@edge-base/server 0.3.1 → 0.3.3

package/src/lib/postgres-handler.ts

@@ -65,8 +65,10 @@ function postgresInvalidJsonMessage(context: string, tableName: string): string
   return `Invalid JSON body for ${context} on table '${tableName}'. Send application/json with the expected fields.`;
 }
 
-function postgresRuleRejectedMessage(tableName: string, action: 'insert' | 'update' | 'delete'): string {
-  return `Access denied by access rules for ${action} on table '${tableName}'.`;
+function postgresRuleRejectedMessage(tableName: string, action: 'read' | 'insert' | 'update' | 'delete'): string {
+  // Wording kept in lockstep with the D1 handler's d1RuleRejectedMessage so the
+  // two SQL-dialect providers surface identical 403 messages.
+  return `Access denied. The '${action}' access rule for table '${tableName}' rejected this request.`;
 }
 
 function postgresValidationMessage(context: string, tableName: string): string {
@@ -91,6 +93,35 @@ export async function handlePgRequest(
   doPath: string,
 ): Promise<Response> {
   const resolved = resolvePgConnection(c.env, namespace);
+
+  // Multi-table transact has no table path segment — handle before table
+  // validation. Requires a session-scoped connection for BEGIN/COMMIT, which
+  // the local dev sidecar (independent statement calls) cannot provide.
+  if (doPath === '/transact' && c.req.raw.method === 'POST') {
+    const transactLocalDev = getLocalDevPostgresExecOptions(
+      c.env as unknown as Record<string, unknown>,
+      namespace,
+    );
+    if (transactLocalDev) {
+      return c.json({
+        code: 501,
+        message:
+          'transact is not supported through the local dev PostgreSQL sidecar: '
+          + 'statements execute on independent connections, so BEGIN/COMMIT cannot span them.',
+      }, 501);
+    }
+    return withPostgresConnection(resolved.connectionString, async (query) => {
+      await ensurePgSchema(resolved.connectionString, namespace, resolved.dbBlock.tables ?? {}, query);
+      return handleTransact(
+        c,
+        resolved,
+        (c.get('auth') as AuthContext | null | undefined) ?? null,
+        checkServiceKey(c),
+        query,
+      );
+    });
+  }
+
   const tableConfig = resolved.dbBlock.tables?.[tableName];
   if (!tableConfig) {
     return c.json({ code: 404, message: `Table '${tableName}' not found in database '${namespace}'.` }, 404);
@@ -437,7 +468,9 @@ async function handleSearch(
   const queryOpts = parseQueryParams(Object.fromEntries(new URL(c.req.url).searchParams));
   const searchTerm = queryOpts.search || '';
   if (!searchTerm) {
-    return c.json({ code: 400, message: 'Search term is required (use ?search=)' }, 400);
+    // Missing/empty search term — return empty result (same as D1/DO handler;
+    // the ?search= query param is optional per openapi.json).
+    return c.json({ items: [] });
   }
 
   // Use FTS fields from config, or fallback to text columns from schema
@@ -557,7 +590,6 @@ async function handleInsert(
       code: 400,
       message: summarizeValidationErrors(validation.errors),
       data: toFieldErrorData(validation.errors),
-      errors: validation.errors,
     }, 400);
   }
 
@@ -685,7 +717,6 @@ async function handleUpdate(
       code: 400,
       message: postgresValidationMessage(`update record '${id}'`, tableName),
       data: toFieldErrorData(validation.errors),
-      errors: validation.errors,
     }, 400);
   }
 
@@ -723,7 +754,9 @@ async function handleUpdate(
   const { data } = preparePgUpdateData(body, tableConfig);
 
   if (Object.keys(data).length === 0) {
-    return c.json({ code: 400, message: 'No valid fields to update.' }, 400);
+    // Empty update body — return the existing record as-is (same as D1/DO
+    // handler); a no-op update is not an error per openapi.json.
+    return c.json(stripInternalPgFields(existingRow));
   }
 
   const { setClauses, params, nextParamIndex } = parseUpdateBody(
@@ -859,7 +892,7 @@ async function handleDelete(
     ),
   );
 
-  return c.json({ success: true, deleted: stripInternalPgFields(existingRow) });
+  return c.json({ deleted: true });
 }
 
