzle schema, so they need the table. A
+    // collection without one — another engine's, or simply unregistered — has
+    // nothing more to offer.
+    const table = registry.getTable(getTableName(collection));
+    if (!table) return [];
+
     // Otherwise infer from Drizzle schema
-    const keys: { fieldName: string; type: "string" | "number"; isUUID?: boolean }[] = [];
+    const keys: PrimaryKeyInfo[] = [];
     for (const [key, colRaw] of Object.entries(table)) {
         const col = colRaw as AnyPgColumn;
         if (col && typeof col === "object" && "primary" in col && col.primary) {
@@ -96,56 +128,141 @@ isUUID });
     return keys;
 }
 
-export function parseIdValues(idValue: string | number, primaryKeys: { fieldName: string; type: "string" | "number"; isUUID?: boolean }[]): Record<string, string | number> {
-    const result: Record<string, string | number> = {};
-
-    if (primaryKeys.length === 0) {
-        return result;
+/**
+ * The key columns, for callers that cannot do their job without one.
+ *
+ * {@link getPrimaryKeys} answers "what keys, if any" and returns `[]` for a
+ * collection with no address. Most of this driver, though, is building a WHERE
+ * clause and has no meaning without a key — for those, an empty array is not an
+ * answer, and indexing `[0]` into it produces `Cannot read properties of
+ * undefined` three frames from where the real problem is. This says what is
+ * wrong and which collection it is wrong about.
+ */
+export function requirePrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): PrimaryKeyInfo[] {
+    const keys = getPrimaryKeys(collection, registry);
+    if (keys.length === 0) {
+        throw new Error(
+            `Collection '${collection.slug}' has no primary key, so its rows cannot be addressed. ` +
+            `Mark the key property with \`isId\` in its config, or register a table whose schema declares one.`
+        );
     }
+    return keys;
+}
 
-    if (primaryKeys.length === 1) {
-        const pk = primaryKeys[0];
-        if (pk.type === "number" && !pk.isUUID) {
-            const parsed = typeof idValue === "number" ? idValue : parseInt(String(idValue), 10);
-            if (isNaN(parsed)) {
-                throw new Error(`Invalid numeric ID: ${idValue}`);
-            }
-            result[pk.fieldName] = parsed;
-        } else {
-            result[pk.fieldName] = String(idValue);
-        }
-        return result;
-    }
+/**
+ * Collections whose key the *browser* cannot resolve, and what it will do
+ * instead.
+ *
+ * The two sides resolve keys from different evidence. This driver reads, in
+ * order: properties marked `isId`, the primary keys of the Drizzle schema, then
+ * a column literally named `id`. The admin shares the `CollectionConfig` — it
+ * compiles the same collection files into its bundle — but never the Drizzle
+ * schema, so the middle tier is invisible to it.
+ *
+ * Nothing can normalize this at runtime: the server does not serve the admin
+ * its collections, so a key resolved here cannot be handed over there. The
+ * config files are the only thing both sides read, so the fix is an edit to
+ * them, and the most this can do is say exactly which edit.
+ *
+ * Two shapes, and the second is the dangerous one:
+ *
+ * - No `isId`, no `id` property → the admin resolves no address, warns in the
+ *   console, and rows cannot be opened or linked.
+ * - No `isId`, but an `id` property that is *not* the key → the admin addresses
+ *   rows by `id` while this driver reads the address as the real key. Nothing
+ *   errors: the addresses look right and route wrong.
+ */
+export function findUnresolvableKeyCollections(
+    collections: CollectionConfig[],
+    registry: PostgresCollectionRegistry
+): { collection: CollectionConfig; keys: PrimaryKeyInfo[]; shadowedByIdProperty: boolean }[] {
+    const findings: { collection: CollectionConfig; keys: PrimaryKeyInfo[]; shadowedByIdProperty: boolean }[] = [];
 
-    // Composite key - split by :::
-    const parts = String(idValue).split(":::");
-    if (parts.length !== primaryKeys.length) {
-        throw new Error(`Composite ID parts mismatch. Expected ${primaryKeys.length}, got ${parts.length} for ID: ${idValue}`);
-    }
+    for (const collection of collections) {
+        // Declared `isId` is the tier both sides share: if it is there, they agree.
+        if (getDeclaredPrimaryKeys(collection).length > 0) continue;
 
