@rebasepro/server-postgres 0.13.1-canary.gf57a27e → 0.14.0

package/dist/index.es.js

@@ -2,17 +2,18 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
-import { A as resolveCollectionRelations, B as legacyForeignKeyName, C as securityRuleToConditions, D as getEnumVarName, E as getColumnName, F as createRelationRef, G as camelCase, H as getPolicyNamesForRule, I as createRelationRefWithData, K as toSnakeCase, L as normalizeToEntityRelation, M as getDeclaredPrimaryKeys, N as isAddressableId, O as getTableName$1, P as parseIdValues, Q as Vector, R as updateDateAutoValues, S as policyToPostgres, T as findRelation, U as isPrototypePollutingKey, W as mergeDeep, X as hasForeignKeyOnTarget, Y as resolveClientListLimit, Z as isManyToMany, _ as resolveStringColumnLength, b as resolveJunctionSpecs, c as buildSearchColumnSpec, g as relationalCollections, h as CollectionRegistry, j as buildCompositeId, k as getTableVarName, l as hiddenColumnsOption, m as buildSdkData, o as SEARCH_UNACCENT_FN, p as visibleColumnProjection, r as authUsersColumnSql, t as AUTH_USERS_COLUMNS, v as getJunctionCollectionConfig, w as findAnonymousGrants, x as getEffectiveSecurityRules, y as getJunctionSecurityRules, z as generateForeignKeyName } from "./auth-users-columns-Dt9g712t.js";
-import { c as isPostgresCollectionConfig, l as isRelationalCollectionConfig, n as REBASE_SCHEMA, o as usesLegacyRlsFunctions } from "./src-C_wvdMnl.js";
-import { t as ANONYMOUS_USER_ID } from "./policy-CPkCqVTz.js";
-import { t as createPostgresWebSocket } from "./websocket-D0TBU3ia.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-Bww-Lg0s.js";
-import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-Bpv3nUZo.js";
+import { n as resolveClientListLimit, t as ListLimitError } from "./data_driver-ULAyJEi9.js";
+import { A as getEnumVarName, B as createRelationRefWithData, C as getEffectiveSecurityRules, D as fieldKeyForColumn, F as getDeclaredPrimaryKeys, G as legacyForeignKeyName, H as updateDateAutoValues, I as isAddressableId, J as getPolicyNamesForRule, L as parseIdValues, M as getTableVarName, N as resolveCollectionRelations, O as findRelation, P as buildCompositeId, Q as toSnakeCase, R as sortCollectionsBySlug, S as resolveJunctionSpecs, T as securityRuleToConditions, U as firstFreeKey, V as normalizeToEntityRelation, W as generateForeignKeyName, X as mergeDeep, Y as isPrototypePollutingKey, Z as camelCase, _ as CollectionRegistry, b as getJunctionCollectionConfig, g as buildSdkData, h as visibleColumnProjection, j as getTableName$1, k as getColumnName, l as buildSearchColumnSpec, nt as isManyToMany, q as toWireKey, r as authUsersColumnSql, rt as Vector, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as hasForeignKeyOnTarget, u as hiddenColumnsOption, v as relationalCollections, w as policyToPostgres, x as getJunctionSecurityRules, y as resolveStringColumnLength, z as createRelationRef } from "./auth-users-columns-BfQHf9JE.js";
+import { c as isPostgresCollectionConfig, f as ALL_WHERE_FILTER_OPS, l as isRelationalCollectionConfig } from "./src-DCdn3Val.js";
+import { t as createPostgresWebSocket } from "./websocket-C8ZqVBiV.js";
+import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-BJ_3wxwg.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-BH0Dzo_h.js";
+import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-69hYT8nr.js";
 import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, loadCollectionsFromDirectory, logger } from "@rebasepro/server";
-import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, or, relations, sql } from "drizzle-orm";
-import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
+import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, notInArray, or, relations, sql } from "drizzle-orm";
+import { PgArray, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs, { promises } from "fs";
 import path from "path";
 import chokidar from "chokidar";
@@ -134,140 +135,25 @@ var buildPropertyCallbacks = (properties) => {
 	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
 };
 //#endregion
-//#region ../common/src/util/internal-tables.ts
-/**
-* The tables Rebase creates for its own bookkeeping, and the SQL that keeps the
-* end-user role away from them.
-*
-* ## Why this exists
-*
-* Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role
-* provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table
-* in the schemas a project uses — including `rebase`, because a project's own
-* collections are allowed to live there (the scaffold puts `users` there). It
-* also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the
-* migrating role inherits the same grant.
-*
-* Every framework-internal table is created later: auth's tables come up during
-* `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first
-* job registers, `idempotency_keys` on the first request that carries a key. So
-* they all inherited full DML for the end-user role — and none of them enables
-* row-level security, because none of them is a collection with
-* `securityRules`. Measured on a freshly provisioned database, `SET ROLE
-* rebase_user` could read `rebase.refresh_tokens` (session token hashes),
-* `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and
-* `rebase.api_keys` (including its `admin` flag), and insert into
-* `rebase.app_config`.
-*
-* Nothing routes a user-context query at those tables today, so this was not
-* reachable over the API. That is the wrong thing to depend on: the documented
-* model is that RLS is the authorization boundary, and these tables sat outside
-* it. The boundary is now a privilege boundary instead — the role simply cannot
-* address them.
-*
-* ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY
-*
-* RLS with no policy denies every row, which is the same outcome, but it is the
-* *weaker* statement: it leaves the grant in place, so a later policy — or a
-* `FORCE` flag cleared by some future migration — reopens the table. There is no
-* row of `refresh_tokens` any end user should ever reach, so the honest encoding
-* is "this role has no privilege here at all". It also keeps the owner
-* connection (which auth actually runs on) completely unaffected.
-*
-* ## Keeping it true
-*
-* `packages/rls-check` scans the `rebase` schema — it used to skip it as a
-* "platform" schema — and its `rls-disabled` check fires on exactly the
-* condition this module removes: RLS off *and* a DML grant to a reachable role.
-* So a table added here without a revoke is caught by `pnpm rls:check`, not by
-* someone re-reading this file.
-*/
-/**
-* The Postgres role authenticated requests run as.
-*
-* Defined here rather than in the Postgres driver because both the driver (which
-* provisions the role) and this module (which revokes on its behalf) need it,
-* and a second spelling of a role name is a silent no-op waiting to happen.
-*/
-var REBASE_USER_ROLE = "rebase_user";
-/**
-* Framework-internal table names, unqualified.
-*
-* Deliberately NOT including `users`: the auth user table is also a collection,
-* with `securityRules`, RLS enabled and policies applied. Users read their own
-* row through it — revoking there would break sign-in.
-*
-* `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`
-* because `db migrate apply` passes `--revisions-schema rebase`.
-*/
-var REBASE_INTERNAL_TABLES = [
-	"user_identities",
-	"refresh_tokens",
-	"password_reset_tokens",
-	"magic_link_tokens",
-	"mfa_factors",
-	"mfa_challenges",
-	"recovery_codes",
-	"app_config",
-	"schema_meta",
-	"api_keys",
-	"cron_logs",
-	"cron_claims",
-	"idempotency_keys",
-	"entity_history",
-	"branches",
-	"channel_messages",
-	"channel_cursors",
-	"channel_presence",
-	"atlas_schema_revisions"
-];
-/** Postgres identifiers this module is willing to interpolate. */
-var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+//#region ../common/src/data/filter-conditions.ts
 /**
-* A single statement that takes every privilege on `schema.table` away from the
-* end-user role.
+* Read one field's filter as the list of conditions it stands for.
 *
-* Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which
-* happen in practice:
+* Accepts both declared shapes and normalises them to a list:
 *
-*  - the role does not exist when the connection is unprivileged (Rebase then
-*    relies on native RLS rather than a role switch), and a bare `REVOKE` on a
-*    missing role is an error, not a no-op;
-*  - the table may not exist yet — `cron_logs` never appears in a project with
-*    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.
+* ```ts
+* toFilterTuples(["==", "active"])          // [["==", "active"]]
+* toFilterTuples([[">=", 18], ["<", 65]])   // [[">=", 18], ["<", 65]]
+* ```
 *
-* One command, so it is safe on handles that speak the extended query protocol
-* and reject multi-statement strings.
+* A falsy, non-array or empty param has no conditions in it — the empty list,
+* so a caller iterating adds nothing rather than compiling a tuple of
+* `undefined`s and logging about an operator nobody sent.
 */
-function revokeInternalTableSql(schema, table) {
-	if (!SAFE_IDENTIFIER.test(schema)) throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);
-	if (!SAFE_IDENTIFIER.test(table)) throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);
-	const qualified = `"${schema}"."${table}"`;
-	return `
-        DO $rebase_revoke$
-        BEGIN
-            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')
-               AND to_regclass('${qualified}') IS NOT NULL THEN
-                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';
-            END IF;
-        END
-        $rebase_revoke$;
-    `.trim();
-}
-/**
-* Revoke on every internal table in `schema`, one statement at a time.
-*
-* Best-effort per table: a connection that does not own one of them (a
-* pre-provisioned database, a platform-managed ledger) cannot revoke on it, and
-* that must not take down a boot. The caller decides how loud to be — `onError`
-* exists so the driver can warn without this module importing a logger.
-*/
-async function revokeInternalTableAccess(execute, schema, options) {
-	for (const table of options?.tables ?? REBASE_INTERNAL_TABLES) try {
-		await execute(revokeInternalTableSql(schema, table));
-	} catch (error) {
-		options?.onError?.(table, error);
-	}
+function toFilterTuples(filterParam) {
+	if (!filterParam || !Array.isArray(filterParam) || filterParam.length === 0) return [];
+	if (Array.isArray(filterParam[0])) return filterParam;
+	return [filterParam];
 }
 //#endregion
 //#region ../common/src/table-classification.ts
@@ -375,6 +261,55 @@ function getCollectionByPath(collectionPath, registry) {
 	}
 	return collection;
 }
+/**
+* Reject a write naming something that is not a column of the table.
+*
+* Drizzle builds INSERT from `Object.entries(table[Symbol.Columns])` and UPDATE
+* from `Object.keys(tableColumns)`, so a key the table does not carry is not
+* rejected by anything — it is *left out of the statement*. The insert answers
+* 201 having stored nothing under that name; the update, if the key was the
+* only one, builds `update "posts" set  where …` and Postgres raises a syntax
+* error (SQLSTATE 42601), which is neither class 22 nor 23 and so surfaces as a
+* 500 for what is a caller's typo.
+*
+* That makes this the last honest place to check, and the only one every write
+* passes through. `assertKnownWriteFields` in the REST layer checks the same
+* thing against the *config* and is skipped on four paths — `strictWrites:
+* false`, a collection declaring no properties, an auth adapter that owns the
+* body's shape, and a nested route whose target cannot be walked — and it never
+* sees an in-process `rebase.data` write at all.
+*
+* It also gives `strictWrites: false` a truthful implementation. The flag is
+* documented for "a column that really does exist which the config never
+* declared", and skipping the config check alone could not deliver that: the
+* value was dropped a layer later regardless. Skipping the config check and
+* keeping this one does exactly what the flag says — the column must exist,
+* the property need not.
+*/
+function assertWritableColumns(values, table, collectionPath) {
+	const columns = getTableColumns(table);
+	if (!columns || Object.keys(columns).length === 0) return;
+	const unknown = Object.keys(values).filter((key) => !(key in columns));
+	if (unknown.length === 0) return;
+	throw ApiError.badRequest(`'${collectionPath}' has no column${unknown.length > 1 ? "s" : ""} ${unknown.map((key) => `'${key}'`).join(", ")}, so the value${unknown.length > 1 ? "s" : ""} would have been dropped before the statement was built.`, "VALIDATION_UNKNOWN_FIELDS");
+}
+/**
+* A relation whose names do not resolve against the registered schema.
+*
+* Every one of these used to be a `logger.warn` followed by `continue`, so a
+* save reported success for a relation it had not written and a read answered
+* `[]` for one it could not resolve. `assertRelationsResolve` (validate-relations)
+* fails boot on the same defects, which is where they belong — a server that
+* refuses to start is recoverable in a minute. This is the second line, for the
+* paths that assemble a registry by hand, and it exists so that "cannot resolve"
+* is never again reported as "done".
+*
+* @param label  `<collection>.<relation>`
+* @param detail what does not resolve, in terms of the schema
+*/
+function relationMisconfigured(label, detail) {
+	return ApiError.internal(`Relation '${label}' does not resolve against the registered schema: ${detail}. The operation was refused rather than skipped — silently dropping it would report success for a write that never happened, or emptiness for rows that exist. Run \`rebase schema generate\` if the generated schema is older than the database.`, "RELATION_MISCONFIGURED");
+}
 function getTableForCollection(collection, registry) {
 	const tableName = getTableName$1(collection);
 	const table = registry.getTable(tableName);
@@ -466,7 +401,7 @@ function requirePrimaryKeys(collection, registry) {
 * they were *duplicated* and could disagree, not because they existed.
 */
 function sourceKeyField(relation, sourceCollection, registry) {
-	if (relation.sourceKey) return relation.sourceKey;
+	if (relation.sourceKey) return fieldKeyForColumn(sourceCollection, relation.sourceKey);
 	return requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
 }
 /**
@@ -480,7 +415,7 @@ function sourceKeyField(relation, sourceCollection, registry) {
 */
 function joinsOnNaturalKey(relation, sourceCollection, registry) {
 	if (!relation.sourceKey) return false;
-	return relation.sourceKey !== requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
+	return fieldKeyForColumn(sourceCollection, relation.sourceKey) !== requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
 }
 /**
 * Collections whose key the *browser* cannot resolve, and what it will do
@@ -560,6 +495,91 @@ function deriveRowAddress(row, collection, registry) {
 */
 var PG_TRGM_WORD_SIMILARITY_DEFAULT = .6;
 /**
+* A user's search term, made safe to drop inside a `%…%` LIKE pattern.
+*
+* The term is already a bind parameter, so this is not about injection. It is
+* about the two things a LIKE metacharacter does when it arrives from a search
+* box:
+*
+*  1. **It changes the query.** `%` and `_` are wildcards, so searching for
+*     `50%` returned every row and `a_c` matched `abc`. Nothing the caller
+*     could type would find a literal `%`.
+*  2. **It is a cost the caller chooses.** Postgres matches LIKE by
+*     backtracking: each `%` re-tries every remaining offset, so
+*     `?searchString=a%a%a%a%a%a%a%b` is polynomial with an attacker-chosen
+*     exponent — evaluated per row, OR-ed across every string property of the
+*     collection, on a sequential scan (a leading `%` cannot use an index), and
+*     the page limit does not bound it because the scan happens first.
+*
+* This is the server-side half of the pattern `like-pattern-redos.test.ts`
+* hardened the offline evaluator against; that test's own note ("the same
+* translation in the Mongo driver hands the expression to the database, where
+* it occupies a server thread instead") describes this call site.
+*
+* Backslash is the default `ESCAPE` character for LIKE, and the pattern is
+* bound rather than interpolated, so a single backslash here reaches the
+* matcher as one. Escaping the escape character first is what keeps a term
+* ending in `\` from swallowing the closing `%`.
+*
+* Note this is a *substring search*, not the `like` filter operator: a caller
+* who wants wildcards has `?title=like.foo%` for that, where the pattern is the
+* documented input.
+*/
+var escapeLikePattern = (value) => value.replace(/[\\%_]/g, (ch) => `\\${ch}`);
+/**
+* The Drizzle column a relation's column name addresses on a table.
+*
+* A relation names its link in *column* terms — `localKey: "author_id"`,
+* `foreignKeyOnTarget: "author_id"` — because that is what the database and
+* every FK constraint call it. A Drizzle table is keyed by the *wire* name,
+* `authorId`. Indexing the table with the column, which is what every one of
+* these call sites used to do, therefore finds nothing the moment the two
+* differ: for a `columnName`-carrying property that was already true, and it is
+* now true of every derived foreign key.
+*
+* `undefined` rather than a throw: each caller already has a message naming the
+* relation it was resolving, which is worth more than a generic one here.
+*/
+var relationColumn = (table, collection, column) => {
+	const key = fieldKeyForColumn(collection, column);
+	return (key in table ? table[key] : void 0) || void 0;
+};
+/** The target collection of a relation, or `undefined` if its thunk cannot resolve. */
+var targetOf = (relation) => {
+	try {
+		return relation.target();
+	} catch {
+		return;
+	}
+};
+/** Column types `ILIKE '%…%'` is defined on. */
+var ILIKE_SQL_TYPES = /^(text|varchar|character varying|char|character|bpchar|citext)\b/;
+/**
+* Can this column be matched with `ILIKE`?
+*
+* Asked of the column's *declared SQL type*, never with `instanceof`. The
+* previous version tested `column instanceof PgVarchar || … PgText || … PgChar`,
+* and `instanceof` compares class identity: it is only true when the column was
+* constructed by the very same copy of `drizzle-orm` that this module imported.
+*
+* An application's generated schema builds its tables with the app's own
+* `drizzle-orm`, and this driver declares its own dependency on one. When the
+* two ranges do not overlap — an app scaffolded against `^0.44` with a driver
+* asking for `^0.45` — a strict installer gives the driver a second copy, every
+* check returns false, no condition is produced, and the caller compiles that
+* into an impossible `WHERE`. The result is a 200 with an empty page for every
+* search on every collection without a `search` block: the failure looks
+* exactly like "nothing matched". Observed in production, not theorised.
+*
+* `getSQLType()` is a value the column reports about itself, so it crosses
+* module instances the way a class identity cannot. It also happens to fix
+* `citext`, which the `instanceof` list never covered.
+*/
+var supportsILike = (column) => {
+	const sqlType = typeof column?.getSQLType === "function" ? column.getSQLType().toLowerCase() : "";
+	return ILIKE_SQL_TYPES.test(sqlType);
+};
+/**
 * Process-wide default, set once when the driver is constructed.
 *
 * The condition builder is a set of *static* methods reached from a dozen
@@ -657,7 +677,7 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 			}
 			case "hasOne":
 			case "hasMany": {
-				const fkColumn = targetTable[relation.foreignKeyOnTarget];
+				const fkColumn = relationColumn(targetTable, targetOf(relation), relation.foreignKeyOnTarget);
 				if (!fkColumn) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'.`);
 				if (!relation.sourceKey) return eq(fkColumn, parentId);
 				const { table, idColumn } = parent();
@@ -745,14 +765,14 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		if (collection) {
 			const relation = resolveCollectionRelations(collection)[field];
 			if (relation?.kind === "belongsTo") {
-				const foreignKey = columnAt(relation.localKey);
+				const foreignKey = relationColumn(table, collection, relation.localKey);
 				if (foreignKey) return {
 					kind: "column",
 					column: foreignKey
 				};
 			}
 			if (relation && (hasForeignKeyOnTarget(relation) || isManyToMany(relation)) && registry && sourceIdColumn) {
-				const correlationColumn = hasForeignKeyOnTarget(relation) && relation.sourceKey ? columnAt(relation.sourceKey) : sourceIdColumn;
+				const correlationColumn = hasForeignKeyOnTarget(relation) && relation.sourceKey ? relationColumn(table, collection, relation.sourceKey) : sourceIdColumn;
 				if (!correlationColumn) throw new Error(`\`sourceKey: "${relation.sourceKey}"\` on relation '${relation.relationName}' is not a column on '${collectionPath}', so a filter on that relation has nothing to correlate against.`);
 				return {
 					kind: "relation",
@@ -762,7 +782,12 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 				};
 			}
 		}
-		for (const guess of [`${field}_id`, generateForeignKeyName(field)]) {
+		for (const guess of [
+			`${field}Id`,
+			toWireKey(generateForeignKeyName(field)),
+			`${field}_id`,
+			generateForeignKeyName(field)
+		]) {
 			const foreignKey = columnAt(guess);
 			if (foreignKey) return {
 				kind: "column",
@@ -793,8 +818,7 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 			if (!filterParam) continue;
 			const target = this.resolveFilterTarget(table, field, collectionPath, mode, options);
 			if (!target) continue;
-			const paramsList = Array.isArray(filterParam) && filterParam.length > 0 && Array.isArray(filterParam[0]) ? filterParam : [filterParam];
-			for (const [op, value] of paramsList) {
+			for (const [op, value] of toFilterTuples(filterParam)) {
 				const condition = this.compileFilterTarget(target, op, value, field, collectionPath);
 				if (condition) conditions.push(condition);
 			}
@@ -871,7 +895,7 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 			const targetCollection = relation.target();
 			const targetTable = registry.getTable(getTableName$1(targetCollection));
 			if (!targetTable) throw new Error(`Table not found for the target of relation '${relation.relationName}' (collection '${targetCollection.slug}')`);
-			const fkColumn = targetTable[relation.foreignKeyOnTarget];
+			const fkColumn = relationColumn(targetTable, targetCollection, relation.foreignKeyOnTarget);
 			if (!fkColumn) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'.`);
 			const targetIdColumn = this.primaryKeyColumn(targetTable);
 			if (!targetIdColumn) throw new Error(`No primary key or "id" column in the target table of relation '${relation.relationName}', so a filter on it has nothing to match against.`);
@@ -1023,9 +1047,10 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 			case "not-ilike": return sql`${column} NOT ILIKE ${String(value)}`;
 			case "is-null": return sql`${column} IS NULL`;
 			case "is-not-null": return sql`${column} IS NOT NULL`;
-			default:
-				logger.warn(`Unsupported filter operation: ${op}`);
-				return null;
+			default: throw ApiError.badRequest(`Unknown filter operator '${op}'. Valid operators: ${ALL_WHERE_FILTER_OPS.join(", ")}.`, "UNKNOWN_FILTER_OPERATOR", {
+				operator: op,
+				validOperators: ALL_WHERE_FILTER_OPS
+			});
 		}
 	}
 	/**
@@ -1222,7 +1247,7 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 			if (!targetIdCol) throw new Error(`No primary key or "id" column in the target table of relation '${relation.relationName}'.`);
 			return match(targetIdCol);
 		}
-		const foreignKeyCol = targetTable[relation.foreignKeyOnTarget];
+		const foreignKeyCol = relationColumn(targetTable, targetOf(relation), relation.foreignKeyOnTarget);
 		if (!foreignKeyCol) throw new Error(`Foreign key column '${relation.foreignKeyOnTarget}' not found in the target table of relation '${relation.relationName}'. A link through a junction is \`kind: "manyToMany"\`.`);
 		return match(foreignKeyCol);
 	}
@@ -1251,7 +1276,8 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 	*   `tsvector` column. Stems, drops stopwords, AND-es the terms, reaches
 	*   inside JSONB and arrays, and uses the GIN index.
