@formancy/data-sqlserver 0.0.0-stage → 0.1.0

package/dist/index.mjs

@@ -0,0 +1,2797 @@
+import { canonicalFloat32, createSnapshot, decodeRowversion, deleteTerms, encodeRowversion, inSnapshotOrder, listTerms, lookupKeys, lookupPage, rejectedTokens, resolvedRows, rowFilterTerms, throughTerms } from "@formancy/data-core";
+import mssql from "mssql";
+import { createHash } from "node:crypto";
+//#region src/discovery/account.ts
+/**
+* Whose snapshot this is (0027).
+*
+* USER_NAME() is the database principal every permission and every security
+* predicate is evaluated for, and so the one the fingerprint carries.
+* ORIGINAL_LOGIN() is who connected, for a person reading the report: a login
+* mapped to a user of another name reports both (B13), and `sa` -- or any
+* member of sysadmin, or the database's owner -- is `dbo` in the database.
+* ORIGINAL_LOGIN rather than SUSER_SNAME, which an EXECUTE AS would change.
+*/
+const SQL$3 = "select user_name() as [user], original_login() as login";
+async function readAccount(pool) {
+	const row = (await pool.request().query(SQL$3)).recordset[0];
+	return {
+		user: row?.user ?? "",
+		login: row?.login ?? ""
+	};
+}
+//#endregion
+//#region src/discovery/catalog.ts
+/** The objects discovery describes, of sys.objects `o`: user tables and views. Shared with the root's definition (0041). */
+const DESCRIBED_OBJECT = `o.type in ('U', 'V') and o.is_ms_shipped = 0`;
+/**
+* Runs one catalog query over the tables and views in scope.
+*
+* Each schema is bound as its own parameter, `@schema0`, `@schema1`, and the
+* query text receives only those generated names: a schema name is a value
+* and never part of the statement, whatever it contains. A list of
+* parameters rather than one JSON or delimited parameter, because OPENJSON and
+* STRING_SPLIT need compatibility level 130 and a customer's database is often
+* older than its server.
+*
+* `scoped` is a subquery of the object_ids in scope: user tables and views
+* whose schema the database's own collation matches to a scope name. Matching
+* by the database's rules, not by exact spelling, because on a
+* case-insensitive database `SALES` IS `sales`, and reporting it absent would
+* be the silent answer.
+*/
+async function queryScope(pool, schemas, sql) {
+	const request = pool.request();
+	const schemaList = schemas.map((schema, index) => {
+		request.input(`schema${String(index)}`, mssql.NVarChar(mssql.MAX), schema);
+		return `@schema${String(index)}`;
+	}).join(", ");
+	const scoped = `(select o.object_id from sys.objects o join sys.schemas s on s.schema_id = o.schema_id
+    where ${DESCRIBED_OBJECT} and s.name in (${schemaList}))`;
+	return (await request.query(sql(scoped, schemaList))).recordset;
+}
+/** Rows grouped by a key, each group in the order the query returned it. */
+function groupBy(rows, key) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const group = groups.get(key(row));
+		if (group === void 0) groups.set(key(row), [row]);
+		else group.push(row);
+	}
+	return groups;
+}
+const byObjectId = (row) => row.object_id;
+//#endregion
+//#region src/discovery/checks.ts
+/**
+* Check constraints, with the expression as SQL Server stored it -- which is
+* not as it was written: `status in ('draft', 'placed', 'shipped')` comes back
+* as `([status]='shipped' OR [status]='placed' OR [status]='draft')`.
+*
+* `enforced` is not `is_disabled`: ALTER TABLE … NOCHECK CONSTRAINT stops the
+* check for new rows. `validated` is not `is_not_trusted`, which WITH NOCHECK
+* sets and which disabling sets too, so a disabled check is never validated;
+* a WITH NOCHECK one is enforced and not validated, and only `is_disabled`
+* tells the two apart (0026). `is_not_for_replication` is not read: it exempts
+* a replication agent's writes, which are not a form's.
+*/
+const SQL$2 = (scoped) => `
+  select cc.parent_object_id as object_id, cc.name, cc.definition, cc.is_disabled, cc.is_not_trusted
+  from sys.check_constraints cc
+  where cc.parent_object_id in ${scoped}`;
+async function readChecks(pool, schemas) {
+	const rows = await queryScope(pool, schemas, SQL$2);
+	const gaps = [];
+	const byObject = /* @__PURE__ */ new Map();
+	for (const [objectId, group] of groupBy(rows, byObjectId)) byObject.set(objectId, group.map((row) => {
+		if (row.definition === null) gaps.push({
+			objectId,
+			aspect: "checks",
+			detail: `${row.name}: the expression is hidden without VIEW DEFINITION`
+		});
+		return {
+			name: row.name,
+			expression: row.definition,
+			enforced: !row.is_disabled,
+			validated: !row.is_not_trusted
+		};
+	}));
+	return {
+		byObject,
+		gaps
+	};
+}
+//#endregion
+//#region src/discovery/access.ts
+/**
+* The object a column belongs to, as HAS_PERMS_BY_NAME must be given it:
+* QUOTENAME'd, schema and name each. The function PARSES the name, so a raw
+* `it's [odd]` answers NULL (measured, B7), and a name that parses as a
+* different object would answer for that one.
+*/
+const OBJECT = `quotename(object_schema_name(c.object_id)) + N'.' + quotename(object_name(c.object_id))`;
+/**
+* What the account may do with each column, as the server's own privilege
+* check answers it (0027): spliced into the columns query, so every column
+* the list holds has an answer -- never a column without one, which
+* `createSnapshot` would refuse as taken before 0027. That is all one read
+* buys. HAS_PERMS_BY_NAME looks the column up by name when it runs, and a
+* name that does not exist answers 0, not NULL: a concurrent rename can
+* therefore report a granted column as not granted (measured in review on
+* mssql/server:2022-latest, 2026-10-09: 4 wrong of 394 checks run against
+* 400 sp_rename round trips). That fails closed -- the
+* form leaves out or does not write a column it could have -- and drift
+* review sees the column's access come back at the next snapshot.
+*
+* SELECT and UPDATE are asked per column, because SQL Server grants and
+* denies both per column, and HAS_PERMS_BY_NAME applies the precedence the
+* server applies: a column DENY under a table GRANT is a no, a column GRANT
+* under a table DENY a yes, and a later table GRANT removes an earlier column
+* DENY (each measured against a real read, B8). INSERT is asked of the object:
+* the server refuses a column list on an INSERT grant or deny (1020), so every
+* column of an object the account may insert into is insertable.
+*
+* The column is QUOTENAME'd too. HAS_PERMS_BY_NAME parses the sub-securable
+* as an identifier: `group` happens to answer either way, `it's [odd]` raw is
+* NULL and quoted is the right answer (B7). A misparse is not always NULL --
+* a column that does not exist answers 0 -- so quoting is the defence, and
+* the NULL check below catches only the misparse that shows.
+*/
+const ACCESS_COLUMNS = `${OBJECT} as access_object,
+    has_perms_by_name(${OBJECT}, N'OBJECT', N'SELECT', quotename(c.name), N'COLUMN') as can_select,
+    has_perms_by_name(${OBJECT}, N'OBJECT', N'INSERT') as can_insert,
+    has_perms_by_name(${OBJECT}, N'OBJECT', N'UPDATE', quotename(c.name), N'COLUMN') as can_update`;
+function held(row, capability, answer) {
+	if (answer === null) throw new Error(`HAS_PERMS_BY_NAME could not resolve column ${row.name} of ${row.access_object ?? "(unnamed object)"} for ${capability.toUpperCase()}`);
+	return answer === 1;
+}
+/** One column's access from the row the columns query returned. */
+function toAccess(row) {
+	return {
+		select: held(row, "select", row.can_select),
+		insert: held(row, "insert", row.can_insert),
+		update: held(row, "update", row.can_update)
+	};
+}
+/**
+* Whether the account may DELETE from an object of sys.objects `o` in
+* schema `s`, as the server's own check answers it (0049), spliced into the
+* objects query so every object has an answer. QUOTENAME'd, schema and name
+* each, for the reason `OBJECT` above gives. Grants through a role count as
+* the server counts them, and a DENY wins over a GRANT as it does there.
+*
+* DELETE alone deletes nothing by a key: a WHERE or an OUTPUT that names a
+* column needs SELECT on it too, which the columns' access says. Measured on
+* mcr.microsoft.com/mssql/server:2022-latest (16.0.4295.3), 2026-10-11 (P1):
+* a user with DELETE and no SELECT runs `delete … where 1 = 0` and is refused
+* 229 for `where id = 1`; given SELECT on id, `where id = 1` and `output
+* deleted.id` run, and `output deleted.v` is refused 230. Over every table of
+* the fixture, as the owner, the reader and a writer granted DELETE on order
+* and order_line, each answer here was the one `delete … where 1 = 0` got
+* (`discovery-access.integration.test.ts`); a view that cannot be updated is
+* refused 4405 before any privilege is asked, so a view's answer is its
+* grant's.
+*/
+const OBJECT_ACCESS = `quotename(s.name) + N'.' + quotename(o.name) as access_object,
+    has_perms_by_name(quotename(s.name) + N'.' + quotename(o.name), N'OBJECT', N'DELETE') as can_delete`;
+/** An object's access from the row the objects query returned. A NULL is a name the check could not resolve: a defect, said, as for a column. */
+function toObjectAccess(row) {
+	if (row.can_delete === null) throw new Error(`HAS_PERMS_BY_NAME could not resolve ${row.access_object ?? "(unnamed object)"} for DELETE`);
+	return { delete: row.can_delete === 1 };
+}
+//#endregion
+//#region src/discovery/types.ts
+const UNSUPPORTED = { kind: "unsupported" };
+const length = (bytes, bytesPerUnit) => bytes === -1 ? null : bytes / bytesPerUnit;
+const integer = (min, max) => () => ({
+	kind: "integer",
+	min,
+	max
+});
+const decimal = (facts) => ({
+	kind: "decimal",
+	precision: facts.precision,
+	scale: facts.scale
+});
+const timestamp = (withTimeZone) => (facts) => ({
+	kind: "timestamp",
+	withTimeZone,
+	precision: facts.scale
+});
+/** The code page of every UTF-8 collation. */
+const UTF8_CODE_PAGE = 65001;
+/** char and varchar count bytes: of UTF-8 under a UTF-8 collation, of the code page under any other, and a NULL code page is the weaker claim. */
+const byteUnit = (facts) => facts.codePage === UTF8_CODE_PAGE ? "utf8-bytes" : "code-page-bytes";
+/** nchar and nvarchar count UTF-16 code units, two bytes each, under every collation, a UTF-8 one included. */
+const codeUnits = () => "utf16-code-units";
+const text = (unit, bytesPerUnit, fixedLength) => (facts) => ({
+	kind: "text",
+	maxLength: length(facts.maxLength, bytesPerUnit),
+	lengthUnit: unit(facts),
+	fixedLength
+});
+const binary = (fixedLength) => (facts) => ({
+	kind: "binary",
+	maxLength: length(facts.maxLength, 1),
+	fixedLength
+});
+/**
+* The system types this adapter has a normalised meaning for. Anything else --
+* xml, sql_variant, the CLR types, the deprecated text/ntext/image, a type a
+* later server adds -- is `unsupported`: reported, never dropped (0004).
+*
+* The lengths are the catalog's BYTES turned into the unit the type counts,
+* and the unit is said (0026): nchar and nvarchar store UTF-16 code units, two
+* bytes each, so nvarchar(200) is 400 in sys.columns and 200 here. char and
+* varchar count bytes -- of UTF-8 under a UTF-8 collation, where é is two,
+* and of the collation's code page under any other, which is one per
+* character on 1252 and one or two on 932.
+*
+* binary(n) is fixed: it pads a shorter value with zero bytes to n, so 0x01
+* written to binary(4) reads 0x01000000. varbinary keeps what it is given.
+*
+* Temporal precision is the catalog's scale for every temporal type, which is
+* the number of fractional-second digits the server writes. For datetime that
+* is 3 though it keeps 1/300 s, and for smalldatetime 0 though it keeps whole
+* minutes; the contract has no way to say either, and 0007 records the choice.
+*
+* A Map rather than an object, so that a CLR type somebody named `toString`
+* finds nothing here rather than Object.prototype.toString.
+*/
+const BY_SYSTEM_TYPE = /* @__PURE__ */ new Map([
+	["bit", () => ({ kind: "boolean" })],
+	["tinyint", integer("0", "255")],
+	["smallint", integer("-32768", "32767")],
+	["int", integer("-2147483648", "2147483647")],
+	["bigint", integer("-9223372036854775808", "9223372036854775807")],
+	["decimal", decimal],
+	["numeric", decimal],
+	["money", decimal],
+	["smallmoney", decimal],
+	["float", () => ({
+		kind: "float",
+		bits: 64
+	})],
+	["real", () => ({
+		kind: "float",
+		bits: 32
+	})],
+	["date", () => ({ kind: "date" })],
+	["time", (facts) => ({
+		kind: "time",
+		precision: facts.scale
+	})],
+	["datetime2", timestamp(false)],
+	["datetimeoffset", timestamp(true)],
+	["datetime", timestamp(false)],
+	["smalldatetime", timestamp(false)],
+	["char", text(byteUnit, 1, true)],
+	["varchar", text(byteUnit, 1, false)],
+	["nchar", text(codeUnits, 2, true)],
+	["nvarchar", text(codeUnits, 2, false)],
+	["uniqueidentifier", () => ({ kind: "uuid" })],
+	["binary", binary(true)],
+	["varbinary", binary(false)],
+	["timestamp", () => ({ kind: "rowversion" })]
+]);
+/** The suffix a system type is declared with, from the catalog's numbers. */
+function suffix(systemName, facts) {
+	switch (systemName) {
+		case "char":
+		case "varchar":
+		case "binary":
+		case "varbinary": return `(${facts.maxLength === -1 ? "max" : String(facts.maxLength)})`;
+		case "nchar":
+		case "nvarchar": return `(${facts.maxLength === -1 ? "max" : String(facts.maxLength / 2)})`;
+		case "decimal":
+		case "numeric": return `(${String(facts.precision)},${String(facts.scale)})`;
+		case "time":
+		case "datetime2":
+		case "datetimeoffset": return `(${String(facts.scale)})`;
+		default: return "";
+	}
+}
+/**
+* How a person would recognise the declared type: `nvarchar(200)`, an alias
+* type by its qualified name, `sysname` as itself, and `rowversion` rather
+* than the catalog's `timestamp`, which reads as a clock and is not one.
+*/
+function spell(facts, systemName) {
+	if (facts.typeName === null) return systemName === null ? "unknown" : systemName + suffix(systemName, facts);
+	if (facts.isUserDefined === true) return facts.typeSchema === null ? facts.typeName : `${facts.typeSchema}.${facts.typeName}`;
+	if (facts.typeName === "timestamp") return "rowversion";
+	if (facts.typeName !== systemName) return facts.typeName;
+	return facts.typeName + suffix(facts.typeName, facts);
+}
+/**
+* A column's type, normalised from what this account can see of it.
+*
+* The system type comes from the column's system_type_id, which is visible
+* even when the declared user-defined type is not: a type is a securable of
+* its own, and an account may read a table without any permission on the type
+* of one of its columns. Normalising from the declared type would lose that
+* column's meaning; joining to it would lose the column.
+*/
+function normalizeType(facts) {
+	const systemName = facts.systemName ?? facts.typeName;
+	const normalize = systemName === null ? void 0 : BY_SYSTEM_TYPE.get(systemName);
+	return {
+		databaseType: spell(facts, systemName),
+		type: normalize === void 0 ? UNSUPPORTED : normalize(facts),
+		hidden: facts.typeName === null
+	};
+}
+//#endregion
+//#region src/discovery/columns.ts
+/**
+* Columns, their types, how they are generated, their defaults and comments.
+*
+* Every join is a LEFT join, because each joined row is something this account
+* may not be allowed to see while it may see the column: the declared type
+* (a user-defined type is a securable of its own), the default's definition,
+* the comment. An inner join would drop the column, and a dropped column reads
+* as a table that never had it.
+*
+* A default is read through OBJECT_DEFINITION rather than
+* sys.default_constraints, because a default bound with the deprecated
+* sp_bindefault is a default too and is not a constraint. Both are NULL
+* without VIEW DEFINITION. Identity and computed come from sys.columns' own
+* flags: sys.identity_columns and sys.computed_columns add the seed, the
+* increment and the expression, none of which the contract carries.
+*
+* The code page is read from the column's own collation, never the
+* database's: a column may be declared under any collation, and the fixture's
+* UTF-8 varchar sits in a database whose default is code page 1252. It says
+* what a char or varchar length counts (0026).
+*
+* And what the account may do with each column, in the same statement
+* (access.ts, 0027).
+*/
+const SQL$1 = (scoped) => `
+  select ${COLUMN_DEFINITION},
+    object_name(c.default_object_id) as default_name,
+    cast(ep.value as nvarchar(max)) as comment,
+    ${ACCESS_COLUMNS}
+  from ${COLUMN_SOURCE}
+  left join sys.extended_properties ep
+    on ep.class = 1 and ep.major_id = c.object_id and ep.minor_id = c.column_id and ep.name = N'MS_Description'
+  where c.object_id in ${scoped}
+  order by c.object_id, c.column_id`;
+/**
+* What a column's definition is read from, of sys.columns `c`: its type, how
+* it is generated, its default. Shared with the root's definition (0041),
+* which reads exactly these, so a fact added here is the definition's too;
+* discovery adds the access, the comment and the default's name.
