@rebasepro/server-postgres 0.21.2-canary.g1ea48be → 0.23.0

package/dist/index.es.js

@@ -2,27 +2,28 @@ import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
 import { a as createDirectDatabaseConnection, c as guardPoolAgainstDirtyRelease, l as pinSearchPath, o as createPostgresDatabaseConnection, r as cappedPoolMax, s as createReadReplicaConnection, t as DatabasePoolManager, u as poolMaxCeiling } from "./databasePoolManager-Bj5FbeAs.js";
-import { f as hiddenColumnsOption, l as SEARCH_UNACCENT_FN, m as searchColumnNames, o as sharedRelationName, u as buildSearchColumnSpec, x as visibleColumnProjection } from "./plan-schema-Hgl62S-w.js";
-import { d as extractPgError, f as isRoleSwitchingPermissionError, g as sanitizeErrorForClient, h as reachedDatabase, i as diagnoseDbError, l as classifyConnectFailure, m as pgErrorToFriendlyMessage, n as deepestErrorMessage, o as isEconnrefused, p as isRowLevelSecurityDenial, s as parseHostInfo, u as extractCauseMessage } from "./cli-errors-Dka89exj.js";
-import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-CucnFcSE.js";
+import { f as hiddenColumnsOption, l as SEARCH_UNACCENT_FN, m as searchColumnNames, o as sharedRelationName, u as buildSearchColumnSpec, x as visibleColumnProjection } from "./plan-schema-C0fxM8dY.js";
+import { d as extractPgError, f as isRoleSwitchingPermissionError, g as sanitizeErrorForClient, h as reachedDatabase, i as diagnoseDbError, l as classifyConnectFailure, m as pgErrorToFriendlyMessage, n as deepestErrorMessage, o as isEconnrefused, p as isRowLevelSecurityDenial, s as parseHostInfo, u as extractCauseMessage } from "./cli-errors-B8qHg02P.js";
+import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-DGPL6G_C.js";
 import { c as warnOnLegacyRlsFunctions, i as ensureAppRole, l as warnOnRoleSchemaCollision, n as applyAuthContext, o as validatePolicyPgRoles, r as detectConnectionPosture, s as warnOnAnonymousGrants, t as REBASE_USER_ROLE } from "./rls-enforcement-C6Xk0lA6.js";
-import { l as resolveColumnName } from "./column-plan-helpers-CpILzHJS.js";
+import { u as resolveColumnName } from "./column-plan-helpers-DF-8dTVa.js";
 import { i as isAuthCollection, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
-import { a as generatePostgresVectorDdl, i as generatePostgresTriggersDdl, n as generatePostgresPoliciesDdl, r as generatePostgresSearchDdl, t as generatePostgresDdl } from "./generate-postgres-ddl-logic-CR2xcS7e.js";
-import { t as generateSchema } from "./generate-drizzle-schema-logic-DFa9qy9u.js";
-import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-Cr2ye5JC.js";
-import { t as main } from "./generate-drizzle-schema-D2MDdJt-.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-BNLwvxuy.js";
-import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-BnEvEJPr.js";
-import { c as identifyJoinTables, d as singularize, h as humanize, i as buildTablesMap, m as mapPgType, r as buildEnumMap, s as getIconForTable } from "./introspect-db-logic-C6LQdTxj.js";
-import { Client } from "pg";
-import { ApiError, assertFieldOpsValid, assertWriteRequestValid, createDdlBootstrapper, createEmailService, declaredErrorAnswer, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveBatchRefs, resolveRequireAuth, safeCompare, splitFieldOps } from "@rebasepro/server";
-import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isNotNull, isNull, isTable, lt, not, notInArray, or, relations, sql } from "drizzle-orm";
+import { a as generatePostgresVectorDdl, i as generatePostgresTriggersDdl, n as generatePostgresPoliciesDdl, r as generatePostgresSearchDdl, t as generatePostgresDdl } from "./generate-postgres-ddl-logic-Bt2d2mRH.js";
+import { t as generateSchema } from "./generate-drizzle-schema-logic-BfzK7UQd.js";
+import { c as identifyJoinTables, d as singularize, h as humanize, i as buildTablesMap, m as mapPgType, r as buildEnumMap, s as getIconForTable } from "./introspect-db-logic-WMuAfxvw.js";
+import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-BEEjn5cn.js";
+import { t as main } from "./generate-drizzle-schema-yzY_BLhr.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-HQ9GC4tN.js";
+import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-Dhn9KM3B.js";
+import { Client, Pool } from "pg";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { ApiError, RUNTIME_DEFAULT_MAX_BODY_SIZE, assertFieldOpsValid, assertNestedWriteAllowed, assertNoFieldOpsOnCreate, assertQueryFieldsReadable, assertUserCreationBodyValid, assertWriteRequestValid, createDdlBootstrapper, createEmailService, createUserThroughAuthCollection, declaredErrorAnswer, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveBatchRefs, resolveConflictTarget, resolveRequireAuth, safeCompare, splitFieldOps } from "@rebasepro/server";
+import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, is, isNotNull, isNull, isTable, lt, not, notInArray, or, relations, sql } from "drizzle-orm";
+import { PgArray, PgNumeric, PgTable, PgTimestamp, PgTimestampString, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, JUNCTION_PIVOT_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, declaredDatabaseExtensions, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, parseEnvBoolean, parseRelationAggregateSort, resolveClientListLimit } from "@rebasepro/types";
-import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, REBASE_USER_ROLE as REBASE_USER_ROLE$1, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createRelationRef, createRelationRefWithData, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, firstSqlRow, getColumnName, getDeclaredPrimaryKeys, getJunctionCollectionConfig, getJunctionConfigForRelation, getTableName as getTableName$1, getTenantConfig, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseOrderBySpecStrict, requireCallbackClient, requireCallbackCollection, resolveCollectionRelations, resolveJunctionSpecs, resolveTenantWrite, revokeInternalTableSql, sqlRows, tenantBypassRoles, toCallbackError, toFilterTuples, updateDateAutoValues, updateUserAutoValues } from "@rebasepro/common";
-import { camelCase, firstFreeKey, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, mergeDeep, toSnakeCase, toWireKey, unref } from "@rebasepro/utils";
+import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, REBASE_USER_ROLE as REBASE_USER_ROLE$1, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createRelationRef, createRelationRefWithData, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, firstSqlRow, getColumnName, getDeclaredPrimaryKeys, getJunctionCollectionConfig, getJunctionConfigForRelation, getTableName as getTableName$1, getTenantConfig, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseIdValues as parseIdValues$1, parseOrderBySpecStrict, requireCallbackClient, requireCallbackCollection, resolveCollectionRelations, resolveJunctionSpecs, resolveTenantWrite, restoresSoftDeletedRow, revokeInternalTableSql, softDeleteFieldOf, sqlRows, tenantBypassRoles, toCallbackError, toFilterTuples, updateDateAutoValues, updateUserAutoValues } from "@rebasepro/common";
+import { camelCase, firstFreeKey, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, splitSearchTerms, toSnakeCase, toWireKey, unref } from "@rebasepro/utils";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { PgArray, PgNumeric, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs from "fs";
 import { WebSocket, WebSocketServer } from "ws";
 import { EventEmitter } from "events";
@@ -119,6 +120,24 @@ function idCanAddressTable(id, table, idInfoArray) {
 	}));
 }
 /**
+* The condition that names one row: every key column equal to its part of the
+* address.
+*
+* Every key column, not the first. A composite-key read that matched only the
+* leading column answered `p1:::bob` with whichever `p1` row Postgres reached
+* first, and a delete then judged that row's `beforeDelete` while deleting bob —
+* the writes have always matched the whole key, so the reads must too.
+*/
+function rowIdentityCondition(table, idInfoArray, id, collectionPath) {
+	const parsed = parseIdValues(id, idInfoArray);
+	const conditions = idInfoArray.map((info) => {
+		const column = table[info.fieldName];
+		if (!column) throw new Error(`ID field '${info.fieldName}' not found in table for collection '${collectionPath}'`);
+		return eq(column, parsed[info.fieldName]);
+	});
+	return conditions.length === 1 ? conditions[0] : and(...conditions);
+}
+/**
 * The columns of a table's composite primary-key constraint, or `[]`.
 *
 * Fails open for anything that is not a real Drizzle table — a test double, a
@@ -408,6 +427,15 @@ function deriveRowAddress(row, collection, registry) {
 */
 var PG_TRGM_WORD_SIMILARITY_DEFAULT = .6;
 /**
+* What a substring-only hit contributes to `_score` under
+* {@link SearchMode} `"hybrid"`.
+*
+* Below the smallest `ts_rank` a real lexeme match can produce (a single
+* D-weighted hit is 0.1 × 0.0607927 ≈ 0.006), so a row found by the indexed
+* half always outranks one found only by substring.
+*/
+var HYBRID_SUBSTRING_SCORE = .001;
+/**
 * A user's search term, made safe to drop inside a `%…%` LIKE pattern.
 *
 * The term is already a bind parameter, so this is not about injection. It is
@@ -1693,13 +1721,20 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 	* - **Declared** — one `@@ websearch_to_tsquery` against the generated
 	*   `tsvector` column. Stems, drops stopwords, AND-es the terms, reaches
 	*   inside JSONB and arrays, and uses the GIN index.
-	* - **Not declared** — the original `ILIKE '%term%'` OR-ed across top-level
-	*   string properties, with the term escaped (see {@link escapeLikePattern})
-	*   so it is matched as the literal text the user typed.
+	* - **Not declared** — `ILIKE '%term%'` per term, OR-ed across top-level
+	*   string properties and AND-ed across the terms, with each term escaped
+	*   (see {@link escapeLikePattern}) so it is matched as the literal text
+	*   the user typed.
+	*
+	* The second is the default and stays the default, and it AND-es terms for
+	* the same reason `websearch_to_tsquery` does: a person typing two words
+	* into a search box means both, and a name lives in two columns. Matching
+	* the whole string per column instead — which is what this did — cannot
+	* find `sebastian melendez` on a row with `first_name`/`last_name`, and
+	* could not find `sebastian ` at all.
 	*
-	* The second is the default and stays the default. A collection that has
-	* not opted in compiles to exactly the SQL it compiled to before this
-	* branch existed, which is the only reason it is safe to have added it.
+	* Returns at most one condition. Every caller ORs what it gets back, which
+	* is right across columns and wrong across terms, so the AND is built here.
 	*
 	* `collection` is optional so that the callers which genuinely have no
 	* collection in hand — nested paths, derived views — keep working; without
@@ -1711,16 +1746,24 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		if (ftsCondition) return [ftsCondition];
 		let declaredStringProperties = 0;
 		const viewer = currentFieldViewer();
+		const searchableColumns = [];
 		for (const [key, prop] of Object.entries(properties)) {
 			const p = prop;
 			if (!canReadField(prop, viewer)) continue;
 			if (p.type === "string" && !p.enum && p.isId !== "uuid") {
 				declaredStringProperties++;
 				const fieldColumn = table[key];
-				if (fieldColumn && supportsILike(fieldColumn)) searchConditions.push(ilike(fieldColumn, `%${escapeLikePattern(searchString)}%`));
+				if (fieldColumn && supportsILike(fieldColumn)) searchableColumns.push(fieldColumn);
 			}
 		}
-		if (declaredStringProperties > 0 && searchConditions.length === 0) logger.warn(`[search] "${collection?.slug ?? "collection"}" declares ${declaredStringProperties} string property(ies) but none compiled to a searchable column, so this search can only return nothing. Check that the generated schema's column types are text/varchar/char.`);
+		if (declaredStringProperties > 0 && searchableColumns.length === 0) logger.warn(`[search] "${collection?.slug ?? "collection"}" declares ${declaredStringProperties} string property(ies) but none compiled to a searchable column, so this search can only return nothing. Check that the generated schema's column types are text/varchar/char.`);
+		if (searchableColumns.length === 0) return [];
+		const terms = splitSearchTerms(searchString);
+		const perTerm = (terms.length > 0 ? terms : [searchString]).map((term) => {
+			const pattern = `%${escapeLikePattern(term)}%`;
+			return DrizzleConditionBuilder.combineConditionsWithOr(searchableColumns.map((column) => ilike(column, pattern)));
+		});
+		searchConditions.push(DrizzleConditionBuilder.combineConditionsWithAnd(perTerm));
 		return searchConditions;
 	}
 	/**
@@ -1748,12 +1791,66 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		const column = table[spec.column];
 		if (!column) return;
 		const exact = sql`${column} @@ ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)}`;
-		if (!spec.fuzzy) return exact;
+		const substring = spec.mode === "hybrid" ? DrizzleConditionBuilder.buildFoldedSubstringCondition(searchString, spec) : void 0;
+		const matched = substring ? sql`(${exact} OR ${substring})` : exact;
+		if (!spec.fuzzy) return matched;
 		const fuzzyColumn = table[spec.fuzzy.column];
-		if (!fuzzyColumn) return exact;
+		if (!fuzzyColumn) return matched;
 		const needle = spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`;
 		const similar = sql`public.word_similarity(${needle}, ${fuzzyColumn}) >= ${spec.fuzzy.threshold}`;
-		return sql`(${exact} OR ${spec.fuzzy.threshold > PG_TRGM_WORD_SIMILARITY_DEFAULT ? sql`(${needle} OPERATOR(public.<%) ${fuzzyColumn} AND ${similar})` : similar})`;
+		return sql`(${matched} OR ${spec.fuzzy.threshold > PG_TRGM_WORD_SIMILARITY_DEFAULT ? sql`(${needle} OPERATOR(public.<%) ${fuzzyColumn} AND ${similar})` : similar})`;
+	}
+	/**
+	* The substring half of {@link SearchMode} `"hybrid"`: every term found
+	* somewhere in the declared fields, with accents folded on both sides.
+	*
+	* Terms are AND-ed and fields OR-ed, exactly as the ILIKE default does and
+	* for the same reason — a person typing two words means both, and a name
+	* lives in two columns (`splitSearchTerms`). What it does *not* share with
+	* the default is its reach: these are the declared `search.fields`, so it
+	* folds accents, joins `text[]` and walks into JSONB through the same
+	* IMMUTABLE helpers the generated column uses.
+	*
+	* The needle is folded with the same function as the document, so
+	* `munoz` and `Muñoz` meet in the middle rather than one side being
+	* normalized and the other not — the subtle way to build a search that
+	* matches nothing.
+	*
+	* Interpolated as raw SQL because the field expressions are generated (they
+	* name columns and helper functions, which are identifiers, not values);
+	* the *term* is a bind parameter, escaped for LIKE first — see
+	* {@link escapeLikePattern} for what that escape is for.
+	*/
+	static buildFoldedSubstringCondition(searchString, spec) {
+		if (spec.fields.length === 0) return void 0;
+		const perTerm = DrizzleConditionBuilder.foldedNeedles(searchString).map((needle) => DrizzleConditionBuilder.combineConditionsWithOr(spec.fields.map((f) => sql`${sql.raw(f.foldedTextSql)} ILIKE ${needle}`)));
+		return DrizzleConditionBuilder.combineConditionsWithAnd(perTerm);
+	}
+	/**
+	* Whether one text expression holds **any** term of the search string.
+	*
+	* The per-field question, where {@link buildFoldedSubstringCondition} asks
+	* the per-row one: `OR` across terms rather than `AND`, because a two-word
+	* query satisfied across two fields has each field carrying one term. Used
+	* by `_matches` to name the fields that caused a substring hit.
+	*/
+	static foldedSubstringOf(searchString, text) {
+		return DrizzleConditionBuilder.combineConditionsWithOr(DrizzleConditionBuilder.foldedNeedles(searchString).map((needle) => sql`${text} ILIKE ${needle}`));
+	}
+	/**
+	* One accent-folded `%term%` bind parameter per search term.
+	*
+	* The needle is folded with the same function as the document, so `munoz`
+	* and `Muñoz` meet in the middle instead of one side being normalized and
+	* the other not — the subtle way to build a search that matches nothing.
+	*
+	* A string with no terms at all is only whitespace, and stays the single
+	* literal pattern it is on the ILIKE path rather than becoming "no rows",
+	* so both paths answer a stray space the same way.
+	*/
+	static foldedNeedles(searchString) {
+		const terms = splitSearchTerms(searchString);
+		return (terms.length > 0 ? terms : [searchString]).map((term) => sql`${sql.raw(SEARCH_UNACCENT_FN)}(${`%${escapeLikePattern(term)}%`})`);
 	}
 	/**
 	* `websearch_to_tsquery(<config>, <normalized search string>)`.
@@ -1800,17 +1897,18 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		if (!table[spec.column]) return void 0;
 		const query = DrizzleConditionBuilder.normalizedTsQuery(searchString, spec);
 		const config = sql`${spec.language}`;
-		const rows = spec.fields.map((f, i) => sql`(${i}, ${f.path}, ${sql.raw(f.textSql)})`);
+		const rows = spec.fields.map((f, i) => sql`(${i}, ${f.path}, ${sql.raw(f.textSql)}, ${sql.raw(f.foldedTextSql)})`);
+		const matchedField = spec.mode === "hybrid" ? sql`(to_tsvector(${config}::regconfig, f.txt) @@ ${query} OR ${DrizzleConditionBuilder.foldedSubstringOf(searchString, sql`f.folded`)})` : sql`to_tsvector(${config}::regconfig, f.txt) @@ ${query}`;
 		return sql`(
             SELECT coalesce(jsonb_agg(s.m ORDER BY f.ord), '[]'::jsonb)
-            FROM (VALUES ${sql.join(rows, sql`, `)}) AS f(ord, path, txt)
+            FROM (VALUES ${sql.join(rows, sql`, `)}) AS f(ord, path, txt, folded)
             CROSS JOIN LATERAL (
                 SELECT jsonb_build_object(
                     'field', f.path,
                     'snippet', ts_headline(${config}::regconfig, f.txt, ${query},
                         'StartSel=<mark>,StopSel=</mark>,MaxWords=14,MinWords=1,MaxFragments=1,FragmentDelimiter= … ')
                 ) AS m
-                WHERE to_tsvector(${config}::regconfig, f.txt) @@ ${query}
+                WHERE ${matchedField}
             ) s
         )`;
 	}
@@ -1828,18 +1926,27 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		if (!spec) return void 0;
 		const column = table[spec.column];
 		if (!column) return void 0;
-		const rank = sql`ts_rank(${column}, ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)})`;
+		const base = sql`ts_rank(${column}, ${DrizzleConditionBuilder.normalizedTsQuery(searchString, spec)})`;
+		const rank = spec.mode === "hybrid" ? (() => {
+			const substring = DrizzleConditionBuilder.buildFoldedSubstringCondition(searchString, spec);
+			return substring ? sql`(${base} + CASE WHEN ${substring} THEN ${sql.raw(`${HYBRID_SUBSTRING_SCORE}::real`)} ELSE 0 END)` : base;
+		})() : base;
 		if (!spec.fuzzy) return rank;
 		const fuzzyColumn = table[spec.fuzzy.column];
 		if (!fuzzyColumn) return rank;
 		return sql`(${rank} + public.word_similarity(${spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`}, ${fuzzyColumn}))`;
 	}
 	/**
-	* Build a unique field check condition
+	* Build a unique field check condition: rows holding `value`, other than
+	* the one `excludeRow` names.
+	*
+	* `excludeRow` is the whole identity of the row being saved — every key
+	* column — so excluding one member of a composite-key table does not
+	* exclude every row sharing its first key part.
 	*/
-	static buildUniqueFieldCondition(fieldColumn, value, idColumn, excludeId) {
+	static buildUniqueFieldCondition(fieldColumn, value, excludeRow) {
 		const conditions = [eq(fieldColumn, value)];
-		if (excludeId && idColumn) conditions.push(sql`${idColumn} != ${excludeId}`);
+		if (excludeRow) conditions.push(not(excludeRow));
 		return conditions;
 	}
 	/**
@@ -2116,6 +2223,11 @@ function toRestValues(row, collection) {
 * an `update` that echoes the row back overwrite the real value with the null it
 * was handed.
 *
+* A withheld to-one relation takes its foreign key with it. `bandId: 7` names
+* the salary band exactly as `band: { id: 7 }` does, and the row carries the
+* column beside the relation — so withholding only the relation withheld
+* nothing.
+*
 * `_matches` is filtered rather than deleted: it is the list of fields a text
 * search hit, and a field the caller cannot read must not appear in it even
 * though the array itself is theirs to see.
@@ -2125,13 +2237,22 @@ function stripUnreadable(row, collection) {
 	if (!properties) return row;
 	const viewer = currentFieldViewer();
 	const hidden = /* @__PURE__ */ new Set();
+	const hide = (name) => {
+		hidden.add(name);
+		delete row[name];
+	};
+	let relations;
 	for (const [key, property] of Object.entries(properties)) {
 		if (canReadField(property, viewer)) continue;
-		hidden.add(key);
-		delete row[key];
-		if (property.columnName) {
-			hidden.add(property.columnName);
-			delete row[property.columnName];
+		hide(key);
+		if (property.columnName) hide(property.columnName);
+		if (property.type === "relation") {
+			relations ??= resolveCollectionRelations(collection);
+			const relation = findRelation(relations, key);
+			if (relation?.kind === "belongsTo") {
+				hide(fieldKeyForColumn(collection, relation.localKey));
+				hide(relation.localKey);
+			}
 		}
 	}
 	if (hidden.size > 0 && Array.isArray(row._matches)) row._matches = row._matches.filter((match) => !hidden.has(typeof match === "string" ? match : String(match?.field)));
@@ -2336,8 +2457,10 @@ async function removeJunctionLink(tx, binding, parentId, targetId, subject) {
 *    the form runs under RLS, so a user who may edit the parent but cannot see
 *    some of the linked rows gets a shorter list — and writing it back deleted
 *    the links they were never shown. The select that drives the diff runs in
-*    this same transaction under the same policies, so a link the caller cannot
-*    read is in neither list and survives the save.
+*    this same transaction under the same policies, and through
+*    `visibleTargets` — the target's `beforeQuery` scope and soft delete, which
+*    RLS knows nothing of — so a link the caller cannot read is in neither list
+*    and survives the save.
 *  - **Junction payload columns.** A junction carrying its own columns
 *    (`position`, `role`, `created_at`) lost them on every save, because every
 *    row was re-inserted with only the two keys. Untouched links are left alone.
@@ -2360,8 +2483,8 @@ async function removeJunctionLink(tx, binding, parentId, targetId, subject) {
 * that is what keeps a plain `[1, 2, 3]` membership write from wiping the
 * `role`s off the links it did not mention.
