@vibeorm/runtime 2.2.0 → 2.3.0

package/dist/index.js

@@ -50,22 +50,30 @@ function createSqlModel(params) {
   return Object.freeze({ table: params.alias === undefined ? table : sql`${table} AS ${sql.ident({ parts: [params.alias] })}`, fields: Object.freeze(fields) });
 }
 // packages/runtime/src/adapter.ts
+import { VibeError as VibeError2 } from "@vibeorm/schema";
 function toSqlExecutor(params) {
   const { adapter } = params;
-  return async (queryParams) => {
-    const result = await adapter.executeUnsafe({
-      text: queryParams.text,
-      values: queryParams.values
-    });
+  const execute = async (queryParams) => {
+    const result = await adapter.executeUnsafe(queryParams);
     return result.rows;
   };
+  const withSession = async ({ run }) => {
+    if (adapter.withSession === undefined)
+      throw new VibeError2({
+        code: "VIBE_UNSUPPORTED_CAPABILITY",
+        message: "This adapter cannot reserve a migration session. Supply an adapter with session support or an explicitly owned SqlExecutor.",
+        meta: { capability: "session", provider: adapter.provider }
+      });
+    return adapter.withSession({ run });
+  };
+  return Object.assign(execute, { withSession });
 }
 // packages/runtime/src/db-now.ts
-import { VibeError as VibeError2 } from "@vibeorm/schema";
+import { VibeError as VibeError3 } from "@vibeorm/schema";
 function dbNow(options) {
   const offset = options?.plusSeconds ?? 0;
   if (typeof offset !== "number" || !Number.isFinite(offset)) {
-    throw new VibeError2({
+    throw new VibeError3({
       code: "VIBE_VALIDATION",
       message: `dbNow plusSeconds must be a finite number of seconds (fractional is fine), got ${String(offset)}`,
       meta: { plusSeconds: offset }
@@ -84,10 +92,10 @@ function isDbNow(value) {
   return candidate.__vibeDbNow === true && typeof candidate.offsetSeconds === "number" && Number.isFinite(candidate.offsetSeconds);
 }
 // packages/runtime/src/advisory-lock.ts
-import { VibeError as VibeError3, unsupportedCapability } from "@vibeorm/schema";
+import { VibeError as VibeError4, unsupportedCapability } from "@vibeorm/schema";
 import { ADVISORY_KEY_BOUNDS } from "@vibeorm/sql";
 function validationError(params) {
-  return new VibeError3({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
+  return new VibeError4({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
 }
 function readInt32(params) {
   const { value, member, method } = params;
@@ -192,7 +200,7 @@ function statementFor(params) {
   };
 }
 // packages/runtime/src/model-meta.ts
-import { VibeError as VibeError4, enumStorageOf, isEnumType as isEnumType2, validateComputedConfig } from "@vibeorm/schema";
+import { VibeError as VibeError5, enumStorageOf, isEnumType as isEnumType2, validateComputedConfig } from "@vibeorm/schema";
 import { enumMembershipCodec } from "@vibeorm/sql";
 function toClientName(params) {
   const { name } = params;
@@ -321,7 +329,7 @@ function buildModelMeta(params) {
     for (const name of model.primaryKey.fields) {
       const field = fieldByName.get(name);
       if (field === undefined) {
-        throw new VibeError4({
+        throw new VibeError5({
           code: "VIBE_SCHEMA_INVALID",
           message: `model "${model.name}" declares composite primary-key field "${name}", which does not exist`,
           meta: { model: model.name, field: name }
@@ -427,7 +435,7 @@ function getModelMeta(params) {
   const { meta, model } = params;
   const found = meta.modelByName.get(model);
   if (found === undefined) {
-    throw new VibeError4({
+    throw new VibeError5({
       code: "VIBE_VALIDATION",
       message: `unknown model "${model}"`,
       meta: { model, known: [...new Set(meta.models.map((entry) => entry.name))] }
@@ -440,20 +448,20 @@ function getFieldMeta(params) {
   const found = model.fieldByName.get(field);
   if (found === undefined) {
     if (model.computed !== null && model.computed.has(field)) {
-      throw new VibeError4({
+      throw new VibeError5({
         code: "VIBE_VALIDATION",
         message: `"${field}" on model "${model.name}" is a computed field \u2014 computed fields appear in results (select/omit) only, not in ${context}`,
         meta: { model: model.name, field, context, computed: true }
       });
     }
     if (model.relationByName.has(field)) {
-      throw new VibeError4({
+      throw new VibeError5({
         code: "VIBE_VALIDATION",
         message: `"${field}" on model "${model.name}" is a relation \u2014 not valid in ${context} here (relation writes use nested-write verbs, relation reads use select/include)`,
         meta: { model: model.name, field, context }
       });
     }
-    throw new VibeError4({
+    throw new VibeError5({
       code: "VIBE_VALIDATION",
       message: `unknown field "${field}" on model "${model.name}" in ${context}`,
       meta: { model: model.name, field, context }
@@ -463,7 +471,7 @@ function getFieldMeta(params) {
 }
 // packages/runtime/src/codecs.ts
 import { JSON_TRANSPORT, projectionOutputName, parsePgArrayLiteral, toPgArrayLiteral } from "@vibeorm/sql";
-import { VibeError as VibeError5, isEnumType as isEnumType3 } from "@vibeorm/schema";
+import { VibeError as VibeError6, isEnumType as isEnumType3 } from "@vibeorm/schema";
 import { DIALECT_CODECS, decodeIsNoop } from "@vibeorm/sql";
 import {
   DIALECT_CODECS as DIALECT_CODECS2,
@@ -512,10 +520,29 @@ function decodeValue(params) {
   return codec.decode(value);
 }
 var DECIMAL_LITERAL = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/;
+function validateAtomicOperand(params) {
+  const { field, value } = params;
+  if (field.scalarType === "BigInt") {
+    if (typeof value === "bigint" || typeof value === "number" && Number.isSafeInteger(value))
+      return value;
+  } else if (field.scalarType === "Decimal") {
+    if (typeof value === "string" && DECIMAL_LITERAL.test(value.trim()))
+      return value.trim();
+    if (typeof value === "number" && Number.isFinite(value))
+      return value;
+  } else if (typeof value === "number" && Number.isFinite(value)) {
+    return value;
+  }
+  throw new VibeError6({
+    code: "VIBE_VALIDATION",
+    message: `Invalid arithmetic operand for ${field.scalarType} field "${field.name}"`,
+    meta: { field: field.name, value }
+  });
+}
 function toRealNumber(params) {
   const { field, value } = params;
   const refuse = () => {
-    throw new VibeError5({
+    throw new VibeError6({
       code: "VIBE_VALIDATION",
       message: `"${String(value)}" is not a numeric value for the Decimal field "${field.name}"`,
       meta: { field: field.name, value }
@@ -755,7 +782,7 @@ function positionalMaterializer(params) {
     const output = projectionOutputName({ column });
     const entry = plan.byColumn.get(output);
     if (entry === undefined)
-      throw new VibeError5({ code: "VIBE_INTERNAL", message: "positional projection has no schema field", meta: { model: model.name, column: output } });
+      throw new VibeError6({ code: "VIBE_INTERNAL", message: "positional projection has no schema field", meta: { model: model.name, column: output } });
     return entry;
   });
   const width = slots.length;
@@ -763,7 +790,7 @@ function positionalMaterializer(params) {
   const chunked = width > chunkSize;
   const count = Math.ceil(width / chunkSize);
   const invalid = () => {
-    throw new VibeError5({ code: "VIBE_INTERNAL", message: "positional relation payload does not match its SQL projection", meta: { model: model.name, expectedColumns: width } });
+    throw new VibeError6({ code: "VIBE_INTERNAL", message: "positional relation payload does not match its SQL projection", meta: { model: model.name, expectedColumns: width } });
   };
   if (width === 0 || new Set(slots.map((slot) => slot.name)).size !== width)
     return invalid();
@@ -805,7 +832,7 @@ function decodeAggregateValue(params) {
   return field === null ? value : decodeValue({ dialect, field, value });
 }
 // packages/runtime/src/lateral-projection.ts
-import { VibeError as VibeError6, unsupportedCapability as unsupportedCapability2 } from "@vibeorm/schema";
+import { VibeError as VibeError7, unsupportedCapability as unsupportedCapability2 } from "@vibeorm/schema";
 function isPlainObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
 }
@@ -822,7 +849,7 @@ function lateralProjection(params) {
   const columns = names.map((name) => {
     const field = model.fieldByName.get(name);
     if (field === undefined)
-      throw new VibeError6({ code: "VIBE_INTERNAL", message: "lateral projection references an unknown field", meta: { model: model.name, field: name } });
+      throw new VibeError7({ code: "VIBE_INTERNAL", message: "lateral projection references an unknown field", meta: { model: model.name, field: name } });
     return Object.freeze(applyLateralTransform({ model, column: { table: LATERAL_CHILD_ALIAS, name: field.columnName } }));
   });
   const descriptor = Object.freeze({ columns: Object.freeze(columns), hiddenOrder: Object.freeze(hiddenOrder) });
@@ -871,7 +898,7 @@ function applyLateralTransform(params) {
 
 // packages/runtime/src/query-builder.ts
 import { isSqlFragment, mapConflictColumns } from "@vibeorm/sql";
-import { VibeError as VibeError10, unsupportedCapability as unsupportedCapability4 } from "@vibeorm/schema";
+import { VibeError as VibeError11, unsupportedCapability as unsupportedCapability4 } from "@vibeorm/schema";
 import {
   SQL_DEFAULT_CELL,
   containsPattern,
@@ -885,9 +912,9 @@ import {
 import { describeRowLock } from "@vibeorm/sql";
 
 // packages/runtime/src/bulk-upsert.ts
-import { VibeError as VibeError7, unsupportedCapability as unsupportedCapability3 } from "@vibeorm/schema";
+import { VibeError as VibeError8, unsupportedCapability as unsupportedCapability3 } from "@vibeorm/schema";
 function validationError2(params) {
-  return new VibeError7({
+  return new VibeError8({
     code: "VIBE_VALIDATION",
     message: params.message,
     ...params.meta === undefined ? {} : { meta: params.meta }
@@ -1069,8 +1096,13 @@ function conflictKeyOf(params) {
 function assertNoDuplicateConflictKeys(params) {
   const { model, compiled, targetColumns } = params;
   const firstIndexByKey = new Map;
+  const signature = [...targetColumns].sort((left, right) => left < right ? -1 : 1).join("\x00");
+  const nullsNotDistinct = [...model.compoundUniques.values(), ...model.singleIndexUniques].some((group) => group.nullsNotDistinct && signatureOf({ fields: group.fields }) === signature);
   for (let index = 0;index < compiled.length; index += 1) {
-    const key = conflictKeyOf({ row: compiled[index], columns: targetColumns });
+    const row = compiled[index];
+    if (!nullsNotDistinct && targetColumns.some((column) => row[column] === null))
+      continue;
+    const key = conflictKeyOf({ row, columns: targetColumns });
     const first = firstIndexByKey.get(key);
     if (first !== undefined) {
       throw validationError2({
@@ -1206,7 +1238,7 @@ function assertConflictKeysAreComparable(params) {
 }
 
 // packages/runtime/src/keyset.ts
-import { VibeError as VibeError8 } from "@vibeorm/schema";
+import { VibeError as VibeError9 } from "@vibeorm/schema";
 var KEYSET_TOKEN_VERSION = 1;
 var KEYSET_TOKEN_PREFIX = "vk1.";
 var KEYSET_MAX_PAGE_SIZE = 1e4;
@@ -1216,10 +1248,10 @@ var DATETIME_NEEDS_PRECISION_ASSERTION = Object.freeze({
   sqlite: false
 });
 function keysetValidation(params) {
-  return new VibeError8({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
+  return new VibeError9({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
 }
 function keysetUnsupported(params) {
-  return new VibeError8({
+  return new VibeError9({
     code: "VIBE_UNSUPPORTED_CAPABILITY",
     message: params.message,
     meta: params.meta
@@ -1602,9 +1634,9 @@ function decodeKeysetToken(params) {
 }
 
