@rebasepro/server-postgres 0.12.1-canary.gdfba2a1 → 0.12.1-canary.gf5f1d39

package/src/auth/ensure-tables.ts

@@ -107,38 +107,16 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
                 ? "GENERATED ALWAYS AS IDENTITY"
                 : "DEFAULT gen_random_uuid()::text";
 
-        // Identifiers for the constraint and indexes reconciled further down.
-        // Derived from the resolved table name so two auth tables in different
-        // schemas cannot collide, and truncated to Postgres's 63-byte identifier
-        // limit here rather than letting the server truncate silently — the
-        // `IF NOT EXISTS` guards below have to compare against the same name
-        // Postgres actually stored, or they re-run forever.
-        const authIdentifier = (suffix: string) => `${resolvedTable}_${suffix}`.slice(0, 63);
-        const emailLengthConstraint = `"${authIdentifier("email_length_check")}"`;
-        const emailLowerUniqueIndex = authIdentifier("email_lower_key");
-        const verificationTokenIndex = authIdentifier("email_verification_token_idx");
-
-        // Every string column here is TEXT, deliberately. In Postgres VARCHAR(n)
-        // and TEXT are the same type with the same storage and the same
-        // performance; the only difference is a length check, and none of these
-        // columns wants one. The widths this table used to carry were inherited
-        // MySQL habit (255) and they were all wrong in the same direction —
-        // `password_hash VARCHAR(255)` against a 193-char scrypt string left 62
-        // characters of headroom in front of a KEY_LENGTH constant living in
-        // another package, and `photo_url VARCHAR(500)` rejected the `data:` URIs
-        // and long signed URLs that OAuth providers hand back. A limit worth
-        // having is a CHECK — alterable without a table rewrite, unlike a type
-        // modifier — which is why `email` has one and nothing else does.
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(usersTableName)} (
                 id ${sql.raw(userIdType)} PRIMARY KEY ${sql.raw(idDefault)},
-                email TEXT NOT NULL CONSTRAINT ${sql.raw(emailLengthConstraint)} CHECK (length(email) <= 320),
-                display_name TEXT,
-                photo_url TEXT,
+                email VARCHAR(255) UNIQUE NOT NULL,
+                display_name VARCHAR(255),
+                photo_url VARCHAR(500),
                 roles TEXT[] DEFAULT '{}' NOT NULL,
-                password_hash TEXT,
+                password_hash VARCHAR(255),
                 email_verified BOOLEAN DEFAULT FALSE NOT NULL,
-                email_verification_token TEXT,
+                email_verification_token VARCHAR(255),
                 email_verification_sent_at TIMESTAMP WITH TIME ZONE,
                 is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
                 metadata JSONB DEFAULT '{}' NOT NULL,
@@ -381,12 +359,12 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // statement that references it. `email` is deliberately absent: it has
         // existed since the first era and cannot be added NOT NULL safely.
         const userColumnBackfills = [
-            "display_name TEXT",
-            "photo_url TEXT",
+            "display_name VARCHAR(255)",
+            "photo_url VARCHAR(500)",
             "roles TEXT[] DEFAULT '{}' NOT NULL",
-            "password_hash TEXT",
+            "password_hash VARCHAR(255)",
             "email_verified BOOLEAN DEFAULT FALSE NOT NULL",
-            "email_verification_token TEXT",
+            "email_verification_token VARCHAR(255)",
             "email_verification_sent_at TIMESTAMP WITH TIME ZONE",
             "is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
             "metadata JSONB DEFAULT '{}' NOT NULL",
@@ -401,139 +379,6 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             `);
         }
 