-    for (let i = 0; i < primaryKeys.length; i++) {
-        const pk = primaryKeys[i];
-        const val = parts[i];
-        if (pk.type === "number" && !pk.isUUID) {
-            const parsed = parseInt(val, 10);
-            if (isNaN(parsed)) {
-                throw new Error(`Invalid numeric ID component: ${val}`);
-            }
-            result[pk.fieldName] = parsed;
-        } else {
-            result[pk.fieldName] = val;
-        }
+        // No registered table resolves to no keys, and a collection this cannot
+        // resolve a key for is one it has nothing to say about.
+        const keys = getPrimaryKeys(collection, registry);
+        if (keys.length === 0) continue;
+
+        // A single key named `id` is the last tier on both sides: they agree
+        // without anything being declared.
+        if (keys.length === 1 && keys[0].fieldName === "id") continue;
+
+        findings.push({
+            collection,
+            keys,
+            shadowedByIdProperty: Boolean(collection.properties?.id)
+        });
     }
 
-    return result;
+    return findings;
 }
 
-export function buildCompositeId(values: Record<string, unknown>, primaryKeys: { fieldName: string; type: "string" | "number"; isUUID?: boolean }[]): string {
-    if (primaryKeys.length === 0) {
-        return "";
+/**
+ * Report the collections from {@link findUnresolvableKeyCollections} at boot,
+ * with the edit that fixes each one.
+ *
+ * Grouped by failure, not by collection: the shadowed case is a routing bug and
+ * the silent case is a missing feature, and they deserve different urgency.
+ */
+export function warnOnKeysTheAdminCannotResolve(
+    collections: CollectionConfig[],
+    registry: PostgresCollectionRegistry
+): void {
+    const findings = findUnresolvableKeyCollections(collections, registry);
+    if (findings.length === 0) return;
+
+    const edit = (f: { collection: CollectionConfig; keys: PrimaryKeyInfo[] }) =>
+        `${f.collection.slug}: mark ${f.keys.map(k => `\`${k.fieldName}\``).join(" and ")} with ` +
+        `\`isId: ${f.keys[0].isUUID ? "\"uuid\"" : f.keys[0].type === "number" ? "\"increment\"" : "true"}\``;
+
+    const shadowed = findings.filter(f => f.shadowedByIdProperty);
+    const silent = findings.filter(f => !f.shadowedByIdProperty);
+
+    if (shadowed.length > 0) {
+        logger.warn(
+            `⚠️ These collections declare no \`isId\`, and their key is only in the drizzle schema — but they ` +
+            `do have a property called \`id\`. The admin has no way to know \`id\` is not the key, so it will ` +
+            `address rows by it while this server reads the address as the real key: the links look right and ` +
+            `route wrong. Nothing will error.\n\n` +
+            shadowed.map(f => `  • ${edit(f)}`).join("\n") + "\n"
+        );
     }
-    if (primaryKeys.length === 1) {
-        return String(values[primaryKeys[0].fieldName] ?? "");
+
+    if (silent.length > 0) {
+        logger.warn(
+            `⚠️ These collections declare no \`isId\`, and their key is only in the drizzle schema, which the ` +
+            `admin never sees. It will resolve no address for their rows, so detail links, caching and ` +
+            `relations will not work for them:\n\n` +
+            silent.map(f => `  • ${edit(f)}`).join("\n") + "\n"
+        );
+    }
+}
+
+/**
+ * The address of a row: derived from the collection's primary keys, because a
+ * row does not carry one — it is exactly its columns.
+ *
+ * Falls back to a literal `id` column, for a row that reached us from somewhere
+ * other than this driver. Returns `""` when there is no key and no `id` —
+ * callers decide what that means, since "unaddressable" is a different answer
+ * in a notification (broadcast a wildcard) than in a save (fail).
+ */
+export function deriveRowAddress(
+    row: Record<string, unknown>,
+    collection: CollectionConfig,
+    registry: PostgresCollectionRegistry
+): string {
+    const composite = buildCompositeId(row, getPrimaryKeys(collection, registry));
+    // An all-empty composite is indistinguishable from a missing key, and
+    // `buildCompositeId` returns "" for no keys at all.
+    if (composite && composite.split(COMPOSITE_ID_SEPARATOR).some(part => part !== "")) {
+        return composite;
     }
-    return primaryKeys.map(pk => String(values[pk.fieldName] ?? "")).join(":::");
+    if (row.id !== undefined && row.id !== null) return String(row.id);
+    return "";
 }
+

