@rebasepro/server-postgres 0.22.0 → 0.23.0

package/dist/index.es.js

@@ -2,27 +2,28 @@ import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
 import { a as createDirectDatabaseConnection, c as guardPoolAgainstDirtyRelease, l as pinSearchPath, o as createPostgresDatabaseConnection, r as cappedPoolMax, s as createReadReplicaConnection, t as DatabasePoolManager, u as poolMaxCeiling } from "./databasePoolManager-Bj5FbeAs.js";
-import { f as hiddenColumnsOption, l as SEARCH_UNACCENT_FN, m as searchColumnNames, o as sharedRelationName, u as buildSearchColumnSpec, x as visibleColumnProjection } from "./plan-schema-CboAIwLN.js";
-import { d as extractPgError, f as isRoleSwitchingPermissionError, g as sanitizeErrorForClient, h as reachedDatabase, i as diagnoseDbError, l as classifyConnectFailure, m as pgErrorToFriendlyMessage, n as deepestErrorMessage, o as isEconnrefused, p as isRowLevelSecurityDenial, s as parseHostInfo, u as extractCauseMessage } from "./cli-errors-Dka89exj.js";
-import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-CucnFcSE.js";
+import { f as hiddenColumnsOption, l as SEARCH_UNACCENT_FN, m as searchColumnNames, o as sharedRelationName, u as buildSearchColumnSpec, x as visibleColumnProjection } from "./plan-schema-C0fxM8dY.js";
+import { d as extractPgError, f as isRoleSwitchingPermissionError, g as sanitizeErrorForClient, h as reachedDatabase, i as diagnoseDbError, l as classifyConnectFailure, m as pgErrorToFriendlyMessage, n as deepestErrorMessage, o as isEconnrefused, p as isRowLevelSecurityDenial, s as parseHostInfo, u as extractCauseMessage } from "./cli-errors-B8qHg02P.js";
+import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-DGPL6G_C.js";
 import { c as warnOnLegacyRlsFunctions, i as ensureAppRole, l as warnOnRoleSchemaCollision, n as applyAuthContext, o as validatePolicyPgRoles, r as detectConnectionPosture, s as warnOnAnonymousGrants, t as REBASE_USER_ROLE } from "./rls-enforcement-C6Xk0lA6.js";
-import { l as resolveColumnName } from "./column-plan-helpers-CpILzHJS.js";
+import { u as resolveColumnName } from "./column-plan-helpers-DF-8dTVa.js";
 import { i as isAuthCollection, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
-import { a as generatePostgresVectorDdl, i as generatePostgresTriggersDdl, n as generatePostgresPoliciesDdl, r as generatePostgresSearchDdl, t as generatePostgresDdl } from "./generate-postgres-ddl-logic-D7imhYV8.js";
-import { t as generateSchema } from "./generate-drizzle-schema-logic-BcMl7VSy.js";
-import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-CpAgy51F.js";
-import { t as main } from "./generate-drizzle-schema-B537GIvz.js";
-import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-CaMOS76G.js";
-import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-Cr5B4UmH.js";
-import { c as identifyJoinTables, d as singularize, h as humanize, i as buildTablesMap, m as mapPgType, r as buildEnumMap, s as getIconForTable } from "./introspect-db-logic-C6LQdTxj.js";
-import { Client } from "pg";
-import { ApiError, assertFieldOpsValid, assertWriteRequestValid, createDdlBootstrapper, createEmailService, declaredErrorAnswer, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveBatchRefs, resolveRequireAuth, safeCompare, splitFieldOps } from "@rebasepro/server";
-import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isNotNull, isNull, isTable, lt, not, notInArray, or, relations, sql } from "drizzle-orm";
+import { a as generatePostgresVectorDdl, i as generatePostgresTriggersDdl, n as generatePostgresPoliciesDdl, r as generatePostgresSearchDdl, t as generatePostgresDdl } from "./generate-postgres-ddl-logic-Bt2d2mRH.js";
+import { t as generateSchema } from "./generate-drizzle-schema-logic-BfzK7UQd.js";
+import { c as identifyJoinTables, d as singularize, h as humanize, i as buildTablesMap, m as mapPgType, r as buildEnumMap, s as getIconForTable } from "./introspect-db-logic-WMuAfxvw.js";
+import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-BEEjn5cn.js";
+import { t as main } from "./generate-drizzle-schema-yzY_BLhr.js";
+import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-HQ9GC4tN.js";
+import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-Dhn9KM3B.js";
+import { Client, Pool } from "pg";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { ApiError, RUNTIME_DEFAULT_MAX_BODY_SIZE, assertFieldOpsValid, assertNestedWriteAllowed, assertNoFieldOpsOnCreate, assertQueryFieldsReadable, assertUserCreationBodyValid, assertWriteRequestValid, createDdlBootstrapper, createEmailService, createUserThroughAuthCollection, declaredErrorAnswer, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveBatchRefs, resolveConflictTarget, resolveRequireAuth, safeCompare, splitFieldOps } from "@rebasepro/server";
+import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, is, isNotNull, isNull, isTable, lt, not, notInArray, or, relations, sql } from "drizzle-orm";
+import { PgArray, PgNumeric, PgTable, PgTimestamp, PgTimestampString, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, JUNCTION_PIVOT_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, declaredDatabaseExtensions, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, parseEnvBoolean, parseRelationAggregateSort, resolveClientListLimit } from "@rebasepro/types";
-import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, REBASE_USER_ROLE as REBASE_USER_ROLE$1, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createRelationRef, createRelationRefWithData, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, firstSqlRow, getColumnName, getDeclaredPrimaryKeys, getJunctionCollectionConfig, getJunctionConfigForRelation, getTableName as getTableName$1, getTenantConfig, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseOrderBySpecStrict, requireCallbackClient, requireCallbackCollection, resolveCollectionRelations, resolveJunctionSpecs, resolveTenantWrite, revokeInternalTableSql, sqlRows, tenantBypassRoles, toCallbackError, toFilterTuples, updateDateAutoValues, updateUserAutoValues } from "@rebasepro/common";
-import { camelCase, firstFreeKey, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, mergeDeep, splitSearchTerms, toSnakeCase, toWireKey, unref } from "@rebasepro/utils";
+import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, REBASE_USER_ROLE as REBASE_USER_ROLE$1, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createRelationRef, createRelationRefWithData, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, firstSqlRow, getColumnName, getDeclaredPrimaryKeys, getJunctionCollectionConfig, getJunctionConfigForRelation, getTableName as getTableName$1, getTenantConfig, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseIdValues as parseIdValues$1, parseOrderBySpecStrict, requireCallbackClient, requireCallbackCollection, resolveCollectionRelations, resolveJunctionSpecs, resolveTenantWrite, restoresSoftDeletedRow, revokeInternalTableSql, softDeleteFieldOf, sqlRows, tenantBypassRoles, toCallbackError, toFilterTuples, updateDateAutoValues, updateUserAutoValues } from "@rebasepro/common";
+import { camelCase, firstFreeKey, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, splitSearchTerms, toSnakeCase, toWireKey, unref } from "@rebasepro/utils";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { PgArray, PgNumeric, PgTable, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs from "fs";
 import { WebSocket, WebSocketServer } from "ws";
 import { EventEmitter } from "events";
@@ -119,6 +120,24 @@ function idCanAddressTable(id, table, idInfoArray) {
 	}));
 }
 /**
+* The condition that names one row: every key column equal to its part of the
+* address.
+*
+* Every key column, not the first. A composite-key read that matched only the
+* leading column answered `p1:::bob` with whichever `p1` row Postgres reached
+* first, and a delete then judged that row's `beforeDelete` while deleting bob —
+* the writes have always matched the whole key, so the reads must too.
+*/
+function rowIdentityCondition(table, idInfoArray, id, collectionPath) {
+	const parsed = parseIdValues(id, idInfoArray);
+	const conditions = idInfoArray.map((info) => {
+		const column = table[info.fieldName];
+		if (!column) throw new Error(`ID field '${info.fieldName}' not found in table for collection '${collectionPath}'`);
+		return eq(column, parsed[info.fieldName]);
+	});
+	return conditions.length === 1 ? conditions[0] : and(...conditions);
+}
+/**
 * The columns of a table's composite primary-key constraint, or `[]`.
 *
 * Fails open for anything that is not a real Drizzle table — a test double, a
@@ -1918,11 +1937,16 @@ var DrizzleConditionBuilder = class DrizzleConditionBuilder {
 		return sql`(${rank} + public.word_similarity(${spec.unaccent ? sql`${sql.raw(SEARCH_UNACCENT_FN)}(${searchString})` : sql`${searchString}`}, ${fuzzyColumn}))`;
 	}
 	/**
-	* Build a unique field check condition
+	* Build a unique field check condition: rows holding `value`, other than
+	* the one `excludeRow` names.
+	*
+	* `excludeRow` is the whole identity of the row being saved — every key
+	* column — so excluding one member of a composite-key table does not
+	* exclude every row sharing its first key part.
 	*/
-	static buildUniqueFieldCondition(fieldColumn, value, idColumn, excludeId) {
+	static buildUniqueFieldCondition(fieldColumn, value, excludeRow) {
 		const conditions = [eq(fieldColumn, value)];
-		if (excludeId && idColumn) conditions.push(sql`${idColumn} != ${excludeId}`);
+		if (excludeRow) conditions.push(not(excludeRow));
 		return conditions;
 	}
 	/**
@@ -2199,6 +2223,11 @@ function toRestValues(row, collection) {
 * an `update` that echoes the row back overwrite the real value with the null it
 * was handed.
 *
+* A withheld to-one relation takes its foreign key with it. `bandId: 7` names
+* the salary band exactly as `band: { id: 7 }` does, and the row carries the
+* column beside the relation — so withholding only the relation withheld
+* nothing.
+*
 * `_matches` is filtered rather than deleted: it is the list of fields a text
 * search hit, and a field the caller cannot read must not appear in it even
 * though the array itself is theirs to see.
@@ -2208,13 +2237,22 @@ function stripUnreadable(row, collection) {
 	if (!properties) return row;
 	const viewer = currentFieldViewer();
 	const hidden = /* @__PURE__ */ new Set();
+	const hide = (name) => {
+		hidden.add(name);
+		delete row[name];
+	};
+	let relations;
 	for (const [key, property] of Object.entries(properties)) {
 		if (canReadField(property, viewer)) continue;
-		hidden.add(key);
-		delete row[key];
-		if (property.columnName) {
-			hidden.add(property.columnName);
-			delete row[property.columnName];
+		hide(key);
+		if (property.columnName) hide(property.columnName);
+		if (property.type === "relation") {
+			relations ??= resolveCollectionRelations(collection);
+			const relation = findRelation(relations, key);
+			if (relation?.kind === "belongsTo") {
+				hide(fieldKeyForColumn(collection, relation.localKey));
+				hide(relation.localKey);
+			}
 		}
 	}
 	if (hidden.size > 0 && Array.isArray(row._matches)) row._matches = row._matches.filter((match) => !hidden.has(typeof match === "string" ? match : String(match?.field)));
@@ -2419,8 +2457,10 @@ async function removeJunctionLink(tx, binding, parentId, targetId, subject) {
 *    the form runs under RLS, so a user who may edit the parent but cannot see
 *    some of the linked rows gets a shorter list — and writing it back deleted
 *    the links they were never shown. The select that drives the diff runs in
-*    this same transaction under the same policies, so a link the caller cannot
-*    read is in neither list and survives the save.
+*    this same transaction under the same policies, and through
+*    `visibleTargets` — the target's `beforeQuery` scope and soft delete, which
+*    RLS knows nothing of — so a link the caller cannot read is in neither list
+*    and survives the save.
 *  - **Junction payload columns.** A junction carrying its own columns
 *    (`position`, `role`, `created_at`) lost them on every save, because every
 *    row was re-inserted with only the two keys. Untouched links are left alone.
@@ -2443,8 +2483,8 @@ async function removeJunctionLink(tx, binding, parentId, targetId, subject) {
 * that is what keeps a plain `[1, 2, 3]` membership write from wiping the
 * `role`s off the links it did not mention.
 */
-async function applyJunctionMembership(tx, binding, parentId, links) {
-	const existingRows = await tx.select({ targetId: binding.targetColumn }).from(binding.table).where(eq(binding.parentColumn, parentId));
+async function applyJunctionMembership(tx, binding, parentId, links, visibleTargets) {
+	const existingRows = visibleTargets ? await tx.select({ targetId: binding.targetColumn }).from(binding.table).innerJoin(visibleTargets.table, eq(binding.targetColumn, visibleTargets.idColumn)).where(and(eq(binding.parentColumn, parentId), visibleTargets.condition)) : await tx.select({ targetId: binding.targetColumn }).from(binding.table).where(eq(binding.parentColumn, parentId));
 	const existingById = /* @__PURE__ */ new Map();
 	for (const row of existingRows) {
 		if (row.targetId === null || row.targetId === void 0) continue;
@@ -2503,6 +2543,8 @@ async function removeLinks(tx, binding, parentId, removed) {
 	if ((await tx.select({ present: sql`1` }).from(binding.table).where(and(...conditions)).limit(1)).length === 0) return;
 	throw ApiError.forbidden(`Not allowed to remove ${removed.length - deleted} of ${removed.length} link(s) for relation '${binding.label}': a row-level security policy rejected the write.`, "WRITE_DENIED");
 }
+//#endregion
+//#region src/services/soft-delete.ts
 /**
 * The soft-delete field this collection uses, or `undefined` if it has none.
 *
@@ -2512,9 +2554,8 @@ async function removeLinks(tx, binding, parentId, removed) {
 * worth avoiding — deletes would silently start removing rows.
 */
 function resolveSoftDelete(collection) {
-	const declared = collection?.softDelete;
-	if (!declared) return void 0;
-	const field = typeof declared === "object" && declared.field || "deletedAt";
+	const field = softDeleteFieldOf(collection);
+	if (!field) return void 0;
 	return {
 		field,
 		columnName: ((collection?.properties)?.[field])?.columnName ?? toSnakeCase(field)
@@ -2640,6 +2681,10 @@ function resolveBeforeQuery(registry, collection) {
 	if (own?.beforeQuery) hooks.push(own.beforeQuery);
 	return hooks;
 }
+/** Whether anything at all would run for this collection. */
+function hasBeforeQuery(registry, collection) {
+	return resolveBeforeQuery(registry, collection).length > 0;
+}
 /**
 * The conditions every `beforeQuery` hook for this collection asks to add.
 *
@@ -2789,6 +2834,21 @@ var RelationService = class {
 		});
 	}
 	/**
+	* The target rows a caller may see through `relation`: the target's
+	* `beforeQuery` scope and its soft delete, as one condition on the target
+	* table, or `undefined` when neither applies.
+	*
+	* What every loader here narrows a read by, exposed for the membership
+	* writes. A write that diffs a new link set against "what is linked now"
+	* has to diff against what the caller could have read — otherwise saving
+	* back the list they were shown unlinks every row they were not.
+	*/
+	async visibleTargetCondition(parentCollection, relation, parentId) {
+		const targetCollection = relation.target();
+		const targetTable = getTableForCollection(targetCollection, this.registry);
+		return andSoftDelete(await this.narrowTargetRead(parentCollection, relation, parentId), targetCollection, targetTable);
+	}
+	/**
 	* One target row, as the {@link RelatedRow} everything here returns.
 	*
 	* Eight sites built this by hand, which is how the address came to be the
@@ -2847,11 +2907,11 @@ var RelationService = class {
 			return col;
 		};
 		if (parentPks.length === 1) {
-			const values = parentIds.map((id) => parseIdValues(id, parentPks)[parentPks[0].fieldName]);
+			const values = parentIds.map((id) => parseIdValues$1(id, parentPks)[parentPks[0].fieldName]);
 			return inArray(columnFor(parentPks[0].fieldName), values);
 		}
 		return or(...parentIds.map((id) => {
-			const values = parseIdValues(id, parentPks);
+			const values = parseIdValues$1(id, parentPks);
 			return and(...parentPks.map((pk) => eq(columnFor(pk.fieldName), values[pk.fieldName])));
 		}));
 	}
@@ -2902,7 +2962,7 @@ var RelationService = class {
 		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		if (!joinsOnNaturalKey(relation, parentCollection, this.registry)) {
 			for (const id of parentIds) {
-				const value = parseIdValues(id, parentPks)[parentPks[0].fieldName];
+				const value = parseIdValues$1(id, parentPks)[parentPks[0].fieldName];
 				keyByParentId.set(String(id), value);
 				parentIdByKey.set(String(value), id);
 			}
@@ -2952,7 +3012,7 @@ var RelationService = class {
 		const idField = targetTable[idInfo[0].fieldName];
 		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
-		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
+		const parsedParentId = parseIdValues$1(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTableName = getTableName$1(parentCollection);
 		const parentTable = this.registry.getTable(parentTableName);
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
@@ -2977,7 +3037,7 @@ var RelationService = class {
 				currentTable = joinTable;
 			}
 			const parentIdField = parentTable[requirePrimaryKeys(parentCollection, this.registry)[0].fieldName];
-			query = query.where(narrowed(eq(parentIdField, parsedParentId), relatedNarrowing));
+			query = query.where(narrowed(eq(parentIdField, parsedParentId), andSoftDelete(relatedNarrowing, targetCollection, targetTable)));
 			if (options.limit) query = query.limit(options.limit);
 			const results = await query;
 			const targetTableName = relation.joinPath[relation.joinPath.length - 1].table;
@@ -3040,7 +3100,7 @@ var RelationService = class {
 		const targetIdField = targetTable[requirePrimaryKeys(targetCollection, this.registry)[0].fieldName];
 		const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
-		const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
+		const parsedParentId = parseIdValues$1(parentId, parentPks)[parentIdInfo.fieldName];
 		const parentTableName = getTableName$1(parentCollection);
 		const parentTable = this.registry.getTable(parentTableName);
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
@@ -3067,7 +3127,7 @@ var RelationService = class {
 	async isRelated(hop, targetId) {
 		const targetTable = getTableForCollection(hop.targetCollection, this.registry);
 		const targetPks = requirePrimaryKeys(hop.targetCollection, this.registry);
-		const parsedTargetId = parseIdValues(targetId, targetPks);
+		const parsedTargetId = parseIdValues$1(targetId, targetPks);
 		const identity = targetPks.map((pk) => {
 			const column = targetTable[pk.fieldName];
 			if (!column) throw new Error(`ID field '${pk.fieldName}' not found in table for collection '${hop.targetCollection.slug}'`);
@@ -3097,7 +3157,7 @@ var RelationService = class {
 		const parentTable = this.registry.getTable(parentTableName);
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
-		const parsedParentIds = parentIds.map((id) => parseIdValues(id, parentPks)[parentIdInfo.fieldName]);
+		const parsedParentIds = parentIds.map((id) => parseIdValues$1(id, parentPks)[parentIdInfo.fieldName]);
 		const narrowTarget = andSoftDelete(narrowBoth(narrow, await this.narrowTargetRead(parentCollection, relation)), targetCollection, targetTable);
 		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
@@ -3201,7 +3261,7 @@ var RelationService = class {
 		const parentTable = this.registry.getTable(parentTableName);
 		if (!parentTable) throw unregisteredTable(parentCollection.slug, parentTableName, "parent");
 		const parentIdCol = parentTable[parentIdInfo.fieldName];
-		const parsedParentIds = parentIds.map((id) => parseIdValues(id, parentPks)[parentIdInfo.fieldName]);
+		const parsedParentIds = parentIds.map((id) => parseIdValues$1(id, parentPks)[parentIdInfo.fieldName]);
 		const narrowTarget = andSoftDelete(narrowBoth(narrow, await this.narrowTargetRead(parentCollection, relation)), targetCollection, targetTable);
 		if (relation.kind === "via") {
 			let query = this.db.select().from(parentTable).$dynamic();
@@ -4042,6 +4102,11 @@ var FetchService = class FetchService {
 	* rows in arbitrary order, and paging over that repeats and skips rows.