 */
-async function applyJunctionMembership(tx, binding, parentId, links) {
-	const existingRows = await tx.select({ targetId: binding.targetColumn }).from(binding.table).where(eq(binding.parentColumn, parentId));
+async function applyJunctionMembership(tx, binding, parentId, links, visibleTargets) {
+	const existingRows = visibleTargets ? await tx.select({ targetId: binding.targetColumn }).from(binding.table).innerJoin(visibleTargets.table, eq(binding.targetColumn, visibleTargets.idColumn)).where(and(eq(binding.parentColumn, parentId), visibleTargets.condition)) : await tx.select({ targetId: binding.targetColumn }).from(binding.table).where(eq(binding.parentColumn, parentId));
 	const existingById = /* @__PURE__ */ new Map();
 	for (const row of existingRows) {
 		if (row.targetId === null || row.targetId === void 0) continue;
@@ -2420,6 +2543,8 @@ async function removeLinks(tx, binding, parentId, removed) {
 	if ((await tx.select({ present: sql`1` }).from(binding.table).where(and(...conditions)).limit(1)).length === 0) return;
 	throw ApiError.forbidden(`Not allowed to remove ${removed.length - deleted} of ${removed.length} link(s) for relation '${binding.label}': a row-level security policy rejected the write.`, "WRITE_DENIED");
 }
+//#endregion
+//#region src/services/soft-delete.ts
 /**
 * The soft-delete field this collection uses, or `undefined` if it has none.
 *
@@ -2429,9 +2554,8 @@ async function removeLinks(tx, binding, parentId, removed) {
 * worth avoiding — deletes would silently start removing rows.
 */
 function resolveSoftDelete(collection) {
-	const declared = collection?.softDelete;
-	if (!declared) return void 0;
-	const field = typeof declared === "object" && declared.field || "deletedAt";
+	const field = softDeleteFieldOf(collection);
+	if (!field) return void 0;
 	return {
 		field,
 		columnName: ((collection?.properties)?.[field])?.columnName ?? toSnakeCase(field)
@@ -2488,6 +2612,128 @@ function andSoftDelete(where, collection, table, withDeleted) {
 	return where ? and(where, condition) : condition;
 }
 //#endregion
+//#region src/services/read-scope.ts
+/**
+* `beforeQuery`: the one place a collection callback can change *which* rows a
+* read asks for.
+*
+* `afterRead` runs over rows that have already been fetched, so until this
+* existed an application developer who needed the read itself narrowed — a
+* tenant scope, a visibility window, a per-role row filter — had two options:
+* patch this driver, or `rebase eject`.
+*
+* Two properties are load-bearing, and both belong to the *shape* of the thing
+* rather than to how carefully each call site was written.
+*
+* ## It can only narrow
+*
+* A hook returns a {@link QueryNarrowing} — a declarative filter, optionally a
+* logical group — which is AND-ed into the query the caller sent. `AND(q, c)`
+* is a subset of `q` for every `c`, so there is no `c` a hook can return that
+* widens a read. The obvious alternative shape, `(query) => query`, can: a
+* hook that drops a condition on the way through runs the query without it,
+* and on an RLS data plane a dropped condition returns everything the policies
+* happen to allow. That is the same reasoning behind
+* `UnknownFilterFieldsMode` defaulting to `"error"`, and it is why that mode is
+* **forced** to `"error"` for a hook's own filter here whatever the
+* process-wide setting is: a scope condition naming a renamed column has to
+* refuse the request, never be dropped from it.
+*
+* ## It cannot be skipped
+*
+* The hooks are resolved *by the read path itself*, out of the registry that
+* read already holds — not handed to it by a caller who might forget. So a
+* read that compiles a WHERE compiles this one too, or it throws.
+*
+* The one thing a read path cannot derive is the identity the hook runs as:
+* `FetchService`, `RelationService` and `DataService` carry no user. That
+* arrives as a {@link ReadCallContextProvider}, threaded from the driver that
+* constructed them — the driver is the only object that knows both the caller
+* and the connection, and it constructs a service per transaction anyway, so
+* there is exactly one place per instance to pass it.
+*
+* Absence is the interesting case, and it fails closed: a service built with no
+* provider refuses any read of a collection that declares `beforeQuery`, with
+* a message naming the collection. So a future construction site that forgets
+* the provider breaks loudly on the first scoped collection instead of quietly
+* serving every row — which is the failure mode this whole module exists to
+* rule out. A deployment with no `beforeQuery` anywhere never reaches any of
+* this: the check is one map lookup and the compiled SQL is byte-identical.
+*
+* @module
+*/
+/**
+* The `beforeQuery` hooks that apply to one collection, in the order they run.
+*
+* Global first, then the collection's own — the same order `afterRead` and
+* `beforeSave` use. The order changes nothing about the outcome here (both are
+* AND-ed in, so neither can relax the other) and is kept because a hook that
+* logs or measures should see the same sequence everywhere.
+*
+* There is no property tier: a property callback shapes one value on a row, and
+* a row filter is not a value.
+*/
+function resolveBeforeQuery(registry, collection) {
+	const hooks = [];
+	const global = registry?.getGlobalCallbacks();
+	if (global?.beforeQuery) hooks.push(global.beforeQuery);
+	const own = collection?.callbacks;
+	if (own?.beforeQuery) hooks.push(own.beforeQuery);
+	return hooks;
+}
+/** Whether anything at all would run for this collection. */
+function hasBeforeQuery(registry, collection) {
+	return resolveBeforeQuery(registry, collection).length > 0;
+}
+/**
+* The conditions every `beforeQuery` hook for this collection asks to add.
+*
+* Returned as a list rather than pre-combined so a caller pushes them onto the
+* same `allConditions` array its own filter goes into. Every caller AND-es
+* that array, which is what makes these additive — the hook is not trusted to
+* narrow, it is only ever given a way to.
+*/
+async function beforeQueryConditions(env, collection, path, table, description, filterContext) {
+	const hooks = resolveBeforeQuery(env.registry, collection);
+	if (hooks.length === 0) return [];
+	if (!collection) throw new Error(`[beforeQuery] "${path}" resolves to no registered collection, so a global \`beforeQuery\` cannot be compiled against it. Register the collection, or narrow the hook to the collections it applies to.`);
+	if (!env.callContext) throw new Error(`[beforeQuery] "${collection.slug}" declares a \`beforeQuery\` hook, and this read was compiled by a service that was built without a call-context provider, so the hook could not run. Serving the read unnarrowed is not an option — a hook that does not run widens the result set. Construct the service through the driver (which passes one), or pass a provider explicitly.`);
+	const context = env.callContext();
+	const unknownFields = "error";
+	const options = {
+		...filterContext,
+		unknownFields
+	};
+	const conditions = [];
+	for (const hook of hooks) {
+		const narrowing = await hook({
+			collection,
+			path,
+			operation: description.operation,
+			query: description.query,
+			context
+		});
+		if (!narrowing) continue;
+		if (!narrowing.filter && !narrowing.logical) throw new Error(`[beforeQuery] "${collection.slug}" returned an object with neither \`filter\` nor \`logical\`. Return nothing (or \`undefined\`) to add no conditions; an empty object reads as a scope that was meant to be built and was not.`);
+		if (narrowing.filter) conditions.push(...DrizzleConditionBuilder.buildFilterConditions(narrowing.filter, table, path, options));
+		if (narrowing.logical) {
+			const logical = DrizzleConditionBuilder.buildLogicalConditions(narrowing.logical, table, path, options);
+			if (logical) conditions.push(logical);
+		}
+	}
+	return conditions;
+}
+/**
+* {@link beforeQueryConditions}, pre-combined, for the read paths that hold a
+* single `SQL` rather than a list of them — a single get, a relation loader.
+*/
+async function beforeQueryCondition(env, collection, path, table, description, filterContext) {
+	const conditions = await beforeQueryConditions(env, collection, path, table, description, filterContext);
+	if (conditions.length === 0) return void 0;
+	if (conditions.length === 1) return conditions[0];
+	return and(...conditions);
+}
+//#endregion
 //#region src/services/RelationService.ts
 /**
 * Typed wrapper for Drizzle dynamic query innerJoin.
@@ -2522,6 +2768,17 @@ function narrowed(base, narrow) {
 	return narrow ? and(base, narrow) : base;
 }
 /**
+* Two optional conditions, AND-ed: either, both, or neither.
+*
+* The include's own `where` and the target collection's `beforeQuery` arrive
+* separately and are both optional, and they have to reach the loaders as one
+* condition because that is the shape every relation kind threads through.
+*/
+function narrowBoth(a, b) {
+	if (a && b) return and(a, b);
+	return a ?? b;
+}
+/**
 * The registry has no table for a collection a relation just asked about.
 *
 * "Parent table not found" was the whole message, four times over, and it names
@@ -2538,9 +2795,58 @@ function unregisteredTable(collectionSlug, table, role) {
 var RelationService = class {
 	db;
 	registry;
-	constructor(db, registry) {
+	callContext;
+	constructor(db, registry, callContext) {
 		this.db = db;
 		this.registry = registry;
+		this.callContext = callContext;
+	}
+	/**
+	* The **target** collection's `beforeQuery` narrowing, for rows reached
+	* through a relation.
+	*
+	* The target's, not the parent's, because these are the target's rows: a
+	* scope on `comments` has to hold whether they are listed at
+	* `/comments` or loaded as `post.comments`. Without this an `include` is a
+	* way around every row filter a collection declares — the exact hole
+	* `stripUnreadable` was once missing from the relation-ref branch.
+	*
+	* Folded into the `narrow` condition the loaders already thread through
+	* every relation kind, so a `via` join, a junction, a foreign key and the
+	* dynamic relation builder all apply it or none of them do.
+	*/
+	narrowTargetRead(parentCollection, relation, parentId) {
+		const targetCollection = relation.target();
+		const targetTable = getTableForCollection(targetCollection, this.registry);
+		return beforeQueryCondition({
+			registry: this.registry,
+			callContext: this.callContext
+		}, targetCollection, targetCollection.slug, targetTable, {
+			operation: "relation",
+			query: { relatedTo: {
+				parentSlug: parentCollection.slug,
+				parentId,
+				relationName: relation.relationName
+			} }
+		}, {
+			collection: targetCollection,
+			registry: this.registry
+		});
+	}
+	/**
+	* The target rows a caller may see through `relation`: the target's
+	* `beforeQuery` scope and its soft delete, as one condition on the target
+	* table, or `undefined` when neither applies.
+	*
+	* What every loader here narrows a read by, exposed for the membership
+	* writes. A write that diffs a new link set against "what is linked now"
+	* has to diff against what the caller could have read — otherwise saving
+	* back the list they were shown unlinks every row they were not.
+	*/
+	async visibleTargetCondition(parentCollection, relation, parentId) {
+		const targetCollection = relation.target();
+		const targetTable = getTableForCollection(targetCollection, this.registry);
+		return andSoftDelete(await this.narrowTargetRead(parentCollection, relation, parentId), targetCollection, targetTable);
 	}
 	/**
 	* One target row, as the {@link RelatedRow} everything here returns.
@@ -2601,11 +2907,11 @@ var RelationService = class {
 			return col;
 		};
 		if (parentPks.length === 1) {
-			const values = parentIds.map((id) => parseIdValues(id, parentPks)[parentPks[0].fieldName]);
+			const values = parentIds.map((id) => parseIdValues$1(id, parentPks)[parentPks[0].fieldName]);
 			return inArray(columnFor(parentPks[0].fieldName), values);
 		}
 		return or(...parentIds.map((id) => {
-			const values = parseIdValues(id, parentPks);
+			const values = parseIdValues$1(id, parentPks);
 			return and(...parentPks.map((pk) => eq(columnFor(pk.fieldName), values[pk.fieldName])));
 		}));
 	}
@@ -2656,7 +2962,7 @@ var RelationService = class {
 		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		if (!joinsOnNaturalKey(relation, parentCollection, this.registry)) {
 			for (const id of parentIds) {
-				const value = parseIdValues(id, parentPks)[parentPks[0].fieldName];
+				const value = parseIdValues$1(id, parentPks)[parentPks[0].fieldName];
 				keyByParentId.set(String(id), value);
 				parentIdByKey.set(String(value), id);
 			}
@@ -2706,11 +3012,12 @@ var RelationService = class {
 		const idField = targetTable[idInfo[0].fieldName];
 		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
-		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
+		const parsedParentId = parseIdValues$1(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTableName = getTableName$1(parentCollection);
 		const parentTable = this.registry.getTable(parentTableName);
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
+		const relatedNarrowing = await this.narrowTargetRead(parentCollection, relation, parentId);
 		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
 			let currentTable = parentTable;
@@ -2730,7 +3037,7 @@ var RelationService = class {
 				currentTable = joinTable;
 			}
 			const parentIdField = parentTable[requirePrimaryKeys(parentCollection, this.registry)[0].fieldName];
-			query = query.where(eq(parentIdField, parsedParentId));
+			query = query.where(narrowed(eq(parentIdField, parsedParentId), andSoftDelete(relatedNarrowing, targetCollection, targetTable)));
 			if (options.limit) query = query.limit(options.limit);
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
@@ -2747,6 +3054,7 @@ var RelationService = class {
 		const additionalFilters = [];
 		const relatedSoftDelete = softDeleteCondition(targetCollection, targetTable);
 		if (relatedSoftDelete) additionalFilters.push(relatedSoftDelete);
+		if (relatedNarrowing) additionalFilters.push(relatedNarrowing);
 		if (options.searchString) {
 			const searchConditions = DrizzleConditionBuilder.buildSearchConditions(options.searchString, targetCollection.properties, targetTable, targetCollection);
 			if (searchConditions.length === 0) return [];
@@ -2792,7 +3100,7 @@ var RelationService = class {
 		const targetIdField = targetTable[requirePrimaryKeys(targetCollection, this.registry)[0].fieldName];
 		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
-		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
+		const parsedParentId = parseIdValues$1(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTableName = getTableName$1(parentCollection);
 		const parentTable = this.registry.getTable(parentTableName);
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
@@ -2801,6 +3109,8 @@ var RelationService = class {
 		if (matchValue === void 0) return 0;
 		const countSoftDelete = softDeleteCondition(targetCollection, targetTable);
 		if (countSoftDelete) additionalFilters = [...additionalFilters, countSoftDelete];
+		const countNarrowing = await this.narrowTargetRead(parentCollection, relation, parentId);
+		if (countNarrowing) additionalFilters = [...additionalFilters, countNarrowing];
 		let query = this.db.select({ count: sql`count(distinct ${targetIdField})` }).from(targetTable).$dynamic();
 		query = DrizzleConditionBuilder.buildRelationCountQuery(query, relation, matchValue, targetTable, parentTable, parentIdCol, targetIdField, this.registry, additionalFilters);
 		const result = await query;
@@ -2817,7 +3127,7 @@ var RelationService = class {
 	async isRelated(hop, targetId) {
 		const targetTable = getTableForCollection(hop.targetCollection, this.registry);
 		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
-		const parsedTargetId = parseIdValues(targetId, targetPks);
+		const parsedTargetId = parseIdValues$1(targetId, targetPks);
 		const identity = targetPks.map((pk) => {
 			const column = targetTable[pk.fieldName];
 			if (!column) throw new Error(`ID field '${pk.fieldName}' not found in table for collection '${hop.targetCollection.slug}'`);
@@ -2847,8 +3157,8 @@ var RelationService = class {
 		const parentTable = this.registry.getTable(parentTableName);
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
-		const parsedParentIds = parentIds.map((id) => parseIdValues(id, parentPks)[parentIdInfo.fieldName]);
-		const narrowTarget = andSoftDelete(narrow, targetCollection, targetTable);
+		const parsedParentIds = parentIds.map((id) => parseIdValues$1(id, parentPks)[parentIdInfo.fieldName]);
+		const narrowTarget = andSoftDelete(narrowBoth(narrow, await this.narrowTargetRead(parentCollection, relation)), targetCollection, targetTable);
 		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
 			let currentTable = parentTable;
@@ -2951,8 +3261,8 @@ var RelationService = class {
 		const parentTable = this.registry.getTable(parentTableName);
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
-		const parsedParentIds = parentIds.map((id) => parseIdValues(id, parentPks)[parentIdInfo.fieldName]);
-		const narrowTarget = andSoftDelete(narrow, targetCollection, targetTable);
+		const parsedParentIds = parentIds.map((id) => parseIdValues$1(id, parentPks)[parentIdInfo.fieldName]);
+		const narrowTarget = andSoftDelete(narrowBoth(narrow, await this.narrowTargetRead(parentCollection, relation)), targetCollection, targetTable);
 		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
 			let currentTable = parentTable;
@@ -3652,11 +3962,13 @@ function numericAggregateAliases(aggregates, properties) {
 var FetchService = class FetchService {
 	db;
 	registry;
+	callContext;
 	relationService;
-	constructor(db, registry) {
+	constructor(db, registry, callContext) {
 		this.db = db;
 		this.registry = registry;
-		this.relationService = new RelationService(db, registry);
+		this.callContext = callContext;
+		this.relationService = new RelationService(db, registry, callContext);
 	}
 	/**
 	* Get the relational query builder for a given table name.
@@ -3690,6 +4002,63 @@ var FetchService = class FetchService {
 		};
 	}
 	/**
+	* The conditions this collection's `beforeQuery` hooks ask to add, for a
+	* read that is about to be compiled.
+	*
+	* Resolved here, from the registry this service already holds, rather than
+	* handed in by a caller — so a read path that builds a WHERE cannot serve
+	* one of these collections without the hook. `[]` when nothing is declared,
+	* which leaves the compiled SQL byte-identical.
+	*
+	* Every caller pushes the result onto the same `allConditions` array its
+	* own filter goes into, and every one of those arrays is AND-ed. That is
+	* what keeps a hook additive: it is not trusted to narrow, it is only ever
+	* given a way to.
+	*/
+	narrowRead(collectionPath, collection, table, operation, query) {
+		return beforeQueryConditions({
+			registry: this.registry,
+			callContext: this.callContext
+		}, collection, collectionPath, table, {
+			operation,
+			query
+		}, this.filterContext(collectionPath, table));
+	}
+	/** {@link narrowRead}, pre-combined, for the reads that hold one `SQL`. */
+	narrowReadCondition(collectionPath, collection, table, operation, query) {
+		return beforeQueryCondition({
+			registry: this.registry,
+			callContext: this.callContext
+		}, collection, collectionPath, table, {
+			operation,
+			query
+		}, this.filterContext(collectionPath, table));
+	}
+	/**
+	* The read the hooks are shown, from the options a read path was given.
+	*
+	* Transport is left out on purpose — a `databaseId`, an `include` tree, a
+	* `withDeleted` flag are not part of "which rows". What is in is what a
+	* scope might reasonably branch on.
+	*/
+	static describeRead(options) {
+		const orderBy = normalizeDriverOrderBy(options.orderBy, options.order);
+		return {
+			filter: options.filter,
+			logical: options.logical,
+			searchString: options.searchString,
+			limit: options.limit,
+			offset: options.offset,
+			orderBy: orderBy && orderBy.length > 0 ? orderBy : void 0,
+			fields: options.fields,
+			relatedTo: options.relatedTo ? {
+				parentSlug: options.relatedTo.parentCollection.slug,
+				parentId: options.relatedTo.parentId,
+				relationName: options.relatedTo.relation.relationName
+			} : void 0
+		};
+	}
+	/**
 	* The table column this collection's rows are keyed by, or `undefined`.
 	*
 	* `getPrimaryKeys` rather than `requirePrimaryKeys`: a collection with no
@@ -3733,6 +4102,11 @@ var FetchService = class FetchService {
 	* rows in arbitrary order, and paging over that repeats and skips rows.
 	*/
 	static SCORE_FIELD = "_score";
+	/**
+	* The distance a vector search attaches to every row it serves, and to no
+	* other. Like `_score` it is computed per query and stored nowhere.
+	*/
+	static DISTANCE_FIELD = "_distance";
 	resolveOrderTarget(table, orderBy, collection, searchString) {
 		if (orderBy === FetchService.SCORE_FIELD && collection && searchString) {
 			const rank = DrizzleConditionBuilder.buildSearchRankExpression(searchString, table, collection);
@@ -3816,15 +4190,17 @@ var FetchService = class FetchService {
 		return key.direction === "asc";
 	}
 	/**
-	* The full `ORDER BY`: the caller's keys, then the id.
+	* The full `ORDER BY`: the caller's keys, then the primary key.
 	*
-	* The id is always last and always descending. It is not decoration — it is
-	* what makes the ordering *total*, and a cursor over a non-total order
-	* repeats and skips rows among the ties. Every keyset comparison built by
-	* {@link buildCursorConditions} ends on the same `id DESC`, and the two have
-	* to agree: they did not, and an ascending sort paged with `id >` against an
-	* `ORDER BY … , id DESC`, so rows sharing a sort value were dropped from
-	* every page after the first.
+	* The key is always last and always descending, every column of it. It is
+	* not decoration — it is what makes the ordering *total*, and a cursor over
+	* a non-total order repeats and skips rows among the ties. Every keyset
+	* comparison built by {@link buildCursorConditions} ends on the same key
+	* `DESC`, and the two have to agree: they did not, and an ascending sort
+	* paged with `id >` against an `ORDER BY … , id DESC`, so rows sharing a
+	* sort value were dropped from every page after the first. Nor is the
+	* first column of a composite key enough: it ties every row that shares
+	* it, which is exactly the rows a cursor then skipped.
 	*
 	* Where the NULLs go is written out rather than inherited. Postgres already
 	* defaults to `NULLS LAST` ascending and `NULLS FIRST` descending, so this
@@ -3835,13 +4211,13 @@ var FetchService = class FetchService {
 	* relation reaches nothing from, which is precisely the "nobody waiting"
 	* end of a queue.
 	*/
-	buildOrderExpressions(keys, idField, tieBreakOnId = true) {
+	buildOrderExpressions(keys, keyColumns) {
 		const expressions = keys.map((key) => {
 			const nullsLast = FetchService.nullsLast(key);
 			if (key.direction === "asc") return nullsLast ? sql`${key.target} ASC NULLS LAST` : sql`${key.target} ASC NULLS FIRST`;
 			return nullsLast ? sql`${key.target} DESC NULLS LAST` : sql`${key.target} DESC NULLS FIRST`;
 		});
-		if (tieBreakOnId) expressions.push(desc(idField));
+		for (const column of keyColumns) expressions.push(desc(column));
 		return expressions;
 	}
 	resolveOrderByField(table, orderBy, collection) {
@@ -3884,40 +4260,6 @@ var FetchService = class FetchService {
 		});
 	}
 	/**
-	* Build the `with` config for Drizzle's relational query API.