package/src/services/dataService.ts

@@ -154,9 +154,10 @@ export class DataService implements DataRepository {
         collectionPath: string,
         values: Partial<M>,
         id?: string | number,
-        databaseId?: string
+        databaseId?: string,
+        options?: { upsert?: boolean }
     ): Promise<Record<string, unknown>> {
-        return this.persistService.save<M>(collectionPath, values, id, databaseId);
+        return this.persistService.save<M>(collectionPath, values, id, databaseId, options);
     }
 
     /**

package/src/services/index.ts

@@ -8,6 +8,7 @@ export {
     getCollectionByPath,
     getTableForCollection,
     getPrimaryKeys,
+    deriveRowAddress,
     parseIdValues,
     buildCompositeId
 } from "./collection-helpers";

package/src/services/realtimeService.ts

@@ -14,7 +14,7 @@ import { applyAuthContext } from "../security/rls-enforcement";
 import { logger } from "@rebasepro/server";
 import { sanitizeErrorForClient } from "../utils/pg-error-utils";
 import { CdcListener, type CdcChangeEvent } from "./cdc/CdcListener";
-import { getPrimaryKeys, buildCompositeId } from "./collection-helpers";
+import { deriveRowAddress, getPrimaryKeys, type PrimaryKeyInfo } from "./collection-helpers";
 
 /** Channel name used for Postgres LISTEN/NOTIFY cross-instance realtime. */
 const PG_NOTIFY_CHANNEL = "rebase_entity_changes";
@@ -390,7 +390,7 @@ export class RealtimeService extends EventEmitter implements RealtimeProvider {
                 authContext
             );
 
-            this.sendCollectionUpdate(clientId, subscriptionId, rows);
+            this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 
         } catch (error) {
             const sanitized = sanitizeErrorForClient(error, request.path);
@@ -554,7 +554,7 @@ export class RealtimeService extends EventEmitter implements RealtimeProvider {
                     // Phase 1: Send instant row-level patch (no DB query)
                     // This gives immediate cross-tab feedback
                     if (!row || !(row as Record<string, unknown>)?._rebase_invalidated) {
-                        this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row);
+                        this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row, notifyPath);
                     }
 
                     // Phase 2: Schedule a deferred full refetch for correctness
@@ -609,7 +609,7 @@ export class RealtimeService extends EventEmitter implements RealtimeProvider {
             if (!this._subscriptions.has(subscriptionId)) return;
             try {
                 const rows = await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest!, subscription.authContext);
-                this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows);
+                this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath);
             } catch (error) {
                 const sanitized = sanitizeErrorForClient(error, notifyPath);
                 this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -910,11 +910,12 @@ roles: activeAuth.roles },
         return await this.dataService.fetchOne(notifyPath, id);
     }
 
-    private sendCollectionUpdate(clientId: string, subscriptionId: string, rows: Record<string, unknown>[]) {
+    private sendCollectionUpdate(clientId: string, subscriptionId: string, rows: Record<string, unknown>[], path: string) {
         const message: CollectionUpdateMessage = {
             type: "collection_update",
             subscriptionId,
-            rows: rows
+            rows: rows,
+            pks: this.primaryKeysForPath(path)
         };
         this.sendMessage(clientId, message);
     }
@@ -931,17 +932,45 @@ roles: activeAuth.roles },
     /**
      * Send a lightweight row-level patch to a collection subscriber.
      * The client can merge this into its cached data for instant feedback.
+     *
+     * The key columns ride along: the patch names a row by address, and the
+     * client has to find that row among the ones it cached — which carry
+     * columns and no address. The SDK holds no collection config to derive one
+     * from, so this is the only place the mapping can come from.
      */
-    private sendCollectionPatch(clientId: string, subscriptionId: string, id: string, row: Record<string, unknown> | null) {
+    private sendCollectionPatch(
+        clientId: string,
+        subscriptionId: string,
+        id: string,
+        row: Record<string, unknown> | null,
+        notifyPath: string
+    ) {
         const message: CollectionPatchMessage = {
             type: "collection_patch",
             subscriptionId,
             id,
-            row: row
+            row: row,
+            pks: this.primaryKeysForPath(notifyPath)
         };
         this.sendMessage(clientId, message);
     }
 