 	*/
 	static SCORE_FIELD = "_score";
+	/**
+	* The distance a vector search attaches to every row it serves, and to no
+	* other. Like `_score` it is computed per query and stored nowhere.
+	*/
+	static DISTANCE_FIELD = "_distance";
 	resolveOrderTarget(table, orderBy, collection, searchString) {
 		if (orderBy === FetchService.SCORE_FIELD && collection && searchString) {
 			const rank = DrizzleConditionBuilder.buildSearchRankExpression(searchString, table, collection);
@@ -4125,15 +4190,17 @@ var FetchService = class FetchService {
 		return key.direction === "asc";
 	}
 	/**
-	* The full `ORDER BY`: the caller's keys, then the id.
+	* The full `ORDER BY`: the caller's keys, then the primary key.
 	*
-	* The id is always last and always descending. It is not decoration — it is
-	* what makes the ordering *total*, and a cursor over a non-total order
-	* repeats and skips rows among the ties. Every keyset comparison built by
-	* {@link buildCursorConditions} ends on the same `id DESC`, and the two have
-	* to agree: they did not, and an ascending sort paged with `id >` against an
-	* `ORDER BY … , id DESC`, so rows sharing a sort value were dropped from
-	* every page after the first.
+	* The key is always last and always descending, every column of it. It is
+	* not decoration — it is what makes the ordering *total*, and a cursor over
+	* a non-total order repeats and skips rows among the ties. Every keyset
+	* comparison built by {@link buildCursorConditions} ends on the same key
+	* `DESC`, and the two have to agree: they did not, and an ascending sort
+	* paged with `id >` against an `ORDER BY … , id DESC`, so rows sharing a
+	* sort value were dropped from every page after the first. Nor is the
+	* first column of a composite key enough: it ties every row that shares
+	* it, which is exactly the rows a cursor then skipped.
 	*
 	* Where the NULLs go is written out rather than inherited. Postgres already
 	* defaults to `NULLS LAST` ascending and `NULLS FIRST` descending, so this
@@ -4144,13 +4211,13 @@ var FetchService = class FetchService {
 	* relation reaches nothing from, which is precisely the "nobody waiting"
 	* end of a queue.
 	*/
-	buildOrderExpressions(keys, idField, tieBreakOnId = true) {
+	buildOrderExpressions(keys, keyColumns) {
 		const expressions = keys.map((key) => {
 			const nullsLast = FetchService.nullsLast(key);
 			if (key.direction === "asc") return nullsLast ? sql`${key.target} ASC NULLS LAST` : sql`${key.target} ASC NULLS FIRST`;
 			return nullsLast ? sql`${key.target} DESC NULLS LAST` : sql`${key.target} DESC NULLS FIRST`;
 		});
-		if (tieBreakOnId) expressions.push(desc(idField));
+		for (const column of keyColumns) expressions.push(desc(column));
 		return expressions;
 	}
 	resolveOrderByField(table, orderBy, collection) {
@@ -4193,40 +4260,6 @@ var FetchService = class FetchService {
 		});
 	}
 	/**
-	* Build the `with` config for Drizzle's relational query API.
-	* Converts collection relations to a Drizzle-compatible `with` object.
-	*
-	* When `include` is provided, only those relations are loaded.
-	* When `include` is absent, ALL relations are loaded (the admin path).
-	*
-	* Automatically detects many-to-many junction tables and nests
-	* the target relation so actual row data is returned.
-	*/
-	buildWithConfig(collection, include) {
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const withConfig = {};
-		const shouldInclude = (key) => !include || include.length === 0 || include[0] === "*" || include.includes(key);
-		for (const [key, relation] of Object.entries(resolvedRelations)) {
-			if (!shouldInclude(key)) continue;
-			const drizzleRelName = relation.relationName || key;
-			if (relation.kind === "via") continue;
-			if (relation.cardinality === "many" && isJunctionRelation(relation)) {
-				const targetFkName = this.getJunctionTargetRelationName(relation, collection);
-				if (targetFkName) withConfig[drizzleRelName] = { with: { [targetFkName]: true } };
-				else withConfig[drizzleRelName] = true;
-			} else withConfig[drizzleRelName] = true;
-		}
-		return withConfig;
-	}
-	/**
-	* Get the Drizzle relation name on the junction table that points to the actual target row.
-	* For example, for posts_tags junction, this returns "tag_id" (the relation pointing to tags).
-	*/
-	getJunctionTargetRelationName(relation, _collection) {
-		if (isManyToMany(relation)) return relation.through.targetColumn.replace(/_id$/, "_id");
-		return null;
-	}
-	/**
 	* The relations one level of an include tree names, resolved.
 	*
 	* A name that is not a relation is a **400 `UNKNOWN_RELATION`**. It used to
@@ -4454,36 +4487,49 @@ var FetchService = class FetchService {
 	*/
 	cursorFor(collectionPath, row, orderBy) {
 		if (orderBy?.some(([field]) => field === FetchService.SCORE_FIELD)) return void 0;
+		if (FetchService.DISTANCE_FIELD in row) return void 0;
 		try {
 			const pks = getPrimaryKeys(getCollectionByPath(collectionPath, this.registry), this.registry);
 			if (pks.length === 0) return void 0;
 			const address = buildCompositeId$1(row, pks);
 			if (!address || !address.split(COMPOSITE_ID_SEPARATOR$1).some((part) => part !== "")) return void 0;
-			return encodeCursor(orderBy, row, row[pks[0].fieldName]);
+			return encodeCursor(orderBy, row, pks.length === 1 ? row[pks[0].fieldName] : address);
 		} catch {
 			return;
 		}
 	}
 	/**
-	* Post-fetch joinPath relations for a single flat row.
-	* joinPath relations cannot be expressed via Drizzle's `with` config,
-	* so they must be loaded separately after the primary query.
-	*/
-	async resolveJoinPathRelations(row, collection, collectionPath, parsedId, _databaseId) {
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const promises = Object.entries(resolvedRelations).filter(([key, relation]) => relation.kind === "via").map(async ([key, relation]) => {
-			try {
-				const relatedRows = await this.relationService.fetchRelatedEntities(collectionPath, parsedId, key, { limit: relation.cardinality === "one" ? 1 : void 0 });
-				if (relation.cardinality === "one" && relatedRows.length > 0) {
-					const e = relatedRows[0];
-					row[key] = createRelationRefWithData(e.id, e.path, e);
-				} else if (relation.cardinality === "many") row[key] = relatedRows.map((e) => createRelationRefWithData(e.id, e.path, e));
-			} catch (e) {
-				if (reachedDatabase(e)) throw e;
-				logger.warn(`Could not resolve joinPath relation '${key}'`, { error: e });
-			}
+	* Every relation of one row, as the refs the admin renders, attached in
+	* place.
+	*
+	* Loaded by the batched loaders an `include` takes, so a target reached from
+	* this row is read as the caller may see it: its `beforeQuery` scope and its
+	* soft delete applied, its unreadable fields stripped. Populated through
+	* drizzle's relational `with`, the single get knew neither, and a
+	* tenant-scoped user fetching an owner was handed another tenant's docs —
+	* and the trashed ones — under a relation `?include=` answered correctly.
+	*
+	* A to-many relation that reaches nothing is `[]`; a to-one is left off. A
+	* relation that fails for a reason other than the database is logged and
+	* left off, as on the include path, rather than failing the whole row.
+	*/
+	async loadRelationRefs(row, address, collection, collectionPath) {
+		if (!address) return;
+		const toRef = (related) => createRelationRefWithData(related.id, related.path, {
+			id: related.id,
+			path: related.path,
+			values: related.values
 		});
-		await Promise.all(promises);
+		for (const [key, relation] of Object.entries(resolveCollectionRelations(collection))) try {
+			if (relation.cardinality === "one") {
+				const related = (await this.relationService.batchFetchRelatedEntities(collectionPath, [address], key, relation)).get(address);
+				if (related) row[key] = toRef(related);
+			} else row[key] = ((await this.relationService.batchFetchRelatedEntitiesMany(collectionPath, [address], key, relation)).get(address) ?? []).map(toRef);
+		} catch (e) {
+			if (e instanceof ApiError) throw e;
+			if (reachedDatabase(e)) throw e;
+			logger.warn(`[FetchService] Could not load relation '${key}' on ${collectionPath}`, { error: e });
+		}
 	}
 	/**
 	* Extract cursor pagination conditions from startAfter options.
@@ -4493,26 +4539,102 @@ var FetchService = class FetchService {
 	* one key that is the familiar `k > v OR (k = v AND id < cursorId)`; with
 	* several it nests, each key's tie handing the decision to the next.
 	*/
-	buildCursorConditions(table, idField, idInfo, options, collectionPath) {
+	buildCursorConditions(table, idInfoArray, options, collectionPath) {
 		if (!options.startAfter) return [];
 		const cursor = options.startAfter;
 		const keys = normalizeDriverOrderBy(options.orderBy, options.order);
+		const keyColumns = FetchService.keyColumns(table, idInfoArray, collectionPath);
+		const cursorKey = FetchService.cursorKey(cursor, idInfoArray, collectionPath);
 		if (keys) {
 			if (keys.some(([field]) => field === FetchService.SCORE_FIELD)) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with `orderBy: \"_score\"`. Relevance is computed per query rather than stored, so it cannot key a cursor. Use `limit`/`offset` for relevance-ordered pages, or order by a column.", "SCORE_CURSOR_UNSUPPORTED", { field: FetchService.SCORE_FIELD });
-			const collection = collectionPath ? getCollectionByPath(collectionPath, this.registry) : void 0;
-			const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
-			const resolved = this.resolveOrderKeys(table, keys, collection, void 0, collectionPath, startAfterId ?? void 0);
-			if (resolved.length > 0 && startAfterId !== void 0) {
+			const collection = getCollectionByPath(collectionPath, this.registry);
+			const resolved = this.resolveOrderKeys(table, keys, collection, void 0, collectionPath, cursorKey?.length === 1 ? cursorKey[0] : void 0);
+			if (resolved.length > 0 && cursorKey) {
 				const cursorValues = cursor.values;
 				const values = resolved.map(({ field, cursorTarget }) => cursorTarget ? null : cursorValues && field in cursorValues ? cursorValues[field] : cursor[field]);
-				if (values.every((value, i) => resolved[i].cursorTarget || value !== void 0)) return [this.buildKeysetComparison(resolved, values, idField, startAfterId)];
+				if (values.every((value, i) => resolved[i].cursorTarget || value !== void 0)) {
+					const seekValues = values.map((value, i) => this.preciseCursorValue(table, resolved[i].target, value, keyColumns, cursorKey));
+					return [this.buildKeysetComparison(resolved, seekValues, keyColumns, cursorKey)];
+				}
 			}
-		} else {
-			const startAfterId = cursor.id ?? cursor[idInfo.fieldName];
-			if (startAfterId !== void 0 && startAfterId !== null) return [lt(idField, parseIdValues(startAfterId, [idInfo])[idInfo.fieldName])];
-		}
+		} else if (cursorKey) return [FetchService.keyAfter(keyColumns, cursorKey)];
 		return [];
 	}
+	/** The table's primary key columns, in key order. */
+	static keyColumns(table, idInfoArray, collectionPath) {
+		return idInfoArray.map((info) => {
+			const column = table[info.fieldName];
+			if (!column) throw new Error(`ID field '${info.fieldName}' not found in table for collection '${collectionPath}'`);
+			return column;
+		});
+	}
+	/**
+	* The cursor row's key, one value per key column — or `undefined` for a
+	* cursor that names no row.
+	*
+	* A cursor carries the row's address, which for a composite key is every
+	* part joined (see {@link cursorFor}). One that carries fewer parts than
+	* the key has columns — the first column's value alone, say — cannot say
+	* which row it stopped at, and is refused rather than read as a guess.
+	*/
+	static cursorKey(cursor, idInfoArray, collectionPath) {
+		const address = cursor.id;
+		if (idInfoArray.length === 1) {
+			const value = address ?? cursor[idInfoArray[0].fieldName];
+			return value === void 0 || value === null ? void 0 : [value];
+		}
+		if (address === void 0 || address === null) {
+			const parts = idInfoArray.map((info) => cursor[info.fieldName]);
+			return parts.some((part) => part === void 0 || part === null) ? void 0 : parts;
+		}
+		let parsed;
+		try {
+			parsed = parseIdValues$1(String(address), idInfoArray);
+		} catch {
+			throw ApiError.badRequest(`Invalid cursor: its row id does not name every key column of '${collectionPath}' (${idInfoArray.map((info) => info.fieldName).join(", ")}). Pass back the \`nextCursor\` from the previous page unchanged — it is opaque and must not be built by hand.`, "INVALID_CURSOR");
+		}
+		return idInfoArray.map((info) => parsed[info.fieldName]);
+	}
+	/**
+	* "Sorts after the cursor row" on the key alone: the key descending, as the
+	* `ORDER BY` ends.
+	*
+	* Every column runs the same direction, so for a composite key the
+	* row-value comparison is exactly the lexicographic order the `ORDER BY`
+	* produces.
+	*/
+	static keyAfter(keyColumns, cursorKey) {
+		if (keyColumns.length === 1) return lt(keyColumns[0], cursorKey[0]);
+		const values = keyColumns.map((column, i) => sql.param(cursorKey[i], column));
+		return sql`(${sql.join(keyColumns, sql`, `)}) < (${sql.join(values, sql`, `)})`;
+	}
+	/**
+	* The cursor row's value for a timestamp key, to the microsecond.
+	*
+	* A cursor is built from the row as served, and a timestamp is served to
+	* the millisecond while Postgres stores it to the microsecond. Seeking past
+	* the served value compares the column against something up to 999µs short
+	* of the cursor row's own, so every row in that sliver lands on the wrong
+	* side of it: paging `createdAt desc` over rows written in one transaction
+	* stopped after the first page, and ascending repeated the cursor row
+	* forever.
+	*
+	* So the exact value is read back from the cursor row by its key — but only
+	* while that row still holds the millisecond the cursor carries. A row
+	* deleted or re-stamped since the page was served falls back to the stored
+	* value, which is where the listing was when the cursor was issued.
+	*
+	* Any other key, and a NULL, is returned as it came.
+	*/
+	preciseCursorValue(table, target, value, keyColumns, cursorKey) {
+		if (value === null || value === void 0) return value;
+		if (!is(target, PgTimestamp) && !is(target, PgTimestampString)) return value;
+		if (target.precision !== void 0 && target.precision <= 3) return value;
+		const stored = sql`CAST(${value instanceof Date ? value.toISOString() : String(value)} AS ${sql.raw(target.getSQLType())})`;
+		const alias = sql.identifier("__cursor_row");
+		const column = sql`${alias}.${sql.identifier(target.name)}`;
+		return sql`COALESCE((SELECT ${column} FROM ${table} AS ${alias} WHERE ${sql.join(keyColumns.map((key, i) => sql`${alias}.${sql.identifier(key.name)} = ${sql.param(cursorKey[i], key)}`), sql` AND `)} AND ${column} >= ${stored} AND ${column} < ${stored} + INTERVAL '1 millisecond' LIMIT 1), ${stored})`;
+	}
 	/**
 	* "Sorts strictly after the cursor row", over `keys` and then the id.
 	*
@@ -4526,13 +4648,13 @@ var FetchService = class FetchService {
 	* NULL and therefore match nothing. Ordering by a nullable column and paging
 	* used to drop every row whose sort value was NULL from page two onward.
