@rebasepro/server-postgres 0.20.0 → 0.21.0

package/dist/index.es.js

@@ -5,22 +5,22 @@ import { a as createDirectDatabaseConnection, c as guardPoolAgainstDirtyRelease,
 import { f as hiddenColumnsOption, l as SEARCH_UNACCENT_FN, m as searchColumnNames, o as sharedRelationName, u as buildSearchColumnSpec, x as visibleColumnProjection } from "./plan-schema-Hgl62S-w.js";
 import { d as extractPgError, f as isRoleSwitchingPermissionError, g as sanitizeErrorForClient, h as reachedDatabase, i as diagnoseDbError, l as classifyConnectFailure, m as pgErrorToFriendlyMessage, n as deepestErrorMessage, o as isEconnrefused, p as isRowLevelSecurityDenial, s as parseHostInfo, u as extractCauseMessage } from "./cli-errors-C3g_kHBw.js";
 import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-W3DMfcZZ.js";
-import { c as warnOnLegacyRlsFunctions, i as ensureAppRole, l as warnOnRoleSchemaCollision, n as applyAuthContext, o as validatePolicyPgRoles, r as detectConnectionPosture, s as warnOnAnonymousGrants, t as REBASE_USER_ROLE } from "./rls-enforcement-BV12vBwQ.js";
+import { c as warnOnLegacyRlsFunctions, i as ensureAppRole, l as warnOnRoleSchemaCollision, n as applyAuthContext, o as validatePolicyPgRoles, r as detectConnectionPosture, s as warnOnAnonymousGrants, t as REBASE_USER_ROLE } from "./rls-enforcement-C6Xk0lA6.js";
 import { l as resolveColumnName } from "./column-plan-helpers-CpILzHJS.js";
 import { i as isAuthCollection, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
 import { a as generatePostgresVectorDdl, i as generatePostgresTriggersDdl, n as generatePostgresPoliciesDdl, r as generatePostgresSearchDdl, t as generatePostgresDdl } from "./generate-postgres-ddl-logic-CR2xcS7e.js";
 import { t as generateSchema } from "./generate-drizzle-schema-logic-Dfyf_MRu.js";
 import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-Bkvehxdm.js";
 import { t as main } from "./generate-drizzle-schema-vSK-VdYT.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-DA7a6SUV.js";
-import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-CYMtuuOd.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-BNLwvxuy.js";
+import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-BnEvEJPr.js";
 import { c as identifyJoinTables, d as singularize, h as humanize, i as buildTablesMap, m as mapPgType, r as buildEnumMap, s as getIconForTable } from "./introspect-db-logic-C6LQdTxj.js";
 import { Client } from "pg";
 import { ApiError, assertFieldOpsValid, assertWriteRequestValid, createDdlBootstrapper, createEmailService, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveBatchRefs, resolveRequireAuth, safeCompare, splitFieldOps } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isNotNull, isNull, isTable, lt, not, notInArray, or, relations, sql } from "drizzle-orm";
-import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, declaredDatabaseExtensions, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, parseRelationAggregateSort, resolveClientListLimit } from "@rebasepro/types";
-import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createRelationRef, createRelationRefWithData, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, getColumnName, getDeclaredPrimaryKeys, getJunctionCollectionConfig, getTableName as getTableName$1, getTenantConfig, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseOrderBySpecStrict, resolveCollectionRelations, resolveJunctionSpecs, resolveTenantWrite, revokeInternalTableSql, tenantBypassRoles, toCallbackError, toFilterTuples, updateDateAutoValues, updateUserAutoValues } from "@rebasepro/common";
-import { camelCase, firstFreeKey, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, mergeDeep, toSnakeCase, toWireKey } from "@rebasepro/utils";
+import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, JUNCTION_PIVOT_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, declaredDatabaseExtensions, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, parseRelationAggregateSort, resolveClientListLimit } from "@rebasepro/types";
+import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, REBASE_USER_ROLE as REBASE_USER_ROLE$1, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createRelationRef, createRelationRefWithData, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, firstSqlRow, getColumnName, getDeclaredPrimaryKeys, getJunctionCollectionConfig, getJunctionConfigForRelation, getTableName as getTableName$1, getTenantConfig, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseOrderBySpecStrict, requireCallbackClient, requireCallbackCollection, resolveCollectionRelations, resolveJunctionSpecs, resolveTenantWrite, revokeInternalTableSql, sqlRows, tenantBypassRoles, toCallbackError, toFilterTuples, updateDateAutoValues, updateUserAutoValues } from "@rebasepro/common";
+import { camelCase, firstFreeKey, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, mergeDeep, toSnakeCase, toWireKey, unref } from "@rebasepro/utils";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { PgArray, PgNumeric, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs from "fs";
@@ -64,7 +64,7 @@ import { inspect } from "util";
 * currently stores `undefined`, but the store's type says the difference is
 * carried rather than flattened.
 */
-var storage = new AsyncLocalStorage();
+var storage$1 = new AsyncLocalStorage();
 /**
 * Run `fn` with `viewer` as the caller every row strip judges against.
 *
@@ -73,7 +73,7 @@ var storage = new AsyncLocalStorage();
 * which is the behaviour both halves need and the reason this is not a variable.
 */
 function withFieldViewer(viewer, fn) {
-	return storage.run(viewer, fn);
+	return storage$1.run(viewer, fn);
 }
 /**
 * The caller the current read is for, or `undefined` on the trusted server plane
@@ -85,17 +85,16 @@ function withFieldViewer(viewer, fn) {
 * that is what establishes the viewer.
 */
 function currentFieldViewer() {
-	return storage.getStore();
+	return storage$1.getStore();
 }
 //#endregion
 //#region src/services/collection-helpers.ts
 /** Safely extract Drizzle column metadata from a column object. */
 function getColumnMeta(col) {
-	const raw = col;
 	return {
-		columnType: typeof raw.columnType === "string" ? raw.columnType : void 0,
-		dataType: typeof raw.dataType === "string" ? raw.dataType : void 0,
-		primary: typeof raw.primary === "boolean" ? raw.primary : void 0
+		columnType: typeof col.columnType === "string" ? col.columnType : void 0,
+		dataType: typeof col.dataType === "string" ? col.dataType : void 0,
+		primary: typeof col.primary === "boolean" ? col.primary : void 0
 	};
 }
 /**
@@ -1540,11 +1539,9 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 			if (additionalJoins && additionalJoins.length > 0) joins.push(...additionalJoins);
 		}
 		if (currentTable !== parentTable) {
-			let currentTableName = "unknown";
-			let parentTableName = "unknown";
-			if (currentTable && typeof currentTable === "object") currentTableName = currentTable[Symbol.for("drizzle:Name")] || currentTable._?.name || currentTable.tableName || currentTable.name || "unknown";
-			if (parentTable && typeof parentTable === "object") parentTableName = parentTable[Symbol.for("drizzle:Name")] || parentTable._?.name || parentTable.tableName || parentTable.name || "unknown";
-			if (!(currentTableName.includes("_") || currentTableName === "unknown" || parentTableName === "unknown")) throw new Error(`Join path did not result in connecting to parent table. Current: ${currentTableName}, Parent: ${parentTableName}`);
+			const currentTableName = getTableName(currentTable);
+			const parentTableName = getTableName(parentTable);
+			if (!currentTableName.includes("_")) throw new Error(`Join path did not result in connecting to parent table. Current: ${currentTableName}, Parent: ${parentTableName}`);
 		}
 		return {
 			joins,
@@ -1559,8 +1556,10 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		let condition;
 		const additionalJoins = [];
 		if (currentTable === toTable) {
-			const left = fromTable[fromColName];
-			const right = currentTable[toColName];
+			const cols = getTableColumns(fromTable);
+			const currentCols = getTableColumns(currentTable);
+			const left = cols[fromColName];
+			const right = currentCols[toColName];
 			if (!left || !right) {
 				if (registry) {
 					const junctionResult = this.tryBuildJunctionJoin(currentTable, fromTable, fromColName, toColName, fromTableName, toTableName, registry);
@@ -1572,7 +1571,7 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 			condition = eq(left, right);
 		} else if (currentTable === fromTable) {
 			const left = toTable[toColName];
-			const right = currentTable[fromColName];
+			const right = getTableColumns(currentTable)[fromColName];
 			if (!left || !right) {
 				if (registry) {
 					const junctionResult = this.tryBuildJunctionJoin(currentTable, toTable, fromColName, toColName, fromTableName, toTableName, registry);
@@ -2000,968 +1999,527 @@ var isVectorColumn = (column) => /^(vector|halfvec|sparsevec)\b/.test(columnSqlT
 */
 var PostgresConditionBuilder = DrizzleConditionBuilder;
 //#endregion
-//#region src/data-transformer.ts
+//#region src/services/row-pipeline.ts
 /**
-* Helper function to sanitize and convert dates to ISO strings
+* Whether a many-relation reaches its target through a junction table.
+*
+* Also used to build the drizzle `with` config, which is why it is exported:
+* the query has to nest one level deeper for a junction, and the row walk has
+* to unwrap that same level back out.
 */
-function sanitizeAndConvertDates(obj) {
-	if (obj === null || obj === void 0) return null;
-	if (typeof obj === "number" && isNaN(obj)) return null;
-	if (typeof obj === "string" && obj.toLowerCase() === "nan") return null;
-	if (Array.isArray(obj)) return obj.map((v) => sanitizeAndConvertDates(v));
-	if (obj instanceof Date) return obj.toISOString();
-	if (typeof obj === "object") {
-		const newObj = {};
-		for (const key in obj) {
-			if (!Object.prototype.hasOwnProperty.call(obj, key)) continue;
-			if (isPrototypePollutingKey(key)) continue;
-			newObj[key] = sanitizeAndConvertDates(obj[key]);
-		}
-		return newObj;
-	}
-	if (typeof obj === "string") {
-		if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/.test(obj) || /^\w{3} \w{3} \d{2} \d{4} \d{2}:\d{2}:\d{2} GMT[+-]\d{4} \(.+\)$/.test(obj)) {
-			const date = new Date(obj);
-			if (!isNaN(date.getTime())) return date.toISOString();
-		}
-	}
-	return obj;
+function isJunctionRelation(relation) {
+	if (isManyToMany(relation)) return true;
+	return relation.kind === "via" && relation.joinPath.length > 1;
 }
 /**
-* Transform relations for database storage (relation objects to IDs)
+* Reach the target row inside a junction row.
+*
+* A junction row looks like `{ post_id: 1, tag_id: { id: 5, name: "ts" } }` —
+* the foreign keys, and the target nested under one of them. The target is the
+* only object among them, so that is how it is found. A junction row that has
+* not been nested (no `with` on the join) has no object and is returned as-is.
+*
+* "The only object" stopped being true when a junction gained
+* `through.properties`: a payload `map` is an object too, and it sits in the
+* row beside the target with no guaranteed order between them — so this would
+* have unwrapped to the payload and served it as the tag. The payload keys are
+* known from the relation, so they are skipped by name rather than by shape.
 */
-function serializeDataToServer(row, properties, collection, registry) {
-	if (!row || !properties) return {
-		scalarData: row ?? {},
-		inverseRelationUpdates: [],
-		joinPathRelationUpdates: []
-	};
-	const result = {};
-	const resolvedRelations = collection ? resolveCollectionRelations(collection) : {};
-	const inverseRelationUpdates = [];
-	const joinPathRelationUpdates = [];
-	const foreignKeys = /* @__PURE__ */ new Set();
-	Object.values(resolvedRelations).forEach((relation) => {
-		if (relation.kind === "belongsTo") foreignKeys.add(fieldKeyForColumn(collection, relation.localKey));
-	});
-	for (const [key, value] of Object.entries(row)) {
-		if (isPrototypePollutingKey(key)) continue;
-		if (value === void 0) continue;
-		const property = properties[key];
-		const effectiveValue = foreignKeys.has(key) && value === "" ? null : value;
-		if (!property) {
-			result[key] = effectiveValue;
-			continue;
-		}
-		if (property.type === "relation" && collection) {
-			const relation = findRelation(resolvedRelations, key);
-			if (relation) {
-				if (relation.kind === "belongsTo") {
-					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
-					if (serializedValue !== void 0) result[fieldKeyForColumn(collection, relation.localKey)] = serializedValue;
-					continue;
-				} else if (hasForeignKeyOnTarget(relation)) {
-					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
-					inverseRelationUpdates.push({
-						relationKey: key,
-						relation,
-						newValue: serializedValue
-					});
-					continue;
-				} else if (relation.kind === "via") {
-					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
-					if (relation.cardinality === "one") joinPathRelationUpdates.push({
-						relationKey: key,
-						relation,
-						newTargetId: serializedValue
-					});
-					else inverseRelationUpdates.push({
-						relationKey: key,
-						relation,
-						newValue: serializedValue
-					});
-					continue;
-				}
-			}
-		}
-		result[key] = serializePropertyToServer(effectiveValue, property, key);
-	}
-	return {
-		scalarData: result,
-		inverseRelationUpdates,
-		joinPathRelationUpdates
-	};
+function unwrapJunctionRow(item, relation) {
+	const payload = isManyToMany(relation) ? relation.through.properties : void 0;
+	const nestedKey = Object.keys(item).find((key) => key !== JUNCTION_PIVOT_KEY && !(payload && key in payload) && typeof item[key] === "object" && item[key] !== null && !Array.isArray(item[key]));
+	return nestedKey ? item[nestedKey] : item;
 }
 /**
-* How to name a rejected value in an error, without quoting it back.
+* Give back the number a `number` property was declared to be.
 *
-* The value may be anything the caller sent, including a secret in the wrong
-* field, so the message describes its shape rather than echoing it — an echoed
-* value ends up in logs and in error-reporting services.
+* Postgres returns NUMERIC as a string and drizzle keeps it that way, since a
+* numeric can hold more precision than a double. But the collection declared
+* this property `number` and the OpenAPI spec this server publishes says
+* `type: number`, so serving `"9.99"` breaks its own contract — and breaks it
+* asymmetrically, because a create answers with the number and the read that
+* follows answers with the string. Any client that multiplies a price works
+* until the first refresh.
+*
+* Declaring a property `number` already accepts double precision — that is what
+* the admin has always parsed it to. Columns REST serves that no property
+* declares are left exactly as the database returned them.
 */
-function describeValue(value) {
-	if (value === null) return "null";
-	if (Array.isArray(value)) return "an array";
-	if (value instanceof Date) return "a date";
-	const type = typeof value;
-	return type === "object" ? "an object" : `a ${type}`;
+function coerceDeclaredNumber(value, property) {
+	if (property?.type !== "number" || typeof value !== "string") return value;
+	const parsed = parseFloat(value);
+	return isNaN(parsed) ? null : parsed;
 }
 /**
-* Serialize a single property value for database storage.
+* Serve a `date` column as the timestamp this API says it serves.
 *
-* `propertyKey` is only ever used to phrase errors and warnings. Without it the
-* one trace a bad value left was `Expected array value for array property, got
-* string` — no collection, no property, no value, which in the log of a
-* thousand-row import names nothing at all.
+* The OpenAPI document this server publishes types a `date` property as
+* `string, format: date-time` — RFC 3339 — and node-postgres hands over the
+* Postgres literal: `"2026-08-24 01:37:57.647+02"`, with a space where the `T`
+* belongs and a two-digit offset. V8 parses that by accident; Safari's
+* `new Date()` does not have to, and the spec never promised it. A column whose
+* documented type only parses in some browsers is not a contract.
+*
+* A date-only column (`mode: "date"`, `format: "date"` in the spec) is already
+* RFC 3339 as `YYYY-MM-DD` and is left alone — widening it to a timestamp would
+* invent a time of day and a timezone the column does not have.
 */
-function serializePropertyToServer(value, property, propertyKey) {
-	if (value === null || value === void 0) return value;
-	const fieldLabel = propertyKey ? `'${propertyKey}'` : `a '${property.type}' field`;
-	switch (property.type) {
-		case "relation":
-			if (Array.isArray(value)) return value.map((v) => serializePropertyToServer(v, property, propertyKey));
-			else if (typeof value === "object" && value !== null && "id" in value) return value.id;
-			if (value === "") return null;
-			return value;
-		case "array":
-			if (Array.isArray(value)) {
-				if (property.of) return value.map((item) => serializePropertyToServer(item, property.of, propertyKey));
-				else if (property.oneOf) {
-					const typeField = property.oneOf.typeField ?? DEFAULT_ONE_OF_TYPE;
-					const valueField = property.oneOf.valueField ?? DEFAULT_ONE_OF_VALUE;
-					return value.map((e) => {
-						if (e === null) return null;
-						if (typeof e !== "object") return e;
-						const rec = e;
-						const type = rec[typeField];
-						const childProperty = property.oneOf?.properties[type];
-						if (!type || !childProperty) return e;
-						return {
-							[typeField]: type,
-							[valueField]: serializePropertyToServer(rec[valueField], childProperty, propertyKey)
-						};
-					});
-				}
-				return value;
-			}
-			throw ApiError.badRequest(`${fieldLabel} expects an array, but received ${describeValue(value)}.`, "VALIDATION_INVALID_VALUE");
-		case "geopoint": {
-			if (typeof value !== "object" || Array.isArray(value)) throw ApiError.badRequest(`${fieldLabel} expects a geopoint object with \`latitude\` and \`longitude\`, but received ${describeValue(value)}.`, "VALIDATION_INVALID_VALUE");
-			const point = value;
-			if (typeof point.latitude !== "number" || typeof point.longitude !== "number") throw ApiError.badRequest(`${fieldLabel} expects a geopoint object with numeric \`latitude\` and \`longitude\`.`, "VALIDATION_INVALID_VALUE");
-			return {
-				latitude: point.latitude,
-				longitude: point.longitude
-			};
-		}
-		case "map":
-			if (typeof value === "object" && property.properties) {
-				const result = {};
-				for (const [subKey, subValue] of Object.entries(value)) {
-					const subProperty = property.properties[subKey];
-					if (subProperty) result[subKey] = serializePropertyToServer(subValue, subProperty, propertyKey ? `${propertyKey}.${subKey}` : subKey);
-					else result[subKey] = subValue;
-				}
-				return result;
-			}
-			return value;
-		case "vector":
-			if (value instanceof Vector) return value.value;
-			if (value && typeof value === "object" && "value" in value && Array.isArray(value.value)) return value.value.map(Number);
-			if (Array.isArray(value)) return value.map(Number);
-			return value;
-		case "binary": {
-			const decoded = tryDecodeBase64DataUrl(value);
-			if (decoded) return decoded;
-			if (Buffer.isBuffer(value)) return value;
-			return value;
-		}
-		default: {
-			const decoded = tryDecodeBase64DataUrl(value);
-			if (decoded) return decoded;
-			return value;
-		}
-	}
+function toRestDate(value) {
+	if (value instanceof Date) return isNaN(value.getTime()) ? null : value.toISOString();
+	if (value && typeof value === "object" && value.__type === "date") return value.value ?? null;
+	if (typeof value !== "string" && typeof value !== "number") return value;
+	if (typeof value === "string" && /^\d{4}-\d{2}-\d{2}$/.test(value)) return value;
+	const date = new Date(value);
+	return isNaN(date.getTime()) ? value : date.toISOString();
 }
 /**
-* Transform IDs back to relation objects for frontend
+* One scalar, as REST serves it: declared numbers as numbers, declared dates as
+* RFC 3339, everything else exactly as the database returned it.
 */
-async function parseDataFromServer(data, collection, db, registry) {
+function toRestScalar(value, property) {
+	if (property?.type === "date") return toRestDate(value);
+	return coerceDeclaredNumber(value, property);
+}
+/**
+* Apply {@link toRestScalar} across a row, leaving undeclared columns alone.
+*
+* Exported because the include loader attaches related rows itself, and a
+* target rendered differently from its parent is the shape bug this whole file
+* exists to prevent — a date was a string at the top level and a
+* `{ __type: "date" }` envelope one level down, in the same response.
