@rebasepro/server-postgres 0.12.0 → 0.12.1-canary.g06f263c

package/dist/schema/ensure-collection-policies.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Applying a bundle's RLS policies to a database at boot, idempotently.
+ *
+ * ## Why this exists
+ *
+ * {@link ensureCollectionTables} creates the collection *tables* a managed
+ * runtime boots against, but a table with row-level security disabled and no
+ * policies is not servable: authenticated requests run as the restricted
+ * `rebase_user` role, so a read with no `SELECT` policy returns nothing (a
+ * public collection answered 401) and a write with no `INSERT`/`UPDATE` policy
+ * is denied. The policies live in the collections' `securityRules`; nothing at
+ * boot applied them. `rebase db push` does — but it drives Atlas against a
+ * local `DATABASE_URL`, and a managed tenant's database is reachable only from
+ * inside the cluster, by the runtime that is already connected to it. So the
+ * runtime is the only thing that *can* apply them, and this is where it does.
+ *
+ * ## Why this is safe to run on every boot
+ *
+ * Every statement is idempotent: `ENABLE ROW LEVEL SECURITY` is a no-op once
+ * enabled, and each policy is a `DROP POLICY IF EXISTS` immediately followed by
+ * a `CREATE POLICY`, so re-applying asserts exactly the declared state. It adds
+ * and replaces; it never drops data. (It does not *reconcile* — a policy a
+ * previous push left behind under an old name is not removed here; that stays a
+ * `db push` / `db migrate` concern, alongside destructive schema changes.)
+ *
+ * Unlike table creation, a failure here is not fatal: RLS stays enabled, so a
+ * table whose policies could not be applied fails **closed** (denies) rather
+ * than leaking rows. One collection's policy failing (e.g. a rule that
+ * references a table a real migration has not created yet) must not crash-loop
+ * the whole deployment and take the other collections' working routes down with
+ * it. Failures are reported loudly and per-table so the operator can see
+ * exactly which collection is not yet servable and why.
+ */
+import { type CollectionConfig } from "@rebasepro/types";
+import { type Queryable } from "./ensure-collection-tables";
+export interface PolicyEnsureResult {
+    /** `CREATE POLICY` statements that ran successfully. */
+    policiesApplied: number;
+    /** Tables that had RLS enabled. */
+    tablesSecured: number;
+    /** Declared tables absent from the database — left to a real migration. */
+    skipped: {
+        table: string;
+        reason: string;
+    }[];
+    /** Tables whose RLS could not be fully applied (fail closed). */
+    failures: {
+        table: string;
+        error: string;
+    }[];
+}
+/**
+ * Bring the declared collections' RLS policies up to date. Returns what it did.
+ *
+ * Only tables that already exist are touched: the boot-time table creator runs
+ * first, so anything still missing is a table this additive path is not allowed
+ * to create (a junction, or a relation left to a migration). Enabling RLS on a
+ * non-existent table would error, so those are recorded as skipped, not failed.
+ */
+export declare function ensureCollectionPolicies(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void): Promise<PolicyEnsureResult>;

package/dist/schema/ensure-collection-tables.d.ts

@@ -46,9 +46,17 @@ export interface ExistingSchema {
     tables: Map<string, Set<string>>;
     /** `schema.typename` of every enum type that already exists. */
     enums: Set<string>;
+    /**
+     * `schema.table.constraint` of every constraint that already exists.
+     *
+     * Optional so a caller that only cares about tables can still build one by
+     * hand; absent is read as "none known", which at worst re-attempts a
+     * constraint that then fails harmlessly as a duplicate.
+     */
+    constraints?: Set<string>;
 }
 export interface EnsureAction {
-    kind: "create-enum" | "create-table" | "add-column";
+    kind: "create-enum" | "create-table" | "add-column" | "add-constraint";
     /** Qualified target, for logging: `public.posts` or `public.posts.title`. */
     target: string;
     sql: string;
@@ -58,6 +66,20 @@ export interface EnsurePlan {
     /** Every statement, in dependency order. Empty when the schema is current. */
     statements: string[];
 }
+export interface EnsureOutcome extends EnsurePlan {
+    /**
+     * Constraints that could not be added — always non-fatal.