+*/
+const COLUMN_DEFINITION = `c.object_id, c.column_id, c.name,
+    t.name as type_name, schema_name(t.schema_id) as type_schema, t.is_user_defined,
+    st.name as system_name,
+    c.max_length, c.precision, c.scale,
+    convert(int, collationproperty(c.collation_name, 'CodePage')) as code_page,
+    c.is_nullable, c.is_identity, c.is_computed, c.generated_always_type,
+    c.default_object_id,
+    object_definition(c.default_object_id) as default_definition`;
+const COLUMN_SOURCE = `sys.columns c
+  left join sys.types t on t.user_type_id = c.user_type_id
+  left join sys.types st on st.user_type_id = c.system_type_id`;
+/** The name sys.types gives rowversion's system type: its deprecated synonym. */
+const ROWVERSION_SYSTEM_TYPE = "timestamp";
+/** One bracketed name as SQL Server stores it in a definition, a `]` inside it doubled. */
+const BRACKETED = String.raw`\[(?:[^\]]|\]\])+\]`;
+/**
+* A default that is exactly the next value of one sequence, as SQL Server
+* stores the definition: `(NEXT VALUE FOR [schema].[name])`, however it was
+* written. One that computes with the value has more around it.
+*/
+const NEXT_VALUE = new RegExp(String.raw`^\(NEXT VALUE FOR (?:${BRACKETED}\.){0,2}${BRACKETED}\)$`, "i");
+/**
+* How the column gets its value.
+*
+* IDENTITY is `identity-always`: an insert that names it is refused (544)
+* unless IDENTITY_INSERT is on, which needs ALTER on the table, and an update
+* of it is refused outright (8102). SQL Server has no BY DEFAULT identity; a
+* default of NEXT VALUE FOR a sequence is what takes its place, and behaves as
+* PostgreSQL's does: it numbers a row an insert leaves out, takes a value
+* given to it, and a value given by hand collides with the sequence later
+* (2627, measured). It is `identity-by-default`, and keeps its default (0026).
+* Its definition is read without VIEW DEFINITION only as NULL, and then the
+* column cannot be told from an ordinary default: it is `none`, and the
+* snapshot's `defaults` gap says the definition was hidden.
+*
+* A period column (GENERATED ALWAYS AS ROW START or END) is written by the
+* database and refused in an insert, which is what `computed` tells a form
+* generator; `none` would offer it as an input.
+*/
+function generation(row) {
+	if (row.is_identity) return "identity-always";
+	if (row.system_name === ROWVERSION_SYSTEM_TYPE) return "rowversion";
+	if (row.is_computed || row.generated_always_type !== 0) return "computed";
+	if (row.default_definition !== null && NEXT_VALUE.test(row.default_definition)) return "identity-by-default";
+	return "none";
+}
+/**
+* A column as its definition describes it, without access, comment or gaps:
+* what the root's description reports of it (0041), and what discovery
+* reports with those added.
+*/
+function describedColumn(row) {
+	const { databaseType, type } = typed(row);
+	return {
+		name: row.name,
+		ordinal: row.column_id,
+		databaseType,
+		type,
+		nullable: row.is_nullable,
+		hasDefault: row.default_object_id !== 0,
+		defaultExpression: row.default_definition,
+		generated: generation(row)
+	};
+}
+function typed(row) {
+	return normalizeType({
+		typeName: row.type_name,
+		typeSchema: row.type_schema,
+		isUserDefined: row.is_user_defined,
+		systemName: row.system_name,
+		maxLength: row.max_length,
+		precision: row.precision,
+		scale: row.scale,
+		codePage: row.code_page
+	});
+}
+function toColumn(row, gaps) {
+	const column = describedColumn(row);
+	if (typed(row).hidden) gaps.push({
+		objectId: row.object_id,
+		aspect: "columns",
+		detail: column.type.kind === "unsupported" ? `${row.name}: its type is hidden from this account, so it is reported as unsupported` : `${row.name}: its user-defined type is hidden from this account, so it is reported as its base type ${column.databaseType}`
+	});
+	if (column.hasDefault && row.default_definition === null) gaps.push({
+		objectId: row.object_id,
+		aspect: "defaults",
+		detail: `${row.name}: the definition of its default ${row.default_name ?? "(unnamed)"} is hidden without VIEW DEFINITION`
+	});
+	return {
+		...column,
+		comment: row.comment,
+		access: toAccess(row)
+	};
+}
+async function readColumns(pool, schemas) {
+	const rows = await queryScope(pool, schemas, SQL$1);
+	const gaps = [];
+	const byObject = /* @__PURE__ */ new Map();
+	for (const [objectId, group] of groupBy(rows, byObjectId)) byObject.set(objectId, group.map((row) => toColumn(row, gaps)));
+	return {
+		byObject,
+		gaps
+	};
+}
+//#endregion
+//#region src/discovery/foreign-keys.ts
+/**
+* Foreign keys, one row per column pair, in constraint_column_id order -- the
+* pairing of a composite key.
+*
+* The target is LEFT joined, because what SQL Server shows an account that
+* may read the referencing table and not the referenced one is precise and
+* partial: the key, its flags, its own columns, and a referenced_object_id
+* whose OBJECT_NAME is NULL and whose columns COL_NAME cannot name. An inner
+* join would drop the key -- "no relationship", the one wrong answer -- so the
+* key is reported with an unknown target and a gap says why.
+*/
+const FOREIGN_KEYS_SQL = (scoped) => `
+  select fk.parent_object_id as object_id, fk.object_id as key_id, fk.name, fk.is_disabled, fk.is_not_trusted,
+    fk.delete_referential_action, fk.update_referential_action,
+    rs.name as referenced_schema, ro.name as referenced_name,
+    pc.name as column_name, rc.name as referenced_column
+  from sys.foreign_keys fk
+  join sys.foreign_key_columns fkc on fkc.constraint_object_id = fk.object_id
+  join sys.columns pc on pc.object_id = fkc.parent_object_id and pc.column_id = fkc.parent_column_id
+  left join sys.objects ro on ro.object_id = fk.referenced_object_id
+  left join sys.schemas rs on rs.schema_id = ro.schema_id
+  left join sys.columns rc on rc.object_id = fkc.referenced_object_id and rc.column_id = fkc.referenced_column_id
+  where fk.parent_object_id in ${scoped}
+  order by fk.parent_object_id, fk.object_id, fkc.constraint_column_id`;
+/** sys.foreign_keys' *_referential_action codes. SQL Server has no RESTRICT. */
+const ACTIONS = [
+	"no-action",
+	"cascade",
+	"set-null",
+	"set-default"
+];
+function action(code, name) {
+	const found = ACTIONS[code];
+	if (found === void 0) throw new Error(`${name} has referential action ${String(code)}, which this adapter does not know`);
+	return found;
+}
+/**
+* The target, or `null` when any part of it is hidden: a schema and a name
+* and every paired column, or nothing. Half a target -- a table without its
+* columns -- would pair the key with the wrong columns downstream.
+*/
+function target(rows) {
+	const [first] = rows;
+	const columns = [];
+	for (const row of rows) {
+		if (row.referenced_column === null) return null;
+		columns.push(row.referenced_column);
+	}
+	if (first.referenced_schema === null || first.referenced_name === null) return null;
+	return {
+		table: {
+			schema: first.referenced_schema,
+			name: first.referenced_name
+		},
+		columns
+	};
+}
+function toForeignKey(rows, gaps) {
+	const [first] = rows;
+	const references = target(rows);
+	if (references === null) gaps.push({
+		objectId: first.object_id,
+		aspect: "foreign-keys",
+		detail: `${first.name} references a table this account cannot see: the key and its own columns are visible, the name of its target and of the target's columns are not`
+	});
+	return {
+		name: first.name,
+		columns: rows.map((row) => row.column_name),
+		references,
+		onUpdate: action(first.update_referential_action, first.name),
+		onDelete: action(first.delete_referential_action, first.name),
+		enforced: !first.is_disabled,
+		validated: !first.is_not_trusted
+	};
+}
+async function readForeignKeys(pool, schemas) {
+	const rows = await queryScope(pool, schemas, FOREIGN_KEYS_SQL);
+	const gaps = [];
+	const byObject = /* @__PURE__ */ new Map();
+	for (const [objectId, group] of groupBy(rows, byObjectId)) byObject.set(objectId, foreignKeysOf(group, gaps));
+	return {
+		byObject,
+		gaps
+	};
+}
+/** One object's foreign keys from its rows, in the query's order: discovery's, and the root's description's (0041), which keeps no gaps. */
+function foreignKeysOf(rows, gaps) {
+	return [...groupBy(rows, (row) => row.key_id).values()].map((keyRows) => toForeignKey(keyRows, gaps));
+}
+//#endregion
+//#region src/discovery/keys.ts
+/**
+* Primary keys and unique constraints, each in its key order.
+*
+* key_ordinal, never column_id: a composite key declared (tenant_id,
+* customer_no) over columns created the other way round pairs by the key's
+* order, and a foreign key into it pairs by the same. Ordered by numbers only,
+* so the database's collation never decides an order here.
+*
+* Unique constraints only, not unique indexes: a unique index may be filtered,
+* and a filtered index is not a key.
+*/
+const KEYS_SQL = (scoped) => `
+  select kc.parent_object_id as object_id, kc.object_id as key_id, kc.name,
+    cast(case kc.type when 'PK' then 1 else 0 end as bit) as is_primary_key,
+    c.name as column_name
+  from sys.key_constraints kc
+  join sys.index_columns ic on ic.object_id = kc.parent_object_id and ic.index_id = kc.unique_index_id
+  join sys.columns c on c.object_id = ic.object_id and c.column_id = ic.column_id
+  where kc.parent_object_id in ${scoped} and ic.key_ordinal > 0
+  order by kc.parent_object_id, kc.object_id, ic.key_ordinal`;
+/**
+* Each table's keys, by object_id. Keys of a table this account can see are
+* visible with it, so there is never a gap to report here.
+*/
+async function readKeys(pool, schemas) {
+	const rows = await queryScope(pool, schemas, KEYS_SQL);
+	const byObject = /* @__PURE__ */ new Map();
+	for (const [objectId, group] of groupBy(rows, byObjectId)) byObject.set(objectId, keysOf(group));
+	return byObject;
+}
+/** One object's keys from its rows, in the query's order: discovery's, and the root's description's (0041). */
+function keysOf(rows) {
+	const keys = {
+		primaryKey: null,
+		uniqueKeys: []
+	};
+	for (const keyRows of groupBy(rows, (row) => row.key_id).values()) {
+		const [first] = keyRows;
+		const key = {
+			name: first.name,
+			columns: keyRows.map((row) => row.column_name)
+		};
+		if (first.is_primary_key) keys.primaryKey = key;
+		else keys.uniqueKeys.push(key);
+	}
+	return keys;
+}
+//#endregion
+//#region src/discovery/objects.ts
+/**
+* The tables and views in scope, with their MS_Description and whether the
+* account may delete from each (access.ts, 0049).
+*
+* Only what this account holds some permission on: SQL Server filters
+* sys.objects without a word. Whether that filter can have hidden anything is
+* the schemas concern's question, not this one's.
+*
+* Comments are extended properties, and an account that can see the object
+* can see them: no gap is needed for comments, which was found by asking a
+* real server as a reader with SELECT only.
+*/
+/** An object's kind, of sys.objects `o`: discovery's mapping, and the root's definition's (0041). `o.type` is char(2), so 'V' is compared as 'V '. */
+const OBJECT_KIND = `case o.type when 'V' then 'view' else 'table' end`;
+const SQL = (scoped) => `
+  select o.object_id, s.name as schema_name, o.name as object_name,
+    ${OBJECT_KIND} as kind,
+    cast(ep.value as nvarchar(max)) as comment,
+    ${OBJECT_ACCESS}
+  from sys.objects o
+  join sys.schemas s on s.schema_id = o.schema_id
+  left join sys.extended_properties ep
+    on ep.class = 1 and ep.major_id = o.object_id and ep.minor_id = 0 and ep.name = N'MS_Description'
+  where o.object_id in ${scoped}`;
+/** Each object in scope, by object_id, with nothing attached yet. */
+async function readObjects(pool, schemas) {
+	const rows = await queryScope(pool, schemas, SQL);
+	return new Map(rows.map((row) => [row.object_id, {
+		ref: {
+			schema: row.schema_name,
+			name: row.object_name
+		},
+		kind: row.kind,
+		comment: row.comment,
+		columns: [],
+		primaryKey: null,
+		uniqueKeys: [],
+		foreignKeys: [],
+		checks: [],
+		access: toObjectAccess(row)
+	}]));
+}
+//#endregion
+//#region src/discovery/visibility.ts
+/**
+* Whether this account can see every object in each schema of the scope.
+*
+* SQL Server lists in sys.objects only the securables an account holds some
+* permission on, so a table the reader may not touch is simply not there.
+* VIEW DEFINITION on the schema is what lifts that filter -- on its own,
+* without any data access -- so a schema where the account lacks it gets a
+* gap: the object list may be short, and nothing in it says by how much.
+*
+* sys.schemas itself is not filtered: an account sees every schema, including
+* ones it holds nothing in. A scope name with no schema behind it is therefore
+* established as absent and needs no gap. The gap names the schema as the
+* catalog spells it, which on a case-insensitive database may not be how the
+* scope does: `SALES` finds `sales`, and the gap is about `sales` (0027).
+*
+* HAS_PERMS_BY_NAME parses the name it is given, so it gets QUOTENAME's
+* output: given `it's [odd]` raw it returns NULL, which would read as "may not
+* see" for a schema the account can see perfectly well.
+*/
+const SCHEMAS_SQL = (_scoped, schemaList) => `
+  select s.name, has_perms_by_name(quotename(s.name), 'SCHEMA', 'VIEW DEFINITION') as can_view_definitions
+  from sys.schemas s
+  where s.name in (${schemaList})`;
+/**
+* Who a DENY row binds: the account itself, or a role it is in -- which is how
+* a DBA usually denies, and a row that names the role.
+*/
+const BINDS_ME = `(p.grantee_principal_id = database_principal_id() or is_member(user_name(p.grantee_principal_id)) = 1)`;
+/**
+* Objects this account is denied VIEW DEFINITION on, which therefore vanish
+* from sys.objects even under a schema-level grant that HAS_PERMS_BY_NAME
+* still reports. The account can read its own DENY rows -- made to it or to a
+* role it is in -- but not the denied object's name or schema, so they are
+* counted rather than placed: any of them may be in scope. CONTROL is counted
+* too, because denying it denies everything it implies.
+*
+* A condition on `sys.database_permissions p`, exported, as `DENIED_SCHEMAS`
+* and `VIEWS_DATABASE` are, for the delete's guard (0050): the batch that
+* refuses a delete its account can no longer see every key of, and the
+* snapshot's `referenced-by` gap, read the one condition.
+*/
+const DENIED_OBJECTS = `p.class = 1 and p.state = 'D' and p.permission_name in ('VIEW DEFINITION', 'CONTROL')
+    and ${BINDS_ME}
+    and object_name(p.major_id) is null`;
+const DENIED_OBJECTS_SQL = `
+  select count(*) as hidden
+  from sys.database_permissions p
+  where ${DENIED_OBJECTS}`;
+/**
+* Schemas this account is denied VIEW DEFINITION or CONTROL on (class 3).
+* A schema in scope already answers for itself through HAS_PERMS_BY_NAME
+* above; this count is for row security, because a security policy lives in
+* a schema of its own and may filter a table in any other. Measured (B10f):
+* with VIEW DEFINITION on the database and a deny on the policy's schema, the
+* database check still says yes, the policy is not listed, and the object
+* count above is 0 -- so without this count, a policy that applies would read
+* as none.
+*
+* Only a deny the server applies is counted. A DENY binds no sysadmin and no
+* dbo, yet one made to `public` matches BINDS_ME for them through IS_MEMBER,
+* and the owner, who sees every policy, would be told it is denied a schema.
+* HAS_PERMS_BY_NAME applies the exemption and the deny's precedence, so a
+* schema whose definitions the account can still see is not counted.
+*/
+const DENIED_SCHEMAS = `p.class = 3 and p.state = 'D' and p.permission_name in ('VIEW DEFINITION', 'CONTROL')
+    and ${BINDS_ME}
+    and has_perms_by_name(quotename(schema_name(p.major_id)), N'SCHEMA', N'VIEW DEFINITION') = 0`;
+const DENIED_SCHEMAS_SQL = `
+  select count(*) as hidden
+  from sys.database_permissions p
+  where ${DENIED_SCHEMAS}`;
+/**
+* Whether the account may view every definition in the database, which is
+* what lists to it every object of every schema -- and so every security
+* policy, which lives in a schema of its own and filters a table in any
+* other (0027, B10b), and every foreign key, which is on a table in any
+* schema and refers to one in scope (0049, P2). VIEW SECURITY DEFINITION
+* shows no policy at all (B10d). The database is QUOTENAME'd:
+* HAS_PERMS_BY_NAME parses it, and in a database named `it's [odd] db` the
+* raw name answers NULL (B9).