-        // Which of the columns below the table actually has. An adopted table —
-        // one this framework did not create, which the column-name resolution in
-        // `services.ts` exists to support — may be missing any of them, and every
-        // statement past this point has to tolerate that rather than abort the
-        // whole migration block.
-        const usersColumns = await db.execute(sql`
-            SELECT column_name, data_type
-            FROM information_schema.columns
-            WHERE table_schema = ${usersSchema} AND table_name = ${resolvedTable}
-        `);
-        const usersColumnTypes = new Map(
-            (usersColumns.rows as { column_name: string; data_type: string }[])
-                .map(row => [row.column_name, row.data_type])
-        );
-
-        // ── Migration: VARCHAR(n) → TEXT on the users string columns ────────
-        // Tables created before the widths came off still carry them. Postgres
-        // treats varchar(n) → text as binary-coercible with no stricter
-        // constraint, so this is a catalogue-only change: no table rewrite, no
-        // index rebuild, just a brief ACCESS EXCLUSIVE lock. Guarded on the
-        // current type so it runs once and is a pure catalogue read thereafter.
-        for (const column of ["email", "display_name", "photo_url", "password_hash", "email_verification_token"]) {
-            if (usersColumnTypes.get(column) !== "character varying") continue;
-            await db.execute(sql`
-                ALTER TABLE ${sql.raw(usersTableName)}
-                ALTER COLUMN ${sql.raw(`"${column}"`)} TYPE TEXT
-            `);
-            logger.info(`🔧 Widened ${usersTableName}.${column} from VARCHAR(n) to TEXT`);
-        }
-
-        // ── Migration: case-insensitive email identity ──────────────────────
-        // `getUserByEmail` has always searched `email.toLowerCase()` while the
-        // write path stored whatever it was handed, leaving normalisation to a
-        // convention every caller had to remember. A row that reached the table
-        // with mixed case is then invisible to every lookup — the account exists,
-        // login reports no such user, and the plain UNIQUE on `email` does not
-        // stop a second row differing only in case, because it compares bytes.
-        //
-        // Fixed on both sides: `mapPayload` now folds on write, and this index
-        // makes the database agree. A unique index on lower(email) is strictly
-        // stronger than the byte-exact UNIQUE that older tables carry, so the
-        // old constraint is left alone — it can no longer fire on anything the
-        // new one would allow.
-        //
-        // Deliberately no AUTH_SCHEMA_VERSION bump: a runtime that predates this
-        // migration keeps working against the migrated table (all of its own
-        // write paths already lower-cased), which is exactly the additive case
-        // the version stamp is documented not to cover.
-        if (usersColumnTypes.has("email")) {
-            const indexPresent = await db.execute(sql`
-                SELECT 1 FROM pg_class c
-                JOIN pg_namespace n ON n.oid = c.relnamespace
-                WHERE n.nspname = ${usersSchema} AND c.relname = ${emailLowerUniqueIndex} AND c.relkind = 'i'
-            `);
-            if (indexPresent.rows.length === 0) {
-                // Case-collisions already in the table would make the unique
-                // index impossible to build. Report them and leave the table
-                // alone: the next boot retries, so fixing the rows is all the
-                // operator has to do. Failing loudly beats folding the emails
-                // and letting CREATE INDEX pick which account survives.
-                const collisions = await db.execute(sql`
-                    SELECT lower(email) AS normalized, count(*)::int AS occurrences
-                    FROM ${sql.raw(usersTableName)}
-                    WHERE email IS NOT NULL
-                    GROUP BY lower(email)
-                    HAVING count(*) > 1
-                    LIMIT 10
-                `);
-                if (collisions.rows.length > 0) {
-                    const sample = (collisions.rows as { normalized: string; occurrences: number }[])
-                        .map(row => `${row.normalized} (×${row.occurrences})`)
-                        .join(", ");
-                    logger.error(
-                        `❌ Cannot enforce case-insensitive email uniqueness on ${usersTableName}: ` +
-                        `these addresses already exist more than once, differing only in case — ${sample}. ` +
-                        "Merge or delete the duplicates and restart; until then two accounts can share " +
-                        "one address and only the lower-cased one is reachable by login."
-                    );
-                } else {
-                    const folded = await db.execute(sql`
-                        UPDATE ${sql.raw(usersTableName)}
-                        SET email = lower(email)
-                        WHERE email IS NOT NULL AND email <> lower(email)
-                    `);
-                    if (folded.rowCount) {
-                        logger.info(`🔧 Lower-cased ${folded.rowCount} email address(es) in ${usersTableName}`);
-                    }
-                    await db.execute(sql`
-                        CREATE UNIQUE INDEX IF NOT EXISTS ${sql.raw(`"${emailLowerUniqueIndex}"`)}
-                        ON ${sql.raw(usersTableName)} (lower(email))
-                    `);
-                    logger.info(`✅ Email uniqueness on ${usersTableName} is now case-insensitive`);
-                }
-            }
-        }
-
-        // ── Migration: bound the email column's length ──────────────────────
-        // The only length limit on this table worth keeping. 320 is the RFC 5321
-        // maximum (64-char local part + @ + 255-char domain), and it matters here
-        // beyond tidiness: `email` carries a btree index, and a sufficiently long
-        // value fails index insertion with an error that says nothing about
-        // email. NOT VALID so an adopted table with a long row still migrates —
-        // it binds all new writes, which is the part that matters.
-        if (usersColumnTypes.has("email")) {
-            const checkPresent = await db.execute(sql`
-                SELECT 1 FROM pg_constraint c
-                JOIN pg_class t ON t.oid = c.conrelid
-                JOIN pg_namespace n ON n.oid = t.relnamespace
-                WHERE n.nspname = ${usersSchema}
-                  AND t.relname = ${resolvedTable}
-                  AND c.conname = ${authIdentifier("email_length_check")}
-            `);
-            if (checkPresent.rows.length === 0) {
-                await db.execute(sql`
-                    ALTER TABLE ${sql.raw(usersTableName)}
-                    ADD CONSTRAINT ${sql.raw(emailLengthConstraint)} CHECK (length(email) <= 320) NOT VALID
-                `);
-            }
-        }
-
-        // ── Index: email verification token lookups ─────────────────────────
-        // `getUserByVerificationToken` filters on this column, which had no
-        // index — every click of a verification link was a sequential scan of
-        // the whole users table. Partial, because the column is NULL for every
-        // user who is not mid-verification, which is nearly all of them.
-        if (usersColumnTypes.has("email_verification_token")) {
-            await db.execute(sql`
-                CREATE INDEX IF NOT EXISTS ${sql.raw(`"${verificationTokenIndex}"`)}
-                ON ${sql.raw(usersTableName)} (email_verification_token)
-                WHERE email_verification_token IS NOT NULL
-            `);
-        }
-
         // ── Migration: refresh_tokens become session-scoped, rotation-safe ──
         // Two shapes are reconciled here, on EVERY table named refresh_tokens
         // in whatever schema it lives (a database provisioned by an older era