 // packages/runtime/src/relation-plan.ts
-import { VibeError as VibeError9, implicitJoinTable } from "@vibeorm/schema";
+import { VibeError as VibeError10, implicitJoinTable } from "@vibeorm/schema";
 function validationError3(params) {
-  return new VibeError9({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
+  return new VibeError10({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
 }
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof Date);
@@ -1629,7 +1661,7 @@ function keyFields(params) {
   return names.map((name) => {
     const field = model.fieldByName.get(name);
     if (field === undefined) {
-      throw new VibeError9({
+      throw new VibeError10({
         code: "VIBE_SCHEMA_INVALID",
         message: `relation "${relation.name}" on ${relation.model} names unknown ${what} field "${name}"`,
         meta: { model: relation.model, relation: relation.name }
@@ -1641,7 +1673,7 @@ function keyFields(params) {
 function singleKeyPair(params) {
   const { link, what } = params;
   if (link.parentKeys.length !== 1 || link.childKeys.length !== 1) {
-    throw new VibeError9({
+    throw new VibeError10({
       code: "VIBE_UNSUPPORTED_CAPABILITY",
       message: `${what} on relation "${link.relation.name}" of ${link.relation.model} needs a single-column relation key \u2014 this relation links ${link.parentKeys.length} columns; use an explicit junction model`,
       meta: { model: link.relation.model, relation: link.relation.name, arity: link.parentKeys.length }
@@ -1685,7 +1717,7 @@ function resolveRelationLinkUncached(params) {
   const target = getModelMeta({ meta, model: relation.targetModel });
   if (relation.type === "manyToMany") {
     if (relation.model === relation.targetModel) {
-      throw new VibeError9({
+      throw new VibeError10({
         code: "VIBE_SCHEMA_INVALID",
         message: `relation "${relation.name}" on ${relation.model} is an implicit self many-to-many: both sides own the ` + `same join-table column, so this field and its inverse would read the same rows. Model each direction ` + `with an explicit junction model.`,
         meta: { model: relation.model, relation: relation.name, targetModel: relation.targetModel }
@@ -1727,7 +1759,7 @@ function resolveRelationLinkUncached(params) {
   }
   const reverse = findReverseRelation({ relation, target });
   if (reverse === null || reverse.fields === undefined || reverse.fields.length === 0) {
-    throw new VibeError9({
+    throw new VibeError10({
       code: "VIBE_SCHEMA_INVALID",
       message: `relation "${relation.name}" on ${relation.model} has no foreign-key counterpart on ${relation.targetModel}`,
       meta: { model: relation.model, relation: relation.name, target: relation.targetModel }
@@ -1752,7 +1784,7 @@ function pairedKeys(params) {
   const parentKeys = keyFields({ model, names: parentNames, relation, what: "fields" });
   const childKeys = keyFields({ model: target, names: childNames, relation, what: "references" });
   if (parentKeys.length !== childKeys.length) {
-    throw new VibeError9({
+    throw new VibeError10({
       code: "VIBE_SCHEMA_INVALID",
       message: `relation "${relation.name}" on ${relation.model} links ${parentKeys.length} field(s) to ${childKeys.length} reference(s) \u2014 a foreign key must pair every column`,
       meta: { model: relation.model, relation: relation.name }
@@ -2102,7 +2134,7 @@ var AGG_FN_BY_KEY = {
   _max: "max"
 };
 function validationError4(params) {
-  return new VibeError10({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
+  return new VibeError11({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
 }
 function isPlainObject3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof Date) && !(value instanceof Uint8Array);
@@ -2667,6 +2699,12 @@ function compileOperatorFilter(params) {
           });
         }
         for (const item of operand) {
+          if (item === null) {
+            throw validationError4({
+              message: `"${operator}" on ${model.name}.${field.name} cannot contain null; use an explicit null comparison`,
+              meta: { model: model.name, field: field.name, operator }
+            });
+          }
           if (isDbNow(item)) {
             throw validationError4({
               message: `dbNow() cannot ride an "${operator}" list on ${model.name}.${field.name} \u2014 compare with lt/lte/gt/gte/equals instead`,
@@ -3496,21 +3534,17 @@ function orderedColumns(params) {
   return model.fields.map((field) => field.columnName).filter((column) => (column in values));
 }
 function compileAtomicOperation(params) {
-  const { model, field, operator, operand } = params;
+  const { model, entry, operator, operand } = params;
+  const field = entry.field;
   if (field.scalarType === null || !NUMERIC_TYPES.includes(field.scalarType)) {
     throw validationError4({
       message: `"${operator}" needs a numeric field, but ${model.name}.${field.name} is ${String(field.enumName ?? field.scalarType)}`,
       meta: { model: model.name, field: field.name, operator }
     });
   }
-  const numeric = typeof operand === "bigint" ? Number(operand) : operand;
-  if (typeof numeric !== "number" || !Number.isFinite(numeric)) {
-    throw validationError4({
-      message: `"${operator}" on ${model.name}.${field.name} expects a number`,
-      meta: { model: model.name, field: field.name, operator, operand }
-    });
-  }
-  return { __op: operator, value: numeric };
+  const numeric = validateAtomicOperand({ field, value: operand });
+  const encoded = encodeWith(entry, numeric);
+  return { __op: operator, value: encoded, ...field.scalarType === "Decimal" ? { numericType: "Decimal" } : {} };
 }
 function compileUpdateSet(params) {
   const { dialect, model, data } = params;
@@ -3565,7 +3599,7 @@ function compileUpdateSet(params) {
           meta: { model: model.name, field: field.name, operator }
         });
       }
-      set[field.columnName] = compileAtomicOperation({ model, field, operator: atomic, operand });
+      set[field.columnName] = compileAtomicOperation({ model, entry, operator: atomic, operand });
       continue;
     }
     set[field.columnName] = encodeWith(entry, value);
@@ -5283,7 +5317,7 @@ function buildQuery(params) {
       const targetFields = conflictTargetGroup({ model, where }).fields;
       for (const field of targetFields) {
         if (!(field.columnName in row.values)) {
-          throw new VibeError10({
+          throw new VibeError11({
             code: "VIBE_INTERNAL",
             message: `upsert on ${model.name}: create data does not bind conflict-target column "${field.columnName}" \u2014 this shape must run the find-then-write fallback flow`,
             meta: { model: model.name, column: field.columnName }
@@ -5294,7 +5328,7 @@ function buildQuery(params) {
       for (const [key, value] of Object.entries(where)) {
         if (value === undefined || nativeTargetNames.has(key))
           continue;
-        throw new VibeError10({
+        throw new VibeError11({
           code: "VIBE_INTERNAL",
           message: `upsert on ${model.name}: where field "${key}" is not part of the conflict target \u2014 guarded upserts must run the find-then-write fallback flow`,
           meta: { model: model.name, field: key }
@@ -5346,8 +5380,95 @@ function buildQuery(params) {
 // packages/runtime/src/diagnostics/preview.ts
 import { getSqlDialect, renderStatement } from "@vibeorm/sql";
 
+// packages/runtime/src/extensions.ts
+import { VibeError as VibeError12, extensionManifestEntry } from "@vibeorm/schema";
+function assertExtensionManifest(params) {
+  const { manifest } = params;
+  const instances = params.instances ?? [];
+  const live = new Map(instances.map((extension) => [extension.name, extensionManifestEntry({ extension })]));
+  const problems = [];
+  for (const baked of manifest) {
+    const current = live.get(baked.name);
+    if (current === undefined) {
+      problems.push(`"${baked.name}" was baked into the client but not passed to VibeClient`);
+      continue;
+    }
+    if (current.version !== baked.version) {
+      problems.push(`"${baked.name}" version changed (generated ${baked.version}, live ${current.version})`);
+    } else if (current.optionsHash !== baked.optionsHash) {
+      problems.push(`"${baked.name}" options changed since generate`);
+    }
+    live.delete(baked.name);
+  }
+  for (const name of live.keys()) {
+    problems.push(`"${name}" is configured but missing from the generated client`);
+  }
+  if (problems.length > 0) {
+    throw new VibeError12({
+      code: "VIBE_STALE_CLIENT",
+      message: `extension list changed since generate; run vibeorm generate \u2014 ${problems.join("; ")}`,
+      meta: { manifest, problems }
+    });
+  }
+}
+function buildExtensionOperatorMap(params) {
+  const { instances, dialect, provider } = params;
+  const map = new Map;
+  const owner = new Map;
+  for (const extension of instances) {
+    for (const operator of extension.sql?.whereOperators ?? []) {
+      const existing = owner.get(operator.name);
+      if (existing !== undefined) {
+        throw new VibeError12({
+          code: "VIBE_CONFIG",
+          message: `where operator "${operator.name}" is claimed by both "${existing}" and "${extension.name}"`,
+          meta: { operator: operator.name }
+        });
+      }
+      owner.set(operator.name, extension.name);
+      map.set(operator.name, ({ column, operand, model, field }) => {
+        const compiled = operator.compile({
+          column,
+          operand,
+          dialect,
+          provider,
+          options: extension.options
+        });
+        if ("error" in compiled) {
+          throw new VibeError12({
+            code: "VIBE_VALIDATION",
+            message: `"${operator.name}" on ${model}.${field}: ${compiled.error}`,
+            meta: { model, field, operator: operator.name, extension: extension.name }
+          });
+        }
+        return { kind: "fragment", fragment: compiled.fragment };
+      });
+    }
+  }
+  return map.size === 0 ? null : map;
+}
+function buildConnectHooks(params) {
+  const { instances, dialect, provider } = params;
+  const hooks = [];
+  for (const extension of instances) {
+    const onConnect = extension.runtime?.onConnect;
+    if (onConnect === undefined)
+      continue;
+    hooks.push(({ execute }) => onConnect({
+      execute: (execParams) => execute({
+        text: execParams.text,
+        ...execParams.values === undefined ? {} : { values: execParams.values }
+      }),
+      dialect,
+      provider,
+      options: extension.options
+    }));
+  }
+  return hooks;
+}
+
 // packages/runtime/src/relation-key.ts
-import { VibeError as VibeError11 } from "@vibeorm/schema";
+import { VibeError as VibeError13 } from "@vibeorm/schema";
 function relationValueKey(params) {
   const { value } = params;
   if (value === null || value === undefined)
@@ -5380,7 +5501,7 @@ function relationTupleKey(params) {
     if (value === null || value === undefined)
       return null;
     if (typeof value === "object" && !(value instanceof Date) && !(value instanceof Uint8Array)) {
-      throw new VibeError11({
+      throw new VibeError13({
         code: "VIBE_UNSUPPORTED_CAPABILITY",
         message: "a relation key of this type cannot be compared faithfully in memory \u2014 relation links support String, Int, BigInt, Boolean, DateTime and Bytes keys",
         meta: { received: Object.prototype.toString.call(value) }
@@ -5406,7 +5527,7 @@ function assertWriteScope(params) {
 }
 