 	* - **Not declared** — the original `ILIKE '%term%'` OR-ed across top-level
-	*   string properties, unchanged.
+	*   string properties, with the term escaped (see {@link escapeLikePattern})
+	*   so it is matched as the literal text the user typed.
 	*
 	* The second is the default and stays the default. A collection that has
 	* not opted in compiles to exactly the SQL it compiled to before this
@@ -1265,15 +1291,16 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		const searchConditions = [];
 		const ftsCondition = collection ? DrizzleConditionBuilder.buildFullTextCondition(searchString, table, collection) : void 0;
 		if (ftsCondition) return [ftsCondition];
+		let declaredStringProperties = 0;
 		for (const [key, prop] of Object.entries(properties)) {
 			const p = prop;
 			if (p.type === "string" && !p.enum && p.isId !== "uuid") {
+				declaredStringProperties++;
 				const fieldColumn = table[key];
-				if (fieldColumn) {
-					if (fieldColumn instanceof PgVarchar || fieldColumn instanceof PgText || fieldColumn instanceof PgChar || fieldColumn && typeof fieldColumn === "object" && !("columnType" in fieldColumn)) searchConditions.push(ilike(fieldColumn, `%${searchString}%`));
-				}
+				if (fieldColumn && supportsILike(fieldColumn)) searchConditions.push(ilike(fieldColumn, `%${escapeLikePattern(searchString)}%`));
 			}
 		}
+		if (declaredStringProperties > 0 && searchConditions.length === 0) logger.warn(`[search] "${collection?.slug ?? "collection"}" declares ${declaredStringProperties} string property(ies) but none compiled to a searchable column, so this search can only return nothing. Check that the generated schema's column types are text/varchar/char.`);
 		return searchConditions;
 	}
 	/**
@@ -1485,10 +1512,19 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 	* - `orderBy`: SQL expression to ORDER BY distance (ascending = closest first)
 	* - `filter`: optional WHERE clause for distance threshold
 	* - `distanceSelect`: SQL expression for selecting the distance as `_distance`
+	*
+	* `property` is `?vector_search=` off the querystring, so it is an untrusted
+	* *name*, and it used to be looked up straight in the drizzle table object.
+	* Two ways that went wrong, both answering 500 to a malformed request:
+	* `?vector_search=title` built `"title" <=> '[1,2]'::vector`, which the
+	* database rejects with "operator does not exist"; and a table object also
+	* carries non-column keys (`_`, methods), which passed the `if (!column)`
+	* guard and compiled to nonsense. The name is resolved against the table's
+	* actual columns and required to be a `vector` — anything else is the
+	* caller's mistake and gets a 400 that says so.
 	*/
 	static buildVectorSearchConditions(table, vectorSearch) {
-		const column = table[vectorSearch.property];
-		if (!column) throw new Error(`Vector column '${vectorSearch.property}' not found in table`);
+		const column = DrizzleConditionBuilder.resolveVectorColumn(table, vectorSearch.property);
 		if (!Array.isArray(vectorSearch.vector) || vectorSearch.vector.length === 0 || !vectorSearch.vector.every((n) => typeof n === "number" && Number.isFinite(n))) throw new Error("Vector search requires a non-empty array of finite numbers");
 		const vectorLiteral = `'[${vectorSearch.vector.join(",")}]'::vector`;
 		const distanceFn = vectorSearch.distance || "cosine";
@@ -1510,7 +1546,33 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 			distanceSelect: sql`(${column} ${sql.raw(operator)} ${sql.raw(vectorLiteral)})`
 		};
 	}
+	/**
+	* The `vector` column a request named, or a 400 explaining what it named.
+	*
+	* `getTableColumns` rather than a key lookup: it returns only the columns,
+	* so `_`, `getSQL` and every other property of a drizzle table stop looking
+	* like candidates. The type check is on the *physical* column
+	* (`vector(1536)`) rather than on the declared property, so it holds for an
+	* introspected collection too, where the property carries no Rebase type.
+	*/
+	static resolveVectorColumn(table, property) {
+		const columns = getTableColumns(table);
+		const column = columns?.[property];
+		if (!column) {
+			const known = Object.entries(columns ?? {}).filter(([, c]) => isVectorColumn(c)).map(([name]) => name);
+			throw ApiError.badRequest(`Unknown vector property "${property}". ` + (known.length > 0 ? `This collection's vector properties are: ${known.join(", ")}.` : "This collection declares no `vector` property to search."), "UNKNOWN_VECTOR_PROPERTY");
+		}
+		if (!isVectorColumn(column)) throw ApiError.badRequest(`Property "${property}" is not a vector column (it is \`${columnSqlType(column) || "unknown"}\`), so it has no distance operator. Name the property declared as \`{ type: "vector" }\`.`, "UNKNOWN_VECTOR_PROPERTY");
+		return column;
+	}
 };
+/** The column's SQL type, for a value that may not be a drizzle column at all. */
+var columnSqlType = (column) => {
+	const getSQLType = column?.getSQLType;
+	return typeof getSQLType === "function" ? getSQLType.call(column).toLowerCase() : "";
+};
+/** True for `vector(1536)` and its pgvector siblings, whatever the width. */
+var isVectorColumn = (column) => /^(vector|halfvec|sparsevec)\b/.test(columnSqlType(column));
 /**
 * Alias for DrizzleConditionBuilder for consistent naming with other database implementations.
 * This allows code to use PostgresConditionBuilder alongside future MongoConditionBuilder, etc.
@@ -1559,10 +1621,11 @@ function serializeDataToServer(row, properties, collection, registry) {
 	const joinPathRelationUpdates = [];
 	const foreignKeys = /* @__PURE__ */ new Set();
 	Object.values(resolvedRelations).forEach((relation) => {
-		if (relation.kind === "belongsTo") foreignKeys.add(relation.localKey);
+		if (relation.kind === "belongsTo") foreignKeys.add(fieldKeyForColumn(collection, relation.localKey));
 	});
 	for (const [key, value] of Object.entries(row)) {
 		if (isPrototypePollutingKey(key)) continue;
+		if (value === void 0) continue;
 		const property = properties[key];
 		const effectiveValue = foreignKeys.has(key) && value === "" ? null : value;
 		if (!property) {
@@ -1573,11 +1636,11 @@ function serializeDataToServer(row, properties, collection, registry) {
 			const relation = findRelation(resolvedRelations, key);
 			if (relation) {
 				if (relation.kind === "belongsTo") {
-					const serializedValue = serializePropertyToServer(effectiveValue, property);
-					if (serializedValue !== void 0) result[relation.localKey] = serializedValue;
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
+					if (serializedValue !== void 0) result[fieldKeyForColumn(collection, relation.localKey)] = serializedValue;
 					continue;
 				} else if (hasForeignKeyOnTarget(relation)) {
-					const serializedValue = serializePropertyToServer(effectiveValue, property);
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
 					inverseRelationUpdates.push({
 						relationKey: key,
 						relation,
@@ -1585,7 +1648,7 @@ function serializeDataToServer(row, properties, collection, registry) {
 					});
 					continue;
 				} else if (relation.kind === "via") {
-					const serializedValue = serializePropertyToServer(effectiveValue, property);
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
 					if (relation.cardinality === "one") joinPathRelationUpdates.push({
 						relationKey: key,
 						relation,
@@ -1600,7 +1663,7 @@ function serializeDataToServer(row, properties, collection, registry) {
 				}
 			}
 		}
-		result[key] = serializePropertyToServer(effectiveValue, property);
+		result[key] = serializePropertyToServer(effectiveValue, property, key);
 	}
 	return {
 		scalarData: result,
@@ -1609,19 +1672,39 @@ function serializeDataToServer(row, properties, collection, registry) {
 	};
 }
 /**
-* Serialize a single property value for database storage
+* How to name a rejected value in an error, without quoting it back.
+*
+* The value may be anything the caller sent, including a secret in the wrong
+* field, so the message describes its shape rather than echoing it — an echoed
+* value ends up in logs and in error-reporting services.
+*/
+function describeValue(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return "an array";
+	if (value instanceof Date) return "a date";
+	const type = typeof value;
+	return type === "object" ? "an object" : `a ${type}`;
+}
+/**
+* Serialize a single property value for database storage.
+*
+* `propertyKey` is only ever used to phrase errors and warnings. Without it the
+* one trace a bad value left was `Expected array value for array property, got
+* string` — no collection, no property, no value, which in the log of a
+* thousand-row import names nothing at all.
 */
-function serializePropertyToServer(value, property) {
+function serializePropertyToServer(value, property, propertyKey) {
 	if (value === null || value === void 0) return value;
+	const fieldLabel = propertyKey ? `'${propertyKey}'` : `a '${property.type}' field`;
 	switch (property.type) {
 		case "relation":
-			if (Array.isArray(value)) return value.map((v) => serializePropertyToServer(v, property));
+			if (Array.isArray(value)) return value.map((v) => serializePropertyToServer(v, property, propertyKey));
 			else if (typeof value === "object" && value !== null && "id" in value) return value.id;
 			if (value === "") return null;
 			return value;
 		case "array":
 			if (Array.isArray(value)) {
-				if (property.of) return value.map((item) => serializePropertyToServer(item, property.of));
+				if (property.of) return value.map((item) => serializePropertyToServer(item, property.of, propertyKey));
 				else if (property.oneOf) {
 					const typeField = property.oneOf.typeField ?? "type";
 					const valueField = property.oneOf.valueField ?? "value";
@@ -1634,20 +1717,28 @@ function serializePropertyToServer(value, property) {
 						if (!type || !childProperty) return e;
 						return {
 							[typeField]: type,
-							[valueField]: serializePropertyToServer(rec[valueField], childProperty)
+							[valueField]: serializePropertyToServer(rec[valueField], childProperty, propertyKey)
 						};
 					});
 				}
 				return value;
 			}
-			logger.warn(`Expected array value for array property, got ${typeof value}. Coercing to empty array.`);
-			return [];
+			throw ApiError.badRequest(`${fieldLabel} expects an array, but received ${describeValue(value)}.`, "VALIDATION_INVALID_VALUE");
+		case "geopoint": {
+			if (typeof value !== "object" || Array.isArray(value)) throw ApiError.badRequest(`${fieldLabel} expects a geopoint object with \`latitude\` and \`longitude\`, but received ${describeValue(value)}.`, "VALIDATION_INVALID_VALUE");
+			const point = value;
+			if (typeof point.latitude !== "number" || typeof point.longitude !== "number") throw ApiError.badRequest(`${fieldLabel} expects a geopoint object with numeric \`latitude\` and \`longitude\`.`, "VALIDATION_INVALID_VALUE");
+			return {
+				latitude: point.latitude,
+				longitude: point.longitude
+			};
+		}
 		case "map":
 			if (typeof value === "object" && property.properties) {
 				const result = {};
 				for (const [subKey, subValue] of Object.entries(value)) {
 					const subProperty = property.properties[subKey];
-					if (subProperty) result[subKey] = serializePropertyToServer(subValue, subProperty);
+					if (subProperty) result[subKey] = serializePropertyToServer(subValue, subProperty, propertyKey ? `${propertyKey}.${subKey}` : subKey);
 					else result[subKey] = subValue;
 				}
 				return result;
@@ -1682,8 +1773,9 @@ async function parseDataFromServer(data, collection, db, registry) {
 	for (const [propKey, property] of Object.entries(properties)) if (property.type === "relation" && !(propKey in result)) {
 		const relation = findRelation(resolvedRelations, propKey);
 		if (relation) {
-			if (relation.kind === "belongsTo" && relation.localKey in data) {
-				const fkValue = data[relation.localKey];
+			const localField = relation.kind === "belongsTo" ? fieldKeyForColumn(collection, relation.localKey) : "";
+			if (relation.kind === "belongsTo" && localField in data) {
+				const fkValue = data[localField];
 				if (fkValue !== null && fkValue !== void 0) try {
 					const targetCollection = relation.target();
 					result[propKey] = createRelationRef(fkValue.toString(), targetCollection.slug);
@@ -1696,7 +1788,7 @@ async function parseDataFromServer(data, collection, db, registry) {
 				const pks = getPrimaryKeys(collection, registry);
 				const currentId = relation.sourceKey ? data[relation.sourceKey] : buildCompositeId(data, pks);
 				if (targetTable && currentId !== void 0 && currentId !== null && currentId !== "") {
-					const foreignKeyColumn = targetTable[relation.foreignKeyOnTarget];
+					const foreignKeyColumn = targetTable[fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget)];
 					if (foreignKeyColumn) {
 						const relatedRows = await db.select().from(targetTable).where(eq(foreignKeyColumn, currentId)).limit(relation.cardinality === "one" ? 1 : 100);
 						if (relatedRows.length > 0) if (relation.cardinality === "one") {
@@ -1885,6 +1977,7 @@ function parsePropertyFromServer(value, property, collection, propertyKey) {
 				return isNaN(parsed) ? null : parsed;
 			}
 			return value;
+		case "geopoint": return value;
 		case "vector": {
 			let nums = [];
 			if (typeof value === "string") nums = value.slice(1, -1).split(",").map(Number);
@@ -1944,7 +2037,9 @@ function normalizeScalarValues(data, properties, collection, resolvedRelations,
 	const result = {};
 	const internalFKColumns = /* @__PURE__ */ new Set();
 	Object.values(resolvedRelations).forEach((relation) => {
-		if (relation.kind === "belongsTo" && !properties[relation.localKey]) internalFKColumns.add(relation.localKey);
+		if (relation.kind !== "belongsTo") return;
+		const localField = fieldKeyForColumn(collection, relation.localKey);
+		if (!properties[localField]) internalFKColumns.add(localField);
 	});
 	for (const [key, value] of Object.entries(data)) {
 		if (internalFKColumns.has(key)) {
@@ -1977,34 +2072,179 @@ function normalizeDbValues(data, collection) {
 	return normalizeScalarValues(data, properties, collection, resolveCollectionRelations(collection), { skipRelations: true });
 }
 //#endregion
-//#region src/services/RelationService.ts
+//#region src/services/write-denial.ts
+/**
+* Explain a write that matched no rows.
+*
+* Row-level security filters UPDATE and DELETE through the policy's USING
+* clause instead of raising: a denied write is reported by Postgres exactly
+* like a successful one that happened to match nothing. Left unchecked, a
+* caller cannot tell "denied" from "done" — the write returns 200/204 and the
+* row is untouched. An agent handed a key with `orders:delete` and no delete
+* policy is the case that makes it concrete: it deletes nothing, forever, and
+* is told it worked every time.
+*
+* Re-reading the target over the *same* RLS-scoped handle separates the two
+* cases. A visible row means the policy rejected the write (403); an invisible
+* one means there is nothing there to write for this caller (404, matching what
+* a GET would say). The re-read is bound by the caller's own policies, so it
+* discloses nothing a plain read wouldn't.
+*
+* Only reached when zero rows matched, so the happy path pays nothing.
+*
+* It lives here, rather than beside its first caller, because every zero-row
+* write has to answer the same question and answer it identically: the rule
+* that a readable-but-unwritable target is a 403 is the contract, and a second
+* copy of it is a second chance to get it wrong.
+*
+* @param handle     The RLS-scoped connection the write ran on — not a fresh
+*                   one, or the re-read would answer for a different caller.
+* @param table      The table the write targeted (the junction, for a link).
+* @param conditions The write's own WHERE terms, reused verbatim.
+* @param denied     Message for the 403: the target is there and was refused.
+* @param missing    Message for the 404: there is nothing there for this caller.
+*/
+async function explainZeroRowWrite(handle, table, conditions, denied, missing) {
+	if ((await handle.select({ present: sql`1` }).from(table).where(and(...conditions)).limit(1)).length > 0) return ApiError.forbidden(denied, "WRITE_DENIED");
+	return ApiError.notFound(missing);
+}
+//#endregion
+//#region src/services/junction-writes.ts
+/** A junction that cannot be resolved is a broken relation, not a no-op. */
+var misconfigured = (label, detail) => relationMisconfigured(label, detail);
+function column(table, name, label, role) {
+	const col = name ? table[name] : void 0;
+	if (!col) throw misconfigured(label, `no ${role} column '${name ?? "?"}' on the junction table`);
+	return col;
+}
+/** The junction a `manyToMany` names outright. */
+function bindThroughJunction(registry, through, label) {
+	const table = registry.getTable(through.table);
+	if (!table) throw misconfigured(label, `no table '${through.table}' in the registry`);
+	return {
+		table,
+		parentColumn: column(table, through.sourceColumn, label, "source"),
+		targetColumn: column(table, through.targetColumn, label, "target"),
+		label
+	};
+}
+/** The bare column name, whether written as `col` or `table.col`. */
+var columnPart = (spec) => {
+	const one = Array.isArray(spec) ? spec[0] : spec;
+	return one.includes(".") ? one.split(".")[1] : one;
+};
+/** The table a column spec names, or undefined when it is unqualified. */
+var tablePart = (spec) => {
+	const one = Array.isArray(spec) ? spec[0] : spec;
+	return one.includes(".") ? one.split(".")[0] : void 0;
+};
 /**
-* The ids in a to-many relation write, whatever shape the caller sent.
-*
-* A membership list is written as either the related rows (`[{ id: 1 }]`, what
-* the admin UI sends back after reading them) or as bare keys (`[1]`, `["t-1"]`,
-* what anyone writing the API by hand sends). Only the first was read, via a
-* blind `.map(rel => rel.id)`, and a bare key therefore became `undefined`:
-* on a numeric-keyed target that surfaced as `Invalid numeric ID: undefined`,
-* and on a string-keyed one it did not surface at all — `String(undefined)`
-* wrote a junction row pointing at the literal `"undefined"`, which no read
-* would ever match. Both shapes are accepted here, in one place, because both
-* call sites had the same assumption.
-*
-* An element that carries no key is refused rather than skipped: dropping it
-* would silently write a shorter membership list than the caller asked for.
-*/
-function relationTargetIds(value, relationName, collectionSlug) {
-	if (!Array.isArray(value)) return [];
-	return value.map((element, index) => {
-		if (typeof element === "string" || typeof element === "number") return element;
-		if (element && typeof element === "object") {
-			const id = element.id;
-			if (typeof id === "string" || typeof id === "number") return id;
-		}
-		throw new Error(`Cannot write relation "${relationName}" on "${collectionSlug}": element ${index} carries no id. Pass either the related rows (\`[{ id: … }]\`) or their keys (\`[1, 2]\`), not ${element === null ? "null" : typeof element}.`);
-	});
+* The junction a `via` relation reaches through, from either end.
+*
+* A step is `{ table: T, on: { from, to } }` where `from` names a column on
+* whatever the walk was standing on and `to` names one on `T`. That positional
+* meaning is what makes the unqualified form work at all, so the walk carries
+* the previous table rather than asking the column names where they live.
+*/
+function bindJoinPathJunction(registry, joinPath, parentTableName, targetTableName, label) {
+	const junctionName = joinPath.map((step) => step.table).find((table) => table !== parentTableName && table !== targetTableName);
+	if (!junctionName) throw misconfigured(label, "its joinPath has no table between the two ends to hold the links");
+	const table = registry.getTable(junctionName);
+	if (!table) throw misconfigured(label, `no table '${junctionName}' in the registry`);
+	let parentColumnName;
+	let targetColumnName;
+	let previousTable = parentTableName;
+	for (const step of joinPath) {
+		const fromTable = tablePart(step.on.from) ?? previousTable;
+		const toTable = tablePart(step.on.to) ?? step.table;
+		if (toTable === junctionName && fromTable === parentTableName) parentColumnName = columnPart(step.on.to);
+		else if (fromTable === junctionName && toTable === parentTableName) parentColumnName = columnPart(step.on.from);
+		else if (toTable === junctionName && fromTable === targetTableName) targetColumnName = columnPart(step.on.to);
+		else if (fromTable === junctionName && toTable === targetTableName) targetColumnName = columnPart(step.on.from);
+		previousTable = step.table;
+	}
+	if (!parentColumnName || !targetColumnName) throw misconfigured(label, `its joinPath does not connect '${parentTableName}' and '${targetTableName}' through '${junctionName}'`);
+	return {
+		table,
+		parentColumn: column(table, parentColumnName, label, "source"),
+		targetColumn: column(table, targetColumnName, label, "target"),
+		label
+	};
+}
+/**
+* Remove one link, leaving the row on the far side alone.
+*
+* This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
+* target is shared, so deleting the row would remove the tag from every other
+* post that uses it.
+*/
+async function removeJunctionLink(tx, binding, parentId, targetId, subject) {
+	const conditions = [eq(binding.parentColumn, parentId), eq(binding.targetColumn, targetId)];
+	if (((await tx.delete(binding.table).where(and(...conditions))).rowCount ?? 0) === 0) throw await explainZeroRowWrite(tx, binding.table, conditions, `Not allowed to unlink "${targetId}" from "${subject.parent}" "${parentId}": a row-level security policy rejected the write.`, `No "${subject.relation}" link between "${subject.parent}" "${parentId}" and "${targetId}" to remove.`);
+	logger.info(`Unlinked '${subject.relation}' ${targetId} from ${subject.parent} ${parentId}`);
+}
+/**
+* Make the junction say that `parentId` is linked to exactly `targetIds`, by
+* diffing against what is linked now rather than replacing the set.
+*
+* A save of the parent used to delete every junction row for it and re-insert
+* the ids the browser sent — a list the browser assembled from a read it did
+* earlier. Three things followed, all data loss rather than display:
+*
+*  - **Lost update.** Two editors with post 7 open: A adds tag X and saves, B
+*    saves any field from a form that predates it, and X is gone with nothing
+*    reported to either of them.
+*  - **A partially-read set is a partially-deleted set.** The read that fills
+*    the form runs under RLS, so a user who may edit the parent but cannot see
+*    some of the linked rows gets a shorter list — and writing it back deleted
+*    the links they were never shown. The select that drives the diff runs in
+*    this same transaction under the same policies, so a link the caller cannot
+*    read is in neither list and survives the save.
+*  - **Junction payload columns.** A junction carrying its own columns
+*    (`position`, `role`, `created_at`) lost them on every save, because every
+*    row was re-inserted with only the two keys. Untouched links are left alone.
+*
+* The insert is `ON CONFLICT DO NOTHING`, so two sessions adding the same link
+* concurrently is a no-op rather than a unique violation.
