@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g1822133

package/dist/index.es.js

@@ -2,16 +2,18 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
-import { A as toSnakeCase, C as normalizeToEntityRelation, D as getPolicyNamesForRule, F as Vector, N as hasForeignKeyOnTarget, O as mergeDeep, P as isManyToMany, S as createRelationRefWithData, T as generateForeignKeyName, _ as buildCompositeId, a as getJunctionSecurityRules, b as parseIdValues, c as policyToPostgres, d as findRelation, f as getColumnName, g as resolveCollectionRelations, h as getTableVarName, i as getJunctionCollectionConfig, k as camelCase, l as securityRuleToConditions, m as getTableName$1, n as CollectionRegistry, o as resolveJunctionSpecs, p as getEnumVarName, r as resolveStringColumnLength, s as getEffectiveSecurityRules, t as buildSdkData, u as findAnonymousGrants, v as getDeclaredPrimaryKeys, w as updateDateAutoValues, x as createRelationRef, y as isAddressableId } from "./src-DlPBctw_.js";
-import { n as isPostgresCollectionConfig, r as isRelationalCollectionConfig } from "./src-DoU9yPqq.js";
-import { t as ANONYMOUS_USER_ID } from "./policy-CeA1JcxP.js";
-import { t as createPostgresWebSocket } from "./websocket-B2LsrINK.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-CD8o_1Sl.js";
+import { n as resolveClientListLimit, t as ListLimitError } from "./data_driver-ULAyJEi9.js";
+import { A as getEnumVarName, B as createRelationRefWithData, C as getEffectiveSecurityRules, D as fieldKeyForColumn, F as getDeclaredPrimaryKeys, G as legacyForeignKeyName, H as updateDateAutoValues, I as isAddressableId, J as getPolicyNamesForRule, L as parseIdValues, M as getTableVarName, N as resolveCollectionRelations, O as findRelation, P as buildCompositeId, Q as toSnakeCase, R as sortCollectionsBySlug, S as resolveJunctionSpecs, T as securityRuleToConditions, U as firstFreeKey, V as normalizeToEntityRelation, W as generateForeignKeyName, X as mergeDeep, Y as isPrototypePollutingKey, Z as camelCase, _ as CollectionRegistry, b as getJunctionCollectionConfig, g as buildSdkData, h as visibleColumnProjection, j as getTableName$1, k as getColumnName, l as buildSearchColumnSpec, nt as isManyToMany, q as toWireKey, r as authUsersColumnSql, rt as Vector, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as hasForeignKeyOnTarget, u as hiddenColumnsOption, v as relationalCollections, w as policyToPostgres, x as getJunctionSecurityRules, y as resolveStringColumnLength, z as createRelationRef } from "./auth-users-columns-BfQHf9JE.js";
+import { c as isPostgresCollectionConfig, f as ALL_WHERE_FILTER_OPS, l as isRelationalCollectionConfig } from "./src-DCdn3Val.js";
+import { t as createPostgresWebSocket } from "./websocket-C8ZqVBiV.js";
+import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-BJ_3wxwg.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-BH0Dzo_h.js";
+import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-69hYT8nr.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
-import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, or, relations, sql } from "drizzle-orm";
-import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
+import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, notInArray, or, relations, sql } from "drizzle-orm";
+import { PgArray, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs, { promises } from "fs";
 import path from "path";
 import chokidar from "chokidar";
@@ -30,25 +32,6 @@ import { randomUUID } from "crypto";
 function isChannelBusInstance(setting) {
 	return typeof setting?.publish === "function";
 }
-/**
-* Resolve a client-supplied list `limit` into a safe, always-defined value.
-*
-* - A provided limit is coerced to an integer and clamped to `[1, maxLimit]`,
-*   so `0`, negatives, and absurd values can never bypass the cap.
-* - An absent / blank / non-numeric limit falls back to the mode default:
-*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
-*
-* The return is never `undefined` — no ingress that routes its client limit
-* through this can produce an unbounded read.
-*/
-function resolveClientListLimit(rawLimit, opts = {}) {
-	const maxLimit = opts.maxLimit ?? 1e3;
-	if (rawLimit != null && String(rawLimit).trim() !== "") {
-		const parsed = typeof rawLimit === "number" ? rawLimit : parseInt(String(rawLimit), 10);
-		if (Number.isFinite(parsed)) return Math.min(Math.max(1, Math.floor(parsed)), maxLimit);
-	}
-	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
-}
 //#endregion
 //#region ../common/src/util/email.ts
 /**
@@ -152,6 +135,27 @@ var buildPropertyCallbacks = (properties) => {
 	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
 };
 //#endregion
+//#region ../common/src/data/filter-conditions.ts
+/**
+* Read one field's filter as the list of conditions it stands for.
+*
+* Accepts both declared shapes and normalises them to a list:
+*
+* ```ts
+* toFilterTuples(["==", "active"])          // [["==", "active"]]
+* toFilterTuples([[">=", 18], ["<", 65]])   // [[">=", 18], ["<", 65]]
+* ```
+*
+* A falsy, non-array or empty param has no conditions in it — the empty list,
+* so a caller iterating adds nothing rather than compiling a tuple of
+* `undefined`s and logging about an operator nobody sent.
+*/
+function toFilterTuples(filterParam) {
+	if (!filterParam || !Array.isArray(filterParam) || filterParam.length === 0) return [];
+	if (Array.isArray(filterParam[0])) return filterParam;
+	return [filterParam];
+}
+//#endregion
 //#region ../common/src/table-classification.ts
 /** Schemas that are always considered Rebase-internal. */
 var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
@@ -257,6 +261,55 @@ function getCollectionByPath(collectionPath, registry) {
 	}
 	return collection;
 }
+/**
+* Reject a write naming something that is not a column of the table.
+*
+* Drizzle builds INSERT from `Object.entries(table[Symbol.Columns])` and UPDATE
+* from `Object.keys(tableColumns)`, so a key the table does not carry is not
+* rejected by anything — it is *left out of the statement*. The insert answers
+* 201 having stored nothing under that name; the update, if the key was the
+* only one, builds `update "posts" set  where …` and Postgres raises a syntax
+* error (SQLSTATE 42601), which is neither class 22 nor 23 and so surfaces as a
+* 500 for what is a caller's typo.
+*
+* That makes this the last honest place to check, and the only one every write
+* passes through. `assertKnownWriteFields` in the REST layer checks the same
+* thing against the *config* and is skipped on four paths — `strictWrites:
+* false`, a collection declaring no properties, an auth adapter that owns the
+* body's shape, and a nested route whose target cannot be walked — and it never
+* sees an in-process `rebase.data` write at all.
+*
+* It also gives `strictWrites: false` a truthful implementation. The flag is
+* documented for "a column that really does exist which the config never
+* declared", and skipping the config check alone could not deliver that: the
+* value was dropped a layer later regardless. Skipping the config check and
+* keeping this one does exactly what the flag says — the column must exist,
+* the property need not.
+*/
+function assertWritableColumns(values, table, collectionPath) {
+	const columns = getTableColumns(table);
+	if (!columns || Object.keys(columns).length === 0) return;
+	const unknown = Object.keys(values).filter((key) => !(key in columns));
+	if (unknown.length === 0) return;
+	throw ApiError.badRequest(`'${collectionPath}' has no column${unknown.length > 1 ? "s" : ""} ${unknown.map((key) => `'${key}'`).join(", ")}, so the value${unknown.length > 1 ? "s" : ""} would have been dropped before the statement was built.`, "VALIDATION_UNKNOWN_FIELDS");
+}
+/**
+* A relation whose names do not resolve against the registered schema.
+*
+* Every one of these used to be a `logger.warn` followed by `continue`, so a
+* save reported success for a relation it had not written and a read answered
+* `[]` for one it could not resolve. `assertRelationsResolve` (validate-relations)
+* fails boot on the same defects, which is where they belong — a server that
+* refuses to start is recoverable in a minute. This is the second line, for the
+* paths that assemble a registry by hand, and it exists so that "cannot resolve"
+* is never again reported as "done".
+*
+* @param label  `<collection>.<relation>`
+* @param detail what does not resolve, in terms of the schema
+*/
+function relationMisconfigured(label, detail) {
+	return ApiError.internal(`Relation '${label}' does not resolve against the registered schema: ${detail}. The operation was refused rather than skipped — silently dropping it would report success for a write that never happened, or emptiness for rows that exist. Run \`rebase schema generate\` if the generated schema is older than the database.`, "RELATION_MISCONFIGURED");
+}
 function getTableForCollection(collection, registry) {
 	const tableName = getTableName$1(collection);
 	const table = registry.getTable(tableName);
@@ -348,7 +401,7 @@ function requirePrimaryKeys(collection, registry) {
 * they were *duplicated* and could disagree, not because they existed.
 */
 function sourceKeyField(relation, sourceCollection, registry) {
-	if (relation.sourceKey) return relation.sourceKey;
+	if (relation.sourceKey) return fieldKeyForColumn(sourceCollection, relation.sourceKey);
 	return requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
 }
 /**
@@ -362,7 +415,7 @@ function sourceKeyField(relation, sourceCollection, registry) {
 */
 function joinsOnNaturalKey(relation, sourceCollection, registry) {
 	if (!relation.sourceKey) return false;
-	return relation.sourceKey !== requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
+	return fieldKeyForColumn(sourceCollection, relation.sourceKey) !== requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
 }
 /**
 * Collections whose key the *browser* cannot resolve, and what it will do
@@ -436,6 +489,97 @@ function deriveRowAddress(row, collection, registry) {
 //#endregion
 //#region src/utils/drizzle-conditions.ts
 /**
+* Postgres's own default for `pg_trgm.word_similarity_threshold`. Named here
+* because the fuzzy predicate has to know when the index-backed operator agrees
+* with the collection's declared threshold and when it would narrow too far.
+*/
+var PG_TRGM_WORD_SIMILARITY_DEFAULT = .6;
+/**
+* A user's search term, made safe to drop inside a `%…%` LIKE pattern.
+*
+* The term is already a bind parameter, so this is not about injection. It is
+* about the two things a LIKE metacharacter does when it arrives from a search
+* box:
+*
+*  1. **It changes the query.** `%` and `_` are wildcards, so searching for
+*     `50%` returned every row and `a_c` matched `abc`. Nothing the caller
+*     could type would find a literal `%`.
+*  2. **It is a cost the caller chooses.** Postgres matches LIKE by
+*     backtracking: each `%` re-tries every remaining offset, so
+*     `?searchString=a%a%a%a%a%a%a%b` is polynomial with an attacker-chosen
+*     exponent — evaluated per row, OR-ed across every string property of the
+*     collection, on a sequential scan (a leading `%` cannot use an index), and
+*     the page limit does not bound it because the scan happens first.
+*
+* This is the server-side half of the pattern `like-pattern-redos.test.ts`
+* hardened the offline evaluator against; that test's own note ("the same
+* translation in the Mongo driver hands the expression to the database, where
+* it occupies a server thread instead") describes this call site.
+*
+* Backslash is the default `ESCAPE` character for LIKE, and the pattern is
+* bound rather than interpolated, so a single backslash here reaches the
+* matcher as one. Escaping the escape character first is what keeps a term
+* ending in `\` from swallowing the closing `%`.
+*
+* Note this is a *substring search*, not the `like` filter operator: a caller
+* who wants wildcards has `?title=like.foo%` for that, where the pattern is the
+* documented input.
+*/
+var escapeLikePattern = (value) => value.replace(/[\\%_]/g, (ch) => `\\${ch}`);
+/**
+* The Drizzle column a relation's column name addresses on a table.
+*
+* A relation names its link in *column* terms — `localKey: "author_id"`,
+* `foreignKeyOnTarget: "author_id"` — because that is what the database and
+* every FK constraint call it. A Drizzle table is keyed by the *wire* name,
+* `authorId`. Indexing the table with the column, which is what every one of
+* these call sites used to do, therefore finds nothing the moment the two
+* differ: for a `columnName`-carrying property that was already true, and it is
+* now true of every derived foreign key.
+*
+* `undefined` rather than a throw: each caller already has a message naming the
+* relation it was resolving, which is worth more than a generic one here.
+*/
+var relationColumn = (table, collection, column) => {
+	const key = fieldKeyForColumn(collection, column);
+	return (key in table ? table[key] : void 0) || void 0;
+};
+/** The target collection of a relation, or `undefined` if its thunk cannot resolve. */
+var targetOf = (relation) => {
+	try {
+		return relation.target();
+	} catch {
+		return;
+	}
+};
+/** Column types `ILIKE '%…%'` is defined on. */
+var ILIKE_SQL_TYPES = /^(text|varchar|character varying|char|character|bpchar|citext)\b/;
+/**
+* Can this column be matched with `ILIKE`?
+*
+* Asked of the column's *declared SQL type*, never with `instanceof`. The
+* previous version tested `column instanceof PgVarchar || … PgText || … PgChar`,
+* and `instanceof` compares class identity: it is only true when the column was
+* constructed by the very same copy of `drizzle-orm` that this module imported.
+*
+* An application's generated schema builds its tables with the app's own
+* `drizzle-orm`, and this driver declares its own dependency on one. When the
+* two ranges do not overlap — an app scaffolded against `^0.44` with a driver
+* asking for `^0.45` — a strict installer gives the driver a second copy, every
+* check returns false, no condition is produced, and the caller compiles that
+* into an impossible `WHERE`. The result is a 200 with an empty page for every
+* search on every collection without a `search` block: the failure looks
+* exactly like "nothing matched". Observed in production, not theorised.
+*
+* `getSQLType()` is a value the column reports about itself, so it crosses
+* module instances the way a class identity cannot. It also happens to fix
+* `citext`, which the `instanceof` list never covered.
+*/
+var supportsILike = (column) => {
+	const sqlType = typeof column?.getSQLType === "function" ? column.getSQLType().toLowerCase() : "";
+	return ILIKE_SQL_TYPES.test(sqlType);
+};
+/**
 * Process-wide default, set once when the driver is constructed.
 *
 * The condition builder is a set of *static* methods reached from a dozen
@@ -493,7 +637,7 @@ function toMembershipList(value) {
 * @example
 * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;
 */
-var DrizzleConditionBuilder = class {
+var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 	/**
 	* Express "reachable from this parent through this relation" as a plain
 	* `WHERE` condition on the target table.
@@ -533,7 +677,7 @@ var DrizzleConditionBuilder = class {
 			}
 			case "hasOne":
 			case "hasMany": {
-				const fkColumn = targetTable[relation.foreignKeyOnTarget];
+				const fkColumn = relationColumn(targetTable, targetOf(relation), relation.foreignKeyOnTarget);
 				if (!fkColumn) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'.`);
 				if (!relation.sourceKey) return eq(fkColumn, parentId);
 				const { table, idColumn } = parent();
@@ -621,14 +765,14 @@ var DrizzleConditionBuilder = class {
 		if (collection) {
 			const relation = resolveCollectionRelations(collection)[field];
 			if (relation?.kind === "belongsTo") {
-				const foreignKey = columnAt(relation.localKey);
+				const foreignKey = relationColumn(table, collection, relation.localKey);
 				if (foreignKey) return {
 					kind: "column",
 					column: foreignKey
 				};
 			}
 			if (relation && (hasForeignKeyOnTarget(relation) || isManyToMany(relation)) && registry && sourceIdColumn) {
-				const correlationColumn = hasForeignKeyOnTarget(relation) && relation.sourceKey ? columnAt(relation.sourceKey) : sourceIdColumn;
+				const correlationColumn = hasForeignKeyOnTarget(relation) && relation.sourceKey ? relationColumn(table, collection, relation.sourceKey) : sourceIdColumn;
 				if (!correlationColumn) throw new Error(`\`sourceKey: "${relation.sourceKey}"\` on relation '${relation.relationName}' is not a column on '${collectionPath}', so a filter on that relation has nothing to correlate against.`);
 				return {
 					kind: "relation",
@@ -638,7 +782,12 @@ var DrizzleConditionBuilder = class {
 				};
 			}
 		}
-		for (const guess of [`${field}_id`, generateForeignKeyName(field)]) {
+		for (const guess of [
+			`${field}Id`,
+			toWireKey(generateForeignKeyName(field)),
+			`${field}_id`,
+			generateForeignKeyName(field)
+		]) {
 			const foreignKey = columnAt(guess);
 			if (foreignKey) return {
 				kind: "column",
@@ -669,8 +818,7 @@ var DrizzleConditionBuilder = class {
 			if (!filterParam) continue;
 			const target = this.resolveFilterTarget(table, field, collectionPath, mode, options);
 			if (!target) continue;
-			const paramsList = Array.isArray(filterParam) && filterParam.length > 0 && Array.isArray(filterParam[0]) ? filterParam : [filterParam];
-			for (const [op, value] of paramsList) {
+			for (const [op, value] of toFilterTuples(filterParam)) {
 				const condition = this.compileFilterTarget(target, op, value, field, collectionPath);
 				if (condition) conditions.push(condition);
 			}
@@ -747,7 +895,7 @@ var DrizzleConditionBuilder = class {
 			const targetCollection = relation.target();
 			const targetTable = registry.getTable(getTableName$1(targetCollection));
 			if (!targetTable) throw new Error(`Table not found for the target of relation '${relation.relationName}' (collection '${targetCollection.slug}')`);
-			const fkColumn = targetTable[relation.foreignKeyOnTarget];
+			const fkColumn = relationColumn(targetTable, targetCollection, relation.foreignKeyOnTarget);
 			if (!fkColumn) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'.`);
 			const targetIdColumn = this.primaryKeyColumn(targetTable);
 			if (!targetIdColumn) throw new Error(`No primary key or "id" column in the target table of relation '${relation.relationName}', so a filter on it has nothing to match against.`);
@@ -899,9 +1047,10 @@ var DrizzleConditionBuilder = class {
 			case "not-ilike": return sql`${column} NOT ILIKE ${String(value)}`;
 			case "is-null": return sql`${column} IS NULL`;
 			case "is-not-null": return sql`${column} IS NOT NULL`;
-			default:
-				logger.warn(`Unsupported filter operation: ${op}`);
-				return null;
+			default: throw ApiError.badRequest(`Unknown filter operator '${op}'. Valid operators: ${ALL_WHERE_FILTER_OPS.join(", ")}.`, "UNKNOWN_FILTER_OPERATOR", {
+				operator: op,
+				validOperators: ALL_WHERE_FILTER_OPS
+			});
 		}
 	}
 	/**
@@ -1098,7 +1247,7 @@ var DrizzleConditionBuilder = class {
 			if (!targetIdCol) throw new Error(`No primary key or "id" column in the target table of relation '${relation.relationName}'.`);
 			return match(targetIdCol);
 		}
-		const foreignKeyCol = targetTable[relation.foreignKeyOnTarget];
+		const foreignKeyCol = relationColumn(targetTable, targetOf(relation), relation.foreignKeyOnTarget);
 		if (!foreignKeyCol) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'. A link through a junction is \`kind: "manyToMany"\`.`);
 		return match(foreignKeyCol);
 	}
@@ -1119,22 +1268,153 @@ var DrizzleConditionBuilder = class {
 		return or(...conditions);
 	}
 	/**
-	* Build search conditions for text fields
+	* Build search conditions for text fields.
+	*
+	* Two shapes, chosen by whether the collection declared a `search` block:
+	*
+	* - **Declared** — one `@@ websearch_to_tsquery` against the generated
+	*   `tsvector` column. Stems, drops stopwords, AND-es the terms, reaches
+	*   inside JSONB and arrays, and uses the GIN index.
+	* - **Not declared** — the original `ILIKE '%term%'` OR-ed across top-level
+	*   string properties, with the term escaped (see {@link escapeLikePattern})
+	*   so it is matched as the literal text the user typed.
+	*
+	* The second is the default and stays the default. A collection that has
+	* not opted in compiles to exactly the SQL it compiled to before this
+	* branch existed, which is the only reason it is safe to have added it.
+	*
+	* `collection` is optional so that the callers which genuinely have no
+	* collection in hand — nested paths, derived views — keep working; without
+	* one there is no `search` block to read and the ILIKE path is correct.
 	*/
-	static buildSearchConditions(searchString, properties, table) {
+	static buildSearchConditions(searchString, properties, table, collection) {
 		const searchConditions = [];
+		const ftsCondition = collection ? DrizzleConditionBuilder.buildFullTextCondition(searchString, table, collection) : void 0;
+		if (ftsCondition) return [ftsCondition];
+		let declaredStringProperties = 0;
 		for (const [key, prop] of Object.entries(properties)) {
 			const p = prop;
 			if (p.type === "string" && !p.enum && p.isId !== "uuid") {
+				declaredStringProperties++;
 				const fieldColumn = table[key];
-				if (fieldColumn) {
-					if (fieldColumn instanceof PgVarchar || fieldColumn instanceof PgText || fieldColumn instanceof PgChar || fieldColumn && typeof fieldColumn === "object" && !("columnType" in fieldColumn)) searchConditions.push(ilike(fieldColumn, `%${searchString}%`));
-				}
+				if (fieldColumn && supportsILike(fieldColumn)) searchConditions.push(ilike(fieldColumn, `%${escapeLikePattern(searchString)}%`));
 			}
 		}
+		if (declaredStringProperties > 0 && searchConditions.length === 0) logger.warn(`[search] "${collection?.slug ?? "collection"}" declares ${declaredStringProperties} string property(ies) but none compiled to a searchable column, so this search can only return nothing. Check that the generated schema's column types are text/varchar/char.`);
 		return searchConditions;
 	}
 	/**
+	* The `@@` predicate for a collection that declared a `search` block, or
+	* undefined for one that did not.
+	*
+	* The query is normalized exactly as the indexed content was — same text
+	* search configuration, same accent folding. Skipping that on the query
+	* side is the subtle way to get a search that matches nothing: the column
+	* would hold `gestion` while the query asked for `gestión`.
+	*
+	* `websearch_to_tsquery` rather than `plainto_tsquery` because it is the
+	* one that behaves the way a search box looks like it should — quoted
+	* phrases, `or`, and a leading `-` to exclude — and because it never throws
+	* on user input, which `to_tsquery` does on so much as a stray parenthesis.
+	*/
+	static buildFullTextCondition(searchString, table, collection) {
+		let spec;
+		try {
+			spec = buildSearchColumnSpec(collection);
+		} catch {
+			return;
+		}
+		if (!spec) return void 0;
+		const column = table[spec.column];
+		if (!column) return;
+		const exact = sql`${column} @@ ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)}`;
+		if (!spec.fuzzy) return exact;
+		const fuzzyColumn = table[spec.fuzzy.column];
+		if (!fuzzyColumn) return exact;
+		const needle = spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`;
+		const similar = sql`public.word_similarity(${needle}, ${fuzzyColumn}) >= ${spec.fuzzy.threshold}`;
+		return sql`(${exact} OR ${spec.fuzzy.threshold > PG_TRGM_WORD_SIMILARITY_DEFAULT ? sql`(${needle} OPERATOR(public.<%) ${fuzzyColumn} AND ${similar})` : similar})`;
+	}
+	/**
+	* `websearch_to_tsquery(<config>, <normalized search string>)`.
+	*
+	* Split out because the ranking expression needs the identical query — a
+	* row ranked against a different tsquery than it was matched against is a
+	* ranking of something else.
+	*/
+	static normalizedTsQuery(searchString, spec) {
+		const normalized = spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`;
+		return sql`websearch_to_tsquery(${spec.language}, ${normalized})`;
+	}
+	/**
+	* A JSONB array of `{ field, snippet }` naming which declared fields matched
+	* and showing the text around each hit — what backs `_matches`.
+	*
+	* A ranked list answers "which rows", never "why this row". For a talent
+	* pool that difference is the product: a candidate surfacing for
+	* "iso 14001" on a *certification* is a different candidate from one whose
+	* bio happens to mention the standard, and the score cannot tell them apart.
+	*
+	* Built as a correlated subquery over a `VALUES` list of the declared
+	* fields, rather than one `CASE` per field, so the shape does not change
+	* with the number of fields and the empty result is a plain `[]`.
+	*
+	* `ts_headline` runs over the same normalized text that was indexed. Over
+	* the *original* text it would find nothing to mark whenever `unaccent` is
+	* on — the query's lexemes are folded and the document's are not — and
+	* would return the text silently unhighlighted. Folded-but-marked beats
+	* pretty-but-inert.
+	*
+	* Undefined when the collection has not opted in, when the column is not on
+	* the table yet, or when the caller did not ask: this costs a `ts_headline`
+	* per field per row and `ts_headline` re-parses the document.
+	*/
+	static buildSearchMatchesExpression(searchString, table, collection) {
+		let spec;
+		try {
+			spec = buildSearchColumnSpec(collection);
+		} catch {
+			return;
+		}
+		if (!spec || spec.fields.length === 0) return void 0;
+		if (!table[spec.column]) return void 0;
+		const query = DrizzleConditionBuilder.normalizedTsQuery(searchString, spec);
+		const config = sql`${spec.language}`;
+		const rows = spec.fields.map((f, i) => sql`(${i}, ${f.path}, ${sql.raw(f.textSql)})`);
+		return sql`(
+            SELECT coalesce(jsonb_agg(s.m ORDER BY f.ord), '[]'::jsonb)
+            FROM (VALUES ${sql.join(rows, sql`, `)}) AS f(ord, path, txt)
+            CROSS JOIN LATERAL (
+                SELECT jsonb_build_object(
+                    'field', f.path,
+                    'snippet', ts_headline(${config}::regconfig, f.txt, ${query},
+                        'StartSel=<mark>,StopSel=</mark>,MaxWords=14,MinWords=1,MaxFragments=1,FragmentDelimiter= … ')
+                ) AS m
+                WHERE to_tsvector(${config}::regconfig, f.txt) @@ ${query}
+            ) s
+        )`;
+	}
+	/**
+	* `ts_rank(<column>, <query>)` for the collection, or undefined when it has
+	* not opted in. This is what backs `orderBy: ["_score", "desc"]`.