 // ─── BATCH ───
@@ -874,6 +907,7 @@ async function handleBatch(
   query: PostgresExecutor,
 ): Promise<Response> {
   let body: {
+    /** DEPRECATED: legacy alias for `inserts` (pinned by src/__tests__/postgres-batch-compat.test.ts). */
     items?: Record<string, unknown>[];
     inserts?: Record<string, unknown>[];
     updates?: { id: string; data: Record<string, unknown> }[];
@@ -882,112 +916,545 @@ async function handleBatch(
   try {
     body = await c.req.json();
   } catch {
-    return c.json({ code: 400, message: postgresInvalidJsonMessage('batch insert', tableName) }, 400);
+    return c.json({ code: 400, message: postgresInvalidJsonMessage('batch operations', tableName) }, 400);
   }
 
+  // DEPRECATED: the `items` request alias (for `inserts`) and the `items`
+  // response echo are kept for backwards compatibility with early PG-only
+  // clients. New clients should send the D1/DO-aligned
+  // { inserts, updates, deletes } shape.
+  const hasInserts = Array.isArray(body.inserts) || Array.isArray(body.items);
   const inserts = Array.isArray(body.inserts)
     ? body.inserts
     : Array.isArray(body.items)
       ? body.items
       : [];
-  const updates = Array.isArray(body.updates) ? body.updates : [];
-  const deletes = Array.isArray(body.deletes) ? body.deletes : [];
+  const hasUpdates = Array.isArray(body.updates);
+  const updates = hasUpdates ? body.updates! : [];
+  const hasDeletes = Array.isArray(body.deletes);
+  const deletes = hasDeletes ? body.deletes! : [];
 
+  // Batch size limit: 500 total ops (D1/DO parity)
+  const MAX_BATCH_SIZE = 500;
   const totalOps = inserts.length + updates.length + deletes.length;
-  if (totalOps === 0) {
-    return c.json({ code: 400, message: 'items array is required and must not be empty' }, 400);
-  }
-
-  if (totalOps > 500) {
-    return c.json({ code: 400, message: 'Batch size cannot exceed 500 items.' }, 400);
+  if (totalOps > MAX_BATCH_SIZE) {
+    return c.json({ code: 400, message: `Batch limit exceeded: ${totalOps} operations (max ${MAX_BATCH_SIZE}).` }, 400);
   }
 
-  if (updates.length > 0 || deletes.length > 0) {
-    return c.json({
-      code: 400,
-      message: 'PostgreSQL batch currently supports inserts/upserts only. Use batch-by-filter for updates/deletes.',
-    }, 400);
-  }
-
-  // Check insert rule (table-level, once)
-  const tableAccess = getTableAccess(tableConfig);
-  if (!isServiceKey && inserts.length > 0 && tableAccess?.insert !== undefined) {
-    if (!(await evalInsertRule(tableAccess.insert, auth))) {
-      return c.json({ code: 403, message: postgresRuleRejectedMessage(tableName, 'insert') }, 403);
-    }
+  // Response keys mirror the request keys (D1/DO parity); {} → {} with 200.
+  const results: Record<string, unknown> = {};
+  if (hasInserts) {
+    results.inserted = [];
+    // DEPRECATED response echo: `items` mirrors `inserted` for legacy clients.
+    results.items = [];
   }
+  if (hasUpdates) results.updated = [];
+  if (hasDeletes) results.deleted = 0;
 
   const upsertMode = c.req.query('upsert') === 'true';
   const conflictTarget = c.req.query('conflictTarget') || 'id';
-  const results: Record<string, unknown>[] = [];
 