+     *
+     * A foreign key can only fail on data that already violates it, and the
+     * column it would police exists either way, so the collection still serves.
+     * Refusing to boot over one would turn a pre-existing data problem into an
+     * outage. Reported loudly instead.
+     */
+    failures: {
+        target: string;
+        error: string;
+    }[];
+}
 /**
  * Decide what to add. Pure — the caller supplies what exists and runs the result.
  *
@@ -76,4 +98,4 @@ export declare function readExistingSchema(client: Queryable, schemas: string[])
  * cannot be added, say) should not roll back the tables that were created fine.
  * The error is surfaced with the statement that caused it.
  */
-export declare function ensureCollectionTables(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void): Promise<EnsurePlan>;
+export declare function ensureCollectionTables(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void): Promise<EnsureOutcome>;

package/dist/schema/generate-postgres-ddl-logic.d.ts

@@ -1,8 +1,123 @@
-import { CollectionConfig, Property } from "@rebasepro/types";
+import { CollectionConfig, Property, SecurityRule } from "@rebasepro/types";
 export declare const resolveColumnName: (propName: string, prop?: Property | null) => string;
+export declare const getPrimaryKeyProp: (collection: CollectionConfig) => {
+    name: string;
+    type: "string" | "number";
+    isUuid: boolean;
+};
+export declare const isNumericId: (collection: CollectionConfig) => boolean;
+export declare const getPrimaryKeyName: (collection: CollectionConfig) => string;
 export declare const isIdProperty: (propName: string, prop: Property, collection: CollectionConfig) => boolean;
+type ResolveCollection = (slug: string) => CollectionConfig | undefined;
+/**
+ * The individual SQL statements a single security rule compiles to: a
+ * `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete
+ * statement (terminated by `;`, no trailing newline).
+ *
+ * This is the primitive the boot-time RLS applier runs one statement at a time
+ * (the runtime's DB handle speaks the extended query protocol, which forbids
+ * multiple commands in one execute), while `db push` writes the joined string.
+ */
+export declare const generatePolicyStatements: (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection) => string[];
 export declare const getSqlColumnType: (propName: string, prop: Property, collection: CollectionConfig, collections: CollectionConfig[]) => string;
 export declare const generatePostgresDdl: (collections: CollectionConfig[], options?: {
     includePolicies?: boolean;
 }) => Promise<string>;
+/** The RLS statements one declared collection's table needs, ready to run. */
+/**
+ * A foreign key, as both its parts and the statement that creates it.
+ *
+ * `ALTER TABLE … ADD CONSTRAINT` has no `IF NOT EXISTS`, so a caller applying
+ * these has to skip by name — hence the name is a field and not only a substring
+ * of the SQL.
+ */
+export interface ForeignKeyPlan {
+    constraintName: string;
+    schema: string;
+    /** Bare table name, no schema prefix. */
+    table: string;
+    column: string;
+    targetSchema: string;
+    targetTable: string;
+    targetColumn: string;
+    sql: string;
+}
+/** A column a `relation` or `reference` property owns on its own table. */
+export interface RelationalColumnPlan {
+    schema: string;
+    /** Bare table name, no schema prefix. */
+    table: string;
+    column: string;
+    /** Postgres type, exactly as the DDL generator declares it. */
+    type: string;
+    /** Absent when the target collection is not part of this bundle. */
+    foreignKey?: ForeignKeyPlan;
+}
+/** The table behind a many-to-many `through` relation. */
+export interface JunctionTablePlan {
+    schema: string;
+    /** Bare table name, no schema prefix. */
+    table: string;
+    columns: {
+        name: string;
+        type: string;
+    }[];
+    /** Both endpoint columns plus the composite primary key. */
+    createTable: string;
+    foreignKeys: ForeignKeyPlan[];
+}
+/**
+ * The FK columns the declared collections own — one entry per `relation`
+ * (`belongsTo` side) or `reference` property.
