@rebasepro/server-postgres 0.12.1-canary.gf5f1d39 → 0.13.1-canary.g06dbe5b

package/dist/{src-BbFOPJ1S.js → auth-users-columns-CBEOeYqa.js}

@@ -1,8 +1,62 @@
 import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
-import { r as __require, t as __commonJSMin } from "./chunk-DSJWtz9O.js";
-import { a as policy, c as getDeclaredSubcollections, f as getDataSourceCapabilities, g as EntityRelation, h as toCanonicalOp, i as ANONYMOUS_USER_ID, l as isPostgresCollectionConfig, m as REST_TO_CANONICAL, p as NULL_OPS, s as isManyToMany, u as isRelationalCollectionConfig } from "./src-Zqwaw3P5.js";
+import { l as __require, s as __commonJSMin } from "./connection-BuZ97wsr.js";
+import { a as policy, i as ANONYMOUS_USER_IDS, r as ANONYMOUS_USER_ID } from "./data_driver-ULAyJEi9.js";
+import { a as rewriteLegacyRlsFunctions, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as NULL_OPS, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as toCanonicalOp, p as REST_TO_CANONICAL, r as RLS_ROLES_SQL, s as getDeclaredSubcollections } from "./src-C_wvdMnl.js";
+import { createHash } from "node:crypto";
+//#region ../types/src/types/entities.ts
+/**
+* Class used to create a reference to a entity in a different path
+*/
+var EntityRelation = class {
+	__type = "relation";
+	/**
+	* ID of the entity
+	*/
+	id;
+	/**
+	* A string representing the path of the referenced document (relative
+	* to the root of the database).
+	*/
+	path;
+	/**
+	* Pre-fetched data payload to eliminate N+1 queries.
+	* When present, clients can use this directly instead of fetching.
+	*/
+	data;
+	constructor(id, path, data) {
+		this.id = id;
+		this.path = path;
+		this.data = data;
+	}
+	get pathWithId() {
+		return `${this.path}/${this.id}`;
+	}
+	isEntityReference() {
+		return false;
+	}
+	isEntityRelation() {
+		return true;
+	}
+};
+var Vector = class {
+	value;
+	constructor(value) {
+		this.value = value;
+	}
+};
+//#endregion
+//#region ../types/src/types/relations.ts
+/** @group Models */
+function hasForeignKeyOnTarget(relation) {
+	return relation.kind === "hasOne" || relation.kind === "hasMany";
+}
+/** @group Models */
+function isManyToMany(relation) {
+	return relation.kind === "manyToMany";
+}
+//#endregion
 //#region ../common/src/util/common.ts
 var DEFAULT_ONE_OF_TYPE = "type";
 var DEFAULT_ONE_OF_VALUE = "value";
@@ -954,6 +1008,35 @@ function camelCase(str) {
 	});
 })))();
 /**
+* Segments that reach the prototype chain rather than a property of the object.
+*
+* The twin of this function in `@rebasepro/forms` could be made to write onto
+* `Object.prototype` through a path of `__proto__.x`. This copy survives the
+* write by accident — its `clone` always spreads into a fresh object, while the
+* form engine's has a "preserve class instances" branch that hands back
+* `Object.prototype` itself — but `getIn` still *reads* through the chain, and
+* handing back `Object.prototype` is how a polluted value is read out again.
+*
+* Closed on both sides here, so the two implementations agree.
+*/
+var UNSAFE_PATH_SEGMENTS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+/**
+* Whether writing this single key with `obj[key] = …` would reach the prototype
+* chain instead of creating a property.
+*
+* The single-key counterpart of {@link pathTraversesPrototype}, for the many
+* places that copy an object one key at a time. `JSON.parse` creates
+* `__proto__` as an *own* property, so it survives `hasOwnProperty` — and then
+* `target[key] = value` invokes the setter and replaces the target's prototype.
+*/
+function isPrototypePollutingKey(key) {
+	return UNSAFE_PATH_SEGMENTS.has(key);
+}
+/**
 * Deep clone a value, preserving function references and class instances.
 * Unlike structuredClone, this handles objects that contain functions
 * (e.g. CollectionConfig with target(), childCollections(), callbacks).
@@ -1014,16 +1097,12 @@ function removeFunctions(o) {
 	if (o === void 0) return void 0;
 	if (o === null) return null;
 	if (typeof o === "object") {
-		if (Array.isArray(o)) return o.map((v) => removeFunctions(v));
+		if (Array.isArray(o)) return o.filter((v) => typeof v !== "function").map((v) => removeFunctions(v));
 		if (!isPlainObject(o)) return o;
-		return Object.entries(o).filter(([_, value]) => typeof value !== "function").map(([key, value]) => {
-			if (Array.isArray(value)) return { [key]: value.map((v) => removeFunctions(v)) };
-			else if (typeof value === "object") return { [key]: removeFunctions(value) };
-			else return { [key]: value };
-		}).reduce((a, b) => ({
-			...a,
-			...b
-		}), {});
+		return Object.entries(o).filter(([_, value]) => typeof value !== "function").reduce((acc, [key, value]) => {
+			acc[key] = removeFunctions(value);
+			return acc;
+		}, {});
 	}
 	return o;
 }
@@ -1162,11 +1241,101 @@ function getPolicyNamesForRule(rule, tableName) {
 	return ops.map((op, opIdx) => rule.name ? ops.length > 1 ? `${rule.name}_${op}` : rule.name : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`);
 }
 //#endregion
+//#region ../utils/src/plurals.ts
+/**
+* Returns the singular of an English word.
+*
+* @param {string} word
+* @param {number} [amount]
+* @returns {string}
+*/
+function singular(word, amount) {
+	if (amount !== void 0 && amount !== 1) return word;
+	const singulars = {
+		"(quiz)zes$": "$1",
+		"(matr)ices$": "$1ix",
+		"(vert|ind)ices$": "$1ex",
+		"^(ox)en$": "$1",
+		"(alias)es$": "$1",
+		"(octop|vir)i$": "$1us",
+		"(cris|ax|test)es$": "$1is",
+		"(shoe)s$": "$1",
+		"(o)es$": "$1",
+		"(bus)es$": "$1",
+		"([m|l])ice$": "$1ouse",
+		"(x|ch|ss|sh)es$": "$1",
+		"(m)ovies$": "$1ovie",
+		"(s)eries$": "$1eries",
+		"([^aeiouy]|qu)ies$": "$1y",
+		"([lr])ves$": "$1f",
+		"(tive)s$": "$1",
+		"(hive)s$": "$1",
+		"(li|wi|kni)ves$": "$1fe",
+		"(shea|loa|lea|thie)ves$": "$1f",
+		"(^analy)ses$": "$1sis",
+		"((a)naly|(b)a|(d)iagno|(p)arenthe|(p)rogno|(s)ynop|(t)he)ses$": "$1$2sis",
+		"([ti])a$": "$1um",
+		"(n)ews$": "$1ews",
+		"(h|bl)ouses$": "$1ouse",
+		"(corpse)s$": "$1",
+		"(us)es$": "$1",
+		s$: ""
+	};
+	const irregular = {
+		move: "moves",
+		foot: "feet",
+		goose: "geese",
+		sex: "sexes",
+		child: "children",
+		man: "men",
+		tooth: "teeth",
+		person: "people"
+	};
+	if ([
+		"sheep",
+		"fish",
+		"deer",
+		"moose",
+		"series",
+		"species",
+		"money",
+		"rice",
+		"information",
+		"equipment",
+		"bison",
+		"cod",
+		"offspring",
+		"pike",
+		"salmon",
+		"shrimp",
+		"swine",
+		"trout",
+		"aircraft",
+		"hovercraft",
+		"spacecraft",
+		"sugar",
+		"tuna",
+		"you",
+		"wood"
+	].indexOf(word.toLowerCase()) >= 0) return word;
+	for (const w in irregular) {
+		const pattern = new RegExp(`${irregular[w]}$`, "i");
+		if (pattern.test(word)) return word.replace(pattern, w);
+	}
+	for (const reg in singulars) {
+		const pattern = new RegExp(reg, "i");
+		if (pattern.test(word)) return word.replace(pattern, singulars[reg]);
+	}
+	return word;
+}
+//#endregion
 //#region ../utils/src/names.ts
 /**
 * Generates a foreign key column name from a given string, typically a collection slug or name.
-* It converts the name to snake_case, attempts to singularize it by removing a trailing 's'
-* (a common convention for collection names), and appends '_id'.
+* It singularizes the name, converts it to snake_case and appends '_id'.
+*
+* Singularization runs *before* snake-casing so that acronyms survive: `toSnakeCase`
+* splits on every capital, which turned "URLs" into "ur_ls" and then "ur_l_id".
 *
 * @param name The base name to convert to a foreign key.
 * @returns A foreign key name in the format 'singular_name_id'.
@@ -1176,8 +1345,8 @@ function getPolicyNamesForRule(rule, tableName) {
 * generateForeignKeyName("users")
 *
 * @example
-* // returns "post_id"
-* generateForeignKeyName("posts")
+* // returns "category_id"
+* generateForeignKeyName("categories")
 *
 * @example
 * // returns "product_id"
@@ -1185,8 +1354,63 @@ function getPolicyNamesForRule(rule, tableName) {
 *
 */
 function generateForeignKeyName(name) {
-	const snakeCaseName = toSnakeCase(name);
-	return `${snakeCaseName.endsWith("s") ? snakeCaseName.slice(0, -1) : snakeCaseName}_id`;
+	return `${toSnakeCase(singularizeForKey(name))}_id`;
+}
+/**
+* `singular()` handles real English plurals, but its final catch-all rule strips
+* any trailing "s", which mangles words that only look plural. Guard the two
+* cases that produce a column name nobody would recognise:
+*
+* - a double "s" ending is never a plural marker ("address", "class", "process"),
+*   so stripping it yields "addres";
+* - a name that singularizes to nothing (the literal "s") would yield "_id".
+*/
+function singularizeForKey(name) {
+	if (/ss$/i.test(name)) return name;
+	const result = singular(name);
+	return result.length > 0 ? result : name;
+}
+/**
+* What `generateForeignKeyName` returned before it learned to singularize:
+* snake-case the name, then chop one trailing "s".