+*/
+const VIEWS_DATABASE = `has_perms_by_name(quotename(db_name()), N'DATABASE', N'VIEW DEFINITION')`;
+const DATABASE_SQL = `select ${VIEWS_DATABASE} as can_view_definitions`;
+/**
+* Why this account may not see every definition in the database, or nothing
+* when it may: what row security (0027) and what refers to a table (0049)
+* are established by, because a security policy and a foreign key each live
+* on an object of any schema. Established takes VIEW DEFINITION on the
+* database and no VIEW DEFINITION or CONTROL deny on an object or a schema
+* binding the account -- a denied object, or an object in a denied schema,
+* is not listed even under the database grant (B10e, B10f; for a key, P2).
+* `lists` names what the database grant lists, for the sentence.
+*/
+function unseenDefinitions(visibility, lists) {
+	const reasons = [];
+	if (!visibility.canViewDatabase) reasons.push(`this account lacks VIEW DEFINITION on the database, which is what lists every ${lists}`);
+	if (visibility.denied.objects > 0) reasons.push(`this account is denied VIEW DEFINITION or CONTROL on ${String(visibility.denied.objects)} object(s)`);
+	if (visibility.denied.schemas > 0) reasons.push(`this account is denied VIEW DEFINITION or CONTROL on ${String(visibility.denied.schemas)} schema(s)`);
+	return reasons;
+}
+async function readObjectVisibility(pool, schemas) {
+	const [rows, deniedObjects, deniedSchemas, database] = await Promise.all([
+		queryScope(pool, schemas, SCHEMAS_SQL),
+		pool.request().query(DENIED_OBJECTS_SQL),
+		pool.request().query(DENIED_SCHEMAS_SQL),
+		pool.request().query(DATABASE_SQL)
+	]);
+	const gaps = rows.filter((row) => row.can_view_definitions !== 1).map((row) => ({
+		subject: {
+			kind: "schema",
+			schema: row.name
+		},
+		aspect: "objects",
+		detail: `without VIEW DEFINITION on schema ${row.name}, the catalog lists only the tables and views this account holds a permission on, so one it cannot see is absent without trace`
+	}));
+	const denied = {
+		objects: deniedObjects.recordset[0]?.hidden ?? 0,
+		schemas: deniedSchemas.recordset[0]?.hidden ?? 0
+	};
+	if (denied.objects > 0) gaps.push({
+		subject: { kind: "scope" },
+		aspect: "objects",
+		detail: `this account is denied VIEW DEFINITION on ${String(denied.objects)} object(s) it therefore cannot see, and the catalog does not say which schema they are in: any of them may be in scope`
+	});
+	return {
+		gaps,
+		denied,
+		canViewDatabase: database.recordset[0]?.can_view_definitions === 1
+	};
+}
+//#endregion
+//#region src/discovery/referenced-by.ts
+/**
+* Every foreign key the catalog shows that refers to a table in scope, from a
+* table in any schema, one row per column pair in constraint_column_id order
+* (0049). Joined, not LEFT joined: a key is listed to an account exactly when
+* it may see the table the key is on, and then it sees that table's columns,
+* and the referenced table is one in scope; what the account cannot see is
+* the whole key, which the gap below says.
+*/
+const INBOUND_SQL = (scoped) => `
+  select fk.referenced_object_id as object_id, fk.object_id as key_id, fk.name,
+    schema_name(po.schema_id) as referring_schema, po.name as referring_name,
+    fk.is_disabled, fk.delete_referential_action, fk.update_referential_action,
+    pc.name as column_name, rc.name as referenced_column
+  from sys.foreign_keys fk
+  join sys.objects po on po.object_id = fk.parent_object_id
+  join sys.foreign_key_columns fkc on fkc.constraint_object_id = fk.object_id
+  join sys.columns pc on pc.object_id = fkc.parent_object_id and pc.column_id = fkc.parent_column_id
+  join sys.columns rc on rc.object_id = fkc.referenced_object_id and rc.column_id = fkc.referenced_column_id
+  where fk.referenced_object_id in ${scoped}
+  order by fk.referenced_object_id, fk.object_id, fkc.constraint_column_id`;
+function toInbound(rows) {
+	const [first] = rows;
+	const actionOf = (code) => action(code, first.name);
+	return {
+		table: {
+			schema: first.referring_schema,
+			name: first.referring_name
+		},
+		name: first.name,
+		columns: rows.map((row) => row.column_name),
+		referencedColumns: rows.map((row) => row.referenced_column),
+		onDelete: actionOf(first.delete_referential_action),
+		onUpdate: actionOf(first.update_referential_action),
+		enforced: !first.is_disabled
+	};
+}
+/**
+* Every edge constraint that connects a node table in scope, from an edge
+* table in any schema: one row per constraint and node table, whichever end
+* of a clause the node is.
+*
+* An edge constraint is not a foreign key -- sys.foreign_keys does not list
+* it -- yet a delete of a node acts through it. Measured on 16.0.4295.3,
+* 2026-10-11 (`discovery.integration.test.ts`): ON DELETE CASCADE removes
+* the edges that connect the node, from either end, and NO ACTION refuses
+* the delete with 547 while one does. This release describes neither the
+* edge nor its constraint, so each is a `referenced-by` gap on the node.
+* sys.edge_constraints is filtered as sys.foreign_keys is: measured the same
+* day, a constraint on an edge table in another schema is listed under VIEW
+* DEFINITION on the database and not under VIEW DEFINITION on the node's
+* schema alone -- where `referencedByGaps` already gives its scope gap.
+*/
+const EDGES_SQL = (scoped) => `
+  select distinct n.object_id, ec.name, schema_name(e.schema_id) as edge_schema, e.name as edge_name,
+    ec.delete_referential_action_desc as delete_action
+  from sys.edge_constraints ec
+  join sys.edge_constraint_clauses cl on cl.object_id = ec.object_id
+  join sys.objects e on e.object_id = ec.parent_object_id
+  join sys.objects n on n.object_id in (cl.from_object_id, cl.to_object_id)
+  where n.object_id in ${scoped}`;
+function edgeGap(row) {
+	return {
+		objectId: row.object_id,
+		aspect: "referenced-by",
+		detail: `edge constraint ${row.name} of ${row.edge_schema}.${row.edge_name} connects this node table, ON DELETE ${row.delete_action}, so a delete of its rows acts on that table's edges or is refused by them; this release lists foreign keys, not edge constraints`
+	};
+}
+/**
+* Every key the catalog shows that refers to each table in scope, by the
+* referenced table's object_id, and a gap on each node table an edge
+* constraint connects.
+*/
+async function readReferencedBy(pool, schemas) {
+	const [rows, edges] = await Promise.all([queryScope(pool, schemas, INBOUND_SQL), queryScope(pool, schemas, EDGES_SQL)]);
+	const byObject = /* @__PURE__ */ new Map();
+	for (const [objectId, group] of groupBy(rows, byObjectId)) byObject.set(objectId, [...groupBy(group, (row) => row.key_id).values()].map(toInbound));
+	return {
+		byObject,
+		gaps: edges.map(edgeGap)
+	};
+}
+/**
+* The gap that says what refers to a table may be short, or none (0049).
+*
+* SQL Server lists a foreign key only to an account that may see the table
+* the key is on, and that table may be in any schema. Measured on
+* 16.0.4295.3, 2026-10-11 (P2), with a key from another schema onto
+* sales.order: the owner and a database VIEW DEFINITION grantee see it; a
+* grantee of VIEW DEFINITION on sales alone, the reader, and a database
+* grantee denied VIEW DEFINITION on the other schema or on its table do
+* not -- the reader sees not even fk_order_line_order. So the lists are
+* complete exactly where row security is established, by the one rule
+* `unseenDefinitions` holds, and otherwise ONE gap on the scope says why: a
+* key the account cannot see may refer to any table in scope. The gap is
+* there only when some object is described, as row security's is: it
+* explains an answer, and an account that sees nothing gave none.
+*/
+function referencedByGaps(described, visibility) {
+	const reasons = unseenDefinitions(visibility, "foreign key on a table in any schema");
+	if (reasons.length === 0 || described === 0) return [];
+	return [{
+		subject: { kind: "scope" },
+		aspect: "referenced-by",
+		detail: `${reasons.join("; ")}, so a key on a table it cannot see may refer to any table in scope`
+	}];
+}
+//#endregion
+//#region src/discovery/row-security.ts
+/**
+* The objects in scope an enabled security policy has a predicate on, filter
+* or block. Positive evidence, and it needs nothing more: a policy this
+* account can see that targets a table applies to it, because SQL Server
+* exempts nobody from an enabled policy -- dbo and sysadmin included. A
+* disabled policy filters nothing and is not counted.
+*/
+const POLICED_SQL = (scoped) => `
+  select distinct pr.target_object_id as object_id
+  from sys.security_predicates pr
+  join sys.security_policies p on p.object_id = pr.object_id
+  where p.is_enabled = 1 and pr.target_object_id in ${scoped}`;
+/** The object_ids in scope that an enabled policy this account can see targets. */
+async function readPolicies(pool, schemas) {
+	const policed = await queryScope(pool, schemas, POLICED_SQL);
+	return new Set(policed.map((row) => row.object_id));
+}
+/**
+* Each object's row security, and the gap that explains an `unknown` (0027).
+*
+* `applies` where a visible enabled policy targets the object. `none` only
+* where it is established that no policy is hidden, by the rule
+* `unseenDefinitions` holds: a denied policy, or a policy in a denied schema,
+* is not listed even under the database grant (B10e, B10f). Anything else is
+* `unknown`, with ONE gap on the scope: a hidden policy can filter any table,
+* so the doubt cannot be placed on an object. The gap is there only when some
+* object is unknown; it explains an answer, and an account that sees nothing
+* gave none.
+*/
+function rowSecurityOf(objectIds, policed, visibility) {
+	const reasons = unseenDefinitions(visibility, "security policy");
+	const established = reasons.length === 0;
+	const of = (objectId) => policed.has(objectId) ? "applies" : established ? "none" : "unknown";
+	return {
+		of,
+		gaps: [...objectIds].some((objectId) => of(objectId) === "unknown") ? [{
+			subject: { kind: "scope" },
+			aspect: "row-security",
+			detail: `${reasons.join("; ")}, so a security policy it cannot see may filter any table or view in scope`
+		}] : []
+	};
+}
+//#endregion
+//#region src/version.ts
+/**
+* The build the server runs, as it states it ("16.0.4205.1").
+*
+* One query, shared by `ping` and by discovery, so the version a snapshot
+* records and the version a ping reports cannot differ — and so discovery
+* does not import the adapter that imports it. `ProductVersion` rather than
+* `@@VERSION`, which adds the edition, the OS and a paragraph of text. Cast,
+* because `SERVERPROPERTY` returns `sql_variant` and the driver would hand that
+* back as something other than a string.
+*/
+async function readServerVersion(pool) {
+	const row = (await pool.request().query("select cast(serverproperty('ProductVersion') as nvarchar(128)) as version")).recordset[0];
+	if (row === void 0) throw new Error("SQL Server answered the version query with no row");
+	return row.version;
+}
+//#endregion
+//#region src/discovery/discover.ts
+/**
+* What this connection's account can see of the tables and views in `scope`,
+* what it may do with each column, whether a security policy filters each
+* object for it -- and, as gaps, what it cannot establish (0007, 0027) --
+* whether it may delete from each, and every key it can see that refers to
+* each, from any schema (0049).
+*
+* Read from SQL Server's catalog views, never INFORMATION_SCHEMA, which carries
+* neither the trust and disable flags of a key nor rowversion nor extended
+* properties (0004). One catalog concern per query, each bound to the scope by
+* parameters; they run side by side and are not one consistent read. A
+* concurrent ALTER can tear the result, in which case createSnapshot refuses
+* what no catalog could produce, or drift review sees the change next time.
+* A column and its privileges are one read (access.ts), so no column lacks
+* an answer; a concurrent rename can still make that answer a false "no".
+*
+* Unlike PostgreSQL's, this catalog is filtered by permission: an object the
+* account holds nothing on is absent, behind a schema gap, a security policy
+* it cannot see leaves row security `unknown`, behind a scope gap, and a key
+* on a table it cannot see is missing from what refers to a table, behind
+* another. A graph edge constraint, which is not a foreign key, is a gap on
+* each node table it connects, for any account (referenced-by.ts).
+*
+* The pool is the caller's. Nothing here opens a connection or reads
+* configuration, and nothing here closes the pool.
+*/
+async function discoverSqlServer(pool, scope) {
+	const schemas = [...new Set(scope.schemas)];
+	const [version, account] = await Promise.all([readServerVersion(pool), readAccount(pool)]);
+	if (schemas.length === 0) return createSnapshot({
+		kind: "sqlserver",
+		serverVersion: version,
+		account,
+		scope,
+		objects: [],
+		gaps: []
+	});
+	const [objects, columns, keys, foreignKeys, referencedBy, checks, visibility, policed] = await Promise.all([
+		readObjects(pool, schemas),
+		readColumns(pool, schemas),
+		readKeys(pool, schemas),
+		readForeignKeys(pool, schemas),
+		readReferencedBy(pool, schemas),
+		readChecks(pool, schemas),
+		readObjectVisibility(pool, schemas),
+		readPolicies(pool, schemas)
+	]);
+	const rowSecurity = rowSecurityOf(objects.keys(), policed, visibility);
+	const assembled = [];
+	for (const [objectId, object] of objects) {
+		const objectKeys = keys.get(objectId);
+		assembled.push({
+			...object,
+			columns: columns.byObject.get(objectId) ?? [],
+			primaryKey: objectKeys?.primaryKey ?? null,
+			uniqueKeys: objectKeys?.uniqueKeys ?? [],
+			foreignKeys: foreignKeys.byObject.get(objectId) ?? [],
+			checks: checks.byObject.get(objectId) ?? [],
+			rowSecurity: rowSecurity.of(objectId),
+			referencedBy: referencedBy.byObject.get(objectId) ?? []
+		});
+	}
+	return createSnapshot({
+		kind: "sqlserver",
+		serverVersion: version,
+		account,
+		scope,
+		objects: assembled,
+		gaps: [
+			...visibility.gaps,
+			...rowSecurity.gaps,
+			...referencedByGaps(objects.size, visibility),
+			...named$2(objects, [
+				...columns.gaps,
+				...foreignKeys.gaps,
+				...referencedBy.gaps,
+				...checks.gaps
+			])
+		]
+	});
+}
+/**
+* Gaps with the object's name in place of its id. A gap on an object the
+* objects query did not return belongs to a table created between the two
+* reads, and is left out with the table.
+*/
+function named$2(objects, gaps) {
+	return gaps.flatMap((gap) => {
+		const object = objects.get(gap.objectId);
+		return object === void 0 ? [] : [{
+			subject: {
+				kind: "object",
+				object: object.ref
+			},
+			aspect: gap.aspect,
+			detail: gap.detail
+		}];
+	});
+}
+//#endregion
+//#region src/adapter.ts
+/**
+* SQL Server, through a pool the composition root connected.
+*
+* The pool rather than a connection string: opening the connection is where a
+* secret is handled, and that happens once, in the composition root, where the
+* secret resolver lives. Nothing in this package reads configuration, and the
+* tests hand it a pool pointed at a container.
+*
+* `ConnectionPool` is in this signature, which is why `@types/mssql` is a
+* dependency of this package and not a devDependency: a consumer type-checking
+* against the published declarations needs it, and `skipLibCheck` would not
+* save them, since the import is in OUR declaration file. The install gate
+* runs with `skipLibCheck` off for exactly this.
+*/
+function createSqlServerAdapter(pool) {
+	return {
+		kind: "sqlserver",
+		async ping() {
+			return {
+				kind: "sqlserver",
+				version: await readServerVersion(pool)
+			};
+		},
+		discover: (scope) => discoverSqlServer(pool, scope),
+		async close() {
+			await pool.close();
+		}
+	};
+}
+//#endregion
+//#region src/sql/statement.ts
+/**
+* The parameters of one statement as it is built: each value gets the next
+* generated name, `@p0`, `@p1`, and only that name reaches the SQL text. A
+* value is never spliced into a statement, whatever it holds.
+*/
+var Parameters = class {
+	#list = [];
+	/** Binds a value and returns its name, for the SQL being built. */
+	add(type, value) {
+		const name = `p${String(this.#list.length)}`;
+		this.#list.push({
+			name,
+			type,
+			value
+		});
+		return `@${name}`;
+	}
+	statement(sql) {
+		return {
+			sql,
+			parameters: [...this.#list]
+		};
+	}
+};
+/** A request for one statement, its values bound. A value the driver will not take is thrown here, before anything is sent. */
+function prepare(pool, statement) {
+	const request = pool.request();
+	for (const parameter of statement.parameters) request.input(parameter.name, parameter.type, parameter.value);
+	return request;
+}
+/**
+* Sends a prepared statement and returns its last result set: a write batch
+* selects what it wrote after its own bookkeeping, and a read selects once.
+*
+* Every statement travels as `sp_executesql`, with or without parameters —
+* `tedious` sends a query no other way — which is what keeps the values out of
+* the SQL text, and what ends a `SET` with the request. What this rejects
+* with is always the driver's.