-	* Converts collection relations to a Drizzle-compatible `with` object.
-	*
-	* When `include` is provided, only those relations are loaded.
-	* When `include` is absent, ALL relations are loaded (the admin path).
-	*
-	* Automatically detects many-to-many junction tables and nests
-	* the target relation so actual row data is returned.
-	*/
-	buildWithConfig(collection, include) {
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const withConfig = {};
-		const shouldInclude = (key) => !include || include.length === 0 || include[0] === "*" || include.includes(key);
-		for (const [key, relation] of Object.entries(resolvedRelations)) {
-			if (!shouldInclude(key)) continue;
-			const drizzleRelName = relation.relationName || key;
-			if (relation.kind === "via") continue;
-			if (relation.cardinality === "many" && isJunctionRelation(relation)) {
-				const targetFkName = this.getJunctionTargetRelationName(relation, collection);
-				if (targetFkName) withConfig[drizzleRelName] = { with: { [targetFkName]: true } };
-				else withConfig[drizzleRelName] = true;
-			} else withConfig[drizzleRelName] = true;
-		}
-		return withConfig;
-	}
-	/**
-	* Get the Drizzle relation name on the junction table that points to the actual target row.
-	* For example, for posts_tags junction, this returns "tag_id" (the relation pointing to tags).
-	*/
-	getJunctionTargetRelationName(relation, _collection) {
-		if (isManyToMany(relation)) return relation.through.targetColumn.replace(/_id$/, "_id");
-		return null;
-	}
-	/**
 	* The relations one level of an include tree names, resolved.
 	*
 	* A name that is not a relation is a **400 `UNKNOWN_RELATION`**. It used to
@@ -4145,36 +4487,49 @@ var FetchService = class FetchService {
 	*/
 	cursorFor(collectionPath, row, orderBy) {
 		if (orderBy?.some(([field]) => field === FetchService.SCORE_FIELD)) return void 0;
+		if (FetchService.DISTANCE_FIELD in row) return void 0;
 		try {
 			const pks = getPrimaryKeys(getCollectionByPath(collectionPath, this.registry), this.registry);
 			if (pks.length === 0) return void 0;
 			const address = buildCompositeId$1(row, pks);
 			if (!address || !address.split(COMPOSITE_ID_SEPARATOR$1).some((part) => part !== "")) return void 0;
-			return encodeCursor(orderBy, row, row[pks[0].fieldName]);
+			return encodeCursor(orderBy, row, pks.length === 1 ? row[pks[0].fieldName] : address);
 		} catch {
 			return;
 		}
 	}
 	/**
-	* Post-fetch joinPath relations for a single flat row.
-	* joinPath relations cannot be expressed via Drizzle's `with` config,
-	* so they must be loaded separately after the primary query.
-	*/
-	async resolveJoinPathRelations(row, collection, collectionPath, parsedId, _databaseId) {
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const promises = Object.entries(resolvedRelations).filter(([key, relation]) => relation.kind === "via").map(async ([key, relation]) => {
-			try {
-				const relatedRows = await this.relationService.fetchRelatedEntities(collectionPath, parsedId, key, { limit: relation.cardinality === "one" ? 1 : void 0 });
-				if (relation.cardinality === "one" && relatedRows.length > 0) {
-					const e = relatedRows[0];
-					row[key] = createRelationRefWithData(e.id, e.path, e);
-				} else if (relation.cardinality === "many") row[key] = relatedRows.map((e) => createRelationRefWithData(e.id, e.path, e));
-			} catch (e) {
-				if (reachedDatabase(e)) throw e;
-				logger.warn(`Could not resolve joinPath relation '${key}'`, { error: e });
-			}
+	* Every relation of one row, as the refs the admin renders, attached in
+	* place.
+	*
+	* Loaded by the batched loaders an `include` takes, so a target reached from
+	* this row is read as the caller may see it: its `beforeQuery` scope and its
+	* soft delete applied, its unreadable fields stripped. Populated through
+	* drizzle's relational `with`, the single get knew neither, and a
+	* tenant-scoped user fetching an owner was handed another tenant's docs —
+	* and the trashed ones — under a relation `?include=` answered correctly.
+	*
+	* A to-many relation that reaches nothing is `[]`; a to-one is left off. A
+	* relation that fails for a reason other than the database is logged and
+	* left off, as on the include path, rather than failing the whole row.
+	*/
+	async loadRelationRefs(row, address, collection, collectionPath) {
+		if (!address) return;
+		const toRef = (related) => createRelationRefWithData(related.id, related.path, {
+			id: related.id,
+			path: related.path,
+			values: related.values
 		});
-		await Promise.all(promises);
+		for (const [key, relation] of Object.entries(resolveCollectionRelations(collection))) try {
+			if (relation.cardinality === "one") {
+				const related = (await this.relationService.batchFetchRelatedEntities(collectionPath, [address], key, relation)).get(address);
+				if (related) row[key] = toRef(related);
+			} else row[key] = ((await this.relationService.batchFetchRelatedEntitiesMany(collectionPath, [address], key, relation)).get(address) ?? []).map(toRef);
+		} catch (e) {
+			if (e instanceof ApiError) throw e;
+			if (reachedDatabase(e)) throw e;
+			logger.warn(`[FetchService] Could not load relation '${key}' on ${collectionPath}`, { error: e });
+		}
 	}
 	/**
 	* Extract cursor pagination conditions from startAfter options.
@@ -4184,26 +4539,102 @@ var FetchService = class FetchService {
 	* one key that is the familiar `k > v OR (k = v AND id < cursorId)`; with
 	* several it nests, each key's tie handing the decision to the next.
 	*/
-	buildCursorConditions(table, idField, idInfo, options, collectionPath) {
+	buildCursorConditions(table, idInfoArray, options, collectionPath) {
 		if (!options.startAfter) return [];
 		const cursor = options.startAfter;
 		const keys = normalizeDriverOrderBy(options.orderBy, options.order);
+		const keyColumns = FetchService.keyColumns(table, idInfoArray, collectionPath);
+		const cursorKey = FetchService.cursorKey(cursor, idInfoArray, collectionPath);
 		if (keys) {
 			if (keys.some(([field]) => field === FetchService.SCORE_FIELD)) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with `orderBy: \"_score\"`. Relevance is computed per query rather than stored, so it cannot key a cursor. Use `limit`/`offset` for relevance-ordered pages, or order by a column.", "SCORE_CURSOR_UNSUPPORTED", { field: FetchService.SCORE_FIELD });
-			const collection = collectionPath ? getCollectionByPath(collectionPath, this.registry) : void 0;
-			const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
-			const resolved = this.resolveOrderKeys(table, keys, collection, void 0, collectionPath, startAfterId ?? void 0);
-			if (resolved.length > 0 && startAfterId !== void 0) {
+			const collection = getCollectionByPath(collectionPath, this.registry);
+			const resolved = this.resolveOrderKeys(table, keys, collection, void 0, collectionPath, cursorKey?.length === 1 ? cursorKey[0] : void 0);
+			if (resolved.length > 0 && cursorKey) {
 				const cursorValues = cursor.values;
 				const values = resolved.map(({ field, cursorTarget }) => cursorTarget ? null : cursorValues && field in cursorValues ? cursorValues[field] : cursor[field]);
-				if (values.every((value, i) => resolved[i].cursorTarget || value !== void 0)) return [this.buildKeysetComparison(resolved, values, idField, startAfterId)];
+				if (values.every((value, i) => resolved[i].cursorTarget || value !== void 0)) {
+					const seekValues = values.map((value, i) => this.preciseCursorValue(table, resolved[i].target, value, keyColumns, cursorKey));
+					return [this.buildKeysetComparison(resolved, seekValues, keyColumns, cursorKey)];
+				}
 			}
-		} else {
-			const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
-			if (startAfterId !== void 0 && startAfterId !== null) return [lt(idField, parseIdValues(startAfterId, [idInfo])[idInfo.fieldName])];
-		}
+		} else if (cursorKey) return [FetchService.keyAfter(keyColumns, cursorKey)];
 		return [];
 	}
+	/** The table's primary key columns, in key order. */
+	static keyColumns(table, idInfoArray, collectionPath) {
+		return idInfoArray.map((info) => {
+			const column = table[info.fieldName];
+			if (!column) throw new Error(`ID field '${info.fieldName}' not found in table for collection '${collectionPath}'`);
+			return column;
+		});
+	}
+	/**
+	* The cursor row's key, one value per key column — or `undefined` for a
+	* cursor that names no row.
+	*
+	* A cursor carries the row's address, which for a composite key is every
+	* part joined (see {@link cursorFor}). One that carries fewer parts than
+	* the key has columns — the first column's value alone, say — cannot say
+	* which row it stopped at, and is refused rather than read as a guess.
+	*/
+	static cursorKey(cursor, idInfoArray, collectionPath) {
+		const address = cursor.id;
+		if (idInfoArray.length === 1) {
+			const value = address ?? cursor[idInfoArray[0].fieldName];
+			return value === void 0 || value === null ? void 0 : [value];
+		}
+		if (address === void 0 || address === null) {
+			const parts = idInfoArray.map((info) => cursor[info.fieldName]);
+			return parts.some((part) => part === void 0 || part === null) ? void 0 : parts;
+		}
+		let parsed;
+		try {
+			parsed = parseIdValues$1(String(address), idInfoArray);
+		} catch {
+			throw ApiError.badRequest(`Invalid cursor: its row id does not name every key column of '${collectionPath}' (${idInfoArray.map((info) => info.fieldName).join(", ")}). Pass back the \`nextCursor\` from the previous page unchanged — it is opaque and must not be built by hand.`, "INVALID_CURSOR");
+		}
+		return idInfoArray.map((info) => parsed[info.fieldName]);
+	}
+	/**
+	* "Sorts after the cursor row" on the key alone: the key descending, as the
+	* `ORDER BY` ends.
+	*
+	* Every column runs the same direction, so for a composite key the
+	* row-value comparison is exactly the lexicographic order the `ORDER BY`
+	* produces.
+	*/
+	static keyAfter(keyColumns, cursorKey) {
+		if (keyColumns.length === 1) return lt(keyColumns[0], cursorKey[0]);
+		const values = keyColumns.map((column, i) => sql.param(cursorKey[i], column));
+		return sql`(${sql.join(keyColumns, sql`, `)}) < (${sql.join(values, sql`, `)})`;
+	}
+	/**
+	* The cursor row's value for a timestamp key, to the microsecond.
+	*
+	* A cursor is built from the row as served, and a timestamp is served to
+	* the millisecond while Postgres stores it to the microsecond. Seeking past
+	* the served value compares the column against something up to 999µs short
+	* of the cursor row's own, so every row in that sliver lands on the wrong
+	* side of it: paging `createdAt desc` over rows written in one transaction
+	* stopped after the first page, and ascending repeated the cursor row
+	* forever.
+	*
+	* So the exact value is read back from the cursor row by its key — but only
+	* while that row still holds the millisecond the cursor carries. A row
+	* deleted or re-stamped since the page was served falls back to the stored
+	* value, which is where the listing was when the cursor was issued.
+	*
+	* Any other key, and a NULL, is returned as it came.
+	*/
+	preciseCursorValue(table, target, value, keyColumns, cursorKey) {
+		if (value === null || value === void 0) return value;
+		if (!is(target, PgTimestamp) && !is(target, PgTimestampString)) return value;
+		if (target.precision !== void 0 && target.precision <= 3) return value;
+		const stored = sql`CAST(${value instanceof Date ? value.toISOString() : String(value)} AS ${sql.raw(target.getSQLType())})`;
+		const alias = sql.identifier("__cursor_row");
+		const column = sql`${alias}.${sql.identifier(target.name)}`;
+		return sql`COALESCE((SELECT ${column} FROM ${table} AS ${alias} WHERE ${sql.join(keyColumns.map((key, i) => sql`${alias}.${sql.identifier(key.name)} = ${sql.param(cursorKey[i], key)}`), sql` AND `)} AND ${column} >= ${stored} AND ${column} < ${stored} + INTERVAL '1 millisecond' LIMIT 1), ${stored})`;
+	}
 	/**
 	* "Sorts strictly after the cursor row", over `keys` and then the id.
 	*
@@ -4217,13 +4648,13 @@ var FetchService = class FetchService {
 	* NULL and therefore match nothing. Ordering by a nullable column and paging
 	* used to drop every row whose sort value was NULL from page two onward.
 	*/
-	buildKeysetComparison(keys, values, idField, cursorId, index = 0) {
-		if (index >= keys.length) return lt(idField, cursorId);
+	buildKeysetComparison(keys, values, keyColumns, cursorKey, index = 0) {
+		if (index >= keys.length) return FetchService.keyAfter(keyColumns, cursorKey);
 		const { direction, cursorTarget } = keys[index];
 		const nullsLast = FetchService.nullsLast(keys[index]);
 		const target = keys[index].target;
 		const value = values[index];
-		const rest = this.buildKeysetComparison(keys, values, idField, cursorId, index + 1);
+		const rest = this.buildKeysetComparison(keys, values, keyColumns, cursorKey, index + 1);
 		const after = (a, b) => direction === "asc" ? gt(a, b) : lt(a, b);
 		const afterSql = (a, b) => direction === "asc" ? sql`${a} > ${b}` : sql`${a} < ${b}`;
 		if (cursorTarget) return nullsLast ? or(and(isNull(cursorTarget), isNull(target), rest), and(isNotNull(cursorTarget), or(afterSql(target, cursorTarget), isNull(target), and(sql`${target} = ${cursorTarget}`, rest)))) : or(and(isNull(cursorTarget), or(isNotNull(target), and(isNull(target), rest))), and(isNotNull(cursorTarget), or(afterSql(target, cursorTarget), and(sql`${target} = ${cursorTarget}`, rest))));
@@ -4237,7 +4668,7 @@ var FetchService = class FetchService {
 	buildRelationScope(hop) {
 		const parentPks = requirePrimaryKeys(hop.parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
-		const parsedParentId = parseIdValues(hop.parentId, parentPks)[parentIdInfo.fieldName];
+		const parsedParentId = parseIdValues$1(hop.parentId, parentPks)[parentIdInfo.fieldName];
 		const parent = () => {
 			const table = getTableForCollection(hop.parentCollection, this.registry);
 			const idColumn = table[parentIdInfo.fieldName];
@@ -4277,58 +4708,38 @@ var FetchService = class FetchService {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
-		const idInfo = idInfoArray[0];
-		const idField = table[idInfo.fieldName];
-		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
 		if (!idCanAddressTable(id, table, idInfoArray)) return void 0;
-		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
+		const addressed = rowIdentityCondition(table, idInfoArray, id, collectionPath);
+		const narrowing = await this.narrowReadCondition(collectionPath, collection, table, "get", {});
+		const identity = narrowing ? and(addressed, narrowing) : addressed;
 		const tableName = getTableName(table);
 		const qb = this.getQueryBuilder(tableName);
-		if (qb) try {
-			const withConfig = this.buildWithConfig(collection);
-			const hidden = hiddenColumnsOption(getTableColumns(table), collection);
-			const row = await qb.findFirst({
-				where: andSoftDelete(eq(idField, parsedId), collection, table, withDeleted),
-				with: withConfig,
-				...hidden ? { columns: hidden } : {}
-			});
-			if (!row) return void 0;
-			const flatRow = toFlatRow(row, collection, this.registry);
-			await this.resolveJoinPathRelations(flatRow, collection, collectionPath, parsedId, databaseId);
-			return flatRow;
-		} catch (e) {
-			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
-				logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
-				logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
+		if (qb) {
+			let row = null;
+			try {
+				const hidden = hiddenColumnsOption(getTableColumns(table), collection);
+				row = await qb.findFirst({
+					where: andSoftDelete(identity, collection, table, withDeleted),
+					...hidden ? { columns: hidden } : {}
+				});
+			} catch (e) {
+				if (reachedDatabase(e)) throw e;
+				logger.warn(`[FetchService] db.query.findFirst failed for ${collectionPath}, falling back to db.select`, { error: e });
+			}
+			if (row === void 0) return void 0;
+			if (row !== null) {
+				const flatRow = toFlatRow(row, collection, this.registry);
+				await this.loadRelationRefs(flatRow, buildCompositeId$1(row, idInfoArray), collection, collectionPath);
+				return stripUnreadable(flatRow, collection);
 			}
-			if (reachedDatabase(e)) throw e;
-			logger.warn(`[FetchService] db.query.findFirst failed for ${collectionPath}, falling back to db.select`, { error: e });
 		}
 		const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
-		const result = await this.db.select(visibleOne).from(table).where(andSoftDelete(eq(idField, parsedId), collection, table, withDeleted)).limit(1);
+		const result = await this.db.select(visibleOne).from(table).where(andSoftDelete(identity, collection, table, withDeleted)).limit(1);
 		if (result.length === 0) return void 0;
 		const raw = result[0];
-		const values = await parseDataFromServer(raw, collection, this.db, this.registry);
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const propertyKeys = new Set(Object.keys(collection.properties));
-		const relationPromises = Object.entries(resolvedRelations).filter(([key]) => propertyKeys.has(key)).map(async ([key, relation]) => {
-			if (relation.cardinality === "many") {
-				const relatedRows = await this.relationService.fetchRelatedEntities(collectionPath, parsedId, key, {});
-				values[key] = relatedRows.map((e) => createRelationRef(e.id, e.path));
-			} else if (relation.cardinality === "one") {
-				if (values[key] == null) try {
-					const relatedRows = await this.relationService.fetchRelatedEntities(collectionPath, parsedId, key, { limit: 1 });
-					if (relatedRows.length > 0) {
-						const e = relatedRows[0];
-						values[key] = createRelationRef(e.id, e.path);
-					}
-				} catch (e) {
-					if (reachedDatabase(e)) throw e;
-					logger.warn(`Could not resolve one-to-one relation property: ${key}`, { error: e });
-				}
-			}
-		});
-		await Promise.all(relationPromises);
+		const values = await parseDataFromServer(raw, collection);
+		await this.loadRelationRefs(values, buildCompositeId$1(raw, idInfoArray), collection, collectionPath);
+		stripUnreadable(values, collection);
 		return {
 			...values,
 			id: id.toString()
@@ -4359,6 +4770,7 @@ var FetchService = class FetchService {
 		if (results.length === 0) return [];
 		const values = await Promise.all(results.map(async (rawRow) => await parseDataFromServer(rawRow, collection)));
 		if (include) await this.loadIncludes(values, collection, collectionPath, include);
+		for (const row of values) stripUnreadable(row, collection);
 		return values;
 	}
 	/**
@@ -4366,11 +4778,10 @@ var FetchService = class FetchService {
 	*/
 	async fetchCollection(collectionPath, options = {}) {
 		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
-		if (hop) return this.fetchRowsWithConditions(hop.targetCollection.slug, {
+		return this.fetchRowsWithConditions(hop ? hop.targetCollection.slug : collectionPath, {
 			...options,
 			relatedTo: hop
 		});
-		return this.fetchRowsWithConditions(collectionPath, options);
 	}
 	/**
 	* Search rows by text
@@ -4406,6 +4817,10 @@ var FetchService = class FetchService {
 			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, effectivePath, this.filterContext(effectivePath, table));
 			if (logicalCondition) allConditions.push(logicalCondition);
 		}
+		allConditions.push(...await this.narrowRead(effectivePath, collection, table, "count", FetchService.describeRead({
+			...options,
+			relatedTo: hop
+		})));
 		if (options.vectorSearch) {
 			const vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
 			if (vectorMeta.filter) allConditions.push(vectorMeta.filter);
@@ -4484,13 +4899,16 @@ var FetchService = class FetchService {
 			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
 			if (logicalCondition) conditions.push(logicalCondition);
 		}
+		conditions.push(...await this.narrowRead(collectionPath, collection, table, "aggregate", FetchService.describeRead(options)));
 		if (conditions.length > 0) {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(conditions);
 			if (finalCondition) query = query.where(finalCondition);
 		}
 		if (groupColumns.length > 0) {
 			query = query.groupBy(...groupColumns.map((g) => g.column));
+			query = query.orderBy(...this.aggregateOrdering(options.orderBy, groupColumns, options.aggregates, selection));
 			if (options.limit) query = query.limit(options.limit);
+			if (options.offset) query = query.offset(options.offset);
 		}
 		const rows = await query;
 		const numericAliases = numericAggregateAliases(options.aggregates, collection?.properties ?? {});
@@ -4505,19 +4923,69 @@ var FetchService = class FetchService {
 		});
 	}
 	/**
-	* Check if a field value is unique
+	* The `ORDER BY` of a grouped aggregate: the caller's keys, then every
+	* group key they did not name.
+	*
+	* A grouped aggregate is paged like a listing — `limit` bounds it, so more
+	* groups than one page holds are reached with `offset` — and a page is only
+	* a page over a total order. With no `ORDER BY` at all, Postgres returns the
+	* groups in whatever order its plan produces them, so "the next fifty" was
+	* not a thing that existed. The group keys identify a group, so ending on
+	* them makes the order total and puts every page boundary in the same place
+	* on every request.
+	*
+	* A key may name a `groupBy` field or an aggregate by its alias
+	* (`count`, `sum_total`), sorted on the aggregate's own expression — a
+	* drizzle selection is not aliased in the SQL, so there is no output name
+	* to refer to. Anything else is a 400: Postgres would refuse it too, but as
+	* a `GROUP BY` error from inside the statement.
+	*/
+	aggregateOrdering(orderBy, groupColumns, aggregates, selection) {
+		const keys = [];
+		const named = /* @__PURE__ */ new Set();
+		for (const [field, direction, nulls] of orderBy ?? []) {
+			const group = groupColumns.find((g) => g.field === field);
+			const aggregate = aggregates.find((a) => a.alias === field);
+			const target = group?.column ?? (aggregate ? selection[aggregate.alias] : void 0);
+			if (!target) {
+				const sortable = [...groupColumns.map((g) => g.field), ...aggregates.map((a) => a.alias)];
+				throw ApiError.badRequest(`An aggregate cannot be sorted by '${field}'. It sorts by what it returns: ${sortable.map((name) => `'${name}'`).join(", ")}.`, "INVALID_ORDER_BY");
+			}
+			keys.push({
+				field,
+				direction,
+				nulls,
+				target
+			});
+			named.add(field);
+		}
+		for (const group of groupColumns) if (!named.has(group.field)) keys.push({
+			field: group.field,
+			direction: "asc",
+			target: group.column
+		});
+		return this.buildOrderExpressions(keys, []);
+	}
+	/**
+	* Check if a field value is unique.