+*/
+async function applyJunctionMembership(tx, binding, parentId, targetIds) {
+	const existingRows = await tx.select({ targetId: binding.targetColumn }).from(binding.table).where(eq(binding.parentColumn, parentId));
+	const existingById = /* @__PURE__ */ new Map();
+	for (const row of existingRows) {
+		if (row.targetId === null || row.targetId === void 0) continue;
+		existingById.set(String(row.targetId), row.targetId);
+	}
+	const wantedById = /* @__PURE__ */ new Map();
+	for (const targetId of targetIds) {
+		if (targetId === null || targetId === void 0) continue;
+		wantedById.set(String(targetId), targetId);
+	}
+	const removed = [...existingById.entries()].filter(([key]) => !wantedById.has(key)).map(([, value]) => value);
+	const added = [...wantedById.entries()].filter(([key]) => !existingById.has(key)).map(([, value]) => value);
+	if (removed.length > 0) await removeLinks(tx, binding, parentId, removed);
+	if (added.length > 0) await tx.insert(binding.table).values(added.map((targetId) => ({
+		[binding.parentColumn.name]: parentId,
+		[binding.targetColumn.name]: targetId
+	}))).onConflictDoNothing();
+}
+/**
+* Drop the named links, and refuse to call it done if the database kept any.
+*
+* Every id here came out of the select in {@link applyJunctionMembership}, on
+* this same handle, so all of them were visible. Fewer deletions than that means
+* something refused them — and a save that reports success while the membership
+* it stored is not the membership it was given has told the caller something
+* untrue about the database.
+*/
+async function removeLinks(tx, binding, parentId, removed) {
+	const conditions = [eq(binding.parentColumn, parentId), inArray(binding.targetColumn, removed)];
+	const deleted = (await tx.delete(binding.table).where(and(...conditions))).rowCount ?? 0;
+	if (deleted >= removed.length) return;
+	if ((await tx.select({ present: sql`1` }).from(binding.table).where(and(...conditions)).limit(1)).length === 0) return;
+	throw ApiError.forbidden(`Not allowed to remove ${removed.length - deleted} of ${removed.length} link(s) for relation '${binding.label}': a row-level security policy rejected the write.`, "WRITE_DENIED");
 }
+//#endregion
+//#region src/services/RelationService.ts
 /**
 * Typed wrapper for Drizzle dynamic query innerJoin.
 * Drizzle's `$dynamic()` queries lose the `innerJoin` method from
@@ -2112,6 +2352,10 @@ var RelationService = class {
 		const { keyByParentId } = await this.resolveSourceKeys(parentCollection, relation, [parentId], db);
 		return keyByParentId.get(String(parentId));
 	}
+	/**
+	* Shared with {@link RelationWriteService}: a write needs the same source
+	* key a read does, and resolving it twice is how the two would disagree.
+	*/
 	async resolveSourceKeys(parentCollection, relation, parentIds, db = this.db) {
 		const keyByParentId = /* @__PURE__ */ new Map();
 		const parentIdByKey = /* @__PURE__ */ new Map();
@@ -2282,30 +2526,6 @@ var RelationService = class {
 		return await this.countRelatedRows(hop.parentCollection, hop.parentId, hop.relation, identity) > 0;
 	}
 	/**
-	* Remove the junction row linking a parent to `targetId`, leaving the target
-	* row itself alone.
-	*
-	* This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
-	* target is shared, so deleting the row would remove the tag from every other
-	* post that uses it. It used to do exactly that — resolve the path to the
-	* `tags` table and delete by primary key.
-	*/
-	async unlinkRelatedEntity(tx, hop, targetId) {
-		if (!isManyToMany(hop.relation)) throw new Error(`Relation '${hop.relationKey}' has no junction table to unlink through`);
-		const through = hop.relation.through;
-		const junctionTable = this.registry.getTable(through.table);
-		if (!junctionTable) throw new Error(`Junction table not found: ${through.table}`);
-		const sourceJunctionColumn = junctionTable[through.sourceColumn];
-		const targetJunctionColumn = junctionTable[through.targetColumn];
-		if (!sourceJunctionColumn || !targetJunctionColumn) throw new Error(`Junction columns not found for relation '${hop.relationKey}' on table '${through.table}'`);
-		const parentPks = requirePrimaryKeys(hop.parentCollection, this.registry);
-		const parsedParentId = parseIdValues(hop.parentId, parentPks)[parentPks[0].fieldName];
-		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
-		const parsedTargetId = parseIdValues(targetId, targetPks)[targetPks[0].fieldName];
-		await tx.delete(junctionTable).where(and(eq(sourceJunctionColumn, parsedParentId), eq(targetJunctionColumn, parsedTargetId)));
-		logger.info(`Unlinked '${hop.relationKey}' ${parsedTargetId} from ${hop.parentCollection.slug} ${parsedParentId}`);
-	}
-	/**
 	* Batch fetch related rows for multiple parent rows to avoid N+1 queries
 	*/
 	async batchFetchRelatedEntities(parentCollectionPath, parentIds, _relationKey, relation) {
@@ -2353,7 +2573,7 @@ var RelationService = class {
 		}
 		if (relation.kind === "belongsTo") {
 			this.assertSingleKeyAddressable(parentCollection, parentPks, relation.localKey);
-			const localKeyCol = parentTable[relation.localKey];
+			const localKeyCol = parentTable[fieldKeyForColumn(parentCollection, relation.localKey)];
 			if (!localKeyCol) throw new Error(`Local key column '${relation.localKey}' not found in parent table`);
 			const fkRows = await this.db.select({
 				parentId: parentIdCol,
@@ -2399,7 +2619,7 @@ var RelationService = class {
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
 			if (!hasForeignKeyOnTarget(relation)) continue;
-			const foreignKeyValue = targetRow[relation.foreignKeyOnTarget];
+			const foreignKeyValue = targetRow[fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget)];
 			if (foreignKeyValue === void 0 || foreignKeyValue === null) continue;
 			const parentId = parentIdByKey.get(String(foreignKeyValue));
 			if (parentId !== void 0) resultMap.set(String(parentId), await this.toRelatedRow(targetRow, targetCollection, targetPks));
@@ -2456,17 +2676,7 @@ var RelationService = class {
 		}
 		if (relation.kind === "manyToMany") {
 			this.assertSingleKeyAddressable(parentCollection, parentPks, `${relation.through.table}.${relation.through.sourceColumn}`);
-			const junctionTable = this.registry.getTable(relation.through.table);
-			if (!junctionTable) {
-				logger.warn(`[batchFetchRelatedEntitiesMany] Junction table '${relation.through.table}' not found`);
-				return /* @__PURE__ */ new Map();
-			}
-			const sourceJunctionCol = junctionTable[relation.through.sourceColumn];
-			const targetJunctionCol = junctionTable[relation.through.targetColumn];
-			if (!sourceJunctionCol || !targetJunctionCol) {
-				logger.warn(`[batchFetchRelatedEntitiesMany] Junction columns not found in '${relation.through.table}'`);
-				return /* @__PURE__ */ new Map();
-			}
+			const { table: junctionTable, parentColumn: sourceJunctionCol, targetColumn: targetJunctionCol } = bindThroughJunction(this.registry, relation.through, `${parentCollection.slug}.${relation.relationName}`);
 			const results = await this.db.select().from(junctionTable).innerJoin(targetTable, eq(targetJunctionCol, targetIdField)).where(inArray(sourceJunctionCol, parsedParentIds));
 			const resultMap = /* @__PURE__ */ new Map();
 			const targetTableName = getTableName$1(targetCollection);
@@ -2494,7 +2704,7 @@ var RelationService = class {
 		for (const row of results) {
 			const targetRow = row[getTableName$1(targetCollection)] || row;
 			if (!hasForeignKeyOnTarget(relation)) continue;
-			const foreignKeyValue = targetRow[relation.foreignKeyOnTarget];
+			const foreignKeyValue = targetRow[fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget)];
 			if (foreignKeyValue === void 0 || foreignKeyValue === null) continue;
 			const parentId = parentIdByKey.get(String(foreignKeyValue));
 			if (parentId !== void 0) {
@@ -2506,346 +2716,6 @@ var RelationService = class {
 		}
 		return resultMap;
 	}
-	/**
-	* Update many-to-many and junction relations
-	*/
-	async updateRelationsUsingJoins(tx, collection, id, relationValues) {
-		const resolvedRelations = resolveCollectionRelations(collection);
-		for (const [key, value] of Object.entries(relationValues)) {
-			const relation = findRelation(resolvedRelations, key);
-			if (!relation || relation.cardinality !== "many") continue;
-			const targetEntityIds = relationTargetIds(value, key, collection.slug);
-			const targetCollection = relation.target();
-			if (relation.kind === "via") {
-				const parentTableName = getTableName$1(collection);
-				const targetTableName = getTableName$1(targetCollection);
-				let junctionTable = void 0;
-				let sourceJunctionColumn = null;
-				let targetJunctionColumn = null;
-				const junctionTableName = relation.joinPath.find((step) => step.table !== parentTableName && step.table !== targetTableName)?.table;
-				if (junctionTableName) {
-					junctionTable = this.registry.getTable(junctionTableName);
-					if (junctionTable) for (const joinStep of relation.joinPath) {
-						const fromTable = DrizzleConditionBuilder.getTableNamesFromColumns(joinStep.on.from)[0];
-						const toTable = DrizzleConditionBuilder.getTableNamesFromColumns(joinStep.on.to)[0];
-						if (fromTable === parentTableName && toTable === junctionTableName) {
-							const columnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(joinStep.on.to);
-							sourceJunctionColumn = junctionTable[columnNames[0]];
-						} else if (fromTable === junctionTableName && toTable === parentTableName) {
-							const columnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(joinStep.on.from);
-							sourceJunctionColumn = junctionTable[columnNames[0]];
-						}
-						if (fromTable === junctionTableName && toTable === targetTableName) {
-							const columnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(joinStep.on.from);
-							targetJunctionColumn = junctionTable[columnNames[0]];
-						} else if (fromTable === targetTableName && toTable === junctionTableName) {
-							const columnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(joinStep.on.to);
-							targetJunctionColumn = junctionTable[columnNames[0]];
-						}
-					}
-				}
-				if (!junctionTable || !sourceJunctionColumn || !targetJunctionColumn) {
-					logger.warn(`Could not determine junction table for relation '${key}' in collection '${collection.slug}'`);
-					continue;
-				}
-				const parentPks = requirePrimaryKeys(collection, this.registry);
-				const parentIdInfo = parentPks[0];
-				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
-				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
-				if (targetEntityIds.length > 0) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-					const targetIdInfo = targetPks[0];
-					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-						[sourceJunctionColumn.name]: parsedParentId,
-						[targetJunctionColumn.name]: targetId
-					}));
-					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
-				}
-			} else if (relation.kind === "manyToMany") {
-				const junctionTable = this.registry.getTable(relation.through.table);
-				if (!junctionTable) {
-					logger.warn(`Junction table '${relation.through.table}' not found for relation '${key}' in collection '${collection.slug}'`);
-					continue;
-				}
-				const sourceJunctionColumn = junctionTable[relation.through.sourceColumn];
-				const targetJunctionColumn = junctionTable[relation.through.targetColumn];
-				if (!sourceJunctionColumn || !targetJunctionColumn) {
-					logger.warn(`Junction columns not found for relation '${key}'`);
-					continue;
-				}
-				const parentPks = requirePrimaryKeys(collection, this.registry);
-				const parentIdInfo = parentPks[0];
-				const parsedParentId = parseIdValues(id, parentPks)[parentIdInfo.fieldName];
-				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
-				if (targetEntityIds.length > 0) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-					const targetIdInfo = targetPks[0];
-					const newLinks = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-						[sourceJunctionColumn.name]: parsedParentId,
-						[targetJunctionColumn.name]: targetId
-					}));
-					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
-				}
-			} else if (relation.cardinality === "many" && hasForeignKeyOnTarget(relation)) {
-				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-				const targetIdInfo = targetPks[0];
-				const targetIdCol = targetTable[targetIdInfo.fieldName];
-				const fkCol = targetTable[relation.foreignKeyOnTarget];
-				if (!fkCol || !targetIdCol) {
-					logger.warn(`Invalid inverse-many config for relation '${key}' in collection '${collection.slug}'`);
-					continue;
-				}
-				const parentKeyValue = (await this.resolveSourceKeys(collection, relation, [id], tx)).keyByParentId.get(String(id));
-				if (parentKeyValue === void 0) throw new Error(`Cannot write relation '${key}' on '${collection.slug}': row '${id}' has no value in \`sourceKey: "${sourceKeyField(relation, collection, this.registry)}"\`, so there is nothing for the related rows to point at.`);
-				if (targetEntityIds.length > 0) {
-					const parsedTargetIds = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(and(eq(fkCol, parentKeyValue), sql`${targetIdCol} NOT IN (${sql.join(parsedTargetIds)})`));
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: parentKeyValue }).where(inArray(targetIdCol, parsedTargetIds));
-				} else await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(fkCol, parentKeyValue));
-			} else logger.warn(`Many relation '${key}' in collection '${collection.slug}' lacks write configuration and will be skipped during save.`);
-		}
-	}
-	/**
-	* Update inverse relations (where FK is on the target table)
-	*/
-	async updateInverseRelations(tx, sourceCollection, sourceEntityId, inverseRelationUpdates) {
-		for (const update of inverseRelationUpdates) {
-			const { relation, newValue } = update;
-			try {
-				const targetCollection = relation.target();
-				const targetTable = getTableForCollection(targetCollection, this.registry);
-				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-				const targetIdInfo = targetPks[0];
-				requirePrimaryKeys(sourceCollection, this.registry)[0];
-				if (relation.kind === "via") {
-					await this.updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue);
-					continue;
-				}
-				if (isManyToMany(relation)) {
-					await this.updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, {
-						table: relation.through.table,
-						sourceColumn: relation.through.sourceColumn,
-						targetColumn: relation.through.targetColumn
-					});
-					continue;
-				}
-				if (!hasForeignKeyOnTarget(relation)) {
-					logger.warn(`Relation '${relation.relationName}' has no column on the target to write. Skipping.`);
-					continue;
-				}
-				const foreignKeyColumn = targetTable[relation.foreignKeyOnTarget];
-				if (!foreignKeyColumn) {
-					logger.warn(`Foreign key column '${relation.foreignKeyOnTarget}' not found in target table for relation '${relation.relationName}'`);
-					continue;
-				}
-				const sourceKeyValue = (await this.resolveSourceKeys(sourceCollection, relation, [sourceEntityId], tx)).keyByParentId.get(String(sourceEntityId));
-				if (sourceKeyValue === void 0) throw new Error(`Cannot write relation '${relation.relationName}' on '${sourceCollection.slug}': row '${sourceEntityId}' has no value in \`sourceKey: "${sourceKeyField(relation, sourceCollection, this.registry)}"\`, so there is nothing for the related row to point at.`);
-				if (newValue === null || newValue === void 0) await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
-				else {
-					const parsedNewTargetId = parseIdValues(newValue, targetPks)[targetIdInfo.fieldName];
-					const targetIdField = targetTable[targetIdInfo.fieldName];
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
-					await tx.update(targetTable).set({ [relation.foreignKeyOnTarget]: sourceKeyValue }).where(eq(targetIdField, parsedNewTargetId));
-				}
-			} catch (e) {
-				logger.warn(`Failed to update inverse relation '${relation.relationName}'`, { error: e });
-			}
-		}
-	}
-	/**
-	* Handle inverse relations with joinPath
-	*/
-	async updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue) {
-		try {
-			const sourceTableName = getTableName$1(sourceCollection);
-			const targetTableName = getTableName$1(targetCollection);
-			const intermediateTables = relation.joinPath.map((step) => step.table).filter((table) => table !== sourceTableName && table !== targetTableName);
-			if (intermediateTables.length === 1 && relation.cardinality === "many") {
-				const junctionTableName = intermediateTables[0];
-				const junctionTable = this.registry.getTable(junctionTableName);
-				if (!junctionTable) {
-					logger.warn(`Junction table '${junctionTableName}' not found for inverse joinPath relation '${relation.relationName}'`);
-					return;
-				}
-				let sourceJunctionColumn = null;
-				let targetJunctionColumn = null;
-				for (const step of relation.joinPath) if (step.table === junctionTableName) {
-					const fromTable = DrizzleConditionBuilder.getTableNamesFromColumns(step.on.from)[0];
-					const toColumnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(step.on.to);
-					const fromColumnNames = DrizzleConditionBuilder.getColumnNamesFromColumns(step.on.from);
-					if (fromTable === sourceTableName) sourceJunctionColumn = junctionTable[toColumnNames[0]];
-					else if (fromTable === targetTableName) targetJunctionColumn = junctionTable[toColumnNames[0]];
-					else {
-						const toTable = DrizzleConditionBuilder.getTableNamesFromColumns(step.on.to)[0];
-						if (toTable === sourceTableName) sourceJunctionColumn = junctionTable[fromColumnNames[0]];
-						else if (toTable === targetTableName) targetJunctionColumn = junctionTable[fromColumnNames[0]];
-					}
-				}
-				if (!sourceJunctionColumn || !targetJunctionColumn) {
-					logger.warn(`Could not determine junction columns for inverse joinPath relation '${relation.relationName}'`);
-					return;
-				}
-				const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
-				const sourceIdInfo = sourcePks[0];
-				const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
-				await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
-				if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-					const targetIdInfo = targetPks[0];
-					const newLinks = relationTargetIds(newValue, relation.relationName, sourceCollection.slug).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-						[sourceJunctionColumn.name]: parsedSourceId,
-						[targetJunctionColumn.name]: targetId
-					}));
-					if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
-				} else if (newValue && !Array.isArray(newValue)) {
-					const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-					const targetIdInfo = targetPks[0];
-					const parsedTargetId = parseIdValues(typeof newValue === "object" && newValue !== null ? newValue.id : newValue, targetPks)[targetIdInfo.fieldName];
-					const newLink = {
-						[sourceJunctionColumn.name]: parsedSourceId,
-						[targetJunctionColumn.name]: parsedTargetId
-					};
-					await tx.insert(junctionTable).values(newLink);
-				}
-			}
-		} catch (error) {
-			logger.error(`Failed to update inverse joinPath relation '${relation.relationName}'`, { error });
-			throw error;
-		}
-	}
-	/**
-	* Handle many-to-many inverse relation updates using junction tables
-	*/
-	async updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, junctionInfo) {
-		try {
-			const junctionTable = this.registry.getTable(junctionInfo.table);
-			if (!junctionTable) {
-				logger.warn(`Junction table '${junctionInfo.table}' not found for many-to-many inverse relation '${relation.relationName}'`);
-				return;
-			}
-			const sourceJunctionColumn = junctionTable[junctionInfo.sourceColumn];
-			const targetJunctionColumn = junctionTable[junctionInfo.targetColumn];
-			if (!sourceJunctionColumn || !targetJunctionColumn) {
-				logger.warn(`Junction columns not found for relation '${relation.relationName}'`);
-				return;
-			}
-			const sourcePks = requirePrimaryKeys(sourceCollection, this.registry);
-			const sourceIdInfo = sourcePks[0];
-			const parsedSourceId = parseIdValues(sourceEntityId, sourcePks)[sourceIdInfo.fieldName];
-			await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
-			if (newValue && Array.isArray(newValue) && newValue.length > 0) {
-				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-				const targetIdInfo = targetPks[0];
-				const newLinks = relationTargetIds(newValue, relation.relationName, sourceCollection.slug).map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]).map((targetId) => ({
-					[sourceJunctionColumn.name]: parsedSourceId,
-					[targetJunctionColumn.name]: targetId
-				}));
-				if (newLinks.length > 0) await tx.insert(junctionTable).values(newLinks);
-			}
-		} catch (error) {
-			logger.error(`Failed to update many-to-many inverse relation '${relation.relationName}'`, { error });
-			throw error;
-		}
-	}
-	/**
-	* Update one-to-one relations that use joinPath
-	*/
-	async updateJoinPathOneToOneRelations(tx, parentCollection, parentId, updates) {
-		for (const upd of updates) {
-			const { relation, newTargetId } = upd;
-			const targetCollection = relation.target();
-			const targetTable = getTableForCollection(targetCollection, this.registry);
-			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-			const targetIdInfo = targetPks[0];
-			const targetIdCol = targetTable[targetIdInfo.fieldName];
-			const { targetFKColName, parentSourceColName } = this.resolveJoinPathWriteMapping(parentCollection, relation);
-			const parentTable = getTableForCollection(parentCollection, this.registry);
-			const parentPks = requirePrimaryKeys(parentCollection, this.registry);
-			const parentIdInfo = parentPks[0];
-			const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
-			const parentIdCol = parentTable[parentIdInfo.fieldName];
-			const parentSourceCol = parentTable[parentSourceColName];
-			const targetFKCol = targetTable[targetFKColName];
-			if (!parentSourceCol) {
-				logger.warn(`Parent source column '${parentSourceColName}' not found for joinPath relation '${relation.relationName}'`);
-				continue;
-			}
-			if (!targetFKCol) {
-				logger.warn(`Target FK column '${targetFKColName}' not found for joinPath relation '${relation.relationName}'`);
-				continue;
-			}
-			const parentRows = await tx.select({ val: parentSourceCol }).from(parentTable).where(eq(parentIdCol, parsedParentId)).limit(1);
-			if (parentRows.length === 0) continue;
-			const parentFKValue = parentRows[0].val;
-			if (newTargetId === null || newTargetId === void 0) {
-				if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
-				continue;
-			}
-			const parsedTargetId = parseIdValues(newTargetId, targetPks)[targetIdInfo.fieldName];
-			if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
-			else {
-				logger.warn(`Cannot set joinPath relation '${relation.relationName}' because parent FK value is null/undefined`);
-				continue;
-			}
-			await tx.update(targetTable).set({ [targetFKColName]: parentFKValue }).where(eq(targetIdCol, parsedTargetId));
-		}
-	}
-	/**
-	* Resolve joinPath write mapping for one-to-one relations
-	*/
-	resolveJoinPathWriteMapping(parentCollection, relation) {
-		if (!relation.joinPath || relation.joinPath.length === 0) throw new Error("resolveJoinPathWriteMapping requires a joinPath relation");
-		const parentTableName = getTableName$1(parentCollection);
-		const lastStep = relation.joinPath[relation.joinPath.length - 1];