+*/
+function toRestValues(row, collection) {
 	const properties = collection.properties;
-	if (!data || !properties) return data;
-	const resolvedRelations = resolveCollectionRelations(collection);
-	const result = normalizeScalarValues(data, properties, collection, resolvedRelations, { skipRelations: false });
-	for (const [propKey, property] of Object.entries(properties)) if (property.type === "relation" && !(propKey in result)) {
-		const relation = findRelation(resolvedRelations, propKey);
-		if (relation) {
-			const localField = relation.kind === "belongsTo" ? fieldKeyForColumn(collection, relation.localKey) : "";
-			if (relation.kind === "belongsTo" && localField in data) {
-				const fkValue = data[localField];
-				if (fkValue !== null && fkValue !== void 0) try {
-					const targetCollection = relation.target();
-					result[propKey] = createRelationRef(fkValue.toString(), targetCollection.slug);
-				} catch (e) {
-					logger.warn(`Could not resolve target collection for relation property: ${propKey}`, { error: e });
-				}
-			} else if (hasForeignKeyOnTarget(relation) && db && registry) try {
-				const targetCollection = relation.target();
-				const targetTable = registry.getTable(getTableName$1(targetCollection));
-				const pks = getPrimaryKeys(collection, registry);
-				const currentId = relation.sourceKey ? data[relation.sourceKey] : buildCompositeId$1(data, pks);
-				if (targetTable && currentId !== void 0 && currentId !== null && currentId !== "") {
-					const foreignKeyColumn = targetTable[fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget)];
-					if (foreignKeyColumn) {
-						const relatedRows = await db.select().from(targetTable).where(eq(foreignKeyColumn, currentId)).limit(relation.cardinality === "one" ? 1 : 100);
-						if (relatedRows.length > 0) if (relation.cardinality === "one") {
-							const targetPks = getPrimaryKeys(targetCollection, registry);
-							const relatedRow = relatedRows[0];
-							result[propKey] = createRelationRef(buildCompositeId$1(relatedRow, targetPks), targetCollection.slug);
-						} else {
-							const targetPks = getPrimaryKeys(targetCollection, registry);
-							result[propKey] = relatedRows.map((row) => createRelationRef(buildCompositeId$1(row, targetPks), targetCollection.slug));
-						}
-					}
-				}
-			} catch (e) {
-				logger.warn(`Could not resolve inverse relation property: ${propKey}`, { error: e });
-			}
-			else if (relation.kind === "via" && db && registry) try {
-				const targetCollection = relation.target();
-				const pks = getPrimaryKeys(collection, registry);
-				const currentId = buildCompositeId$1(data, pks);
-				if (currentId) {
-					const sourceTable = registry.getTable(getTableName$1(collection));
-					if (!sourceTable) {
-						logger.warn(`Source table not found for collection: ${collection.slug}`);
-						continue;
-					}
-					let query = db.select().from(sourceTable);
-					let currentTable = sourceTable;
-					for (const join of relation.joinPath) {
-						const joinTable = registry.getTable(join.table);
-						if (!joinTable) {
-							logger.warn(`Join table not found: ${join.table}`);
-							break;
-						}
-						const fromColumn = Array.isArray(join.on.from) ? join.on.from[0] : join.on.from;
-						const toColumn = Array.isArray(join.on.to) ? join.on.to[0] : join.on.to;
-						const fromParts = fromColumn.split(".");
-						const toParts = toColumn.split(".");
-						const fromColName = fromParts[fromParts.length - 1];
-						const toColName = toParts[toParts.length - 1];
-						const fromCol = currentTable[fromColName];
-						const toCol = joinTable[toColName];
-						if (!fromCol || !toCol) {
-							logger.warn(`Join columns not found: ${fromColumn} -> ${toColumn}`);
-							break;
-						}
-						query = query.innerJoin(joinTable, eq(fromCol, toCol));
-						currentTable = joinTable;
-					}
-					if (pks.length === 1) {
-						const sourceIdField = sourceTable[pks[0].fieldName];
-						query = query.where(eq(sourceIdField, currentId));
-					} else logger.warn(`Join path resolution for composite primary keys is not yet fully supported: ${collection.slug}`);
-					const additionalFilters = [];
-					let combinedWhere;
-					if (pks.length === 1) {
-						const sourceIdField = sourceTable[pks[0].fieldName];
-						combinedWhere = DrizzleConditionBuilder.combineConditionsWithAnd([eq(sourceIdField, currentId), ...additionalFilters].filter(Boolean));
-					}
-					const joinResults = await query.where(combinedWhere).limit(relation.cardinality === "one" ? 1 : 100);
-					if (joinResults.length > 0) {
-						const targetPks = getPrimaryKeys(targetCollection, registry);
-						const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
-						if (relation.cardinality === "one") {
-							const joinResult = joinResults[0];
-							result[propKey] = createRelationRef(buildCompositeId$1(joinResult[targetTableName] || joinResult, targetPks), targetCollection.slug);
-						} else result[propKey] = joinResults.map((joinResult) => {
-							return createRelationRef(buildCompositeId$1(joinResult[targetTableName] || joinResult, targetPks), targetCollection.slug);
-						});
-					}
-				}
-			} catch (e) {
-				logger.warn(`Could not resolve join path relation property: ${propKey}`, { error: e });
-			}
+	if (!properties) return row;
+	const out = {};
+	for (const [key, value] of Object.entries(row)) out[key] = toRestScalar(value, properties[key]);
+	return out;
+}
+/** Render one target row in the requested style. */
+/**
+* Drop every column this caller may not read.
+*
+* Password hashes and verification tokens have to be readable server-side but
+* must never reach a client — and "never" has to mean every exit from this
+* pipeline, including relation targets, or a secret leaks through whichever
+* path was overlooked. Keyed by both the property name and its column name,
+* since a row can arrive keyed either way depending on the caller.
+*
+* `excludeFromApi` is the case with no roles in it: `effectiveAccess` expands
+* the flag to `read: []`, which no caller satisfies, so the flag needs no branch
+* of its own here and no longer has one. `access.read: ["hr"]` is the same walk
+* asking a different question of {@link currentFieldViewer}.
+*
+* The field is **deleted**, never nulled. A withheld value that arrives as
+* `null` is indistinguishable from a stored `null`, which turns a permission
+* boundary into a question a client can answer by counting nulls — and it makes
+* an `update` that echoes the row back overwrite the real value with the null it
+* was handed.
+*
+* `_matches` is filtered rather than deleted: it is the list of fields a text
+* search hit, and a field the caller cannot read must not appear in it even
+* though the array itself is theirs to see.
+*/
+function stripUnreadable(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	const viewer = currentFieldViewer();
+	const hidden = /* @__PURE__ */ new Set();
+	for (const [key, property] of Object.entries(properties)) {
+		if (canReadField(property, viewer)) continue;
+		hidden.add(key);
+		delete row[key];
+		if (property.columnName) {
+			hidden.add(property.columnName);
+			delete row[property.columnName];
 		}
 	}
-	return result;
+	if (hidden.size > 0 && Array.isArray(row._matches)) row._matches = row._matches.filter((match) => !hidden.has(typeof match === "string" ? match : String(match?.field)));
+	return row;
+}
+function renderTarget(targetRow, targetCollection, style, registry) {
+	if (style === "inline") return stripUnreadable(toRestValues({ ...targetRow }, targetCollection), targetCollection);
+	const address = relationTargetAddress(targetRow, targetCollection, registry);
+	const path = targetCollection.slug;
+	return createRelationRefWithData(address, path, {
+		id: address,
+		path,
+		values: stripUnreadable(normalizeDbValues(targetRow, targetCollection), targetCollection)
+	});
 }
 /**
-* Try to decode a `data:application/octet-stream;base64,...` data URL string
-* into a Buffer. Returns null if the value is not a matching data URL.
+* The address a relation ref points at.
+*
+* The whole key, not its first column: a composite-keyed target addressed by
+* `tenant_id` alone points at every row that shares it. A target whose key
+* cannot be resolved at all used to throw here — reading `[0]` of an empty
+* array — taking down the parent's fetch over a relation it may not even have
+* asked for. The first column is a guess, but a ref that resolves to nothing
+* beats no rows at all.
 */
-function tryDecodeBase64DataUrl(value) {
-	if (typeof value !== "string") return null;
-	if (!value.startsWith("data:application/octet-stream;base64,")) return null;
-	const base64Data = value.split(",")[1];
-	return base64Data ? Buffer.from(base64Data, "base64") : null;
+function relationTargetAddress(targetRow, targetCollection, registry) {
+	const address = deriveRowAddress(targetRow, targetCollection, registry);
+	if (address) return address;
+	return String(targetRow[Object.keys(targetRow)[0]] ?? "");
 }
 /**
-* Try to resolve an unknown value into a Buffer.
-* Handles native Buffers and `{ type: "Buffer", data: number[] }` objects (from JSON deserialization).
-* Returns null if the value is not a buffer.
+* The row the admin renders: every column, with relations as references.
+*
+* Values are normalized (dates, numbers, NaN) because the admin's view-model
+* expects real types. The row's own address is *not* among the columns — it is
+* derived by the consumer from the collection's primary keys.
 */
-function tryResolveBuffer(value) {
-	if (Buffer.isBuffer(value)) return value;
-	if (typeof value === "object" && value !== null) {
-		const rawVal = value;
-		if (rawVal.type === "Buffer" && Array.isArray(rawVal.data)) return Buffer.from(rawVal.data);
+function toFlatRow(row, collection, registry) {
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const normalized = normalizeDbValues(row, collection);
+	for (const [key, relation] of Object.entries(resolvedRelations)) {
+		const relData = row[relation.relationName || key];
+		if (relData === void 0 || relData === null) continue;
+		if (relation.cardinality === "many" && Array.isArray(relData)) {
+			const targetCollection = relation.target();
+			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item, relation) : item, targetCollection, "ref", registry));
+		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
 	}
-	return null;
+	return stripUnreadable(normalized, collection);
 }
 /**
-* Convert a Buffer to a UTF-8 string if all bytes are printable ASCII,
-* otherwise return a base64 data URL.
+* The row REST serves: every column under its own name, with the value Postgres
+* returned, and relations inlined as the target's columns.
+*
+* Values are the ones the database returned, except where that contradicts the
+* declared type: a `number` property is served as a number (see
+* {@link coerceDeclaredNumber}) and a `date` as RFC 3339, which is what this
+* server's own OpenAPI document says a date column is (see
+* {@link toRestDate}).
+*
+* Keyed by the row rather than by the relation list — a REST fetch only loads
+* the relations `include` asked for, so the row is the authority on which are
+* actually there.
 */
-function bufferToStringOrBase64(buf) {
-	for (let i = 0; i < buf.length; i++) {
-		const b = buf[i];
-		if ((b < 32 || b > 126) && b !== 9 && b !== 10 && b !== 13) return `data:application/octet-stream;base64,${buf.toString("base64")}`;
-	}
-	return buf.toString("utf8");
-}
-function parsePropertyFromServer(value, property, collection, propertyKey) {
-	if (value === null || value === void 0) return value;
-	switch (property.type) {
-		case "binary": {
-			const buf = tryResolveBuffer(value);
-			if (buf) return `data:application/octet-stream;base64,${buf.toString("base64")}`;
-			return value;
-		}
-		case "string": {
-			if (typeof value === "string") return value;
-			const buf = tryResolveBuffer(value);
-			if (buf) return bufferToStringOrBase64(buf);
-			if (typeof value === "object" && value !== null) try {
-				return JSON.stringify(value);
-			} catch {
-				return String(value);
-			}
-			return String(value);
-		}
-		case "relation":
-			if (typeof value === "string" || typeof value === "number") {
-				let relationDef = property.resolvedRelation;
-				if (!relationDef && propertyKey) relationDef = findRelation(resolveCollectionRelations(collection), propertyKey);
-				if (!relationDef) {
-					logger.warn(`ResolvedRelation not defined in property for key: ${propertyKey || "unknown"}`);
-					return value;
-				}
-				try {
-					const targetCollection = relationDef.target();
-					return createRelationRef(value.toString(), targetCollection.slug);
-				} catch (e) {
-					logger.warn(`Could not resolve target collection for relation property: ${propertyKey || "unknown"}`, { error: e });
-					return value;
-				}
-			}
-			return value;
-		case "array":
-			if (Array.isArray(value)) {
-				if (property.of) return value.map((item) => parsePropertyFromServer(item, property.of, collection));
-				else if (property.oneOf) {
-					const typeField = property.oneOf.typeField ?? DEFAULT_ONE_OF_TYPE;
-					const valueField = property.oneOf.valueField ?? DEFAULT_ONE_OF_VALUE;
-					return value.map((e) => {
-						if (e === null) return null;
-						if (typeof e !== "object") return e;
-						const rec = e;
-						const type = rec[typeField];
-						const childProperty = property.oneOf?.properties[type];
-						if (!type || !childProperty) return e;
-						return {
-							[typeField]: type,
-							[valueField]: parsePropertyFromServer(rec[valueField], childProperty, collection)
-						};
-					});
-				}
-			} else {
-				logger.warn(`Expected array value from DB for array property, got ${typeof value}. Coercing to array.`);
-				return typeof value === "string" ? [value] : [];
-			}
-			return value;
-		case "map":
-			if (typeof value === "object" && property.properties) {
-				const result = {};
-				for (const [subKey, subValue] of Object.entries(value)) {
-					const subProperty = property.properties[subKey];
-					if (subProperty) result[subKey] = parsePropertyFromServer(subValue, subProperty, collection);
-					else result[subKey] = subValue;
-				}
-				return result;
-			}
-			return value;
-		case "number":
-			if (typeof value === "string") {
-				const parsed = parseFloat(value);
-				return isNaN(parsed) ? null : parsed;
-			}
-			return value;
-		case "geopoint": return value;
-		case "vector": {
-			let nums = [];
-			if (typeof value === "string") nums = value.slice(1, -1).split(",").map(Number);
-			else if (Array.isArray(value)) nums = value.map(Number);
-			else if (value instanceof Vector) nums = value.value;
-			else if (typeof value === "object" && value !== null && "value" in value) {
-				const valObj = value;
-				if (Array.isArray(valObj.value)) nums = valObj.value.map(Number);
-			}
-			return {
-				__type: "Vector",
-				value: nums
-			};
-		}
-		case "date": {
-			let date;
-			if (value instanceof Date) date = value;
-			else if (typeof value === "string" || typeof value === "number") {
-				const parsedDate = new Date(value);
-				if (!isNaN(parsedDate.getTime())) date = parsedDate;
-			}
-			if (date) return {
-				__type: "date",
-				value: date.toISOString()
-			};
-			return null;
-		}
-		default: {
-			const buf = tryResolveBuffer(value);
-			if (buf) return bufferToStringOrBase64(buf);
-			return value;
-		}
+function toRestRow(row, collection, registry) {
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const flat = {};
+	for (const [key, value] of Object.entries(row)) {
+		const relation = findRelation(resolvedRelations, key);
+		if (relation && Array.isArray(value)) flat[key] = value.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item, relation) : item, relation.target(), "inline", registry));
+		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
+		else flat[key] = toRestScalar(value, collection.properties?.[key]);
 	}
+	return stripUnreadable(flat, collection);
 }
+//#endregion
+//#region src/services/write-denial.ts
 /**
-* Shared internal helper: normalizes scalar column values from a DB row
-* into frontend format. Handles FK-column preservation, type coercion
-* (dates, numbers, NaN), and property filtering.
+* Explain a write that matched no rows.
 *
-* @param skipRelations  When `true`, relation-typed properties are omitted
-*                       from the result (used by `normalizeDbValues` where
-*                       Drizzle's relational API already hydrates them).
+* Row-level security filters UPDATE and DELETE through the policy's USING
+* clause instead of raising: a denied write is reported by Postgres exactly
+* like a successful one that happened to match nothing. Left unchecked, a
+* caller cannot tell "denied" from "done" — the write returns 200/204 and the
+* row is untouched. An agent handed a key with `orders:delete` and no delete
+* policy is the case that makes it concrete: it deletes nothing, forever, and
+* is told it worked every time.
+*
+* Re-reading the target over the *same* RLS-scoped handle separates the two
+* cases. A visible row means the policy rejected the write (403); an invisible
+* one means there is nothing there to write for this caller (404, matching what
+* a GET would say). The re-read is bound by the caller's own policies, so it
+* discloses nothing a plain read wouldn't.
+*
+* Only reached when zero rows matched, so the happy path pays nothing.
+*
+* It lives here, rather than beside its first caller, because every zero-row
+* write has to answer the same question and answer it identically: the rule
+* that a readable-but-unwritable target is a 403 is the contract, and a second
+* copy of it is a second chance to get it wrong.
+*
+* @param handle     The RLS-scoped connection the write ran on — not a fresh
+*                   one, or the re-read would answer for a different caller.
+* @param table      The table the write targeted (the junction, for a link).
+* @param conditions The write's own WHERE terms, reused verbatim.
+* @param denied     Message for the 403: the target is there and was refused.
+* @param missing    Message for the 404: there is nothing there for this caller.
 */
+async function explainZeroRowWrite(handle, table, conditions, denied, missing) {
+	if ((await handle.select({ present: sql`1` }).from(table).where(and(...conditions)).limit(1)).length > 0) return ApiError.forbidden(denied, "WRITE_DENIED");
+	return ApiError.notFound(missing);
+}
+//#endregion
+//#region src/services/junction-writes.ts
+/** A junction that cannot be resolved is a broken relation, not a no-op. */
+var misconfigured = (label, detail) => relationMisconfigured(label, detail);
+function column(table, name, label, role) {
+	const col = name ? table[name] : void 0;
+	if (!col) throw misconfigured(label, `no ${role} column '${name ?? "?"}' on the junction table`);
+	return col;
+}
+/** The junction a `manyToMany` names outright. */
+function bindThroughJunction(registry, through, label) {
+	const table = registry.getTable(through.table);
+	if (!table) throw misconfigured(label, `no table '${through.table}' in the registry`);
+	return {
+		table,
+		parentColumn: column(table, through.sourceColumn, label, "source"),
+		targetColumn: column(table, through.targetColumn, label, "target"),
+		label,
+		payload: through.properties ?? {}
+	};
+}
+/** The bare column name, whether written as `col` or `table.col`. */
+var columnPart = (spec) => {
+	const one = Array.isArray(spec) ? spec[0] : spec;
+	return one.includes(".") ? one.split(".")[1] : one;
+};
+/** The table a column spec names, or undefined when it is unqualified. */
+var tablePart = (spec) => {
+	const one = Array.isArray(spec) ? spec[0] : spec;
+	return one.includes(".") ? one.split(".")[0] : void 0;
+};
 /**
-* Keys a query computes and attaches to a row, rather than reads from a column.
+* The junction a `via` relation reaches through, from either end.
 *
-* An explicit set rather than a `_` prefix rule: a user's column may perfectly
-* well be called `_internal`, and passing it through here would put a value on
-* the row that no property describes and nothing downstream knows how to type.
+* A step is `{ table: T, on: { from, to } }` where `from` names a column on
+* whatever the walk was standing on and `to` names one on `T`. That positional
+* meaning is what makes the unqualified form work at all, so the walk carries
+* the previous table rather than asking the column names where they live.