+	*/
+	static buildSearchRankExpression(searchString, table, collection) {
+		let spec;
+		try {
+			spec = buildSearchColumnSpec(collection);
+		} catch {
+			return;
+		}
+		if (!spec) return void 0;
+		const column = table[spec.column];
+		if (!column) return void 0;
+		const rank = sql`ts_rank(${column}, ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)})`;
+		if (!spec.fuzzy) return rank;
+		const fuzzyColumn = table[spec.fuzzy.column];
+		if (!fuzzyColumn) return rank;
+		return sql`(${rank} + public.word_similarity(${spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`}, ${fuzzyColumn}))`;
+	}
+	/**
 	* Build a unique field check condition
 	*/
 	static buildUniqueFieldCondition(fieldColumn, value, idColumn, excludeId) {
@@ -1232,10 +1512,19 @@ var DrizzleConditionBuilder = class {
 	* - `orderBy`: SQL expression to ORDER BY distance (ascending = closest first)
 	* - `filter`: optional WHERE clause for distance threshold
 	* - `distanceSelect`: SQL expression for selecting the distance as `_distance`
+	*
+	* `property` is `?vector_search=` off the querystring, so it is an untrusted
+	* *name*, and it used to be looked up straight in the drizzle table object.
+	* Two ways that went wrong, both answering 500 to a malformed request:
+	* `?vector_search=title` built `"title" <=> '[1,2]'::vector`, which the
+	* database rejects with "operator does not exist"; and a table object also
+	* carries non-column keys (`_`, methods), which passed the `if (!column)`
+	* guard and compiled to nonsense. The name is resolved against the table's
+	* actual columns and required to be a `vector` — anything else is the
+	* caller's mistake and gets a 400 that says so.
 	*/
 	static buildVectorSearchConditions(table, vectorSearch) {
-		const column = table[vectorSearch.property];
-		if (!column) throw new Error(`Vector column '${vectorSearch.property}' not found in table`);
+		const column = DrizzleConditionBuilder.resolveVectorColumn(table, vectorSearch.property);
 		if (!Array.isArray(vectorSearch.vector) || vectorSearch.vector.length === 0 || !vectorSearch.vector.every((n) => typeof n === "number" && Number.isFinite(n))) throw new Error("Vector search requires a non-empty array of finite numbers");
 		const vectorLiteral = `'[${vectorSearch.vector.join(",")}]'::vector`;
 		const distanceFn = vectorSearch.distance || "cosine";
@@ -1257,7 +1546,33 @@ var DrizzleConditionBuilder = class {
 			distanceSelect: sql`(${column} ${sql.raw(operator)} ${sql.raw(vectorLiteral)})`
 		};
 	}
+	/**
+	* The `vector` column a request named, or a 400 explaining what it named.
+	*
+	* `getTableColumns` rather than a key lookup: it returns only the columns,
+	* so `_`, `getSQL` and every other property of a drizzle table stop looking
+	* like candidates. The type check is on the *physical* column
+	* (`vector(1536)`) rather than on the declared property, so it holds for an
+	* introspected collection too, where the property carries no Rebase type.
+	*/
+	static resolveVectorColumn(table, property) {
+		const columns = getTableColumns(table);
+		const column = columns?.[property];
+		if (!column) {
+			const known = Object.entries(columns ?? {}).filter(([, c]) => isVectorColumn(c)).map(([name]) => name);
+			throw ApiError.badRequest(`Unknown vector property "${property}". ` + (known.length > 0 ? `This collection's vector properties are: ${known.join(", ")}.` : "This collection declares no `vector` property to search."), "UNKNOWN_VECTOR_PROPERTY");
+		}
+		if (!isVectorColumn(column)) throw ApiError.badRequest(`Property "${property}" is not a vector column (it is \`${columnSqlType(column) || "unknown"}\`), so it has no distance operator. Name the property declared as \`{ type: "vector" }\`.`, "UNKNOWN_VECTOR_PROPERTY");
+		return column;
+	}
+};
+/** The column's SQL type, for a value that may not be a drizzle column at all. */
+var columnSqlType = (column) => {
+	const getSQLType = column?.getSQLType;
+	return typeof getSQLType === "function" ? getSQLType.call(column).toLowerCase() : "";
 };
+/** True for `vector(1536)` and its pgvector siblings, whatever the width. */
+var isVectorColumn = (column) => /^(vector|halfvec|sparsevec)\b/.test(columnSqlType(column));
 /**
 * Alias for DrizzleConditionBuilder for consistent naming with other database implementations.
 * This allows code to use PostgresConditionBuilder alongside future MongoConditionBuilder, etc.
@@ -1276,7 +1591,11 @@ function sanitizeAndConvertDates(obj) {
 	if (obj instanceof Date) return obj.toISOString();
 	if (typeof obj === "object") {
 		const newObj = {};
-		for (const key in obj) if (Object.prototype.hasOwnProperty.call(obj, key)) newObj[key] = sanitizeAndConvertDates(obj[key]);
+		for (const key in obj) {
+			if (!Object.prototype.hasOwnProperty.call(obj, key)) continue;
+			if (isPrototypePollutingKey(key)) continue;
+			newObj[key] = sanitizeAndConvertDates(obj[key]);
+		}
 		return newObj;
 	}
 	if (typeof obj === "string") {
@@ -1302,9 +1621,11 @@ function serializeDataToServer(row, properties, collection, registry) {
 	const joinPathRelationUpdates = [];
 	const foreignKeys = /* @__PURE__ */ new Set();
 	Object.values(resolvedRelations).forEach((relation) => {
-		if (relation.kind === "belongsTo") foreignKeys.add(relation.localKey);
+		if (relation.kind === "belongsTo") foreignKeys.add(fieldKeyForColumn(collection, relation.localKey));
 	});
 	for (const [key, value] of Object.entries(row)) {
+		if (isPrototypePollutingKey(key)) continue;
+		if (value === void 0) continue;
 		const property = properties[key];
 		const effectiveValue = foreignKeys.has(key) && value === "" ? null : value;
 		if (!property) {
@@ -1315,11 +1636,11 @@ function serializeDataToServer(row, properties, collection, registry) {
 			const relation = findRelation(resolvedRelations, key);
 			if (relation) {
 				if (relation.kind === "belongsTo") {
-					const serializedValue = serializePropertyToServer(effectiveValue, property);
-					if (serializedValue !== void 0) result[relation.localKey] = serializedValue;
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
+					if (serializedValue !== void 0) result[fieldKeyForColumn(collection, relation.localKey)] = serializedValue;
 					continue;
 				} else if (hasForeignKeyOnTarget(relation)) {
-					const serializedValue = serializePropertyToServer(effectiveValue, property);
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
 					inverseRelationUpdates.push({
 						relationKey: key,
 						relation,
@@ -1327,7 +1648,7 @@ function serializeDataToServer(row, properties, collection, registry) {
 					});
 					continue;
 				} else if (relation.kind === "via") {
-					const serializedValue = serializePropertyToServer(effectiveValue, property);
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
 					if (relation.cardinality === "one") joinPathRelationUpdates.push({
 						relationKey: key,
 						relation,
@@ -1342,7 +1663,7 @@ function serializeDataToServer(row, properties, collection, registry) {
 				}
 			}
 		}
-		result[key] = serializePropertyToServer(effectiveValue, property);
+		result[key] = serializePropertyToServer(effectiveValue, property, key);
 	}
 	return {
 		scalarData: result,
@@ -1351,19 +1672,39 @@ function serializeDataToServer(row, properties, collection, registry) {
 	};
 }
 /**
-* Serialize a single property value for database storage
+* How to name a rejected value in an error, without quoting it back.
+*
+* The value may be anything the caller sent, including a secret in the wrong
+* field, so the message describes its shape rather than echoing it — an echoed
+* value ends up in logs and in error-reporting services.
+*/
+function describeValue(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return "an array";
+	if (value instanceof Date) return "a date";
+	const type = typeof value;
+	return type === "object" ? "an object" : `a ${type}`;
+}
+/**
+* Serialize a single property value for database storage.
+*
+* `propertyKey` is only ever used to phrase errors and warnings. Without it the
+* one trace a bad value left was `Expected array value for array property, got
+* string` — no collection, no property, no value, which in the log of a
+* thousand-row import names nothing at all.
 */
-function serializePropertyToServer(value, property) {
+function serializePropertyToServer(value, property, propertyKey) {
 	if (value === null || value === void 0) return value;
+	const fieldLabel = propertyKey ? `'${propertyKey}'` : `a '${property.type}' field`;
 	switch (property.type) {
 		case "relation":
-			if (Array.isArray(value)) return value.map((v) => serializePropertyToServer(v, property));
+			if (Array.isArray(value)) return value.map((v) => serializePropertyToServer(v, property, propertyKey));
 			else if (typeof value === "object" && value !== null && "id" in value) return value.id;
 			if (value === "") return null;
 			return value;
 		case "array":
 			if (Array.isArray(value)) {
-				if (property.of) return value.map((item) => serializePropertyToServer(item, property.of));
+				if (property.of) return value.map((item) => serializePropertyToServer(item, property.of, propertyKey));
 				else if (property.oneOf) {
 					const typeField = property.oneOf.typeField ?? "type";
 					const valueField = property.oneOf.valueField ?? "value";
@@ -1376,20 +1717,28 @@ function serializePropertyToServer(value, property) {
 						if (!type || !childProperty) return e;
 						return {
 							[typeField]: type,
-							[valueField]: serializePropertyToServer(rec[valueField], childProperty)
+							[valueField]: serializePropertyToServer(rec[valueField], childProperty, propertyKey)
 						};
 					});
 				}
 				return value;
 			}
-			logger.warn(`Expected array value for array property, got ${typeof value}. Coercing to empty array.`);
-			return [];
+			throw ApiError.badRequest(`${fieldLabel} expects an array, but received ${describeValue(value)}.`, "VALIDATION_INVALID_VALUE");
+		case "geopoint": {
+			if (typeof value !== "object" || Array.isArray(value)) throw ApiError.badRequest(`${fieldLabel} expects a geopoint object with \`latitude\` and \`longitude\`, but received ${describeValue(value)}.`, "VALIDATION_INVALID_VALUE");
+			const point = value;
+			if (typeof point.latitude !== "number" || typeof point.longitude !== "number") throw ApiError.badRequest(`${fieldLabel} expects a geopoint object with numeric \`latitude\` and \`longitude\`.`, "VALIDATION_INVALID_VALUE");
+			return {
+				latitude: point.latitude,
+				longitude: point.longitude
+			};
+		}
 		case "map":
 			if (typeof value === "object" && property.properties) {
 				const result = {};
 				for (const [subKey, subValue] of Object.entries(value)) {
 					const subProperty = property.properties[subKey];
-					if (subProperty) result[subKey] = serializePropertyToServer(subValue, subProperty);
+					if (subProperty) result[subKey] = serializePropertyToServer(subValue, subProperty, propertyKey ? `${propertyKey}.${subKey}` : subKey);
 					else result[subKey] = subValue;
 				}
 				return result;
@@ -1424,8 +1773,9 @@ async function parseDataFromServer(data, collection, db, registry) {
 	for (const [propKey, property] of Object.entries(properties)) if (property.type === "relation" && !(propKey in result)) {
 		const relation = findRelation(resolvedRelations, propKey);
 		if (relation) {
-			if (relation.kind === "belongsTo" && relation.localKey in data) {
-				const fkValue = data[relation.localKey];
+			const localField = relation.kind === "belongsTo" ? fieldKeyForColumn(collection, relation.localKey) : "";
+			if (relation.kind === "belongsTo" && localField in data) {
+				const fkValue = data[localField];
 				if (fkValue !== null && fkValue !== void 0) try {
 					const targetCollection = relation.target();
 					result[propKey] = createRelationRef(fkValue.toString(), targetCollection.slug);
@@ -1438,7 +1788,7 @@ async function parseDataFromServer(data, collection, db, registry) {
 				const pks = getPrimaryKeys(collection, registry);
 				const currentId = relation.sourceKey ? data[relation.sourceKey] : buildCompositeId(data, pks);
 				if (targetTable && currentId !== void 0 && currentId !== null && currentId !== "") {
-					const foreignKeyColumn = targetTable[relation.foreignKeyOnTarget];
+					const foreignKeyColumn = targetTable[fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget)];
 					if (foreignKeyColumn) {
 						const relatedRows = await db.select().from(targetTable).where(eq(foreignKeyColumn, currentId)).limit(relation.cardinality === "one" ? 1 : 100);
 						if (relatedRows.length > 0) if (relation.cardinality === "one") {
@@ -1627,6 +1977,7 @@ function parsePropertyFromServer(value, property, collection, propertyKey) {
 				return isNaN(parsed) ? null : parsed;
 			}
 			return value;
+		case "geopoint": return value;
 		case "vector": {
 			let nums = [];
 			if (typeof value === "string") nums = value.slice(1, -1).split(",").map(Number);
@@ -1670,17 +2021,35 @@ function parsePropertyFromServer(value, property, collection, propertyKey) {
 *                       from the result (used by `normalizeDbValues` where
 *                       Drizzle's relational API already hydrates them).
 */
+/**
+* Keys a query computes and attaches to a row, rather than reads from a column.
+*
+* An explicit set rather than a `_` prefix rule: a user's column may perfectly
+* well be called `_internal`, and passing it through here would put a value on
+* the row that no property describes and nothing downstream knows how to type.
+*/
+var QUERY_METADATA_KEYS = /* @__PURE__ */ new Set([
+	"_score",
+	"_distance",
+	"_matches"
+]);
 function normalizeScalarValues(data, properties, collection, resolvedRelations, options) {
 	const result = {};
 	const internalFKColumns = /* @__PURE__ */ new Set();
 	Object.values(resolvedRelations).forEach((relation) => {
-		if (relation.kind === "belongsTo" && !properties[relation.localKey]) internalFKColumns.add(relation.localKey);
+		if (relation.kind !== "belongsTo") return;
+		const localField = fieldKeyForColumn(collection, relation.localKey);
+		if (!properties[localField]) internalFKColumns.add(localField);
 	});
 	for (const [key, value] of Object.entries(data)) {
 		if (internalFKColumns.has(key)) {
 			result[key] = value === null ? null : typeof value === "number" ? value : String(value);
 			continue;
 		}
+		if (QUERY_METADATA_KEYS.has(key)) {
+			result[key] = value;
+			continue;
+		}
 		const property = properties[key];
 		if (!property) continue;
 		if (options.skipRelations && property.type === "relation") continue;
@@ -1703,34 +2072,179 @@ function normalizeDbValues(data, collection) {
 	return normalizeScalarValues(data, properties, collection, resolveCollectionRelations(collection), { skipRelations: true });
 }
 //#endregion
-//#region src/services/RelationService.ts
+//#region src/services/write-denial.ts
+/**
+* Explain a write that matched no rows.
+*
+* Row-level security filters UPDATE and DELETE through the policy's USING
+* clause instead of raising: a denied write is reported by Postgres exactly
+* like a successful one that happened to match nothing. Left unchecked, a
+* caller cannot tell "denied" from "done" — the write returns 200/204 and the
+* row is untouched. An agent handed a key with `orders:delete` and no delete
+* policy is the case that makes it concrete: it deletes nothing, forever, and
+* is told it worked every time.
+*
+* Re-reading the target over the *same* RLS-scoped handle separates the two
+* cases. A visible row means the policy rejected the write (403); an invisible
+* one means there is nothing there to write for this caller (404, matching what
+* a GET would say). The re-read is bound by the caller's own policies, so it
+* discloses nothing a plain read wouldn't.
+*
+* Only reached when zero rows matched, so the happy path pays nothing.
+*
+* It lives here, rather than beside its first caller, because every zero-row
+* write has to answer the same question and answer it identically: the rule
+* that a readable-but-unwritable target is a 403 is the contract, and a second
+* copy of it is a second chance to get it wrong.
+*
+* @param handle     The RLS-scoped connection the write ran on — not a fresh
+*                   one, or the re-read would answer for a different caller.
+* @param table      The table the write targeted (the junction, for a link).
+* @param conditions The write's own WHERE terms, reused verbatim.
+* @param denied     Message for the 403: the target is there and was refused.
+* @param missing    Message for the 404: there is nothing there for this caller.
+*/
+async function explainZeroRowWrite(handle, table, conditions, denied, missing) {
+	if ((await handle.select({ present: sql`1` }).from(table).where(and(...conditions)).limit(1)).length > 0) return ApiError.forbidden(denied, "WRITE_DENIED");
+	return ApiError.notFound(missing);
+}
+//#endregion
+//#region src/services/junction-writes.ts
+/** A junction that cannot be resolved is a broken relation, not a no-op. */
+var misconfigured = (label, detail) => relationMisconfigured(label, detail);
+function column(table, name, label, role) {
+	const col = name ? table[name] : void 0;
+	if (!col) throw misconfigured(label, `no ${role} column '${name ?? "?"}' on the junction table`);
+	return col;
+}
+/** The junction a `manyToMany` names outright. */
+function bindThroughJunction(registry, through, label) {
+	const table = registry.getTable(through.table);
+	if (!table) throw misconfigured(label, `no table '${through.table}' in the registry`);
+	return {
+		table,
+		parentColumn: column(table, through.sourceColumn, label, "source"),
+		targetColumn: column(table, through.targetColumn, label, "target"),
+		label
+	};
+}
+/** The bare column name, whether written as `col` or `table.col`. */
+var columnPart = (spec) => {
+	const one = Array.isArray(spec) ? spec[0] : spec;
+	return one.includes(".") ? one.split(".")[1] : one;
+};
+/** The table a column spec names, or undefined when it is unqualified. */
+var tablePart = (spec) => {
+	const one = Array.isArray(spec) ? spec[0] : spec;
+	return one.includes(".") ? one.split(".")[0] : void 0;
+};
 /**
-* The ids in a to-many relation write, whatever shape the caller sent.
+* The junction a `via` relation reaches through, from either end.
+*
+* A step is `{ table: T, on: { from, to } }` where `from` names a column on
+* whatever the walk was standing on and `to` names one on `T`. That positional
+* meaning is what makes the unqualified form work at all, so the walk carries
+* the previous table rather than asking the column names where they live.
+*/
+function bindJoinPathJunction(registry, joinPath, parentTableName, targetTableName, label) {
+	const junctionName = joinPath.map((step) => step.table).find((table) => table !== parentTableName && table !== targetTableName);
+	if (!junctionName) throw misconfigured(label, "its joinPath has no table between the two ends to hold the links");
+	const table = registry.getTable(junctionName);
+	if (!table) throw misconfigured(label, `no table '${junctionName}' in the registry`);
+	let parentColumnName;
+	let targetColumnName;
+	let previousTable = parentTableName;
+	for (const step of joinPath) {
+		const fromTable = tablePart(step.on.from) ?? previousTable;
+		const toTable = tablePart(step.on.to) ?? step.table;
+		if (toTable === junctionName && fromTable === parentTableName) parentColumnName = columnPart(step.on.to);
+		else if (fromTable === junctionName && toTable === parentTableName) parentColumnName = columnPart(step.on.from);
+		else if (toTable === junctionName && fromTable === targetTableName) targetColumnName = columnPart(step.on.to);
+		else if (fromTable === junctionName && toTable === targetTableName) targetColumnName = columnPart(step.on.from);
+		previousTable = step.table;
+	}
+	if (!parentColumnName || !targetColumnName) throw misconfigured(label, `its joinPath does not connect '${parentTableName}' and '${targetTableName}' through '${junctionName}'`);
+	return {
+		table,
+		parentColumn: column(table, parentColumnName, label, "source"),
+		targetColumn: column(table, targetColumnName, label, "target"),
+		label
+	};
+}
+/**
+* Remove one link, leaving the row on the far side alone.
 *
-* A membership list is written as either the related rows (`[{ id: 1 }]`, what
-* the admin UI sends back after reading them) or as bare keys (`[1]`, `["t-1"]`,
-* what anyone writing the API by hand sends). Only the first was read, via a
-* blind `.map(rel => rel.id)`, and a bare key therefore became `undefined`:
-* on a numeric-keyed target that surfaced as `Invalid numeric ID: undefined`,
-* and on a string-keyed one it did not surface at all — `String(undefined)`
-* wrote a junction row pointing at the literal `"undefined"`, which no read
-* would ever match. Both shapes are accepted here, in one place, because both
-* call sites had the same assumption.
+* This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
+* target is shared, so deleting the row would remove the tag from every other
+* post that uses it.
+*/
+async function removeJunctionLink(tx, binding, parentId, targetId, subject) {
+	const conditions = [eq(binding.parentColumn, parentId), eq(binding.targetColumn, targetId)];
+	if (((await tx.delete(binding.table).where(and(...conditions))).rowCount ?? 0) === 0) throw await explainZeroRowWrite(tx, binding.table, conditions, `Not allowed to unlink "${targetId}" from "${subject.parent}" "${parentId}": a row-level security policy rejected the write.`, `No "${subject.relation}" link between "${subject.parent}" "${parentId}" and "${targetId}" to remove.`);
+	logger.info(`Unlinked '${subject.relation}' ${targetId} from ${subject.parent} ${parentId}`);
+}
+/**
+* Make the junction say that `parentId` is linked to exactly `targetIds`, by
+* diffing against what is linked now rather than replacing the set.
+*
+* A save of the parent used to delete every junction row for it and re-insert
+* the ids the browser sent — a list the browser assembled from a read it did
+* earlier. Three things followed, all data loss rather than display:
+*
+*  - **Lost update.** Two editors with post 7 open: A adds tag X and saves, B
+*    saves any field from a form that predates it, and X is gone with nothing
+*    reported to either of them.
+*  - **A partially-read set is a partially-deleted set.** The read that fills
+*    the form runs under RLS, so a user who may edit the parent but cannot see
+*    some of the linked rows gets a shorter list — and writing it back deleted
+*    the links they were never shown. The select that drives the diff runs in
+*    this same transaction under the same policies, so a link the caller cannot
+*    read is in neither list and survives the save.
+*  - **Junction payload columns.** A junction carrying its own columns
+*    (`position`, `role`, `created_at`) lost them on every save, because every
+*    row was re-inserted with only the two keys. Untouched links are left alone.
+*
+* The insert is `ON CONFLICT DO NOTHING`, so two sessions adding the same link
+* concurrently is a no-op rather than a unique violation.
+*/
+async function applyJunctionMembership(tx, binding, parentId, targetIds) {
+	const existingRows = await tx.select({ targetId: binding.targetColumn }).from(binding.table).where(eq(binding.parentColumn, parentId));
+	const existingById = /* @__PURE__ */ new Map();
+	for (const row of existingRows) {
+		if (row.targetId === null || row.targetId === void 0) continue;
+		existingById.set(String(row.targetId), row.targetId);
+	}
+	const wantedById = /* @__PURE__ */ new Map();
+	for (const targetId of targetIds) {
+		if (targetId === null || targetId === void 0) continue;
+		wantedById.set(String(targetId), targetId);
+	}
+	const removed = [...existingById.entries()].filter(([key]) => !wantedById.has(key)).map(([, value]) => value);
+	const added = [...wantedById.entries()].filter(([key]) => !existingById.has(key)).map(([, value]) => value);
+	if (removed.length > 0) await removeLinks(tx, binding, parentId, removed);
+	if (added.length > 0) await tx.insert(binding.table).values(added.map((targetId) => ({
+		[binding.parentColumn.name]: parentId,
+		[binding.targetColumn.name]: targetId
+	}))).onConflictDoNothing();
+}
+/**
+* Drop the named links, and refuse to call it done if the database kept any.
 *
-* An element that carries no key is refused rather than skipped: dropping it
-* would silently write a shorter membership list than the caller asked for.
+* Every id here came out of the select in {@link applyJunctionMembership}, on
+* this same handle, so all of them were visible. Fewer deletions than that means
+* something refused them — and a save that reports success while the membership
+* it stored is not the membership it was given has told the caller something
+* untrue about the database.
 */
-function relationTargetIds(value, relationName, collectionSlug) {
-	if (!Array.isArray(value)) return [];
-	return value.map((element, index) => {
-		if (typeof element === "string" || typeof element === "number") return element;
-		if (element && typeof element === "object") {
-			const id = element.id;
-			if (typeof id === "string" || typeof id === "number") return id;
-		}
-		throw new Error(`Cannot write relation "${relationName}" on "${collectionSlug}": element ${index} carries no id. Pass either the related rows (\`[{ id: … }]\`) or their keys (\`[1, 2]\`), not ${element === null ? "null" : typeof element}.`);
-	});
+async function removeLinks(tx, binding, parentId, removed) {
+	const conditions = [eq(binding.parentColumn, parentId), inArray(binding.targetColumn, removed)];
+	const deleted = (await tx.delete(binding.table).where(and(...conditions))).rowCount ?? 0;
+	if (deleted >= removed.length) return;
+	if ((await tx.select({ present: sql`1` }).from(binding.table).where(and(...conditions)).limit(1)).length === 0) return;
+	throw ApiError.forbidden(`Not allowed to remove ${removed.length - deleted} of ${removed.length} link(s) for relation '${binding.label}': a row-level security policy rejected the write.`, "WRITE_DENIED");
 }
+//#endregion
+//#region src/services/RelationService.ts
 /**
 * Typed wrapper for Drizzle dynamic query innerJoin.
 * Drizzle's `$dynamic()` queries lose the `innerJoin` method from
@@ -1838,6 +2352,10 @@ var RelationService = class {
 		const { keyByParentId } = await this.resolveSourceKeys(parentCollection, relation, [parentId], db);
 		return keyByParentId.get(String(parentId));
 	}
+	/**
+	* Shared with {@link RelationWriteService}: a write needs the same source
+	* key a read does, and resolving it twice is how the two would disagree.