package/src/auth/services.ts

@@ -54,25 +54,6 @@ function getColumn(table: RebasePgTable | undefined, ...keys: string[]): RebaseP
     return key ? table[key] : undefined;
 }
 
-/**
- * The single definition of what an email address looks like in storage.
- *
- * Reads have always folded case; writes did not, and normalising was left to
- * each caller. That asymmetry is only ever one forgotten `.toLowerCase()` away
- * from a row no lookup can find — the account exists, every sign-in path
- * reports no such user, and the byte-exact UNIQUE on the column does not stop a
- * duplicate differing only in case. Applied on both sides here so the guarantee
- * belongs to the repository rather than to its callers' discipline; the
- * `lower(email)` unique index added in `ensureAuthTablesExist` is the database
- * half of the same rule.
- *
- * Whitespace goes too: a trailing space survives the fold and reproduces the
- * problem exactly.
- */
-export function normalizeEmail<T>(email: T): T | string {
-    return typeof email === "string" ? email.trim().toLowerCase() : email;
-}
-
 /**
  * PostgreSQL implementation of UserRepository.
  * Handles all user-related database operations using Drizzle ORM.
@@ -203,7 +184,7 @@ export class UserService implements UserRepository {
         const metadataKey = getColumnKey(this.usersTable, "metadata") || "metadata";
 
         if ("id" in data) payload[idKey] = data.id;
-        if ("email" in data) payload[emailKey] = normalizeEmail(data.email);
+        if ("email" in data) payload[emailKey] = data.email;
         if ("passwordHash" in data) payload[passwordHashKey] = data.passwordHash;
         if ("displayName" in data) payload[displayNameKey] = data.displayName;
         if ("photoUrl" in data) payload[photoUrlKey] = data.photoUrl;
@@ -263,7 +244,7 @@ export class UserService implements UserRepository {
     async getUserByEmail(email: string): Promise<UserData | null> {
         const emailCol = getColumn(this.usersTable, "email");
         if (!emailCol) return null;
-        const [row] = await this.db.select().from(this.usersTable).where(eq(emailCol, normalizeEmail(email)));
+        const [row] = await this.db.select().from(this.usersTable).where(eq(emailCol, email.toLowerCase()));
         return row ? this.mapRowToUser(row as Record<string, unknown>) : null;
     }
 

package/src/schema/auth-schema.ts

@@ -1,19 +1,8 @@
-import { pgSchema, pgTable, uuid, timestamp, boolean, jsonb, text, unique, index } from "drizzle-orm/pg-core";
+import { pgSchema, pgTable, varchar, uuid, timestamp, boolean, jsonb, text, unique, index } from "drizzle-orm/pg-core";
 import { relations } from "drizzle-orm";
 
