@rebasepro/server-postgres 0.19.1 → 0.19.2-canary.g08eed46

package/dist/index.es.js

@@ -2,28 +2,92 @@ import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
 import { a as createDirectDatabaseConnection, c as guardPoolAgainstDirtyRelease, l as pinSearchPath, o as createPostgresDatabaseConnection, r as cappedPoolMax, s as createReadReplicaConnection, t as DatabasePoolManager, u as poolMaxCeiling } from "./databasePoolManager-Bj5FbeAs.js";
-import { a as generatePostgresVectorDdl, g as SEARCH_UNACCENT_FN, i as generatePostgresSearchDdl, n as generatePostgresDdl, p as resolveColumnName, r as generatePostgresPoliciesDdl, v as buildSearchColumnSpec, w as visibleColumnProjection, y as hiddenColumnsOption } from "./generate-postgres-ddl-logic-CtnpIBVv.js";
-import { a as isEconnrefused, c as classifyConnectFailure, d as isRoleSwitchingPermissionError, f as isRowLevelSecurityDenial, h as sanitizeErrorForClient, i as diagnoseDbError, l as extractCauseMessage, m as reachedDatabase, n as deepestErrorMessage, o as parseHostInfo, p as pgErrorToFriendlyMessage, u as extractPgError } from "./cli-errors-DxN4yzdH.js";
-import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-ByLfM_Tt.js";
-import { c as warnOnLegacyRlsFunctions, i as ensureAppRole, l as warnOnRoleSchemaCollision, n as applyAuthContext, o as validatePolicyPgRoles, r as detectConnectionPosture, s as warnOnAnonymousGrants, t as REBASE_USER_ROLE } from "./rls-enforcement-DeYEjYLt.js";
-import { n as getDrizzleColumn, t as generateSchema } from "./generate-drizzle-schema-logic-so2Z_lyC.js";
-import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-D4wJzM4y.js";
-import { t as main } from "./generate-drizzle-schema-CwEgVyjO.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-Br3tqwsy.js";
-import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-CIojK-Rx.js";
+import { f as hiddenColumnsOption, l as SEARCH_UNACCENT_FN, m as searchColumnNames, o as sharedRelationName, u as buildSearchColumnSpec, x as visibleColumnProjection } from "./plan-schema-Hgl62S-w.js";
+import { d as extractPgError, f as isRoleSwitchingPermissionError, g as sanitizeErrorForClient, h as reachedDatabase, i as diagnoseDbError, l as classifyConnectFailure, m as pgErrorToFriendlyMessage, n as deepestErrorMessage, o as isEconnrefused, p as isRowLevelSecurityDenial, s as parseHostInfo, u as extractCauseMessage } from "./cli-errors-C3g_kHBw.js";
+import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-W3DMfcZZ.js";
+import { c as warnOnLegacyRlsFunctions, i as ensureAppRole, l as warnOnRoleSchemaCollision, n as applyAuthContext, o as validatePolicyPgRoles, r as detectConnectionPosture, s as warnOnAnonymousGrants, t as REBASE_USER_ROLE } from "./rls-enforcement-BV12vBwQ.js";
+import { l as resolveColumnName } from "./column-plan-helpers-CpILzHJS.js";
+import { i as isAuthCollection, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
+import { a as generatePostgresVectorDdl, i as generatePostgresTriggersDdl, n as generatePostgresPoliciesDdl, r as generatePostgresSearchDdl, t as generatePostgresDdl } from "./generate-postgres-ddl-logic-CR2xcS7e.js";
+import { t as generateSchema } from "./generate-drizzle-schema-logic-Dfyf_MRu.js";
+import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-Bkvehxdm.js";
+import { t as main } from "./generate-drizzle-schema-vSK-VdYT.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-DA7a6SUV.js";
+import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-CYMtuuOd.js";
 import { c as identifyJoinTables, d as singularize, h as humanize, i as buildTablesMap, m as mapPgType, r as buildEnumMap, s as getIconForTable } from "./introspect-db-logic-C6LQdTxj.js";
 import { Client } from "pg";
-import { ApiError, assertWriteRequestValid, createDdlBootstrapper, createEmailService, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveRequireAuth, safeCompare } from "@rebasepro/server";
-import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isNotNull, isNull, isTable, lt, notInArray, or, relations, sql } from "drizzle-orm";
-import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, ListLimitError, Vector, declaredDatabaseExtensions, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, parseRelationAggregateSort, resolveClientListLimit } from "@rebasepro/types";
-import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, classifyTable, createRelationRef, createRelationRefWithData, detectJunctionTables, fieldKeyForColumn, findRelation, getColumnName, getDeclaredPrimaryKeys, getTableName as getTableName$1, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeToEntityRelation, parseIdValues, parseOrderBySpecStrict, resolveCollectionRelations, revokeInternalTableSql, toCallbackError, toFilterTuples, updateDateAutoValues } from "@rebasepro/common";
+import { ApiError, assertFieldOpsValid, assertWriteRequestValid, createDdlBootstrapper, createEmailService, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveBatchRefs, resolveRequireAuth, safeCompare, splitFieldOps } from "@rebasepro/server";
+import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isNotNull, isNull, isTable, lt, not, notInArray, or, relations, sql } from "drizzle-orm";
+import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, declaredDatabaseExtensions, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, parseRelationAggregateSort, resolveClientListLimit } from "@rebasepro/types";
+import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createRelationRef, createRelationRefWithData, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, getColumnName, getDeclaredPrimaryKeys, getJunctionCollectionConfig, getTableName as getTableName$1, getTenantConfig, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseOrderBySpecStrict, resolveCollectionRelations, resolveJunctionSpecs, resolveTenantWrite, revokeInternalTableSql, tenantBypassRoles, toCallbackError, toFilterTuples, updateDateAutoValues, updateUserAutoValues } from "@rebasepro/common";
 import { camelCase, firstFreeKey, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, mergeDeep, toSnakeCase, toWireKey } from "@rebasepro/utils";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { PgArray, PgNumeric, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs from "fs";
 import { WebSocket, WebSocketServer } from "ws";
 import { EventEmitter } from "events";
 import { randomUUID } from "crypto";
 import { inspect } from "util";
+//#region src/services/field-viewer.ts
+/**
+* Who the current read is *for*, available to the row walk without threading it
+* through every read signature.
+*
+* Per-field `access.read` has to be applied wherever a row leaves this driver,
+* and that is not one place: a REST list, a single get, a relation target
+* inlined into a parent, the same target rendered as an admin ref, a realtime
+* frame, a history entry. The row pipeline is the one function they all share —
+* and it is reached through `FetchService`, `RelationService` and `DataService`,
+* none of which carry a user. Threading one through would be a parameter added
+* to a dozen signatures and forgotten on the thirteenth, which is precisely how
+* `stripExcluded` came to be missing from the relation-ref branch for a year.
+*
+* So the viewer is ambient, established at the two places that already
+* establish the *database's* auth context for a read — `applyAuthContext` is
+* called on the same line in both:
+*
+*  - `AuthenticatedPostgresBackendDriver.withTransaction`, which every REST,
+*    SDK and WebSocket read runs inside;
+*  - `RealtimeService`'s RLS-bound refetches, which build the frames a
+*    subscriber receives.
+*
+* Deliberately `run()` and not `enterWith()`. `enterWith` persists past the call
+* that made it, so a `rebase.dataAsAdmin` read inside a user's request — a
+* `beforeSave` hook, an `afterRead` hook — would leave the admin viewer in place
+* for the rest of that request and strip nothing from what the user is served.
+*
+* @module
+*/
+/**
+* `undefined` inside the store is meaningful and is not the same as no store at
+* all: {@link FieldViewer} reads absence as the trusted server plane. Nothing
+* currently stores `undefined`, but the store's type says the difference is
+* carried rather than flattened.
+*/
+var storage = new AsyncLocalStorage();
+/**
+* Run `fn` with `viewer` as the caller every row strip judges against.
+*
+* Nested calls shadow: a `dataAsAdmin` read inside a user request runs under the
+* service identity for its duration and the user's viewer is restored after it,
+* which is the behaviour both halves need and the reason this is not a variable.
+*/
+function withFieldViewer(viewer, fn) {
+	return storage.run(viewer, fn);
+}
+/**
+* The caller the current read is for, or `undefined` on the trusted server plane
+* — an in-process `rebase.data` call on the base driver, a migration, the auth
+* adapter reading a password hash to verify it.
+*
+* Absence cannot be reached from outside: every API ingress scopes its driver
+* with `withAuth`, including an unauthenticated one (`roles: ["anon"]`), and
+* that is what establishes the viewer.
+*/
+function currentFieldViewer() {
+	return storage.getStore();
+}
+//#endregion
 //#region src/services/collection-helpers.ts
 /** Safely extract Drizzle column metadata from a column object. */
 function getColumnMeta(col) {
@@ -55,6 +119,25 @@ function idCanAddressTable(id, table, idInfoArray) {
 		};
 	}));
 }
+/**
+* The columns of a table's composite primary-key constraint, or `[]`.
+*
+* Fails open for anything that is not a real Drizzle table — a test double, a
+* hand-built registry entry — because "no key" is a legitimate answer here and
+* throwing would take out every caller that only wanted to ask.
+*/
+function compositePrimaryKeyColumns(table) {
+	try {
+		return getTableConfig(table).primaryKeys?.[0]?.columns ?? [];
+	} catch {
+		return [];
+	}
+}
+/** The Drizzle key a column is registered under, falling back to its name. */
+function columnFieldName(table, column) {
+	for (const [key, candidate] of Object.entries(getTableColumns(table))) if (candidate === column) return key;
+	return column.name;
+}
 function getCollectionByPath(collectionPath, registry) {
 	const collection = registry.getCollectionByPath(collectionPath);
 	if (!collection) {
@@ -66,6 +149,14 @@ function getCollectionByPath(collectionPath, registry) {
 /**
 * Reject a write naming something that is not a column of the table.
 *
+* "The table" is the one read back from `information_schema` at boot — see
+* `catalogue-schema.ts` — so this asks the database, not a file. It used to ask
+* the generated module, which made the commonest cause of this error a stale
+* `schema.generated.ts`: a property added to a collection was created in the
+* database by boot-ensure and still answered `400` on its first save, because
+* the module had not been regenerated. That cause no longer exists, and the
+* remedy below no longer names it.
+*
 * Drizzle builds INSERT from `Object.entries(table[Symbol.Columns])` and UPDATE
 * from `Object.keys(tableColumns)`, so a key the table does not carry is not
 * rejected by anything — it is *left out of the statement*. The insert answers
@@ -93,7 +184,14 @@ function assertWritableColumns(values, table, collectionPath) {
 	if (!columns || Object.keys(columns).length === 0) return;
 	const unknown = Object.keys(values).filter((key) => !(key in columns));
 	if (unknown.length === 0) return;
-	throw ApiError.badRequest(`'${collectionPath}' has no column${unknown.length > 1 ? "s" : ""} ${unknown.map((key) => `'${key}'`).join(", ")}, so the value${unknown.length > 1 ? "s" : ""} would have been dropped before the statement was built. If you just added the propert` + (unknown.length > 1 ? "ies" : "y") + ", the generated schema is behind the collection: run `rebase schema generate`.", "VALIDATION_UNKNOWN_FIELDS");
+	const byColumnName = /* @__PURE__ */ new Map();
+	for (const [key, column] of Object.entries(columns)) {
+		const name = column?.name;
+		if (typeof name === "string" && name !== key) byColumnName.set(name, key);
+	}
+	const misspelled = unknown.filter((key) => byColumnName.has(key));
+	if (misspelled.length === unknown.length) throw ApiError.badRequest(`'${collectionPath}' has no field ${misspelled.map((key) => `'${key}'`).join(", ")} — ${misspelled.length > 1 ? "those are column names" : "that is a column name"}. Write ${misspelled.map((key) => `'${byColumnName.get(key)}'`).join(", ")} instead: a field is addressed by its property key, and the column behind it is an implementation detail.`, "VALIDATION_UNKNOWN_FIELDS");
+	throw ApiError.badRequest(`'${collectionPath}' has no column${unknown.length > 1 ? "s" : ""} ${unknown.map((key) => `'${key}'`).join(", ")}, so the value${unknown.length > 1 ? "s" : ""} would have been dropped before the statement was built. If you just added the propert` + (unknown.length > 1 ? "ies" : "y") + ", the database does not have the column yet: apply the schema (`rebase db push`, or redeploy so boot creates it).", "VALIDATION_UNKNOWN_FIELDS");
 }
 /**
 * A relation whose names do not resolve against the registered schema.
@@ -122,10 +220,16 @@ function getTableForCollection(collection, registry) {
 * The key columns a collection's rows are addressed by.
 *
 * Three tiers, in order: properties marked `isId`, the primary keys of the
-* drizzle schema, and finally a column literally named `id`. Only the first is
-* visible to the browser, which is why a key known only to drizzle is reported
+* registered table, and finally a column literally named `id`. Only the first is
+* visible to the browser, which is why a key known only to the table is reported
 * at boot — see {@link warnOnKeysTheAdminCannotResolve}.
 *
+* The second tier reads the table the registry holds, which is built from
+* `information_schema` — the database's own primary key, not a generated file's
+* claim about it. Composite keys are declared as a table constraint rather than
+* on each column (that is the only legal way to say it), so both shapes are
+* asked for.
+*
 * Returns `[]` when nothing resolves, rather than throwing. It used to open by
 * resolving the table, which throws when there is none — so the `isId` tier,
 * which needs no table at all, was unreachable for exactly the collections
@@ -162,6 +266,14 @@ function getPrimaryKeys(collection, registry) {
 			});
 		}
 	}
+	if (keys.length === 0) for (const column of compositePrimaryKeyColumns(table)) {
+		const meta = getColumnMeta(column);
+		keys.push({
+			fieldName: columnFieldName(table, column),
+			type: column.dataType === "number" || meta.columnType === "PgSerial" || meta.columnType === "PgInteger" ? "number" : "string",
+			isUUID: meta.columnType === "PgUUID"
+		});
+	}
 	if (keys.length === 0 && "id" in table) {
 		const idCol = table["id"];
 		const idMeta = getColumnMeta(idCol);
@@ -780,7 +892,10 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		if ("type" in cond) {
 			const subSQLs = cond.conditions.map((c) => this.buildLogicalConditions(c, table, collectionPath, options)).filter((sql) => sql !== null);
 			if (subSQLs.length === 0) return null;
-			return (cond.type === "or" ? or(...subSQLs) : and(...subSQLs)) ?? null;
+			if (cond.type === "or") return or(...subSQLs) ?? null;
+			const conjunction = and(...subSQLs) ?? null;
+			if (cond.type === "not") return conjunction ? not(conjunction) : null;
+			return conjunction;
 		} else {
 			const target = this.resolveFilterTarget(table, cond.column, collectionPath, options.unknownFields ?? defaultUnknownFilterFieldsMode, options);
 			if (!target) return null;
@@ -1596,8 +1711,10 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		const ftsCondition = collection ? DrizzleConditionBuilder.buildFullTextCondition(searchString, table, collection) : void 0;
 		if (ftsCondition) return [ftsCondition];
 		let declaredStringProperties = 0;
+		const viewer = currentFieldViewer();
 		for (const [key, prop] of Object.entries(properties)) {
 			const p = prop;
+			if (!canReadField(prop, viewer)) continue;
 			if (p.type === "string" && !p.enum && p.isId !== "uuid") {
 				declaredStringProperties++;
 				const fieldColumn = table[key];
@@ -2420,42 +2537,101 @@ function coerceDeclaredNumber(value, property) {
 	const parsed = parseFloat(value);
 	return isNaN(parsed) ? null : parsed;
 }
-/** Apply {@link coerceDeclaredNumber} across a row, leaving every other column alone. */
-function coerceDeclaredNumbers(row, collection) {
+/**
+* Serve a `date` column as the timestamp this API says it serves.
+*
+* The OpenAPI document this server publishes types a `date` property as
+* `string, format: date-time` — RFC 3339 — and node-postgres hands over the
+* Postgres literal: `"2026-08-24 01:37:57.647+02"`, with a space where the `T`
+* belongs and a two-digit offset. V8 parses that by accident; Safari's
+* `new Date()` does not have to, and the spec never promised it. A column whose
+* documented type only parses in some browsers is not a contract.
+*
+* A date-only column (`mode: "date"`, `format: "date"` in the spec) is already
+* RFC 3339 as `YYYY-MM-DD` and is left alone — widening it to a timestamp would
+* invent a time of day and a timezone the column does not have.
+*/
+function toRestDate(value) {
+	if (value instanceof Date) return isNaN(value.getTime()) ? null : value.toISOString();
+	if (value && typeof value === "object" && value.__type === "date") return value.value ?? null;
+	if (typeof value !== "string" && typeof value !== "number") return value;
+	if (typeof value === "string" && /^\d{4}-\d{2}-\d{2}$/.test(value)) return value;
+	const date = new Date(value);
+	return isNaN(date.getTime()) ? value : date.toISOString();
+}
+/**
+* One scalar, as REST serves it: declared numbers as numbers, declared dates as
+* RFC 3339, everything else exactly as the database returned it.
+*/
+function toRestScalar(value, property) {
+	if (property?.type === "date") return toRestDate(value);
+	return coerceDeclaredNumber(value, property);
+}
+/**
+* Apply {@link toRestScalar} across a row, leaving undeclared columns alone.
+*
+* Exported because the include loader attaches related rows itself, and a
+* target rendered differently from its parent is the shape bug this whole file
+* exists to prevent — a date was a string at the top level and a
+* `{ __type: "date" }` envelope one level down, in the same response.
+*/
+function toRestValues(row, collection) {
 	const properties = collection.properties;
 	if (!properties) return row;
 	const out = {};
-	for (const [key, value] of Object.entries(row)) out[key] = coerceDeclaredNumber(value, properties[key]);
+	for (const [key, value] of Object.entries(row)) out[key] = toRestScalar(value, properties[key]);
 	return out;
 }
 /** Render one target row in the requested style. */
 /**
-* Drop every column the collection marked `excludeFromApi`.
+* Drop every column this caller may not read.
 *
 * Password hashes and verification tokens have to be readable server-side but
 * must never reach a client — and "never" has to mean every exit from this
 * pipeline, including relation targets, or a secret leaks through whichever
 * path was overlooked. Keyed by both the property name and its column name,
 * since a row can arrive keyed either way depending on the caller.
+*
+* `excludeFromApi` is the case with no roles in it: `effectiveAccess` expands
+* the flag to `read: []`, which no caller satisfies, so the flag needs no branch
+* of its own here and no longer has one. `access.read: ["hr"]` is the same walk
+* asking a different question of {@link currentFieldViewer}.
+*
+* The field is **deleted**, never nulled. A withheld value that arrives as
+* `null` is indistinguishable from a stored `null`, which turns a permission
+* boundary into a question a client can answer by counting nulls — and it makes
+* an `update` that echoes the row back overwrite the real value with the null it
+* was handed.
+*
+* `_matches` is filtered rather than deleted: it is the list of fields a text
+* search hit, and a field the caller cannot read must not appear in it even
+* though the array itself is theirs to see.
 */
-function stripExcluded(row, collection) {
+function stripUnreadable(row, collection) {
 	const properties = collection.properties;
 	if (!properties) return row;
+	const viewer = currentFieldViewer();
+	const hidden = /* @__PURE__ */ new Set();
 	for (const [key, property] of Object.entries(properties)) {
-		if (!property?.excludeFromApi) continue;
+		if (canReadField(property, viewer)) continue;
+		hidden.add(key);
 		delete row[key];
-		if (property.columnName) delete row[property.columnName];
+		if (property.columnName) {
+			hidden.add(property.columnName);
+			delete row[property.columnName];
+		}
 	}
+	if (hidden.size > 0 && Array.isArray(row._matches)) row._matches = row._matches.filter((match) => !hidden.has(typeof match === "string" ? match : String(match?.field)));
 	return row;
 }
 function renderTarget(targetRow, targetCollection, style, registry) {
-	if (style === "inline") return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
+	if (style === "inline") return stripUnreadable(toRestValues({ ...targetRow }, targetCollection), targetCollection);
 	const address = relationTargetAddress(targetRow, targetCollection, registry);
 	const path = targetCollection.slug;
 	return createRelationRefWithData(address, path, {
 		id: address,
 		path,
-		values: stripExcluded(normalizeDbValues(targetRow, targetCollection), targetCollection)
+		values: stripUnreadable(normalizeDbValues(targetRow, targetCollection), targetCollection)
 	});
 }
 /**
@@ -2491,7 +2667,7 @@ function toFlatRow(row, collection, registry) {
 			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, targetCollection, "ref", registry));
 		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
 	}
-	return stripExcluded(normalized, collection);
+	return stripUnreadable(normalized, collection);
 }
 /**
 * The row REST serves: every column under its own name, with the value Postgres
@@ -2499,9 +2675,9 @@ function toFlatRow(row, collection, registry) {
 *
 * Values are the ones the database returned, except where that contradicts the
 * declared type: a `number` property is served as a number (see
-* {@link coerceDeclaredNumber}). Dates stay as the database returned them —
-* JSON has its own opinions about dates that the admin's view-model does not
-* share.
+* {@link coerceDeclaredNumber}) and a `date` as RFC 3339, which is what this
+* server's own OpenAPI document says a date column is (see
+* {@link toRestDate}).
