@rebasepro/server-postgres 0.9.1-canary.f2f61da → 0.9.1-canary.fd3754b

package/dist/schema/auth-default-policies.d.ts

@@ -0,0 +1,10 @@
+import { CollectionConfig, SecurityRule } from "@rebasepro/types";
+/**
+ * Returns the security rules that should be applied to a collection: the
+ * author's explicit `securityRules` plus the framework defaults described in
+ * the module doc (baseline server/admin read for all collections; self-read
+ * and the admin write gate for auth collections).
+ *
+ * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+ */
+export declare function getEffectiveSecurityRules(collection: CollectionConfig): SecurityRule[];

package/dist/schema/doctor.d.ts

@@ -2,7 +2,7 @@ import { CollectionConfig, Property } from "@rebasepro/types";
 export type IssueSeverity = "error" | "warning" | "info";
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale";
     table?: string;
     column?: string;
     expected?: string;

package/dist/security/policy-drift.d.ts

@@ -22,10 +22,6 @@ export interface PolicyRef {
     roles: string[];
     /** SELECT / INSERT / UPDATE / DELETE / ALL. */
     command: string;
-    /** Whether a USING clause is present at all (not what it says). */
-    hasUsing: boolean;
-    /** Whether a WITH CHECK clause is present at all (not what it says). */
-    hasWithCheck: boolean;
 }
 export interface PolicyDrift {
     /** Described by the collections, absent from the database. */
@@ -49,18 +45,11 @@ export declare function parseExpectedPolicies(ddl: string): PolicyRef[];
 /**
  * Diff expected against live.
  *
- * Compares names, roles, command, and whether each clause exists — all exact
- * values. Policy expression *text* is deliberately not compared: Postgres
- * rewrites `qual`/`with_check` when storing them (parenthesising, casting,
- * schema-qualifying), so text comparison reports drift that does not exist, and
- * a check that cries wolf gets ignored.
- *
- * Presence is not text, though. A NULL `qual` is not a rewrite of an
- * expression, it is the absence of one, and absence has no false-positive risk:
- * either the generator emitted a clause or it did not. That distinction is worth
- * the extra comparison — a production database was found with a SELECT policy
- * whose `qual` was NULL, matching on every field this checked and denying 100%
- * of reads. The same blindness would hide a policy that fails open.
+ * Compares names, roles and command only — all exact values. Policy
+ * *expressions* are deliberately not compared: Postgres rewrites `qual`/
+ * `with_check` when storing them (parenthesising, casting, schema-qualifying),
+ * so text comparison reports drift that does not exist, and a check that cries
+ * wolf gets ignored. Roles alone catch the failure this exists for.
  */
 export declare function checkPolicyDrift(client: Queryable, collections: CollectionConfig[]): Promise<PolicyDrift>;
 export declare const hasDrift: (d: PolicyDrift) => boolean;

package/dist/security/rls-enforcement.d.ts

@@ -1,5 +1,4 @@
 import { SQL } from "drizzle-orm";
-import { SecurityRule } from "@rebasepro/types";
 /**
  * Unified RLS enforcement — the "user context vs server context" model.
  *
@@ -95,34 +94,10 @@ export declare function ensureAppRole(run: RawSqlRunner, schemas: string[]): Pro
  * treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`
  * is `NULLIF(current_setting('app.user_id'), '')` — so an EMPTY user id would
  * be read as NULL and silently escalate a user request to server privileges.
- * Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,
- * rather than trusting every caller (e.g. realtime subscription auth) to do it.
- * That sentinel is exported from `@rebasepro/types` because it leaks into rule
- * semantics: it is why `auth.uid() IS NOT NULL` is true for anonymous requests.
+ * Coerce empty/blank ids to a sentinel here, at the single chokepoint, rather
+ * than trusting every caller (e.g. realtime subscription auth) to do it.
  */
 export declare function applyAuthContext(tx: SqlTx, auth: AuthContext, userRole?: string): Promise<void>;
-/**
- * Warn about rules that read as "signed-in users only" but admit anonymous
- * callers — `auth.uid() IS NOT NULL`, or a comparison against another
- * platform's magic user id such as `'anon'`.
- *
- * The sibling of {@link validatePolicyPgRoles}, for the more dangerous spelling
- * of the same habit. A foreign `pgRoles` value makes a policy unreachable and
- * the table reads empty — loud, and that guard throws. These do the opposite:
- * the rule compiles to a grant, and nothing looks wrong until the data is
- * already public.
- *
- * Warns rather than throws. Unlike an unreachable `pgRoles`, these rules are
- * serving traffic today: refusing to boot would take an app offline to report a
- * problem it already has, and on the read path it would take it offline
- * *because* its data was exposed. Rewriting the author's SQL is not an option
- * either — this is the escape hatch whose whole promise is that it means what it
- * says. So: say so, loudly, and leave the rule alone.
- */
-export declare function warnOnAnonymousGrants(collections: {
-    slug?: string;
-    securityRules?: readonly SecurityRule[];
-}[]): void;
 /**
  * Reject `pgRoles` that this server can never satisfy.
  *