-		const targetFKColName = DrizzleConditionBuilder.getColumnNamesFromColumns(lastStep.on.to)[0];
-		let currentFrom = lastStep.on.from;
-		let safety = 0;
-		while (safety++ < 10) {
-			if (DrizzleConditionBuilder.getTableNamesFromColumns(currentFrom)[0] === parentTableName) break;
-			const prevStep = relation.joinPath.find((s) => {
-				return (Array.isArray(s.on.to) ? s.on.to[0] : s.on.to) === currentFrom;
-			});
-			if (!prevStep) throw new Error(`Could not resolve parent source column for joinPath relation '${relation.relationName}'`);
-			currentFrom = prevStep.on.from;
-		}
-		return {
-			targetFKColName,
-			parentSourceColName: DrizzleConditionBuilder.getColumnNamesFromColumns(currentFrom)[0]
-		};
-	}
-	/**
-	* Handle junction table creation for many-to-many path-based saves
-	*/
-	async handleJunctionTableCreation(tx, newEntityId, junctionTableInfo) {
-		const { parentCollection, parentId, relation, relationKey } = junctionTableInfo;
-		const targetCollection = relation.target();
-		try {
-			const junctionTable = this.registry.getTable(relation.through.table);
-			if (!junctionTable) {
-				logger.warn(`Junction table '${relation.through.table}' not found for relation '${relationKey}'`);
-				return;
-			}
-			const sourceJunctionColumn = junctionTable[relation.through.sourceColumn];
-			const targetJunctionColumn = junctionTable[relation.through.targetColumn];
-			if (!sourceJunctionColumn || !targetJunctionColumn) {
-				logger.warn(`Junction columns not found for relation '${relationKey}'`);
-				return;
-			}
-			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
-			const targetIdInfo = targetPks[0];
-			const parsedNewEntityId = parseIdValues(newEntityId, targetPks)[targetIdInfo.fieldName];
-			const junctionData = {
-				[sourceJunctionColumn.name]: parentId,
-				[targetJunctionColumn.name]: parsedNewEntityId
-			};
-			await tx.insert(junctionTable).values(junctionData).onConflictDoNothing();
-			logger.info(`Linked '${relationKey}' ${parsedNewEntityId} to ${parentId}`);
-		} catch (error) {
-			logger.error(`Failed to create junction table entry for relation '${relationKey}'`, { error });
-			throw error;
-		}
-	}
 };
 //#endregion
 //#region src/services/row-pipeline.ts
@@ -3293,8 +3163,7 @@ function sanitizeErrorForClient(error, context) {
 			column: pgError.column,
 			table: pgError.table,
 			constraint: pgError.constraint,
-			dataType: pgError.dataType,
-			drizzleMessage: error instanceof Error ? error.message : String(error)
+			dataType: pgError.dataType
 		});
 		return pgErrorToFriendlyMessage(pgError, context);
 	}
@@ -3410,10 +3279,15 @@ var FetchService = class FetchService {
 		if (direct) return direct;
 		const declaredRelation = collection ? resolveCollectionRelations(collection)[orderBy] : void 0;
 		if (declaredRelation?.kind === "belongsTo") {
-			const foreignKey = columnAt(declaredRelation.localKey);
+			const foreignKey = columnAt(fieldKeyForColumn(collection, declaredRelation.localKey));
 			if (foreignKey) return foreignKey;
 		}
-		for (const guess of [`${orderBy}_id`, generateForeignKeyName(orderBy)]) {
+		for (const guess of [
+			`${orderBy}Id`,
+			toWireKey(generateForeignKeyName(orderBy)),
+			`${orderBy}_id`,
+			generateForeignKeyName(orderBy)
+		]) {
 			const foreignKey = columnAt(guess);
 			if (foreignKey) return foreignKey;
 		}
@@ -3487,6 +3361,7 @@ var FetchService = class FetchService {
 					row[key] = createRelationRefWithData(e.id, e.path, e);
 				} else if (relation.cardinality === "many") row[key] = relatedRows.map((e) => createRelationRefWithData(e.id, e.path, e));
 			} catch (e) {
+				if (reachedDatabase(e)) throw e;
 				logger.warn(`Could not resolve joinPath relation '${key}'`, { error: e });
 			}
 		});
@@ -3522,6 +3397,7 @@ var FetchService = class FetchService {
 				for (const row of addressable) row[key] = (resultMap.get(String(parentIdOf(row))) || []).map((e) => ({ ...e.values }));
 			}
 		} catch (e) {
+			if (reachedDatabase(e)) throw e;
 			logger.warn(`Could not batch resolve joinPath relation '${key}' for REST`, { error: e });
 		}
 	}
@@ -3686,6 +3562,7 @@ var FetchService = class FetchService {
 						values[key] = createRelationRef(e.id, e.path);
 					}
 				} catch (e) {
+					if (reachedDatabase(e)) throw e;
 					logger.warn(`Could not resolve one-to-one relation property: ${key}`, { error: e });
 				}
 			}
@@ -3823,6 +3700,7 @@ var FetchService = class FetchService {
 						if (relatedRow) item.values[key] = createRelationRefWithData(relatedRow.id, relatedRow.path, relatedRow);
 					});
 				} catch (e) {
+					if (reachedDatabase(e)) throw e;
 					logger.warn(`Could not batch load one-to-one relation property: ${key}`, { error: e });
 				}
 			}
@@ -3836,6 +3714,7 @@ var FetchService = class FetchService {
 					item.values[key] = relatedRows.map((e) => createRelationRefWithData(e.id, e.path, e));
 				});
 			} catch (e) {
+				if (reachedDatabase(e)) throw e;
 				logger.warn(`Could not batch load many relation property: ${key}`, { error: e });
 			}
 		}
@@ -3969,6 +3848,7 @@ var FetchService = class FetchService {
 					if (related) row[key] = { ...related.values };
 				}
 			} catch (e) {
+				if (reachedDatabase(e)) throw e;
 				logger.warn(`[include] Failed to batch load one-to-one '${key}'`, { error: e });
 			}
 		}
@@ -3981,6 +3861,7 @@ var FetchService = class FetchService {
 					row[key] = batchResults.get(String(eid)) || [];
 				}
 			} catch (e) {
+				if (reachedDatabase(e)) throw e;
 				logger.warn(`[include] Failed to batch load many '${key}'`, { error: e });
 			}
 		}
@@ -4043,6 +3924,7 @@ var FetchService = class FetchService {
 					...e.values
 				}));
 			} catch (e) {
+				if (reachedDatabase(e)) throw e;
 				logger.warn(`[include] Failed to load relation '${key}'`, { error: e });
 			}
 		}
@@ -4079,6 +3961,10 @@ var FetchService = class FetchService {
 			const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
 			if (filterConditions.length > 0) allConditions.push(...filterConditions);
 		}
+		if (options.logical) {
+			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
+			if (logicalCondition) allConditions.push(logicalCondition);
+		}
 		if (vectorMeta?.filter) allConditions.push(vectorMeta.filter);
 		if (allConditions.length > 0) {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
@@ -4090,55 +3976,318 @@ var FetchService = class FetchService {
 			const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
 			if (orderByField) orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
 		}
-		orderExpressions.push(desc(idField));
-		if (orderExpressions.length > 0) query = query.orderBy(...orderExpressions);
-		const limitValue = options.vectorSearch ? options.limit || 10 : options.searchString ? options.limit || 50 : options.limit;
-		if (limitValue) query = query.limit(limitValue);
-		if (options.offset && options.offset > 0) query = query.offset(options.offset);
-		const rawResults = await query;
-		if (vectorMeta) return rawResults.map((r) => ({
-			...r.table_row,
-			_distance: typeof r._distance === "number" ? r._distance : parseFloat(String(r._distance))
-		}));
-		if (rankSelect) return rawResults.map((r) => ({
-			...r.table_row,
-			_score: typeof r._score === "number" ? r._score : parseFloat(String(r._score)),
-			...matchesSelect ? { _matches: r._matches ?? [] } : {}
-		}));
-		return rawResults;
+		orderExpressions.push(desc(idField));
+		if (orderExpressions.length > 0) query = query.orderBy(...orderExpressions);
+		const limitValue = options.vectorSearch ? options.limit || 10 : options.searchString ? options.limit || 50 : options.limit;
+		if (limitValue) query = query.limit(limitValue);
+		if (options.offset && options.offset > 0) query = query.offset(options.offset);
+		const rawResults = await query;
+		if (vectorMeta) return rawResults.map((r) => ({
+			...r.table_row,
+			_distance: typeof r._distance === "number" ? r._distance : parseFloat(String(r._distance))
+		}));
+		if (rankSelect) return rawResults.map((r) => ({
+			...r.table_row,
+			_score: typeof r._score === "number" ? r._score : parseFloat(String(r._score)),
+			...matchesSelect ? { _matches: r._matches ?? [] } : {}
+		}));
+		return rawResults;
+	}
+	/**
+	* Check if the Drizzle instance has the relational query API available
+	* for a given collection path.
+	* Note: Primary path now uses inline `getQueryBuilder()` checks.
+	*/
+	hasDrizzleQueryAPI(collectionPath) {
+		if (!this.getQueryBuilder("__probe__")) return false;
+		const tableName = getTableName(getTableForCollection(getCollectionByPath(collectionPath, this.registry), this.registry));
+		return !!this.getQueryBuilder(tableName);
+	}
+	/**
+	* Fallback path used when db.query is unavailable.
+	* The primary path uses db.query.findMany with `with` config, which
+	* loads all relations in a single query.
+	*
+	* Batch fetch many-to-many related rows for multiple parent IDs.
+	* Groups results by parent ID to avoid N+1.
+	*/
+	async batchFetchManyRelatedRows(parentCollectionPath, parentIds, relationKey) {
+		if (parentIds.length === 0) return /* @__PURE__ */ new Map();
+		const relation = resolveCollectionRelations(getCollectionByPath(parentCollectionPath, this.registry))[relationKey];
+		if (!relation) {
+			logger.warn(`[batchFetchManyRelatedRows] ResolvedRelation '${relationKey}' not found, skipping`);
+			return /* @__PURE__ */ new Map();
+		}
+		const entityMap = await this.relationService.batchFetchRelatedEntitiesMany(parentCollectionPath, parentIds, relationKey, relation);
+		const flatMap = /* @__PURE__ */ new Map();
+		for (const [key, rows] of entityMap) flatMap.set(key, rows.map((e) => ({
+			...e.values,
+			id: e.id
+		})));
+		return flatMap;
+	}
+};
+//#endregion
+//#region src/services/RelationWriteService.ts
+/**
+* The ids in a to-many relation write, whatever shape the caller sent.
+*
+* A membership list is written as either the related rows (`[{ id: 1 }]`, what
+* the admin UI sends back after reading them) or as bare keys (`[1]`, `["t-1"]`,
+* what anyone writing the API by hand sends). Only the first was read, via a
+* blind `.map(rel => rel.id)`, and a bare key therefore became `undefined`:
+* on a numeric-keyed target that surfaced as `Invalid numeric ID: undefined`,
+* and on a string-keyed one it did not surface at all — `String(undefined)`
+* wrote a junction row pointing at the literal `"undefined"`, which no read
+* would ever match. Both shapes are accepted here, in one place, because both
+* call sites had the same assumption.
+*
+* An element that carries no key is refused rather than skipped: dropping it
+* would silently write a shorter membership list than the caller asked for.
+*/
+function relationTargetIds(value, relationName, collectionSlug) {
+	if (!Array.isArray(value)) return [];
+	return value.map((element, index) => {
+		if (typeof element === "string" || typeof element === "number") return element;
+		if (element && typeof element === "object") {
+			const id = element.id;
+			if (typeof id === "string" || typeof id === "number") return id;
+		}
+		throw new Error(`Cannot write relation "${relationName}" on "${collectionSlug}": element ${index} carries no id. Pass either the related rows (\`[{ id: … }]\`) or their keys (\`[1, 2]\`), not ${element === null ? "null" : typeof element}.`);
+	});
+}
+/**
+* Writing relations: junction membership, foreign-key stamping, and the links a
+* nested path creates or removes.
+*
+* Split from {@link RelationService}, which now only reads. The two had grown
+* into one 1700-line class doing two unrelated jobs, and sharing one habit —
+* warning about a relation it could not resolve and carrying on, which surfaces
+* as an empty list on the read side and as a successful save on the write side.
+* Separating them is what made that visible as one class of defect rather than
+* eighteen scattered log lines.
+*
+* The reads it still needs — the source key a link joins on — it asks
+* {@link RelationService} for rather than reimplementing.
+*/
+var RelationWriteService = class {
+	db;
+	registry;
+	reads;
+	constructor(db, registry) {
+		this.db = db;
+		this.registry = registry;
+		this.reads = new RelationService(db, registry);
+	}
+	/**
+	* Remove the junction row linking a parent to `targetId`, leaving the target
+	* row itself alone.
+	*
+	* This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
+	* target is shared, so deleting the row would remove the tag from every other
+	* post that uses it. It used to do exactly that — resolve the path to the
+	* `tags` table and delete by primary key.
+	*/
+	async unlinkRelatedEntity(tx, hop, targetId) {
+		if (!isManyToMany(hop.relation)) throw new Error(`Relation '${hop.relationKey}' has no junction table to unlink through`);
+		await removeJunctionLink(tx, bindThroughJunction(this.registry, hop.relation.through, `${hop.parentCollection.slug}.${hop.relationKey}`), this.parsedId(hop.parentCollection, hop.parentId), this.parsedId(hop.targetCollection, targetId), {
+			parent: hop.parentCollection.slug,
+			relation: hop.relationKey
+		});
+	}
+	/** A collection's id, parsed to the type its primary key column holds. */
+	parsedId(collection, id) {
+		const pks = requirePrimaryKeys(collection, this.registry);
+		return parseIdValues(id, pks)[pks[0].fieldName];
+	}
+	/** The same, for the membership list a to-many write names. */
+	parsedIds(collection, ids) {
+		if (ids.length === 0) return [];
+		const pks = requirePrimaryKeys(collection, this.registry);
+		return ids.map((id) => parseIdValues(id, pks)[pks[0].fieldName]);
+	}
+	/**
+	* Update many-to-many and junction relations
+	*/
+	async updateRelationsUsingJoins(tx, collection, id, relationValues) {
+		const resolvedRelations = resolveCollectionRelations(collection);
+		for (const [key, value] of Object.entries(relationValues)) {
+			const relation = findRelation(resolvedRelations, key);
+			if (!relation || relation.cardinality !== "many") continue;
+			const targetEntityIds = relationTargetIds(value, key, collection.slug);
+			const targetCollection = relation.target();
+			const label = `${collection.slug}.${key}`;
+			if (relation.kind === "via") await applyJunctionMembership(tx, bindJoinPathJunction(this.registry, relation.joinPath, getTableName$1(collection), getTableName$1(targetCollection), label), this.parsedId(collection, id), this.parsedIds(targetCollection, targetEntityIds));
+			else if (relation.kind === "manyToMany") await applyJunctionMembership(tx, bindThroughJunction(this.registry, relation.through, label), this.parsedId(collection, id), this.parsedIds(targetCollection, targetEntityIds));
+			else if (relation.cardinality === "many" && hasForeignKeyOnTarget(relation)) {
+				const targetTable = getTableForCollection(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+				const targetIdInfo = targetPks[0];
+				const targetIdCol = targetTable[targetIdInfo.fieldName];
+				const fkField = fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget);
+				const fkCol = targetTable[fkField];
+				if (!fkCol || !targetIdCol) throw relationMisconfigured(label, `the target table '${getTableName$1(targetCollection)}' has no ${fkCol ? `'${targetIdInfo.fieldName}' key column` : `'${relation.foreignKeyOnTarget}' foreign-key column`}`);
+				const parentKeyValue = (await this.reads.resolveSourceKeys(collection, relation, [id], tx)).keyByParentId.get(String(id));
+				if (parentKeyValue === void 0) throw new Error(`Cannot write relation '${key}' on '${collection.slug}': row '${id}' has no value in \`sourceKey: "${sourceKeyField(relation, collection, this.registry)}"\`, so there is nothing for the related rows to point at.`);
+				if (targetEntityIds.length > 0) {
+					const parsedTargetIds = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
+					await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(fkCol, parentKeyValue), notInArray(targetIdCol, parsedTargetIds)));
+					await tx.update(targetTable).set({ [fkField]: parentKeyValue }).where(inArray(targetIdCol, parsedTargetIds));
+				} else await tx.update(targetTable).set({ [fkField]: null }).where(eq(fkCol, parentKeyValue));
+			} else throw relationMisconfigured(label, "it is a to-many relation with no way to write links — a `manyToMany` needs `through`, a `hasMany` needs `foreignKeyOnTarget`");
+		}
+	}
+	/**
+	* Update inverse relations (where FK is on the target table)
+	*/
+	async updateInverseRelations(tx, sourceCollection, sourceEntityId, inverseRelationUpdates) {
+		for (const update of inverseRelationUpdates) {
+			const { relation, newValue } = update;
+			try {
+				const targetCollection = relation.target();
+				const targetTable = getTableForCollection(targetCollection, this.registry);
+				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+				const targetIdInfo = targetPks[0];
+				requirePrimaryKeys(sourceCollection, this.registry)[0];
+				if (relation.kind === "via") {
+					await this.updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue);
+					continue;
+				}
+				if (isManyToMany(relation)) {
+					await this.updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, {
+						table: relation.through.table,
+						sourceColumn: relation.through.sourceColumn,
+						targetColumn: relation.through.targetColumn
+					});
+					continue;
+				}
+				const label = `${sourceCollection.slug}.${relation.relationName}`;
+				if (!hasForeignKeyOnTarget(relation)) throw relationMisconfigured(label, `a '${relation.kind}' relation names no column on the target to write the link into`);
+				const fkField = fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget);
+				const foreignKeyColumn = targetTable[fkField];
+				if (!foreignKeyColumn) throw relationMisconfigured(label, `'${relation.foreignKeyOnTarget}' is not a column on the target table '${getTableName$1(targetCollection)}'`);
+				const sourceKeyValue = (await this.reads.resolveSourceKeys(sourceCollection, relation, [sourceEntityId], tx)).keyByParentId.get(String(sourceEntityId));
+				if (sourceKeyValue === void 0) throw new Error(`Cannot write relation '${relation.relationName}' on '${sourceCollection.slug}': row '${sourceEntityId}' has no value in \`sourceKey: "${sourceKeyField(relation, sourceCollection, this.registry)}"\`, so there is nothing for the related row to point at.`);
+				if (newValue === null || newValue === void 0) await tx.update(targetTable).set({ [fkField]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
+				else {
+					const parsedNewTargetId = parseIdValues(newValue, targetPks)[targetIdInfo.fieldName];
+					const targetIdField = targetTable[targetIdInfo.fieldName];
+					await tx.update(targetTable).set({ [fkField]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
+					await tx.update(targetTable).set({ [fkField]: sourceKeyValue }).where(eq(targetIdField, parsedNewTargetId));
+				}
+			} catch (e) {
+				if (e instanceof ApiError || e?.name === "ApiError") throw e;
+				logger.warn(`Failed to update inverse relation '${relation.relationName}'`, { error: e });
+			}
+		}
+	}
+	/**
+	* Handle inverse relations with joinPath
+	*/
+	async updateInverseJoinPathRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue) {
+		const sourceTableName = getTableName$1(sourceCollection);
+		const targetTableName = getTableName$1(targetCollection);
+		if (relation.joinPath.map((step) => step.table).filter((table) => table !== sourceTableName && table !== targetTableName).length !== 1 || relation.cardinality !== "many") return;
+		try {
+			const binding = bindJoinPathJunction(this.registry, relation.joinPath, sourceTableName, targetTableName, `${sourceCollection.slug}.${relation.relationName}`);
+			const targetIds = Array.isArray(newValue) ? relationTargetIds(newValue, relation.relationName, sourceCollection.slug) : newValue === null || newValue === void 0 ? [] : relationTargetIds([newValue], relation.relationName, sourceCollection.slug);
+			await applyJunctionMembership(tx, binding, this.parsedId(sourceCollection, sourceEntityId), this.parsedIds(targetCollection, targetIds));
+		} catch (error) {
+			logger.error(`Failed to update inverse joinPath relation '${relation.relationName}'`, { error });
+			throw error;
+		}
+	}
+	/**
+	* Handle many-to-many inverse relation updates using junction tables
+	*/
+	async updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, junctionInfo) {
+		try {
+			const targetIds = Array.isArray(newValue) ? relationTargetIds(newValue, relation.relationName, sourceCollection.slug) : [];
+			await applyJunctionMembership(tx, bindThroughJunction(this.registry, junctionInfo, `${sourceCollection.slug}.${relation.relationName}`), this.parsedId(sourceCollection, sourceEntityId), this.parsedIds(targetCollection, targetIds));
+		} catch (error) {
+			logger.error(`Failed to update many-to-many inverse relation '${relation.relationName}'`, { error });
+			throw error;
+		}
+	}
+	/**
+	* Update one-to-one relations that use joinPath
+	*/
+	async updateJoinPathOneToOneRelations(tx, parentCollection, parentId, updates) {
+		for (const upd of updates) {
+			const { relation, newTargetId } = upd;
+			const targetCollection = relation.target();
+			const targetTable = getTableForCollection(targetCollection, this.registry);
+			const targetPks = requirePrimaryKeys(targetCollection, this.registry);
+			const targetIdInfo = targetPks[0];
+			const targetIdCol = targetTable[targetIdInfo.fieldName];
+			const { targetFKColName: targetFKColumn, parentSourceColName: parentSourceColumn } = this.resolveJoinPathWriteMapping(parentCollection, relation);
+			const targetFKColName = fieldKeyForColumn(targetCollection, targetFKColumn);
+			const parentSourceColName = fieldKeyForColumn(parentCollection, parentSourceColumn);
+			const parentTable = getTableForCollection(parentCollection, this.registry);
+			const parentPks = requirePrimaryKeys(parentCollection, this.registry);
+			const parentIdInfo = parentPks[0];
+			const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
+			const parentIdCol = parentTable[parentIdInfo.fieldName];
+			const parentSourceCol = parentTable[parentSourceColName];
+			const targetFKCol = targetTable[targetFKColName];
+			const label = `${parentCollection.slug}.${relation.relationName}`;
+			if (!parentSourceCol) throw relationMisconfigured(label, `its joinPath reads '${parentSourceColName}', which is not a column on '${getTableName$1(parentCollection)}'`);
+			if (!targetFKCol) throw relationMisconfigured(label, `its joinPath writes '${targetFKColName}', which is not a column on '${getTableName$1(targetCollection)}'`);
+			const parentRows = await tx.select({ val: parentSourceCol }).from(parentTable).where(eq(parentIdCol, parsedParentId)).limit(1);
+			if (parentRows.length === 0) continue;
+			const parentFKValue = parentRows[0].val;
+			if (newTargetId === null || newTargetId === void 0) {
+				if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
+				continue;
+			}
+			const parsedTargetId = parseIdValues(newTargetId, targetPks)[targetIdInfo.fieldName];
+			if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
+			else throw ApiError.badRequest(`Cannot write relation '${label}': row '${parentId}' has no value in '${parentSourceColName}', which is the column its joinPath joins on, so there is nothing for the related row to point at.`, "RELATION_SOURCE_KEY_EMPTY");
+			await tx.update(targetTable).set({ [targetFKColName]: parentFKValue }).where(eq(targetIdCol, parsedTargetId));
+		}
 	}
 	/**
-	* Check if the Drizzle instance has the relational query API available
-	* for a given collection path.