+*
+* This is here to be *detected*, never to be generated. A database provisioned
+* under the old rule carries `categorie_id`, `addresse_id`, `children_id` or
+* `ur_l_id` where the current rule expects `category_id`, `address_id`,
+* `child_id` and `url_id` — and the boot-time schema ensure is additive, so it
+* would create the new column empty beside the populated old one and leave the
+* relation reading nothing. No error, no missing table: the failure is silent,
+* which is the only reason this function still exists.
+*
+* `ensureCollectionSchema` calls it to recognise that shape and say so.
+* Returns the same string as `generateForeignKeyName` for every regular plural,
+* so a caller can compare the two and act only when they differ.
+*/
+function legacyForeignKeyName(name) {
+	const snake = toSnakeCase(name);
+	return `${snake.endsWith("s") ? snake.slice(0, -1) : snake}_id`;
+}
+/**
+* Truncate an identifier to what Postgres will actually store.
+*
+* Postgres silently truncates identifiers at NAMEDATALEN-1 = 63 **bytes**, so a
+* name generated longer than that is not the name the database ends up holding.
+* Anything that later looks the object up by the name it generated then misses.
+*
+* Byte length, not string length: NAMEDATALEN is a byte bound, and a multi-byte
+* character straddling the boundary would be cut mid-sequence by `slice(0, 63)`.
+*
+* `TextEncoder` rather than `Buffer`, which is not a matter of taste: `Buffer`
+* is a Node global, and this package is imported by browser-facing ones. It
+* typechecked only where `@types/node` happened to be in scope, so
+* `packages/codegen` — whose tsconfig is `lib: ["ESNext", "dom"]` — could not
+* compile the file at all, and both of its suites failed to run. `TextEncoder`
+* and `TextDecoder` are standard in both runtimes and need no ambient types.
+*/
+function toPostgresIdentifier(name) {
+	const bytes = new TextEncoder().encode(name);
+	if (bytes.byteLength <= 63) return name;
+	return new TextDecoder("utf-8").decode(bytes.subarray(0, 63)).replace(/�+$/, "");
 }
 //#endregion
 //#region ../common/src/util/entities.ts
@@ -1211,10 +1435,21 @@ function updateDateAutoValues({ inputValues, properties, status, timestampNowVal
 * have `id` and `path` fields — these are relation-shaped objects from
 * edge cases in the data pipeline (REST fallback, stale cache, custom data source).
 *
+* When `targetPath` is given, also accepts a bare id. A relation column is a
+* foreign key, and the REST layer returns it as the scalar it is; only some
+* fetch paths hydrate it into an object. Which form a caller sees therefore
+* depends on how the row was loaded, and a caller that only accepted objects
+* reported half of its own data as a type error. The declared target is the
+* missing half: with it, an id is a relation that has not been fetched yet.
+*
 * Returns null if the value cannot be coerced.
 */
-function normalizeToEntityRelation(value, propertyType) {
+function normalizeToEntityRelation(value, propertyType, targetPath) {
 	if (value instanceof EntityRelation) return value;
+	if (targetPath && (typeof value === "string" || typeof value === "number")) {
+		if (value === "") return null;
+		return new EntityRelation(value, targetPath);
+	}
 	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
 	const obj = value;
 	if (!(obj.__type === "relation" || obj.__type === "reference" || typeof obj.isEntityRelation === "function" && obj.isEntityRelation() || typeof obj.isEntityReference === "function" && obj.isEntityReference() || propertyType === "relation" && typeof obj.id !== "undefined" && typeof obj.path === "string")) return null;
@@ -1286,6 +1521,53 @@ function createRelationRefWithData(id, path, data) {
 		data
 	};
 }
+//#endregion
+//#region ../common/src/util/collections.ts
+/**
+* A copy of `collections` ordered by slug.
+*
+* Every generator that turns collections into a file is order-dependent, and
+* every one of them is compared against its own output — `rebase doctor`
+* regenerates in memory and diffs, `generate-sdk && git diff --exit-code` gates
+* CI. While only the *writers* sorted, a project whose `readdirSync` order
+* differed from its slug order was reported permanently out of date, and the
+* fix the message printed rewrote the file in the order it was already in. The
+* generators sort themselves now, so no caller can get this wrong.
+*
+* A slug-less collection is left to the generator's own validation, which names
+* the offending collection; sorting must not throw first.
+*/
+function sortCollectionsBySlug(collections) {
+	return [...collections].sort((a, b) => (a.slug ?? "").localeCompare(b.slug ?? ""));
+}
+/** The eight-four-four-four-twelve shape of a UUID, any version. */
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Whether one address part can be a value of the column it addresses. */
+function partIsAddressable(part, pk) {
+	if (pk.isUUID) return UUID_PATTERN.test(String(part));
+	if (pk.type === "number") return typeof part === "number" ? Number.isFinite(part) : !isNaN(parseInt(String(part), 10));
+	return true;
+}
+/**
+* Whether an address could name a row at all, before asking the database.
+*
+* A `uuid` column cannot hold `"new"`, and an `integer` column cannot hold
+* `"abc"` — so the answer to "which row is this" is "none", and that is a 404,
+* not a failure. Postgres cannot say so politely: the comparison never runs, it
+* raises `22P02` and aborts the enclosing transaction, after which every
+* further statement returns the far less helpful `25P02`.
+*
+* `isUUID` must come from the column, not from `isId: "uuid"` in a config: the
+* config is a claim about a key, and a `text` column that holds ids of some
+* other shape is a working app this must not start rejecting.
+*/
+function isAddressableId(idValue, primaryKeys) {
+	if (primaryKeys.length === 0) return false;
+	if (primaryKeys.length === 1) return partIsAddressable(idValue, primaryKeys[0]);
+	const parts = String(idValue).split(":::");
+	if (parts.length !== primaryKeys.length) return false;
+	return parts.every((part, i) => partIsAddressable(part, primaryKeys[i]));
+}
 /**
 * Derive a row's address from its key columns.
 *
@@ -1426,8 +1708,7 @@ function enumToObjectEntries(enumValues) {
 function resolveRelation(relation, sourceCollection, propertyKey) {
 	const target = relation.target;
 	if (typeof target !== "function") throw new Error(`Relation${relation.relationName ? ` '${relation.relationName}'` : ""} on '${sourceCollection.slug}' has no \`target\`. Give it a thunk: \`target: () => otherCollection\`.`);
-	const targetCollection = target();
-	if (!targetCollection?.slug) throw new Error(`Relation${relation.relationName ? ` '${relation.relationName}'` : ""} on '${sourceCollection.slug}' has a \`target\` that did not resolve to a collection.`);
+	const targetCollection = callTarget(relation, sourceCollection, propertyKey, target);
 	const relationName = relation.relationName ?? propertyKey ?? toSnakeCase(targetCollection.slug);
 	const shared = {
 		relationName,
@@ -1454,7 +1735,8 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 			cardinality: "one",
 			writable: true,
 			shared: false,
-			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName)
+			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName),
+			sourceKey: relation.sourceKey
 		};
 		case "hasMany": return {
 			...shared,
@@ -1462,7 +1744,8 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 			cardinality: "many",
 			writable: true,
 			shared: false,
-			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName)
+			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName),
+			sourceKey: relation.sourceKey
 		};
 		case "manyToMany": {
 			const sourceTable = getTableName(sourceCollection);
@@ -1491,6 +1774,43 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 		default: throw new Error(`Unknown relation kind: ${JSON.stringify(relation)}`);
 	}
 }
+/** How this relation is addressed in an error message, before it has a resolved name. */
+function describe(relation, sourceCollection, propertyKey) {
+	const name = relation.relationName ?? propertyKey;
+	return `Relation${name ? ` '${name}'` : ""} on '${sourceCollection.slug}'`;
+}
+/**
+* Call the `target` thunk, and translate the two ways an import cycle breaks it
+* into an error that names the cause.
+*
+* The thunk exists to defer the reference until every module has finished
+* evaluating, and for a cycle that closes at import time it does. What it cannot
+* defer is a cycle that leaves the binding permanently unusable, and there are
+* two shapes of that:
+*
+*  - **ESM/TDZ.** `const` and `class` bindings in a not-yet-evaluated module are
+*    in the temporal dead zone, so reading one throws `ReferenceError: x is not
+*    defined`. The stack points at the thunk — a one-line arrow function that is
+*    obviously fine — and says nothing about the cycle that made it throw.
+*  - **CJS interop.** The half-initialised module object has no `default` yet,
+*    the import resolves to `undefined`, and the thunk returns it without
+*    complaint. That one used to surface here as "did not resolve to a
+*    collection", which is true and unhelpful.
+*
+* Both mean the same thing, and the fix for both is the same: break the cycle,
+* or move the relation into the collection that does not close it.
+*/
+function callTarget(relation, sourceCollection, propertyKey, target) {
+	let targetCollection;
+	try {
+		targetCollection = target();
+	} catch (error) {
+		if (error instanceof ReferenceError) throw new Error(`${describe(relation, sourceCollection, propertyKey)} targets a collection that is not initialized yet — almost always an import cycle between the two collection files. Break the cycle (move the shared piece into a third module, or import the target lazily) so the target's module finishes evaluating before the registry is built.`, { cause: error });
+		throw error;
+	}
+	if (!targetCollection?.slug) throw new Error(`${describe(relation, sourceCollection, propertyKey)} has a \`target\` that resolved to ${targetCollection === void 0 ? "`undefined`" : "something that is not a collection"}. ` + (targetCollection === void 0 ? "Under CommonJS interop an import cycle resolves the default import to `undefined`, so check whether this collection and its target import each other. Otherwise the thunk is returning the wrong value — it must return the collection itself, not a promise or a module." : "The thunk must return a collection config with a `slug`."));
+	return targetCollection;
+}
 //#endregion
 //#region ../common/src/util/relations.ts
 /**
@@ -1686,9 +2006,9 @@ function isKeywordAt(upper, i, keyword) {
 *
 * This used to be `sql.split(/ AND /i)`, which tore subqueries in half: the
 * `AND` inside
-*   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = auth.uid())`
+*   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = rebase.uid())`
 * split the expression, and re-emitting the halves produced
-*   `(EXISTS (...) AND m.user_id = auth.uid())`
+*   `(EXISTS (...) AND m.user_id = rebase.uid())`
 * where `m` is no longer in scope — SQL that Postgres rejects outright with
 * "missing FROM-clause entry for table". Returning null instead keeps such a
 * clause as a `raw` expression, which round-trips verbatim.