+ *
+ * Split out of {@link generatePostgresDdl} so the boot-time schema ensure can
+ * create the same columns with the same names, types and constraints. Before
+ * this it skipped them outright, which was survivable only because `db push`
+ * always followed; on a managed tenant nothing follows, so a table arrived
+ * without the column its own collection reads and wrote 400 on every insert.
+ *
+ * A relation whose target is not in the bundle yields no column at all (the
+ * generator returns early on an unresolvable target); a `reference` whose target
+ * is unknown yields the column without a constraint. Both mirror the generator
+ * exactly — a divergence here is a schema fork between boot and `db push`.
+ */
+export declare const planRelationalColumns: (collections: CollectionConfig[]) => RelationalColumnPlan[];
+/**
+ * The junction tables a bundle's many-to-many relations imply.
+ *
+ * Derived from {@link resolveJunctionSpecs}, the same source the junction RLS
+ * comes from, so a table created here always has policies planned for it — a
+ * junction with row-level security left off is readable and writable by every
+ * signed-in user, which is why the two must ship together.
+ */
+export declare const planJunctionTables: (collections: CollectionConfig[]) => JunctionTablePlan[];
+export interface CollectionPolicyPlan {
+    /** The table's schema (e.g. `public`, `rebase`). */
+    schema: string;
+    /** The bare table name, no schema prefix. */
+    table: string;
+    /** `schema.table` — matches the keys `readExistingSchema` returns. */
+    qualified: string;
+    /** `ALTER TABLE … ENABLE ROW LEVEL SECURITY;` — locked by default. */
+    enableRls: string;
+    /** `DROP POLICY IF EXISTS` / `CREATE POLICY` statements, in order. */
+    policyStatements: string[];
+}
+/**
+ * The per-table RLS plan for the *declared* collections, as executable
+ * statements — what the managed runtime applies at boot so a freshly
+ * provisioned tenant database serves data instead of 401ing every read.
+ *
+ * Mirrors {@link generatePostgresPoliciesDdl} exactly (same
+ * `generatePolicyStatements`, same enable-RLS, same effective rules, same
+ * derived junction rules), so boot and `db push` produce identical policies from
+ * identical collections.
+ *
+ * Junction tables are included, and have to be: boot creates them now
+ * ({@link planJunctionTables}), and a junction with RLS left off is readable and
+ * writable by every signed-in user. A junction whose table is still absent is
+ * skipped by the applier, not planned away here.
+ */
+export declare const planCollectionPolicies: (collections: CollectionConfig[]) => CollectionPolicyPlan[];
 export declare const generatePostgresPoliciesDdl: (collections: CollectionConfig[]) => string;
+export {};

package/dist/{src-BbFOPJ1S.js → src-C_NHNVW2.js}

@@ -1,8 +1,61 @@
 import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
-import { r as __require, t as __commonJSMin } from "./chunk-DSJWtz9O.js";
-import { a as policy, c as getDeclaredSubcollections, f as getDataSourceCapabilities, g as EntityRelation, h as toCanonicalOp, i as ANONYMOUS_USER_ID, l as isPostgresCollectionConfig, m as REST_TO_CANONICAL, p as NULL_OPS, s as isManyToMany, u as isRelationalCollectionConfig } from "./src-Zqwaw3P5.js";
+import { l as __require, s as __commonJSMin } from "./connection-BuZ97wsr.js";
+import { a as getDataSourceCapabilities, c as toCanonicalOp, n as isPostgresCollectionConfig, o as NULL_OPS, r as isRelationalCollectionConfig, s as REST_TO_CANONICAL, t as getDeclaredSubcollections } from "./src-DoU9yPqq.js";
+import { n as ANONYMOUS_USER_IDS, r as policy, t as ANONYMOUS_USER_ID } from "./policy-CeA1JcxP.js";
+//#region ../types/src/types/entities.ts
+/**
+* Class used to create a reference to a entity in a different path
+*/
+var EntityRelation = class {
+	__type = "relation";
+	/**
+	* ID of the entity
+	*/
+	id;
+	/**
+	* A string representing the path of the referenced document (relative
+	* to the root of the database).