+  // ── Pre-validate ALL operations before executing any (D1 parity) ──
   for (const item of inserts) {
-    // Validate
     const validation = validateInsert(item, tableConfig.schema);
     if (!validation.valid) {
       return c.json({
         code: 400,
         message: postgresValidationMessage('batch insert', tableName),
         data: toFieldErrorData(validation.errors),
-        errors: validation.errors,
       }, 400);
     }
+  }
+  for (const entry of updates) {
+    if (!entry || typeof entry !== 'object' || typeof entry.id !== 'string' || !entry.id) {
+      return c.json({ code: 400, message: `Each batch update entry for table '${tableName}' must include an id.` }, 400);
+    }
+    if (!entry.data || typeof entry.data !== 'object') {
+      return c.json({ code: 400, message: `Each batch update entry for table '${tableName}' must include a data object.` }, 400);
+    }
+    const validation = validateUpdate(entry.data, tableConfig.schema);
+    if (!validation.valid) {
+      return c.json({
+        code: 400,
+        message: postgresValidationMessage('batch update', tableName),
+        data: toFieldErrorData(validation.errors),
+      }, 400);
+    }
+  }
+
+  // Check insert rule (table-level, once — D1/DO batch parity)
+  const tableAccess = getTableAccess(tableConfig);
+  if (!isServiceKey && inserts.length > 0 && tableAccess?.insert !== undefined) {
+    if (!(await evalInsertRule(tableAccess.insert, auth))) {
+      return c.json({ code: 403, message: postgresRuleRejectedMessage(tableName, 'insert') }, 403);
+    }
+  }
+
+  if (totalOps === 0) {
+    return c.json(results);
+  }
+
+  // Batch is documented as all-or-nothing, which requires BEGIN/COMMIT on a
+  // session-scoped connection. The local dev sidecar executes statements on
+  // independent connections, so it cannot honor that promise — reject like
+  // the /transact guard does.
+  const localDevBatch = getLocalDevPostgresExecOptions(
+    c.env as unknown as Record<string, unknown>,
+    resolved.namespace,
+  );
+  if (localDevBatch) {
+    return c.json({
+      code: 501,
+      message:
+        'batch is not supported through the local dev PostgreSQL sidecar: '
+        + 'statements execute on independent connections, so BEGIN/COMMIT cannot span them.',
+    }, 501);
+  }
+
+  const insertedRows: Record<string, unknown>[] = [];
+  const updatedRows: Record<string, unknown>[] = [];
+  const liveChanges: Array<{
+    type: 'added' | 'modified' | 'removed';
+    docId: string;
+    data: Record<string, unknown> | null;
+  }> = [];
+
+  // All-or-nothing: run every operation inside one transaction. Per-row
+  // update/delete rules are evaluated on rows pre-read inside the transaction
+  // (accepted parity with the DO reference — JS rules cannot run inside SQL).
+  await query('BEGIN');
+  try {
+    // ── Inserts (or upserts when ?upsert=true) ──
+    for (const item of inserts) {
+      const { data } = preparePgInsertData(item, tableConfig);
+
+      const columns = Object.keys(data);
+      const values = columns.map(col => data[col] ?? null);
+      const placeholders = values.map((_, i) => `$${i + 1}`).join(', ');
+      let sql = `INSERT INTO ${escapePgIdentifier(tableName)} (${columns.map(escapePgIdentifier).join(', ')}) VALUES (${placeholders})`;
+      if (upsertMode) {
+        const updateCols = columns.filter((col) => col !== 'id' && col !== 'createdAt' && col !== conflictTarget);
+        if (updateCols.length > 0) {
+          const updateSet = updateCols
+            .map((col) => `${escapePgIdentifier(col)} = EXCLUDED.${escapePgIdentifier(col)}`)
+            .join(', ');
+          sql += ` ON CONFLICT (${escapePgIdentifier(conflictTarget)}) DO UPDATE SET ${updateSet}`;
+        } else {
+          sql += ` ON CONFLICT (${escapePgIdentifier(conflictTarget)}) DO NOTHING`;
+        }
+      }
+      sql += ' RETURNING *';
+
+      const result = await query(sql, values);
+      if (result.rows.length > 0) {
+        const row = stripInternalPgFields(result.rows[0] as Record<string, unknown>);
+        insertedRows.push(row);
+        liveChanges.push({ type: 'added', docId: String(row.id ?? ''), data: row });
+      }
+    }
+
+    // ── Updates (per-row rule on the current row, read inside the transaction) ──
+    for (const entry of updates) {
+      if (!isServiceKey && tableAccess?.update !== undefined) {
+        const { sql: getSql, params: getParams } = buildGetQuery(tableName, entry.id, undefined, 'postgres');
+        const current = await query(getSql, getParams);
+        // Missing rows are no-ops (DO parity) — only evaluate rules on real rows.
+        if (
+          current.rows.length > 0
+          && !(await evalRowRule(tableAccess.update, auth, current.rows[0] as Record<string, unknown>))
+        ) {
+          throw new EdgeBaseError(403, postgresRuleRejectedMessage(tableName, 'update'));
+        }
+      }
+
+      const { data } = preparePgUpdateData(entry.data, tableConfig);
+      if (Object.keys(data).length === 0) {
+        // Nothing to set — echo the current row (D1 parity on empty set clauses).
+        const { sql: getSql, params: getParams } = buildGetQuery(tableName, entry.id, undefined, 'postgres');
+        const current = await query(getSql, getParams);
+        updatedRows.push(current.rows.length > 0
+          ? stripInternalPgFields(current.rows[0] as Record<string, unknown>)
+          : { id: entry.id, ...entry.data });
+        continue;
+      }
+
+      const { setClauses, params, nextParamIndex } = parseUpdateBody(
+        data,
+        ['id'],
+        { dialect: 'postgres', startIndex: 1 },
+      );
+      const sql = `UPDATE ${escapePgIdentifier(tableName)} SET ${setClauses.join(', ')} WHERE "id" = $${nextParamIndex} RETURNING *`;
+      const updated = await query(sql, [...params, entry.id]);
+      const row = updated.rows.length > 0
+        ? stripInternalPgFields(updated.rows[0] as Record<string, unknown>)
+        : { id: entry.id, ...entry.data };
+      updatedRows.push(row);
+      if (updated.rows.length > 0) {
+        liveChanges.push({ type: 'modified', docId: String(row.id ?? entry.id), data: row });
+      }
+    }
 