 */
-var QUERY_METADATA_KEYS = /* @__PURE__ */ new Set([
-	"_score",
-	"_distance",
-	"_matches"
-]);
-function normalizeScalarValues(data, properties, collection, resolvedRelations, options) {
-	const result = {};
-	const internalFKColumns = /* @__PURE__ */ new Set();
-	Object.values(resolvedRelations).forEach((relation) => {
-		if (relation.kind !== "belongsTo") return;
-		const localField = fieldKeyForColumn(collection, relation.localKey);
-		if (!properties[localField]) internalFKColumns.add(localField);
-	});
-	for (const [key, value] of Object.entries(data)) {
-		if (internalFKColumns.has(key)) {
-			result[key] = value === null ? null : typeof value === "number" ? value : String(value);
-			continue;
-		}
-		if (QUERY_METADATA_KEYS.has(key)) {
-			result[key] = value;
-			continue;
-		}
-		const property = properties[key];
-		if (!property) continue;
-		if (options.skipRelations && property.type === "relation") continue;
-		result[key] = parsePropertyFromServer(value, property, collection, key);
+function bindJoinPathJunction(registry, joinPath, parentTableName, targetTableName, label) {
+	const junctionName = joinPath.map((step) => step.table).find((table) => table !== parentTableName && table !== targetTableName);
+	if (!junctionName) throw misconfigured(label, "its joinPath has no table between the two ends to hold the links");
+	const table = registry.getTable(junctionName);
+	if (!table) throw misconfigured(label, `no table '${junctionName}' in the registry`);
+	let parentColumnName;
+	let targetColumnName;
+	let previousTable = parentTableName;
+	for (const step of joinPath) {
+		const fromTable = tablePart(step.on.from) ?? previousTable;
+		const toTable = tablePart(step.on.to) ?? step.table;
+		if (toTable === junctionName && fromTable === parentTableName) parentColumnName = columnPart(step.on.to);
+		else if (fromTable === junctionName && toTable === parentTableName) parentColumnName = columnPart(step.on.from);
+		else if (toTable === junctionName && fromTable === targetTableName) targetColumnName = columnPart(step.on.to);
+		else if (fromTable === junctionName && toTable === targetTableName) targetColumnName = columnPart(step.on.from);
+		previousTable = step.table;
 	}
-	return result;
+	if (!parentColumnName || !targetColumnName) throw misconfigured(label, `its joinPath does not connect '${parentTableName}' and '${targetTableName}' through '${junctionName}'`);
+	return {
+		table,
+		parentColumn: column(table, parentColumnName, label, "source"),
+		targetColumn: column(table, targetColumnName, label, "target"),
+		label,
+		payload: {}
+	};
 }
 /**
-* Lightweight value normalization for db.query results.
-* Only handles type coercion (dates, numbers, NaN) and property filtering.
-* Does NOT query the database for relations — those are already resolved
-* by Drizzle's relational query API.
+* Remove one link, leaving the row on the far side alone.
 *
-* Use this instead of `parseDataFromServer` when processing results from
-* `db.query.findFirst/findMany` which return pre-hydrated relation data.
+* This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
+* target is shared, so deleting the row would remove the tag from every other
+* post that uses it.
 */
-function normalizeDbValues(data, collection) {
-	const properties = collection.properties;
-	if (!data || !properties) return data;
-	return normalizeScalarValues(data, properties, collection, resolveCollectionRelations(collection), { skipRelations: true });
+async function removeJunctionLink(tx, binding, parentId, targetId, subject) {
+	const conditions = [eq(binding.parentColumn, parentId), eq(binding.targetColumn, targetId)];
+	if (((await tx.delete(binding.table).where(and(...conditions))).rowCount ?? 0) === 0) throw await explainZeroRowWrite(tx, binding.table, conditions, `Not allowed to unlink "${targetId}" from "${subject.parent}" "${parentId}": a row-level security policy rejected the write.`, `No "${subject.relation}" link between "${subject.parent}" "${parentId}" and "${targetId}" to remove.`);
+	logger.info(`Unlinked '${subject.relation}' ${targetId} from ${subject.parent} ${parentId}`);
 }
-//#endregion
-//#region src/services/row-pipeline.ts
 /**
-* Whether a many-relation reaches its target through a junction table.
+* Make the junction say that `parentId` is linked to exactly `targetIds`, by
+* diffing against what is linked now rather than replacing the set.
 *
-* Also used to build the drizzle `with` config, which is why it is exported:
-* the query has to nest one level deeper for a junction, and the row walk has
-* to unwrap that same level back out.
+* A save of the parent used to delete every junction row for it and re-insert
+* the ids the browser sent — a list the browser assembled from a read it did
+* earlier. Three things followed, all data loss rather than display:
+*
+*  - **Lost update.** Two editors with post 7 open: A adds tag X and saves, B
+*    saves any field from a form that predates it, and X is gone with nothing
+*    reported to either of them.
+*  - **A partially-read set is a partially-deleted set.** The read that fills
+*    the form runs under RLS, so a user who may edit the parent but cannot see
+*    some of the linked rows gets a shorter list — and writing it back deleted
+*    the links they were never shown. The select that drives the diff runs in
+*    this same transaction under the same policies, so a link the caller cannot
+*    read is in neither list and survives the save.
+*  - **Junction payload columns.** A junction carrying its own columns
+*    (`position`, `role`, `created_at`) lost them on every save, because every
+*    row was re-inserted with only the two keys. Untouched links are left alone.
+*
+* The insert is `ON CONFLICT DO NOTHING`, so two sessions adding the same link
+* concurrently is a no-op rather than a unique violation.
+*
+* ## The payload
+*
+* An element may carry `pivot` — the link's own columns, from a `_pivot` on the
+* wire. The array still *sets membership*: what is not in it is unlinked, and
+* what is in it is linked. The payload is what the link should hold once it
+* exists, so a new link is inserted with it (columns the caller left out take
+* their DEFAULT) and an existing link named with a payload is updated to match.
+*
+* The alternative — ignoring the payload on a link that already exists — makes
+* `PATCH { members: [{ id: 7, _pivot: { role: "admin" } }] }` a no-op that
+* answers 200, which is the one outcome a caller cannot tell from success. An
+* element with no `pivot` at all leaves the existing link exactly as it was;
+* that is what keeps a plain `[1, 2, 3]` membership write from wiping the
+* `role`s off the links it did not mention.
 */
-function isJunctionRelation(relation) {
-	if (isManyToMany(relation)) return true;
-	return relation.kind === "via" && relation.joinPath.length > 1;
+async function applyJunctionMembership(tx, binding, parentId, links) {
+	const existingRows = await tx.select({ targetId: binding.targetColumn }).from(binding.table).where(eq(binding.parentColumn, parentId));
+	const existingById = /* @__PURE__ */ new Map();
+	for (const row of existingRows) {
+		if (row.targetId === null || row.targetId === void 0) continue;
+		existingById.set(String(row.targetId), row.targetId);
+	}
+	const wantedById = /* @__PURE__ */ new Map();
+	for (const link of links) {
+		if (link.id === null || link.id === void 0) continue;
+		wantedById.set(String(link.id), link);
+	}
+	const removed = [...existingById.entries()].filter(([key]) => !wantedById.has(key)).map(([, value]) => value);
+	const added = [...wantedById.entries()].filter(([key]) => !existingById.has(key)).map(([, link]) => link);
+	const repayloaded = [...wantedById.entries()].filter(([key, link]) => existingById.has(key) && link.pivot && Object.keys(link.pivot).length > 0).map(([, link]) => link);
+	if (removed.length > 0) await removeLinks(tx, binding, parentId, removed);
+	if (added.length > 0) await tx.insert(binding.table).values(added.map((link) => ({
+		[binding.parentColumn.name]: parentId,
+		[binding.targetColumn.name]: link.id,
+		...link.pivot ?? {}
+	}))).onConflictDoNothing();
+	for (const link of repayloaded) await tx.update(binding.table).set(link.pivot).where(and(eq(binding.parentColumn, parentId), eq(binding.targetColumn, link.id)));
 }
 /**
-* Reach the target row inside a junction row.
+* Set the columns of ONE existing link, without touching the membership.
 *
-* A junction row looks like `{ post_id: 1, tag_id: { id: 5, name: "ts" } }` —
-* the foreign keys, and the target nested under one of them. The target is the
-* only object among them, so that is how it is found. A junction row that has
-* not been nested (no `with` on the join) has no object and is returned as-is.
+* The membership array cannot express this on its own: sending one element
+* would unlink everything else, and sending the whole set to change one link's
+* `role` is the lost-update race {@link applyJunctionMembership}'s diff exists
+* to avoid, reintroduced by the caller. So there is a route for it —
+* `PATCH /api/data/:slug/:id/:relation/:targetId` with a `_pivot` body.
+*
+* A link that is not there is a **404**, not a silent insert: "update the role
+* on this membership" and "create this membership" are different requests, and
+* a caller who mistyped an id should hear about it rather than get a new link
+* with a partial payload. Zero rows is also how a policy refusal arrives on
+* Postgres, which is why the distinction is drawn by
+* {@link explainZeroRowWrite} rather than by this function guessing.
 */
-function unwrapJunctionRow(item) {
-	const nestedKey = Object.keys(item).find((key) => typeof item[key] === "object" && item[key] !== null && !Array.isArray(item[key]));
-	return nestedKey ? item[nestedKey] : item;
+async function updateJunctionPivot(tx, binding, parentId, targetId, values, subject) {
+	const conditions = [eq(binding.parentColumn, parentId), eq(binding.targetColumn, targetId)];
+	if (((await tx.update(binding.table).set(values).where(and(...conditions))).rowCount ?? 0) === 0) throw await explainZeroRowWrite(tx, binding.table, conditions, `Not allowed to update the link between "${subject.parent}" "${parentId}" and "${targetId}": a row-level security policy rejected the write.`, `No "${subject.relation}" link between "${subject.parent}" "${parentId}" and "${targetId}" to update.`);
+	logger.info(`Updated '${subject.relation}' link ${targetId} on ${subject.parent} ${parentId}`);
 }
 /**
-* Give back the number a `number` property was declared to be.
+* Drop the named links, and refuse to call it done if the database kept any.
 *
-* Postgres returns NUMERIC as a string and drizzle keeps it that way, since a
-* numeric can hold more precision than a double. But the collection declared
-* this property `number` and the OpenAPI spec this server publishes says
-* `type: number`, so serving `"9.99"` breaks its own contract — and breaks it
-* asymmetrically, because a create answers with the number and the read that
-* follows answers with the string. Any client that multiplies a price works
-* until the first refresh.
-*
-* Declaring a property `number` already accepts double precision — that is what
-* the admin has always parsed it to. Columns REST serves that no property
-* declares are left exactly as the database returned them.
+* Every id here came out of the select in {@link applyJunctionMembership}, on
+* this same handle, so all of them were visible. Fewer deletions than that means
+* something refused them — and a save that reports success while the membership
+* it stored is not the membership it was given has told the caller something
+* untrue about the database.
 */
-function coerceDeclaredNumber(value, property) {
-	if (property?.type !== "number" || typeof value !== "string") return value;
-	const parsed = parseFloat(value);
-	return isNaN(parsed) ? null : parsed;
+async function removeLinks(tx, binding, parentId, removed) {
+	const conditions = [eq(binding.parentColumn, parentId), inArray(binding.targetColumn, removed)];
+	const deleted = (await tx.delete(binding.table).where(and(...conditions))).rowCount ?? 0;
+	if (deleted >= removed.length) return;
+	if ((await tx.select({ present: sql`1` }).from(binding.table).where(and(...conditions)).limit(1)).length === 0) return;
+	throw ApiError.forbidden(`Not allowed to remove ${removed.length - deleted} of ${removed.length} link(s) for relation '${binding.label}': a row-level security policy rejected the write.`, "WRITE_DENIED");
 }
 /**
-* Serve a `date` column as the timestamp this API says it serves.
-*
-* The OpenAPI document this server publishes types a `date` property as
-* `string, format: date-time` — RFC 3339 — and node-postgres hands over the
-* Postgres literal: `"2026-08-24 01:37:57.647+02"`, with a space where the `T`
-* belongs and a two-digit offset. V8 parses that by accident; Safari's
-* `new Date()` does not have to, and the spec never promised it. A column whose
-* documented type only parses in some browsers is not a contract.
+* The soft-delete field this collection uses, or `undefined` if it has none.
 *
-* A date-only column (`mode: "date"`, `format: "date"` in the spec) is already
-* RFC 3339 as `YYYY-MM-DD` and is left alone — widening it to a timestamp would
-* invent a time of day and a timezone the column does not have.
+* Returns the field even when the property is missing, because the *boot* check
+* is what refuses that config; making this return `undefined` for it would turn
+* a misconfiguration into "soft delete quietly off", which is the failure mode
+* worth avoiding — deletes would silently start removing rows.
 */
-function toRestDate(value) {
-	if (value instanceof Date) return isNaN(value.getTime()) ? null : value.toISOString();
-	if (value && typeof value === "object" && value.__type === "date") return value.value ?? null;
-	if (typeof value !== "string" && typeof value !== "number") return value;
-	if (typeof value === "string" && /^\d{4}-\d{2}-\d{2}$/.test(value)) return value;
-	const date = new Date(value);
-	return isNaN(date.getTime()) ? value : date.toISOString();
+function resolveSoftDelete(collection) {
+	const declared = collection?.softDelete;
+	if (!declared) return void 0;
+	const field = typeof declared === "object" && declared.field || "deletedAt";
+	return {
+		field,
+		columnName: ((collection?.properties)?.[field])?.columnName ?? toSnakeCase(field)
+	};
 }
 /**
-* One scalar, as REST serves it: declared numbers as numbers, declared dates as
-* RFC 3339, everything else exactly as the database returned it.
+* The drizzle column behind the soft-delete field, if the table has one.
+*
+* Matched on the column's own `name` rather than on the key, because a
+* generated schema keys columns by the property name while an introspected one
+* may key them by the column — and this has to work for both.
 */
-function toRestScalar(value, property) {
-	if (property?.type === "date") return toRestDate(value);
-	return coerceDeclaredNumber(value, property);
+function softDeleteColumn(collection, table) {
+	const resolved = resolveSoftDelete(collection);
+	if (!resolved) return void 0;
+	const columns = table ? getTableColumns(table) : void 0;
+	if (!columns) return void 0;
+	const direct = columns[resolved.field] ?? columns[resolved.columnName];
+	if (direct) return direct;
+	for (const column of Object.values(columns)) if (column.name === resolved.columnName) return column;
 }
 /**
-* Apply {@link toRestScalar} across a row, leaving undeclared columns alone.
+* `deleted_at IS NULL` — or nothing, when the caller asked for the deleted rows
+* or the collection has no soft delete at all.
 *
-* Exported because the include loader attaches related rows itself, and a
-* target rendered differently from its parent is the shape bug this whole file
-* exists to prevent — a date was a string at the top level and a
-* `{ __type: "date" }` envelope one level down, in the same response.
+* The one place the rule is written. Call it from every read; `undefined` means
+* "add no condition", which composes with `and(...)` unchanged.
 */
-function toRestValues(row, collection) {
-	const properties = collection.properties;
-	if (!properties) return row;
-	const out = {};
-	for (const [key, value] of Object.entries(row)) out[key] = toRestScalar(value, properties[key]);
-	return out;
+function softDeleteCondition(collection, table, withDeleted) {
+	if (withDeleted === true) return void 0;
+	const column = softDeleteColumn(collection, table);
+	if (!column) return void 0;
+	return withDeleted === "only" ? isNotNull(column) : isNull(column);
 }
-/** Render one target row in the requested style. */
 /**
-* Drop every column this caller may not read.
-*
-* Password hashes and verification tokens have to be readable server-side but
-* must never reach a client — and "never" has to mean every exit from this
-* pipeline, including relation targets, or a secret leaks through whichever
-* path was overlooked. Keyed by both the property name and its column name,
-* since a row can arrive keyed either way depending on the caller.
-*
-* `excludeFromApi` is the case with no roles in it: `effectiveAccess` expands
-* the flag to `read: []`, which no caller satisfies, so the flag needs no branch
-* of its own here and no longer has one. `access.read: ["hr"]` is the same walk
-* asking a different question of {@link currentFieldViewer}.
-*
-* The field is **deleted**, never nulled. A withheld value that arrives as
-* `null` is indistinguishable from a stored `null`, which turns a permission
-* boundary into a question a client can answer by counting nulls — and it makes
-* an `update` that echoes the row back overwrite the real value with the null it
-* was handed.
+* Fold the soft-delete condition into a list of conditions that is being built.
 *
-* `_matches` is filtered rather than deleted: it is the list of fields a text
-* search hit, and a field the caller cannot read must not appear in it even
-* though the array itself is theirs to see.
+* A convenience for the call sites that already collect `SQL[]`, so adding soft
+* delete to one of them is a single line rather than three.
 */
-function stripUnreadable(row, collection) {
-	const properties = collection.properties;
-	if (!properties) return row;
-	const viewer = currentFieldViewer();
-	const hidden = /* @__PURE__ */ new Set();
-	for (const [key, property] of Object.entries(properties)) {
-		if (canReadField(property, viewer)) continue;
-		hidden.add(key);
-		delete row[key];
-		if (property.columnName) {
-			hidden.add(property.columnName);
-			delete row[property.columnName];
-		}
-	}
-	if (hidden.size > 0 && Array.isArray(row._matches)) row._matches = row._matches.filter((match) => !hidden.has(typeof match === "string" ? match : String(match?.field)));
-	return row;
-}
-function renderTarget(targetRow, targetCollection, style, registry) {
-	if (style === "inline") return stripUnreadable(toRestValues({ ...targetRow }, targetCollection), targetCollection);
-	const address = relationTargetAddress(targetRow, targetCollection, registry);
-	const path = targetCollection.slug;
-	return createRelationRefWithData(address, path, {
-		id: address,
-		path,
-		values: stripUnreadable(normalizeDbValues(targetRow, targetCollection), targetCollection)
-	});
+function withSoftDelete(conditions, collection, table, withDeleted) {
+	const condition = softDeleteCondition(collection, table, withDeleted);
+	if (condition) conditions.push(condition);
+	return conditions;
 }
 /**
-* The address a relation ref points at.
+* Combine an existing `where` with the soft-delete condition.
 *
-* The whole key, not its first column: a composite-keyed target addressed by
-* `tenant_id` alone points at every row that shares it. A target whose key
-* cannot be resolved at all used to throw here — reading `[0]` of an empty
-* array — taking down the parent's fetch over a relation it may not even have
-* asked for. The first column is a guess, but a ref that resolves to nothing
-* beats no rows at all.
+* For the call sites that hold one composed condition rather than a list.
 */
-function relationTargetAddress(targetRow, targetCollection, registry) {
-	const address = deriveRowAddress(targetRow, targetCollection, registry);
-	if (address) return address;
-	return String(targetRow[Object.keys(targetRow)[0]] ?? "");
+function andSoftDelete(where, collection, table, withDeleted) {
+	const condition = softDeleteCondition(collection, table, withDeleted);
+	if (!condition) return where;
+	return where ? and(where, condition) : condition;
 }
+//#endregion
+//#region src/services/RelationService.ts
 /**
-* The row the admin renders: every column, with relations as references.
+* Typed wrapper for Drizzle dynamic query innerJoin.
+* Drizzle's `$dynamic()` queries lose the `innerJoin` method from
+* their static type, but it exists at runtime. This helper bridges
+* the gap with a single confined cast.
 *
-* Values are normalized (dates, numbers, NaN) because the admin's view-model
-* expects real types. The row's own address is *not* among the columns — it is
-* derived by the consumer from the collection's primary keys.
+* Exported so `data-transformer` uses this one rather than restating the same
+* fact — it wrote `query.innerJoin(...) as unknown as typeof query`, which is
+* the same claim about the same drizzle behaviour in a second spelling.
 */
-function toFlatRow(row, collection, registry) {
-	const resolvedRelations = resolveCollectionRelations(collection);
-	const normalized = normalizeDbValues(row, collection);
-	for (const [key, relation] of Object.entries(resolvedRelations)) {
-		const relData = row[relation.relationName || key];
-		if (relData === void 0 || relData === null) continue;
-		if (relation.cardinality === "many" && Array.isArray(relData)) {
-			const targetCollection = relation.target();
-			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, targetCollection, "ref", registry));
-		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
-	}
-	return stripUnreadable(normalized, collection);
+function applyDynamicJoin(query, joinTable, condition) {
+	return query.innerJoin(joinTable, condition);
 }
 /**
-* The row REST serves: every column under its own name, with the value Postgres
-* returned, and relations inlined as the target's columns.
-*
-* Values are the ones the database returned, except where that contradicts the
-* declared type: a `number` property is served as a number (see
-* {@link coerceDeclaredNumber}) and a `date` as RFC 3339, which is what this
-* server's own OpenAPI document says a date column is (see
-* {@link toRestDate}).
-*
-* Keyed by the row rather than by the relation list — a REST fetch only loads
-* the relations `include` asked for, so the row is the authority on which are
-* actually there.
+* Typed wrapper for DrizzleConditionBuilder.buildRelationQuery on dynamic queries.
+* The method returns a widened generic that doesn't reassign cleanly;
+* this helper confines the cast.