+	*/
+	path;
+	/**
+	* Pre-fetched data payload to eliminate N+1 queries.
+	* When present, clients can use this directly instead of fetching.
+	*/
+	data;
+	constructor(id, path, data) {
+		this.id = id;
+		this.path = path;
+		this.data = data;
+	}
+	get pathWithId() {
+		return `${this.path}/${this.id}`;
+	}
+	isEntityReference() {
+		return false;
+	}
+	isEntityRelation() {
+		return true;
+	}
+};
+var Vector = class {
+	value;
+	constructor(value) {
+		this.value = value;
+	}
+};
+//#endregion
+//#region ../types/src/types/relations.ts
+/** @group Models */
+function hasForeignKeyOnTarget(relation) {
+	return relation.kind === "hasOne" || relation.kind === "hasMany";
+}
+/** @group Models */
+function isManyToMany(relation) {
+	return relation.kind === "manyToMany";
+}
+//#endregion
 //#region ../common/src/util/common.ts
 var DEFAULT_ONE_OF_TYPE = "type";
 var DEFAULT_ONE_OF_VALUE = "value";
@@ -1811,7 +1864,12 @@ var UID_NOT_NULL = /auth\.uid\(\)\s+IS\s+NOT\s+NULL/i;
 * is how the trusted *server* context is recognised), so:
 *
 *  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
-*  - `auth.uid() != 'anon'` compares against a string no caller ever has.
+*  - `auth.uid() != 'anon'` excludes one spelling of anonymous and admits the
+*    other. This one is not hypothetical and was not only a foreign habit:
+*    rebase's own request path reported `'anon'` while everything that compiled
+*    or checked a policy used `'anonymous'`, so whichever literal an author
+*    picked, half the anonymous callers walked through. See
+*    {@link ANONYMOUS_USER_IDS}.
 *
 * Either one turns a lockdown into a full grant, and neither looks wrong. No
 * real user id is ever one of these literals, and a user-context request is
@@ -1849,7 +1907,7 @@ function findAnonymousGrants(expr) {
 				found.push({
 					pattern: "foreign-uid-literal",
 					detail: literal.value,
-					explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for every caller. Use \`condition: policy.authenticated()\` to mean "signed in".`
+					explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for every caller. Use \`condition: policy.authenticated()\` to mean "signed in" — it compiles to NOT IN (${ANONYMOUS_USER_IDS.map((v) => `'${v}'`).join(", ")}), covering every spelling rebase has reported rather than whichever one you remember.`
 				});
 				return;
 			}
@@ -1944,7 +2002,7 @@ function compile(expr, scope) {
 		}
 		case "rolesOverlap": return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
 		case "rolesContain": return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
-		case "authenticated": return `auth.uid() IS NOT NULL AND auth.uid() <> ${quoteLiteral(ANONYMOUS_USER_ID)}`;
+		case "authenticated": return `auth.uid() IS NOT NULL AND auth.uid() NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
 		case "serverContext": return "auth.uid() IS NULL";
 		case "existsIn": return compileExistsIn(expr, scope);
 		case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
@@ -2016,75 +2074,6 @@ function rolesArraySql(roles) {
 	return `ARRAY[${[...roles].sort().map((r) => `'${r}'`).join(",")}]`;
 }
 //#endregion
-//#region ../common/src/util/callbacks.ts
-/**
-* Helper function to recursively check if there are any callbacks in the properties.
-*/
-function hasPropertyCallbacks(properties, callbackName) {
-	if (!properties) return false;
-	for (const property of Object.values(properties)) {
-		if (property.callbacks?.[callbackName]) return true;
-		if (property.type === "map" && property.properties) {
-			if (hasPropertyCallbacks(property.properties, callbackName)) return true;
-		} else if (property.type === "array" && property.of) {
-			const ofs = Array.isArray(property.of) ? property.of : [property.of];
-			for (const of of ofs) {
-				if (of.callbacks?.[callbackName]) return true;
-				if (of.type === "map" && of.properties && hasPropertyCallbacks(of.properties, callbackName)) return true;
-			}
-		}
-	}
-	return false;
-}
-/**
-* Recursively process properties to apply field-level hooks.