 /**
  * Factory function to dynamically create the auth tables bound to the specified schema names.
- *
- * This module builds queries; it does not create tables. `ensureAuthTablesExist`
- * owns the DDL, which makes everything here a *claim* about a database it cannot
- * enforce — and the claims drifted. Every column below was declared
- * `varchar(n)` while the DDL created it as `TEXT`: `user_agent` as varchar(500),
- * `ip_address` as varchar(45), `secret_encrypted` as varchar(500), every
- * `token_hash` as varchar(255). None of it was true of any database this
- * framework ever provisioned. Harmless at runtime — drizzle does not enforce a
- * length client-side, so the widths only ever misled the next reader — but a
- * schema module that describes columns that do not exist is worse than no
- * schema module. They are `text` here now because they are TEXT there.
  */
 export function createAuthSchema(usersSchemaName = "rebase") {
     const usersSchema = usersSchemaName === "public" ? null : pgSchema(usersSchemaName);
@@ -26,12 +15,12 @@ export function createAuthSchema(usersSchemaName = "rebase") {
      */
     const users = usersTableCreator("users", {
         id: uuid("id").defaultRandom().primaryKey(),
-        email: text("email").notNull().unique(),
-        passwordHash: text("password_hash"), // NULL for OAuth-only users
-        displayName: text("display_name"),
-        photoUrl: text("photo_url"),
+        email: varchar("email", { length: 255 }).notNull().unique(),
+        passwordHash: varchar("password_hash", { length: 255 }), // NULL for OAuth-only users
+        displayName: varchar("display_name", { length: 255 }),
+        photoUrl: varchar("photo_url", { length: 500 }),
         emailVerified: boolean("email_verified").default(false).notNull(),
-        emailVerificationToken: text("email_verification_token"),
+        emailVerificationToken: varchar("email_verification_token", { length: 255 }),
         emailVerificationSentAt: timestamp("email_verification_sent_at"),
         isAnonymous: boolean("is_anonymous").default(false).notNull(),
         roles: text("roles").array().default([]).notNull(),
@@ -76,7 +65,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
         sessionId: uuid("session_id").defaultRandom().notNull(),
-        tokenHash: text("token_hash").notNull().unique(),
+        tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
         revoked: boolean("revoked").default(false).notNull(),
         rotatedAt: timestamp("rotated_at"),
@@ -87,8 +76,8 @@ export function createAuthSchema(usersSchemaName = "rebase") {
          * that rotates immediately after it.
          */
         sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
-        userAgent: text("user_agent"),
-        ipAddress: text("ip_address"),
+        userAgent: varchar("user_agent", { length: 500 }),
+        ipAddress: varchar("ip_address", { length: 45 }),
         createdAt: timestamp("created_at").defaultNow().notNull()
     }, (table) => ({
         sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId)
@@ -100,7 +89,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
     const passwordResetTokens = tableCreator("password_reset_tokens", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-        tokenHash: text("token_hash").notNull().unique(),
+        tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
         usedAt: timestamp("used_at"),
         createdAt: timestamp("created_at").defaultNow().notNull()
@@ -110,7 +99,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
      * App config - key/value store for custom settings
      */
     const appConfig = tableCreator("app_config", {
-        key: text("key").primaryKey(),
+        key: varchar("key", { length: 100 }).primaryKey(),
         value: jsonb("value").notNull(),
         updatedAt: timestamp("updated_at").defaultNow().notNull()
     });
@@ -121,8 +110,8 @@ export function createAuthSchema(usersSchemaName = "rebase") {
     const userIdentities = tableCreator("user_identities", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-        provider: text("provider").notNull(), // e.g. 'google', 'linkedin'
-        providerId: text("provider_id").notNull(),
+        provider: varchar("provider", { length: 50 }).notNull(), // e.g. 'google', 'linkedin'
+        providerId: varchar("provider_id", { length: 255 }).notNull(),
         profileData: jsonb("profile_data"),
         createdAt: timestamp("created_at").defaultNow().notNull(),
         updatedAt: timestamp("updated_at").defaultNow().notNull()
@@ -136,9 +125,9 @@ export function createAuthSchema(usersSchemaName = "rebase") {
     const mfaFactors = tableCreator("mfa_factors", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-        factorType: text("factor_type").notNull(), // 'totp'
-        secretEncrypted: text("secret_encrypted").notNull(),
-        friendlyName: text("friendly_name"),
+        factorType: varchar("factor_type", { length: 20 }).notNull(), // 'totp'
+        secretEncrypted: varchar("secret_encrypted", { length: 500 }).notNull(),
+        friendlyName: varchar("friendly_name", { length: 255 }),
         verified: boolean("verified").default(false).notNull(),
         createdAt: timestamp("created_at").defaultNow().notNull(),
         updatedAt: timestamp("updated_at").defaultNow().notNull()
@@ -152,7 +141,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         factorId: uuid("factor_id").notNull().references(() => mfaFactors.id, { onDelete: "cascade" }),
         createdAt: timestamp("created_at").defaultNow().notNull(),
         verifiedAt: timestamp("verified_at"),
-        ipAddress: text("ip_address"),
+        ipAddress: varchar("ip_address", { length: 45 }),
         expiresAt: timestamp("expires_at").notNull()
     });
 