 */
-function toRestRow(row, collection, registry) {
-	const resolvedRelations = resolveCollectionRelations(collection);
-	const flat = {};
-	for (const [key, value] of Object.entries(row)) {
-		const relation = findRelation(resolvedRelations, key);
-		if (relation && Array.isArray(value)) flat[key] = value.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, relation.target(), "inline", registry));
-		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
-		else flat[key] = toRestScalar(value, collection.properties?.[key]);
-	}
-	return stripUnreadable(flat, collection);
+function applyDynamicRelationQuery(query, ...args) {
+	return DrizzleConditionBuilder.buildRelationQuery(...args);
 }
-//#endregion
-//#region src/services/write-denial.ts
 /**
-* Explain a write that matched no rows.
-*
-* Row-level security filters UPDATE and DELETE through the policy's USING
-* clause instead of raising: a denied write is reported by Postgres exactly
-* like a successful one that happened to match nothing. Left unchecked, a
-* caller cannot tell "denied" from "done" — the write returns 200/204 and the
-* row is untouched. An agent handed a key with `orders:delete` and no delete
-* policy is the case that makes it concrete: it deletes nothing, forever, and
-* is told it worked every time.
-*
-* Re-reading the target over the *same* RLS-scoped handle separates the two
-* cases. A visible row means the policy rejected the write (403); an invisible
-* one means there is nothing there to write for this caller (404, matching what
-* a GET would say). The re-read is bound by the caller's own policies, so it
-* discloses nothing a plain read wouldn't.
-*
-* Only reached when zero rows matched, so the happy path pays nothing.
-*
-* It lives here, rather than beside its first caller, because every zero-row
-* write has to answer the same question and answer it identically: the rule
-* that a readable-but-unwritable target is a 403 is the contract, and a second
-* copy of it is a second chance to get it wrong.
+* The relation's own matching condition, AND-ed with an include's `where`.
 *
-* @param handle     The RLS-scoped connection the write ran on — not a fresh
-*                   one, or the re-read would answer for a different caller.
-* @param table      The table the write targeted (the junction, for a link).
-* @param conditions The write's own WHERE terms, reused verbatim.
-* @param denied     Message for the 403: the target is there and was refused.
-* @param missing    Message for the 404: there is nothing there for this caller.
+* Written once because the batch loaders reach the same decision from six
+* places — one per relation kind, twice over for the to-one and to-many
+* variants — and a `where` dropped from one of them is a filter the caller
+* asked for that silently did not apply.
 */
-async function explainZeroRowWrite(handle, table, conditions, denied, missing) {
-	if ((await handle.select({ present: sql`1` }).from(table).where(and(...conditions)).limit(1)).length > 0) return ApiError.forbidden(denied, "WRITE_DENIED");
-	return ApiError.notFound(missing);
-}
-//#endregion
-//#region src/services/junction-writes.ts
-/** A junction that cannot be resolved is a broken relation, not a no-op. */
-var misconfigured = (label, detail) => relationMisconfigured(label, detail);
-function column(table, name, label, role) {
-	const col = name ? table[name] : void 0;
-	if (!col) throw misconfigured(label, `no ${role} column '${name ?? "?"}' on the junction table`);
-	return col;
-}
-/** The junction a `manyToMany` names outright. */
-function bindThroughJunction(registry, through, label) {
-	const table = registry.getTable(through.table);
-	if (!table) throw misconfigured(label, `no table '${through.table}' in the registry`);
-	return {
-		table,
-		parentColumn: column(table, through.sourceColumn, label, "source"),
-		targetColumn: column(table, through.targetColumn, label, "target"),
-		label
-	};
-}
-/** The bare column name, whether written as `col` or `table.col`. */
-var columnPart = (spec) => {
-	const one = Array.isArray(spec) ? spec[0] : spec;
-	return one.includes(".") ? one.split(".")[1] : one;
-};
-/** The table a column spec names, or undefined when it is unqualified. */
-var tablePart = (spec) => {
-	const one = Array.isArray(spec) ? spec[0] : spec;
-	return one.includes(".") ? one.split(".")[0] : void 0;
-};
-/**
-* The junction a `via` relation reaches through, from either end.
-*
-* A step is `{ table: T, on: { from, to } }` where `from` names a column on
-* whatever the walk was standing on and `to` names one on `T`. That positional
-* meaning is what makes the unqualified form work at all, so the walk carries
-* the previous table rather than asking the column names where they live.
-*/
-function bindJoinPathJunction(registry, joinPath, parentTableName, targetTableName, label) {
-	const junctionName = joinPath.map((step) => step.table).find((table) => table !== parentTableName && table !== targetTableName);
-	if (!junctionName) throw misconfigured(label, "its joinPath has no table between the two ends to hold the links");
-	const table = registry.getTable(junctionName);
-	if (!table) throw misconfigured(label, `no table '${junctionName}' in the registry`);
-	let parentColumnName;
-	let targetColumnName;
-	let previousTable = parentTableName;
-	for (const step of joinPath) {
-		const fromTable = tablePart(step.on.from) ?? previousTable;
-		const toTable = tablePart(step.on.to) ?? step.table;
-		if (toTable === junctionName && fromTable === parentTableName) parentColumnName = columnPart(step.on.to);
-		else if (fromTable === junctionName && toTable === parentTableName) parentColumnName = columnPart(step.on.from);
-		else if (toTable === junctionName && fromTable === targetTableName) targetColumnName = columnPart(step.on.to);
-		else if (fromTable === junctionName && toTable === targetTableName) targetColumnName = columnPart(step.on.from);
-		previousTable = step.table;
-	}
-	if (!parentColumnName || !targetColumnName) throw misconfigured(label, `its joinPath does not connect '${parentTableName}' and '${targetTableName}' through '${junctionName}'`);
-	return {
-		table,
-		parentColumn: column(table, parentColumnName, label, "source"),
-		targetColumn: column(table, targetColumnName, label, "target"),
-		label
-	};
-}
-/**
-* Remove one link, leaving the row on the far side alone.
-*
-* This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
-* target is shared, so deleting the row would remove the tag from every other
-* post that uses it.
-*/
-async function removeJunctionLink(tx, binding, parentId, targetId, subject) {
-	const conditions = [eq(binding.parentColumn, parentId), eq(binding.targetColumn, targetId)];
-	if (((await tx.delete(binding.table).where(and(...conditions))).rowCount ?? 0) === 0) throw await explainZeroRowWrite(tx, binding.table, conditions, `Not allowed to unlink "${targetId}" from "${subject.parent}" "${parentId}": a row-level security policy rejected the write.`, `No "${subject.relation}" link between "${subject.parent}" "${parentId}" and "${targetId}" to remove.`);
-	logger.info(`Unlinked '${subject.relation}' ${targetId} from ${subject.parent} ${parentId}`);
-}
-/**
-* Make the junction say that `parentId` is linked to exactly `targetIds`, by
-* diffing against what is linked now rather than replacing the set.
-*
-* A save of the parent used to delete every junction row for it and re-insert
-* the ids the browser sent — a list the browser assembled from a read it did
-* earlier. Three things followed, all data loss rather than display:
-*
-*  - **Lost update.** Two editors with post 7 open: A adds tag X and saves, B
-*    saves any field from a form that predates it, and X is gone with nothing
-*    reported to either of them.
-*  - **A partially-read set is a partially-deleted set.** The read that fills
-*    the form runs under RLS, so a user who may edit the parent but cannot see
-*    some of the linked rows gets a shorter list — and writing it back deleted
-*    the links they were never shown. The select that drives the diff runs in
-*    this same transaction under the same policies, so a link the caller cannot
-*    read is in neither list and survives the save.
-*  - **Junction payload columns.** A junction carrying its own columns
-*    (`position`, `role`, `created_at`) lost them on every save, because every
-*    row was re-inserted with only the two keys. Untouched links are left alone.
-*
-* The insert is `ON CONFLICT DO NOTHING`, so two sessions adding the same link
-* concurrently is a no-op rather than a unique violation.
-*/
-async function applyJunctionMembership(tx, binding, parentId, targetIds) {
-	const existingRows = await tx.select({ targetId: binding.targetColumn }).from(binding.table).where(eq(binding.parentColumn, parentId));
-	const existingById = /* @__PURE__ */ new Map();
-	for (const row of existingRows) {
-		if (row.targetId === null || row.targetId === void 0) continue;
-		existingById.set(String(row.targetId), row.targetId);
-	}
-	const wantedById = /* @__PURE__ */ new Map();
-	for (const targetId of targetIds) {
-		if (targetId === null || targetId === void 0) continue;
-		wantedById.set(String(targetId), targetId);
-	}
-	const removed = [...existingById.entries()].filter(([key]) => !wantedById.has(key)).map(([, value]) => value);
-	const added = [...wantedById.entries()].filter(([key]) => !existingById.has(key)).map(([, value]) => value);
-	if (removed.length > 0) await removeLinks(tx, binding, parentId, removed);
-	if (added.length > 0) await tx.insert(binding.table).values(added.map((targetId) => ({
-		[binding.parentColumn.name]: parentId,
-		[binding.targetColumn.name]: targetId
-	}))).onConflictDoNothing();
-}
-/**
-* Drop the named links, and refuse to call it done if the database kept any.
-*
-* Every id here came out of the select in {@link applyJunctionMembership}, on
-* this same handle, so all of them were visible. Fewer deletions than that means
-* something refused them — and a save that reports success while the membership
-* it stored is not the membership it was given has told the caller something
-* untrue about the database.
-*/
-async function removeLinks(tx, binding, parentId, removed) {
-	const conditions = [eq(binding.parentColumn, parentId), inArray(binding.targetColumn, removed)];
-	const deleted = (await tx.delete(binding.table).where(and(...conditions))).rowCount ?? 0;
-	if (deleted >= removed.length) return;
-	if ((await tx.select({ present: sql`1` }).from(binding.table).where(and(...conditions)).limit(1)).length === 0) return;
-	throw ApiError.forbidden(`Not allowed to remove ${removed.length - deleted} of ${removed.length} link(s) for relation '${binding.label}': a row-level security policy rejected the write.`, "WRITE_DENIED");
-}
-/**
-* The soft-delete field this collection uses, or `undefined` if it has none.
-*
-* Returns the field even when the property is missing, because the *boot* check
-* is what refuses that config; making this return `undefined` for it would turn
-* a misconfiguration into "soft delete quietly off", which is the failure mode
-* worth avoiding — deletes would silently start removing rows.
-*/
-function resolveSoftDelete(collection) {
-	const declared = collection?.softDelete;
-	if (!declared) return void 0;
-	const field = typeof declared === "object" && declared.field || "deletedAt";
-	return {
-		field,
-		columnName: ((collection?.properties)?.[field])?.columnName ?? toSnakeCase(field)
-	};
-}
-/**
-* The drizzle column behind the soft-delete field, if the table has one.
-*
-* Matched on the column's own `name` rather than on the key, because a
-* generated schema keys columns by the property name while an introspected one
-* may key them by the column — and this has to work for both.
-*/
-function softDeleteColumn(collection, table) {
-	const resolved = resolveSoftDelete(collection);
-	if (!resolved) return void 0;
-	const columns = table ? getTableColumns(table) : void 0;
-	if (!columns) return void 0;
-	const direct = columns[resolved.field] ?? columns[resolved.columnName];
-	if (direct) return direct;
-	for (const column of Object.values(columns)) if (column.name === resolved.columnName) return column;
-}
-/**
-* `deleted_at IS NULL` — or nothing, when the caller asked for the deleted rows
-* or the collection has no soft delete at all.
-*
-* The one place the rule is written. Call it from every read; `undefined` means
-* "add no condition", which composes with `and(...)` unchanged.
-*/
-function softDeleteCondition(collection, table, withDeleted) {
-	if (withDeleted === true) return void 0;
-	const column = softDeleteColumn(collection, table);
-	if (!column) return void 0;
-	return withDeleted === "only" ? isNotNull(column) : isNull(column);
-}
-/**
-* Fold the soft-delete condition into a list of conditions that is being built.
-*
-* A convenience for the call sites that already collect `SQL[]`, so adding soft
-* delete to one of them is a single line rather than three.
-*/
-function withSoftDelete(conditions, collection, table, withDeleted) {
-	const condition = softDeleteCondition(collection, table, withDeleted);
-	if (condition) conditions.push(condition);
-	return conditions;
-}
-/**
-* Combine an existing `where` with the soft-delete condition.
-*
-* For the call sites that hold one composed condition rather than a list.
-*/
-function andSoftDelete(where, collection, table, withDeleted) {
-	const condition = softDeleteCondition(collection, table, withDeleted);
-	if (!condition) return where;
-	return where ? and(where, condition) : condition;
-}
-//#endregion
-//#region src/services/RelationService.ts
-/**
-* Typed wrapper for Drizzle dynamic query innerJoin.
-* Drizzle's `$dynamic()` queries lose the `innerJoin` method from
-* their static type, but it exists at runtime. This helper bridges
-* the gap with a single confined cast.
-*/
-function applyDynamicJoin(query, joinTable, condition) {
-	return query.innerJoin(joinTable, condition);
-}
-/**
-* Typed wrapper for DrizzleConditionBuilder.buildRelationQuery on dynamic queries.
-* The method returns a widened generic that doesn't reassign cleanly;
-* this helper confines the cast.
-*/
-function applyDynamicRelationQuery(query, ...args) {
-	return DrizzleConditionBuilder.buildRelationQuery(...args);
-}
-/**
-* The relation's own matching condition, AND-ed with an include's `where`.
-*
-* Written once because the batch loaders reach the same decision from six
-* places — one per relation kind, twice over for the to-one and to-many
-* variants — and a `where` dropped from one of them is a filter the caller
-* asked for that silently did not apply.
-*/
-function narrowed(base, narrow) {
-	return narrow ? and(base, narrow) : base;
+function narrowed(base, narrow) {
+	return narrow ? and(base, narrow) : base;
 }
 /**
 * The registry has no table for a collection a relation just asked about.
@@ -3008,6 +2566,26 @@ var RelationService = class {
 		};
 	}
 	/**
+	* The junction row's own columns, as the caller may see them.
+	*
+	* Read through the same two steps the target's columns go through:
+	* `parseDataFromServer` gives the declared type (a `date` is a Date, a
+	* NUMERIC is a number) and `stripUnreadable` drops what this caller may not
+	* read. The second is the point — `access.read: ["hr"]` on a payload
+	* property has to mean the same thing it means on a collection's, and the
+	* synthetic junction config carries the property verbatim, so the same
+	* `effectiveAccess` answers both.
+	*
+	* Only the payload keys: the two foreign keys are the link's identity, and
+	* the caller already has both — one is the row they asked from, the other
+	* is the target's own id.
+	*/
+	async readPivot(junctionRow, junctionConfig, payloadKeys) {
+		const raw = {};
+		for (const key of payloadKeys) if (key in junctionRow) raw[key] = junctionRow[key];
+		return stripUnreadable(await parseDataFromServer(raw, junctionConfig), junctionConfig);
+	}
+	/**
 	* A WHERE matching any of `parentIds`, by the whole key.
 	*
 	* A single key is an `IN (…)`. A composite one cannot be: matching
@@ -3411,43 +2989,540 @@ var RelationService = class {
 			const results = await this.db.select().from(junctionTable).innerJoin(targetTable, eq(targetJunctionCol, targetIdField)).where(narrowed(inArray(sourceJunctionCol, parsedParentIds), narrowTarget));
 			const resultMap = /* @__PURE__ */ new Map();
 			const targetTableName = getTableName$1(targetCollection);
+			const payloadKeys = Object.keys(relation.through.properties);
+			const junctionConfig = payloadKeys.length > 0 ? getJunctionConfigForRelation(relation.through) : void 0;
 			for (const row of results) {
 				const junctionData = row[relation.through.table] || row;
 				const targetData = row[targetTableName] || row;
 				const parentId = String(junctionData[relation.through.sourceColumn]);
 				const arr = resultMap.get(parentId) || [];
-				arr.push(await this.toRelatedRow(targetData, targetCollection, targetPks));
+				const related = await this.toRelatedRow(targetData, targetCollection, targetPks);
+				if (junctionConfig) related.pivot = await this.readPivot(junctionData, junctionConfig, payloadKeys);
+				arr.push(related);
 				resultMap.set(parentId, arr);
 			}
 			return resultMap;
 		}
-		this.assertSingleKeyAddressable(parentCollection, parentPks, hasForeignKeyOnTarget(relation) ? relation.foreignKeyOnTarget : relation.relationName, relation);
-		const { keyByParentId, parentIdByKey } = hasForeignKeyOnTarget(relation) ? await this.resolveSourceKeys(parentCollection, relation, parentIds) : {
-			keyByParentId: /* @__PURE__ */ new Map(),
-			parentIdByKey: /* @__PURE__ */ new Map()
-		};
-		const matchValues = hasForeignKeyOnTarget(relation) ? [...keyByParentId.values()] : parsedParentIds;
-		if (matchValues.length === 0) return /* @__PURE__ */ new Map();
-		let query = this.db.select().from(targetTable).$dynamic();
-		query = applyDynamicRelationQuery(query, query, relation, matchValues, targetTable, parentTable, parentIdCol, targetIdField, this.registry, narrowTarget ? [narrowTarget] : []);
-		const results = await query;
-		const resultMap = /* @__PURE__ */ new Map();
-		for (const row of results) {
-			const targetRow = row[getTableName$1(targetCollection)] || row;
-			if (!hasForeignKeyOnTarget(relation)) continue;
-			const foreignKeyValue = targetRow[fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget)];
-			if (foreignKeyValue === void 0 || foreignKeyValue === null) continue;
-			const parentId = parentIdByKey.get(String(foreignKeyValue));
-			if (parentId !== void 0) {
-				const key = String(parentId);
-				const arr = resultMap.get(key) || [];
-				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
-				resultMap.set(key, arr);
-			}
+		this.assertSingleKeyAddressable(parentCollection, parentPks, hasForeignKeyOnTarget(relation) ? relation.foreignKeyOnTarget : relation.relationName, relation);
+		const { keyByParentId, parentIdByKey } = hasForeignKeyOnTarget(relation) ? await this.resolveSourceKeys(parentCollection, relation, parentIds) : {
+			keyByParentId: /* @__PURE__ */ new Map(),
+			parentIdByKey: /* @__PURE__ */ new Map()
+		};
+		const matchValues = hasForeignKeyOnTarget(relation) ? [...keyByParentId.values()] : parsedParentIds;
+		if (matchValues.length === 0) return /* @__PURE__ */ new Map();
+		let query = this.db.select().from(targetTable).$dynamic();
+		query = applyDynamicRelationQuery(query, query, relation, matchValues, targetTable, parentTable, parentIdCol, targetIdField, this.registry, narrowTarget ? [narrowTarget] : []);
+		const results = await query;
+		const resultMap = /* @__PURE__ */ new Map();
+		for (const row of results) {
+			const targetRow = row[getTableName$1(targetCollection)] || row;
+			if (!hasForeignKeyOnTarget(relation)) continue;
+			const foreignKeyValue = targetRow[fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget)];
+			if (foreignKeyValue === void 0 || foreignKeyValue === null) continue;
+			const parentId = parentIdByKey.get(String(foreignKeyValue));
+			if (parentId !== void 0) {
+				const key = String(parentId);
+				const arr = resultMap.get(key) || [];
+				arr.push(await this.toRelatedRow(targetRow, targetCollection, targetPks));
+				resultMap.set(key, arr);
+			}
+		}
+		return resultMap;
+	}
+};
+//#endregion
+//#region src/data-transformer.ts
+/**
+* Helper function to sanitize and convert dates to ISO strings
+*/
+function sanitizeAndConvertDates(obj) {
+	if (obj === null || obj === void 0) return null;
+	if (typeof obj === "number" && isNaN(obj)) return null;
+	if (typeof obj === "string" && obj.toLowerCase() === "nan") return null;
+	if (Array.isArray(obj)) return obj.map((v) => sanitizeAndConvertDates(v));
+	if (obj instanceof Date) return obj.toISOString();
+	if (typeof obj === "object") {
+		const newObj = {};
+		for (const key in obj) {
+			if (!Object.prototype.hasOwnProperty.call(obj, key)) continue;
+			if (isPrototypePollutingKey(key)) continue;
+			newObj[key] = sanitizeAndConvertDates(obj[key]);
+		}
+		return newObj;
+	}
+	if (typeof obj === "string") {
+		if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/.test(obj) || /^\w{3} \w{3} \d{2} \d{4} \d{2}:\d{2}:\d{2} GMT[+-]\d{4} \(.+\)$/.test(obj)) {
+			const date = new Date(obj);
+			if (!isNaN(date.getTime())) return date.toISOString();
+		}
+	}
+	return obj;
+}
+/**
+* Transform relations for database storage (relation objects to IDs)
+*/
+function serializeDataToServer(row, properties, collection, registry) {
+	if (!row || !properties) return {
+		scalarData: row ?? {},
+		inverseRelationUpdates: [],
+		joinPathRelationUpdates: []
+	};
+	const result = {};
+	const resolvedRelations = collection ? resolveCollectionRelations(collection) : {};
+	const inverseRelationUpdates = [];
+	const joinPathRelationUpdates = [];
+	const foreignKeys = /* @__PURE__ */ new Set();
+	Object.values(resolvedRelations).forEach((relation) => {
+		if (relation.kind === "belongsTo") foreignKeys.add(fieldKeyForColumn(collection, relation.localKey));
+	});
+	for (const [key, value] of Object.entries(row)) {
+		if (isPrototypePollutingKey(key)) continue;
+		if (value === void 0) continue;
+		const property = properties[key];
+		const effectiveValue = foreignKeys.has(key) && value === "" ? null : value;
+		if (!property) {
+			result[key] = effectiveValue;
+			continue;
+		}
+		if (property.type === "relation" && collection) {
+			const relation = findRelation(resolvedRelations, key);
+			if (relation) {
+				if (relation.kind === "belongsTo") {
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
+					if (serializedValue !== void 0) result[fieldKeyForColumn(collection, relation.localKey)] = serializedValue;
+					continue;
+				} else if (hasForeignKeyOnTarget(relation)) {
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
+					inverseRelationUpdates.push({
+						relationKey: key,
+						relation,
+						newValue: serializedValue
+					});
+					continue;
+				} else if (relation.kind === "via") {
+					const serializedValue = serializePropertyToServer(effectiveValue, property, key);
+					if (relation.cardinality === "one") joinPathRelationUpdates.push({
+						relationKey: key,
+						relation,
+						newTargetId: serializedValue
+					});
+					else inverseRelationUpdates.push({
+						relationKey: key,
+						relation,
+						newValue: serializedValue
+					});
+					continue;
+				}
+			}
+		}
+		result[key] = serializePropertyToServer(effectiveValue, property, key);
+	}
+	return {
+		scalarData: result,
+		inverseRelationUpdates,
+		joinPathRelationUpdates
+	};
+}
+/**
+* How to name a rejected value in an error, without quoting it back.