 	*/
-	buildKeysetComparison(keys, values, idField, cursorId, index = 0) {
-		if (index >= keys.length) return lt(idField, cursorId);
+	buildKeysetComparison(keys, values, keyColumns, cursorKey, index = 0) {
+		if (index >= keys.length) return FetchService.keyAfter(keyColumns, cursorKey);
 		const { direction, cursorTarget } = keys[index];
 		const nullsLast = FetchService.nullsLast(keys[index]);
 		const target = keys[index].target;
 		const value = values[index];
-		const rest = this.buildKeysetComparison(keys, values, idField, cursorId, index + 1);
+		const rest = this.buildKeysetComparison(keys, values, keyColumns, cursorKey, index + 1);
 		const after = (a, b) => direction === "asc" ? gt(a, b) : lt(a, b);
 		const afterSql = (a, b) => direction === "asc" ? sql`${a} > ${b}` : sql`${a} < ${b}`;
 		if (cursorTarget) return nullsLast ? or(and(isNull(cursorTarget), isNull(target), rest), and(isNotNull(cursorTarget), or(afterSql(target, cursorTarget), isNull(target), and(sql`${target} = ${cursorTarget}`, rest)))) : or(and(isNull(cursorTarget), or(isNotNull(target), and(isNull(target), rest))), and(isNotNull(cursorTarget), or(afterSql(target, cursorTarget), and(sql`${target} = ${cursorTarget}`, rest))));
@@ -4546,7 +4668,7 @@ var FetchService = class FetchService {
 	buildRelationScope(hop) {
 		const parentPks = requirePrimaryKeys(hop.parentCollection, this.registry);
 		const parentIdInfo = parentPks[0];
-		const parsedParentId = parseIdValues(hop.parentId, parentPks)[parentIdInfo.fieldName];
+		const parsedParentId = parseIdValues$1(hop.parentId, parentPks)[parentIdInfo.fieldName];
 		const parent = () => {
 			const table = getTableForCollection(hop.parentCollection, this.registry);
 			const idColumn = table[parentIdInfo.fieldName];
@@ -4586,60 +4708,38 @@ var FetchService = class FetchService {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
-		const idInfo = idInfoArray[0];
-		const idField = table[idInfo.fieldName];
-		if (!idField) throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
 		if (!idCanAddressTable(id, table, idInfoArray)) return void 0;
-		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
+		const addressed = rowIdentityCondition(table, idInfoArray, id, collectionPath);
 		const narrowing = await this.narrowReadCondition(collectionPath, collection, table, "get", {});
-		const identity = narrowing ? and(eq(idField, parsedId), narrowing) : eq(idField, parsedId);
+		const identity = narrowing ? and(addressed, narrowing) : addressed;
 		const tableName = getTableName(table);
 		const qb = this.getQueryBuilder(tableName);
-		if (qb) try {
-			const withConfig = this.buildWithConfig(collection);
-			const hidden = hiddenColumnsOption(getTableColumns(table), collection);
-			const row = await qb.findFirst({
-				where: andSoftDelete(identity, collection, table, withDeleted),
-				with: withConfig,
-				...hidden ? { columns: hidden } : {}
-			});
-			if (!row) return void 0;
-			const flatRow = toFlatRow(row, collection, this.registry);
-			await this.resolveJoinPathRelations(flatRow, collection, collectionPath, parsedId, databaseId);
-			return flatRow;
-		} catch (e) {
-			if (e instanceof Error && e.message.includes("not enough information to infer relation")) {
-				logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
-				logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
+		if (qb) {
+			let row = null;
+			try {
+				const hidden = hiddenColumnsOption(getTableColumns(table), collection);
+				row = await qb.findFirst({
+					where: andSoftDelete(identity, collection, table, withDeleted),
+					...hidden ? { columns: hidden } : {}
+				});
+			} catch (e) {
+				if (reachedDatabase(e)) throw e;
+				logger.warn(`[FetchService] db.query.findFirst failed for ${collectionPath}, falling back to db.select`, { error: e });
+			}
+			if (row === void 0) return void 0;
+			if (row !== null) {
+				const flatRow = toFlatRow(row, collection, this.registry);
+				await this.loadRelationRefs(flatRow, buildCompositeId$1(row, idInfoArray), collection, collectionPath);
+				return stripUnreadable(flatRow, collection);
 			}
-			if (reachedDatabase(e)) throw e;
-			logger.warn(`[FetchService] db.query.findFirst failed for ${collectionPath}, falling back to db.select`, { error: e });
 		}
 		const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
 		const result = await this.db.select(visibleOne).from(table).where(andSoftDelete(identity, collection, table, withDeleted)).limit(1);
 		if (result.length === 0) return void 0;
 		const raw = result[0];
-		const values = await parseDataFromServer(raw, collection, this.db, this.registry);
-		const resolvedRelations = resolveCollectionRelations(collection);
-		const propertyKeys = new Set(Object.keys(collection.properties));
-		const relationPromises = Object.entries(resolvedRelations).filter(([key]) => propertyKeys.has(key)).map(async ([key, relation]) => {
-			if (relation.cardinality === "many") {
-				const relatedRows = await this.relationService.fetchRelatedEntities(collectionPath, parsedId, key, {});
-				values[key] = relatedRows.map((e) => createRelationRef(e.id, e.path));
-			} else if (relation.cardinality === "one") {
-				if (values[key] == null) try {
-					const relatedRows = await this.relationService.fetchRelatedEntities(collectionPath, parsedId, key, { limit: 1 });
-					if (relatedRows.length > 0) {
-						const e = relatedRows[0];
-						values[key] = createRelationRef(e.id, e.path);
-					}
-				} catch (e) {
-					if (reachedDatabase(e)) throw e;
-					logger.warn(`Could not resolve one-to-one relation property: ${key}`, { error: e });
-				}
-			}
-		});
-		await Promise.all(relationPromises);
+		const values = await parseDataFromServer(raw, collection);
+		await this.loadRelationRefs(values, buildCompositeId$1(raw, idInfoArray), collection, collectionPath);
+		stripUnreadable(values, collection);
 		return {
 			...values,
 			id: id.toString()
@@ -4670,6 +4770,7 @@ var FetchService = class FetchService {
 		if (results.length === 0) return [];
 		const values = await Promise.all(results.map(async (rawRow) => await parseDataFromServer(rawRow, collection)));
 		if (include) await this.loadIncludes(values, collection, collectionPath, include);
+		for (const row of values) stripUnreadable(row, collection);
 		return values;
 	}
 	/**
@@ -4677,11 +4778,10 @@ var FetchService = class FetchService {
 	*/
 	async fetchCollection(collectionPath, options = {}) {
 		const hop = isNestedPath(collectionPath) ? resolveNestedPath(collectionPath, this.registry) : void 0;
-		if (hop) return this.fetchRowsWithConditions(hop.targetCollection.slug, {
+		return this.fetchRowsWithConditions(hop ? hop.targetCollection.slug : collectionPath, {
 			...options,
 			relatedTo: hop
 		});
-		return this.fetchRowsWithConditions(collectionPath, options);
 	}
 	/**
 	* Search rows by text
@@ -4806,7 +4906,9 @@ var FetchService = class FetchService {
 		}
 		if (groupColumns.length > 0) {
 			query = query.groupBy(...groupColumns.map((g) => g.column));
+			query = query.orderBy(...this.aggregateOrdering(options.orderBy, groupColumns, options.aggregates, selection));
 			if (options.limit) query = query.limit(options.limit);
+			if (options.offset) query = query.offset(options.offset);
 		}
 		const rows = await query;
 		const numericAliases = numericAggregateAliases(options.aggregates, collection?.properties ?? {});
@@ -4821,6 +4923,50 @@ var FetchService = class FetchService {
 		});
 	}
 	/**
+	* The `ORDER BY` of a grouped aggregate: the caller's keys, then every
+	* group key they did not name.
+	*
+	* A grouped aggregate is paged like a listing — `limit` bounds it, so more
+	* groups than one page holds are reached with `offset` — and a page is only
+	* a page over a total order. With no `ORDER BY` at all, Postgres returns the
+	* groups in whatever order its plan produces them, so "the next fifty" was
+	* not a thing that existed. The group keys identify a group, so ending on
+	* them makes the order total and puts every page boundary in the same place
+	* on every request.
+	*
+	* A key may name a `groupBy` field or an aggregate by its alias
+	* (`count`, `sum_total`), sorted on the aggregate's own expression — a
+	* drizzle selection is not aliased in the SQL, so there is no output name
+	* to refer to. Anything else is a 400: Postgres would refuse it too, but as
+	* a `GROUP BY` error from inside the statement.
+	*/
+	aggregateOrdering(orderBy, groupColumns, aggregates, selection) {
+		const keys = [];
+		const named = /* @__PURE__ */ new Set();
+		for (const [field, direction, nulls] of orderBy ?? []) {
+			const group = groupColumns.find((g) => g.field === field);
+			const aggregate = aggregates.find((a) => a.alias === field);
+			const target = group?.column ?? (aggregate ? selection[aggregate.alias] : void 0);
+			if (!target) {
+				const sortable = [...groupColumns.map((g) => g.field), ...aggregates.map((a) => a.alias)];
+				throw ApiError.badRequest(`An aggregate cannot be sorted by '${field}'. It sorts by what it returns: ${sortable.map((name) => `'${name}'`).join(", ")}.`, "INVALID_ORDER_BY");
+			}
+			keys.push({
+				field,
+				direction,
+				nulls,
+				target
+			});
+			named.add(field);
+		}
+		for (const group of groupColumns) if (!named.has(group.field)) keys.push({
+			field: group.field,
+			direction: "asc",
+			target: group.column
+		});
+		return this.buildOrderExpressions(keys, []);
+	}
+	/**
 	* Check if a field value is unique.
 	*
 	* Deliberately **not** narrowed by `beforeQuery`, and it is the only read
@@ -4836,12 +4982,10 @@ var FetchService = class FetchService {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
-		const idInfo = idInfoArray[0];
-		const idField = table[idInfo.fieldName];
 		const field = table[fieldName];
 		if (!field) return true;
-		const parsedExcludeId = excludeEntityId ? parseIdValues(excludeEntityId, idInfoArray)[idInfo.fieldName] : void 0;
-		const conditions = DrizzleConditionBuilder.buildUniqueFieldCondition(field, value, idField, parsedExcludeId);
+		const excludeRow = excludeEntityId && idCanAddressTable(excludeEntityId, table, idInfoArray) ? rowIdentityCondition(table, idInfoArray, excludeEntityId, collectionPath) : void 0;
+		const conditions = DrizzleConditionBuilder.buildUniqueFieldCondition(field, value, excludeRow);
 		const result = await this.db.select({ count: count() }).from(table).where(and(...conditions));
 		return Number(result[0]?.count || 0) === 0;
 	}
@@ -4901,14 +5045,12 @@ var FetchService = class FetchService {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
-		const idInfo = idInfoArray[0];
-		const idField = table[idInfo.fieldName];
 		if (!idCanAddressTable(id, table, idInfoArray)) return null;
-		const parsedId = parseIdValues(id, idInfoArray)[idInfo.fieldName];
+		const addressed = rowIdentityCondition(table, idInfoArray, id, collectionPath);
 		const withDeleted = options?.withDeleted;
 		const projection = this.columnProjection(table, collection, options?.fields, idInfoArray);
 		const narrowing = await this.narrowReadCondition(collectionPath, collection, table, "get", FetchService.describeRead({ fields: options?.fields }));
-		const identity = narrowing ? and(eq(idField, parsedId), narrowing) : eq(idField, parsedId);
+		const identity = narrowing ? and(addressed, narrowing) : addressed;
 		const result = await this.db.select(projection).from(table).where(andSoftDelete(identity, collection, table, withDeleted)).limit(1);
 		if (result.length === 0) return null;
 		const row = toRestRow(result[0], collection, this.registry);
@@ -4923,8 +5065,7 @@ var FetchService = class FetchService {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = requirePrimaryKeys(collection, this.registry);
-		const idInfo = idInfoArray[0];
-		const idField = table[idInfo.fieldName];
+		if (options.vectorSearch && options.startAfter) throw ApiError.badRequest("Cursor pagination (`startAfter`) cannot be combined with a vector search. Its rows are ordered by a distance computed per query, which cannot key a cursor. Use `limit`/`offset` for the next page of nearest rows.", "VECTOR_CURSOR_UNSUPPORTED");
 		let vectorMeta;
 		if (options.vectorSearch) vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
 		const visible = this.columnProjection(table, collection, options.fields, idInfoArray, options.distinct === true);
@@ -4972,10 +5113,11 @@ var FetchService = class FetchService {
 			const missing = sortKeys.map(([field]) => field).filter((field) => !selected.has(field));
 			if (missing.length > 0) throw ApiError.badRequest(`\`distinct\` cannot sort by ${missing.map((f) => `'${f}'`).join(", ")}: a DISTINCT read can only be ordered by columns it returns, or the rows it collapses have no defined order. Add ${missing.map((f) => `'${f}'`).join(", ")} to \`fields\`, or drop them from \`orderBy\`.`, "DISTINCT_ORDER_BY_NOT_SELECTED", { fields: missing });
 		}
-		const orderExpressions = vectorMeta ? [asc(vectorMeta.orderBy), desc(idField)] : this.buildOrderExpressions(this.resolveOrderKeys(table, sortKeys, collection, options.searchString), idField, !wantsDistinct);
+		const keyColumns = FetchService.keyColumns(table, idInfoArray, collectionPath);
+		const orderExpressions = vectorMeta ? [asc(vectorMeta.orderBy), ...keyColumns.map((column) => desc(column))] : this.buildOrderExpressions(this.resolveOrderKeys(table, sortKeys, collection, options.searchString), wantsDistinct ? [] : keyColumns);
 		if (orderExpressions.length > 0) query = query.orderBy(...orderExpressions);
 		if (options.startAfter) {
-			const cursorConditions = this.buildCursorConditions(table, idField, idInfo, options, collectionPath);
+			const cursorConditions = this.buildCursorConditions(table, idInfoArray, options, collectionPath);
 			if (cursorConditions.length > 0) {
 				allConditions.push(...cursorConditions);
 				const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
@@ -5114,16 +5256,33 @@ var RelationWriteService = class {
 			relation: hop.relationKey
 		});
 	}
+	/**
+	* The target rows of `relation` this caller can see, for a junction diff —
+	* or `undefined` when that is all of them. See
+	* {@link RelationService.visibleTargetCondition}.
+	*/
+	async visibleTargets(parentCollection, relation, parentId) {
+		const condition = await this.reads.visibleTargetCondition(parentCollection, relation, parentId);
+		if (!condition) return void 0;
+		const targetCollection = relation.target();
+		const table = getTableForCollection(targetCollection, this.registry);
+		const [idInfo] = requirePrimaryKeys(targetCollection, this.registry);
+		return {
+			table,
+			idColumn: table[idInfo.fieldName],
+			condition
+		};
+	}
 	/** A collection's id, parsed to the type its primary key column holds. */
 	parsedId(collection, id) {
 		const pks = requirePrimaryKeys(collection, this.registry);
-		return parseIdValues(id, pks)[pks[0].fieldName];
+		return parseIdValues$1(id, pks)[pks[0].fieldName];
 	}
 	/** The same, for the membership list a to-many write names. */
 	parsedIds(collection, ids) {
 		if (ids.length === 0) return [];
 		const pks = requirePrimaryKeys(collection, this.registry);
-		return ids.map((id) => parseIdValues(id, pks)[pks[0].fieldName]);
+		return ids.map((id) => parseIdValues$1(id, pks)[pks[0].fieldName]);
 	}
 	/**
 	* A membership list as links: the target ids parsed, and each element's
@@ -5141,7 +5300,7 @@ var RelationWriteService = class {
 		if (elements.length === 0) return [];
 		const pks = requirePrimaryKeys(collection, this.registry);
 		return elements.map((element) => ({
-			id: parseIdValues(element.id, pks)[pks[0].fieldName],
+			id: parseIdValues$1(element.id, pks)[pks[0].fieldName],
 			pivot: element.pivot ? serializePivot(element.pivot, payload, label) : void 0
 		}));
 	}
@@ -5157,8 +5316,8 @@ var RelationWriteService = class {
 			const targetEntityIds = elements.map((element) => element.id);
 			const targetCollection = relation.target();
 			const label = `${collection.slug}.${key}`;
-			if (relation.kind === "via") await applyJunctionMembership(tx, bindJoinPathJunction(this.registry, relation.joinPath, getTableName$1(collection), getTableName$1(targetCollection), label), this.parsedId(collection, id), this.parsedLinks(targetCollection, elements, {}, label));
-			else if (relation.kind === "manyToMany") await applyJunctionMembership(tx, bindThroughJunction(this.registry, relation.through, label), this.parsedId(collection, id), this.parsedLinks(targetCollection, elements, relation.through.properties, label));
+			if (relation.kind === "via") await applyJunctionMembership(tx, bindJoinPathJunction(this.registry, relation.joinPath, getTableName$1(collection), getTableName$1(targetCollection), label), this.parsedId(collection, id), this.parsedLinks(targetCollection, elements, {}, label), await this.visibleTargets(collection, relation, id));
+			else if (relation.kind === "manyToMany") await applyJunctionMembership(tx, bindThroughJunction(this.registry, relation.through, label), this.parsedId(collection, id), this.parsedLinks(targetCollection, elements, relation.through.properties, label), await this.visibleTargets(collection, relation, id));
 			else if (relation.cardinality === "many" && hasForeignKeyOnTarget(relation)) {
 				const targetTable = getTableForCollection(targetCollection, this.registry);
 				const targetPks = requirePrimaryKeys(targetCollection, this.registry);
@@ -5169,11 +5328,12 @@ var RelationWriteService = class {
 				if (!fkCol || !targetIdCol) throw relationMisconfigured(label, `the target table '${getTableName$1(targetCollection)}' has no ${fkCol ? `'${targetIdInfo.fieldName}' key column` : `'${relation.foreignKeyOnTarget}' foreign-key column`}`);
 				const parentKeyValue = (await this.reads.resolveSourceKeys(collection, relation, [id], tx)).keyByParentId.get(String(id));
 				if (parentKeyValue === void 0) throw new Error(`Cannot write relation '${key}' on '${collection.slug}': row '${id}' has no value in \`sourceKey: "${sourceKeyField(relation, collection, this.registry)}"\`, so there is nothing for the related rows to point at.`);
+				const visible = await this.reads.visibleTargetCondition(collection, relation, id);
 				if (targetEntityIds.length > 0) {
-					const parsedTargetIds = targetEntityIds.map((id) => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
-					await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(fkCol, parentKeyValue), notInArray(targetIdCol, parsedTargetIds)));
+					const parsedTargetIds = targetEntityIds.map((id) => parseIdValues$1(id, targetPks)[targetIdInfo.fieldName]);
+					await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(fkCol, parentKeyValue), notInArray(targetIdCol, parsedTargetIds), visible));
 					await tx.update(targetTable).set({ [fkField]: parentKeyValue }).where(inArray(targetIdCol, parsedTargetIds));
-				} else await tx.update(targetTable).set({ [fkField]: null }).where(eq(fkCol, parentKeyValue));
+				} else await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(fkCol, parentKeyValue), visible));
 			} else throw relationMisconfigured(label, "it is a to-many relation with no way to write links — a `manyToMany` needs `through`, a `hasMany` needs `foreignKeyOnTarget`");
 		}
 	}
@@ -5209,15 +5369,16 @@ var RelationWriteService = class {
 				if (!foreignKeyColumn) throw relationMisconfigured(label, `'${relation.foreignKeyOnTarget}' is not a column on the target table '${getTableName$1(targetCollection)}'`);
 				const sourceKeyValue = (await this.reads.resolveSourceKeys(sourceCollection, relation, [sourceEntityId], tx)).keyByParentId.get(String(sourceEntityId));
 				if (sourceKeyValue === void 0) throw new Error(`Cannot write relation '${relation.relationName}' on '${sourceCollection.slug}': row '${sourceEntityId}' has no value in \`sourceKey: "${sourceKeyField(relation, sourceCollection, this.registry)}"\`, so there is nothing for the related row to point at.`);
-				if (newValue === null || newValue === void 0) await tx.update(targetTable).set({ [fkField]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
+				const visible = await this.reads.visibleTargetCondition(sourceCollection, relation, sourceEntityId);
+				if (newValue === null || newValue === void 0) await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(foreignKeyColumn, sourceKeyValue), visible));
 				else {
-					const parsedNewTargetId = parseIdValues(newValue, targetPks)[targetIdInfo.fieldName];
+					const parsedNewTargetId = parseIdValues$1(newValue, targetPks)[targetIdInfo.fieldName];
 					const targetIdField = targetTable[targetIdInfo.fieldName];
-					await tx.update(targetTable).set({ [fkField]: null }).where(eq(foreignKeyColumn, sourceKeyValue));
+					await tx.update(targetTable).set({ [fkField]: null }).where(and(eq(foreignKeyColumn, sourceKeyValue), visible));
 					await tx.update(targetTable).set({ [fkField]: sourceKeyValue }).where(eq(targetIdField, parsedNewTargetId));
 				}
 			} catch (e) {
-				if (e instanceof ApiError || e?.name === "ApiError") throw e;
+				if (e instanceof ApiError || e?.name === "ApiError" || reachedDatabase(e)) throw e;
 				logger.warn(`Failed to update inverse relation '${relation.relationName}'`, { error: e });
 			}
 		}
@@ -5232,7 +5393,7 @@ var RelationWriteService = class {
 		try {
 			const binding = bindJoinPathJunction(this.registry, relation.joinPath, sourceTableName, targetTableName, `${sourceCollection.slug}.${relation.relationName}`);
 			const elements = Array.isArray(newValue) ? relationLinkElements(newValue, relation.relationName, sourceCollection.slug) : newValue === null || newValue === void 0 ? [] : relationLinkElements([newValue], relation.relationName, sourceCollection.slug);
-			await applyJunctionMembership(tx, binding, this.parsedId(sourceCollection, sourceEntityId), this.parsedLinks(targetCollection, elements, {}, `${sourceCollection.slug}.${relation.relationName}`));
+			await applyJunctionMembership(tx, binding, this.parsedId(sourceCollection, sourceEntityId), this.parsedLinks(targetCollection, elements, {}, `${sourceCollection.slug}.${relation.relationName}`), await this.visibleTargets(sourceCollection, relation, sourceEntityId));
 		} catch (error) {
 			logger.error(`Failed to update inverse joinPath relation '${relation.relationName}'`, { error });
 			throw error;
@@ -5245,7 +5406,7 @@ var RelationWriteService = class {
 		const label = `${sourceCollection.slug}.${relation.relationName}`;
 		try {
 			const elements = Array.isArray(newValue) ? relationLinkElements(newValue, relation.relationName, sourceCollection.slug) : [];
-			await applyJunctionMembership(tx, bindThroughJunction(this.registry, junctionInfo, label), this.parsedId(sourceCollection, sourceEntityId), this.parsedLinks(targetCollection, elements, junctionInfo.properties, label));
+			await applyJunctionMembership(tx, bindThroughJunction(this.registry, junctionInfo, label), this.parsedId(sourceCollection, sourceEntityId), this.parsedLinks(targetCollection, elements, junctionInfo.properties, label), await this.visibleTargets(sourceCollection, relation, sourceEntityId));
 		} catch (error) {
 			logger.error(`Failed to update many-to-many inverse relation '${relation.relationName}'`, { error });
 			throw error;
@@ -5268,7 +5429,7 @@ var RelationWriteService = class {
 			const parentTable = getTableForCollection(parentCollection, this.registry);
 			const parentPks = requirePrimaryKeys(parentCollection, this.registry);
 			const parentIdInfo = parentPks[0];
-			const parsedParentId = parseIdValues(parentId, parentPks)[parentIdInfo.fieldName];
+			const parsedParentId = parseIdValues$1(parentId, parentPks)[parentIdInfo.fieldName];
 			const parentIdCol = parentTable[parentIdInfo.fieldName];
 			const parentSourceCol = parentTable[parentSourceColName];
 			const targetFKCol = targetTable[targetFKColName];
@@ -5282,7 +5443,7 @@ var RelationWriteService = class {
 				if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
 				continue;
 			}
-			const parsedTargetId = parseIdValues(newTargetId, targetPks)[targetIdInfo.fieldName];
+			const parsedTargetId = parseIdValues$1(newTargetId, targetPks)[targetIdInfo.fieldName];
 			if (parentFKValue !== null && parentFKValue !== void 0) await tx.update(targetTable).set({ [targetFKColName]: null }).where(eq(targetFKCol, String(parentFKValue)));
 			else throw ApiError.badRequest(`Cannot write relation '${label}': row '${parentId}' has no value in '${parentSourceColName}', which is the column its joinPath joins on, so there is nothing for the related row to point at.`, "RELATION_SOURCE_KEY_EMPTY");
 			await tx.update(targetTable).set({ [targetFKColName]: parentFKValue }).where(eq(targetIdCol, parsedTargetId));
@@ -5351,6 +5512,10 @@ var RelationWriteService = class {
 * silently empties itself the first time it is incremented from an unset column
 * is worse than one that never worked.
