@rebasepro/server-postgres 0.12.1-canary.gf5f1d39 → 0.13.1-canary.g18cfeb7

package/dist/ensure-collection-tables-DSIxvLLD.js

@@ -0,0 +1,694 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { A as generateForeignKeyName, I as toSnakeCase, M as getPolicyNamesForRule, c as resolveStringColumnLength, d as resolveJunctionSpecs, f as getEffectiveSecurityRules, g as findRelation, i as isAuthCollection, j as legacyForeignKeyName, l as getJunctionCollectionConfig, m as securityRuleToConditions, n as authUsersColumnDefinition, p as policyToPostgres, r as authUsersColumnSql, s as relationalCollections, t as AUTH_USERS_COLUMNS, u as getJunctionSecurityRules, x as resolveCollectionRelations, y as getTableName } from "./auth-users-columns-Do9mw5Y5.js";
+import { c as isPostgresCollectionConfig } from "./src-C_wvdMnl.js";
+import { logger } from "@rebasepro/server";
+//#region src/schema/generate-postgres-ddl-logic.ts
+var resolveColumnName = (propName, prop) => {
+	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+	return toSnakeCase(propName);
+};
+var getPrimaryKeyProp = (collection) => {
+	if (collection.properties) {
+		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
+		if (idPropEntry) {
+			const prop = idPropEntry[1];
+			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
+			return {
+				name: idPropEntry[0],
+				type: prop.type === "number" ? "number" : "string",
+				isUuid
+			};
+		}
+	}
+	const idProp = collection.properties?.["id"];
+	if (idProp?.type === "number") return {
+		name: "id",
+		type: "number",
+		isUuid: false
+	};
+	return {
+		name: "id",
+		type: "string",
+		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
+	};
+};
+var isNumericId = (collection) => {
+	return getPrimaryKeyProp(collection).type === "number";
+};
+var getPrimaryKeyName = (collection) => {
+	return getPrimaryKeyProp(collection).name;
+};
+/** The column type a junction holds for one endpoint's primary key. */
+var junctionKeyType = (collection) => isNumericId(collection) ? "INTEGER" : getPrimaryKeyProp(collection).isUuid ? "UUID" : "TEXT";
+var isIdProperty = (propName, prop, collection) => {
+	if ("isId" in prop && Boolean(prop.isId)) return true;
+	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
+};
+/**
+* The individual SQL statements a single security rule compiles to: a
+* `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete
+* statement (terminated by `;`, no trailing newline).
+*
+* This is the primitive the boot-time RLS applier runs one statement at a time
+* (the runtime's DB handle speaks the extended query protocol, which forbids
+* multiple commands in one execute), while `db push` writes the joined string.
+*/
+var generatePolicyStatements = (collection, rule, resolveCollection) => {
+	const tableName = getTableName(collection);
+	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+	const policyNames = getPolicyNamesForRule(rule, tableName);
+	return ops.flatMap((op, opIdx) => {
+		return generateSinglePolicyStatements(collection, rule, op, policyNames[opIdx], resolveCollection);
+	});
+};
+var generateSinglePolicyStatements = (collection, rule, operation, policyName, resolveCollection) => {
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	const tableName = getTableName(collection);
+	const mode = (rule.mode ?? "permissive").toUpperCase();
+	const operationUpper = operation.toUpperCase();
+	const pgRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
+	const needsUsing = operation !== "insert";
+	const needsWithCheck = operation !== "select" && operation !== "delete";
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	let usingClause = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection, { resolveCollection }) : null;
+	let withCheckClause = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection, { resolveCollection }) : null;
+	if (!usingClause && needsUsing) usingClause = "false";
+	if (!withCheckClause && needsWithCheck) withCheckClause = "false";
+	const drop = `DROP POLICY IF EXISTS "${policyName}" ON "${schema}"."${tableName}";`;
+	let create = `CREATE POLICY "${policyName}" ON "${schema}"."${tableName}" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map((r) => `"${r}"`).join(", ")}`;
+	if (usingClause) create += ` USING (${usingClause})`;
+	if (withCheckClause) create += ` WITH CHECK (${withCheckClause})`;
+	create += ";";
+	return [drop, create];
+};
+/**
+* Single-quote escaping for a SQL string literal (PostgreSQL doubles the
+* quote). Enum labels come straight from user-authored collection config, so a
+* label like `it's` closes the literal early and the whole generated file stops
+* parsing at the `CREATE TYPE`. Lives here rather than next to its other caller
+* because ensure-collection-tables already imports from this module — the
+* reverse would be a cycle.