+*
+* The value may be anything the caller sent, including a secret in the wrong
+* field, so the message describes its shape rather than echoing it — an echoed
+* value ends up in logs and in error-reporting services.
+*/
+function describeValue(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return "an array";
+	if (value instanceof Date) return "a date";
+	const type = typeof value;
+	return type === "object" ? "an object" : `a ${type}`;
+}
+/**
+* Serialize a single property value for database storage.
+*
+* `propertyKey` is only ever used to phrase errors and warnings. Without it the
+* one trace a bad value left was `Expected array value for array property, got
+* string` — no collection, no property, no value, which in the log of a
+* thousand-row import names nothing at all.
+*/
+function serializePropertyToServer(value, property, propertyKey) {
+	if (value === null || value === void 0) return value;
+	const fieldLabel = propertyKey ? `'${propertyKey}'` : `a '${property.type}' field`;
+	switch (property.type) {
+		case "relation":
+			if (Array.isArray(value)) return value.map((v) => serializePropertyToServer(v, property, propertyKey));
+			else if (typeof value === "object" && value !== null && "id" in value) return value.id;
+			if (value === "") return null;
+			return value;
+		case "array":
+			if (Array.isArray(value)) {
+				if (property.of) return value.map((item) => serializePropertyToServer(item, property.of, propertyKey));
+				else if (property.oneOf) {
+					const typeField = property.oneOf.typeField ?? DEFAULT_ONE_OF_TYPE;
+					const valueField = property.oneOf.valueField ?? DEFAULT_ONE_OF_VALUE;
+					return value.map((e) => {
+						if (e === null) return null;
+						if (typeof e !== "object") return e;
+						const rec = e;
+						const type = rec[typeField];
+						const childProperty = property.oneOf?.properties[type];
+						if (!type || !childProperty) return e;
+						return {
+							[typeField]: type,
+							[valueField]: serializePropertyToServer(rec[valueField], childProperty, propertyKey)
+						};
+					});
+				}
+				return value;
+			}
+			throw ApiError.badRequest(`${fieldLabel} expects an array, but received ${describeValue(value)}.`, "VALIDATION_INVALID_VALUE");
+		case "geopoint": {
+			if (typeof value !== "object" || Array.isArray(value)) throw ApiError.badRequest(`${fieldLabel} expects a geopoint object with \`latitude\` and \`longitude\`, but received ${describeValue(value)}.`, "VALIDATION_INVALID_VALUE");
+			const point = value;
+			if (typeof point.latitude !== "number" || typeof point.longitude !== "number") throw ApiError.badRequest(`${fieldLabel} expects a geopoint object with numeric \`latitude\` and \`longitude\`.`, "VALIDATION_INVALID_VALUE");
+			return {
+				latitude: point.latitude,
+				longitude: point.longitude
+			};
+		}
+		case "map":
+			if (typeof value === "object" && property.properties) {
+				const result = {};
+				for (const [subKey, subValue] of Object.entries(value)) {
+					const subProperty = property.properties[subKey];
+					if (subProperty) result[subKey] = serializePropertyToServer(subValue, subProperty, propertyKey ? `${propertyKey}.${subKey}` : subKey);
+					else result[subKey] = subValue;
+				}
+				return result;
+			}
+			return value;
+		case "vector":
+			if (value instanceof Vector) return value.value;
+			if (value && typeof value === "object" && "value" in value && Array.isArray(value.value)) return value.value.map(Number);
+			if (Array.isArray(value)) return value.map(Number);
+			return value;
+		case "binary": {
+			const decoded = tryDecodeBase64DataUrl(value);
+			if (decoded) return decoded;
+			if (Buffer.isBuffer(value)) return value;
+			return value;
+		}
+		default: {
+			const decoded = tryDecodeBase64DataUrl(value);
+			if (decoded) return decoded;
+			return value;
+		}
+	}
+}
+/**
+* Transform IDs back to relation objects for frontend
+*/
+async function parseDataFromServer(data, collection, db, registry) {
+	const properties = collection.properties;
+	if (!data || !properties) return data;
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const result = normalizeScalarValues(data, properties, collection, resolvedRelations, { skipRelations: false });
+	for (const [propKey, property] of Object.entries(properties)) if (property.type === "relation" && !(propKey in result)) {
+		const relation = findRelation(resolvedRelations, propKey);
+		if (relation) {
+			const localField = relation.kind === "belongsTo" ? fieldKeyForColumn(collection, relation.localKey) : "";
+			if (relation.kind === "belongsTo" && localField in data) {
+				const fkValue = data[localField];
+				if (fkValue !== null && fkValue !== void 0) try {
+					const targetCollection = relation.target();
+					result[propKey] = createRelationRef(fkValue.toString(), targetCollection.slug);
+				} catch (e) {
+					logger.warn(`Could not resolve target collection for relation property: ${propKey}`, { error: e });
+				}
+			} else if (hasForeignKeyOnTarget(relation) && db && registry) try {
+				const targetCollection = relation.target();
+				const targetTable = registry.getTable(getTableName$1(targetCollection));
+				const pks = getPrimaryKeys(collection, registry);
+				const currentId = relation.sourceKey ? data[relation.sourceKey] : buildCompositeId$1(data, pks);
+				if (targetTable && currentId !== void 0 && currentId !== null && currentId !== "") {
+					const foreignKeyColumn = targetTable[fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget)];
+					if (foreignKeyColumn) {
+						const relatedRows = await db.select().from(targetTable).where(eq(foreignKeyColumn, currentId)).limit(relation.cardinality === "one" ? 1 : 100);
+						if (relatedRows.length > 0) if (relation.cardinality === "one") {
+							const targetPks = getPrimaryKeys(targetCollection, registry);
+							const relatedRow = relatedRows[0];
+							result[propKey] = createRelationRef(buildCompositeId$1(relatedRow, targetPks), targetCollection.slug);
+						} else {
+							const targetPks = getPrimaryKeys(targetCollection, registry);
+							result[propKey] = relatedRows.map((row) => createRelationRef(buildCompositeId$1(row, targetPks), targetCollection.slug));
+						}
+					}
+				}
+			} catch (e) {
+				logger.warn(`Could not resolve inverse relation property: ${propKey}`, { error: e });
+			}
+			else if (relation.kind === "via" && db && registry) try {
+				const targetCollection = relation.target();
+				const pks = getPrimaryKeys(collection, registry);
+				const currentId = buildCompositeId$1(data, pks);
+				if (currentId) {
+					const sourceTable = registry.getTable(getTableName$1(collection));
+					if (!sourceTable) {
+						logger.warn(`Source table not found for collection: ${collection.slug}`);
+						continue;
+					}
+					let query = db.select().from(sourceTable);
+					let currentTable = sourceTable;
+					for (const join of relation.joinPath) {
+						const joinTable = registry.getTable(join.table);
+						if (!joinTable) {
+							logger.warn(`Join table not found: ${join.table}`);
+							break;
+						}
+						const fromColumn = Array.isArray(join.on.from) ? join.on.from[0] : join.on.from;
+						const toColumn = Array.isArray(join.on.to) ? join.on.to[0] : join.on.to;
+						const fromParts = fromColumn.split(".");
+						const toParts = toColumn.split(".");
+						const fromColName = fromParts[fromParts.length - 1];
+						const toColName = toParts[toParts.length - 1];
+						const fromCol = currentTable[fromColName];
+						const toCol = joinTable[toColName];
+						if (!fromCol || !toCol) {
+							logger.warn(`Join columns not found: ${fromColumn} -> ${toColumn}`);
+							break;
+						}
+						query = applyDynamicJoin(query, joinTable, eq(fromCol, toCol));
+						currentTable = joinTable;
+					}
+					if (pks.length === 1) {
+						const sourceIdField = sourceTable[pks[0].fieldName];
+						query = query.where(eq(sourceIdField, currentId));
+					} else logger.warn(`Join path resolution for composite primary keys is not yet fully supported: ${collection.slug}`);
+					const additionalFilters = [];
+					let combinedWhere;
+					if (pks.length === 1) {
+						const sourceIdField = sourceTable[pks[0].fieldName];
+						combinedWhere = DrizzleConditionBuilder.combineConditionsWithAnd([eq(sourceIdField, currentId), ...additionalFilters].filter(Boolean));
+					}
+					const joinResults = await query.where(combinedWhere).limit(relation.cardinality === "one" ? 1 : 100);
+					if (joinResults.length > 0) {
+						const targetPks = getPrimaryKeys(targetCollection, registry);
+						const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
+						if (relation.cardinality === "one") {
+							const joinResult = joinResults[0];
+							result[propKey] = createRelationRef(buildCompositeId$1(joinResult[targetTableName] || joinResult, targetPks), targetCollection.slug);
+						} else result[propKey] = joinResults.map((joinResult) => {
+							return createRelationRef(buildCompositeId$1(joinResult[targetTableName] || joinResult, targetPks), targetCollection.slug);
+						});
+					}
+				}
+			} catch (e) {
+				logger.warn(`Could not resolve join path relation property: ${propKey}`, { error: e });
+			}
+		}
+	}
+	return result;
+}
+/**
+* Try to decode a `data:application/octet-stream;base64,...` data URL string
+* into a Buffer. Returns null if the value is not a matching data URL.
+*/
+function tryDecodeBase64DataUrl(value) {
+	if (typeof value !== "string") return null;
+	if (!value.startsWith("data:application/octet-stream;base64,")) return null;
+	const base64Data = value.split(",")[1];
+	return base64Data ? Buffer.from(base64Data, "base64") : null;
+}
+/**
+* Try to resolve an unknown value into a Buffer.
+* Handles native Buffers and `{ type: "Buffer", data: number[] }` objects (from JSON deserialization).
+* Returns null if the value is not a buffer.
+*/
+function tryResolveBuffer(value) {
+	if (Buffer.isBuffer(value)) return value;
+	if (typeof value === "object" && value !== null) {
+		const rawVal = value;
+		if (rawVal.type === "Buffer" && Array.isArray(rawVal.data)) return Buffer.from(rawVal.data);
+	}
+	return null;
+}
+/**
+* Convert a Buffer to a UTF-8 string if all bytes are printable ASCII,
+* otherwise return a base64 data URL.
+*/
+function bufferToStringOrBase64(buf) {
+	for (let i = 0; i < buf.length; i++) {
+		const b = buf[i];
+		if ((b < 32 || b > 126) && b !== 9 && b !== 10 && b !== 13) return `data:application/octet-stream;base64,${buf.toString("base64")}`;
+	}
+	return buf.toString("utf8");
+}
+function parsePropertyFromServer(value, property, collection, propertyKey) {
+	if (value === null || value === void 0) return value;
+	switch (property.type) {
+		case "binary": {
+			const buf = tryResolveBuffer(value);
+			if (buf) return `data:application/octet-stream;base64,${buf.toString("base64")}`;
+			return value;
+		}
+		case "string": {
+			if (typeof value === "string") return value;
+			const buf = tryResolveBuffer(value);
+			if (buf) return bufferToStringOrBase64(buf);
+			if (typeof value === "object" && value !== null) try {
+				return JSON.stringify(value);
+			} catch {
+				return String(value);
+			}
+			return String(value);
+		}
+		case "relation":
+			if (typeof value === "string" || typeof value === "number") {
+				let relationDef = property.resolvedRelation;
+				if (!relationDef && propertyKey) relationDef = findRelation(resolveCollectionRelations(collection), propertyKey);
+				if (!relationDef) {
+					logger.warn(`ResolvedRelation not defined in property for key: ${propertyKey || "unknown"}`);
+					return value;
+				}
+				try {
+					const targetCollection = relationDef.target();
+					return createRelationRef(value.toString(), targetCollection.slug);
+				} catch (e) {
+					logger.warn(`Could not resolve target collection for relation property: ${propertyKey || "unknown"}`, { error: e });
+					return value;
+				}
+			}
+			return value;
+		case "array":
+			if (Array.isArray(value)) {
+				if (property.of) return value.map((item) => parsePropertyFromServer(item, property.of, collection));
+				else if (property.oneOf) {
+					const typeField = property.oneOf.typeField ?? DEFAULT_ONE_OF_TYPE;
+					const valueField = property.oneOf.valueField ?? DEFAULT_ONE_OF_VALUE;
+					return value.map((e) => {
+						if (e === null) return null;
+						if (typeof e !== "object") return e;
+						const rec = e;
+						const type = rec[typeField];
+						const childProperty = property.oneOf?.properties[type];
+						if (!type || !childProperty) return e;
+						return {
+							[typeField]: type,
+							[valueField]: parsePropertyFromServer(rec[valueField], childProperty, collection)
+						};
+					});
+				}
+			} else {
+				logger.warn(`Expected array value from DB for array property, got ${typeof value}. Coercing to array.`);
+				return typeof value === "string" ? [value] : [];
+			}
+			return value;
+		case "map":
+			if (typeof value === "object" && property.properties) {
+				const result = {};
+				for (const [subKey, subValue] of Object.entries(value)) {
+					const subProperty = property.properties[subKey];
+					if (subProperty) result[subKey] = parsePropertyFromServer(subValue, subProperty, collection);
+					else result[subKey] = subValue;
+				}
+				return result;
+			}
+			return value;
+		case "number":
+			if (typeof value === "string") {
+				const parsed = parseFloat(value);
+				return isNaN(parsed) ? null : parsed;
+			}
+			return value;
+		case "geopoint": return value;
+		case "vector": {
+			let nums = [];
+			if (typeof value === "string") nums = value.slice(1, -1).split(",").map(Number);
+			else if (Array.isArray(value)) nums = value.map(Number);
+			else if (value instanceof Vector) nums = value.value;
+			else if (typeof value === "object" && value !== null && "value" in value) {
+				const valObj = value;
+				if (Array.isArray(valObj.value)) nums = valObj.value.map(Number);
+			}
+			return {
+				__type: "Vector",
+				value: nums
+			};
+		}
+		case "date": {
+			let date;
+			if (value instanceof Date) date = value;
+			else if (typeof value === "string" || typeof value === "number") {
+				const parsedDate = new Date(value);
+				if (!isNaN(parsedDate.getTime())) date = parsedDate;
+			}
+			if (date) return {
+				__type: "date",
+				value: date.toISOString()
+			};
+			return null;
+		}
+		default: {
+			const buf = tryResolveBuffer(value);
+			if (buf) return bufferToStringOrBase64(buf);
+			return value;
+		}
+	}
+}
+/**
+* Shared internal helper: normalizes scalar column values from a DB row
+* into frontend format. Handles FK-column preservation, type coercion
+* (dates, numbers, NaN), and property filtering.
+*
+* @param skipRelations  When `true`, relation-typed properties are omitted
+*                       from the result (used by `normalizeDbValues` where
+*                       Drizzle's relational API already hydrates them).
+*/
+/**
+* Keys a query computes and attaches to a row, rather than reads from a column.
+*
+* An explicit set rather than a `_` prefix rule: a user's column may perfectly
+* well be called `_internal`, and passing it through here would put a value on
+* the row that no property describes and nothing downstream knows how to type.
+*/
+var QUERY_METADATA_KEYS = /* @__PURE__ */ new Set([
+	"_score",
+	"_distance",
+	"_matches"
+]);
+function normalizeScalarValues(data, properties, collection, resolvedRelations, options) {
+	const result = {};
+	const internalFKColumns = /* @__PURE__ */ new Set();
+	Object.values(resolvedRelations).forEach((relation) => {
+		if (relation.kind !== "belongsTo") return;
+		const localField = fieldKeyForColumn(collection, relation.localKey);
+		if (!properties[localField]) internalFKColumns.add(localField);
+	});
+	for (const [key, value] of Object.entries(data)) {
+		if (internalFKColumns.has(key)) {
+			result[key] = value === null ? null : typeof value === "number" ? value : String(value);
+			continue;
+		}
+		if (QUERY_METADATA_KEYS.has(key)) {
+			result[key] = value;
+			continue;
 		}
-		return resultMap;
+		const property = properties[key];
+		if (!property) continue;
+		if (options.skipRelations && property.type === "relation") continue;
+		result[key] = parsePropertyFromServer(value, property, collection, key);
 	}
-};
+	return result;
+}
+/**
+* Lightweight value normalization for db.query results.
+* Only handles type coercion (dates, numbers, NaN) and property filtering.
+* Does NOT query the database for relations — those are already resolved
+* by Drizzle's relational query API.
+*
+* Use this instead of `parseDataFromServer` when processing results from
+* `db.query.findFirst/findMany` which return pre-hydrated relation data.
+*/
+function normalizeDbValues(data, collection) {
+	const properties = collection.properties;
+	if (!data || !properties) return data;
+	return normalizeScalarValues(data, properties, collection, resolveCollectionRelations(collection), { skipRelations: true });
+}
 //#endregion
 //#region src/services/nested-path.ts
 /**
@@ -3925,6 +4000,7 @@ var FetchService = class FetchService {
 		if (node.fields && node.fields.length > 0) {
 			const keep = new Set(node.fields);
 			for (const pk of getPrimaryKeys(targetCollection, this.registry)) keep.add(pk.fieldName);
+			keep.add(JUNCTION_PIVOT_KEY);
 			out = out.map((row) => {
 				const projected = {};
 				for (const [key, value] of Object.entries(row)) if (keep.has(key)) projected[key] = value;
@@ -3976,7 +4052,10 @@ var FetchService = class FetchService {
 					const results = await this.relationService.batchFetchRelatedEntitiesMany(collectionPath, rowIds, key, relation, narrow);
 					for (const row of addressable) {
 						const related = results.get(String(addressOf(row))) ?? [];
-						const shaped = this.shapeRelatedRows(related.map((e) => toRestValues({ ...e.values }, targetCollection)), node, targetCollection);
+						const shaped = this.shapeRelatedRows(related.map((e) => e.pivot ? {
+							...toRestValues({ ...e.values }, targetCollection),
+							[JUNCTION_PIVOT_KEY]: e.pivot
+						} : toRestValues({ ...e.values }, targetCollection)), node, targetCollection);
 						row[key] = shaped;
 						loaded.push(...shaped);
 					}
@@ -4595,33 +4674,54 @@ var FetchService = class FetchService {
 //#endregion
 //#region src/services/RelationWriteService.ts
 /**
-* The ids in a to-many relation write, whatever shape the caller sent.