+	*
+	* Deliberately **not** narrowed by `beforeQuery`, and it is the only read
+	* here that is not. The question is whether the value exists anywhere in
+	* the table, not whether it exists among the rows this caller can see:
+	* narrowed, it would answer "unique" for a value a hidden row already
+	* holds, and the insert would then be rejected by the unique constraint
+	* with a message about a row the caller has no way to find. Uniqueness is a
+	* property of the table.
 	*/
 	async checkUniqueField(collectionPath, fieldName, value, excludeEntityId, _databaseId) {
 		if (value === void 0 || value === null) return true;
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
-		const idInfo = idInfoArray[0];
-		const idField = table[idInfo.fieldName];
 		const field = table[fieldName];
 		if (!field) return true;
-		const parsedExcludeId = excludeEntityId ? parseIdValues(excludeEntityId, idInfoArray)[idInfo.fieldName] : void 0;
-		const conditions = DrizzleConditionBuilder.buildUniqueFieldCondition(field, value, idField, parsedExcludeId);
+		const excludeRow = excludeEntityId && idCanAddressTable(excludeEntityId, table, idInfoArray) ? rowIdentityCondition(table, idInfoArray, excludeEntityId, collectionPath) : void 0;
+		const conditions = DrizzleConditionBuilder.buildUniqueFieldCondition(field, value, excludeRow);
 		const result = await this.db.select({ count: count() }).from(table).where(and(...conditions));
 		return Number(result[0]?.count || 0) === 0;
 	}
@@ -4577,13 +5045,13 @@ var FetchService = class FetchService {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
-		const idInfo = idInfoArray[0];
-		const idField = table[idInfo.fieldName];
 		if (!idCanAddressTable(id, table, idInfoArray)) return null;
-		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
+		const addressed = rowIdentityCondition(table, idInfoArray, id, collectionPath);
 		const withDeleted = options?.withDeleted;
 		const projection = this.columnProjection(table, collection, options?.fields, idInfoArray);
-		const result = await this.db.select(projection).from(table).where(andSoftDelete(eq(idField, parsedId), collection, table, withDeleted)).limit(1);
+		const narrowing = await this.narrowReadCondition(collectionPath, collection, table, "get", FetchService.describeRead({ fields: options?.fields }));
+		const identity = narrowing ? and(addressed, narrowing) : addressed;
+		const result = await this.db.select(projection).from(table).where(andSoftDelete(identity, collection, table, withDeleted)).limit(1);
 		if (result.length === 0) return null;
 		const row = toRestRow(result[0], collection, this.registry);
 		const normalizedInclude = normalizeInclude(include);
@@ -4597,8 +5065,7 @@ var FetchService = class FetchService {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
-		const idInfo = idInfoArray[0];
-		const idField = table[idInfo.fieldName];
+		if (options.vectorSearch && options.startAfter) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with a vector search. Its rows are ordered by a distance computed per query, which cannot key a cursor. Use `limit`/`offset` for the next page of nearest rows.", "VECTOR_CURSOR_UNSUPPORTED");
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
 		const visible = this.columnProjection(table, collection, options.fields, idInfoArray, options.distinct === true);
@@ -4634,6 +5101,7 @@ var FetchService = class FetchService {
 			const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
 			if (logicalCondition) allConditions.push(logicalCondition);
 		}
+		allConditions.push(...await this.narrowRead(collectionPath, collection, table, "list", FetchService.describeRead(options)));
 		if (vectorMeta?.filter) allConditions.push(vectorMeta.filter);
 		if (allConditions.length > 0) {
 			const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
@@ -4645,10 +5113,11 @@ var FetchService = class FetchService {
 			const missing = sortKeys.map(([field]) => field).filter((field) => !selected.has(field));
 			if (missing.length > 0) throw ApiError.badRequest(`\`distinct\` cannot sort by ${missing.map((f) => `'${f}'`).join(", ")}: a DISTINCT read can only be ordered by columns it returns, or the rows it collapses have no defined order. Add ${missing.map((f) => `'${f}'`).join(", ")} to \`fields\`, or drop them from \`orderBy\`.`, "DISTINCT_ORDER_BY_NOT_SELECTED", { fields: missing });
 		}
-		const orderExpressions = vectorMeta ? [asc(vectorMeta.orderBy), desc(idField)] : this.buildOrderExpressions(this.resolveOrderKeys(table, sortKeys, collection, options.searchString), idField, !wantsDistinct);
+		const keyColumns = FetchService.keyColumns(table, idInfoArray, collectionPath);
+		const orderExpressions = vectorMeta ? [asc(vectorMeta.orderBy), ...keyColumns.map((column) => desc(column))] : this.buildOrderExpressions(this.resolveOrderKeys(table, sortKeys, collection, options.searchString), wantsDistinct ? [] : keyColumns);
 		if (orderExpressions.length > 0) query = query.orderBy(...orderExpressions);
 		if (options.startAfter) {
-			const cursorConditions = this.buildCursorConditions(table, idField, idInfo, options, collectionPath);
+			const cursorConditions = this.buildCursorConditions(table, idInfoArray, options, collectionPath);
 			if (cursorConditions.length > 0) {
 				allConditions.push(...cursorConditions);
 				const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
@@ -4738,11 +5207,13 @@ function serializePivot(pivot, payload, label) {
 var RelationWriteService = class {
 	db;
 	registry;
+	callContext;
 	reads;
-	constructor(db, registry) {
+	constructor(db, registry, callContext) {
 		this.db = db;
 		this.registry = registry;
-		this.reads = new RelationService(db, registry);
+		this.callContext = callContext;
+		this.reads = new RelationService(db, registry, callContext);
 	}
 	/**
 	* Remove the junction row linking a parent to `targetId`, leaving the target
@@ -4785,16 +5256,33 @@ var RelationWriteService = class {
 			relation: hop.relationKey
 		});
 	}
+	/**
+	* The target rows of `relation` this caller can see, for a junction diff —
+	* or `undefined` when that is all of them. See
+	* {@link RelationService.visibleTargetCondition}.
+	*/
+	async visibleTargets(parentCollection, relation, parentId) {
+		const condition = await this.reads.visibleTargetCondition(parentCollection, relation, parentId);
+		if (!condition) return void 0;
+		const targetCollection = relation.target();
+		const table = getTableForCollection(targetCollection, this.registry);
+		const [idInfo] = requirePrimaryKeys(targetCollection, this.registry);
+		return {
+			table,
+			idColumn: table[idInfo.fieldName],
+			condition
+		};
+	}
 	/** A collection's id, parsed to the type its primary key column holds. */
 	parsedId(collection, id) {
 		const pks = requirePrimaryKeys(collection, this.registry);
-		return parseIdValues(id, pks)[pks[0].fieldName];
+		return parseIdValues$1(id, pks)[pks[0].fieldName];
 	}
 	/** The same, for the membership list a to-many write names. */
 	parsedIds(collection, ids) {
 		if (ids.length === 0) return [];
 		const pks = requirePrimaryKeys(collection, this.registry);
-		return ids.map((id) => parseIdValues(id, pks)[pks[0].fieldName]);
+		return ids.map((id) => parseIdValues$1(id, pks)[pks[0].fieldName]);
 	}
 	/**
 	* A membership list as links: the target ids parsed, and each element's
@@ -4812,7 +5300,7 @@ var RelationWriteService = class {
 		if (elements.length === 0) return [];
 		const pks = requirePrimaryKeys(collection, this.registry);
 		return elements.map((element) => ({
-			id: parseIdValues(element.id, pks)[pks[0].fieldName],
+			id: parseIdValues$1(element.id, pks)[pks[0].fieldName],
 			pivot: element.pivot ? serializePivot(element.pivot, payload, label) : void 0
 		}));
 	}
@@ -4828,8 +5316,8 @@ var RelationWriteService = class {
 			const targetEntityIds = elements.map((element) => element.id);
 			const targetCollection = relation.target();
 			const label = `${collection.slug}.${key}`;
-			if (relation.kind === "via") await applyJunctionMembership(tx, bindJoinPathJunction(this.registry, relation.joinPath, getTableName$1(collection), getTableName$1(targetCollection), label), this.parsedId(collection, id), this.parsedLinks(targetCollection, elements, {}, label));
-			else if (relation.kind === "manyToMany") await applyJunctionMembership(tx, bindThroughJunction(this.registry, relation.through, label), this.parsedId(collection, id), this.parsedLinks(targetCollection, elements, relation.through.properties, label));
+			if (relation.kind === "via") await applyJunctionMembership(tx, bindJoinPathJunction(this.registry, relation.joinPath, getTableName$1(collection), getTableName$1(targetCollection), label), this.parsedId(collection, id), this.parsedLinks(targetCollection, elements, {}, label), await this.visibleTargets(collection, relation, id));
+			else if (relation.kind === "manyToMany") await applyJunctionMembership(tx, bindThroughJunction(this.registry, relation.through, label), this.parsedId(collection, id), this.parsedLinks(targetCollection, elements, relation.through.properties, label), await this.visibleTargets(collection, relation, id));
 			else if (relation.cardinality === "many" && hasForeignKeyOnTarget(relation)) {
 				const targetTable = getTableForCollection(targetCollection, this.registry);
 				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
@@ -4840,11 +5328,12 @@ var RelationWriteService = class {
 				if (!fkCol || !targetIdCol) throw relationMisconfigured(label, `the target table '${getTableName$1(targetCollection)}' has no ${fkCol ? `'${targetIdInfo.fieldName}' key column` : `'${relation.foreignKeyOnTarget}' foreign-key column`}`);
 				const parentKeyValue = (await this.reads.resolveSourceKeys(collection, relation, [id], tx)).keyByParentId.get(String(id));
 				if (parentKeyValue === void 0) throw new Error(`Cannot write relation '${key}' on '${collection.slug}': row '${id}' has no value in \`sourceKey: "${sourceKeyField(relation, collection, this.registry)}"\`, so there is nothing for the related rows to point at.`);
+				const visible = await this.reads.visibleTargetCondition(collection, relation, id);
 				if (targetEntityIds.length > 0) {
-					const parsedTargetIds = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
-					await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(fkCol, parentKeyValue), notInArray(targetIdCol, parsedTargetIds)));
+					const parsedTargetIds = targetEntityIds.map((id) => parseIdValues$1(id, targetPks)[targetIdInfo.fieldName]);
+					await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(fkCol, parentKeyValue), notInArray(targetIdCol, parsedTargetIds), visible));
 					await tx.update(targetTable).set({ [fkField]: parentKeyValue }).where(inArray(targetIdCol, parsedTargetIds));
-				} else await tx.update(targetTable).set({ [fkField]: null }).where(eq(fkCol, parentKeyValue));
+				} else await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(fkCol, parentKeyValue), visible));
 			} else throw relationMisconfigured(label, "it is a to-many relation with no way to write links — a `manyToMany` needs `through`, a `hasMany` needs `foreignKeyOnTarget`");
 		}
 	}
@@ -4880,15 +5369,16 @@ var RelationWriteService = class {
 				if (!foreignKeyColumn) throw relationMisconfigured(label, `'${relation.foreignKeyOnTarget}' is not a column on the target table '${getTableName$1(targetCollection)}'`);
 				const sourceKeyValue = (await this.reads.resolveSourceKeys(sourceCollection, relation, [sourceEntityId], tx)).keyByParentId.get(String(sourceEntityId));
 				if (sourceKeyValue === void 0) throw new Error(`Cannot write relation '${relation.relationName}' on '${sourceCollection.slug}': row '${sourceEntityId}' has no value in \`sourceKey: "${sourceKeyField(relation, sourceCollection, this.registry)}"\`, so there is nothing for the related row to point at.`);
-				if (newValue === null || newValue === void 0) await tx.update(targetTable).set({ [fkField]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
+				const visible = await this.reads.visibleTargetCondition(sourceCollection, relation, sourceEntityId);
+				if (newValue === null || newValue === void 0) await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(foreignKeyColumn, sourceKeyValue), visible));
 				else {
-					const parsedNewTargetId = parseIdValues(newValue, targetPks)[targetIdInfo.fieldName];
+					const parsedNewTargetId = parseIdValues$1(newValue, targetPks)[targetIdInfo.fieldName];
 					const targetIdField = targetTable[targetIdInfo.fieldName];
-					await tx.update(targetTable).set({ [fkField]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
+					await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(foreignKeyColumn, sourceKeyValue), visible));
 					await tx.update(targetTable).set({ [fkField]: sourceKeyValue }).where(eq(targetIdField, parsedNewTargetId));
 				}
 			} catch (e) {
-				if (e instanceof ApiError || e?.name === "ApiError") throw e;
+				if (e instanceof ApiError || e?.name === "ApiError" || reachedDatabase(e)) throw e;
 				logger.warn(`Failed to update inverse relation '${relation.relationName}'`, { error: e });
 			}
 		}
@@ -4903,7 +5393,7 @@ var RelationWriteService = class {
 		try {
 			const binding = bindJoinPathJunction(this.registry, relation.joinPath, sourceTableName, targetTableName, `${sourceCollection.slug}.${relation.relationName}`);
 			const elements = Array.isArray(newValue) ? relationLinkElements(newValue, relation.relationName, sourceCollection.slug) : newValue === null || newValue === void 0 ? [] : relationLinkElements([newValue], relation.relationName, sourceCollection.slug);
-			await applyJunctionMembership(tx, binding, this.parsedId(sourceCollection, sourceEntityId), this.parsedLinks(targetCollection, elements, {}, `${sourceCollection.slug}.${relation.relationName}`));
+			await applyJunctionMembership(tx, binding, this.parsedId(sourceCollection, sourceEntityId), this.parsedLinks(targetCollection, elements, {}, `${sourceCollection.slug}.${relation.relationName}`), await this.visibleTargets(sourceCollection, relation, sourceEntityId));
 		} catch (error) {
 			logger.error(`Failed to update inverse joinPath relation '${relation.relationName}'`, { error });
 			throw error;
@@ -4916,7 +5406,7 @@ var RelationWriteService = class {
 		const label = `${sourceCollection.slug}.${relation.relationName}`;
 		try {
 			const elements = Array.isArray(newValue) ? relationLinkElements(newValue, relation.relationName, sourceCollection.slug) : [];
-			await applyJunctionMembership(tx, bindThroughJunction(this.registry, junctionInfo, label), this.parsedId(sourceCollection, sourceEntityId), this.parsedLinks(targetCollection, elements, junctionInfo.properties, label));
+			await applyJunctionMembership(tx, bindThroughJunction(this.registry, junctionInfo, label), this.parsedId(sourceCollection, sourceEntityId), this.parsedLinks(targetCollection, elements, junctionInfo.properties, label), await this.visibleTargets(sourceCollection, relation, sourceEntityId));
 		} catch (error) {
 			logger.error(`Failed to update many-to-many inverse relation '${relation.relationName}'`, { error });
 			throw error;
@@ -4939,7 +5429,7 @@ var RelationWriteService = class {
 			const parentTable = getTableForCollection(parentCollection, this.registry);
 			const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 			const parentIdInfo = parentPks[0];
-			const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
+			const parsedParentId = parseIdValues$1(parentId, parentPks)[parentIdInfo.fieldName];
 			const parentIdCol = parentTable[parentIdInfo.fieldName];
 			const parentSourceCol = parentTable[parentSourceColName];
 			const targetFKCol = targetTable[targetFKColName];
@@ -4953,7 +5443,7 @@ var RelationWriteService = class {
 				if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
 				continue;
 			}
-			const parsedTargetId = parseIdValues(newTargetId, targetPks)[targetIdInfo.fieldName];
+			const parsedTargetId = parseIdValues$1(newTargetId, targetPks)[targetIdInfo.fieldName];
 			if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
 			else throw ApiError.badRequest(`Cannot write relation '${label}': row '${parentId}' has no value in '${parentSourceColName}', which is the column its joinPath joins on, so there is nothing for the related row to point at.`, "RELATION_SOURCE_KEY_EMPTY");
 			await tx.update(targetTable).set({ [targetFKColName]: parentFKValue }).where(eq(targetIdCol, parsedTargetId));
@@ -5022,6 +5512,10 @@ var RelationWriteService = class {
 * silently empties itself the first time it is incremented from an unset column
 * is worse than one that never worked.
 *
+* What an operation produces answers to the property's declared bounds, and
+* that check is compiled here too, as conditions for the same UPDATE — see
+* {@link compileFieldOpBounds}.
+*
 * @module
 */
 /** What the column is, as Postgres sees it: `text[]`, `jsonb`, `integer`, … */
@@ -5100,26 +5594,184 @@ function compileFieldOps(table, fieldOps, context) {
 	for (const [field, op] of Object.entries(fieldOps)) compiled[field] = compileFieldOp(table, field, op, context);
 	return compiled;
 }
+/**
+* The declared bounds each operation's *result* must satisfy, as conditions
+* for the UPDATE that applies it.
+*
+* `{ stock: -5 }` on `stock: { validation: { min: 0 } }` is refused before the
+* statement is built, because the value is in the request. What
+* `{ stock: { $inc: -1000 } }` produces depends on the stored row, which the
+* request never sees, so it can only be judged where the row is: in the WHERE
+* of the UPDATE that does the arithmetic, over the row that statement holds
+* locked. Reading the row first and judging the sum would reopen the race the
+* operation exists to close — two decrements of a stock of 1 would each read
+* `1`, each find room for one more, and both go through. A condition on the
+* UPDATE cannot be raced that way: under READ COMMITTED an UPDATE blocked on a
+* concurrent writer re-evaluates its WHERE against the row that writer
+* committed, so the second decrement sees `0 - 1` and matches nothing.
+*
+* The bound is the whole declared range, applied to the result the way it
+* applies to a value: a number's `min`, `max`, `moreThan`, `lessThan`,
+* `positive` and `negative`, an array's `min` and `max` items. `integer` is not
+* here: a whole increment of a whole number stays whole, and the request
+* already refuses a fractional one. `$merge` has no bounds to hold.
+*/
+function compileFieldOpBounds(table, fieldOps, properties, context) {
+	const bounds = [];
+	for (const [field, op] of Object.entries(fieldOps)) {
+		const property = properties[field];
+		if (!property?.validation) continue;
+		if (property.type === "number" && op.operator === "$inc" && typeof op.operand === "number") {
+			const result = compileFieldOp(table, field, op, context);
+			bounds.push(...numberBounds(field, property.validation, result, op.operand));
+		} else if (property.type === "array" && (op.operator === "$push" || op.operator === "$pull")) {
+			const column = table[field];
+			const result = compileFieldOp(table, field, op, context);
+			const size = column && isNativeArray(sqlTypeOf(column)) ? sql`cardinality(${result})` : sql`jsonb_array_length((${result})::jsonb)`;
+			bounds.push(...arrayBounds(field, property.validation, size, op.operator));
+		}
+	}
+	return bounds;
+}
+function numberBounds(field, rules, result, operand) {
+	const by = `$inc by ${operand}`;
+	const bounds = [];
+	if (rules.min !== void 0) bounds.push({
+		field,
+		code: "min",
+		holds: sql`(${result}) >= ${rules.min}::numeric`,
+		message: `'${field}' must be at least ${rules.min}, and ${by} would take it below that.`
+	});
+	if (rules.max !== void 0) bounds.push({
+		field,
+		code: "max",
+		holds: sql`(${result}) <= ${rules.max}::numeric`,
+		message: `'${field}' must be at most ${rules.max}, and ${by} would take it above that.`
+	});
+	if (rules.moreThan !== void 0) bounds.push({
+		field,
+		code: "more_than",
+		holds: sql`(${result}) > ${rules.moreThan}::numeric`,
+		message: `'${field}' must be greater than ${rules.moreThan}, and ${by} would take it to ${rules.moreThan} or below.`
+	});
+	if (rules.lessThan !== void 0) bounds.push({
+		field,
+		code: "less_than",
+		holds: sql`(${result}) < ${rules.lessThan}::numeric`,
+		message: `'${field}' must be less than ${rules.lessThan}, and ${by} would take it to ${rules.lessThan} or above.`
+	});
+	if (rules.positive) bounds.push({
+		field,
+		code: "positive",
+		holds: sql`(${result}) > 0`,
+		message: `'${field}' must be positive, and ${by} would take it to 0 or below.`
+	});
+	if (rules.negative) bounds.push({
+		field,
+		code: "negative",
+		holds: sql`(${result}) < 0`,
+		message: `'${field}' must be negative, and ${by} would take it to 0 or above.`
+	});
+	return bounds;
+}
+function arrayBounds(field, rules, size, operator) {
+	const items = (n) => `${n} item${n === 1 ? "" : "s"}`;
+	const bounds = [];
+	if (rules.min !== void 0) bounds.push({
+		field,
+		code: "min_items",
+		holds: sql`COALESCE(${size} >= ${rules.min}::numeric, TRUE)`,
+		message: `'${field}' must have at least ${items(rules.min)}, and ${operator} would leave it with fewer.`
+	});
+	if (rules.max !== void 0) bounds.push({
+		field,
+		code: "max_items",
+		holds: sql`COALESCE(${size} <= ${rules.max}::numeric, TRUE)`,
+		message: `'${field}' must have at most ${items(rules.max)}, and ${operator} would leave it with more.`
+	});
+	return bounds;
+}
+/**
+* Which bounds the row, as it now stands, would break — for an UPDATE that
+* carried bounds and matched nothing.
+*
+* A guarded UPDATE matching zero rows means one of three things: the row is not
+* there for this caller (404), a row-level security policy refused the write
+* (403), or the operation's result broke a bound (400). The first two are
+* `explainZeroRowWrite`'s; this answers the third, by evaluating each bound
+* against the row over the same handle and the same key conditions. An empty
+* answer — the row is not visible, or every bound holds — leaves the decision to
+* `explainZeroRowWrite`.
+*
+* It is a second statement, so the row can change in between. A row deleted in
+* between is a 404 here as it would have been anyway. A row changed so that the
+* operation now fits reads as "every bound holds" and falls through to the
+* row-level-security answer; the write was refused either way, and the
+* refusal is never turned into a write.
+*
+* Only booleans come back — whether each bound holds — never the stored value.
+*/
+async function brokenFieldOpBounds(handle, table, conditions, bounds) {
+	if (bounds.length === 0) return [];
+	const selection = {};
+	bounds.forEach((bound, index) => {
+		selection[`bound${index}`] = sql`(${bound.holds})`;
+	});
+	const row = (await handle.select(selection).from(table).where(and(...conditions)).limit(1))[0];
+	if (!row) return [];
+	return bounds.filter((_bound, index) => row[`bound${index}`] === false);
+}
+/** The 400 a write gets when an operation's result breaks a bound. */
+function fieldOpBoundsError(collectionSlug, broken) {
+	const violations = broken.map(({ field, code, message }) => ({
+		field,
+		code,
+		message
+	}));
+	const messages = violations.map((violation) => violation.message);
+	return ApiError.badRequest(messages.join(" "), "VALIDATION_CONSTRAINT", {
+		collection: collectionSlug,
+		violations,
+		messages
+	});
+}
 //#endregion
 //#region src/services/PersistService.ts
 /**
+* The top-level properties whose value is stamped once, when the row is
+* created: `on_create` dates and `user_on_create` identities.