@@ -1762,15 +2082,15 @@ function stripOuterParens(sql) {
 	}
 }
 function sqlToPolicy(sql) {
-	const trimmed = stripOuterParens(sql.trim());
+	const trimmed = stripOuterParens(rewriteLegacyRlsFunctions(sql).trim());
 	if (trimmed.toLowerCase() === "true") return policy.true();
 	if (trimmed.toLowerCase() === "false") return policy.false();
-	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
+	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
 	if (overlapMatch) {
 		const roles = overlapMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
 		return policy.rolesOverlap(roles);
 	}
-	const containMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
+	const containMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
 	if (containMatch) {
 		const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
 		return policy.rolesContain(roles);
@@ -1786,10 +2106,10 @@ function sqlToPolicy(sql) {
 		const right = parseOperand(rightStr.trim());
 		if (left && right) return policy.compare(left, op === "=" ? "eq" : "neq", right);
 	}
-	return policy.raw(sql);
+	return policy.raw(trimmed);
 }
 /**
-* Literals from other BaaS platforms that people compare `auth.uid()` against
+* Literals from other BaaS platforms that people compare `rebase.uid()` against
 * out of habit. Mirrors the driver's `FOREIGN_CONVENTION_ROLES` guard on
 * `pgRoles`, one surface over: the same muscle memory inside a `using:` string
 * is the more dangerous spelling, because it inverts a rule instead of
@@ -1800,18 +2120,30 @@ var FOREIGN_CONVENTION_UIDS = {
 	authenticated: "Supabase",
 	service_role: "Supabase"
 };
-/** `auth.uid() IS NOT NULL` in raw SQL, the clause that is always true. */
-var UID_NOT_NULL = /auth\.uid\(\)\s+IS\s+NOT\s+NULL/i;
+/**
+* `rebase.uid() IS NOT NULL` in raw SQL, the clause that is always true.
+*
+* Both schema spellings, because this runs over policy bodies read back from a
+* database, and one migrated by a pre-1.0 release still holds `auth.uid()`.
+* A security check that stops recognising a dangerous clause because the
+* framework renamed a function is a check that silently turns off.
+*/
+var UID_NOT_NULL = /\b(?:rebase|auth)\.uid\(\)\s+IS\s+NOT\s+NULL/i;
 /**
 * Find clauses that read as "signed-in users only" but admit anonymous callers.
 *
-* Both spellings come from the same place — Supabase, where `auth.uid()` really
-* is NULL for an anonymous request. Rebase substitutes
+* Both spellings come from the same place — Supabase, where its own `auth.uid()`
+* really is NULL for an anonymous request. Rebase substitutes
 * {@link ANONYMOUS_USER_ID} instead (a blank id would read back as NULL, which
 * is how the trusted *server* context is recognised), so:
 *
-*  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
-*  - `auth.uid() != 'anon'` compares against a string no caller ever has.
+*  - `rebase.uid() IS NOT NULL` is a tautology on the user path, and
+*  - `rebase.uid() != 'anon'` excludes one spelling of anonymous and admits the
+*    other. This one is not hypothetical and was not only a foreign habit:
+*    rebase's own request path reported `'anon'` while everything that compiled
+*    or checked a policy used `'anonymous'`, so whichever literal an author
+*    picked, half the anonymous callers walked through. See
+*    {@link ANONYMOUS_USER_IDS}.
 *
 * Either one turns a lockdown into a full grant, and neither looks wrong. No
 * real user id is ever one of these literals, and a user-context request is
@@ -1838,7 +2170,7 @@ function findAnonymousGrants(expr) {
 				if (UID_NOT_NULL.test(e.sql)) found.push({
 					pattern: "uid-not-null",
 					detail: e.sql,
-					explanation: `\`auth.uid() IS NOT NULL\` is true for every request that came from a client, including anonymous ones — they carry '${ANONYMOUS_USER_ID}', not NULL. Use \`condition: policy.authenticated()\` to mean "signed in".`
+					explanation: `\`rebase.uid() IS NOT NULL\` is true for every request that came from a client, including anonymous ones — they carry '${ANONYMOUS_USER_ID}', not NULL. Use \`condition: policy.authenticated()\` to mean "signed in".`
 				});
 				return;
 			case "compare": {
@@ -1849,7 +2181,7 @@ function findAnonymousGrants(expr) {
 				found.push({
 					pattern: "foreign-uid-literal",
 					detail: literal.value,
-					explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for every caller. Use \`condition: policy.authenticated()\` to mean "signed in".`
+					explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for every caller. Use \`condition: policy.authenticated()\` to mean "signed in" — it compiles to NOT IN (${ANONYMOUS_USER_IDS.map((v) => `'${v}'`).join(", ")}), covering every spelling rebase has reported rather than whichever one you remember.`
 				});
 				return;
 			}
@@ -1860,12 +2192,43 @@ function findAnonymousGrants(expr) {
 	return found;
 }
 function parseOperand(str) {
-	if (/current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return policy.authUid();
-	const stringMatch = str.match(/^'(.+)'$/);
-	if (stringMatch) return policy.literal(stringMatch[1]);
-	if (/^\w+$/.test(str)) return policy.field(str);
+	if (/^current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)$/i.test(str) || /^rebase\.uid\(\)$/i.test(str)) return policy.authUid();
+	const literal = parseSingleQuoted(str);
+	if (literal !== null) return policy.literal(literal);
+	if (/^-?\d+$/.test(str)) return policy.literal(Number(str));
+	if (/^-?\d*\.\d+$/.test(str)) return policy.literal(Number(str));
+	if (/^true$/i.test(str)) return policy.literal(true);
+	if (/^false$/i.test(str)) return policy.literal(false);
+	if (/^null$/i.test(str)) return policy.literal(null);
+	if (/^\w+$/.test(str) && toSnakeCase(str) !== "") return policy.field(str);
 	return null;
 }
+/**
+* Decode a single-quoted SQL literal, or null when `str` is not exactly one.
+*
+* Rejecting is as important as decoding: `'a' = 'b'` is two literals and an
+* operator, not one literal whose body contains a quote, and a regex anchored
+* on the outer quotes would happily read it as the latter. Every interior quote
+* must therefore be part of a `''` pair.
+*/
+function parseSingleQuoted(str) {
+	if (str.length < 2 || !str.startsWith("'") || !str.endsWith("'")) return null;
+	const body = str.slice(1, -1);
+	let out = "";
+	for (let i = 0; i < body.length; i++) {
+		if (body[i] !== "'") {
+			out += body[i];
+			continue;
+		}
+		if (body[i + 1] === "'") {
+			out += "'";
+			i++;
+			continue;
+		}
+		return null;
+	}
+	return out;
+}
 //#endregion
 //#region ../common/src/util/policy/securityRuleToConditions.ts
 /**
@@ -1942,12 +2305,12 @@ function compile(expr, scope) {
 			const rightSql = castForAuthUid(expr.right, operandToSql(expr.right, scope), expr.left);
 			return `${leftSql} ${COMPARE_SQL[expr.op]} ${rightSql}`;
 		}
-		case "rolesOverlap": return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
-		case "rolesContain": return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
-		case "authenticated": return `auth.uid() IS NOT NULL AND auth.uid() <> ${quoteLiteral(ANONYMOUS_USER_ID)}`;
-		case "serverContext": return "auth.uid() IS NULL";
+		case "rolesOverlap": return `string_to_array(${RLS_ROLES_SQL}, ',') && ${rolesArraySql(expr.roles)}`;
+		case "rolesContain": return `string_to_array(${RLS_ROLES_SQL}, ',') @> ${rolesArraySql(expr.roles)}`;
+		case "authenticated": return `${RLS_UID_SQL} IS NOT NULL AND ${RLS_UID_SQL} NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
+		case "serverContext": return `${RLS_UID_SQL} IS NULL`;
 		case "existsIn": return compileExistsIn(expr, scope);
-		case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
+		case "raw": return rewriteLegacyRlsFunctions(expr.sql).replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
 	}
 }
 /**
@@ -1984,8 +2347,8 @@ function operandToSql(operand, scope) {
 		case "field": return `${scope.fieldPrefix}${resolveColumnName(operand.name, scope.fieldCollection)}`;
 		case "outerField": return `${scope.outerPrefix}${resolveColumnName(operand.name, scope.outerCollection)}`;
 		case "literal": return quoteLiteral(operand.value);
-		case "authUid": return "auth.uid()";
-		case "authRoles": return "string_to_array(auth.roles(), ',')";
+		case "authUid": return RLS_UID_SQL;
+		case "authRoles": return `string_to_array(${RLS_ROLES_SQL}, ',')`;
 	}
 }
 /**
@@ -2016,75 +2379,6 @@ function rolesArraySql(roles) {
 	return `ARRAY[${[...roles].sort().map((r) => `'${r}'`).join(",")}]`;
 }
 //#endregion
-//#region ../common/src/util/callbacks.ts
-/**
-* Helper function to recursively check if there are any callbacks in the properties.
-*/
-function hasPropertyCallbacks(properties, callbackName) {
-	if (!properties) return false;
-	for (const property of Object.values(properties)) {
-		if (property.callbacks?.[callbackName]) return true;
-		if (property.type === "map" && property.properties) {
-			if (hasPropertyCallbacks(property.properties, callbackName)) return true;
-		} else if (property.type === "array" && property.of) {
-			const ofs = Array.isArray(property.of) ? property.of : [property.of];
-			for (const of of ofs) {
-				if (of.callbacks?.[callbackName]) return true;
-				if (of.type === "map" && of.properties && hasPropertyCallbacks(of.properties, callbackName)) return true;
-			}
-		}
-	}
-	return false;
-}
-/**
-* Recursively process properties to apply field-level hooks.