 *
+* What an operation produces answers to the property's declared bounds, and
+* that check is compiled here too, as conditions for the same UPDATE — see
+* {@link compileFieldOpBounds}.
+*
 * @module
 */
 /** What the column is, as Postgres sees it: `text[]`, `jsonb`, `integer`, … */
@@ -5429,9 +5594,165 @@ function compileFieldOps(table, fieldOps, context) {
 	for (const [field, op] of Object.entries(fieldOps)) compiled[field] = compileFieldOp(table, field, op, context);
 	return compiled;
 }
+/**
+* The declared bounds each operation's *result* must satisfy, as conditions
+* for the UPDATE that applies it.
+*
+* `{ stock: -5 }` on `stock: { validation: { min: 0 } }` is refused before the
+* statement is built, because the value is in the request. What
+* `{ stock: { $inc: -1000 } }` produces depends on the stored row, which the
+* request never sees, so it can only be judged where the row is: in the WHERE
+* of the UPDATE that does the arithmetic, over the row that statement holds
+* locked. Reading the row first and judging the sum would reopen the race the
+* operation exists to close — two decrements of a stock of 1 would each read
+* `1`, each find room for one more, and both go through. A condition on the
+* UPDATE cannot be raced that way: under READ COMMITTED an UPDATE blocked on a
+* concurrent writer re-evaluates its WHERE against the row that writer
+* committed, so the second decrement sees `0 - 1` and matches nothing.
+*
+* The bound is the whole declared range, applied to the result the way it
+* applies to a value: a number's `min`, `max`, `moreThan`, `lessThan`,
+* `positive` and `negative`, an array's `min` and `max` items. `integer` is not
+* here: a whole increment of a whole number stays whole, and the request
+* already refuses a fractional one. `$merge` has no bounds to hold.
+*/
+function compileFieldOpBounds(table, fieldOps, properties, context) {
+	const bounds = [];
+	for (const [field, op] of Object.entries(fieldOps)) {
+		const property = properties[field];
+		if (!property?.validation) continue;
+		if (property.type === "number" && op.operator === "$inc" && typeof op.operand === "number") {
+			const result = compileFieldOp(table, field, op, context);
+			bounds.push(...numberBounds(field, property.validation, result, op.operand));
+		} else if (property.type === "array" && (op.operator === "$push" || op.operator === "$pull")) {
+			const column = table[field];
+			const result = compileFieldOp(table, field, op, context);
+			const size = column && isNativeArray(sqlTypeOf(column)) ? sql`cardinality(${result})` : sql`jsonb_array_length((${result})::jsonb)`;
+			bounds.push(...arrayBounds(field, property.validation, size, op.operator));
+		}
+	}
+	return bounds;
+}
+function numberBounds(field, rules, result, operand) {
+	const by = `$inc by ${operand}`;
+	const bounds = [];
+	if (rules.min !== void 0) bounds.push({
+		field,
+		code: "min",
+		holds: sql`(${result}) >= ${rules.min}::numeric`,
+		message: `'${field}' must be at least ${rules.min}, and ${by} would take it below that.`
+	});
+	if (rules.max !== void 0) bounds.push({
+		field,
+		code: "max",
+		holds: sql`(${result}) <= ${rules.max}::numeric`,
+		message: `'${field}' must be at most ${rules.max}, and ${by} would take it above that.`
+	});
+	if (rules.moreThan !== void 0) bounds.push({
+		field,
+		code: "more_than",
+		holds: sql`(${result}) > ${rules.moreThan}::numeric`,
+		message: `'${field}' must be greater than ${rules.moreThan}, and ${by} would take it to ${rules.moreThan} or below.`
+	});
+	if (rules.lessThan !== void 0) bounds.push({
+		field,
+		code: "less_than",
+		holds: sql`(${result}) < ${rules.lessThan}::numeric`,
+		message: `'${field}' must be less than ${rules.lessThan}, and ${by} would take it to ${rules.lessThan} or above.`
+	});
+	if (rules.positive) bounds.push({
+		field,
+		code: "positive",
+		holds: sql`(${result}) > 0`,
+		message: `'${field}' must be positive, and ${by} would take it to 0 or below.`
+	});
+	if (rules.negative) bounds.push({
+		field,
+		code: "negative",
+		holds: sql`(${result}) < 0`,
+		message: `'${field}' must be negative, and ${by} would take it to 0 or above.`
+	});
+	return bounds;
+}
+function arrayBounds(field, rules, size, operator) {
+	const items = (n) => `${n} item${n === 1 ? "" : "s"}`;
+	const bounds = [];
+	if (rules.min !== void 0) bounds.push({
+		field,
+		code: "min_items",
+		holds: sql`COALESCE(${size} >= ${rules.min}::numeric, TRUE)`,
+		message: `'${field}' must have at least ${items(rules.min)}, and ${operator} would leave it with fewer.`
+	});
+	if (rules.max !== void 0) bounds.push({
+		field,
+		code: "max_items",
+		holds: sql`COALESCE(${size} <= ${rules.max}::numeric, TRUE)`,
+		message: `'${field}' must have at most ${items(rules.max)}, and ${operator} would leave it with more.`
+	});
+	return bounds;
+}
+/**
+* Which bounds the row, as it now stands, would break — for an UPDATE that
+* carried bounds and matched nothing.
+*
+* A guarded UPDATE matching zero rows means one of three things: the row is not
+* there for this caller (404), a row-level security policy refused the write
+* (403), or the operation's result broke a bound (400). The first two are
+* `explainZeroRowWrite`'s; this answers the third, by evaluating each bound
+* against the row over the same handle and the same key conditions. An empty
+* answer — the row is not visible, or every bound holds — leaves the decision to
+* `explainZeroRowWrite`.
+*
+* It is a second statement, so the row can change in between. A row deleted in
+* between is a 404 here as it would have been anyway. A row changed so that the
+* operation now fits reads as "every bound holds" and falls through to the
+* row-level-security answer; the write was refused either way, and the
+* refusal is never turned into a write.
+*
+* Only booleans come back — whether each bound holds — never the stored value.
+*/
+async function brokenFieldOpBounds(handle, table, conditions, bounds) {
+	if (bounds.length === 0) return [];
+	const selection = {};
+	bounds.forEach((bound, index) => {
+		selection[`bound${index}`] = sql`(${bound.holds})`;
+	});
+	const row = (await handle.select(selection).from(table).where(and(...conditions)).limit(1))[0];
+	if (!row) return [];
+	return bounds.filter((_bound, index) => row[`bound${index}`] === false);
+}
+/** The 400 a write gets when an operation's result breaks a bound. */
+function fieldOpBoundsError(collectionSlug, broken) {
+	const violations = broken.map(({ field, code, message }) => ({
+		field,
+		code,
+		message
+	}));
+	const messages = violations.map((violation) => violation.message);
+	return ApiError.badRequest(messages.join(" "), "VALIDATION_CONSTRAINT", {
+		collection: collectionSlug,
+		violations,
+		messages
+	});
+}
 //#endregion
 //#region src/services/PersistService.ts
 /**
+* The top-level properties whose value is stamped once, when the row is
+* created: `on_create` dates and `user_on_create` identities.
+*
+* What they hold is a fact about the row's creation, so a write to a row that
+* already exists has nothing to say about them — an update, and the
+* conflict-update of an upsert that met a stored row. Top level only: a stamp
+* nested inside a `map` is part of that map's value, not a column a write can
+* leave out.
+*/
+function createStampKeys(properties) {
+	const keys = [];
+	for (const [key, property] of Object.entries(properties ?? {})) if (property?.type === "date" && property.autoValue === "on_create" || property?.type === "string" && property.autoValue === "user_on_create") keys.push(key);
+	return keys;
+}
+/**
 * Service for handling all row write operations.
 * Handles saving, deleting, and updating rows.
 */
@@ -5493,14 +5814,20 @@ var PersistService = class {
 		const collection = getCollectionByPath(collectionPath, this.registry);
 		const table = getTableForCollection(collection, this.registry);
 		const idInfoArray = getPrimaryKeys(collection, this.registry);
-		const parsedIdObj = parseIdValues(id, idInfoArray);
+		const parsedIdObj = parseIdValues$1(id, idInfoArray);
 		const conditions = [];
 		for (const info of idInfoArray) {
 			const field = table[info.fieldName];
 			if (!field) throw new Error(`ID field '${info.fieldName}' not found in table for collection '${collectionPath}'`);
 			conditions.push(eq(field, parsedIdObj[info.fieldName]));
 		}
-		if (((await this.db.delete(table).where(and(...conditions))).rowCount ?? 0) === 0) throw await this.explainZeroRowWrite(this.db, table, conditions, collectionPath, id, "delete");
+		let result;
+		try {
+			result = await this.db.delete(table).where(and(...conditions));
+		} catch (error) {
+			throw this.toUserFriendlyError(error, collection.slug, collection, "delete");
+		}
+		if ((result.rowCount ?? 0) === 0) throw await this.explainZeroRowWrite(this.db, table, conditions, collectionPath, id, "delete");
 	}
 	/**
 	* Delete all rows from a collection
@@ -5544,6 +5871,10 @@ var PersistService = class {
 	* the row already exists — which is what a re-runnable import needs. The
 	* conflict is matched on the primary key unless `options.onConflict` names
 	* other columns; see {@link SaveProps.onConflict} for why that matters.
+	* When the INSERT meets a stored row, the conflict-update sets what the
+	* caller wrote and nothing the create alone decides — see
+	* {@link PersistSaveOptions.insertOnlyKeys} — and only on a row the caller's
+	* `beforeQuery` scope reaches.
 	*
 	* `values` may carry field operations (`{ views: { $inc: 1 } }`). They are
 	* split out here rather than at the REST boundary because every request
@@ -5561,7 +5892,7 @@ var PersistService = class {
 			effectiveCollectionPath = hop.targetCollection.slug;
 			const parentIdForWrite = () => {
 				const parentPks = getPrimaryKeys(hop.parentCollection, this.registry);
-				return parseIdValues(hop.parentId, parentPks)[parentPks[0].fieldName];
+				return parseIdValues$1(hop.parentId, parentPks)[parentPks[0].fieldName];
 			};
 			if (isManyToMany(hop.relation)) junctionTableInfo = {
 				parentCollection: hop.parentCollection,
@@ -5622,10 +5953,11 @@ var PersistService = class {
 				let currentId;
 				if (id && !options?.upsert) {
 					currentId = id;
-					const idValues = parseIdValues(id, idInfoArray);
+					const idValues = parseIdValues$1(id, idInfoArray);
 					if (joinPathRelationUpdates.length > 0) await this.relationWrites.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
 					const scalarKeys = Object.keys(entityData);
 					const compiledOps = fieldOpKeys.length > 0 ? compileFieldOps(table, fieldOps, { collectionPath: effectiveCollectionPath }) : void 0;
+					const bounds = fieldOpKeys.length > 0 ? compileFieldOpBounds(table, fieldOps, collection.properties ?? {}, { collectionPath: effectiveCollectionPath }) : [];
 					if (scalarKeys.length > 0 || compiledOps) {
 						const updateQuery = tx.update(table).set({
 							...entityData,
@@ -5636,11 +5968,15 @@ var PersistService = class {
 							const field = table[info.fieldName];
 							conditions.push(eq(field, idValues[info.fieldName]));
 						}
-						if (((await updateQuery.where(and(...conditions))).rowCount ?? 0) === 0) throw await this.explainZeroRowWrite(tx, table, conditions, effectiveCollectionPath, currentId, "update");
+						if (((await updateQuery.where(and(...conditions, ...bounds.map((bound) => bound.holds)))).rowCount ?? 0) === 0) {
+							const broken = await brokenFieldOpBounds(tx, table, conditions, bounds);
+							if (broken.length > 0) throw fieldOpBoundsError(collection.slug, broken);
+							throw await this.explainZeroRowWrite(tx, table, conditions, effectiveCollectionPath, currentId, "update");
+						}
 					}
 				} else {
 					const dataForInsert = { ...entityData };
-					if (id && options?.upsert) Object.assign(dataForInsert, parseIdValues(id, idInfoArray));
+					if (id && options?.upsert) Object.assign(dataForInsert, parseIdValues$1(id, idInfoArray));
 					for (const info of idInfoArray) if (dataForInsert[info.fieldName] === "" || dataForInsert[info.fieldName] === null || dataForInsert[info.fieldName] === void 0) delete dataForInsert[info.fieldName];
 					const insertQuery = tx.insert(table).values(dataForInsert);
 					const targetFields = options?.onConflict && options.onConflict.length > 0 ? [...options.onConflict] : idInfoArray.map((info) => info.fieldName);
@@ -5655,11 +5991,24 @@ var PersistService = class {
 						const set = { ...dataForInsert };
 						for (const info of idInfoArray) delete set[info.fieldName];
 						for (const field of targetFields) delete set[field];
-						for (const [propName, prop] of Object.entries(collection.properties ?? {})) if (prop.type === "date" && prop.autoValue === "on_create") delete set[propName];
-						result = Object.keys(set).length > 0 ? await insertQuery.onConflictDoUpdate({
+						for (const key of createStampKeys(collection.properties)) delete set[key];
+						for (const key of options.insertOnlyKeys ?? []) delete set[key];
+						const scope = await this.writeScope(collection, effectiveCollectionPath, table);
+						const updating = Object.keys(set).length > 0;
+						result = updating ? await insertQuery.onConflictDoUpdate({
 							target,
-							set
+							set,
+							setWhere: scope
 						}).returning(returningKeys) : await insertQuery.onConflictDoNothing({ target }).returning(returningKeys);
+						if (result.length === 0) {
+							const keyConditions = target.map((column, i) => eq(column, dataForInsert[targetFields[i]]));
+							if (scope) keyConditions.push(scope);
+							const keyLabel = targetFields.map((field) => String(dataForInsert[field])).join(", ");
+							const missing = `No row "${keyLabel}" in "${effectiveCollectionPath}" to update.`;
+							if (updating) throw await explainZeroRowWrite(tx, table, keyConditions, `Not allowed to update "${keyLabel}" in "${effectiveCollectionPath}": a row-level security policy rejected the write.`, missing);
+							result = await tx.select(returningKeys).from(table).where(and(...keyConditions)).limit(1);
+							if (result.length === 0) throw ApiError.notFound(missing);
+						}
 					} else result = await insertQuery.returning(returningKeys);
 					const resultRow = result[0];
 					if (!resultRow) if (id) currentId = id;
@@ -5680,6 +6029,26 @@ var PersistService = class {
 		return finalEntity;
 	}
 	/**
+	* The caller's `beforeQuery` scope over this table, as one condition: what
+	* a stored row must satisfy for a write that meets it to change it. The
+	* same scope the update gate and the single get apply; `undefined` when the
+	* collection declares no hook.
+	*/
+	writeScope(collection, collectionPath, table) {
+		const [key] = getPrimaryKeys(collection, this.registry);
+		return beforeQueryCondition({
+			registry: this.registry,
+			callContext: this.callContext
+		}, collection, collectionPath, table, {
+			operation: "get",
+			query: {}
+		}, {
+			collection,
+			registry: this.registry,
+			sourceIdColumn: key ? table[key.fieldName] : void 0
+		});
+	}
+	/**
 	* Get the RelationService instance for external use
 	*/
 	getRelationService() {
@@ -5708,7 +6077,7 @@ var PersistService = class {
 	* so `author_id` had to be translated to `authorId` by whoever read the
 	* message — which nothing does. See `pgFieldViolations`.
 	*/
-	toUserFriendlyError(error, collectionSlug, collection) {
+	toUserFriendlyError(error, collectionSlug, collection, operation = "save") {
 		if (error instanceof ApiError || error?.name === "ApiError") return error;
 		const pgError = extractPgError(error);
 		if (pgError) {
@@ -5718,7 +6087,7 @@ var PersistService = class {
 				collection: collectionSlug,
 				violations
 			} : void 0;
-			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`, details) : ApiError.badRequest(message, `PG_${code}`, details);
+			if (/^2[23]/.test(code)) return code === "23505" || code === "23001" || code === "23503" && operation === "delete" ? ApiError.conflict(message, `PG_${code}`, details) : ApiError.badRequest(message, `PG_${code}`, details);
 			if (isRowLevelSecurityDenial(error)) return ApiError.forbidden(message, "WRITE_DENIED");
 			return new Error(message, { cause: error });
 		}
@@ -5903,6 +6272,10 @@ var WriteTransactionScope = class {
 	open = true;
 	inflight = /* @__PURE__ */ new Set();
 	commitHooks = [];
+	/** The first tracked statement that failed, whether or not its caller caught it. */
+	failure;
+	settledHooks = [];
+	settledContext;
 	/** The transaction handle, for statements in this package that are already written against drizzle. */
 	tx;
 	/** Attach the transaction, once it has begun. */
@@ -5933,7 +6306,10 @@ var WriteTransactionScope = class {
 		const done = () => {
 			this.inflight.delete(settled);
 		};
-		settled.then(done, done);
+		settled.then(done, (error) => {
+			this.failure ??= error;
+			done();
+		});
 		return settled;
 	}
 	afterCommit(fn) {
@@ -5950,6 +6326,65 @@ var WriteTransactionScope = class {
 		this.open = false;
 	}
 	/**
+	* Refuse to commit a transaction a failed statement has aborted.