+* The same reading, keeping the link's own values.
 *
-* A membership list is written as either the related rows (`[{ id: 1 }]`, what
-* the admin UI sends back after reading them) or as bare keys (`[1]`, `["t-1"]`,
-* what anyone writing the API by hand sends). Only the first was read, via a
-* blind `.map(rel => rel.id)`, and a bare key therefore became `undefined`:
-* on a numeric-keyed target that surfaced as `Invalid numeric ID: undefined`,
-* and on a string-keyed one it did not surface at all — `String(undefined)`
-* wrote a junction row pointing at the literal `"undefined"`, which no read
-* would ever match. Both shapes are accepted here, in one place, because both
-* call sites had the same assumption.
-*
-* An element that carries no key is refused rather than skipped: dropping it
-* would silently write a shorter membership list than the caller asked for.
+* An element may be `{ id, _pivot: { role: "owner" } }` where the relation is a
+* `manyToMany` whose `through` declares `properties`. The `_pivot` is taken off
+* here and nowhere else: it is not a column of the target, so leaving it on the
+* element would make it look like one to every later step.
 */
-function relationTargetIds(value, relationName, collectionSlug) {
+function relationLinkElements(value, relationName, collectionSlug) {
 	if (!Array.isArray(value)) return [];
 	return value.map((element, index) => {
-		if (typeof element === "string" || typeof element === "number") return element;
+		if (typeof element === "string" || typeof element === "number") return { id: element };
 		if (element && typeof element === "object") {
 			const id = element.id;
-			if (typeof id === "string" || typeof id === "number") return id;
+			const pivot = element[JUNCTION_PIVOT_KEY];
+			if (typeof id === "string" || typeof id === "number") return {
+				id,
+				pivot: pivot && typeof pivot === "object" && !Array.isArray(pivot) ? pivot : void 0
+			};
 		}
 		throw new Error(`Cannot write relation "${relationName}" on "${collectionSlug}": element ${index} carries no id. Pass either the related rows (\`[{ id: … }]\`) or their keys (\`[1, 2]\`), not ${element === null ? "null" : typeof element}.`);
 	});
 }
 /**
+* A `_pivot` as the junction table's columns.
+*
+* Exported because the payload route needs the identical reading — one function
+* so a value written through `PATCH posts/1 { tags: [{ id, _pivot }] }` and the
+* same value written through `PATCH posts/1/tags/5 { _pivot }` cannot be
+* serialized two ways.
+*/
+function serializePivot(pivot, payload, label) {
+	const declared = Object.keys(payload);
+	if (declared.length === 0) throw ApiError.badRequest(`Relation '${label}' carries no junction columns, so there is nothing to write under \`${JUNCTION_PIVOT_KEY}\`. Declare them in \`through.properties\`.`, "VALIDATION_UNKNOWN_FIELDS", { relation: label });
+	const values = {};
+	for (const [key, value] of Object.entries(pivot)) {
+		const property = payload[key];
+		if (!property) throw ApiError.badRequest(`The junction behind relation '${label}' has no column '${key}'. Its \`through.properties\` are: ${declared.sort().map((k) => `'${k}'`).join(", ")}.`, "VALIDATION_UNKNOWN_FIELDS", {
+			relation: label,
+			field: key,
+			validFields: declared.sort()
+		});
+		if (value === void 0) continue;
+		const serialized = serializePropertyToServer(value, property, key);
+		if (serialized !== void 0) values[key] = serialized;
+	}
+	return values;
+}
+/**
 * Writing relations: junction membership, foreign-key stamping, and the links a
 * nested path creates or removes.
 *
@@ -4660,6 +4760,31 @@ var RelationWriteService = class {
 			relation: hop.relationKey
 		});
 	}
+	/**
+	* Set the columns of one existing link, leaving the membership alone.
+	*
+	* `PATCH /api/data/:slug/:id/:relation/:targetId` with a `_pivot` body. The
+	* membership array cannot say this: one element would unlink everything
+	* else, and re-sending the whole set to change one `role` reintroduces the
+	* lost update the membership diff exists to avoid.
+	*/
+	async updateRelationPivot(tx, hop, targetId, pivot) {
+		if (!isManyToMany(hop.relation)) throw ApiError.badRequest(`Relation '${hop.relationKey}' on '${hop.parentCollection.slug}' is a ${hop.relation.kind}, which has no junction row to carry \`${JUNCTION_PIVOT_KEY}\`. Only a \`manyToMany\` with \`through.properties\` does.`, "VALIDATION_UNKNOWN_FIELDS", {
+			relation: hop.relationKey,
+			collection: hop.parentCollection.slug
+		});
+		const label = `${hop.parentCollection.slug}.${hop.relationKey}`;
+		const binding = bindThroughJunction(this.registry, hop.relation.through, label);
+		const values = serializePivot(pivot, hop.relation.through.properties, label);
+		if (Object.keys(values).length === 0) throw ApiError.badRequest(`\`${JUNCTION_PIVOT_KEY}\` named no junction column to set on '${label}'.`, "VALIDATION_CONSTRAINT", {
+			relation: hop.relationKey,
+			collection: hop.parentCollection.slug
+		});
+		await updateJunctionPivot(tx, binding, this.parsedId(hop.parentCollection, hop.parentId), this.parsedId(hop.targetCollection, targetId), values, {
+			parent: hop.parentCollection.slug,
+			relation: hop.relationKey
+		});
+	}
 	/** A collection's id, parsed to the type its primary key column holds. */
 	parsedId(collection, id) {
 		const pks = requirePrimaryKeys(collection, this.registry);
@@ -4672,6 +4797,26 @@ var RelationWriteService = class {
 		return ids.map((id) => parseIdValues(id, pks)[pks[0].fieldName]);
 	}
 	/**
+	* A membership list as links: the target ids parsed, and each element's
+	* `_pivot` turned into the columns the junction table holds.
+	*
+	* The values go through `serializePropertyToServer` — the same function
+	* every collection column's value goes through on a save — so a `date`
+	* arrives as a Date and a `map` as JSON, keyed by the property key, which is
+	* what the drizzle junction table is keyed by. A key the junction does not
+	* declare is **refused**, not dropped: drizzle leaves an unknown key out of
+	* the statement, so dropping it is a write that reports success having
+	* stored nothing.
+	*/
+	parsedLinks(collection, elements, payload, label) {
+		if (elements.length === 0) return [];
+		const pks = requirePrimaryKeys(collection, this.registry);
+		return elements.map((element) => ({
+			id: parseIdValues(element.id, pks)[pks[0].fieldName],
+			pivot: element.pivot ? serializePivot(element.pivot, payload, label) : void 0
+		}));
+	}
+	/**
 	* Update many-to-many and junction relations
 	*/
 	async updateRelationsUsingJoins(tx, collection, id, relationValues) {
@@ -4679,11 +4824,12 @@ var RelationWriteService = class {
 		for (const [key, value] of Object.entries(relationValues)) {
 			const relation = findRelation(resolvedRelations, key);
 			if (!relation || relation.cardinality !== "many") continue;
-			const targetEntityIds = relationTargetIds(value, key, collection.slug);
+			const elements = relationLinkElements(value, key, collection.slug);
+			const targetEntityIds = elements.map((element) => element.id);
 			const targetCollection = relation.target();
 			const label = `${collection.slug}.${key}`;
-			if (relation.kind === "via") await applyJunctionMembership(tx, bindJoinPathJunction(this.registry, relation.joinPath, getTableName$1(collection), getTableName$1(targetCollection), label), this.parsedId(collection, id), this.parsedIds(targetCollection, targetEntityIds));
-			else if (relation.kind === "manyToMany") await applyJunctionMembership(tx, bindThroughJunction(this.registry, relation.through, label), this.parsedId(collection, id), this.parsedIds(targetCollection, targetEntityIds));
+			if (relation.kind === "via") await applyJunctionMembership(tx, bindJoinPathJunction(this.registry, relation.joinPath, getTableName$1(collection), getTableName$1(targetCollection), label), this.parsedId(collection, id), this.parsedLinks(targetCollection, elements, {}, label));
+			else if (relation.kind === "manyToMany") await applyJunctionMembership(tx, bindThroughJunction(this.registry, relation.through, label), this.parsedId(collection, id), this.parsedLinks(targetCollection, elements, relation.through.properties, label));
 			else if (relation.cardinality === "many" && hasForeignKeyOnTarget(relation)) {
 				const targetTable = getTableForCollection(targetCollection, this.registry);
 				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
@@ -4722,7 +4868,8 @@ var RelationWriteService = class {
 					await this.updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, {
 						table: relation.through.table,
 						sourceColumn: relation.through.sourceColumn,
-						targetColumn: relation.through.targetColumn
+						targetColumn: relation.through.targetColumn,
+						properties: relation.through.properties
 					});
 					continue;
 				}
@@ -4755,8 +4902,8 @@ var RelationWriteService = class {
 		if (relation.joinPath.map((step) => step.table).filter((table) => table !== sourceTableName && table !== targetTableName).length !== 1 || relation.cardinality !== "many") return;
 		try {
 			const binding = bindJoinPathJunction(this.registry, relation.joinPath, sourceTableName, targetTableName, `${sourceCollection.slug}.${relation.relationName}`);
-			const targetIds = Array.isArray(newValue) ? relationTargetIds(newValue, relation.relationName, sourceCollection.slug) : newValue === null || newValue === void 0 ? [] : relationTargetIds([newValue], relation.relationName, sourceCollection.slug);
-			await applyJunctionMembership(tx, binding, this.parsedId(sourceCollection, sourceEntityId), this.parsedIds(targetCollection, targetIds));
+			const elements = Array.isArray(newValue) ? relationLinkElements(newValue, relation.relationName, sourceCollection.slug) : newValue === null || newValue === void 0 ? [] : relationLinkElements([newValue], relation.relationName, sourceCollection.slug);
+			await applyJunctionMembership(tx, binding, this.parsedId(sourceCollection, sourceEntityId), this.parsedLinks(targetCollection, elements, {}, `${sourceCollection.slug}.${relation.relationName}`));
 		} catch (error) {
 			logger.error(`Failed to update inverse joinPath relation '${relation.relationName}'`, { error });
 			throw error;
@@ -4766,9 +4913,10 @@ var RelationWriteService = class {
 	* Handle many-to-many inverse relation updates using junction tables
 	*/
 	async updateManyToManyInverseRelation(tx, sourceCollection, sourceEntityId, targetCollection, relation, newValue, junctionInfo) {
+		const label = `${sourceCollection.slug}.${relation.relationName}`;
 		try {
-			const targetIds = Array.isArray(newValue) ? relationTargetIds(newValue, relation.relationName, sourceCollection.slug) : [];
-			await applyJunctionMembership(tx, bindThroughJunction(this.registry, junctionInfo, `${sourceCollection.slug}.${relation.relationName}`), this.parsedId(sourceCollection, sourceEntityId), this.parsedIds(targetCollection, targetIds));
+			const elements = Array.isArray(newValue) ? relationLinkElements(newValue, relation.relationName, sourceCollection.slug) : [];
+			await applyJunctionMembership(tx, bindThroughJunction(this.registry, junctionInfo, label), this.parsedId(sourceCollection, sourceEntityId), this.parsedLinks(targetCollection, elements, junctionInfo.properties, label));
 		} catch (error) {
 			logger.error(`Failed to update many-to-many inverse relation '${relation.relationName}'`, { error });
 			throw error;
@@ -4974,6 +5122,23 @@ var PersistService = class {
 		this.fetchService = new FetchService(db, registry);
 	}
 	/**
+	* Set the columns of one many-to-many link, without touching the membership.
+	*
+	* `collectionPath` is the nested address — `posts/1/tags` — and `targetId`
+	* the row on the far side, so this is `PATCH posts/1/tags/5` with a
+	* `_pivot` body. Separate from {@link save} because the two mean different
+	* things at the same URL: a body of the target's own columns edits the tag,
+	* a body of `_pivot` edits the *link* to it, and conflating them would let
+	* a caller who meant one silently perform the other.
+	*/
+	async updateRelationPivot(collectionPath, targetId, pivot) {
+		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
+		if (!hop) throw ApiError.badRequest(`"${collectionPath}" is not a relation on a row, so there is no link to update. A \`${JUNCTION_PIVOT_KEY}\` write addresses \`<collection>/<id>/<relation>/<targetId>\`.`, "VALIDATION_UNKNOWN_FIELDS", { path: collectionPath });
+		assertWritableThrough(hop, collectionPath);
+		if (!await this.relationService.isRelated(hop, targetId)) throw ApiError.notFound(`No row "${targetId}" in "${collectionPath}" to update the link of.`);
+		await this.relationWrites.updateRelationPivot(this.db, hop, targetId, pivot);
+	}
+	/**
 	* Explain a row write that matched nothing — see {@link explainZeroRowWrite}
 	* for why a zero-row write cannot be reported as success.
 	*/
@@ -5331,6 +5496,10 @@ var DataService = class {
 	/**
 	* Delete all rows from a collection
 	*/
+	/** See {@link PersistService.updateRelationPivot}. */
+	async updateRelationPivot(collectionPath, targetId, pivot) {
+		return this.persistService.updateRelationPivot(collectionPath, targetId, pivot);
+	}
 	async deleteAll(collectionPath, databaseId) {
 		return this.persistService.deleteAll(collectionPath, databaseId);
 	}
@@ -5377,6 +5546,125 @@ var DataService = class {
 	}
 };
 //#endregion
+//#region src/services/write-transaction-scope.ts
+/**
+* The write transaction a request is running inside, published to whatever
+* the request's callbacks call into.
+*
+* `AuthenticatedPostgresBackendDriver.withTransaction` opens one of these for
+* every read-write transaction. A collection callback runs inside that
+* transaction, and what it hands off — a job, a queue message, a topic event,
+* a history entry — has to commit with the write or not at all. Those are
+* written by code that is not handed the transaction (the job store lives in
+* `@rebasepro/server` and knows no driver), so the transaction is found here
+* instead: through `AsyncLocalStorage`, and through the resolver
+* `@rebasepro/server` reads.
+*
+* Only write transactions. A read opens its own `READ ONLY` transaction, where
+* an insert would fail with 25006, and nothing a read does is undone by
+* anything — so inside a read the scope is explicitly empty and a queued job
+* commits on its own, as it always did.
+*/
+var WriteTransactionScope = class {
+	run;
+	open = true;
+	inflight = /* @__PURE__ */ new Set();
+	commitHooks = [];
+	/** The transaction handle, for statements in this package that are already written against drizzle. */
+	tx;
+	/** Attach the transaction, once it has begun. */
+	bind(tx, run) {
+		this.tx = tx;
+		this.run = run;
+	}
+	/** Bound, and not yet committing. */
+	get active() {
+		return this.open && this.run !== void 0;
+	}
+	exec(sqlText, params) {
+		if (!this.active) return Promise.reject(/* @__PURE__ */ new Error("This write's transaction is no longer open to new statements."));
+		return this.track(this.run(sqlText, params));
+	}
+	/**
+	* Count a statement as part of the transaction, so the commit waits for it.
+	* A callback that queues work without awaiting it has still asked for that
+	* work to be part of the write.
+	*
+	* Settled into a native promise first, and only that one is handed back:
+	* drizzle's query builders re-run their statement on every `.then()`, so
+	* observing one here and awaiting it at the call site would insert twice.
+	*/
+	track(statement) {
+		const settled = Promise.resolve(statement);
+		this.inflight.add(settled);
+		const done = () => {
+			this.inflight.delete(settled);
+		};
+		settled.then(done, done);
+		return settled;
+	}
+	afterCommit(fn) {
+		this.commitHooks.push(fn);
+	}
+	/**
+	* Wait for every tracked statement, then close to new ones — called as the
+	* last thing inside the transaction, before its commit. A statement that
+	* arrives after this cannot be part of the write, so it runs on its own
+	* connection, as if outside any write.
+	*/
+	async settle() {
+		while (this.inflight.size > 0) await Promise.allSettled([...this.inflight]);
+		this.open = false;
+	}
+	/**
+	* The transaction is over, whichever way it went. Nothing may reach it now:
+	* its client is back in the pool, and a callback's detached promise still
+	* carries this scope in its async context.
+	*/
+	close() {
+		this.open = false;
+	}
+	/** The transaction committed: run what was waiting for that, outside any write. */
+	committed() {
+		for (const hook of this.commitHooks.splice(0)) try {
+			storage.run(void 0, hook);
+		} catch (error) {
+			logger.error("[transaction] An after-commit hook threw; the write had already committed", { error });
+		}
+	}
+};
+/**
+* On `globalThis`, like the singleton, so two copies of this package share one
+* store: the copy that opened a transaction and the copy whose code asks for it
+* are not guaranteed to be the same.
+*/
+var STORAGE_SLOT = Symbol.for("rebase.postgres.writeTransactionScope");
+var storage = globalThis[STORAGE_SLOT] ??= new AsyncLocalStorage();
+/** The open write transaction the caller is inside, if any. */
+function currentWriteScope() {
+	const scope = storage.getStore();
+	return scope?.active ? scope : void 0;
+}
+/**
+* Run `fn` with `scope` as the current write transaction. `undefined` clears
+* it: a read nested inside a write's callback is not part of that write.
+*/
+function runInWriteScope(scope, fn) {
+	return storage.run(scope, fn);
+}
+/**
+* Publish the scope to `@rebasepro/server`'s job store and webhook dispatcher.
+*
+* Written to the slot directly, not through `setAmbientTransactionResolver`:
+* the runtime image supplies `@rebasepro/server` while a bundle brings this
+* package, and importing a function an older image does not export would fail
+* to link and stop the boot. Through the slot, an older server simply never
+* reads it. The key is frozen — `@rebasepro/server/src/db/ambient-transaction.ts`
+* reads the same one, and `write-transaction-scope-e2e.test.ts` fails if they
+* drift apart.
+*/
+globalThis[Symbol.for("rebase.server.ambientTransactionResolver")] = currentWriteScope;
+//#endregion
 //#region src/schema/classify-change.ts
 var VERDICT_RANK = {
 	safe: 0,
@@ -5817,6 +6105,12 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	branchService;
 	user;
 	data;
+	/**
+	* The server singleton, attached by `initializeRebaseBackend` after boot —
+	* a driver exists before the client does. Typed as what is attached: a
+	* `RebaseServerClient` has no `data`, and callbacks read it as
+	* `context.client`.
+	*/
 	client;
 	/**
 	* Auto-set to `true` once a `SET LOCAL ROLE` has failed with insufficient
@@ -5896,8 +6190,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	*/
 	schemaFactsQueryable() {
 		return { query: async (text) => {
-			const result = await this.db.execute(sql.raw(text));
-			return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
+			return { rows: sqlRows(await this.db.execute(sql.raw(text))) };
 		} };
 	}
 	/**
@@ -5940,18 +6233,28 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	* suite, because it is the kind of property that is easy to break from a
 	* distance and impossible to notice.
 	*
-	* Previously returned through `as unknown as RebaseCallContext`, which
+	* Previously returned through `as RebaseCallContext`, which
 	* disabled checking for the whole object and let `driver` — documented in
 	* the callbacks guide — sit on the runtime context while absent from the
 	* contract. Both are declared now, so this is a plain typed return.
+	*
+	* `client` went through a narrower cast, `as RebaseCallContext["client"]`,
+	* and it lied twice. It said `RebaseClient`, `data` included, about the
+	* server singleton, which has no `data` — so `context.client.data` compiled
+	* and threw in production. And it dropped the `| undefined` of a client
+	* that is attached after construction. The type now leaves `data` off, and
+	* a driver that was never given a client refuses by name, at the read.