+*/
+async function send(request, statement) {
+	return [...(await request.query(statement.sql)).recordsets.at(-1) ?? []];
+}
+/**
+* Runs one lookup statement until `signal` aborts (0061). Already aborted: it
+* throws `signal.reason` and builds and sends nothing -- the check that also
+* stops a resolve between two key groups, since a listener added to a signal
+* that has already aborted is never called. Aborted while the statement is on
+* its way or running: `request.cancel()` sends a TDS attention on the
+* statement's own connection, and this rejects with exactly `signal.reason`
+* at once, without waiting for the server's acknowledgement. An answer read
+* before the abort is returned as it came.
+*
+* Attention is in-band: tedious waits for the server to acknowledge it
+* before the connection takes another request, so a cancel can only ever
+* stop its own statement. Measured on 2026-10-14 against SQL Server 2022
+* with mssql 12.7.4 and tedious 20.3.3: of 300 trials, the 99 cancels sent
+* as the statement completed reached 0 next requests on the connection. An
+* abort before mssql holds a connection marks the request cancelled, and
+* mssql gives the connection back without sending the statement.
+*
+* The driver's own rejection of a cancelled statement, ECANCEL, comes after
+* this has rejected, and is dropped: by then nobody is waiting for it. The
+* connection goes back to the pool when it arrives.
+*
+* No `requestTimeout` is set here: the deadline is the caller's signal, one
+* timer the same on both engines that also counts the wait for a pooled
+* connection, which tedious's timer, started at send, does not. mssql's
+* default request timeout of 15 s, which it hands tedious for every request
+* (lib/tedious/connection-pool.js), still bounds every statement, a
+* lookup's included.
+*/
+function runUntil(pool, statement, signal) {
+	stopIfAborted(signal);
+	const request = prepare(pool, statement);
+	const answer = send(request, statement);
+	return new Promise((resolve, reject) => {
+		const stop = () => {
+			request.cancel();
+			reject(signal.reason);
+		};
+		signal.addEventListener("abort", stop, { once: true });
+		answer.then((rows) => {
+			signal.removeEventListener("abort", stop);
+			resolve(rows);
+		}, (error) => {
+			signal.removeEventListener("abort", stop);
+			reject(error);
+		});
+	});
+}
+/** Throws `signal.reason` when the caller has already gone, so nothing is built or sent for it. */
+function stopIfAborted(signal) {
+	if (signal.aborted) throw signal.reason;
+}
+//#endregion
+//#region src/sql/values.ts
+/**
+* How a value crosses between SQL Server and the API, in both directions, for
+* every kind the contract names. One module for the lookup half and the record
+* half, because two spellings of one decimal inside one adapter is the
+* divergence the core exists to prevent.
+*
+* Out of the database, every value is converted to text BY THE SERVER, into
+* exactly what `codecFor(column).parse` returns, and the driver only ever
+* carries a string. `tedious` returns `decimal(18,4)` as a lossy JavaScript
+* number and `date` as midnight UTC (0007); a string it cannot misread.
+*
+* Into the database, every value except a boolean and a float travels as
+* nvarchar text and is converted by the server to the column's type. Not
+* through the driver's typed parameters: `tedious` binds a `Decimal` parameter
+* through a JavaScript number, so `1234567890123.4567` is stored as
+* `1234567890123.4568` (the records suite holds it), and the largest
+* `decimal(18,4)` is refused outright (8023, measured once on 2026-10-09).
+*/
+/** SQL Server's largest decimal precision: decimal(38, s). */
+const MAX_PRECISION = 38;
+/** SQL Server's integer types, narrowest first, by the range the snapshot gives each. */
+const INTEGER_TYPES = [
+	[
+		"tinyint",
+		0n,
+		255n
+	],
+	[
+		"smallint",
+		-32768n,
+		32767n
+	],
+	[
+		"int",
+		-2147483648n,
+		2147483647n
+	],
+	[
+		"bigint",
+		-9223372036854775808n,
+		9223372036854775807n
+	]
+];
+/** The integer type a column of this range is: a key compared with its own type is a seek, not a conversion of every row. */
+function integerType(type) {
+	const min = BigInt(type.min);
+	const max = BigInt(type.max);
+	const found = INTEGER_TYPES.find(([, low, high]) => low <= min && max <= high);
+	if (found === void 0) throw new Error(`No SQL Server integer type holds ${type.min} to ${type.max}`);
+	return found[0];
+}
+/**
+* The decimal type a value is converted to, spliced into the statement
+* because SQL Server takes no parameter there. So the precision and the scale
+* are checked to be what its syntax allows — whole numbers, 1 to 38 and 0 to
+* the precision — before they become SQL: they come from approved bindings,
+* and a bundle altered where it is stored must not run as a statement.
+*/
+function decimalType(type) {
+	const { precision, scale } = type;
+	if (precision === null || scale === null) throw new Error("A SQL Server decimal has a precision and a scale");
+	if (!Number.isSafeInteger(precision) || !Number.isSafeInteger(scale) || precision < 1 || precision > MAX_PRECISION || scale < 0 || scale > precision) throw new Error(`A SQL Server decimal's precision is 1 to ${String(MAX_PRECISION)} and its scale 0 to its precision`);
+	return `decimal(${String(precision)}, ${String(scale)})`;
+}
+function noValue(type) {
+	return /* @__PURE__ */ new Error(`A ${type.kind} column has no canonical API value, so it can be neither read nor written as one`);
+}
+/**
+* SQL that reads `expression` as the text of its canonical API value.
+*
+* - text: itself, as nvarchar(max), so a `varchar` is decoded by the server's
+*   code page and not by the driver's. A char(n) or nchar(n) without its
+*   padding: SQL Server keeps it through the conversion (`AB ` for a char(3)
+*   holding AB, C1) and PostgreSQL's bpchar drops it, so a fixed-length key
+*   would otherwise have one token per engine (0028). `rtrim` removes U+0020
+*   and nothing else — a no-break space or a tab stays (C1b) — which is
+*   exactly the padding. Measured on SQL Server 2022 (16.0.4295) on 2026-10-09.
+* - integer: the decimal string, whatever its width.
+* - decimal: every digit the column holds, padded to its scale, in style 2 —
+*   which a decimal ignores, and which gives `money` its four places where
+*   its default conversion rounds to two.
+* - boolean: `1` or `0`, which `fromCanonicalText` makes `true` or `false`.
+* - float: style 3, seventeen significant digits, which a double round-trips
+*   through; a real's are then made its shortest decimal by
+*   `fromCanonicalText` (0026).
+* - date `YYYY-MM-DD`; time `HH:MM`; an instant `YYYY-MM-DDTHH:MM:SSZ` in UTC.
+*   Each is formancy's shape, and a time's seconds and an instant's fraction
+*   are cut off, not rounded, because the shapes cannot hold them (0017).
+* - a zoneless timestamp: `YYYY-MM-DDTHH:MM:SS`, then its fraction with the
+*   trailing zeros dropped, as PostgreSQL spells it (0026). See
+*   `zonelessText`.
+* - uuid: lower case, as the codec spells it; SQL Server prints upper case.
+*
+* Text and decimals are read by the column's own type, never by the length,
+* precision or scale the snapshot remembers: CONVERT truncates text and
+* rounds a decimal to the type it is given without a word, so a column
+* widened since discovery would read back as a value it does not hold
+* (measured: 'Muster AG,' for 'Muster AG, Zurich branch', 1.2346 for
+* 1.234567). PostgreSQL reads `::text`, which loses nothing either.
+*/
+function canonicalText(type, expression) {
+	switch (type.kind) {
+		case "text": return type.fixedLength ? `rtrim(convert(nvarchar(max), ${expression}))` : `convert(nvarchar(max), ${expression})`;
+		case "integer": return `convert(nvarchar(20), ${expression})`;
+		case "decimal": return `convert(nvarchar(50), ${expression}, 2)`;
+		case "boolean": return `convert(nchar(1), ${expression})`;
+		case "float": return `convert(nvarchar(30), ${expression}, 3)`;
+		case "date": return `convert(nchar(10), ${expression}, 23)`;
+		case "time": return `convert(nchar(5), ${expression}, 108)`;
+		case "timestamp": return type.withTimeZone ? `convert(nchar(19), switchoffset(${expression}, '+00:00'), 126) + N'Z'` : zonelessText(expression);
+		case "uuid": return `lower(convert(nchar(36), ${expression}))`;
+		case "binary":
+		case "rowversion":
+		case "unsupported": throw noValue(type);
+	}
+}
+/**
+* A zoneless timestamp as text, with its fraction and without its trailing
+* zeros: `2026-10-08T12:34:56.5`. Style 126 prints the column's own scale with
+* trailing zeros -- datetime2(3) holding .5 is `…56.500`, datetime2(7) holding
+* .12 is `…50.1200000`, datetime holding .007 is `…56.007` -- and leaves the
+* fraction out on a whole second. datetime keeps 1/300 s, so what it holds
+* for .007 is .00666…, and style 126 spells it to the millisecond: the one
+* read that is rounded, by SQL Server, and the contract says so. The zeros are trimmed by reversing the text
+* and keeping it up to the first digit that is not 0. Only text past nineteen
+* characters is trimmed -- it has a fraction, and the fraction a digit that
+* is not 0 -- so a whole second ending in 0 keeps it: `…12:34:50`, never
+* `…12:34:5`. Measured on SQL Server 2022 (16.0.4295) on 2026-10-09 for .12,
+* .5, .007, .01, .0000001, .9999999 and a whole second; the records suite
+* holds datetime2(7), datetime and smalldatetime to it. The conversion is
+* spelled five times, which the server evaluates per column read.
+*/
+function zonelessText(expression) {
+	const text = `convert(nvarchar(27), ${expression}, 126)`;
+	return `case when len(${text}) > 19 then left(${text}, len(${text}) + 1 - patindex(N'%[^0]%', reverse(${text}))) else ${text} end`;
+}
+/**
+* The API value for text `canonicalText` produced: a boolean and a float become
+* JSON's own; everything else stays a string. A real becomes the shortest
+* decimal naming its float32 -- 0.1, never the 0.10000000149011612 its style 3
+* text is -- which is what the codec returns for it and what PostgreSQL reads
+* (0026), so a value read and sent back unchanged is unchanged.
+*/
+function fromCanonicalText(type, text) {
+	if (text === null) return null;
+	if (type.kind === "boolean") return text === "1";
+	if (type.kind === "float") return type.bits === 32 ? canonicalFloat32(Number(text)) : Number(text);
+	return text;
+}
+function requireType(ok, type) {
+	if (!ok) throw new Error(`A value for a ${type.kind} column is not the canonical value a codec returns`);
+}
+/** As text, for the server to convert: the one way into the database that loses nothing. */
+function asText(parameters, value) {
+	return parameters.add(mssql.NVarChar(mssql.MAX), value);
+}
+/**
+* SQL that converts `text` — an nvarchar expression holding a canonical value
+* — to its column's type: `convert(decimal(18, 4), @p3)`. A timestamp is an
+* instant; a zoneless one is never written. One spelling for a value bound as
+* text and for a key read back as text, so a record is found again exactly
+* the way it is named.
+*/
+function fromText(type, text) {
+	switch (type.kind) {
+		case "text": return text;
+		case "integer": return `convert(${integerType(type)}, ${text})`;
+		case "decimal": return `convert(${decimalType(type)}, ${text})`;
+		case "date": return `convert(date, ${text}, 23)`;
+		case "time": return `convert(time, ${text})`;
+		case "timestamp": return `convert(datetimeoffset, ${text}, 127)`;
+		case "uuid": return `convert(uniqueidentifier, ${text})`;
+	}
+}
+/**
+* Whether a key of this kind read back by `canonicalText` is turned by
+* `fromText` into the very value it was read from. A time and an instant are
+* cut short (0017); a boolean and a float do not travel as text.
+*/
+function isExactKey(type) {
+	return type.kind === "text" || type.kind === "integer" || type.kind === "decimal" || type.kind === "uuid" || type.kind === "date";
+}
+/**
+* Binds one canonical value and returns the SQL expression that is it, typed
+* as its column: `convert(decimal(18, 4), @p3)`. Null is bound with the same
+* type, so it is a typed NULL.
+*
+* Text is bound as nvarchar(max), never with the column's length: a parameter
+* declared shorter than its value is truncated by the server without a word,
+* and the column's own length check is the one that should refuse.
+*
+* A value of the wrong JavaScript type is a programming error, refused before
+* anything is sent: the record port's values arrive as a codec returned them.
+*/
+function bindValue(parameters, type, value) {
+	const given = value === null ? null : typeof value;
+	switch (type.kind) {
+		case "integer":
+			requireType(given === null || given === "string" || given === "number" && Number.isSafeInteger(value), type);
+			return fromText(type, asText(parameters, value === null ? null : String(value)));
+		case "boolean":
+			requireType(given === null || given === "boolean", type);
+			return parameters.add(mssql.Bit, value);
+		case "float":
+			requireType(given === null || given === "number" && Number.isFinite(value), type);
+			return parameters.add(mssql.Float, value);
+		case "timestamp":
+			if (!type.withTimeZone) throw noValue(type);
+			requireType(given === null || given === "string", type);
+			return fromText(type, asText(parameters, value));
+		case "text":
+		case "decimal":
+		case "date":
+		case "time":
+		case "uuid":
+			requireType(given === null || given === "string", type);
+			return fromText(type, asText(parameters, value));
+		case "binary":
+		case "rowversion":
+		case "unsupported": throw noValue(type);
+	}
+}
+//#endregion
+//#region src/sql/quote.ts
+/** sysname is nvarchar(128): no SQL Server identifier is longer, and QUOTENAME returns NULL past it. */
+const MAX_IDENTIFIER_LENGTH = 128;
+/**
+* One identifier, bracket-quoted with every `]` doubled, which is what
+* QUOTENAME does: inside brackets nothing else is special, so a name with a
+* dot, a space, a quote or a reserved word is one identifier and never SQL.
+*
+* Names come from approved metadata (CLAUDE.md, "Secrets and identifiers"),
+* so one that no catalog could hold — empty, longer than sysname, or carrying
+* a NUL — is a programming error, and refused before any SQL is built.
+*/
+function quoteName(name) {
+	if (typeof name !== "string" || name.length === 0 || name.length > MAX_IDENTIFIER_LENGTH || name.includes("\0")) throw new Error(`An identifier is 1 to ${String(MAX_IDENTIFIER_LENGTH)} characters without NUL, as SQL Server's catalog holds it`);
+	return `[${name.replaceAll("]", "]]")}]`;
+}
+/**
+* A table or view, quoted one part at a time from its two fields. Never from
+* a dotted string: `sales.order` split at the dot is a guess, and a name that
+* contains a dot is legal once quoted (0015).
+*/
+function quoteTable(ref) {
+	return `${quoteName(ref.schema)}.${quoteName(ref.name)}`;
+}
+//#endregion
+//#region src/sql/order.ts
+/**
+* The order of `row`'s columns, made explicit about NULLs where a term says
+* where they go: SQL Server puts them first in an ascending order and has no
+* NULLS LAST, so such a column is preceded by a CASE that places them. Text
+* is ordered by the column's collation -- the server's rule, not code-point
+* order -- a uniqueidentifier by its byte groups (above), and the key that
+* ends every order makes it total, because a key is unique under that same
+* rule.
+*
+* The direction is spliced, because SQL Server takes no parameter for ASC or
+* DESC, so it is checked to be one of the two first: the core only writes
+* those, but this is handed a configuration or a request, and one read from
+* a bundle altered where it is stored must not run as a statement.
+*/
+function orderBy(row, terms) {
+	if (terms.length === 0) throw new Error("An order names at least one column.");
+	return terms.flatMap((term) => {
+		if (term.direction !== "asc" && term.direction !== "desc") throw new Error(`${term.column} sorts asc or desc`);
+		const name = `${row}.${quoteName(term.column)}`;
+		if (term.nulls === null) return [`${name} ${term.direction}`];
+		if (term.nulls !== "first" && term.nulls !== "last") throw new Error(`${term.column} puts NULLs first or last`);
+		const [nullRank, valueRank] = term.nulls === "first" ? ["0", "1"] : ["1", "0"];
+		return [`case when ${name} is null then ${nullRank} else ${valueRank} end`, `${name} ${term.direction}`];
+	}).join(", ");
+}
+//#endregion
+//#region src/sql/search.ts
+/**
+* The search as a LIKE pattern that matches only itself: `\` is the escape,
+* and the escape, `%`, `_` and `[` are escaped by it. `[` too, because
+* SQL Server reads `[a-c]` as a character class; `]`, `^` and `-` mean
+* something only inside one.
+*/
+function containsPattern(search) {
+	return `%${search.replace(/[\\%_[]/g, (character) => `\\${character}`)}%`;
+}
+/**
+* What a search column of `row` is matched as: text as itself, so the
+* column's collation folds case and accents as it does in an index; an
+* integer as its canonical text, the digits its label or its cell shows,
+* converted explicitly rather than by LIKE's implicit conversion (0028).