+*
+* What they hold is a fact about the row's creation, so a write to a row that
+* already exists has nothing to say about them — an update, and the
+* conflict-update of an upsert that met a stored row. Top level only: a stamp
+* nested inside a `map` is part of that map's value, not a column a write can
+* leave out.
+*/
+function createStampKeys(properties) {
+	const keys = [];
+	for (const [key, property] of Object.entries(properties ?? {})) if (property?.type === "date" && property.autoValue === "on_create" || property?.type === "string" && property.autoValue === "user_on_create") keys.push(key);
+	return keys;
+}
+/**
 * Service for handling all row write operations.
 * Handles saving, deleting, and updating rows.
 */
 var PersistService = class {
 	db;
 	registry;
+	callContext;
 	/** Reads: whether a row is under a parent, the key a link joins on. */
 	relationService;
 	/** Writes: junction membership, foreign-key stamping, links. */
 	relationWrites;
 	fetchService;
-	constructor(db, registry) {
+	constructor(db, registry, callContext) {
 		this.db = db;
 		this.registry = registry;
-		this.relationService = new RelationService(db, registry);
-		this.relationWrites = new RelationWriteService(db, registry);
-		this.fetchService = new FetchService(db, registry);
+		this.callContext = callContext;
+		this.relationService = new RelationService(db, registry, callContext);
+		this.relationWrites = new RelationWriteService(db, registry, callContext);
+		this.fetchService = new FetchService(db, registry, callContext);
 	}
 	/**
 	* Set the columns of one many-to-many link, without touching the membership.
@@ -5162,14 +5814,20 @@ var PersistService = class {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = getPrimaryKeys(collection, this.registry);
-		const parsedIdObj = parseIdValues(id, idInfoArray);
+		const parsedIdObj = parseIdValues$1(id, idInfoArray);
 		const conditions = [];
 		for (const info of idInfoArray) {
 			const field = table[info.fieldName];
 			if (!field) throw new Error(`ID field '${info.fieldName}' not found in table for collection '${collectionPath}'`);
 			conditions.push(eq(field, parsedIdObj[info.fieldName]));
 		}
-		if (((await this.db.delete(table).where(and(...conditions))).rowCount ?? 0) === 0) throw await this.explainZeroRowWrite(this.db, table, conditions, collectionPath, id, "delete");
+		let result;
+		try {
+			result = await this.db.delete(table).where(and(...conditions));
+		} catch (error) {
+			throw this.toUserFriendlyError(error, collection.slug, collection, "delete");
+		}
+		if ((result.rowCount ?? 0) === 0) throw await this.explainZeroRowWrite(this.db, table, conditions, collectionPath, id, "delete");
 	}
 	/**
 	* Delete all rows from a collection
@@ -5213,6 +5871,10 @@ var PersistService = class {
 	* the row already exists — which is what a re-runnable import needs. The
 	* conflict is matched on the primary key unless `options.onConflict` names
 	* other columns; see {@link SaveProps.onConflict} for why that matters.
+	* When the INSERT meets a stored row, the conflict-update sets what the
+	* caller wrote and nothing the create alone decides — see
+	* {@link PersistSaveOptions.insertOnlyKeys} — and only on a row the caller's
+	* `beforeQuery` scope reaches.
 	*
 	* `values` may carry field operations (`{ views: { $inc: 1 } }`). They are
 	* split out here rather than at the REST boundary because every request
@@ -5230,7 +5892,7 @@ var PersistService = class {
 			effectiveCollectionPath = hop.targetCollection.slug;
 			const parentIdForWrite = () => {
 				const parentPks = getPrimaryKeys(hop.parentCollection, this.registry);
-				return parseIdValues(hop.parentId, parentPks)[parentPks[0].fieldName];
+				return parseIdValues$1(hop.parentId, parentPks)[parentPks[0].fieldName];
 			};
 			if (isManyToMany(hop.relation)) junctionTableInfo = {
 				parentCollection: hop.parentCollection,
@@ -5291,10 +5953,11 @@ var PersistService = class {
 				let currentId;
 				if (id && !options?.upsert) {
 					currentId = id;
-					const idValues = parseIdValues(id, idInfoArray);
+					const idValues = parseIdValues$1(id, idInfoArray);
 					if (joinPathRelationUpdates.length > 0) await this.relationWrites.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
 					const scalarKeys = Object.keys(entityData);
 					const compiledOps = fieldOpKeys.length > 0 ? compileFieldOps(table, fieldOps, { collectionPath: effectiveCollectionPath }) : void 0;
+					const bounds = fieldOpKeys.length > 0 ? compileFieldOpBounds(table, fieldOps, collection.properties ?? {}, { collectionPath: effectiveCollectionPath }) : [];
 					if (scalarKeys.length > 0 || compiledOps) {
 						const updateQuery = tx.update(table).set({
 							...entityData,
@@ -5305,11 +5968,15 @@ var PersistService = class {
 							const field = table[info.fieldName];
 							conditions.push(eq(field, idValues[info.fieldName]));
 						}
-						if (((await updateQuery.where(and(...conditions))).rowCount ?? 0) === 0) throw await this.explainZeroRowWrite(tx, table, conditions, effectiveCollectionPath, currentId, "update");
+						if (((await updateQuery.where(and(...conditions, ...bounds.map((bound) => bound.holds)))).rowCount ?? 0) === 0) {
+							const broken = await brokenFieldOpBounds(tx, table, conditions, bounds);
+							if (broken.length > 0) throw fieldOpBoundsError(collection.slug, broken);
+							throw await this.explainZeroRowWrite(tx, table, conditions, effectiveCollectionPath, currentId, "update");
+						}
 					}
 				} else {
 					const dataForInsert = { ...entityData };
-					if (id && options?.upsert) Object.assign(dataForInsert, parseIdValues(id, idInfoArray));
+					if (id && options?.upsert) Object.assign(dataForInsert, parseIdValues$1(id, idInfoArray));
 					for (const info of idInfoArray) if (dataForInsert[info.fieldName] === "" || dataForInsert[info.fieldName] === null || dataForInsert[info.fieldName] === void 0) delete dataForInsert[info.fieldName];
 					const insertQuery = tx.insert(table).values(dataForInsert);
 					const targetFields = options?.onConflict && options.onConflict.length > 0 ? [...options.onConflict] : idInfoArray.map((info) => info.fieldName);
@@ -5324,11 +5991,24 @@ var PersistService = class {
 						const set = { ...dataForInsert };
 						for (const info of idInfoArray) delete set[info.fieldName];
 						for (const field of targetFields) delete set[field];
-						for (const [propName, prop] of Object.entries(collection.properties ?? {})) if (prop.type === "date" && prop.autoValue === "on_create") delete set[propName];
-						result = Object.keys(set).length > 0 ? await insertQuery.onConflictDoUpdate({
+						for (const key of createStampKeys(collection.properties)) delete set[key];
+						for (const key of options.insertOnlyKeys ?? []) delete set[key];
+						const scope = await this.writeScope(collection, effectiveCollectionPath, table);
+						const updating = Object.keys(set).length > 0;
+						result = updating ? await insertQuery.onConflictDoUpdate({
 							target,
-							set
+							set,
+							setWhere: scope
 						}).returning(returningKeys) : await insertQuery.onConflictDoNothing({ target }).returning(returningKeys);
+						if (result.length === 0) {
+							const keyConditions = target.map((column, i) => eq(column, dataForInsert[targetFields[i]]));
+							if (scope) keyConditions.push(scope);
+							const keyLabel = targetFields.map((field) => String(dataForInsert[field])).join(", ");
+							const missing = `No row "${keyLabel}" in "${effectiveCollectionPath}" to update.`;
+							if (updating) throw await explainZeroRowWrite(tx, table, keyConditions, `Not allowed to update "${keyLabel}" in "${effectiveCollectionPath}": a row-level security policy rejected the write.`, missing);
+							result = await tx.select(returningKeys).from(table).where(and(...keyConditions)).limit(1);
+							if (result.length === 0) throw ApiError.notFound(missing);
+						}
 					} else result = await insertQuery.returning(returningKeys);
 					const resultRow = result[0];
 					if (!resultRow) if (id) currentId = id;
@@ -5349,6 +6029,26 @@ var PersistService = class {
 		return finalEntity;
 	}
 	/**
+	* The caller's `beforeQuery` scope over this table, as one condition: what
+	* a stored row must satisfy for a write that meets it to change it. The
+	* same scope the update gate and the single get apply; `undefined` when the
+	* collection declares no hook.
+	*/
+	writeScope(collection, collectionPath, table) {
+		const [key] = getPrimaryKeys(collection, this.registry);
+		return beforeQueryCondition({
+			registry: this.registry,
+			callContext: this.callContext
+		}, collection, collectionPath, table, {
+			operation: "get",
+			query: {}
+		}, {
+			collection,
+			registry: this.registry,
+			sourceIdColumn: key ? table[key.fieldName] : void 0
+		});
+	}
+	/**
 	* Get the RelationService instance for external use
 	*/
 	getRelationService() {
@@ -5377,7 +6077,7 @@ var PersistService = class {
 	* so `author_id` had to be translated to `authorId` by whoever read the
 	* message — which nothing does. See `pgFieldViolations`.
 	*/
-	toUserFriendlyError(error, collectionSlug, collection) {
+	toUserFriendlyError(error, collectionSlug, collection, operation = "save") {
 		if (error instanceof ApiError || error?.name === "ApiError") return error;
 		const pgError = extractPgError(error);
 		if (pgError) {
@@ -5387,7 +6087,7 @@ var PersistService = class {
 				collection: collectionSlug,
 				violations
 			} : void 0;
-			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`, details) : ApiError.badRequest(message, `PG_${code}`, details);
+			if (/^2[23]/.test(code)) return code === "23505" || code === "23001" || code === "23503" && operation === "delete" ? ApiError.conflict(message, `PG_${code}`, details) : ApiError.badRequest(message, `PG_${code}`, details);
 			if (isRowLevelSecurityDenial(error)) return ApiError.forbidden(message, "WRITE_DENIED");
 			return new Error(message, { cause: error });
 		}
@@ -5413,13 +6113,15 @@ var PersistService = class {
 var DataService = class {
 	db;
 	registry;
+	callContext;
 	fetchService;
 	persistService;
-	constructor(db, registry) {
+	constructor(db, registry, callContext) {
 		this.db = db;
 		this.registry = registry;
-		this.fetchService = new FetchService(db, registry);
-		this.persistService = new PersistService(db, registry);
+		this.callContext = callContext;
+		this.fetchService = new FetchService(db, registry, callContext);
+		this.persistService = new PersistService(db, registry, callContext);
 	}
 	/**
 	* Fetch a single row by ID
@@ -5570,6 +6272,10 @@ var WriteTransactionScope = class {
 	open = true;
 	inflight = /* @__PURE__ */ new Set();
 	commitHooks = [];
+	/** The first tracked statement that failed, whether or not its caller caught it. */
+	failure;
+	settledHooks = [];
+	settledContext;
 	/** The transaction handle, for statements in this package that are already written against drizzle. */
 	tx;
 	/** Attach the transaction, once it has begun. */
@@ -5600,7 +6306,10 @@ var WriteTransactionScope = class {
 		const done = () => {
 			this.inflight.delete(settled);
 		};
-		settled.then(done, done);
+		settled.then(done, (error) => {
+			this.failure ??= error;
+			done();
+		});
 		return settled;
 	}
 	afterCommit(fn) {
@@ -5617,6 +6326,65 @@ var WriteTransactionScope = class {
 		this.open = false;
 	}
 	/**
+	* Refuse to commit a transaction a failed statement has aborted.
+	*
+	* Once any statement fails, Postgres aborts the whole transaction, and
+	* catching the error in JavaScript does not undo that. The COMMIT that
+	* follows is answered with the tag `ROLLBACK` and no error, so the driver
+	* resolves it: the write reported success — 200, webhooks, realtime,
+	* the idempotency record — while nothing was stored. A callback that
+	* wrapped a lookup or a job enqueue in `try/catch` was enough.
+	*
+	* So one statement is asked of the transaction before its commit. On an
+	* aborted one it fails with `25P02`, and the write is refused and rolled
+	* back instead. A failed `context.data` write is not caught by this: it
+	* runs in a savepoint, is undone on its own, and leaves the transaction
+	* usable — which is what makes catching one safe.
+	*/
+	async assertCommittable() {
+		if (!this.tx) return;
+		try {
+			await this.tx.execute(sql`SELECT 1`);
+		} catch (error) {
+			if (extractPgError(error)?.code !== "25P02") throw error;
+			logger.error("[transaction] A statement on this write's transaction failed and its error was caught; the write was rolled back", { error: this.failure ?? error });
+			const refusal = new ApiError(500, "TRANSACTION_ABORTED", "A statement on this write's transaction failed and its error was caught. That aborts the transaction in Postgres, so the write was rolled back and nothing was stored. A failed `context.data` write is undone on its own and may be caught; any other failed statement (a read, a job enqueue) has to be let through.");
+			refusal.cause = this.failure ?? error;
+			throw refusal;
+		}
+	}
+	/**
+	* What a hook deferred with {@link afterSettled} is handed as `context`:
+	* the same caller, on a driver where every call is a transaction of its
+	* own. The write's transaction is gone by the time the hook runs, so a
+	* context bound to it would be bound to a connection back in the pool.
+	*/
+	setSettledContext(context) {
+		this.settledContext = context;
+	}
+	/**
+	* Run `fn` once this write's transaction is over, whichever way it went,
+	* outside it — for what a failure hook hands off (a job, a queue message,
+	* a webhook), which must not ride the transaction the failure rolls back.
+	* `false` when this scope has no context to hand it; the caller runs it
+	* itself then.
+	*/
+	afterSettled(fn) {
+		if (!this.settledContext) return false;
+		this.settledHooks.push(fn);
+		return true;
+	}
+	/** The transaction committed or rolled back: run what was waiting for either. */
+	async settled() {
+		const context = this.settledContext;
+		if (!context) return;
+		for (const hook of this.settledHooks.splice(0)) try {
+			await storage.run(void 0, () => hook(context));
+		} catch (error) {
+			logger.error("[transaction] A hook deferred to the end of the write threw", { error });
+		}
+	}
+	/**
 	* The transaction is over, whichever way it went. Nothing may reach it now:
 	* its client is back in the pool, and a callback's detached promise still
 	* carries this scope in its async context.
@@ -5734,7 +6502,15 @@ function classifyCollectionChanges(before, after, facts) {
 			});
 			continue;
 		}
-		classifyProperties(previous.get(slug), collection, changes, facts);
+		const was = previous.get(slug);
+		if (qualifiedTable(was) !== qualifiedTable(collection)) changes.push({
+			kind: "rename-table",
+			verdict: "needs-migration",
+			collection: slug,
+			detail: `"${slug}" moves from table "${qualifiedTable(was)}" to "${qualifiedTable(collection)}", which would create the new table empty and leave every row in the old one.`,
+			remedy: "The ensure path never renames or moves a table. Do it in a migration you have read (ALTER TABLE … RENAME TO, or SET SCHEMA), then change the collection to match."
+		});
+		classifyProperties(was, collection, changes, facts);
 	}
 	for (const [slug, collection] of previous) {
 		if (next.has(slug)) continue;
@@ -6043,6 +6819,13 @@ function effectiveSqlRole(requestedRole) {
 /** How {@link effectiveSqlRole} names "whatever role the connection holds". */
 var CONNECTION_OWNER = "<connection owner>";
 /**
+* What puts a session back after caller SQL: the session user and role, then
+* every setting. Two statements, because the extended protocol refuses a
+* multi-command string. Pinned settings (`search_path` from the connection's
+* startup options) come back as they were pinned.
+*/
+var RESET_SESSION_STATEMENTS = ["SET SESSION AUTHORIZATION DEFAULT", "RESET ALL"];
+/**
 * A statement named a database role the connection cannot assume.
 *
 * Its own type because the tempting recovery — run it anyway, as the owner — is
@@ -6062,6 +6845,66 @@ var RoleSwitchUnavailableError = class extends Error {
 	}
 };
 /**
+* Fold what a `beforeSave` returned into the values being saved.
+*
+* The hook returns the values that will be saved, so a key it returns replaces
+* the value outright: an array it filtered stays filtered, a map it narrowed
+* stays narrow. A key it leaves out keeps the value it was given, so a hook
+* that returns only the field it computed still saves the rest.
+*
+* Not a deep merge. `mergeDeep` merges arrays of objects element by element and
+* keeps every element past the end of the shorter one, so a hook that dropped
+* one line item of three had the last one merged back in and the order was
+* stored with a line duplicated.
+*/
+function applyBeforeSaveResult(values, result) {
+	return {
+		...values,
+		...result
+	};
+}
+/**
+* The keys of a create's final values that its INSERT alone may write: those
+* the caller did not send, no `beforeSave` hook wrote, and that are not an
+* `on_update` stamp — a declared default, a tenant stamp, a create-time stamp.
+* See `PersistSaveOptions.insertOnlyKeys`.
+*/
+function insertOnlyKeysOf(finalValues, callerValues, beforeHooks, afterHooks, properties) {
+	const sent = new Set(Object.keys(callerValues ?? {}));
+	const updateStamps = new Set(Object.entries(properties ?? {}).filter(([, property]) => property?.type === "date" && property.autoValue === "on_update" || property?.type === "string" && property.autoValue === "user_on_update").map(([key]) => key));
+	return Object.keys(finalValues).filter((key) => !sent.has(key) && !updateStamps.has(key) && beforeHooks[key] === afterHooks[key]);
+}
+/**
+* Refuse an update that stamps a `softDelete` collection's field.
+*
+* Stamping it IS the delete — every read hides the row from then on — so it is
+* `delete`'s to do, where the permission is `delete`, `beforeDelete` can veto,
+* `afterDelete` runs and history says "delete". Written by an update, a caller
+* holding only write access trashed rows, past all of that. Clearing it stays
+* an update: that is how a row is restored, and what a form sends back for a
+* live row.
+*/
+function assertUpdateDoesNotSoftDelete(collection, values, path) {
+	const softDelete = resolveSoftDelete(collection);
+	if (!softDelete) return;
+	const value = values?.[softDelete.field];
+	if (value === void 0 || value === null) return;
+	const slug = collection?.slug ?? path;
+	const message = `'${softDelete.field}' on '${slug}' records a delete, so an update may only clear it (null restores the row). Delete the row to set it.`;
+	throw ApiError.badRequest(message, "FIELD_NOT_WRITABLE", {
+		collection: slug,
+		violations: [{
+			field: softDelete.field,
+			code: "soft_delete",
+			message
+		}]
+	});
+}
+/** A key that names a row: not absent, and not the empty string a form sends. */
+function isPresentKey(id) {
+	return id !== void 0 && id !== null && id !== "";
+}
+/**
 * Refuse a write that would leave a *required* `created_by` / `updated_by`
 * column null because nobody is acting.
 *
@@ -6173,7 +7016,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		this.db = db;
 		this.registry = registry;
 		this.poolManager = poolManager;
-		this.dataService = new DataService(db, registry);
+		this.dataService = new DataService(db, registry, () => this.buildCallContext());
 		this.realtimeService = realtimeService;
 		this.historyService = historyService;
 		this.user = user;
@@ -6398,17 +7241,11 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			return out;
 		}));
 	}
-	async fetchCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, vectorSearch }) {
+	async fetchCollection({ path, collection, startAfter, ...query }) {
 		const rows = await this.dataService.fetchCollection(path, {
-			filter,
-			orderBy,
-			order,
-			limit,
-			offset,
+			...query,
 			startAfter,
-			databaseId: collection?.databaseId,
-			searchString,
-			vectorSearch
+			databaseId: collection?.databaseId
 		});
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
 		if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
@@ -6592,16 +7429,17 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		const { collection: slug, userField, tenantField } = tenant.from.membership;
 		const cap = PostgresBackendDriver.TENANT_MEMBERSHIP_CAP;
 		try {
-			const rows = await this.dataService.fetchCollection(slug, {
+			const rows = await withFieldViewer(void 0, () => this.dataService.fetchCollection(slug, {
 				filter: { [userField]: ["==", uid] },
 				limit: cap + 1,
 				databaseId: collection?.databaseId
-			});
+			}));
 			return {
 				tenants: Array.from(new Set(rows.slice(0, cap).map((row) => row[tenantField]).filter((value) => value !== null && value !== void 0).map((value) => typeof value === "object" ? value.id ?? value : value))),
 				complete: rows.length <= cap
 			};
 		} catch (err) {
+			if (reachedDatabase(err)) throw err;
 			logger.debug(`[save] Could not read '${slug}' to resolve the caller's tenants`, { detail: err instanceof Error ? err.message : String(err) });
 			return {
 				tenants: [],
@@ -6609,21 +7447,86 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			};
 		}
 	}
+	/**
+	* The stored row an upsert's key names, if this caller can address it —
+	* with its address and the values to update it with.
+	*
+	* Read as the caller reads: their policies and `beforeQuery` scope, and
+	* soft-deleted rows hidden, so a row found here is one an update may
+	* target. On the trusted plane for its fields only, like
+	* {@link resolveCallerTenants}: the key columns are the server's to see.
+	*
+	* `undefined` when the key is incomplete (the write is a plain insert,
+	* which is the persistence layer's rule too), when a key value is not a
+	* plain value, or when no such row is visible. None of those can write a
+	* stored row wrongly: the statement's own conflict branch sets only what
+	* the caller sent, and only on a row in their scope.
+	*
+	* The values drop the key and the conflict target, which the stored row
+	* already has: a natural-key upsert carrying a key the caller invented
+	* must not move the row onto it.