 *
 * Keyed by the row rather than by the relation list — a REST fetch only loads
 * the relations `include` asked for, so the row is the authority on which are
@@ -2514,9 +2690,9 @@ function toRestRow(row, collection, registry) {
 		const relation = findRelation(resolvedRelations, key);
 		if (relation && Array.isArray(value)) flat[key] = value.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, relation.target(), "inline", registry));
 		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
-		else flat[key] = coerceDeclaredNumber(value, collection.properties?.[key]);
+		else flat[key] = toRestScalar(value, collection.properties?.[key]);
 	}
-	return stripExcluded(flat, collection);
+	return stripUnreadable(flat, collection);
 }
 //#endregion
 //#region src/services/write-denial.ts
@@ -2690,6 +2866,73 @@ async function removeLinks(tx, binding, parentId, removed) {
 	if ((await tx.select({ present: sql`1` }).from(binding.table).where(and(...conditions)).limit(1)).length === 0) return;
 	throw ApiError.forbidden(`Not allowed to remove ${removed.length - deleted} of ${removed.length} link(s) for relation '${binding.label}': a row-level security policy rejected the write.`, "WRITE_DENIED");
 }
+/**
+* The soft-delete field this collection uses, or `undefined` if it has none.
+*
+* Returns the field even when the property is missing, because the *boot* check
+* is what refuses that config; making this return `undefined` for it would turn
+* a misconfiguration into "soft delete quietly off", which is the failure mode
+* worth avoiding — deletes would silently start removing rows.
+*/
+function resolveSoftDelete(collection) {
+	const declared = collection?.softDelete;
+	if (!declared) return void 0;
+	const field = typeof declared === "object" && declared.field || "deletedAt";
+	return {
+		field,
+		columnName: ((collection?.properties)?.[field])?.columnName ?? toSnakeCase(field)
+	};
+}
+/**
+* The drizzle column behind the soft-delete field, if the table has one.
+*
+* Matched on the column's own `name` rather than on the key, because a
+* generated schema keys columns by the property name while an introspected one
+* may key them by the column — and this has to work for both.
+*/
+function softDeleteColumn(collection, table) {
+	const resolved = resolveSoftDelete(collection);
+	if (!resolved) return void 0;
+	const columns = table ? getTableColumns(table) : void 0;
+	if (!columns) return void 0;
+	const direct = columns[resolved.field] ?? columns[resolved.columnName];
+	if (direct) return direct;
+	for (const column of Object.values(columns)) if (column.name === resolved.columnName) return column;
+}
+/**
+* `deleted_at IS NULL` — or nothing, when the caller asked for the deleted rows
+* or the collection has no soft delete at all.
+*
+* The one place the rule is written. Call it from every read; `undefined` means
+* "add no condition", which composes with `and(...)` unchanged.
+*/
+function softDeleteCondition(collection, table, withDeleted) {
+	if (withDeleted === true) return void 0;
+	const column = softDeleteColumn(collection, table);
+	if (!column) return void 0;
+	return withDeleted === "only" ? isNotNull(column) : isNull(column);
+}
+/**
+* Fold the soft-delete condition into a list of conditions that is being built.
+*
+* A convenience for the call sites that already collect `SQL[]`, so adding soft
+* delete to one of them is a single line rather than three.
+*/
+function withSoftDelete(conditions, collection, table, withDeleted) {
+	const condition = softDeleteCondition(collection, table, withDeleted);
+	if (condition) conditions.push(condition);
+	return conditions;
+}
+/**
+* Combine an existing `where` with the soft-delete condition.
+*
+* For the call sites that hold one composed condition rather than a list.
+*/
+function andSoftDelete(where, collection, table, withDeleted) {
+	const condition = softDeleteCondition(collection, table, withDeleted);
+	if (!condition) return where;
+	return where ? and(where, condition) : condition;
+}
 //#endregion
 //#region src/services/RelationService.ts
 /**
@@ -2710,6 +2953,17 @@ function applyDynamicRelationQuery(query, ...args) {
 	return DrizzleConditionBuilder.buildRelationQuery(...args);
 }
 /**
+* The relation's own matching condition, AND-ed with an include's `where`.
+*
+* Written once because the batch loaders reach the same decision from six
+* places — one per relation kind, twice over for the to-one and to-many
+* variants — and a `where` dropped from one of them is a filter the caller
+* asked for that silently did not apply.
+*/
+function narrowed(base, narrow) {
+	return narrow ? and(base, narrow) : base;
+}
+/**
 * The registry has no table for a collection a relation just asked about.
 *
 * "Parent table not found" was the whole message, four times over, and it names
@@ -2746,7 +3000,7 @@ var RelationService = class {
 	*/
 	async toRelatedRow(targetRow, targetCollection, targetPks, options) {
 		const values = options?.resolveNested ? await parseDataFromServer(targetRow, targetCollection, this.db, this.registry) : await parseDataFromServer(targetRow, targetCollection);
-		stripExcluded(values, targetCollection);
+		stripUnreadable(values, targetCollection);
 		return {
 			id: buildCompositeId$1(targetRow, targetPks),
 			path: targetCollection.slug,
@@ -2913,6 +3167,8 @@ var RelationService = class {
 		if (matchValue === void 0) return [];
 		let query = this.db.select().from(targetTable).$dynamic();
 		const additionalFilters = [];
+		const relatedSoftDelete = softDeleteCondition(targetCollection, targetTable);
+		if (relatedSoftDelete) additionalFilters.push(relatedSoftDelete);
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, targetCollection.properties, targetTable, targetCollection);
 			if (searchConditions.length === 0) return [];
@@ -2965,6 +3221,8 @@ var RelationService = class {
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
 		const matchValue = hasForeignKeyOnTarget(relation) ? (await this.resolveSourceKeys(parentCollection, relation, [parentId])).keyByParentId.get(String(parentId)) : parsedParentId;
 		if (matchValue === void 0) return 0;
+		const countSoftDelete = softDeleteCondition(targetCollection, targetTable);
+		if (countSoftDelete) additionalFilters = [...additionalFilters, countSoftDelete];
 		let query = this.db.select({ count: sql`count(distinct ${targetIdField})` }).from(targetTable).$dynamic();
 		query = DrizzleConditionBuilder.buildRelationCountQuery(query, relation, matchValue, targetTable, parentTable, parentIdCol, targetIdField, this.registry, additionalFilters);
 		const result = await query;
@@ -2990,9 +3248,14 @@ var RelationService = class {
 		return await this.countRelatedRows(hop.parentCollection, hop.parentId, hop.relation, identity) > 0;
 	}
 	/**
-	* Batch fetch related rows for multiple parent rows to avoid N+1 queries
+	* Batch fetch related rows for multiple parent rows to avoid N+1 queries.
+	*
+	* `narrow` is an extra condition on the *target* table — what a per-include
+	* `where` compiles to. It is pushed into the query rather than applied to
+	* the rows that come back, because filtering afterwards reads every related
+	* row of every parent in order to discard most of them.
 	*/
-	async batchFetchRelatedEntities(parentCollectionPath, parentIds, _relationKey, relation) {
+	async batchFetchRelatedEntities(parentCollectionPath, parentIds, _relationKey, relation, narrow) {
 		if (parentIds.length === 0) return /* @__PURE__ */ new Map();
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
@@ -3007,6 +3270,7 @@ var RelationService = class {
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
 		const parsedParentIds = parentIds.map((id) => parseIdValues(id, parentPks)[parentIdInfo.fieldName]);
+		const narrowTarget = andSoftDelete(narrow, targetCollection, targetTable);
 		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
 			let currentTable = parentTable;
@@ -3025,7 +3289,7 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
+			query = query.where(narrowed(this.parentKeyCondition(parentTable, parentPks, parentIds), narrowTarget));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
@@ -3057,7 +3321,7 @@ var RelationService = class {
 				}
 			}
 			if (uniqueFkValues.length === 0) return /* @__PURE__ */ new Map();
-			const targetResults = await this.db.select().from(targetTable).where(inArray(targetIdField, uniqueFkValues));
+			const targetResults = await this.db.select().from(targetTable).where(narrowed(inArray(targetIdField, uniqueFkValues), narrowTarget));
 			const targetById = /* @__PURE__ */ new Map();
 			for (const row of targetResults) {
 				const tid = String(row[targetIdInfo.fieldName]);
@@ -3078,7 +3342,7 @@ var RelationService = class {
 		const matchValues = hasForeignKeyOnTarget(relation) ? [...keyByParentId.values()] : parsedParentIds;
 		if (matchValues.length === 0) return /* @__PURE__ */ new Map();
 		let query = this.db.select().from(targetTable).$dynamic();
-		query = applyDynamicRelationQuery(query, query, relation, matchValues, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
+		query = applyDynamicRelationQuery(query, query, relation, matchValues, targetTable, parentTable, parentIdCol, targetIdField, this.registry, narrowTarget ? [narrowTarget] : []);
 		const results = await query;
 		const resultMap = /* @__PURE__ */ new Map();
 		for (const row of results) {
@@ -3096,7 +3360,7 @@ var RelationService = class {
 	* Returns a Map<parentId, RelatedRow[]> instead of Map<parentId, RelatedRow>.
 	* Uses a single SQL query with IN clause to avoid N+1.
 	*/
-	async batchFetchRelatedEntitiesMany(parentCollectionPath, parentIds, _relationKey, relation) {
+	async batchFetchRelatedEntitiesMany(parentCollectionPath, parentIds, _relationKey, relation, narrow) {
 		if (parentIds.length === 0) return /* @__PURE__ */ new Map();
 		const parentCollection = getCollectionByPath(parentCollectionPath, this.registry);
 		const targetCollection = relation.target();
@@ -3110,6 +3374,7 @@ var RelationService = class {
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
 		const parsedParentIds = parentIds.map((id) => parseIdValues(id, parentPks)[parentIdInfo.fieldName]);
+		const narrowTarget = andSoftDelete(narrow, targetCollection, targetTable);
 		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
 			let currentTable = parentTable;
@@ -3126,7 +3391,7 @@ var RelationService = class {
 				query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
 				currentTable = joinTable;
 			}
-			query = query.where(this.parentKeyCondition(parentTable, parentPks, parentIds));
+			query = query.where(narrowed(this.parentKeyCondition(parentTable, parentPks, parentIds), narrowTarget));
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
 			const resultMap = /* @__PURE__ */ new Map();
@@ -3143,7 +3408,7 @@ var RelationService = class {
 		if (relation.kind === "manyToMany") {
 			this.assertSingleKeyAddressable(parentCollection, parentPks, `${relation.through.table}.${relation.through.sourceColumn}`);
 			const { table: junctionTable, parentColumn: sourceJunctionCol, targetColumn: targetJunctionCol } = bindThroughJunction(this.registry, relation.through, `${parentCollection.slug}.${relation.relationName}`);
-			const results = await this.db.select().from(junctionTable).innerJoin(targetTable, eq(targetJunctionCol, targetIdField)).where(inArray(sourceJunctionCol, parsedParentIds));
+			const results = await this.db.select().from(junctionTable).innerJoin(targetTable, eq(targetJunctionCol, targetIdField)).where(narrowed(inArray(sourceJunctionCol, parsedParentIds), narrowTarget));
 			const resultMap = /* @__PURE__ */ new Map();
 			const targetTableName = getTableName$1(targetCollection);
 			for (const row of results) {
@@ -3164,7 +3429,7 @@ var RelationService = class {
 		const matchValues = hasForeignKeyOnTarget(relation) ? [...keyByParentId.values()] : parsedParentIds;
 		if (matchValues.length === 0) return /* @__PURE__ */ new Map();
 		let query = this.db.select().from(targetTable).$dynamic();
-		query = applyDynamicRelationQuery(query, query, relation, matchValues, targetTable, parentTable, parentIdCol, targetIdField, this.registry, []);
+		query = applyDynamicRelationQuery(query, query, relation, matchValues, targetTable, parentTable, parentIdCol, targetIdField, this.registry, narrowTarget ? [narrowTarget] : []);
 		const results = await query;
 		const resultMap = /* @__PURE__ */ new Map();
 		for (const row of results) {
@@ -3262,6 +3527,28 @@ function assertWritableThrough(hop, path) {
 //#endregion
 //#region src/services/FetchService.ts
 /**
+* Ascending comparison for two values of one column, with NULLs placed.
+*
+* Used only to order the rows *inside* one included relation, where the sort
+* happens after a batched load rather than in SQL — see
+* {@link FetchService.shapeRelatedRows}. The NULL placement is the same
+* question the `ORDER BY` answers, and it is answered the same way here so a
+* nested `orderBy` does not put its empty values at the opposite end from the
+* identical top-level one.
+*/
+function compareForSort(a, b, nullsLast) {
+	const aNull = a === null || a === void 0;
+	const bNull = b === null || b === void 0;
+	if (aNull && bNull) return 0;
+	if (aNull) return nullsLast ? 1 : -1;
+	if (bNull) return nullsLast ? -1 : 1;
+	const av = a instanceof Date ? a.getTime() : a;
+	const bv = b instanceof Date ? b.getTime() : b;
+	if (typeof av === "number" && typeof bv === "number") return av - bv;
+	if (typeof av === "boolean" && typeof bv === "boolean") return (av ? 1 : 0) - (bv ? 1 : 0);
+	return String(av).localeCompare(String(bv));
+}
+/**
 * Service for handling all row read operations.
 * Handles fetching, searching, counting, and filtering rows.
 */
@@ -3391,12 +3678,13 @@ var FetchService = class FetchService {
 	*/
 	resolveOrderKeys(table, keys, collection, searchString, collectionPath, cursorId) {
 		const resolved = [];
-		for (const [field, direction] of keys) {
+		for (const [field, direction, nulls] of keys) {
 			const aggregate = this.resolveAggregateOrderTarget(table, field, collection, collectionPath);
 			if (aggregate) {
 				resolved.push({
 					field,
 					direction,
+					nulls,
 					target: aggregate,
 					...cursorId !== void 0 && { cursorTarget: this.resolveAggregateOrderTarget(table, field, collection, collectionPath, cursorId) }
 				});
@@ -3406,12 +3694,31 @@ var FetchService = class FetchService {
 			if (target) resolved.push({
 				field,
 				direction,
+				nulls,
 				target
 			});
 		}
 		return resolved;
 	}
 	/**
+	* Whether this key's NULLs sort *after* its real values.
+	*
+	* The default is Postgres's own — `NULLS LAST` ascending, `NULLS FIRST`
+	* descending — and it was previously hardcoded in two places that had to
+	* agree: the `ORDER BY` and the keyset comparison behind cursor paging. A
+	* key that states a placement overrides it, in both, because they read the
+	* answer from here.
+	*
+	* The default is also the thing a "newest first" list gets wrong: every row
+	* with no date sorts to the very top, ahead of everything real, and the only
+	* way out used to be an `is-not-null` filter that dropped those rows
+	* entirely. `orderBy: [["published_at", "desc", "last"]]` is the fix.
+	*/
+	static nullsLast(key) {
+		if (key.nulls) return key.nulls === "last";
+		return key.direction === "asc";
+	}
+	/**
 	* The full `ORDER BY`: the caller's keys, then the id.
 	*
 	* The id is always last and always descending. It is not decoration — it is
@@ -3431,9 +3738,13 @@ var FetchService = class FetchService {
 	* relation reaches nothing from, which is precisely the "nobody waiting"
 	* end of a queue.
 	*/
-	buildOrderExpressions(keys, idField) {
-		const expressions = keys.map(({ direction, target }) => direction === "asc" ? sql`${target} ASC NULLS LAST` : sql`${target} DESC NULLS FIRST`);
-		expressions.push(desc(idField));
+	buildOrderExpressions(keys, idField, tieBreakOnId = true) {
+		const expressions = keys.map((key) => {
+			const nullsLast = FetchService.nullsLast(key);
+			if (key.direction === "asc") return nullsLast ? sql`${key.target} ASC NULLS LAST` : sql`${key.target} ASC NULLS FIRST`;
+			return nullsLast ? sql`${key.target} DESC NULLS LAST` : sql`${key.target} DESC NULLS FIRST`;
+		});
+		if (tieBreakOnId) expressions.push(desc(idField));
 		return expressions;
 	}
 	resolveOrderByField(table, orderBy, collection) {
@@ -3510,6 +3821,240 @@ var FetchService = class FetchService {
 		return null;
 	}
 	/**
+	* The relations one level of an include tree names, resolved.
+	*
+	* A name that is not a relation is a **400 `UNKNOWN_RELATION`**. It used to
+	* be dropped silently, which answers 200 with the field missing — and a
+	* missing relation field is indistinguishable from a row that genuinely has
+	* no related row, so a typo in an `include` looked like empty data.
+	*/
+	resolveIncludeLevel(collection, tree, wildcard) {
+		const resolvedRelations = resolveCollectionRelations(collection);
+		const out = [];
+		if (wildcard) for (const [key, relation] of Object.entries(resolvedRelations)) out.push({
+			key,
+			node: tree[key] ?? { children: {} },
+			relation
+		});
+		for (const [key, node] of Object.entries(tree)) {
+			if (wildcard && key in resolvedRelations) continue;
+			const relation = resolvedRelations[key];
+			if (!relation) {
+				const known = Object.keys(resolvedRelations).sort();
+				throw ApiError.badRequest(`Unknown relation '${key}' on collection '${collection.slug ?? collection.name}'` + (known.length > 0 ? `. Its relations are: ${known.join(", ")}` : ". It declares no relations."), "UNKNOWN_RELATION", {
+					relation: key,
+					collection: collection.slug ?? collection.name,
+					...known.length > 0 && { validRelations: known }
+				});
+			}
+			out.push({
+				key,
+				node,
+				relation
+			});
+		}
+		return out;
+	}
+	/**
+	* The extra `WHERE` an include's own `where`/`logical` puts on the target.
+	*
+	* Pushed into the batch query rather than applied to the rows it returns:
+	* filtering afterwards reads every related row of every parent to throw
+	* most of them away, and on a to-many relation that is the whole table.
+	*/
+	includeNarrowing(node, targetCollection) {
+		if (!node.where && !node.logical) return void 0;
+		const targetPath = targetCollection.slug;
+		const targetTable = getTableForCollection(targetCollection, this.registry);
+		const conditions = [];
+		if (node.where) conditions.push(...this.buildFilterConditions(node.where, targetTable, targetPath));
+		if (node.logical) {
+			const logical = DrizzleConditionBuilder.buildLogicalConditions(node.logical, targetTable, targetPath, this.filterContext(targetPath, targetTable));
+			if (logical) conditions.push(logical);
+		}
+		return conditions.length > 0 ? DrizzleConditionBuilder.combineConditionsWithAnd(conditions) : void 0;
+	}
+	/**
+	* Sort, cap and project the rows of ONE to-many relation, per parent.
+	*
+	* `orderBy` and `limit` are applied here rather than in SQL because a limit
+	* on a batched relation load is *per parent*, and expressing that needs a
+	* LATERAL or a window function per relation kind — four of them, each with
+	* its own join shape. The rows were already narrowed by
+	* {@link includeNarrowing} in SQL, so what this sorts and cuts is the set
+	* the caller asked for and not the table.
+	*/
+	shapeRelatedRows(rows, node, targetCollection) {
+		let out = rows;
+		if (node.orderBy && node.orderBy.length > 0) {
+			const keys = node.orderBy;
+			out = [...out].sort((a, b) => {
+				for (const [field, direction, nulls] of keys) {
+					const cmp = compareForSort(a[field], b[field], FetchService.nullsLast({
+						direction,
+						nulls
+					}));
+					if (cmp !== 0) return direction === "desc" ? -cmp : cmp;
+				}
+				return 0;
+			});
+		}
+		if (node.limit !== void 0) out = out.slice(0, node.limit);
+		if (node.fields && node.fields.length > 0) {
+			const keep = new Set(node.fields);
+			for (const pk of getPrimaryKeys(targetCollection, this.registry)) keep.add(pk.fieldName);
+			out = out.map((row) => {
+				const projected = {};
+				for (const [key, value] of Object.entries(row)) if (keep.has(key)) projected[key] = value;
+				return projected;
+			});
+		}
+		return out;
+	}
+	/**
+	* Load an include tree onto `rows`, in place, one batched query per
+	* relation per level.
+	*
+	* Recurses into nested includes with the rows it just loaded, so
+	* `comments.author` is two queries for a page of posts rather than one per
+	* comment. The depth bound lives on the normalizer
+	* ({@link MAX_INCLUDE_DEPTH}); this asserts it again because the tree can
+	* also be built in-process, where nothing normalized it.