-    const { data } = preparePgInsertData(item, tableConfig);
-
-    const columns = Object.keys(data);
-    const values = columns.map(col => data[col] ?? null);
-    const placeholders = values.map((_, i) => `$${i + 1}`).join(', ');
-    let sql = `INSERT INTO ${escapePgIdentifier(tableName)} (${columns.map(escapePgIdentifier).join(', ')}) VALUES (${placeholders})`;
-    if (upsertMode) {
-      const updateCols = columns.filter((col) => col !== 'id' && col !== 'createdAt' && col !== conflictTarget);
-      if (updateCols.length > 0) {
-        const updateSet = updateCols
-          .map((col) => `${escapePgIdentifier(col)} = EXCLUDED.${escapePgIdentifier(col)}`)
-          .join(', ');
-        sql += ` ON CONFLICT (${escapePgIdentifier(conflictTarget)}) DO UPDATE SET ${updateSet}`;
-      } else {
-        sql += ` ON CONFLICT (${escapePgIdentifier(conflictTarget)}) DO NOTHING`;
+    // ── Deletes (per-row rule on the current row, read inside the transaction) ──
+    for (const id of deletes) {
+      if (!isServiceKey && tableAccess?.delete !== undefined) {
+        const { sql: getSql, params: getParams } = buildGetQuery(tableName, id, undefined, 'postgres');
+        const current = await query(getSql, getParams);
+        // Missing rows are no-ops (DO parity) — only evaluate rules on real rows.
+        if (
+          current.rows.length > 0
+          && !(await evalRowRule(tableAccess.delete, auth, current.rows[0] as Record<string, unknown>))
+        ) {
+          throw new EdgeBaseError(403, postgresRuleRejectedMessage(tableName, 'delete'));
+        }
+      }
+      const deleted = await query(
+        `DELETE FROM ${escapePgIdentifier(tableName)} WHERE "id" = $1 RETURNING "id"`,
+        [id],
+      );
+      if (deleted.rows.length > 0) {
+        liveChanges.push({ type: 'removed', docId: id, data: null });
       }
     }
-    sql += ' RETURNING *';
 
-    const result = await query(sql, values);
-    if (result.rows.length > 0) {
-      results.push(stripInternalPgFields(result.rows[0] as Record<string, unknown>));
+    await query('COMMIT');
+  } catch (error) {
+    try {
+      await query('ROLLBACK');
+    } catch {
+      // connection-level failure — the transaction dies with the session
     }
+    if (error instanceof EdgeBaseError) {
+      return c.json(error.toJSON(), error.status as 400);
+    }
+    throw error;
+  }
+
+  if (hasInserts) {
+    results.inserted = insertedRows;
+    // DEPRECATED response echo: `items` mirrors `inserted` for legacy clients
+    // (pinned by src/__tests__/postgres-batch-compat.test.ts).
+    results.items = insertedRows;
   }
+  if (hasUpdates) results.updated = updatedRows;
+  // D1 parity: `deleted` echoes the number of requested ids, not affected rows.
+  if (hasDeletes) results.deleted = deletes.length;
 