-*/
-async function processProperties(properties, values, previousValues, propsContext, callbackName) {
-	if (!values || typeof values !== "object") return values;
-	const result = { ...values };
-	for (const [key, property] of Object.entries(properties)) {
-		if (result[key] === void 0) continue;
-		let currentValue = result[key];
-		const previousValue = previousValues?.[key];
-		if (property.type === "array" && Array.isArray(currentValue)) {
-			if (property.of && !Array.isArray(property.of)) currentValue = await Promise.all(currentValue.map(async (item, index) => {
-				const prevItem = Array.isArray(previousValue) ? previousValue[index] : void 0;
-				return (await processProperties({ "_tmp": property.of }, { "_tmp": item }, { "_tmp": prevItem }, propsContext, callbackName))["_tmp"];
-			}));
-		} else if (property.type === "map" && property.properties && typeof currentValue === "object") currentValue = await processProperties(property.properties, currentValue, previousValue ?? {}, propsContext, callbackName);
-		if (property.callbacks?.[callbackName]) {
-			const cbRes = await Promise.resolve(property.callbacks[callbackName]({
-				...propsContext,
-				value: currentValue,
-				previousValue
-			}));
-			if (cbRes !== void 0) currentValue = cbRes;
-		}
-		result[key] = currentValue;
-	}
-	return result;
-}
-/**
-* Helper function to extract field-level PropertyCallbacks from a properties schema
-* and wrap them into an CollectionCallbacks object recursively.
-*/
-var buildPropertyCallbacks = (properties) => {
-	if (!properties) return void 0;
-	const propertyCallbacks = {};
-	if (hasPropertyCallbacks(properties, "afterRead")) propertyCallbacks.afterRead = async (props) => {
-		const row = props.row;
-		const processedValues = await processProperties(properties, row, row, props, "afterRead");
-		return {
-			...props.row,
-			...processedValues
-		};
-	};
-	if (hasPropertyCallbacks(properties, "beforeSave")) propertyCallbacks.beforeSave = async (props) => {
-		return await processProperties(properties, props.values, props.previousValues ?? {}, props, "beforeSave");
-	};
-	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
-};
-//#endregion
 //#region ../common/src/util/auth-default-policies.ts
 /**
 * Default RLS policies injected by the schema generator.
@@ -2092,8 +2386,14 @@ var buildPropertyCallbacks = (properties) => {
 * Rebase's enforcement model is unified: authenticated (user-context) requests
 * run under the restricted `rebase_user` role, so Postgres RLS binds *every*
 * statement — reads and writes. A collection's `securityRules` are the whole
-* authorization model. The server context (auth flows, migrations,
-* `dataAsAdmin`) runs as the owner and bypasses RLS.
+* authorization model. The server context (auth flows, migrations, raw
+* `rebase.sql`) runs as the owner and bypasses RLS.
+*
+* `rebase.dataAsAdmin` is **not** in that set, despite the name: it is scoped as
+* `{ uid: "service", roles: ["admin"] }`, so it runs as `rebase_user` like any
+* other caller and clears the baseline below through the *admin* arm, not the
+* server arm. Which is why `disableDefaultPolicies` plus a lone
+* `policy.serverContext()` rule locks it out too.
 *
 * Because RLS default-denies, every collection is **locked by default**: with
 * no rules, only the server context and admins can touch it. The generator
@@ -2134,7 +2434,7 @@ var DEFAULT_GUARDED_OPS = [
 	"delete"
 ];
 /** Whether a collection is flagged as an authentication collection. */
-function isAuthCollection(collection) {
+function isAuthCollection$1(collection) {
 	const auth = collection.auth;
 	return auth === true || typeof auth === "object" && auth?.enabled === true;
 }
@@ -2167,7 +2467,7 @@ function getEffectiveSecurityRules(collection) {
 		condition: SERVER_OR_ADMIN_EXPR$1,
 		check: SERVER_OR_ADMIN_EXPR$1
 	});
-	if (isAuthCollection(collection)) {
+	if (isAuthCollection$1(collection)) {
 		injected.push({
 			name: `${tableName}_default_self_read`,
 			operations: ["select"],
@@ -2659,10 +2959,27 @@ function getJunctionSecurityRules(spec) {
 	});
 })))();
 /**
-* Apply PropertyConditions to a resolved property, evaluating all JSON Logic rules.
+* How wide a `varchar`/`char` column should be for a given property.
+*
+* One definition, three call sites, because they used to disagree. For the same
+* `columnType: "varchar"` property the DDL generator emitted `VARCHAR(255)`
+* while the Drizzle generator emitted a bare `varchar("col")` — which Postgres
+* reads as *unbounded* — so which of the two you ran decided whether the column
+* had a limit at all. Introspection then dropped the length entirely, so reading
+* an existing `character varying(500)` column back and regenerating it produced
+* a `VARCHAR(255)`: a silent narrowing of a column with data already in it.
+*
+* `validation.max` is the property's own statement about how long the value may
+* be, so it is the only sensible source for the column's width — and it keeps
+* the constraint the database enforces in step with the one the app enforces,
+* rather than inventing a second, different limit underneath it.
 */
+function resolveStringColumnLength(prop) {
+	const max = prop.validation?.max;
+	return typeof max === "number" && Number.isInteger(max) && max > 0 ? max : 255;
+}
 //#endregion
-//#region ../../node_modules/.pnpm/fast-equals@6.0.0/node_modules/fast-equals/dist/es/index.mjs
+//#region ../../node_modules/.pnpm/fast-equals@6.0.2/node_modules/fast-equals/dist/es/index.mjs
 var { getOwnPropertyNames, getOwnPropertySymbols } = Object;
 var { hasOwnProperty } = Object.prototype;
 /**
@@ -2698,7 +3015,8 @@ function createIsCircular(areItemsEqual) {
 * not enumerable and symbol properties.
 */
 function getStrictProperties(object) {
-	return getOwnPropertyNames(object).concat(getOwnPropertySymbols(object));
+	const symbols = getOwnPropertySymbols(object);
+	return symbols.length ? getOwnPropertyNames(object).concat(symbols) : getOwnPropertyNames(object);
 }
 /**
 * Whether the object contains the property passed as an own property.
@@ -2771,7 +3089,7 @@ function areMapsEqual(a, b, state) {
 	const size = a.size;
 	if (size !== b.size) return false;
 	if (!size) return true;
-	const matchedIndices = new Array(size);
+	const matchedIndices = new Uint8Array(size);
 	const aIterable = a.entries();
 	let aResult;
 	let bResult;
@@ -2779,7 +3097,7 @@ function areMapsEqual(a, b, state) {
 	while (aResult = aIterable.next()) {
 		if (aResult.done) break;
 		const bIterable = b.entries();
-		let hasMatch = false;
+		let hasMatch = 0;
 		let matchIndex = 0;
 		while (bResult = bIterable.next()) {
 			if (bResult.done) break;
@@ -2790,7 +3108,7 @@ function areMapsEqual(a, b, state) {
 			const aEntry = aResult.value;
 			const bEntry = bResult.value;
 			if (state.equals(aEntry[0], bEntry[0], index, matchIndex, a, b, state) && state.equals(aEntry[1], bEntry[1], aEntry[0], bEntry[0], a, b, state)) {
-				hasMatch = matchedIndices[matchIndex] = true;
+				hasMatch = matchedIndices[matchIndex] = 1;
 				break;
 			}
 			matchIndex++;
@@ -2848,19 +3166,19 @@ function areSetsEqual(a, b, state) {
 	const size = a.size;
 	if (size !== b.size) return false;
 	if (!size) return true;
-	const matchedIndices = new Array(size);
+	const matchedIndices = new Uint8Array(size);
 	const aIterable = a.values();
 	let aResult;
 	let bResult;
 	while (aResult = aIterable.next()) {
 		if (aResult.done) break;
 		const bIterable = b.values();
-		let hasMatch = false;
+		let hasMatch = 0;
 		let matchIndex = 0;
 		while (bResult = bIterable.next()) {
 			if (bResult.done) break;
 			if (!matchedIndices[matchIndex] && state.equals(aResult.value, bResult.value, aResult.value, bResult.value, a, b, state)) {
-				hasMatch = matchedIndices[matchIndex] = true;
+				hasMatch = matchedIndices[matchIndex] = 1;
 				break;
 			}
 			matchIndex++;
@@ -2873,8 +3191,8 @@ function areSetsEqual(a, b, state) {
 * Whether the TypedArray instances are equal in value.
 */
 function areTypedArraysEqual(a, b) {
-	let index = a.byteLength;
-	if (b.byteLength !== index || a.byteOffset !== b.byteOffset) return false;
+	let index = a.length;
+	if (b.length !== index || a.byteOffset !== b.byteOffset) return false;
 	while (index-- > 0) if (a[index] !== b[index]) return false;
 	return true;
 }
@@ -3116,6 +3434,46 @@ function resolveDataSource(collection, registry) {
 		capabilities: getDataSourceCapabilities(engine)
 	};
 }
+/**
+* Does a SQL toolchain own this collection's storage?
+*
+* "Owns the storage" means: something generates a table for it, pushes that
+* table to a database, plans its RLS policies, and reports it as drifted when
+* the two disagree. That is true of a Postgres collection and false of a
+* Firestore or MongoDB one, whose documents live in a store Rebase never
+* migrates — and the two were never told apart. Every stage of the SQL
+* toolchain took "the collections" to mean *all* of them, so a Firestore
+* collection declared next to the Postgres ones got a `pgTable` in the
+* generated schema, a `CREATE TABLE` at boot, RLS policies, and a place in the
+* `db push` include list — where its name shielding a same-named real table
+* from Atlas's exclude list is the one that can lose data.
+*
+* The answer is the resolved engine's {@link DataSourceCapabilities}, not a
+* name check: an engine registered through `registerDataSourceCapabilities`
+* gets the same treatment as the built-in ones.