+	*/
+	async loadIncludes(rows, collection, collectionPath, include, depth = 1) {
+		if (rows.length === 0 || depth > MAX_INCLUDE_DEPTH) return;
+		const idInfoArray = getPrimaryKeys(collection, this.registry);
+		if (idInfoArray.length === 0) return;
+		const addressOf = (row) => {
+			const address = buildCompositeId$1(row, idInfoArray);
+			return address && address.split(COMPOSITE_ID_SEPARATOR$1).some((part) => part !== "") ? address : void 0;
+		};
+		const addressable = rows.filter((row) => addressOf(row) !== void 0);
+		if (addressable.length === 0) return;
+		const rowIds = addressable.map((row) => addressOf(row));
+		const levels = this.resolveIncludeLevel(collection, include.tree, include.wildcard);
+		for (const { key, node, relation } of levels) {
+			const targetCollection = relation.target();
+			const narrow = this.includeNarrowing(node, targetCollection);
+			const loaded = [];
+			try {
+				if (relation.cardinality === "one") {
+					const results = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation, narrow);
+					for (const row of addressable) {
+						const related = results.get(String(addressOf(row)));
+						if (!related) {
+							row[key] = null;
+							continue;
+						}
+						const [shaped] = this.shapeRelatedRows([toRestValues({ ...related.values }, targetCollection)], node, targetCollection);
+						row[key] = shaped;
+						loaded.push(shaped);
+					}
+				} else {
+					const results = await this.relationService.batchFetchRelatedEntitiesMany(collectionPath, rowIds, key, relation, narrow);
+					for (const row of addressable) {
+						const related = results.get(String(addressOf(row))) ?? [];
+						const shaped = this.shapeRelatedRows(related.map((e) => toRestValues({ ...e.values }, targetCollection)), node, targetCollection);
+						row[key] = shaped;
+						loaded.push(...shaped);
+					}
+				}
+			} catch (e) {
+				if (e instanceof ApiError) throw e;
+				if (reachedDatabase(e)) throw e;
+				logger.warn(`[include] Failed to load relation '${key}' on ${collectionPath}`, { error: e });
+				continue;
+			}
+			const children = Object.keys(node.children).length > 0 ? {
+				wildcard: false,
+				tree: node.children
+			} : void 0;
+			if (children && loaded.length > 0) await this.loadIncludes(loaded, targetCollection, targetCollection.slug, children, depth + 1);
+		}
+	}
+	/**
+	* The SELECT list for a read: the visible columns, narrowed to `fields`.
+	*
+	* `?fields=` used to be a trim of the *response* — every column read out of
+	* the database and most of them thrown away in JavaScript. It is a
+	* projection now, so asking for two columns of a wide row reads two
+	* columns; that is also what makes `distinct` mean anything.
+	*
+	* Two things survive a narrowing regardless:
+	*
+	* - the **primary key**, because a row nobody can address cannot be
+	*   updated, deleted, or paged past — and `meta.nextCursor` is derived from
+	*   it, so a projection without it would silently disable seeking. The one
+	*   exception is `distinct`, below;
+	* - the exclusions. `excludeFromApi` and the generated search columns are
+	*   removed *after* the narrowing, so naming one in `fields` does not
+	*   un-hide it. That was the shape of the `?searchString=` leak: a path
+	*   that skipped the projection returned a password hash the plain read
+	*   correctly withheld.
+	*
+	* An unknown column name is a 400 rather than a silent omission: a caller
+	* who mistypes `?fields=titel` otherwise gets rows without titles and no
+	* hint why.
+	*
+	* **`distinct` drops the primary key.** Keeping it is what the refusal of
+	* `distinct` beside a search or vector query already describes: a value
+	* that differs on every row makes the whole row distinct by construction,
+	* so the query "would answer 200 having done nothing". A surrogate key does
+	* that more reliably than any score — `?fields=status&distinct=true` came
+	* back with one row per row, every one carrying its `id`. So a distinct
+	* read is a read of the named columns and nothing else. It addresses no
+	* rows, which is the honest shape for one: `cursorFor` finds no key on the
+	* row and issues no cursor, and the result is a set of values rather than a
+	* set of rows to update or delete.
+	*/
+	columnProjection(table, collection, fields, idInfoArray, distinct) {
+		const visible = visibleColumnProjection(getTableColumns(table), collection);
+		if (!fields || fields.length === 0) return visible;
+		let tableColumns;
+		try {
+			tableColumns = getTableColumns(table);
+		} catch {
+			return visible;
+		}
+		const available = visible ?? tableColumns;
+		const keep = new Set(fields);
+		if (!distinct) for (const pk of idInfoArray) keep.add(pk.fieldName);
+		const projection = {};
+		for (const name of keep) {
+			const column = available[name];
+			if (column !== void 0) {
+				projection[name] = column;
+				continue;
+			}
+			if (tableColumns[name] !== void 0) continue;
+			throw ApiError.badRequest(`Unknown field '${name}' in \`fields\` on collection '${collection.slug ?? collection.name}'. Valid fields: ` + Object.keys(available).sort().join(", "), "UNKNOWN_FIELD", {
+				field: name,
+				collection: collection.slug ?? collection.name
+			});
+		}
+		return projection;
+	}
+	/**
+	* The opaque cursor that continues a listing after `row`. See
+	* {@link RestFetchService.cursorFor}.
+	*
+	* Here rather than at the route because deriving it needs the collection's
+	* primary key, which may be named anything and span several columns — the
+	* driver's knowledge, not the HTTP layer's.
+	*/
+	cursorFor(collectionPath, row, orderBy) {
+		if (orderBy?.some(([field]) => field === FetchService.SCORE_FIELD)) return void 0;
+		try {
+			const pks = getPrimaryKeys(getCollectionByPath(collectionPath, this.registry), this.registry);
+			if (pks.length === 0) return void 0;
+			const address = buildCompositeId$1(row, pks);
+			if (!address || !address.split(COMPOSITE_ID_SEPARATOR$1).some((part) => part !== "")) return void 0;
+			return encodeCursor(orderBy, row, row[pks[0].fieldName]);
+		} catch {
+			return;
+		}
+	}
+	/**
 	* Post-fetch joinPath relations for a single flat row.
 	* joinPath relations cannot be expressed via Drizzle's `with` config,
 	* so they must be loaded separately after the primary query.
@@ -3531,81 +4076,6 @@ var FetchService = class FetchService {
 		await Promise.all(promises);
 	}
 	/**
-	* Resolves joinPath relations for raw REST rows and directly injects them.
-	* Uses RelationService to query the database and maps results back to the flattened objects.
-	*/
-	async resolveJoinPathRelationsBatchRest(rows, collection, collectionPath, idInfoArray, include) {
-		if (rows.length === 0) return;
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const propertyKeys = new Set(Object.keys(collection.properties || {}));
-		const shouldInclude = (key) => !include || include.length === 0 || include[0] === "*" || include.includes(key);
-		const joinPathRelations = Object.entries(resolvedRelations).filter(([key, relation]) => relation.kind === "via" && propertyKeys.has(key) && shouldInclude(key));
-		if (joinPathRelations.length === 0) return;
-		const parentIdOf = (row) => {
-			const address = buildCompositeId$1(row, idInfoArray);
-			return address && address.split(COMPOSITE_ID_SEPARATOR$1).some((part) => part !== "") ? address : void 0;
-		};
-		for (const [key, relation] of joinPathRelations) try {
-			const addressable = rows.filter((r) => parentIdOf(r) !== void 0 && parentIdOf(r) !== null);
-			if (addressable.length === 0) continue;
-			const rowIds = addressable.map((r) => parentIdOf(r));
-			if (relation.cardinality === "one") {
-				const resultMap = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation);
-				for (const row of addressable) {
-					const relatedRow = resultMap.get(String(parentIdOf(row)));
-					row[key] = relatedRow ? { ...relatedRow.values } : null;
-				}
-			} else if (relation.cardinality === "many") {
-				const resultMap = await this.relationService.batchFetchRelatedEntitiesMany(collectionPath, rowIds, key, relation);
-				for (const row of addressable) row[key] = (resultMap.get(String(parentIdOf(row))) || []).map((e) => ({ ...e.values }));
-			}
-		} catch (e) {
-			if (reachedDatabase(e)) throw e;
-			logger.warn(`Could not batch resolve joinPath relation '${key}' for REST`, { error: e });
-		}
-	}
-	/**
-	* Build db.query-compatible options from standard fetch options.
-	* Handles filter, search, orderBy, limit, and cursor-based pagination.
-	*/
-	buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig, scopeCondition) {
-		const queryOpts = {};
-		const hidden = hiddenColumnsOption(getTableColumns(table), this.registry.getCollectionByPath(collectionPath) ?? void 0);
-		if (hidden) queryOpts.columns = hidden;
-		if (withConfig) queryOpts.with = withConfig;
-		const allConditions = [];
-		if (scopeCondition) allConditions.push(scopeCondition);
-		if (options.searchString) {
-			const collection = getCollectionByPath(collectionPath, this.registry);
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
-			if (searchConditions.length === 0) {
-				queryOpts.where = and(eq(idField, -99999999));
-				return queryOpts;
-			}
-			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
-		}
-		if (options.filter) {
-			const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
-			if (filterConditions.length > 0) allConditions.push(...filterConditions);
-		}
-		if (options.logical) {
-			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
-			if (logicalCondition) allConditions.push(logicalCondition);
-		}
-		if (options.startAfter) {
-			const cursorConditions = this.buildCursorConditions(table, idField, idInfo, options, collectionPath);
-			if (cursorConditions.length > 0) allConditions.push(...cursorConditions);
-		}
-		if (allConditions.length > 0) queryOpts.where = and(...allConditions);
-		const orderKeys = normalizeDriverOrderBy(options.orderBy, options.order);
-		const resolvedOrder = orderKeys ? this.resolveOrderKeys(table, orderKeys, getCollectionByPath(collectionPath, this.registry), options.searchString) : [];
-		queryOpts.orderBy = this.buildOrderExpressions(resolvedOrder, idField);
-		const limitValue = options.searchString ? options.limit || 50 : options.limit;
-		if (limitValue) queryOpts.limit = limitValue;
-		if (options.offset && options.offset > 0) queryOpts.offset = options.offset;
-		return queryOpts;
-	}
-	/**
 	* Extract cursor pagination conditions from startAfter options.
 	*
 	* "Every row that sorts after this one", written out as a comparison over
@@ -3649,12 +4119,15 @@ var FetchService = class FetchService {
 	buildKeysetComparison(keys, values, idField, cursorId, index = 0) {
 		if (index >= keys.length) return lt(idField, cursorId);
 		const { direction, cursorTarget } = keys[index];
+		const nullsLast = FetchService.nullsLast(keys[index]);
 		const target = keys[index].target;
 		const value = values[index];
 		const rest = this.buildKeysetComparison(keys, values, idField, cursorId, index + 1);
-		if (cursorTarget) return direction === "asc" ? or(and(isNull(cursorTarget), isNull(target), rest), and(isNotNull(cursorTarget), or(sql`${target} > ${cursorTarget}`, isNull(target), and(sql`${target} = ${cursorTarget}`, rest)))) : or(and(isNull(cursorTarget), or(isNotNull(target), and(isNull(target), rest))), and(isNotNull(cursorTarget), or(sql`${target} < ${cursorTarget}`, and(sql`${target} = ${cursorTarget}`, rest))));
-		if (value === null) return direction === "asc" ? and(isNull(target), rest) : or(isNotNull(target), and(isNull(target), rest));
-		return direction === "asc" ? or(gt(target, value), isNull(target), and(eq(target, value), rest)) : or(lt(target, value), and(eq(target, value), rest));
+		const after = (a, b) => direction === "asc" ? gt(a, b) : lt(a, b);
+		const afterSql = (a, b) => direction === "asc" ? sql`${a} > ${b}` : sql`${a} < ${b}`;
+		if (cursorTarget) return nullsLast ? or(and(isNull(cursorTarget), isNull(target), rest), and(isNotNull(cursorTarget), or(afterSql(target, cursorTarget), isNull(target), and(sql`${target} = ${cursorTarget}`, rest)))) : or(and(isNull(cursorTarget), or(isNotNull(target), and(isNull(target), rest))), and(isNotNull(cursorTarget), or(afterSql(target, cursorTarget), and(sql`${target} = ${cursorTarget}`, rest))));
+		if (value === null) return nullsLast ? and(isNull(target), rest) : or(isNotNull(target), and(isNull(target), rest));
+		return nullsLast ? or(after(target, value), isNull(target), and(eq(target, value), rest)) : or(after(target, value), and(eq(target, value), rest));
 	}
 	/**
 	* Compile "rows reachable from this parent" into a `WHERE` condition on the
@@ -3698,7 +4171,7 @@ var FetchService = class FetchService {
 	/**
 	* Fetch a single row by ID
 	*/
-	async fetchOne(collectionPath, id, databaseId) {
+	async fetchOne(collectionPath, id, databaseId, withDeleted) {
 		if (!await this.isAddressableUnder(collectionPath, id)) return void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
@@ -3714,7 +4187,7 @@ var FetchService = class FetchService {
 			const withConfig = this.buildWithConfig(collection);
 			const hidden = hiddenColumnsOption(getTableColumns(table), collection);
 			const row = await qb.findFirst({
-				where: eq(idField, parsedId),
+				where: andSoftDelete(eq(idField, parsedId), collection, table, withDeleted),
 				with: withConfig,
 				...hidden ? { columns: hidden } : {}
 			});
@@ -3731,7 +4204,7 @@ var FetchService = class FetchService {
 			logger.warn(`[FetchService] db.query.findFirst failed for ${collectionPath}, falling back to db.select`, { error: e });
 		}
 		const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
-		const result = await this.db.select(visibleOne).from(table).where(eq(idField, parsedId)).limit(1);
+		const result = await this.db.select(visibleOne).from(table).where(andSoftDelete(eq(idField, parsedId), collection, table, withDeleted)).limit(1);
 		if (result.length === 0) return void 0;
 		const raw = result[0];
 		const values = await parseDataFromServer(raw, collection, this.db, this.registry);
@@ -3764,84 +4237,13 @@ var FetchService = class FetchService {
 	* Unified method to fetch rows with optional search functionality
 	*/
 	async fetchRowsWithConditions(collectionPath, options = {}) {
-		const scopeCondition = options.relatedTo ? this.buildRelationScope(options.relatedTo) : void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
 		const idInfo = idInfoArray[0];
-		const idField = table[idInfo.fieldName];
-		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
-		const tableName = getTableName(table);
-		const qb = this.getQueryBuilder(tableName);
-		const withConfig = this.buildWithConfig(collection);
-		const hasRelations = withConfig && Object.keys(withConfig).length > 0;
-		if (qb && !options.searchString && !hasRelations && !options.vectorSearch) try {
-			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, void 0, scopeCondition);
-			return (await qb.findMany(queryOpts)).map((row) => toFlatRow(row, collection, this.registry));
-		} catch (e) {
-			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
-				logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
-				logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
-			}
-			if (reachedDatabase(e)) throw e;
-			logger.warn(`[FetchService] db.query.findMany failed for ${collectionPath}, falling back to db.select`, { error: e });
-		}
-		let vectorMeta;
-		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
-		const visible = visibleColumnProjection(getTableColumns(table), collection);
-		const rankSelect = options.searchString ? DrizzleConditionBuilder.buildSearchRankExpression(options.searchString, table, collection) : void 0;
-		const matchesSelect = options.searchString && options.searchExplain ? DrizzleConditionBuilder.buildSearchMatchesExpression(options.searchString, table, collection) : void 0;
-		let query = vectorMeta ? this.db.select({
-			table_row: visible ?? table,
-			_distance: vectorMeta.distanceSelect
-		}).from(table).$dynamic() : rankSelect ? this.db.select({
-			table_row: visible ?? table,
-			_score: rankSelect,
-			...matchesSelect ? { _matches: matchesSelect } : {}
-		}).from(table).$dynamic() : visible ? this.db.select(visible).from(table).$dynamic() : this.db.select().from(table).$dynamic();
-		const allConditions = [];
-		if (scopeCondition) allConditions.push(scopeCondition);
-		if (options.searchString) {
-			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
-			if (searchConditions.length === 0) return [];
-			allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions));
-		}
-		if (options.filter) {
-			const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
-			if (filterConditions.length > 0) allConditions.push(...filterConditions);
-		}
-		if (options.logical) {
-			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
-			if (logicalCondition) allConditions.push(logicalCondition);
-		}
-		if (vectorMeta?.filter) allConditions.push(vectorMeta.filter);
-		if (allConditions.length > 0) {
-			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
-			if (finalCondition) query = query.where(finalCondition);
-		}
-		const orderExpressions = vectorMeta ? [asc(vectorMeta.orderBy), desc(idField)] : this.buildOrderExpressions(this.resolveOrderKeys(table, normalizeDriverOrderBy(options.orderBy, options.order) ?? [], collection, options.searchString), idField);
-		query = query.orderBy(...orderExpressions);
-		if (options.startAfter) {
-			const cursorConditions = this.buildCursorConditions(table, idField, idInfo, options, collectionPath);
-			if (cursorConditions.length > 0) {
-				allConditions.push(...cursorConditions);
-				const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
-				if (finalCondition) query = query.where(finalCondition);
-			}
-		}
-		const limitValue = options.vectorSearch ? options.limit || 10 : options.searchString ? options.limit || 50 : options.limit;
-		if (limitValue) query = query.limit(limitValue);
-		if (options.offset && options.offset > 0) query = query.offset(options.offset);
-		const rawResults = await query;
-		const results = vectorMeta ? rawResults.map((r) => ({
-			...r.table_row,
-			_distance: typeof r._distance === "number" ? r._distance : parseFloat(String(r._distance))
-		})) : rankSelect ? rawResults.map((r) => ({
-			...r.table_row,
-			_score: typeof r._score === "number" ? r._score : parseFloat(String(r._score)),
-			...matchesSelect ? { _matches: r._matches ?? [] } : {}
-		})) : rawResults;
-		return this.processRowResults(results, collection, collectionPath, idInfo, options.databaseId, false, idInfoArray);
+		if (!table[idInfo.fieldName]) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
+		const results = await this.fetchRowsWithConditionsRaw(collectionPath, options);
+		return this.processRowResults(results, collection, collectionPath, idInfo, options.databaseId, normalizeInclude(options.include), idInfoArray);
 	}
 	/**
 	* Fallback path used when db.query is unavailable.
@@ -3852,54 +4254,11 @@ var FetchService = class FetchService {
 	*
 	* Process raw database results into flat rows with relations.
 	*/
-	async processRowResults(results, collection, collectionPath, idInfo, _databaseId, skipRelations = false, idInfoArray) {
+	async processRowResults(results, collection, collectionPath, idInfo, _databaseId, include, _idInfoArray) {
 		if (results.length === 0) return [];
-		const parsedRows = await Promise.all(results.map(async (rawRow) => {
-			return {
-				rawRow,
-				values: await parseDataFromServer(rawRow, collection)
-			};
-		}));
-		if (!skipRelations) {
-			const resolvedRelations = resolveCollectionRelations(collection);
-			const propertyKeys = new Set(Object.keys(collection.properties));
-			for (const [key, relation] of Object.entries(resolvedRelations)) {
-				if (!propertyKeys.has(key) || relation.cardinality !== "one") continue;
-				const rowsMissingRelation = parsedRows.filter((item) => {
-					const val = item.values[key];
-					if (val == null) return true;
-					if (typeof val === "object" && !Array.isArray(val) && val.__type === "relation" && val.data == null) return true;
-					return false;
-				});
-				if (rowsMissingRelation.length === 0) continue;
-				try {
-					const rowIds = rowsMissingRelation.map((item) => item.rawRow[idInfo.fieldName]);
-					const relationResults = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation);
-					rowsMissingRelation.forEach((item) => {
-						const id = item.rawRow[idInfo.fieldName];
-						const relatedRow = relationResults.get(String(id));
-						if (relatedRow) item.values[key] = createRelationRefWithData(relatedRow.id, relatedRow.path, relatedRow);
-					});
-				} catch (e) {
-					if (reachedDatabase(e)) throw e;
-					logger.warn(`Could not batch load one-to-one relation property: ${key}`, { error: e });
-				}
-			}
-			const manyRelations = Object.entries(resolvedRelations).filter(([key, relation]) => propertyKeys.has(key) && relation.cardinality === "many");
-			for (const [key, relation] of manyRelations) try {
-				const rowIds = parsedRows.map((item) => item.rawRow[idInfo.fieldName]);
-				const relationResults = await this.relationService.batchFetchRelatedEntitiesMany(collectionPath, rowIds, key, relation);
-				parsedRows.forEach((item) => {
-					const id = String(item.rawRow[idInfo.fieldName]);
-					const relatedRows = relationResults.get(id) || [];
-					item.values[key] = relatedRows.map((e) => createRelationRefWithData(e.id, e.path, e));
-				});
-			} catch (e) {
-				if (reachedDatabase(e)) throw e;
-				logger.warn(`Could not batch load many relation property: ${key}`, { error: e });
-			}
-		}
-		return parsedRows.map((item) => item.values);
+		const values = await Promise.all(results.map(async (rawRow) => await parseDataFromServer(rawRow, collection)));
+		if (include) await this.loadIncludes(values, collection, collectionPath, include);
+		return values;
 	}
 	/**
 	* Fetch a collection of rows
@@ -3932,6 +4291,7 @@ var FetchService = class FetchService {
 		let query = this.db.select({ count: count() }).from(table).$dynamic();
 		const allConditions = [];
 		if (hop) allConditions.push(this.buildRelationScope(hop));
+		withSoftDelete(allConditions, collection, table, options.withDeleted);
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return 0;
@@ -4012,6 +4372,7 @@ var FetchService = class FetchService {
 		for (const group of groupColumns) selection[group.field] = sql`${group.column}`;
 		let query = this.db.select(selection).from(table).$dynamic();
 		const conditions = [];
+		withSoftDelete(conditions, collection, table, options.withDeleted);
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return [];
@@ -4066,12 +4427,24 @@ var FetchService = class FetchService {
 		return this.relationService;
 	}
 	/**
-	* Fetch a collection of rows with optional relation includes.
-	* When `include` is provided, only the specified relations are populated
-	* with full row data (not just { id, path, __type }).
-	* When `include` is absent, no relation queries are made (fast path).