   // Emit batch database-live events
-  if (results.length > 0) {
-    const changes = results.map(r => ({
-      type: 'added' as const,
-      docId: String((r as Record<string, unknown>).id ?? ''),
-      data: r as Record<string, unknown>,
-    }));
+  if (liveChanges.length > 0) {
+    if (liveChanges.length >= 10) {
+      scheduleDbLive(
+        c.executionCtx,
+        emitDbLiveBatchEvent(c.env, resolved.namespace, tableName, liveChanges),
+        `emit batch ${resolved.namespace}.${tableName} (${liveChanges.length} changes)`,
+      );
+    } else {
+      scheduleDbLive(
+        c.executionCtx,
+        Promise.all(
+          liveChanges.map((ch) =>
+            emitDbLiveEvent(c.env, resolved.namespace, tableName, ch.type, ch.docId, ch.data),
+          ),
+        ).then(() => undefined),
+        `emit fan-out ${resolved.namespace}.${tableName} (${liveChanges.length} changes)`,
+      );
+    }
+  }
+
+  return c.json(results);
+}
+
+// ─── TRANSACT (multi-table atomic writes) ───
+
+interface PgTransactOp {
+  table?: unknown;
+  op?: unknown;
+  id?: unknown;
+  data?: unknown;
+  where?: unknown;
+  exists?: unknown;
+}
+
+/**
+ * Multi-table atomic writes on a single session-scoped connection via
+ * BEGIN/COMMIT. `expect` ops run real SELECTs inside the transaction, so
+ * assertions hold at commit time under PostgreSQL's isolation, and any
+ * failure rolls the whole batch back.
+ */
+async function handleTransact(
+  c: Context<HonoEnv>,
+  resolved: PgResolvedDb,
+  auth: AuthContext | null,
+  isServiceKey: boolean,
+  query: PostgresExecutor,
+): Promise<Response> {
+  let body: { operations?: PgTransactOp[] };
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ code: 400, message: postgresInvalidJsonMessage('transact operations', '(multi-table)') }, 400);
+  }
+  const operations = body.operations;
+  if (!Array.isArray(operations) || operations.length === 0) {
+    return c.json({ code: 400, message: 'transact requires a non-empty operations array.' }, 400);
+  }
+  const MAX_TRANSACT_OPS = 500;
+  if (operations.length > MAX_TRANSACT_OPS) {
+    return c.json({ code: 400, message: `Transact limit exceeded: ${operations.length} operations (max ${MAX_TRANSACT_OPS}).` }, 400);
+  }
+
+  const tables = resolved.dbBlock.tables ?? {};
+  const tableCtx = new Map<string, TableConfig>();
+  for (const op of operations) {
+    if (typeof op?.table !== 'string' || !op.table) {
+      return c.json({ code: 400, message: 'Each transact operation must name a table.' }, 400);
+    }
+    if (op.op !== 'insert' && op.op !== 'update' && op.op !== 'delete' && op.op !== 'expect') {
+      return c.json({ code: 400, message: `Unknown transact op '${String(op.op)}'. Expected insert | update | delete | expect.` }, 400);
+    }
+    if (op.op === 'insert' && (!op.data || typeof op.data !== 'object')) {
+      return c.json({ code: 400, message: 'transact insert requires a data object.' }, 400);
+    }
+    if (op.op === 'update' && (typeof op.id !== 'string' || !op.id || !op.data || typeof op.data !== 'object')) {
+      return c.json({ code: 400, message: 'transact update requires an id and a data object.' }, 400);
+    }
+    if (op.op === 'delete' && (typeof op.id !== 'string' || !op.id)) {
+      return c.json({ code: 400, message: 'transact delete requires an id.' }, 400);
+    }
+    if (op.op === 'expect') {
+      const hasId = typeof op.id === 'string' && op.id.length > 0;
+      const hasWhere = Array.isArray(op.where) && op.where.length > 0;
+      if (!hasId && !hasWhere) {
+        return c.json({ code: 400, message: 'transact expect requires an id and/or where conditions.' }, 400);
+      }
+      if (typeof op.exists !== 'boolean') {
+        return c.json({ code: 400, message: 'transact expect requires a boolean exists.' }, 400);
+      }
+    }
+    if (!tableCtx.has(op.table)) {
+      const tableConfig = tables[op.table];
+      if (!tableConfig) {
+        return c.json({ code: 400, message: `Table '${op.table}' not found in database '${resolved.namespace}'.` }, 400);
+      }
+      tableCtx.set(op.table, tableConfig);
+    }
+  }
+
+  // Table-level insert rules (matches batch semantics).
+  if (!isServiceKey) {
+    const checkedInsert = new Set<string>();
+    for (const op of operations) {
+      if (op.op !== 'insert' || checkedInsert.has(op.table as string)) continue;
+      checkedInsert.add(op.table as string);
+      const access = getTableAccess(tableCtx.get(op.table as string)!);