+*
+* Deliberately answers **true** for an engine nobody has heard of. Build-time
+* tooling (the CLI, the schema generator) has no data-source registry to
+* resolve a `dataSource` key against, so an unknown key resolves to an unknown
+* engine — and the cost of the two mistakes is not symmetric. Wrongly
+* including a collection generates a table nothing writes to; wrongly excluding
+* one silently stops generating a table the app is serving from. Declare
+* `engine` on a collection that is not SQL-backed and this is exact.
+*/
+function isRelationalCollection(collection, registry) {
+	return getDataSourceCapabilities(collection?.engine ?? (collection?.dataSource ? resolveDataSource(collection, registry).engine : void 0)).supportsRelations;
+}
+/**
+* The subset of `collections` a SQL toolchain owns — see
+* {@link isRelationalCollection}.
+*
+* Every stage that generates SQL from collections starts by calling this, so
+* the rule lives in one place rather than being re-decided per generator. It
+* keeps the input order.
+*/
+function relationalCollections(collections, registry) {
+	return collections.filter((collection) => isRelationalCollection(collection, registry));
+}
 //#endregion
 //#region ../common/src/collections/CollectionRegistry.ts
 var CollectionRegistry = class {
@@ -3410,8 +3768,24 @@ var QueryBuilder = class {
 	/**
 	* Set a free-text search string if supported by the backend.
 	*/
-	search(searchString) {
+	search(searchString, options) {
 		this.params.searchString = searchString;
+		if (options?.explain !== void 0) this.params.searchExplain = options.explain;
+		return this;
+	}
+	/**
+	* Order rows by nearest-neighbour distance to `vector`, closest first.
+	*
+	* Postgres only, over a property declared as `type: "vector"`. Rows come
+	* back with a `_distance`; `where` filters before the ordering.
+	*/
+	vectorSearch(property, vector, options) {
+		this.params.vectorSearch = {
+			property,
+			vector,
+			...options?.distance !== void 0 && { distance: options.distance },
+			...options?.threshold !== void 0 && { threshold: options.threshold }
+		};
 		return this;
 	}
 	/**
@@ -3468,6 +3842,30 @@ var RebasePaginationError = class RebasePaginationError extends Error {
 		Object.setPrototypeOf(this, RebasePaginationError.prototype);
 	}
 };
+/**
+* Resolve `limit`/`offset`/`page` into the window a read will actually use.
+*
+* Lives here, next to the walk, for the reason at the top of this file: every
+* transport has to mean the same thing by "page two". Four of them did not —
+* the REST layer strode by {@link DEFAULT_LIST_LIMIT}, the local-first
+* evaluator by {@link DEFAULT_PAGE_SIZE}, the in-process accessor by 20, and
+* the published type documented a fourth number. Pages that overlap or skip
+* rows are the mildest of those outcomes.
+*
+* `page` wins over `offset`, as {@link FindParams} documents. `driverOffset`
+* is the value to hand a driver: it stays `undefined` when the caller named no
+* offset, because keyset pagination seeks with a `where` clause and must not
+* look like it is paging by offset.
+*/
+function resolveFindWindow(params) {
+	const limit = params?.limit ?? 50;
+	const offset = params?.page != null ? Math.max(0, (params.page - 1) * limit) : params?.offset ?? 0;
+	return {
+		limit,
+		offset,
+		driverOffset: params?.page != null ? offset : params?.offset
+	};
+}
 function normalizePageSize(raw) {
 	if (raw === void 0 || !Number.isFinite(raw)) return 200;
 	return Math.max(1, Math.floor(raw));
@@ -3587,21 +3985,39 @@ async function collectAllPages(find, params, label = "collection") {
 * metadata, so type coercion is the responsibility of the server-side data
 * driver which has access to the collection schema.
 *
-* Commas inside list values are backslash-escaped (`\,`), and literal
-* backslashes are escaped as `\\`.
+* Structural characters inside a value are backslash-escaped: `,` → `\,`,
+* `(` → `\(`, `)` → `\)`, and a literal backslash as `\\`. Decoding is
+* deliberately conservative — only those four sequences are decoded, so a
+* backslash that arrives unescaped from an older client survives intact.
 *
 * @module
 */
 /**
-* Unescape a single list item from the wire format.
-* `\\` → `\`, `\,` → `,`
+* Unescape a wire-format value.
+*
+* **Conservative**, and deliberately so: only the four sequences
+* {@link escapeWireValue} actually produces are decoded. A backslash followed
+* by anything else is left exactly as it is.
+*
+* This used to consume the backslash before *any* character, which is
+* indistinguishable for anything this codec emitted — it only ever emits those
+* four — but not for input arriving from elsewhere. A client on an older
+* release sends a Windows path or a LIKE pattern with a literal `C:\x`
+* unescaped, and greedy unescaping silently turned it into `C:x`, changing
+* which rows matched. Decoding only what the encoder can produce makes the two
+* directions agree across versions.
 */
-function unescapeListItem(value) {
+function unescapeWireValue(value) {
 	let result = "";
-	for (let i = 0; i < value.length; i++) if (value[i] === "\\" && i + 1 < value.length) {
-		result += value[i + 1];
-		i++;
-	} else result += value[i];
+	for (let i = 0; i < value.length; i++) {
+		const next = value[i + 1];
+		if (value[i] === "\\" && (next === "\\" || next === "," || next === "(" || next === ")")) {
+			result += next;
+			i++;
+			continue;
+		}
+		result += value[i];
+	}
 	return result;
 }
 /**
@@ -3619,10 +4035,10 @@ function splitListItems(inner) {
 		current += inner[i] + inner[i + 1];
 		i++;
 	} else if (inner[i] === ",") {
-		items.push(unescapeListItem(current));
+		items.push(unescapeWireValue(current));
 		current = "";
 	} else current += inner[i];
-	items.push(unescapeListItem(current));
+	items.push(unescapeWireValue(current));
 	return items;
 }
 var REST_OP_LOOKUP = REST_TO_CANONICAL;
@@ -3717,14 +4133,16 @@ function createPrimaryKeyResolver(options) {
 * than postgres still serve rows with one, and this keeps them working.
 */
 function rowToEntity(row, slug, primaryKeys = []) {
+	const { _matches, ...values } = row;
 	return {
 		id: primaryKeys.length > 0 ? buildCompositeId(row, primaryKeys) : row.id,
 		path: slug,
-		values: row
+		values,
+		..._matches ? { searchMatches: _matches } : {}
 	};
 }
 /**
-* The relation envelope `toCmsRow` writes where a relation was:
+* The relation envelope `toFlatRow` writes where a relation was:
 * `{ id, path, __type: "relation", data: { id, path, values } }`. It is the
 * admin's view-model, and the only pipeline that produces one is postgres'.
 */
@@ -3763,21 +4181,22 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 	const accessor = {
 		async find(params) {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
-			const limit = params?.limit ?? 20;
-			const offset = params?.offset ?? 0;
+			const { limit, offset, driverOffset } = resolveFindWindow(params);
 			const fetchService = driver.restFetchService;
 			const rows = fetchService ? await fetchService.fetchCollectionForRest(slug, {
 				filter,
-				limit: params?.limit,
-				offset: params?.offset,
+				logical: params?.logical,
+				limit,
+				offset: driverOffset,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString
 			}, params?.include) : await driver.fetchCollection({
 				path: slug,
-				limit: params?.limit,
-				offset: params?.offset,
+				limit,
+				offset: driverOffset,
 				filter,
+				logical: params?.logical,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString
@@ -3787,7 +4206,9 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 			if (driver.count) {
 				total = await driver.count({
 					path: slug,
-					filter
+					filter,
+					logical: params?.logical,
+					searchString: params?.searchString
 				});
 				hasMore = offset + rows.length < total;
 			}
@@ -3839,30 +4260,48 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				values: {}
 			} });
 		},
+		updateMany: driver.updateMany ? async (updates) => {
+			return (await driver.updateMany({
+				path: slug,
+				updates: updates.map((u) => ({
+					id: u.id,
+					values: u.data
+				}))
+			})).map((row) => rowToEntity(row, slug, getPks()));
+		} : void 0,
+		deleteMany: driver.deleteMany ? async (ids) => {
+			await driver.deleteMany({
+				path: slug,
+				ids
+			});
+		} : void 0,
 		count: driver.count ? async (params) => {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
 			return driver.count({
 				path: slug,
-				filter
+				filter,
+				logical: params?.logical,
+				searchString: params?.searchString
 			});
 		} : void 0,
 		listen: driver.listenCollection ? (params, onUpdate, onError) => {
-			const limit = params?.limit ?? 20;
-			const offset = params?.offset ?? 0;
+			const { limit, offset, driverOffset } = resolveFindWindow(params);
 			const normalize = driver.restFetchService ? inlineRelationRefs : (row) => row;
 			return driver.listenCollection({
 				path: slug,
-				limit: params?.limit,
-				offset: params?.offset,
+				limit,
+				offset: driverOffset,
 				filter: params?.where,
+				logical: params?.logical,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString,
+				searchExplain: params?.searchExplain,
 				onUpdate: (entities) => {
 					onUpdate({
 						data: entities.map((row) => rowToEntity(normalize(row), slug, getPks())),
 						meta: {
-							total: entities.length,
+							total: offset + entities.length,
 							limit,
 							offset,
 							hasMore: entities.length >= limit
@@ -3895,8 +4334,11 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 		offset(count) {
 			return new QueryBuilder(accessor).offset(count);
 		},
-		search(searchString) {
-			return new QueryBuilder(accessor).search(searchString);
+		search(searchString, options) {
+			return new QueryBuilder(accessor).search(searchString, options);
+		},
+		vectorSearch(property, vector, options) {
+			return new QueryBuilder(accessor).vectorSearch(property, vector, options);
 		},
 		include(...relations) {
 			return new QueryBuilder(accessor).include(...relations);
@@ -3984,8 +4426,18 @@ var SdkQueryBuilder = class {
 		this.params.offset = count;
 		return this;
 	}
-	search(searchString) {
+	search(searchString, options) {
 		this.params.searchString = searchString;
+		if (options?.explain !== void 0) this.params.searchExplain = options.explain;
+		return this;
+	}
+	vectorSearch(property, vector, options) {
+		this.params.vectorSearch = {
+			property,
+			vector,
+			...options?.distance !== void 0 && { distance: options.distance },
+			...options?.threshold !== void 0 && { threshold: options.threshold }
+		};
 		return this;
 	}
 	include(...relations) {
@@ -4039,9 +4491,24 @@ function toSdkCollectionClient(snap, slug = "collection") {
 		async update(id, data) {
 			return entityToRow(await snap.update(id, data));
 		},
+		async updateMany(updates) {
+			if (!Array.isArray(updates)) throw new TypeError("updateMany expects an array of { id, data } entries.");
+			if (updates.length === 0) return [];
+			if (!snap.updateMany) throw new Error("Bulk updates are not supported by this collection's data source. Fall back to update() per record.");
+			return (await snap.updateMany(updates.map((u) => ({
+				id: u.id,
+				data: u.data
+			})))).map(entityToRow);
+		},
 		delete(id) {
 			return snap.delete(id);
 		},
+		async deleteMany(ids) {
+			if (!Array.isArray(ids)) throw new TypeError("deleteMany expects an array of ids.");
+			if (ids.length === 0) return;
+			if (!snap.deleteMany) throw new Error("Bulk deletes are not supported by this collection's data source. Fall back to delete() per record.");
+			await snap.deleteMany(ids);
+		},
 		count: snap.count ? (params) => snap.count(params) : void 0,
 		listen: snap.listen ? (params, onUpdate, onError) => snap.listen(params, (res) => onUpdate({
 			data: res.data.map(entityToRow),
@@ -4057,6 +4524,7 @@ function toSdkCollectionClient(snap, slug = "collection") {
 		limit: (count) => new SdkQueryBuilder(client).limit(count),
 		offset: (count) => new SdkQueryBuilder(client).offset(count),
 		search: (searchString) => new SdkQueryBuilder(client).search(searchString),
+		vectorSearch: (property, vector, options) => new SdkQueryBuilder(client).vectorSearch(property, vector, options),
 		include: (...relations) => new SdkQueryBuilder(client).include(...relations)
 	};
 	return client;
@@ -4102,72 +4570,502 @@ function buildSdkData(driver) {
 	return wrapAsSdkData(buildRebaseData(driver));
 }
 //#endregion
-//#region ../common/src/table-classification.ts
-/** Schemas that are always considered Rebase-internal. */
-var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
-/** Table-name prefixes that mark a table as Rebase-internal regardless of schema. */
-var REBASE_INTERNAL_PREFIXES = [
-	"_rebase_",
-	"_auth_",
-	"drizzle_"
-];
+//#region src/schema/search-column.ts
+/**
+* The one place a collection's `search` block becomes SQL.