+	*
+	* Once any statement fails, Postgres aborts the whole transaction, and
+	* catching the error in JavaScript does not undo that. The COMMIT that
+	* follows is answered with the tag `ROLLBACK` and no error, so the driver
+	* resolves it: the write reported success — 200, webhooks, realtime,
+	* the idempotency record — while nothing was stored. A callback that
+	* wrapped a lookup or a job enqueue in `try/catch` was enough.
+	*
+	* So one statement is asked of the transaction before its commit. On an
+	* aborted one it fails with `25P02`, and the write is refused and rolled
+	* back instead. A failed `context.data` write is not caught by this: it
+	* runs in a savepoint, is undone on its own, and leaves the transaction
+	* usable — which is what makes catching one safe.
+	*/
+	async assertCommittable() {
+		if (!this.tx) return;
+		try {
+			await this.tx.execute(sql`SELECT 1`);
+		} catch (error) {
+			if (extractPgError(error)?.code !== "25P02") throw error;
+			logger.error("[transaction] A statement on this write's transaction failed and its error was caught; the write was rolled back", { error: this.failure ?? error });
+			const refusal = new ApiError(500, "TRANSACTION_ABORTED", "A statement on this write's transaction failed and its error was caught. That aborts the transaction in Postgres, so the write was rolled back and nothing was stored. A failed `context.data` write is undone on its own and may be caught; any other failed statement (a read, a job enqueue) has to be let through.");
+			refusal.cause = this.failure ?? error;
+			throw refusal;
+		}
+	}
+	/**
+	* What a hook deferred with {@link afterSettled} is handed as `context`:
+	* the same caller, on a driver where every call is a transaction of its
+	* own. The write's transaction is gone by the time the hook runs, so a
+	* context bound to it would be bound to a connection back in the pool.
+	*/
+	setSettledContext(context) {
+		this.settledContext = context;
+	}
+	/**
+	* Run `fn` once this write's transaction is over, whichever way it went,
+	* outside it — for what a failure hook hands off (a job, a queue message,
+	* a webhook), which must not ride the transaction the failure rolls back.
+	* `false` when this scope has no context to hand it; the caller runs it
+	* itself then.
+	*/
+	afterSettled(fn) {
+		if (!this.settledContext) return false;
+		this.settledHooks.push(fn);
+		return true;
+	}
+	/** The transaction committed or rolled back: run what was waiting for either. */
+	async settled() {
+		const context = this.settledContext;
+		if (!context) return;
+		for (const hook of this.settledHooks.splice(0)) try {
+			await storage.run(void 0, () => hook(context));
+		} catch (error) {
+			logger.error("[transaction] A hook deferred to the end of the write threw", { error });
+		}
+	}
+	/**
 	* The transaction is over, whichever way it went. Nothing may reach it now:
 	* its client is back in the pool, and a callback's detached promise still
 	* carries this scope in its async context.
@@ -6067,7 +6502,15 @@ function classifyCollectionChanges(before, after, facts) {
 			});
 			continue;
 		}
-		classifyProperties(previous.get(slug), collection, changes, facts);
+		const was = previous.get(slug);
+		if (qualifiedTable(was) !== qualifiedTable(collection)) changes.push({
+			kind: "rename-table",
+			verdict: "needs-migration",
+			collection: slug,
+			detail: `"${slug}" moves from table "${qualifiedTable(was)}" to "${qualifiedTable(collection)}", which would create the new table empty and leave every row in the old one.`,
+			remedy: "The ensure path never renames or moves a table. Do it in a migration you have read (ALTER TABLE … RENAME TO, or SET SCHEMA), then change the collection to match."
+		});
+		classifyProperties(was, collection, changes, facts);
 	}
 	for (const [slug, collection] of previous) {
 		if (next.has(slug)) continue;
@@ -6376,6 +6819,13 @@ function effectiveSqlRole(requestedRole) {
 /** How {@link effectiveSqlRole} names "whatever role the connection holds". */
 var CONNECTION_OWNER = "<connection owner>";
 /**
+* What puts a session back after caller SQL: the session user and role, then
+* every setting. Two statements, because the extended protocol refuses a
+* multi-command string. Pinned settings (`search_path` from the connection's
+* startup options) come back as they were pinned.
+*/
+var RESET_SESSION_STATEMENTS = ["SET SESSION AUTHORIZATION DEFAULT", "RESET ALL"];
+/**
 * A statement named a database role the connection cannot assume.
 *
 * Its own type because the tempting recovery — run it anyway, as the owner — is
@@ -6395,6 +6845,66 @@ var RoleSwitchUnavailableError = class extends Error {
 	}
 };
 /**
+* Fold what a `beforeSave` returned into the values being saved.
+*
+* The hook returns the values that will be saved, so a key it returns replaces
+* the value outright: an array it filtered stays filtered, a map it narrowed
+* stays narrow. A key it leaves out keeps the value it was given, so a hook
+* that returns only the field it computed still saves the rest.
+*
+* Not a deep merge. `mergeDeep` merges arrays of objects element by element and
+* keeps every element past the end of the shorter one, so a hook that dropped
+* one line item of three had the last one merged back in and the order was
+* stored with a line duplicated.
+*/
+function applyBeforeSaveResult(values, result) {
+	return {
+		...values,
+		...result
+	};
+}
+/**
+* The keys of a create's final values that its INSERT alone may write: those
+* the caller did not send, no `beforeSave` hook wrote, and that are not an
+* `on_update` stamp — a declared default, a tenant stamp, a create-time stamp.
+* See `PersistSaveOptions.insertOnlyKeys`.
+*/
+function insertOnlyKeysOf(finalValues, callerValues, beforeHooks, afterHooks, properties) {
+	const sent = new Set(Object.keys(callerValues ?? {}));
+	const updateStamps = new Set(Object.entries(properties ?? {}).filter(([, property]) => property?.type === "date" && property.autoValue === "on_update" || property?.type === "string" && property.autoValue === "user_on_update").map(([key]) => key));
+	return Object.keys(finalValues).filter((key) => !sent.has(key) && !updateStamps.has(key) && beforeHooks[key] === afterHooks[key]);
+}
+/**
+* Refuse an update that stamps a `softDelete` collection's field.
+*
+* Stamping it IS the delete — every read hides the row from then on — so it is
+* `delete`'s to do, where the permission is `delete`, `beforeDelete` can veto,
+* `afterDelete` runs and history says "delete". Written by an update, a caller
+* holding only write access trashed rows, past all of that. Clearing it stays
+* an update: that is how a row is restored, and what a form sends back for a
+* live row.
+*/
+function assertUpdateDoesNotSoftDelete(collection, values, path) {
+	const softDelete = resolveSoftDelete(collection);
+	if (!softDelete) return;
+	const value = values?.[softDelete.field];
+	if (value === void 0 || value === null) return;
+	const slug = collection?.slug ?? path;
+	const message = `'${softDelete.field}' on '${slug}' records a delete, so an update may only clear it (null restores the row). Delete the row to set it.`;
+	throw ApiError.badRequest(message, "FIELD_NOT_WRITABLE", {
+		collection: slug,
+		violations: [{
+			field: softDelete.field,
+			code: "soft_delete",
+			message
+		}]
+	});
+}
+/** A key that names a row: not absent, and not the empty string a form sends. */
+function isPresentKey(id) {
+	return id !== void 0 && id !== null && id !== "";
+}
+/**
 * Refuse a write that would leave a *required* `created_by` / `updated_by`
 * column null because nobody is acting.
 *
@@ -6731,17 +7241,11 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			return out;
 		}));
 	}
-	async fetchCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, vectorSearch }) {
+	async fetchCollection({ path, collection, startAfter, ...query }) {
 		const rows = await this.dataService.fetchCollection(path, {
-			filter,
-			orderBy,
-			order,
-			limit,
-			offset,
+			...query,
 			startAfter,
-			databaseId: collection?.databaseId,
-			searchString,
-			vectorSearch
+			databaseId: collection?.databaseId
 		});
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
 		if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
@@ -6925,16 +7429,17 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		const { collection: slug, userField, tenantField } = tenant.from.membership;
 		const cap = PostgresBackendDriver.TENANT_MEMBERSHIP_CAP;
 		try {
-			const rows = await this.dataService.fetchCollection(slug, {
+			const rows = await withFieldViewer(void 0, () => this.dataService.fetchCollection(slug, {
 				filter: { [userField]: ["==", uid] },
 				limit: cap + 1,
 				databaseId: collection?.databaseId
-			});
+			}));
 			return {
 				tenants: Array.from(new Set(rows.slice(0, cap).map((row) => row[tenantField]).filter((value) => value !== null && value !== void 0).map((value) => typeof value === "object" ? value.id ?? value : value))),
 				complete: rows.length <= cap
 			};
 		} catch (err) {
+			if (reachedDatabase(err)) throw err;
 			logger.debug(`[save] Could not read '${slug}' to resolve the caller's tenants`, { detail: err instanceof Error ? err.message : String(err) });
 			return {
 				tenants: [],
@@ -6942,21 +7447,86 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			};
 		}
 	}
+	/**
+	* The stored row an upsert's key names, if this caller can address it —
+	* with its address and the values to update it with.
+	*
+	* Read as the caller reads: their policies and `beforeQuery` scope, and
+	* soft-deleted rows hidden, so a row found here is one an update may
+	* target. On the trusted plane for its fields only, like
+	* {@link resolveCallerTenants}: the key columns are the server's to see.
+	*
+	* `undefined` when the key is incomplete (the write is a plain insert,
+	* which is the persistence layer's rule too), when a key value is not a
+	* plain value, or when no such row is visible. None of those can write a
+	* stored row wrongly: the statement's own conflict branch sets only what
+	* the caller sent, and only on a row in their scope.
+	*
+	* The values drop the key and the conflict target, which the stored row
+	* already has: a natural-key upsert carrying a key the caller invented
+	* must not move the row onto it.
+	*/
+	async findUpsertTarget(path, collection, values, id, onConflict) {
+		const primaryKeys = getPrimaryKeys(collection, this.registry);
+		const key = { ...values };
+		if (isPresentKey(id)) Object.assign(key, parseIdValues$1(id, primaryKeys));
+		const targetFields = onConflict && onConflict.length > 0 ? [...onConflict] : primaryKeys.map((info) => info.fieldName);
+		if (targetFields.length === 0) return void 0;
+		const filter = {};
+		for (const field of targetFields) {
+			const value = key[field];
+			if (value === void 0 || value === null || value === "") return void 0;
+			if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return void 0;
+			filter[field] = ["==", value];
+		}
+		const [row] = await withFieldViewer(void 0, () => this.dataService.fetchCollectionForRest(path, {
+			filter,
+			limit: 1,
+			databaseId: collection.databaseId
+		}));
+		if (!row || targetFields.some((field) => String(row[field]) !== String(key[field]))) return void 0;
+		const rest = { ...values };
+		for (const field of [...primaryKeys.map((info) => info.fieldName), ...targetFields]) delete rest[field];
+		return {
+			id: deriveRowAddress(row, collection, this.registry),
+			values: rest
+		};
+	}
 	async save({ path, id, values, collection, status, upsert, onConflict }) {
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
+		if (status === "existing") assertUpdateDoesNotSoftDelete(resolvedCollection, values, path);
+		const upserting = upsert === true && status !== "existing";
+		if (upserting && resolvedCollection) {
+			const stored = await this.findUpsertTarget(path, resolvedCollection, values, id, onConflict);
+			if (stored) return this.save({
+				path,
+				id: stored.id,
+				values: stored.values,
+				collection,
+				status: "existing"
+			});
+		}
 		let updatedValues = values;
 		const contextForCallback = this.buildCallContext();
 		if ((status === "new" || status === "copy") && resolvedCollection?.properties) updatedValues = applyDefaultValuesOnCreate(updatedValues, resolvedCollection.properties);
 		let previousValuesForHistory;
-		if (status === "existing" && id) try {
-			const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
-			if (existing) {
-				const { id: _existingId, ...existingValues } = existing;
-				previousValuesForHistory = existingValues;
+		if (status === "existing" && id) {
+			const gateOnScope = hasBeforeQuery(this.registry, resolvedCollection);
+			try {
+				const existing = await this.dataService.getFetchService().fetchOneForRest(path, id, void 0, resolvedCollection?.databaseId);
+				if (!existing && gateOnScope) throw ApiError.notFound(`No row "${id}" in "${path}" to update.`);
+				if (existing) {
+					const { id: _existingId, ...existingValues } = existing;
+					previousValuesForHistory = existingValues;
+				}
+			} catch (err) {
+				if (err instanceof ApiError) throw err;
+				if (reachedDatabase(err)) throw err;
+				logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
 			}
-		} catch (err) {
-			logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
 		}
+		/** The row as the hooks receive it, to tell what they wrote. */
+		const beforeHooks = updatedValues;
 		try {
 			if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
 				const callbackCollection = requireCallbackCollection(resolvedCollection, path);
@@ -6970,7 +7540,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 						status,
 						context: contextForCallback
 					});
-					if (result) updatedValues = mergeDeep(updatedValues, result);
+					if (result) updatedValues = applyBeforeSaveResult(updatedValues, result);
 				}
 				if (callbacks?.beforeSave) {
 					const result = await callbacks.beforeSave({
@@ -6982,7 +7552,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 						status,
 						context: contextForCallback
 					});
-					if (result) updatedValues = mergeDeep(updatedValues, result);
+					if (result) updatedValues = applyBeforeSaveResult(updatedValues, result);
 				}
 				if (propertyCallbacks?.beforeSave) {
 					const result = await propertyCallbacks.beforeSave({
@@ -6994,12 +7564,13 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 						status,
 						context: contextForCallback
 					});
-					if (result) updatedValues = mergeDeep(updatedValues, result);
+					if (result) updatedValues = applyBeforeSaveResult(updatedValues, result);
 				}
 			}
 		} catch (callbackError) {
 			throw toCallbackError(callbackError, "beforeSave", path);
 		}
+		const afterHooks = updatedValues;
 		if (resolvedCollection?.properties) {
 			updatedValues = updateDateAutoValues({
 				inputValues: updatedValues,
@@ -7014,12 +7585,29 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				status: status ?? "new",
 				uid: this.user?.uid
 			});
+			if (status === "existing") {
+				const kept = { ...updatedValues };
+				for (const key of createStampKeys(resolvedCollection.properties)) delete kept[key];
+				updatedValues = kept;
+			}
 		}
 		updatedValues = await this.applyTenantScope(resolvedCollection, path, updatedValues, status ?? "new", previousValuesForHistory);
+		let writeId = id;
+		if ((status === "new" || status === "copy") && !upsert && isPresentKey(id) && resolvedCollection) {
+			updatedValues = {
+				...updatedValues,
+				...parseIdValues$1(id, getPrimaryKeys(resolvedCollection, this.registry))
+			};
+			writeId = void 0;
+		}
+		const insertOnlyKeys = upserting ? insertOnlyKeysOf(updatedValues, values, beforeHooks, afterHooks, resolvedCollection?.properties) : void 0;
+		const softDeleteField = resolveSoftDelete(resolvedCollection)?.field;
+		if (insertOnlyKeys && softDeleteField && updatedValues[softDeleteField] !== void 0 && updatedValues[softDeleteField] !== null) insertOnlyKeys.push(softDeleteField);
 		try {
-			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, {
-				upsert,
-				onConflict
+			let savedRow = await this.dataService.save(path, updatedValues, writeId, resolvedCollection?.databaseId, {
+				upsert: upserting,
+				onConflict,
+				insertOnlyKeys
 			});
 			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
 				const callbackCollection = requireCallbackCollection(resolvedCollection, path);
@@ -7079,9 +7667,9 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 				throw toCallbackError(callbackError, "afterSave", path);
 			}
 			if (this.historyService && resolvedCollection?.history) await this.historyService.recordHistory({
-				tableName: path,
+				tableName: resolvedCollection.slug,
 				id: savedId,
-				action: status === "new" ? "create" : "update",
+				action: status === "existing" ? "update" : "create",
 				values: savedValues,
 				previousValues: previousValuesForHistory,
 				updatedBy: this.user?.uid
@@ -7097,27 +7685,31 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		} catch (error) {
 			if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
 				const callbackCollection = requireCallbackCollection(resolvedCollection, path);
-				const errorProps = {
-					path,
-					id,
-					values: updatedValues,
-					previousValues: previousValuesForHistory,
-					status,
-					error,
-					context: contextForCallback
+				const runHooks = async (context) => {
+					const errorProps = {
+						collection: callbackCollection,
+						path,
+						id,
+						values: updatedValues,
+						previousValues: previousValuesForHistory,
+						status,
+						error,
+						context
+					};
+					for (const [tier, hook] of [
+						["global", globalCallbacks?.afterSaveError],
+						["collection", callbacks?.afterSaveError],
+						["property", propertyCallbacks?.afterSaveError]
+					]) {
+						if (!hook) continue;
+						try {
+							await hook(errorProps);
+						} catch (hookError) {
+							logger.error(`[save] The ${tier} afterSaveError hook for "${path}" threw; answering with the save's own failure`, { error: hookError });
+						}
+					}
 				};
-				if (globalCallbacks?.afterSaveError) await globalCallbacks.afterSaveError({
-					collection: callbackCollection,
-					...errorProps
-				});
-				if (callbacks?.afterSaveError) await callbacks.afterSaveError({
-					collection: callbackCollection,
-					...errorProps
-				});
-				if (propertyCallbacks?.afterSaveError) await propertyCallbacks.afterSaveError({
-					collection: callbackCollection,
-					...errorProps
-				});
+				if (!currentWriteScope()?.afterSettled(runHooks)) await runHooks(contextForCallback);
 			}
 			throw error;
 		}
@@ -7215,7 +7807,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 					if (!await txDriver.fetchOne({
 						path,
 						id: String(id),
-						collection
+						collection,
+						withDeleted: restoresSoftDeletedRow(collection ?? this.registry?.getCollectionByPath(path), values) ? true : void 0
 					})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
 						statusCode: 404,
 						code: "NOT_FOUND"
@@ -7325,7 +7918,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 							if (!await txDriver.fetchOne({
 								path: operation.path,
 								id,
-								collection: operation.collection
+								collection: operation.collection,
+								withDeleted: restoresSoftDeletedRow(operation.collection ?? this.registry?.getCollectionByPath(operation.path), values) ? true : void 0
 							})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
 								statusCode: 404,
 								code: "NOT_FOUND"
@@ -7410,7 +8004,9 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		} catch (callbackError) {
 			throw toCallbackError(callbackError, "beforeDelete", targetPath);
 		}
-		const softDelete = hard ? void 0 : resolveSoftDelete(resolvedCollection);
+		const hop = isNestedPath(targetPath) ? resolveNestedPath(targetPath, this.registry) : void 0;
+		const unlinking = hop !== void 0 && isJunctionBackedRelation(hop.relation);
+		const softDelete = hard || unlinking ? void 0 : resolveSoftDelete(resolvedCollection);
 		if (softDelete) await this.dataService.save(targetPath, { [softDelete.field]: /* @__PURE__ */ new Date() }, row.id, resolvedCollection?.databaseId);
 		else await this.dataService.delete(targetPath, row.id, resolvedCollection?.databaseId);
 		try {
@@ -7441,8 +8037,8 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		} catch (callbackError) {
 			throw toCallbackError(callbackError, "afterDelete", targetPath);
 		}
-		if (this.historyService && resolvedCollection?.history) await this.historyService.recordHistory({
-			tableName: targetPath,
+		if (this.historyService && resolvedCollection?.history && !unlinking) await this.historyService.recordHistory({
+			tableName: resolvedCollection.slug,
 			id: row.id.toString(),
 			action: "delete",
 			values: stored,
@@ -7497,8 +8093,48 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		return sql.join(chunks, sql.raw(""));
 	}
 	async executeSql(sqlText, options) {
+		if (options?.isolateSession) return this.onIsolatedSession(this.getTargetDb(options.database), (db) => this.executeSqlOn(db, sqlText, options));
 		if (!options?.database && !options?.role) return this.dataService.executeSql(sqlText, options?.params);
-		const targetDb = this.getTargetDb(options?.database);
+		return this.executeSqlOn(this.getTargetDb(options?.database), sqlText, options);
+	}
+	/**
+	* Run `fn` on a session of its own, and put that session back the way it
+	* was handed out before anything else can use it.