package/dist/services/FetchService.d.ts

@@ -40,22 +40,44 @@ export declare class FetchService {
      * the target relation so actual row data is returned.
      */
     private buildWithConfig;
+    /**
+     * Detect if a many-to-many relation uses a junction table in the Drizzle schema.
+     */
+    private isJunctionRelation;
     /**
      * Get the Drizzle relation name on the junction table that points to the actual target row.
      * For example, for posts_tags junction, this returns "tag_id" (the relation pointing to tags).
      */
     private getJunctionTargetRelationName;
+    /**
+     * Convert a db.query result row (with nested relation objects) to a flat row.
+     * Handles:
+     * - Placing `id` at the top level as a string
+     * - Type normalization (dates, numbers, NaN) via normalizeDbValues
+     * - Converting nested relation objects to { id, path, __type: "relation" } for CMS
+     * - Flattening junction-table many-to-many results
+     */
+    private drizzleResultToRow;
     /**
      * Post-fetch joinPath relations for a single flat row.
      * joinPath relations cannot be expressed via Drizzle's `with` config,
      * so they must be loaded separately after the primary query.
      */
     private resolveJoinPathRelations;
+    /**
+     * Post-fetch joinPath relations for a batch of flat rows.
+     * Uses batch fetching to avoid N+1 queries for list views.
+     */
+    private resolveJoinPathRelationsBatch;
     /**
      * Resolves joinPath relations for raw REST rows and directly injects them.
      * Uses RelationService to query the database and maps results back to the flattened objects.
      */
     private resolveJoinPathRelationsBatchRest;
+    /**
+     * Convert a db.query result row to a flat REST-style object with populated relations.
+     */
+    private drizzleResultToRestRow;
     /**
      * Build db.query-compatible options from standard fetch options.
      * Handles filter, search, orderBy, limit, and cursor-based pagination.
@@ -86,10 +108,8 @@ export declare class FetchService {
     }): Promise<Record<string, unknown>[]>;
     /**
      * Fallback path used when db.query is unavailable.
-     *
-     * The primary path runs the results through `toCmsRow`, which maps
-     * relations from what drizzle already nested — no query per row. This one
-     * has no nesting to read, so it resolves relations itself, in batches.
+     * The primary path uses drizzleResultToRow which handles relation
+     * mapping without N+1 queries.
      *
      * Process raw database results into flat rows with relations.
      */

package/dist/services/PersistService.d.ts

@@ -12,24 +12,6 @@ export declare class PersistService {
     private relationService;
     private fetchService;
     constructor(db: DrizzleClient, registry: PostgresCollectionRegistry);
-    /**
-     * Explain a write that matched no rows.
-     *
-     * Row-level security filters UPDATE and DELETE through the policy's USING
-     * clause instead of raising: a denied write is reported by Postgres exactly
-     * like a successful one that happened to match nothing. Left unchecked, a
-     * caller cannot tell "denied" from "done" — the write returns 200/204 and
-     * the row is untouched.
-     *
-     * Re-reading the target over the *same* RLS-scoped handle separates the two
-     * cases. A visible row means the policy rejected the write (403); an
-     * invisible one means there is nothing there to write for this caller (404,
-     * matching what a GET would say). The re-read is bound by the caller's own
-     * policies, so it discloses nothing a plain read wouldn't.
-     *
-     * Only reached when zero rows matched, so the happy path pays nothing.
-     */
-    private explainZeroRowWrite;
     /**
      * Delete an row by ID
      */
@@ -40,16 +22,8 @@ export declare class PersistService {
     deleteAll(collectionPath: string, _databaseId?: string): Promise<void>;
     /**
      * Save an row (create or update)
-     *
-     * With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
-     * UPDATE against the primary key rather than a plain UPDATE. That is one
-     * statement, so it cannot lose a race the way a read-then-write can, and it
-     * does not care whether the row already exists — which is what a re-runnable
-     * import needs.
      */
-    save<M extends Record<string, unknown>>(collectionPath: string, values: Partial<M>, id?: string | number, databaseId?: string, options?: {
-        upsert?: boolean;
-    }): Promise<Record<string, unknown>>;
+    save<M extends Record<string, unknown>>(collectionPath: string, values: Partial<M>, id?: string | number, databaseId?: string): Promise<Record<string, unknown>>;
     /**
      * Get the RelationService instance for external use
      */