-	* Note: Primary path now uses inline `getQueryBuilder()` checks.
+	* Resolve joinPath write mapping for one-to-one relations
 	*/
-	hasDrizzleQueryAPI(collectionPath) {
-		if (!this.getQueryBuilder("__probe__")) return false;
-		const tableName = getTableName(getTableForCollection(getCollectionByPath(collectionPath, this.registry), this.registry));
-		return !!this.getQueryBuilder(tableName);
+	resolveJoinPathWriteMapping(parentCollection, relation) {
+		if (!relation.joinPath || relation.joinPath.length === 0) throw new Error("resolveJoinPathWriteMapping requires a joinPath relation");
+		const parentTableName = getTableName$1(parentCollection);
+		const lastStep = relation.joinPath[relation.joinPath.length - 1];
+		const targetFKColName = DrizzleConditionBuilder.getColumnNamesFromColumns(lastStep.on.to)[0];
+		let currentFrom = lastStep.on.from;
+		let safety = 0;
+		while (safety++ < 10) {
+			if (DrizzleConditionBuilder.getTableNamesFromColumns(currentFrom)[0] === parentTableName) break;
+			const prevStep = relation.joinPath.find((s) => {
+				return (Array.isArray(s.on.to) ? s.on.to[0] : s.on.to) === currentFrom;
+			});
+			if (!prevStep) throw new Error(`Could not resolve parent source column for joinPath relation '${relation.relationName}'`);
+			currentFrom = prevStep.on.from;
+		}
+		return {
+			targetFKColName,
+			parentSourceColName: DrizzleConditionBuilder.getColumnNamesFromColumns(currentFrom)[0]
+		};
 	}
 	/**
-	* Fallback path used when db.query is unavailable.
-	* The primary path uses db.query.findMany with `with` config, which
-	* loads all relations in a single query.
-	*
-	* Batch fetch many-to-many related rows for multiple parent IDs.
-	* Groups results by parent ID to avoid N+1.
+	* Handle junction table creation for many-to-many path-based saves
 	*/
-	async batchFetchManyRelatedRows(parentCollectionPath, parentIds, relationKey) {
-		if (parentIds.length === 0) return /* @__PURE__ */ new Map();
-		const relation = resolveCollectionRelations(getCollectionByPath(parentCollectionPath, this.registry))[relationKey];
-		if (!relation) {
-			logger.warn(`[batchFetchManyRelatedRows] ResolvedRelation '${relationKey}' not found, skipping`);
-			return /* @__PURE__ */ new Map();
+	async handleJunctionTableCreation(tx, newEntityId, junctionTableInfo) {
+		const { parentCollection, parentId, relation, relationKey } = junctionTableInfo;
+		const targetCollection = relation.target();
+		try {
+			const binding = bindThroughJunction(this.registry, relation.through, `${parentCollection.slug}.${relationKey}`);
+			const parsedNewEntityId = this.parsedId(targetCollection, newEntityId);
+			const junctionData = {
+				[binding.parentColumn.name]: parentId,
+				[binding.targetColumn.name]: parsedNewEntityId
+			};
+			await tx.insert(binding.table).values(junctionData).onConflictDoNothing();
+			logger.info(`Linked '${relationKey}' ${parsedNewEntityId} to ${parentId}`);
+		} catch (error) {
+			logger.error(`Failed to create junction table entry for relation '${relationKey}'`, { error });
+			throw error;
 		}
-		const entityMap = await this.relationService.batchFetchRelatedEntitiesMany(parentCollectionPath, parentIds, relationKey, relation);
-		const flatMap = /* @__PURE__ */ new Map();
-		for (const [key, rows] of entityMap) flatMap.set(key, rows.map((e) => ({
-			...e.values,
-			id: e.id
-		})));
-		return flatMap;
 	}
 };
 //#endregion
@@ -4150,34 +4299,24 @@ var FetchService = class FetchService {
 var PersistService = class {
 	db;
 	registry;
+	/** Reads: whether a row is under a parent, the key a link joins on. */
 	relationService;
+	/** Writes: junction membership, foreign-key stamping, links. */
+	relationWrites;
 	fetchService;
 	constructor(db, registry) {
 		this.db = db;
 		this.registry = registry;
 		this.relationService = new RelationService(db, registry);
+		this.relationWrites = new RelationWriteService(db, registry);
 		this.fetchService = new FetchService(db, registry);
 	}
 	/**
-	* Explain a write that matched no rows.
-	*
-	* Row-level security filters UPDATE and DELETE through the policy's USING
-	* clause instead of raising: a denied write is reported by Postgres exactly
-	* like a successful one that happened to match nothing. Left unchecked, a
-	* caller cannot tell "denied" from "done" — the write returns 200/204 and
-	* the row is untouched.
-	*
-	* Re-reading the target over the *same* RLS-scoped handle separates the two
-	* cases. A visible row means the policy rejected the write (403); an
-	* invisible one means there is nothing there to write for this caller (404,
-	* matching what a GET would say). The re-read is bound by the caller's own
-	* policies, so it discloses nothing a plain read wouldn't.
-	*
-	* Only reached when zero rows matched, so the happy path pays nothing.
+	* Explain a row write that matched nothing — see {@link explainZeroRowWrite}
+	* for why a zero-row write cannot be reported as success.
 	*/
-	async explainZeroRowWrite(handle, table, conditions, collectionPath, id, operation) {
-		if ((await handle.select({ present: sql`1` }).from(table).where(and(...conditions)).limit(1)).length > 0) return ApiError.forbidden(`Not allowed to ${operation} "${id}" in "${collectionPath}": a row-level security policy rejected the write.`, "WRITE_DENIED");
-		return ApiError.notFound(`No row "${id}" in "${collectionPath}" to ${operation}.`);
+	explainZeroRowWrite(handle, table, conditions, collectionPath, id, operation) {
+		return explainZeroRowWrite(handle, table, conditions, `Not allowed to ${operation} "${id}" in "${collectionPath}": a row-level security policy rejected the write.`, `No row "${id}" in "${collectionPath}" to ${operation}.`);
 	}
 	/**
 	* Delete an row by ID
@@ -4189,7 +4328,7 @@ var PersistService = class {
 			if (!await this.relationService.isRelated(hop, id)) throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to delete.`);
 			if (isJunctionBackedRelation(hop.relation)) {
 				if (!isManyToMany(hop.relation)) throw ApiError.badRequest(`"${collectionPath}" reaches '${hop.targetCollection.slug}' through a multi-hop joinPath, so there is no single link to remove. Delete the row at "${hop.targetCollection.slug}" directly if that is what you meant.`, "RELATION_NOT_UNLINKABLE");
-				await this.relationService.unlinkRelatedEntity(this.db, hop, id);
+				await this.relationWrites.unlinkRelatedEntity(this.db, hop, id);
 				return;
 			}
 		}
@@ -4213,8 +4352,14 @@ var PersistService = class {
 		await this.db.delete(table);
 	}
 	/**
-	* The column on the *target* table that records the parent, for a create
-	* under a nested one-to-many path.
+	* The field on the *target* row that records the parent, for a create under
+	* a nested one-to-many path.
+	*
+	* A **field**, not the column: the value is stamped into the caller's
+	* payload, which is keyed by wire names — `authorId`, never the `author_id`
+	* the relation names its link by. Stamping the column instead put a key on
+	* the payload that no property answers to, and `strictWrites` rejected the
+	* request the framework had just written to.
 	*
 	* Returns `undefined` when the link is not a column at all (a multi-hop
 	* `joinPath`), so the caller writes the row without stamping anything.
@@ -4227,8 +4372,8 @@ var PersistService = class {
 		const { relation } = hop;
 		switch (relation.kind) {
 			case "hasOne":
-			case "hasMany": return relation.foreignKeyOnTarget;
-			case "via": return relation.joinPath.length === 1 ? DrizzleConditionBuilder.getColumnNamesFromColumns(relation.joinPath[0].on.to)[0] : void 0;
+			case "hasMany": return fieldKeyForColumn(hop.targetCollection, relation.foreignKeyOnTarget);
+			case "via": return relation.joinPath.length === 1 ? fieldKeyForColumn(hop.targetCollection, DrizzleConditionBuilder.getColumnNamesFromColumns(relation.joinPath[0].on.to)[0]) : void 0;
 			default: return;
 		}
 	}
@@ -4300,12 +4445,13 @@ var PersistService = class {
 			const inverseRelationUpdates = serializedResult.inverseRelationUpdates;
 			const joinPathRelationUpdates = serializedResult.joinPathRelationUpdates;
 			const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
+			assertWritableColumns(entityData, table, effectiveCollectionPath);
 			savedId = await this.db.transaction(async (tx) => {
 				let currentId;
 				if (id && !options?.upsert) {
 					currentId = id;
 					const idValues = parseIdValues(id, idInfoArray);
-					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
+					if (joinPathRelationUpdates.length > 0) await this.relationWrites.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
 					if (Object.keys(entityData).length > 0) {
 						const updateQuery = tx.update(table).set(entityData);
 						const conditions = [];
@@ -4326,6 +4472,7 @@ var PersistService = class {
 						const target = idInfoArray.map((info) => table[info.fieldName]);
 						const set = { ...dataForInsert };
 						for (const info of idInfoArray) delete set[info.fieldName];
+						for (const [propName, prop] of Object.entries(collection.properties ?? {})) if (prop.type === "date" && prop.autoValue === "on_create") delete set[propName];
 						result = Object.keys(set).length > 0 ? await insertQuery.onConflictDoUpdate({
 							target,
 							set
@@ -4335,11 +4482,11 @@ var PersistService = class {
 					if (!resultRow) if (id) currentId = id;
 					else throw ApiError.forbidden(`Not allowed to write to "${effectiveCollectionPath}": the row was rejected by a row-level security policy.`, "WRITE_DENIED");
 					else currentId = buildCompositeId(resultRow, idInfoArray);
-					if (joinPathRelationUpdates.length > 0) await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
+					if (joinPathRelationUpdates.length > 0) await this.relationWrites.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
 				}
-				if (inverseRelationUpdates.length > 0) await this.relationService.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
-				if (Object.keys(relationValues).length > 0) await this.relationService.updateRelationsUsingJoins(tx, collection, currentId, relationValues);
-				if (junctionTableInfo) await this.relationService.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
+				if (inverseRelationUpdates.length > 0) await this.relationWrites.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
+				if (Object.keys(relationValues).length > 0) await this.relationWrites.updateRelationsUsingJoins(tx, collection, currentId, relationValues);
+				if (junctionTableInfo) await this.relationWrites.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
 				return currentId;
 			});
 		} catch (error) {
@@ -4356,6 +4503,15 @@ var PersistService = class {
 		return this.relationService;
 	}
 	/**
+	* The write half, for external use. Separate from
+	* {@link getRelationService} because they are separate objects now: reads
+	* answer questions, writes change rows, and the callers of one are not the
+	* callers of the other.
+	*/
+	getRelationWriteService() {
+		return this.relationWrites;
+	}
+	/**
 	* Get the FetchService instance for external use
 	*/
 	getFetchService() {
@@ -4701,284 +4857,6 @@ var BranchService = class {
 	}
 };
 //#endregion
-//#region src/security/rls-enforcement.ts
-var quoteIdent$1 = (name) => `"${name.replace(/"/g, "\"\"")}"`;
-/** DML the user role holds on managed tables (RLS still filters per row). */
-var USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
-/**
-* Warn when the connection role shares its name with an existing schema.
-*
-* Postgres resolves unqualified names through `search_path`, which defaults to
-* `"$user", public` — and `$user` is the connection ROLE. When a schema of that
-* name exists it sits ahead of `public`, so every unqualified statement
-* silently operates on it instead:
-*
-*     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts
-*
-* Nothing errors. You get a second table of the same name in the wrong schema,
-* and reads that pin `public` cannot see it — which reads as "missing table" and
-* sends people to re-run a push that creates a *third* copy. The bootstrapper
-* has a whole branch dedicated to recognising the symptom after the fact.
-*
-* Rebase shipped straight into this: it creates a schema named `rebase` while
-* every template named the database role `rebase` too. The scaffold uses
-* `rebase_app` now, and every pool Rebase opens pins `search_path=public`
-* (`pinSearchPath`), which covers the paths the framework controls. This covers
-* the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,
-* a hand-written migration — because the hazard is a property of the two NAMES,
-* not of any one connection.
-*
-* A warning rather than a boot failure: the database works, the framework's own
-* traffic is pinned, and refusing to start over a naming choice a user may have
-* inherited would be worse than the risk.
-*/
-async function warnOnRoleSchemaCollision(run) {
-	try {
-		const rows = await run(`
-            SELECT current_user AS role,
-                   EXISTS (
-                       SELECT 1 FROM pg_namespace n WHERE n.nspname = current_user
-                   ) AS collides
-        `);
-		if (rows[0]?.collides !== true) return;
-		const role = String(rows[0]?.role ?? "the connection role");
-		logger.warn(`⚠️  The database role "${role}" has the same name as a schema. Postgres resolves unqualified names through \`search_path\`, which defaults to \`"$user", public\` — so "${role}" is searched BEFORE public, and any unqualified \`CREATE TABLE\`/\`SELECT\` from a tool that does not pin the path (psql, pg_dump, drizzle-kit, a hand-written migration) silently lands in "${role}" instead. Rebase's own connections pin \`search_path=public\`, so the server is unaffected. To remove the hazard entirely, connect as a role whose name is not also a schema — the scaffold uses "rebase_app".`);
-	} catch {}
-}
-async function detectConnectionPosture(run) {
-	const row = (await run(`
-        SELECT current_user            AS role,
-               r.rolsuper              AS superuser,
-               r.rolbypassrls          AS bypassrls,
-               EXISTS (
-                   SELECT 1 FROM pg_tables t
-                   WHERE t.tableowner = current_user
-                     AND t.schemaname NOT IN ('pg_catalog', 'information_schema')
-               )                       AS owns_tables
-        FROM pg_roles r
-        WHERE r.rolname = current_user
-    `))[0] ?? {};
-	const superuser = row.superuser === true;
-	const bypassRLS = row.bypassrls === true;
-	const ownsTables = row.owns_tables === true;
-	return {
-		role: String(row.role ?? "unknown"),
-		superuser,
-		bypassRLS,
-		ownsTables,
-		privileged: superuser || bypassRLS || ownsTables
-	};
-}
-/**
-* Human-actionable instructions for when the connection cannot provision the
-* user role itself (no CREATEROLE and role not pre-created by the platform).
-*/
-function appRoleSetupInstructions(connectionRole, schemas) {
-	const grants = schemas.map((s) => `GRANT USAGE ON SCHEMA ${quoteIdent$1(s)} TO ${REBASE_USER_ROLE};\nGRANT ${USER_TABLE_PRIVILEGES} ON ALL TABLES IN SCHEMA ${quoteIdent$1(s)} TO ${REBASE_USER_ROLE};\nGRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${quoteIdent$1(s)} TO ${REBASE_USER_ROLE};`).join("\n");
-	return `Rebase enforces row-level security by running authenticated requests as the restricted role "${REBASE_USER_ROLE}", but the connection role "${connectionRole}" bypasses RLS and cannot create that role itself.\nRun the following as a database administrator, then restart:\n\nCREATE ROLE ${REBASE_USER_ROLE} NOLOGIN NOSUPERUSER NOBYPASSRLS NOINHERIT;\nGRANT ${REBASE_USER_ROLE} TO ${quoteIdent$1(connectionRole)};\n` + grants;
-}
-/**
-* Idempotently provision the `rebase_user` role, membership for the current
-* connection role, and DML grants (+ default privileges for future tables)
-* on every existing schema in `schemas`.
-*
-* Split into privilege tiers so it works both when the connection is a
-* superuser (creates everything) and when the platform pre-created the role
-* and membership (e.g. CNPG `postInitApplicationSQL`) and the connection is
-* merely the table owner — owners can always run the grant tier themselves.
-*
-* RLS still filters every row: these grants only make the tables *reachable*
-* by the role; the policies decide which rows/commands actually pass.
-*
-* Throws with precise setup instructions when the role is missing and the
-* connection cannot create it.
-*/
-async function ensureAppRole(run, schemas) {
-	const uniqueSchemas = Array.from(new Set(schemas.filter(Boolean)));
-	if ((await run(`SELECT 1 FROM pg_roles WHERE rolname = 'rebase_user'`)).length === 0) try {
-		await run(`CREATE ROLE ${REBASE_USER_ROLE} NOLOGIN NOSUPERUSER NOBYPASSRLS NOINHERIT`);
-	} catch (err) {
-		throw new Error(`Failed to create the "${REBASE_USER_ROLE}" role: ${err instanceof Error ? err.message : String(err)}\n\n` + appRoleSetupInstructions("current connection role", uniqueSchemas));
-	}
-	const memberRows = await run(`
-        SELECT (pg_has_role(current_user, '${REBASE_USER_ROLE}', 'MEMBER')
-                OR (SELECT rolsuper FROM pg_roles WHERE rolname = current_user)) AS can_set,
-               current_user AS role
-    `);
-	if (memberRows[0]?.can_set !== true) try {
-		await run(`GRANT ${REBASE_USER_ROLE} TO CURRENT_USER`);
-	} catch (err) {
-		throw new Error(`The connection role is not a member of "${REBASE_USER_ROLE}" and cannot grant itself membership: ${err instanceof Error ? err.message : String(err)}\n\n` + appRoleSetupInstructions(String(memberRows[0]?.role ?? "current connection role"), uniqueSchemas));
-	}
-	const nspRows = await run("SELECT nspname FROM pg_namespace");
-	const existing = new Set(nspRows.map((r) => String(r.nspname)));
-	for (const schema of uniqueSchemas) {
-		if (!existing.has(schema)) continue;
-		const s = quoteIdent$1(schema);
-		await run(`GRANT USAGE ON SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
-		await run(`GRANT ${USER_TABLE_PRIVILEGES} ON ALL TABLES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
-		await run(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${s} TO ${REBASE_USER_ROLE}`);
-		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);
-		await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);
-		await revokeInternalTableAccess(async (text) => {
-			await run(text);
-		}, schema, { onError: (table, error) => logger.warn(`🔐 [rls] Could not revoke "${REBASE_USER_ROLE}" access to "${schema}"."${table}" — it stays reachable by authenticated requests: ` + (error instanceof Error ? error.message : String(error))) });
-	}
-	logger.info(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
-}
-/**
-* Apply the authenticated context to a transaction: the `app.*` GUCs that RLS
-* policies read via `auth.uid()` / `auth.roles()` / `auth.jwt()`, and — when
-* `userRole` is set — `SET LOCAL ROLE` so RLS binds every statement in this
-* transaction (reads *and* writes).
-*
-* GUCs are set with `is_local = true` and the role switch is `LOCAL`: both
-* reset at commit/rollback, so pooled connections are never polluted.
-*
-* Fails closed by construction: if the role switch errors, the transaction
-* aborts instead of proceeding privileged.
-*
-* SECURITY: this function is only ever called on the **user** path (the server
-* context uses the base/owner driver and never calls it). The default policies
-* treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`
-* is `NULLIF(current_setting('app.uid'), '')` — so an EMPTY user id would
-* be read as NULL and silently escalate a user request to server privileges.
-* Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,
-* rather than trusting every caller (e.g. realtime subscription auth) to do it.
-* That sentinel is exported from `@rebasepro/types` because it leaks into rule
-* semantics: it is why `auth.uid() IS NOT NULL` is true for anonymous requests.
-*/
-async function applyAuthContext(tx, auth, userRole) {
-	const uid = typeof auth.uid === "string" && auth.uid.trim() !== "" ? auth.uid : ANONYMOUS_USER_ID;
-	const normalizedRoles = auth.roles.map((r) => typeof r === "string" ? r : r?.id ?? String(r));
-	await tx.execute(sql`
-        SELECT
-            set_config('app.uid', ${uid}, true),
-            set_config('app.user_id', ${uid}, true),
-            set_config('app.user_roles', ${normalizedRoles.join(",")}, true),
-            set_config('app.jwt', ${JSON.stringify({
-		sub: uid,
-		roles: auth.roles
-	})}, true)
-    `);
-	if (userRole) await tx.execute(sql.raw(`SET LOCAL ROLE ${quoteIdent$1(userRole)}`));
-}
-/** Role names from other BaaS platforms that people reach for out of habit. */
-var FOREIGN_CONVENTION_ROLES = {
-	authenticated: "Supabase",
-	anon: "Supabase",
-	service_role: "Supabase"
-};
-/**
-* Warn about rules that read as "signed-in users only" but admit anonymous
-* callers — `auth.uid() IS NOT NULL`, or a comparison against another
-* platform's magic user id such as `'anon'`.
-*
-* The sibling of {@link validatePolicyPgRoles}, for the more dangerous spelling
-* of the same habit. A foreign `pgRoles` value makes a policy unreachable and
-* the table reads empty — loud, and that guard throws. These do the opposite:
-* the rule compiles to a grant, and nothing looks wrong until the data is
-* already public.
-*
-* Warns rather than throws. Unlike an unreachable `pgRoles`, these rules are
-* serving traffic today: refusing to boot would take an app offline to report a
-* problem it already has, and on the read path it would take it offline
-* *because* its data was exposed. Rewriting the author's SQL is not an option
-* either — this is the escape hatch whose whole promise is that it means what it
-* says. So: say so, loudly, and leave the rule alone.