+    /** The key columns of the collection at `path`, if they can be resolved. */
+    private primaryKeysForPath(path: string): PrimaryKeyInfo[] | undefined {
+        try {
+            const collection = this.registry.getCollectionByPath(path);
+            if (!collection) return undefined;
+            const keys = getPrimaryKeys(collection, this.registry);
+            return keys.length > 0 ? keys : undefined;
+        } catch {
+            // `getCollectionByPath` throws on a path it cannot walk — and this
+            // is called for parent paths too, which include entity paths like
+            // `posts/1` that name no collection. Telling the subscriber nothing
+            // is right here; letting it throw would drop the notification.
+            return undefined;
+        }
+    }
+
     private sendError(clientId: string, error: string, subscriptionId?: string, code?: string) {
         const message = {
             type: "error" as const,
@@ -1294,17 +1323,9 @@ lastSeen: Date.now() });
 
     /** Compute the canonical (possibly composite) id string from a captured row. */
     private extractIdFromCdcRow(collection: CollectionConfig, row: Record<string, unknown>): string {
-        try {
-            const primaryKeys = getPrimaryKeys(collection, this.registry);
-            const composite = buildCompositeId(row, primaryKeys);
-            if (composite && composite !== ":::") return composite;
-        } catch {
-            /* fall through to id-field / wildcard */
-        }
-        // Fallbacks: a plain `id` column (common), else a collection-level
-        // invalidation ("*") — single-row subs won't match but collection subs refetch.
-        if (row.id !== undefined && row.id !== null) return String(row.id);
-        return "*";
+        // Unaddressable falls back to a collection-level invalidation: single-row
+        // subs won't match, but collection subs still refetch.
+        return deriveRowAddress(row, collection, this.registry) || "*";
     }
 