+	* Fetch a collection of rows, with the relations `include` names.
+	*
+	* ## Why this no longer uses `db.query.findMany({ with })`
 	*
-	* @param include - Array of relation keys to populate, or ["*"] for all
+	* It used to, whenever a `db.query` builder existed for the table — which
+	* is Drizzle's relational API, and which compiles a to-many relation into a
+	* lateral join. This file's own comment on the *other* read path says what
+	* that costs: "catastrophically slow for large collections (7s+ for 350
+	* rows)". So the admin fetch avoided it and REST took it, and the fast,
+	* batched loader that the admin used was unreachable from the HTTP API.
+	*
+	* There is one loader now, {@link loadIncludes}, and every read reaches it:
+	* one query per relation per level, never one per row. That also makes this
+	* method and the realtime refetch the same code, which is what stops
+	* `find()` and `listen()` returning different shapes for one query.
+	*
+	* @param include - see {@link IncludeSpec}: names, dotted paths, `["*"]`,
+	*   or the parametrised tree. An unknown name is a 400 `UNKNOWN_RELATION`.
 	*/
 	async fetchCollectionForRest(collectionPath, options = {}, include) {
 		if (isNestedPath(collectionPath)) {
@@ -4081,67 +4454,24 @@ var FetchService = class FetchService {
 				relatedTo: hop
 			}, include);
 		}
-		const scopeCondition = options.relatedTo ? this.buildRelationScope(options.relatedTo) : void 0;
 		const collection = getCollectionByPath(collectionPath, this.registry);
-		const table = getTableForCollection(collection, this.registry);
-		const idInfoArray = requirePrimaryKeys(collection, this.registry);
-		const idInfo = idInfoArray[0];
-		const idField = table[idInfo.fieldName];
-		const tableName = getTableName(table);
-		const qb = this.getQueryBuilder(tableName);
-		if (qb && !options.searchString && !options.vectorSearch) try {
-			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
-			const queryOpts = this.buildDrizzleQueryOptions(table, idField, idInfo, options, collectionPath, withConfig, scopeCondition);
-			const restRows = (await qb.findMany(queryOpts)).map((row) => toRestRow(row, collection, this.registry));
-			await this.resolveJoinPathRelationsBatchRest(restRows, collection, collectionPath, idInfoArray, include);
-			return restRows;
-		} catch (e) {
-			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
-				logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
-				logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
-			}
-			if (reachedDatabase(e)) throw e;
-			logger.warn(`[fetchCollectionForRest] db.query.findMany failed for ${collectionPath}, falling back`, { error: e });
-		}
+		const normalizedInclude = normalizeInclude(include);
 		const rows = (await this.fetchRowsWithConditionsRaw(collectionPath, options)).map((row) => toRestRow(row, collection, this.registry));
-		if (!include || include.length === 0) return rows;
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const propertyKeys = new Set(Object.keys(collection.properties || {}));
-		const shouldInclude = (key) => include[0] === "*" || include.includes(key);
-		const rowIds = rows.map((e) => e[idInfo.fieldName]);
-		for (const [key, relation] of Object.entries(resolvedRelations)) {
-			if (!propertyKeys.has(key) || !shouldInclude(key) || relation.cardinality !== "one") continue;
-			try {
-				const batchResults = await this.relationService.batchFetchRelatedEntities(collectionPath, rowIds, key, relation);
-				for (const row of rows) {
-					const eid = row[idInfo.fieldName];
-					const related = batchResults.get(String(eid));
-					if (related) row[key] = { ...related.values };
-				}
-			} catch (e) {
-				if (reachedDatabase(e)) throw e;
-				logger.warn(`[include] Failed to batch load one-to-one '${key}'`, { error: e });
-			}
-		}
-		for (const [key, relation] of Object.entries(resolvedRelations)) {
-			if (!propertyKeys.has(key) || !shouldInclude(key) || relation.cardinality !== "many") continue;
-			try {
-				const batchResults = await this.batchFetchManyRelatedRows(collectionPath, rowIds, key);
-				for (const row of rows) {
-					const eid = row[idInfo.fieldName];
-					row[key] = batchResults.get(String(eid)) || [];
-				}
-			} catch (e) {
-				if (reachedDatabase(e)) throw e;
-				logger.warn(`[include] Failed to batch load many '${key}'`, { error: e });
-			}
-		}
+		if (normalizedInclude) await this.loadIncludes(rows, collection, collectionPath, normalizedInclude);
 		return rows;
 	}
 	/**
-	* Fetch a single row with optional relation includes for REST API.
+	* Fetch a single row, with the relations `include` names.
+	*
+	* The same two steps `fetchCollectionForRest` takes, for one row, through
+	* the same {@link loadIncludes}. It used to be a separate implementation on
+	* `db.query.findFirst({ with })` with a hand-written N+1 fallback beneath
+	* it, and the two disagreed: the primary path returned a to-one relation as
+	* the target's columns, the fallback merged an `id` over them, and a
+	* relation that resolved to nothing was *absent* on one path and `null` on
+	* the other. `find()[0]` and `findById()` now answer with the same row.
 	*/
-	async fetchOneForRest(collectionPath, id, include, databaseId) {
+	async fetchOneForRest(collectionPath, id, include, databaseId, options) {
 		if (!await this.isAddressableUnder(collectionPath, id)) return null;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
@@ -4150,56 +4480,14 @@ var FetchService = class FetchService {
 		const idField = table[idInfo.fieldName];
 		if (!idCanAddressTable(id, table, idInfoArray)) return null;
 		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
-		const tableName = getTableName(table);
-		const qb = this.getQueryBuilder(tableName);
-		if (qb) try {
-			const withConfig = include && include.length > 0 ? this.buildWithConfig(collection, include) : void 0;
-			const row = await qb.findFirst({
-				where: eq(idField, parsedId),
-				...withConfig ? { with: withConfig } : {}
-			});
-			if (!row) return null;
-			const restRow = toRestRow(row, collection, this.registry);
-			await this.resolveJoinPathRelationsBatchRest([restRow], collection, collectionPath, idInfoArray, include);
-			return restRow;
-		} catch (e) {
-			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
-				logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
-				logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
-			}
-			if (reachedDatabase(e)) throw e;
-			logger.warn(`[fetchOneForRest] db.query.findFirst failed for ${collectionPath}, falling back`, { error: e });
-		}
-		const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
-		const result = await this.db.select(visibleOne).from(table).where(eq(idField, parsedId)).limit(1);
+		const withDeleted = options?.withDeleted;
+		const projection = this.columnProjection(table, collection, options?.fields, idInfoArray);
+		const result = await this.db.select(projection).from(table).where(andSoftDelete(eq(idField, parsedId), collection, table, withDeleted)).limit(1);
 		if (result.length === 0) return null;
-		const flatEntity = toRestRow(result[0], collection, this.registry);
-		if (!include || include.length === 0) return flatEntity;
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const propertyKeys = new Set(Object.keys(collection.properties || {}));
-		const shouldInclude = (key) => include[0] === "*" || include.includes(key);
-		for (const [key, relation] of Object.entries(resolvedRelations)) {
-			if (!propertyKeys.has(key) || !shouldInclude(key)) continue;
-			try {
-				const relatedRows = await this.relationService.fetchRelatedEntities(collectionPath, parsedId, key, {});
-				if (relation.cardinality === "one") {
-					if (relatedRows.length > 0) {
-						const e = relatedRows[0];
-						flatEntity[key] = {
-							id: e.id,
-							...e.values
-						};
-					}
-				} else flatEntity[key] = relatedRows.map((e) => ({
-					id: e.id,
-					...e.values
-				}));
-			} catch (e) {
-				if (reachedDatabase(e)) throw e;
-				logger.warn(`[include] Failed to load relation '${key}'`, { error: e });
-			}
-		}
-		return flatEntity;
+		const row = toRestRow(result[0], collection, this.registry);
+		const normalizedInclude = normalizeInclude(include);
+		if (normalizedInclude) await this.loadIncludes([row], collection, collectionPath, normalizedInclude);
+		return row;
 	}
 	/**
 	* Fetch raw rows without any relation processing (for REST fast path)
@@ -4207,12 +4495,20 @@ var FetchService = class FetchService {
 	async fetchRowsWithConditionsRaw(collectionPath, options = {}) {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
-		const idField = table[requirePrimaryKeys(collection, this.registry)[0].fieldName];
+		const idInfoArray = requirePrimaryKeys(collection, this.registry);
+		const idInfo = idInfoArray[0];
+		const idField = table[idInfo.fieldName];
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
-		const visible = visibleColumnProjection(getTableColumns(table), collection);
+		const visible = this.columnProjection(table, collection, options.fields, idInfoArray, options.distinct === true);
 		const rankSelect = options.searchString ? DrizzleConditionBuilder.buildSearchRankExpression(options.searchString, table, collection) : void 0;
 		const matchesSelect = options.searchString && options.searchExplain ? DrizzleConditionBuilder.buildSearchMatchesExpression(options.searchString, table, collection) : void 0;
+		const wantsDistinct = options.distinct === true;
+		if (wantsDistinct && (vectorMeta || rankSelect)) throw ApiError.badRequest("`distinct` cannot be combined with a search or vector query: both attach a per-row score to every row, so no two rows are ever equal and DISTINCT would have no effect. Drop one of the two.", "DISTINCT_NOT_APPLICABLE");
+		const selectFrom = () => {
+			const builder = wantsDistinct ? this.db.selectDistinct.bind(this.db) : this.db.select.bind(this.db);
+			return visible ? builder(visible).from(table).$dynamic() : builder().from(table).$dynamic();
+		};
 		let query = vectorMeta ? this.db.select({
 			table_row: visible ?? table,
 			_distance: vectorMeta.distanceSelect
@@ -4220,9 +4516,10 @@ var FetchService = class FetchService {
 			table_row: visible ?? table,
 			_score: rankSelect,
 			...matchesSelect ? { _matches: matchesSelect } : {}
-		}).from(table).$dynamic() : visible ? this.db.select(visible).from(table).$dynamic() : this.db.select().from(table).$dynamic();
+		}).from(table).$dynamic() : selectFrom();
 		const allConditions = [];
 		if (options.relatedTo) allConditions.push(this.buildRelationScope(options.relatedTo));
+		withSoftDelete(allConditions, collection, table, options.withDeleted);
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, collection.properties, table, collection);
 			if (searchConditions.length === 0) return [];
@@ -4241,8 +4538,22 @@ var FetchService = class FetchService {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
 			if (finalCondition) query = query.where(finalCondition);
 		}
-		const orderExpressions = vectorMeta ? [asc(vectorMeta.orderBy), desc(idField)] : this.buildOrderExpressions(this.resolveOrderKeys(table, normalizeDriverOrderBy(options.orderBy, options.order) ?? [], collection, options.searchString), idField);
-		query = query.orderBy(...orderExpressions);
+		const sortKeys = normalizeDriverOrderBy(options.orderBy, options.order) ?? [];
+		if (wantsDistinct && visible) {
+			const selected = new Set(Object.keys(visible));
+			const missing = sortKeys.map(([field]) => field).filter((field) => !selected.has(field));
+			if (missing.length > 0) throw ApiError.badRequest(`\`distinct\` cannot sort by ${missing.map((f) => `'${f}'`).join(", ")}: a DISTINCT read can only be ordered by columns it returns, or the rows it collapses have no defined order. Add ${missing.map((f) => `'${f}'`).join(", ")} to \`fields\`, or drop them from \`orderBy\`.`, "DISTINCT_ORDER_BY_NOT_SELECTED", { fields: missing });
+		}
+		const orderExpressions = vectorMeta ? [asc(vectorMeta.orderBy), desc(idField)] : this.buildOrderExpressions(this.resolveOrderKeys(table, sortKeys, collection, options.searchString), idField, !wantsDistinct);
+		if (orderExpressions.length > 0) query = query.orderBy(...orderExpressions);
+		if (options.startAfter) {
+			const cursorConditions = this.buildCursorConditions(table, idField, idInfo, options, collectionPath);
+			if (cursorConditions.length > 0) {
+				allConditions.push(...cursorConditions);
+				const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
+				if (finalCondition) query = query.where(finalCondition);
+			}
+		}
 		const limitValue = options.vectorSearch ? options.limit || 10 : options.searchString ? options.limit || 50 : options.limit;
 		if (limitValue) query = query.limit(limitValue);
 		if (options.offset && options.offset > 0) query = query.offset(options.offset);
@@ -4258,39 +4569,6 @@ var FetchService = class FetchService {
 		}));
 		return rawResults;
 	}
-	/**
-	* Check if the Drizzle instance has the relational query API available
-	* for a given collection path.
-	* Note: Primary path now uses inline `getQueryBuilder()` checks.
-	*/
-	hasDrizzleQueryAPI(collectionPath) {
-		if (!this.getQueryBuilder("__probe__")) return false;
-		const tableName = getTableName(getTableForCollection(getCollectionByPath(collectionPath, this.registry), this.registry));
-		return !!this.getQueryBuilder(tableName);
-	}
-	/**
-	* Fallback path used when db.query is unavailable.
-	* The primary path uses db.query.findMany with `with` config, which
-	* loads all relations in a single query.
-	*
-	* Batch fetch many-to-many related rows for multiple parent IDs.
-	* Groups results by parent ID to avoid N+1.
-	*/
-	async batchFetchManyRelatedRows(parentCollectionPath, parentIds, relationKey) {
-		if (parentIds.length === 0) return /* @__PURE__ */ new Map();
-		const relation = resolveCollectionRelations(getCollectionByPath(parentCollectionPath, this.registry))[relationKey];
-		if (!relation) {
-			logger.warn(`[batchFetchManyRelatedRows] ResolvedRelation '${relationKey}' not found, skipping`);
-			return /* @__PURE__ */ new Map();
-		}
-		const entityMap = await this.relationService.batchFetchRelatedEntitiesMany(parentCollectionPath, parentIds, relationKey, relation);
-		const flatMap = /* @__PURE__ */ new Map();
-		for (const [key, rows] of entityMap) flatMap.set(key, rows.map((e) => ({
-			...e.values,
-			id: e.id
-		})));
-		return flatMap;
-	}
 };
 //#endregion
 //#region src/services/RelationWriteService.ts
@@ -4556,6 +4834,103 @@ var RelationWriteService = class {
 	}
 };
 //#endregion
+//#region src/services/field-op-sql.ts
+/**
+* Turning `{ views: { $inc: 1 } }` into the `SET` clause that cannot lose a
+* concurrent write.
+*
+* The contract — which operators exist, what they accept, which property types
+* they are legal on — lives in `@rebasepro/server`. What is here is the part
+* only this driver can know: an `array` property is a native `text[]` on one
+* collection and a jsonb document on the next (see the DDL generator's `array`
+* arm), and the two need entirely different statements. Compiling from the
+* property type alone would emit `array_append` against a jsonb column, which
+* Postgres rejects at plan time with a function-does-not-exist error naming
+* neither the collection nor the field.
+*
+* Every expression is NULL-safe. `NULL + 1` is `NULL`, and a counter that
+* silently empties itself the first time it is incremented from an unset column
+* is worse than one that never worked.
+*
+* @module
+*/
+/** What the column is, as Postgres sees it: `text[]`, `jsonb`, `integer`, … */
+function sqlTypeOf(column) {
+	try {
+		return String(column.getSQLType()).toLowerCase();
+	} catch {
+		return "";
+	}
+}
+function isNativeArray(type) {
+	return type.endsWith("[]") || type.endsWith(" array");
+}
+/** A `json` column needs the result cast back; a `jsonb` one does not. */
+function isPlainJson(type) {
+	return type === "json";
+}
+function asList(operand) {
+	return Array.isArray(operand) ? operand : [operand];
+}
+/**
+* The expression one operation compiles to, or a 400 saying why it cannot.
+*
+* `field` is the property key; it is already known to be a column of `table`
+* (the caller checks that against the same table it builds the statement from).
+*/
+function compileFieldOp(table, field, op, context) {
+	const column = table[field];
+	if (!column) throw ApiError.badRequest(`'${field}' is not a column of "${context.collectionPath}", so ${op.operator} has nothing to apply to.`, "INVALID_FIELD_OPERATION");
+	const type = sqlTypeOf(column);
+	switch (op.operator) {
+		case "$inc": return sql`COALESCE(${column}, 0) + ${op.operand}`;
+		case "$push": {
+			const values = asList(op.operand);
+			if (isNativeArray(type)) {
+				let expression = sql`${column}`;
+				for (const value of values) expression = sql`array_append(${expression}, ${value})`;
+				return expression;
+			}
+			if (type.startsWith("json")) {
+				const appended = sql`COALESCE(${column}::jsonb, '[]'::jsonb) || ${JSON.stringify(values)}::jsonb`;
+				return isPlainJson(type) ? sql`(${appended})::json` : appended;
+			}
+			throw unsupportedColumn(field, op.operator, type, context);
+		}
+		case "$pull": {
+			const values = asList(op.operand);
+			if (isNativeArray(type)) {
+				let expression = sql`${column}`;
+				for (const value of values) expression = sql`array_remove(${expression}, ${value})`;
+				return expression;
+			}
+			if (type.startsWith("json")) {
+				const filtered = sql`COALESCE((
+                    SELECT jsonb_agg(element)
+                    FROM jsonb_array_elements(COALESCE(${column}::jsonb, '[]'::jsonb)) AS element
+                    WHERE NOT (element IN (SELECT jsonb_array_elements(${sql`${JSON.stringify(values)}::jsonb`})))
+                ), '[]'::jsonb)`;
+				return isPlainJson(type) ? sql`(${filtered})::json` : filtered;
+			}
+			throw unsupportedColumn(field, op.operator, type, context);
+		}
+		case "$merge": {
+			if (!type.startsWith("json")) throw unsupportedColumn(field, op.operator, type, context);
+			const merged = sql`COALESCE(${column}::jsonb, '{}'::jsonb) || ${JSON.stringify(op.operand)}::jsonb`;
+			return isPlainJson(type) ? sql`(${merged})::json` : merged;
+		}
+	}
+}
+function unsupportedColumn(field, operator, type, context) {
+	return ApiError.badRequest(`${operator} cannot be applied to '${field}' on "${context.collectionPath}": the column is ${type || "of an unknown type"}, and ${operator} needs ` + (operator === "$merge" ? "a json or jsonb column." : "an array or json column."), "INVALID_FIELD_OPERATION");
+}
+/** Compile a whole map of operations into a `SET`-ready object. */
+function compileFieldOps(table, fieldOps, context) {
+	const compiled = {};
+	for (const [field, op] of Object.entries(fieldOps)) compiled[field] = compileFieldOp(table, field, op, context);
+	return compiled;
+}
+//#endregion
 //#region src/services/PersistService.ts
 /**
 * Service for handling all row write operations.
@@ -4646,10 +5021,17 @@ var PersistService = class {
 	* Save an row (create or update)
 	*
 	* With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
-	* UPDATE against the primary key rather than a plain UPDATE. That is one
-	* statement, so it cannot lose a race the way a read-then-write can, and it
-	* does not care whether the row already exists — which is what a re-runnable
-	* import needs.
+	* UPDATE rather than a plain UPDATE. That is one statement, so it cannot
+	* lose a race the way a read-then-write can, and it does not care whether
+	* the row already exists — which is what a re-runnable import needs. The
+	* conflict is matched on the primary key unless `options.onConflict` names
+	* other columns; see {@link SaveProps.onConflict} for why that matters.
+	*
+	* `values` may carry field operations (`{ views: { $inc: 1 } }`). They are
+	* split out here rather than at the REST boundary because every request
+	* boundary — HTTP, the WebSocket, in-process `context.data` — reaches this
+	* one method, and a rule applied at one door is a rule the other doors do
+	* not have. What they compile to is `field-op-sql.ts`.