+	*/
+	async findUpsertTarget(path, collection, values, id, onConflict) {
+		const primaryKeys = getPrimaryKeys(collection, this.registry);
+		const key = { ...values };
+		if (isPresentKey(id)) Object.assign(key, parseIdValues$1(id, primaryKeys));
+		const targetFields = onConflict && onConflict.length > 0 ? [...onConflict] : primaryKeys.map((info) => info.fieldName);
+		if (targetFields.length === 0) return void 0;
+		const filter = {};
+		for (const field of targetFields) {
+			const value = key[field];
+			if (value === void 0 || value === null || value === "") return void 0;
+			if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return void 0;
+			filter[field] = ["==", value];
+		}
+		const [row] = await withFieldViewer(void 0, () => this.dataService.fetchCollectionForRest(path, {
+			filter,
+			limit: 1,
+			databaseId: collection.databaseId
+		}));
+		if (!row || targetFields.some((field) => String(row[field]) !== String(key[field]))) return void 0;
+		const rest = { ...values };
+		for (const field of [...primaryKeys.map((info) => info.fieldName), ...targetFields]) delete rest[field];
+		return {
+			id: deriveRowAddress(row, collection, this.registry),
+			values: rest
+		};
+	}
 	async save({ path, id, values, collection, status, upsert, onConflict }) {
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
+		if (status === "existing") assertUpdateDoesNotSoftDelete(resolvedCollection, values, path);
+		const upserting = upsert === true && status !== "existing";
+		if (upserting && resolvedCollection) {
+			const stored = await this.findUpsertTarget(path, resolvedCollection, values, id, onConflict);
+			if (stored) return this.save({
+				path,
+				id: stored.id,
+				values: stored.values,
+				collection,
+				status: "existing"
+			});
+		}
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
 		if ((status === "new" || status === "copy") && resolvedCollection?.properties) updatedValues = applyDefaultValuesOnCreate(updatedValues, resolvedCollection.properties);
 		let previousValuesForHistory;
-		if (status === "existing" && id) try {
-			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
-			if (existing) {
-				const { id: _existingId, ...existingValues } = existing;
-				previousValuesForHistory = existingValues;
+		if (status === "existing" && id) {
+			const gateOnScope = hasBeforeQuery(this.registry, resolvedCollection);
+			try {
+				const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
+				if (!existing && gateOnScope) throw ApiError.notFound(`No row "${id}" in "${path}" to update.`);
+				if (existing) {
+					const { id: _existingId, ...existingValues } = existing;
+					previousValuesForHistory = existingValues;
+				}
+			} catch (err) {
+				if (err instanceof ApiError) throw err;
+				if (reachedDatabase(err)) throw err;
+				logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
 			}
-		} catch (err) {
-			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
 		}
+		/** The row as the hooks receive it, to tell what they wrote. */
+		const beforeHooks = updatedValues;
 		try {
 			if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
 				const callbackCollection = requireCallbackCollection(resolvedCollection, path);
@@ -6637,7 +7540,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 						status,
 						context: contextForCallback
 					});
-					if (result) updatedValues = mergeDeep(updatedValues, result);
+					if (result) updatedValues = applyBeforeSaveResult(updatedValues, result);
 				}
 				if (callbacks?.beforeSave) {
 					const result = await callbacks.beforeSave({
@@ -6649,7 +7552,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 						status,
 						context: contextForCallback
 					});
-					if (result) updatedValues = mergeDeep(updatedValues, result);
+					if (result) updatedValues = applyBeforeSaveResult(updatedValues, result);
 				}
 				if (propertyCallbacks?.beforeSave) {
 					const result = await propertyCallbacks.beforeSave({
@@ -6661,12 +7564,13 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 						status,
 						context: contextForCallback
 					});
-					if (result) updatedValues = mergeDeep(updatedValues, result);
+					if (result) updatedValues = applyBeforeSaveResult(updatedValues, result);
 				}
 			}
 		} catch (callbackError) {
 			throw toCallbackError(callbackError, "beforeSave", path);
 		}
+		const afterHooks = updatedValues;
 		if (resolvedCollection?.properties) {
 			updatedValues = updateDateAutoValues({
 				inputValues: updatedValues,
@@ -6681,12 +7585,29 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				status: status ?? "new",
 				uid: this.user?.uid
 			});
+			if (status === "existing") {
+				const kept = { ...updatedValues };
+				for (const key of createStampKeys(resolvedCollection.properties)) delete kept[key];
+				updatedValues = kept;
+			}
 		}
 		updatedValues = await this.applyTenantScope(resolvedCollection, path, updatedValues, status ?? "new", previousValuesForHistory);
+		let writeId = id;
+		if ((status === "new" || status === "copy") && !upsert && isPresentKey(id) && resolvedCollection) {
+			updatedValues = {
+				...updatedValues,
+				...parseIdValues$1(id, getPrimaryKeys(resolvedCollection, this.registry))
+			};
+			writeId = void 0;
+		}
+		const insertOnlyKeys = upserting ? insertOnlyKeysOf(updatedValues, values, beforeHooks, afterHooks, resolvedCollection?.properties) : void 0;
+		const softDeleteField = resolveSoftDelete(resolvedCollection)?.field;
+		if (insertOnlyKeys && softDeleteField && updatedValues[softDeleteField] !== void 0 && updatedValues[softDeleteField] !== null) insertOnlyKeys.push(softDeleteField);
 		try {
-			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, {
-				upsert,
-				onConflict
+			let savedRow = await this.dataService.save(path, updatedValues, writeId, resolvedCollection?.databaseId, {
+				upsert: upserting,
+				onConflict,
+				insertOnlyKeys
 			});
 			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
 				const callbackCollection = requireCallbackCollection(resolvedCollection, path);
@@ -6746,9 +7667,9 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				throw toCallbackError(callbackError, "afterSave", path);
 			}
 			if (this.historyService && resolvedCollection?.history) await this.historyService.recordHistory({
-				tableName: path,
+				tableName: resolvedCollection.slug,
 				id: savedId,
-				action: status === "new" ? "create" : "update",
+				action: status === "existing" ? "update" : "create",
 				values: savedValues,
 				previousValues: previousValuesForHistory,
 				updatedBy: this.user?.uid
@@ -6764,27 +7685,31 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		} catch (error) {
 			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
 				const callbackCollection = requireCallbackCollection(resolvedCollection, path);
-				const errorProps = {
-					path,
-					id,
-					values: updatedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					error,
-					context: contextForCallback
+				const runHooks = async (context) => {
+					const errorProps = {
+						collection: callbackCollection,
+						path,
+						id,
+						values: updatedValues,
+						previousValues: previousValuesForHistory,
+						status,
+						error,
+						context
+					};
+					for (const [tier, hook] of [
+						["global", globalCallbacks?.afterSaveError],
+						["collection", callbacks?.afterSaveError],
+						["property", propertyCallbacks?.afterSaveError]
+					]) {
+						if (!hook) continue;
+						try {
+							await hook(errorProps);
+						} catch (hookError) {
+							logger.error(`[save] The ${tier} afterSaveError hook for "${path}" threw; answering with the save's own failure`, { error: hookError });
+						}
+					}
 				};
-				if (globalCallbacks?.afterSaveError) await globalCallbacks.afterSaveError({
-					collection: callbackCollection,
-					...errorProps
-				});
-				if (callbacks?.afterSaveError) await callbacks.afterSaveError({
-					collection: callbackCollection,
-					...errorProps
-				});
-				if (propertyCallbacks?.afterSaveError) await propertyCallbacks.afterSaveError({
-					collection: callbackCollection,
-					...errorProps
-				});
+				if (!currentWriteScope()?.afterSettled(runHooks)) await runHooks(contextForCallback);
 			}
 			throw error;
 		}
@@ -6803,7 +7728,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	*/
 	bindToTransaction(tx) {
 		const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
-		txDriver.dataService = new DataService(tx, this.registry);
+		txDriver.dataService = new DataService(tx, this.registry, () => txDriver.buildCallContext());
 		txDriver.client = this.client;
 		txDriver._deferNotifications = this._deferNotifications;
 		txDriver._pendingNotifications = this._pendingNotifications;
@@ -6825,7 +7750,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	*/
 	callContextWithin(tx, user) {
 		const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, user, this.poolManager, this.historyService);
-		txDriver.dataService = new DataService(tx, this.registry);
+		txDriver.dataService = new DataService(tx, this.registry, () => txDriver.buildCallContext());
 		txDriver.client = this.client;
 		return txDriver.buildCallContext();
 	}
@@ -6882,7 +7807,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 					if (!await txDriver.fetchOne({
 						path,
 						id: String(id),
-						collection
+						collection,
+						withDeleted: restoresSoftDeletedRow(collection ?? this.registry?.getCollectionByPath(path), values) ? true : void 0
 					})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
 						statusCode: 404,
 						code: "NOT_FOUND"
@@ -6992,7 +7918,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 							if (!await txDriver.fetchOne({
 								path: operation.path,
 								id,
-								collection: operation.collection
+								collection: operation.collection,
+								withDeleted: restoresSoftDeletedRow(operation.collection ?? this.registry?.getCollectionByPath(operation.path), values) ? true : void 0
 							})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
 								statusCode: 404,
 								code: "NOT_FOUND"
@@ -7077,7 +8004,9 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		} catch (callbackError) {
 			throw toCallbackError(callbackError, "beforeDelete", targetPath);
 		}
-		const softDelete = hard ? void 0 : resolveSoftDelete(resolvedCollection);
+		const hop = isNestedPath(targetPath) ? resolveNestedPath(targetPath, this.registry) : void 0;
+		const unlinking = hop !== void 0 && isJunctionBackedRelation(hop.relation);
+		const softDelete = hard || unlinking ? void 0 : resolveSoftDelete(resolvedCollection);
 		if (softDelete) await this.dataService.save(targetPath, { [softDelete.field]: /* @__PURE__ */ new Date() }, row.id, resolvedCollection?.databaseId);
 		else await this.dataService.delete(targetPath, row.id, resolvedCollection?.databaseId);
 		try {
@@ -7108,8 +8037,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		} catch (callbackError) {
 			throw toCallbackError(callbackError, "afterDelete", targetPath);
 		}
-		if (this.historyService && resolvedCollection?.history) await this.historyService.recordHistory({
-			tableName: targetPath,
+		if (this.historyService && resolvedCollection?.history && !unlinking) await this.historyService.recordHistory({
+			tableName: resolvedCollection.slug,
 			id: row.id.toString(),
 			action: "delete",
 			values: stored,
@@ -7164,8 +8093,48 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		return sql.join(chunks, sql.raw(""));
 	}
 	async executeSql(sqlText, options) {
+		if (options?.isolateSession) return this.onIsolatedSession(this.getTargetDb(options.database), (db) => this.executeSqlOn(db, sqlText, options));
 		if (!options?.database && !options?.role) return this.dataService.executeSql(sqlText, options?.params);
-		const targetDb = this.getTargetDb(options?.database);
+		return this.executeSqlOn(this.getTargetDb(options?.database), sqlText, options);
+	}
+	/**
+	* Run `fn` on a session of its own, and put that session back the way it
+	* was handed out before anything else can use it.
+	*
+	* For SQL a person wrote — the Studio editor. It may `SET ROLE`,
+	* `SET SESSION AUTHORIZATION` or `set_config(…, false)`, which outlive the
+	* statement (and a transaction's commit) and stay on the connection. On a
+	* pooled one they were inherited by whatever checked it out next: an auth
+	* lookup, the job store or history running as `rebase_user`, on one
+	* connection in N, until a restart. `SET SESSION AUTHORIZATION DEFAULT`
+	* clears the role as well, which `RESET ALL` does not.
+	*
+	* A connection that cannot be reset — the statement left a transaction
+	* open or aborted — is destroyed rather than returned. A handle that is
+	* already one session (PGlite in process, a single client) is reset in
+	* place.
+	*/
+	async onIsolatedSession(targetDb, fn) {
+		const pool = "$client" in targetDb ? targetDb.$client : void 0;
+		if (!(pool instanceof Pool)) try {
+			return await fn(targetDb);
+		} finally {
+			for (const statement of RESET_SESSION_STATEMENTS) await targetDb.execute(sql.raw(statement)).catch((error) => logger.error("[PostgresBackendDriver] Could not reset the session after caller SQL", { error }));
+		}
+		const connection = await pool.connect();
+		let reusable = true;
+		try {
+			return await fn(drizzle(connection));
+		} finally {
+			try {
+				for (const statement of RESET_SESSION_STATEMENTS) await connection.query(statement);
+			} catch {
+				reusable = false;
+			}
+			connection.release(reusable ? void 0 : true);
+		}
+	}
+	async executeSqlOn(targetDb, sqlText, options) {
 		try {
 			let needsRoleSwitch = false;
 			if (options?.role) try {
@@ -7345,14 +8314,15 @@ var PostgresBackendDriver = class PostgresBackendDriver {
               AND ccu2.table_name != ${safeName};
         `)).rows,
 			policies: (await this.db.execute(sql`
-            SELECT 
-                polname as policy_name, 
-                polcmd as cmd, 
-                polroles::regrole[]::text[] as roles, 
-                pg_get_expr(polqual, polrelid) as qual, 
-                pg_get_expr(polwithcheck, polrelid) as with_check
-            FROM pg_policy
-            WHERE polrelid = (SELECT oid FROM pg_class WHERE relname = ${safeName} AND relnamespace = 'public'::regnamespace);
+            SELECT
+                policyname AS policy_name,
+                permissive,
+                cmd,
+                roles::text[] AS roles,
+                qual,
+                with_check
+            FROM pg_policies
+            WHERE schemaname = 'public' AND tablename = ${safeName};
         `)).rows
 		};
 	}
@@ -7407,11 +8377,22 @@ var AuthenticatedPostgresBackendDriver = class {
 	async withTransaction(operation, options) {
 		const pendingNotifications = [];
 		const writeScope = options?.accessMode === "read only" ? void 0 : new WriteTransactionScope();
+		const client = this.delegate.client;
+		writeScope?.setSettledContext({
+			user: this.user,
+			driver: this,
+			data: this.data,
+			get client() {
+				return requireCallbackClient(client);
+			},
+			storageSource: client?.storage
+		});
 		const result = await withFieldViewer({ roles: this.user?.roles ?? [] }, async () => await runInWriteScope(writeScope, () => this.delegate.db.transaction(async (tx) => {
 			if (!this.user?.uid) logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
 			if (!this.user?.roles) logger.warn("[DataDriver] User roles are missing for authenticated delegate. Using empty array. User object", { detail: this.user });
 			await applyAuthContext(tx, authContextOf(this.user), this.delegate.rlsUserRole);
-			const txEntityService = new DataService(tx, this.delegate.registry);
+			let hookContext;
+			const txEntityService = new DataService(tx, this.delegate.registry, () => hookContext ??= this.delegate.callContextWithin(tx, this.user));
 			const txDelegate = new PostgresBackendDriver(tx, this.delegate.realtimeService, this.delegate.registry, this.user, this.delegate.poolManager, this.delegate.historyService);
 			txDelegate.dataService = txEntityService;
 			txDelegate._deferNotifications = true;
@@ -7426,9 +8407,14 @@ var AuthenticatedPostgresBackendDriver = class {
 				throw error;
 			}
 			await writeScope?.settle();
+			await writeScope?.assertCommittable();
 			return out;
-		}, options)).finally(() => writeScope?.close()));
+		}, options)).finally(() => writeScope?.close())).catch(async (error) => {
+			await writeScope?.settled();
+			throw error;
+		});
 		writeScope?.committed();
+		await writeScope?.settled();
 		for (const notification of pendingNotifications) try {
 			await this.delegate.realtimeService.notifyUpdate(notification.path, notification.id, notification.row, notification.databaseId);
 		} catch (e) {
@@ -7797,6 +8783,41 @@ function buildJunctionLinkMap(registry) {
 	return map;
 }
 //#endregion
+//#region src/services/read-field-access.ts
+/**
+* Refuse a read that names a field its caller may not read, for the doors that
+* take a driver-shaped request rather than a query string: the socket's
+* `FETCH_COLLECTION`, `COUNT` and `CHECK_UNIQUE_FIELD`, and `subscribe_collection`.
+* Callers hand it the request itself, not a re-listed copy of some of its keys.
+*
+* The row strip keeps a withheld value off the wire; this is the other half, and
+* without it the value is still readable one predicate at a time — a `COUNT`
+* filtered on `passwordHash like '$2b$10$A%'` answers 1 or 0. `GET /api/data`
+* refuses the same request with `FIELD_NOT_READABLE`, and this is that rule, not
+* a copy of it: only the request's shape is translated here.
+*
+* The shape arrives as whatever JSON the client sent, so it is read defensively.
+* A malformed `orderBy` or `fields` is not this check's to reject; the entries
+* that name a field are checked and the rest are left for the driver to refuse.
+*/
+function assertReadRequestReadable(request, collection, viewer) {
+	const vectorProperty = request.vectorSearch && typeof request.vectorSearch === "object" ? request.vectorSearch.property : void 0;
+	assertQueryFieldsReadable({
+		where: request.filter && typeof request.filter === "object" ? request.filter : void 0,
+		logical: request.logical,
+		orderBy: sortedFields(request.orderBy),
+		fields: Array.isArray(request.fields) ? request.fields : void 0,
+		include: request.include ?? void 0,
+		vectorSearch: typeof vectorProperty === "string" ? { property: vectorProperty } : void 0
+	}, collection, viewer);
+}
+/** The fields an `orderBy` sorts on, in either of its two spellings. */
+function sortedFields(orderBy) {
+	if (typeof orderBy === "string") return [{ field: orderBy }];
+	if (!Array.isArray(orderBy)) return void 0;
+	return orderBy.flatMap((entry) => Array.isArray(entry) && typeof entry[0] === "string" ? [{ field: entry[0] }] : []);
+}
+//#endregion
 //#region src/services/cdc/trigger-cdc.ts
 /**
 * Trigger-based Change Data Capture (CDC).
@@ -7829,6 +8850,11 @@ var CDC_TRIGGER_NAME = "rebase_cdc_trigger";
 * statement* if the limit is exceeded. We stay comfortably under it and, for
 * wide rows, fall back to an identity-only payload so CDC can never break a
 * write. 7900 leaves headroom for the JSON envelope keys.
+*
+* The identity is every primary-key column, read from the catalogue for the
+* table that fired — `id` only where the table declares no primary key. It
+* used to be `id` alone, so a wide row of a table keyed on anything else
+* arrived with no key at all and reached no single-row subscriber.
 */
 var MAX_NOTIFY_BYTES = 7900;
 var quoteIdent = (name) => `"${name.replace(/"/g, "\"\"")}"`;
@@ -7852,6 +8878,7 @@ LANGUAGE plpgsql AS $rebase_cdc$
 DECLARE
     rec     jsonb;
     payload text;
+    ident   jsonb;
 BEGIN
     IF (TG_OP = 'DELETE') THEN
         rec := to_jsonb(OLD);
@@ -7870,11 +8897,18 @@ BEGIN
     -- 8000-byte cap, emit an identity-only payload the consumer can still route
     -- (and refetch the authoritative row from).
     IF (octet_length(payload) > ${MAX_NOTIFY_BYTES}) THEN
+        SELECT jsonb_object_agg(a.attname, rec->a.attname) INTO ident
+        FROM pg_index i
+        JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum = ANY (i.indkey)
+        WHERE i.indrelid = TG_RELID AND i.indisprimary;
+        IF ident IS NULL THEN
+            ident := CASE WHEN rec ? 'id' THEN jsonb_build_object('id', rec->'id') ELSE '{}'::jsonb END;
+        END IF;
         payload := json_build_object(
             'schema',    TG_TABLE_SCHEMA,
             'table',     TG_TABLE_NAME,
             'op',        TG_OP,
-            'row',       CASE WHEN rec ? 'id' THEN jsonb_build_object('id', rec->'id') ELSE '{}'::jsonb END,
+            'row',       ident,
             'truncated', true
         )::text;
     END IF;
@@ -8023,6 +9057,15 @@ var PgNotifyListener = class {
 			if (initial) throw err;
 			logger.error(`❌ ${logLabel} Failed to connect LISTEN client`, { error: err });
 			this.scheduleReconnect();
+			return;
+		}
+		if (!initial && this.options.onReconnect) {
+			logger.warn(`⚠️ ${logLabel} LISTEN client reconnected; anything published while it was down was missed.`);
+			try {
+				this.options.onReconnect();
+			} catch (err) {
+				logger.error(`❌ ${logLabel} Error resyncing after a reconnect`, { error: err });
+			}
 		}
 	}
 	scheduleReconnect() {
@@ -8079,11 +9122,17 @@ function parseCdcPayload(payload) {
 */
 var CdcListener = class {
 	listener;
-	constructor(connectionString, onEvent) {
+	/**
+	* @param onReconnect Called when the connection is listening again after a
+	*        drop. Every change committed in the gap was notified to nobody, so
+	*        this is where subscribers are told to look again.
+	*/
+	constructor(connectionString, onEvent, onReconnect) {
 		this.listener = new PgNotifyListener({
 			connectionString,
 			channel: CDC_CHANNEL,
 			logLabel: "[CDC]",
+			onReconnect,
 			onPayload: (payload) => {
 				const event = parseCdcPayload(payload);
 				if (!event) {
@@ -8921,6 +9970,23 @@ function callbackContextWithin(driver, tx, auth) {
 	});
 }
 /**
+* How long a client gets to answer the close frame at shutdown before its
+* socket is dropped. `ws` would otherwise wait its own 30s close timeout, which
+* is longer than the whole shutdown budget.
+*/
+var WEBSOCKET_CLOSE_GRACE_MS = 1e3;
+/**
+* Close each socket with 1001, and terminate the ones still open after
+* `graceMs`. Nothing here waits: the HTTP server's close() is what waits for
+* the sockets to end.
+*/
+function closeWebSockets(sockets, graceMs) {
+	for (const ws of sockets) {
+		if (ws.readyState === WebSocket.OPEN) ws.close(1001, "server shutting down");
+		if (ws.readyState !== WebSocket.CLOSED) unref(setTimeout(() => ws.terminate(), graceMs));
+	}
+}
+/**
 * PostgreSQL-specific realtime service.
 * Handles WebSocket connections and subscriptions for real-time row updates.
 *
@@ -9037,8 +10103,20 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* and always flow through. Keyed → expiry timestamp (ms).
 	*/
 	recentAppEmits = /* @__PURE__ */ new Map();
-	/** How long an app-emit key suppresses its own CDC echo. Covers NOTIFY round-trip latency. */
-	static CDC_DEDUP_WINDOW_MS = 5e3;
+	/**
+	* How long an app-emit key suppresses its own CDC echo: the refetch
+	* debounce, and no longer.
+	*
+	* The mark cannot tell an echo from another writer's change to the same
+	* row, and a save that touches no row of the table (a to-many relation
+	* only, an empty payload) is announced with no echo ever coming to consume
+	* it. Held for seconds, it swallowed the next change psql, a cron or
+	* another instance made to that row. Inside the debounce nothing is lost:
+	* the refetch the app emit scheduled has not started yet — its timer fires
+	* no earlier than this — and it reads after any commit whose NOTIFY has
+	* already arrived. An echo later than that costs one more refetch.