+*
+* Four things describe a Postgres table in this codebase — the DDL generator,
+* the Drizzle schema generator, the runtime table builder for BaaS mode, and
+* the boot-time schema ensure — and each of them has, at some point, described
+* a column differently from the others. The `varchar(255)` note in
+* `generate-postgres-ddl-logic` is one such scar: the same property produced a
+* capped column down one path and an uncapped one down the other, and nothing
+* failed until a user hit the cap.
+*
+* So the search column is not implemented four times. It is computed once,
+* here, and every generator renders the same {@link SearchColumnSpec}. There is
+* a test asserting exactly that (`search-column-contract.test.ts`); the point of
+* this module is that the test has something to assert *about*.
+*
+* ## Why the expressions look the way they do
+*
+* A `GENERATED ALWAYS AS … STORED` expression must be strictly IMMUTABLE, and
+* Postgres is stricter here than intuition. Verified against PostgreSQL 18:
+*
+* | expression                              | immutable |
+* |-----------------------------------------|-----------|
+* | `to_tsvector('spanish', col)`           | yes       |
+* | `to_tsvector(col)` (1-arg)              | **no** — depends on `default_text_search_config` |
+* | `array_to_string(col, ' ')`             | **no**    |
+* | `col::text` on `text[]`                 | **no**    |
+* | `to_jsonb(col)`                         | **no**    |
+* | `unaccent(col)`                         | **no** — dictionary lookup is STABLE |
+* | `jsonb_to_tsvector('spanish', j, '["string"]')` | yes |
+* | `setweight(...) || setweight(...)`      | yes       |
+*
+* Three of the four things a real search column needs are therefore unavailable
+* directly, which is why {@link searchHelperFunctions} exists: each wraps a
+* stable built-in in an SQL function declared IMMUTABLE. That declaration is a
+* promise, and it is a true one for these three — array joining, JSON string
+* extraction and accent folding are all deterministic for a given input; the
+* built-ins are marked stable only because they must account for element types
+* and dictionaries in general.
+*
+* The alternative was to skip `unaccent` and text arrays entirely. That is not
+* a real option in an accented language: Postgres stems `auditoría` to
+* `auditor` and `auditoria` to `auditori` — *different lexemes* — so a query
+* typed without accents misses every row that carries them.
+*/
+/** Schema-qualified so a collection outside `public` still resolves them. */
+var HELPER_SCHEMA = "public";
+/**
+* Names of the helper functions. Frozen: they are recorded in the stored
+* generation expression of every search column ever created, so renaming one
+* orphans every table that already has a search column.
+*/
+var SEARCH_TEXT_FN = `${HELPER_SCHEMA}.rebase_search_text`;
+var SEARCH_UNACCENT_FN = `${HELPER_SCHEMA}.rebase_search_unaccent`;
+/** Raised when a `search` block names something that cannot be searched. */
+var SearchConfigError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SearchConfigError";
+	}
+};
+/** The `search` block of a collection, or undefined when it has none. */
+var getSearchConfig = (collection) => isPostgresCollectionConfig(collection) ? collection.search : void 0;
+/**
+* Refuse a `search` block on a collection this engine does not store.
+*
+* The type only permits one on a `PostgresCollectionConfig`, so TypeScript
+* already stops the ordinary case. This catches the rest — a JS config, a cast,
+* a collection whose `engine` was changed after the block was written — because
+* the alternative is the exact failure the block exists to prevent: a developer
+* who declared what to index, saw no error, and got the substring fallback.
+*
+* Called with *every* collection, before the Postgres ones are filtered out.
+*/
+var assertSearchIsPostgresOnly = (collections) => {
+	for (const collection of collections) {
+		if (isPostgresCollectionConfig(collection)) continue;
+		if (!collection.search) continue;
+		const engine = collection.engine ?? "non-postgres";
+		throw new SearchConfigError(`${collection.slug}.search: full-text search is a Postgres feature, and this collection is served by \`${engine}\`. Remove the block — it would otherwise look configured while \`.search()\` kept using the default substring match.`);
+	}
+};
+var columnNameOf = (propName, prop) => prop && "columnName" in prop && typeof prop.columnName === "string" ? prop.columnName : toSnakeCase(propName);
+/**
+* Classify a property for search purposes.
+*
+* Deliberately narrower than `getSqlColumnType`: search only cares whether a
+* value reaches text, and the mapping from property to *physical* type is
+* asserted against `getSqlColumnType` in the contract test rather than
+* duplicated here.
+*
+* Returns null for anything that is not text-bearing, which the caller turns
+* into a boot error naming the property.
+*/
+var classify = (prop) => {
+	switch (prop.type) {
+		case "string": {
+			const sp = prop;
+			if (sp.enum) return {
+				kind: "text",
+				reason: "enum"
+			};
+			if (sp.isId === "uuid" || sp.columnType === "uuid") return {
+				kind: "text",
+				reason: "uuid"
+			};
+			return { kind: "text" };
+		}
+		case "map":
+			if (prop.columnType === "json") return {
+				kind: "jsonb",
+				reason: "json"
+			};
+			return { kind: "jsonb" };
+		case "array": {
+			const ap = prop;
+			let colType = ap.columnType;
+			if (!colType && ap.of && !Array.isArray(ap.of)) {
+				const of = ap.of;
+				if (of.type === "string") colType = "text[]";
+				else if (of.type === "number") colType = of.validation?.integer ? "integer[]" : "numeric[]";
+				else if (of.type === "boolean") colType = "boolean[]";
+			}
+			if (colType === "text[]") return { kind: "text_array" };
+			if (colType === "json") return {
+				kind: "jsonb",
+				reason: "json"
+			};
+			if (colType === "integer[]" || colType === "boolean[]" || colType === "numeric[]") return {
+				kind: "text_array",
+				reason: "non_text_array"
+			};
+			return { kind: "jsonb" };
+		}
+		default: return null;
+	}
+};
+var normalize = (inner, unaccent) => unaccent ? `${SEARCH_UNACCENT_FN}(${inner})` : inner;
+/** SQL reading one field as plain text, before normalization. */
+var rawTextSql = (field) => {
+	const col = `"${field.column}"`;
+	if (field.kind === "text") return `coalesce(${col}, '')`;
+	if (field.kind === "text_array") return `${SEARCH_TEXT_FN}(coalesce(${col}, '{}'::text[]))`;
+	return `${SEARCH_TEXT_FN}(coalesce(${field.jsonPath.length === 0 ? col : field.jsonPath.length === 1 ? `${col} -> ${quote(field.jsonPath[0])}` : `${col} #> ${quote(`{${field.jsonPath.join(",")}}`)}`}, '{}'::jsonb))`;
+};
+var quote = (v) => `'${v.replace(/'/g, "''")}'`;
 /**
-* Synchronously classify a table based on naming conventions.
+* Resolve and validate one declared field path.
 *
-* @param tableName  - The unqualified name of the table.
-* @param schemaName - The schema the table belongs to (e.g. `"public"`, `"rebase"`).
-* @returns `"rebase-internal"` when the table belongs to a reserved schema or
-*          carries a reserved prefix; `"user"` otherwise.
+* A path that does not resolve throws. The whole point of an explicit block is
+* that the author knows what is indexed; a silently dropped field would make it
+* a guess again, and the failure — a search that returns nothing for content
+* that is plainly in the row — is invisible from the outside.