 // packages/runtime/src/nested-writes.ts
-import { VibeError as VibeError12 } from "@vibeorm/schema";
+import { VibeError as VibeError14 } from "@vibeorm/schema";
 function parentTupleOf(params) {
   const { link, row } = params;
   return link.parentKeys.map((field) => row[field.name]);
@@ -5453,10 +5574,10 @@ function detachAssignment(params) {
   return out;
 }
 function validationError5(params) {
-  return new VibeError12({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
+  return new VibeError14({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
 }
 function notFound(params) {
-  return new VibeError12({ code: "VIBE_NOT_FOUND", message: params.message, meta: params.meta });
+  return new VibeError14({ code: "VIBE_NOT_FOUND", message: params.message, meta: params.meta });
 }
 function isPlainObject4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof Date) && !(value instanceof Uint8Array);
@@ -5601,7 +5722,7 @@ function chunkKeyList(params) {
   const { dialect, keys, perKey, reserved } = params;
   if (keys.length === 0)
     return [];
-  if (dialect.inArrayStrategy !== "expand")
+  if (params.expanded !== true && dialect.inArrayStrategy !== "expand")
     return [keys];
   const size = Math.max(1, Math.floor((dialect.paramBudget - reserved) / perKey));
   const chunks = [];
@@ -5638,27 +5759,30 @@ async function deleteJoinRows(params) {
   const join = link.join;
   const pair = singleKeyPair({ link, what: "implicit many-to-many writes" });
   const parentValue = encodeValue({ dialect: dialect.name, field: pair.parent, value: parentKey });
-  await run.statement({
-    statement: {
-      kind: "delete",
-      table: { name: join.tableName },
-      where: {
-        kind: "and",
-        operands: [
-          { kind: "cmp", op: "eq", column: { name: join.parentColumn }, value: parentValue },
-          ...childKeys === undefined ? [] : [
-            {
-              kind: "inArray",
-              column: { name: join.childColumn },
-              values: childKeys.map((key) => encodeValue({ dialect: dialect.name, field: pair.child, value: key }))
-            }
+  const chunks = childKeys === undefined ? [undefined] : chunkKeyList({ dialect, keys: childKeys, perKey: 1, reserved: 1 });
+  for (const chunk of chunks) {
+    await run.statement({
+      statement: {
+        kind: "delete",
+        table: { name: join.tableName },
+        where: {
+          kind: "and",
+          operands: [
+            { kind: "cmp", op: "eq", column: { name: join.parentColumn }, value: parentValue },
+            ...chunk === undefined ? [] : [
+              {
+                kind: "inArray",
+                column: { name: join.childColumn },
+                values: chunk.map((key) => encodeValue({ dialect: dialect.name, field: pair.child, value: key }))
+              }
+            ]
           ]
-        ]
-      }
-    },
-    model: link.relation.model,
-    method: "nested.disconnect"
-  });
+        }
+      },
+      model: link.relation.model,
+      method: "nested.disconnect"
+    });
+  }
 }
 async function assertM2MMembers(params) {
   const { run, ctx, link, parentKey, childKeys, target, verb, relation } = params;
@@ -5666,10 +5790,10 @@ async function assertM2MMembers(params) {
     return;
   const members = await loadMemberKeys({ run, ctx, link, parentKey, childKeys });
   const pair = singleKeyPair({ link, what: "implicit many-to-many writes" });
-  const connected = new Set(members.map((member) => String(member)));
+  const connected = new Set(members.map((member) => relationValueKey({ value: decodeValue({ dialect: ctx.dialect.name, field: pair.child, value: member }) })));
   for (const childKey of childKeys) {
-    const childValue = encodeValue({ dialect: ctx.dialect.name, field: pair.child, value: childKey });
-    if (connected.has(String(childValue)))
+    const childValue = decodeValue({ dialect: ctx.dialect.name, field: pair.child, value: childKey });
+    if (connected.has(relationValueKey({ value: childValue })))
       continue;
     throw notFound({
       message: `nested "${verb}" on ${link.relation.model}.${relation}: ${target} is not connected`,
@@ -5760,7 +5884,7 @@ function isFilterableUniqueWhere(params) {
   return isUniqueWhere({ model: target, where });
 }
 async function connectChildrenByFk(params) {
-  const { run, op, items, fk, verb } = params;
+  const { dialect, run, op, items, fk, verb } = params;
   const target = op.link.target;
   if (items.length === 0)
     return;
@@ -5771,11 +5895,18 @@ async function connectChildrenByFk(params) {
     }
     return;
   }
-  const affected = await run.affected({
-    model: target.name,
-    method: "updateMany",
-    args: { where: { OR: items.map((item) => ({ ...item })) }, data: fk }
-  });
+  let perKey = 1;
+  for (const item of items)
+    perKey = Math.max(perKey, Object.values(item).filter((value) => value !== undefined && value !== null).length);
+  const reserved = Object.values(fk).filter((value) => value !== undefined).length + target.fields.filter((field) => field.isUpdatedAt && fk[field.name] === undefined).length;
+  let affected = 0;
+  for (const chunk of chunkKeyList({ dialect, keys: items, perKey, reserved, expanded: true })) {
+    affected += await run.affected({
+      model: target.name,
+      method: "updateMany",
+      args: { where: { OR: chunk.map((item) => ({ ...item })) }, data: fk }
+    });
+  }
   if (affected >= items.length)
     return;
   for (const item of items) {
@@ -5845,7 +5976,7 @@ async function applyChildCreateOps(params) {
       continue;
     }
     if (verb === "connect") {
-      await connectChildrenByFk({ run, op, items, fk, verb });
+      await connectChildrenByFk({ dialect: ctx.dialect, run, op, items, fk, verb });
       continue;
     }
     for (const item of items) {
@@ -6082,7 +6213,8 @@ async function loadMemberKeys(params) {
   const values = childKeys.map((childKey) => encodeValue({ dialect: ctx.dialect.name, field: pair.child, value: childKey }));
   const found = [];
   for (const chunk of chunkKeyList({ dialect: ctx.dialect, keys: values, perKey: 1, reserved: 1 })) {
-    found.push(...await scan(chunk));
+    for (const member of await scan(chunk))
+      found.push(member);
   }
   return found;
 }
@@ -6128,7 +6260,7 @@ async function applyChildUpdateOps(params) {
             method: "updateMany",
             args: { where: fk, data: detach }
           });
-          await connectChildrenByFk({ run, op, items, fk, verb });
+          await connectChildrenByFk({ dialect: ctx.dialect, run, op, items, fk, verb });
         }
         break;
       }
@@ -6578,7 +6710,9 @@ function previewOperation(params) {
   const { schema, model, method, args, relationStrategy, clientOptions } = params;
   const includeValues = params.includeParameterValues === true;
   const dialect = getSqlDialect({ dialect: params.dialect });
-  const meta = buildRuntimeMeta({ schema });
+  const baseMeta = buildRuntimeMeta({ schema });
+  const operatorMap = buildExtensionOperatorMap({ instances: params.extensions ?? [], dialect: params.dialect, provider: schema.datasource.provider });
+  const meta = operatorMap === null ? baseMeta : { ...baseMeta, extensionOperators: operatorMap };
   const modelMeta = getModelMeta({ meta, model });
   const writesNested = (method === "create" || method === "update" || method === "upsert") && (hasNestedWrites({ model: modelMeta, data: args?.data }) || hasNestedWrites({ model: modelMeta, data: args?.create }) || hasNestedWrites({ model: modelMeta, data: args?.update }));
   const effectiveArgs = args === undefined || !writesNested ? args : {
@@ -6660,7 +6794,7 @@ function previewOperation(params) {
   };
 }
 // packages/runtime/src/diagnostics/plan.ts
-import { VibeError as VibeError13, unsupportedCapability as unsupportedCapability5 } from "@vibeorm/schema";
+import { VibeError as VibeError15, unsupportedCapability as unsupportedCapability5 } from "@vibeorm/schema";
 import { NATIVE_RLS, getSqlDialect as getSqlDialect2, renderPostgresExplain, renderPostgresWorkload, renderStatement as renderStatement2 } from "@vibeorm/sql";
 var PLAN_DEFAULTS = Object.freeze({ maxNodes: 200, maxConditionLength: 2000 });
 var CONDITION_KEYS = [
@@ -6679,7 +6813,7 @@ var CONDITION_KEYS = [
   "Output"
 ];
 function planError(params) {
-  return new VibeError13({ code: "VIBE_ADAPTER", message: params.message, meta: {} });
+  return new VibeError15({ code: "VIBE_ADAPTER", message: params.message, meta: {} });
 }
 function asRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
@@ -6712,14 +6846,14 @@ function parsePostgresPlan(params) {
   const maxNodes = params.maxNodes ?? PLAN_DEFAULTS.maxNodes;
   const includeLiterals = params.includeLiterals === true;
   if (!Number.isInteger(maxNodes) || maxNodes < 1) {
-    throw new VibeError13({ code: "VIBE_CONFIG", message: `maxNodes must be a positive integer, got ${String(maxNodes)}`, meta: { maxNodes } });
+    throw new VibeError15({ code: "VIBE_CONFIG", message: `maxNodes must be a positive integer, got ${String(maxNodes)}`, meta: { maxNodes } });
   }
   let parsed = payload;
   if (typeof payload === "string") {
     try {
       parsed = JSON.parse(payload);
     } catch {
-      throw new VibeError13({
+      throw new VibeError15({
         code: "VIBE_ADAPTER",
         message: "EXPLAIN returned malformed JSON",
         meta: { reason: "malformed-plan-json", mode }
@@ -6787,7 +6921,7 @@ function parsePostgresPlan(params) {
 var WRITE_LEADERS = ["INSERT", "UPDATE", "DELETE", "MERGE", "TRUNCATE", "CREATE", "DROP", "ALTER", "GRANT", "REVOKE", "COPY", "CALL", "DO"];
 var SIDE_EFFECT_CALLS = /\bpg_(?:try_)?advisory_(?:xact_)?lock(?:_shared)?\s*\(/i;
 function refuse(params) {
-  return new VibeError13({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta ?? {} });
+  return new VibeError15({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta ?? {} });
 }
 function executableReadRefusal(params) {
   const normalized = normalizeSql({ text: params.text });
@@ -6917,7 +7051,7 @@ async function explainOnSession(params) {
   const context = await readPlanContext({ executor, dialect, rlsContextKeys: contextKeys });
   if (!context.representative) {
     if (params.requireRepresentativeContext === true) {
-      throw new VibeError13({
+      throw new VibeError15({
         code: "VIBE_RLS_CONTEXT",
         message: `refusing to report a plan taken under a non-representative identity: ${context.reason ?? "role bypasses row policies"}`,
         meta: { currentUser: context.currentUser, bypassRls: context.bypassRls, superuser: context.superuser }
@@ -6960,7 +7094,9 @@ async function explainOperation(params) {
   const { schema, model, method, args } = params;
   const dialect = requirePostgres({ dialect: params.dialect });
   const mode = params.mode ?? "estimate";
-  const meta = buildRuntimeMeta({ schema });
+  const baseMeta = buildRuntimeMeta({ schema });
+  const operatorMap = buildExtensionOperatorMap({ instances: params.extensions ?? [], dialect: params.dialect, provider: schema.datasource.provider });
+  const meta = operatorMap === null ? baseMeta : { ...baseMeta, extensionOperators: operatorMap };
   const plan = buildQuery({
     meta,
     dialect,
@@ -6991,18 +7127,19 @@ async function explainOperation(params) {
   });
 }
 // packages/runtime/src/diagnostics/statement-diagnostics.ts
-import { VibeError as VibeError14 } from "@vibeorm/schema";
+import { VibeError as VibeError16 } from "@vibeorm/schema";
 import { renderPostgresWorkload as renderPostgresWorkload2 } from "@vibeorm/sql";
 var STATEMENT_DIAGNOSTICS_DEFAULTS = Object.freeze({
   slowerThanMs: 0,
   explain: "off",
   explainTimeoutMs: 5000,
+  maxOutstandingExplains: 4,
   analyzeWarnBelowMs: 1,
   envVariable: "VIBEORM_DIAGNOSTICS"
 });
 var EXPLAIN_MODES = ["off", "estimate", "analyze"];
 function configError(params) {
-  return new VibeError14({ code: "VIBE_CONFIG", message: params.message, meta: params.meta ?? {} });
+  return new VibeError16({ code: "VIBE_CONFIG", message: params.message, meta: params.meta ?? {} });
 }
 function isExplainMode(value) {
   return typeof value === "string" && EXPLAIN_MODES.includes(value);
@@ -7128,7 +7265,7 @@ function summarizePlan(params) {
   };
 }
 function errorCode(error) {
-  return error instanceof VibeError14 ? error.code : "VIBE_INTERNAL";
+  return error instanceof VibeError16 ? error.code : "VIBE_INTERNAL";
 }
 function createStatementDiagnostics(params) {
   const { config, adapter, dialect } = params;
@@ -7215,6 +7352,10 @@ function createStatementDiagnostics(params) {
         report({ ...base, explainSkipped: "not-a-read" });
         return;
       }
+      if (outstanding.size >= STATEMENT_DIAGNOSTICS_DEFAULTS.maxOutstandingExplains) {
+        report({ ...base, explainSkipped: "overload" });
+        return;
+      }
       schedule(statement, config.explain, base);
     },
     flush: async () => {
@@ -7346,7 +7487,7 @@ async function readWorkloadStatistics(params) {
   };
 }
 // packages/runtime/src/diagnostics/insight.ts
-import { VibeError as VibeError15 } from "@vibeorm/schema";
+import { VibeError as VibeError17 } from "@vibeorm/schema";
 var DIAGNOSTIC_THRESHOLDS = Object.freeze({
   repeatThreshold: 5,
   minRepeatThreshold: 2,
@@ -7364,7 +7505,7 @@ function bounded(params) {
   if (value === undefined)
     return fallback;
   if (!Number.isInteger(value) || value < min || value > max) {
-    throw new VibeError15({
+    throw new VibeError17({
       code: "VIBE_CONFIG",
       message: `${name} must be an integer between ${min} and ${max}, got ${String(value)}`,
       meta: { [name]: value }
@@ -7587,11 +7728,11 @@ function recommendFromPlan(params) {
   return findings.slice(0, maxFindings);
 }
 // packages/runtime/src/relation-loader.ts
-import { VibeError as VibeError17 } from "@vibeorm/schema";
+import { VibeError as VibeError19 } from "@vibeorm/schema";
 import { renderStatement as renderStatement3 } from "@vibeorm/sql";
 