+	*/
 	async resolveSourceKeys(parentCollection, relation, parentIds, db = this.db) {
 		const keyByParentId = /* @__PURE__ */ new Map();
 		const parentIdByKey = /* @__PURE__ */ new Map();
@@ -1933,7 +2451,7 @@ var RelationService = class {
 		let query = this.db.select().from(targetTable).$dynamic();
 		const additionalFilters = [];
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, targetCollection.properties, targetTable);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, targetCollection.properties, targetTable, targetCollection);
 			if (searchConditions.length === 0) return [];
 			const searchCombined = DrizzleConditionBuilder.combineConditionsWithOr(searchConditions);
 			if (searchCombined) additionalFilters.push(searchCombined);
@@ -2008,30 +2526,6 @@ var RelationService = class {
 		return await this.countRelatedRows(hop.parentCollection, hop.parentId, hop.relation, identity) > 0;
 	}
 	/**
-	* Remove the junction row linking a parent to `targetId`, leaving the target
-	* row itself alone.
-	*
-	* This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
-	* target is shared, so deleting the row would remove the tag from every other
-	* post that uses it. It used to do exactly that — resolve the path to the
-	* `tags` table and delete by primary key.
-	*/
-	async unlinkRelatedEntity(tx, hop, targetId) {
-		if (!isManyToMany(hop.relation)) throw new Error(`Relation '${hop.relationKey}' has no junction table to unlink through`);
-		const through = hop.relation.through;
-		const junctionTable = this.registry.getTable(through.table);
-		if (!junctionTable) throw new Error(`Junction table not found: ${through.table}`);
-		const sourceJunctionColumn = junctionTable[through.sourceColumn];
-		const targetJunctionColumn = junctionTable[through.targetColumn];
-		if (!sourceJunctionColumn || !targetJunctionColumn) throw new Error(`Junction columns not found for relation '${hop.relationKey}' on table '${through.table}'`);
-		const parentPks = requirePrimaryKeys(hop.parentCollection, this.registry);
-		const parsedParentId = parseIdValues(hop.parentId, parentPks)[parentPks[0].fieldName];
-		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
-		const parsedTargetId = parseIdValues(targetId, targetPks)[targetPks[0].fieldName];
-		await tx.delete(junctionTable).where(and(eq(sourceJunctionColumn, parsedParentId), eq(targetJunctionColumn, parsedTargetId)));
-		logger.info(`Unlinked '${hop.relationKey}' ${parsedTargetId} from ${hop.parentCollection.slug} ${parsedParentId}`);
-	}
-	/**
 	* Batch fetch related rows for multiple parent rows to avoid N+1 queries
 	*/
 	async batchFetchRelatedEntities(parentCollectionPath, parentIds, _relationKey, relation) {
@@ -2079,7 +2573,7 @@ var RelationService = class {
 		}
 		if (relation.kind === "belongsTo") {
 			this.assertSingleKeyAddressable(parentCollection, parentPks, relation.localKey);
-			const localKeyCol = parentTable[relation.localKey];
+			const localKeyCol = parentTable[fieldKeyForColumn(parentCollection, relation.localKey)];
 			if (!localKeyCol) throw new Error(`Local key column '${relation.localKey}' not found in parent table`);
 			const fkRows = await this.db.select({
 				parentId: parentIdCol,
@@ -2125,7 +2619,7 @@ var RelationService = class {
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
 			if (!hasForeignKeyOnTarget(relation)) continue;
-			const foreignKeyValue = targetRow[relation.foreignKeyOnTarget];
+			const foreignKeyValue = targetRow[fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget)];
 			if (foreignKeyValue === void 0 || foreignKeyValue === null) continue;
 			const parentId = parentIdByKey.get(String(foreignKeyValue));
 			if (parentId !== void 0) resultMap.set(String(parentId), await this.toRelatedRow(targetRow, targetCollection, targetPks));
@@ -2182,17 +2676,7 @@ var RelationService = class {
 		}
 		if (relation.kind === "manyToMany") {
 			this.assertSingleKeyAddressable(parentCollection, parentPks, `${relation.through.table}.${relation.through.sourceColumn}`);
-			const junctionTable = this.registry.getTable(relation.through.table);
-			if (!junctionTable) {
-				logger.warn(`[batchFetchRelatedEntitiesMany] Junction table '${relation.through.table}' not found`);
-				return /* @__PURE__ */ new Map();
-			}
-			const sourceJunctionCol = junctionTable[relation.through.sourceColumn];
-			const targetJunctionCol = junctionTable[relation.through.targetColumn];
-			if (!sourceJunctionCol || !targetJunctionCol) {
-				logger.warn(`[batchFetchRelatedEntitiesMany] Junction columns not found in '${relation.through.table}'`);
-				return /* @__PURE__ */ new Map();
-			}
+			const { table: junctionTable, parentColumn: sourceJunctionCol, targetColumn: targetJunctionCol } = bindThroughJunction(this.registry, relation.through, `${parentCollection.slug}.${relation.relationName}`);
 			const results = await this.db.select().from(junctionTable).innerJoin(targetTable, eq(targetJunctionCol, targetIdField)).where(inArray(sourceJunctionCol, parsedParentIds));
 			const resultMap = /* @__PURE__ */ new Map();
 			const targetTableName = getTableName$1(targetCollection);
@@ -2220,7 +2704,7 @@ var RelationService = class {
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
 			if (!hasForeignKeyOnTarget(relation)) continue;
-			const foreignKeyValue = targetRow[relation.foreignKeyOnTarget];
+			const foreignKeyValue = targetRow[fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget)];
 			if (foreignKeyValue === void 0 || foreignKeyValue === null) continue;
 			const parentId = parentIdByKey.get(String(foreignKeyValue));
 			if (parentId !== void 0) {
@@ -2232,346 +2716,6 @@ var RelationService = class {
 		}
 		return resultMap;
 	}
-	/**
-	* Update many-to-many and junction relations
-	*/
-	async updateRelationsUsingJoins(tx, collection, id, relationValues) {
-		const resolvedRelations = resolveCollectionRelations(collection);
-		for (const [key, value] of Object.entries(relationValues)) {
-			const relation = findRelation(resolvedRelations, key);
-			if (!relation || relation.cardinality !== "many") continue;
-			const targetEntityIds = relationTargetIds(value, key, collection.slug);
-			const targetCollection = relation.target();
-			if (relation.kind === "via") {
-				const parentTableName = getTableName$1(collection);
-				const targetTableName = getTableName$1(targetCollection);
-				let junctionTable = void 0;
-				let sourceJunctionColumn = null;
-				let targetJunctionColumn = null;
-				const junctionTableName = relation.joinPath.find((step) => step.table !== parentTableName && step.table !== targetTableName)?.table;
-				if (junctionTableName) {
-					junctionTable = this.registry.getTable(junctionTableName);
-					if (junctionTable) for (const joinStep of relation.joinPath) {
-						const fromTable = DrizzleConditionBuilder.getTableNamesFromColumns(joinStep.on.from)[0];
-						const toTable = DrizzleConditionBuilder.getTableNamesFromColumns(joinStep.on.to)[0];
-						if (fromTable === parentTableName && toTable === junctionTableName) {
-							const columnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(joinStep.on.to);
-							sourceJunctionColumn = junctionTable[columnNames[0]];
-						} else if (fromTable === junctionTableName && toTable === parentTableName) {
-							const columnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(joinStep.on.from);
-							sourceJunctionColumn = junctionTable[columnNames[0]];
-						}
-						if (fromTable === junctionTableName && toTable === targetTableName) {
-							const columnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(joinStep.on.from);
-							targetJunctionColumn = junctionTable[columnNames[0]];
-						} else if (fromTable === targetTableName && toTable === junctionTableName) {
-							const columnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(joinStep.on.to);
-							targetJunctionColumn = junctionTable[columnNames[0]];
-						}
-					}
-				}
-				if (!junctionTable || !sourceJunctionColumn || !targetJunctionColumn) {
-					logger.warn(`Could not determine junction table for relation '${key}' in collection '${collection.slug}'`);
-					continue;
-				}
-				const parentPks = requirePrimaryKeys(collection, this.registry);
-				const parentIdInfo = parentPks[0];
-				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
-				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
-				if (targetEntityIds.length > 0) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-					const targetIdInfo = targetPks[0];
-					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-						[sourceJunctionColumn.name]: parsedParentId,
-						[targetJunctionColumn.name]: targetId
-					}));
-					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
-				}
-			} else if (relation.kind === "manyToMany") {
-				const junctionTable = this.registry.getTable(relation.through.table);
-				if (!junctionTable) {
-					logger.warn(`Junction table '${relation.through.table}' not found for relation '${key}' in collection '${collection.slug}'`);
-					continue;
-				}
-				const sourceJunctionColumn = junctionTable[relation.through.sourceColumn];
-				const targetJunctionColumn = junctionTable[relation.through.targetColumn];
-				if (!sourceJunctionColumn || !targetJunctionColumn) {
-					logger.warn(`Junction columns not found for relation '${key}'`);
-					continue;
-				}
-				const parentPks = requirePrimaryKeys(collection, this.registry);
-				const parentIdInfo = parentPks[0];
-				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
-				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
-				if (targetEntityIds.length > 0) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-					const targetIdInfo = targetPks[0];
-					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-						[sourceJunctionColumn.name]: parsedParentId,
-						[targetJunctionColumn.name]: targetId
-					}));
-					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
-				}
-			} else if (relation.cardinality === "many" && hasForeignKeyOnTarget(relation)) {
-				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-				const targetIdInfo = targetPks[0];
-				const targetIdCol = targetTable[targetIdInfo.fieldName];
-				const fkCol = targetTable[relation.foreignKeyOnTarget];
-				if (!fkCol || !targetIdCol) {
-					logger.warn(`Invalid inverse-many config for relation '${key}' in collection '${collection.slug}'`);
-					continue;
-				}
-				const parentKeyValue = (await this.resolveSourceKeys(collection, relation, [id], tx)).keyByParentId.get(String(id));
-				if (parentKeyValue === void 0) throw new Error(`Cannot write relation '${key}' on '${collection.slug}': row '${id}' has no value in \`sourceKey: "${sourceKeyField(relation, collection, this.registry)}"\`, so there is nothing for the related rows to point at.`);
-				if (targetEntityIds.length > 0) {
-					const parsedTargetIds = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(and(eq(fkCol, parentKeyValue), sql`${targetIdCol} NOT IN (${sql.join(parsedTargetIds)})`));
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: parentKeyValue }).where(inArray(targetIdCol, parsedTargetIds));
-				} else await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(fkCol, parentKeyValue));
-			} else logger.warn(`Many relation '${key}' in collection '${collection.slug}' lacks write configuration and will be skipped during save.`);
-		}
-	}
-	/**
-	* Update inverse relations (where FK is on the target table)
-	*/
-	async updateInverseRelations(tx, sourceCollection, sourceEntityId, inverseRelationUpdates) {
-		for (const update of inverseRelationUpdates) {
-			const { relation, newValue } = update;
-			try {
-				const targetCollection = relation.target();
-				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-				const targetIdInfo = targetPks[0];
-				requirePrimaryKeys(sourceCollection, this.registry)[0];
-				if (relation.kind === "via") {
-					await this.updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue);
-					continue;
-				}
-				if (isManyToMany(relation)) {
-					await this.updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, {
-						table: relation.through.table,
-						sourceColumn: relation.through.sourceColumn,
-						targetColumn: relation.through.targetColumn
-					});
-					continue;
-				}
-				if (!hasForeignKeyOnTarget(relation)) {
-					logger.warn(`Relation '${relation.relationName}' has no column on the target to write. Skipping.`);
-					continue;
-				}
-				const foreignKeyColumn = targetTable[relation.foreignKeyOnTarget];
-				if (!foreignKeyColumn) {
-					logger.warn(`Foreign key column '${relation.foreignKeyOnTarget}' not found in target table for relation '${relation.relationName}'`);
-					continue;
-				}
-				const sourceKeyValue = (await this.resolveSourceKeys(sourceCollection, relation, [sourceEntityId], tx)).keyByParentId.get(String(sourceEntityId));
-				if (sourceKeyValue === void 0) throw new Error(`Cannot write relation '${relation.relationName}' on '${sourceCollection.slug}': row '${sourceEntityId}' has no value in \`sourceKey: "${sourceKeyField(relation, sourceCollection, this.registry)}"\`, so there is nothing for the related row to point at.`);
-				if (newValue === null || newValue === void 0) await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
-				else {
-					const parsedNewTargetId = parseIdValues(newValue, targetPks)[targetIdInfo.fieldName];
-					const targetIdField = targetTable[targetIdInfo.fieldName];
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: sourceKeyValue }).where(eq(targetIdField, parsedNewTargetId));
-				}
-			} catch (e) {
-				logger.warn(`Failed to update inverse relation '${relation.relationName}'`, { error: e });
-			}
-		}
-	}
-	/**
-	* Handle inverse relations with joinPath
-	*/
-	async updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue) {
-		try {
-			const sourceTableName = getTableName$1(sourceCollection);
-			const targetTableName = getTableName$1(targetCollection);
-			const intermediateTables = relation.joinPath.map((step) => step.table).filter((table) => table !== sourceTableName && table !== targetTableName);
-			if (intermediateTables.length === 1 && relation.cardinality === "many") {
-				const junctionTableName = intermediateTables[0];
-				const junctionTable = this.registry.getTable(junctionTableName);
-				if (!junctionTable) {
-					logger.warn(`Junction table '${junctionTableName}' not found for inverse joinPath relation '${relation.relationName}'`);
-					return;
-				}
-				let sourceJunctionColumn = null;
-				let targetJunctionColumn = null;
-				for (const step of relation.joinPath) if (step.table === junctionTableName) {
-					const fromTable = DrizzleConditionBuilder.getTableNamesFromColumns(step.on.from)[0];
-					const toColumnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(step.on.to);
-					const fromColumnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(step.on.from);
-					if (fromTable === sourceTableName) sourceJunctionColumn = junctionTable[toColumnNames[0]];
-					else if (fromTable === targetTableName) targetJunctionColumn = junctionTable[toColumnNames[0]];
-					else {
-						const toTable = DrizzleConditionBuilder.getTableNamesFromColumns(step.on.to)[0];
-						if (toTable === sourceTableName) sourceJunctionColumn = junctionTable[fromColumnNames[0]];
-						else if (toTable === targetTableName) targetJunctionColumn = junctionTable[fromColumnNames[0]];
-					}
-				}
-				if (!sourceJunctionColumn || !targetJunctionColumn) {
-					logger.warn(`Could not determine junction columns for inverse joinPath relation '${relation.relationName}'`);
-					return;
-				}
-				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
-				const sourceIdInfo = sourcePks[0];
-				const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
-				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
-				if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-					const targetIdInfo = targetPks[0];
-					const newLinks = relationTargetIds(newValue, relation.relationName, sourceCollection.slug).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-						[sourceJunctionColumn.name]: parsedSourceId,
-						[targetJunctionColumn.name]: targetId
-					}));
-					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
-				} else if (newValue && !Array.isArray(newValue)) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-					const targetIdInfo = targetPks[0];
-					const parsedTargetId = parseIdValues(typeof newValue === "object" && newValue !== null ? newValue.id : newValue, targetPks)[targetIdInfo.fieldName];
-					const newLink = {
-						[sourceJunctionColumn.name]: parsedSourceId,
-						[targetJunctionColumn.name]: parsedTargetId
-					};
-					await tx.insert(junctionTable).values(newLink);
-				}
-			}
-		} catch (error) {
-			logger.error(`Failed to update inverse joinPath relation '${relation.relationName}'`, { error });
-			throw error;
-		}
-	}
-	/**
-	* Handle many-to-many inverse relation updates using junction tables
-	*/
-	async updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, junctionInfo) {
-		try {
-			const junctionTable = this.registry.getTable(junctionInfo.table);
-			if (!junctionTable) {
-				logger.warn(`Junction table '${junctionInfo.table}' not found for many-to-many inverse relation '${relation.relationName}'`);
-				return;
-			}
-			const sourceJunctionColumn = junctionTable[junctionInfo.sourceColumn];
-			const targetJunctionColumn = junctionTable[junctionInfo.targetColumn];
-			if (!sourceJunctionColumn || !targetJunctionColumn) {
-				logger.warn(`Junction columns not found for relation '${relation.relationName}'`);
-				return;
-			}
-			const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
-			const sourceIdInfo = sourcePks[0];
-			const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
-			await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
-			if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-				const targetIdInfo = targetPks[0];
-				const newLinks = relationTargetIds(newValue, relation.relationName, sourceCollection.slug).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-					[sourceJunctionColumn.name]: parsedSourceId,
-					[targetJunctionColumn.name]: targetId
-				}));
-				if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
-			}
-		} catch (error) {
-			logger.error(`Failed to update many-to-many inverse relation '${relation.relationName}'`, { error });
-			throw error;
-		}
-	}
-	/**
-	* Update one-to-one relations that use joinPath
-	*/
-	async updateJoinPathOneToOneRelations(tx, parentCollection, parentId, updates) {
-		for (const upd of updates) {
-			const { relation, newTargetId } = upd;
-			const targetCollection = relation.target();
-			const targetTable = getTableForCollection(targetCollection, this.registry);
-			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-			const targetIdInfo = targetPks[0];
-			const targetIdCol = targetTable[targetIdInfo.fieldName];
-			const { targetFKColName, parentSourceColName } = this.resolveJoinPathWriteMapping(parentCollection, relation);
-			const parentTable = getTableForCollection(parentCollection, this.registry);
-			const parentPks = requirePrimaryKeys(parentCollection, this.registry);
-			const parentIdInfo = parentPks[0];
-			const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
-			const parentIdCol = parentTable[parentIdInfo.fieldName];
-			const parentSourceCol = parentTable[parentSourceColName];
-			const targetFKCol = targetTable[targetFKColName];
-			if (!parentSourceCol) {
-				logger.warn(`Parent source column '${parentSourceColName}' not found for joinPath relation '${relation.relationName}'`);
-				continue;
-			}
-			if (!targetFKCol) {
-				logger.warn(`Target FK column '${targetFKColName}' not found for joinPath relation '${relation.relationName}'`);
-				continue;
-			}
-			const parentRows = await tx.select({ val: parentSourceCol }).from(parentTable).where(eq(parentIdCol, parsedParentId)).limit(1);
-			if (parentRows.length === 0) continue;
-			const parentFKValue = parentRows[0].val;
-			if (newTargetId === null || newTargetId === void 0) {
-				if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
-				continue;
-			}
-			const parsedTargetId = parseIdValues(newTargetId, targetPks)[targetIdInfo.fieldName];
-			if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
-			else {
-				logger.warn(`Cannot set joinPath relation '${relation.relationName}' because parent FK value is null/undefined`);
-				continue;
-			}
-			await tx.update(targetTable).set({ [targetFKColName]: parentFKValue }).where(eq(targetIdCol, parsedTargetId));
-		}
-	}
-	/**
-	* Resolve joinPath write mapping for one-to-one relations
-	*/
-	resolveJoinPathWriteMapping(parentCollection, relation) {
-		if (!relation.joinPath || relation.joinPath.length === 0) throw new Error("resolveJoinPathWriteMapping requires a joinPath relation");
-		const parentTableName = getTableName$1(parentCollection);
-		const lastStep = relation.joinPath[relation.joinPath.length - 1];
-		const targetFKColName = DrizzleConditionBuilder.getColumnNamesFromColumns(lastStep.on.to)[0];
-		let currentFrom = lastStep.on.from;
-		let safety = 0;
-		while (safety++ < 10) {
-			if (DrizzleConditionBuilder.getTableNamesFromColumns(currentFrom)[0] === parentTableName) break;
-			const prevStep = relation.joinPath.find((s) => {
-				return (Array.isArray(s.on.to) ? s.on.to[0] : s.on.to) === currentFrom;
-			});
-			if (!prevStep) throw new Error(`Could not resolve parent source column for joinPath relation '${relation.relationName}'`);
-			currentFrom = prevStep.on.from;
-		}
-		return {
-			targetFKColName,
-			parentSourceColName: DrizzleConditionBuilder.getColumnNamesFromColumns(currentFrom)[0]
-		};
-	}
-	/**
-	* Handle junction table creation for many-to-many path-based saves
-	*/
-	async handleJunctionTableCreation(tx, newEntityId, junctionTableInfo) {
-		const { parentCollection, parentId, relation, relationKey } = junctionTableInfo;
-		const targetCollection = relation.target();
-		try {
-			const junctionTable = this.registry.getTable(relation.through.table);
-			if (!junctionTable) {
-				logger.warn(`Junction table '${relation.through.table}' not found for relation '${relationKey}'`);
-				return;
-			}
-			const sourceJunctionColumn = junctionTable[relation.through.sourceColumn];
-			const targetJunctionColumn = junctionTable[relation.through.targetColumn];
-			if (!sourceJunctionColumn || !targetJunctionColumn) {
-				logger.warn(`Junction columns not found for relation '${relationKey}'`);
-				return;
-			}
-			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-			const targetIdInfo = targetPks[0];
-			const parsedNewEntityId = parseIdValues(newEntityId, targetPks)[targetIdInfo.fieldName];
-			const junctionData = {
-				[sourceJunctionColumn.name]: parentId,
-				[targetJunctionColumn.name]: parsedNewEntityId
-			};
-			await tx.insert(junctionTable).values(junctionData).onConflictDoNothing();
-			logger.info(`Linked '${relationKey}' ${parsedNewEntityId} to ${parentId}`);
-		} catch (error) {
-			logger.error(`Failed to create junction table entry for relation '${relationKey}'`, { error });
-			throw error;
-		}
-	}
 };
 //#endregion
 //#region src/services/row-pipeline.ts
@@ -3019,8 +3163,7 @@ function sanitizeErrorForClient(error, context) {
 			column: pgError.column,
 			table: pgError.table,
 			constraint: pgError.constraint,
-			dataType: pgError.dataType,
-			drizzleMessage: error instanceof Error ? error.message : String(error)
+			dataType: pgError.dataType
 		});
 		return pgErrorToFriendlyMessage(pgError, context);
 	}
@@ -3039,7 +3182,7 @@ function sanitizeErrorForClient(error, context) {
 * Service for handling all row read operations.
 * Handles fetching, searching, counting, and filtering rows.
 */
-var FetchService = class {
+var FetchService = class FetchService {
 	db;
 	registry;
 	relationService;
@@ -3112,16 +3255,39 @@ var FetchService = class {
 	* and skips rows rather than erroring. The guesses stay, last, for a
 	* caller that hands over no collection to resolve against.
 	*/
+	/**
+	* The ORDER BY target, which may be relevance rather than a column.
+	*
+	* `_score` is only meaningful for a collection that declared a `search`
+	* block *and* for a request that carried a search string — ranking rows
+	* against no query ranks them all at zero. Outside those two conditions it
+	* is an unknown field and gets the same 400 as any other typo, which is the
+	* behaviour that matters: a sort that is silently dropped returns 200 with
+	* rows in arbitrary order, and paging over that repeats and skips rows.