 	*/
 	async save(collectionPath, values, id, databaseId, options) {
 		let effectiveCollectionPath = collectionPath;
@@ -4692,8 +5074,14 @@ var PersistService = class {
 			if (!field) throw new Error(`Primary key field '${info.fieldName}' not found in table for collection '${effectiveCollectionPath}'`);
 			returningKeys[info.fieldName] = field;
 		});
+		const { values: plainValues, fieldOps } = splitFieldOps(effectiveValues);
+		const fieldOpKeys = Object.keys(fieldOps);
+		if (fieldOpKeys.length > 0) {
+			if (!id) throw ApiError.badRequest(`Field operations (${fieldOpKeys.map((k) => `'${k}'`).join(", ")}) need an existing row to act on, and this write to "${effectiveCollectionPath}" is an insert. Send the value itself instead.`, "INVALID_FIELD_OPERATION");
+			if (options?.upsert) throw ApiError.badRequest(`Field operations (${fieldOpKeys.map((k) => `'${k}'`).join(", ")}) cannot be combined with an upsert: an upsert may insert, and there would be no stored value to operate on. Use an update, or send the value itself.`, "INVALID_FIELD_OPERATION");
+		}
 		const relationValues = {};
-		const otherValues = { ...effectiveValues };
+		const otherValues = { ...plainValues };
 		const resolvedRelations = resolveCollectionRelations(collection);
 		for (const key in resolvedRelations) {
 			const relation = resolvedRelations[key];
@@ -4711,14 +5099,20 @@ var PersistService = class {
 			const joinPathRelationUpdates = serializedResult.joinPathRelationUpdates;
 			const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
 			assertWritableColumns(entityData, table, effectiveCollectionPath);
+			if (fieldOpKeys.length > 0) assertWritableColumns(Object.fromEntries(fieldOpKeys.map((key) => [key, null])), table, effectiveCollectionPath);
 			savedId = await this.db.transaction(async (tx) => {
 				let currentId;
 				if (id && !options?.upsert) {
 					currentId = id;
 					const idValues = parseIdValues(id, idInfoArray);
 					if (joinPathRelationUpdates.length > 0) await this.relationWrites.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
-					if (Object.keys(entityData).length > 0) {
-						const updateQuery = tx.update(table).set(entityData);
+					const scalarKeys = Object.keys(entityData);
+					const compiledOps = fieldOpKeys.length > 0 ? compileFieldOps(table, fieldOps, { collectionPath: effectiveCollectionPath }) : void 0;
+					if (scalarKeys.length > 0 || compiledOps) {
+						const updateQuery = tx.update(table).set({
+							...entityData,
+							...compiledOps ?? {}
+						});
 						const conditions = [];
 						for (const info of idInfoArray) {
 							const field = table[info.fieldName];
@@ -4731,12 +5125,18 @@ var PersistService = class {
 					if (id && options?.upsert) Object.assign(dataForInsert, parseIdValues(id, idInfoArray));
 					for (const info of idInfoArray) if (dataForInsert[info.fieldName] === "" || dataForInsert[info.fieldName] === null || dataForInsert[info.fieldName] === void 0) delete dataForInsert[info.fieldName];
 					const insertQuery = tx.insert(table).values(dataForInsert);
-					const hasFullKey = idInfoArray.length > 0 && idInfoArray.every((info) => dataForInsert[info.fieldName] !== void 0);
+					const targetFields = options?.onConflict && options.onConflict.length > 0 ? [...options.onConflict] : idInfoArray.map((info) => info.fieldName);
+					const hasFullKey = targetFields.length > 0 && targetFields.every((field) => dataForInsert[field] !== void 0);
 					let result;
 					if (options?.upsert && hasFullKey) {
-						const target = idInfoArray.map((info) => table[info.fieldName]);
+						const target = targetFields.map((field) => {
+							const column = table[field];
+							if (!column) throw ApiError.badRequest(`'${field}' is not a column of "${effectiveCollectionPath}", so it cannot be an upsert target.`, "INVALID_CONFLICT_TARGET");
+							return column;
+						});
 						const set = { ...dataForInsert };
 						for (const info of idInfoArray) delete set[info.fieldName];
+						for (const field of targetFields) delete set[field];
 						for (const [propName, prop] of Object.entries(collection.properties ?? {})) if (prop.type === "date" && prop.autoValue === "on_create") delete set[propName];
 						result = Object.keys(set).length > 0 ? await insertQuery.onConflictDoUpdate({
 							target,
@@ -4755,7 +5155,7 @@ var PersistService = class {
 				return currentId;
 			});
 		} catch (error) {
-			throw this.toUserFriendlyError(error, collection.slug);
+			throw this.toUserFriendlyError(error, collection.slug, collection);
 		}
 		const finalEntity = await this.fetchService.fetchOneForRest(collection.slug, savedId, void 0, databaseId);
 		if (!finalEntity) throw new Error("Could not fetch row after save.");
@@ -4784,13 +5184,23 @@ var PersistService = class {
 	}
 	/**
 	* Translate raw PostgreSQL / Drizzle errors into user-friendly messages.
+	*
+	* `collection` is passed so the SQLSTATE can be turned into a *field*: the
+	* error carries a physical column and the caller only ever sees wire names,
+	* so `author_id` had to be translated to `authorId` by whoever read the
+	* message — which nothing does. See `pgFieldViolations`.
 	*/
-	toUserFriendlyError(error, collectionSlug) {
+	toUserFriendlyError(error, collectionSlug, collection) {
 		if (error instanceof ApiError || error?.name === "ApiError") return error;
 		const pgError = extractPgError(error);
 		if (pgError) {
-			const { message, code } = pgErrorToFriendlyMessage(pgError, collectionSlug);
-			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`) : ApiError.badRequest(message, `PG_${code}`);
+			const { message, code, violations } = pgErrorToFriendlyMessage(pgError, collectionSlug, { collection });
+			/** `details` for a 4xx, carrying the field(s) — never the values. */
+			const details = violations.length > 0 ? {
+				collection: collectionSlug,
+				violations
+			} : void 0;
+			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`, details) : ApiError.badRequest(message, `PG_${code}`, details);
 			if (isRowLevelSecurityDenial(error)) return ApiError.forbidden(message, "WRITE_DENIED");
 			return new Error(message, { cause: error });
 		}
@@ -4827,8 +5237,8 @@ var DataService = class {
 	/**
 	* Fetch a single row by ID
 	*/
-	async fetchOne(collectionPath, id, databaseId) {
-		return this.fetchService.fetchOne(collectionPath, id, databaseId);
+	async fetchOne(collectionPath, id, databaseId, withDeleted) {
+		return this.fetchService.fetchOne(collectionPath, id, databaseId, withDeleted);
 	}
 	/**
 	* Fetch a collection of rows with optional filtering, ordering, and pagination
@@ -4837,6 +5247,27 @@ var DataService = class {
 		return this.fetchService.fetchCollection(collectionPath, options);
 	}
 	/**
+	* The REST read pipeline: flat rows, with exactly the relations `include`
+	* names — see {@link FetchService.fetchCollectionForRest}.
+	*
+	* Exposed on the facade because it is what *every* consumer should be
+	* reading through. The realtime refetch used to go via `fetchCollection`
+	* above, which nests a relation under a `{ __type: "relation" }` envelope
+	* and loaded every relation regardless, so a subscription and a REST list
+	* answered the same query with two different row shapes.
+	*/
+	async fetchCollectionForRest(collectionPath, options = {}, include) {
+		return this.fetchService.fetchCollectionForRest(collectionPath, options, include);
+	}
+	/** One row, through the same pipeline. See {@link FetchService.fetchOneForRest}. */
+	async fetchOneForRest(collectionPath, id, include, databaseId, options) {
+		return this.fetchService.fetchOneForRest(collectionPath, id, include, databaseId, options);
+	}
+	/** See {@link FetchService.cursorFor}. */
+	cursorFor(collectionPath, row, orderBy) {
+		return this.fetchService.cursorFor(collectionPath, row, orderBy);
+	}
+	/**
 	* Search rows by text
 	*/
 	async searchRows(collectionPath, searchString, options = {}) {
@@ -4955,7 +5386,9 @@ var physicalShapeOf = (prop) => JSON.stringify([
 	prop.columnType ?? null,
 	prop.dimensions ?? null,
 	prop.isId ?? null,
-	prop.validation?.max ?? null
+	prop.validation?.max ?? null,
+	prop.precision ?? null,
+	prop.scale ?? null
 ]);
 /** Whether the table behind a collection exists and is empty. */
 var tableIsEmpty = (collection, facts) => {
@@ -5226,37 +5659,34 @@ async function generateSchemaCommit(input) {
 	const options = { constraints: "converge" };
 	const classified = classifyCollectionChanges(input.before, input.after, input.existing);
 	if (!classified.applicable) throw new SchemaCommitError(`This change cannot be applied to a running database:\n` + classified.changes.filter((change) => change.verdict !== "safe").map((change) => `  • ${change.detail}${change.remedy ? `\n    ${change.remedy}` : ""}`).join("\n"), classified);
-	const [schema, ddl, policies, search, vector] = await Promise.all([
-		generateSchema(input.after),
-		generatePostgresDdl(input.after, {
-			includePolicies: false,
-			includeSearch: false,
-			includeVector: false
-		}),
-		Promise.resolve(generatePostgresPoliciesDdl(input.after)),
-		Promise.resolve(generatePostgresSearchDdl(input.after)),
-		Promise.resolve(generatePostgresVectorDdl(input.after, { extensions: declaredDatabaseExtensions() }))
-	]);
 	const generated = [
 		{
 			path: paths.schemaFile,
-			contents: schema
+			contents: generateSchema(input.after)
 		},
 		{
 			path: paths.ddlFile,
-			contents: ddl
+			contents: generatePostgresDdl(input.after, {
+				includePolicies: false,
+				includeSearch: false,
+				includeVector: false
+			})
 		},
 		{
 			path: paths.policiesFile,
-			contents: policies
+			contents: generatePostgresPoliciesDdl(input.after)
 		},
 		{
 			path: paths.searchFile,
-			contents: search
+			contents: generatePostgresSearchDdl(input.after)
+		},
+		{
+			path: paths.vectorFile,
+			contents: generatePostgresVectorDdl(input.after, { extensions: declaredDatabaseExtensions() })
 		},
 		{
-			path: paths.vectorFile,
-			contents: vector
+			path: paths.triggersFile,
+			contents: generatePostgresTriggersDdl(input.after)
 		}
 	];
 	const previous = planCollectionSchemaEnsure(input.before, existing, options);
@@ -5322,6 +5752,37 @@ var RoleSwitchUnavailableError = class extends Error {
 		this.pgError = pgError;
 	}
 };
+/**
+* Refuse a write that would leave a *required* `created_by` / `updated_by`
+* column null because nobody is acting.
+*
+* A `user_on_create` column takes the uid from the call context, and an
+* anonymous request, a service token and an in-process write all have none.
+* Storing `null` is the right answer where the column allows it — plenty of
+* rows are legitimately written by the server. Where the collection has said
+* `required`, it is not: that declaration means "a row must record who made
+* it", and a write that cannot answer the question is a write this collection
+* does not accept. Better a 400 naming the field than a 23502 naming the
+* column, three layers down, after the hooks have run.
+*/
+function assertActingUserForAutoValues(properties, status, uid, path) {
+	if (uid) return;
+	for (const [key, property] of Object.entries(properties)) {
+		const prop = property;
+		if (!prop || prop.type !== "string") continue;
+		if (prop.autoValue !== "user_on_create" && prop.autoValue !== "user_on_update") continue;
+		if (!prop.validation?.required) continue;
+		if (status === "existing" && prop.autoValue === "user_on_create") continue;
+		throw ApiError.badRequest(`'${key}' on '${path}' records the acting user and is required, and this request has none. Sign in, or drop \`required\` from the property to let the server write rows anonymously.`, "VALIDATION_CONSTRAINT", {
+			collection: path,
+			violations: [{
+				field: key,
+				code: "required",
+				message: `'${key}' records the acting user, and there is none.`
+			}]
+		});
+	}
+}
 var PostgresBackendDriver = class PostgresBackendDriver {
 	db;
 	registry;
@@ -5431,15 +5892,16 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				const rows = await raw.fetchCollectionForRest(collectionPath, options, include);
 				return this.applyAfterReadForRest(rows, collectionPath);
 			},
-			fetchOneForRest: async (collectionPath, id, include, databaseId) => {
-				const row = await raw.fetchOneForRest(collectionPath, id, include, databaseId);
+			fetchOneForRest: async (collectionPath, id, include, databaseId, options) => {
+				const row = await raw.fetchOneForRest(collectionPath, id, include, databaseId, options);
 				if (!row) return row;
 				const [masked] = await this.applyAfterReadForRest([row], collectionPath);
 				return masked;
 			},
 			aggregate: async (collectionPath, options) => {
 				return raw.aggregate(collectionPath, options);
-			}
+			},
+			cursorFor: (collectionPath, row, orderBy) => raw.cursorFor(collectionPath, row, orderBy)
 		};
 	}
 	/**
@@ -5661,8 +6123,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			this.realtimeService.subscriptions.delete(subscriptionId);
 		};
 	}
-	async fetchOne({ path, id, databaseId, collection }) {
-		let row = await this.dataService.fetchOne(path, id, databaseId || collection?.databaseId);
+	async fetchOne({ path, id, databaseId, collection, withDeleted }) {
+		let row = await this.dataService.fetchOne(path, id, databaseId || collection?.databaseId, withDeleted);
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
 		if (row && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
 			const contextForCallback = this.buildCallContext();
@@ -5713,10 +6175,110 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			this.realtimeService.subscriptions.delete(subscriptionId);
 		};
 	}
-	async save({ path, id, values, collection, status, upsert }) {
+	/**
+	* How many membership rows a single write will read to answer "which
+	* tenants is this caller in".
+	*
+	* A cap, not a limit on the feature: past it the API-level check stops
+	* being able to prove a tenant is *not* the caller's, and defers to the
+	* policy's `WITH CHECK`, which decides either way. The alternative — an
+	* uncapped read of a membership table on every insert — makes the cost of a
+	* write depend on how many organizations one user happens to belong to.
+	*/
+	static TENANT_MEMBERSHIP_CAP = 100;
+	/**
+	* Stamp, or refuse, the tenant on a write to a `tenant`-scoped collection.
+	*
+	* A no-op for every collection that declares no tenancy, which is the
+	* common case and costs one property read.
+	*/
+	async applyTenantScope(collection, path, values, status, previousValues) {
+		const tenant = getTenantConfig(collection);
+		if (!tenant) return values;
+		const bypassRoles = tenantBypassRoles(tenant);
+		const callerRoles = (this.user?.roles ?? []).map((r) => typeof r === "string" ? r : String(r?.id ?? r));
+		const bypass = !this.user || callerRoles.some((r) => bypassRoles.includes(r));
+		const { tenants, complete } = bypass ? {
+			tenants: [],
+			complete: true
+		} : await this.resolveCallerTenants(tenant, collection);
+		const decision = resolveTenantWrite({
+			tenant,
+			values,
+			status,
+			callerTenants: tenants,
+			callerTenantsComplete: complete,
+			bypass,
+			previousValues,
+			slug: collection?.slug ?? path
+		});
+		if (decision.refusal) {
+			const { code, field, message } = decision.refusal;
+			throw ApiError.badRequest(message, code, {
+				collection: path,
+				violations: [{
+					field,
+					code,
+					message
+				}]
+			});
+		}
+		return decision.values;
+	}
+	/**
+	* The tenants this caller may write into.
+	*
+	* Two sources, and they answer at different costs. A `claim` is already on
+	* the request — no query. A `membership` is rows in a table, and reading
+	* them is a real query, so it is capped (see
+	* {@link PostgresBackendDriver.TENANT_MEMBERSHIP_CAP}) and `complete` says
+	* whether the cap was hit.
+	*
+	* The membership read runs in the caller's own context, so the membership
+	* collection's RLS applies to it — exactly as it does inside the generated
+	* policy's subquery. That is deliberate: if the two disagreed, the API
+	* would refuse writes the database would have accepted, or accept writes it
+	* refuses. `validateCollectionConfig` is what makes sure the membership
+	* collection is readable by its own members in the first place.
+	*/
+	async resolveCallerTenants(tenant, collection) {
+		if ("claim" in tenant.from) {
+			const value = this.user?.claims?.[tenant.from.claim];
+			return {
+				tenants: value === void 0 || value === null || value === "" ? [] : [value],
+				complete: true
+			};
+		}
+		const uid = this.user?.uid;
+		if (!uid) return {
+			tenants: [],
+			complete: true
+		};
+		const { collection: slug, userField, tenantField } = tenant.from.membership;
+		const cap = PostgresBackendDriver.TENANT_MEMBERSHIP_CAP;
+		try {
+			const rows = await this.dataService.fetchCollection(slug, {
+				filter: { [userField]: ["==", uid] },
+				limit: cap + 1,
+				databaseId: collection?.databaseId
+			});
+			return {
+				tenants: Array.from(new Set(rows.slice(0, cap).map((row) => row[tenantField]).filter((value) => value !== null && value !== void 0).map((value) => typeof value === "object" ? value.id ?? value : value))),
+				complete: rows.length <= cap
+			};
+		} catch (err) {
+			logger.debug(`[save] Could not read '${slug}' to resolve the caller's tenants`, { detail: err instanceof Error ? err.message : String(err) });
+			return {
+				tenants: [],
+				complete: false
+			};
+		}
+	}
+	async save({ path, id, values, collection, status, upsert, onConflict }) {
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
+		if ((status === "new" || status === "copy") && resolvedCollection?.properties) updatedValues = applyDefaultValuesOnCreate(updatedValues, resolvedCollection.properties);
 		let previousValuesForHistory;
 		if (status === "existing" && id) try {
 			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
@@ -5769,14 +6331,27 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		} catch (callbackError) {
 			throw toCallbackError(callbackError, "beforeSave", path);
 		}
-		if (resolvedCollection?.properties) updatedValues = updateDateAutoValues({
-			inputValues: updatedValues,
-			properties: resolvedCollection.properties,
-			status: status ?? "new",
-			timestampNowValue: /* @__PURE__ */ new Date()
-		});
+		if (resolvedCollection?.properties) {
+			updatedValues = updateDateAutoValues({
+				inputValues: updatedValues,
+				properties: resolvedCollection.properties,
+				status: status ?? "new",
+				timestampNowValue: /* @__PURE__ */ new Date()
+			});
+			assertActingUserForAutoValues(resolvedCollection.properties, status ?? "new", this.user?.uid, path);
+			updatedValues = updateUserAutoValues({
+				inputValues: updatedValues,
+				properties: resolvedCollection.properties,
+				status: status ?? "new",
+				uid: this.user?.uid
+			});
+		}
+		updatedValues = await this.applyTenantScope(resolvedCollection, path, updatedValues, status ?? "new", previousValuesForHistory);
 		try {
-			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, { upsert });
+			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, {
+				upsert,
+				onConflict
+			});
 			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
 				if (globalCallbacks?.afterRead) savedRow = await globalCallbacks.afterRead({
 					collection: resolvedCollection,
@@ -5832,7 +6407,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			} catch (callbackError) {
 				throw toCallbackError(callbackError, "afterSave", path);
 			}
-			if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
+			if (this.historyService && resolvedCollection?.history) await this.historyService.recordHistory({
 				tableName: path,
 				id: savedId,
 				action: status === "new" ? "create" : "update",
@@ -5887,13 +6462,17 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	* Rows are applied in order, so a batch that touches the same key twice ends
 	* with the last write winning, exactly as separate calls would.
 	*/
-	async saveMany({ path, rows, collection, upsert }) {
+	bindToTransaction(tx) {
+		const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+		txDriver.dataService = new DataService(tx, this.registry);
+		txDriver.client = this.client;
+		txDriver._deferNotifications = this._deferNotifications;
+		txDriver._pendingNotifications = this._pendingNotifications;
+		return txDriver;
+	}
+	async saveMany({ path, rows, collection, upsert, onConflict }) {
 		return this.db.transaction(async (tx) => {
-			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-			txDriver.dataService = new DataService(tx, this.registry);
-			txDriver.client = this.client;
-			txDriver._deferNotifications = this._deferNotifications;
-			txDriver._pendingNotifications = this._pendingNotifications;
+			const txDriver = this.bindToTransaction(tx);
 			const saved = [];
 			for (let i = 0; i < rows.length; i++) {
 				const values = rows[i];
@@ -5904,7 +6483,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 						values,
 						collection,
 						status: "new",
-						upsert
+						upsert,
+						onConflict
 					}));
 				} catch (error) {
 					const label = id !== void 0 ? `id ${JSON.stringify(id)}` : "no id";
@@ -5935,11 +6515,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	*/
 	async updateMany({ path, updates, collection }) {
 		return this.db.transaction(async (tx) => {
-			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-			txDriver.dataService = new DataService(tx, this.registry);
-			txDriver.client = this.client;
-			txDriver._deferNotifications = this._deferNotifications;
-			txDriver._pendingNotifications = this._pendingNotifications;
+			const txDriver = this.bindToTransaction(tx);
 			const saved = [];
 			for (let i = 0; i < updates.length; i++) {
 				const { id, values } = updates[i];
@@ -5981,13 +6557,9 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	* dependents would behave differently depending on how many rows the caller
 	* happened to delete at once. Same pipeline, one transaction.
 	*/
-	async deleteMany({ path, ids, collection }) {
+	async deleteMany({ path, ids, collection, hard }) {
 		await this.db.transaction(async (tx) => {
-			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-			txDriver.dataService = new DataService(tx, this.registry);
-			txDriver.client = this.client;
-			txDriver._deferNotifications = this._deferNotifications;
-			txDriver._pendingNotifications = this._pendingNotifications;
+			const txDriver = this.bindToTransaction(tx);
 			for (let i = 0; i < ids.length; i++) {
 				const id = ids[i];
 				try {
@@ -6006,7 +6578,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 							path,
 							values: existing
 						},
-						collection
+						collection,
+						hard
 					});
 				} catch (error) {
 					throw Object.assign(new Error(`Delete ${i} of ${ids.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
@@ -6018,7 +6591,107 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			}
 		});
 	}
-	async delete({ row, collection }) {
+	/**
+	* A mixed list of writes across collections, as one unit of work.
+	*
+	* Same transaction, same tx-bound sub-driver and same per-entry error
+	* labelling as {@link saveMany} — deliberately the same plumbing rather
+	* than a second copy of it, because the three ways this could drift
+	* (notifications not deferred, the sub-driver not bound, an error losing
+	* its status) are all silent.
+	*
+	* The one thing this adds is `$ref`. An operation may name itself, and a
+	* later one may stand a `{ "$ref": "order.id" }` where a value goes; the
+	* substitution happens here because inside the transaction is the only
+	* place the row the reference points at exists. Backward references only —
+	* the REST layer refuses a forward one before the transaction opens, so a
+	* body that cannot work never costs a rollback.