+	*
+	* For SQL a person wrote — the Studio editor. It may `SET ROLE`,
+	* `SET SESSION AUTHORIZATION` or `set_config(…, false)`, which outlive the
+	* statement (and a transaction's commit) and stay on the connection. On a
+	* pooled one they were inherited by whatever checked it out next: an auth
+	* lookup, the job store or history running as `rebase_user`, on one
+	* connection in N, until a restart. `SET SESSION AUTHORIZATION DEFAULT`
+	* clears the role as well, which `RESET ALL` does not.
+	*
+	* A connection that cannot be reset — the statement left a transaction
+	* open or aborted — is destroyed rather than returned. A handle that is
+	* already one session (PGlite in process, a single client) is reset in
+	* place.
+	*/
+	async onIsolatedSession(targetDb, fn) {
+		const pool = "$client" in targetDb ? targetDb.$client : void 0;
+		if (!(pool instanceof Pool)) try {
+			return await fn(targetDb);
+		} finally {
+			for (const statement of RESET_SESSION_STATEMENTS) await targetDb.execute(sql.raw(statement)).catch((error) => logger.error("[PostgresBackendDriver] Could not reset the session after caller SQL", { error }));
+		}
+		const connection = await pool.connect();
+		let reusable = true;
+		try {
+			return await fn(drizzle(connection));
+		} finally {
+			try {
+				for (const statement of RESET_SESSION_STATEMENTS) await connection.query(statement);
+			} catch {
+				reusable = false;
+			}
+			connection.release(reusable ? void 0 : true);
+		}
+	}
+	async executeSqlOn(targetDb, sqlText, options) {
 		try {
 			let needsRoleSwitch = false;
 			if (options?.role) try {
@@ -7678,14 +8314,15 @@ var PostgresBackendDriver = class PostgresBackendDriver {
               AND ccu2.table_name != ${safeName};
         `)).rows,
 			policies: (await this.db.execute(sql`
-            SELECT 
-                polname as policy_name, 
-                polcmd as cmd, 
-                polroles::regrole[]::text[] as roles, 
-                pg_get_expr(polqual, polrelid) as qual, 
-                pg_get_expr(polwithcheck, polrelid) as with_check
-            FROM pg_policy
-            WHERE polrelid = (SELECT oid FROM pg_class WHERE relname = ${safeName} AND relnamespace = 'public'::regnamespace);
+            SELECT
+                policyname AS policy_name,
+                permissive,
+                cmd,
+                roles::text[] AS roles,
+                qual,
+                with_check
+            FROM pg_policies
+            WHERE schemaname = 'public' AND tablename = ${safeName};
         `)).rows
 		};
 	}
@@ -7740,6 +8377,16 @@ var AuthenticatedPostgresBackendDriver = class {
 	async withTransaction(operation, options) {
 		const pendingNotifications = [];
 		const writeScope = options?.accessMode === "read only" ? void 0 : new WriteTransactionScope();
+		const client = this.delegate.client;
+		writeScope?.setSettledContext({
+			user: this.user,
+			driver: this,
+			data: this.data,
+			get client() {
+				return requireCallbackClient(client);
+			},
+			storageSource: client?.storage
+		});
 		const result = await withFieldViewer({ roles: this.user?.roles ?? [] }, async () => await runInWriteScope(writeScope, () => this.delegate.db.transaction(async (tx) => {
 			if (!this.user?.uid) logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
 			if (!this.user?.roles) logger.warn("[DataDriver] User roles are missing for authenticated delegate. Using empty array. User object", { detail: this.user });
@@ -7760,9 +8407,14 @@ var AuthenticatedPostgresBackendDriver = class {
 				throw error;
 			}
 			await writeScope?.settle();
+			await writeScope?.assertCommittable();
 			return out;
-		}, options)).finally(() => writeScope?.close()));
+		}, options)).finally(() => writeScope?.close())).catch(async (error) => {
+			await writeScope?.settled();
+			throw error;
+		});
 		writeScope?.committed();
+		await writeScope?.settled();
 		for (const notification of pendingNotifications) try {
 			await this.delegate.realtimeService.notifyUpdate(notification.path, notification.id, notification.row, notification.databaseId);
 		} catch (e) {
@@ -8131,6 +8783,41 @@ function buildJunctionLinkMap(registry) {
 	return map;
 }
 //#endregion
+//#region src/services/read-field-access.ts
+/**
+* Refuse a read that names a field its caller may not read, for the doors that
+* take a driver-shaped request rather than a query string: the socket's
+* `FETCH_COLLECTION`, `COUNT` and `CHECK_UNIQUE_FIELD`, and `subscribe_collection`.
+* Callers hand it the request itself, not a re-listed copy of some of its keys.
+*
+* The row strip keeps a withheld value off the wire; this is the other half, and
+* without it the value is still readable one predicate at a time — a `COUNT`
+* filtered on `passwordHash like '$2b$10$A%'` answers 1 or 0. `GET /api/data`
+* refuses the same request with `FIELD_NOT_READABLE`, and this is that rule, not
+* a copy of it: only the request's shape is translated here.
+*
+* The shape arrives as whatever JSON the client sent, so it is read defensively.
+* A malformed `orderBy` or `fields` is not this check's to reject; the entries
+* that name a field are checked and the rest are left for the driver to refuse.
+*/
+function assertReadRequestReadable(request, collection, viewer) {
+	const vectorProperty = request.vectorSearch && typeof request.vectorSearch === "object" ? request.vectorSearch.property : void 0;
+	assertQueryFieldsReadable({
+		where: request.filter && typeof request.filter === "object" ? request.filter : void 0,
+		logical: request.logical,
+		orderBy: sortedFields(request.orderBy),
+		fields: Array.isArray(request.fields) ? request.fields : void 0,
+		include: request.include ?? void 0,
+		vectorSearch: typeof vectorProperty === "string" ? { property: vectorProperty } : void 0
+	}, collection, viewer);
+}
+/** The fields an `orderBy` sorts on, in either of its two spellings. */
+function sortedFields(orderBy) {
+	if (typeof orderBy === "string") return [{ field: orderBy }];
+	if (!Array.isArray(orderBy)) return void 0;
+	return orderBy.flatMap((entry) => Array.isArray(entry) && typeof entry[0] === "string" ? [{ field: entry[0] }] : []);
+}
+//#endregion
 //#region src/services/cdc/trigger-cdc.ts
 /**
 * Trigger-based Change Data Capture (CDC).
@@ -8163,6 +8850,11 @@ var CDC_TRIGGER_NAME = "rebase_cdc_trigger";
 * statement* if the limit is exceeded. We stay comfortably under it and, for
 * wide rows, fall back to an identity-only payload so CDC can never break a
 * write. 7900 leaves headroom for the JSON envelope keys.
+*
+* The identity is every primary-key column, read from the catalogue for the
+* table that fired — `id` only where the table declares no primary key. It
+* used to be `id` alone, so a wide row of a table keyed on anything else
+* arrived with no key at all and reached no single-row subscriber.
 */
 var MAX_NOTIFY_BYTES = 7900;
 var quoteIdent = (name) => `"${name.replace(/"/g, "\"\"")}"`;
@@ -8186,6 +8878,7 @@ LANGUAGE plpgsql AS $rebase_cdc$
 DECLARE
     rec     jsonb;
     payload text;
+    ident   jsonb;
 BEGIN
     IF (TG_OP = 'DELETE') THEN
         rec := to_jsonb(OLD);
@@ -8204,11 +8897,18 @@ BEGIN
     -- 8000-byte cap, emit an identity-only payload the consumer can still route
     -- (and refetch the authoritative row from).
     IF (octet_length(payload) > ${MAX_NOTIFY_BYTES}) THEN
+        SELECT jsonb_object_agg(a.attname, rec->a.attname) INTO ident
+        FROM pg_index i
+        JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum = ANY (i.indkey)
+        WHERE i.indrelid = TG_RELID AND i.indisprimary;
+        IF ident IS NULL THEN
+            ident := CASE WHEN rec ? 'id' THEN jsonb_build_object('id', rec->'id') ELSE '{}'::jsonb END;
+        END IF;
         payload := json_build_object(
             'schema',    TG_TABLE_SCHEMA,
             'table',     TG_TABLE_NAME,
             'op',        TG_OP,
-            'row',       CASE WHEN rec ? 'id' THEN jsonb_build_object('id', rec->'id') ELSE '{}'::jsonb END,
+            'row',       ident,
             'truncated', true
         )::text;
     END IF;
@@ -8357,6 +9057,15 @@ var PgNotifyListener = class {
 			if (initial) throw err;
 			logger.error(`❌ ${logLabel} Failed to connect LISTEN client`, { error: err });
 			this.scheduleReconnect();
+			return;
+		}
+		if (!initial && this.options.onReconnect) {
+			logger.warn(`⚠️ ${logLabel} LISTEN client reconnected; anything published while it was down was missed.`);
+			try {
+				this.options.onReconnect();
+			} catch (err) {
+				logger.error(`❌ ${logLabel} Error resyncing after a reconnect`, { error: err });
+			}
 		}
 	}
 	scheduleReconnect() {
@@ -8413,11 +9122,17 @@ function parseCdcPayload(payload) {
 */
 var CdcListener = class {
 	listener;
-	constructor(connectionString, onEvent) {
+	/**
+	* @param onReconnect Called when the connection is listening again after a
+	*        drop. Every change committed in the gap was notified to nobody, so
+	*        this is where subscribers are told to look again.
+	*/
+	constructor(connectionString, onEvent, onReconnect) {
 		this.listener = new PgNotifyListener({
 			connectionString,
 			channel: CDC_CHANNEL,
 			logLabel: "[CDC]",
+			onReconnect,
 			onPayload: (payload) => {
 				const event = parseCdcPayload(payload);
 				if (!event) {
@@ -9255,6 +9970,23 @@ function callbackContextWithin(driver, tx, auth) {
 	});
 }
 /**
+* How long a client gets to answer the close frame at shutdown before its
+* socket is dropped. `ws` would otherwise wait its own 30s close timeout, which
+* is longer than the whole shutdown budget.
+*/
+var WEBSOCKET_CLOSE_GRACE_MS = 1e3;
+/**
+* Close each socket with 1001, and terminate the ones still open after
+* `graceMs`. Nothing here waits: the HTTP server's close() is what waits for
+* the sockets to end.
+*/
+function closeWebSockets(sockets, graceMs) {
+	for (const ws of sockets) {
+		if (ws.readyState === WebSocket.OPEN) ws.close(1001, "server shutting down");
+		if (ws.readyState !== WebSocket.CLOSED) unref(setTimeout(() => ws.terminate(), graceMs));
+	}
+}
+/**
 * PostgreSQL-specific realtime service.
 * Handles WebSocket connections and subscriptions for real-time row updates.
 *
@@ -9371,8 +10103,20 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* and always flow through. Keyed → expiry timestamp (ms).
 	*/
 	recentAppEmits = /* @__PURE__ */ new Map();
-	/** How long an app-emit key suppresses its own CDC echo. Covers NOTIFY round-trip latency. */
-	static CDC_DEDUP_WINDOW_MS = 5e3;
+	/**
+	* How long an app-emit key suppresses its own CDC echo: the refetch
+	* debounce, and no longer.
+	*
+	* The mark cannot tell an echo from another writer's change to the same
+	* row, and a save that touches no row of the table (a to-many relation
+	* only, an empty payload) is announced with no echo ever coming to consume
+	* it. Held for seconds, it swallowed the next change psql, a cron or
+	* another instance made to that row. Inside the debounce nothing is lost:
+	* the refetch the app emit scheduled has not started yet — its timer fires
+	* no earlier than this — and it reads after any commit whose NOTIFY has
+	* already arrived. An echo later than that costs one more refetch.
+	*/
+	static CDC_DEDUP_WINDOW_MS = RealtimeService.REFETCH_DEBOUNCE_MS;
 	constructor(db, registry) {
 		super();
 		this.db = db;
@@ -9597,7 +10341,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		const subscriptionId = request.subscriptionId;
 		let canDeliver;
 		try {
-			if (!this.registry.getCollectionByPath(request.path)) {
+			const collection = this.registry.getCollectionByPath(request.path);
+			if (!collection) {
 				const registered = this.registry.getCollections().map((c) => c.slug).join(", ");
 				const msg = `Collection not found: '${request.path}'. Registered: [${registered}]`;
 				logger.error(`[RealtimeService] ${msg}`);
@@ -9628,6 +10373,17 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				this.sendError(clientId, e.message, subscriptionId, e.code);
 				return;
 			}
+			try {
+				assertReadRequestReadable({
+					...request,
+					orderBy
+				}, collection, { roles: authContext?.roles ?? ["anon"] });
+			} catch (e) {
+				if (!(e instanceof ApiError)) throw e;
+				logger.warn(`[RealtimeService] Refused subscription to '${request.path}': ${e.message}`);
+				this.sendError(clientId, e.message, subscriptionId, e.code);
+				return;
+			}
 			const subscription = {
 				clientId,
 				type: "collection",
@@ -9706,6 +10462,76 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		if (canDeliver && !canDeliver.mayReportFailure()) return;
 		this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
 	}
+	/**
+	* Re-judge everything a socket holds open as the identity it has now.
+	*
+	* A socket re-authenticates on every session refresh, and when a role is
+	* taken away, a tenant claim removed or a different account signs in, the
+	* next token says so. Requests read as the new identity at once; the
+	* subscriptions kept refetching as the one they were opened with, so a
+	* demoted user went on receiving editor-only or another tenant's rows for
+	* as long as the view stayed mounted.
+	*
+	* Each of this client's subscriptions is replaced by one carrying the new
+	* identity — a replacement, so a refetch already running as the old one
+	* cannot deliver — and refetched, so the view narrows now rather than at
+	* the next write. A subscription whose filter, sort or projection names a
+	* field the new roles may not read is ended with the refusal a new
+	* subscription would get. Channel memberships are put to the authorizer
+	* again, when one is installed, and left when it refuses.
+	*/
+	async rescopeClient(clientId, authContext) {
+		for (const [subscriptionId, subscription] of [...this._subscriptions.entries()]) {
+			if (subscription.clientId !== clientId) continue;
+			if (subscription.type === "collection" && subscription.collectionRequest) {
+				const collection = this.registry.getCollectionByPath(subscription.path);
+				const request = subscription.collectionRequest;
+				try {
+					if (collection) assertReadRequestReadable({
+						filter: request.filter,
+						logical: request.logical,
+						orderBy: request.orderBy,
+						fields: request.fields
+					}, collection, { roles: authContext.roles ?? ["anon"] });
+				} catch (e) {
+					if (!(e instanceof ApiError)) throw e;
+					await this.handleUnsubscribe(clientId, subscriptionId);
+					this.sendError(clientId, e.message, subscriptionId, e.code);
+					continue;
+				}
+			}
+			const rescoped = {
+				...subscription,
+				authContext,
+				started: 0,
+				delivered: 0
+			};
+			this._subscriptions.set(subscriptionId, rescoped);
+			if (rescoped.type === "single" && rescoped.id !== void 0) this.debouncedSingleRefetch(subscriptionId, rescoped.path, String(rescoped.id), rescoped);
+			else if (rescoped.type === "collection" && rescoped.collectionRequest) this.debouncedCollectionRefetch(subscriptionId, rescoped.path, rescoped);
+		}
+		const authorizer = this.channelAuthorizer;
+		if (!authorizer) return;
+		for (const [channel, members] of [...this.channels.entries()]) {
+			if (!members.has(clientId)) continue;
+			let allowed;
+			try {
+				allowed = await authorizer({
+					channel,
+					action: "join",
+					clientId,
+					user: authContext
+				});
+			} catch (error) {
+				logger.error(`❌ [Channels] Authorizer threw re-checking "${channel}" after a sign-in — leaving it`, { error });
+				allowed = false;
+			}
+			if (!allowed) {
+				this.leaveChannel(clientId, channel);
+				this.denyChannelAction(clientId, channel, "join", "refused by the channel authorizer for the identity this socket signed in as");
+			}
+		}
+	}
 	async handleUnsubscribe(_clientId, subscriptionId) {
 		this._subscriptions.delete(subscriptionId);
 		this.subscriptionCallbacks.delete(subscriptionId);
@@ -9736,6 +10562,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	*/
 	async notifyUpdate(path, id, row, databaseId, broadcast = true, origin = "app") {
 		this.debugLog("🔔 [RealtimeService] notifyUpdate called for path:", path, "id:", id, "isDelete:", row === null, "origin:", origin);
+		const aliases = this.aliasPaths(path);
 		if (this.cdcActive) {
 			const key = this.dedupKey(path, id, databaseId);
 			if (origin === "cdc") {
@@ -9743,7 +10570,13 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					this.debugLog("🔁 [RealtimeService] Suppressing CDC echo of local app mutation:", key);
 					return;
 				}
-			} else this.markAppEmit(key);
+			} else {
+				this.markAppEmit(key);
+				if (isNestedPath(path)) {
+					const root = aliases.find((alias) => !isNestedPath(alias));
+					if (root) this.markAppEmit(this.dedupKey(root, id, databaseId));
+				}
+			}
 		}
 		const pathsToNotify = [path];
 		if (path.includes("/") && path.split("/").length > 1) {
@@ -9752,6 +10585,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			this.debugLog(`🔗 [RealtimeService] Nested path detected. Will notify paths: ${pathsToNotify.join(", ")}`);
 		}
 		for (const notifyPath of pathsToNotify) await this.notifyPathUpdate(notifyPath, path, id, row, databaseId);
+		for (const alias of aliases) await this.notifyPathUpdate(alias, alias, id, row, databaseId);
 		if (broadcast && this.broadcasting && !this.cdcActive) try {
 			await this.broadcastChange(path, id, databaseId);
 		} catch (err) {
@@ -9950,7 +10784,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					}));
 				}
 				return fetchedEntities;
-			}));
+			}, { accessMode: "read only" }));
 		}
 		return await withFieldViewer({ roles: authContext?.roles ?? [] }, async () => await this.dataService.fetchCollectionForRest(notifyPath, {
 			filter: collectionRequest.filter,
@@ -10002,7 +10836,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					}, this.rlsUserRole);
 					let hookContext;
 					return countOnce(new DataService(tx, this.registry, () => hookContext ??= callbackContextWithin(this.driver, tx, activeAuth)));
-				});
+				}, { accessMode: "read only" });
 			} else total = await countOnce(this.dataService);
 		} catch (error) {
 			logger.warn(`[RealtimeService] Could not count '${notifyPath}' for a subscription frame`, { error });
@@ -10115,7 +10949,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					}
 				}
 				return processedEntity;
-			}));
+			}, { accessMode: "read only" }));
 		}
 		return await withFieldViewer({ roles: authContext?.roles ?? [] }, async () => await this.dataService.fetchOneForRest(notifyPath, id) ?? void 0);
 	}
@@ -10194,6 +11028,39 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	* Extract parent paths from a nested path like "posts/70/tags"
 	* Returns ["posts", "posts/70"] for the example above
 	*/
+	/**
+	* The other paths a subscriber can address the row written at `path` by.