+*/
+function searched(row, search) {
+	const column = `${row}.${quoteName(search.name)}`;
+	return search.type.kind === "integer" ? canonicalText(search.type, column) : column;
+}
+/** The condition that some column of `row` contains `search`, the pattern bound once. `columns` is never empty: a search over nothing is refused before SQL. */
+function searchPredicate(parameters, row, columns, search) {
+	if (columns.length === 0) throw new Error("A search names at least one column; one over none would match nothing on one engine and fail on the other.");
+	const pattern = parameters.add(mssql.NVarChar(mssql.MAX), containsPattern(search));
+	return `(${columns.map((entry) => `${searched(row, entry)} like ${pattern} escape N'\\'`).join(" or ")})`;
+}
+//#endregion
+//#region src/sql/filters.ts
+/**
+* How a row filter and the write check compare text exactly (0028): the
+* column's canonical value is the trusted value, UTF-16 unit for unit, as
+* PostgreSQL compares two `"C"`-collated texts.
+*
+* SQL Server has no such operator. Every collation, BIN2 included, ignores
+* trailing spaces in `=`, so `N'acme' = N'acme ' collate BIN2` is true (C2),
+* and a filter of BIN2 alone let tenant `acme` read the rows of `acme `
+* (C2-table). Two equal-length strings that BIN2 calls equal are the same
+* string, so the byte lengths are compared too.
+*/
+/** A collation that compares code point by code point: case and accents count, trailing spaces still do not. */
+const EXACT_COLLATION = "Latin1_General_100_BIN2";
+/**
+* SQL that is true when two nvarchar expressions are exactly the same text.
+* Both sides are canonical text — what `canonicalText` reads, or a bound
+* value — so a char(n)'s padding is already gone from both.
+*/
+function exactText(left, right) {
+	return `${left} = ${right} collate ${EXACT_COLLATION} and datalength(${left}) = datalength(${right})`;
+}
+/**
+* One row filter on `column`, binding its value once.
+*
+* A non-text value is bound as its column's type, as a record key is: the
+* canonical spelling `scopeRowFilters` checked converts to exactly one value.
+*
+* Text is compared three ways, all on one parameter:
+*
+* - `column = @p`, in the column's own collation, which admits a superset —
+*   an exactly equal pair is equal under every collation — and is the
+*   conjunct an index seeks on. Measured on SQL Server 2022 (16.0.4295) on
+*   2026-10-09 over 20,004 rows (C5): an nvarchar or nchar column seeks
+*   (`GetRangeWithMismatchedTypes`), and so does a char or varchar under a
+*   Windows collation; a char or varchar under a `SQL_` collation still
+*   converts every row and scans, as it did before (0017). BIN2 alone never
+*   seeked: the fixture's lookup scanned another index and looked each row up.
+* - the same under BIN2, so case and accents count.
+* - for variable-length text, the byte lengths, so trailing spaces count.
+*   A fixed-length column needs none: its canonical value has no padding, a
+*   value ending in a space is refused before this (`scopeRowFilters`), and
+*   `=` ignores the padding the column stores.
+*
+* The parameter is nvarchar(max), never the column's length, which the
+* server would truncate it to without a word.
+*/
+function filterPredicate(parameters, column, term) {
+	const { type } = term;
+	if (type.kind !== "text") return `${column} = ${bindValue(parameters, type, term.value)}`;
+	const value = parameters.add(mssql.NVarChar(mssql.MAX), term.value);
+	const exact = `${column} = ${value} and ${column} = ${value} collate ${EXACT_COLLATION}`;
+	return type.fixedLength ? exact : `${exact} and datalength(convert(nvarchar(max), ${column})) = datalength(${value})`;
+}
+//#endregion
+//#region src/lookups/statements.ts
+/**
+* The parameters one statement may bind. SQL Server's message says "a maximum
+* of 2100 parameters", and a request with 2099 is refused with 8003: the
+* driver sends every parameterised statement through `sp_executesql`, whose
+* own `@stmt` and `@params` are two of the 2100. Measured against SQL Server
+* 2022 through `tedious` on 2026-10-09; the lookup suite holds the edge.
+*/
+const PARAMETER_LIMIT = 2098;
+/** The table, under one alias every column is qualified with, so a column called `v` or `k0` cannot be mistaken for the key list's. */
+const TARGET = "[target]";
+function column$1(name) {
+	return `${TARGET}.${quoteName(name)}`;
+}
+/** The key, each column as the canonical text a token is made of: `[k0]`, `[k1]`, … */
+function keySelect(config) {
+	return config.targetColumns.map((key, index) => `${canonicalText(key.type, column$1(key.name))} as [k${String(index)}]`);
+}
+/**
+* The display columns, `[d0]`, `[d1]`, …, read as a record read reads them:
+* the canonical text of each, by the type the configuration carries, which
+* `fromCanonicalText` decodes and `displayText` spells (0028). Not SQL
+* Server's own style 126, which spelled a bit `1`, a uuid in upper case, a
+* float in scientific notation and an instant in its stored offset (C6).
+*/
+function displaySelect(config) {
+	return config.display.map((display, index) => `${canonicalText(display.type, column$1(display.name))} as [d${String(index)}]`);
+}
+/** A row whose key holds a NULL cannot be referenced by any foreign key value, so it is never offered. */
+function keysPresent(config) {
+	return config.targetColumns.map((key) => `${column$1(key.name)} is not null`);
+}
+/**
+* The actor's trusted filters, in the same WHERE as everything else: a row
+* outside them does not exist for this call. Each compares exactly (0028).
+*/
+function filtered(parameters, terms) {
+	return terms.map((term) => filterPredicate(parameters, column$1(term.column), term));
+}
+/**
+* One page: up to `limit + 1` rows, so `lookupPage` can tell whether there is
+* more without a COUNT. The search is one parameter, matched against each
+* search column with LIKE.
+*/
+function pageStatement(config, query, terms) {
+	const parameters = new Parameters();
+	const where = [...keysPresent(config), ...filtered(parameters, terms)];
+	if (query.search !== "") {
+		if (config.search.length === 0) throw new Error(`${config.source} has no searchable column`);
+		where.push(searchPredicate(parameters, TARGET, config.search, query.search));
+	}
+	const offset = parameters.add(mssql.BigInt, query.offset);
+	const fetch = parameters.add(mssql.Int, query.limit + 1);
+	return parameters.statement(`select ${[...keySelect(config), ...displaySelect(config)].join(", ")} from ${quoteTable(config.target)} as ${TARGET}
+    where ${where.join(" and ")}
+    order by ${orderBy(TARGET, config.sort)}
+    offset ${offset} rows fetch next ${fetch} rows only`);
+}
+/**
+* The rows, under the filters, whose key is one of `keys`. The keys travel as
+* a table value constructor joined by EXISTS, so a composite key is compared
+* column by column, each value converted to its key column's type, and a row
+* is returned at most once however many keys the database finds equal to it.
+*/
+function keysStatement(config, keys, terms, withDisplay) {
+	const parameters = new Parameters();
+	const where = filtered(parameters, terms);
+	const rows = keys.map((key) => `(${config.targetColumns.map((target, index) => bindValue(parameters, target.type, key[index] ?? null)).join(", ")})`);
+	const names = config.targetColumns.map((_, index) => `[k${String(index)}]`);
+	const matches = config.targetColumns.map((target, index) => `${column$1(target.name)} = [v].[k${String(index)}]`);
+	where.push(`exists (select 1 from (values ${rows.join(", ")}) as [v] (${names.join(", ")}) where ${matches.join(" and ")})`);
+	const select = withDisplay ? [...keySelect(config), ...displaySelect(config)] : keySelect(config);
+	return parameters.statement(`select ${select.join(", ")} from ${quoteTable(config.target)} as ${TARGET} where ${where.join(" and ")}`);
+}
+/**
+* The keys in groups that each fit one statement: every key binds one
+* parameter per key column, and the filters bind theirs in every group.
+* Splitting makes resolve and rejects several reads rather than one, so a row
+* changed between two of them is seen as it was when its own group ran.
+*/
+function keyGroups(config, keys, filterCount) {
+	const size = Math.floor((PARAMETER_LIMIT - filterCount) / config.targetColumns.length);
+	if (size < 1) throw new Error(`${config.source}: ${String(filterCount)} filters leave no parameter for a key`);
+	const groups = [];
+	for (let start = 0; start < keys.length; start += size) groups.push(keys.slice(start, start + size));
+	return groups;
+}
+//#endregion
+//#region src/lookups/lookups.ts
+function foundRow(config, row) {
+	return {
+		key: config.targetColumns.map((_, index) => {
+			const value = row[`k${String(index)}`];
+			if (typeof value !== "string") throw new Error(`${config.source}: a key column came back without a value`);
+			return value;
+		}),
+		display: config.display.map((display, index) => fromCanonicalText(display.type, row[`d${String(index)}`] ?? null))
+	};
+}
+/**
+* The rows under the filters whose key is one of `keys`, read in as many
+* statements as the parameter limit needs, one after another so a long list
+* holds one connection rather than the pool. Each group runs until `signal`
+* aborts, and `runUntil` checks it before building the next, so an aborted
+* resolve sends no further group (0061).
+*/
+async function findKeys(pool, config, keys, terms, withDisplay, signal) {
+	const found = [];
+	for (const group of keyGroups(config, keys, terms.length)) {
+		const rows = await runUntil(pool, keysStatement(config, group, terms, withDisplay), signal);
+		for (const row of rows) found.push(foundRow(config, row));
+	}
+	return found;
+}
+/**
+* The lookup half of the SQL Server adapter, through a pool the composition
+* root connected.
+*
+* Every answer is decided by `@formancy/data-core`'s helpers — which tokens
+* are asked about, how a page knows there is more, when a token is a member —
+* and this only queries. The filters are read with `rowFilterTerms` before
+* anything is built, so a request without a policy fails instead of seeing
+* every row, and they are part of the same statement as the rest.
+*
+* What SQL Server decides on its own, and the adapter does not hide: how a
+* search matches and how text orders is the column's collation, so on a
+* case-insensitive database a search for `muster` finds `Muster AG` and
+* `apple` sorts before `Banana`; and equality ignores trailing spaces, which
+* is why membership is the re-encoded row's and never the database's match
+* (0012). A filter is the exception: it compares the column's canonical value
+* with its trusted value exactly — case, accents and trailing spaces count —
+* as PostgreSQL's does, and still seeks an nvarchar column's index
+* (../sql/filters.ts, 0028). A label is the record reader's value, spelled by
+* `displayText`, so it reads the same on both engines.
+*
+* A database error propagates: a lookup that cannot answer refuses, and
+* formancy turns that into a refused submission.
+*
+* Every statement runs until the caller's signal aborts, and is then stopped
+* in the database by `request.cancel()`, a TDS attention (0061,
+* ../sql/statement.ts). A signal already aborted is refused before the
+* filters are read or a key is parsed, so a request already gone costs
+* nothing. The pool is the one records use: an attention travels on the
+* statement's own connection, so unlike PostgreSQL's cancel request it
+* cannot stop anyone else's statement. No per-request `requestTimeout` is
+* set; mssql's default of 15 s, which it hands tedious for every request
+* (lib/tedious/connection-pool.js), still bounds every statement.
+*/
+function createSqlServerLookups(pool) {
+	return {
+		async search(config, query, filters, signal) {
+			stopIfAborted(signal);
+			const rows = await runUntil(pool, pageStatement(config, query, rowFilterTerms(filters)), signal);
+			return lookupPage(config, rows.map((row) => foundRow(config, row)), query.limit);
+		},
+		async resolve(config, tokens, filters, signal) {
+			stopIfAborted(signal);
+			const terms = rowFilterTerms(filters);
+			const keys = lookupKeys(config, tokens);
+			if (keys.length === 0) return [];
+			return resolvedRows(config, tokens, await findKeys(pool, config, keys, terms, true, signal));
+		},
+		async rejects(config, tokens, filters, signal) {
+			stopIfAborted(signal);
+			const terms = rowFilterTerms(filters);
+			const keys = lookupKeys(config, tokens);
+			const found = keys.length === 0 ? [] : await findKeys(pool, config, keys, terms, false, signal);
+			return rejectedTokens(tokens, found.map((row) => row.key));
+		}
+	};
+}
+//#endregion
+//#region src/records/definition.ts
+/**
+* The facts of the object whose quoted name the parameter `table` holds, as
+* one JSON text; NULL when the catalog shows no such object as discovery
+* would describe it.
+*/
+function factsOf(table) {
+	const scoped = "(o.object_id)";
+	return `(select ${OBJECT_KIND} as [kind], o.object_id as [object],
+    (select ${COLUMN_DEFINITION} from ${COLUMN_SOURCE} where c.object_id = o.object_id order by c.column_id for json path, include_null_values) as [columns],
+    (${KEYS_SQL(scoped)} for json path, include_null_values) as [keys],
+    (${FOREIGN_KEYS_SQL(scoped)} for json path, include_null_values) as [foreignKeys]
+  from sys.objects o
+  where o.object_id = object_id(${table}) and ${DESCRIBED_OBJECT}
+  for json path, without_array_wrapper, include_null_values)`;
+}
+/** The SHA-256 of a facts text, as varbinary(32); NULL for NULL. */
+function digestOf(facts) {
+	return `hashbytes('SHA2_256', ${facts})`;
+}
+/** A definition this adapter made: a SHA-256 in hex. */
+const DEFINITION = /^[0-9a-f]{64}$/;
+/** The definition's bytes, to bind as varbinary(32); a definition this adapter did not make is a programming error. */
+function definitionBytes(token) {
+	if (typeof token !== "string" || !DEFINITION.test(token)) throw new Error("A write carries the definition this adapter described the table with: a SHA-256 in hex.");
+	return Buffer.from(token, "hex");
+}
+/**
+* The description, from the facts text and the digest the same statement
+* computed: `undefined` when there are no facts, `cut` when the text that
+* arrived is not the text that was hashed -- a TEXTSIZE shorter than it.
+*/
+function describedFrom(facts, digest) {
+	if (facts === null || digest === null) return void 0;
+	if (!createHash("sha256").update(Buffer.from(facts, "utf16le")).digest().equals(digest)) return "cut";
+	const parsed = JSON.parse(facts);
+	const keys = keysOf(parsed.keys ?? []);
+	return inSnapshotOrder({
+		kind: parsed.kind,
+		columns: (parsed.columns ?? []).map(describedColumn),
+		primaryKey: keys.primaryKey,
+		uniqueKeys: keys.uniqueKeys,
+		foreignKeys: foreignKeysOf(parsed.foreignKeys ?? [], []),
+		definition: digest.toString("hex")
+	});
+}
+//#endregion
+//#region src/records/statements.ts
+/**
+* The SQL of each record operation. Every statement selects the same shape —
+* `[found]`, then `[c0]`, `[c1]`, … the canonical text of each requested
+* column, then `[version]` — so one function in records.ts reads all of them.
+*
+* The write batches raise errors of their own, below. A user error number is
+* anybody's — a customer's trigger may THROW 51701 too — so errors.ts takes
+* one as the adapter's only when its message is exactly the adapter's.
+*/
+/** Raised when a text column did not store the text it was sent: a varchar whose code page lacks a character, or that drops trailing spaces. */
+const TEXT_NOT_STORED = 51701;
+/** Its message: the index of the written value, in the request's order. */
+const TEXT_NOT_STORED_MESSAGE = /^formancy: text not stored as sent: ([0-9]+)$/;
+/** Raised when an update matched more than one row: an identity that is not a key. */
+const NOT_ONE_ROW = 51702;
+const NOT_ONE_ROW_MESSAGE = "formancy: the identity matched more than one row";
+/** Raised when an enabled INSTEAD OF trigger decides what the write stores. An account that cannot see the table is refused before, by the definition's check (0041). */
+const DECIDED_BY_TRIGGER = 51703;
+const DECIDED_BY_TRIGGER_MESSAGE = "formancy: an INSTEAD OF trigger decides what this write stores";
+/** Raised when a trigger ended the write's transaction and began another. */
+const TRANSACTION_REPLACED = 51704;
+const TRANSACTION_REPLACED_MESSAGE = "formancy: a trigger ended the transaction of the write and began another";
+/** Raised from CATCH when the error came after a trigger had ended the write's transaction: it may have committed (0031). */
+const TRANSACTION_ENDED = 51705;
+const TRANSACTION_ENDED_MESSAGE = "formancy: a trigger ended the transaction of the write and then raised an error";
+/** Raised when the table's definition is not the one the write was decided over (0041), after the statement or in CATCH. */
+const DEFINITION_MOVED$1 = 51706;
+const DEFINITION_MOVED_MESSAGE = "formancy: table definition moved";
+/** Raised when a delete's account cannot see every key that refers to a table the delete reaches, or one acts on the delete that it was not decided over (0050, 0051). */
+const REACH_MOVED = 51707;
+const REACH_MOVED_MESSAGE = "formancy: what refers to the table moved";
+/** Raised when a delete's account may not DELETE from a table past the root the delete reaches (0051). */
+const REACH_UNDELETABLE = 51708;
+const REACH_UNDELETABLE_MESSAGE = "formancy: this account may not delete from a table the delete reaches";
+/**
+* What every statement returns, from `source` — `[r].` for the table, `inserted.`
+* for an OUTPUT clause. `[found]` is always there, so a request for no
+* columns is still a statement. A rowversion comes back as its 8 bytes, which
+* `encodeRowversion` spells, so the adapter and the core cannot spell a token
+* two ways; a version column as its decimal text.