+	*/
+	async batchWrite({ operations }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = this.bindToTransaction(tx);
+			const results = [];
+			/** What each named operation wrote, for the `$ref`s after it. */
+			const named = /* @__PURE__ */ new Map();
+			for (let i = 0; i < operations.length; i++) {
+				const operation = operations[i];
+				try {
+					const values = operation.values ? resolveBatchRefs(operation.values, named) : void 0;
+					const rawId = operation.id !== void 0 ? resolveBatchRefs(operation.id, named) : void 0;
+					const id = rawId === void 0 || rawId === null ? void 0 : String(rawId);
+					let row = null;
+					switch (operation.op) {
+						case "create":
+							row = await txDriver.save({
+								path: operation.path,
+								values: values ?? {},
+								collection: operation.collection,
+								status: "new"
+							});
+							break;
+						case "upsert":
+							row = await txDriver.save({
+								path: operation.path,
+								values: values ?? {},
+								collection: operation.collection,
+								status: "new",
+								upsert: true,
+								onConflict: operation.onConflict
+							});
+							break;
+						case "update":
+							if (!await txDriver.fetchOne({
+								path: operation.path,
+								id,
+								collection: operation.collection
+							})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+								statusCode: 404,
+								code: "NOT_FOUND"
+							});
+							row = await txDriver.save({
+								path: operation.path,
+								id,
+								values: values ?? {},
+								collection: operation.collection,
+								status: "existing"
+							});
+							break;
+						case "delete": {
+							const existing = await txDriver.fetchOne({
+								path: operation.path,
+								id,
+								collection: operation.collection
+							});
+							if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+								statusCode: 404,
+								code: "NOT_FOUND"
+							});
+							await txDriver.delete({
+								row: {
+									id,
+									path: operation.path,
+									values: existing
+								},
+								collection: operation.collection
+							});
+							row = null;
+							break;
+						}
+					}
+					if (operation.ref && row) named.set(operation.ref, row);
+					results.push(row);
+				} catch (error) {
+					throw Object.assign(new Error(`Operation ${i} of ${operations.length} (${operation.op} on "${operation.path}") failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return results;
+		});
+	}
+	async delete({ row, collection, hard }) {
 		const targetPath = row.path;
 		const targetRow = { ...row.values ?? {} };
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, targetPath);
@@ -6058,7 +6731,9 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		} catch (callbackError) {
 			throw toCallbackError(callbackError, "beforeDelete", targetPath);
 		}
-		await this.dataService.delete(targetPath, row.id, resolvedCollection?.databaseId);
+		const softDelete = hard ? void 0 : resolveSoftDelete(resolvedCollection);
+		if (softDelete) await this.dataService.save(targetPath, { [softDelete.field]: /* @__PURE__ */ new Date() }, row.id, resolvedCollection?.databaseId);
+		else await this.dataService.delete(targetPath, row.id, resolvedCollection?.databaseId);
 		try {
 			if (globalCallbacks?.afterDelete || callbacks?.afterDelete || propertyCallbacks?.afterDelete) {
 				if (globalCallbacks?.afterDelete) await globalCallbacks.afterDelete({
@@ -6086,7 +6761,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		} catch (callbackError) {
 			throw toCallbackError(callbackError, "afterDelete", targetPath);
 		}
-		if (this.historyService && resolvedCollection?.history) this.historyService.recordHistory({
+		if (this.historyService && resolvedCollection?.history) await this.historyService.recordHistory({
 			tableName: targetPath,
 			id: row.id.toString(),
 			action: "delete",
@@ -6108,12 +6783,13 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	async checkUniqueField(path, name, value, id, collection) {
 		return this.dataService.checkUniqueField(path, name, value, id, collection?.databaseId);
 	}
-	async count({ path, collection, filter, logical, searchString, vectorSearch }) {
+	async count({ path, collection, filter, logical, searchString, vectorSearch, withDeleted }) {
 		return this.dataService.count(path, {
 			filter,
 			logical,
 			searchString,
-			vectorSearch
+			vectorSearch,
+			withDeleted
 		});
 	}
 	getTargetDb(databaseName) {
@@ -6365,21 +7041,22 @@ var AuthenticatedPostgresBackendDriver = class {
 					return delegate.restFetchService.fetchCollectionForRest(collectionPath, options, include);
 				}, { accessMode: "read only" });
 			},
-			fetchOneForRest: async (collectionPath, id, include, databaseId) => {
+			fetchOneForRest: async (collectionPath, id, include, databaseId, options) => {
 				return this.withTransaction(async (delegate) => {
-					return delegate.restFetchService.fetchOneForRest(collectionPath, id, include, databaseId);
+					return delegate.restFetchService.fetchOneForRest(collectionPath, id, include, databaseId, options);
 				}, { accessMode: "read only" });
 			},
 			aggregate: async (collectionPath, options) => {
 				return this.withTransaction(async (delegate) => {
 					return delegate.restFetchService.aggregate(collectionPath, options);
 				}, { accessMode: "read only" });
-			}
+			},
+			cursorFor: (collectionPath, row, orderBy) => this.delegate.restFetchService.cursorFor?.(collectionPath, row, orderBy)
 		};
 	}
 	async withTransaction(operation, options) {
 		const pendingNotifications = [];
-		const result = await this.delegate.db.transaction(async (tx) => {
+		const result = await withFieldViewer({ roles: this.user?.roles ?? [] }, async () => await this.delegate.db.transaction(async (tx) => {
 			let uid = this.user?.uid;
 			if (!uid) {
 				logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
@@ -6390,7 +7067,8 @@ var AuthenticatedPostgresBackendDriver = class {
 			await applyAuthContext(tx, {
 				uid,
 				roles: userRoles,
-				isAnonymous: this.user?.isAnonymous === true
+				isAnonymous: this.user?.isAnonymous === true,
+				claims: this.user?.claims
 			}, this.delegate.rlsUserRole);
 			const txEntityService = new DataService(tx, this.delegate.registry);
 			const txDelegate = new PostgresBackendDriver(tx, this.delegate.realtimeService, this.delegate.registry, this.user, this.delegate.poolManager, this.delegate.historyService);
@@ -6399,7 +7077,7 @@ var AuthenticatedPostgresBackendDriver = class {
 			txDelegate._pendingNotifications = pendingNotifications;
 			txDelegate.client = this.delegate.client;
 			return await operation(txDelegate);
-		}, options);
+		}, options));
 		for (const notification of pendingNotifications) try {
 			await this.delegate.realtimeService.notifyUpdate(notification.path, notification.id, notification.row, notification.databaseId);
 		} catch (e) {
@@ -6417,7 +7095,8 @@ var AuthenticatedPostgresBackendDriver = class {
 	injectAuthContext(unsubscribe) {
 		const authContext = {
 			uid: this.user?.uid || "anonymous",
-			roles: this.user?.roles ?? []
+			roles: this.user?.roles ?? [],
+			...this.user?.claims ? { claims: this.user.claims } : {}
 		};
 		const entries = Array.from(this.delegate.realtimeService.subscriptions.entries());
 		const lastSub = entries[entries.length - 1]?.[1];
@@ -6448,6 +7127,33 @@ var AuthenticatedPostgresBackendDriver = class {
 	async saveMany(props) {
 		return this.withTransaction((delegate) => delegate.saveMany(props));
 	}
+	/**
+	* Present for the same reason `saveMany` is, and absent until now.
+	*
+	* Every request that reaches the REST layer is served by *this* class — the
+	* base driver never sees one — and the routes ask `if (!driver.updateMany)`
+	* before doing anything. So `PATCH /api/data/<c>/bulk` and
+	* `POST /api/data/<c>/bulk/delete` answered `BULK_UNSUPPORTED` on Postgres,
+	* the one backend that implements them, for every authenticated caller.
+	* The methods existed one class down and nothing forwarded to them.
+	*/
+	async updateMany(props) {
+		return this.withTransaction((delegate) => delegate.updateMany(props));
+	}
+	async deleteMany(props) {
+		return this.withTransaction((delegate) => delegate.deleteMany(props));
+	}
+	/**
+	* One transaction, one RLS context, every collection the batch touches.
+	*
+	* The whole point is that it runs as the caller: a batch that dropped to
+	* the base driver would write across collections with row-level security
+	* switched off, which is the opposite of what a cross-collection write
+	* needs.
+	*/
+	async batchWrite(props) {
+		return this.withTransaction((delegate) => delegate.batchWrite(props));
+	}
 	async delete(props) {
 		return this.withTransaction((delegate) => delegate.delete(props));
 	}
@@ -8185,11 +8891,14 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					orderBy,
 					order: request.order,
 					limit: boundedLimit,
-					offset: request.offset,
+					offset: request.page != null && request.page > 0 ? (request.page - 1) * boundedLimit : request.offset,
 					startAfter: request.startAfter,
 					databaseId: request.collection?.databaseId,
 					searchString: request.searchString,
-					searchExplain: request.searchExplain
+					searchExplain: request.searchExplain,
+					include: request.include,
+					fields: request.fields,
+					distinct: request.distinct
 				},
 				authContext,
 				started: 0,
@@ -8198,7 +8907,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			this._subscriptions.set(subscriptionId, subscription);
 			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			const rows = await this.fetchCollectionWithAuth(request.path, subscription.collectionRequest, authContext);
-			if (canDeliver()) this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
+			const meta = await this.collectionMetaWithAuth(request.path, subscription.collectionRequest, rows, authContext);
+			if (canDeliver()) this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path, meta);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
 			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -8361,7 +9071,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			const canDeliver = this.beginDelivery(subscriptionId, subscription);
 			try {
 				const rows = await this.fetchCollectionWithAuth(notifyPath, subscription.collectionRequest, subscription.authContext);
-				if (canDeliver()) this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath);
+				const meta = await this.collectionMetaWithAuth(notifyPath, subscription.collectionRequest, rows, subscription.authContext);
+				if (canDeliver()) this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath, meta);
 			} catch (error) {
 				const sanitized = sanitizeErrorForClient(error, notifyPath);
 				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
@@ -8399,24 +9110,14 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				uid: ANONYMOUS_USER_ID,
 				roles: ["anon"]
 			};
-			return await this.db.transaction(async (tx) => {
+			return await withFieldViewer({ roles: activeAuth.roles ?? [] }, async () => await this.db.transaction(async (tx) => {
 				await applyAuthContext(tx, {
 					uid: activeAuth.uid,
 					roles: activeAuth.roles,
-					isAnonymous: activeAuth.isAnonymous === true
+					isAnonymous: activeAuth.isAnonymous === true,
+					claims: activeAuth.claims
 				}, this.rlsUserRole);
-				const txEntityService = new DataService(tx, this.registry);
-				let fetchedEntities;
-				if (collectionRequest.searchString) fetchedEntities = await txEntityService.searchRows(notifyPath, collectionRequest.searchString, {
-					filter: collectionRequest.filter,
-					logical: collectionRequest.logical,
-					orderBy: collectionRequest.orderBy,
-					order: collectionRequest.order,
-					limit: collectionRequest.limit,
-					databaseId: collectionRequest.databaseId,
-					searchExplain: collectionRequest.searchExplain
-				});
-				else fetchedEntities = await txEntityService.fetchCollection(notifyPath, {
+				const fetchedEntities = await new DataService(tx, this.registry).fetchCollectionForRest(notifyPath, {
 					filter: collectionRequest.filter,
 					logical: collectionRequest.logical,
 					orderBy: collectionRequest.orderBy,
@@ -8424,8 +9125,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					limit: collectionRequest.limit,
 					offset: collectionRequest.offset,
 					startAfter: collectionRequest.startAfter,
-					databaseId: collectionRequest.databaseId
-				});
+					searchString: collectionRequest.searchString,
+					searchExplain: collectionRequest.searchExplain,
+					databaseId: collectionRequest.databaseId,
+					fields: collectionRequest.fields,
+					distinct: collectionRequest.distinct
+				}, collectionRequest.include);
 				const registryCollection = this.registry.getCollectionByPath(notifyPath);
 				const resolvedCollection = collection ? {
 					...collection,
@@ -8467,27 +9172,78 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					}));
 				}
 				return fetchedEntities;
-			});
+			}));
 		}
-		if (collectionRequest.searchString) return await this.dataService.searchRows(notifyPath, collectionRequest.searchString, {
+		return await withFieldViewer({ roles: authContext?.roles ?? [] }, async () => await this.dataService.fetchCollectionForRest(notifyPath, {
 			filter: collectionRequest.filter,
 			logical: collectionRequest.logical,
 			orderBy: collectionRequest.orderBy,
 			order: collectionRequest.order,
 			limit: collectionRequest.limit,
+			offset: collectionRequest.offset,
+			startAfter: collectionRequest.startAfter,
+			searchString: collectionRequest.searchString,
+			searchExplain: collectionRequest.searchExplain,
 			databaseId: collectionRequest.databaseId,
-			searchExplain: collectionRequest.searchExplain
-		});
-		return await this.dataService.fetchCollection(notifyPath, {
+			fields: collectionRequest.fields,
+			distinct: collectionRequest.distinct
+		}, collectionRequest.include));
+	}
+	/**
+	* The `meta` a `collection_update` frame carries beside its rows.
+	*
+	* Frames used to carry rows and primary keys and nothing else, so the
+	* client issued a `GET /count` **per push** to fill in a total it needed to
+	* render the same list it had just been handed — one extra round trip per
+	* write, per subscriber, forever. The refetch already knows the query; it
+	* counts once, here, under the same RLS transaction that read the rows, so
+	* the total describes the same set they came from.
+	*/
+	async collectionMetaWithAuth(notifyPath, collectionRequest, rows, authContext) {
+		const limit = collectionRequest.limit ?? rows.length;
+		const offset = collectionRequest.offset ?? 0;
+		const countOnce = async (service) => service.count(notifyPath, {
 			filter: collectionRequest.filter,
 			logical: collectionRequest.logical,
-			orderBy: collectionRequest.orderBy,
-			order: collectionRequest.order,
-			limit: collectionRequest.limit,
-			offset: collectionRequest.offset,
-			startAfter: collectionRequest.startAfter,
+			searchString: collectionRequest.searchString,
 			databaseId: collectionRequest.databaseId
 		});
+		let total;
+		try {
+			if (this.driver) {
+				const activeAuth = authContext || {
+					uid: ANONYMOUS_USER_ID,
+					roles: ["anon"]
+				};
+				total = await this.db.transaction(async (tx) => {
+					await applyAuthContext(tx, {
+						uid: activeAuth.uid,
+						roles: activeAuth.roles,
+						isAnonymous: activeAuth.isAnonymous === true,
+						claims: activeAuth.claims
+					}, this.rlsUserRole);
+					return countOnce(new DataService(tx, this.registry));
+				});
+			} else total = await countOnce(this.dataService);
+		} catch (error) {
+			logger.warn(`[RealtimeService] Could not count '${notifyPath}' for a subscription frame`, { error });
+			return {
+				limit,
+				offset,
+				hasMore: false,
+				partial: true
+			};
+		}
+		const last = rows[rows.length - 1];
+		const hasMore = offset + rows.length < total;
+		const nextCursor = hasMore && last ? this.dataService.cursorFor?.(notifyPath, last, normalizeDriverOrderBy(collectionRequest.orderBy, collectionRequest.order)) : void 0;
+		return {
+			total,
+			limit,
+			offset,
+			hasMore,
+			...nextCursor && { nextCursor }
+		};
 	}
 	/**
 	* Debounce an row refetch for a WebSocket subscription.
@@ -8538,13 +9294,14 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				uid: ANONYMOUS_USER_ID,
 				roles: ["anon"]
 			};
-			return await this.db.transaction(async (tx) => {
+			return await withFieldViewer({ roles: activeAuth.roles ?? [] }, async () => await this.db.transaction(async (tx) => {
 				await applyAuthContext(tx, {
 					uid: activeAuth.uid,
 					roles: activeAuth.roles,
-					isAnonymous: activeAuth.isAnonymous === true
+					isAnonymous: activeAuth.isAnonymous === true,
+					claims: activeAuth.claims
 				}, this.rlsUserRole);
-				let processedEntity = await new DataService(tx, this.registry).fetchOne(notifyPath, id, collection?.databaseId);
+				let processedEntity = await new DataService(tx, this.registry).fetchOneForRest(notifyPath, id, void 0, collection?.databaseId) ?? void 0;
 				if (processedEntity) {
 					const registryCollection = this.registry.getCollectionByPath(notifyPath);
 					const resolvedCollection = collection ? {
@@ -8584,16 +9341,17 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					}
 				}
 				return processedEntity;
-			});
+			}));
 		}
-		return await this.dataService.fetchOne(notifyPath, id);
+		return await withFieldViewer({ roles: authContext?.roles ?? [] }, async () => await this.dataService.fetchOneForRest(notifyPath, id) ?? void 0);
 	}
-	sendCollectionUpdate(clientId, subscriptionId, rows, path) {
+	sendCollectionUpdate(clientId, subscriptionId, rows, path, meta) {
 		const message = {
 			type: "collection_update",
 			subscriptionId,
 			rows,
-			pks: this.primaryKeysForPath(path)
+			pks: this.primaryKeysForPath(path),
+			...meta && { meta }
 		};
 		this.sendMessage(clientId, message);
 	}
@@ -9750,7 +10508,8 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 							uid: jwtPayload.uid,
 							roles: jwtPayload.roles ?? [],
 							isAdmin: (jwtPayload.roles ?? []).some((r) => r === "admin"),
-							isAnonymous: jwtPayload.isAnonymous === true
+							isAnonymous: jwtPayload.isAnonymous === true,
+							claims: jwtPayload.claims
 						};
 					}
 					if (verifiedUser) {
@@ -9825,7 +10584,8 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					if (!path || !values || typeof values !== "object") return;
 					const collection = driver.registry?.getCollectionByPath(path);
 					if (!collection) return;
-					assertWriteRequestValid(values, collection);
+					assertWriteRequestValid(values, collection, { viewer: { roles: clientSessions.get(clientId)?.user?.roles ?? ["anon"] } });
+					assertFieldOpsValid(values, collection);
 				};
 				const getScopedDelegate = async () => {
 					const session = clientSessions.get(clientId);
@@ -9837,7 +10597,8 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 							photoURL: null,
 							providerId: "websocket",
 							isAnonymous: false,
-							roles: session.user.roles ?? []
+							roles: session.user.roles ?? [],
+							claims: session.user.claims
 						} : {
 							uid: ANONYMOUS_USER_ID,
 							displayName: null,
@@ -10146,7 +10907,8 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						const authContext = session?.user ? {
 							uid: session.user.uid,
 							roles: session.user.roles ?? [],
-							isAnonymous: session.user.isAnonymous === true
+							isAnonymous: session.user.isAnonymous === true,
+							claims: session.user.claims
 						} : {
 							uid: ANONYMOUS_USER_ID,
 							roles: ["anon"],
@@ -10353,7 +11115,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-Br3tqwsy.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-DA7a6SUV.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -10425,22 +11187,21 @@ var quote = (xs) => Array.from(xs).map((s) => `\`${s}\``).join(", ");
 /** `on.from` / `on.to` accept a single column or a composite tuple. */
 var asColumns = (value) => Array.isArray(value) ? value : [value];
 /**
-* Distinguish "this column name is wrong" from "the generated schema is old".
+* Distinguish "this column name is wrong" from "this database was never
+* migrated".
 *
-* They present identically here — a relation asks for a column the registered
-* table does not have — but they are opposite problems with opposite fixes, and
-* getting them the wrong way round is how the 0.12 → 0.13 upgrade bricked
-* projects.
+* They present identically here — a relation asks for a column the table does
+* not have — but they are opposite problems with opposite fixes, and getting
+* them the wrong way round is how the 0.12 → 0.13 upgrade bricked projects.
 *
-* The registered table is not the database. It comes from the project's
-* checked-in `backend/src/schema.generated.ts`, and 0.13 changed the rule that
-* derives foreign-key names: `categories` yields `category_id` where it used to
-* yield `categorie_id`. Boot-ensure renames the database column to match, so by
-* the time this runs the *database* is correct and the *generated module* is the
-* stale one. Reporting "not a column" then points at the wrong artifact, and the
-* generic fix — "set `through.targetColumn` to one of: …", listing the legacy
-* name because that is what the stale module still has — talks the reader into
-* pinning a column that no longer exists.
+* 0.13 changed the rule that derives foreign-key names: `categories` yields
+* `category_id` where it used to yield `categorie_id`. Boot-ensure renames the
+* database column to match — but only in a process that provisions. Where
+* nothing has, the database still carries the old spelling while the config
+* derives the new one, and the generic fix ("set `through.targetColumn` to one
+* of: …", listing the legacy name because that is what the table still has)
+* talks the reader into pinning a column that is about to be renamed out from
+* under them.