+	*/
+	static SCORE_FIELD = "_score";
+	resolveOrderTarget(table, orderBy, collection, searchString) {
+		if (orderBy === FetchService.SCORE_FIELD && collection && searchString) {
+			const rank = DrizzleConditionBuilder.buildSearchRankExpression(searchString, table, collection);
+			if (rank) return rank;
+		}
+		return this.resolveOrderByField(table, orderBy, collection);
+	}
 	resolveOrderByField(table, orderBy, collection) {
 		const columnAt = (key) => (key in table ? table[key] : void 0) || void 0;
 		const direct = columnAt(orderBy);
 		if (direct) return direct;
 		const declaredRelation = collection ? resolveCollectionRelations(collection)[orderBy] : void 0;
 		if (declaredRelation?.kind === "belongsTo") {
-			const foreignKey = columnAt(declaredRelation.localKey);
+			const foreignKey = columnAt(fieldKeyForColumn(collection, declaredRelation.localKey));
 			if (foreignKey) return foreignKey;
 		}
-		for (const guess of [`${orderBy}_id`, generateForeignKeyName(orderBy)]) {
+		for (const guess of [
+			`${orderBy}Id`,
+			toWireKey(generateForeignKeyName(orderBy)),
+			`${orderBy}_id`,
+			generateForeignKeyName(orderBy)
+		]) {
 			const foreignKey = columnAt(guess);
 			if (foreignKey) return foreignKey;
 		}
@@ -3195,6 +3361,7 @@ var FetchService = class {
 					row[key] = createRelationRefWithData(e.id, e.path, e);
 				} else if (relation.cardinality === "many") row[key] = relatedRows.map((e) => createRelationRefWithData(e.id, e.path, e));
 			} catch (e) {
+				if (reachedDatabase(e)) throw e;
 				logger.warn(`Could not resolve joinPath relation '${key}'`, { error: e });
 			}
 		});
@@ -3230,6 +3397,7 @@ var FetchService = class {
 				for (const row of addressable) row[key] = (resultMap.get(String(parentIdOf(row))) || []).map((e) => ({ ...e.values }));
 			}
 		} catch (e) {
+			if (reachedDatabase(e)) throw e;
 			logger.warn(`Could not batch resolve joinPath relation '${key}' for REST`, { error: e });
 		}
 	}
@@ -3239,12 +3407,14 @@ var FetchService = class {
 	*/
 	buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig, scopeCondition) {
 		const queryOpts = {};
+		const hidden = hiddenColumnsOption(getTableColumns(table), this.registry.getCollectionByPath(collectionPath) ?? void 0);
+		if (hidden) queryOpts.columns = hidden;
 		if (withConfig) queryOpts.with = withConfig;
 		const allConditions = [];
 		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
 			const collection = getCollectionByPath(collectionPath, this.registry);
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) {
 				queryOpts.where = and(eq(idField, -99999999));
 				return queryOpts;
@@ -3267,7 +3437,7 @@ var FetchService = class {
 		const orderExpressions = [];
 		if (options.orderBy) {
 			const collection = getCollectionByPath(collectionPath, this.registry);
-			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
 			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
 		}
 		orderExpressions.push(desc(idField));
@@ -3284,6 +3454,7 @@ var FetchService = class {
 		if (!options.startAfter) return [];
 		const cursor = options.startAfter;
 		if (options.orderBy) {
+			if (options.orderBy === FetchService.SCORE_FIELD) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with `orderBy: \"_score\"`. Relevance is computed per query rather than stored, so it cannot key a cursor. Use `limit`/`offset` for relevance-ordered pages, or order by a column.", "SCORE_CURSOR_UNSUPPORTED", { field: FetchService.SCORE_FIELD });
 			const collection = collectionPath ? getCollectionByPath(collectionPath, this.registry) : void 0;
 			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
 			if (orderByField) {
@@ -3354,9 +3525,11 @@ var FetchService = class {
 		const qb = this.getQueryBuilder(tableName);
 		if (qb) try {
 			const withConfig = this.buildWithConfig(collection);
+			const hidden = hiddenColumnsOption(getTableColumns(table), collection);
 			const row = await qb.findFirst({
 				where: eq(idField, parsedId),
-				with: withConfig
+				with: withConfig,
+				...hidden ? { columns: hidden } : {}
 			});
 			if (!row) return void 0;
 			const flatRow = toFlatRow(row, collection, this.registry);
@@ -3370,7 +3543,8 @@ var FetchService = class {
 			if (reachedDatabase(e)) throw e;
 			logger.warn(`[FetchService] db.query.findFirst failed for ${collectionPath}, falling back to db.select`, { error: e });
 		}
-		const result = await this.db.select().from(table).where(eq(idField, parsedId)).limit(1);
+		const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
+		const result = await this.db.select(visibleOne).from(table).where(eq(idField, parsedId)).limit(1);
 		if (result.length === 0) return void 0;
 		const raw = result[0];
 		const values = await parseDataFromServer(raw, collection, this.db, this.registry);
@@ -3388,6 +3562,7 @@ var FetchService = class {
 						values[key] = createRelationRef(e.id, e.path);
 					}
 				} catch (e) {
+					if (reachedDatabase(e)) throw e;
 					logger.warn(`Could not resolve one-to-one relation property: ${key}`, { error: e });
 				}
 			}
@@ -3426,14 +3601,21 @@ var FetchService = class {
 		}
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
+		const visible = visibleColumnProjection(getTableColumns(table), collection);
+		const rankSelect = options.searchString ? DrizzleConditionBuilder.buildSearchRankExpression(options.searchString, table, collection) : void 0;
+		const matchesSelect = options.searchString && options.searchExplain ? DrizzleConditionBuilder.buildSearchMatchesExpression(options.searchString, table, collection) : void 0;
 		let query = vectorMeta ? this.db.select({
-			table_row: table,
+			table_row: visible ?? table,
 			_distance: vectorMeta.distanceSelect
-		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
+		}).from(table).$dynamic() : rankSelect ? this.db.select({
+			table_row: visible ?? table,
+			_score: rankSelect,
+			...matchesSelect ? { _matches: matchesSelect } : {}
+		}).from(table).$dynamic() : visible ? this.db.select(visible).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
 		if (scopeCondition) allConditions.push(scopeCondition);
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return [];
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
@@ -3453,7 +3635,7 @@ var FetchService = class {
 		const orderExpressions = [];
 		if (vectorMeta) orderExpressions.push(asc(vectorMeta.orderBy));
 		else if (options.orderBy) {
-			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
 			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
 		}
 		orderExpressions.push(desc(idField));
@@ -3473,6 +3655,10 @@ var FetchService = class {
 		const results = vectorMeta ? rawResults.map((r) => ({
 			...r.table_row,
 			_distance: typeof r._distance === "number" ? r._distance : parseFloat(String(r._distance))
+		})) : rankSelect ? rawResults.map((r) => ({
+			...r.table_row,
+			_score: typeof r._score === "number" ? r._score : parseFloat(String(r._score)),
+			...matchesSelect ? { _matches: r._matches ?? [] } : {}
 		})) : rawResults;
 		return this.processRowResults(results, collection, collectionPath, idInfo, options.databaseId, false, idInfoArray);
 	}
@@ -3514,6 +3700,7 @@ var FetchService = class {
 						if (relatedRow) item.values[key] = createRelationRefWithData(relatedRow.id, relatedRow.path, relatedRow);
 					});
 				} catch (e) {
+					if (reachedDatabase(e)) throw e;
 					logger.warn(`Could not batch load one-to-one relation property: ${key}`, { error: e });
 				}
 			}
@@ -3527,6 +3714,7 @@ var FetchService = class {
 					item.values[key] = relatedRows.map((e) => createRelationRefWithData(e.id, e.path, e));
 				});
 			} catch (e) {
+				if (reachedDatabase(e)) throw e;
 				logger.warn(`Could not batch load many relation property: ${key}`, { error: e });
 			}
 		}
@@ -3564,7 +3752,7 @@ var FetchService = class {
 		const allConditions = [];
 		if (hop) allConditions.push(this.buildRelationScope(hop));
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return 0;
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
@@ -3660,6 +3848,7 @@ var FetchService = class {
 					if (related) row[key] = { ...related.values };
 				}
 			} catch (e) {
+				if (reachedDatabase(e)) throw e;
 				logger.warn(`[include] Failed to batch load one-to-one '${key}'`, { error: e });
 			}
 		}
@@ -3672,6 +3861,7 @@ var FetchService = class {
 					row[key] = batchResults.get(String(eid)) || [];
 				}
 			} catch (e) {
+				if (reachedDatabase(e)) throw e;
 				logger.warn(`[include] Failed to batch load many '${key}'`, { error: e });
 			}
 		}
@@ -3709,7 +3899,8 @@ var FetchService = class {
 			if (reachedDatabase(e)) throw e;
 			logger.warn(`[fetchOneForRest] db.query.findFirst failed for ${collectionPath}, falling back`, { error: e });
 		}
-		const result = await this.db.select().from(table).where(eq(idField, parsedId)).limit(1);
+		const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
+		const result = await this.db.select(visibleOne).from(table).where(eq(idField, parsedId)).limit(1);
 		if (result.length === 0) return null;
 		const flatEntity = { ...result[0] };
 		if (!include || include.length === 0) return flatEntity;
@@ -3733,6 +3924,7 @@ var FetchService = class {
 					...e.values
 				}));
 			} catch (e) {
+				if (reachedDatabase(e)) throw e;
 				logger.warn(`[include] Failed to load relation '${key}'`, { error: e });
 			}
 		}
@@ -3747,14 +3939,21 @@ var FetchService = class {
 		const idField = table[requirePrimaryKeys(collection, this.registry)[0].fieldName];
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
+		const visible = visibleColumnProjection(getTableColumns(table), collection);
+		const rankSelect = options.searchString ? DrizzleConditionBuilder.buildSearchRankExpression(options.searchString, table, collection) : void 0;
+		const matchesSelect = options.searchString && options.searchExplain ? DrizzleConditionBuilder.buildSearchMatchesExpression(options.searchString, table, collection) : void 0;
 		let query = vectorMeta ? this.db.select({
-			table_row: table,
+			table_row: visible ?? table,
 			_distance: vectorMeta.distanceSelect
-		}).from(table).$dynamic() : this.db.select().from(table).$dynamic();
+		}).from(table).$dynamic() : rankSelect ? this.db.select({
+			table_row: visible ?? table,
+			_score: rankSelect,
+			...matchesSelect ? { _matches: matchesSelect } : {}
+		}).from(table).$dynamic() : visible ? this.db.select(visible).from(table).$dynamic() : this.db.select().from(table).$dynamic();
 		const allConditions = [];
 		if (options.relatedTo) allConditions.push(this.buildRelationScope(options.relatedTo));
 		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table);
+			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return [];
 			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
 		}
@@ -3762,6 +3961,10 @@ var FetchService = class {
 			const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
 			if (filterConditions.length > 0) allConditions.push(...filterConditions);
 		}
+		if (options.logical) {
+			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
+			if (logicalCondition) allConditions.push(logicalCondition);
+		}
 		if (vectorMeta?.filter) allConditions.push(vectorMeta.filter);
 		if (allConditions.length > 0) {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
@@ -3770,7 +3973,7 @@ var FetchService = class {
 		const orderExpressions = [];
 		if (vectorMeta) orderExpressions.push(asc(vectorMeta.orderBy));
 		else if (options.orderBy) {
-			const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
 			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
 		}
 		orderExpressions.push(desc(idField));
@@ -3783,6 +3986,11 @@ var FetchService = class {
 			...r.table_row,
 			_distance: typeof r._distance === "number" ? r._distance : parseFloat(String(r._distance))
 		}));
+		if (rankSelect) return rawResults.map((r) => ({
+			...r.table_row,
+			_score: typeof r._score === "number" ? r._score : parseFloat(String(r._score)),
+			...matchesSelect ? { _matches: r._matches ?? [] } : {}
+		}));
 		return rawResults;
 	}
 	/**
@@ -3796,51 +4004,6 @@ var FetchService = class {
 		return !!this.getQueryBuilder(tableName);
 	}
 	/**
-	* Attempt to use Drizzle's relational query API (db.query.<table>.findMany)
-	* for efficient JOIN-based relation loading.
-	* Returns null if the API is not available or the query fails.
-	* Note: Primary path now uses `buildWithConfig` + `buildDrizzleQueryOptions`.
-	*/
-	async fetchWithDrizzleQuery(collectionPath, collection, options, include, idInfo, idInfoArray) {
-		try {
-			const table = getTableForCollection(collection, this.registry);
-			const tableName = getTableName(table);
-			const queryTarget = this.getQueryBuilder(tableName);
-			if (!queryTarget?.findMany) return null;
-			const resolvedRelations = resolveCollectionRelations(collection);
-			const withConfig = {};
-			for (const [key, relation] of Object.entries(resolvedRelations)) if (include[0] === "*" || include.includes(key)) {
-				const drizzleRelName = relation.relationName || key;
-				withConfig[drizzleRelName] = true;
-			}
-			const queryOpts = { with: withConfig };
-			if (options.limit) queryOpts.limit = options.limit;
-			if (options.filter) {
-				const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
-				if (filterConditions.length > 0) queryOpts.where = and(...filterConditions);
-			}
-			if (options.orderBy) {
-				const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
-				if (orderByField) queryOpts.orderBy = options.order === "asc" ? asc(orderByField) : desc(orderByField);
-			}
-			return (await queryTarget.findMany(queryOpts)).map((row) => {
-				const flat = {};
-				for (const [k, v] of Object.entries(row)) if (Array.isArray(v)) flat[k] = v.map((item) => {
-					const keys = Object.keys(item);
-					const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-					if (nestedObj && keys.length <= 3) return { ...item[nestedObj] };
-					return { ...item };
-				});
-				else if (typeof v === "object" && v !== null) flat[k] = { ...v };
-				else flat[k] = v;
-				return flat;
-			});
-		} catch (e) {
-			logger.warn(`[include] Drizzle relational query failed for '${collectionPath}', falling back`, { error: e });
-			return null;
-		}
-	}
-	/**
 	* Fallback path used when db.query is unavailable.
 	* The primary path uses db.query.findMany with `with` config, which
 	* loads all relations in a single query.
@@ -3865,6 +4028,269 @@ var FetchService = class {
 	}
 };
 //#endregion
+//#region src/services/RelationWriteService.ts
+/**
+* The ids in a to-many relation write, whatever shape the caller sent.
+*
+* A membership list is written as either the related rows (`[{ id: 1 }]`, what
+* the admin UI sends back after reading them) or as bare keys (`[1]`, `["t-1"]`,
+* what anyone writing the API by hand sends). Only the first was read, via a
+* blind `.map(rel => rel.id)`, and a bare key therefore became `undefined`:
+* on a numeric-keyed target that surfaced as `Invalid numeric ID: undefined`,
+* and on a string-keyed one it did not surface at all — `String(undefined)`
+* wrote a junction row pointing at the literal `"undefined"`, which no read
+* would ever match. Both shapes are accepted here, in one place, because both
+* call sites had the same assumption.
+*
+* An element that carries no key is refused rather than skipped: dropping it
+* would silently write a shorter membership list than the caller asked for.
+*/
+function relationTargetIds(value, relationName, collectionSlug) {
+	if (!Array.isArray(value)) return [];
+	return value.map((element, index) => {
+		if (typeof element === "string" || typeof element === "number") return element;
+		if (element && typeof element === "object") {
+			const id = element.id;
+			if (typeof id === "string" || typeof id === "number") return id;
+		}
+		throw new Error(`Cannot write relation "${relationName}" on "${collectionSlug}": element ${index} carries no id. Pass either the related rows (\`[{ id: … }]\`) or their keys (\`[1, 2]\`), not ${element === null ? "null" : typeof element}.`);
+	});
+}
+/**
+* Writing relations: junction membership, foreign-key stamping, and the links a
+* nested path creates or removes.
+*
+* Split from {@link RelationService}, which now only reads. The two had grown
+* into one 1700-line class doing two unrelated jobs, and sharing one habit —
+* warning about a relation it could not resolve and carrying on, which surfaces
+* as an empty list on the read side and as a successful save on the write side.
+* Separating them is what made that visible as one class of defect rather than
+* eighteen scattered log lines.
+*
+* The reads it still needs — the source key a link joins on — it asks
+* {@link RelationService} for rather than reimplementing.
+*/
+var RelationWriteService = class {
+	db;
+	registry;
+	reads;
+	constructor(db, registry) {
+		this.db = db;
+		this.registry = registry;
+		this.reads = new RelationService(db, registry);
+	}
+	/**
+	* Remove the junction row linking a parent to `targetId`, leaving the target
+	* row itself alone.
+	*
+	* This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
+	* target is shared, so deleting the row would remove the tag from every other
+	* post that uses it. It used to do exactly that — resolve the path to the
+	* `tags` table and delete by primary key.
+	*/
+	async unlinkRelatedEntity(tx, hop, targetId) {
+		if (!isManyToMany(hop.relation)) throw new Error(`Relation '${hop.relationKey}' has no junction table to unlink through`);
+		await removeJunctionLink(tx, bindThroughJunction(this.registry, hop.relation.through, `${hop.parentCollection.slug}.${hop.relationKey}`), this.parsedId(hop.parentCollection, hop.parentId), this.parsedId(hop.targetCollection, targetId), {
+			parent: hop.parentCollection.slug,
+			relation: hop.relationKey
+		});
+	}
+	/** A collection's id, parsed to the type its primary key column holds. */
+	parsedId(collection, id) {
+		const pks = requirePrimaryKeys(collection, this.registry);
+		return parseIdValues(id, pks)[pks[0].fieldName];
+	}
+	/** The same, for the membership list a to-many write names. */
+	parsedIds(collection, ids) {
+		if (ids.length === 0) return [];
+		const pks = requirePrimaryKeys(collection, this.registry);
+		return ids.map((id) => parseIdValues(id, pks)[pks[0].fieldName]);
+	}
+	/**
+	* Update many-to-many and junction relations
+	*/
+	async updateRelationsUsingJoins(tx, collection, id, relationValues) {
+		const resolvedRelations = resolveCollectionRelations(collection);
+		for (const [key, value] of Object.entries(relationValues)) {
+			const relation = findRelation(resolvedRelations, key);
+			if (!relation || relation.cardinality !== "many") continue;
+			const targetEntityIds = relationTargetIds(value, key, collection.slug);
+			const targetCollection = relation.target();
+			const label = `${collection.slug}.${key}`;
+			if (relation.kind === "via") await applyJunctionMembership(tx, bindJoinPathJunction(this.registry, relation.joinPath, getTableName$1(collection), getTableName$1(targetCollection), label), this.parsedId(collection, id), this.parsedIds(targetCollection, targetEntityIds));
+			else if (relation.kind === "manyToMany") await applyJunctionMembership(tx, bindThroughJunction(this.registry, relation.through, label), this.parsedId(collection, id), this.parsedIds(targetCollection, targetEntityIds));
+			else if (relation.cardinality === "many" && hasForeignKeyOnTarget(relation)) {
+				const targetTable = getTableForCollection(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+				const targetIdInfo = targetPks[0];
+				const targetIdCol = targetTable[targetIdInfo.fieldName];
+				const fkField = fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget);
+				const fkCol = targetTable[fkField];
+				if (!fkCol || !targetIdCol) throw relationMisconfigured(label, `the target table '${getTableName$1(targetCollection)}' has no ${fkCol ? `'${targetIdInfo.fieldName}' key column` : `'${relation.foreignKeyOnTarget}' foreign-key column`}`);
+				const parentKeyValue = (await this.reads.resolveSourceKeys(collection, relation, [id], tx)).keyByParentId.get(String(id));
+				if (parentKeyValue === void 0) throw new Error(`Cannot write relation '${key}' on '${collection.slug}': row '${id}' has no value in \`sourceKey: "${sourceKeyField(relation, collection, this.registry)}"\`, so there is nothing for the related rows to point at.`);
+				if (targetEntityIds.length > 0) {
+					const parsedTargetIds = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
+					await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(fkCol, parentKeyValue), notInArray(targetIdCol, parsedTargetIds)));
+					await tx.update(targetTable).set({ [fkField]: parentKeyValue }).where(inArray(targetIdCol, parsedTargetIds));
+				} else await tx.update(targetTable).set({ [fkField]: null }).where(eq(fkCol, parentKeyValue));
+			} else throw relationMisconfigured(label, "it is a to-many relation with no way to write links — a `manyToMany` needs `through`, a `hasMany` needs `foreignKeyOnTarget`");
+		}
+	}
+	/**
+	* Update inverse relations (where FK is on the target table)
+	*/
+	async updateInverseRelations(tx, sourceCollection, sourceEntityId, inverseRelationUpdates) {
+		for (const update of inverseRelationUpdates) {
+			const { relation, newValue } = update;
+			try {
+				const targetCollection = relation.target();
+				const targetTable = getTableForCollection(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+				const targetIdInfo = targetPks[0];
+				requirePrimaryKeys(sourceCollection, this.registry)[0];
+				if (relation.kind === "via") {
+					await this.updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue);
+					continue;
+				}
+				if (isManyToMany(relation)) {
+					await this.updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, {
+						table: relation.through.table,
+						sourceColumn: relation.through.sourceColumn,
+						targetColumn: relation.through.targetColumn
+					});
+					continue;
+				}
+				const label = `${sourceCollection.slug}.${relation.relationName}`;
+				if (!hasForeignKeyOnTarget(relation)) throw relationMisconfigured(label, `a '${relation.kind}' relation names no column on the target to write the link into`);
+				const fkField = fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget);
+				const foreignKeyColumn = targetTable[fkField];
+				if (!foreignKeyColumn) throw relationMisconfigured(label, `'${relation.foreignKeyOnTarget}' is not a column on the target table '${getTableName$1(targetCollection)}'`);
+				const sourceKeyValue = (await this.reads.resolveSourceKeys(sourceCollection, relation, [sourceEntityId], tx)).keyByParentId.get(String(sourceEntityId));
+				if (sourceKeyValue === void 0) throw new Error(`Cannot write relation '${relation.relationName}' on '${sourceCollection.slug}': row '${sourceEntityId}' has no value in \`sourceKey: "${sourceKeyField(relation, sourceCollection, this.registry)}"\`, so there is nothing for the related row to point at.`);
+				if (newValue === null || newValue === void 0) await tx.update(targetTable).set({ [fkField]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
+				else {
+					const parsedNewTargetId = parseIdValues(newValue, targetPks)[targetIdInfo.fieldName];
+					const targetIdField = targetTable[targetIdInfo.fieldName];
+					await tx.update(targetTable).set({ [fkField]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
+					await tx.update(targetTable).set({ [fkField]: sourceKeyValue }).where(eq(targetIdField, parsedNewTargetId));
+				}
+			} catch (e) {
+				if (e instanceof ApiError || e?.name === "ApiError") throw e;
+				logger.warn(`Failed to update inverse relation '${relation.relationName}'`, { error: e });
+			}
+		}
+	}
+	/**
+	* Handle inverse relations with joinPath
+	*/
+	async updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue) {
+		const sourceTableName = getTableName$1(sourceCollection);
+		const targetTableName = getTableName$1(targetCollection);
+		if (relation.joinPath.map((step) => step.table).filter((table) => table !== sourceTableName && table !== targetTableName).length !== 1 || relation.cardinality !== "many") return;
+		try {
+			const binding = bindJoinPathJunction(this.registry, relation.joinPath, sourceTableName, targetTableName, `${sourceCollection.slug}.${relation.relationName}`);
+			const targetIds = Array.isArray(newValue) ? relationTargetIds(newValue, relation.relationName, sourceCollection.slug) : newValue === null || newValue === void 0 ? [] : relationTargetIds([newValue], relation.relationName, sourceCollection.slug);
+			await applyJunctionMembership(tx, binding, this.parsedId(sourceCollection, sourceEntityId), this.parsedIds(targetCollection, targetIds));
+		} catch (error) {
+			logger.error(`Failed to update inverse joinPath relation '${relation.relationName}'`, { error });
+			throw error;
+		}
+	}
+	/**
+	* Handle many-to-many inverse relation updates using junction tables
+	*/
+	async updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, junctionInfo) {
+		try {
+			const targetIds = Array.isArray(newValue) ? relationTargetIds(newValue, relation.relationName, sourceCollection.slug) : [];
+			await applyJunctionMembership(tx, bindThroughJunction(this.registry, junctionInfo, `${sourceCollection.slug}.${relation.relationName}`), this.parsedId(sourceCollection, sourceEntityId), this.parsedIds(targetCollection, targetIds));
+		} catch (error) {
+			logger.error(`Failed to update many-to-many inverse relation '${relation.relationName}'`, { error });
+			throw error;
+		}
+	}
+	/**
+	* Update one-to-one relations that use joinPath
+	*/
+	async updateJoinPathOneToOneRelations(tx, parentCollection, parentId, updates) {
+		for (const upd of updates) {
+			const { relation, newTargetId } = upd;
+			const targetCollection = relation.target();
+			const targetTable = getTableForCollection(targetCollection, this.registry);
+			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+			const targetIdInfo = targetPks[0];
+			const targetIdCol = targetTable[targetIdInfo.fieldName];
+			const { targetFKColName: targetFKColumn, parentSourceColName: parentSourceColumn } = this.resolveJoinPathWriteMapping(parentCollection, relation);
+			const targetFKColName = fieldKeyForColumn(targetCollection, targetFKColumn);
+			const parentSourceColName = fieldKeyForColumn(parentCollection, parentSourceColumn);
+			const parentTable = getTableForCollection(parentCollection, this.registry);
+			const parentPks = requirePrimaryKeys(parentCollection, this.registry);
+			const parentIdInfo = parentPks[0];
+			const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
+			const parentIdCol = parentTable[parentIdInfo.fieldName];
+			const parentSourceCol = parentTable[parentSourceColName];
+			const targetFKCol = targetTable[targetFKColName];
+			const label = `${parentCollection.slug}.${relation.relationName}`;
+			if (!parentSourceCol) throw relationMisconfigured(label, `its joinPath reads '${parentSourceColName}', which is not a column on '${getTableName$1(parentCollection)}'`);
+			if (!targetFKCol) throw relationMisconfigured(label, `its joinPath writes '${targetFKColName}', which is not a column on '${getTableName$1(targetCollection)}'`);
+			const parentRows = await tx.select({ val: parentSourceCol }).from(parentTable).where(eq(parentIdCol, parsedParentId)).limit(1);
+			if (parentRows.length === 0) continue;
+			const parentFKValue = parentRows[0].val;
+			if (newTargetId === null || newTargetId === void 0) {
+				if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
+				continue;
+			}
+			const parsedTargetId = parseIdValues(newTargetId, targetPks)[targetIdInfo.fieldName];
+			if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
+			else throw ApiError.badRequest(`Cannot write relation '${label}': row '${parentId}' has no value in '${parentSourceColName}', which is the column its joinPath joins on, so there is nothing for the related row to point at.`, "RELATION_SOURCE_KEY_EMPTY");
+			await tx.update(targetTable).set({ [targetFKColName]: parentFKValue }).where(eq(targetIdCol, parsedTargetId));
+		}
+	}
+	/**
+	* Resolve joinPath write mapping for one-to-one relations
+	*/
+	resolveJoinPathWriteMapping(parentCollection, relation) {
+		if (!relation.joinPath || relation.joinPath.length === 0) throw new Error("resolveJoinPathWriteMapping requires a joinPath relation");
+		const parentTableName = getTableName$1(parentCollection);
+		const lastStep = relation.joinPath[relation.joinPath.length - 1];
+		const targetFKColName = DrizzleConditionBuilder.getColumnNamesFromColumns(lastStep.on.to)[0];
+		let currentFrom = lastStep.on.from;
+		let safety = 0;
+		while (safety++ < 10) {
+			if (DrizzleConditionBuilder.getTableNamesFromColumns(currentFrom)[0] === parentTableName) break;
+			const prevStep = relation.joinPath.find((s) => {
+				return (Array.isArray(s.on.to) ? s.on.to[0] : s.on.to) === currentFrom;
+			});
+			if (!prevStep) throw new Error(`Could not resolve parent source column for joinPath relation '${relation.relationName}'`);
+			currentFrom = prevStep.on.from;
+		}
+		return {
+			targetFKColName,
+			parentSourceColName: DrizzleConditionBuilder.getColumnNamesFromColumns(currentFrom)[0]
+		};
+	}
+	/**
+	* Handle junction table creation for many-to-many path-based saves
+	*/
+	async handleJunctionTableCreation(tx, newEntityId, junctionTableInfo) {
+		const { parentCollection, parentId, relation, relationKey } = junctionTableInfo;
+		const targetCollection = relation.target();
+		try {
+			const binding = bindThroughJunction(this.registry, relation.through, `${parentCollection.slug}.${relationKey}`);
+			const parsedNewEntityId = this.parsedId(targetCollection, newEntityId);
+			const junctionData = {
+				[binding.parentColumn.name]: parentId,
+				[binding.targetColumn.name]: parsedNewEntityId
+			};
+			await tx.insert(binding.table).values(junctionData).onConflictDoNothing();
+			logger.info(`Linked '${relationKey}' ${parsedNewEntityId} to ${parentId}`);
+		} catch (error) {
+			logger.error(`Failed to create junction table entry for relation '${relationKey}'`, { error });
+			throw error;
+		}
+	}
+};
+//#endregion
 //#region src/services/PersistService.ts
 /**
 * Service for handling all row write operations.