     // ── App/CDC de-duplication ──

package/src/services/row-pipeline.ts

@@ -0,0 +1,215 @@
+import { CollectionConfig, Property, Relation } from "@rebasepro/types";
+import { resolveCollectionRelations, findRelation, createRelationRefWithData } from "@rebasepro/common";
+import { normalizeDbValues } from "../data-transformer";
+import { deriveRowAddress } from "./collection-helpers";
+import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
+
+/**
+ * Turning a drizzle result into a row we serve.
+ *
+ * There are two shapes, and they are the same walk. Both take a row whose
+ * relation fields hold nested objects, both unwrap junction rows to reach the
+ * target behind them, and both leave every other column alone. They differ only
+ * in what they put where the relation was:
+ *
+ * - `"ref"` — a `{ id, path, __type: "relation" }` reference carrying the
+ *   target's values. This is what the admin renders.
+ * - `"inline"` — the target's own columns, flat. This is what REST serves.
+ *
+ * They used to be two functions that happened to agree, and the agreement was
+ * not enforced by anything: the row-identity bug had to be fixed five times
+ * across differently-shaped copies of this walk, and one of the copies was
+ * dead code nobody had noticed. Whatever the next cross-cutting change is, it
+ * is one edit here.
+ */
+export type RelationStyle = "ref" | "inline";
+
+/**
+ * Whether a many-relation reaches its target through a junction table.
+ *
+ * Also used to build the drizzle `with` config, which is why it is exported:
+ * the query has to nest one level deeper for a junction, and the row walk has
+ * to unwrap that same level back out.
+ */
+export function isJunctionRelation(relation: Relation): boolean {
+    // An explicit `through` says so outright.
+    if (relation.through) return true;
+    // A joinPath with an intermediate table is the same thing, spelled longhand.
+    if (relation.joinPath && relation.joinPath.length > 1) return true;
+    return false;
+}
+
+/**
+ * Reach the target row inside a junction row.
+ *
+ * A junction row looks like `{ post_id: 1, tag_id: { id: 5, name: "ts" } }` —
+ * the foreign keys, and the target nested under one of them. The target is the
+ * only object among them, so that is how it is found. A junction row that has
+ * not been nested (no `with` on the join) has no object and is returned as-is.
+ */
+function unwrapJunctionRow(item: Record<string, unknown>): Record<string, unknown> {
+    const nestedKey = Object.keys(item).find(
+        key => typeof item[key] === "object" && item[key] !== null && !Array.isArray(item[key])
+    );
+    return nestedKey ? item[nestedKey] as Record<string, unknown> : item;
+}
+
+/**
+ * Give back the number a `number` property was declared to be.
+ *
+ * Postgres returns NUMERIC as a string and drizzle keeps it that way, since a
+ * numeric can hold more precision than a double. But the collection declared
+ * this property `number` and the OpenAPI spec this server publishes says
+ * `type: number`, so serving `"9.99"` breaks its own contract — and breaks it
+ * asymmetrically, because a create answers with the number and the read that
+ * follows answers with the string. Any client that multiplies a price works
+ * until the first refresh.
+ *
+ * Declaring a property `number` already accepts double precision — that is what
+ * the admin has always parsed it to. Columns REST serves that no property
+ * declares are left exactly as the database returned them.
+ */
+function coerceDeclaredNumber(value: unknown, property: Property | undefined): unknown {
+    if (property?.type !== "number" || typeof value !== "string") return value;
+    const parsed = parseFloat(value);
+    return isNaN(parsed) ? null : parsed;
+}
+
+/** Apply {@link coerceDeclaredNumber} across a row, leaving every other column alone. */
+function coerceDeclaredNumbers(
+    row: Record<string, unknown>,
+    collection: CollectionConfig
+): Record<string, unknown> {
+    const properties = collection.properties;
+    if (!properties) return row;
+
+    const out: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(row)) {
+        out[key] = coerceDeclaredNumber(value, properties[key] as Property | undefined);
+    }
+    return out;
+}
+
+/** Render one target row in the requested style. */
+function renderTarget(
+    targetRow: Record<string, unknown>,
+    targetCollection: CollectionConfig,
+    style: RelationStyle,
+    registry: PostgresCollectionRegistry
+): unknown {
+    if (style === "inline") {
+        // The target's columns, and only those: its address is the consumer's
+        // to derive, and merging one in overwrites a real `id` column.
+        return coerceDeclaredNumbers({ ...targetRow }, targetCollection);
+    }
+
+    const address = relationTargetAddress(targetRow, targetCollection, registry);
+    const path = targetCollection.slug;
+    return createRelationRefWithData(address, path, {
+        id: address,
+        path,
+        values: normalizeDbValues(targetRow, targetCollection)
+    });
+}
+
+/**
+ * The address a relation ref points at.
+ *
+ * The whole key, not its first column: a composite-keyed target addressed by
+ * `tenant_id` alone points at every row that shares it. A target whose key
+ * cannot be resolved at all used to throw here — reading `[0]` of an empty
+ * array — taking down the parent's fetch over a relation it may not even have
+ * asked for. The first column is a guess, but a ref that resolves to nothing
+ * beats no rows at all.
+ */
+export function relationTargetAddress(
+    targetRow: Record<string, unknown>,
+    targetCollection: CollectionConfig,
+    registry: PostgresCollectionRegistry
+): string {
+    const address = deriveRowAddress(targetRow, targetCollection, registry);
+    if (address) return address;
+    return String(targetRow[Object.keys(targetRow)[0]] ?? "");
+}
+
+/**
+ * The row the admin renders: every column, with relations as references.
+ *
+ * Values are normalized (dates, numbers, NaN) because the admin's view-model
+ * expects real types. The row's own address is *not* among the columns — it is
+ * derived by the consumer from the collection's primary keys.
+ */
+export function toCmsRow(
+    row: Record<string, unknown>,
+    collection: CollectionConfig,
+    registry: PostgresCollectionRegistry
+): Record<string, unknown> {
+    const resolvedRelations = resolveCollectionRelations(collection);
+    const normalized = normalizeDbValues(row, collection) as Record<string, unknown>;
+
+    // Keyed by relation, reading the drizzle relation name off the raw row: the
+    // relation's property key and the name drizzle nested it under are not
+    // always the same, and the value is written back under the property key.
+    for (const [key, relation] of Object.entries(resolvedRelations)) {
+        const relData = row[relation.relationName || key];
+        if (relData === undefined || relData === null) continue;
+
+        if (relation.cardinality === "many" && Array.isArray(relData)) {
+            const targetCollection = relation.target();
+            normalized[key] = relData.map((item: Record<string, unknown>) =>
+                renderTarget(
+                    isJunctionRelation(relation) ? unwrapJunctionRow(item) : item,
+                    targetCollection,
+                    "ref",
+                    registry
+                ));
+        } else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) {
+            normalized[key] = renderTarget(relData as Record<string, unknown>, relation.target(), "ref", registry);
+        }
+    }
+
+    return normalized;
+}
+
+/**
+ * The row REST serves: every column under its own name, with the value Postgres
+ * returned, and relations inlined as the target's columns.
+ *
+ * Values are the ones the database returned, except where that contradicts the
+ * declared type: a `number` property is served as a number (see
+ * {@link coerceDeclaredNumber}). Dates stay as the database returned them —
+ * JSON has its own opinions about dates that the admin's view-model does not
+ * share.
+ *
+ * Keyed by the row rather than by the relation list — a REST fetch only loads
+ * the relations `include` asked for, so the row is the authority on which are
+ * actually there.
+ */
+export function toRestRow(
+    row: Record<string, unknown>,
+    collection: CollectionConfig,
+    registry: PostgresCollectionRegistry
+): Record<string, unknown> {
+    const resolvedRelations = resolveCollectionRelations(collection);
+    const flat: Record<string, unknown> = {};
+
+    for (const [key, value] of Object.entries(row)) {
+        const relation = findRelation(resolvedRelations, key);
+
+        if (relation && Array.isArray(value)) {
+            flat[key] = value.map((item: Record<string, unknown>) =>
+                renderTarget(
+                    isJunctionRelation(relation) ? unwrapJunctionRow(item) : item,
+                    relation.target(),
+                    "inline",
+                    registry
+                ));
+        } else if (relation && typeof value === "object" && value !== null) {
+            flat[key] = renderTarget(value as Record<string, unknown>, relation.target(), "inline", registry);
+        } else {
+            flat[key] = coerceDeclaredNumber(value, collection.properties?.[key] as Property | undefined);
+        }
+    }
+
+    return flat;
+}