+*/
+function selection(columns, concurrency, source) {
+	const selected = [{
+		name: "[found]",
+		declared: "int",
+		expression: "1"
+	}];
+	columns.forEach((column, index) => {
+		selected.push({
+			name: `[c${String(index)}]`,
+			declared: "nvarchar(max)",
+			expression: canonicalText(column.type, `${source}${quoteName(column.name)}`)
+		});
+	});
+	if (concurrency !== null) selected.push(versionOf(concurrency, source));
+	return selected;
+}
+function versionOf(concurrency, source) {
+	const column = `${source}${quoteName(concurrency.column)}`;
+	return concurrency.kind === "rowversion" ? {
+		name: "[version]",
+		declared: "binary(8)",
+		expression: column
+	} : {
+		name: "[version]",
+		declared: "nvarchar(20)",
+		expression: `convert(nvarchar(20), ${column})`
+	};
+}
+function column(name) {
+	return `[r].${quoteName(name)}`;
+}
+function keyPredicates(parameters, key) {
+	return key.map((value) => `${column(value.name)} = ${bindValue(parameters, value.type, value.value)}`);
+}
+/** The trusted filters, each comparing the column's canonical value exactly (../sql/filters.ts, 0028). */
+function filterPredicates(parameters, terms) {
+	return terms.map((term) => filterPredicate(parameters, column(term.column), term));
+}
+/** The alias of a through's target inside its EXISTS. */
+const PARENT = "[p]";
+/**
+* One through (0043) as a condition on the record: its parent row, the one
+* the record's foreign-key columns reference, is one the target's filter
+* admits. An EXISTS in the statement itself, under the statement's own
+* locks. The pair compares with `=`, as the foreign key does; the filter
+* terms compare exactly (0028). Every column is qualified, so a key onto the
+* same table compares the parent's key with the record's column and never a
+* row with itself. A record whose foreign key is NULL matches no parent.
+*/
+function throughPredicate(parameters, through) {
+	const pairs = through.pairs.map((pair) => `${PARENT}.${quoteName(pair.references)} = ${column(pair.column)}`);
+	const terms = through.terms.map((term) => filterPredicate(parameters, `${PARENT}.${quoteName(term.column)}`, term));
+	return `exists (select 1 from ${quoteTable(through.target)} as ${PARENT} where ${[...pairs, ...terms].join(" and ")})`;
+}
+/** What locates a record in every statement but an insert: its key, the trusted filters and every through. */
+function located(parameters, key, terms, through) {
+	return [
+		...keyPredicates(parameters, key),
+		...filterPredicates(parameters, terms),
+		...through.map((entry) => throughPredicate(parameters, entry))
+	];
+}
+/** The table's quoted name, bound as `object_id` reads it. */
+function tableName(parameters, table) {
+	return parameters.add(mssql.NVarChar(mssql.MAX), quoteTable(table));
+}
+/** The table's facts and their digest, as `[facts]` and `[digest]` of a derived table `[f]`. */
+function described(parameters, table) {
+	return {
+		columns: [{
+			name: "[facts]",
+			expression: "[f].[facts]"
+		}, {
+			name: "[digest]",
+			expression: digestOf("[f].[facts]")
+		}],
+		from: `(select ${factsOf(tableName(parameters, table))} as [facts]) as [f]`
+	};
+}
+/** A description's columns as a select list. */
+function describedSelect(columns) {
+	return columns.map((column) => `${column.expression} as ${column.name}`).join(", ");
+}
+/** The table's description, in one statement: its facts and their digest. */
+function describeStatement(table) {
+	const parameters = new Parameters();
+	const { columns, from } = described(parameters, table);
+	return parameters.statement(`select ${describedSelect(columns)} from ${from}`);
+}
+/**
+* One record under the filters, with the table as this same statement found
+* it (0041): one statement, which holds a schema-stability lock on the table
+* while it runs, so no ALTER lands between the facts and the record.
+* `top (2)`, so an identity that matched more than one row is noticed
+* without reading every row it matched; one row with a NULL `[found]` when
+* none is inside the filters.
+*/
+function readStatement(request, terms, through) {
+	const parameters = new Parameters();
+	const { columns, from } = described(parameters, request.target.table);
+	const where = located(parameters, request.key, terms, through);
+	const record = selection(request.columns, request.target.concurrency, `[r].`).map((selected) => `${selected.expression} as ${selected.name}`);
+	return parameters.statement(`select ${describedSelect(columns)}, [record].* from ${from} outer apply (select top (2) ${record.join(", ")} from ${quoteTable(request.target.table)} as [r] where ${where.join(" and ")}) as [record]`);
+}
+/**
+* Whether a record is there for this actor -- what tells a stale update from
+* one aimed at nothing -- and whether the table's definition is still the
+* one the update was decided over (0041), which comes first. Located as the
+* update is, inside the filters and every through (0043), so a record outside
+* them is not found whatever version was sent.
+*/
+function existsStatement(request, terms, through, definition) {
+	const parameters = new Parameters();
+	const table = request.target.table;
+	const same = `case when ${digestOf(factsOf(tableName(parameters, table)))} = ${parameters.add(mssql.VarBinary(32), definition)} then 1 else 0 end`;
+	const where = located(parameters, request.key, terms, through);
+	return parameters.statement(`select (select count(*) from ${quoteTable(table)} as [r] where ${where.join(" and ")}) as [found], ${same} as [same]`);
+}
+/**
+* Reads the version back from the row itself, after the statement and its
+* AFTER triggers and before the commit. OUTPUT saw the row before a trigger
+* that touches it — an audit column, a version the application's own trigger
+* moves — changed its version again; a token taken from OUTPUT would be stale
+* before anyone held it, and refuse the next save.
+*
+* The row is found by its identity as the statement wrote it, a generated one
+* included, captured as canonical text and converted back as a bound key is,
+* so it is found exactly as a later save names it. The text goes through
+* variables rather than a join on the table variable, whose column would
+* bring the database's collation into the comparison and conflict with a key
+* column's own (468). A target with no identity, or with a key column of
+* another kind — a time or an instant, whose text is cut short, a boolean or
+* a float, which do not travel as text — keeps the version the statement saw.
+*/
+function versionAfterTriggers(target) {
+	const keys = target.identity.map((column, index) => ({
+		column: quoteName(column.name),
+		type: column.type,
+		variable: `@i${String(index)}`,
+		name: `[i${String(index)}]`
+	}));
+	const exact = (key) => isExactKey(key.type);
+	if (target.concurrency === null || keys.length === 0 || !keys.every(exact)) return {
+		captured: [],
+		declared: [],
+		statements: []
+	};
+	const where = keys.map((key) => `[stored].${key.column} = ${fromText(key.type, key.variable)}`);
+	const version = versionOf(target.concurrency, "[stored].");
+	return {
+		captured: keys.map((key) => ({
+			name: key.name,
+			declared: "nvarchar(max)",
+			expression: canonicalText(key.type, `inserted.${key.column}`)
+		})),
+		declared: [`declare ${keys.map((key) => `${key.variable} nvarchar(max)`).join(", ")};`],
+		statements: [`select ${keys.map((key) => `${key.variable} = ${key.name}`).join(", ")} from @written;`, `update [written] set [version] = ${version.expression} from @written as [written] cross join ${quoteTable(target.table)} as [stored] where ${where.join(" and ")};`]
+	};
+}
+/**
+* Whether an INSTEAD OF trigger decides what this write stores. Such a
+* trigger runs in place of the statement, and OUTPUT returns the row as if
+* the statement had run — the identity 0, the values before the trigger
+* changed them, a row for an update that changed nothing — so nothing the
+* batch reads says what the trigger stored, and the write is refused.
+*
+* Asked of the catalog after the statement, so a table that is not there has
+* already failed it as schema-changed (208), and after the definition's
+* check, so a table the account writes but cannot see in the catalog --
+* denied VIEW DEFINITION, `object_id` NULL to it -- has already failed that
+* as a moved definition (51706): its facts are NULL. Whether a trigger
+* decides such a write cannot be told, and it is refused either way: fail
+* closed. Before 0041 this check refused it itself, by `object_id` being
+* NULL; that branch could no longer be reached and is gone. The table's
+* name is bound, as `object_id` reads it.
+*/
+function insteadOfGuard(name, operation) {
+	return `if exists (${`select 1 from sys.triggers as [t] join sys.trigger_events as [e] on [e].[object_id] = [t].[object_id] where [t].[parent_id] = object_id(${name}) and [t].[is_instead_of_trigger] = 1 and [t].[is_disabled] = 0 and [e].[type_desc] = N'${operation}'`}) throw ${String(DECIDED_BY_TRIGGER)}, N'${DECIDED_BY_TRIGGER_MESSAGE}', 1;`;
+}
+/**
+* Whether the table still has the definition the write was decided over
+* (0041), as a statement: NULL-safe, because `NULL <> x` is not true and a
+* table the catalog no longer shows hashes to NULL.
+*/
+function definitionGuard(table, definition) {
+	return [`set @d = ${digestOf(factsOf(table))};`, `if @d is null or @d <> ${definition} throw ${String(DEFINITION_MOVED$1)}, N'${DEFINITION_MOVED_MESSAGE}', 1;`];
+}
+/**
+* The batch every write runs in, so that what it stored is checked before it
+* commits, and nothing it did outlives an error:
+*
+* - `OUTPUT … INTO` a table variable, never a bare `OUTPUT`, which SQL Server
+*   refuses (334) on a table with an enabled trigger. The output is the row as
+*   the statement wrote it, before any AFTER trigger changed it; the version
+*   is read back from the row afterwards (`versionAfterTriggers`).
+* - The transaction is the one the batch began. A trigger that rolls it back
+*   and begins another leaves `@@trancount` as it was, so nothing is raised,
+*   and the commit would commit an empty transaction over a write that is
+*   gone; one that commits it and begins another has stored the write. The
+*   batch cannot tell the two apart, and says so (errors.ts). CATCH asks the
+*   same question: a trigger that committed and then raised an error of its
+*   own has stored the write, and its error is not the refusal it looks
+*   like. Measured (0031): in CATCH the transaction is no longer the one the
+*   batch began after a trigger's COMMIT, its COMMIT and BEGIN, and its
+*   ROLLBACK, and still is after a constraint's error or a trigger that only
+*   raises. So the error is replaced by one that says the transaction ended
+*   -- unknown-outcome, over-reported for the ROLLBACK -- unless it is 3609
+*   or the batch's own replaced-transaction error, which already say so.
+* - No INSTEAD OF trigger decided what was stored (`insteadOfGuard`).
+* - Every text value is compared with what its column stored, exactly, and a
+*   difference rolls the write back: SQL Server converts nvarchar to a
+*   single-byte varchar without an error, a character its code page lacks
+*   becoming its "best fit" or `?` (0017), and a varchar created under
+*   ANSI_PADDING OFF drops trailing spaces without one (C12, 0028). The stored
+*   side is canonical text, a char(n)'s padding trimmed, so one comparison
+*   (`exactText`) serves both lengths. OUTPUT shows the row before an AFTER
+*   trigger changed it, so this sees what the statement stored, not a trigger.
+* - TRY…CATCH rolls back on every error it catches, then rethrows it as it
+*   was. xact_abort alone does not: a trigger's RAISERROR, unlike THROW, ends
+*   nothing, so the statement and the commit would run and the driver would
+*   still report the error — a refusal over a write that committed.
+* - `xact_abort`, for what CATCH cannot catch in its own scope: a table
+*   missing when the batch compiles is resolved only when its statement
+*   runs, after `begin transaction`, and without xact_abort its 208 leaves
+*   the transaction open on the pooled connection. Both settings end with the
+*   request, which runs inside `sp_executesql` (../sql/statement.ts).
+* - The table's definition is the one the write was decided over (0041),
+*   read after the statement, while its locks keep any ALTER out: ALTER
+*   needs a schema-modification lock, which waits for this transaction. And
+*   again in CATCH, after the rollback: a statement that failed against a
+*   moved table -- 'many' into a column retyped to int, 245 -- is answered
+*   as the move. Only while the transaction is still the batch's own: one a
+*   trigger ended is answered as ended, 3609, 51704 or 51705, before the
+*   catalog is read, because the trigger may have committed the write
+*   (0031). Measured: asked first, the definition answered "nothing was
+*   written" over a row a trigger's COMMIT had stored. The catalog reads in
+*   CATCH even when the transaction was doomed, once it is rolled back
+*   (measured, the probes before 0041).
+*/
+function writeBatch(parameters, { target, definition, operation, statement, assigned, returned, afterWrite }) {
+	const guarded = assigned.flatMap(({ value, sql }, index) => value.type.kind === "text" && value.value !== null ? [{
+		value,
+		sql,
+		index
+	}] : []);
+	const stored = guarded.map(({ value }, position) => ({
+		name: `[w${String(position)}]`,
+		declared: "nvarchar(max)",
+		expression: canonicalText(value.type, `inserted.${quoteName(value.name)}`)
+	}));
+	const refind = operation === "DELETE" ? {
+		captured: [],
+		declared: [],
+		statements: []
+	} : versionAfterTriggers(target);
+	const table = tableName(parameters, target.table);
+	const moved = definitionGuard(table, parameters.add(mssql.VarBinary(32), definition));
+	const captured = [
+		...returned,
+		...stored,
+		...refind.captured
+	];
+	const output = `output ${captured.map((column) => column.expression).join(", ")} into @written (${captured.map((column) => column.name).join(", ")})`;
+	const checks = guarded.map(({ sql, index }, position) => `if exists (select 1 from @written where not (${exactText(`[w${String(position)}]`, sql)})) throw ${String(TEXT_NOT_STORED)}, N'formancy: text not stored as sent: ${String(index)}', 1;`);
+	return [
+		"set nocount on;",
+		"set xact_abort on;",
+		`declare @written table (${captured.map((column) => `${column.name} ${column.declared}`).join(", ")});`,
+		"declare @transaction bigint, @rows int, @ended bit, @d varbinary(32);",
+		...refind.declared,
+		"begin try",
+		"begin transaction;",
+		"set @transaction = current_transaction_id();",
+		`${statement(output)};`,
+		"set @rows = @@rowcount;",
+		`if coalesce(current_transaction_id(), 0) <> @transaction throw ${String(TRANSACTION_REPLACED)}, N'${TRANSACTION_REPLACED_MESSAGE}', 1;`,
+		...moved,
+		insteadOfGuard(table, operation),
+		...afterWrite,
+		...checks,
+		...refind.statements,
+		"commit transaction;",
+		"end try",
+		"begin catch",
+		"set @ended = case when coalesce(current_transaction_id(), 0) <> @transaction then 1 else 0 end;",
+		"if @@trancount > 0 rollback transaction;",
+		`if @ended = 1 and error_number() <> 3609 and not (error_number() = ${String(TRANSACTION_REPLACED)} and error_message() = N'${TRANSACTION_REPLACED_MESSAGE}') throw ${String(TRANSACTION_ENDED)}, N'${TRANSACTION_ENDED_MESSAGE}', 1;`,
+		"if @ended = 1 throw;",
+		...moved,
+		"throw;",
+		"end catch;",
+		`select ${returned.map((column) => column.name).join(", ")} from @written;`
+	].join("\n");
+}
+/** Exactly the given columns, so a column with a default gets it and a generated one is never named. */
+function insertStatement(request, definition) {
+	const parameters = new Parameters();
+	const assigned = request.values.map((value) => ({
+		value,
+		sql: bindValue(parameters, value.type, value.value)
+	}));
+	const table = quoteTable(request.target.table);
+	const columns = assigned.map(({ value }) => quoteName(value.name)).join(", ");
+	const values = assigned.map(({ sql }) => sql).join(", ");
+	const sql = writeBatch(parameters, {
+		target: request.target,
+		definition,
+		operation: "INSERT",
+		statement: (output) => assigned.length === 0 ? `insert into ${table} ${output} default values` : `insert into ${table} (${columns}) ${output} values (${values})`,
+		assigned,
+		returned: selection(request.returning, request.target.concurrency, "inserted."),
+		afterWrite: []
+	});
+	return parameters.statement(sql);
+}
+/** Whether the row's version is still the one expected: a rowversion's 8 bytes, or a version column compared as a bigint. An update's and a delete's (0050). */
+function versionIs(parameters, concurrency, expected) {
+	const version = column(concurrency.column);
+	return expected.kind === "rowversion" ? `${version} = ${parameters.add(mssql.VarBinary(8), expected.bytes)}` : `${version} = convert(bigint, ${parameters.add(mssql.NVarChar(mssql.MAX), expected.value)})`;
+}
+/**
+* ONE guarded statement (0015): the key, the trusted filters, every through
+* (0043) and the expected version in a single WHERE, and for a version column
+* the increment in the same SET, so nothing can change between the check and
+* the write. A row the filters or a through exclude is not matched, so another
+* tenant's record cannot be changed even with its current version in hand.
+* More than one row matched means the identity is not a key, and the batch
+* rolls back rather than change several. The table is aliased, `update [r]
+* … from <table> as [r]`, so that the through's EXISTS can name the row.