-*/
-function warnOnAnonymousGrants(collections) {
-	const byRisk = /* @__PURE__ */ new Map();
-	for (const collection of collections) for (const rule of collection.securityRules ?? []) {
-		const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
-		const risks = [usingExpr, withCheckExpr].filter((e) => e !== null).flatMap(findAnonymousGrants);
-		for (const risk of risks) {
-			const key = `${risk.pattern}:${risk.detail}`;
-			const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
-			const entry = byRisk.get(key) ?? {
-				risk,
-				sites: []
-			};
-			if (!entry.sites.includes(site)) entry.sites.push(site);
-			byRisk.set(key, entry);
-		}
-	}
-	if (byRisk.size === 0) return;
-	const problems = [...byRisk.values()].map(({ risk, sites }) => `  • ${risk.explanation}\n    ${sites.length} rule(s): ${sites.join(", ")}`);
-	logger.warn(`Security rules that read as a lockdown but grant access to anonymous requests. Every caller from a client carries a user id ('${ANONYMOUS_USER_ID}' when nobody is signed in), so these clauses are true for everyone:\n\n` + problems.join("\n\n") + "\n");
-}
-/**
-* Name the collections whose raw policy SQL still calls the pre-1.0 helpers.
-*
-* The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the
-* database, so nothing is broken and no policy is wrong — which is exactly why
-* this has to be said out loud. A silent rewrite that works forever is not a
-* migration, it is a second supported spelling nobody wrote down, and the next
-* person to read those rules will copy the old one.
-*
-* Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,
-* `policy.rolesOverlap(...)`) compile from the model and were never affected.
-*/
-function warnOnLegacyRlsFunctions(collections) {
-	const sites = [];
-	for (const collection of collections) for (const rule of collection.securityRules ?? []) {
-		const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
-		if (![usingExpr, withCheckExpr].filter((e) => e !== null).some(containsLegacyRlsCall)) continue;
-		const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
-		if (!sites.includes(site)) sites.push(site);
-	}
-	if (sites.length === 0) return;
-	logger.warn(`These security rules call the pre-1.0 RLS helpers (\`auth.uid()\`, \`auth.roles()\`, \`auth.jwt()\`). They still work — the compiler rewrites them — but the functions now live in the \`rebase\` schema, and the \`auth\` one is Supabase's. Update the raw SQL in these rules to \`${REBASE_SCHEMA}.uid()\` and friends, or switch them to the structured helpers (\`policy.authUid()\`, \`policy.rolesOverlap()\`), which never had to be spelled by hand:\n\n` + sites.map((s) => `  • ${s}`).join("\n") + "\n");
-}
-/** Whether any `raw` expression in the tree calls a pre-1.0 helper. */
-function containsLegacyRlsCall(expr) {
-	switch (expr.kind) {
-		case "raw": return usesLegacyRlsFunctions(expr.sql);
-		case "and":
-		case "or": return expr.operands.some(containsLegacyRlsCall);
-		case "not": return containsLegacyRlsCall(expr.operand);
-		case "existsIn": return containsLegacyRlsCall(expr.where);
-		default: return false;
-	}
-}
-/**
-* Reject `pgRoles` that this server can never satisfy.
-*
-* `pgRoles` sets the `TO` clause of a generated policy, so a policy naming a
-* role the request never runs as simply never applies — and RLS then filters
-* every row. The table reads as empty, which is indistinguishable from having
-* no data, so the mistake survives review and ships.
-*
-* Requests run as `rebase_user`, so a policy is only reachable if it targets
-* `public` or a role `rebase_user` holds. Anything else is a configuration
-* error worth failing the boot for.
-*/
-async function validatePolicyPgRoles(run, collections, requestRole = REBASE_USER_ROLE) {
-	const wanted = /* @__PURE__ */ new Map();
-	for (const collection of collections) for (const rule of collection.securityRules ?? []) for (const role of rule.pgRoles ?? []) {
-		if (role === "public") continue;
-		wanted.set(role, [...wanted.get(role) ?? [], collection.slug ?? "(unnamed)"]);
-	}
-	if (wanted.size === 0) return;
-	const names = [...wanted.keys()].map((r) => `'${r.replace(/'/g, "''")}'`).join(",");
-	const rows = await run(`
-        SELECT r.rolname AS role,
-               COALESCE(pg_has_role(to_regrole('${requestRole.replace(/'/g, "''")}'), r.oid, 'MEMBER'), false) AS reachable
-        FROM pg_roles r
-        WHERE r.rolname IN (${names})
-    `);
-	const reachable = new Map(rows.map((row) => [String(row.role), row.reachable === true]));
-	const problems = [];
-	for (const [role, slugs] of wanted) {
-		if (reachable.get(role) === true) continue;
-		const why = reachable.has(role) ? `"${requestRole}" is not a member of it` : "no such role exists in this database";
-		const platform = FOREIGN_CONVENTION_ROLES[role];
-		const hint = platform ? `"${role}" is a ${platform} convention, not a PostgreSQL role. Application roles belong in \`roles: ["${role === "service_role" ? "admin" : role}"]\`, which is checked inside the policy via auth.roles().` : `Either grant it (GRANT ${role} TO ${requestRole}) or drop \`pgRoles\` so the policy targets \`public\`.`;
-		problems.push(`  • pgRoles: ["${role}"] on ${slugs.join(", ")} — ${why}.\n    ${hint}`);
-	}
-	if (problems.length > 0) throw new Error(`Security rules target PostgreSQL roles this server cannot use. Requests run as "${requestRole}", so these policies would never apply and every row would be filtered out — the collections would look empty rather than error.\n\n` + problems.join("\n\n") + "\n");
-}
-//#endregion
 //#region src/PostgresBackendDriver.ts
 var PostgresBackendDriver = class PostgresBackendDriver {
 	db;
@@ -6222,6 +6100,13 @@ function createAuthSchema(usersSchemaName = "rebase") {
 		* that rotates immediately after it.
 		*/
 		sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
+		/**
+		* The assurance level the sign-in was established at — `aal2` only
+		* where a second factor was actually presented. Carried across
+		* rotations, because refresh is not a new authentication and has
+		* nothing else to read the level from.
+		*/
+		aal: text("aal"),
 		userAgent: text("user_agent"),
 		ipAddress: text("ip_address"),
 		createdAt: timestamp("created_at").defaultNow().notNull()
@@ -6267,6 +6152,13 @@ function createAuthSchema(usersSchemaName = "rebase") {
 		secretEncrypted: text("secret_encrypted").notNull(),
 		friendlyName: text("friendly_name"),
 		verified: boolean("verified").default(false).notNull(),
+		/**
+		* The highest TOTP time step ever accepted for this factor. RFC 6238
+		* §5.2 forbids accepting an OTP twice, and the ±1 step window that
+		* exists for clock drift is also a 90-second replay window: without
+		* this, one observed code buys a fresh session for a minute and a half.
+		*/
+		lastUsedCounter: bigint("last_used_counter", { mode: "number" }),
 		createdAt: timestamp("created_at").defaultNow().notNull(),
 		updatedAt: timestamp("updated_at").defaultNow().notNull()
 	});
@@ -6284,6 +6176,8 @@ function createAuthSchema(usersSchemaName = "rebase") {
 			createdAt: timestamp("created_at").defaultNow().notNull(),
 			verifiedAt: timestamp("verified_at"),
 			ipAddress: text("ip_address"),
+			/** Failed guesses recorded against this challenge; bounded by the route. */
+			attempts: integer("attempts").default(0).notNull(),
 			expiresAt: timestamp("expires_at").notNull()
 		}),
 		recoveryCodes: tableCreator("recovery_codes", {
@@ -6360,6 +6254,26 @@ var magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({ user:
 * Uses the explicit `columnName` when set (e.g. from introspection),
 * falling back to `toSnakeCase(propName)` for manually-authored collections.
 */
+var JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+/**
+* A string literal for the generated schema file.
+*
+* Column names, table names and enum values are all written into this file as
+* literals, and none of them is constrained to be quote-free: a Postgres
+* identifier only has to be quoted, and `O'Brien` is an ordinary enum value.
+* Interpolating them raw ended the literal early — for enum values, inside
+* single quotes, where an apostrophe is not an edge case.
+*/
+var quote$1 = (value) => JSON.stringify(value);
+/** An object key: verbatim when it is an identifier, quoted otherwise. */
+var propKey = (name) => JS_IDENTIFIER.test(name) ? name : quote$1(name);
+/**
+* A property access on a generated table variable.
+*
+* `users.full name` is not an expression; `users["full name"]` is, and Drizzle
+* treats the two identically.
+*/
+var member = (object, key) => JS_IDENTIFIER.test(key) ? `${object}.${key}` : `${object}[${quote$1(key)}]`;
 var resolveColumnName = (propName, prop) => {
 	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
 	return toSnakeCase(propName);
@@ -6390,26 +6304,16 @@ var getPrimaryKeyProp = (collection) => {
 	};
 };
 /**
-* Given a raw DB column name (e.g. "client_id"), find the Drizzle property key
-* on the collection that maps to that column. A property matches if:
-*   (a) it has an explicit `columnName` equal to the given column, OR
-*   (b) its snake_case form equals the given column.
+* Given a raw DB column name (e.g. "client_id"), the Drizzle property key that
+* maps to it.
 *
-* Returns the property key (the Drizzle object key) if found, or the original
-* column name as a fallback.
+* One line, because the rule is shared: the Drizzle object key is the wire
+* name, and {@link fieldKeyForColumn} is the one definition of what a column is
+* named on the wire. This used to be a private copy that fell back to the
+* column verbatim, which is how a derived foreign key ended up served as
+* `author_id` beside a hand-authored `displayName`.
 */
-var resolvePropertyKeyForColumn = (collection, column) => {
-	if (!collection.properties) return column;
-	for (const [propKey, prop] of Object.entries(collection.properties)) {
-		const p = prop;
-		if ("columnName" in p && typeof p.columnName === "string") {
-			if (p.columnName === column) return propKey;
-		}
-		if (toSnakeCase(propKey) === column) return propKey;
-		if (propKey === column) return propKey;
-	}
-	return column;
-};
+var resolvePropertyKeyForColumn = (collection, column) => fieldKeyForColumn(collection, column);
 var isNumericId = (collection) => {
 	return getPrimaryKeyProp(collection).type === "number";
 };
@@ -6420,18 +6324,25 @@ var isIdProperty = (propName, prop, collection) => {
 	if ("isId" in prop && Boolean(prop.isId)) return true;
 	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
 };
+/**
+* The Drizzle column declaration a property compiles to, or `null` when the
+* property puts no column on *this* table (an inverse relation, whose column
+* lives on the target). Exported so it can be checked against its DDL twin
+* `getSqlColumnType` directly — the two disagreeing is what left `geopoint`
+* with a database column and no Drizzle key.
+*/
 var getDrizzleColumn = (propName, prop, collection, collections) => {
 	const colName = resolveColumnName(propName, prop);
 	let columnDefinition;
 	switch (prop.type) {
 		case "string": {
 			const stringProp = prop;
-			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}("${colName}")`;
-			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid("${colName}")`;
-			else if (stringProp.columnType === "uuid") columnDefinition = `uuid("${colName}")`;
-			else if (stringProp.columnType === "char") columnDefinition = `char("${colName}", { length: ${resolveStringColumnLength(stringProp)} })`;
-			else if (stringProp.columnType === "varchar") columnDefinition = `varchar("${colName}", { length: ${resolveStringColumnLength(stringProp)} })`;
-			else columnDefinition = `text("${colName}")`;
+			if (stringProp.enum) columnDefinition = `${getEnumVarName(getTableName$1(collection), propName)}(${quote$1(colName)})`;
+			else if ("isId" in stringProp && stringProp.isId === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
+			else if (stringProp.columnType === "uuid") columnDefinition = `uuid(${quote$1(colName)})`;
+			else if (stringProp.columnType === "char") columnDefinition = `char(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
+			else if (stringProp.columnType === "varchar") columnDefinition = `varchar(${quote$1(colName)}, { length: ${resolveStringColumnLength(stringProp)} })`;
+			else columnDefinition = `text(${quote$1(colName)})`;
 			if (isIdProperty(propName, prop, collection)) columnDefinition += ".primaryKey()";
 			if ("isId" in stringProp && stringProp.isId !== "manual" && stringProp.isId !== true) {
 				if (stringProp.isId === "uuid") columnDefinition += ".defaultRandom()";
@@ -6447,10 +6358,10 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 		case "number": {
 			const numProp = prop;
 			const isId = isIdProperty(propName, prop, collection);
-			let baseType = numProp.validation?.integer || isId ? `integer("${colName}")` : `numeric("${colName}")`;
-			if (numProp.columnType) if (numProp.columnType === "double precision") baseType = `doublePrecision("${colName}")`;
-			else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") baseType = `${numProp.columnType}("${colName}", { mode: "number" })`;
-			else baseType = `${numProp.columnType}("${colName}")`;
+			let baseType = numProp.validation?.integer || isId ? `integer(${quote$1(colName)})` : `numeric(${quote$1(colName)})`;
+			if (numProp.columnType) if (numProp.columnType === "double precision") baseType = `doublePrecision(${quote$1(colName)})`;
+			else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") baseType = `${numProp.columnType}(${quote$1(colName)}, { mode: "number" })`;
+			else baseType = `${numProp.columnType}(${quote$1(colName)})`;
 			if ("isId" in numProp && numProp.isId === "increment") columnDefinition = `${baseType}.generatedByDefaultAsIdentity()`;
 			else if ("isId" in numProp && typeof numProp.isId === "string" && numProp.isId !== "manual") {
 				columnDefinition = baseType;
@@ -6462,19 +6373,22 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			break;
 		}
 		case "boolean":
-			columnDefinition = `boolean("${colName}")`;
+			columnDefinition = `boolean(${quote$1(colName)})`;
 			break;
 		case "date": {
 			const dateProp = prop;
-			if (dateProp.columnType === "date") columnDefinition = `date("${colName}", { mode: 'string' })`;
-			else if (dateProp.columnType === "time") columnDefinition = `time("${colName}")`;
-			else columnDefinition = `timestamp("${colName}", { withTimezone: true, mode: 'string' })`;
+			if (dateProp.columnType === "date") columnDefinition = `date(${quote$1(colName)}, { mode: 'string' })`;
+			else if (dateProp.columnType === "time") columnDefinition = `time(${quote$1(colName)})`;
+			else columnDefinition = `timestamp(${quote$1(colName)}, { withTimezone: true, mode: 'string' })`;
 			if (dateProp.autoValue === "on_create" || dateProp.autoValue === "on_update") columnDefinition += ".default(sql`now()`)";
 			break;
 		}
 		case "map":
-			if (prop.columnType === "json") columnDefinition = `json("${colName}")`;
-			else columnDefinition = `jsonb("${colName}")`;
+			if (prop.columnType === "json") columnDefinition = `json(${quote$1(colName)})`;
+			else columnDefinition = `jsonb(${quote$1(colName)})`;
+			break;
+		case "geopoint":
+			columnDefinition = `jsonb(${quote$1(colName)})`;
 			break;
 		case "array": {
 			const arrayProp = prop;
@@ -6485,25 +6399,28 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
 				else if (ofProp.type === "boolean") colType = "boolean[]";
 			}
-			if (colType === "json") columnDefinition = `json("${colName}")`;
-			else if (colType === "text[]") columnDefinition = `text("${colName}").array()`;
-			else if (colType === "integer[]") columnDefinition = `integer("${colName}").array()`;
-			else if (colType === "boolean[]") columnDefinition = `boolean("${colName}").array()`;
-			else if (colType === "numeric[]") columnDefinition = `numeric("${colName}").array()`;
-			else columnDefinition = `jsonb("${colName}")`;
+			if (colType === "json") columnDefinition = `json(${quote$1(colName)})`;
+			else if (colType === "text[]") columnDefinition = `text(${quote$1(colName)}).array()`;
+			else if (colType === "integer[]") columnDefinition = `integer(${quote$1(colName)}).array()`;
+			else if (colType === "boolean[]") columnDefinition = `boolean(${quote$1(colName)}).array()`;
+			else if (colType === "numeric[]") columnDefinition = `numeric(${quote$1(colName)}).array()`;
+			else columnDefinition = `jsonb(${quote$1(colName)})`;
 			break;
 		}
-		case "vector":
-			columnDefinition = `vector("${colName}", { dimensions: ${prop.dimensions} })`;
+		case "vector": {
+			const vp = prop;
+			columnDefinition = `vector(${quote$1(colName)}, { dimensions: ${vp.dimensions} })`;
 			break;
+		}
 		case "binary":
-			columnDefinition = `customType({ dataType() { return 'bytea'; } })("${colName}")`;
+			columnDefinition = `customType({ dataType() { return 'bytea'; } })(${quote$1(colName)})`;
 			break;
 		case "relation": {
 			const refProp = prop;
 			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
 			if (!relation || relation.kind !== "belongsTo") return null;
-			if (collection.properties[relation.localKey] && propName !== relation.localKey) return null;
+			const fkFieldKey = fieldKeyForColumn(collection, relation.localKey);
+			if (collection.properties[fkFieldKey] && propName !== fkFieldKey) return null;
 			let targetCollection;
 			try {
 				targetCollection = relation.target();
@@ -6519,30 +6436,31 @@ var getDrizzleColumn = (propName, prop, collection, collections) => {
 			const required = prop.validation?.required;
 			const refOptionsParts = [onUpdate, `onDelete: \"${relation.onDelete ?? (required ? "cascade" : "set null")}\"`].filter(Boolean);
 			const refOptions = refOptionsParts.length > 0 ? `{ ${refOptionsParts.join(", ")} }` : "";
-			let columnDef = `${baseColumn}.references(() => ${targetTableVar}.${targetIdField}${refOptions ? `, ${refOptions}` : ""})`;
+			let columnDef = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}${refOptions ? `, ${refOptions}` : ""})`;
 			if (required) columnDef += ".notNull()";
-			return `    ${relation.localKey}: ${columnDef}`;
+			return `    ${propKey(fkFieldKey)}: ${columnDef}`;
 		}
 		case "reference": {
 			const refProp = prop;
 			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName$1(c) === refProp.path);
 			if (!targetCollection) {
-				columnDefinition = `text("${colName}")`;
+				columnDefinition = `text(${quote$1(colName)})`;
 				break;
 			}
 			const pkProp = getPrimaryKeyProp(targetCollection);
 			const targetTableVar = getTableVarName(getTableName$1(targetCollection));
 			const targetIdField = pkProp.name;
-			const baseColumn = pkProp.type === "number" ? `integer("${colName}")` : pkProp.isUuid ? `uuid("${colName}")` : `text("${colName}")`;
+			const baseColumn = pkProp.type === "number" ? `integer(${quote$1(colName)})` : pkProp.isUuid ? `uuid(${quote$1(colName)})` : `text(${quote$1(colName)})`;
 			const required = prop.validation?.required;
-			columnDefinition = `${baseColumn}.references(() => ${targetTableVar}.${targetIdField}, ${`{ onDelete: "${required ? "cascade" : "set null"}" }`})`;
+			const refOptions = `{ onDelete: "${required ? "cascade" : "set null"}" }`;
+			columnDefinition = `${baseColumn}.references(() => ${member(targetTableVar, targetIdField)}, ${refOptions})`;
 			if (required) columnDefinition += ".notNull()";
-			return `    ${propName}: ${columnDefinition}`;
+			return `    ${propKey(propName)}: ${columnDefinition}`;
 		}
-		default: return null;
+		default: throw new Error(`No Postgres column mapping for property '${propName}' of type '${prop.type}' in collection '${collection.slug}'. Add a case to \`getDrizzleColumn\` (and to \`getSqlColumnType\`, which must agree).`);
 	}
 	if (prop.validation?.required) columnDefinition += ".notNull()";
-	return `    ${propName}: ${columnDefinition}`;
+	return `    ${propKey(propName)}: ${columnDefinition}`;
 };
 /**
 * Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
@@ -6575,7 +6493,7 @@ var generateSinglePolicyCode = (collection, rule, operation, policyName, resolve
 	parts.push(`to: [${toRoles.map((r) => `"${r}"`).join(", ")}]`);
 	if (usingClause) parts.push(`using: ${usingClause}`);
 	if (withCheckClause) parts.push(`withCheck: ${withCheckClause}`);
-	return `    pgPolicy("${policyName}", { ${parts.join(", ")} }),\n`;
+	return `    pgPolicy(${quote$1(policyName)}, { ${parts.join(", ")} }),\n`;
 };
 /**
 * Computes a deterministic shared relation name for Drizzle.
@@ -6610,7 +6528,7 @@ var computeSharedRelationName = (rel, sourceCollection, _collections) => {
 	return fallback;
 };
 var generateSchema = async (allCollections, stripPolicies = false) => {
-	const collections = relationalCollections(allCollections);
+	const collections = sortCollectionsBySlug(relationalCollections(allCollections));
 	let schemaContent = "// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\n\n";
 	const hasUuid = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "string" && (p.autoValue === "uuid" || p.isId === "uuid")));
 	const hasVector = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "vector"));
@@ -6661,7 +6579,7 @@ var generateSchema = async (allCollections, stripPolicies = false) => {
 				const enumDbName = `${collectionPath}_${resolveColumnName(propName, prop)}`;
 				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
 				if (values.length > 0) {
-					schemaContent += `export const ${enumVarName} = pgEnum(\"${enumDbName}\", [${values.map((v) => `'${v}'`).join(", ")}]);\n`;
+					schemaContent += `export const ${enumVarName} = pgEnum(${quote$1(enumDbName)}, [${values.map((v) => quote$1(v)).join(", ")}]);\n`;
 					if (!exportedEnumVars.includes(enumVarName)) exportedEnumVars.push(enumVarName);
 				}
 			}
@@ -6763,9 +6681,9 @@ var generateSchema = async (allCollections, stripPolicies = false) => {
 						break;
 					}
 				} catch {}
-				tableRelations.push(`    "${relation.through.sourceColumn}": one(${sourceTableVar}, {\n        fields: [${tableVarName}.${relation.through.sourceColumn}],\n        references: [${sourceTableVar}.${sourceId}],\n        relationName: \"${owningRelationName}\"\n    })`);
+				tableRelations.push(`    ${quote$1(relation.through.sourceColumn)}: one(${sourceTableVar}, {\n        fields: [${member(tableVarName, relation.through.sourceColumn)}],\n        references: [${member(sourceTableVar, sourceId)}],\n        relationName: ${quote$1(owningRelationName)}\n    })`);
 				const targetRelationName = inverseRelationName ? inverseRelationName : `${tableName}_${relation.through.targetColumn}`;
-				tableRelations.push(`    "${relation.through.targetColumn}": one(${targetTableVar}, {\n        fields: [${tableVarName}.${relation.through.targetColumn}],\n        references: [${targetTableVar}.${targetId}],\n        relationName: "${targetRelationName}"\n    })`);
+				tableRelations.push(`    ${quote$1(relation.through.targetColumn)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, relation.through.targetColumn)}],\n        references: [${member(targetTableVar, targetId)}],\n        relationName: ${quote$1(targetRelationName)}\n    })`);
 			}
 		} else {
 			const resolvedRelations = resolveCollectionRelations(collection);
@@ -6780,7 +6698,7 @@ var generateSchema = async (allCollections, stripPolicies = false) => {
 				switch (rel.kind) {
 					case "belongsTo": {
 						const localFieldKey = resolvePropertyKeyForColumn(collection, rel.localKey);
-						tableRelations.push(`    "${relationKey}": one(${targetTableVar}, {\n        fields: [${tableVarName}.${localFieldKey}],\n        references: [${targetTableVar}.${getPrimaryKeyName(target)}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
+						tableRelations.push(`    ${quote$1(relationKey)}: one(${targetTableVar}, {\n        fields: [${member(tableVarName, localFieldKey)}],\n        references: [${member(targetTableVar, getPrimaryKeyName(target))}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
 						break;
 					}
 					case "hasOne":
@@ -6811,7 +6729,7 @@ var generateSchema = async (allCollections, stripPolicies = false) => {
 							const drizzleFieldKey = resolvePropertyKeyForColumn(collection, otherRel.foreignKeyOnTarget);
 							const referencedKey = otherRel.sourceKey ? resolvePropertyKeyForColumn(otherCollection, otherRel.sourceKey) : getPrimaryKeyName(otherCollection);
 							const synthKey = `_synth_${otherTableVar}_${drizzleFieldKey}`;
-							tableRelations.push(`    "${synthKey}": one(${otherTableVar}, {\n        fields: [${tableVarName}.${drizzleFieldKey}],\n        references: [${otherTableVar}.${referencedKey}],\n        relationName: \"${drizzleRelationName}\"\n    })`);
+							tableRelations.push(`    ${quote$1(synthKey)}: one(${otherTableVar}, {\n        fields: [${member(tableVarName, drizzleFieldKey)}],\n        references: [${member(otherTableVar, referencedKey)}],\n        relationName: ${quote$1(drizzleRelationName)}\n    })`);
 							emittedRelationNames.add(deduplicationKey);
 						}
 					}
@@ -6831,6 +6749,44 @@ var generateSchema = async (allCollections, stripPolicies = false) => {
 	return schemaContent;
 };
 //#endregion
+//#region src/cli-output.ts
+/**
+* Terminal output for the `rebase db|schema|doctor` commands.