package/src/utils/drizzle-conditions.ts

@@ -1126,6 +1126,19 @@ export class DrizzleConditionBuilder {
             throw new Error(`Vector column '${vectorSearch.property}' not found in table`);
         }
 
+        // The vector is interpolated as a raw SQL literal below (pgvector has no
+        // bind form for the `::vector` cast), so every element must be a finite
+        // number. The REST query parser already enforces this, but this builder
+        // is a shared entry point — validate here too so no future caller can
+        // turn an unchecked value into SQL injection.
+        if (
+            !Array.isArray(vectorSearch.vector) ||
+            vectorSearch.vector.length === 0 ||
+            !vectorSearch.vector.every((n) => typeof n === "number" && Number.isFinite(n))
+        ) {
+            throw new Error("Vector search requires a non-empty array of finite numbers");
+        }
+
         const vectorLiteral = `'[${vectorSearch.vector.join(",")}]'::vector`;
         const distanceFn = vectorSearch.distance || "cosine";
 

package/src/websocket.ts

@@ -620,9 +620,12 @@ roles: ["anon"] };
                 if (error instanceof Error) {
                     logger.error("Stack trace", { detail: error.stack });
                 }
+                // Unwrap the cause chain: a Drizzle failure reports itself as
+                // "Failed query: <sql> params:", which tells the user nothing and
+                // echoes the statement back at them. The reason is in the cause.
                 const errorMessage = process.env.NODE_ENV === "production"
                     ? "An unexpected error occurred"
-                    : (error instanceof Error ? error.message : "An unexpected error occurred");
+                    : extractErrorMessage(error);
                 const errorResponse = {
                     type: "ERROR",
                     requestId,

package/dist/schema/auth-default-policies.d.ts

@@ -1,10 +0,0 @@
-import { CollectionConfig, SecurityRule } from "@rebasepro/types";
-/**
- * Returns the security rules that should be applied to a collection: the
- * author's explicit `securityRules` plus the framework defaults described in
- * the module doc (baseline server/admin read for all collections; self-read
- * and the admin write gate for auth collections).
- *
- * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
- */
-export declare function getEffectiveSecurityRules(collection: CollectionConfig): SecurityRule[];