@@ -162,7 +151,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
     const recoveryCodes = tableCreator("recovery_codes", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-        codeHash: text("code_hash").notNull(),
+        codeHash: varchar("code_hash", { length: 255 }).notNull(),
         usedAt: timestamp("used_at"),
         createdAt: timestamp("created_at").defaultNow().notNull()
     });
@@ -173,7 +162,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
     const magicLinkTokens = tableCreator("magic_link_tokens", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-        tokenHash: text("token_hash").notNull().unique(),
+        tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
         usedAt: timestamp("used_at"),
         createdAt: timestamp("created_at").defaultNow().notNull()

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,6 +1,6 @@
 import { CollectionConfig, NumberProperty, Property, ResolvedRelation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty, isManyToMany, type ResolvedManyToMany, type ResolvedBelongsTo, type ResolvedForeignKeyOnTarget, hasForeignKeyOnTarget } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/collection-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig, resolveStringColumnLength } from "@rebasepro/common";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
 // --- Helper Functions ---
@@ -98,13 +98,9 @@ const getDrizzleColumn = (propName: string, prop: Property, collection: Collecti
             } else if (stringProp.columnType === "uuid") {
                 columnDefinition = `uuid("${colName}")`;
             } else if (stringProp.columnType === "char") {
-                columnDefinition = `char("${colName}", { length: ${resolveStringColumnLength(stringProp)} })`;
+                columnDefinition = `char("${colName}")`;
             } else if (stringProp.columnType === "varchar") {
-                // The length is not optional decoration: `varchar("col")` with
-                // no length is an UNBOUNDED varchar in Postgres, which is what
-                // this emitted while the DDL generator emitted VARCHAR(255) for
-                // the very same property.
-                columnDefinition = `varchar("${colName}", { length: ${resolveStringColumnLength(stringProp)} })`;
+                columnDefinition = `varchar("${colName}")`;
             } else {
                 // `text` is the default, and the only length-unbounded choice.
                 // Ask for `varchar` explicitly if you want the length constraint.

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,5 +1,5 @@
 import { CollectionConfig, NumberProperty, Property, ResolvedRelation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty, isManyToMany, type ResolvedManyToMany, type ResolvedBelongsTo } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig, resolveStringColumnLength } from "@rebasepro/common";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 
 // --- Helper Functions ---
@@ -103,15 +103,11 @@ export const getSqlColumnType = (propName: string, prop: Property, collection: C
             if (stringProp.isId === "uuid" || stringProp.columnType === "uuid") {
                 return "UUID";
             }
-            // Width comes from `validation.max` when the property states one.
-            // It used to be a hardcoded 255 here and *absent* on the Drizzle
-            // path, so the same property produced a bounded column down one
-            // generator and an unbounded one down the other.
             if (stringProp.columnType === "char") {
-                return `CHAR(${resolveStringColumnLength(stringProp)})`;
+                return "CHAR(255)";
             }
             if (stringProp.columnType === "varchar") {
-                return `VARCHAR(${resolveStringColumnLength(stringProp)})`;
+                return "VARCHAR(255)";
             }
             // `text` is the default. The two generators disagreed here before:
             // this one emitted VARCHAR(255) while the drizzle path emitted a bare