+*/
+var resolveField = (entry, collection, cfg) => {
+	const path = typeof entry === "string" ? entry : entry.path;
+	const weight = (typeof entry === "string" ? void 0 : entry.weight) ?? "B";
+	const where = `${collection.slug}.search`;
+	if (!path || typeof path !== "string") throw new SearchConfigError(`${where}: every entry in \`fields\` needs a property path.`);
+	const [head, ...rest] = path.split(".");
+	const prop = collection.properties?.[head];
+	if (!prop) throw new SearchConfigError(`${where}: "${path}" starts at property "${head}", which this collection does not declare. Known properties: ${Object.keys(collection.properties ?? {}).join(", ")}.`);
+	const classified = classify(prop);
+	if (!classified) throw new SearchConfigError(`${where}: "${path}" is a \`${prop.type}\` property, which holds no text to search. Searchable kinds are \`string\`, \`string[]\` and \`map\` (or a path inside one).`);
+	if (classified.reason === "enum") throw new SearchConfigError(`${where}: "${path}" is an enum. Enums are a fixed vocabulary — filter on them with \`where\` instead, which is exact and uses an index.`);
+	if (classified.reason === "uuid") throw new SearchConfigError(`${where}: "${path}" is a UUID column. Look it up by id rather than searching it.`);
+	if (classified.reason === "json") throw new SearchConfigError(`${where}: "${path}" is a \`json\` column, and the cast from \`json\` to \`jsonb\` is not immutable, so it cannot feed a generated column. Declare the property as \`jsonb\` (the default) to search it.`);
+	if (classified.reason === "non_text_array") throw new SearchConfigError(`${where}: "${path}" is an array of numbers or booleans. Only \`string[]\` carries text to search.`);
+	if (rest.length > 0 && classified.kind !== "jsonb") throw new SearchConfigError(`${where}: "${path}" addresses a path inside "${head}", but "${head}" is a \`${prop.type}\` property, not a \`map\`. Only map properties have paths inside them.`);
+	const column = columnNameOf(head, prop);
+	const textSql = normalize(rawTextSql({
+		column,
+		jsonPath: rest,
+		kind: classified.kind
+	}), cfg.unaccent === true);
+	const language = cfg.language ?? "simple";
+	return {
+		path,
+		column,
+		jsonPath: rest,
+		kind: classified.kind,
+		weight,
+		sql: `setweight(to_tsvector(${quote(language)}, ${textSql}), ${quote(weight)})`,
+		textSql
+	};
+};
+/**
+* Build the full spec for a collection, or undefined when it has not opted in.
+*
+* Throws {@link SearchConfigError} on a config that cannot be honoured. Callers
+* at boot surface that as a startup failure — a search block that half-works is
+* worse than one that refuses.
+*/
+var buildSearchColumnSpec = (collection) => {
+	const cfg = getSearchConfig(collection);
+	if (!cfg) return void 0;
+	if (!Array.isArray(cfg.fields) || cfg.fields.length === 0) throw new SearchConfigError(`${collection.slug}.search: \`fields\` is empty. Name the properties to index, or remove the \`search\` block to keep the default ILIKE behaviour.`);
+	const table = getTableName(collection);
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	const column = cfg.column ?? "search_vector";
+	if (collection.properties?.[column]) throw new SearchConfigError(`${collection.slug}.search: the generated column "${column}" collides with a declared property of the same name. Set \`search.column\` to something else.`);
+	const fields = cfg.fields.map((entry) => resolveField(entry, collection, cfg));
+	const seen = /* @__PURE__ */ new Set();
+	for (const f of fields) {
+		if (seen.has(f.path)) throw new SearchConfigError(`${collection.slug}.search: "${f.path}" is listed twice.`);
+		seen.add(f.path);
+	}
+	const extensions = [];
+	if (cfg.unaccent) extensions.push("unaccent");
+	if (cfg.fuzzy) extensions.push("pg_trgm");
+	const spec = {
+		schema,
+		table,
+		column,
+		language: cfg.language ?? "simple",
+		unaccent: cfg.unaccent === true,
+		fields,
+		expression: fields.map((f) => f.sql).join(" || "),
+		indexName: toPostgresIdentifier(`${table}_${column}_gin`),
+		extensions
+	};
+	if (cfg.fuzzy) {
+		const fuzzyColumn = `${column}_text`;
+		if (collection.properties?.[fuzzyColumn]) throw new SearchConfigError(`${collection.slug}.search: \`fuzzy\` needs the column "${fuzzyColumn}", which collides with a declared property. Set \`search.column\` to something else.`);
+		spec.fuzzy = {
+			column: fuzzyColumn,
+			expression: fields.map((f) => f.textSql).join(" || ' ' || "),
+			indexName: toPostgresIdentifier(`${table}_${fuzzyColumn}_trgm`),
+			threshold: cfg.fuzzyThreshold ?? .3
+		};
+	}
+	return spec;
+};
+/**
+* The IMMUTABLE wrappers the generated expressions call.
+*
+* `CREATE OR REPLACE` so a boot against an existing database is a no-op rather
+* than an error, and idempotent for the same reason every other boot-time DDL
+* statement here is.
+*
+* The bodies are stable built-ins wrapped in an immutable promise — see the
+* module comment for why that promise is sound. `STRICT` matters: it makes NULL
+* in mean NULL out without executing the body, which is what the `coalesce` at
+* each call site then absorbs.
+*/
+var searchHelperFunctions = (spec) => {
+	const statements = [`CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(text[]) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT array_to_string($1, ' ') $$;`, `CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(jsonb) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT coalesce(string_agg(v, ' '), '')\n       FROM jsonb_array_elements_text(jsonb_path_query_array($1, 'strict $.**?(@.type() == "string")')) AS v $$;`];
+	if (spec.unaccent) statements.push(`CREATE OR REPLACE FUNCTION ${SEARCH_UNACCENT_FN}(text) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT ${HELPER_SCHEMA}.unaccent('${HELPER_SCHEMA}.unaccent'::regdictionary, $1) $$;`);
+	return statements;
+};
+/**
+* `CREATE EXTENSION` statements the spec's expressions depend on.
+*
+* `WITH SCHEMA public` is load-bearing, not tidiness. An unqualified
+* `CREATE EXTENSION` installs into the first schema on `search_path`, which
+* defaults to `"$user", public` — and the scaffold's database role is named
+* `rebase`, the same as the schema the generator creates one statement earlier.
+* So the moment that schema exists, `CREATE EXTENSION unaccent` puts the
+* dictionary in `rebase`, and every reference to `public.unaccent` below fails
+* with "text search dictionary does not exist". Observed, not theorised.
+*/
+var searchExtensionStatements = (spec) => spec.extensions.map((e) => `CREATE EXTENSION IF NOT EXISTS ${e} WITH SCHEMA ${HELPER_SCHEMA};`);
+/**
+* Index statements for the spec.
+*
+* `CONCURRENTLY` is deliberately *not* used here. This form is emitted into a
+* SQL file replayed as one unit — a migration, or `search.sql` — where a
+* concurrent build is not allowed. The boot-time ensure path runs statement by
+* statement against tables that are live and populated, and uses the
+* concurrent form instead; see `ensureSearchColumns`.
+*/
+var searchIndexStatements = (spec) => {
+	const statements = [`CREATE INDEX IF NOT EXISTS "${spec.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.column}");`];
+	if (spec.fuzzy) statements.push(`CREATE INDEX IF NOT EXISTS "${spec.fuzzy.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.fuzzy.column}" ${HELPER_SCHEMA}.gin_trgm_ops);`);
+	return statements;
+};
+/**
+* Marker on the comment of every generated search column this module creates.
+*
+* Versioned because the fingerprint below is only comparable against itself: a
+* future change to how it is computed has to read as "not stamped by this
+* version" rather than as drift on every existing column.
+*/
+var SEARCH_STAMP_PREFIX = "rebase:search:v1:";
+/**
+* A stable fingerprint of one generated column's expression.
+*
+* Why a stamp rather than reading the expression back: Postgres stores a
+* generated column's expression *parsed*, and hands it back deparsed — casts
+* made explicit, identifiers requoted, schema qualifications added or dropped
+* according to `search_path`. Comparing that text to the text we generated
+* would report drift on wording, and this comparison decides whether a boot
+* refuses, so a false positive is an outage. The stamp is written by the same
+* code that writes the column, so equality means what it says.
+*/
+var searchExpressionFingerprint = (expression) => `${SEARCH_STAMP_PREFIX}${createHash("sha256").update(expression).digest("hex").slice(0, 16)}`;
+/**
+* The stamps for a spec's generated columns — one per column, never shared.
 *
-* @remarks
-* Junction-table detection requires an async database query and is therefore
-* **not** handled by this function. Use {@link detectJunctionTables} to obtain
-* the set of junction tables, then reclassify as needed.
+* Per column on purpose: turning `fuzzy` on adds a second column and changes
+* nothing about the first, and a spec-wide fingerprint would report the
+* untouched `tsvector` column as drifted and refuse a boot over a change that
+* is purely additive.
 */
-function classifyTable(tableName, schemaName) {
-	if (REBASE_INTERNAL_SCHEMAS.includes(schemaName) || REBASE_INTERNAL_PREFIXES.some((prefix) => tableName.startsWith(prefix))) return "rebase-internal";
-	return "user";
-}
-/** SQL query that detects junction tables in the `public` schema. */
-var JUNCTION_TABLES_SQL = `
-  SELECT t.table_name
-  FROM information_schema.tables t
-  WHERE t.table_schema = 'public'
-    AND t.table_type = 'BASE TABLE'
-    AND NOT EXISTS (
-      SELECT 1
-      FROM information_schema.columns c
-      WHERE c.table_schema = t.table_schema
-        AND c.table_name = t.table_name
-        AND c.column_name NOT IN (
-          SELECT kcu.column_name
-          FROM information_schema.key_column_usage kcu
-          JOIN information_schema.table_constraints tc
-            ON tc.constraint_name = kcu.constraint_name
-            AND tc.table_schema = kcu.table_schema
-          WHERE tc.constraint_type = 'FOREIGN KEY'
-            AND kcu.table_schema = t.table_schema
-            AND kcu.table_name = t.table_name
-        )
-    )
-`;
+var searchColumnStamps = (spec) => {
+	const stamp = (column, expression) => {
+		const fingerprint = searchExpressionFingerprint(expression);
+		return {
+			column,
+			expression,
+			fingerprint,
+			sql: `COMMENT ON COLUMN "${spec.schema}"."${spec.table}"."${column}" IS ${quote(fingerprint)};`
+		};
+	};
+	const stamps = [stamp(spec.column, spec.expression)];
+	if (spec.fuzzy) stamps.push(stamp(spec.fuzzy.column, spec.fuzzy.expression));
+	return stamps;
+};
+/**
+* The generated column names a collection's search block adds, if any.