+*/
+function updateStatement(request, terms, through, expected, definition) {
+	const parameters = new Parameters();
+	const { target } = request;
+	const assigned = request.set.map((value) => ({
+		value,
+		sql: bindValue(parameters, value.type, value.value)
+	}));
+	const set = assigned.map(({ value, sql }) => `${quoteName(value.name)} = ${sql}`);
+	const version = column(target.concurrency.column);
+	if (target.concurrency.kind === "version-column") set.push(`${quoteName(target.concurrency.column)} = ${version} + 1`);
+	const where = [...located(parameters, request.key, terms, through), versionIs(parameters, target.concurrency, expected)];
+	const sql = writeBatch(parameters, {
+		target,
+		definition,
+		operation: "UPDATE",
+		statement: (output) => `update [r] set ${set.join(", ")} ${output} from ${quoteTable(target.table)} as [r] where ${where.join(" and ")}`,
+		assigned,
+		returned: selection(request.returning, target.concurrency, "inserted."),
+		afterWrite: [`if @rows > 1 throw ${String(NOT_ONE_ROW)}, N'${NOT_ONE_ROW_MESSAGE}', 1;`]
+	});
+	return parameters.statement(sql);
+}
+//#endregion
+//#region src/records/delete.ts
+/** sys.foreign_keys' `delete_referential_action` for each action a delete acts through. */
+const ACTION_CODES = {
+	cascade: 1,
+	"set-null": 2,
+	"set-default": 3
+};
+/** A table's name as `object_id` and HAS_PERMS_BY_NAME read it: quoted, and bound. */
+const named$1 = (parameters, table) => tableName(parameters, table);
+/**
+* Whether the account still sees every key that refers to a table the delete
+* reaches, and every key that acts on it is one the reach accepts, as a
+* statement that raises 51707 when either fails (0050, 0051). The planner
+* refuses a grant over any other key by the snapshot (`deleteProblems`);
+* this is the same rule asked of the catalog inside the delete's
+* transaction, so a key added after the form was published is refused
+* there, and whatever its cascade did is rolled back with it.
+*
+* A key that acts on delete -- cascades, sets NULL or sets a default --
+* onto a table the delete removes rows of is accepted only as the reach
+* names it: the table it is on, its name, the table it refers to and its
+* action, the name compared under Latin1_General_100_BIN2, never under the
+* database's collation. A key that refers to a column the delete clears and
+* acts ON UPDATE would carry the change on, and is refused whatever it is.
+*
+* Run after the statement, under its locks: ADD FOREIGN KEY ... REFERENCES
+* a table needs a schema-modification lock, which waits for this
+* transaction. An edge constraint that cascades acts on a delete of a node
+* as such a key does, from either end of each of its clauses (0049, P2b),
+* and sys.foreign_keys does not list it, so sys.edge_constraints is read
+* too; none is ever accepted, since the snapshot names one only as a gap.
+*
+* SQL Server lists a key only to an account that may see the table the key
+* is on (0049, P2), so the catalog alone could miss one. The account sees
+* every key exactly under discovery's own conditions for a snapshot without
+* a `referenced-by` gap -- VIEW DEFINITION on the database, and no VIEW
+* DEFINITION or CONTROL deny on an object or a schema that binds it --
+* shared from `visibility.ts`, so the guard and the gap cannot disagree; an
+* account that lost either since its snapshot is refused, whether or not a
+* key is hidden from it. A disabled key is counted: enabled again, it acts
+* without anything here noticing. sys.foreign_keys is read by the
+* referenced object's id through an index seek (measured on 16.0.4295.3,
+* 2026-10-11, P8); the edge constraints' plan and cost are not measured.
+*/
+function reachGuard(parameters, reach) {
+	const removed = reach.removed.map((table) => `object_id(${named$1(parameters, table)})`).join(", ");
+	const accepted = reach.accepted.length === 0 ? "" : ` and not exists (select 1 from (values ${reach.accepted.map((key) => `(${named$1(parameters, key.from)}, ${parameters.add(mssql.NVarChar(mssql.MAX), key.name)}, ${named$1(parameters, key.onto)}, ${parameters.add(mssql.TinyInt, ACTION_CODES[key.onDelete])})`).join(", ")}) as [a]([from], [key], [onto], [action])
+      where [k].[parent_object_id] = object_id([a].[from]) and [k].[name] = [a].[key] collate Latin1_General_100_BIN2
+        and [k].[referenced_object_id] = object_id([a].[onto]) and [k].[delete_referential_action] = [a].[action])`;
+	const cleared = reach.cleared.flatMap(({ table, columns }) => columns.map((column) => `(${named$1(parameters, table)}, ${parameters.add(mssql.NVarChar(mssql.MAX), column)})`));
+	const followed = cleared.length === 0 ? [] : [
+		`  or exists (select 1 from sys.foreign_keys as [k] join sys.foreign_key_columns as [c] on [c].[constraint_object_id] = [k].[object_id]`,
+		`    join (values ${cleared.join(", ")}) as [x]([table], [column]) on [k].[referenced_object_id] = object_id([x].[table])`,
+		`      and col_name([c].[referenced_object_id], [c].[referenced_column_id]) = [x].[column] collate Latin1_General_100_BIN2`,
+		`    where [k].[update_referential_action] <> 0)`
+	];
+	return [
+		`if coalesce(${VIEWS_DATABASE}, 0) <> 1`,
+		`  or exists (select 1 from sys.database_permissions p where ${DENIED_OBJECTS})`,
+		`  or exists (select 1 from sys.database_permissions p where ${DENIED_SCHEMAS})`,
+		`  or exists (select 1 from sys.foreign_keys as [k] where [k].[referenced_object_id] in (${removed}) and [k].[delete_referential_action] <> 0${accepted})`,
+		`  or exists (select 1 from sys.edge_constraints as [ec] join sys.edge_constraint_clauses as [cl] on [cl].[object_id] = [ec].[object_id]`,
+		`    where ([cl].[from_object_id] in (${removed}) or [cl].[to_object_id] in (${removed})) and [ec].[delete_referential_action] <> 0)`,
+		...followed,
+		`  throw ${String(REACH_MOVED)}, N'${REACH_MOVED_MESSAGE}', 1;`
+	].join("\n");
+}
+/**
+* Whether the account may DELETE from every table past the root the delete
+* reaches, as a statement that raises 51708 when it may not (0051). SQL
+* Server asks the deleting account nothing of the tables a cascade or a SET
+* NULL reaches -- no grant, and a DENY there does not stop it: measured on
+* 16.0.4295.3, 2026-10-12 (0051 P5) -- so the batch asks, and a delete is held
+* to what its account could have deleted directly, as PostgreSQL's lock holds
+* it. HAS_PERMS_BY_NAME applies grants, denies and their precedence; NULL,
+* for a name it cannot resolve, is a refusal. The root's own DELETE is the
+* statement's to refuse, 229, before anything here runs.
+*/
+function reachDeletable(parameters, reach) {
+	const past = [...reach.removed.slice(1), ...reach.cleared.map((entry) => entry.table)];
+	if (past.length === 0) return [];
+	return [`if exists (select 1 from (values ${past.map((table) => `(${named$1(parameters, table)})`).join(", ")}) as [t]([table]) where coalesce(has_perms_by_name([t].[table], N'OBJECT', N'DELETE'), 0) <> 1)`, `  throw ${String(REACH_UNDELETABLE)}, N'${REACH_UNDELETABLE_MESSAGE}', 1;`];
+}
+/**
+* ONE guarded delete (0050): the key, the trusted filters, every through and
+* the expected version in a single WHERE, in the write batch, so nothing can
+* change between the check and the delete and nothing it did outlives a
+* check that fails. OUTPUT ... INTO the batch's table variable returns the
+* key and the version the row was deleted at, the root's row alone -- not a
+* row a cascade deleted, measured (0051 P5); an AFTER DELETE trigger runs
+* before the checks, and what it does is the database's (0050). After the
+* statement, in order: the transaction is still the batch's, the definition
+* is the one the delete was decided over (0041), no INSTEAD OF DELETE
+* trigger decided it, the reach is what the delete was decided over and
+* visible (`reachGuard`), the account may delete from every table of it
+* (`reachDeletable`, 0051), and one row or none was deleted -- more is an
+* identity that is not a key, and the batch rolls back rather than delete
+* several.
+*/
+function deleteStatement(request, terms, expected, definition) {
+	const parameters = new Parameters();
+	const { target } = request;
+	const where = [...located(parameters, terms.key, terms.terms, terms.through), versionIs(parameters, target.concurrency, expected)];
+	const sql = writeBatch(parameters, {
+		target,
+		definition,
+		operation: "DELETE",
+		statement: (output) => `delete [r] ${output} from ${quoteTable(terms.root)} as [r] where ${where.join(" and ")}`,
+		assigned: [],
+		returned: selection(target.identity, target.concurrency, "deleted."),
+		afterWrite: [
+			reachGuard(parameters, terms.reach),
+			...reachDeletable(parameters, terms.reach),
+			`if @rows > 1 throw ${String(NOT_ONE_ROW)}, N'${NOT_ONE_ROW_MESSAGE}', 1;`
+		]
+	});
+	return parameters.statement(sql);
+}
+//#endregion
+//#region src/records/errors.ts
+const UNIQUE_KEY = /^Violation of (?:PRIMARY KEY|UNIQUE KEY) constraint '(.+?)'\. Cannot insert duplicate key in object '/;
+const UNIQUE_INDEX = /^Cannot insert duplicate key row in object '.+?' with unique index '(.+?)'\. The duplicate key value is /;
+/** A foreign key to its own table is FOREIGN KEY SAME TABLE for a reference to no row, SAME TABLE REFERENCE for a row still referenced. */
+const CONFLICT = /^The [A-Z]+ statement conflicted with the (FOREIGN KEY(?: SAME TABLE)?|(?:SAME TABLE )?REFERENCE|CHECK) constraint "(.+?)"\. The conflict occurred in /;
+/** Every translation of 547 keeps these SQL keywords: checked by hand in the 34 languages of SQL Server 2022 on 2026-10-09, and in German by the failures suite. */
+const FOREIGN_KEY_WORDS = /\b(?:FOREIGN KEY|REFERENCE)\b/;
+const NULL_COLUMN = /^Cannot insert the value NULL into column '(.+?)', table '/;
+const TRUNCATED_COLUMN = /^String or binary data would be truncated in table '.+?', column '(.+?)'\. Truncated value: /;
+const DENIED_COLUMN = /^The [A-Z ]+ permission was denied on the column '(.+?)' of the object '/;
+const INVALID_COLUMN = /^Invalid column name '(.+)'\.$/;
+/** Conversions and overflows: a value the codec accepted and the column, or the column's type, could not hold. */
+const OUT_OF_RANGE = /* @__PURE__ */ new Set([
+	220,
+	232,
+	244,
+	245,
+	248,
+	8114,
+	8115
+]);
+/**
+* A column the database writes itself, which a binding named for a write: an
+* identity (544 on insert, 8102 on update), a computed column (271), a
+* rowversion (273 on insert, 272 on update — measured, not 273 for both), a
+* GENERATED ALWAYS column such as a system-versioning period's start or end
+* (13536 on insert, 13537 on update). A
+* binding comes to name one when the column became one after discovery, so
+* it is `schema-changed`, as PostgreSQL's 428C9 is (C8, 0028). The parity
+* suite provokes every number here.
+*/
+const GENERATED_COLUMN = /* @__PURE__ */ new Set([
+	544,
+	8102,
+	271,
+	273,
+	272,
+	13536,
+	13537
+]);
+/**
+* The refusals SQL Server documents as passing, and the only `unavailable`
+* ones. 1205, a deadlock victim, and 3906, a database switched to read-only,
+* are provoked by the parity suite; the others are by documentation, not
+* provoked.
+*/
+const PASSING = /* @__PURE__ */ new Set([
+	1205,
+	1222,
+	1204,
+	701,
+	8645,
+	8651,
+	9002,
+	1105,
+	3960,
+	3906,
+	976,
+	983
+]);
+/** The first number SQL Server leaves to users: THROW's and RAISERROR's own. */
+const FIRST_USER_ERROR = 5e4;
+function named(pattern, message) {
+	return pattern.exec(message)?.[1];
+}
+function failure(code, message, names = {}) {
+	return {
+		ok: false,
+		code,
+		...names.column === void 0 ? {} : { column: names.column },
+		...names.constraint === void 0 ? {} : { constraint: names.constraint },
+		message
+	};
+}
+/**
+* Error 547 is a foreign key and a check alike; which one is the constraint
+* the message names. In English the message says so in a fixed sentence; in
+* any other language the kind is the SQL keyword the translation keeps, and
+* the name is left out because its quoting differs per language.
+*/
+function constraintConflict(message) {
+	const match = CONFLICT.exec(message);
+	const kind = match?.[1];
+	return (kind === void 0 ? FOREIGN_KEY_WORDS.test(message) : kind !== "CHECK") ? failure("foreign-key-violation", "SQL Server refused the write: a foreign key has no row to reference, or a referenced row is still referenced (547).", { constraint: match?.[2] }) : failure("check-violation", "SQL Server refused the write: a check constraint does not accept a value (547).", { constraint: match?.[2] });
+}
+/** A trigger ended the transaction the write ran in. Whether by COMMIT or by ROLLBACK, nothing the batch can read says. */
+const ENDED_BY_TRIGGER = "it may have committed, and it is not retried.";
+/**
+* The write batch's own errors (statements.ts), recognised by number AND
+* message: a customer's trigger may THROW the same number, and its error is
+* then an unrecognised refusal like any other.
+*
+* - An INSTEAD OF trigger that decides the write is `refused`: the batch
+*   rolled it back, and the same write would be refused again (0028). Not
+*   `schema-changed`, which would claim a binding names something gone, and
+*   send someone to a drift review that cannot show a trigger (0017).
+* - A transaction a trigger replaced is `unknown-outcome`: it may have
+*   committed the write before beginning another. So is one a trigger ended
+*   and then raised an error in: the error is not a refusal of a write the
+*   COMMIT stored (0031).
+* - A table whose definition moved is `schema-changed` (0041): the batch
+*   found, after its statement or in CATCH, that the table is not the one
+*   the write was decided over, and rolled it back. So is a delete whose
+*   reach moved, or whose account no longer sees every key (0050).
+*/
+function ownError(error, written) {
+	if (error.number === 51702 && error.message === "formancy: the identity matched more than one row") throw new Error("The record identity matched more than one row, so the update was rolled back: the bindings do not name a key.");
+	if (error.number === 51703 && error.message === "formancy: an INSTEAD OF trigger decides what this write stores") return failure("refused", "An INSTEAD OF trigger would decide what this write stores, so the adapter refused it; nothing was written.");
+	if (error.number === 51704 && error.message === "formancy: a trigger ended the transaction of the write and began another") return failure("unknown-outcome", `A trigger ended the transaction of the write and began another; ${ENDED_BY_TRIGGER}`);
+	if (error.number === 51705 && error.message === "formancy: a trigger ended the transaction of the write and then raised an error") return failure("unknown-outcome", `A trigger ended the transaction of the write and then raised an error; ${ENDED_BY_TRIGGER}`);
+	if (error.number === 51706 && error.message === "formancy: table definition moved") return failure("schema-changed", "The table's definition is not the one this write was decided over; nothing was written.");
+	if (error.number === 51707 && error.message === "formancy: what refers to the table moved") return failure("schema-changed", "A foreign key now acts on this delete that it was not decided over, or this account can no longer see every key that refers to a table it reaches; nothing was deleted.");
+	if (error.number === 51708 && error.message === "formancy: this account may not delete from a table the delete reaches") return failure("permission-denied", "This account may not DELETE from a table this delete reaches, so the delete was refused and rolled back; nothing was deleted.");
+	const index = error.number === 51701 ? TEXT_NOT_STORED_MESSAGE.exec(error.message)?.[1] : void 0;
+	if (index === void 0) return void 0;
+	return failure("out-of-range", "SQL Server did not store this text as sent: its code page lacks a character, or the column drops trailing spaces, and the write was rolled back.", { column: written[Number(index)]?.name });
+}
+/**
+* A refusal the server reported for this statement, which therefore did not
+* commit: the write batch rolls back on every error it is told of, a
+* trigger's RAISERROR included, and on the errors it cannot catch xact_abort
+* does (statements.ts). Except 3609: a trigger ended the write's transaction
+* itself, and SQL Server raises it alike after a COMMIT, which stored the
+* write, and after a ROLLBACK, which did not. A trigger that commits and then
+* raises an error of its own never reaches here as that error: the batch's
+* CATCH sees its transaction gone and raises its own instead (statements.ts,
+* 0031).
+*/
+function refusal(error, written) {
+	const own = ownError(error, written);
+	if (own !== void 0) return own;
+	const { number, message } = error;
+	switch (number) {
+		case 3609: return failure("unknown-outcome", `A trigger ended the transaction of the write (3609); ${ENDED_BY_TRIGGER}`);
+		case 2627:
+		case 2601: return failure("unique-violation", `SQL Server refused the write: a unique key already holds this value (${String(number)}).`, { constraint: named(number === 2627 ? UNIQUE_KEY : UNIQUE_INDEX, message) });
+		case 547: return constraintConflict(message);
+		case 515: return failure("not-null-violation", "SQL Server refused the write: a column that does not allow NULL was given none (515).", { column: named(NULL_COLUMN, message) });
+		case 2628: return failure("too-long", "SQL Server refused the write: a value is longer than its column (2628).", { column: named(TRUNCATED_COLUMN, message) });
+		case 8152: return failure("too-long", "SQL Server refused the write: a value is longer than its column (8152).");
+		case 229:
+		case 230: return failure("permission-denied", `SQL Server refused this account the operation (${String(number)}).`, { column: named(DENIED_COLUMN, message) });
+		case 33504: return failure("permission-denied", "A security policy on this table refused the row this write would store (33504).");
+		case 207:
+		case 208: return failure("schema-changed", `A table or column the binding names is not there any more (${String(number)}).`, { column: named(INVALID_COLUMN, message) });
+		default:
+			if (OUT_OF_RANGE.has(number)) return failure("out-of-range", `SQL Server could not hold a value in its column's type (${String(number)}).`);
+			if (GENERATED_COLUMN.has(number)) return failure("schema-changed", `A column the binding writes is one SQL Server now generates itself (${String(number)}); nothing was written.`);
+			if (PASSING.has(number)) return failure("unavailable", `SQL Server could not complete this now (${String(number)}), and nothing was written.`);
+			if (number >= FIRST_USER_ERROR) return failure("refused", `The database refused the statement with an error of its own (${String(number)}), a trigger's or a procedure's, and nothing was written.`);
+			return failure("refused", `SQL Server refused the statement with error ${String(number)}, and nothing was written.`);
+	}
+}
+/**
+* A refusal SQL Server reported for the statement, with the connection still
+* alive — severity 20 and above end the session.