-*/
-async function processProperties(properties, values, previousValues, propsContext, callbackName) {
-	if (!values || typeof values !== "object") return values;
-	const result = { ...values };
-	for (const [key, property] of Object.entries(properties)) {
-		if (result[key] === void 0) continue;
-		let currentValue = result[key];
-		const previousValue = previousValues?.[key];
-		if (property.type === "array" && Array.isArray(currentValue)) {
-			if (property.of && !Array.isArray(property.of)) currentValue = await Promise.all(currentValue.map(async (item, index) => {
-				const prevItem = Array.isArray(previousValue) ? previousValue[index] : void 0;
-				return (await processProperties({ "_tmp": property.of }, { "_tmp": item }, { "_tmp": prevItem }, propsContext, callbackName))["_tmp"];
-			}));
-		} else if (property.type === "map" && property.properties && typeof currentValue === "object") currentValue = await processProperties(property.properties, currentValue, previousValue ?? {}, propsContext, callbackName);
-		if (property.callbacks?.[callbackName]) {
-			const cbRes = await Promise.resolve(property.callbacks[callbackName]({
-				...propsContext,
-				value: currentValue,
-				previousValue
-			}));
-			if (cbRes !== void 0) currentValue = cbRes;
-		}
-		result[key] = currentValue;
-	}
-	return result;
-}
-/**
-* Helper function to extract field-level PropertyCallbacks from a properties schema
-* and wrap them into an CollectionCallbacks object recursively.
-*/
-var buildPropertyCallbacks = (properties) => {
-	if (!properties) return void 0;
-	const propertyCallbacks = {};
-	if (hasPropertyCallbacks(properties, "afterRead")) propertyCallbacks.afterRead = async (props) => {
-		const row = props.row;
-		const processedValues = await processProperties(properties, row, row, props, "afterRead");
-		return {
-			...props.row,
-			...processedValues
-		};
-	};
-	if (hasPropertyCallbacks(properties, "beforeSave")) propertyCallbacks.beforeSave = async (props) => {
-		return await processProperties(properties, props.values, props.previousValues ?? {}, props, "beforeSave");
-	};
-	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
-};
-//#endregion
 //#region ../common/src/util/auth-default-policies.ts
 /**
 * Default RLS policies injected by the schema generator.
@@ -2659,10 +2648,27 @@ function getJunctionSecurityRules(spec) {
 	});
 })))();
 /**
-* Apply PropertyConditions to a resolved property, evaluating all JSON Logic rules.
+* How wide a `varchar`/`char` column should be for a given property.
+*
+* One definition, three call sites, because they used to disagree. For the same
+* `columnType: "varchar"` property the DDL generator emitted `VARCHAR(255)`
+* while the Drizzle generator emitted a bare `varchar("col")` — which Postgres
+* reads as *unbounded* — so which of the two you ran decided whether the column
+* had a limit at all. Introspection then dropped the length entirely, so reading
+* an existing `character varying(500)` column back and regenerating it produced
+* a `VARCHAR(255)`: a silent narrowing of a column with data already in it.
+*
+* `validation.max` is the property's own statement about how long the value may
+* be, so it is the only sensible source for the column's width — and it keeps
+* the constraint the database enforces in step with the one the app enforces,
+* rather than inventing a second, different limit underneath it.
 */
+function resolveStringColumnLength(prop) {
+	const max = prop.validation?.max;
+	return typeof max === "number" && Number.isInteger(max) && max > 0 ? max : 255;
+}
 //#endregion
-//#region ../../node_modules/.pnpm/fast-equals@6.0.0/node_modules/fast-equals/dist/es/index.mjs
+//#region ../../node_modules/.pnpm/fast-equals@6.0.2/node_modules/fast-equals/dist/es/index.mjs
 var { getOwnPropertyNames, getOwnPropertySymbols } = Object;
 var { hasOwnProperty } = Object.prototype;
 /**
@@ -2698,7 +2704,8 @@ function createIsCircular(areItemsEqual) {
 * not enumerable and symbol properties.