@@ -3873,34 +4299,24 @@ var FetchService = class {
 var PersistService = class {
 	db;
 	registry;
+	/** Reads: whether a row is under a parent, the key a link joins on. */
 	relationService;
+	/** Writes: junction membership, foreign-key stamping, links. */
+	relationWrites;
 	fetchService;
 	constructor(db, registry) {
 		this.db = db;
 		this.registry = registry;
 		this.relationService = new RelationService(db, registry);
+		this.relationWrites = new RelationWriteService(db, registry);
 		this.fetchService = new FetchService(db, registry);
 	}
 	/**
-	* Explain a write that matched no rows.
-	*
-	* Row-level security filters UPDATE and DELETE through the policy's USING
-	* clause instead of raising: a denied write is reported by Postgres exactly
-	* like a successful one that happened to match nothing. Left unchecked, a
-	* caller cannot tell "denied" from "done" — the write returns 200/204 and
-	* the row is untouched.
-	*
-	* Re-reading the target over the *same* RLS-scoped handle separates the two
-	* cases. A visible row means the policy rejected the write (403); an
-	* invisible one means there is nothing there to write for this caller (404,
-	* matching what a GET would say). The re-read is bound by the caller's own
-	* policies, so it discloses nothing a plain read wouldn't.
-	*
-	* Only reached when zero rows matched, so the happy path pays nothing.
+	* Explain a row write that matched nothing — see {@link explainZeroRowWrite}
+	* for why a zero-row write cannot be reported as success.
 	*/
-	async explainZeroRowWrite(handle, table, conditions, collectionPath, id, operation) {
-		if ((await handle.select({ present: sql`1` }).from(table).where(and(...conditions)).limit(1)).length > 0) return ApiError.forbidden(`Not allowed to ${operation} "${id}" in "${collectionPath}": a row-level security policy rejected the write.`, "WRITE_DENIED");
-		return ApiError.notFound(`No row "${id}" in "${collectionPath}" to ${operation}.`);
+	explainZeroRowWrite(handle, table, conditions, collectionPath, id, operation) {
+		return explainZeroRowWrite(handle, table, conditions, `Not allowed to ${operation} "${id}" in "${collectionPath}": a row-level security policy rejected the write.`, `No row "${id}" in "${collectionPath}" to ${operation}.`);
 	}
 	/**
 	* Delete an row by ID
@@ -3912,7 +4328,7 @@ var PersistService = class {
 			if (!await this.relationService.isRelated(hop, id)) throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to delete.`);
 			if (isJunctionBackedRelation(hop.relation)) {
 				if (!isManyToMany(hop.relation)) throw ApiError.badRequest(`"${collectionPath}" reaches '${hop.targetCollection.slug}' through a multi-hop joinPath, so there is no single link to remove. Delete the row at "${hop.targetCollection.slug}" directly if that is what you meant.`, "RELATION_NOT_UNLINKABLE");
-				await this.relationService.unlinkRelatedEntity(this.db, hop, id);
+				await this.relationWrites.unlinkRelatedEntity(this.db, hop, id);
 				return;
 			}
 		}
@@ -3936,8 +4352,14 @@ var PersistService = class {
 		await this.db.delete(table);
 	}
 	/**
-	* The column on the *target* table that records the parent, for a create
-	* under a nested one-to-many path.
+	* The field on the *target* row that records the parent, for a create under
+	* a nested one-to-many path.
+	*
+	* A **field**, not the column: the value is stamped into the caller's
+	* payload, which is keyed by wire names — `authorId`, never the `author_id`
+	* the relation names its link by. Stamping the column instead put a key on
+	* the payload that no property answers to, and `strictWrites` rejected the
+	* request the framework had just written to.
 	*
 	* Returns `undefined` when the link is not a column at all (a multi-hop
 	* `joinPath`), so the caller writes the row without stamping anything.
@@ -3950,8 +4372,8 @@ var PersistService = class {
 		const { relation } = hop;
 		switch (relation.kind) {
 			case "hasOne":
-			case "hasMany": return relation.foreignKeyOnTarget;
-			case "via": return relation.joinPath.length === 1 ? DrizzleConditionBuilder.getColumnNamesFromColumns(relation.joinPath[0].on.to)[0] : void 0;
+			case "hasMany": return fieldKeyForColumn(hop.targetCollection, relation.foreignKeyOnTarget);
+			case "via": return relation.joinPath.length === 1 ? fieldKeyForColumn(hop.targetCollection, DrizzleConditionBuilder.getColumnNamesFromColumns(relation.joinPath[0].on.to)[0]) : void 0;
 			default: return;
 		}
 	}
@@ -4023,12 +4445,13 @@ var PersistService = class {
 			const inverseRelationUpdates = serializedResult.inverseRelationUpdates;
 			const joinPathRelationUpdates = serializedResult.joinPathRelationUpdates;
 			const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
+			assertWritableColumns(entityData, table, effectiveCollectionPath);
 			savedId = await this.db.transaction(async (tx) => {
 				let currentId;
 				if (id && !options?.upsert) {
 					currentId = id;
 					const idValues = parseIdValues(id, idInfoArray);
-					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
+					if (joinPathRelationUpdates.length > 0) await this.relationWrites.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
 					if (Object.keys(entityData).length > 0) {
 						const updateQuery = tx.update(table).set(entityData);
 						const conditions = [];
@@ -4049,6 +4472,7 @@ var PersistService = class {
 						const target = idInfoArray.map((info) => table[info.fieldName]);
 						const set = { ...dataForInsert };
 						for (const info of idInfoArray) delete set[info.fieldName];
+						for (const [propName, prop] of Object.entries(collection.properties ?? {})) if (prop.type === "date" && prop.autoValue === "on_create") delete set[propName];
 						result = Object.keys(set).length > 0 ? await insertQuery.onConflictDoUpdate({
 							target,
 							set
@@ -4058,11 +4482,11 @@ var PersistService = class {
 					if (!resultRow) if (id) currentId = id;
 					else throw ApiError.forbidden(`Not allowed to write to "${effectiveCollectionPath}": the row was rejected by a row-level security policy.`, "WRITE_DENIED");
 					else currentId = buildCompositeId(resultRow, idInfoArray);
-					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
+					if (joinPathRelationUpdates.length > 0) await this.relationWrites.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
 				}
-				if (inverseRelationUpdates.length > 0) await this.relationService.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
-				if (Object.keys(relationValues).length > 0) await this.relationService.updateRelationsUsingJoins(tx, collection, currentId, relationValues);
-				if (junctionTableInfo) await this.relationService.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
+				if (inverseRelationUpdates.length > 0) await this.relationWrites.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
+				if (Object.keys(relationValues).length > 0) await this.relationWrites.updateRelationsUsingJoins(tx, collection, currentId, relationValues);
+				if (junctionTableInfo) await this.relationWrites.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
 				return currentId;
 			});
 		} catch (error) {
@@ -4079,6 +4503,15 @@ var PersistService = class {
 		return this.relationService;
 	}
 	/**
+	* The write half, for external use. Separate from
+	* {@link getRelationService} because they are separate objects now: reads
+	* answer questions, writes change rows, and the callers of one are not the
+	* callers of the other.
+	*/
+	getRelationWriteService() {
+		return this.relationWrites;
+	}
+	/**
 	* Get the FetchService instance for external use
 	*/
 	getFetchService() {
@@ -4091,7 +4524,8 @@ var PersistService = class {
 		if (error instanceof ApiError || error?.name === "ApiError") return error;
 		const pgError = extractPgError(error);
 		if (pgError) {
-			const { message } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+			const { message, code } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`) : ApiError.badRequest(message, `PG_${code}`);
 			return new Error(message);
 		}
 		const causeMessage = extractCauseMessage(error);
@@ -4316,6 +4750,7 @@ var BranchService = class {
                 metadata     JSONB DEFAULT '{}'
             );
         `));
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "branches")));
 	}
 	/**
 	* Create a new branch database by templating the source database.
@@ -4422,241 +4857,6 @@ var BranchService = class {
 	}
 };
 //#endregion
-//#region src/security/rls-enforcement.ts
-/**
-* Unified RLS enforcement — the "user context vs server context" model.
-*
-* Every operation runs in one of two contexts:
-*
-*  - **User context** — a request authenticated (or anonymous) via
-*    `driver.withAuth(user)`. Runs as the restricted `rebase_user` role: a
-*    non-owner, NOSUPERUSER, NOBYPASSRLS role, so Postgres RLS binds *every*
-*    statement (SELECT, INSERT, UPDATE, DELETE). The collection's
-*    `securityRules` are the whole authorization model; app-layer callbacks
-*    are validation/side-effects, not a security boundary.
-*
-*  - **Server context** — the base (owner) connection: auth flows, migrations,
-*    background jobs, and the explicit `rebase.dataAsAdmin` accessor. As table
-*    owner it bypasses RLS. This is the trusted plane, equivalent to
-*    Supabase's `service_role`.
-*
-* This module provides the three pieces:
-*
-*  1. {@link detectConnectionPosture} — is the connection subject to RLS at
-*     all? (superuser / BYPASSRLS / table owner ⇒ no)
-*  2. {@link ensureAppRole} — idempotently provision `rebase_user` with
-*     SELECT/INSERT/UPDATE/DELETE grants (+ default privileges so future
-*     tables stay covered).
-*  3. {@link applyAuthContext} — per-transaction: set the `app.*` GUCs the
-*     policies read (`auth.uid()` etc.) and `SET LOCAL ROLE rebase_user` so
-*     RLS binds. Transaction-scoped, so it composes with poolers.
-*
-* Provisioning runs from the framework's own bootstrap/migrate (which already
-* self-creates the `auth` schema and functions) — enforcement is default-on,
-* not an operator opt-in.
-*/
-/** The restricted role every authenticated (user-context) request runs as. */
-var REBASE_USER_ROLE = "rebase_user";
-var quoteIdent$1 = (name) => `"${name.replace(/"/g, "\"\"")}"`;
-/** DML the user role holds on managed tables (RLS still filters per row). */
-var USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
-async function detectConnectionPosture(run) {
-	const row = (await run(`
-        SELECT current_user            AS role,
-               r.rolsuper              AS superuser,
-               r.rolbypassrls          AS bypassrls,
-               EXISTS (
-                   SELECT 1 FROM pg_tables t
-                   WHERE t.tableowner = current_user
-                     AND t.schemaname NOT IN ('pg_catalog', 'information_schema')
-               )                       AS owns_tables
-        FROM pg_roles r
-        WHERE r.rolname = current_user
-    `))[0] ?? {};
-	const superuser = row.superuser === true;
-	const bypassRLS = row.bypassrls === true;
-	const ownsTables = row.owns_tables === true;
-	return {
-		role: String(row.role ?? "unknown"),
-		superuser,
-		bypassRLS,
-		ownsTables,
-		privileged: superuser || bypassRLS || ownsTables
-	};
-}
-/**
-* Human-actionable instructions for when the connection cannot provision the
-* user role itself (no CREATEROLE and role not pre-created by the platform).
-*/
-function appRoleSetupInstructions(connectionRole, schemas) {
-	const grants = schemas.map((s) => `GRANT USAGE ON SCHEMA ${quoteIdent$1(s)} TO ${REBASE_USER_ROLE};\nGRANT ${USER_TABLE_PRIVILEGES} ON ALL TABLES IN SCHEMA ${quoteIdent$1(s)} TO ${REBASE_USER_ROLE};\nGRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${quoteIdent$1(s)} TO ${REBASE_USER_ROLE};`).join("\n");
-	return `Rebase enforces row-level security by running authenticated requests as the restricted role "${REBASE_USER_ROLE}", but the connection role "${connectionRole}" bypasses RLS and cannot create that role itself.\nRun the following as a database administrator, then restart:\n\nCREATE ROLE ${REBASE_USER_ROLE} NOLOGIN NOSUPERUSER NOBYPASSRLS NOINHERIT;\nGRANT ${REBASE_USER_ROLE} TO ${quoteIdent$1(connectionRole)};\n` + grants;
-}
-/**
-* Idempotently provision the `rebase_user` role, membership for the current
-* connection role, and DML grants (+ default privileges for future tables)
-* on every existing schema in `schemas`.
-*
-* Split into privilege tiers so it works both when the connection is a
-* superuser (creates everything) and when the platform pre-created the role
-* and membership (e.g. CNPG `postInitApplicationSQL`) and the connection is
-* merely the table owner — owners can always run the grant tier themselves.
-*
-* RLS still filters every row: these grants only make the tables *reachable*
-* by the role; the policies decide which rows/commands actually pass.
-*
-* Throws with precise setup instructions when the role is missing and the
-* connection cannot create it.
-*/
-async function ensureAppRole(run, schemas) {
-	const uniqueSchemas = Array.from(new Set(schemas.filter(Boolean)));
-	if ((await run(`SELECT 1 FROM pg_roles WHERE rolname = 'rebase_user'`)).length === 0) try {
-		await run(`CREATE ROLE ${REBASE_USER_ROLE} NOLOGIN NOSUPERUSER NOBYPASSRLS NOINHERIT`);
-	} catch (err) {
-		throw new Error(`Failed to create the "${REBASE_USER_ROLE}" role: ${err instanceof Error ? err.message : String(err)}\n\n` + appRoleSetupInstructions("current connection role", uniqueSchemas));
-	}
-	const memberRows = await run(`
-        SELECT (pg_has_role(current_user, '${REBASE_USER_ROLE}', 'MEMBER')
-                OR (SELECT rolsuper FROM pg_roles WHERE rolname = current_user)) AS can_set,
-               current_user AS role
-    `);
-	if (memberRows[0]?.can_set !== true) try {
-		await run(`GRANT ${REBASE_USER_ROLE} TO CURRENT_USER`);
-	} catch (err) {
-		throw new Error(`The connection role is not a member of "${REBASE_USER_ROLE}" and cannot grant itself membership: ${err instanceof Error ? err.message : String(err)}\n\n` + appRoleSetupInstructions(String(memberRows[0]?.role ?? "current connection role"), uniqueSchemas));
-	}
-	const nspRows = await run("SELECT nspname FROM pg_namespace");
-	const existing = new Set(nspRows.map((r) => String(r.nspname)));
-	for (const schema of uniqueSchemas) {
-		if (!existing.has(schema)) continue;
-		const s = quoteIdent$1(schema);
-		await run(`GRANT USAGE ON SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
-		await run(`GRANT ${USER_TABLE_PRIVILEGES} ON ALL TABLES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
-		await run(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
-		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);
-		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);
-	}
-	logger.info(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
-}
-/**
-* Apply the authenticated context to a transaction: the `app.*` GUCs that RLS
-* policies read via `auth.uid()` / `auth.roles()` / `auth.jwt()`, and — when
-* `userRole` is set — `SET LOCAL ROLE` so RLS binds every statement in this
-* transaction (reads *and* writes).
-*
-* GUCs are set with `is_local = true` and the role switch is `LOCAL`: both
-* reset at commit/rollback, so pooled connections are never polluted.
-*
-* Fails closed by construction: if the role switch errors, the transaction
-* aborts instead of proceeding privileged.
-*
-* SECURITY: this function is only ever called on the **user** path (the server
-* context uses the base/owner driver and never calls it). The default policies
-* treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`
-* is `NULLIF(current_setting('app.uid'), '')` — so an EMPTY user id would
-* be read as NULL and silently escalate a user request to server privileges.
-* Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,
-* rather than trusting every caller (e.g. realtime subscription auth) to do it.
-* That sentinel is exported from `@rebasepro/types` because it leaks into rule
-* semantics: it is why `auth.uid() IS NOT NULL` is true for anonymous requests.
-*/
-async function applyAuthContext(tx, auth, userRole) {
-	const uid = typeof auth.uid === "string" && auth.uid.trim() !== "" ? auth.uid : ANONYMOUS_USER_ID;
-	const normalizedRoles = auth.roles.map((r) => typeof r === "string" ? r : r?.id ?? String(r));
-	await tx.execute(sql`
-        SELECT
-            set_config('app.uid', ${uid}, true),
-            set_config('app.user_id', ${uid}, true),
-            set_config('app.user_roles', ${normalizedRoles.join(",")}, true),
-            set_config('app.jwt', ${JSON.stringify({
-		sub: uid,
-		roles: auth.roles
-	})}, true)
-    `);
-	if (userRole) await tx.execute(sql.raw(`SET LOCAL ROLE ${quoteIdent$1(userRole)}`));
-}
-/** Role names from other BaaS platforms that people reach for out of habit. */
-var FOREIGN_CONVENTION_ROLES = {
-	authenticated: "Supabase",
-	anon: "Supabase",
-	service_role: "Supabase"
-};
-/**
-* Warn about rules that read as "signed-in users only" but admit anonymous
-* callers — `auth.uid() IS NOT NULL`, or a comparison against another
-* platform's magic user id such as `'anon'`.
-*
-* The sibling of {@link validatePolicyPgRoles}, for the more dangerous spelling
-* of the same habit. A foreign `pgRoles` value makes a policy unreachable and
-* the table reads empty — loud, and that guard throws. These do the opposite:
-* the rule compiles to a grant, and nothing looks wrong until the data is
-* already public.
-*
-* Warns rather than throws. Unlike an unreachable `pgRoles`, these rules are
-* serving traffic today: refusing to boot would take an app offline to report a
-* problem it already has, and on the read path it would take it offline
-* *because* its data was exposed. Rewriting the author's SQL is not an option
-* either — this is the escape hatch whose whole promise is that it means what it
-* says. So: say so, loudly, and leave the rule alone.
-*/
-function warnOnAnonymousGrants(collections) {
-	const byRisk = /* @__PURE__ */ new Map();
-	for (const collection of collections) for (const rule of collection.securityRules ?? []) {
-		const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
-		const risks = [usingExpr, withCheckExpr].filter((e) => e !== null).flatMap(findAnonymousGrants);
-		for (const risk of risks) {
-			const key = `${risk.pattern}:${risk.detail}`;
-			const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
-			const entry = byRisk.get(key) ?? {
-				risk,
-				sites: []
-			};
-			if (!entry.sites.includes(site)) entry.sites.push(site);
-			byRisk.set(key, entry);
-		}
-	}
-	if (byRisk.size === 0) return;
-	const problems = [...byRisk.values()].map(({ risk, sites }) => `  • ${risk.explanation}\n    ${sites.length} rule(s): ${sites.join(", ")}`);
-	logger.warn(`Security rules that read as a lockdown but grant access to anonymous requests. Every caller from a client carries a user id ('${ANONYMOUS_USER_ID}' when nobody is signed in), so these clauses are true for everyone:\n\n` + problems.join("\n\n") + "\n");
-}
-/**
-* Reject `pgRoles` that this server can never satisfy.
-*
-* `pgRoles` sets the `TO` clause of a generated policy, so a policy naming a
-* role the request never runs as simply never applies — and RLS then filters
-* every row. The table reads as empty, which is indistinguishable from having
-* no data, so the mistake survives review and ships.
-*
-* Requests run as `rebase_user`, so a policy is only reachable if it targets
-* `public` or a role `rebase_user` holds. Anything else is a configuration
-* error worth failing the boot for.
-*/
-async function validatePolicyPgRoles(run, collections, requestRole = REBASE_USER_ROLE) {
-	const wanted = /* @__PURE__ */ new Map();
-	for (const collection of collections) for (const rule of collection.securityRules ?? []) for (const role of rule.pgRoles ?? []) {
-		if (role === "public") continue;
-		wanted.set(role, [...wanted.get(role) ?? [], collection.slug ?? "(unnamed)"]);
-	}
-	if (wanted.size === 0) return;
-	const names = [...wanted.keys()].map((r) => `'${r.replace(/'/g, "''")}'`).join(",");
-	const rows = await run(`
-        SELECT r.rolname AS role,
-               COALESCE(pg_has_role(to_regrole('${requestRole.replace(/'/g, "''")}'), r.oid, 'MEMBER'), false) AS reachable
-        FROM pg_roles r
-        WHERE r.rolname IN (${names})
-    `);
-	const reachable = new Map(rows.map((row) => [String(row.role), row.reachable === true]));
-	const problems = [];
-	for (const [role, slugs] of wanted) {
-		if (reachable.get(role) === true) continue;
-		const why = reachable.has(role) ? `"${requestRole}" is not a member of it` : "no such role exists in this database";
-		const platform = FOREIGN_CONVENTION_ROLES[role];
-		const hint = platform ? `"${role}" is a ${platform} convention, not a PostgreSQL role. Application roles belong in \`roles: ["${role === "service_role" ? "admin" : role}"]\`, which is checked inside the policy via auth.roles().` : `Either grant it (GRANT ${role} TO ${requestRole}) or drop \`pgRoles\` so the policy targets \`public\`.`;
-		problems.push(`  • pgRoles: ["${role}"] on ${slugs.join(", ")} — ${why}.\n    ${hint}`);
-	}
-	if (problems.length > 0) throw new Error(`Security rules target PostgreSQL roles this server cannot use. Requests run as "${requestRole}", so these policies would never apply and every row would be filtered out — the collections would look empty rather than error.\n\n` + problems.join("\n\n") + "\n");
-}
-//#endregion
 //#region src/PostgresBackendDriver.ts
 var PostgresBackendDriver = class PostgresBackendDriver {
 	db;
@@ -4749,6 +4949,25 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			}
 		};
 	}
+	/**
+	* Build the context handed to every collection callback.
+	*
+	* Note `data: this.data` — `this` is whichever driver is running the
+	* operation, so the callback's data plane inherits that driver's privilege.
+	* On a user request `AuthenticatedPostgresBackendDriver.withTransaction`
+	* constructs a fresh base driver bound to the RLS-scoped transaction and
+	* runs the operation on it, so `this.data` speaks through that connection
+	* and policies apply. On server-context work `this` is the base driver on
+	* the owner connection, and they do not. Pinned by the
+	* `"scopes context.data to the caller"` case in the `rls-enforcement` e2e
+	* suite, because it is the kind of property that is easy to break from a
+	* distance and impossible to notice.
+	*
+	* Previously returned through `as unknown as RebaseCallContext`, which
+	* disabled checking for the whole object and let `driver` — documented in
+	* the callbacks guide — sit on the runtime context while absent from the
+	* contract. Both are declared now, so this is a plain typed return.
+	*/
 	buildCallContext() {
 		return {
 			user: this.user,
@@ -5204,6 +5423,106 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			return saved;
 		});
 	}
+	/**
+	* Update many rows through the same pipeline as {@link save}, in one
+	* transaction.
+	*
+	* Structurally the mirror of {@link saveMany} — same tx-bound sub-driver,
+	* same deferred notifications, same per-row error labelling — but it calls
+	* `save` with an explicit `id` and `status: "existing"`, which is precisely
+	* what `saveMany` cannot do: that one passes `status: "new"` and keeps the
+	* key inside `values`, so it inserts or upserts and can never target a
+	* particular row.
+	*
+	* All-or-nothing, so an id matching no row aborts the batch. A partial
+	* update is the outcome with no good recovery: the caller cannot tell which
+	* half landed without re-reading everything.
+	*/
+	async updateMany({ path, updates, collection }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < updates.length; i++) {
+				const { id, values } = updates[i];
+				try {
+					if (!await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					saved.push(await txDriver.save({
+						path,
+						id: String(id),
+						values,
+						collection,
+						status: "existing"
+					}));
+				} catch (error) {
+					throw Object.assign(new Error(`Update ${i} of ${updates.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return saved;
+		});
+	}
+	/**
+	* Delete many rows in one transaction, running the full delete pipeline —
+	* `beforeDelete`, the delete, `afterDelete` — for each.
+	*
+	* Looping the single-row {@link delete} rather than emitting one
+	* `DELETE ... WHERE id = ANY($1)` is the deliberate choice: a single
+	* statement would be faster and would skip every callback, so a collection
+	* relying on `beforeDelete` to veto or on `afterDelete` to clean up
+	* dependents would behave differently depending on how many rows the caller
+	* happened to delete at once. Same pipeline, one transaction.
+	*/
+	async deleteMany({ path, ids, collection }) {
+		await this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			for (let i = 0; i < ids.length; i++) {
+				const id = ids[i];
+				try {
+					const existing = await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					});
+					if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					await txDriver.delete({
+						row: {
+							id: String(id),
+							path,
+							values: existing
+						},
+						collection
+					});
+				} catch (error) {
+					throw Object.assign(new Error(`Delete ${i} of ${ids.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+		});
+	}
 	async delete({ row, collection }) {
 		const targetPath = row.path;
 		const targetRow = { ...row.values ?? {} };
@@ -5781,6 +6100,13 @@ function createAuthSchema(usersSchemaName = "rebase") {
 		* that rotates immediately after it.
 		*/
 		sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
+		/**
+		* The assurance level the sign-in was established at — `aal2` only
+		* where a second factor was actually presented. Carried across
+		* rotations, because refresh is not a new authentication and has
+		* nothing else to read the level from.
+		*/
+		aal: text("aal"),
 		userAgent: text("user_agent"),
 		ipAddress: text("ip_address"),
 		createdAt: timestamp("created_at").defaultNow().notNull()
@@ -5826,6 +6152,13 @@ function createAuthSchema(usersSchemaName = "rebase") {
 		secretEncrypted: text("secret_encrypted").notNull(),
 		friendlyName: text("friendly_name"),
 		verified: boolean("verified").default(false).notNull(),
+		/**
+		* The highest TOTP time step ever accepted for this factor. RFC 6238
+		* §5.2 forbids accepting an OTP twice, and the ±1 step window that
+		* exists for clock drift is also a 90-second replay window: without
+		* this, one observed code buys a fresh session for a minute and a half.