+	*/
+	static CDC_DEDUP_WINDOW_MS = RealtimeService.REFETCH_DEBOUNCE_MS;
 	constructor(db, registry) {
 		super();
 		this.db = db;
@@ -9263,7 +10341,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		const subscriptionId = request.subscriptionId;
 		let canDeliver;
 		try {
-			if (!this.registry.getCollectionByPath(request.path)) {
+			const collection = this.registry.getCollectionByPath(request.path);
+			if (!collection) {
 				const registered = this.registry.getCollections().map((c) => c.slug).join(", ");
 				const msg = `Collection not found: '${request.path}'. Registered: [${registered}]`;
 				logger.error(`[RealtimeService] ${msg}`);
@@ -9294,6 +10373,17 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				this.sendError(clientId, e.message, subscriptionId, e.code);
 				return;
 			}
+			try {
+				assertReadRequestReadable({
+					...request,
+					orderBy
+				}, collection, { roles: authContext?.roles ?? ["anon"] });
+			} catch (e) {
+				if (!(e instanceof ApiError)) throw e;
+				logger.warn(`[RealtimeService] Refused subscription to '${request.path}': ${e.message}`);
+				this.sendError(clientId, e.message, subscriptionId, e.code);
+				return;
+			}
 			const subscription = {
 				clientId,
 				type: "collection",
@@ -9372,6 +10462,76 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (canDeliver && !canDeliver.mayReportFailure()) return;
 		this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
 	}
+	/**
+	* Re-judge everything a socket holds open as the identity it has now.
+	*
+	* A socket re-authenticates on every session refresh, and when a role is
+	* taken away, a tenant claim removed or a different account signs in, the
+	* next token says so. Requests read as the new identity at once; the
+	* subscriptions kept refetching as the one they were opened with, so a
+	* demoted user went on receiving editor-only or another tenant's rows for
+	* as long as the view stayed mounted.
+	*
+	* Each of this client's subscriptions is replaced by one carrying the new
+	* identity — a replacement, so a refetch already running as the old one
+	* cannot deliver — and refetched, so the view narrows now rather than at
+	* the next write. A subscription whose filter, sort or projection names a
+	* field the new roles may not read is ended with the refusal a new
+	* subscription would get. Channel memberships are put to the authorizer
+	* again, when one is installed, and left when it refuses.
+	*/
+	async rescopeClient(clientId, authContext) {
+		for (const [subscriptionId, subscription] of [...this._subscriptions.entries()]) {
+			if (subscription.clientId !== clientId) continue;
+			if (subscription.type === "collection" && subscription.collectionRequest) {
+				const collection = this.registry.getCollectionByPath(subscription.path);
+				const request = subscription.collectionRequest;
+				try {
+					if (collection) assertReadRequestReadable({
+						filter: request.filter,
+						logical: request.logical,
+						orderBy: request.orderBy,
+						fields: request.fields
+					}, collection, { roles: authContext.roles ?? ["anon"] });
+				} catch (e) {
+					if (!(e instanceof ApiError)) throw e;
+					await this.handleUnsubscribe(clientId, subscriptionId);
+					this.sendError(clientId, e.message, subscriptionId, e.code);
+					continue;
+				}
+			}
+			const rescoped = {
+				...subscription,
+				authContext,
+				started: 0,
+				delivered: 0
+			};
+			this._subscriptions.set(subscriptionId, rescoped);
+			if (rescoped.type === "single" && rescoped.id !== void 0) this.debouncedSingleRefetch(subscriptionId, rescoped.path, String(rescoped.id), rescoped);
+			else if (rescoped.type === "collection" && rescoped.collectionRequest) this.debouncedCollectionRefetch(subscriptionId, rescoped.path, rescoped);
+		}
+		const authorizer = this.channelAuthorizer;
+		if (!authorizer) return;
+		for (const [channel, members] of [...this.channels.entries()]) {
+			if (!members.has(clientId)) continue;
+			let allowed;
+			try {
+				allowed = await authorizer({
+					channel,
+					action: "join",
+					clientId,
+					user: authContext
+				});
+			} catch (error) {
+				logger.error(`❌ [Channels] Authorizer threw re-checking "${channel}" after a sign-in — leaving it`, { error });
+				allowed = false;
+			}
+			if (!allowed) {
+				this.leaveChannel(clientId, channel);
+				this.denyChannelAction(clientId, channel, "join", "refused by the channel authorizer for the identity this socket signed in as");
+			}
+		}
+	}
 	async handleUnsubscribe(_clientId, subscriptionId) {
 		this._subscriptions.delete(subscriptionId);
 		this.subscriptionCallbacks.delete(subscriptionId);
@@ -9402,6 +10562,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	*/
 	async notifyUpdate(path, id, row, databaseId, broadcast = true, origin = "app") {
 		this.debugLog("🔔 [RealtimeService] notifyUpdate called for path:", path, "id:", id, "isDelete:", row === null, "origin:", origin);
+		const aliases = this.aliasPaths(path);
 		if (this.cdcActive) {
 			const key = this.dedupKey(path, id, databaseId);
 			if (origin === "cdc") {
@@ -9409,7 +10570,13 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					this.debugLog("🔁 [RealtimeService] Suppressing CDC echo of local app mutation:", key);
 					return;
 				}
-			} else this.markAppEmit(key);
+			} else {
+				this.markAppEmit(key);
+				if (isNestedPath(path)) {
+					const root = aliases.find((alias) => !isNestedPath(alias));
+					if (root) this.markAppEmit(this.dedupKey(root, id, databaseId));
+				}
+			}
 		}
 		const pathsToNotify = [path];
 		if (path.includes("/") && path.split("/").length > 1) {
@@ -9418,6 +10585,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			this.debugLog(`🔗 [RealtimeService] Nested path detected. Will notify paths: ${pathsToNotify.join(", ")}`);
 		}
 		for (const notifyPath of pathsToNotify) await this.notifyPathUpdate(notifyPath, path, id, row, databaseId);
+		for (const alias of aliases) await this.notifyPathUpdate(alias, alias, id, row, databaseId);
 		if (broadcast && this.broadcasting && !this.cdcActive) try {
 			await this.broadcastChange(path, id, databaseId);
 		} catch (err) {
@@ -9566,7 +10734,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					isAnonymous: activeAuth.isAnonymous === true,
 					claims: activeAuth.claims
 				}, this.rlsUserRole);
-				const fetchedEntities = await new DataService(tx, this.registry).fetchCollectionForRest(notifyPath, {
+				let hookContext;
+				const fetchedEntities = await new DataService(tx, this.registry, () => hookContext ??= callbackContextWithin(this.driver, tx, activeAuth)).fetchCollectionForRest(notifyPath, {
 					filter: collectionRequest.filter,
 					logical: collectionRequest.logical,
 					orderBy: collectionRequest.orderBy,
@@ -9615,7 +10784,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					}));
 				}
 				return fetchedEntities;
-			}));
+			}, { accessMode: "read only" }));
 		}
 		return await withFieldViewer({ roles: authContext?.roles ?? [] }, async () => await this.dataService.fetchCollectionForRest(notifyPath, {
 			filter: collectionRequest.filter,
@@ -9665,8 +10834,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 						isAnonymous: activeAuth.isAnonymous === true,
 						claims: activeAuth.claims
 					}, this.rlsUserRole);
-					return countOnce(new DataService(tx, this.registry));
-				});
+					let hookContext;
+					return countOnce(new DataService(tx, this.registry, () => hookContext ??= callbackContextWithin(this.driver, tx, activeAuth)));
+				}, { accessMode: "read only" });
 			} else total = await countOnce(this.dataService);
 		} catch (error) {
 			logger.warn(`[RealtimeService] Could not count '${notifyPath}' for a subscription frame`, { error });
@@ -9744,7 +10914,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					isAnonymous: activeAuth.isAnonymous === true,
 					claims: activeAuth.claims
 				}, this.rlsUserRole);
-				let processedEntity = await new DataService(tx, this.registry).fetchOneForRest(notifyPath, id, void 0, collection?.databaseId) ?? void 0;
+				let hookContext;
+				let processedEntity = await new DataService(tx, this.registry, () => hookContext ??= callbackContextWithin(this.driver, tx, activeAuth)).fetchOneForRest(notifyPath, id, void 0, collection?.databaseId) ?? void 0;
 				if (processedEntity) {
 					const registryCollection = this.registry.getCollectionByPath(notifyPath);
 					const resolvedCollection = collection ? {
@@ -9778,7 +10949,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					}
 				}
 				return processedEntity;
-			}));
+			}, { accessMode: "read only" }));
 		}
 		return await withFieldViewer({ roles: authContext?.roles ?? [] }, async () => await this.dataService.fetchOneForRest(notifyPath, id) ?? void 0);
 	}
@@ -9857,6 +11028,39 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* Extract parent paths from a nested path like "posts/70/tags"
 	* Returns ["posts", "posts/70"] for the example above
 	*/
+	/**
+	* The other paths a subscriber can address the row written at `path` by.
+	*
+	* `authors/1/posts` and `posts` are two addresses for the same rows, and
+	* subscriptions were matched by the written path's exact string. So a post
+	* saved through `authors/1/posts` never reached a subscriber of `posts` or
+	* of `posts/43`, and one saved through `posts` never reached a subscriber
+	* of `authors/1/posts`, whose list it may just have joined or left.
+	*
+	* The aliases are the target collection's root path, and every nested path
+	* a live subscription holds that lands on the same collection. Each still
+	* refetches under its own scope and its own parent, so naming a path here
+	* decides only who is asked to look again — never what they are shown.
+	*/
+	aliasPaths(path) {
+		const slug = this.collectionSlugAt(path);
+		if (!slug) return [];
+		const aliases = /* @__PURE__ */ new Set();
+		if (slug !== path) aliases.add(slug);
+		for (const subscription of this._subscriptions.values()) {
+			if (subscription.path === path || aliases.has(subscription.path) || !isNestedPath(subscription.path)) continue;
+			if (this.collectionSlugAt(subscription.path) === slug) aliases.add(subscription.path);
+		}
+		return [...aliases];
+	}
+	/** The slug of the collection a path lands on, or `undefined` for one that names none. */
+	collectionSlugAt(path) {
+		try {
+			return this.registry.getCollectionByPath(path)?.slug;
+		} catch {
+			return;
+		}
+	}
 	getParentPaths(path) {
 		const segments = path.split("/").filter((s) => s.length > 0);
 		const parentPaths = [];
@@ -10429,8 +11633,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	*  1. All debounced refetch timers are cancelled (prevents queries after pool closes).
 	*  2. All subscription state and callbacks are cleared.
 	*  3. The dedicated LISTEN client (outside the pool) is disconnected.
-	*  4. All WebSocket clients are removed (but not forcefully closed — the
-	*     HTTP server close will handle that).
+	*  4. All WebSocket clients are closed with 1001 ("going away"); one that
+	*     does not answer the close frame is dropped after a short grace.
 	*/
 	async destroy() {
 		for (const [key, timer] of this.refetchTimers) {
@@ -10465,7 +11669,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		await this.stopCdc();
 		await this.bus.stop().catch((error) => logger.warn("⚠️ [ChannelBus] Error while stopping the channel bus", { error }));
 		this.bus = new MemoryChannelBus();
+		const sockets = [...this.clients.values()];
 		this.clients.clear();
+		closeWebSockets(sockets, WEBSOCKET_CLOSE_GRACE_MS);
 		this.debugLog("🧹 [RealtimeService] destroy() complete — all resources released.");
 	}
 	/** Whether database-level change capture is currently the active source. */
@@ -10496,7 +11702,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		this.cdcTableMap = this.buildCdcTableMap();
 		this.junctionLinkMap = buildJunctionLinkMap(this.registry);
-		this.cdcListener = new CdcListener(connectionString, (event) => this.handleCdcEvent(event));
+		this.cdcListener = new CdcListener(connectionString, (event) => this.handleCdcEvent(event), () => this.resyncSubscriptions());
 		try {
 			await this.cdcListener.start();
 		} catch (err) {
@@ -10509,6 +11715,32 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		this.cdcActive = true;
 		logger.debug(`📡 [RealtimeService] Database-level change capture ACTIVE — writes from ANY source now emit realtime events (${this.cdcTableMap.size} mapped table key(s)).`);
 	}
+	/**
+	* Refetch every live subscription, as a change to its path would.
+	*
+	* Called when a LISTEN connection (CDC, or the cross-instance broadcast)
+	* is listening again after a drop. Postgres does not queue NOTIFY for a
+	* session that is not listening, so every change committed while it was
+	* down — by another instance, psql, a cron — reached nobody here, and a
+	* subscriber held its pre-gap rows until some later change to the same
+	* collection happened to arrive. Each refetch runs under the
+	* subscription's own scope, so this decides only who looks again.
+	*/
+	resyncSubscriptions() {
+		for (const [subscriptionId, subscription] of this._subscriptions.entries()) try {
+			if (subscription.clientId === "driver") {
+				const callback = this.subscriptionCallbacks.get(subscriptionId);
+				if (!callback) continue;
+				if (subscription.type === "single" && subscription.id !== void 0) this.debouncedSingleDriverRefetch(subscriptionId, subscription.path, String(subscription.id), subscription, callback);
+				else if (subscription.type === "collection" && subscription.collectionRequest) this.debouncedDriverRefetch(subscriptionId, subscription.path, subscription, callback);
+			} else if (this.clients.has(subscription.clientId)) {
+				if (subscription.type === "single" && subscription.id !== void 0) this.debouncedSingleRefetch(subscriptionId, subscription.path, String(subscription.id), subscription);
+				else if (subscription.type === "collection" && subscription.collectionRequest) this.debouncedCollectionRefetch(subscriptionId, subscription.path, subscription);
+			}
+		} catch (error) {
+			logger.error(`❌ [RealtimeService] Could not resync subscription ${subscriptionId}`, { error });
+		}
+	}
 	/** Stop the CDC listener and clear its state. */
 	async stopCdc() {
 		this.cdcActive = false;
@@ -10598,7 +11830,29 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	}
 	/** Compute the canonical (possibly composite) id string from a captured row. */
 	extractIdFromCdcRow(collection, row) {
-		return deriveRowAddress(row, collection, this.registry) || "*";
+		return deriveRowAddress(this.cdcRowByKeyFields(collection, row), collection, this.registry) || "*";
+	}
+	/**
+	* A captured row with its key under the key's *field* names.
+	*
+	* The trigger captures the tuple by column — `user_id` — and an address is
+	* built from the key's property names — `userId`. Read by property name
+	* alone, a key declared apart from its column was never on the captured
+	* row, the address fell back to `*`, and no single-row subscriber heard
+	* about any write made outside this server.
+	*/
+	cdcRowByKeyFields(collection, row) {
+		const table = this.registry.getTable(getTableName$1(collection));
+		const columns = table ? getTableColumns(table) : void 0;
+		const keyed = { ...row };
+		for (const pk of getPrimaryKeys(collection, this.registry)) {
+			if (pk.fieldName in row) continue;
+			const property = collection.properties?.[pk.fieldName];
+			const declared = property && "columnName" in property ? property.columnName : void 0;
+			const columnName = columns?.[pk.fieldName]?.name ?? declared ?? toSnakeCase(pk.fieldName);
+			if (columnName in row) keyed[pk.fieldName] = row[columnName];
+		}
+		return keyed;
 	}
 	dedupKey(path, id, databaseId) {
 		return `${databaseId ?? ""}::${path}::${id}`;
@@ -10670,8 +11924,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	}
 	/**
 	* Create and connect the dedicated LISTEN client with auto-reconnect.
+	*
+	* @param reconnect Set when the client is coming back from a drop: every
+	*        notification published in the gap is gone, so the subscriptions
+	*        are refetched once it is listening again.
 	*/
-	async connectListenClient() {
+	async connectListenClient({ reconnect = false } = {}) {
 		if (!this.listenConnectionString) return;
 		let pending;
 		try {
@@ -10717,6 +11975,10 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			this.listenClient = client;
 			pending = void 0;
 			this.debugLog(`📡 [RealtimeService] LISTEN client connected on channel "${PG_NOTIFY_CHANNEL}"`);
+			if (reconnect) {
+				logger.warn("⚠️ [RealtimeService] LISTEN client reconnected; refetching every subscription for what it missed.");
+				this.resyncSubscriptions();
+			}
 		} catch (err) {
 			if (pending) try {
 				await pending.end();
@@ -10741,7 +12003,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				} catch {}
 				this.listenClient = void 0;
 			}
-			await this.connectListenClient();
+			await this.connectListenClient({ reconnect: true });
 		}, delay);
 	}
 };
@@ -10776,6 +12038,17 @@ var WS_RATE_WINDOW_MS = 6e4;
 * a considered product limit (see `docs/channel-authorization.md`).
 */
 var WS_CHANNEL_RATE_LIMIT = 7200;
+/**
+* The largest frame a socket that has not authenticated may send, in bytes.
+*
+* All such a socket can usefully say is `AUTHENTICATE` with a token — a few
+* KiB with custom claims — and everything else is answered `UNAUTHORIZED`.
+* Without this, each of those answers came after the whole frame was buffered,
+* stringified and parsed, up to the body limit: a handful of connections that
+* never signed in could hold the process's memory. A larger frame closes the
+* socket with 1009 before it is read.
+*/
+var MAX_UNAUTHENTICATED_FRAME_BYTES = 64 * 1024;
 /** Frames counted against the channel budget rather than the general one. */
 var CHANNEL_MESSAGE_TYPES = /* @__PURE__ */ new Set([
 	"join_channel",
@@ -10877,7 +12150,33 @@ function isAdminSession(session) {
 	if (!session.user.roles) return false;
 	return session.user.roles.some((r) => r === "admin");
 }
-function createPostgresWebSocket(server, realtimeService, driver, authConfig, authAdapter) {
+/** A frame's size in bytes, however `ws` delivered it. */
+function frameBytes(data) {
+	if (Array.isArray(data)) return data.reduce((total, chunk) => total + chunk.length, 0);
+	return data.byteLength;
+}
+/**
+* Where a connection comes from, as the data API's rate limiter reads an
+* address: the upgrade request's headers (believed only as far as proxies are
+* declared) and the socket's own address.
+*/
+function connectionOrigin(request) {
+	return {
+		header: (name) => {
+			const value = request?.headers[name];
+			return Array.isArray(value) ? value.join(", ") : value;
+		},
+		socketAddress: request?.socket?.remoteAddress
+	};
+}
+/**
+* `limits` are the data API's, for the same rows reached through this door:
+* frames larger than its body limit close the socket with 1009 before they are
+* read, and every data frame counts in the caller's data-API bucket — the one
+* their HTTP requests count in — rather than only in a budget per connection,
+* which a caller multiplied by opening more.
+*/
+function createPostgresWebSocket(server, realtimeService, driver, authConfig, authAdapter, limits) {
 	const clientSessions = /* @__PURE__ */ new Map();
 	const isProduction = process.env.NODE_ENV === "production";
 	/**
@@ -10900,15 +12199,20 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 		if (extras.length === 0) logger.debug(message);
 		else logger.debug(message, { details: extras.length === 1 ? extras[0] : extras });
 	};
-	const wss = new WebSocketServer({ server });
+	const maxPayload = limits?.maxPayload ?? RUNTIME_DEFAULT_MAX_BODY_SIZE;
+	const wss = new WebSocketServer({
+		server,
+		maxPayload: maxPayload > 0 ? maxPayload : 0
+	});
 	wss.on("error", (err) => {
 		if (err.code === "EADDRINUSE") return;
 		logger.error("❌ [WebSocket Server] Error", { error: err });
 	});
 	const requireAuth = !!authAdapter || resolveRequireAuth(authConfig);
 	if (requireAuth && !authAdapter && !authConfig?.jwtSecret && !authConfig?.serviceKey) logger.warn("🔐 [WebSocket Server] Authentication is required but no adapter, jwtSecret or serviceKey is configured — no client can complete AUTH, so every realtime message will be refused with UNAUTHORIZED.");
-	wss.on("connection", (ws) => {
+	wss.on("connection", (ws, request) => {
 		const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
+		const origin = connectionOrigin(request);
 		wsDebug(`WebSocket client connected: ${clientId}`);
 		clientSessions.set(clientId, {
 			ws,
@@ -10923,9 +12227,16 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 			wsDebug(`WebSocket client disconnected: ${clientId}`);
 			clientSessions.delete(clientId);
 		});
+		ws.on("error", (error) => {
+			wsDebug(`WebSocket client ${clientId} error: ${error.message}`);
+		});
 		ws.on("message", async (message) => {
 			let requestId;
 			try {
+				if (!clientSessions.get(clientId)?.authenticated && frameBytes(message) > MAX_UNAUTHENTICATED_FRAME_BYTES) {
+					ws.close(1009, "Authenticate before sending anything larger than a token.");
+					return;
+				}
 				const { type, payload, requestId: reqId } = JSON.parse(message.toString());
 				requestId = reqId;
 				wsDebug(`[WS] ${clientId} → ${type}`, requestId ? `(${requestId})` : "");
@@ -10944,6 +12255,33 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						}
 					}));
 				};
+				{
+					const session = clientSessions.get(clientId);
+					if (session) {
+						const now = Date.now();
+						if (CHANNEL_MESSAGE_TYPES.has(type)) {
+							if (now - session.channelWindowStart > WS_RATE_WINDOW_MS) {
+								session.channelMessageCount = 0;
+								session.channelWindowStart = now;
+							}
+							session.channelMessageCount++;
+							if (session.channelMessageCount > WS_CHANNEL_RATE_LIMIT) {
+								sendError("ERROR", "RATE_LIMITED", "Too many channel messages. Please slow down.");
+								return;
+							}
+						} else {
+							if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {
+								session.messageCount = 0;
+								session.messageWindowStart = now;
+							}
+							session.messageCount++;
+							if (session.messageCount > WS_RATE_LIMIT) {
+								sendError("ERROR", "RATE_LIMITED", "Too many requests. Please slow down.");
+								return;
+							}
+						}
+					}
+				}
 				if (type === "AUTHENTICATE") {
 					const { token } = payload || {};
 					if (!token) {
@@ -10957,7 +12295,8 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 							uid: adapterUser.uid,
 							roles: adapterUser.roles,
 							isAdmin: adapterUser.isAdmin,
-							isAnonymous: adapterUser.isAnonymous === true
+							isAnonymous: adapterUser.isAnonymous === true,
+							...adapterUser.claims ? { claims: adapterUser.claims } : {}
 						};
 					} catch {}
 					else if (authConfig?.serviceKey && safeCompare(token, authConfig.serviceKey)) verifiedUser = {
@@ -10981,6 +12320,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						if (session) {
 							session.user = verifiedUser;
 							session.authenticated = true;
+							await realtimeService.rescopeClient(clientId, sessionAuthContext(session));
 						}
 						wsDebug(`[WS] replying AUTH_SUCCESS for requestId ${requestId}`);
 						ws.send(JSON.stringify({
@@ -11004,39 +12344,22 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						return;
 					}
 				}
-				{
-					const session = clientSessions.get(clientId);
-					if (session) {
-						const now = Date.now();
-						if (CHANNEL_MESSAGE_TYPES.has(type)) {
-							if (now - session.channelWindowStart > WS_RATE_WINDOW_MS) {
-								session.channelMessageCount = 0;
-								session.channelWindowStart = now;
-							}
-							session.channelMessageCount++;
-							if (session.channelMessageCount > WS_CHANNEL_RATE_LIMIT) {
-								sendError("ERROR", "RATE_LIMITED", "Too many channel messages. Please slow down.");
-								return;
-							}
-						} else {
-							if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {
-								session.messageCount = 0;
-								session.messageWindowStart = now;
-							}
-							session.messageCount++;
-							if (session.messageCount > WS_RATE_LIMIT) {
-								sendError("ERROR", "RATE_LIMITED", "Too many requests. Please slow down.");
-								return;
-							}
-						}
-					}
-				}
 				if (ADMIN_ONLY_TYPES.has(type)) {
 					if (!isAdminSession(clientSessions.get(clientId))) {
 						sendError("ERROR", "FORBIDDEN", "Admin access required for this operation");
 						return;
 					}
 				}
+				if (limits?.dataRateLimit && PUBLIC_TYPES.has(type)) {
+					const decision = await limits.dataRateLimit({
+						...origin,
+						uid: clientSessions.get(clientId)?.user?.uid
+					});
+					if (decision && !decision.allowed) {
+						sendError("ERROR", "RATE_LIMITED", "Too many requests, please try again later.");
+						return;
+					}
+				}
 				/**
 				* Apply the REST layer's write checks to a socket payload.