+*
+* These are physical columns on the table, so `SELECT *` returns them. They are
+* an index in column form — a list of lexeme positions, or a concatenation of
+* every searchable field on the row — and nothing outside the query planner has
+* any use for them. Left in, every list response carries a second, larger copy
+* of the row's text.
+*/
+var searchColumnNames = (collection) => {
+	let spec;
+	try {
+		spec = buildSearchColumnSpec(collection);
+	} catch {
+		return [];
+	}
+	if (!spec) return [];
+	return spec.fuzzy ? [spec.column, spec.fuzzy.column] : [spec.column];
+};
 /**
-* Asynchronously detect junction (link) tables in the `public` schema.
+* True for a column whose type only ever holds a search index.
 *
-* A junction table is defined as a table where **every** column participates in
-* at least one foreign-key constraint.
+* Independent of any collection config on purpose: an introspected database
+* (BaaS mode) can carry a `tsvector` column this framework never created —
+* Pagila's `film.fulltext` is the canonical one — and it should not be returned
+* to callers either. `isDerivedIndexColumn` already keeps such a column out of
+* the *properties*; this keeps it out of the *rows*.
+*/
+var isSearchIndexColumn = (column) => {
+	const sqlType = typeof column?.getSQLType === "function" ? column.getSQLType().toLowerCase() : "";
+	return sqlType === "tsvector" || sqlType === "tsquery";
+};
+/**
+* A drizzle select projection over `table` with the search columns dropped.
+*
+* Returns undefined when nothing needs dropping, so the common case keeps using
+* a plain `select()` and this stays invisible in the generated SQL.
+*/
+var visibleColumnProjection = (tableColumns, collection) => {
+	const excluded = excludedColumnNames(tableColumns, collection);
+	if (!tableColumns || excluded.length === 0) return void 0;
+	const projection = {};
+	for (const [name, column] of Object.entries(tableColumns)) if (!excluded.includes(name)) projection[name] = column;
+	return projection;
+};
+/** The same exclusion as a drizzle `db.query` `columns` denylist. */
+var hiddenColumnsOption = (tableColumns, collection) => {
+	const excluded = excludedColumnNames(tableColumns, collection);
+	if (excluded.length === 0) return void 0;
+	return Object.fromEntries(excluded.map((name) => [name, false]));
+};
+/**
+* The columns to keep out of a response, by name.
 *
-* @param executeSql - A callback that executes a raw SQL string and returns the
-*                     resulting rows.
-* @returns A `Set` containing the names of all detected junction tables.
+* `tableColumns` is whatever `getTableColumns` returned, which is `undefined`
+* for anything that is not a real drizzle table — a stub in a test, a derived
+* or nested path with no table behind it. Nothing to exclude is the right
+* answer there, and it has to be an answer rather than a throw: this runs on
+* the read path of every collection, opted in or not.
 */
-async function detectJunctionTables(executeSql) {
-	const rows = await executeSql(JUNCTION_TABLES_SQL);
-	const junctionTables = /* @__PURE__ */ new Set();
-	for (const row of rows) if (typeof row.table_name === "string") junctionTables.add(row.table_name);
-	return junctionTables;
+var excludedColumnNames = (tableColumns, collection) => {
+	if (!tableColumns || typeof tableColumns !== "object") return [];
+	const byName = new Set(collection ? searchColumnNames(collection) : []);
+	return Object.keys(tableColumns).filter((name) => byName.has(name) || isSearchIndexColumn(tableColumns[name]));
+};
+//#endregion
+//#region src/schema/auth-users-columns.ts
+/**
+* `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it
+* — it synthesizes `anon_<32 hex>@anonymous.local` rather than inserting NULL.
+* The 320-char bound (RFC 5321) is a CHECK rather than a `VARCHAR(n)`, added
+* separately by `ensureAuthTablesExist` so it can be `NOT VALID` on an adopted
+* table that already holds a longer row.
+*/
+var AUTH_USERS_COLUMNS = [
+	{
+		column: "email",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		column: "display_name",
+		type: "TEXT"
+	},
+	{
+		column: "photo_url",
+		type: "TEXT"
+	},
+	{
+		column: "roles",
+		type: "TEXT[]",
+		default: "'{}'",
+		notNull: true
+	},
+	{
+		column: "password_hash",
+		type: "TEXT"
+	},
+	{
+		column: "email_verified",
+		type: "BOOLEAN",
+		default: "FALSE",
+		notNull: true
+	},
+	{
+		column: "email_verification_token",
+		type: "TEXT"
+	},
+	{
+		column: "email_verification_sent_at",
+		type: "TIMESTAMP WITH TIME ZONE"
+	},
+	{
+		column: "is_anonymous",
+		type: "BOOLEAN",
+		default: "FALSE",
+		notNull: true
+	},
+	{
+		column: "metadata",
+		type: "JSONB",
+		default: "'{}'",
+		notNull: true
+	},
+	{
+		column: "tokens_valid_after",
+		type: "TIMESTAMP WITH TIME ZONE"
+	},
+	{
+		column: "created_at",
+		type: "TIMESTAMP WITH TIME ZONE",
+		default: "NOW()",
+		notNull: true
+	},
+	{
+		column: "updated_at",
+		type: "TIMESTAMP WITH TIME ZONE",
+		default: "NOW()",
+		notNull: true
+	}
+];
+var BY_COLUMN = new Map(AUTH_USERS_COLUMNS.map((c) => [c.column, c]));
+/** Type + inline constraints, as they appear after the column name. */
+function authUsersColumnSql(spec) {
+	return [
+		spec.type,
+		spec.default !== void 0 ? `DEFAULT ${spec.default}` : "",
+		spec.notNull ? "NOT NULL" : ""
+	].filter(Boolean).join(" ");
+}
+/**
+* The auth-owned definition for a physical column name, or `undefined` when
+* auth does not own it.
+*
+* Callers pass the RESOLVED column name (after `columnName` mapping), because
+* that is the only name the three creators agree on: the scaffold's users
+* collection spells the property `displayName` and the column `display_name`.
+*/
+function authUsersColumnDefinition(column) {
+	const spec = BY_COLUMN.get(column);
+	return spec ? authUsersColumnSql(spec) : void 0;
+}
+/**
+* Whether a collection is an auth collection, i.e. whether the definitions in
+* this module apply to its table at all.
+*
+* Duplicated in shape from `@rebasepro/common`'s policy defaults on purpose:
+* that one takes a `CollectionConfig`, this one is called from DDL code paths
+* that hold looser objects, and both spellings must accept `auth: true` as well
+* as `auth: { enabled: true }`.
+*/
+function isAuthCollection(collection) {
+	const auth = collection?.auth;
+	if (auth === true) return true;
+	return typeof auth === "object" && auth !== null && auth.enabled === true;
 }
 //#endregion
-export { toSnakeCase as A, createRelationRefWithData as C, getPolicyNamesForRule as D, generateForeignKeyName as E, DEFAULT_ONE_OF_VALUE as M, mergeDeep as O, createRelationRef as S, updateDateAutoValues as T, getTableVarName as _, getJunctionCollectionConfig as a, getDeclaredPrimaryKeys as b, getEffectiveSecurityRules as c, securityRuleToConditions as d, findAnonymousGrants as f, getTableName as g, getEnumVarName as h, CollectionRegistry as i, DEFAULT_ONE_OF_TYPE as j, camelCase as k, buildPropertyCallbacks as l, getColumnName as m, detectJunctionTables as n, getJunctionSecurityRules as o, findRelation as p, buildSdkData as r, resolveJunctionSpecs as s, classifyTable as t, policyToPostgres as u, resolveCollectionRelations as v, normalizeToEntityRelation as w, parseIdValues as x, buildCompositeId as y };
+export { isManyToMany as $, getTableName as A, normalizeToEntityRelation as B, getEffectiveSecurityRules as C, findRelation as D, findAnonymousGrants as E, isAddressableId as F, getPolicyNamesForRule as G, generateForeignKeyName as H, parseIdValues as I, camelCase as J, isPrototypePollutingKey as K, sortCollectionsBySlug as L, resolveCollectionRelations as M, buildCompositeId as N, getColumnName as O, getDeclaredPrimaryKeys as P, hasForeignKeyOnTarget as Q, createRelationRef as R, resolveJunctionSpecs as S, securityRuleToConditions as T, legacyForeignKeyName as U, updateDateAutoValues as V, toPostgresIdentifier as W, DEFAULT_ONE_OF_TYPE as X, toSnakeCase as Y, DEFAULT_ONE_OF_VALUE as Z, CollectionRegistry as _, SEARCH_STAMP_PREFIX as a, getJunctionCollectionConfig as b, assertSearchIsPostgresOnly as c, searchColumnStamps as d, Vector as et, searchExtensionStatements as f, buildSdkData as g, visibleColumnProjection as h, isAuthCollection as i, getTableVarName as j, getEnumVarName as k, buildSearchColumnSpec as l, searchIndexStatements as m, authUsersColumnDefinition as n, SEARCH_TEXT_FN as o, searchHelperFunctions as p, mergeDeep as q, authUsersColumnSql as r, SEARCH_UNACCENT_FN as s, AUTH_USERS_COLUMNS as t, hiddenColumnsOption as u, relationalCollections as v, policyToPostgres as w, getJunctionSecurityRules as x, resolveStringColumnLength as y, createRelationRefWithData as z };
 
-//# sourceMappingURL=src-BbFOPJ1S.js.map
+//# sourceMappingURL=auth-users-columns-CBEOeYqa.js.map