 *
 * So when the wanted name is what the current rule derives, and the table
 * carries what the *previous* rule would have derived from the same source, say
@@ -10468,8 +11229,8 @@ function staleCodegenRename(wanted, available, sources) {
 /** The shared explanation, so every relation kind reports it identically. */
 function staleCodegenDefect(table, { legacy, current }) {
 	return {
-		problem: `the generated Drizzle schema still declares \`${legacy}\` on \`${table}\`, but this release derives \`${current}\` — the generated schema predates the foreign-key naming fix and no longer describes the database`,
-		fix: `regenerate it with \`rebase schema generate\` (or \`pnpm run schema:generate\`). The database column has already been renamed for you at boot, so nothing else is needed. To keep \`${legacy}\` instead, name it explicitly on the relation and regenerate.`
+		problem: `the database still has \`${legacy}\` on \`${table}\`, but this release derives \`${current}\` — the column predates the foreign-key naming fix and nothing has renamed it yet`,
+		fix: `let boot-ensure rename it (redeploy, or start with schema provisioning enabled), or run \`rebase db push\`. Then run \`rebase schema generate\` so the committed schema file agrees. To keep \`${legacy}\` instead, name it explicitly on the relation.`
 	};
 }
 /**
@@ -10648,16 +11409,13 @@ function assertRelationsResolve(collections, registry) {
 	const defects = findRelationDefects(collections, registry);
 	if (defects.length === 0) return;
 	const lines = defects.map((d) => `  • ${d.collection}.${d.relationName} (${d.kind})\n      ${d.problem}\n      fix: ${d.fix}`);
-	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against \`backend/src/schema.generated.ts\`.
+	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against the database this server is connected to.
 
 Each of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
 
-If the database was migrated recently — an upgrade, a \`db push\`, a restore — this file is
-probably older than the schema it describes. Regenerate it before changing anything else:
-
-    rebase schema generate
-
-If it is already current, then the collection is what disagrees with it:
+If the schema has not been applied to this database yet, apply it — \`rebase db push\`
+(dev), \`rebase db migrate\` (prod), or a redeploy, which creates tables at boot. If it
+has, then the collection is what disagrees with the database:
 
 ` + lines.join("\n\n") + "\n");
 }
@@ -11907,11 +12665,30 @@ var HistoryService = class {
 		};
 	}
 	/**
-	* Record a history entry for an row change.
-	* This is intentionally fire-and-forget safe — errors are logged but never
-	* bubble up to block the main save/delete operation.
+	* Record a history entry for a row change.
+	*
+	* ## Why this is allowed to fail the write
 	*
-	* After inserting, kicks off a non-blocking pruning pass for this row.
+	* It used to swallow every error into a log line, and the driver called it
+	* without `await`, so the promise was dropped on the floor. Both halves of
+	* that made the same claim: that the audit trail is a nice-to-have. It is
+	* not — `history: true` is opted into by collections whose changes somebody
+	* has to be able to reconstruct, and a trail with gaps is worse than no
+	* trail, because nothing distinguishes "no change was made" from "the entry
+	* did not get written". The gaps were silent and unbounded: a transient
+	* error on the history insert lost the entry for a row that committed
+	* anyway, and nobody found out.
+	*
+	* So it throws, and the driver awaits it inside the write's transaction.
+	* The row and its history entry commit together or neither does. That is a
+	* real trade — a broken `rebase.entity_history` now fails writes to the
+	* collections that declare history, where before it failed quietly — and it
+	* is the right side of it for a table that exists to answer "who changed
+	* this". The table is created at boot (`ensureHistoryTableExists`), so the
+	* failure mode is a database that is broken in other ways too.
+	*
+	* The pruning pass stays non-blocking: a prune that does not run leaves
+	* *extra* history, which is not a loss and is fixed by the next write.
 	*/
 	async recordHistory(params) {
 		const { tableName, id, action, values, previousValues, updatedBy } = params;
@@ -11919,7 +12696,7 @@ var HistoryService = class {
 		if (action === "update" && (!changedFields || changedFields.length === 0)) return;
 		try {
 			await this.db.execute(sql`
-                INSERT INTO rebase.entity_history 
+                INSERT INTO rebase.entity_history
                     (table_name, entity_id, action, changed_fields, "values", previous_values, updated_by)
                 VALUES (
                     ${tableName},
@@ -11931,10 +12708,11 @@ var HistoryService = class {
                     ${updatedBy ?? null}
                 )
             `);
-			this.pruneEntity(tableName, id).catch((err) => logger.error("History prune failed", { error: err }));
 		} catch (error) {
 			logger.error("Failed to record row history", { error });
+			throw new Error(`Could not record the history entry for "${tableName}" (${String(id)}). The write was rolled back: this collection declares \`history: true\`, and a row that commits without its audit entry leaves a gap nothing can distinguish from "no change was made".`, { cause: error });
 		}
+		this.pruneEntity(tableName, id).catch((err) => logger.error("History prune failed", { error: err }));
 	}
 	/**
 	* Fetch history entries for an row, ordered by most recent first.
@@ -12221,6 +12999,12 @@ async function introspectSchema(client, pgSchema) {
             c.udt_name,
             c.is_nullable,
             c.column_default,
+            -- A stored generated column must be declared as one, or drizzle
+            -- writes DEFAULT into it on every INSERT. Postgres tolerates that
+            -- today; the generated module has always declared them properly,
+            -- and the runtime tables are built to match it.
+            c.is_generated,
+            c.generation_expression,
             (SELECT a.atttypmod FROM pg_attribute a
              JOIN pg_class pc ON a.attrelid = pc.oid
              WHERE pc.relname = c.table_name
@@ -12372,18 +13156,40 @@ function buildCollectionsFromSchema({ tablesMap, enumMap, joinTables }, pgSchema
 /**
 * Build drizzle tables at runtime from an introspected schema.
 *
-* A project with declared collections gets its drizzle tables from a generated `schema.generated.ts` that
-* the developer commits. BaaS mode has no such file — it points at a database
-* and serves it — so the equivalent table objects are constructed here from
-* `information_schema` metadata.
+* **Every** data source's tables are built here, from `information_schema`,
+* after boot-ensure has run — a project with declared collections included. The
+* committed `schema.generated.ts` is a build artefact for Atlas, `db push`,
+* `eject` and user code; the runtime does not read it for its tables, because a
+* file that is one commit behind the database used to change what the server
+* served (a renamed foreign-key column 500'd every request, a lost relation
+* silently emptied a list). See `catalogue-schema.ts` for the caller.
 *
 * These are handed to drizzle as its schema, which keeps the relational query
 * path (`db.query.*`) working; without them FetchService would fall back to
 * plain selects and lose relation loading.
+*
+* Two things a caller has to supply for the tables to match what the generated
+* module used to produce, both about *names*: the Drizzle object is keyed by the
+* wire name of a column and not by the column (`authorId`, not `author_id`), and
+* a relation is keyed by the collection's own relation key rather than by a
+* guess made from the foreign key. Both come from the collections — see
+* `columnKeysFromCollections` and `buildDrizzleRelationsFromCollections`.
 */
+var columnNameAsKey = (_table, column) => column;
 /** drizzle ships no bytea builder; binary must round-trip as a Buffer. */
 var bytea = customType({ dataType: () => "bytea" });
 /**
+* A full-text search column, declared with its real SQL type.
+*
+* Not cosmetic: `isSearchIndexColumn` asks the column for its type and drops
+* every `tsvector` from the projection, so a search column that fell through to
+* `text` (the old default for an unrecognised type) would be selected, returned
+* to callers, and rendered in the admin as a wall of lexemes. drizzle ships no
+* builder for these two.
+*/
+var tsvector = customType({ dataType: () => "tsvector" });
+var tsquery = customType({ dataType: () => "tsquery" });
+/**
 * Postgres stores a column's type modifier (varchar length, vector dimensions)
 * in `atttypmod`. For length-carrying string types it is length + VARHDRSZ(4);
 * for pgvector it is the dimension count as-is. -1 means unspecified.
@@ -12415,8 +13221,11 @@ function scalarBuilder(udtName, name, col) {
 		case "date": return date(name);
 		case "time": return time(name);
 		case "timetz": return time(name, { withTimezone: true });
-		case "timestamp": return timestamp(name);
-		case "timestamptz": return timestamp(name, { withTimezone: true });
+		case "timestamp": return timestamp(name, { mode: "string" });
+		case "timestamptz": return timestamp(name, {
+			withTimezone: true,
+			mode: "string"
+		});
 		case "interval": return interval(name);
 		case "bytea": return bytea(name);
 		case "inet": return inet(name);
@@ -12438,6 +13247,8 @@ function scalarBuilder(udtName, name, col) {
 			const length = varlenLength(col);
 			return length ? varchar(name, { length }) : text(name);
 		}
+		case "tsvector": return tsvector(name);
+		case "tsquery": return tsquery(name);
 		default: return text(name);
 	}
 }
@@ -12447,20 +13258,26 @@ function columnBuilderFor(col) {
 }
 /**
 * Build one drizzle table per introspected table, keyed by table name.
+*
+* @param columnKey how a column is named on the wire — see {@link ColumnKeyResolver}.
 */
-function buildDrizzleTablesFromSchema(tablesMap, pgSchemaName = "public") {
+function buildDrizzleTablesFromSchema(tablesMap, pgSchemaName = "public", columnKey = columnNameAsKey) {
 	const schema = pgSchemaName === "public" ? null : pgSchema(pgSchemaName);
 	const createTable = schema ? schema.table.bind(schema) : pgTable;
 	const tables = {};
 	for (const [tableName, meta] of tablesMap) {
 		const columns = {};
+		const keyOf = /* @__PURE__ */ new Map();
 		for (const col of meta.columns) {
 			let builder = columnBuilderFor(col);
 			if (col.is_nullable === "NO") builder = builder.notNull();
 			if (meta.pks.length === 1 && meta.pks[0] === col.column_name) builder = builder.primaryKey();
-			columns[col.column_name] = builder;
+			if (col.is_generated === "ALWAYS") builder = builder.generatedAlwaysAs(sql.raw(col.generation_expression ?? ""));
+			const key = columnKey(tableName, col.column_name);
+			keyOf.set(col.column_name, key);
+			columns[key] = builder;
 		}
-		tables[tableName] = createTable(tableName, columns, meta.pks.length > 1 ? (t) => [primaryKey({ columns: meta.pks.map((pk) => t[pk]) })] : void 0);
+		tables[tableName] = createTable(tableName, columns, meta.pks.length > 1 ? (t) => [primaryKey({ columns: meta.pks.map((pk) => t[keyOf.get(pk) ?? pk]) })] : void 0);
 	}
 	return tables;
 }
@@ -12475,29 +13292,29 @@ function buildDrizzleTablesFromSchema(tablesMap, pgSchemaName = "public") {
 * The keys here must match `buildRelations` in introspect-runtime.ts, which is
 * what names the collection's relation properties.
 */
-function buildDrizzleRelationsFromSchema(tablesMap, tables) {
+function buildDrizzleRelationsFromSchema(tablesMap, tables, columnKey = columnNameAsKey) {
 	/** Owning side, per table: the `one()` relations from its foreign keys. */
 	const owning = /* @__PURE__ */ new Map();
 	/** Inverse side, per referenced table: the matching `many()` back-references. */
 	const inverse = /* @__PURE__ */ new Map();
 	for (const [tableName, meta] of tablesMap) {
 		if (!tables[tableName]) continue;
-		const columnNames = new Set(meta.columns.map((c) => c.column_name));
+		const columnNames = new Set(meta.columns.map((c) => columnKey(tableName, c.column_name)));
 		for (const fk of meta.fks) {
 			if (!tables[fk.foreign_table_name]) continue;
-			let key = fk.column_name.replace(/_id$/, "");
+			let key = toWireKey(fk.column_name.replace(/_id$/, ""));
 			if (meta.pks.includes(fk.column_name) && key === fk.column_name) key = fk.foreign_table_name;
 			if (columnNames.has(key)) continue;
 			const relationName = `${tableName}_${fk.column_name}`;
 			owning.set(tableName, [...owning.get(tableName) ?? [], {
 				key,
 				targetTable: fk.foreign_table_name,
-				fkColumn: fk.column_name,
-				targetColumn: fk.foreign_column_name,
+				fkColumn: columnKey(tableName, fk.column_name),
+				targetColumn: columnKey(fk.foreign_table_name, fk.foreign_column_name),
 				relationName
 			}]);
 			const backKey = tableName;
-			if (new Set((tablesMap.get(fk.foreign_table_name)?.columns ?? []).map((c) => c.column_name)).has(backKey)) continue;
+			if (new Set((tablesMap.get(fk.foreign_table_name)?.columns ?? []).map((c) => columnKey(fk.foreign_table_name, c.column_name))).has(backKey)) continue;
 			inverse.set(fk.foreign_table_name, [...inverse.get(fk.foreign_table_name) ?? [], {
 				key: backKey,
 				sourceTable: tableName,
@@ -12528,6 +13345,584 @@ function buildDrizzleRelationsFromSchema(tablesMap, tables) {
 	return built;
 }
 //#endregion
+//#region src/schema/config-relations.ts
+/**
+* Build drizzle `relations()` for declared collections, from the collections.
+*
+* The heuristic builder in `dynamic-tables.ts` names a relation after the
+* foreign-key column (`author_id` → `author`), which is the only evidence a
+* database offers and is right for BaaS mode. It is wrong for a project that
+* declares its collections: there the relation's name is whatever the author
+* called it, `include=writer` addresses that name, and a relation whose key was
+* guessed from the column simply does not answer to it — the read returns the
+* bare foreign key and no target, silently, which is how a demo lost every
+* relation in its list view while the detail view (a different code path) kept
+* working.
+*
+* So when there are collections, they are the authority for *which* relations
+* exist and what they are called; the live catalogue is the authority for the
+* columns underneath. This is the same pairing `generate-drizzle-schema-logic`
+* emits into `schema.generated.ts` — kind for kind, key for key, and paired by
+* the same {@link sharedRelationName} — only built against tables read back from
+* `information_schema` rather than against a file.
+*/
+/** A collection's table, with any schema prefix stripped — as the DDL creates it. */
+function bareTableName(name) {
+	return name.includes(".") ? name.split(".").pop() : name;
+}
+/**
+* The field key a collection's rows are addressed by, as the generated module
+* spells it: the property marked `isId`, else `id`.
+*
+* Deliberately the config's answer rather than the catalogue's primary key —
+* `references: [users.id]` in the generated file is keyed the same way, and the
+* two have to name the same Drizzle key for a relation to compile at all.
+*/
+function primaryKeyFieldKey(collection) {
+	for (const [key, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && Boolean(prop.isId)) return key;
+	return "id";
+}
+/**
+* A column of a built table, by its Drizzle key or by its column name.
+*
+* The key is the answer in the ordinary case, and the name is the fallback for
+* the one place a caller holds a column and not a field: a junction table's two
+* foreign keys, which are keyed by column *unless* the project also declares a
+* collection over that table, in which case they are keyed by its property
+* names. Looking both up costs a scan of one table and removes the difference.
+*/
+function columnOf(table, key) {
+	if (!table) return void 0;
+	const direct = table[key];
+	if (direct) return direct;
+	for (const column of Object.values(getTableColumns(table))) if (column?.name === key) return column;
+}
+/**
+* Drizzle relations for every declared collection, keyed `<table>Relations`.
+*
+* @param collections every collection backed by a table in `tables`
+* @param tables      catalogue-built tables, keyed by bare table name
+*/
+function buildDrizzleRelationsFromCollections(collections, tables) {
+	const ones = /* @__PURE__ */ new Map();
+	const manys = /* @__PURE__ */ new Map();
+	/** `<relationName>::<kind>` already emitted on a table — the generator dedupes the same way. */
+	const emitted = /* @__PURE__ */ new Map();
+	const claim = (table, name, kind) => {
+		const seen = emitted.get(table) ?? /* @__PURE__ */ new Set();
+		emitted.set(table, seen);
+		const key = `${name}::${kind}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	};
+	const addOne = (table, spec) => ones.set(table, [...ones.get(table) ?? [], spec]);
+	const addMany = (table, spec) => manys.set(table, [...manys.get(table) ?? [], spec]);
+	const byTable = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const table = bareTableName(getTableName$1(collection));
+		if (table && tables[table]) byTable.set(table, collection);
+	}
+	for (const [tableName, collection] of byTable) {
+		const table = tables[tableName];
+		for (const [relationKey, relation] of Object.entries(resolveCollectionRelations(collection))) {
+			let target;
+			try {
+				target = relation.target();
+			} catch (err) {
+				logger.debug(`[schema] Relation ${collection.slug}.${relationKey} has no resolvable target`, { error: err });
+				continue;
+			}
+			const targetTable = tables[bareTableName(getTableName$1(target))];
+			const name = sharedRelationName(relation, collection);
+			switch (relation.kind) {
+				case "belongsTo": {
+					if (!targetTable) continue;
+					if (!claim(tableName, name, relation.kind)) continue;
+					const localKey = fieldKeyForColumn(collection, relation.localKey);
+					const referenced = primaryKeyFieldKey(target);
+					const field = columnOf(table, localKey);
+					const reference = columnOf(targetTable, referenced);
+					if (!field || !reference) continue;
+					addOne(tableName, {
+						key: relationKey,
+						target: targetTable,
+						fields: [field],
+						references: [reference],
+						relationName: name
+					});
+					break;
+				}
+				case "hasOne":
+					if (!targetTable) continue;
+					if (!claim(tableName, name, relation.kind)) continue;
+					addOne(tableName, {
+						key: relationKey,
+						target: targetTable,
+						relationName: name
+					});
+					break;
+				case "hasMany":
+					if (!targetTable) continue;
+					if (!claim(tableName, name, relation.kind)) continue;
+					addMany(tableName, {
+						key: relationKey,
+						target: targetTable,
+						relationName: name
+					});
+					break;
+				case "manyToMany": {
+					const junctionName = bareTableName(relation.through.table);
+					const junction = tables[junctionName];
+					if (!junction) continue;
+					if (!claim(tableName, name, relation.kind)) continue;
+					addMany(tableName, {
+						key: relationKey,
+						target: junction,
+						relationName: name
+					});
+					addJunctionSides(relation, collection, target, junctionName, tables, addOne, claim);
+					break;
+				}
+				case "via": break;
+			}
+		}
+	}
+	for (const [tableName, collection] of byTable) {
+		const table = tables[tableName];
+		for (const [, relation] of Object.entries(resolveCollectionRelations(collection))) {
+			if (relation.kind !== "hasMany" && relation.kind !== "hasOne") continue;
+			let target;
+			try {
+				target = relation.target();
+			} catch {
+				continue;
+			}
+			const targetTableName = bareTableName(getTableName$1(target));
+			const targetTable = tables[targetTableName];
+			if (!targetTable) continue;
+			const name = sharedRelationName(relation, collection);
+			if (!claim(targetTableName, name, "belongsTo")) continue;
+			const fkKey = fieldKeyForColumn(target, relation.foreignKeyOnTarget);
+			const referencedKey = relation.sourceKey ? fieldKeyForColumn(collection, relation.sourceKey) : primaryKeyFieldKey(collection);
+			const field = columnOf(targetTable, fkKey);
+			const reference = columnOf(table, referencedKey);
+			if (!field || !reference) continue;
+			addOne(targetTableName, {
+				key: `_synth_${targetTableName}_${fkKey}`,
+				target: tables[tableName],
+				fields: [field],
+				references: [reference],
+				relationName: name
+			});
+		}
+	}
+	const built = {};
+	for (const tableName of /* @__PURE__ */ new Set([...ones.keys(), ...manys.keys()])) {
+		const table = tables[tableName];
+		if (!table) continue;
+		const tableOnes = ones.get(tableName) ?? [];
+		const tableManys = manys.get(tableName) ?? [];
+		built[`${tableName}Relations`] = relations(table, ({ one, many }) => {
+			const map = {};
+			for (const spec of tableOnes) map[spec.key] = spec.fields ? one(spec.target, {
+				fields: spec.fields,
+				references: spec.references,
+				relationName: spec.relationName
+			}) : one(spec.target, { relationName: spec.relationName });
+			for (const spec of tableManys) {
+				if (map[spec.key]) continue;
+				map[spec.key] = many(spec.target, { relationName: spec.relationName });
+			}
+			return map;
+		});
+	}
+	return built;
+}
+/**
+* The junction table's own two `one()` sides.
+*
+* A many-to-many is a `many(junction)` on each endpoint, so the junction has to
+* carry the matching `one()` back to each — without them drizzle can join a
+* post to its `posts_tags` rows and no further, and the tags come back as
+* junction rows. Keyed by the junction's own columns, which is how the
+* generated file keys them too.
+*/
+function addJunctionSides(relation, sourceCollection, targetCollection, junctionName, tables, addOne, claim) {
+	const junction = tables[junctionName];
+	const sourceTable = tables[bareTableName(getTableName$1(sourceCollection))];
+	const targetTable = tables[bareTableName(getTableName$1(targetCollection))];
+	if (!junction || !sourceTable || !targetTable) return;
+	const sourceName = sharedRelationName(relation, sourceCollection);
+	const inverse = Object.values(resolveCollectionRelations(targetCollection)).find((r) => r.kind === "manyToMany" && bareTableName(r.through.table) === junctionName);
+	const targetName = inverse ? sharedRelationName(inverse, targetCollection) : `${junctionName}_${relation.through.targetColumn}`;
+	const pairs = [[
+		relation.through.sourceColumn,
+		sourceTable,
+		sourceName,
+		sourceCollection,
+		"source"
+	], [
+		relation.through.targetColumn,
+		targetTable,
+		targetName,
+		targetCollection,
+		"target"
+	]];
+	for (const [column, endpointTable, relationName, endpointCollection] of pairs) {
+		if (!claim(junctionName, relationName, "junction")) continue;
+		const field = columnOf(junction, column);
+		const reference = columnOf(endpointTable, primaryKeyFieldKey(endpointCollection));
+		if (!field || !reference) continue;
+		addOne(junctionName, {
+			key: column,
+			target: endpointTable,
+			fields: [field],
+			references: [reference],
+			relationName
+		});
+	}
+}
+//#endregion
+//#region src/schema/catalogue-schema.ts
+/** The Postgres schema a collection's table lives in. */
+function schemaOfCollection(collection, fallback) {
+	const declared = collection.schema;
+	return typeof declared === "string" && declared.length > 0 ? declared : fallback;
+}
+/**
+* How a column of each table is keyed in the Drizzle object.