 // packages/runtime/src/computed.ts
-import { VibeError as VibeError16 } from "@vibeorm/schema";
+import { VibeError as VibeError18 } from "@vibeorm/schema";
 function sameNeeds(a, b) {
   if (a.length !== b.length)
     return false;
@@ -7627,7 +7768,7 @@ function assertComputedManifest(params) {
     problems.push(`"${key}" is configured but missing from the generated client`);
   }
   if (problems.length > 0) {
-    throw new VibeError16({
+    throw new VibeError18({
       code: "VIBE_STALE_CLIENT",
       message: `computed-field config changed since generate; run vibeorm generate \u2014 ${problems.join("; ")}`,
       meta: { problems }
@@ -7655,7 +7796,7 @@ function resolveRelationConcurrency(params) {
   if (concurrency === undefined)
     return 1;
   if (!Number.isInteger(concurrency) || concurrency < 1) {
-    throw new VibeError17({
+    throw new VibeError19({
       code: "VIBE_CONFIG",
       message: `relationLoading.concurrency must be a positive integer \u2014 got ${String(concurrency)}`,
       meta: { concurrency }
@@ -7840,7 +7981,7 @@ function chunkKeys(params) {
     const rendered = renderStatement3({ dialect: ctx.dialect, statement: build(keys.slice(0, 1)) });
     fixed = rendered.values.length - (expands ? arity : 1);
     if (fixed + arity > budget) {
-      throw new VibeError17({
+      throw new VibeError19({
         code: "VIBE_UNSUPPORTED_CAPABILITY",
         message: `relation "${relation}" needs ${fixed + arity} bound parameters for its own predicate, more than ${ctx.dialect.name}'s ${budget}-parameter statement budget \u2014 narrow the nested filter`,
         meta: { relation, dialect: ctx.dialect.name, required: fixed + arity, budget }
@@ -7970,7 +8111,7 @@ async function loadManyToMany(params) {
   const link = node.link;
   const join = link.join;
   if (join === null) {
-    throw new VibeError17({
+    throw new VibeError19({
       code: "VIBE_INTERNAL",
       message: `manyToMany relation "${node.name}" resolved without join-table wiring`
     });
@@ -8267,7 +8408,7 @@ async function attachLateralRelations(params) {
         try {
           parsed2 = JSON.parse(raw);
         } catch (cause) {
-          throw new VibeError17({
+          throw new VibeError19({
             code: "VIBE_INTERNAL",
             message: `relation column "${column}" returned text that is not valid JSON`,
             meta: { relation: node.name },
@@ -8277,7 +8418,7 @@ async function attachLateralRelations(params) {
       }
       if (isList) {
         if (!Array.isArray(parsed2)) {
-          throw new VibeError17({ code: "VIBE_INTERNAL", message: "to-many relation payload must be an array", meta: { relation: node.name } });
+          throw new VibeError19({ code: "VIBE_INTERNAL", message: "to-many relation payload must be an array", meta: { relation: node.name } });
         }
         const children = parsed2.map(decodePosition);
         for (const child of children) {
@@ -8318,7 +8459,7 @@ async function attachLateralRelations(params) {
       const raw = row[column];
       const count = typeof raw === "number" || typeof raw === "bigint" || typeof raw === "string" && /^\d+$/.test(raw) ? Number(raw) : NaN;
       if (!Number.isSafeInteger(count) || count < 0) {
-        throw new VibeError17({ code: "VIBE_INTERNAL", message: "relation count payload must be a non-negative safe integer", meta: { relation: selection.counts[index]?.name } });
+        throw new VibeError19({ code: "VIBE_INTERNAL", message: "relation count payload must be a non-negative safe integer", meta: { relation: selection.counts[index]?.name } });
       }
       counts[selection.counts[index].name] = count;
       delete row[column];
@@ -8326,97 +8467,12 @@ async function attachLateralRelations(params) {
     row._count = counts;
   }
 }
-// packages/runtime/src/extensions.ts
-import { VibeError as VibeError18, extensionManifestEntry } from "@vibeorm/schema";
-function assertExtensionManifest(params) {
-  const { manifest } = params;
-  const instances = params.instances ?? [];
-  const live = new Map(instances.map((extension) => [extension.name, extensionManifestEntry({ extension })]));
-  const problems = [];
-  for (const baked of manifest) {
-    const current = live.get(baked.name);
-    if (current === undefined) {
-      problems.push(`"${baked.name}" was baked into the client but not passed to VibeClient`);
-      continue;
-    }
-    if (current.version !== baked.version) {
-      problems.push(`"${baked.name}" version changed (generated ${baked.version}, live ${current.version})`);
-    } else if (current.optionsHash !== baked.optionsHash) {
-      problems.push(`"${baked.name}" options changed since generate`);
-    }
-    live.delete(baked.name);
-  }
-  for (const name of live.keys()) {
-    problems.push(`"${name}" is configured but missing from the generated client`);
-  }
-  if (problems.length > 0) {
-    throw new VibeError18({
-      code: "VIBE_STALE_CLIENT",
-      message: `extension list changed since generate; run vibeorm generate \u2014 ${problems.join("; ")}`,
-      meta: { manifest, problems }
-    });
-  }
-}
-function buildExtensionOperatorMap(params) {
-  const { instances, dialect, provider } = params;
-  const map = new Map;
-  const owner = new Map;
-  for (const extension of instances) {
-    for (const operator of extension.sql?.whereOperators ?? []) {
-      const existing = owner.get(operator.name);
-      if (existing !== undefined) {
-        throw new VibeError18({
-          code: "VIBE_CONFIG",
-          message: `where operator "${operator.name}" is claimed by both "${existing}" and "${extension.name}"`,
-          meta: { operator: operator.name }
-        });
-      }
-      owner.set(operator.name, extension.name);
-      map.set(operator.name, ({ column, operand, model, field }) => {
-        const compiled = operator.compile({
-          column,
-          operand,
-          dialect,
-          provider,
-          options: extension.options
-        });
-        if ("error" in compiled) {
-          throw new VibeError18({
-            code: "VIBE_VALIDATION",
-            message: `"${operator.name}" on ${model}.${field}: ${compiled.error}`,
-            meta: { model, field, operator: operator.name, extension: extension.name }
-          });
-        }
-        return { kind: "fragment", fragment: compiled.fragment };
-      });
-    }
-  }
-  return map.size === 0 ? null : map;
-}
-function buildConnectHooks(params) {
-  const { instances, dialect, provider } = params;
-  const hooks = [];
-  for (const extension of instances) {
-    const onConnect = extension.runtime?.onConnect;
-    if (onConnect === undefined)
-      continue;
-    hooks.push(({ execute }) => onConnect({
-      execute: (execParams) => execute({
-        text: execParams.text,
-        ...execParams.values === undefined ? {} : { values: execParams.values }
-      }),
-      dialect,
-      provider,
-      options: extension.options
-    }));
-  }
-  return hooks;
-}
 // packages/runtime/src/views.ts
-import { VibeError as VibeError20 } from "@vibeorm/schema";
+import { VibeError as VibeError21 } from "@vibeorm/schema";
 
 // packages/runtime/src/sql-access.ts
-import { VibeError as VibeError19 } from "@vibeorm/schema";
+import { Buffer as Buffer2 } from "buffer";
+import { VibeError as VibeError20 } from "@vibeorm/schema";
 import { isSqlFragment as isSqlFragment2 } from "@vibeorm/sql";
 function containsSqlFragment(value, seen = new Set) {
   if (isSqlFragment2(value))
@@ -8424,42 +8480,92 @@ function containsSqlFragment(value, seen = new Set) {
   if (typeof value !== "object" || value === null || seen.has(value))
     return false;
   seen.add(value);
-  if (Array.isArray(value))
-    return value.some((entry) => containsSqlFragment(entry, seen));
-  return Object.values(value).some((entry) => containsSqlFragment(entry, seen));
+  const keys = new Set;
+  for (let object = value;object !== null && object !== Object.prototype; object = Object.getPrototypeOf(object)) {
+    for (const key of Object.getOwnPropertyNames(object)) {
+      if (keys.has(key) || key === "constructor")
+        continue;
+      keys.add(key);
+      const descriptor = Object.getOwnPropertyDescriptor(object, key);
+      if (descriptor === undefined)
+        continue;
+      const child = "value" in descriptor ? descriptor.value : object === value && descriptor.enumerable ? value[key] : undefined;
+      if (containsSqlFragment(child, seen))
+        return true;
+    }
+  }
+  return false;
 }
 function restrictedSqlArgs(params) {
+  const refuse2 = () => params.refusal?.() ?? new VibeError20({ code: "VIBE_VALIDATION", message: `SQL fragments are unavailable through ${params.path}; use the unrestricted client`, meta: { path: params.path } });
+  if (containsSqlFragment(params.value))
+    throw refuse2();
   const seen = new Map;
   const copy = (value) => {
     if (isSqlFragment2(value))
-      throw new VibeError19({ code: "VIBE_VALIDATION", message: `SQL fragments are unavailable through ${params.path}; use the unrestricted client`, meta: { path: params.path } });
+      throw refuse2();
     if (typeof value !== "object" || value === null)
       return value;
     if (seen.has(value))
       return seen.get(value);
+    let out;
     if (Array.isArray(value)) {
-      const out2 = [];
-      seen.set(value, out2);
+      const array = [];
+      out = array;
+      seen.set(value, out);
       for (const item of value)
-        out2.push(copy(item));
-      return out2;
+        array.push(copy(item));
+    } else if (value instanceof Date) {
+      out = new Date(value.getTime());
+    } else if (value instanceof Uint8Array) {
+      out = Buffer2.isBuffer(value) ? Buffer2.from(value) : new Uint8Array(value);
+    } else {
+      const record = Object.create(null);
+      out = record;
+      seen.set(value, out);
+      for (const [key, child] of Object.entries(value)) {
+        if (key !== "toJSON" || typeof child !== "function")
+          record[key] = copy(child);
+      }
     }
-    if (value instanceof Date)
-      return new Date(value.getTime());
-    if (value instanceof Uint8Array)
-      return new Uint8Array(value);
-    const out = Object.create(null);
     seen.set(value, out);
-    for (const [key, child] of Object.entries(value))
-      out[key] = copy(child);
+    const toJSON = value.toJSON;
+    const nativeJson = value instanceof Date && toJSON === Date.prototype.toJSON || Buffer2.isBuffer(value) && toJSON === Buffer2.prototype.toJSON;
+    if (typeof toJSON === "function" && !nativeJson) {
+      Object.defineProperty(out, "toJSON", { enumerable: false, value: (key) => {
+        const result = toJSON.call(value, key);
+        return result === value ? out : restrictedSqlArgs({ ...params, value: result });
+      } });
+    }
     return out;
   };
   return copy(params.value);
 }
+var conflictSchemas = new WeakMap;
+function registerRestrictedSqlSchema(params) {
+  conflictSchemas.set(params.meta, new Map(params.schema.models.map((model) => [
+    model.name,
+    model.indexes.flatMap((index) => index.kind === "unique" && index.where !== undefined ? [{ fields: index.fields.map((field) => field.name), where: index.where }] : [])
+  ])));
+}
+function restrictConflictPredicates(params) {
+  for (const key of ["onConflict", "skipDuplicates"]) {
+    const option = params.args[key];
+    if (typeof option !== "object" || option === null)
+      continue;
+    const spec = option;
+    if (spec.where === undefined)
+      continue;
+    const target = spec.target;
+    const declared = conflictSchemas.get(params.meta)?.get(params.model.name)?.some((index) => typeof spec.where === "string" && index.where === spec.where && Array.isArray(target) && target.length === index.fields.length && index.fields.every((field, position) => field === target[position]));
+    if (declared !== true)
+      throw new VibeError20({ code: "VIBE_VALIDATION", message: `${params.path}: ${key}.where must match a declared unique index and its target fields; free-form SQL requires the unrestricted client`, meta: { model: params.model.name, path: params.path } });
+  }
+}
 