+      if (access?.insert !== undefined && !(await evalInsertRule(access.insert, auth))) {
+        return c.json({ code: 403, message: postgresRuleRejectedMessage(op.table as string, 'insert') }, 403);
+      }
+    }
+  }
+
+  const results: Record<string, unknown>[] = [];
+  const liveChanges: Array<{
+    table: string;
+    type: 'added' | 'modified' | 'removed';
+    docId: string;
+    data: Record<string, unknown> | null;
+  }> = [];
+
+  await query('BEGIN');
+  try {
+    for (const op of operations) {
+      const name = op.table as string;
+      const tableConfig = tableCtx.get(name)!;
+
+      if (op.op === 'expect') {
+        const clauses: string[] = [];
+        const params: unknown[] = [];
+        if (typeof op.id === 'string' && op.id) {
+          params.push(op.id);
+          clauses.push(`"id" = $${params.length}`);
+        }
+        for (const cond of (op.where as unknown[]) ?? []) {
+          if (!Array.isArray(cond) || cond.length !== 3) {
+            throw new EdgeBaseError(400, 'transact expect where entries must be [field, "==", value].');
+          }
+          const [field, cmp, value] = cond as [unknown, unknown, unknown];
+          if (typeof field !== 'string' || !field) {
+            throw new EdgeBaseError(400, 'transact expect where field must be a string.');
+          }
+          if (cmp !== '==') {
+            throw new EdgeBaseError(400, `transact expect only supports '==' conditions (got '${String(cmp)}').`);
+          }
+          if (value === null) {
+            clauses.push(`${escapePgIdentifier(field)} IS NULL`);
+            continue;
+          }
+          if (typeof value === 'object') {
+            throw new EdgeBaseError(400, 'transact expect cannot compare object values.');
+          }
+          params.push(value);
+          clauses.push(`${escapePgIdentifier(field)} = $${params.length}`);
+        }
+        const probe = await query(
+          `SELECT * FROM ${escapePgIdentifier(name)} WHERE ${clauses.join(' AND ')} LIMIT 1`,
+          params,
+        );
+        // Read rule guards expect probes so they cannot leak row existence.
+        if (!isServiceKey && probe.rows.length > 0) {
+          const access = getTableAccess(tableConfig);
+          if (
+            access?.read !== undefined
+            && !(await evalRowRule(access.read, auth, probe.rows[0] as Record<string, unknown>))
+          ) {
+            throw new EdgeBaseError(403, postgresRuleRejectedMessage(name, 'read'));
+          }
+        }
+        if (op.exists === true && probe.rows.length === 0) {
+          throw new EdgeBaseError(409, `Transaction expectation failed: expected a matching row in "${name}".`);
+        }
+        if (op.exists === false && probe.rows.length > 0) {
+          throw new EdgeBaseError(409, `Transaction expectation failed: expected no matching row in "${name}".`);
+        }
+        results.push({ expected: true });
+        continue;
+      }
+
+      if (op.op === 'insert') {
+        const item = op.data as Record<string, unknown>;
+        const validation = validateInsert(item, tableConfig.schema);
+        if (!validation.valid) {
+          throw new EdgeBaseError(
+            400,
+            postgresValidationMessage('transact insert', name),
+            toFieldErrorData(validation.errors) as never,
+          );
+        }
+        const { data } = preparePgInsertData(item, tableConfig);
+        const columns = Object.keys(data);
+        const values = columns.map((col) => data[col] ?? null);
+        const placeholders = values.map((_, i) => `$${i + 1}`).join(', ');
+        const sql = `INSERT INTO ${escapePgIdentifier(name)} (${columns.map(escapePgIdentifier).join(', ')}) VALUES (${placeholders}) RETURNING *`;
+        const inserted = await query(sql, values);
+        const row = inserted.rows.length > 0
+          ? stripInternalPgFields(inserted.rows[0] as Record<string, unknown>)
+          : { ...data };
+        results.push({ inserted: row });
+        liveChanges.push({ table: name, type: 'added', docId: String(row.id ?? ''), data: row });
+        continue;
+      }
+
+      if (op.op === 'update') {
+        const id = op.id as string;
+        const bodyData = op.data as Record<string, unknown>;
+        const validation = validateUpdate(bodyData, tableConfig.schema);
+        if (!validation.valid) {
+          throw new EdgeBaseError(
+            400,