+		*/
+		lastUsedCounter: bigint("last_used_counter", { mode: "number" }),
 		createdAt: timestamp("created_at").defaultNow().notNull(),
 		updatedAt: timestamp("updated_at").defaultNow().notNull()
 	});
@@ -5843,6 +6176,8 @@ function createAuthSchema(usersSchemaName = "rebase") {
 			createdAt: timestamp("created_at").defaultNow().notNull(),
 			verifiedAt: timestamp("verified_at"),
 			ipAddress: text("ip_address"),
+			/** Failed guesses recorded against this challenge; bounded by the route. */
+			attempts: integer("attempts").default(0).notNull(),
 			expiresAt: timestamp("expires_at").notNull()
 		}),
 		recoveryCodes: tableCreator("recovery_codes", {
@@ -5919,6 +6254,26 @@ var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user:
 * Uses the explicit `columnName` when set (e.g. from introspection),
 * falling back to `toSnakeCase(propName)` for manually-authored collections.
 */
+var JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+/**
+* A string literal for the generated schema file.
+*
+* Column names, table names and enum values are all written into this file as
+* literals, and none of them is constrained to be quote-free: a Postgres
+* identifier only has to be quoted, and `O'Brien` is an ordinary enum value.
+* Interpolating them raw ended the literal early — for enum values, inside
+* single quotes, where an apostrophe is not an edge case.
+*/
+var quote$1 = (value) => JSON.stringify(value);
+/** An object key: verbatim when it is an identifier, quoted otherwise. */
+var propKey = (name) => JS_IDENTIFIER.test(name) ? name : quote$1(name);
+/**
+* A property access on a generated table variable.
+*
+* `users.full name` is not an expression; `users["full name"]` is, and Drizzle
+* treats the two identically.
+*/
+var member = (object, key) => JS_IDENTIFIER.test(key) ? `${object}.${key}` : `${object}[${quote$1(key)}]`;
 var resolveColumnName = (propName, prop) => {
 	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
 	return toSnakeCase(propName);
@@ -5949,26 +6304,16 @@ var getPrimaryKeyProp = (collection) => {
 	};
 };
 /**
-* Given a raw DB column name (e.g. "client_id"), find the Drizzle property key
-* on the collection that maps to that column. A property matches if:
-*   (a) it has an explicit `columnName` equal to the given column, OR
-*   (b) its snake_case form equals the given column.
+* Given a raw DB column name (e.g. "client_id"), the Drizzle property key that
+* maps to it.
 *
-* Returns the property key (the Drizzle object key) if found, or the original
-* column name as a fallback.
+* One line, because the rule is shared: the Drizzle object key is the wire
+* name, and {@link fieldKeyForColumn} is the one definition of what a column is
+* named on the wire. This used to be a private copy that fell back to the
+* column verbatim, which is how a derived foreign key ended up served as
+* `author_id` beside a hand-authored `displayName`.
 */
-var resolvePropertyKeyForColumn = (collection, column) => {
-	if (!collection.properties) return column;
-	for (const [propKey, prop] of Object.entries(collection.properties)) {
-		const p = prop;
-		if ("columnName" in p && typeof p.columnName === "string") {
-			if (p.columnName === column) return propKey;
-		}
-		if (toSnakeCase(propKey) === column) return propKey;
-		if (propKey === column) return propKey;
-	}
-	return column;
-};
+var resolvePropertyKeyForColumn = (collection, column) => fieldKeyForColumn(collection, column);
 var isNumericId = (collection) => {
 	return getPrimaryKeyProp(collection).type === "number";
 };
@@ -5979,18 +6324,25 @@ var isIdProperty = (propName, prop, collection) => {
 	if ("isId" in prop && Boolean(prop.isId)) return true;
 	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
 };
+/**
+* The Drizzle column declaration a property compiles to, or `null` when the
+* property puts no column on *this* table (an inverse relation, whose column
+* lives on the target). Exported so it can be checked against its DDL twin
+* `getSqlColumnType` directly — the two disagreeing is what left `geopoint`
+* with a database column and no Drizzle key.
+*/
 var getDrizzleColumn = (propName, prop, collection, collections) => {
 	const colName = resolveColumnName(propName, prop);
 	let columnDefinition;
 	switch (prop.type) {
 		case "string": {
 			const stringProp = prop;
-			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}("${colName}")`;
-			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid("${colName}")`;
-			else if (stringProp.columnType === "uuid") columnDefinition = `uuid("${colName}")`;
-			else if (stringProp.columnType === "char") columnDefinition = `char("${colName}", { length: ${resolveStringColumnLength(stringProp)} })`;
-			else if (stringProp.columnType === "varchar") columnDefinition = `varchar("${colName}", { length: ${resolveStringColumnLength(stringProp)} })`;
-			else columnDefinition = `text("${colName}")`;
+			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}(${quote$1(colName)})`;
+			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
+			else if (stringProp.columnType === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
+			else if (stringProp.columnType === "char") columnDefinition = `char(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
+			else if (stringProp.columnType === "varchar") columnDefinition = `varchar(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
+			else columnDefinition = `text(${quote$1(colName)})`;
 			if (isIdProperty(propName, prop, collection)) columnDefinition += ".primaryKey()";
 			if ("isId" in stringProp && stringProp.isId !== "manual" && stringProp.isId !== true) {
 				if (stringProp.isId === "uuid") columnDefinition += ".defaultRandom()";
@@ -6006,10 +6358,10 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 		case "number": {
 			const numProp = prop;
 			const isId = isIdProperty(propName, prop, collection);
-			let baseType = numProp.validation?.integer || isId ? `integer("${colName}")` : `numeric("${colName}")`;
-			if (numProp.columnType) if (numProp.columnType === "double precision") baseType = `doublePrecision("${colName}")`;
-			else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") baseType = `${numProp.columnType}("${colName}", { mode: "number" })`;
-			else baseType = `${numProp.columnType}("${colName}")`;
+			let baseType = numProp.validation?.integer || isId ? `integer(${quote$1(colName)})` : `numeric(${quote$1(colName)})`;
+			if (numProp.columnType) if (numProp.columnType === "double precision") baseType = `doublePrecision(${quote$1(colName)})`;
+			else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") baseType = `${numProp.columnType}(${quote$1(colName)}, { mode: "number" })`;
+			else baseType = `${numProp.columnType}(${quote$1(colName)})`;
 			if ("isId" in numProp && numProp.isId === "increment") columnDefinition = `${baseType}.generatedByDefaultAsIdentity()`;
 			else if ("isId" in numProp && typeof numProp.isId === "string" && numProp.isId !== "manual") {
 				columnDefinition = baseType;
@@ -6021,19 +6373,22 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			break;
 		}
 		case "boolean":
-			columnDefinition = `boolean("${colName}")`;
+			columnDefinition = `boolean(${quote$1(colName)})`;
 			break;
 		case "date": {
 			const dateProp = prop;
-			if (dateProp.columnType === "date") columnDefinition = `date("${colName}", { mode: 'string' })`;
-			else if (dateProp.columnType === "time") columnDefinition = `time("${colName}")`;
-			else columnDefinition = `timestamp("${colName}", { withTimezone: true, mode: 'string' })`;
+			if (dateProp.columnType === "date") columnDefinition = `date(${quote$1(colName)}, { mode: 'string' })`;
+			else if (dateProp.columnType === "time") columnDefinition = `time(${quote$1(colName)})`;
+			else columnDefinition = `timestamp(${quote$1(colName)}, { withTimezone: true, mode: 'string' })`;
 			if (dateProp.autoValue === "on_create" || dateProp.autoValue === "on_update") columnDefinition += ".default(sql`now()`)";
 			break;
 		}
 		case "map":
-			if (prop.columnType === "json") columnDefinition = `json("${colName}")`;
-			else columnDefinition = `jsonb("${colName}")`;
+			if (prop.columnType === "json") columnDefinition = `json(${quote$1(colName)})`;
+			else columnDefinition = `jsonb(${quote$1(colName)})`;
+			break;
+		case "geopoint":
+			columnDefinition = `jsonb(${quote$1(colName)})`;
 			break;
 		case "array": {
 			const arrayProp = prop;
@@ -6044,25 +6399,28 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
 				else if (ofProp.type === "boolean") colType = "boolean[]";
 			}
-			if (colType === "json") columnDefinition = `json("${colName}")`;
-			else if (colType === "text[]") columnDefinition = `text("${colName}").array()`;
-			else if (colType === "integer[]") columnDefinition = `integer("${colName}").array()`;
-			else if (colType === "boolean[]") columnDefinition = `boolean("${colName}").array()`;
-			else if (colType === "numeric[]") columnDefinition = `numeric("${colName}").array()`;
-			else columnDefinition = `jsonb("${colName}")`;
+			if (colType === "json") columnDefinition = `json(${quote$1(colName)})`;
+			else if (colType === "text[]") columnDefinition = `text(${quote$1(colName)}).array()`;
+			else if (colType === "integer[]") columnDefinition = `integer(${quote$1(colName)}).array()`;
+			else if (colType === "boolean[]") columnDefinition = `boolean(${quote$1(colName)}).array()`;
+			else if (colType === "numeric[]") columnDefinition = `numeric(${quote$1(colName)}).array()`;
+			else columnDefinition = `jsonb(${quote$1(colName)})`;
 			break;
 		}
-		case "vector":
-			columnDefinition = `vector("${colName}", { dimensions: ${prop.dimensions} })`;
+		case "vector": {
+			const vp = prop;
+			columnDefinition = `vector(${quote$1(colName)}, { dimensions: ${vp.dimensions} })`;
 			break;
+		}
 		case "binary":
-			columnDefinition = `customType({ dataType() { return 'bytea'; } })("${colName}")`;
+			columnDefinition = `customType({ dataType() { return 'bytea'; } })(${quote$1(colName)})`;
 			break;
 		case "relation": {
 			const refProp = prop;
 			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
 			if (!relation || relation.kind !== "belongsTo") return null;
-			if (collection.properties[relation.localKey] && propName !== relation.localKey) return null;
+			const fkFieldKey = fieldKeyForColumn(collection, relation.localKey);
+			if (collection.properties[fkFieldKey] && propName !== fkFieldKey) return null;
 			let targetCollection;
 			try {
 				targetCollection = relation.target();
@@ -6078,30 +6436,31 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			const required = prop.validation?.required;
 			const refOptionsParts = [onUpdate, `onDelete: \"${relation.onDelete ?? (required ? "cascade" : "set null")}\"`].filter(Boolean);
 			const refOptions = refOptionsParts.length > 0 ? `{ ${refOptionsParts.join(", ")} }` : "";
-			let columnDef = `${baseColumn}.references(() => ${targetTableVar}.${targetIdField}${refOptions ? `, ${refOptions}` : ""})`;
+			let columnDef = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}${refOptions ? `, ${refOptions}` : ""})`;
 			if (required) columnDef += ".notNull()";
-			return `    ${relation.localKey}: ${columnDef}`;
+			return `    ${propKey(fkFieldKey)}: ${columnDef}`;
 		}
 		case "reference": {
 			const refProp = prop;
 			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName$1(c) === refProp.path);
 			if (!targetCollection) {
-				columnDefinition = `text("${colName}")`;
+				columnDefinition = `text(${quote$1(colName)})`;
 				break;
 			}
 			const pkProp = getPrimaryKeyProp(targetCollection);
 			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
 			const targetIdField = pkProp.name;
-			const baseColumn = pkProp.type === "number" ? `integer("${colName}")` : pkProp.isUuid ? `uuid("${colName}")` : `text("${colName}")`;
+			const baseColumn = pkProp.type === "number" ? `integer(${quote$1(colName)})` : pkProp.isUuid ? `uuid(${quote$1(colName)})` : `text(${quote$1(colName)})`;
 			const required = prop.validation?.required;
-			columnDefinition = `${baseColumn}.references(() => ${targetTableVar}.${targetIdField}, ${`{ onDelete: "${required ? "cascade" : "set null"}" }`})`;
+			const refOptions = `{ onDelete: "${required ? "cascade" : "set null"}" }`;
+			columnDefinition = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}, ${refOptions})`;
 			if (required) columnDefinition += ".notNull()";
-			return `    ${propName}: ${columnDefinition}`;
+			return `    ${propKey(propName)}: ${columnDefinition}`;
 		}
-		default: return null;
+		default: throw new Error(`No Postgres column mapping for property '${propName}' of type '${prop.type}' in collection '${collection.slug}'. Add a case to \`getDrizzleColumn\` (and to \`getSqlColumnType\`, which must agree).`);
 	}
 	if (prop.validation?.required) columnDefinition += ".notNull()";
-	return `    ${propName}: ${columnDefinition}`;
+	return `    ${propKey(propName)}: ${columnDefinition}`;
 };
 /**
 * Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
@@ -6134,7 +6493,7 @@ var generateSinglePolicyCode = (collection, rule, operation, policyName, resolve
 	parts.push(`to: [${toRoles.map((r) => `"${r}"`).join(", ")}]`);
 	if (usingClause) parts.push(`using: ${usingClause}`);
 	if (withCheckClause) parts.push(`withCheck: ${withCheckClause}`);
-	return `    pgPolicy("${policyName}", { ${parts.join(", ")} }),\n`;
+	return `    pgPolicy(${quote$1(policyName)}, { ${parts.join(", ")} }),\n`;
 };
 /**
 * Computes a deterministic shared relation name for Drizzle.
@@ -6168,11 +6527,13 @@ var computeSharedRelationName = (rel, sourceCollection, _collections) => {
 	}
 	return fallback;
 };
-var generateSchema = async (collections, stripPolicies = false) => {
+var generateSchema = async (allCollections, stripPolicies = false) => {
+	const collections = sortCollectionsBySlug(relationalCollections(allCollections));
 	let schemaContent = "// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\n\n";
 	const hasUuid = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "string" && (p.autoValue === "uuid" || p.isId === "uuid")));
 	const hasVector = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "vector"));
 	const hasBinary = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "binary"));
+	const hasSearch = collections.some((c) => buildSearchColumnSpec(c) !== void 0);
 	const pgCoreImports = [
 		"primaryKey",
 		"pgTable",
@@ -6197,7 +6558,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 	];
 	if (hasUuid) pgCoreImports.push("uuid");
 	if (hasVector) pgCoreImports.push("vector");
-	if (hasBinary) pgCoreImports.push("customType");
+	if (hasBinary || hasSearch) pgCoreImports.push("customType");
 	const uniqueSchemas = Array.from(new Set(collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)));
 	if (uniqueSchemas.length > 0) pgCoreImports.push("pgSchema");
 	schemaContent += `import { ${pgCoreImports.join(", ")} } from 'drizzle-orm/pg-core';\n`;
@@ -6218,7 +6579,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 				const enumDbName = `${collectionPath}_${resolveColumnName(propName, prop)}`;
 				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
 				if (values.length > 0) {
-					schemaContent += `export const ${enumVarName} = pgEnum(\"${enumDbName}\", [${values.map((v) => `'${v}'`).join(", ")}]);\n`;
+					schemaContent += `export const ${enumVarName} = pgEnum(${quote$1(enumDbName)}, [${values.map((v) => quote$1(v)).join(", ")}]);\n`;
 					if (!exportedEnumVars.includes(enumVarName)) exportedEnumVars.push(enumVarName);
 				}
 			}
@@ -6279,6 +6640,11 @@ var generateSchema = async (collections, stripPolicies = false) => {
 				const columnString = getDrizzleColumn(propName, prop, collection, collections);
 				if (columnString) columns.add(columnString);
 			});
+			const searchSpec = buildSearchColumnSpec(collection);
+			if (searchSpec) {
+				columns.add(`    ${searchSpec.column}: customType({ dataType() { return 'tsvector'; } })("${searchSpec.column}").generatedAlwaysAs(sql\`${searchSpec.expression}\`)`);
+				if (searchSpec.fuzzy) columns.add(`    ${searchSpec.fuzzy.column}: text("${searchSpec.fuzzy.column}").generatedAlwaysAs(sql\`${searchSpec.fuzzy.expression}\`)`);
+			}
 			if (!Array.from(columns).some((col) => col.includes(".primaryKey()"))) columns.add("    id: text(\"id\").primaryKey()");
 			schemaContent += `${Array.from(columns).join(",\n")}`;
 			const securityRules = getEffectiveSecurityRules(collection);
@@ -6315,9 +6681,9 @@ var generateSchema = async (collections, stripPolicies = false) => {
 						break;
 					}
 				} catch {}
-				tableRelations.push(`    "${relation.through.sourceColumn}": one(${sourceTableVar}, {\n        fields: [${tableVarName}.${relation.through.sourceColumn}],\n        references: [${sourceTableVar}.${sourceId}],\n        relationName: \"${owningRelationName}\"\n    })`);
+				tableRelations.push(`    ${quote$1(relation.through.sourceColumn)}: one(${sourceTableVar}, {\n        fields: [${member(tableVarName, relation.through.sourceColumn)}],\n        references: [${member(sourceTableVar, sourceId)}],\n        relationName: ${quote$1(owningRelationName)}\n    })`);
 				const targetRelationName = inverseRelationName ? inverseRelationName : `${tableName}_${relation.through.targetColumn}`;
-				tableRelations.push(`    "${relation.through.targetColumn}": one(${targetTableVar}, {\n        fields: [${tableVarName}.${relation.through.targetColumn}],\n        references: [${targetTableVar}.${targetId}],\n        relationName: "${targetRelationName}"\n    })`);
+				tableRelations.push(`    ${quote$1(relation.through.targetColumn)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, relation.through.targetColumn)}],\n        references: [${member(targetTableVar, targetId)}],\n        relationName: ${quote$1(targetRelationName)}\n    })`);
 			}
 		} else {
 			const resolvedRelations = resolveCollectionRelations(collection);
@@ -6332,7 +6698,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 				switch (rel.kind) {
 					case "belongsTo": {
 						const localFieldKey = resolvePropertyKeyForColumn(collection, rel.localKey);
-						tableRelations.push(`    "${relationKey}": one(${targetTableVar}, {\n        fields: [${tableVarName}.${localFieldKey}],\n        references: [${targetTableVar}.${getPrimaryKeyName(target)}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
+						tableRelations.push(`    ${quote$1(relationKey)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, localFieldKey)}],\n        references: [${member(targetTableVar, getPrimaryKeyName(target))}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
 						break;
 					}
 					case "hasOne":
@@ -6363,7 +6729,7 @@ var generateSchema = async (collections, stripPolicies = false) => {
 							const drizzleFieldKey = resolvePropertyKeyForColumn(collection, otherRel.foreignKeyOnTarget);
 							const referencedKey = otherRel.sourceKey ? resolvePropertyKeyForColumn(otherCollection, otherRel.sourceKey) : getPrimaryKeyName(otherCollection);
 							const synthKey = `_synth_${otherTableVar}_${drizzleFieldKey}`;
-							tableRelations.push(`    "${synthKey}": one(${otherTableVar}, {\n        fields: [${tableVarName}.${drizzleFieldKey}],\n        references: [${otherTableVar}.${referencedKey}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
+							tableRelations.push(`    ${quote$1(synthKey)}: one(${otherTableVar}, {\n        fields: [${member(tableVarName, drizzleFieldKey)}],\n        references: [${member(otherTableVar, referencedKey)}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
 							emittedRelationNames.add(deduplicationKey);
 						}
 					}
@@ -6383,6 +6749,44 @@ var generateSchema = async (collections, stripPolicies = false) => {
 	return schemaContent;
 };
 //#endregion
+//#region src/cli-output.ts
+/**
+* Terminal output for the `rebase db|schema|doctor` commands.
+*
+* These commands used to write every line through `logger`, and that is a
+* category error with three separate consequences:
+*
+*  - `logger` prefixes each line with its own level, so a box-drawn report
+*    arrived as `ℹ️ [INFO]   ┌─ ✗ Missing Column ───` and the frame no longer
+*    lined up with anything;
+*  - `logger` is gated by `LOG_LEVEL`, which ships in the scaffold's own
+*    `.env.example` — a developer who quietened their dev server with
+*    `LOG_LEVEL=warn` got a `rebase db push` that printed almost nothing and
+*    still exited non-zero, indistinguishable from a crash;
+*  - under `NODE_ENV=production` `logger` emits JSON, so the whole report
+*    became log records with the chalk escape codes embedded in them.
+*
+* A CLI's report *is* its return value. It goes to the terminal unconditionally
+* and unadorned. `packages/cli` has always written its output this way; this is
+* the same three functions for the plugin CLI that `rebase` delegates to.
+*
+* `logger` still belongs in this package's *runtime* — a request handler has no
+* terminal and its lines want levels, timestamps and redaction. The rule is the
+* caller, not the severity: anything a developer reads because they typed a
+* command goes here, anything a server emits while running goes to `logger`.
+*
+* Errors and warnings go to stderr so `rebase db push > plan.txt` keeps the
+* diagnosis on the terminal where it is readable.
+*/
+/** One line of human-facing output on stdout. */
+var out = (line = "") => {
+	console.log(line);
+};
+/** One line of human-facing error output on stderr. */
+var outError = (line = "") => {
+	console.error(line);
+};
+//#endregion
 //#region src/schema/generate-drizzle-schema.ts
 var formatTerminalText = (text, options = {}) => {
 	let codes = "";
@@ -6410,7 +6814,7 @@ var formatTerminalText = (text, options = {}) => {
 var runGeneration = async (collectionsFilePath, outputPath) => {
 	try {
 		if (!collectionsFilePath) {
-			logger.error("Error: No collections file path provided. Skipping schema generation.");
+			outError("Error: No collections file path provided. Skipping schema generation.");
 			return;
 		}
 		let collections = await loadCollectionsFromDirectory(path.resolve(collectionsFilePath));
@@ -6421,18 +6825,18 @@ var runGeneration = async (collectionsFilePath, outputPath) => {
 			const outputDir = path.dirname(outputPath);
 			await promises.mkdir(outputDir, { recursive: true });
 			await promises.writeFile(outputPath, schemaContent);
-			logger.info(`✅ Drizzle schema generated successfully at ${outputPath}`);
+			out(`✅ Drizzle schema generated successfully at ${outputPath}`);
 		} else {
-			logger.info("✅ Drizzle schema generated successfully.");
-			logger.info(String(schemaContent));
+			out("✅ Drizzle schema generated successfully.");
+			out(String(schemaContent));
 		}
-		logger.info(`You can now run ${formatTerminalText("rebase db generate", {
+		out(`You can now run ${formatTerminalText("rebase db generate", {
 			bold: true,
 			backgroundColor: "blue",
 			textColor: "black"
 		})} to generate the SQL migration files.`);
 	} catch (error) {
-		logger.error("Error generating schema", { error });
+		outError(`Error generating schema: ${error instanceof Error ? error.stack ?? error.message : String(error)}`);
 	}
 };
 var main = () => {
@@ -6442,18 +6846,18 @@ var main = () => {
 	const outputPath = outputPathArg ? outputPathArg.split("=")[1] : void 0;
 	const watch = process.argv.includes("--watch");
 	if (!collectionsFilePath) {
-		logger.info("Usage: ts-node generate-drizzle-schema.ts <path-to-collections-file> [--output <path-to-output-file>] [--watch]");
+		out("Usage: ts-node generate-drizzle-schema.ts <path-to-collections-file> [--output <path-to-output-file>] [--watch]");
 		return;
 	}
 	const resolvedPath = path.resolve(process.cwd(), collectionsFilePath);
 	const resolvedOutputPath = outputPath ? path.resolve(process.cwd(), outputPath) : void 0;
 	if (watch) {
-		logger.info(`Watching for changes in ${resolvedPath}...`);
+		out(`Watching for changes in ${resolvedPath}...`);
 		chokidar.watch(resolvedPath, {
 			persistent: true,
 			ignoreInitial: false
 		}).on("all", (event, filePath) => {
-			logger.info(`[${event}] ${filePath}. Regenerating schema...`);
+			out(`[${event}] ${filePath}. Regenerating schema...`);
 			runGeneration(resolvedPath, resolvedOutputPath);
 		});
 	} else runGeneration(resolvedPath, resolvedOutputPath);
@@ -6637,7 +7041,7 @@ async function provisionTriggerCdc(run, tables) {
 			logger.warn(`⚠️ [CDC] Could not attach change-capture trigger to "${key}" — is the table migrated? Writes to it won't emit database-level events.`, { detail: reason });
 		}
 	}
-	logger.info(`📡 [CDC] Trigger-based change capture provisioned on ${installed.length} table(s)` + (skipped.length ? ` (${skipped.length} skipped)` : "") + ".");
+	logger.debug(`📡 [CDC] Trigger-based change capture provisioned on ${installed.length} table(s)` + (skipped.length ? ` (${skipped.length} skipped)` : "") + ".");
 	return {
 		installed,
 		skipped
@@ -6727,7 +7131,7 @@ var PgNotifyListener = class {
 			await client.connect();
 			await client.query(`LISTEN ${channel}`);
 			this.client = client;
-			logger.info(`📡 ${logLabel} Listening on channel "${channel}".`);
+			logger.debug(`📡 ${logLabel} Listening on channel "${channel}".`);
 		} catch (err) {
 			if (initial) throw err;
 			logger.error(`❌ ${logLabel} Failed to connect LISTEN client`, { error: err });
@@ -6982,6 +7386,8 @@ var ChannelHistoryStore = class {
                 last_seq BIGINT NOT NULL
             )
         `);
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")));
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")));
 		this.tablesReady = true;
 		logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
 	}
@@ -7165,6 +7571,7 @@ var ChannelPresenceStore = class {
             CREATE INDEX IF NOT EXISTS idx_channel_presence_last_seen
             ON rebase.channel_presence (last_seen)
         `);
+		await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence")));
 		this.tablesReady = true;
 	}
 	/** Record (or refresh) a client's presence. */
@@ -7556,6 +7963,12 @@ var PG_NOTIFY_CHANNEL = "rebase_entity_changes";
 var RealtimeService = class RealtimeService extends EventEmitter {
 	db;
 	registry;
+	/**
+	* Declares to the multi-engine router that channel frames can be handled
+	* here. Read by `createRoutedRealtimeService`, which otherwise would have to
+	* guess — and guessed "the default provider", whichever engine that is.