 	*/
 	buildCallContext() {
+		const client = this.client;
 		return {
 			user: this.user,
 			driver: this,
 			data: this.data,
-			client: this.client,
-			storageSource: this.client?.storage
+			get client() {
+				return requireCallbackClient(client);
+			},
+			storageSource: client?.storage
 		};
 	}
 	resolveCollectionCallbacks(collection, path) {
@@ -5985,20 +6288,22 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	async applyAfterReadToRow(row, path, resolved, contextForCallback) {
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = resolved;
 		let out = row;
+		if (!PostgresBackendDriver.hasAfterRead(resolved)) return out;
+		const callbackCollection = requireCallbackCollection(resolvedCollection, path);
 		if (globalCallbacks?.afterRead) out = await globalCallbacks.afterRead({
-			collection: resolvedCollection,
+			collection: callbackCollection,
 			path,
 			row: out,
 			context: contextForCallback
 		}) ?? out;
 		if (callbacks?.afterRead) out = await callbacks.afterRead({
-			collection: resolvedCollection,
+			collection: callbackCollection,
 			path,
 			row: out,
 			context: contextForCallback
 		}) ?? out;
 		if (propertyCallbacks?.afterRead) out = await propertyCallbacks.afterRead({
-			collection: resolvedCollection,
+			collection: callbackCollection,
 			path,
 			row: out,
 			context: contextForCallback
@@ -6030,9 +6335,10 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		if (resolved.collection) try {
 			const rels = resolveCollectionRelations(resolved.collection);
 			for (const [key, rel] of Object.entries(rels)) {
-				const targetPath = (typeof rel.target === "function" ? rel.target() : void 0)?.slug;
+				const target = typeof rel.target === "function" ? rel.target() : void 0;
+				const targetPath = target?.slug;
 				if (!targetPath) continue;
-				const targetResolved = this.resolveCollectionCallbacks(void 0, targetPath);
+				const targetResolved = this.resolveCollectionCallbacks(target, targetPath);
 				if (PostgresBackendDriver.hasAfterRead(targetResolved)) relationTargets[key] = {
 					path: targetPath,
 					resolved: targetResolved
@@ -6079,22 +6385,23 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
 		if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
 			const contextForCallback = this.buildCallContext();
+			const callbackCollection = requireCallbackCollection(resolvedCollection, path);
 			return Promise.all(rows.map(async (row) => {
 				let fetched = row;
 				if (globalCallbacks?.afterRead) fetched = await globalCallbacks.afterRead({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					path,
 					row: fetched,
 					context: contextForCallback
 				}) ?? fetched;
 				if (callbacks?.afterRead) fetched = await callbacks.afterRead({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					path,
 					row: fetched,
 					context: contextForCallback
 				}) ?? fetched;
 				if (propertyCallbacks?.afterRead) fetched = await propertyCallbacks.afterRead({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					path,
 					row: fetched,
 					context: contextForCallback
@@ -6150,20 +6457,21 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
 		if (row && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
 			const contextForCallback = this.buildCallContext();
+			const callbackCollection = requireCallbackCollection(resolvedCollection, path);
 			if (globalCallbacks?.afterRead) row = await globalCallbacks.afterRead({
-				collection: resolvedCollection,
+				collection: callbackCollection,
 				path,
 				row,
 				context: contextForCallback
 			}) ?? row;
 			if (callbacks?.afterRead) row = await callbacks.afterRead({
-				collection: resolvedCollection,
+				collection: callbackCollection,
 				path,
 				row,
 				context: contextForCallback
 			}) ?? row;
 			if (propertyCallbacks?.afterRead) row = await propertyCallbacks.afterRead({
-				collection: resolvedCollection,
+				collection: callbackCollection,
 				path,
 				row,
 				context: contextForCallback
@@ -6313,9 +6621,10 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		}
 		try {
 			if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
+				const callbackCollection = requireCallbackCollection(resolvedCollection, path);
 				if (globalCallbacks?.beforeSave) {
 					const result = await globalCallbacks.beforeSave({
-						collection: resolvedCollection,
+						collection: callbackCollection,
 						path,
 						id,
 						values: updatedValues,
@@ -6327,7 +6636,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				}
 				if (callbacks?.beforeSave) {
 					const result = await callbacks.beforeSave({
-						collection: resolvedCollection,
+						collection: callbackCollection,
 						path,
 						id,
 						values: updatedValues,
@@ -6339,7 +6648,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				}
 				if (propertyCallbacks?.beforeSave) {
 					const result = await propertyCallbacks.beforeSave({
-						collection: resolvedCollection,
+						collection: callbackCollection,
 						path,
 						id,
 						values: updatedValues,
@@ -6375,20 +6684,21 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				onConflict
 			});
 			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
+				const callbackCollection = requireCallbackCollection(resolvedCollection, path);
 				if (globalCallbacks?.afterRead) savedRow = await globalCallbacks.afterRead({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					path,
 					row: savedRow,
 					context: contextForCallback
 				}) ?? savedRow;
 				if (callbacks?.afterRead) savedRow = await callbacks.afterRead({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					path,
 					row: savedRow,
 					context: contextForCallback
 				}) ?? savedRow;
 				if (propertyCallbacks?.afterRead) savedRow = await propertyCallbacks.afterRead({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					path,
 					row: savedRow,
 					context: contextForCallback
@@ -6398,8 +6708,9 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			const savedValues = savedRow;
 			try {
 				if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
+					const callbackCollection = requireCallbackCollection(resolvedCollection, path);
 					if (globalCallbacks?.afterSave) await globalCallbacks.afterSave({
-						collection: resolvedCollection,
+						collection: callbackCollection,
 						path,
 						id: savedId,
 						values: savedValues,
@@ -6408,7 +6719,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 						context: contextForCallback
 					});
 					if (callbacks?.afterSave) await callbacks.afterSave({
-						collection: resolvedCollection,
+						collection: callbackCollection,
 						path,
 						id: savedId,
 						values: savedValues,
@@ -6417,7 +6728,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 						context: contextForCallback
 					});
 					if (propertyCallbacks?.afterSave) await propertyCallbacks.afterSave({
-						collection: resolvedCollection,
+						collection: callbackCollection,
 						path,
 						id: savedId,
 						values: savedValues,
@@ -6447,6 +6758,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			return savedRow;
 		} catch (error) {
 			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
+				const callbackCollection = requireCallbackCollection(resolvedCollection, path);
 				const errorProps = {
 					path,
 					id,
@@ -6457,15 +6769,15 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 					context: contextForCallback
 				};
 				if (globalCallbacks?.afterSaveError) await globalCallbacks.afterSaveError({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					...errorProps
 				});
 				if (callbacks?.afterSaveError) await callbacks.afterSaveError({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					...errorProps
 				});
 				if (propertyCallbacks?.afterSaveError) await propertyCallbacks.afterSaveError({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					...errorProps
 				});
 			}
@@ -6492,6 +6804,26 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		txDriver._pendingNotifications = this._pendingNotifications;
 		return txDriver;
 	}
+	/**
+	* The callback context for work already running inside `tx` on behalf of
+	* `user` — for a caller that opened the user-scoped transaction itself.
+	*
+	* The realtime refetch is that caller: it applies the subscriber's auth
+	* context and role switch on its own connection. Its `afterRead` hooks used
+	* to get a context assembled by hand, and it was wrong in both directions:
+	* `data` was THIS driver's — the base one, on the owner connection, outside
+	* that transaction — so a hook reading related rows through `context.data`
+	* bypassed RLS on every subscription frame while the REST read of the same
+	* rows did not; and `client` and `storageSource` were absent, though the
+	* type promises both. This builds the context the REST path builds, bound to
+	* the transaction the rows came from.
+	*/
+	callContextWithin(tx, user) {
+		const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, user, this.poolManager, this.historyService);
+		txDriver.dataService = new DataService(tx, this.registry);
+		txDriver.client = this.client;
+		return txDriver.buildCallContext();
+	}
 	async saveMany({ path, rows, collection, upsert, onConflict }) {
 		return this.db.transaction(async (tx) => {
 			const txDriver = this.bindToTransaction(tx);
@@ -6720,10 +7052,11 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		const contextForCallback = this.buildCallContext();
 		try {
 			if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
+				const callbackCollection = requireCallbackCollection(resolvedCollection, targetPath);
 				let preventDefault = false;
 				if (globalCallbacks?.beforeDelete) {
 					if (await globalCallbacks.beforeDelete({
-						collection: resolvedCollection,
+						collection: callbackCollection,
 						path: targetPath,
 						id: row.id,
 						row: targetRow,
@@ -6732,7 +7065,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				}
 				if (callbacks?.beforeDelete) {
 					if (await callbacks.beforeDelete({
-						collection: resolvedCollection,
+						collection: callbackCollection,
 						path: targetPath,
 						id: row.id,
 						row: targetRow,
@@ -6741,7 +7074,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				}
 				if (propertyCallbacks?.beforeDelete) {
 					if (await propertyCallbacks.beforeDelete({
-						collection: resolvedCollection,
+						collection: callbackCollection,
 						path: targetPath,
 						id: row.id,
 						row: targetRow,
@@ -6758,22 +7091,23 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		else await this.dataService.delete(targetPath, row.id, resolvedCollection?.databaseId);
 		try {
 			if (globalCallbacks?.afterDelete || callbacks?.afterDelete || propertyCallbacks?.afterDelete) {
+				const callbackCollection = requireCallbackCollection(resolvedCollection, targetPath);
 				if (globalCallbacks?.afterDelete) await globalCallbacks.afterDelete({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					path: targetPath,
 					id: row.id,
 					row: targetRow,
 					context: contextForCallback
 				});
 				if (callbacks?.afterDelete) await callbacks.afterDelete({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					path: targetPath,
 					id: row.id,
 					row: targetRow,
 					context: contextForCallback
 				});
 				if (propertyCallbacks?.afterDelete) await propertyCallbacks.afterDelete({
-					collection: resolvedCollection,
+					collection: callbackCollection,
 					path: targetPath,
 					id: row.id,
 					row: targetRow,
@@ -6802,6 +7136,9 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		await this.dataService.deleteAll(path);
 		await this.realtimeService.notifyUpdate(path, "*", null);
 	}
+	async updateRelationPivot({ path, targetId, pivot }) {
+		await this.dataService.updateRelationPivot(path, targetId, pivot);
+	}
 	async checkUniqueField(path, name, value, id, collection) {
 		return this.dataService.checkUniqueField(path, name, value, id, collection?.databaseId);
 	}
@@ -6984,7 +7321,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			col.enum_values = [];
 		}
 		return {
-			columns,
+			columns: sqlRows(columns),
 			foreignKeys: (await this.db.execute(sql`
             SELECT
                 kcu.column_name as column_name,
@@ -7078,7 +7415,8 @@ var AuthenticatedPostgresBackendDriver = class {
 	}
 	async withTransaction(operation, options) {
 		const pendingNotifications = [];
-		const result = await withFieldViewer({ roles: this.user?.roles ?? [] }, async () => await this.delegate.db.transaction(async (tx) => {
+		const writeScope = options?.accessMode === "read only" ? void 0 : new WriteTransactionScope();
+		const result = await withFieldViewer({ roles: this.user?.roles ?? [] }, async () => await runInWriteScope(writeScope, () => this.delegate.db.transaction(async (tx) => {
 			let uid = this.user?.uid;
 			if (!uid) {
 				logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
@@ -7098,8 +7436,18 @@ var AuthenticatedPostgresBackendDriver = class {
 			txDelegate._deferNotifications = true;
 			txDelegate._pendingNotifications = pendingNotifications;
 			txDelegate.client = this.delegate.client;
-			return await operation(txDelegate);
-		}, options));
+			writeScope?.bind(tx, (sqlText, params) => txEntityService.executeSql(sqlText, params));
+			let out;
+			try {
+				out = await operation(txDelegate);
+			} catch (error) {
+				writeScope?.close();
+				throw error;
+			}
+			await writeScope?.settle();
+			return out;
+		}, options)).finally(() => writeScope?.close()));
+		writeScope?.committed();
 		for (const notification of pendingNotifications) try {
 			await this.delegate.realtimeService.notifyUpdate(notification.path, notification.id, notification.row, notification.databaseId);
 		} catch (e) {
@@ -7182,6 +7530,9 @@ var AuthenticatedPostgresBackendDriver = class {
 	async deleteAll(path) {
 		return this.withTransaction((delegate) => delegate.deleteAll(path));
 	}
+	async updateRelationPivot(props) {
+		return this.withTransaction((delegate) => delegate.updateRelationPivot(props));
+	}
 	async checkUniqueField(path, name, value, id, collection) {
 		return this.withTransaction((delegate) => delegate.checkUniqueField(path, name, value, id, collection), { accessMode: "read only" });
 	}
@@ -7810,7 +8161,7 @@ var CdcListener = class {
 */
 function drizzleDdlBootstrapper(db, scope) {
 	return createDdlBootstrapper(async (statement) => {
-		return (await db.execute(sql.raw(statement))).rows ?? [];
+		return sqlRows(await db.execute(sql.raw(statement)));
 	}, scope);
 }
 //#endregion
@@ -8412,7 +8763,7 @@ var PostgresChannelBus = class {
 				this.openWindow();
 			}
 		}, this.batchWindowMs);
-		this.windowTimer.unref?.();
+		unref(this.windowTimer);
 	}
 	/** Send everything queued and settle the promises waiting on it. */
 	flush() {
@@ -8563,6 +8914,38 @@ function createChannelBus(setting, deps) {
 //#region src/services/realtimeService.ts
 /** Channel name used for Postgres LISTEN/NOTIFY cross-instance realtime. */
 var PG_NOTIFY_CHANNEL = "rebase_entity_changes";
+function mintsCallContexts(driver) {
+	return driver !== void 0 && "callContextWithin" in driver && typeof driver.callContextWithin === "function";
+}
+/**
+* The context a subscription frame's `afterRead` hooks run with.
+*
+* It used to be assembled here by hand — `{ user, driver, data }` cast to
+* `RebaseCallContext` — and the cast hid two faults. `data` was the realtime
+* service's own driver, the base one on the owner connection, outside the
+* transaction this frame's rows were read in: a hook enriching rows through
+* `context.data` bypassed RLS on every frame, while the REST read of the same
+* rows, whose hooks run on the caller's transaction, did not. And `client` and
+* `storageSource`, which the type declares required, were missing, so a hook
+* that signs a URL or invokes a function worked over REST and failed every
+* `.listen()`. The driver now builds it, bound to `tx`, the way the REST path
+* builds it.
+*
+* Refuses rather than falling back: the fallback IS the unscoped context.
+*/
+function callbackContextWithin(driver, tx, auth) {
+	if (!mintsCallContexts(driver)) throw new Error("This driver cannot run afterRead hooks inside the subscriber's transaction.");
+	return driver.callContextWithin(tx, {
+		uid: auth.uid,
+		roles: auth.roles,
+		isAnonymous: auth.isAnonymous === true,
+		displayName: null,
+		email: null,
+		photoURL: null,
+		providerId: "realtime",
+		...auth.claims ? { claims: auth.claims } : {}
+	});
+}
 /**
 * PostgreSQL-specific realtime service.
 * Handles WebSocket connections and subscriptions for real-time row updates.
@@ -9162,30 +9545,24 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				const globalCallbacks = this.registry?.getGlobalCallbacks();
 				const propertyCallbacks = resolvedCollection?.properties ? buildPropertyCallbacks(resolvedCollection.properties) : void 0;
 				if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
-					const contextForCallback = {
-						user: {
-							uid: activeAuth.uid,
-							roles: activeAuth.roles
-						},
-						driver: this.driver,
-						data: this.driver && "data" in this.driver ? this.driver.data : void 0
-					};
+					const contextForCallback = callbackContextWithin(this.driver, tx, activeAuth);
+					const callbackCollection = requireCallbackCollection(resolvedCollection, notifyPath);
 					return await Promise.all(fetchedEntities.map(async (fetchedRow) => {
 						let processedEntity = fetchedRow;
 						if (globalCallbacks?.afterRead) processedEntity = await globalCallbacks.afterRead({
-							collection: resolvedCollection,
+							collection: callbackCollection,
 							path: notifyPath,
 							row: processedEntity,
 							context: contextForCallback
 						}) ?? processedEntity;
 						if (callbacks?.afterRead) processedEntity = await callbacks.afterRead({
-							collection: resolvedCollection,
+							collection: callbackCollection,
 							path: notifyPath,
 							row: processedEntity,
 							context: contextForCallback
 						}) ?? processedEntity;
 						if (propertyCallbacks?.afterRead) processedEntity = await propertyCallbacks.afterRead({
-							collection: resolvedCollection,
+							collection: callbackCollection,
 							path: notifyPath,
 							row: processedEntity,
 							context: contextForCallback
@@ -9334,28 +9711,22 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					const globalCallbacks = this.registry?.getGlobalCallbacks();
 					const propertyCallbacks = resolvedCollection?.properties ? buildPropertyCallbacks(resolvedCollection.properties) : void 0;
 					if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
-						const contextForCallback = {
-							user: {
-								uid: activeAuth.uid,
-								roles: activeAuth.roles
-							},
-							driver: this.driver,
-							data: this.driver && "data" in this.driver ? this.driver.data : void 0
-						};
+						const contextForCallback = callbackContextWithin(this.driver, tx, activeAuth);
+						const callbackCollection = requireCallbackCollection(resolvedCollection, notifyPath);
 						if (globalCallbacks?.afterRead) processedEntity = await globalCallbacks.afterRead({
-							collection: resolvedCollection,
+							collection: callbackCollection,
 							path: notifyPath,
 							row: processedEntity,
 							context: contextForCallback
 						}) ?? processedEntity;
 						if (callbacks?.afterRead) processedEntity = await callbacks.afterRead({
-							collection: resolvedCollection,
+							collection: callbackCollection,
 							path: notifyPath,
 							row: processedEntity,
 							context: contextForCallback
 						}) ?? processedEntity;
 						if (propertyCallbacks?.afterRead) processedEntity = await propertyCallbacks.afterRead({
-							collection: resolvedCollection,
+							collection: callbackCollection,
 							path: notifyPath,
 							row: processedEntity,
 							context: contextForCallback
@@ -9990,7 +10361,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	ensurePresenceSweep() {
 		if (this.presenceSweepInterval || !this.presenceStore) return;
 		this.presenceSweepInterval = setInterval(() => void this.sweepStalePresence(), RealtimeService.PRESENCE_SWEEP_INTERVAL_MS);
-		this.presenceSweepInterval.unref?.();
+		unref(this.presenceSweepInterval);
 	}
 	/** One pass of the stale-roster sweep. See {@link ensurePresenceSweep}. */
 	async sweepStalePresence() {
@@ -11137,7 +11508,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-DA7a6SUV.js").then((n) => n.r);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-BNLwvxuy.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -11190,6 +11561,28 @@ function formatBytes(bytes) {
 	return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
 }
 //#endregion
+//#region src/types.ts
+/**
+* Read a statically-declared drizzle table as one whose columns are looked up
+* by name.
+*
+* The auth services take either the tables this package declares or a host
+* application's own, and reach their columns through strings — `has("aal")`,
+* `col("sessionId")` — because which columns exist is a property of the
+* database in front of them, not of the schema this package compiled against.
+* That is what {@link RebasePgTable} is for.
+*
+* A concrete table does not satisfy it: its columns have specific types and it
+* carries methods and symbols besides, so `Record<string, AnyPgColumn>` is not
+* a supertype and a direct `as` is refused. Written out, that refusal was
+* answered six times with `as unknown as RebasePgTable`, which also discarded
+* the check that the thing being converted is a table at all — the parameter
+* below is what restores it.