 // packages/runtime/src/views.ts
 function validationError6(params) {
-  return new VibeError20({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
+  return new VibeError21({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
 }
 
 class ViewResult {
@@ -8813,7 +8919,7 @@ function createView(params) {
   for (const [clientName, mask] of resolved) {
     const delegate = models[clientName];
     if (delegate === undefined) {
-      throw new VibeError20({
+      throw new VibeError21({
         code: "VIBE_INTERNAL",
         message: `view "${name}": no delegate for model "${mask.model.name}"`,
         meta: { view: name, model: mask.model.name }
@@ -8829,9 +8935,9 @@ function attachDefineView(params) {
   Object.defineProperty(client, "$defineView", { value, enumerable: true });
 }
 // packages/runtime/src/validators.ts
-import { VibeError as VibeError21 } from "@vibeorm/schema";
+import { VibeError as VibeError22 } from "@vibeorm/schema";
 function validationFailed(params) {
-  return new VibeError21({
+  return new VibeError22({
     code: "VIBE_VALIDATION",
     message: `validation failed for ${params.model}.${params.field}: ${params.issues[0]?.message ?? "invalid value"}`,
     meta: { model: params.model, field: params.field, issues: params.issues }
@@ -8840,7 +8946,7 @@ function validationFailed(params) {
 function validateValue(params) {
   const result = params.schema["~standard"].validate(params.value);
   if (result instanceof Promise) {
-    throw new VibeError21({
+    throw new VibeError22({
       code: "VIBE_VALIDATION",
       message: `async validator on ${params.model}.${params.field} \u2014 write validators must be synchronous (validate before calling the client for async rules)`,
       meta: { model: params.model, field: params.field }
@@ -8963,7 +9069,29 @@ function deferPolicyOperation(params) {
 }
 
 // packages/runtime/src/policy.ts
-import { VibeError as VibeError22 } from "@vibeorm/schema";
+import { VibeError as VibeError24 } from "@vibeorm/schema";
+
+// packages/runtime/src/module-context.ts
+import { VibeError as VibeError23 } from "@vibeorm/schema";
+var binders = new WeakMap;
+function registerModuleBinder(params) {
+  binders.set(params.client, params.bind);
+}
+function inheritReadOnlyModuleBinder(params) {
+  const bind = binders.get(params.from);
+  if (bind !== undefined)
+    binders.set(params.to, (artifact) => bind(artifact).$readOnly());
+}
+function bindModuleContext(params) {
+  const bind = binders.get(params.db);
+  if (bind === undefined)
+    throw new VibeError23({
+      code: "VIBE_CONFIG",
+      message: `Module ${params.artifact.manifest.id} needs an unrestricted handle from the same VibeORM runtime installation; scoped and foreign handles cannot attach package models`,
+      meta: { reason: "module_handle", moduleId: params.artifact.manifest.id, protocol: params.artifact.manifest.protocol }
+    });
+  return bind(params.artifact);
+}
 
 // packages/runtime/src/read-only.ts
 import { ReadOnlyClientError } from "@vibeorm/schema";
@@ -9050,7 +9178,7 @@ function classifiedMount(params) {
     return typeof value === "function" ? (...args) => {
       if (containsSqlFragment(args))
         return Promise.reject(readOnlyRefusal({ path: "extension", reason: "raw" }));
-      return value(...restrictedSqlArgs({ value: args, path: "$readOnly extension" }));
+      return value(...restrictedSqlArgs({ value: args, path: "$readOnly extension", refusal: () => readOnlyRefusal({ path: "extension", reason: "raw" }) }));
     } : undefined;
   if (typeof value !== "object" || value === null)
     return;
@@ -9062,7 +9190,7 @@ function classifiedMount(params) {
       namespace[member] = (...args) => {
         if (containsSqlFragment(args))
           return Promise.reject(readOnlyRefusal({ path: member, reason: "raw" }));
-        return fn(...restrictedSqlArgs({ value: args, path: "$readOnly extension" }));
+        return fn(...restrictedSqlArgs({ value: args, path: "$readOnly extension", refusal: () => readOnlyRefusal({ path: member, reason: "raw" }) }));
       };
   }
   return Object.freeze(namespace);
@@ -9077,7 +9205,7 @@ function readOnlyDelegate(params) {
       delegate[method] = (...args) => {
         if (containsSqlFragment(args))
           return Promise.reject(readOnlyRefusal({ path: `${model.clientName}.${method}`, reason: "raw" }));
-        const operation = fn(...args);
+        const operation = fn(...restrictedSqlArgs({ value: args, path: "$readOnly", refusal: () => readOnlyRefusal({ path: `${model.clientName}.${method}`, reason: "raw" }) }));
         params.operations.restrictSql?.({ value: operation });
         return operation;
       };
@@ -9196,6 +9324,7 @@ function readOnlyOver(params) {
   if (existing !== undefined)
     return existing;
   const built = buildReadOnly(params);
+  inheritReadOnlyModuleBinder({ from: params.client, to: built });
   facades.set(params.client, built);
   return built;
 }
@@ -9226,7 +9355,7 @@ function inheritReadOnly(params) {
 