package/dist/services/RelationService.d.ts

@@ -20,40 +20,6 @@ export declare class RelationService {
     private db;
     private registry;
     constructor(db: DrizzleClient, registry: PostgresCollectionRegistry);
-    /**
-     * One target row, as the {@link RelatedRow} everything here returns.
-     *
-     * Eight sites built this by hand, which is how the address came to be the
-     * target's first key column in all eight — one edit, eight places to miss.
-     *
-     * `resolveNested` is the one thing they did not agree on, and the
-     * disagreement was invisible: the single-parent fetches pass `db` and
-     * `registry` to `parseDataFromServer`, so the target's *own* relations get
-     * resolved too, while the batch paths deliberately do not — a query per
-     * target row is the N+1 the batching exists to avoid. Naming the parameter
-     * makes that a decision rather than a difference between two call sites
-     * nobody was comparing.
-     */
-    private toRelatedRow;
-    /**
-     * A WHERE matching any of `parentIds`, by the whole key.
-     *
-     * A single key is an `IN (…)`. A composite one cannot be: matching
-     * `tenant_id IN (1, 1)` collects every row of tenant 1, so two parents that
-     * share their first column each receive the other's relations. It becomes
-     * an OR of ANDs — one exact address per parent — which Postgres indexes the
-     * same way it would a multi-column key lookup.
-     */
-    private parentKeyCondition;
-    /**
-     * Reject a relation that cannot express a composite-keyed parent.
-     *
-     * `localKey` and `foreignKeyOnTarget` are single column names: one column
-     * cannot reference a two-column key, so such a relation has no correct
-     * reading. Left alone it would silently match on the first key column and
-     * hand a tenant's rows to its neighbour — say so instead.
-     */
-    private assertSingleKeyAddressable;
     /**
      * Fetch rows related to a parent row through a specific relation
      */
@@ -106,6 +72,7 @@ export declare class RelationService {
         relationKey: string;
         relation: Relation;
         newValue: unknown;
+        currentId?: string | number;
     }>): Promise<void>;
     /**
      * Handle inverse relations with joinPath