+	*/
+	supportsChannels = true;
 	clients = /* @__PURE__ */ new Map();
 	channels = /* @__PURE__ */ new Map();
 	presence = /* @__PURE__ */ new Map();
@@ -7602,6 +8015,23 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* so a hot channel logs the problem once rather than once per message.
 	*/
 	oversizedBroadcastWarned = /* @__PURE__ */ new Set();
+	/**
+	* Optional narrowing on top of the membership floor — see
+	* {@link ChannelAuthorizer}. Unset by default, which leaves membership as
+	* the whole of the rule.
+	*/
+	channelAuthorizer;
+	/**
+	* Whether a notification from another instance has ever arrived.
+	*
+	* The entity LISTEN handler sees a foreign `sid` on every cross-instance
+	* change, which is proof that this deployment runs more than one pod — the
+	* one fact needed to tell "the memory bus is fine here" from "broadcast and
+	* presence silently reach a fraction of your users".
+	*/
+	foreignInstanceSeen = false;
+	/** So the multi-pod memory-bus warning is emitted once, not once per join. */
+	memoryBusWarned = false;
 	presenceInterval;
 	static PRESENCE_TIMEOUT_MS = 3e4;
 	/** How often stale roster rows from other instances are reaped. */
@@ -7695,7 +8125,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				limit: config.limit,
 				startAfter: config.startAfter,
 				databaseId: config.databaseId,
-				searchString: config.searchString
+				searchString: config.searchString,
+				searchExplain: config.searchExplain
 			}
 		});
 		if (callback) this.subscriptionCallbacks.set(subscriptionId, callback);
@@ -7775,26 +8206,13 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				await this.handleUnsubscribe(clientId, message.subscriptionId);
 				break;
 			case "join_channel":
-				this.joinChannel(clientId, payload?.channel);
-				break;
 			case "leave_channel":
-				this.leaveChannel(clientId, payload?.channel);
-				break;
 			case "broadcast":
-				this.broadcastToChannel(clientId, payload?.channel, payload?.event, payload?.payload);
-				break;
 			case "channel_history":
-				await this.handleChannelHistoryRequest(clientId, payload?.channel, payload?.sinceSeq, payload?.limit);
-				break;
 			case "presence_track":
-				this.joinChannel(clientId, payload?.channel);
-				this.trackPresence(clientId, payload?.channel, payload?.state ?? {});
-				break;
 			case "presence_untrack":
-				this.removePresence(clientId, payload?.channel);
-				break;
 			case "presence_state":
-				this.sendPresenceState(clientId, payload?.channel);
+				await this.handleChannelMessage(clientId, message.type, payload, authContext);
 				break;
 			default: this.sendError(clientId, "Unknown message type " + message.type, message.subscriptionId);
 		}
@@ -7809,30 +8227,40 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				this.sendError(clientId, msg, subscriptionId);
 				return;
 			}
-			const boundedLimit = resolveClientListLimit(request.limit, { vectorSearch: !!request.vectorSearch });
+			if (request.vectorSearch) {
+				const msg = "Realtime subscriptions do not support vector search: a subscription is re-run on every matching write, and nothing here computes distances. Use `.vectorSearch(...).find()` for the query, and subscribe without it if you need live updates.";
+				logger.warn(`[RealtimeService] ${msg}`);
+				this.sendError(clientId, msg, subscriptionId, "VECTOR_SEARCH_NOT_LIVE");
+				return;
+			}
+			let boundedLimit;
+			try {
+				boundedLimit = resolveClientListLimit(request.limit);
+			} catch (e) {
+				if (!(e instanceof ListLimitError)) throw e;
+				logger.warn(`[RealtimeService] Refused subscription to '${request.path}': ${e.message}`);
+				this.sendError(clientId, e.message, subscriptionId, "INVALID_LIMIT");
+				return;
+			}
 			this._subscriptions.set(subscriptionId, {
 				clientId,
 				type: "collection",
 				path: request.path,
 				collectionRequest: {
 					filter: request.filter,
+					logical: request.logical,
 					orderBy: request.orderBy,
 					order: request.order,
 					limit: boundedLimit,
+					offset: request.offset,
 					startAfter: request.startAfter,
 					databaseId: request.collection?.databaseId,
-					searchString: request.searchString
+					searchString: request.searchString,
+					searchExplain: request.searchExplain
 				},
 				authContext
 			});
-			const rows = await this.fetchCollectionWithAuth(request.path, {
-				filter: request.filter,
-				orderBy: request.orderBy,
-				order: request.order,
-				limit: boundedLimit,
-				startAfter: request.startAfter,
-				searchString: request.searchString
-			}, authContext);
+			const rows = await this.fetchCollectionWithAuth(request.path, this._subscriptions.get(subscriptionId).collectionRequest, authContext);
 			this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
@@ -7917,7 +8345,39 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		this.debugLog("🔔 [RealtimeService] notifyUpdate completed for path:", path);
 	}
 	/**
-	* Notify subscriptions for a specific path
+	* Notify subscriptions for a specific path.
+	*
+	* **A subscriber only ever receives rows re-read under its own scope.**
+	* `row` is used to decide *that* something changed, never to say *what* —
+	* every delivery below goes through a refetch that binds the subscription's
+	* own auth context.
+	*
+	* It used to be conditional. The CDC path already did the right thing: it
+	* discards the captured tuple and emits `{_rebase_invalidated: true}`, and
+	* that marker selected the refetch branch. But the marker is produced in
+	* exactly two places, and the *other* side of each branch here shipped the
+	* row it was handed straight to the socket. Two of the three entry paths
+	* took that side — every API mutation (`PostgresBackendDriver.save` passes
+	* the row it just wrote, read under the **writer's** scope) and the legacy
+	* cross-instance LISTEN handler (which re-reads on the owner connection,
+	* bypassing RLS altogether). Path matching was the only filter applied: the
+	* subscription's own `filter`/`logical` was never evaluated, and any
+	* `afterRead` redaction was the writer's rather than the reader's.
+	*
+	* A single-row subscription was the sharpest case. `subscribe_one` on a row
+	* RLS denies is accepted and answered `null`; the next update then pushed
+	* the full row with no later correction. The collection variant was merely
+	* papered over ~300 ms later by the debounced refetch — after the bytes had
+	* already reached the browser.
+	*
+	* The same defect was found and fixed on the Mongo driver in `065e2b615`
+	* (see `packages/server-mongo/test/realtime-authorization.test.ts`); this is
+	* the Postgres half, stated as one rule rather than three patched branches.
+	*
+	* The cost is the instant row-level patch that used to precede the refetch:
+	* cross-tab feedback now waits for the debounce. That is the price of not
+	* being able to know, without asking the database as this subscriber,
+	* whether this subscriber may see the row at all.
 	*/
 	async notifyPathUpdate(notifyPath, originalPath, id, row, _databaseId) {
 		this.debugLog(`📡 [RealtimeService] Notifying path: ${notifyPath} (original: ${originalPath})`);
@@ -7931,12 +8391,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		const webSocketSubscriptions = allSubscriptions.filter(([, sub]) => sub.clientId !== "driver" && this.clients.has(sub.clientId));
 		const driverSubscriptions = allSubscriptions.filter(([subscriptionId, sub]) => sub.clientId === "driver" && this.subscriptionCallbacks.has(subscriptionId));
 		for (const [subscriptionId, subscription] of webSocketSubscriptions) try {
-			if (subscription.type === "single" && notifyPath === originalPath) if (row && row?._rebase_invalidated) this.debouncedSingleRefetch(subscriptionId, notifyPath, id, subscription);
-			else this.sendSingleUpdate(subscription.clientId, subscriptionId, row);
-			else if (subscription.type === "collection" && subscription.collectionRequest) {
-				if (!row || !row?._rebase_invalidated) this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row, notifyPath);
-				this.debouncedCollectionRefetch(subscriptionId, notifyPath, subscription);
-			}
+			if (subscription.type === "single" && notifyPath === originalPath) this.debouncedSingleRefetch(subscriptionId, notifyPath, id, subscription);
+			else if (subscription.type === "collection" && subscription.collectionRequest) this.debouncedCollectionRefetch(subscriptionId, notifyPath, subscription);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, notifyPath);
 			this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -7944,8 +8400,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		for (const [subscriptionId, subscription] of driverSubscriptions) try {
 			const callback = this.subscriptionCallbacks.get(subscriptionId);
 			if (!callback) continue;
-			if (subscription.type === "single" && notifyPath === originalPath) if (row && row?._rebase_invalidated) this.debouncedSingleDriverRefetch(subscriptionId, notifyPath, id, subscription, callback);
-			else callback(row);
+			if (subscription.type === "single" && notifyPath === originalPath) this.debouncedSingleDriverRefetch(subscriptionId, notifyPath, id, subscription, callback);
 			else if (subscription.type === "collection" && subscription.collectionRequest) this.debouncedDriverRefetch(subscriptionId, notifyPath, subscription, callback);
 		} catch (error) {
 			logger.error(`❌ [RealtimeService] Error processing DataDriver subscription ${subscriptionId}`, { error });
@@ -8009,13 +8464,16 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				let fetchedEntities;
 				if (collectionRequest.searchString) fetchedEntities = await txEntityService.searchRows(notifyPath, collectionRequest.searchString, {
 					filter: collectionRequest.filter,
+					logical: collectionRequest.logical,
 					orderBy: collectionRequest.orderBy,
 					order: collectionRequest.order,
 					limit: collectionRequest.limit,
-					databaseId: collectionRequest.databaseId
+					databaseId: collectionRequest.databaseId,
+					searchExplain: collectionRequest.searchExplain
 				});
 				else fetchedEntities = await txEntityService.fetchCollection(notifyPath, {
 					filter: collectionRequest.filter,
+					logical: collectionRequest.logical,
 					orderBy: collectionRequest.orderBy,
 					order: collectionRequest.order,
 					limit: collectionRequest.limit,
@@ -8068,13 +8526,16 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		if (collectionRequest.searchString) return await this.dataService.searchRows(notifyPath, collectionRequest.searchString, {
 			filter: collectionRequest.filter,
+			logical: collectionRequest.logical,
 			orderBy: collectionRequest.orderBy,
 			order: collectionRequest.order,
 			limit: collectionRequest.limit,
-			databaseId: collectionRequest.databaseId
+			databaseId: collectionRequest.databaseId,
+			searchExplain: collectionRequest.searchExplain
 		});
 		return await this.dataService.fetchCollection(notifyPath, {
 			filter: collectionRequest.filter,
+			logical: collectionRequest.logical,
 			orderBy: collectionRequest.orderBy,
 			order: collectionRequest.order,
 			limit: collectionRequest.limit,
@@ -8204,16 +8665,6 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* columns and no address. The SDK holds no collection config to derive one
 	* from, so this is the only place the mapping can come from.
 	*/
-	sendCollectionPatch(clientId, subscriptionId, id, row, notifyPath) {
-		const message = {
-			type: "collection_patch",
-			subscriptionId,
-			id,
-			row,
-			pks: this.primaryKeysForPath(notifyPath)
-		};
-		this.sendMessage(clientId, message);
-	}
 	/** The key columns of the collection at `path`, if they can be resolved. */
 	primaryKeysForPath(path) {
 		try {
@@ -8258,12 +8709,148 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		return parentPaths;
 	}
+	/**
+	* Install a channel authorizer — see {@link ChannelAuthorizer}.
+	*
+	* Nothing in the framework calls this yet: it is the seam a rules API will
+	* be built on, kept deliberately separate from the membership floor so the
+	* floor holds whether or not anyone uses it.
+	*/
+	setChannelAuthorizer(authorizer) {
+		this.channelAuthorizer = authorizer;
+	}
+	/** Which action each channel frame is asking to perform. */
+	static CHANNEL_ACTIONS = {
+		join_channel: "join",
+		broadcast: "broadcast",
+		channel_history: "history",
+		presence_track: "join",
+		presence_state: "presence"
+	};
+	/**
+	* The one door every channel frame comes through.
+	*
+	* Returns synchronously — and so dispatches synchronously — unless an
+	* authorizer is installed. That matters: a client sends `join_channel`,
+	* `presence_state` and `channel_history` back to back on connect, and the
+	* socket's message handler processes each frame up to its first `await`,
+	* so a gate that always yielded would let the reads overtake the join that
+	* is about to authorize them.
+	*/
+	handleChannelMessage(clientId, type, payload, authContext) {
+		const channel = payload?.channel;
+		if (type === "leave_channel") {
+			this.leaveChannel(clientId, channel);
+			return;
+		}
+		if (type === "presence_untrack") {
+			this.removePresence(clientId, channel);
+			return;
+		}
+		const action = RealtimeService.CHANNEL_ACTIONS[type];
+		const allowed = this.authorizeChannelAction(clientId, channel, action, authContext);
+		if (allowed === false) return;
+		if (allowed === true) return this.dispatchChannelMessage(clientId, type, channel, payload);
+		return allowed.then((ok) => {
+			if (ok) return this.dispatchChannelMessage(clientId, type, channel, payload);
+		});
+	}
+	/** Perform an already-authorized channel frame. */
+	dispatchChannelMessage(clientId, type, channel, payload) {
+		switch (type) {
+			case "join_channel":
+				this.joinChannel(clientId, channel);
+				return;
+			case "broadcast":
+				this.broadcastToChannel(clientId, channel, payload?.event, payload?.payload);
+				return;
+			case "channel_history": return this.handleChannelHistoryRequest(clientId, channel, payload?.sinceSeq, payload?.limit);
+			case "presence_track":
+				this.joinChannel(clientId, channel);
+				this.trackPresence(clientId, channel, payload?.state ?? {});
+				return;
+			case "presence_state":
+				this.sendPresenceState(clientId, channel);
+				return;
+		}
+	}
+	/**
+	* Decide whether a client may perform an action on a channel.
+	*
+	* **Membership is the floor.** Reading a channel's presence roster, replaying
+	* its retained history and broadcasting into it all require that this client
+	* has joined it. That is a low bar — joining is open to anyone who can name
+	* the channel — but it is not the bar that was there before, which was none
+	* at all: `channel_history` and `presence_state` answered any socket about
+	* any channel, and a broadcast fanned out to members the sender had never
+	* joined. Two internal tables (`rebase.channel_presence`,
+	* `rebase.channel_messages`) are held outside RLS on the strength of this
+	* check, so it fails closed: an authorizer that throws refuses the frame.
+	*
+	* Anything richer than membership belongs in a {@link ChannelAuthorizer};
+	* this method is where it is consulted, and the only place.
+	*/
+	authorizeChannelAction(clientId, channel, action, authContext) {
+		if (action !== "join" && !this.channels.get(channel)?.has(clientId)) {
+			this.denyChannelAction(clientId, channel, action, "not a member of the channel");
+			return false;
+		}
+		const authorizer = this.channelAuthorizer;
+		if (!authorizer) return true;
+		let verdict;
+		try {
+			verdict = authorizer({
+				channel,
+				action,
+				clientId,
+				user: authContext
+			});
+		} catch (error) {
+			logger.error(`❌ [Channels] Authorizer threw for ${action} on "${channel}" — refusing`, { error });
+			this.denyChannelAction(clientId, channel, action, "channel authorization failed");
+			return false;
+		}
+		if (typeof verdict === "boolean") {
+			if (!verdict) this.denyChannelAction(clientId, channel, action, "refused by the channel authorizer");
+			return verdict;
+		}
+		return verdict.then((ok) => {
+			if (!ok) this.denyChannelAction(clientId, channel, action, "refused by the channel authorizer");
+			return ok;
+		}, (error) => {
+			logger.error(`❌ [Channels] Authorizer rejected for ${action} on "${channel}" — refusing`, { error });
+			this.denyChannelAction(clientId, channel, action, "channel authorization failed");
+			return false;
+		});
+	}
+	/** Tell the client why its channel frame went nowhere, and say so in the log. */
+	denyChannelAction(clientId, channel, action, reason) {
+		this.debugLog(`🚫 [Channels] Refused ${action} on "${channel}" for ${clientId}: ${reason}`);
+		this.sendError(clientId, `Refused ${action} on channel "${channel}": ${reason}`, void 0, "CHANNEL_FORBIDDEN");
+	}
 	/** Join a broadcast channel */
 	joinChannel(clientId, channel) {
 		if (!this.channels.has(channel)) this.channels.set(channel, /* @__PURE__ */ new Set());
 		this.channels.get(channel).add(clientId);
+		this.warnIfMemoryBusOnMultiplePods();
 		this.debugLog(`📡 [Broadcast] Client ${clientId} joined channel: ${channel}`);
 	}
+	/**
+	* Say something the first time channels are used on a deployment that is
+	* demonstrably multi-pod while the bus is still the in-memory default.
+	*
+	* Every other warning in this subsystem covers a *configured* bus failing —
+	* the case where the operator already knew a bus mattered. The common
+	* misconfiguration is the opposite one: scaled to two replicas, never
+	* touched `realtime.bus`, and broadcast and presence quietly serve a
+	* fraction of the room. The evidence is already in the process, so use it.
+	*/
+	warnIfMemoryBusOnMultiplePods() {
+		if (this.memoryBusWarned) return;
+		if (this.bus.kind !== "memory" || !this.foreignInstanceSeen) return;
+		this.memoryBusWarned = true;
+		logger.warn("⚠️ [ChannelBus] Channels are in use with the in-memory bus, but notifications from another instance have been seen — this deployment runs more than one process. Broadcast and presence reach only the clients connected to this one. Set `realtime.bus` (or REBASE_REALTIME_BUS=postgres) to make channels cross-instance.");
+	}
 	/** Leave a broadcast channel */
 	leaveChannel(clientId, channel) {
 		const members = this.channels.get(channel);
@@ -8758,7 +9345,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			throw err;
 		}
 		this.cdcActive = true;
-		logger.info(`📡 [RealtimeService] Database-level change capture ACTIVE — writes from ANY source now emit realtime events (${this.cdcTableMap.size} mapped table key(s)).`);
+		logger.debug(`📡 [RealtimeService] Database-level change capture ACTIVE — writes from ANY source now emit realtime events (${this.cdcTableMap.size} mapped table key(s)).`);
 	}
 	/** Stop the CDC listener and clear its state. */
 	async stopCdc() {
@@ -8941,6 +9528,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				try {
 					const { sid, p, eid, db } = JSON.parse(msg.payload);
 					if (sid === this.instanceId) return;
+					this.foreignInstanceSeen = true;
 					this.debugLog(`📡 [RealtimeService] Received cross-instance notification: path=${p}, id=${eid}, from=${sid}`);
 					let refetchedRow = null;
 					try {
@@ -9131,7 +9719,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-CD8o_1Sl.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-BH0Dzo_h.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -9203,6 +9791,54 @@ var quote = (xs) => Array.from(xs).map((s) => `\`${s}\``).join(", ");
 /** `on.from` / `on.to` accept a single column or a composite tuple. */
 var asColumns = (value) => Array.isArray(value) ? value : [value];
 /**
+* Distinguish "this column name is wrong" from "the generated schema is old".
+*
+* They present identically here — a relation asks for a column the registered
+* table does not have — but they are opposite problems with opposite fixes, and
+* getting them the wrong way round is how the 0.12 → 0.13 upgrade bricked
+* projects.
+*
+* The registered table is not the database. It comes from the project's
+* checked-in `backend/src/schema.generated.ts`, and 0.13 changed the rule that
+* derives foreign-key names: `categories` yields `category_id` where it used to
+* yield `categorie_id`. Boot-ensure renames the database column to match, so by
+* the time this runs the *database* is correct and the *generated module* is the
+* stale one. Reporting "not a column" then points at the wrong artifact, and the
+* generic fix — "set `through.targetColumn` to one of: …", listing the legacy
+* name because that is what the stale module still has — talks the reader into
+* pinning a column that no longer exists.
+*
+* So when the wanted name is what the current rule derives, and the table
+* carries what the *previous* rule would have derived from the same source, say
+* that instead.
+*
+* @param wanted   the column the relation asks for
+* @param available every column the registered table has
+* @param sources  names the default could have been derived from (a slug, a
+*                 relation name) — checking against these rather than guessing
+*                 backwards from `wanted` keeps the match exact
+*/
+function staleCodegenRename(wanted, available, sources) {
+	for (const source of sources) {
+		if (!source) continue;
+		const current = generateForeignKeyName(source);
+		const legacy = legacyForeignKeyName(source);
+		if (current !== wanted || legacy === current) continue;
+		if (available.has(legacy) && !available.has(current)) return {
+			legacy,
+			current
+		};
+	}
+	return null;
+}
+/** The shared explanation, so every relation kind reports it identically. */
+function staleCodegenDefect(table, { legacy, current }) {
+	return {
+		problem: `the generated Drizzle schema still declares \`${legacy}\` on \`${table}\`, but this release derives \`${current}\` — the generated schema predates the foreign-key naming fix and no longer describes the database`,
+		fix: `regenerate it with \`rebase schema generate\` (or \`pnpm run schema:generate\`). The database column has already been renamed for you at boot, so nothing else is needed. To keep \`${legacy}\` instead, name it explicitly on the relation and regenerate.`
+	};
+}
+/**
 * Relations whose names do not resolve against the registered schema.
 *
 * Fails open wherever it cannot see enough to be sure — an unregistered source
@@ -9249,19 +9885,31 @@ function findRelationDefects(collections, registry) {
 			const targetColumns = columnNames(targetTable);
 			switch (relation.kind) {
 				case "belongsTo":
-					if (!sourceColumns.has(relation.localKey)) defects.push({
-						...at,
-						problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
-						fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
-					});
+					if (!sourceColumns.has(relation.localKey)) {
+						const stale = staleCodegenRename(relation.localKey, sourceColumns, [relation.relationName, targetCollection.slug]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(sourceTableName, stale)
+						} : {
+							...at,
+							problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
+							fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
+						});
+					}
 					break;
 				case "hasOne":
 				case "hasMany":
-					if (!targetColumns.has(relation.foreignKeyOnTarget)) defects.push({
-						...at,
-						problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
-						fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
-					});
+					if (!targetColumns.has(relation.foreignKeyOnTarget)) {
+						const stale = staleCodegenRename(relation.foreignKeyOnTarget, targetColumns, [collection.slug]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(targetTableName, stale)
+						} : {
+							...at,
+							problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
+							fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
+						});
+					}
 					if (relation.sourceKey && !sourceColumns.has(relation.sourceKey)) defects.push({
 						...at,
 						problem: `\`sourceKey: "${relation.sourceKey}"\` is not a column on \`${sourceTableName}\``,
@@ -9280,11 +9928,21 @@ function findRelationDefects(collections, registry) {
 						break;
 					}
 					const junctionColumns = columnNames(junction);
-					for (const [label, column] of [["sourceColumn", sourceColumn], ["targetColumn", targetColumn]]) if (!junctionColumns.has(column)) defects.push({
-						...at,
-						problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
-						fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
-					});
+					const derivedFrom = {
+						sourceColumn: [collection.slug],
+						targetColumn: [targetCollection.slug]
+					};
+					for (const [label, column] of [["sourceColumn", sourceColumn], ["targetColumn", targetColumn]]) if (!junctionColumns.has(column)) {
+						const stale = staleCodegenRename(column, junctionColumns, [...derivedFrom[label]]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(table, stale)
+						} : {
+							...at,
+							problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
+							fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
+						});
+					}
 					break;
 				}
 				case "via": {
@@ -9356,7 +10014,16 @@ function assertRelationsResolve(collections, registry) {
 	const defects = findRelationDefects(collections, registry);
 	if (defects.length === 0) return;
 	const lines = defects.map((d) => `  • ${d.collection}.${d.relationName} (${d.kind})\n      ${d.problem}\n      fix: ${d.fix}`);
-	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against the database schema.\n\nEach of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
+	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against \`backend/src/schema.generated.ts\`.
+
+Each of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
+
+If the database was migrated recently — an upgrade, a \`db push\`, a restore — this file is
+probably older than the schema it describes. Regenerate it before changing anything else:
+
+    rebase schema generate
+
+If it is already current, then the collection is what disagrees with it:
 
 ` + lines.join("\n\n") + "\n");
 }
@@ -9377,7 +10044,7 @@ function buildCollectionRegistry(schema) {
 	const registry = new PostgresCollectionRegistry();
 	if (schema.collections) {
 		registry.registerMultiple(schema.collections);
-		logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
+		logger.debug(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
 	}
 	if (schema.tables) Object.values(schema.tables).forEach((table) => {
 		if (isTable(table)) registry.registerTable(table, getTableName(table));
@@ -9552,7 +10219,7 @@ async function probeAuthSchema(db, authSchema) {
 *                     When omitted, a default `rebase.users` table is created.