 // packages/runtime/src/policy.ts
 function policyError(message, meta) {
-  return new VibeError22({ code: "VIBE_VALIDATION", message, meta: meta ?? {} });
+  return new VibeError24({ code: "VIBE_VALIDATION", message, meta: meta ?? {} });
 }
 function policiedModels(meta) {
   return meta.models.filter((model) => model.policy !== undefined);
@@ -9551,7 +9680,11 @@ function scopedDelegate(params) {
     const flat = uniqueToFilter({ model, where: scoped.where ?? {} });
     return { ...scoped, where: mergeWhere({ where: flat, field: policy.field, value }) };
   };
-  const scopeWrite = (args) => scopeSelection({ meta, model, args, context });
+  const scopeWrite = (input) => {
+    const args = restrictedSqlArgs({ value: input, path: "$withPolicy" });
+    restrictConflictPredicates({ meta, model, args, path: "$withPolicy" });
+    return scopeSelection({ meta, model, args, context });
+  };
   const writeData = (data, phase) => forceWriteData({ meta, model, data: data ?? {}, context, phase });
   const pkClientKey = () => {
     for (const [key, group] of model.compoundUniques) {
@@ -9572,7 +9705,7 @@ function scopedDelegate(params) {
     const pkWhere = pk.length === 1 ? { [pk[0]]: target[pk[0]] } : { [pkClientKey()]: Object.fromEntries(pk.map((name) => [name, target[name]])) };
     return write(raw, pkWhere);
   };
-  const notFound2 = (method) => new VibeError22({ code: "VIBE_NOT_FOUND", message: `${method} on ${model.name}: no row matches the unique where inside the bound policy context`, meta: { model: model.name, method } });
+  const notFound2 = (method) => new VibeError24({ code: "VIBE_NOT_FOUND", message: `${method} on ${model.name}: no row matches the unique where inside the bound policy context`, meta: { model: model.name, method } });
   return {
     findMany: (args) => base.findMany(scopeFind(args)),
     findFirst: (args) => base.findFirst(scopeFind(args)),
@@ -9581,7 +9714,7 @@ function scopedDelegate(params) {
     findUniqueOrThrow: (args) => base.findFirstOrThrow(scopeUnique(args)),
     create: (args) => deferred(() => base.create({ ...scopeWrite(args), data: writeData(args.data, "create") })),
     createMany: (args) => deferred(() => base.createMany({
-      ...args,
+      ...scopeWrite(args),
       data: (args.data ?? []).map((row) => writeData(row, "create"))
     })),
     createManyAndReturn: (args) => deferred(() => base.createManyAndReturn({
@@ -9606,7 +9739,7 @@ function scopedDelegate(params) {
       })
     })),
     upsertMany: () => {
-      throw new VibeError22({
+      throw new VibeError24({
         code: "VIBE_UNSUPPORTED_CAPABILITY",
         message: "upsertMany is not available on a policy-bound client: its conflict target is not policy-checked yet",
         meta: { model: model.name }
@@ -9615,7 +9748,7 @@ function scopedDelegate(params) {
     updateManyAndReturn: (args) => deferred(() => {
       const run = base.updateManyAndReturn;
       if (run === undefined) {
-        throw new VibeError22({
+        throw new VibeError24({
           code: "VIBE_UNSUPPORTED_CAPABILITY",
           message: "updateManyAndReturn is not available on this delegate",
           meta: { model: model.name }
@@ -9664,7 +9797,10 @@ function scopedDelegate(params) {
 function globalDelegate(params) {
   const { meta, model, base, context } = params;
   const readArgs = (args) => scopeArgs({ meta, model, args: args ?? {}, context });
-  const sel = (args) => {
+  const sel = (input) => {
+    const args = params.policyBound === false ? input : restrictedSqlArgs({ value: input, path: "$withPolicy" });
+    if (params.policyBound !== false)
+      restrictConflictPredicates({ meta, model, args, path: "$withPolicy" });
     const scoped = scopeSelection({ meta, model, args, context });
     return scoped.where === undefined ? scoped : { ...scoped, where: scopeWhere({ meta, model, where: scoped.where, context }) };
   };
@@ -9679,14 +9815,14 @@ function globalDelegate(params) {
     aggregate: (args) => base.aggregate(readArgs(args)),
     groupBy: (args) => base.groupBy(readArgs(args)),
     create: (args) => deferred(() => base.create({ ...sel(args), data: payload(args.data, "create") })),
-    createMany: (args) => deferred(() => base.createMany({ ...args, data: (args.data ?? []).map((r) => payload(r, "create")) })),
+    createMany: (args) => deferred(() => base.createMany({ ...sel(args), data: (args.data ?? []).map((r) => payload(r, "create")) })),
     createManyAndReturn: (args) => deferred(() => base.createManyAndReturn({ ...sel(args), data: (args.data ?? []).map((r) => payload(r, "create")) })),
     update: (args) => deferred(() => base.update({ ...sel(args), data: payload(args.data, "update") })),
     updateMany: (args) => deferred(() => base.updateMany({ ...sel(args), data: payload(args.data, "update") })),
     updateManyAndReturn: (args) => deferred(() => {
       const run = base.updateManyAndReturn;
       if (run === undefined) {
-        throw new VibeError22({
+        throw new VibeError24({
           code: "VIBE_UNSUPPORTED_CAPABILITY",
           message: "updateManyAndReturn is not available on this delegate"
         });
@@ -9697,7 +9833,7 @@ function globalDelegate(params) {
     upsertMany: (args) => deferred(() => {
       if (params.policyBound === false)
         return base.upsertMany(args);
-      throw new VibeError22({
+      throw new VibeError24({
         code: "VIBE_UNSUPPORTED_CAPABILITY",
         message: "upsertMany is not available on a policy-bound client: its conflict target is not policy-checked yet"
       });
@@ -9764,13 +9900,26 @@ function attachPolicy(params) {
       });
     }
   }
-  const buildScoped = (context) => {
-    for (const model of policied) {
-      const key = model.policy?.context;
-      if (context[key] === undefined || context[key] === null) {
-        throw policyError(`$withPolicy: missing context value "${key}" (required by ${model.name})`, { context: key });
-      }
+  const buildScoped = (input) => {
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+      throw policyError("$withPolicy: context must contain own scalar identity values");
     }
+    const snapshot = Object.create(null);
+    for (const model of policied) {
+      const policy = model.policy;
+      const key = policy.context;
+      const descriptor = Object.getOwnPropertyDescriptor(Object.hasOwn(snapshot, key) ? snapshot : input, key);
+      if (descriptor === undefined || !("value" in descriptor) || descriptor.value === undefined || descriptor.value === null) {
+        throw policyError(`$withPolicy: missing context value "${key}" (required as an own data property by ${model.name})`, { context: key });
+      }
+      const value = descriptor.value;
+      const field = model.fieldByName.get(policy.field);
+      const valid = field !== undefined && !field.isList && (field.scalarType === "String" ? typeof value === "string" : field.scalarType === "Int" ? typeof value === "number" && Number.isSafeInteger(value) : field.scalarType === "BigInt" ? typeof value === "bigint" : field.scalarType === "Float" || field.scalarType === "Decimal" ? typeof value === "number" && Number.isFinite(value) : field.enumName !== null && typeof value === "string" && meta.enums.get(field.enumName)?.includes(value) === true);
+      if (!valid)
+        throw policyError(`$withPolicy: context "${key}" must match the scalar type of ${model.name}.${policy.field}`, { context: key, model: model.name, field: policy.field });
+      snapshot[key] = value;
+    }
+    const context = Object.freeze(snapshot);
     const scoped = Object.create(client);
     const scopedModels = { ...client.$models };
     for (const model of meta.models) {
@@ -9855,7 +10004,7 @@ function attachPolicy(params) {
   });
 }
 // packages/runtime/src/scoped.ts
-import { ScopedQueryError, VibeError as VibeError23 } from "@vibeorm/schema";
+import { ScopedQueryError, VibeError as VibeError25 } from "@vibeorm/schema";
 function refusal(params) {
   return new ScopedQueryError(params);
 }
@@ -10588,6 +10737,7 @@ function rewriteScopedCall(params) {
   const scoped = entry.kind !== "none";
   const root = `${model.clientName}.${method}`;
   const args = restrictedSqlArgs({ value: params.args ?? {}, path: "$scoped" });
+  restrictConflictPredicates({ meta, model, args, path: "$scoped" });
   const ownPred = () => requirePred({ ctx, model, path: root });
   const walkOwnWhere = (where, path) => isPlainObject8(where) ? walkWhere({ ctx, model, where, path }) : where;
   if (FIND_LIKE.includes(method)) {
@@ -10810,7 +10960,7 @@ function attachScoped(params) {
   Object.defineProperty(client, "$scoped", {
     value: (config) => {
       if (!isPlainObject8(config) || !isPlainObject8(config.models)) {
-        throw new VibeError23({
+        throw new VibeError25({
           code: "VIBE_VALIDATION",
           message: "$scoped takes { scope: string | number | bigint | null, models: { <Model>: \u2026 } }"
         });
@@ -10826,7 +10976,7 @@ function attachScoped(params) {
       }
       const scope = config.scope;
       if (scope !== null && typeof scope !== "string" && typeof scope !== "number" && typeof scope !== "bigint") {
-        throw new VibeError23({
+        throw new VibeError25({
           code: "VIBE_VALIDATION",
           message: `$scoped: scope must be a string, number, bigint or null \u2014 got ${typeof scope}`
         });
@@ -10842,7 +10992,7 @@ function attachScoped(params) {
   });
 }
 // packages/runtime/src/rls-readiness.ts
-import { VibeError as VibeError24, assertValidSchemaIR, unsupportedCapability as unsupportedCapability7 } from "@vibeorm/schema";
+import { VibeError as VibeError26, assertValidSchemaIR, unsupportedCapability as unsupportedCapability7 } from "@vibeorm/schema";
 import { NATIVE_RLS as NATIVE_RLS2, getSqlDialect as getSqlDialect4, renderRlsPolicy, renderRlsRole, NATIVE_RLS_PROBE_POLICY, renderRlsReadinessQuery, renderRlsProbeTable } from "@vibeorm/sql";
 import { RLS_READINESS_SQL, NATIVE_RLS_PROBE_POLICY as NATIVE_RLS_PROBE_POLICY2 } from "@vibeorm/sql";
 function textOf(params) {
@@ -10866,7 +11016,7 @@ function intOf(params) {
   return Number.parseInt(value, 10);
 }
 function unreadableCatalog(params) {
-  return new VibeError24({
+  return new VibeError26({
     code: "VIBE_ADAPTER",
     message: `native RLS readiness could not read the "${params.key}" result of the folded catalog read: ${params.detail}. ` + "The inspection is refused rather than treated as an empty result set.",
     meta: { result: params.key }
@@ -10925,7 +11075,7 @@ function requireNativeRls(params) {
     throw unsupportedCapability7({ dialect: dialect.name, feature: "nativeRowLevelSecurity" });
   }
   if (params.schema.rls === undefined) {
-    throw new VibeError24({
+    throw new VibeError26({
       code: "VIBE_CONFIG",
       message: "Native row-level security readiness requires a schema that declares native RLS"
     });
@@ -11338,7 +11488,7 @@ async function inspectNativeRls(params) {
 function requireEmbeddedRole(params) {
   const { role } = params;
   if (typeof role !== "string" || role.length === 0 || role.includes("\x00")) {
-    throw new VibeError24({
+    throw new VibeError26({
       code: "VIBE_CONFIG",
       message: "PGlite native row-level security requires a pre-existing restricted runtime role (nativeRls.runtimeRole) \u2014 its default embedded session is privileged and bypasses every policy",
       meta: { provider: "pglite" }
@@ -11350,7 +11500,7 @@ function assertNativeRlsReady(params) {
   const { report } = params;
   if (report.ready)
     return;
-  throw new VibeError24({
+  throw new VibeError26({
     code: "VIBE_CONFIG",
     message: `Native row-level security is not ready on this database: ${report.problems.map((problem) => `${problem.name} (${problem.status})`).join(", ")}`,
     meta: {
@@ -11374,9 +11524,13 @@ function formatNativeRlsReport(params) {
   }
   return lines;
 }
+// packages/runtime/src/database-module.ts
+import { createHash } from "crypto";
+import { VibeError as VibeError31, assertValidSchemaIR as assertValidSchemaIR3, providerToDialect } from "@vibeorm/schema";
+
 // packages/runtime/src/client.ts
 import { compileSql } from "@vibeorm/sql";
-import { RlsContextError as RlsContextError2, VibeError as VibeError28, assertValidSchemaIR as assertValidSchemaIR2, unsupportedCapability as unsupportedCapability8 } from "@vibeorm/schema";
+import { RlsContextError as RlsContextError2, VibeError as VibeError30, assertValidSchemaIR as assertValidSchemaIR2, unsupportedCapability as unsupportedCapability8 } from "@vibeorm/schema";
 import { ADVISORY_LOCK_RESULT_COLUMN, ParamCollector, getSqlDialect as getSqlDialect5, renderRlsContext, renderRlsPolicy as renderRlsPolicy2, renderRlsRole as renderRlsRole2, renderStatement as renderStatement5 } from "@vibeorm/sql";
 
 // packages/runtime/src/render-cache.ts
@@ -11887,11 +12041,11 @@ function renderStatementCached(params) {
 }
 
 // packages/runtime/src/strict-args.ts
-import { VibeError as VibeError25 } from "@vibeorm/schema";
+import { VibeError as VibeError27 } from "@vibeorm/schema";
 var SKIP = Symbol.for("vibeorm.skip");
 function explicitUndefined(params) {
   const { model, method, path } = params;
-  return new VibeError25({
+  return new VibeError27({
     code: "VIBE_VALIDATION",
     message: `${model}.${method}(): explicit undefined at ${path} \u2014 an undefined value is refused ` + `because it would silently drop the property (widening a filter or losing a write). ` + `Omit the property, or pass SKIP to omit it deliberately; ` + `VibeClient({ strictArguments: false }) restores the legacy behaviour.`,
     meta: { model, method, path }
@@ -12068,10 +12222,10 @@ function bindRlsContext(params) {
 }
 
 // packages/runtime/src/telemetry/recorder.ts
-import { VibeError as VibeError27 } from "@vibeorm/schema";
+import { VibeError as VibeError29 } from "@vibeorm/schema";
 