+*
+* These commands used to write every line through `logger`, and that is a
+* category error with three separate consequences:
+*
+*  - `logger` prefixes each line with its own level, so a box-drawn report
+*    arrived as `ℹ️ [INFO]   ┌─ ✗ Missing Column ───` and the frame no longer
+*    lined up with anything;
+*  - `logger` is gated by `LOG_LEVEL`, which ships in the scaffold's own
+*    `.env.example` — a developer who quietened their dev server with
+*    `LOG_LEVEL=warn` got a `rebase db push` that printed almost nothing and
+*    still exited non-zero, indistinguishable from a crash;
+*  - under `NODE_ENV=production` `logger` emits JSON, so the whole report
+*    became log records with the chalk escape codes embedded in them.
+*
+* A CLI's report *is* its return value. It goes to the terminal unconditionally
+* and unadorned. `packages/cli` has always written its output this way; this is
+* the same three functions for the plugin CLI that `rebase` delegates to.
+*
+* `logger` still belongs in this package's *runtime* — a request handler has no
+* terminal and its lines want levels, timestamps and redaction. The rule is the
+* caller, not the severity: anything a developer reads because they typed a
+* command goes here, anything a server emits while running goes to `logger`.
+*
+* Errors and warnings go to stderr so `rebase db push > plan.txt` keeps the
+* diagnosis on the terminal where it is readable.
+*/
+/** One line of human-facing output on stdout. */
+var out = (line = "") => {
+	console.log(line);
+};
+/** One line of human-facing error output on stderr. */
+var outError = (line = "") => {
+	console.error(line);
+};
+//#endregion
 //#region src/schema/generate-drizzle-schema.ts
 var formatTerminalText = (text, options = {}) => {
 	let codes = "";
@@ -6858,7 +6814,7 @@ var formatTerminalText = (text, options = {}) => {
 var runGeneration = async (collectionsFilePath, outputPath) => {
 	try {
 		if (!collectionsFilePath) {
-			logger.error("Error: No collections file path provided. Skipping schema generation.");
+			outError("Error: No collections file path provided. Skipping schema generation.");
 			return;
 		}
 		let collections = await loadCollectionsFromDirectory(path.resolve(collectionsFilePath));
@@ -6869,18 +6825,18 @@ var runGeneration = async (collectionsFilePath, outputPath) => {
 			const outputDir = path.dirname(outputPath);
 			await promises.mkdir(outputDir, { recursive: true });
 			await promises.writeFile(outputPath, schemaContent);
-			logger.info(`✅ Drizzle schema generated successfully at ${outputPath}`);
+			out(`✅ Drizzle schema generated successfully at ${outputPath}`);
 		} else {
-			logger.info("✅ Drizzle schema generated successfully.");
-			logger.info(String(schemaContent));
+			out("✅ Drizzle schema generated successfully.");
+			out(String(schemaContent));
 		}
-		logger.info(`You can now run ${formatTerminalText("rebase db generate", {
+		out(`You can now run ${formatTerminalText("rebase db generate", {
 			bold: true,
 			backgroundColor: "blue",
 			textColor: "black"
 		})} to generate the SQL migration files.`);
 	} catch (error) {
-		logger.error("Error generating schema", { error });
+		outError(`Error generating schema: ${error instanceof Error ? error.stack ?? error.message : String(error)}`);
 	}
 };
 var main = () => {
@@ -6890,18 +6846,18 @@ var main = () => {
 	const outputPath = outputPathArg ? outputPathArg.split("=")[1] : void 0;
 	const watch = process.argv.includes("--watch");
 	if (!collectionsFilePath) {
-		logger.info("Usage: ts-node generate-drizzle-schema.ts <path-to-collections-file> [--output <path-to-output-file>] [--watch]");
+		out("Usage: ts-node generate-drizzle-schema.ts <path-to-collections-file> [--output <path-to-output-file>] [--watch]");
 		return;
 	}
 	const resolvedPath = path.resolve(process.cwd(), collectionsFilePath);
 	const resolvedOutputPath = outputPath ? path.resolve(process.cwd(), outputPath) : void 0;
 	if (watch) {
-		logger.info(`Watching for changes in ${resolvedPath}...`);
+		out(`Watching for changes in ${resolvedPath}...`);
 		chokidar.watch(resolvedPath, {
 			persistent: true,
 			ignoreInitial: false
 		}).on("all", (event, filePath) => {
-			logger.info(`[${event}] ${filePath}. Regenerating schema...`);
+			out(`[${event}] ${filePath}. Regenerating schema...`);
 			runGeneration(resolvedPath, resolvedOutputPath);
 		});
 	} else runGeneration(resolvedPath, resolvedOutputPath);
@@ -7085,7 +7041,7 @@ async function provisionTriggerCdc(run, tables) {
 			logger.warn(`⚠️ [CDC] Could not attach change-capture trigger to "${key}" — is the table migrated? Writes to it won't emit database-level events.`, { detail: reason });
 		}
 	}
-	logger.info(`📡 [CDC] Trigger-based change capture provisioned on ${installed.length} table(s)` + (skipped.length ? ` (${skipped.length} skipped)` : "") + ".");
+	logger.debug(`📡 [CDC] Trigger-based change capture provisioned on ${installed.length} table(s)` + (skipped.length ? ` (${skipped.length} skipped)` : "") + ".");
 	return {
 		installed,
 		skipped
@@ -7175,7 +7131,7 @@ var PgNotifyListener = class {
 			await client.connect();
 			await client.query(`LISTEN ${channel}`);
 			this.client = client;
-			logger.info(`📡 ${logLabel} Listening on channel "${channel}".`);
+			logger.debug(`📡 ${logLabel} Listening on channel "${channel}".`);
 		} catch (err) {
 			if (initial) throw err;
 			logger.error(`❌ ${logLabel} Failed to connect LISTEN client`, { error: err });
@@ -8007,6 +7963,12 @@ var PG_NOTIFY_CHANNEL = "rebase_entity_changes";
 var RealtimeService = class RealtimeService extends EventEmitter {
 	db;
 	registry;
+	/**
+	* Declares to the multi-engine router that channel frames can be handled
+	* here. Read by `createRoutedRealtimeService`, which otherwise would have to
+	* guess — and guessed "the default provider", whichever engine that is.
+	*/
+	supportsChannels = true;
 	clients = /* @__PURE__ */ new Map();
 	channels = /* @__PURE__ */ new Map();
 	presence = /* @__PURE__ */ new Map();
@@ -8053,6 +8015,23 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* so a hot channel logs the problem once rather than once per message.
 	*/
 	oversizedBroadcastWarned = /* @__PURE__ */ new Set();
+	/**
+	* Optional narrowing on top of the membership floor — see
+	* {@link ChannelAuthorizer}. Unset by default, which leaves membership as
+	* the whole of the rule.
+	*/
+	channelAuthorizer;
+	/**
+	* Whether a notification from another instance has ever arrived.
+	*
+	* The entity LISTEN handler sees a foreign `sid` on every cross-instance
+	* change, which is proof that this deployment runs more than one pod — the
+	* one fact needed to tell "the memory bus is fine here" from "broadcast and
+	* presence silently reach a fraction of your users".
+	*/
+	foreignInstanceSeen = false;
+	/** So the multi-pod memory-bus warning is emitted once, not once per join. */
+	memoryBusWarned = false;
 	presenceInterval;
 	static PRESENCE_TIMEOUT_MS = 3e4;
 	/** How often stale roster rows from other instances are reaped. */
@@ -8227,26 +8206,13 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				await this.handleUnsubscribe(clientId, message.subscriptionId);
 				break;
 			case "join_channel":
-				this.joinChannel(clientId, payload?.channel);
-				break;
 			case "leave_channel":
-				this.leaveChannel(clientId, payload?.channel);
-				break;
 			case "broadcast":
-				this.broadcastToChannel(clientId, payload?.channel, payload?.event, payload?.payload);
-				break;
 			case "channel_history":
-				await this.handleChannelHistoryRequest(clientId, payload?.channel, payload?.sinceSeq, payload?.limit);
-				break;
 			case "presence_track":
-				this.joinChannel(clientId, payload?.channel);
-				this.trackPresence(clientId, payload?.channel, payload?.state ?? {});
-				break;
 			case "presence_untrack":
-				this.removePresence(clientId, payload?.channel);
-				break;
 			case "presence_state":
-				this.sendPresenceState(clientId, payload?.channel);
+				await this.handleChannelMessage(clientId, message.type, payload, authContext);
 				break;
 			default: this.sendError(clientId, "Unknown message type " + message.type, message.subscriptionId);
 		}
@@ -8261,7 +8227,21 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				this.sendError(clientId, msg, subscriptionId);
 				return;
 			}
-			const boundedLimit = resolveClientListLimit(request.limit, { vectorSearch: !!request.vectorSearch });
+			if (request.vectorSearch) {
+				const msg = "Realtime subscriptions do not support vector search: a subscription is re-run on every matching write, and nothing here computes distances. Use `.vectorSearch(...).find()` for the query, and subscribe without it if you need live updates.";
+				logger.warn(`[RealtimeService] ${msg}`);
+				this.sendError(clientId, msg, subscriptionId, "VECTOR_SEARCH_NOT_LIVE");
+				return;
+			}
+			let boundedLimit;
+			try {
+				boundedLimit = resolveClientListLimit(request.limit);
+			} catch (e) {
+				if (!(e instanceof ListLimitError)) throw e;
+				logger.warn(`[RealtimeService] Refused subscription to '${request.path}': ${e.message}`);
+				this.sendError(clientId, e.message, subscriptionId, "INVALID_LIMIT");
+				return;
+			}
 			this._subscriptions.set(subscriptionId, {
 				clientId,
 				type: "collection",
@@ -8365,7 +8345,39 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		this.debugLog("🔔 [RealtimeService] notifyUpdate completed for path:", path);
 	}
 	/**
-	* Notify subscriptions for a specific path
+	* Notify subscriptions for a specific path.
+	*
+	* **A subscriber only ever receives rows re-read under its own scope.**
+	* `row` is used to decide *that* something changed, never to say *what* —
+	* every delivery below goes through a refetch that binds the subscription's
+	* own auth context.
+	*
+	* It used to be conditional. The CDC path already did the right thing: it
+	* discards the captured tuple and emits `{_rebase_invalidated: true}`, and
+	* that marker selected the refetch branch. But the marker is produced in
+	* exactly two places, and the *other* side of each branch here shipped the
+	* row it was handed straight to the socket. Two of the three entry paths
+	* took that side — every API mutation (`PostgresBackendDriver.save` passes
+	* the row it just wrote, read under the **writer's** scope) and the legacy
+	* cross-instance LISTEN handler (which re-reads on the owner connection,
+	* bypassing RLS altogether). Path matching was the only filter applied: the
+	* subscription's own `filter`/`logical` was never evaluated, and any
+	* `afterRead` redaction was the writer's rather than the reader's.
+	*
+	* A single-row subscription was the sharpest case. `subscribe_one` on a row
+	* RLS denies is accepted and answered `null`; the next update then pushed
+	* the full row with no later correction. The collection variant was merely
+	* papered over ~300 ms later by the debounced refetch — after the bytes had
+	* already reached the browser.
+	*
+	* The same defect was found and fixed on the Mongo driver in `065e2b615`
+	* (see `packages/server-mongo/test/realtime-authorization.test.ts`); this is
+	* the Postgres half, stated as one rule rather than three patched branches.
+	*
+	* The cost is the instant row-level patch that used to precede the refetch:
+	* cross-tab feedback now waits for the debounce. That is the price of not
+	* being able to know, without asking the database as this subscriber,
+	* whether this subscriber may see the row at all.
 	*/
 	async notifyPathUpdate(notifyPath, originalPath, id, row, _databaseId) {
 		this.debugLog(`📡 [RealtimeService] Notifying path: ${notifyPath} (original: ${originalPath})`);
@@ -8379,12 +8391,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		const webSocketSubscriptions = allSubscriptions.filter(([, sub]) => sub.clientId !== "driver" && this.clients.has(sub.clientId));
 		const driverSubscriptions = allSubscriptions.filter(([subscriptionId, sub]) => sub.clientId === "driver" && this.subscriptionCallbacks.has(subscriptionId));
 		for (const [subscriptionId, subscription] of webSocketSubscriptions) try {
-			if (subscription.type === "single" && notifyPath === originalPath) if (row && row?._rebase_invalidated) this.debouncedSingleRefetch(subscriptionId, notifyPath, id, subscription);
-			else this.sendSingleUpdate(subscription.clientId, subscriptionId, row);
-			else if (subscription.type === "collection" && subscription.collectionRequest) {
-				if (!row || !row?._rebase_invalidated) this.sendCollectionPatch(subscription.clientId, subscriptionId, id, row, notifyPath);
-				this.debouncedCollectionRefetch(subscriptionId, notifyPath, subscription);
-			}
+			if (subscription.type === "single" && notifyPath === originalPath) this.debouncedSingleRefetch(subscriptionId, notifyPath, id, subscription);
+			else if (subscription.type === "collection" && subscription.collectionRequest) this.debouncedCollectionRefetch(subscriptionId, notifyPath, subscription);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, notifyPath);
 			this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -8392,8 +8400,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		for (const [subscriptionId, subscription] of driverSubscriptions) try {
 			const callback = this.subscriptionCallbacks.get(subscriptionId);
 			if (!callback) continue;
-			if (subscription.type === "single" && notifyPath === originalPath) if (row && row?._rebase_invalidated) this.debouncedSingleDriverRefetch(subscriptionId, notifyPath, id, subscription, callback);
-			else callback(row);
+			if (subscription.type === "single" && notifyPath === originalPath) this.debouncedSingleDriverRefetch(subscriptionId, notifyPath, id, subscription, callback);
 			else if (subscription.type === "collection" && subscription.collectionRequest) this.debouncedDriverRefetch(subscriptionId, notifyPath, subscription, callback);
 		} catch (error) {
 			logger.error(`❌ [RealtimeService] Error processing DataDriver subscription ${subscriptionId}`, { error });
@@ -8457,6 +8464,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				let fetchedEntities;
 				if (collectionRequest.searchString) fetchedEntities = await txEntityService.searchRows(notifyPath, collectionRequest.searchString, {
 					filter: collectionRequest.filter,
+					logical: collectionRequest.logical,
 					orderBy: collectionRequest.orderBy,
 					order: collectionRequest.order,
 					limit: collectionRequest.limit,
@@ -8518,13 +8526,16 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		if (collectionRequest.searchString) return await this.dataService.searchRows(notifyPath, collectionRequest.searchString, {
 			filter: collectionRequest.filter,
+			logical: collectionRequest.logical,
 			orderBy: collectionRequest.orderBy,
 			order: collectionRequest.order,
 			limit: collectionRequest.limit,
-			databaseId: collectionRequest.databaseId
+			databaseId: collectionRequest.databaseId,
+			searchExplain: collectionRequest.searchExplain
 		});
 		return await this.dataService.fetchCollection(notifyPath, {
 			filter: collectionRequest.filter,
+			logical: collectionRequest.logical,
 			orderBy: collectionRequest.orderBy,
 			order: collectionRequest.order,
 			limit: collectionRequest.limit,
@@ -8654,16 +8665,6 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* columns and no address. The SDK holds no collection config to derive one
 	* from, so this is the only place the mapping can come from.
 	*/
-	sendCollectionPatch(clientId, subscriptionId, id, row, notifyPath) {
-		const message = {
-			type: "collection_patch",
-			subscriptionId,
-			id,
-			row,
-			pks: this.primaryKeysForPath(notifyPath)
-		};
-		this.sendMessage(clientId, message);
-	}
 	/** The key columns of the collection at `path`, if they can be resolved. */
 	primaryKeysForPath(path) {
 		try {
@@ -8708,12 +8709,148 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		return parentPaths;
 	}
+	/**
+	* Install a channel authorizer — see {@link ChannelAuthorizer}.
+	*
+	* Nothing in the framework calls this yet: it is the seam a rules API will
+	* be built on, kept deliberately separate from the membership floor so the
+	* floor holds whether or not anyone uses it.
+	*/
+	setChannelAuthorizer(authorizer) {
+		this.channelAuthorizer = authorizer;
+	}
+	/** Which action each channel frame is asking to perform. */
+	static CHANNEL_ACTIONS = {
+		join_channel: "join",
+		broadcast: "broadcast",
+		channel_history: "history",
+		presence_track: "join",
+		presence_state: "presence"
+	};
+	/**
+	* The one door every channel frame comes through.
+	*
+	* Returns synchronously — and so dispatches synchronously — unless an
+	* authorizer is installed. That matters: a client sends `join_channel`,
+	* `presence_state` and `channel_history` back to back on connect, and the
+	* socket's message handler processes each frame up to its first `await`,
+	* so a gate that always yielded would let the reads overtake the join that
+	* is about to authorize them.
+	*/
+	handleChannelMessage(clientId, type, payload, authContext) {
+		const channel = payload?.channel;
+		if (type === "leave_channel") {
+			this.leaveChannel(clientId, channel);
+			return;
+		}
+		if (type === "presence_untrack") {
+			this.removePresence(clientId, channel);
+			return;
+		}
+		const action = RealtimeService.CHANNEL_ACTIONS[type];
+		const allowed = this.authorizeChannelAction(clientId, channel, action, authContext);
+		if (allowed === false) return;
+		if (allowed === true) return this.dispatchChannelMessage(clientId, type, channel, payload);
+		return allowed.then((ok) => {
+			if (ok) return this.dispatchChannelMessage(clientId, type, channel, payload);
+		});
+	}
+	/** Perform an already-authorized channel frame. */
+	dispatchChannelMessage(clientId, type, channel, payload) {
+		switch (type) {
+			case "join_channel":
+				this.joinChannel(clientId, channel);
+				return;
+			case "broadcast":
+				this.broadcastToChannel(clientId, channel, payload?.event, payload?.payload);
+				return;
+			case "channel_history": return this.handleChannelHistoryRequest(clientId, channel, payload?.sinceSeq, payload?.limit);
+			case "presence_track":
+				this.joinChannel(clientId, channel);
+				this.trackPresence(clientId, channel, payload?.state ?? {});
+				return;
+			case "presence_state":
+				this.sendPresenceState(clientId, channel);
+				return;
+		}
+	}
+	/**
+	* Decide whether a client may perform an action on a channel.
+	*
+	* **Membership is the floor.** Reading a channel's presence roster, replaying
+	* its retained history and broadcasting into it all require that this client
+	* has joined it. That is a low bar — joining is open to anyone who can name
+	* the channel — but it is not the bar that was there before, which was none
+	* at all: `channel_history` and `presence_state` answered any socket about
+	* any channel, and a broadcast fanned out to members the sender had never
+	* joined. Two internal tables (`rebase.channel_presence`,
+	* `rebase.channel_messages`) are held outside RLS on the strength of this
+	* check, so it fails closed: an authorizer that throws refuses the frame.
+	*
+	* Anything richer than membership belongs in a {@link ChannelAuthorizer};
+	* this method is where it is consulted, and the only place.
+	*/
+	authorizeChannelAction(clientId, channel, action, authContext) {
+		if (action !== "join" && !this.channels.get(channel)?.has(clientId)) {
+			this.denyChannelAction(clientId, channel, action, "not a member of the channel");
+			return false;
+		}
+		const authorizer = this.channelAuthorizer;
+		if (!authorizer) return true;
+		let verdict;
+		try {
+			verdict = authorizer({
+				channel,
+				action,
+				clientId,
+				user: authContext
+			});
+		} catch (error) {
+			logger.error(`❌ [Channels] Authorizer threw for ${action} on "${channel}" — refusing`, { error });
+			this.denyChannelAction(clientId, channel, action, "channel authorization failed");
+			return false;
+		}
+		if (typeof verdict === "boolean") {
+			if (!verdict) this.denyChannelAction(clientId, channel, action, "refused by the channel authorizer");
+			return verdict;
+		}
+		return verdict.then((ok) => {
+			if (!ok) this.denyChannelAction(clientId, channel, action, "refused by the channel authorizer");
+			return ok;
+		}, (error) => {
+			logger.error(`❌ [Channels] Authorizer rejected for ${action} on "${channel}" — refusing`, { error });
+			this.denyChannelAction(clientId, channel, action, "channel authorization failed");
+			return false;
+		});
+	}
+	/** Tell the client why its channel frame went nowhere, and say so in the log. */
+	denyChannelAction(clientId, channel, action, reason) {
+		this.debugLog(`🚫 [Channels] Refused ${action} on "${channel}" for ${clientId}: ${reason}`);
+		this.sendError(clientId, `Refused ${action} on channel "${channel}": ${reason}`, void 0, "CHANNEL_FORBIDDEN");
+	}
 	/** Join a broadcast channel */
 	joinChannel(clientId, channel) {
 		if (!this.channels.has(channel)) this.channels.set(channel, /* @__PURE__ */ new Set());
 		this.channels.get(channel).add(clientId);
+		this.warnIfMemoryBusOnMultiplePods();
 		this.debugLog(`📡 [Broadcast] Client ${clientId} joined channel: ${channel}`);
 	}
+	/**
+	* Say something the first time channels are used on a deployment that is
+	* demonstrably multi-pod while the bus is still the in-memory default.