 */
 function getStrictProperties(object) {
-	return getOwnPropertyNames(object).concat(getOwnPropertySymbols(object));
+	const symbols = getOwnPropertySymbols(object);
+	return symbols.length ? getOwnPropertyNames(object).concat(symbols) : getOwnPropertyNames(object);
 }
 /**
 * Whether the object contains the property passed as an own property.
@@ -2771,7 +2778,7 @@ function areMapsEqual(a, b, state) {
 	const size = a.size;
 	if (size !== b.size) return false;
 	if (!size) return true;
-	const matchedIndices = new Array(size);
+	const matchedIndices = new Uint8Array(size);
 	const aIterable = a.entries();
 	let aResult;
 	let bResult;
@@ -2779,7 +2786,7 @@ function areMapsEqual(a, b, state) {
 	while (aResult = aIterable.next()) {
 		if (aResult.done) break;
 		const bIterable = b.entries();
-		let hasMatch = false;
+		let hasMatch = 0;
 		let matchIndex = 0;
 		while (bResult = bIterable.next()) {
 			if (bResult.done) break;
@@ -2790,7 +2797,7 @@ function areMapsEqual(a, b, state) {
 			const aEntry = aResult.value;
 			const bEntry = bResult.value;
 			if (state.equals(aEntry[0], bEntry[0], index, matchIndex, a, b, state) && state.equals(aEntry[1], bEntry[1], aEntry[0], bEntry[0], a, b, state)) {
-				hasMatch = matchedIndices[matchIndex] = true;
+				hasMatch = matchedIndices[matchIndex] = 1;
 				break;
 			}
 			matchIndex++;
@@ -2848,19 +2855,19 @@ function areSetsEqual(a, b, state) {
 	const size = a.size;
 	if (size !== b.size) return false;
 	if (!size) return true;
-	const matchedIndices = new Array(size);
+	const matchedIndices = new Uint8Array(size);
 	const aIterable = a.values();
 	let aResult;
 	let bResult;
 	while (aResult = aIterable.next()) {
 		if (aResult.done) break;
 		const bIterable = b.values();
-		let hasMatch = false;
+		let hasMatch = 0;
 		let matchIndex = 0;
 		while (bResult = bIterable.next()) {
 			if (bResult.done) break;
 			if (!matchedIndices[matchIndex] && state.equals(aResult.value, bResult.value, aResult.value, bResult.value, a, b, state)) {
-				hasMatch = matchedIndices[matchIndex] = true;
+				hasMatch = matchedIndices[matchIndex] = 1;
 				break;
 			}
 			matchIndex++;
@@ -2873,8 +2880,8 @@ function areSetsEqual(a, b, state) {
 * Whether the TypedArray instances are equal in value.
 */
 function areTypedArraysEqual(a, b) {
-	let index = a.byteLength;
-	if (b.byteLength !== index || a.byteOffset !== b.byteOffset) return false;
+	let index = a.length;
+	if (b.length !== index || a.byteOffset !== b.byteOffset) return false;
 	while (index-- > 0) if (a[index] !== b[index]) return false;
 	return true;
 }
@@ -4102,72 +4109,6 @@ function buildSdkData(driver) {
 	return wrapAsSdkData(buildRebaseData(driver));
 }
 //#endregion
-//#region ../common/src/table-classification.ts
-/** Schemas that are always considered Rebase-internal. */
-var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
-/** Table-name prefixes that mark a table as Rebase-internal regardless of schema. */
-var REBASE_INTERNAL_PREFIXES = [
-	"_rebase_",
-	"_auth_",
-	"drizzle_"
-];
-/**
-* Synchronously classify a table based on naming conventions.
-*
-* @param tableName  - The unqualified name of the table.
-* @param schemaName - The schema the table belongs to (e.g. `"public"`, `"rebase"`).
-* @returns `"rebase-internal"` when the table belongs to a reserved schema or
-*          carries a reserved prefix; `"user"` otherwise.
-*
-* @remarks
-* Junction-table detection requires an async database query and is therefore
-* **not** handled by this function. Use {@link detectJunctionTables} to obtain
-* the set of junction tables, then reclassify as needed.