 // packages/runtime/src/telemetry/config.ts
-import { VibeError as VibeError26 } from "@vibeorm/schema";
+import { VibeError as VibeError28 } from "@vibeorm/schema";
 var TELEMETRY_DEFAULTS = Object.freeze({
   captureSql: false,
   captureParameterValues: false,
@@ -12086,7 +12240,7 @@ var TELEMETRY_DEFAULTS = Object.freeze({
   latencyBucketsMs: Object.freeze([1, 5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000])
 });
 function configError2(params) {
-  return new VibeError26({
+  return new VibeError28({
     code: "VIBE_CONFIG",
     message: `telemetry: ${params.message}`,
     ...params.meta === undefined ? {} : { meta: params.meta }
@@ -12174,7 +12328,7 @@ function deriveStage(params) {
   return "decode";
 }
 function errorCodeOf(error) {
-  return error instanceof VibeError27 ? error.code : undefined;
+  return error instanceof VibeError29 ? error.code : undefined;
 }
 function newHistogram(bounds) {
   return { counts: new Array(bounds.length + 1).fill(0), sum: 0, count: 0 };
@@ -12557,7 +12711,7 @@ async function instrumentStatement(params) {
 // packages/runtime/src/client.ts
 function notFound2(params) {
   const { model, method } = params;
-  return new VibeError28({
+  return new VibeError30({
     code: "VIBE_NOT_FOUND",
     message: `no ${model} record matched the where clause of ${method}()`,
     meta: { model, method }
@@ -12565,7 +12719,7 @@ function notFound2(params) {
 }
 function transactionLifecycleRefusal(params) {
   const { method } = params;
-  return new VibeError28({
+  return new VibeError30({
     code: "VIBE_VALIDATION",
     message: `${method}() is not available on a transaction client \u2014 the connection is owned by the open transaction; call it on the client that started the transaction`,
     meta: { method, inTransaction: true }
@@ -12573,7 +12727,7 @@ function transactionLifecycleRefusal(params) {
 }
 function viewIsReadOnly(params) {
   const { model, method } = params;
-  return new VibeError28({
+  return new VibeError30({
     code: "VIBE_VALIDATION",
     message: `${model} is a view \u2014 ${method}() is not available on views (they are read-only); write to the underlying table instead`,
     meta: { model, method }
@@ -12656,6 +12810,7 @@ function assembleAggregates(params) {
   }
   return into;
 }
+var moduleMetadata = new WeakMap;
 function engineStateError(params) {
   const { engine } = params;
   for (let frame = engine.lifetime;frame !== undefined; frame = frame.parent) {
@@ -12679,7 +12834,7 @@ async function engineTransaction(params) {
     const support = engine.adapter.budgets?.transactionDeadline;
     const requested = options.deadline.enforcement ?? "between-statements";
     if (support === undefined || support === "unsupported" || requested === "cancel-running-statements" && support !== "cancel-running-statements") {
-      throw new VibeError28({
+      throw new VibeError30({
         code: "VIBE_UNSUPPORTED_CAPABILITY",
         message: "the adapter does not declare support for the requested transaction deadline",
         meta: { provider: engine.adapter.provider, feature: "transactionDeadline", requested, supported: support ?? "undeclared" }
@@ -12854,8 +13009,6 @@ class QueryPromise extends Promise {
     const state = engineStateError({ engine: this.#target });
     if (state !== undefined)
       return state;
-    if (engine.rlsSchema === undefined && this.#target.rlsSchema === undefined)
-      return;
     if (this.#target.rootIdentity !== engine.rootIdentity || this.#target.lifetime !== engine.lifetime || !sameRecord(this.#target.context?.settings ?? {}, engine.context?.settings ?? {}))
       return new RlsContextError2({ reason: "conflicting" });
     return;
@@ -12870,7 +13023,7 @@ class QueryPromise extends Promise {
   }
   #claim() {
     if (this.#started) {
-      throw new VibeError28({
+      throw new VibeError30({
         code: "VIBE_VALIDATION",
         message: "$transaction([...]) needs operations that have not dispatched \u2014 pass delegate calls in the same tick they are created (this one was awaited or created earlier and already executed outside the transaction)"
       });
@@ -12879,6 +13032,7 @@ class QueryPromise extends Promise {
     const scope = this.#scope;
     return {
       start: (target) => {
+        target = { ...target, meta: this.#target.meta, renderCache: this.#target.renderCache, options: this.#target.options };
         if (this.#target.readOnlySql === true)
           target = { ...target, readOnlySql: true };
         if (scope !== undefined && target.operation !== undefined) {
@@ -12983,19 +13137,18 @@ async function runAffected(params) {
 }
 var LOCKABLE_METHODS = Object.freeze(["findMany", "findFirst", "findUnique"]);
 function plan(params) {
-  const { engine, model, method, args } = params;
-  if (engine.readOnlySql === true && containsSqlFragment(args))
-    throw readOnlyRefusal({ path: `${model}.${method}`, reason: "raw" });
+  const { engine, model, method } = params;
+  const args = engine.readOnlySql === true ? restrictedSqlArgs({ value: params.args, path: "$readOnly", refusal: () => readOnlyRefusal({ path: `${model}.${method}`, reason: "raw" }) }) : params.args;
   if (args !== undefined && args["lock"] !== undefined) {
     if (engine.inTransaction !== true) {
-      throw new VibeError28({
+      throw new VibeError30({
         code: "VIBE_VALIDATION",
         message: `lock on ${model}.${method}() requires a transaction \u2014 call it on the client $transaction hands its callback (outside one, the lock would release at statement end)`,
         meta: { model, method }
       });
     }
     if (!LOCKABLE_METHODS.includes(method)) {
-      throw new VibeError28({
+      throw new VibeError30({
         code: "VIBE_VALIDATION",
         message: `lock on ${model}.${method}() is not supported \u2014 only ${LOCKABLE_METHODS.join(", ")} take a lock. ` + `Lock the rows with a find inside the transaction, then write them`,
         meta: { model, method }
@@ -13022,7 +13175,7 @@ function readAcquiredVerdict(params) {
     return true;
   if (value === false || value === 0 || value === "f" || value === "false" || value === "0")
     return false;
-  throw new VibeError28({
+  throw new VibeError30({
     code: "VIBE_INTERNAL",
     message: `internal: ${params.method}() expected a boolean "${ADVISORY_LOCK_RESULT_COLUMN}" column, got ${String(value)}`,
     meta: { method: params.method, value: String(value) }
@@ -13070,6 +13223,10 @@ async function insertedKeyWhere(params) {
       hint: "this model's key is assigned by the database and cannot be read back on this dialect"
     });
   }
+  const insertId = params.insertId;
+  if (typeof insertId === "number" && Number.isSafeInteger(insertId) || typeof insertId === "string" && /^-?\d+$/.test(insertId)) {
+    return { [keyField.name]: decodeValue({ dialect: engine.dialect.name, field: keyField, value: insertId }) };
+  }
   const result = await runStatement({
     engine,
     kind: "rows",
@@ -13082,7 +13239,7 @@ async function insertedKeyWhere(params) {
   });
   const id = result.rows[0]?.id;
   if (id === undefined || id === null) {
-    throw new VibeError28({
+    throw new VibeError30({
       code: "VIBE_INTERNAL",
       message: `could not read back the generated key for ${source.model.name}`,
       meta: { model: source.model.name }
@@ -13120,7 +13277,7 @@ async function runSingleMutation(params) {
         values: bindValues({ adapter: target.adapter, values: rendered.values })
       })
     });
-    return result.affectedRows;
+    return result;
   };
   if (readBeforeWrite) {
     const where = source.refetchWhere;
@@ -13131,7 +13288,7 @@ async function runSingleMutation(params) {
       const before = await refetch({ engine: txEngine, source, where, lock: true });
       if (before === null)
         throw notFound2({ model: source.model.name, method: source.method });
-      const affected = await executeWrite(txEngine);
+      const { affectedRows: affected } = await executeWrite(txEngine);
       if (affected === 0)
         throw notFound2({ model: source.model.name, method: source.method });
       return before;
@@ -13166,7 +13323,7 @@ async function runSingleMutation(params) {
     if (source.method === "update") {
       return await engine.adapter.transaction(async (txAdapter) => {
         const txEngine = { ...engine, adapter: txAdapter, inTransaction: true };
-        const affected2 = await executeWrite(txEngine);
+        const { affectedRows: affected2 } = await executeWrite(txEngine);
         if (affected2 === 0)
           throw notFound2({ model: source.model.name, method: source.method });
         const after2 = await refetch({ engine: txEngine, source, where: knownWhere });
@@ -13175,7 +13332,7 @@ async function runSingleMutation(params) {
         return after2;
       });
     }
-    const affected = await executeWrite(engine);
+    const { affectedRows: affected } = await executeWrite(engine);
     if (affected === 0 && params.allowZeroRows === true)
       return null;
     const after = await refetch({ engine, source, where: knownWhere });
@@ -13185,10 +13342,10 @@ async function runSingleMutation(params) {
   }
   return await engine.adapter.transaction(async (txAdapter) => {
     const txEngine = { ...engine, adapter: txAdapter, inTransaction: true };
-    const affected = await executeWrite(txEngine);
+    const { affectedRows: affected, insertId } = await executeWrite(txEngine);
     if (affected === 0 && params.allowZeroRows === true)
       return null;
-    const where = await insertedKeyWhere({ engine: txEngine, source });
+    const where = await insertedKeyWhere({ engine: txEngine, source, insertId });
     const after = await refetch({ engine: txEngine, source, where });
     if (after === null)
       throw notFound2({ model: source.model.name, method: source.method });
@@ -13410,7 +13567,7 @@ function createDelegate(params) {
     const skipping = args.onConflict !== undefined;
     if (hasNestedWrites({ model: modelMeta, data: args.data })) {
       if (skipping) {
-        throw new VibeError28({
+        throw new VibeError30({
           code: "VIBE_VALIDATION",
           message: `onConflict cannot combine with nested writes on ${modelMeta.name}.create() \u2014 insert the parent row alone, then connect relations`,
           meta: { model: modelMeta.name }
@@ -13511,7 +13668,7 @@ function createDelegate(params) {
   const upsert = async (target, args) => {
     const modelMeta = getModelMeta({ meta: target.meta, model });
     if (hasNestedWrites({ model: modelMeta, data: args.create }) || hasNestedWrites({ model: modelMeta, data: args.update })) {
-      throw new VibeError28({
+      throw new VibeError30({
         code: "VIBE_VALIDATION",
         message: `nested writes are not supported inside upsert arms on ${modelMeta.name} \u2014 use create()/update() with nested data`,
         meta: { model: modelMeta.name }
@@ -13519,7 +13676,7 @@ function createDelegate(params) {
     }
     if (!upsertUsesNativeStatement({ model: modelMeta, args })) {
       if (args.onConflict !== undefined) {
-        throw new VibeError28({
+        throw new VibeError30({
           code: "VIBE_VALIDATION",
           message: `onConflict on ${modelMeta.name}.upsert() needs the native single-statement path \u2014 this shape (a guard field beyond the conflict target, or create data not binding the where's key) runs the find-then-write fallback, which cannot honor an explicit conflict target`,
           meta: { model: modelMeta.name }
@@ -13726,7 +13883,7 @@ function buildClient(params) {
           text: statement.text,
           values: statement.values,
           rowCount: (value) => method.startsWith("$query") ? value.rows.length : value.affectedRows,
-          run: () => statement.values.length > 0 ? runBoundAffected({ adapter: target.adapter, text: statement.text, values: statement.values }) : target.adapter.executeUnsafe(statement)
+          run: () => statement.values.length > 0 ? target.adapter.executeRawBound !== undefined ? target.adapter.executeRawBound(statement) : runBoundAffected({ adapter: target.adapter, text: statement.text, values: statement.values }) : target.adapter.executeUnsafe(statement)
         });
         decodeRows2?.(result.rows);
         return result;
@@ -13797,7 +13954,7 @@ function buildClient(params) {
     }
     for (const operation of operations) {
       if (!isQueryPromise(operation)) {
-        claimError = new VibeError28({
+        claimError = new VibeError30({
           code: "VIBE_VALIDATION",
           message: "$transaction([...]) takes query promises from model delegate calls \u2014 a foreign promise is already running and cannot join the transaction"
         });
@@ -13862,7 +14019,7 @@ function buildClient(params) {
     $models: models,
     $on: (event, listener) => {
       if (event !== "query") {
-        throw new VibeError28({
+        throw new VibeError30({
           code: "VIBE_VALIDATION",
           message: `unknown client event "${String(event)}" \u2014 supported: "query"`,
           meta: { event }
@@ -13877,7 +14034,7 @@ function buildClient(params) {
     $querySql: async ({ query, decoder }) => {
       assertEngineActive({ engine });
       if (decoder === null || typeof decoder !== "object" || typeof decoder.decode !== "function")
-        throw new VibeError28({ code: "VIBE_VALIDATION", message: "$querySql requires an explicit result decoder" });
+        throw new VibeError30({ code: "VIBE_VALIDATION", message: "$querySql requires an explicit result decoder" });
       const statement = compileSql({ dialect: engine.dialect, query });
       let output = [];
       await runRaw("$querySql", statement, (rows) => {
@@ -13899,6 +14056,8 @@ function buildClient(params) {
     $tryAdvisoryLock: (options) => runAdvisoryLock({ method: "$tryAdvisoryLock", options }),
     $connect: async () => {
       assertEngineActive({ engine, requireContext: false });
+      if (engine.borrowedModule === true)