+*
+* `typeof number === 'number'` is the test, not `number !== undefined`: when
+* the driver's error has no `info` — a socket that closed, a request that
+* timed out — mssql's lib/error/request-error.js copies its `code` into
+* `number`, so a lost answer is a `RequestError` whose number is the string
+* `'ECONNRESET'` or `'ETIMEOUT'`. Read as a number, it would be a refusal,
+* `refused`, a claim that nothing was written over a write that may have
+* committed. records-lost-answer.integration.test.ts pins both (0031).
+*/
+function serverError(error) {
+	const { number, class: severity } = error;
+	if (error.name !== "RequestError" || typeof number !== "number") return void 0;
+	if (typeof severity === "number" && severity >= 20) return void 0;
+	return {
+		number,
+		message: error.message
+	};
+}
+/**
+* The failure for what the driver rejected one statement with.
+*
+* - Anything but a `RequestError` is the pool's, from before it handed out a
+*   connection: `mssql` turns every failure after that into a `RequestError`
+*   (lib/tedious/request.js), and before it passes on what the pool rejected
+*   with — its own `ConnectionError` for a pool that is closed or cannot
+*   connect, and tarn's `TimeoutError`, unwrapped, when no connection came
+*   free within `acquireTimeoutMillis`. Nothing was sent, so even a write is
+*   `unavailable`.
+* - The server refused the statement: the code for its error number.
+* - Any other `RequestError` — a timeout, a socket that closed, a session
+*   killed (596, severity 21) — after a write was sent is `unknown-outcome`: it
+*   may have committed, and it is never retried (plan section 12). After a
+*   read it is `unavailable`, because a read changed nothing.
+*
+* A request the driver would not take is thrown before it is sent, and never
+* reaches this. `written` is the values the statement assigned, in its order,
+* so a text value that was not stored can be named.
+*/
+function failureFor(error, phase, written = []) {
+	if (!(error instanceof Error)) throw error;
+	if (error.name !== "RequestError") return failure("unavailable", "SQL Server could not be reached, or no connection came free in time, and nothing was sent.");
+	const server = serverError(error);
+	if (server !== void 0) return refusal(server, written);
+	return phase === "write" ? failure("unknown-outcome", "The connection failed after the write was sent; it may have committed. It is not retried.") : failure("unavailable", "The connection failed during the read, which changed nothing.");
+}
+//#endregion
+//#region src/records/list.ts
+/**
+* One page of a form's records on SQL Server (0044), with the table as this
+* same statement found it (0041), in one statement -- which holds a
+* schema-stability lock on the table while it runs, as a read does, so no
+* ALTER lands between the facts and the page:
+*
+*   select <description, on the page's first row>, [page].*
+*   from (select <the table's facts> as [facts]) as [f]
+*   outer apply (
+*     select 1 as [found], [c0], …, [version], row_number() over (order by <order>) as [n]
+*     from <table> as [r] where <parent> and <filters> and <throughs> and <search>
+*     order by <order> offset @o rows fetch next @l rows only
+*   ) as [page]
+*   order by [page].[n]
+*
+* One row with a NULL `[found]` when the page is empty, so the description is
+* answered either way, as a read's is. The rows of an APPLY have no order of
+* their own, so each carries its position in the page's order -- which is
+* total, the key ending it, so the position is the order -- and the
+* statement is ordered by it. The description is selected once, on the
+* page's first row, whose position is `offset + 1`: repeated, it would send
+* the table's catalog facts once per record.
+*
+* The parent's columns compare with `=`, as the foreign key does, each value
+* bound as its column's type, as a key is; the filters, the throughs and the
+* search are a read's and a lookup's own spellings (`statements.ts`,
+* `sql/search.ts`). A nullable column's NULLs are placed by a CASE before it
+* in the order, and a NOT NULL column is ordered bare, so an index on it can
+* serve the order (`sql/order.ts`). `limit + 1` rows, so `recordPage` can
+* tell whether more follow without a COUNT.
+*/
+function listStatement(request, terms) {
+	const parameters = new Parameters();
+	const { columns, from } = described(parameters, request.target.table);
+	const where = [
+		...keyPredicates(parameters, terms.equal),
+		...filterPredicates(parameters, terms.terms),
+		...terms.through.map((entry) => throughPredicate(parameters, entry))
+	];
+	if (terms.search !== null) where.push(searchPredicate(parameters, "[r]", terms.search.columns, terms.search.text));
+	const order = orderBy("[r]", terms.sort);
+	const offset = parameters.add(mssql.BigInt, terms.offset);
+	const fetch = parameters.add(mssql.Int, terms.limit + 1);
+	const first = parameters.add(mssql.BigInt, terms.offset + 1);
+	const page = [
+		`select ${[...selection(request.columns, request.target.concurrency, `[r].`).map((selected) => `${selected.expression} as ${selected.name}`), `row_number() over (order by ${order}) as [n]`].join(", ")} from ${quoteTable(request.target.table)} as [r]`,
+		where.length > 0 ? `where ${where.join(" and ")}` : "",
+		`order by ${order} offset ${offset} rows fetch next ${fetch} rows only`
+	].filter((part) => part !== "").join(" ");
+	const once = columns.map((column) => `case when [page].[n] is null or [page].[n] = ${first} then ${column.expression} end as ${column.name}`);
+	return parameters.statement(`select ${once.join(", ")}, [page].* from ${from} outer apply (${page}) as [page] order by [page].[n]`);
+}
+//#endregion
+//#region src/records/records.ts
+const NOT_FOUND = {
+	ok: false,
+	code: "not-found",
+	message: "No such record is visible to this request."
+};
+const STALE = {
+	ok: false,
+	code: "stale",
+	message: "The record has changed since it was read."
+};
+/** The table moved under an update that matched nothing, or that was never sent (0041). */
+const DEFINITION_MOVED = {
+	ok: false,
+	code: "schema-changed",
+	message: "The table's definition is not the one this write was decided over; nothing was written."
+};
+/** An object the catalog does not show this account as discovery describes one: gone, out of sight, or not a table or a view. Which, drift review says (0010). */
+const NOT_DESCRIBED = {
+	ok: false,
+	code: "schema-changed",
+	message: "The catalog does not show this table as discovery describes one."
+};
+/** The facts arrived shorter than they were hashed: a TEXTSIZE the connection set. Nothing can be decided over them. */
+const CUT = {
+	ok: false,
+	code: "unavailable",
+	message: "The table's description arrived cut short, so nothing can be decided over it: the connection's TEXTSIZE is smaller than the description."
+};
+/** The largest bigint: a version column's token is compared as one. */
+const BIGINT_MAX = 9223372036854775807n;
+const CANONICAL_INTEGER = /^-?(?:0|[1-9][0-9]*)$/;
+function names(values) {
+	return values.map((value) => value.name);
+}
+/**
+* The key names exactly the target's identity, each column once. Anything
+* else could match several records — or, with no identity at all, every
+* record — so it is a programming error, refused before anything is sent.
+*/
+function checkKey(target, key) {
+	const identity = names(target.identity);
+	const given = names(key);
+	if (identity.length === 0 || given.length !== identity.length || new Set(given).size !== given.length || !identity.every((name) => given.includes(name))) throw new Error(`A record key names exactly its identity (${identity.join(", ")}), and this one names (${given.join(", ")})`);
+}
+/** The values a write assigns: each column once, which SQL Server would otherwise refuse with an error that is not a refusal. */
+function checkAssigned(values, reserved) {
+	const given = names(values);
+	if (new Set(given).size !== given.length) throw new Error("A write names each column once");
+	if (reserved !== null && given.includes(reserved)) throw new Error(`${reserved} is the concurrency column; the database or the adapter writes it`);
+}
+/**
+* The version as it is compared, or `undefined` for a token no record can
+* hold — not 16 lower-case hex digits for a rowversion, not a canonical
+* integer within bigint for a version column. Such a token is never bound; it
+* gets the answer a token that does not match gets.
+*/
+function expectedVersion(concurrency, token) {
+	if (concurrency.kind === "rowversion") {
+		const bytes = decodeRowversion(token);
+		return bytes === void 0 ? void 0 : {
+			kind: "rowversion",
+			bytes: Buffer.from(bytes)
+		};
+	}
+	if (typeof token !== "string" || !CANONICAL_INTEGER.test(token) || token === "-0") return void 0;
+	const value = BigInt(token);
+	return value > BIGINT_MAX || value < -9223372036854775807n - 1n ? void 0 : {
+		kind: "version-column",
+		value: token
+	};
+}
+/** The token for the version a row came back with: `encodeRowversion`'s hex, or a version column's decimal string. */
+function versionToken(concurrency, row) {
+	if (concurrency === null) return null;
+	const version = row.version;
+	if (concurrency.kind === "rowversion") {
+		if (!(version instanceof Uint8Array)) throw new Error(`${concurrency.column} did not come back as a rowversion`);
+		return encodeRowversion(version);
+	}
+	if (typeof version !== "string") throw new Error(`${concurrency.column} did not come back as a version`);
+	return version;
+}
+function recordFrom(row, columns, concurrency) {
+	return {
+		values: Object.fromEntries(columns.map((column, index) => {
+			const text = row[`c${String(index)}`];
+			return [column.name, fromCanonicalText(column.type, typeof text === "string" ? text : null)];
+		})),
+		version: versionToken(concurrency, row)
+	};
+}
+/** Runs one statement, and turns what the driver rejected it with into a failure. A request it would not even take is thrown. */
+async function attempt(pool, statement, phase, written = []) {
+	const request = prepare(pool, statement);
+	try {
+		return await send(request, statement);
+	} catch (error) {
+		return failureFor(error, phase, written);
+	}
+}
+function onlyRow(rows) {
+	if (rows.length > 1) throw new Error("The record identity matched more than one row: the bindings do not name a key.");
+	return rows[0];
+}
+/**
+* The record half of the SQL Server adapter, through a pool the composition
+* root connected (0015).
+*
+* Values arrive canonical and are bound as text the server converts; they
+* leave as text the server produced (`../sql/values.ts`). Each write is one
+* batch: the statement, a check that its transaction is still the one it
+* began and that no INSTEAD OF trigger decided what it stored, a check that
+* every text value was stored as sent, the version read back from the row
+* once its triggers ran, and a commit, all rolled back on any error — so a
+* single-byte varchar cannot quietly keep `LA` for `ŁA`, neither an INSTEAD
+* OF trigger nor one that swaps the transaction can make a write that was not
+* stored look done, and a refusal is not reported over a write the batch
+* committed. A trigger that ends the transaction itself is `unknown-outcome`,
+* whether or not it then raises an error, because whether it committed cannot
+* be told. A database error is a
+* `RecordFailure`, never thrown; a malformed request — a key that is not the
+* identity, a column named twice, a value no codec returns — is a programming
+* error and is.
+*/
+/** The description a row of `describeStatement` or `readStatement` carries, or why there is none. */
+function describedBy(row) {
+	const facts = row.facts;
+	const digest = row.digest;
+	return describedFrom(typeof facts === "string" ? facts : null, digest instanceof Uint8Array ? Buffer.from(digest) : null);
+}
+function createSqlServerRecords(pool) {
+	return {
+		async describe(table) {
+			const rows = await attempt(pool, describeStatement(table), "read");
+			if (!Array.isArray(rows)) return rows;
+			const described = describedBy(rows[0]);
+			if (described === "cut") return CUT;
+			return described === void 0 ? NOT_DESCRIBED : {
+				ok: true,
+				described
+			};
+		},
+		async read(request) {
+			const terms = rowFilterTerms(request.filters);
+			const through = throughTerms(request.through);
+			checkKey(request.target, request.key);
+			const rows = await attempt(pool, readStatement(request, terms, through), "read");
+			if (!Array.isArray(rows)) return rows;
+			const row = onlyRow(rows);
+			const described = describedBy(row);
+			if (described === "cut") return CUT;
+			if (described === void 0) return NOT_DESCRIBED;
+			return {
+				ok: true,
+				described,
+				record: row.found === null ? null : recordFrom(row, request.columns, request.target.concurrency)
+			};
+		},
+		async list(request) {
+			const rows = await attempt(pool, listStatement(request, listTerms(request)), "read");
+			if (!Array.isArray(rows)) return rows;
+			const described = describedBy(rows[0]);
+			if (described === "cut") return CUT;
+			if (described === void 0) return NOT_DESCRIBED;
+			return {
+				ok: true,
+				described,
+				rows: rows.filter((row) => row.found !== null).map((row) => recordFrom(row, request.columns, request.target.concurrency))
+			};
+		},
+		async insert(request) {
+			checkAssigned(request.values, null);
+			const rows = await attempt(pool, insertStatement(request, definitionBytes(request.definition)), "write", request.values);
+			if (!Array.isArray(rows)) return rows;
+			const row = rows[0];
+			if (row === void 0) throw new Error("SQL Server reported no inserted row");
+			return {
+				ok: true,
+				...recordFrom(row, request.returning, request.target.concurrency)
+			};
+		},
+		async update(request) {
+			const { target } = request;
+			const terms = rowFilterTerms(request.filters);
+			const through = throughTerms(request.through);
+			checkKey(target, request.key);
+			if (request.set.length === 0) throw new Error("An update sets at least one column");
+			checkAssigned(request.set, target.concurrency.column);
+			const definition = definitionBytes(request.definition);
+			const expected = expectedVersion(target.concurrency, request.expectedVersion);
+			if (expected !== void 0) {
+				const rows = await attempt(pool, updateStatement(request, terms, through, expected, definition), "write", request.set);
+				if (!Array.isArray(rows)) return rows;
+				const row = onlyRow(rows);
+				if (row !== void 0) return {
+					ok: true,
+					...recordFrom(row, request.returning, target.concurrency)
+				};
+			}
+			const found = await attempt(pool, existsStatement(request, terms, through, definition), "read");
+			if (!Array.isArray(found)) return found;
+			if (Number(found[0]?.same ?? 0) !== 1) return DEFINITION_MOVED;
+			return Number(found[0]?.found ?? 0) > 0 ? STALE : NOT_FOUND;
+		},
+		async delete(request) {
+			const { target } = request;
+			const terms = deleteTerms(request);
+			checkKey(target, terms.key);
+			const definition = definitionBytes(request.definition);
+			const expected = expectedVersion(target.concurrency, terms.expectedVersion);
+			if (expected !== void 0) {
+				const rows = await attempt(pool, deleteStatement(request, terms, expected, definition), "write");
+				if (!Array.isArray(rows)) return rows;
+				const row = onlyRow(rows);
+				if (row !== void 0) {
+					const removed = recordFrom(row, target.identity, target.concurrency);
+					return {
+						ok: true,
+						deleted: {
+							values: removed.values,
+							version: removed.version
+						}
+					};
+				}
+			}
+			const found = await attempt(pool, existsStatement({
+				target,
+				key: terms.key
+			}, terms.terms, terms.through, definition), "read");
+			if (!Array.isArray(found)) return found;
+			if (Number(found[0]?.same ?? 0) !== 1) return DEFINITION_MOVED;
+			return Number(found[0]?.found ?? 0) > 0 ? STALE : NOT_FOUND;
+		}
+	};
+}
+//#endregion
+//#region src/connect.ts
+/**
+* A connected pool, from this package's own copy of mssql.
+*
+* Why the adapter package opens its own connections: mssql's parameter types
+* are objects tedious checks by identity, and this package binds every value
+* with `mssql.NVarChar` and friends from ITS copy. A pool built from another
+* copy — two installs of mssql@12.7.4 that differ only in which supports-color
+* satisfied an optional peer, which is exactly what pnpm produced for the
+* server — refuses every parameter with "type.validate is not a function".
+* Found by the end-to-end suite; no unit test could see it. Opening the pool
+* here means the pool and the types always come from one copy.
+*/
+function connectSqlServer(options) {
+	return new mssql.ConnectionPool({
+		server: options.host,
+		port: options.port,
+		database: options.database,
+		user: options.user,
+		password: options.password,
+		options: {
+			encrypt: options.encrypt,
+			trustServerCertificate: options.trustServerCertificate
+		}
+	}).connect();
+}
+//#endregion
+export { connectSqlServer, createSqlServerAdapter, createSqlServerLookups, createSqlServerRecords, discoverSqlServer };
+
+//# sourceMappingURL=index.mjs.map