+	*
+	* `authors/1/posts` and `posts` are two addresses for the same rows, and
+	* subscriptions were matched by the written path's exact string. So a post
+	* saved through `authors/1/posts` never reached a subscriber of `posts` or
+	* of `posts/43`, and one saved through `posts` never reached a subscriber
+	* of `authors/1/posts`, whose list it may just have joined or left.
+	*
+	* The aliases are the target collection's root path, and every nested path
+	* a live subscription holds that lands on the same collection. Each still
+	* refetches under its own scope and its own parent, so naming a path here
+	* decides only who is asked to look again — never what they are shown.
+	*/
+	aliasPaths(path) {
+		const slug = this.collectionSlugAt(path);
+		if (!slug) return [];
+		const aliases = /* @__PURE__ */ new Set();
+		if (slug !== path) aliases.add(slug);
+		for (const subscription of this._subscriptions.values()) {
+			if (subscription.path === path || aliases.has(subscription.path) || !isNestedPath(subscription.path)) continue;
+			if (this.collectionSlugAt(subscription.path) === slug) aliases.add(subscription.path);
+		}
+		return [...aliases];
+	}
+	/** The slug of the collection a path lands on, or `undefined` for one that names none. */
+	collectionSlugAt(path) {
+		try {
+			return this.registry.getCollectionByPath(path)?.slug;
+		} catch {
+			return;
+		}
+	}
 	getParentPaths(path) {
 		const segments = path.split("/").filter((s) => s.length > 0);
 		const parentPaths = [];
@@ -10766,8 +11633,8 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	*  1. All debounced refetch timers are cancelled (prevents queries after pool closes).
 	*  2. All subscription state and callbacks are cleared.
 	*  3. The dedicated LISTEN client (outside the pool) is disconnected.
-	*  4. All WebSocket clients are removed (but not forcefully closed — the
-	*     HTTP server close will handle that).
+	*  4. All WebSocket clients are closed with 1001 ("going away"); one that
+	*     does not answer the close frame is dropped after a short grace.
 	*/
 	async destroy() {
 		for (const [key, timer] of this.refetchTimers) {
@@ -10802,7 +11669,9 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		await this.stopCdc();
 		await this.bus.stop().catch((error) => logger.warn("⚠️ [ChannelBus] Error while stopping the channel bus", { error }));
 		this.bus = new MemoryChannelBus();
+		const sockets = [...this.clients.values()];
 		this.clients.clear();
+		closeWebSockets(sockets, WEBSOCKET_CLOSE_GRACE_MS);
 		this.debugLog("🧹 [RealtimeService] destroy() complete — all resources released.");
 	}
 	/** Whether database-level change capture is currently the active source. */
@@ -10833,7 +11702,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		}
 		this.cdcTableMap = this.buildCdcTableMap();
 		this.junctionLinkMap = buildJunctionLinkMap(this.registry);
-		this.cdcListener = new CdcListener(connectionString, (event) => this.handleCdcEvent(event));
+		this.cdcListener = new CdcListener(connectionString, (event) => this.handleCdcEvent(event), () => this.resyncSubscriptions());
 		try {
 			await this.cdcListener.start();
 		} catch (err) {
@@ -10846,6 +11715,32 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 		this.cdcActive = true;
 		logger.debug(`📡 [RealtimeService] Database-level change capture ACTIVE — writes from ANY source now emit realtime events (${this.cdcTableMap.size} mapped table key(s)).`);
 	}
+	/**
+	* Refetch every live subscription, as a change to its path would.
+	*
+	* Called when a LISTEN connection (CDC, or the cross-instance broadcast)
+	* is listening again after a drop. Postgres does not queue NOTIFY for a
+	* session that is not listening, so every change committed while it was
+	* down — by another instance, psql, a cron — reached nobody here, and a
+	* subscriber held its pre-gap rows until some later change to the same
+	* collection happened to arrive. Each refetch runs under the
+	* subscription's own scope, so this decides only who looks again.
+	*/
+	resyncSubscriptions() {
+		for (const [subscriptionId, subscription] of this._subscriptions.entries()) try {
+			if (subscription.clientId === "driver") {
+				const callback = this.subscriptionCallbacks.get(subscriptionId);
+				if (!callback) continue;
+				if (subscription.type === "single" && subscription.id !== void 0) this.debouncedSingleDriverRefetch(subscriptionId, subscription.path, String(subscription.id), subscription, callback);
+				else if (subscription.type === "collection" && subscription.collectionRequest) this.debouncedDriverRefetch(subscriptionId, subscription.path, subscription, callback);
+			} else if (this.clients.has(subscription.clientId)) {
+				if (subscription.type === "single" && subscription.id !== void 0) this.debouncedSingleRefetch(subscriptionId, subscription.path, String(subscription.id), subscription);
+				else if (subscription.type === "collection" && subscription.collectionRequest) this.debouncedCollectionRefetch(subscriptionId, subscription.path, subscription);
+			}
+		} catch (error) {
+			logger.error(`❌ [RealtimeService] Could not resync subscription ${subscriptionId}`, { error });
+		}
+	}
 	/** Stop the CDC listener and clear its state. */
 	async stopCdc() {
 		this.cdcActive = false;
@@ -10935,7 +11830,29 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	}
 	/** Compute the canonical (possibly composite) id string from a captured row. */
 	extractIdFromCdcRow(collection, row) {
-		return deriveRowAddress(row, collection, this.registry) || "*";
+		return deriveRowAddress(this.cdcRowByKeyFields(collection, row), collection, this.registry) || "*";
+	}
+	/**
+	* A captured row with its key under the key's *field* names.
+	*
+	* The trigger captures the tuple by column — `user_id` — and an address is
+	* built from the key's property names — `userId`. Read by property name
+	* alone, a key declared apart from its column was never on the captured
+	* row, the address fell back to `*`, and no single-row subscriber heard
+	* about any write made outside this server.
+	*/
+	cdcRowByKeyFields(collection, row) {
+		const table = this.registry.getTable(getTableName$1(collection));
+		const columns = table ? getTableColumns(table) : void 0;
+		const keyed = { ...row };
+		for (const pk of getPrimaryKeys(collection, this.registry)) {
+			if (pk.fieldName in row) continue;
+			const property = collection.properties?.[pk.fieldName];
+			const declared = property && "columnName" in property ? property.columnName : void 0;
+			const columnName = columns?.[pk.fieldName]?.name ?? declared ?? toSnakeCase(pk.fieldName);
+			if (columnName in row) keyed[pk.fieldName] = row[columnName];
+		}
+		return keyed;
 	}
 	dedupKey(path, id, databaseId) {
 		return `${databaseId ?? ""}::${path}::${id}`;
@@ -11007,8 +11924,12 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	}
 	/**
 	* Create and connect the dedicated LISTEN client with auto-reconnect.
+	*
+	* @param reconnect Set when the client is coming back from a drop: every
+	*        notification published in the gap is gone, so the subscriptions
+	*        are refetched once it is listening again.
 	*/
-	async connectListenClient() {
+	async connectListenClient({ reconnect = false } = {}) {
 		if (!this.listenConnectionString) return;
 		let pending;
 		try {
@@ -11054,6 +11975,10 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 			this.listenClient = client;
 			pending = void 0;
 			this.debugLog(`📡 [RealtimeService] LISTEN client connected on channel "${PG_NOTIFY_CHANNEL}"`);
+			if (reconnect) {
+				logger.warn("⚠️ [RealtimeService] LISTEN client reconnected; refetching every subscription for what it missed.");
+				this.resyncSubscriptions();
+			}
 		} catch (err) {
 			if (pending) try {
 				await pending.end();
@@ -11078,7 +12003,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				} catch {}
 				this.listenClient = void 0;
 			}
-			await this.connectListenClient();
+			await this.connectListenClient({ reconnect: true });
 		}, delay);
 	}
 };
@@ -11113,6 +12038,17 @@ var WS_RATE_WINDOW_MS = 6e4;
 * a considered product limit (see `docs/channel-authorization.md`).
 */
 var WS_CHANNEL_RATE_LIMIT = 7200;
+/**
+* The largest frame a socket that has not authenticated may send, in bytes.
+*
+* All such a socket can usefully say is `AUTHENTICATE` with a token — a few
+* KiB with custom claims — and everything else is answered `UNAUTHORIZED`.
+* Without this, each of those answers came after the whole frame was buffered,
+* stringified and parsed, up to the body limit: a handful of connections that
+* never signed in could hold the process's memory. A larger frame closes the
+* socket with 1009 before it is read.
+*/
+var MAX_UNAUTHENTICATED_FRAME_BYTES = 64 * 1024;
 /** Frames counted against the channel budget rather than the general one. */
 var CHANNEL_MESSAGE_TYPES = /* @__PURE__ */ new Set([
 	"join_channel",
@@ -11214,7 +12150,33 @@ function isAdminSession(session) {
 	if (!session.user.roles) return false;
 	return session.user.roles.some((r) => r === "admin");
 }
-function createPostgresWebSocket(server, realtimeService, driver, authConfig, authAdapter) {
+/** A frame's size in bytes, however `ws` delivered it. */
+function frameBytes(data) {
+	if (Array.isArray(data)) return data.reduce((total, chunk) => total + chunk.length, 0);
+	return data.byteLength;
+}
+/**
+* Where a connection comes from, as the data API's rate limiter reads an
+* address: the upgrade request's headers (believed only as far as proxies are
+* declared) and the socket's own address.
+*/
+function connectionOrigin(request) {
+	return {
+		header: (name) => {
+			const value = request?.headers[name];
+			return Array.isArray(value) ? value.join(", ") : value;
+		},
+		socketAddress: request?.socket?.remoteAddress
+	};
+}
+/**
+* `limits` are the data API's, for the same rows reached through this door:
+* frames larger than its body limit close the socket with 1009 before they are
+* read, and every data frame counts in the caller's data-API bucket — the one
+* their HTTP requests count in — rather than only in a budget per connection,
+* which a caller multiplied by opening more.
+*/
+function createPostgresWebSocket(server, realtimeService, driver, authConfig, authAdapter, limits) {
 	const clientSessions = /* @__PURE__ */ new Map();
 	const isProduction = process.env.NODE_ENV === "production";
 	/**
@@ -11237,15 +12199,20 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 		if (extras.length === 0) logger.debug(message);
 		else logger.debug(message, { details: extras.length === 1 ? extras[0] : extras });
 	};
-	const wss = new WebSocketServer({ server });
+	const maxPayload = limits?.maxPayload ?? RUNTIME_DEFAULT_MAX_BODY_SIZE;
+	const wss = new WebSocketServer({
+		server,
+		maxPayload: maxPayload > 0 ? maxPayload : 0
+	});
 	wss.on("error", (err) => {
 		if (err.code === "EADDRINUSE") return;
 		logger.error("❌ [WebSocket Server] Error", { error: err });
 	});
 	const requireAuth = !!authAdapter || resolveRequireAuth(authConfig);
 	if (requireAuth && !authAdapter && !authConfig?.jwtSecret && !authConfig?.serviceKey) logger.warn("🔐 [WebSocket Server] Authentication is required but no adapter, jwtSecret or serviceKey is configured — no client can complete AUTH, so every realtime message will be refused with UNAUTHORIZED.");
-	wss.on("connection", (ws) => {
+	wss.on("connection", (ws, request) => {
 		const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
+		const origin = connectionOrigin(request);
 		wsDebug(`WebSocket client connected: ${clientId}`);
 		clientSessions.set(clientId, {
 			ws,
@@ -11260,9 +12227,16 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 			wsDebug(`WebSocket client disconnected: ${clientId}`);
 			clientSessions.delete(clientId);
 		});
+		ws.on("error", (error) => {
+			wsDebug(`WebSocket client ${clientId} error: ${error.message}`);
+		});
 		ws.on("message", async (message) => {
 			let requestId;
 			try {
+				if (!clientSessions.get(clientId)?.authenticated && frameBytes(message) > MAX_UNAUTHENTICATED_FRAME_BYTES) {
+					ws.close(1009, "Authenticate before sending anything larger than a token.");
+					return;
+				}
 				const { type, payload, requestId: reqId } = JSON.parse(message.toString());
 				requestId = reqId;
 				wsDebug(`[WS] ${clientId} → ${type}`, requestId ? `(${requestId})` : "");
@@ -11281,6 +12255,33 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						}
 					}));
 				};
+				{
+					const session = clientSessions.get(clientId);
+					if (session) {
+						const now = Date.now();
+						if (CHANNEL_MESSAGE_TYPES.has(type)) {
+							if (now - session.channelWindowStart > WS_RATE_WINDOW_MS) {
+								session.channelMessageCount = 0;
+								session.channelWindowStart = now;
+							}
+							session.channelMessageCount++;
+							if (session.channelMessageCount > WS_CHANNEL_RATE_LIMIT) {
+								sendError("ERROR", "RATE_LIMITED", "Too many channel messages. Please slow down.");
+								return;
+							}
+						} else {
+							if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {
+								session.messageCount = 0;
+								session.messageWindowStart = now;
+							}
+							session.messageCount++;
+							if (session.messageCount > WS_RATE_LIMIT) {
+								sendError("ERROR", "RATE_LIMITED", "Too many requests. Please slow down.");
+								return;
+							}
+						}
+					}
+				}
 				if (type === "AUTHENTICATE") {
 					const { token } = payload || {};
 					if (!token) {
@@ -11294,7 +12295,8 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 							uid: adapterUser.uid,
 							roles: adapterUser.roles,
 							isAdmin: adapterUser.isAdmin,
-							isAnonymous: adapterUser.isAnonymous === true
+							isAnonymous: adapterUser.isAnonymous === true,
+							...adapterUser.claims ? { claims: adapterUser.claims } : {}
 						};
 					} catch {}
 					else if (authConfig?.serviceKey && safeCompare(token, authConfig.serviceKey)) verifiedUser = {
@@ -11318,6 +12320,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						if (session) {
 							session.user = verifiedUser;
 							session.authenticated = true;
+							await realtimeService.rescopeClient(clientId, sessionAuthContext(session));
 						}
 						wsDebug(`[WS] replying AUTH_SUCCESS for requestId ${requestId}`);
 						ws.send(JSON.stringify({
@@ -11341,39 +12344,22 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						return;
 					}
 				}
-				{
-					const session = clientSessions.get(clientId);
-					if (session) {
-						const now = Date.now();
-						if (CHANNEL_MESSAGE_TYPES.has(type)) {
-							if (now - session.channelWindowStart > WS_RATE_WINDOW_MS) {
-								session.channelMessageCount = 0;
-								session.channelWindowStart = now;
-							}
-							session.channelMessageCount++;
-							if (session.channelMessageCount > WS_CHANNEL_RATE_LIMIT) {
-								sendError("ERROR", "RATE_LIMITED", "Too many channel messages. Please slow down.");
-								return;
-							}
-						} else {
-							if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {
-								session.messageCount = 0;
-								session.messageWindowStart = now;
-							}
-							session.messageCount++;
-							if (session.messageCount > WS_RATE_LIMIT) {
-								sendError("ERROR", "RATE_LIMITED", "Too many requests. Please slow down.");
-								return;
-							}
-						}
-					}
-				}
 				if (ADMIN_ONLY_TYPES.has(type)) {
 					if (!isAdminSession(clientSessions.get(clientId))) {
 						sendError("ERROR", "FORBIDDEN", "Admin access required for this operation");
 						return;
 					}
 				}
+				if (limits?.dataRateLimit && PUBLIC_TYPES.has(type)) {
+					const decision = await limits.dataRateLimit({
+						...origin,
+						uid: clientSessions.get(clientId)?.user?.uid
+					});
+					if (decision && !decision.allowed) {
+						sendError("ERROR", "RATE_LIMITED", "Too many requests, please try again later.");
+						return;
+					}
+				}
 				/**
 				* Apply the REST layer's write checks to a socket payload.
 				*
@@ -11381,13 +12367,98 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 				* driver decides what a path means, and refusing here would
 				* turn "unknown collection" into a validation error.
 				*/
-				const assertWriteRequest = (path, values) => {
+				const assertWriteRequest = (path, values, status) => {
 					if (!path || !values || typeof values !== "object") return;
 					const collection = driver.registry?.getCollectionByPath(path);
 					if (!collection) return;
-					assertWriteRequestValid(values, collection, { viewer: { roles: clientSessions.get(clientId)?.user?.roles ?? ["anon"] } });
+					assertWriteRequestValid(values, collection, {
+						viewer: { roles: clientSessions.get(clientId)?.user?.roles ?? ["anon"] },
+						status
+					});
 					assertFieldOpsValid(values, collection);
 				};
+				/**
+				* Apply the REST layer's read check to a socket request: no
+				* filter, sort, projection or uniqueness probe over a field
+				* this caller may not read. The strip keeps the value off the
+				* wire; without this a `COUNT` still answers whether a hidden
+				* value matches a pattern, one character at a time.
+				*
+				* Same viewer as `assertWriteRequest`, and silent in the same
+				* case: a path that names no registered collection is the
+				* driver's to answer.
+				*/
+				const assertReadRequest = (path, request) => {
+					if (!path) return;
+					let collection;
+					try {
+						collection = driver.registry?.getCollectionByPath(path);
+					} catch {
+						return;
+					}
+					if (!collection) return;
+					const session = clientSessions.get(clientId);
+					assertReadRequestReadable(request, collection, { roles: session?.user?.roles ?? ["anon"] });
+				};
+				/**
+				* Refuse a write through a nested path that sets a relation
+				* this caller may not write — the rule REST's nested routes
+				* apply, from the same function. The body is checked by
+				* `assertWriteRequest`; this is what the address writes.
+				*
+				* Silent for a root path, and for a nested one the registry
+				* cannot walk: the driver refuses that with its own message.