+        throw new VibeError30({ code: "VIBE_VALIDATION", message: "A package module borrows its adapter; the application owns connection lifecycle", meta: { reason: "module_borrowed_lifecycle", method: "$connect" } });
       if (engine.inTransaction === true)
         throw transactionLifecycleRefusal({ method: "$connect" });
       if (engine.rlsSchema !== undefined) {
@@ -13919,6 +14078,8 @@ function buildClient(params) {
     },
     $disconnect: async () => {
       assertEngineActive({ engine, requireContext: false });
+      if (engine.borrowedModule === true)
+        throw new VibeError30({ code: "VIBE_VALIDATION", message: "A package module borrows its adapter; the application owns connection lifecycle", meta: { reason: "module_borrowed_lifecycle", method: "$disconnect" } });
       if (engine.inTransaction === true)
         throw transactionLifecycleRefusal({ method: "$disconnect" });
       await engine.diagnostics?.flush();
@@ -13954,7 +14115,7 @@ function buildClient(params) {
     });
   } else {
     const refuseLegacy = () => {
-      throw new VibeError28({ code: "VIBE_CONFIG", message: "Native row-level security cannot be combined with application policy or tenant scoping" });
+      throw new VibeError30({ code: "VIBE_CONFIG", message: "Native row-level security cannot be combined with application policy or tenant scoping" });
     };
     Object.defineProperties(client, {
       $withContext: { enumerable: true, value: (context) => {
@@ -13980,6 +14141,25 @@ function buildClient(params) {
     Object.freeze(models);
     Object.freeze(client);
   }
+  registerModuleBinder({ client, bind: ({ schema, manifest }) => {
+    assertEngineActive({ engine, requireContext: false });
+    if (engine.rlsSchema !== undefined || engine.meta.models.some((model) => model.policy !== undefined))
+      throw new VibeError30({ code: "VIBE_CONFIG", message: `Module ${manifest.id} cannot attach models to a policy or native-RLS context`, meta: { reason: "module_restricted_context", moduleId: manifest.id } });
+    if (manifest.dialect !== engine.dialect.name)
+      throw new VibeError30({ code: "VIBE_UNSUPPORTED_CAPABILITY", message: `Module ${manifest.id} requires ${manifest.dialect}, received ${engine.dialect.name}`, meta: { reason: "module_dialect", moduleId: manifest.id } });
+    const previous = engine.moduleManifests.get(manifest.id);
+    if (previous !== undefined && (previous.schemaChecksum !== manifest.schemaChecksum || previous.revision !== manifest.revision || previous.contract !== manifest.contract))
+      throw new VibeError30({ code: "VIBE_CONFIG", message: `Module ${manifest.id} was already bound with a different manifest; use compatible package artifacts`, meta: { reason: "module_manifest_conflict", moduleId: manifest.id, revision: manifest.revision } });
+    let meta = moduleMetadata.get(schema);
+    if (meta === undefined) {
+      meta = buildRuntimeMeta({ schema });
+      registerRestrictedSqlSchema({ meta, schema });
+      moduleMetadata.set(schema, meta);
+    }
+    engine.moduleManifests.set(manifest.id, manifest);
+    const { validate: _validate, ...options } = engine.options;
+    return buildClient({ engine: { ...engine, meta, options, borrowedModule: true, extensionMounts: [], connectHooks: [], renderCache: new StatementRenderCache } });
+  } });
   return client;
 }
 function makeMountContext(params) {
@@ -14024,7 +14204,7 @@ function makeMountContext(params) {
     compileWhere: ({ where, model: modelName, qualify }) => {
       const target = modelName === undefined ? model : getModelMeta({ meta: engine.meta, model: modelName });
       if (target === null) {
-        throw new VibeError28({
+        throw new VibeError30({
           code: "VIBE_INTERNAL",
           message: `extension "${extension}" compiled a where with no model in scope`,
           meta: { extension }
@@ -14053,24 +14233,24 @@ function createMountSurface(params) {
         for (const key of path) {
           receiver = current;
           if (current === null || typeof current !== "object" && typeof current !== "function")
-            throw new VibeError28({ code: "VIBE_CONFIG", message: "Extension mount changed its method shape" });
+            throw new VibeError30({ code: "VIBE_CONFIG", message: "Extension mount changed its method shape" });
           current = Reflect.get(current, key);
         }
         if (typeof current !== "function")
-          throw new VibeError28({ code: "VIBE_CONFIG", message: "Extension mount changed its method shape" });
+          throw new VibeError30({ code: "VIBE_CONFIG", message: "Extension mount changed its method shape" });
         return Reflect.apply(current, receiver, args);
       } });
     }
     if (value === null || typeof value !== "object")
       return value;
     if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {
-      throw new VibeError28({ code: "VIBE_CONFIG", message: "Native RLS extension mounts must expose plain objects and methods" });
+      throw new VibeError30({ code: "VIBE_CONFIG", message: "Native RLS extension mounts must expose plain objects and methods" });
     }
     const result = {};
     for (const key of Reflect.ownKeys(value)) {
       const descriptor = Object.getOwnPropertyDescriptor(value, key);
       if (!("value" in descriptor))
-        throw new VibeError28({ code: "VIBE_CONFIG", message: "Native RLS extension mount accessors are unsupported" });
+        throw new VibeError30({ code: "VIBE_CONFIG", message: "Native RLS extension mount accessors are unsupported" });
       Object.defineProperty(result, key, { value: wrap(descriptor.value, [...path, key]), enumerable: descriptor.enumerable });
     }
     return Object.freeze(result);
@@ -14087,7 +14267,7 @@ function attachExtensionMounts(params) {
       const model = getModelMeta({ meta: engine.meta, model: mount.model ?? "" });
       const delegate = models[model.name];
       if (delegate === undefined || mount.property in delegate) {
-        throw new VibeError28({
+        throw new VibeError30({
           code: "VIBE_CONFIG",
           message: `extension "${mount.extension}" cannot mount "${mount.property}" on ${model.name} \u2014 the name is taken`,
           meta: { extension: mount.extension, model: model.name, property: mount.property }
@@ -14098,7 +14278,7 @@ function attachExtensionMounts(params) {
       continue;
     }
     if (!mount.property.startsWith("$") || mount.property in client) {
-      throw new VibeError28({
+      throw new VibeError30({
         code: "VIBE_CONFIG",
         message: `extension "${mount.extension}" cannot mount client property "${mount.property}" \u2014 root mounts are $-prefixed and must not collide`,
         meta: { extension: mount.extension, property: mount.property }
@@ -14133,9 +14313,9 @@ function createClient(params) {
     const role = options?.nativeRls?.runtimeRole;
     if (adapter.provider === "pglite") {
       if (typeof role !== "string" || role.length === 0 || role.includes("\x00"))
-        throw new VibeError28({ code: "VIBE_CONFIG", message: "PGlite native row-level security requires a pre-existing restricted runtimeRole; embedded binding is not a boundary against the host process" });
+        throw new VibeError30({ code: "VIBE_CONFIG", message: "PGlite native row-level security requires a pre-existing restricted runtimeRole; embedded binding is not a boundary against the host process" });
     } else if (role !== undefined) {
-      throw new VibeError28({ code: "VIBE_CONFIG", message: "Server native row-level security must use the runtime login role, not a runtimeRole switch" });
+      throw new VibeError30({ code: "VIBE_CONFIG", message: "Server native row-level security must use the runtime login role, not a runtimeRole switch" });
     }
   }
   if (extensions?.manifest !== undefined) {
@@ -14145,7 +14325,7 @@ function createClient(params) {
     assertComputedManifest({ manifest: computed.manifest, specs: computed.specs });
   }
   if (computed === undefined && options !== undefined && options["computed"] !== undefined) {
-    throw new VibeError28({
+    throw new VibeError30({
       code: "VIBE_CONFIG",
       message: "this client was generated without computed fields \u2014 declare them in vibeorm.config.ts and re-run vibeorm generate",
       meta: {}
@@ -14159,9 +14339,11 @@ function createClient(params) {
     ...computed?.specs === undefined ? {} : { computed: computed.specs }
   });
   const meta = operatorMap === null ? baseMeta : { ...baseMeta, extensionOperators: operatorMap };
+  registerRestrictedSqlSchema({ meta, schema });
   return buildClient({
     engine: {
       rootIdentity: Object.freeze({}),
+      moduleManifests: new Map,
       ...schema.rls === undefined ? {} : { rlsSchema: schema },
       meta,
       adapter,
@@ -14176,10 +14358,60 @@ function createClient(params) {
     }
   });
 }
+
+// packages/runtime/src/database-module.ts
+function canonicalValue(params) {
+  const { value } = params;
+  if (Array.isArray(value))
+    return value.map((entry) => canonicalValue({ value: entry }));
+  if (value === null || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entry]) => [key, canonicalValue({ value: entry })]));
+}
+function freezeData(params) {
+  if (params.value === null || typeof params.value !== "object" || Object.isFrozen(params.value))
+    return;
+  for (const value of Object.values(params.value))
+    freezeData({ value });
+  Object.freeze(params.value);
+}
+function defineDatabaseModule(params) {
+  for (const key of ["id", "contract", "revision"]) {
+    if (typeof params[key] !== "string" || params[key].trim().length === 0 || params[key].includes("\x00"))
+      throw new VibeError31({ code: "VIBE_CONFIG", message: `Database module ${key} must be a non-empty identifier`, meta: { reason: "module_manifest", key } });
+  }
+  assertValidSchemaIR3({ schema: params.schema });
+  if (params.schema.rls !== undefined || params.schema.extensions.length > 0 || params.schema.models.some((model) => model.policy !== undefined))
+    throw new VibeError31({
+      code: "VIBE_UNSUPPORTED_CAPABILITY",
+      message: `Module ${params.id} cannot declare extensions, policy or native RLS in this module protocol`,
+      meta: { reason: "module_schema_feature", moduleId: params.id }
+    });
+  const serialized = JSON.stringify(canonicalValue({ value: params.schema }));
+  const schema = JSON.parse(serialized);
+  freezeData({ value: schema });
+  const manifest = Object.freeze({
+    id: params.id,
+    contract: params.contract,
+    revision: params.revision,
+    protocol: 1,
+    dialect: providerToDialect({ provider: schema.datasource.provider }),
+    schemaChecksum: createHash("sha256").update(serialized).digest("hex")
+  });
+  if (params.manifest !== undefined && Object.keys(manifest).some((key) => params.manifest[key] !== manifest[key]))
+    throw new VibeError31({
+      code: "VIBE_STALE_CLIENT",
+      message: `Module ${params.id} has incompatible or modified generated metadata; regenerate with a compatible runtime`,
+      meta: { reason: "module_artifact", moduleId: params.id, revision: params.revision, protocol: params.manifest.protocol }
+    });
+  const artifact = Object.freeze({ schema, manifest });
+  const bind = ({ db }) => bindModuleContext({ db, artifact });
+  return Object.freeze({ ...artifact, bind, create: ({ adapter }) => bind({ db: createClient({ schema, adapter }) }) });
+}
 // packages/runtime/src/keyset-iterator.ts
-import { VibeError as VibeError29 } from "@vibeorm/schema";
+import { VibeError as VibeError32 } from "@vibeorm/schema";
 function validation(params) {
-  return new VibeError29({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
+  return new VibeError32({ code: "VIBE_VALIDATION", message: params.message, meta: params.meta });
 }
 function projectionFor(params) {
   const { plan: plan2, select, omit } = params;
@@ -14256,7 +14488,7 @@ function iterateKeyset(options) {
       });
       if (advanced === false) {
         stop();
-        throw new VibeError29({
+        throw new VibeError32({
           code: "VIBE_DATA_INVALID",
           message: `keyset traversal of "${options.model}" is not advancing: the engine returned a row that does not sort after the previous position. ` + "The ordering is not total, or a cursor value lost precision \u2014 a DateTime column finer than milliseconds asserted as millisecond-exact does this.",
           meta: { model: options.model, order: plan2.signature, reason: "keyset-position-not-advancing" }
@@ -14329,7 +14561,7 @@ function iterateKeyset(options) {
   return iterator;
 }
 // packages/runtime/src/telemetry/collector.ts
-import { VibeError as VibeError30 } from "@vibeorm/schema";
+import { VibeError as VibeError33 } from "@vibeorm/schema";
 function createTelemetryCollector(params) {
   const throwOn = new Set(params?.throwOn ?? []);
   const operations = [];
@@ -14339,7 +14571,7 @@ function createTelemetryCollector(params) {
   let shutdowns = 0;
   const hostile = (phase) => {
     if (throwOn.has(phase)) {
-      throw new VibeError30({
+      throw new VibeError33({
         code: "VIBE_INTERNAL",
         message: `telemetry collector: deliberate ${phase} failure`,
         meta: { reason: "telemetry-collector-deliberate-failure", phase }
@@ -14395,7 +14627,7 @@ function createTelemetryCollector(params) {
     operationFor: (lookup) => {
       const matches = operations.filter((event) => event.method === lookup.method && (lookup.model === undefined || event.model === lookup.model));
       if (matches.length > 1) {
-        throw new VibeError30({
+        throw new VibeError33({
           code: "VIBE_VALIDATION",
           message: `telemetry collector: ${matches.length} operations match ${lookup.model ?? "*"}.${lookup.method}`,
           meta: {
@@ -14460,6 +14692,7 @@ export {
   encodeValue,
   encodeKeysetToken,
   delegateMethodAccess,
+  defineDatabaseModule,
   decodeValue,
   decodeRows,
   decodeRow,
@@ -14521,4 +14754,4 @@ export {
   CLIENT_MEMBER_ACCESS
 };
 
-//# debugId=66C6E11BD1A77F7364756E2164756E21
+//# debugId=22841846B558EACA64756E2164756E21