+*
+* The wire name, which is the property key — `authorId`, never `author_id` —
+* because that is what every read and write path in this driver indexes tables
+* and rows by, and what the generated module has always emitted. Getting this
+* wrong does not throw: drizzle leaves an unknown key out of the statement and
+* the write reports success having stored nothing.
+*
+* Two exceptions, both columns no property declares:
+*
+*  - the generated search columns keep their raw names, because `search_vector`
+*    is how `searchColumnNames` excludes them from responses and how the
+*    condition builder finds the one to match against;
+*  - a table no collection claims (a junction) is keyed by its **key** columns'
+*    names, which is also what the generated file does for them — but a
+*    junction that declares `through.properties` keys those payload columns by
+*    their property key, for the same reason a collection does. `joinedAt` with
+*    `columnName: "joined_at"` has to be one name on both sides or a `_pivot`
+*    write is silently dropped by drizzle and the read serves a key the caller
+*    never declared.
+*/
+function columnKeysFromCollections(collections) {
+	const byTable = /* @__PURE__ */ new Map();
+	const rawColumns = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const table = bareTableName(getTableName$1(collection));
+		if (!table) continue;
+		byTable.set(table, collection);
+		rawColumns.set(table, new Set(searchColumnNames(collection)));
+	}
+	const junctionByTable = /* @__PURE__ */ new Map();
+	for (const spec of resolveJunctionSpecs(collections).values()) {
+		if (Object.keys(spec.properties).length === 0) continue;
+		junctionByTable.set(bareTableName(spec.table), getJunctionCollectionConfig(spec));
+	}
+	return (tableName, columnName) => {
+		const collection = byTable.get(tableName);
+		if (!collection) {
+			const junction = junctionByTable.get(tableName);
+			return junction ? fieldKeyForColumn(junction, columnName) : columnName;
+		}
+		if (rawColumns.get(tableName)?.has(columnName)) return columnName;
+		return fieldKeyForColumn(collection, columnName);
+	};
+}
+/**
+* Read the tables this data source serves out of `information_schema`.
+*
+* Restricted to the collections handed in, because the driver is given every
+* collection the project declares while each database holds only its own: an
+* unfiltered read had a second source (`database("analytics")`) reporting the
+* default's tables as its own. Junction tables come too — they back no
+* collection and a many-to-many is unreadable without them.
+*
+* Every schema the collections name is read, not just `public`. The users
+* collection lives in `rebase`, and a run restricted to `public` would leave the
+* registry with no table for it at all.
+*/
+async function readCatalogueSchema(options) {
+	const { client, collections, defaultSchema } = options;
+	/** schema → the tables wanted from it. */
+	const wanted = /* @__PURE__ */ new Map();
+	const want = (schema, table) => {
+		const set = wanted.get(schema) ?? /* @__PURE__ */ new Set();
+		wanted.set(schema, set);
+		set.add(table);
+	};
+	for (const collection of collections) {
+		const table = bareTableName(getTableName$1(collection));
+		if (table) want(schemaOfCollection(collection, defaultSchema), table);
+	}
+	for (const spec of resolveJunctionSpecs(collections).values()) want(spec.schema, bareTableName(spec.table));
+	const columnKey = columnKeysFromCollections(collections);
+	const tables = {};
+	const meta = /* @__PURE__ */ new Map();
+	const missing = [];
+	for (const [schema, names] of wanted) {
+		const live = await introspectSchema(client, schema);
+		const present = /* @__PURE__ */ new Map();
+		for (const name of names) {
+			const found = live.tablesMap.get(name);
+			if (!found) {
+				missing.push(schema === defaultSchema ? name : `${schema}.${name}`);
+				continue;
+			}
+			if (tables[name]) continue;
+			present.set(name, found);
+			meta.set(name, found);
+		}
+		Object.assign(tables, buildDrizzleTablesFromSchema(present, schema, columnKey));
+	}
+	return {
+		tables,
+		relations: buildDrizzleRelationsFromCollections(collections, tables),
+		meta,
+		missing
+	};
+}
+/**
+* The BaaS variant: no collections are declared, so every table in one schema is
+* served and both the collections and the relations are derived from the
+* foreign keys.
+*
+* Kept apart from {@link readCatalogueSchema} because the two answer different
+* questions. Here the database is the entire specification; there it supplies
+* the columns for a specification the project already wrote down.
+*/
+function buildBaasSchema(tablesMap, pgSchemaName, collections) {
+	const columnKey = columnKeysFromCollections(collections);
+	const tables = buildDrizzleTablesFromSchema(tablesMap, pgSchemaName, columnKey);
+	return {
+		tables,
+		relations: buildDrizzleRelationsFromSchema(tablesMap, tables, columnKey)
+	};
+}
+//#endregion
+//#region src/schema/generated-schema-diff.ts
+/**
+* Compare the committed `schema.generated.ts` against the live catalogue, and
+* say so — once per difference, at boot, as a warning and nothing more.
+*
+* The runtime stopped reading that file for its tables (see
+* `catalogue-schema.ts`), which removes an entire class of production failure
+* and creates a smaller one: a stale file is now *invisible*. It is still real —
+* it is what Atlas plans migrations from, what `db push` diffs, what `eject`
+* writes out and what user code imports — so a project whose file no longer
+* describes its database will hit it later, in a tool, with no clue that boot
+* already knew.
+*
+* Hence this: a guard rather than a doc. It never fails boot and never changes
+* what is served — the previous arrangement, where the file could do both,
+* is exactly what was removed.
+*
+* `generated-schema-staleness.ts` answers a narrower question (does the file
+* name every table the collections do) from the file's *source text*. This one
+* compares the loaded module against the database, column by column.
+*/
+/**
+* The families a boot warning is worth raising over.
+*
+* Deliberately coarse. `varchar(120)` and `text` are the same family because the
+* runtime treats them identically and a warning about the difference would fire
+* on every boot of a correct project — the widths still reach Postgres, which
+* enforces them. What this is looking for is the kind of drift that changes what
+* a value *is*: a number that became text, a timestamp that became a date, a
+* column that stopped existing.
+*/
+function typeFamily(sqlType) {
+	if (!sqlType) return "unknown";
+	let type = sqlType.trim().toLowerCase();
+	const isArray = type.endsWith("[]") || type.startsWith("_");
+	type = type.replace(/\[\]$/, "").replace(/^_/, "");
+	type = type.replace(/\s*\([^)]*\)\s*$/, "").trim();
+	const family = FAMILIES[type] ?? type;
+	return isArray ? `${family}[]` : family;
+}
+var FAMILIES = {
+	text: "text",
+	varchar: "text",
+	"character varying": "text",
+	bpchar: "text",
+	char: "text",
+	character: "text",
+	citext: "text",
+	name: "text",
+	int2: "integer",
+	smallint: "integer",
+	smallserial: "integer",
+	int4: "integer",
+	int: "integer",
+	integer: "integer",
+	serial: "integer",
+	int8: "bigint",
+	bigint: "bigint",
+	bigserial: "bigint",
+	float4: "float",
+	real: "float",
+	float8: "float",
+	"double precision": "float",
+	numeric: "numeric",
+	decimal: "numeric",
+	money: "numeric",
+	bool: "boolean",
+	boolean: "boolean",
+	uuid: "uuid",
+	json: "json",
+	jsonb: "jsonb",
+	date: "date",
+	time: "time",
+	"time without time zone": "time",
+	timetz: "time",
+	"time with time zone": "time",
+	timestamp: "timestamp",
+	"timestamp without time zone": "timestamp",
+	timestamptz: "timestamptz",
+	"timestamp with time zone": "timestamptz",
+	interval: "interval",
+	bytea: "bytea",
+	tsvector: "tsvector",
+	tsquery: "tsquery",
+	vector: "vector"
+};
+function catalogueColumns(meta) {
+	const columns = /* @__PURE__ */ new Map();
+	for (const col of meta.columns) columns.set(col.column_name, {
+		name: col.column_name,
+		family: typeFamily(col.udt_name || col.data_type),
+		notNull: col.is_nullable === "NO"
+	});
+	return columns;
+}
+/**
+* Every way the generated module and the database disagree, for the tables both
+* describe.
+*
+* One-directional in one respect only: a table the module has and the database
+* does not is reported (that is the stale-file case), while a table the database
+* has and the module does not is left alone — a database may hold anything, and
+* the collections-vs-file question is `generated-schema-staleness`'s.
+*/
+function diffGeneratedSchemaAgainstCatalogue(options) {
+	const { generated, catalogue, collections } = options;
+	if (!generated) return [];
+	const collectionByTable = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const table = getTableName$1(collection);
+		if (table) collectionByTable.set(bareTableName(table), collection);
+	}
+	const differences = [];
+	for (const value of Object.values(generated)) {
+		if (!isTable(value)) continue;
+		const table = getTableName(value);
+		const collection = collectionByTable.get(table);
+		const at = {
+			table,
+			collection: collection?.slug
+		};
+		const meta = catalogue.get(table);
+		if (!meta) {
+			if (collection) differences.push({
+				...at,
+				kind: "missing-table"
+			});
+			continue;
+		}
+		const live = catalogueColumns(meta);
+		const seen = /* @__PURE__ */ new Set();
+		const authOwned = isAuthCollection(collection) ? new Set(AUTH_USERS_COLUMNS.map((c) => c.column)) : void 0;
+		for (const [key, column] of Object.entries(getTableColumns(value))) {
+			const name = column.name ?? key;
+			seen.add(name);
+			const property = collection ? fieldKeyForColumn(collection, name) : key;
+			const generatedFamily = typeFamily(column.getSQLType?.());
+			const generatedNotNull = Boolean(column.notNull);
+			const found = live.get(name);
+			if (!found) {
+				differences.push({
+					...at,
+					kind: "missing-column",
+					column: name,
+					property,
+					generated: generatedFamily
+				});
+				continue;
+			}
+			if (found.family !== generatedFamily) differences.push({
+				...at,
+				kind: "type",
+				column: name,
+				property,
+				generated: generatedFamily,
+				live: found.family
+			});
+			if (found.notNull !== generatedNotNull && !authOwned?.has(name)) differences.push({
+				...at,
+				kind: "nullability",
+				column: name,
+				property,
+				generated: generatedNotNull ? "NOT NULL" : "nullable",
+				live: found.notNull ? "NOT NULL" : "nullable"
+			});
+		}
+		for (const [name, column] of live) {
+			if (seen.has(name)) continue;
+			if (authOwned?.has(name)) continue;
+			differences.push({
+				...at,
+				kind: "extra-column",
+				column: name,
+				property: collection ? fieldKeyForColumn(collection, name) : name,
+				live: column.family
+			});
+		}
+	}
+	return differences;
+}
+/** One line, in the terms the reader has: collection, property, column. */
+function describeSchemaDifference(difference) {
+	const where = difference.collection ? `${difference.collection} (table "${difference.table}")` : `table "${difference.table}"`;
+	const field = difference.column ? `${difference.property && difference.property !== difference.column ? `${difference.property} → "${difference.column}"` : `"${difference.column}"`}` : void 0;
+	switch (difference.kind) {
+		case "missing-table": return `${where} is in schema.generated.ts but not in the database`;
+		case "missing-column": return `${where}: ${field} is in schema.generated.ts but not in the database`;
+		case "extra-column": return `${where}: ${field} is in the database but not in schema.generated.ts (${difference.live})`;
+		case "type": return `${where}: ${field} is ${difference.generated} in schema.generated.ts and ${difference.live} in the database`;
+		case "nullability": return `${where}: ${field} is ${difference.generated} in schema.generated.ts and ${difference.live} in the database`;
+	}
+}
+/**
+* Report the differences, one warning each, and never throw.
+*
+* Per difference rather than one summary block on purpose: these are read out of
+* a log aggregator as often as a terminal, and a single multi-line message
+* cannot be filtered down to the one collection somebody is looking at.
+*/
+function warnOnGeneratedSchemaDrift(differences) {
+	if (differences.length === 0) return;
+	logger.warn(`📄 [schema] schema.generated.ts no longer describes the database (${differences.length} difference${differences.length === 1 ? "" : "s"}). The server serves the database, so nothing here is broken — but Atlas, \`rebase db push\`, \`rebase eject\` and any code importing that file are all reading a stale description. Run \`rebase schema generate\`.`);
+	for (const difference of differences) logger.warn(`   • ${describeSchemaDifference(difference)}`, {
+		schemaDrift: {
+			kind: difference.kind,
+			table: difference.table,
+			collection: difference.collection,
+			column: difference.column,
+			property: difference.property,
+			generated: difference.generated,
+			live: difference.live
+		},
+		fix: "rebase schema generate"
+	});
+}
+//#endregion
 //#region src/PostgresBootstrapper.ts
 /**
 * PostgresBootstrapper
@@ -12756,7 +14151,7 @@ function createPostgresBootstrapper(pgConfig) {
 	* handful of `CREATE OR REPLACE FUNCTION`.
 	*/
 	const provisionRlsRuntime = async (queryable) => {
-		const { RLS_BOOTSTRAP_STATEMENTS } = await import("./rls-bootstrap-sql-DLDnUjtx.js").then((n) => n.i);
+		const { RLS_BOOTSTRAP_STATEMENTS } = await import("./rls-bootstrap-sql-BlzsOUtz.js").then((n) => n.i);
 		await queryable.query("SELECT pg_advisory_lock(hashtext('rebase_auth_functions_init'))");
 		try {
 			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await queryable.query(statement);
@@ -12789,33 +14184,49 @@ function createPostgresBootstrapper(pgConfig) {
 				}
 				if (policyless.length > 0) logger.warn(`🔒 [rls] ${policyless.length} table(s) have RLS enabled but no policies, so they will return no rows: ${policyless.join(", ")}`);
 				introspectedCollections = buildCollectionsFromSchema(schema, pgSchemaName);
-				introspectedTables = buildDrizzleTablesFromSchema(schema.tablesMap, pgSchemaName);
-				introspectedRelations = buildDrizzleRelationsFromSchema(schema.tablesMap, introspectedTables);
+				({tables: introspectedTables, relations: introspectedRelations} = buildBaasSchema(schema.tablesMap, pgSchemaName, introspectedCollections));
 				logger.info(`🔍 [PostgresRegistry] BaaS mode: derived ${introspectedCollections.length} collections from schema "${pgSchemaName}" [${introspectedCollections.map((c) => c.slug).join(", ")}]`);
 			}
 			let ownTables;
 			let ownRelations;
+			let ownCatalogue;
+			let ownCollections = [];
 			const sourceKey = config.dataSourceKey ?? DEFAULT_DATA_SOURCE_KEY;
-			if (!introspectedCollections && !pgConfig.schema?.tables && collections && collections.length > 0) {
-				const own = collections.filter((c) => c.dataSource === sourceKey || !c.dataSource && sourceKey === DEFAULT_DATA_SOURCE_KEY);
-				if (own.length > 0) {
-					const pgSchemaName = pgConfig.introspectionSchema ?? "public";
-					const live = await introspectSchema(rawClient, pgSchemaName);
-					const wanted = new Set(own.map((c) => getTableName$1(c)));
-					for (const table of [...live.tablesMap.keys()]) if (!wanted.has(table) && !live.joinTables.has(table)) live.tablesMap.delete(table);
-					ownTables = buildDrizzleTablesFromSchema(live.tablesMap, pgSchemaName);
-					ownRelations = buildDrizzleRelationsFromSchema(live.tablesMap, ownTables);
-					const missing = [...wanted].filter((t) => !live.tablesMap.has(t));
-					if (missing.length > 0) logger.warn(`[PostgresRegistry] Data source "${sourceKey}" has no table yet for: ${missing.join(", ")}. Their collections will answer "table not found" until the schema is provisioned.`);
+			if (!introspectedCollections && collections && collections.length > 0) {
+				ownCollections = collections.filter((c) => c.dataSource === sourceKey || !c.dataSource && sourceKey === DEFAULT_DATA_SOURCE_KEY);
+				if (ownCollections.length > 0) {
+					try {
+						await rawClient.query("SELECT 1");
+					} catch (err) {
+						const fatal = diagnoseConnectFailure(err, pgConfig.connectionString);
+						if (fatal) throw fatal;
+					}
+					const catalogue = await readCatalogueSchema({
+						client: rawClient,
+						collections: ownCollections,
+						defaultSchema: pgConfig.introspectionSchema ?? "public"
+					});
+					ownTables = catalogue.tables;
+					ownRelations = catalogue.relations;
+					ownCatalogue = catalogue.meta;
+					if (catalogue.missing.length > 0) logger.warn(`[PostgresRegistry] Data source "${sourceKey}" has no table yet for: ${catalogue.missing.join(", ")}. Their collections will answer "table not found" until the schema is provisioned.`);
 				}
 			}
 			const activeCollections = introspectedCollections ?? collections;
-			const schemaTables = introspectedTables ?? pgConfig.schema?.tables ?? ownTables;
-			const schemaRelations = introspectedRelations ?? pgConfig.schema?.relations ?? ownRelations;
+			const schemaTables = introspectedTables ?? ownTables;
+			const schemaRelations = introspectedRelations ?? ownRelations;
+			if (ownCatalogue) try {
+				warnOnGeneratedSchemaDrift(diffGeneratedSchemaAgainstCatalogue({
+					generated: pgConfig.schema?.tables,
+					catalogue: ownCatalogue,
+					collections: ownCollections
+				}));
+			} catch (err) {
+				logger.debug("[schema] Could not compare schema.generated.ts against the database", { error: err });
+			}
 			const registry = buildCollectionRegistry({
 				collections: activeCollections,
 				tables: schemaTables,
-				enums: pgConfig.schema?.enums,
 				relations: schemaRelations
 			});
 			if (schemaTables) {
@@ -13127,7 +14538,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-D4wJzM4y.js").then((n) => n.n);
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-Bkvehxdm.js").then((n) => n.n);
 			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(describeEnsureFailure(failure));
 			return { applied: plan.actions.length - plan.failures.length };
@@ -13161,7 +14572,7 @@ function createPostgresBootstrapper(pgConfig) {
 			await provisionRlsRuntime(provisioningQueryable(driverResult));
 		},
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-2c2NV8zX.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-CHO0moXQ.js");
 			const queryable = provisioningQueryable(driverResult);
 			const { rows } = await queryable.query("SELECT to_regprocedure('rebase.roles()') IS NOT NULL AS present");
 			if (!rows[0]?.present) await provisionRlsRuntime(queryable);
@@ -13172,7 +14583,7 @@ function createPostgresBootstrapper(pgConfig) {
 			for (const u of outcome.unsecured.filter((u) => u.grantWithdrawn)) logger.error(`🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. Its privileges have been revoked from ${REBASE_USER_ROLE}, so the table is unreachable rather than unprotected. Reads and writes to that collection will fail until RLS can be enabled.`);
 			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
-				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-DLDnUjtx.js").then((n) => n.i);
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-BlzsOUtz.js").then((n) => n.i);
 				await dropLegacyAuthSchema(async (text) => (await queryable.query(text)).rows, {
 					info: (m) => logger.info(m),
 					warn: (m) => logger.warn(m)
@@ -13296,6 +14707,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { ADMIN_ONLY_TYPES, AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, BranchingUnsupportedError, CHANNEL_BUS_NOTIFY_CHANNEL, CONNECTION_OWNER, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PUBLIC_TYPES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, REBASE_USER_ROLE, RealtimeService, RoleSwitchUnavailableError, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, cappedPoolMax, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, describeSchemaDriftCause, detectConnectionPosture, detectToolMajor, diagnoseRowSecurityDumpFailure, discardPartialDump, effectiveSqlRole, ensureAppRole, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getDrizzleColumn, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isRoleSwitchingOptedOut, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, main, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, poolMaxCeiling, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
+export { ADMIN_ONLY_TYPES, AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, BranchingUnsupportedError, CHANNEL_BUS_NOTIFY_CHANNEL, CONNECTION_OWNER, DEFAULT_BATCH_WINDOW_MS, DatabasePoolManager, DrizzleConditionBuilder, MemoryChannelBus, PG_NOTIFY_MAX_PAYLOAD_BYTES, PUBLIC_TYPES, PostgresBackendDriver, PostgresChannelBus, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, REBASE_USER_ROLE, RealtimeService, RoleSwitchUnavailableError, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, buildRowSecurityPgOptions, cappedPoolMax, checkToolServerCompatibility, configureUnknownFilterFields, createAuthSchema, createBackupCron, createChannelBus, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, describeSchemaDriftCause, detectConnectionPosture, detectToolMajor, diagnoseRowSecurityDumpFailure, discardPartialDump, effectiveSqlRole, ensureAppRole, ensureDatabaseExists, escapeLikePattern, frameByteLength, generateSchema, getServerVersionMajor, getUnknownFilterFieldsMode, globalsFileForDump, guardPoolAgainstDirtyRelease, isChannelBusInstance, isRoleSwitchingOptedOut, isScaffoldedLocalDatabase, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, main, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseChannelBusFrame, parseChannelBusPayload, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, pinSearchPath, poolMaxCeiling, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveChannelBusSetting, resolveConnectionString, resolveDriftCheckName, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map