+				*/
+				const assertNestedWrite = (path, kind) => {
+					if (typeof path !== "string" || !isNestedPath(path) || !driver.registry) return;
+					let hop;
+					try {
+						hop = resolveNestedPath(path, driver.registry);
+					} catch {
+						return;
+					}
+					if (!hop) return;
+					const session = clientSessions.get(clientId);
+					assertNestedWriteAllowed(hop, kind, path, { roles: session?.user?.roles ?? ["anon"] });
+				};
+				/** The auth collection at `path`, or `undefined` for any other. */
+				const authCollectionAt = (path) => {
+					if (typeof path !== "string") return void 0;
+					let collection;
+					try {
+						collection = driver.registry?.getCollectionByPath(path);
+					} catch {
+						return;
+					}
+					const auth = collection?.auth;
+					return auth === true || !!auth && typeof auth === "object" && auth.enabled === true ? collection : void 0;
+				};
+				/**
+				* The auth collection's rows are the users, so a write to one
+				* is user administration — the auth adapter's to check, as it
+				* is on the REST routes and `/admin/users`. `undefined` for any
+				* other collection, or an adapter with nothing to say.
+				*/
+				const userAdminFor = (path) => authAdapter && authCollectionAt(path) ? authAdapter : void 0;
+				/**
+				* An upsert's options, under the rules `POST /api/data`
+				* applies to `?on_conflict=`: refused on a nested path,
+				* whose insert branch stamps the parent's key into the
+				* DO UPDATE and so moves the row it matched under this
+				* parent; and a target that is a declared unique key of
+				* the registry's collection, or a 400 naming the ones
+				* there are rather than Postgres's 42P10.
+				*/
+				const upsertOptions = (request) => {
+					if (request.upsert !== true) return {};
+					if (typeof request.path === "string" && isNestedPath(request.path)) throw ApiError.badRequest("An upsert is not accepted on a nested path: a row it matched would be moved under this parent. Send the upsert to the collection directly.", "INVALID_CONFLICT_TARGET");
+					const collection = driver.registry?.getCollectionByPath(request.path);
+					const onConflict = collection ? resolveConflictTarget(request.onConflict, collection, { where: "`onConflict`" }) : void 0;
+					return {
+						upsert: true,
+						...onConflict && { onConflict }
+					};
+				};
 				const getScopedDelegate = async () => {
 					if (typeof driver.withAuth === "function") try {
 						const who = sessionAuthContext(clientSessions.get(clientId));
@@ -11413,6 +12484,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						{
 							wsDebug("📋 [WebSocket Server] Processing FETCH_COLLECTION request");
 							const request = payload;
+							assertReadRequest(request.path, request);
 							const rows = await (await getScopedDelegate()).fetchCollection({
 								...request,
 								limit: resolveClientListLimit(request.limit, { vectorSearch: !!request.vectorSearch })
@@ -11450,8 +12522,31 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 								depth: null,
 								colors: true
 							}));
-							assertWriteRequest(request.path, request.values);
-							const row = await (await getScopedDelegate()).save(request);
+							const usersCollection = request.status !== "existing" && request.upsert !== true && authAdapter?.prepareUserCreation ? authCollectionAt(request.path) : void 0;
+							if (usersCollection) {
+								const body = request.values ?? {};
+								assertUserCreationBodyValid(authAdapter, usersCollection, body, { roles: clientSessions.get(clientId)?.user?.roles ?? ["anon"] });
+								assertNoFieldOpsOnCreate(body, "A create");
+							} else assertWriteRequest(request.path, request.values, request.status);
+							assertNestedWrite(request.path, request.id === void 0 || request.status !== "existing" ? "create" : "update");
+							const delegate = await getScopedDelegate();
+							const userAdmin = request.status === "existing" && request.id !== void 0 ? userAdminFor(request.path) : void 0;
+							const [values] = userAdmin?.prepareUserUpdates ? await userAdmin.prepareUserUpdates([{
+								uid: String(request.id),
+								values: request.values
+							}]) : [request.values];
+							const write = (toWrite) => delegate.save({
+								path: request.path,
+								...request.id !== void 0 && { id: request.id },
+								values: toWrite,
+								status: request.status,
+								...upsertOptions(request)
+							});
+							const created = usersCollection ? await createUserThroughAuthCollection(authAdapter, usersCollection, values ?? {}, write) : void 0;
+							const row = created ? {
+								...created.row,
+								...created.delivery
+							} : await write(values);
 							wsDebug("💾 [WebSocket Server] SAVE_ENTITY result:", inspect(row, {
 								depth: null,
 								colors: true
@@ -11470,13 +12565,19 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 							wsDebug("🗑️ [WebSocket Server] Processing DELETE_ENTITY request");
 							const request = payload;
 							wsDebug("🗑️ [WebSocket Server] Deleting row:", request.row);
-							await (await getScopedDelegate()).delete({
+							assertNestedWrite(request.row?.path, "unlink");
+							const delegate = await getScopedDelegate();
+							const userAdmin = userAdminFor(request.row?.path);
+							const uids = [String(request.row.id)];
+							await userAdmin?.prepareUserDeletions?.(uids);
+							await delegate.delete({
 								row: {
 									id: request.row.id,
 									path: request.row.path
 								},
 								hard: request.hard
 							});
+							await userAdmin?.finalizeUserDeletions?.(uids);
 							wsDebug("🗑️ [WebSocket Server] DELETE_ENTITY completed successfully");
 							const response = {
 								type: "DELETE_SUCCESS",
@@ -11491,6 +12592,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						{
 							wsDebug("🔍 [WebSocket Server] Processing CHECK_UNIQUE_FIELD request");
 							const { path, name, value, id, collection } = payload;
+							if (typeof name === "string") assertReadRequest(path, { filter: { [name]: ["==", value] } });
 							const isUnique = await (await getScopedDelegate()).checkUniqueField(path, name, value, id, collection);
 							wsDebug("🔍 [WebSocket Server] CHECK_UNIQUE_FIELD result:", isUnique);
 							const response = {
@@ -11505,6 +12607,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					case "COUNT":
 						{
 							const request = payload;
+							assertReadRequest(request.path, request);
 							const response = {
 								type: "COUNT_SUCCESS",
 								payload: { count: await (await getScopedDelegate()).count(request) },
@@ -11522,7 +12625,10 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 									sendError("ERROR", "NOT_SUPPORTED", "SQL execution is not available for this driver.");
 									break;
 								}
-								const result = await admin.executeSql(sql, options);
+								const result = await admin.executeSql(sql, {
+									...options,
+									isolateSession: true
+								});
 								if (process.env.NODE_ENV !== "production") wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
 								const auditSession = clientSessions.get(clientId);
 								logger.info("[SQL Audit] WebSocket SQL execution", {
@@ -11929,7 +13035,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-CaMOS76G.js").then((n) => n.r);
+			const { createDump, discardPartialDump, pruneBackups, uploadBackup, validateDump } = await import("./backup-service-HQ9GC4tN.js").then((n) => n.r);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -11943,8 +13049,8 @@ function createBackupCron(config) {
 			log(`Dump created: ${dump.fileName} (${formatBytes(dump.sizeBytes)})`);
 			const check = await validateDump(dump.localFile);
 			if (!check.ok) {
-				if (destination.kind !== "local" && fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);
-				if (dump.globalsFile && destination.kind !== "local" && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);
+				if (dump.globalsFile) discardPartialDump(dump.globalsFile);
+				discardPartialDump(dump.localFile);
 				throw new Error(`New backup failed validation — skipping upload and pruning to protect existing backups. ${check.reason}`);
 			}
 			let storedKey = dump.localFile;
@@ -12519,6 +13625,14 @@ var UserService = class {
 			updatedAt: row.updated_at
 		}));
 	}
+	/**
+	* @see UserRepository.unlinkUserIdentity — scoped to the user as well as
+	* the identity, so it can only ever detach an identity from the account
+	* it names.
+	*/
+	async unlinkUserIdentity(uid, provider, providerId) {
+		await this.withServerContext(async (db) => db.delete(this.userIdentitiesTable).where(sql`${this.userIdentitiesTable.uid} = ${uid} AND ${this.userIdentitiesTable.provider} = ${provider} AND ${this.userIdentitiesTable.providerId} = ${providerId}`));
+	}
 	async linkUserIdentity(uid, provider, providerId, profileData) {
 		await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
 			uid,
@@ -12533,7 +13647,13 @@ var UserService = class {
 		const payload = this.mapPayload(data);
 		const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 		payload[updatedAtKey] = /* @__PURE__ */ new Date();
-		const [row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
+		let row;
+		try {
+			[row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
+		} catch (error) {
+			if (extractPgError(error)?.code === "23505") throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
+			throw error;
+		}
 		return row ? this.mapRowToUser(row) : null;
 	}
 	async deleteUser(id) {
@@ -12586,7 +13706,7 @@ var UserService = class {
 		};
 	}
 	/**
-	* Update user's password hash
+	* Update user's password hash; `null` removes the password.
 	*/
 	async updatePassword(id, passwordHash) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -12756,7 +13876,18 @@ var RefreshTokenService = class RefreshTokenService {
 		if (session && this.has("sessionId")) values.sessionId = session.id;
 		if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
 		if (session?.aal && this.has("aal")) values.aal = session.aal;
-		await this.db.insert(this.refreshTokensTable).values(values);
+		const parentHash = session?.rotatedFrom && this.has("rotatedAt") ? session.rotatedFrom : void 0;
+		if (!parentHash) {
+			await this.db.insert(this.refreshTokensTable).values(values);
+			return true;
+		}
+		return await this.db.transaction(async (tx) => {
+			const live = this.has("revoked") ? sql`${this.refreshTokensTable.tokenHash} = ${parentHash} AND ${this.col("revoked")} IS NOT TRUE` : eq(this.refreshTokensTable.tokenHash, parentHash);
+			const [parent] = await tx.select({ id: this.refreshTokensTable.id }).from(this.refreshTokensTable).where(live).for("share");
+			if (!parent) return false;
+			await tx.insert(this.refreshTokensTable).values(values);
+			return true;
+		});
 	}
 	/**
 	* Build a {@link RefreshTokenInfo} out of a row of {@link selection}.
@@ -12812,17 +13943,31 @@ var RefreshTokenService = class RefreshTokenService {
 		}
 		await this.db.update(this.refreshTokensTable).set({ rotatedAt: /* @__PURE__ */ new Date() }).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 	}
-	/** Final kill of one sign-in: logout, or revoking a device remotely. */
+	/**
+	* Final kill of one sign-in: logout, or revoking a device remotely.
+	*
+	* Lock first, write second, in one transaction. A rotation in flight
+	* holds a share lock on its parent — a row of this session — until the
+	* token it mints is committed (see `createToken`), so the lock here waits
+	* for it, and the write, being a new statement, reads a snapshot that has
+	* that token in it. A lone UPDATE would work from a snapshot taken before
+	* the token existed and leave it live: the sign-out a refresh in flight
+	* used to undo.
+	*/
 	async revokeSession(sessionId) {
 		if (!this.has("sessionId")) return;
-		if (this.has("revoked")) {
-			await this.db.update(this.refreshTokensTable).set({
-				revoked: true,
-				...this.has("rotatedAt") ? { rotatedAt: /* @__PURE__ */ new Date() } : {}
-			}).where(eq(this.col("sessionId"), sessionId));
-			return;
-		}
-		await this.db.delete(this.refreshTokensTable).where(eq(this.col("sessionId"), sessionId));
+		const inSession = eq(this.col("sessionId"), sessionId);
+		await this.db.transaction(async (tx) => {
+			await tx.select({ id: this.refreshTokensTable.id }).from(this.refreshTokensTable).where(inSession).for("update");
+			if (this.has("revoked")) {
+				await tx.update(this.refreshTokensTable).set({
+					revoked: true,
+					...this.has("rotatedAt") ? { rotatedAt: /* @__PURE__ */ new Date() } : {}
+				}).where(inSession);
+				return;
+			}
+			await tx.delete(this.refreshTokensTable).where(inSession);
+		});
 	}
 	/**
 	* Housekeeping: rotation would otherwise leave a row per refresh forever.
@@ -13013,7 +14158,7 @@ var PostgresTokenRepository = class {
 		this.magicLinkTokenService = new MagicLinkTokenService(db, tableOrTables);
 	}
 	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
-		await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+		return this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
 	}
 	async markRefreshTokenRotated(tokenHash) {
 		await this.refreshTokenService.markRotated(tokenHash);
@@ -13102,6 +14247,9 @@ var PostgresAuthRepository = class {
 	async linkUserIdentity(uid, provider, providerId, profileData) {
 		return this.userService.linkUserIdentity(uid, provider, providerId, profileData);
 	}
+	async unlinkUserIdentity(uid, provider, providerId) {
+		await this.userService.unlinkUserIdentity(uid, provider, providerId);
+	}
 	async updateUser(id, data) {
 		return this.userService.updateUser(id, data);
 	}
@@ -13195,7 +14343,7 @@ var PostgresAuthRepository = class {
 	}
 	async deleteRole(_id) {}
 	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
-		await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+		return this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
 	}
 	async markRefreshTokenRotated(tokenHash) {
 		await this.tokenRepository.markRefreshTokenRotated(tokenHash);
@@ -13450,7 +14598,9 @@ var MfaService = class {
 		};
 	}
 	/**
-	* Count one failed guess against a challenge and report the new total.
+	* Count one guess against a challenge and report the new total. The route
+	* claims it before judging the code, so the total it returns is what the
+	* cap is decided on.
 	*
 	* Incremented in the database rather than in the route so that guesses
 	* arriving in parallel — the shape any real brute-force takes — cannot
@@ -15066,9 +16216,13 @@ function createPostgresBootstrapper(pgConfig) {
 	const provisioningDb = (driverResult) => {
 		return (driverResult?.internals)?.db ?? pgConfig.connection;
 	};
-	const provisioningQueryable = (driverResult) => {
-		const db = (driverResult?.internals)?.db ?? pgConfig.connection;
+	const requireProvisioningDb = (driverResult) => {
+		const db = provisioningDb(driverResult);
 		if (!db) throw new Error("Cannot provision the collection schema: this Postgres adapter was created without a `connection`, and no initialized driver was supplied to fall back on. Pass `connection` to `createPostgresAdapter` (see `createPostgresDatabaseConnection`).");
+		return db;
+	};
+	const provisioningQueryable = (driverResult) => {
+		const db = requireProvisioningDb(driverResult);
 		return { async query(text) {
 			return { rows: sqlRows(await db.execute(sql.raw(text))) };
 		} };
@@ -15081,14 +16235,13 @@ function createPostgresBootstrapper(pgConfig) {
 	* Idempotent and cheap to repeat: `CREATE SCHEMA IF NOT EXISTS` plus a
 	* handful of `CREATE OR REPLACE FUNCTION`.
 	*/
-	const provisionRlsRuntime = async (queryable) => {
-		const { RLS_BOOTSTRAP_STATEMENTS } = await import("./rls-bootstrap-sql-H3rCFi3F.js").then((n) => n.i);
-		await queryable.query("SELECT pg_advisory_lock(hashtext('rebase_auth_functions_init'))");
-		try {
-			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await queryable.query(statement);
-		} finally {
-			await queryable.query("SELECT pg_advisory_unlock(hashtext('rebase_auth_functions_init'))");
-		}
+	const provisionRlsRuntime = async (driverResult) => {
+		const db = requireProvisioningDb(driverResult);
+		const { RLS_BOOTSTRAP_STATEMENTS } = await import("./rls-bootstrap-sql-B8EclDyM.js").then((n) => n.i);
+		await db.transaction(async (tx) => {
+			await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
+			for (const statement of RLS_BOOTSTRAP_STATEMENTS) await tx.execute(sql.raw(statement));
+		});
 	};
 	return {
 		type: "postgres",
@@ -15476,7 +16629,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CpAgy51F.js").then((n) => n.n);
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-BEEjn5cn.js").then((n) => n.n);
 			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(describeEnsureFailure(failure));
 			return { applied: plan.actions.length - plan.failures.length };
@@ -15507,13 +16660,13 @@ function createPostgresBootstrapper(pgConfig) {
 		* as the auth path and the migration preamble, from the same constant.
 		*/
 		async ensureRlsRuntime(driverResult) {
-			await provisionRlsRuntime(provisioningQueryable(driverResult));
+			await provisionRlsRuntime(driverResult);
 		},
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-Dzd-2S81.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-RHUcEp4v.js");
 			const queryable = provisioningQueryable(driverResult);
 			const { rows } = await queryable.query("SELECT to_regprocedure('rebase.roles()') IS NOT NULL AS present");
-			if (!rows[0]?.present) await provisionRlsRuntime(queryable);
+			if (!rows[0]?.present) await provisionRlsRuntime(driverResult);
 			const outcome = await ensureCollectionPolicies(queryable, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);
 			for (const failure of outcome.failures) logger.warn(`🔐 [rls] Could not fully apply policies to "${failure.table}" — RLS is on, so it denies until this is resolved: ${failure.error}`);
@@ -15521,7 +16674,7 @@ function createPostgresBootstrapper(pgConfig) {
 			for (const u of outcome.unsecured.filter((u) => u.grantWithdrawn)) logger.error(`🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. Its privileges have been revoked from ${REBASE_USER_ROLE}, so the table is unreachable rather than unprotected. Reads and writes to that collection will fail until RLS can be enabled.`);
 			if (unrevoked.length > 0) throw new Error("Refusing to start: row-level security could not be enabled on " + unrevoked.map((u) => `"${u.table}" (${u.error})`).join(", ") + `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. The table would be served with no row filtering. Fix the database permissions (the connection role must own these tables, or be able to ALTER them) and boot again.`);
 			try {
-				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-H3rCFi3F.js").then((n) => n.i);
+				const { dropLegacyAuthSchema } = await import("./rls-bootstrap-sql-B8EclDyM.js").then((n) => n.i);
 				await dropLegacyAuthSchema(async (text) => (await queryable.query(text)).rows, {
 					info: (m) => logger.info(m),
 					warn: (m) => logger.warn(m)
@@ -15599,9 +16752,9 @@ function createPostgresBootstrapper(pgConfig) {
 			return driverResult.internals.driver.admin;
 		},
 		mountRoutes(app, basePath, driverResult) {},
-		async initializeWebsockets(server, realtimeService, driver, config, adapter) {
+		async initializeWebsockets(server, realtimeService, driver, config, adapter, limits) {
 			const { createPostgresWebSocket } = await Promise.resolve().then(() => websocket_exports);
-			createPostgresWebSocket(server, realtimeService, driver, config, adapter);
+			createPostgresWebSocket(server, realtimeService, driver, config, adapter, limits);
 		}
 	};
 }
@@ -15626,8 +16779,8 @@ function createPostgresAdapter(pgConfig) {
 		async initializeHistory(config, driverResult) {
 			if (bootstrapper.initializeHistory) return bootstrapper.initializeHistory(config, driverResult);
 		},
-		initializeWebsockets(server, realtimeService, driver, config, adapter) {
-			if (bootstrapper.initializeWebsockets) return bootstrapper.initializeWebsockets(server, realtimeService, driver, config, adapter);
+		initializeWebsockets(server, realtimeService, driver, config, adapter, limits) {
+			if (bootstrapper.initializeWebsockets) return bootstrapper.initializeWebsockets(server, realtimeService, driver, config, adapter, limits);
 		},
 		verifyConnection: bootstrapper.verifyConnection ? (driverResult) => bootstrapper.verifyConnection(driverResult) : void 0,
 		ensureCollectionSchema: bootstrapper.ensureCollectionSchema ? (collections, driverResult, log) => bootstrapper.ensureCollectionSchema(collections, driverResult, log) : void 0,