-*/
-function classifyTable(tableName, schemaName) {
-	if (REBASE_INTERNAL_SCHEMAS.includes(schemaName) || REBASE_INTERNAL_PREFIXES.some((prefix) => tableName.startsWith(prefix))) return "rebase-internal";
-	return "user";
-}
-/** SQL query that detects junction tables in the `public` schema. */
-var JUNCTION_TABLES_SQL = `
-  SELECT t.table_name
-  FROM information_schema.tables t
-  WHERE t.table_schema = 'public'
-    AND t.table_type = 'BASE TABLE'
-    AND NOT EXISTS (
-      SELECT 1
-      FROM information_schema.columns c
-      WHERE c.table_schema = t.table_schema
-        AND c.table_name = t.table_name
-        AND c.column_name NOT IN (
-          SELECT kcu.column_name
-          FROM information_schema.key_column_usage kcu
-          JOIN information_schema.table_constraints tc
-            ON tc.constraint_name = kcu.constraint_name
-            AND tc.table_schema = kcu.table_schema
-          WHERE tc.constraint_type = 'FOREIGN KEY'
-            AND kcu.table_schema = t.table_schema
-            AND kcu.table_name = t.table_name
-        )
-    )
-`;
-/**
-* Asynchronously detect junction (link) tables in the `public` schema.
-*
-* A junction table is defined as a table where **every** column participates in
-* at least one foreign-key constraint.
-*
-* @param executeSql - A callback that executes a raw SQL string and returns the
-*                     resulting rows.
-* @returns A `Set` containing the names of all detected junction tables.
-*/
-async function detectJunctionTables(executeSql) {
-	const rows = await executeSql(JUNCTION_TABLES_SQL);
-	const junctionTables = /* @__PURE__ */ new Set();
-	for (const row of rows) if (typeof row.table_name === "string") junctionTables.add(row.table_name);
-	return junctionTables;
-}
-//#endregion
-export { toSnakeCase as A, createRelationRefWithData as C, getPolicyNamesForRule as D, generateForeignKeyName as E, DEFAULT_ONE_OF_VALUE as M, mergeDeep as O, createRelationRef as S, updateDateAutoValues as T, getTableVarName as _, getJunctionCollectionConfig as a, getDeclaredPrimaryKeys as b, getEffectiveSecurityRules as c, securityRuleToConditions as d, findAnonymousGrants as f, getTableName as g, getEnumVarName as h, CollectionRegistry as i, DEFAULT_ONE_OF_TYPE as j, camelCase as k, buildPropertyCallbacks as l, getColumnName as m, detectJunctionTables as n, getJunctionSecurityRules as o, findRelation as p, buildSdkData as r, resolveJunctionSpecs as s, classifyTable as t, policyToPostgres as u, resolveCollectionRelations as v, normalizeToEntityRelation as w, parseIdValues as x, buildCompositeId as y };
+export { DEFAULT_ONE_OF_VALUE as A, updateDateAutoValues as C, camelCase as D, mergeDeep as E, isManyToMany as M, Vector as N, toSnakeCase as O, normalizeToEntityRelation as S, getPolicyNamesForRule as T, buildCompositeId as _, getJunctionSecurityRules as a, createRelationRef as b, policyToPostgres as c, findRelation as d, getColumnName as f, resolveCollectionRelations as g, getTableVarName as h, getJunctionCollectionConfig as i, hasForeignKeyOnTarget as j, DEFAULT_ONE_OF_TYPE as k, securityRuleToConditions as l, getTableName as m, CollectionRegistry as n, resolveJunctionSpecs as o, getEnumVarName as p, resolveStringColumnLength as r, getEffectiveSecurityRules as s, buildSdkData as t, findAnonymousGrants as u, getDeclaredPrimaryKeys as v, generateForeignKeyName as w, createRelationRefWithData as x, parseIdValues as y };
 
-//# sourceMappingURL=src-BbFOPJ1S.js.map
+//# sourceMappingURL=src-C_NHNVW2.js.map