package/dist/services/collection-helpers.d.ts

@@ -1,9 +1,6 @@
 import { PgTable, AnyPgColumn } from "drizzle-orm/pg-core";
 import { CollectionConfig } from "@rebasepro/types";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
-export { buildCompositeId, parseIdValues, COMPOSITE_ID_SEPARATOR } from "@rebasepro/common";
-export type { PrimaryKeyInfo } from "@rebasepro/common";
-import type { PrimaryKeyInfo } from "@rebasepro/common";
 /**
  * Shared helper functions for row operations.
  * These are used by FetchService, PersistService, and RelationService.
@@ -24,80 +21,18 @@ export interface DrizzleColumnMeta {
 export declare function getColumnMeta(col: AnyPgColumn): DrizzleColumnMeta;
 export declare function getCollectionByPath(collectionPath: string, registry: PostgresCollectionRegistry): CollectionConfig;
 export declare function getTableForCollection(collection: CollectionConfig, registry: PostgresCollectionRegistry): PgTable<any>;
-/**
- * The key columns a collection's rows are addressed by.
- *
- * Three tiers, in order: properties marked `isId`, the primary keys of the
- * drizzle schema, and finally a column literally named `id`. Only the first is
- * visible to the browser, which is why a key known only to drizzle is reported
- * at boot — see {@link warnOnKeysTheAdminCannotResolve}.
- *
- * Returns `[]` when nothing resolves, rather than throwing. It used to open by
- * resolving the table, which throws when there is none — so the `isId` tier,
- * which needs no table at all, was unreachable for exactly the collections
- * most likely to have no table registered. Every caller that wanted "no keys"
- * to mean "no keys" had to spell that out in a try/catch.
- *
- * Callers that cannot proceed without a key must say so themselves, naming the
- * collection: an empty array here means "this collection has no address", which
- * is a different answer in a notification (broadcast a wildcard) than in a save
- * (fail).
- */
-export declare function getPrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): PrimaryKeyInfo[];
-/**
- * The key columns, for callers that cannot do their job without one.
- *
- * {@link getPrimaryKeys} answers "what keys, if any" and returns `[]` for a
- * collection with no address. Most of this driver, though, is building a WHERE
- * clause and has no meaning without a key — for those, an empty array is not an
- * answer, and indexing `[0]` into it produces `Cannot read properties of
- * undefined` three frames from where the real problem is. This says what is
- * wrong and which collection it is wrong about.
- */
-export declare function requirePrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): PrimaryKeyInfo[];
-/**
- * Collections whose key the *browser* cannot resolve, and what it will do
- * instead.
- *
- * The two sides resolve keys from different evidence. This driver reads, in
- * order: properties marked `isId`, the primary keys of the Drizzle schema, then
- * a column literally named `id`. The admin shares the `CollectionConfig` — it
- * compiles the same collection files into its bundle — but never the Drizzle
- * schema, so the middle tier is invisible to it.
- *
- * Nothing can normalize this at runtime: the server does not serve the admin
- * its collections, so a key resolved here cannot be handed over there. The
- * config files are the only thing both sides read, so the fix is an edit to
- * them, and the most this can do is say exactly which edit.
- *
- * Two shapes, and the second is the dangerous one:
- *
- * - No `isId`, no `id` property → the admin resolves no address, warns in the
- *   console, and rows cannot be opened or linked.
- * - No `isId`, but an `id` property that is *not* the key → the admin addresses
- *   rows by `id` while this driver reads the address as the real key. Nothing
- *   errors: the addresses look right and route wrong.
- */
-export declare function findUnresolvableKeyCollections(collections: CollectionConfig[], registry: PostgresCollectionRegistry): {
-    collection: CollectionConfig;
-    keys: PrimaryKeyInfo[];
-    shadowedByIdProperty: boolean;
+export declare function getPrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): {
+    fieldName: string;
+    type: "string" | "number";
+    isUUID?: boolean;
 }[];
-/**
- * Report the collections from {@link findUnresolvableKeyCollections} at boot,
- * with the edit that fixes each one.
- *
- * Grouped by failure, not by collection: the shadowed case is a routing bug and
- * the silent case is a missing feature, and they deserve different urgency.
- */
-export declare function warnOnKeysTheAdminCannotResolve(collections: CollectionConfig[], registry: PostgresCollectionRegistry): void;
-/**
- * The address of a row: derived from the collection's primary keys, because a
- * row does not carry one — it is exactly its columns.
- *
- * Falls back to a literal `id` column, for a row that reached us from somewhere
- * other than this driver. Returns `""` when there is no key and no `id` —
- * callers decide what that means, since "unaddressable" is a different answer
- * in a notification (broadcast a wildcard) than in a save (fail).
- */
-export declare function deriveRowAddress(row: Record<string, unknown>, collection: CollectionConfig, registry: PostgresCollectionRegistry): string;
+export declare function parseIdValues(idValue: string | number, primaryKeys: {
+    fieldName: string;
+    type: "string" | "number";
+    isUUID?: boolean;
+}[]): Record<string, string | number>;
+export declare function buildCompositeId(values: Record<string, unknown>, primaryKeys: {
+    fieldName: string;
+    type: "string" | "number";
+    isUUID?: boolean;
+}[]): string;

package/dist/services/dataService.d.ts

@@ -82,9 +82,7 @@ export declare class DataService implements DataRepository {
     /**
      * Save an row (create or update)
      */
-    save<M extends Record<string, unknown>>(collectionPath: string, values: Partial<M>, id?: string | number, databaseId?: string, options?: {
-        upsert?: boolean;
-    }): Promise<Record<string, unknown>>;
+    save<M extends Record<string, unknown>>(collectionPath: string, values: Partial<M>, id?: string | number, databaseId?: string): Promise<Record<string, unknown>>;
     /**
      * Delete an row by ID
      */

package/dist/services/index.d.ts

@@ -1,4 +1,4 @@
 export { FetchService } from "./FetchService";
 export { PersistService } from "./PersistService";
 export { RelationService } from "./RelationService";
-export { getCollectionByPath, getTableForCollection, getPrimaryKeys, deriveRowAddress, parseIdValues, buildCompositeId } from "./collection-helpers";
+export { getCollectionByPath, getTableForCollection, getPrimaryKeys, parseIdValues, buildCompositeId } from "./collection-helpers";

package/dist/services/realtimeService.d.ts

@@ -177,15 +177,8 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
     /**
      * Send a lightweight row-level patch to a collection subscriber.
      * The client can merge this into its cached data for instant feedback.
-     *
-     * The key columns ride along: the patch names a row by address, and the
-     * client has to find that row among the ones it cached — which carry
-     * columns and no address. The SDK holds no collection config to derive one
-     * from, so this is the only place the mapping can come from.
      */
     private sendCollectionPatch;
-    /** The key columns of the collection at `path`, if they can be resolved. */
-    private primaryKeysForPath;
     private sendError;
     private sendMessage;
     /**