+            postgresValidationMessage('transact update', name),
+            toFieldErrorData(validation.errors) as never,
+          );
+        }
+        // Per-row update rule on the current row, read inside the transaction.
+        if (!isServiceKey) {
+          const access = getTableAccess(tableConfig);
+          if (access?.update !== undefined) {
+            const { sql: getSql, params: getParams } = buildGetQuery(name, id, undefined, 'postgres');
+            const current = await query(getSql, getParams);
+            const row = current.rows.length > 0 ? (current.rows[0] as Record<string, unknown>) : {};
+            if (!(await evalRowRule(access.update, auth, row))) {
+              throw new EdgeBaseError(403, postgresRuleRejectedMessage(name, 'update'));
+            }
+          }
+        }
+        const { data } = preparePgUpdateData(bodyData, tableConfig);
+        if (Object.keys(data).length === 0) {
+          results.push({ updated: { id } });
+          continue;
+        }
+        const { setClauses, params, nextParamIndex } = parseUpdateBody(
+          data,
+          ['id'],
+          { dialect: 'postgres', startIndex: 1 },
+        );
+        const sql = `UPDATE ${escapePgIdentifier(name)} SET ${setClauses.join(', ')} WHERE "id" = $${nextParamIndex} RETURNING *`;
+        const updated = await query(sql, [...params, id]);
+        const row = updated.rows.length > 0
+          ? stripInternalPgFields(updated.rows[0] as Record<string, unknown>)
+          : { id, ...bodyData };
+        results.push({ updated: row });
+        if (updated.rows.length > 0) {
+          liveChanges.push({ table: name, type: 'modified', docId: id, data: row });
+        }
+        continue;
+      }
+
+      // delete
+      const id = op.id as string;
+      if (!isServiceKey) {
+        const access = getTableAccess(tableConfig);
+        if (access?.delete !== undefined) {
+          const { sql: getSql, params: getParams } = buildGetQuery(name, id, undefined, 'postgres');
+          const current = await query(getSql, getParams);
+          const row = current.rows.length > 0 ? (current.rows[0] as Record<string, unknown>) : {};
+          if (!(await evalRowRule(access.delete, auth, row))) {
+            throw new EdgeBaseError(403, postgresRuleRejectedMessage(name, 'delete'));
+          }
+        }
+      }
+      const deleted = await query(
+        `DELETE FROM ${escapePgIdentifier(name)} WHERE "id" = $1 RETURNING "id"`,
+        [id],
+      );
+      if (deleted.rows.length > 0) {
+        liveChanges.push({ table: name, type: 'removed', docId: id, data: null });
+      }
+      results.push({ deleted: true, id });
+    }
+    await query('COMMIT');
+  } catch (error) {
+    try {
+      await query('ROLLBACK');
+    } catch {
+      // connection-level failure — the transaction dies with the session
+    }
+    if (error instanceof EdgeBaseError) {
+      return c.json(error.toJSON(), error.status as 400);
+    }
+    throw error;
+  }
+
+  // Emit database-live events grouped per table (same thresholds as batch).
+  const changesByTable = new Map<string, typeof liveChanges>();
+  for (const change of liveChanges) {
+    const list = changesByTable.get(change.table) ?? [];
+    list.push(change);
+    changesByTable.set(change.table, list);
+  }
+  for (const [table, changes] of changesByTable) {
     if (changes.length >= 10) {
       scheduleDbLive(
         c.executionCtx,
-        emitDbLiveBatchEvent(c.env, resolved.namespace, tableName, changes),
-        `emit batch ${resolved.namespace}.${tableName} (${changes.length} changes)`,
+        emitDbLiveBatchEvent(
+          c.env,
+          resolved.namespace,
+          table,
+          changes.map(({ type, docId, data }) => ({ type, docId, data })),
+        ),
+        `emit transact batch ${resolved.namespace}.${table} (${changes.length} changes)`,
       );
     } else {
       scheduleDbLive(
         c.executionCtx,
         Promise.all(
           changes.map((ch) =>
-            emitDbLiveEvent(c.env, resolved.namespace, tableName, ch.type, ch.docId, ch.data),
+            emitDbLiveEvent(c.env, resolved.namespace, table, ch.type, ch.docId, ch.data),
           ),
         ).then(() => undefined),
-        `emit fan-out ${resolved.namespace}.${tableName} (${changes.length} changes)`,
+        `emit transact fan-out ${resolved.namespace}.${table} (${changes.length} changes)`,
       );
     }
   }
 