 */
 async function ensureAuthTablesExist(db, collection) {
-	logger.info("🔍 Checking auth tables...");
+	logger.debug("🔍 Checking auth tables...");
 	await assertAuthSchemaCompatible(db, resolveAuthSchema(collection));
 	try {
 		let usersTableName = "\"rebase\".\"users\"";
@@ -9567,7 +10234,7 @@ async function ensureAuthTablesExist(db, collection) {
 			if (idProp) {
 				const isId = "isId" in idProp ? idProp.isId : void 0;
 				if (isId === "uuid") userIdType = "UUID";
-				else if (isId === "autoincrement") userIdType = "INTEGER";
+				else if (isId === "increment") userIdType = "INTEGER";
 			}
 		}
 		try {
@@ -9583,7 +10250,7 @@ async function ensureAuthTablesExist(db, collection) {
 				if (dbType === "UUID") userIdType = "UUID";
 				else if (dbType === "INTEGER" || dbType === "SMALLINT" || dbType === "BIGINT") userIdType = "INTEGER";
 				else userIdType = "TEXT";
-				logger.info(`✨ Detected ${usersTableName}.id type from database: ${dbType}. Using user_id type: ${userIdType}`);
+				logger.debug(`✨ Detected ${usersTableName}.id type from database: ${dbType}. Using user_id type: ${userIdType}`);
 			}
 		} catch (err) {
 			logger.warn(`⚠️ Failed to introspect ${usersTableName}.id type from database, falling back to config type: ${userIdType}`, { error: err });
@@ -9600,43 +10267,42 @@ async function ensureAuthTablesExist(db, collection) {
 		const emailLengthConstraint = `"${authIdentifier("email_length_check")}"`;
 		const emailLowerUniqueIndex = authIdentifier("email_lower_key");
 		const verificationTokenIndex = authIdentifier("email_verification_token_idx");
+		const usersColumnDdl = AUTH_USERS_COLUMNS.map((spec) => spec.column === "email" ? `${spec.column} ${authUsersColumnSql(spec)} CONSTRAINT ${emailLengthConstraint} CHECK (length(email) <= 320)` : `${spec.column} ${authUsersColumnSql(spec)}`).join(",\n                ");
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(usersTableName)} (
                 id ${sql.raw(userIdType)} PRIMARY KEY ${sql.raw(idDefault)},
-                email TEXT NOT NULL CONSTRAINT ${sql.raw(emailLengthConstraint)} CHECK (length(email) <= 320),
-                display_name TEXT,
-                photo_url TEXT,
-                roles TEXT[] DEFAULT '{}' NOT NULL,
-                password_hash TEXT,
-                email_verified BOOLEAN DEFAULT FALSE NOT NULL,
-                email_verification_token TEXT,
-                email_verification_sent_at TIMESTAMP WITH TIME ZONE,
-                is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
-                metadata JSONB DEFAULT '{}' NOT NULL,
-                tokens_valid_after TIMESTAMP WITH TIME ZONE,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
-                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
+                ${sql.raw(usersColumnDdl)}
             )
         `);
-		await db.execute(sql`
-            CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
-            BEGIN
-                IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
-                    NEW.uid := NEW.user_id;
-                ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
-                    NEW.user_id := NEW.uid;
-                END IF;
-                RETURN NEW;
-            END $$ LANGUAGE plpgsql
-        `);
-		for (const authTable of [
+		const legacyFkTables = [
 			"user_identities",
 			"refresh_tokens",
 			"password_reset_tokens",
 			"magic_link_tokens",
 			"mfa_factors",
 			"recovery_codes"
-		]) {
+		];
+		const legacyFkTableList = legacyFkTables.map((t) => `'${t}'`).join(", ");
+		const legacyUserIdPresent = await db.execute(sql`
+            SELECT 1
+            FROM information_schema.columns
+            WHERE table_schema = ${authSchema}
+              AND table_name IN (${sql.raw(legacyFkTableList)})
+              AND column_name = 'user_id'
+            LIMIT 1
+        `);
+		if (legacyUserIdPresent.rows.length > 0) await db.execute(sql`
+                CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
+                BEGIN
+                    IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
+                        NEW.uid := NEW.user_id;
+                    ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
+                        NEW.user_id := NEW.uid;
+                    END IF;
+                    RETURN NEW;
+                END $$ LANGUAGE plpgsql
+            `);
+		for (const authTable of legacyUserIdPresent.rows.length > 0 ? legacyFkTables : []) {
 			const qualified = `"${authSchema}"."${authTable}"`;
 			await db.execute(sql`
                 DO $$
@@ -9757,54 +10423,50 @@ async function ensureAuthTablesExist(db, collection) {
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
         `);
-		await db.execute(sql`CREATE SCHEMA IF NOT EXISTS auth`);
 		await db.transaction(async (tx) => {
 			await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$
-                    SELECT COALESCE(
-                        NULLIF(current_setting('app.uid', true), ''),
-                        NULLIF(current_setting('app.user_id', true), '')
-                    );
-                $$ LANGUAGE sql STABLE
-            `);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb AS $$
-                    SELECT COALESCE(
-                        NULLIF(current_setting('app.jwt', true), ''),
-                        '{}'
-                    )::jsonb;
-                $$ LANGUAGE sql STABLE
-            `);
-			await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.roles() RETURNS text AS $$
-                    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');
-                $$ LANGUAGE sql STABLE
-            `);
+			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await tx.execute(sql.raw(statement));
 		});
-		for (const columnDef of [
-			"display_name TEXT",
-			"photo_url TEXT",
-			"roles TEXT[] DEFAULT '{}' NOT NULL",
-			"password_hash TEXT",
-			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
-			"email_verification_token TEXT",
-			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
-			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
-			"metadata JSONB DEFAULT '{}' NOT NULL",
-			"tokens_valid_after TIMESTAMP WITH TIME ZONE",
-			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
-			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
-		]) await db.execute(sql`
+		for (const spec of AUTH_USERS_COLUMNS) {
+			if (spec.column === "email") continue;
+			await db.execute(sql`
                 ALTER TABLE ${sql.raw(usersTableName)}
-                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(`${spec.column} ${authUsersColumnSql(spec)}`)}
             `);
-		const usersColumns = await db.execute(sql`
-            SELECT column_name, data_type
+		}
+		const usersColumnRows = (await db.execute(sql`
+            SELECT column_name, data_type, is_nullable, column_default
             FROM information_schema.columns
             WHERE table_schema = ${usersSchema} AND table_name = ${resolvedTable}
-        `);
-		const usersColumnTypes = new Map(usersColumns.rows.map((row) => [row.column_name, row.data_type]));
+        `)).rows;
+		const usersColumnTypes = new Map(usersColumnRows.map((row) => [row.column_name, row.data_type]));
+		const usersColumnState = new Map(usersColumnRows.map((row) => [row.column_name, row]));
+		for (const spec of AUTH_USERS_COLUMNS) {
+			const state = usersColumnState.get(spec.column);
+			if (!state) continue;
+			if (spec.default !== void 0 && state.column_default === null) {
+				await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET DEFAULT ${sql.raw(spec.default)}
+                `);
+				logger.info(`🔧 Restored the default on ${usersTableName}.${spec.column}`);
+			}
+			if (!spec.notNull || state.is_nullable !== "YES") continue;
+			if (spec.default !== void 0) await db.execute(sql`
+                    UPDATE ${sql.raw(usersTableName)}
+                    SET ${sql.raw(`"${spec.column}"`)} = ${sql.raw(spec.default)}
+                    WHERE ${sql.raw(`"${spec.column}"`)} IS NULL
+                `);
+			try {
+				await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET NOT NULL
+                `);
+				logger.info(`🔧 Restored NOT NULL on ${usersTableName}.${spec.column}`);
+			} catch (err) {
+				logger.warn(`⚠️ ${usersTableName}.${spec.column} should be NOT NULL but still holds NULLs, so the constraint was not applied. Fill or remove those rows and restart: ` + (err instanceof Error ? err.message : String(err)));
+			}
+		}
 		for (const column of [
 			"email",
 			"display_name",
@@ -9875,7 +10537,7 @@ async function ensureAuthTablesExist(db, collection) {
                 FROM information_schema.tables
                 WHERE table_name = 'refresh_tokens'
             `)).rows;
-			logger.info(`🔍 refresh_tokens reconcile: found ${found.length} table(s): ${found.map((r) => `"${r.table_schema}"."${r.table_name}"`).join(", ") || "(none)"}`);
+			logger.debug(`🔍 refresh_tokens reconcile: found ${found.length} table(s): ${found.map((r) => `"${r.table_schema}"."${r.table_name}"`).join(", ") || "(none)"}`);
 			for (const { table_schema } of found) {
 				const qualified = `"${table_schema}"."refresh_tokens"`;
 				try {
@@ -9883,6 +10545,7 @@ async function ensureAuthTablesExist(db, collection) {
 					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);
 					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);
 					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS aal TEXT`);
 					await db.execute(sql`
                         UPDATE ${sql.raw(qualified)}
                         SET session_id = gen_random_uuid()::text
@@ -9902,7 +10565,7 @@ async function ensureAuthTablesExist(db, collection) {
                         ON ${sql.raw(qualified)}(session_id)
                     `);
 					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
-					logger.info(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
+					logger.debug(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
 				} catch (perTableError) {
 					logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);
 				}
@@ -9945,6 +10608,7 @@ async function ensureAuthTablesExist(db, collection) {
                 secret_encrypted TEXT NOT NULL,
                 friendly_name TEXT,
                 verified BOOLEAN DEFAULT FALSE,
+                last_used_counter BIGINT,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
@@ -9960,6 +10624,7 @@ async function ensureAuthTablesExist(db, collection) {
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
                 verified_at TIMESTAMP WITH TIME ZONE,
                 ip_address TEXT,
+                attempts INTEGER NOT NULL DEFAULT 0,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL
             )
         `);
@@ -9967,6 +10632,12 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE INDEX IF NOT EXISTS idx_mfa_challenges_factor
             ON ${sql.raw(mfaChallengesTableName)}(factor_id)
         `);
+		try {
+			await db.execute(sql`ALTER TABLE ${sql.raw(mfaFactorsTableName)} ADD COLUMN IF NOT EXISTS last_used_counter BIGINT`);
+			await db.execute(sql`ALTER TABLE ${sql.raw(mfaChallengesTableName)} ADD COLUMN IF NOT EXISTS attempts INTEGER NOT NULL DEFAULT 0`);
+		} catch (mfaMigrationError) {
+			logger.warn(`⚠️  MFA hardening columns skipped: ${mfaMigrationError instanceof Error ? mfaMigrationError.message : String(mfaMigrationError)}`);
+		}
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(recoveryCodesTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
@@ -9986,10 +10657,12 @@ async function ensureAuthTablesExist(db, collection) {
 				[authSchema, "user_identities"],
 				[authSchema, "refresh_tokens"],
 				[authSchema, "password_reset_tokens"],
+				[authSchema, "magic_link_tokens"],
 				[authSchema, "app_config"],
 				[authSchema, "mfa_factors"],
 				[authSchema, "mfa_challenges"],
-				[authSchema, "recovery_codes"]
+				[authSchema, "recovery_codes"],
+				[authSchema, "schema_meta"]
 			];
 			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
                     SELECT 1
@@ -10009,7 +10682,10 @@ async function ensureAuthTablesExist(db, collection) {
 			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
 		}
 		await stampAuthSchemaVersion(db, authSchema);
-		logger.info("✅ Auth tables ready");
+		await revokeInternalTableAccess(async (text) => {
+			await db.execute(sql.raw(text));
+		}, authSchema, { onError: (table, err) => logger.warn(`🔐 Could not revoke authenticated-role access to "${authSchema}"."${table}": ` + (err instanceof Error ? err.message : String(err))) });
+		logger.debug("✅ Auth tables ready");
 	} catch (error) {
 		if (error instanceof AuthSchemaVersionError) throw error;
 		logger.error("❌ Failed to create auth tables", { error });
@@ -10282,7 +10958,7 @@ var UserService = class {
 		const conditions = [];
 		if (roleId) conditions.push(sql`${roleId} = ANY(${sql.raw(usersTableName)}.roles)`);
 		if (search) {
-			const pattern = `%${search}%`;
+			const pattern = `%${escapeLikePattern(search)}%`;
 			conditions.push(sql`(${sql.raw(usersTableName)}.${sql.raw(emailColumn)} ILIKE ${pattern} OR ${sql.raw(usersTableName)}.${sql.raw(displayNameColumn)} ILIKE ${pattern})`);
 		}
 		const whereClause = conditions.length > 0 ? sql`WHERE ${sql.join(conditions, sql` AND `)}` : sql``;
@@ -10458,7 +11134,8 @@ var RefreshTokenService = class {
 			"sessionId",
 			"rotatedAt",
 			"revoked",
-			"sessionStartedAt"
+			"sessionStartedAt",
+			"aal"
 		]) if (this.has(optional)) selection[optional] = this.col(optional);
 		return selection;
 	}
@@ -10472,6 +11149,7 @@ var RefreshTokenService = class {
 		};
 		if (session && this.has("sessionId")) values.sessionId = session.id;
 		if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
+		if (session?.aal && this.has("aal")) values.aal = session.aal;
 		await this.db.insert(this.refreshTokensTable).values(values);
 	}
 	async findByHash(tokenHash) {
@@ -10949,6 +11627,9 @@ var PostgresAuthRepository = class {
 	async verifyMfaFactor(factorId) {
 		return this.getMfaService().verifyMfaFactor(factorId);
 	}
+	async updateMfaFactorSecret(factorId, secretEncrypted) {
+		return this.getMfaService().updateMfaFactorSecret(factorId, secretEncrypted);
+	}
 	async deleteMfaFactor(factorId, uid) {
 		return this.getMfaService().deleteMfaFactor(factorId, uid);
 	}
@@ -10976,6 +11657,12 @@ var PostgresAuthRepository = class {
 	async hasVerifiedMfaFactors(uid) {
 		return this.getMfaService().hasVerifiedMfaFactors(uid);
 	}
+	async claimMfaFactorCounter(factorId, counter) {
+		return this.getMfaService().claimMfaFactorCounter(factorId, counter);
+	}
+	async recordMfaChallengeAttempt(challengeId) {
+		return this.getMfaService().recordMfaChallengeAttempt(challengeId);
+	}
 };
 /**
 * PostgreSQL implementation of MfaRepository.
@@ -11028,7 +11715,7 @@ var MfaService = class {
 	async getMfaFactorById(factorId) {
 		const tableName = this.qualify("mfa_factors");
 		const result = await this.db.execute(sql`
-            SELECT id, uid, factor_type, secret_encrypted, friendly_name, verified, created_at, updated_at
+            SELECT id, uid, factor_type, secret_encrypted, friendly_name, verified, last_used_counter, created_at, updated_at
             FROM ${sql.raw(tableName)}
             WHERE id = ${factorId}
         `);
@@ -11041,10 +11728,29 @@ var MfaService = class {
 			secretEncrypted: row.secret_encrypted,
 			friendlyName: row.friendly_name ?? void 0,
 			verified: row.verified,
+			lastUsedCounter: row.last_used_counter === null || row.last_used_counter === void 0 ? null : Number(row.last_used_counter),
 			createdAt: new Date(row.created_at),
 			updatedAt: new Date(row.updated_at)
 		};
 	}
+	/**
+	* Spend a TOTP time step, once and only once.
+	*
+	* One statement: the `WHERE` is the check, the `UPDATE` is the act, and
+	* `RETURNING` reports which of two concurrent requests carrying the same
+	* six digits won. Reading the counter and then writing it would let both
+	* pass — the exact replay this closes.
+	*/
+	async claimMfaFactorCounter(factorId, counter) {
+		const tableName = this.qualify("mfa_factors");
+		return (await this.db.execute(sql`
+            UPDATE ${sql.raw(tableName)}
+            SET last_used_counter = ${counter}, updated_at = NOW()
+            WHERE id = ${factorId}
+              AND (last_used_counter IS NULL OR last_used_counter < ${counter})
+            RETURNING id
+        `)).rows.length > 0;
+	}
 	async verifyMfaFactor(factorId) {
 		const tableName = this.qualify("mfa_factors");
 		await this.db.execute(sql`
@@ -11053,6 +11759,14 @@ var MfaService = class {
             WHERE id = ${factorId}
         `);
 	}
+	async updateMfaFactorSecret(factorId, secretEncrypted) {
+		const tableName = this.qualify("mfa_factors");
+		await this.db.execute(sql`
+            UPDATE ${sql.raw(tableName)}
+            SET secret_encrypted = ${secretEncrypted}, updated_at = NOW()
+            WHERE id = ${factorId}
+        `);
+	}
 	async deleteMfaFactor(factorId, uid) {
 		const tableName = this.qualify("mfa_factors");
 		await this.db.execute(sql`
@@ -11079,7 +11793,7 @@ var MfaService = class {
 	async getMfaChallengeById(challengeId) {
 		const tableName = this.qualify("mfa_challenges");
 		const result = await this.db.execute(sql`
-            SELECT id, factor_id, created_at, verified_at, ip_address, expires_at
+            SELECT id, factor_id, created_at, verified_at, ip_address, attempts, expires_at
             FROM ${sql.raw(tableName)}
             WHERE id = ${challengeId} AND expires_at > NOW() AND verified_at IS NULL
         `);
@@ -11090,9 +11804,28 @@ var MfaService = class {
 			factorId: row.factor_id,
 			createdAt: new Date(row.created_at),
 			verifiedAt: row.verified_at ? new Date(row.verified_at) : void 0,
-			ipAddress: row.ip_address ?? void 0
+			ipAddress: row.ip_address ?? void 0,
+			attempts: Number(row.attempts ?? 0)
 		};
 	}
+	/**
+	* Count one failed guess against a challenge and report the new total.
+	*
+	* Incremented in the database rather than in the route so that guesses
+	* arriving in parallel — the shape any real brute-force takes — cannot
+	* share a single increment.
+	*/
+	async recordMfaChallengeAttempt(challengeId) {
+		const tableName = this.qualify("mfa_challenges");
+		const result = await this.db.execute(sql`
+            UPDATE ${sql.raw(tableName)}
+            SET attempts = attempts + 1
+            WHERE id = ${challengeId}
+            RETURNING attempts
+        `);
+		if (result.rows.length === 0) return 0;
+		return Number(result.rows[0].attempts);
+	}
 	async verifyMfaChallenge(challengeId) {
 		const tableName = this.qualify("mfa_challenges");
 		await this.db.execute(sql`
@@ -11313,7 +12046,7 @@ function findChangedFields(oldValues, newValues) {
 * pattern as `ensureAuthTablesExist`.
 */
 async function ensureHistoryTableExists(db) {
-	logger.info("🔍 Checking row history table...");
+	logger.debug("🔍 Checking row history table...");
 	try {
 		await db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
 		await db.execute(sql`
@@ -11337,7 +12070,8 @@ async function ensureHistoryTableExists(db) {
             CREATE INDEX IF NOT EXISTS idx_history_time
             ON rebase.entity_history(table_name, entity_id, updated_at DESC)
         `);
-		logger.info("✅ Entity history table ready");
+		await db.execute(sql.raw(revokeInternalTableSql("rebase", "entity_history")));
+		logger.debug("✅ Entity history table ready");
 	} catch (error) {
 		logger.error("❌ Failed to create row history table", { error });
 		logger.warn("⚠️ Continuing without creating history table.");
@@ -11651,6 +12385,7 @@ function idKindFor(col, propType) {
 }
 function buildProperties(meta, enumMap) {
 	const properties = {};
+	const takenKeys = /* @__PURE__ */ new Set();
 	for (const col of meta.columns) {
 		const isPk = meta.pks.includes(col.column_name);
 		if (meta.fks.some((fk) => fk.column_name === col.column_name) && !isPk) continue;
@@ -11663,7 +12398,8 @@ function buildProperties(meta, enumMap) {
 			columnName: col.column_name,
 			type: propType
 		};
-		const key = col.column_name;
+		const key = firstFreeKey([toWireKey(col.column_name), col.column_name], takenKeys);
+		takenKeys.add(key);
 		if (isPk) property.isId = idKindFor(col, propType);
 		else if (col.is_nullable === "NO" && col.column_default === null) property.validation = { required: true };
 		if (isEnum && enumValues) property.enum = enumValues.map((value) => ({
@@ -11700,7 +12436,7 @@ function buildRelations(meta, slugByTable, collectionBySlug) {
 	for (const fk of meta.fks) {
 		const targetSlug = slugByTable.get(fk.foreign_table_name);
 		if (!targetSlug) continue;
-		let key = fk.column_name.replace(/_id$/, "");
+		let key = toWireKey(fk.column_name.replace(/_id$/, ""));
 		if (meta.pks.includes(fk.column_name) && key === fk.column_name) key = fk.foreign_table_name;
 		relations[key] = {
 			name: humanize(key),
@@ -11957,6 +12693,43 @@ function resolveDriftCheckName(col, registeredTableNames) {
 	return (isRelationalCollectionConfig(col) ? col.table : void 0) ?? registeredTableNames.find((k) => k === col.slug) ?? col.slug;
 }
 /**
+* Is this the local database `rebase init` scaffolds — i.e. the one case where
+* "you are connected as a superuser" is not news?
+*
+* The scaffold's own `docker-compose.yml` sets `POSTGRES_USER: rebase_app`,
+* which makes that role the cluster superuser, so the superuser advisory below
+* was the only WARN a brand-new project ever saw and it was about a decision
+* the tool had made for the developer.
+*
+* Of the two available fixes — provision a non-superuser table-owner role in
+* the scaffold, or recognise the local shape and stay quiet — this is the
+* second, because the first breaks the scaffold it is meant to improve: a
+* non-superuser owner cannot `CREATE EXTENSION` (search collections need
+* `pg_trgm`/`unaccent`, applied by `rebase db push` and again by the boot
+* schema-ensure), so the very first `pnpm run db:push` on a scaffolded project
+* with a search block would fail. Trading a working first run for a quieter log
+* line is the wrong trade.
+*
+* The condition is deliberately narrow — a *non-production* process talking to
+* a database on the loopback interface. A genuine production superuser
+* connection still warns, and so does a non-production process pointed at a
+* remote database (the usual "my dev machine writes to staging" mistake, where
+* the advisory is exactly right). NODE_ENV alone would not do: the scaffold
+* ships `NODE_ENV=development` and some deployments inherit it.
+*/
+function isScaffoldedLocalDatabase(connectionString) {
+	if (process.env.NODE_ENV === "production") return false;
+	if (!connectionString) return false;
+	let host;
+	try {
+		host = new URL(connectionString).hostname;
+	} catch {
+		return false;
+	}
+	const bare = host.replace(/^\[|\]$/g, "").toLowerCase();
+	return bare === "localhost" || bare === "::1" || bare === "0.0.0.0" || bare === "" || /^127\./.test(bare) || bare.endsWith(".localhost");
+}
+/**
 * Default PostgreSQL bootstrapper.
 *
 * Use it to register Postgres with `initializeRebaseBackend()`:
@@ -12058,21 +12831,26 @@ function createPostgresBootstrapper(pgConfig) {
 				const runSql = async (text) => {
 					return (await schemaAwareDb.execute(sql.raw(text))).rows ?? [];
 				};
+				await warnOnRoleSchemaCollision(runSql);
 				const posture = await detectConnectionPosture(runSql);
 				if (posture.privileged) {
 					await ensureAppRole(runSql, [
 						"public",
 						"rebase",
-						"auth",
 						...registry.getCollections().map((c) => c.schema).filter((s) => typeof s === "string")
 					]);
 					driver.rlsUserRole = REBASE_USER_ROLE;
 					realtimeService.rlsUserRole = REBASE_USER_ROLE;
 					logger.info(`🔐 RLS enforcement active: authenticated requests run as "${REBASE_USER_ROLE}" (connection "${posture.role}" bypasses RLS: ${posture.superuser ? "superuser" : posture.bypassRLS ? "BYPASSRLS" : "table owner"})`);
-					if (posture.superuser || posture.bypassRLS) logger.warn(`⚠️ The database connection runs as ${posture.superuser ? "a superuser" : "a BYPASSRLS role"} ("${posture.role}"). User requests are isolated via SET LOCAL ROLE, but connect as a non-superuser table-owner role in production so the server/owner context is least-privilege.`);
+					if (posture.superuser || posture.bypassRLS) {
+						const message = `The database connection runs as ${posture.superuser ? "a superuser" : "a BYPASSRLS role"} ("${posture.role}"). User requests are isolated via SET LOCAL ROLE, but connect as a non-superuser table-owner role in production so the server/owner context is least-privilege.`;
+						if (isScaffoldedLocalDatabase(pgConfig.connectionString)) logger.debug(`🔐 ${message}`);
+						else logger.warn(`⚠️ ${message}`);
+					}
 				} else logger.info(`🔐 RLS enforcement: connection role "${posture.role}" is subject to RLS natively; no role switch needed.`);
 				await validatePolicyPgRoles(runSql, registry.getCollections(), driver.rlsUserRole ?? posture.role);
 				warnOnAnonymousGrants(registry.getCollections());
+				warnOnLegacyRlsFunctions(registry.getCollections());
 			}
 			if (driver.branchService) try {
 				await driver.branchService.ensureBranchMetadataTable();
@@ -12288,12 +13066,12 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CBQdOETu.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-CbvaGuVn.js");
 			const plan = await ensureCollectionTables({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
 			} }, collections, log);
-			for (const failure of plan.failures) logger.warn(`🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
+			for (const failure of plan.failures) logger.warn(failure.kind === "comment-column" ? `🔍 [schema] Could not record the search fingerprint on "${failure.target}" — search works, but a later change to the \`search\` block will not be detected: ${failure.error}` : `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
 			return { applied: plan.actions.length - plan.failures.length };
 		},
 		/**
@@ -12313,13 +13091,27 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-ViG8XiPn.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-8vuu-n4r.js");
 			const outcome = await ensureCollectionPolicies({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
 			} }, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
-			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — it stays locked (denies) until this is resolved: ${failure.error}`);
+			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — RLS is on, so it denies until this is resolved: ${failure.error}`);
+			const unrevoked = outcome.unsecured.filter((u) => !u.grantWithdrawn);
+			for (const u of outcome.unsecured.filter((u) => u.grantWithdrawn)) logger.error(`🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. Its privileges have been revoked from ${REBASE_USER_ROLE}, so the table is unreachable rather than unprotected. Reads and writes to that collection will fail until RLS can be enabled.`);
+			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
+			try {
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-69hYT8nr.js").then((n) => n.n);
+				await dropLegacyAuthSchema(async (text) => {
+					return (await internals.db.execute(sql.raw(text))).rows ?? [];
+				}, {
+					info: (m) => logger.info(m),
+					warn: (m) => logger.warn(m)
+				});
+			} catch (err) {
+				logger.info("Left the legacy `auth` schema in place: " + (err instanceof Error ? err.message : String(err)));
+			}
 			return { applied: outcome.policiesApplied };
 		},
 		getAdmin(driverResult) {
@@ -12327,7 +13119,7 @@ function createPostgresBootstrapper(pgConfig) {
 		},
 		mountRoutes(app, basePath, driverResult) {},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			const { createPostgresWebSocket } = await import("./websocket-B2LsrINK.js").then((n) => n.n);
+			const { createPostgresWebSocket } = await import("./websocket-C8ZqVBiV.js").then((n) => n.n);
 			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
 		}
 	};
@@ -12367,6 +13159,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, frameByteLength, generateSchema, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map