+	*
+	* Every other warning in this subsystem covers a *configured* bus failing —
+	* the case where the operator already knew a bus mattered. The common
+	* misconfiguration is the opposite one: scaled to two replicas, never
+	* touched `realtime.bus`, and broadcast and presence quietly serve a
+	* fraction of the room. The evidence is already in the process, so use it.
+	*/
+	warnIfMemoryBusOnMultiplePods() {
+		if (this.memoryBusWarned) return;
+		if (this.bus.kind !== "memory" || !this.foreignInstanceSeen) return;
+		this.memoryBusWarned = true;
+		logger.warn("⚠️ [ChannelBus] Channels are in use with the in-memory bus, but notifications from another instance have been seen — this deployment runs more than one process. Broadcast and presence reach only the clients connected to this one. Set `realtime.bus` (or REBASE_REALTIME_BUS=postgres) to make channels cross-instance.");
+	}
 	/** Leave a broadcast channel */
 	leaveChannel(clientId, channel) {
 		const members = this.channels.get(channel);
@@ -9208,7 +9345,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			throw err;
 		}
 		this.cdcActive = true;
-		logger.info(`📡 [RealtimeService] Database-level change capture ACTIVE — writes from ANY source now emit realtime events (${this.cdcTableMap.size} mapped table key(s)).`);
+		logger.debug(`📡 [RealtimeService] Database-level change capture ACTIVE — writes from ANY source now emit realtime events (${this.cdcTableMap.size} mapped table key(s)).`);
 	}
 	/** Stop the CDC listener and clear its state. */
 	async stopCdc() {
@@ -9391,6 +9528,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				try {
 					const { sid, p, eid, db } = JSON.parse(msg.payload);
 					if (sid === this.instanceId) return;
+					this.foreignInstanceSeen = true;
 					this.debugLog(`📡 [RealtimeService] Received cross-instance notification: path=${p}, id=${eid}, from=${sid}`);
 					let refetchedRow = null;
 					try {
@@ -9581,7 +9719,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-Bww-Lg0s.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-BH0Dzo_h.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -9906,7 +10044,7 @@ function buildCollectionRegistry(schema) {
 	const registry = new PostgresCollectionRegistry();
 	if (schema.collections) {
 		registry.registerMultiple(schema.collections);
-		logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
+		logger.debug(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map((c) => c.slug).join(", ")}]`);
 	}
 	if (schema.tables) Object.values(schema.tables).forEach((table) => {
 		if (isTable(table)) registry.registerTable(table, getTableName(table));
@@ -10081,7 +10219,7 @@ async function probeAuthSchema(db, authSchema) {
 *                     When omitted, a default `rebase.users` table is created.
 */
 async function ensureAuthTablesExist(db, collection) {
-	logger.info("🔍 Checking auth tables...");
+	logger.debug("🔍 Checking auth tables...");
 	await assertAuthSchemaCompatible(db, resolveAuthSchema(collection));
 	try {
 		let usersTableName = "\"rebase\".\"users\"";
@@ -10112,7 +10250,7 @@ async function ensureAuthTablesExist(db, collection) {
 				if (dbType === "UUID") userIdType = "UUID";
 				else if (dbType === "INTEGER" || dbType === "SMALLINT" || dbType === "BIGINT") userIdType = "INTEGER";
 				else userIdType = "TEXT";
-				logger.info(`✨ Detected ${usersTableName}.id type from database: ${dbType}. Using user_id type: ${userIdType}`);
+				logger.debug(`✨ Detected ${usersTableName}.id type from database: ${dbType}. Using user_id type: ${userIdType}`);
 			}
 		} catch (err) {
 			logger.warn(`⚠️ Failed to introspect ${usersTableName}.id type from database, falling back to config type: ${userIdType}`, { error: err });
@@ -10399,7 +10537,7 @@ async function ensureAuthTablesExist(db, collection) {
                 FROM information_schema.tables
                 WHERE table_name = 'refresh_tokens'
             `)).rows;
-			logger.info(`🔍 refresh_tokens reconcile: found ${found.length} table(s): ${found.map((r) => `"${r.table_schema}"."${r.table_name}"`).join(", ") || "(none)"}`);
+			logger.debug(`🔍 refresh_tokens reconcile: found ${found.length} table(s): ${found.map((r) => `"${r.table_schema}"."${r.table_name}"`).join(", ") || "(none)"}`);
 			for (const { table_schema } of found) {
 				const qualified = `"${table_schema}"."refresh_tokens"`;
 				try {
@@ -10407,6 +10545,7 @@ async function ensureAuthTablesExist(db, collection) {
 					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);
 					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);
 					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS aal TEXT`);
 					await db.execute(sql`
                         UPDATE ${sql.raw(qualified)}
                         SET session_id = gen_random_uuid()::text
@@ -10426,7 +10565,7 @@ async function ensureAuthTablesExist(db, collection) {
                         ON ${sql.raw(qualified)}(session_id)
                     `);
 					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
-					logger.info(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
+					logger.debug(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
 				} catch (perTableError) {
 					logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);
 				}
@@ -10469,6 +10608,7 @@ async function ensureAuthTablesExist(db, collection) {
                 secret_encrypted TEXT NOT NULL,
                 friendly_name TEXT,
                 verified BOOLEAN DEFAULT FALSE,
+                last_used_counter BIGINT,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
@@ -10484,6 +10624,7 @@ async function ensureAuthTablesExist(db, collection) {
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
                 verified_at TIMESTAMP WITH TIME ZONE,
                 ip_address TEXT,
+                attempts INTEGER NOT NULL DEFAULT 0,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL
             )
         `);
@@ -10491,6 +10632,12 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE INDEX IF NOT EXISTS idx_mfa_challenges_factor
             ON ${sql.raw(mfaChallengesTableName)}(factor_id)
         `);
+		try {
+			await db.execute(sql`ALTER TABLE ${sql.raw(mfaFactorsTableName)} ADD COLUMN IF NOT EXISTS last_used_counter BIGINT`);
+			await db.execute(sql`ALTER TABLE ${sql.raw(mfaChallengesTableName)} ADD COLUMN IF NOT EXISTS attempts INTEGER NOT NULL DEFAULT 0`);
+		} catch (mfaMigrationError) {
+			logger.warn(`⚠️  MFA hardening columns skipped: ${mfaMigrationError instanceof Error ? mfaMigrationError.message : String(mfaMigrationError)}`);
+		}
 		await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(recoveryCodesTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
@@ -10538,7 +10685,7 @@ async function ensureAuthTablesExist(db, collection) {
 		await revokeInternalTableAccess(async (text) => {
 			await db.execute(sql.raw(text));
 		}, authSchema, { onError: (table, err) => logger.warn(`🔐 Could not revoke authenticated-role access to "${authSchema}"."${table}": ` + (err instanceof Error ? err.message : String(err))) });
-		logger.info("✅ Auth tables ready");
+		logger.debug("✅ Auth tables ready");
 	} catch (error) {
 		if (error instanceof AuthSchemaVersionError) throw error;
 		logger.error("❌ Failed to create auth tables", { error });
@@ -10811,7 +10958,7 @@ var UserService = class {
 		const conditions = [];
 		if (roleId) conditions.push(sql`${roleId} = ANY(${sql.raw(usersTableName)}.roles)`);
 		if (search) {
-			const pattern = `%${search}%`;
+			const pattern = `%${escapeLikePattern(search)}%`;
 			conditions.push(sql`(${sql.raw(usersTableName)}.${sql.raw(emailColumn)} ILIKE ${pattern} OR ${sql.raw(usersTableName)}.${sql.raw(displayNameColumn)} ILIKE ${pattern})`);
 		}
 		const whereClause = conditions.length > 0 ? sql`WHERE ${sql.join(conditions, sql` AND `)}` : sql``;
@@ -10987,7 +11134,8 @@ var RefreshTokenService = class {
 			"sessionId",
 			"rotatedAt",
 			"revoked",
-			"sessionStartedAt"
+			"sessionStartedAt",
+			"aal"
 		]) if (this.has(optional)) selection[optional] = this.col(optional);
 		return selection;
 	}
@@ -11001,6 +11149,7 @@ var RefreshTokenService = class {
 		};
 		if (session && this.has("sessionId")) values.sessionId = session.id;
 		if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
+		if (session?.aal && this.has("aal")) values.aal = session.aal;
 		await this.db.insert(this.refreshTokensTable).values(values);
 	}
 	async findByHash(tokenHash) {
@@ -11478,6 +11627,9 @@ var PostgresAuthRepository = class {
 	async verifyMfaFactor(factorId) {
 		return this.getMfaService().verifyMfaFactor(factorId);
 	}
+	async updateMfaFactorSecret(factorId, secretEncrypted) {
+		return this.getMfaService().updateMfaFactorSecret(factorId, secretEncrypted);
+	}
 	async deleteMfaFactor(factorId, uid) {
 		return this.getMfaService().deleteMfaFactor(factorId, uid);
 	}
@@ -11505,6 +11657,12 @@ var PostgresAuthRepository = class {
 	async hasVerifiedMfaFactors(uid) {
 		return this.getMfaService().hasVerifiedMfaFactors(uid);
 	}
+	async claimMfaFactorCounter(factorId, counter) {
+		return this.getMfaService().claimMfaFactorCounter(factorId, counter);
+	}
+	async recordMfaChallengeAttempt(challengeId) {
+		return this.getMfaService().recordMfaChallengeAttempt(challengeId);
+	}
 };
 /**
 * PostgreSQL implementation of MfaRepository.
@@ -11557,7 +11715,7 @@ var MfaService = class {
 	async getMfaFactorById(factorId) {
 		const tableName = this.qualify("mfa_factors");
 		const result = await this.db.execute(sql`
-            SELECT id, uid, factor_type, secret_encrypted, friendly_name, verified, created_at, updated_at
+            SELECT id, uid, factor_type, secret_encrypted, friendly_name, verified, last_used_counter, created_at, updated_at
             FROM ${sql.raw(tableName)}
             WHERE id = ${factorId}
         `);
@@ -11570,10 +11728,29 @@ var MfaService = class {
 			secretEncrypted: row.secret_encrypted,
 			friendlyName: row.friendly_name ?? void 0,
 			verified: row.verified,
+			lastUsedCounter: row.last_used_counter === null || row.last_used_counter === void 0 ? null : Number(row.last_used_counter),
 			createdAt: new Date(row.created_at),
 			updatedAt: new Date(row.updated_at)
 		};
 	}
+	/**
+	* Spend a TOTP time step, once and only once.
+	*
+	* One statement: the `WHERE` is the check, the `UPDATE` is the act, and
+	* `RETURNING` reports which of two concurrent requests carrying the same
+	* six digits won. Reading the counter and then writing it would let both
+	* pass — the exact replay this closes.
+	*/
+	async claimMfaFactorCounter(factorId, counter) {
+		const tableName = this.qualify("mfa_factors");
+		return (await this.db.execute(sql`
+            UPDATE ${sql.raw(tableName)}
+            SET last_used_counter = ${counter}, updated_at = NOW()
+            WHERE id = ${factorId}
+              AND (last_used_counter IS NULL OR last_used_counter < ${counter})
+            RETURNING id
+        `)).rows.length > 0;
+	}
 	async verifyMfaFactor(factorId) {
 		const tableName = this.qualify("mfa_factors");
 		await this.db.execute(sql`
@@ -11582,6 +11759,14 @@ var MfaService = class {
             WHERE id = ${factorId}
         `);
 	}
+	async updateMfaFactorSecret(factorId, secretEncrypted) {
+		const tableName = this.qualify("mfa_factors");
+		await this.db.execute(sql`
+            UPDATE ${sql.raw(tableName)}
+            SET secret_encrypted = ${secretEncrypted}, updated_at = NOW()
+            WHERE id = ${factorId}
+        `);
+	}
 	async deleteMfaFactor(factorId, uid) {
 		const tableName = this.qualify("mfa_factors");
 		await this.db.execute(sql`
@@ -11608,7 +11793,7 @@ var MfaService = class {
 	async getMfaChallengeById(challengeId) {
 		const tableName = this.qualify("mfa_challenges");
 		const result = await this.db.execute(sql`
-            SELECT id, factor_id, created_at, verified_at, ip_address, expires_at
+            SELECT id, factor_id, created_at, verified_at, ip_address, attempts, expires_at
             FROM ${sql.raw(tableName)}
             WHERE id = ${challengeId} AND expires_at > NOW() AND verified_at IS NULL
         `);
@@ -11619,9 +11804,28 @@ var MfaService = class {
 			factorId: row.factor_id,
 			createdAt: new Date(row.created_at),
 			verifiedAt: row.verified_at ? new Date(row.verified_at) : void 0,
-			ipAddress: row.ip_address ?? void 0
+			ipAddress: row.ip_address ?? void 0,
+			attempts: Number(row.attempts ?? 0)
 		};
 	}
+	/**
+	* Count one failed guess against a challenge and report the new total.
+	*
+	* Incremented in the database rather than in the route so that guesses
+	* arriving in parallel — the shape any real brute-force takes — cannot
+	* share a single increment.
+	*/
+	async recordMfaChallengeAttempt(challengeId) {
+		const tableName = this.qualify("mfa_challenges");
+		const result = await this.db.execute(sql`
+            UPDATE ${sql.raw(tableName)}
+            SET attempts = attempts + 1
+            WHERE id = ${challengeId}
+            RETURNING attempts
+        `);
+		if (result.rows.length === 0) return 0;
+		return Number(result.rows[0].attempts);
+	}
 	async verifyMfaChallenge(challengeId) {
 		const tableName = this.qualify("mfa_challenges");
 		await this.db.execute(sql`
@@ -11842,7 +12046,7 @@ function findChangedFields(oldValues, newValues) {
 * pattern as `ensureAuthTablesExist`.
 */
 async function ensureHistoryTableExists(db) {
-	logger.info("🔍 Checking row history table...");
+	logger.debug("🔍 Checking row history table...");
 	try {
 		await db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
 		await db.execute(sql`
@@ -11867,7 +12071,7 @@ async function ensureHistoryTableExists(db) {
             ON rebase.entity_history(table_name, entity_id, updated_at DESC)
         `);
 		await db.execute(sql.raw(revokeInternalTableSql("rebase", "entity_history")));
-		logger.info("✅ Entity history table ready");
+		logger.debug("✅ Entity history table ready");
 	} catch (error) {
 		logger.error("❌ Failed to create row history table", { error });
 		logger.warn("⚠️ Continuing without creating history table.");
@@ -12181,6 +12385,7 @@ function idKindFor(col, propType) {
 }
 function buildProperties(meta, enumMap) {
 	const properties = {};
+	const takenKeys = /* @__PURE__ */ new Set();
 	for (const col of meta.columns) {
 		const isPk = meta.pks.includes(col.column_name);
 		if (meta.fks.some((fk) => fk.column_name === col.column_name) && !isPk) continue;
@@ -12193,7 +12398,8 @@ function buildProperties(meta, enumMap) {
 			columnName: col.column_name,
 			type: propType
 		};
-		const key = col.column_name;
+		const key = firstFreeKey([toWireKey(col.column_name), col.column_name], takenKeys);
+		takenKeys.add(key);
 		if (isPk) property.isId = idKindFor(col, propType);
 		else if (col.is_nullable === "NO" && col.column_default === null) property.validation = { required: true };
 		if (isEnum && enumValues) property.enum = enumValues.map((value) => ({
@@ -12230,7 +12436,7 @@ function buildRelations(meta, slugByTable, collectionBySlug) {
 	for (const fk of meta.fks) {
 		const targetSlug = slugByTable.get(fk.foreign_table_name);
 		if (!targetSlug) continue;
-		let key = fk.column_name.replace(/_id$/, "");
+		let key = toWireKey(fk.column_name.replace(/_id$/, ""));
 		if (meta.pks.includes(fk.column_name) && key === fk.column_name) key = fk.foreign_table_name;
 		relations[key] = {
 			name: humanize(key),
@@ -12487,6 +12693,43 @@ function resolveDriftCheckName(col, registeredTableNames) {
 	return (isRelationalCollectionConfig(col) ? col.table : void 0) ?? registeredTableNames.find((k) => k === col.slug) ?? col.slug;
 }
 /**
+* Is this the local database `rebase init` scaffolds — i.e. the one case where
+* "you are connected as a superuser" is not news?
+*
+* The scaffold's own `docker-compose.yml` sets `POSTGRES_USER: rebase_app`,
+* which makes that role the cluster superuser, so the superuser advisory below
+* was the only WARN a brand-new project ever saw and it was about a decision
+* the tool had made for the developer.
+*
+* Of the two available fixes — provision a non-superuser table-owner role in
+* the scaffold, or recognise the local shape and stay quiet — this is the
+* second, because the first breaks the scaffold it is meant to improve: a
+* non-superuser owner cannot `CREATE EXTENSION` (search collections need
+* `pg_trgm`/`unaccent`, applied by `rebase db push` and again by the boot
+* schema-ensure), so the very first `pnpm run db:push` on a scaffolded project
+* with a search block would fail. Trading a working first run for a quieter log
+* line is the wrong trade.
+*
+* The condition is deliberately narrow — a *non-production* process talking to
+* a database on the loopback interface. A genuine production superuser
+* connection still warns, and so does a non-production process pointed at a
+* remote database (the usual "my dev machine writes to staging" mistake, where
+* the advisory is exactly right). NODE_ENV alone would not do: the scaffold
+* ships `NODE_ENV=development` and some deployments inherit it.
+*/
+function isScaffoldedLocalDatabase(connectionString) {
+	if (process.env.NODE_ENV === "production") return false;
+	if (!connectionString) return false;
+	let host;
+	try {
+		host = new URL(connectionString).hostname;
+	} catch {
+		return false;
+	}
+	const bare = host.replace(/^\[|\]$/g, "").toLowerCase();
+	return bare === "localhost" || bare === "::1" || bare === "0.0.0.0" || bare === "" || /^127\./.test(bare) || bare.endsWith(".localhost");
+}
+/**
 * Default PostgreSQL bootstrapper.
 *
 * Use it to register Postgres with `initializeRebaseBackend()`:
@@ -12599,7 +12842,11 @@ function createPostgresBootstrapper(pgConfig) {
 					driver.rlsUserRole = REBASE_USER_ROLE;
 					realtimeService.rlsUserRole = REBASE_USER_ROLE;
 					logger.info(`🔐 RLS enforcement active: authenticated requests run as "${REBASE_USER_ROLE}" (connection "${posture.role}" bypasses RLS: ${posture.superuser ? "superuser" : posture.bypassRLS ? "BYPASSRLS" : "table owner"})`);
-					if (posture.superuser || posture.bypassRLS) logger.warn(`⚠️ The database connection runs as ${posture.superuser ? "a superuser" : "a BYPASSRLS role"} ("${posture.role}"). User requests are isolated via SET LOCAL ROLE, but connect as a non-superuser table-owner role in production so the server/owner context is least-privilege.`);
+					if (posture.superuser || posture.bypassRLS) {
+						const message = `The database connection runs as ${posture.superuser ? "a superuser" : "a BYPASSRLS role"} ("${posture.role}"). User requests are isolated via SET LOCAL ROLE, but connect as a non-superuser table-owner role in production so the server/owner context is least-privilege.`;
+						if (isScaffoldedLocalDatabase(pgConfig.connectionString)) logger.debug(`🔐 ${message}`);
+						else logger.warn(`⚠️ ${message}`);
+					}
 				} else logger.info(`🔐 RLS enforcement: connection role "${posture.role}" is subject to RLS natively; no role switch needed.`);
 				await validatePolicyPgRoles(runSql, registry.getCollections(), driver.rlsUserRole ?? posture.role);
 				warnOnAnonymousGrants(registry.getCollections());
@@ -12819,12 +13066,12 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-DRxaUG96.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-CbvaGuVn.js");
 			const plan = await ensureCollectionTables({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
 			} }, collections, log);
-			for (const failure of plan.failures) logger.warn(`🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
+			for (const failure of plan.failures) logger.warn(failure.kind === "comment-column" ? `🔍 [schema] Could not record the search fingerprint on "${failure.target}" — search works, but a later change to the \`search\` block will not be detected: ${failure.error}` : `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
 			return { applied: plan.actions.length - plan.failures.length };
 		},
 		/**
@@ -12844,15 +13091,18 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-CwYUliAa.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-8vuu-n4r.js");
 			const outcome = await ensureCollectionPolicies({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
 			} }, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
-			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — it stays locked (denies) until this is resolved: ${failure.error}`);
+			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — RLS is on, so it denies until this is resolved: ${failure.error}`);
+			const unrevoked = outcome.unsecured.filter((u) => !u.grantWithdrawn);
+			for (const u of outcome.unsecured.filter((u) => u.grantWithdrawn)) logger.error(`🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. Its privileges have been revoked from ${REBASE_USER_ROLE}, so the table is unreachable rather than unprotected. Reads and writes to that collection will fail until RLS can be enabled.`);
+			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
-				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-Bpv3nUZo.js").then((n) => n.n);
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-69hYT8nr.js").then((n) => n.n);
 				await dropLegacyAuthSchema(async (text) => {
 					return (await internals.db.execute(sql.raw(text))).rows ?? [];
 				}, {
@@ -12869,7 +13119,7 @@ function createPostgresBootstrapper(pgConfig) {
 		},
 		mountRoutes(app, basePath, driverResult) {},
 		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			const { createPostgresWebSocket } = await import("./websocket-D0TBU3ia.js").then((n) => n.n);
+			const { createPostgresWebSocket } = await import("./websocket-C8ZqVBiV.js").then((n) => n.n);
 			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
 		}
 	};
@@ -12909,6 +13159,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, frameByteLength, generateSchema, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, CHANNEL_BUS_NOTIFY_CHANNEL, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, diagnoseRowSecurityDumpFailure, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map