-  return c.json({
-    inserted: results,
-    items: results,
-  });
+  return c.json({ results });
 }
 
 // ─── BATCH BY FILTER ───
@@ -997,7 +1464,7 @@ async function handleBatchByFilter(
   resolved: PgResolvedDb,
   tableName: string,
   tableConfig: TableConfig,
-  _auth: AuthContext | null,
+  auth: AuthContext | null,
   isServiceKey: boolean,
   query: PostgresExecutor,
 ): Promise<Response> {
@@ -1026,12 +1493,24 @@ async function handleBatchByFilter(
     return c.json({ code: 400, message: "batch-by-filter with action 'update' requires 'update' data." }, 400);
   }
 
+  // Row-level access rules (DO parity, database-do.ts batch-by-filter):
+  // table-level pre-check with an empty row (sufficient for boolean/auth-only
+  // rules), then per-row function-rule filtering of the matched rows below.
+  // Service keys bypass rules, matching the single-record paths.
+  const tableAccess = getTableAccess(tableConfig);
+  const bfAction = body.action as 'delete' | 'update';
+  const bfRule = bfAction === 'delete' ? tableAccess?.delete : tableAccess?.update;
+  if (!isServiceKey && bfRule !== undefined) {
+    if (!(await evalRowRule(bfRule, auth, {}))) {
+      return c.json({ code: 403, message: postgresRuleRejectedMessage(tableName, bfAction) }, 403);
+    }
+  }
+
   const limit = Math.min(body.limit ?? 500, 500);
   const { sql: selectSql, params: selectParams } = buildListQuery(tableName, {
     filters: body.filter,
     orFilters: body.orFilter,
     pagination: { limit },
-    fields: ['id'],
   }, 'postgres');
   const selectResult = await query(selectSql, selectParams);
   const allRows = selectResult.rows;
@@ -1041,19 +1520,26 @@ async function handleBatchByFilter(
     return c.json({ processed: 0, succeeded: 0 });
   }
 
-  const ids = allRows.map((row) => String((row as Record<string, unknown>).id));
+  // Per-row rule evaluation: keep only rows the rule allows (DO parity).
+  let rows = allRows as Record<string, unknown>[];
+  if (!isServiceKey && typeof bfRule === 'function') {
+    const allowed: Record<string, unknown>[] = [];
+    for (const row of rows) {
+      if (await evalRowRule(bfRule, auth, row)) {
+        allowed.push(row);
+      }
+    }
+    if (allowed.length === 0) {
+      return c.json({ code: 403, message: postgresRuleRejectedMessage(tableName, bfAction) }, 403);
+    }
+    rows = allowed;
+  }
+
+  const ids = rows.map((row) => String(row.id));
   const idPlaceholders = ids.map((_, index) => `$${index + 1}`).join(', ');
   let succeeded = 0;
 
   if (body.action === 'delete') {
-    // Check delete rule at table level
-    const tableAccess = getTableAccess(tableConfig);
-    if (!isServiceKey && tableAccess?.delete !== undefined) {
-      if (typeof tableAccess.delete === 'boolean' && !tableAccess.delete) {
-        return c.json({ code: 403, message: postgresRuleRejectedMessage(tableName, 'delete') }, 403);
-      }
-    }
-
     const sql = `DELETE FROM ${escapePgIdentifier(tableName)} WHERE "id" IN (${idPlaceholders}) RETURNING *`;
     const result = await query(sql, ids);
     succeeded = result.rowCount;
@@ -1079,14 +1565,6 @@ async function handleBatchByFilter(
     return c.json({ code: 400, message: 'data is required for update action.' }, 400);
   }
 
-  // Check update rule at table level
-  const tableAccess = getTableAccess(tableConfig);
-  if (!isServiceKey && tableAccess?.update !== undefined) {
-    if (typeof tableAccess.update === 'boolean' && !tableAccess.update) {
-      return c.json({ code: 403, message: postgresRuleRejectedMessage(tableName, 'update') }, 403);
-    }
-  }
-
   const prepared = preparePgUpdateData(updateData, tableConfig).data;
   if (Object.keys(prepared).length === 0) {
     return c.json({ code: 400, message: 'No valid fields to update.' }, 400);