+*/
+function asRebasePgTable(table) {
+	return table;
+}
+//#endregion
 //#region src/collections/validate-relations.ts
 /**
 * Every name a column answers to: the key in the drizzle schema and the real
@@ -11521,8 +11914,8 @@ var UserService = class {
 			this.userIdentitiesTable = tables.userIdentities || userIdentities;
 		} else {
 			const table = tableOrTables;
-			this.usersTable = table || users;
-			this.userIdentitiesTable = userIdentities;
+			this.usersTable = table || asRebasePgTable(users);
+			this.userIdentitiesTable = asRebasePgTable(userIdentities);
 		}
 	}
 	getQualifiedUsersTableName() {
@@ -11886,7 +12279,7 @@ var UserService = class {
 		};
 	}
 };
-var RefreshTokenService = class {
+var RefreshTokenService = class RefreshTokenService {
 	db;
 	refreshTokensTable;
 	usersTable;
@@ -11896,8 +12289,8 @@ var RefreshTokenService = class {
 			this.refreshTokensTable = tableOrTables.refreshTokens || refreshTokens;
 			this.usersTable = tableOrTables.users || users;
 		} else {
-			this.refreshTokensTable = tableOrTables || refreshTokens;
-			this.usersTable = users;
+			this.refreshTokensTable = tableOrTables || asRebasePgTable(refreshTokens);
+			this.usersTable = asRebasePgTable(users);
 		}
 	}
 	/**
@@ -11944,9 +12337,44 @@ var RefreshTokenService = class {
 		if (session?.aal && this.has("aal")) values.aal = session.aal;
 		await this.db.insert(this.refreshTokensTable).values(values);
 	}
+	/**
+	* Build a {@link RefreshTokenInfo} out of a row of {@link selection}.
+	*
+	* `selection()` is assembled at runtime from the columns this table actually
+	* has, so drizzle types the row as an open record and nothing static
+	* connects it to the interface. Both call sites used to assert the
+	* connection — `row as unknown as RefreshTokenInfo` — which claims every
+	* optional field is present and correctly typed on a row where, by
+	* construction, some of them were never selected.
+	*
+	* Constructing it says the true thing instead: the five required fields come
+	* from columns `selection()` always includes, and each optional one is
+	* copied only when the row carries it. A host application's own
+	* `refresh_tokens` table predating session grouping is the case this whole
+	* class is shaped around, and it is exactly the case the assertion
+	* misdescribed.
+	*/
+	static toInfo(row) {
+		const asDate = (value) => value instanceof Date ? value : new Date(String(value));
+		const info = {
+			id: row.id,
+			uid: row.uid,
+			tokenHash: row.tokenHash,
+			expiresAt: asDate(row.expiresAt),
+			createdAt: asDate(row.createdAt)
+		};
+		if (row.userAgent !== void 0) info.userAgent = row.userAgent;
+		if (row.ipAddress !== void 0) info.ipAddress = row.ipAddress;
+		if (row.sessionId !== void 0 && row.sessionId !== null) info.sessionId = String(row.sessionId);
+		if (row.rotatedAt !== void 0) info.rotatedAt = row.rotatedAt === null ? null : asDate(row.rotatedAt);
+		if (row.revoked !== void 0) info.revoked = Boolean(row.revoked);
+		if (row.sessionStartedAt !== void 0 && row.sessionStartedAt !== null) info.sessionStartedAt = asDate(row.sessionStartedAt);
+		if (row.aal === "aal1" || row.aal === "aal2") info.aal = row.aal;
+		return info;
+	}
 	async findByHash(tokenHash) {
 		const [token] = await this.db.select(this.selection()).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
-		return token || null;
+		return token ? RefreshTokenService.toInfo(token) : null;
 	}
 	/**
 	* Record that a token was rotated away, keeping the row.
@@ -12018,7 +12446,7 @@ var RefreshTokenService = class {
 		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid));
 	}
 	async listForUser(uid) {
-		return await this.db.select(this.selection()).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid)).orderBy(this.refreshTokensTable.createdAt);
+		return (await this.db.select(this.selection()).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid)).orderBy(this.refreshTokensTable.createdAt)).map(RefreshTokenService.toInfo);
 	}
 	async deleteById(id, uid) {
 		await this.db.delete(this.refreshTokensTable).where(sql`${this.refreshTokensTable.id} = ${id} AND ${this.refreshTokensTable.uid} = ${uid}`);
@@ -12033,7 +12461,7 @@ var PasswordResetTokenService = class {
 	constructor(db, tableOrTables) {
 		this.db = db;
 		if (tableOrTables && (tableOrTables.passwordResetTokens || tableOrTables.users)) this.passwordResetTokensTable = tableOrTables.passwordResetTokens || passwordResetTokens;
-		else this.passwordResetTokensTable = tableOrTables || passwordResetTokens;
+		else this.passwordResetTokensTable = tableOrTables || asRebasePgTable(passwordResetTokens);
 	}
 	getQualifiedPasswordResetTokensTableName() {
 		const name = getTableName(this.passwordResetTokensTable);
@@ -12110,7 +12538,7 @@ var MagicLinkTokenService = class {
 	magicLinkTokensTable;
 	constructor(db, tableOrTables) {
 		this.db = db;
-		this.magicLinkTokensTable = magicLinkTokens;
+		this.magicLinkTokensTable = asRebasePgTable(magicLinkTokens);
 	}
 	getQualifiedTableName() {
 		const name = getTableName(this.magicLinkTokensTable);
@@ -12667,6 +13095,81 @@ var MfaService = class {
 	}
 };
 //#endregion
+//#region src/history/ensure-history-table.ts
+/** How a history entry gets written from inside the write it records. */
+var RECORD_HISTORY_FUNCTION = "rebase.record_history";
+var RECORD_HISTORY_SIGNATURE = `${RECORD_HISTORY_FUNCTION}(text, text, text, text[], jsonb, jsonb, text)`;
+/**
+* Auto-create the row history table if it doesn't exist.
+* This runs on startup when history is enabled, following the same
+* pattern as `ensureAuthTablesExist`.
+*
+* Resolves `true` when {@link RECORD_HISTORY_FUNCTION} exists, so an entry can
+* be written on the write's own transaction; `false` sends entries through the
+* pool as before, committing on their own.
+*/
+async function ensureHistoryTableExists(db) {
+	logger.debug("🔍 Checking row history table...");
+	try {
+		await db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
+		await db.execute(sql`
+            CREATE TABLE IF NOT EXISTS rebase.entity_history (
+                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                table_name TEXT NOT NULL,
+                entity_id TEXT NOT NULL,
+                action TEXT NOT NULL,
+                changed_fields TEXT[],
+                "values" JSONB,
+                previous_values JSONB,
+                updated_by TEXT,
+                updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+            )
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_history_entity
+            ON rebase.entity_history(table_name, entity_id)
+        `);
+		await db.execute(sql`
+            CREATE INDEX IF NOT EXISTS idx_history_time
+            ON rebase.entity_history(table_name, entity_id, updated_at DESC)
+        `);
+		await db.execute(sql.raw(revokeInternalTableSql("rebase", "entity_history")));
+		logger.debug("✅ Entity history table ready");
+	} catch (error) {
+		logger.error("❌ Failed to create row history table", { error });
+		logger.warn("⚠️ Continuing without creating history table.");
+		return false;
+	}
+	try {
+		await db.execute(sql.raw(`
+            CREATE OR REPLACE FUNCTION ${RECORD_HISTORY_FUNCTION}(
+                p_table_name text, p_entity_id text, p_action text, p_changed_fields text[],
+                p_values jsonb, p_previous_values jsonb, p_updated_by text
+            ) RETURNS void
+            LANGUAGE sql
+            SECURITY DEFINER
+            SET search_path = pg_catalog, pg_temp
+            AS $fn$
+                INSERT INTO rebase.entity_history
+                    (table_name, entity_id, action, changed_fields, "values", previous_values, updated_by)
+                VALUES (p_table_name, p_entity_id, p_action, p_changed_fields, p_values, p_previous_values, p_updated_by)
+            $fn$
+        `));
+		await db.execute(sql.raw(`REVOKE ALL ON FUNCTION ${RECORD_HISTORY_SIGNATURE} FROM PUBLIC`));
+		await db.execute(sql.raw(`
+            DO $grant$ BEGIN
+                IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE$1}') THEN
+                    GRANT EXECUTE ON FUNCTION ${RECORD_HISTORY_SIGNATURE} TO ${REBASE_USER_ROLE$1};
+                END IF;
+            END $grant$
+        `));
+		return true;
+	} catch (error) {
+		logger.warn(`⚠️ ${RECORD_HISTORY_FUNCTION} could not be created, so a history entry commits on its own: it survives a write that rolls back.`, { error });
+		return false;
+	}
+}
+//#endregion
 //#region src/history/HistoryService.ts
 var DEFAULT_RETENTION = {
 	maxEntries: 200,
@@ -12679,12 +13182,19 @@ var DEFAULT_RETENTION = {
 var HistoryService = class {
 	db;
 	retention;
-	constructor(db, retention) {
+	/**
+	* Whether {@link RECORD_HISTORY_FUNCTION} exists, so an entry recorded
+	* inside a write goes on that write's transaction. Without it, entries go
+	* through the pool and commit on their own.
+	*/
+	inTransaction;
+	constructor(db, retention, options) {
 		this.db = db;
 		this.retention = {
 			...DEFAULT_RETENTION,
 			...retention
 		};
+		this.inTransaction = options?.inTransaction === true;
 	}
 	/**
 	* Record a history entry for a row change.
@@ -12702,7 +13212,13 @@ var HistoryService = class {
 	* anyway, and nobody found out.
 	*
 	* So it throws, and the driver awaits it inside the write's transaction.
-	* The row and its history entry commit together or neither does. That is a
+	* The row and its history entry commit together or neither does — which
+	* needs the entry written *on* that transaction, not merely while it is
+	* open. This service is built once, on the pool, and for a long time it
+	* wrote there: a batch that rolled back after its first row left that
+	* row's entry behind, describing a row that never existed. Inside a write
+	* it now goes through {@link RECORD_HISTORY_FUNCTION} on the write's own
+	* transaction (found through `currentWriteScope`). That is a
 	* real trade — a broken `rebase.entity_history` now fails writes to the
 	* collections that declare history, where before it failed quietly — and it
 	* is the right side of it for a table that exists to answer "who changed
@@ -12717,7 +13233,19 @@ var HistoryService = class {
 		const changedFields = previousValues && values ? findChangedFields(previousValues, values) : null;
 		if (action === "update" && (!changedFields || changedFields.length === 0)) return;
 		try {
-			await this.db.execute(sql`
+			const scope = this.inTransaction ? currentWriteScope() : void 0;
+			if (scope?.tx) await scope.track(scope.tx.execute(sql`
+                    SELECT ${sql.raw(RECORD_HISTORY_FUNCTION)}(
+                        ${tableName},
+                        ${String(id)},
+                        ${action},
+                        ${changedFields ? sql`ARRAY[${sql.join(changedFields.map((f) => sql`${f}`), sql`, `)}]::text[]` : sql`NULL::text[]`},
+                        ${values ? sql`${JSON.stringify(values)}::jsonb` : sql`NULL::jsonb`},
+                        ${previousValues ? sql`${JSON.stringify(previousValues)}::jsonb` : sql`NULL::jsonb`},
+                        ${updatedBy ?? null}::text
+                    )
+                `));
+			else await this.db.execute(sql`
                 INSERT INTO rebase.entity_history
                     (table_name, entity_id, action, changed_fields, "values", previous_values, updated_by)
                 VALUES (
@@ -12759,7 +13287,7 @@ var HistoryService = class {
             `)]);
 		const total = parseInt(countResult.rows[0]?.count ?? "0", 10);
 		return {
-			data: dataResult.rows,
+			data: sqlRows(dataResult),
 			total
 		};
 	}
@@ -12767,14 +13295,12 @@ var HistoryService = class {
 	* Fetch a single history entry by ID.
 	*/
 	async fetchHistoryEntry(historyId) {
-		const result = await this.db.execute(sql`
+		return firstSqlRow(await this.db.execute(sql`
             SELECT id, table_name, entity_id, action, changed_fields,
                    "values", previous_values, updated_by, updated_at
             FROM rebase.entity_history
             WHERE id = ${historyId}
-        `);
-		if (result.rows.length === 0) return null;
-		return result.rows[0];
+        `)) ?? null;
 	}
 	/**
 	* Prune history for a single row: enforce maxEntries and TTL.
@@ -12851,45 +13377,6 @@ function findChangedFields(oldValues, newValues) {
 	return changed.length > 0 ? changed : null;
 }
 //#endregion
-//#region src/history/ensure-history-table.ts
-/**
-* Auto-create the row history table if it doesn't exist.
-* This runs on startup when history is enabled, following the same
-* pattern as `ensureAuthTablesExist`.
-*/
-async function ensureHistoryTableExists(db) {
-	logger.debug("🔍 Checking row history table...");
-	try {
-		await db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);
-		await db.execute(sql`
-            CREATE TABLE IF NOT EXISTS rebase.entity_history (
-                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                table_name TEXT NOT NULL,
-                entity_id TEXT NOT NULL,
-                action TEXT NOT NULL,
-                changed_fields TEXT[],
-                "values" JSONB,
-                previous_values JSONB,
-                updated_by TEXT,
-                updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
-            )
-        `);
-		await db.execute(sql`
-            CREATE INDEX IF NOT EXISTS idx_history_entity
-            ON rebase.entity_history(table_name, entity_id)
-        `);
-		await db.execute(sql`
-            CREATE INDEX IF NOT EXISTS idx_history_time
-            ON rebase.entity_history(table_name, entity_id, updated_at DESC)
-        `);
-		await db.execute(sql.raw(revokeInternalTableSql("rebase", "entity_history")));
-		logger.debug("✅ Entity history table ready");
-	} catch (error) {
-		logger.error("❌ Failed to create row history table", { error });
-		logger.warn("⚠️ Continuing without creating history table.");
-	}
-}
-//#endregion
 //#region src/utils/pg-array-null-patch.ts
 /**
 * Patches all PgArray columns on the given tables to handle NULL values safely.
@@ -13274,8 +13761,10 @@ function scalarBuilder(udtName, name, col) {
 		default: return text(name);
 	}
 }
+/** See {@link FluentColumnBuilder}. */
+var fluent = (builder) => builder;
 function columnBuilderFor(col) {
-	if (col.udt_name.startsWith("_")) return scalarBuilder(col.udt_name.slice(1), col.column_name, col).array();
+	if (col.udt_name.startsWith("_")) return fluent(scalarBuilder(col.udt_name.slice(1), col.column_name, col)).array();
 	return scalarBuilder(col.udt_name, col.column_name, col);
 }
 /**
@@ -13292,9 +13781,9 @@ function buildDrizzleTablesFromSchema(tablesMap, pgSchemaName = "public", column
 		const keyOf = /* @__PURE__ */ new Map();
 		for (const col of meta.columns) {
 			let builder = columnBuilderFor(col);
-			if (col.is_nullable === "NO") builder = builder.notNull();
-			if (meta.pks.length === 1 && meta.pks[0] === col.column_name) builder = builder.primaryKey();
-			if (col.is_generated === "ALWAYS") builder = builder.generatedAlwaysAs(sql.raw(col.generation_expression ?? ""));
+			if (col.is_nullable === "NO") builder = fluent(builder).notNull();
+			if (meta.pks.length === 1 && meta.pks[0] === col.column_name) builder = fluent(builder).primaryKey();
+			if (col.is_generated === "ALWAYS") builder = fluent(builder).generatedAlwaysAs(sql.raw(col.generation_expression ?? ""));
 			const key = columnKey(tableName, col.column_name);
 			keyOf.set(col.column_name, key);
 			columns[key] = builder;
@@ -13353,8 +13842,8 @@ function buildDrizzleRelationsFromSchema(tablesMap, tables, columnKey = columnNa
 		built[`${tableName}Relations`] = relations(table, ({ one, many }) => {
 			const map = {};
 			for (const rel of ones) map[rel.key] = one(tables[rel.targetTable], {
-				fields: [table[rel.fkColumn]],
-				references: [tables[rel.targetTable][rel.targetColumn]],
+				fields: [getTableColumns(table)[rel.fkColumn]],
+				references: [getTableColumns(tables[rel.targetTable])[rel.targetColumn]],
 				relationName: rel.relationName
 			});
 			for (const rel of manys) {
@@ -13415,7 +13904,7 @@ function primaryKeyFieldKey(collection) {
 */
 function columnOf(table, key) {
 	if (!table) return void 0;
-	const direct = table[key];
+	const direct = getTableColumns(table)[key];
 	if (direct) return direct;
 	for (const column of Object.values(getTableColumns(table))) if (column?.name === key) return column;
 }
@@ -14160,8 +14649,7 @@ function createPostgresBootstrapper(pgConfig) {
 		const db = (driverResult?.internals)?.db ?? pgConfig.connection;
 		if (!db) throw new Error("Cannot provision the collection schema: this Postgres adapter was created without a `connection`, and no initialized driver was supplied to fall back on. Pass `connection` to `createPostgresAdapter` (see `createPostgresDatabaseConnection`).");
 		return { async query(text) {
-			const result = await db.execute(sql.raw(text));
-			return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
+			return { rows: sqlRows(await db.execute(sql.raw(text))) };
 		} };
 	};
 	/**
@@ -14173,7 +14661,7 @@ function createPostgresBootstrapper(pgConfig) {
 	* handful of `CREATE OR REPLACE FUNCTION`.
 	*/
 	const provisionRlsRuntime = async (queryable) => {
-		const { RLS_BOOTSTRAP_STATEMENTS } = await import("./rls-bootstrap-sql-BlzsOUtz.js").then((n) => n.i);
+		const { RLS_BOOTSTRAP_STATEMENTS } = await import("./rls-bootstrap-sql-BHA6jLtj.js").then((n) => n.i);
 		await queryable.query("SELECT pg_advisory_lock(hashtext('rebase_auth_functions_init'))");
 		try {
 			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await queryable.query(statement);
@@ -14501,7 +14989,14 @@ function createPostgresBootstrapper(pgConfig) {
 			const usersTable = tableName ? registry.getTable(tableName) : void 0;
 			let usersSchemaName = "rebase";
 			if (authCollection && "schema" in authCollection && typeof authCollection.schema === "string") usersSchemaName = authCollection.schema;
-			const authTables = createAuthSchema(usersSchemaName);
+			const schema = createAuthSchema(usersSchemaName);
+			const authTables = {
+				users: asRebasePgTable(schema.users),
+				refreshTokens: asRebasePgTable(schema.refreshTokens),
+				passwordResetTokens: asRebasePgTable(schema.passwordResetTokens),
+				appConfig: asRebasePgTable(schema.appConfig),
+				userIdentities: asRebasePgTable(schema.userIdentities)
+			};
 			if (usersTable) authTables.users = usersTable;
 			const userService = new UserService(db, authTables);
 			const authRepository = new PostgresAuthRepository(db, authTables);
@@ -14516,9 +15011,9 @@ function createPostgresBootstrapper(pgConfig) {
 		async initializeHistory(config, driverResult) {
 			if (!config) return void 0;
 			const db = driverResult.internals.db;
-			await ensureHistoryTableExists(db);
+			const inTransaction = await ensureHistoryTableExists(db);
 			const retention = typeof config === "object" ? config.retention : void 0;
-			return { historyService: new HistoryService(db, retention ? { ttlDays: retention } : void 0) };
+			return { historyService: new HistoryService(db, retention ? { ttlDays: retention } : void 0, { inTransaction }) };
 		},
 		async initializeRealtime(_config, driverResult) {
 			return driverResult.internals.realtimeService;
@@ -14594,7 +15089,7 @@ function createPostgresBootstrapper(pgConfig) {
 			await provisionRlsRuntime(provisioningQueryable(driverResult));
 		},
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-CHO0moXQ.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-CQGHln-y.js");
 			const queryable = provisioningQueryable(driverResult);
 			const { rows } = await queryable.query("SELECT to_regprocedure('rebase.roles()') IS NOT NULL AS present");
 			if (!rows[0]?.present) await provisionRlsRuntime(queryable);
@@ -14605,7 +15100,7 @@ function createPostgresBootstrapper(pgConfig) {
 			for (const u of outcome.unsecured.filter((u) => u.grantWithdrawn)) logger.error(`🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. Its privileges have been revoked from ${REBASE_USER_ROLE}, so the table is unreachable rather than unprotected. Reads and writes to that collection will fail until RLS can be enabled.`);
 			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
-				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-BlzsOUtz.js").then((n) => n.i);
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-BHA6jLtj.js").then((n) => n.i);
 				await dropLegacyAuthSchema(async (text) => (await queryable.query(text)).rows, {
 					info: (m) => logger.info(m),
 					warn: (m) => logger.warn(m)