 				*
@@ -11044,13 +12367,98 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 				* driver decides what a path means, and refusing here would
 				* turn "unknown collection" into a validation error.
 				*/
-				const assertWriteRequest = (path, values) => {
+				const assertWriteRequest = (path, values, status) => {
 					if (!path || !values || typeof values !== "object") return;
 					const collection = driver.registry?.getCollectionByPath(path);
 					if (!collection) return;
-					assertWriteRequestValid(values, collection, { viewer: { roles: clientSessions.get(clientId)?.user?.roles ?? ["anon"] } });
+					assertWriteRequestValid(values, collection, {
+						viewer: { roles: clientSessions.get(clientId)?.user?.roles ?? ["anon"] },
+						status
+					});
 					assertFieldOpsValid(values, collection);
 				};
+				/**
+				* Apply the REST layer's read check to a socket request: no
+				* filter, sort, projection or uniqueness probe over a field
+				* this caller may not read. The strip keeps the value off the
+				* wire; without this a `COUNT` still answers whether a hidden
+				* value matches a pattern, one character at a time.
+				*
+				* Same viewer as `assertWriteRequest`, and silent in the same
+				* case: a path that names no registered collection is the
+				* driver's to answer.
+				*/
+				const assertReadRequest = (path, request) => {
+					if (!path) return;
+					let collection;
+					try {
+						collection = driver.registry?.getCollectionByPath(path);
+					} catch {
+						return;
+					}
+					if (!collection) return;
+					const session = clientSessions.get(clientId);
+					assertReadRequestReadable(request, collection, { roles: session?.user?.roles ?? ["anon"] });
+				};
+				/**
+				* Refuse a write through a nested path that sets a relation
+				* this caller may not write — the rule REST's nested routes
+				* apply, from the same function. The body is checked by
+				* `assertWriteRequest`; this is what the address writes.
+				*
+				* Silent for a root path, and for a nested one the registry
+				* cannot walk: the driver refuses that with its own message.
+				*/
+				const assertNestedWrite = (path, kind) => {
+					if (typeof path !== "string" || !isNestedPath(path) || !driver.registry) return;
+					let hop;
+					try {
+						hop = resolveNestedPath(path, driver.registry);
+					} catch {
+						return;
+					}
+					if (!hop) return;
+					const session = clientSessions.get(clientId);
+					assertNestedWriteAllowed(hop, kind, path, { roles: session?.user?.roles ?? ["anon"] });
+				};
+				/** The auth collection at `path`, or `undefined` for any other. */
+				const authCollectionAt = (path) => {
+					if (typeof path !== "string") return void 0;
+					let collection;
+					try {
+						collection = driver.registry?.getCollectionByPath(path);
+					} catch {
+						return;
+					}
+					const auth = collection?.auth;
+					return auth === true || !!auth && typeof auth === "object" && auth.enabled === true ? collection : void 0;
+				};
+				/**
+				* The auth collection's rows are the users, so a write to one
+				* is user administration — the auth adapter's to check, as it
+				* is on the REST routes and `/admin/users`. `undefined` for any
+				* other collection, or an adapter with nothing to say.
+				*/
+				const userAdminFor = (path) => authAdapter && authCollectionAt(path) ? authAdapter : void 0;
+				/**
+				* An upsert's options, under the rules `POST /api/data`
+				* applies to `?on_conflict=`: refused on a nested path,
+				* whose insert branch stamps the parent's key into the
+				* DO UPDATE and so moves the row it matched under this
+				* parent; and a target that is a declared unique key of
+				* the registry's collection, or a 400 naming the ones
+				* there are rather than Postgres's 42P10.
+				*/
+				const upsertOptions = (request) => {
+					if (request.upsert !== true) return {};
+					if (typeof request.path === "string" && isNestedPath(request.path)) throw ApiError.badRequest("An upsert is not accepted on a nested path: a row it matched would be moved under this parent. Send the upsert to the collection directly.", "INVALID_CONFLICT_TARGET");
+					const collection = driver.registry?.getCollectionByPath(request.path);
+					const onConflict = collection ? resolveConflictTarget(request.onConflict, collection, { where: "`onConflict`" }) : void 0;
+					return {
+						upsert: true,
+						...onConflict && { onConflict }
+					};
+				};
 				const getScopedDelegate = async () => {
 					if (typeof driver.withAuth === "function") try {
 						const who = sessionAuthContext(clientSessions.get(clientId));
@@ -11076,6 +12484,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						{
 							wsDebug("📋 [WebSocket Server] Processing FETCH_COLLECTION request");
 							const request = payload;
+							assertReadRequest(request.path, request);
 							const rows = await (await getScopedDelegate()).fetchCollection({
 								...request,
 								limit: resolveClientListLimit(request.limit, { vectorSearch: !!request.vectorSearch })
@@ -11113,8 +12522,31 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 								depth: null,
 								colors: true
 							}));
-							assertWriteRequest(request.path, request.values);
-							const row = await (await getScopedDelegate()).save(request);
+							const usersCollection = request.status !== "existing" && request.upsert !== true && authAdapter?.prepareUserCreation ? authCollectionAt(request.path) : void 0;
+							if (usersCollection) {
+								const body = request.values ?? {};
+								assertUserCreationBodyValid(authAdapter, usersCollection, body, { roles: clientSessions.get(clientId)?.user?.roles ?? ["anon"] });
+								assertNoFieldOpsOnCreate(body, "A create");
+							} else assertWriteRequest(request.path, request.values, request.status);
+							assertNestedWrite(request.path, request.id === void 0 || request.status !== "existing" ? "create" : "update");
+							const delegate = await getScopedDelegate();
+							const userAdmin = request.status === "existing" && request.id !== void 0 ? userAdminFor(request.path) : void 0;
+							const [values] = userAdmin?.prepareUserUpdates ? await userAdmin.prepareUserUpdates([{
+								uid: String(request.id),
+								values: request.values
+							}]) : [request.values];
+							const write = (toWrite) => delegate.save({
+								path: request.path,
+								...request.id !== void 0 && { id: request.id },
+								values: toWrite,
+								status: request.status,
+								...upsertOptions(request)
+							});
+							const created = usersCollection ? await createUserThroughAuthCollection(authAdapter, usersCollection, values ?? {}, write) : void 0;
+							const row = created ? {
+								...created.row,
+								...created.delivery
+							} : await write(values);
 							wsDebug("💾 [WebSocket Server] SAVE_ENTITY result:", inspect(row, {
 								depth: null,
 								colors: true
@@ -11133,13 +12565,19 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 							wsDebug("🗑️ [WebSocket Server] Processing DELETE_ENTITY request");
 							const request = payload;
 							wsDebug("🗑️ [WebSocket Server] Deleting row:", request.row);
-							await (await getScopedDelegate()).delete({
+							assertNestedWrite(request.row?.path, "unlink");
+							const delegate = await getScopedDelegate();
+							const userAdmin = userAdminFor(request.row?.path);
+							const uids = [String(request.row.id)];
+							await userAdmin?.prepareUserDeletions?.(uids);
+							await delegate.delete({
 								row: {
 									id: request.row.id,
 									path: request.row.path
 								},
 								hard: request.hard
 							});
+							await userAdmin?.finalizeUserDeletions?.(uids);
 							wsDebug("🗑️ [WebSocket Server] DELETE_ENTITY completed successfully");
 							const response = {
 								type: "DELETE_SUCCESS",
@@ -11154,6 +12592,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						{
 							wsDebug("🔍 [WebSocket Server] Processing CHECK_UNIQUE_FIELD request");
 							const { path, name, value, id, collection } = payload;
+							if (typeof name === "string") assertReadRequest(path, { filter: { [name]: ["==", value] } });
 							const isUnique = await (await getScopedDelegate()).checkUniqueField(path, name, value, id, collection);
 							wsDebug("🔍 [WebSocket Server] CHECK_UNIQUE_FIELD result:", isUnique);
 							const response = {
@@ -11168,6 +12607,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					case "COUNT":
 						{
 							const request = payload;
+							assertReadRequest(request.path, request);
 							const response = {
 								type: "COUNT_SUCCESS",
 								payload: { count: await (await getScopedDelegate()).count(request) },
@@ -11185,7 +12625,10 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 									sendError("ERROR", "NOT_SUPPORTED", "SQL execution is not available for this driver.");
 									break;
 								}
-								const result = await admin.executeSql(sql, options);
+								const result = await admin.executeSql(sql, {
+									...options,
+									isolateSession: true
+								});
 								if (process.env.NODE_ENV !== "production") wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
 								const auditSession = clientSessions.get(clientId);
 								logger.info("[SQL Audit] WebSocket SQL execution", {
@@ -11592,7 +13035,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-BNLwvxuy.js").then((n) => n.r);
+			const { createDump, discardPartialDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-HQ9GC4tN.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -11606,8 +13049,8 @@ function createBackupCron(config) {
 			log(`Dump created: ${dump.fileName} (${formatBytes(dump.sizeBytes)})`);
 			const check = await validateDump(dump.localFile);
 			if (!check.ok) {
-				if (destination.kind !== "local" && fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);
-				if (dump.globalsFile && destination.kind !== "local" && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);
+				if (dump.globalsFile) discardPartialDump(dump.globalsFile);
+				discardPartialDump(dump.localFile);
 				throw new Error(`New backup failed validation — skipping upload and pruning to protect existing backups. ${check.reason}`);
 			}
 			let storedKey = dump.localFile;
@@ -12182,6 +13625,14 @@ var UserService = class {
 			updatedAt: row.updated_at
 		}));
 	}
+	/**
+	* @see UserRepository.unlinkUserIdentity — scoped to the user as well as
+	* the identity, so it can only ever detach an identity from the account
+	* it names.
+	*/
+	async unlinkUserIdentity(uid, provider, providerId) {
+		await this.withServerContext(async (db) => db.delete(this.userIdentitiesTable).where(sql`${this.userIdentitiesTable.uid} = ${uid} AND ${this.userIdentitiesTable.provider} = ${provider} AND ${this.userIdentitiesTable.providerId} = ${providerId}`));
+	}
 	async linkUserIdentity(uid, provider, providerId, profileData) {
 		await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
 			uid,
@@ -12196,7 +13647,13 @@ var UserService = class {
 		const payload = this.mapPayload(data);
 		const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 		payload[updatedAtKey] = /* @__PURE__ */ new Date();
-		const [row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
+		let row;
+		try {
+			[row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
+		} catch (error) {
+			if (extractPgError(error)?.code === "23505") throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
+			throw error;
+		}
 		return row ? this.mapRowToUser(row) : null;
 	}
 	async deleteUser(id) {
@@ -12249,7 +13706,7 @@ var UserService = class {
 		};
 	}
 	/**
-	* Update user's password hash
+	* Update user's password hash; `null` removes the password.
 	*/
 	async updatePassword(id, passwordHash) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -12419,7 +13876,18 @@ var RefreshTokenService = class RefreshTokenService {
 		if (session && this.has("sessionId")) values.sessionId = session.id;
 		if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
 		if (session?.aal && this.has("aal")) values.aal = session.aal;
-		await this.db.insert(this.refreshTokensTable).values(values);
+		const parentHash = session?.rotatedFrom && this.has("rotatedAt") ? session.rotatedFrom : void 0;
+		if (!parentHash) {
+			await this.db.insert(this.refreshTokensTable).values(values);
+			return true;
+		}
+		return await this.db.transaction(async (tx) => {
+			const live = this.has("revoked") ? sql`${this.refreshTokensTable.tokenHash} = ${parentHash} AND ${this.col("revoked")} IS NOT TRUE` : eq(this.refreshTokensTable.tokenHash, parentHash);
+			const [parent] = await tx.select({ id: this.refreshTokensTable.id }).from(this.refreshTokensTable).where(live).for("share");
+			if (!parent) return false;
+			await tx.insert(this.refreshTokensTable).values(values);
+			return true;
+		});
 	}
 	/**
 	* Build a {@link RefreshTokenInfo} out of a row of {@link selection}.
@@ -12475,17 +13943,31 @@ var RefreshTokenService = class RefreshTokenService {
 		}
 		await this.db.update(this.refreshTokensTable).set({ rotatedAt: /* @__PURE__ */ new Date() }).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 	}
-	/** Final kill of one sign-in: logout, or revoking a device remotely. */
+	/**
+	* Final kill of one sign-in: logout, or revoking a device remotely.
+	*
+	* Lock first, write second, in one transaction. A rotation in flight
+	* holds a share lock on its parent — a row of this session — until the
+	* token it mints is committed (see `createToken`), so the lock here waits
+	* for it, and the write, being a new statement, reads a snapshot that has
+	* that token in it. A lone UPDATE would work from a snapshot taken before
+	* the token existed and leave it live: the sign-out a refresh in flight
+	* used to undo.
+	*/
 	async revokeSession(sessionId) {
 		if (!this.has("sessionId")) return;
-		if (this.has("revoked")) {
-			await this.db.update(this.refreshTokensTable).set({
-				revoked: true,
-				...this.has("rotatedAt") ? { rotatedAt: /* @__PURE__ */ new Date() } : {}
-			}).where(eq(this.col("sessionId"), sessionId));
-			return;
-		}
-		await this.db.delete(this.refreshTokensTable).where(eq(this.col("sessionId"), sessionId));
+		const inSession = eq(this.col("sessionId"), sessionId);
+		await this.db.transaction(async (tx) => {
+			await tx.select({ id: this.refreshTokensTable.id }).from(this.refreshTokensTable).where(inSession).for("update");
+			if (this.has("revoked")) {
+				await tx.update(this.refreshTokensTable).set({
+					revoked: true,
+					...this.has("rotatedAt") ? { rotatedAt: /* @__PURE__ */ new Date() } : {}
+				}).where(inSession);
+				return;
+			}
+			await tx.delete(this.refreshTokensTable).where(inSession);
+		});
 	}
 	/**
 	* Housekeeping: rotation would otherwise leave a row per refresh forever.
@@ -12676,7 +14158,7 @@ var PostgresTokenRepository = class {
 		this.magicLinkTokenService = new MagicLinkTokenService(db, tableOrTables);
 	}
 	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
-		await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+		return this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
 	}
 	async markRefreshTokenRotated(tokenHash) {
 		await this.refreshTokenService.markRotated(tokenHash);
@@ -12765,6 +14247,9 @@ var PostgresAuthRepository = class {
 	async linkUserIdentity(uid, provider, providerId, profileData) {
 		return this.userService.linkUserIdentity(uid, provider, providerId, profileData);
 	}
+	async unlinkUserIdentity(uid, provider, providerId) {
+		await this.userService.unlinkUserIdentity(uid, provider, providerId);
+	}
 	async updateUser(id, data) {
 		return this.userService.updateUser(id, data);
 	}
@@ -12858,7 +14343,7 @@ var PostgresAuthRepository = class {
 	}
 	async deleteRole(_id) {}
 	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
-		await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+		return this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
 	}
 	async markRefreshTokenRotated(tokenHash) {
 		await this.tokenRepository.markRefreshTokenRotated(tokenHash);
@@ -13113,7 +14598,9 @@ var MfaService = class {
 		};
 	}
 	/**
-	* Count one failed guess against a challenge and report the new total.
+	* Count one guess against a challenge and report the new total. The route
+	* claims it before judging the code, so the total it returns is what the
+	* cap is decided on.
 	*
 	* Incremented in the database rather than in the route so that guesses
 	* arriving in parallel — the shape any real brute-force takes — cannot
@@ -14729,9 +16216,13 @@ function createPostgresBootstrapper(pgConfig) {
 	const provisioningDb = (driverResult) => {
 		return (driverResult?.internals)?.db ?? pgConfig.connection;
 	};
-	const provisioningQueryable = (driverResult) => {
-		const db = (driverResult?.internals)?.db ?? pgConfig.connection;
+	const requireProvisioningDb = (driverResult) => {
+		const db = provisioningDb(driverResult);
 		if (!db) throw new Error("Cannot provision the collection schema: this Postgres adapter was created without a `connection`, and no initialized driver was supplied to fall back on. Pass `connection` to `createPostgresAdapter` (see `createPostgresDatabaseConnection`).");
+		return db;
+	};
+	const provisioningQueryable = (driverResult) => {
+		const db = requireProvisioningDb(driverResult);
 		return { async query(text) {
 			return { rows: sqlRows(await db.execute(sql.raw(text))) };
 		} };
@@ -14744,14 +16235,13 @@ function createPostgresBootstrapper(pgConfig) {
 	* Idempotent and cheap to repeat: `CREATE SCHEMA IF NOT EXISTS` plus a
 	* handful of `CREATE OR REPLACE FUNCTION`.
 	*/
-	const provisionRlsRuntime = async (queryable) => {
-		const { RLS_BOOTSTRAP_STATEMENTS } = await import("./rls-bootstrap-sql-BHA6jLtj.js").then((n) => n.i);
-		await queryable.query("SELECT pg_advisory_lock(hashtext('rebase_auth_functions_init'))");
-		try {
-			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await queryable.query(statement);
-		} finally {
-			await queryable.query("SELECT pg_advisory_unlock(hashtext('rebase_auth_functions_init'))");
-		}
+	const provisionRlsRuntime = async (driverResult) => {
+		const db = requireProvisioningDb(driverResult);
+		const { RLS_BOOTSTRAP_STATEMENTS } = await import("./rls-bootstrap-sql-B8EclDyM.js").then((n) => n.i);
+		await db.transaction(async (tx) => {
+			await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
+			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await tx.execute(sql.raw(statement));
+		});
 	};
 	return {
 		type: "postgres",
@@ -15139,7 +16629,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-Cr2ye5JC.js").then((n) => n.n);
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-BEEjn5cn.js").then((n) => n.n);
 			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(describeEnsureFailure(failure));
 			return { applied: plan.actions.length - plan.failures.length };
@@ -15170,13 +16660,13 @@ function createPostgresBootstrapper(pgConfig) {
 		* as the auth path and the migration preamble, from the same constant.
 		*/
 		async ensureRlsRuntime(driverResult) {
-			await provisionRlsRuntime(provisioningQueryable(driverResult));
+			await provisionRlsRuntime(driverResult);
 		},
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-B4IDFtQ-.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-RHUcEp4v.js");
 			const queryable = provisioningQueryable(driverResult);
 			const { rows } = await queryable.query("SELECT to_regprocedure('rebase.roles()') IS NOT NULL AS present");
-			if (!rows[0]?.present) await provisionRlsRuntime(queryable);
+			if (!rows[0]?.present) await provisionRlsRuntime(driverResult);
 			const outcome = await ensureCollectionPolicies(queryable, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
 			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — RLS is on, so it denies until this is resolved: ${failure.error}`);
@@ -15184,7 +16674,7 @@ function createPostgresBootstrapper(pgConfig) {
 			for (const u of outcome.unsecured.filter((u) => u.grantWithdrawn)) logger.error(`🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. Its privileges have been revoked from ${REBASE_USER_ROLE}, so the table is unreachable rather than unprotected. Reads and writes to that collection will fail until RLS can be enabled.`);
 			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
-				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-BHA6jLtj.js").then((n) => n.i);
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-B8EclDyM.js").then((n) => n.i);
 				await dropLegacyAuthSchema(async (text) => (await queryable.query(text)).rows, {
 					info: (m) => logger.info(m),
 					warn: (m) => logger.warn(m)
@@ -15262,9 +16752,9 @@ function createPostgresBootstrapper(pgConfig) {
 			return driverResult.internals.driver.admin;
 		},
 		mountRoutes(app, basePath, driverResult) {},
-		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
+		async initializeWebsockets(server, realtimeService, driver, config, adapter, limits) {
 			const { createPostgresWebSocket } = await Promise.resolve().then(() => websocket_exports);
-			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
+			createPostgresWebSocket(server, realtimeService, driver, config, adapter, limits);
 		}
 	};
 }
@@ -15289,8 +16779,8 @@ function createPostgresAdapter(pgConfig) {
 		async initializeHistory(config, driverResult) {
 			if (bootstrapper.initializeHistory) return bootstrapper.initializeHistory(config, driverResult);
 		},
-		initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			if (bootstrapper.initializeWebsockets) return bootstrapper.initializeWebsockets(server, realtimeService, driver, config, adapter);
+		initializeWebsockets(server, realtimeService, driver, config, adapter, limits) {
+			if (bootstrapper.initializeWebsockets) return bootstrapper.initializeWebsockets(server, realtimeService, driver, config, adapter, limits);
 		},
 		verifyConnection: bootstrapper.verifyConnection ? (driverResult) => bootstrapper.verifyConnection(driverResult) : void 0,
 		ensureCollectionSchema: bootstrapper.ensureCollectionSchema ? (collections, driverResult, log) => bootstrapper.ensureCollectionSchema(collections, driverResult, log) : void 0,