+*/
+var quoteSqlLiteral = (value) => `'${value.replace(/'/g, "''")}'`;
+var getSqlColumnType = (propName, prop, collection, collections) => {
+	switch (prop.type) {
+		case "string": {
+			const stringProp = prop;
+			if (stringProp.enum) {
+				const tableName = getTableName(collection);
+				const colName = resolveColumnName(propName, prop);
+				return `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${tableName}_${colName}"`;
+			}
+			if (stringProp.isId === "uuid" || stringProp.columnType === "uuid") return "UUID";
+			if (stringProp.columnType === "char") return `CHAR(${resolveStringColumnLength(stringProp)})`;
+			if (stringProp.columnType === "varchar") return `VARCHAR(${resolveStringColumnLength(stringProp)})`;
+			return "TEXT";
+		}
+		case "number": {
+			const numProp = prop;
+			const isId = isIdProperty(propName, prop, collection);
+			if ("isId" in numProp && numProp.isId === "increment") return "INTEGER GENERATED BY DEFAULT AS IDENTITY";
+			if (numProp.columnType) {
+				if (numProp.columnType === "double precision") return "DOUBLE PRECISION";
+				return numProp.columnType.toUpperCase();
+			}
+			return numProp.validation?.integer || isId ? "INTEGER" : "NUMERIC";
+		}
+		case "boolean": return "BOOLEAN";
+		case "date": {
+			const dateProp = prop;
+			if (dateProp.columnType === "date") return "DATE";
+			if (dateProp.columnType === "time") return "TIME";
+			return "TIMESTAMP WITH TIME ZONE";
+		}
+		case "map": return prop.columnType === "json" ? "JSON" : "JSONB";
+		case "array": {
+			const arrayProp = prop;
+			let colType = arrayProp.columnType;
+			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
+				const ofProp = arrayProp.of;
+				if (ofProp.type === "string") colType = "text[]";
+				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
+				else if (ofProp.type === "boolean") colType = "boolean[]";
+			}
+			if (colType === "json") return "JSON";
+			if (colType === "text[]") return "TEXT[]";
+			if (colType === "integer[]") return "INTEGER[]";
+			if (colType === "boolean[]") return "BOOLEAN[]";
+			if (colType === "numeric[]") return "NUMERIC[]";
+			return "JSONB";
+		}
+		case "vector": return `VECTOR(${prop.dimensions})`;
+		case "binary": return "BYTEA";
+		case "relation": {
+			const refProp = prop;
+			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+			if (relation?.kind !== "belongsTo") throw new Error(`Relation ${propName} does not put a column on this table (only \`belongsTo\` does)`);
+			let targetCollection;
+			try {
+				targetCollection = relation.target();
+			} catch {
+				return "TEXT";
+			}
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
+		}
+		case "reference": {
+			const refProp = prop;
+			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
+			if (!targetCollection) return "TEXT";
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
+		}
+		default: return "TEXT";
+	}
+};
+var schemaOfCollection = (collection) => isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+var bareTableName = (name) => name.includes(".") ? name.split(".").pop() : name;
+/**
+* Truncate a derived identifier the way Postgres does: to 63 bytes, silently.
+*
+* This is not cosmetic, and not really a naming choice at all — it is agreeing
+* with the name the database ALREADY stored. `ADD CONSTRAINT` on a longer name
+* succeeds and records the truncated form, so the untruncated name this used to
+* derive matched nothing in the catalogue. Boot-ensure compares its planned
+* constraints against `readExistingSchema`, which reads catalogue names, so the
+* comparison could never hit: every boot re-issued `ADD CONSTRAINT` for the same
+* constraint, forever, and got "already exists" every time. Non-fatal (foreign
+* keys are the one action allowed to fail) and therefore permanent — an error in
+* the log on every restart of a project whose table and column names happened to
+* be long.
+*
+* Byte length, not string length: NAMEDATALEN is 64 bytes, and a multi-byte
+* character straddling the boundary would be cut mid-sequence by `slice(0, 63)`.
+*/
+var toPostgresIdentifier = (name) => {
+	const bytes = Buffer.from(name, "utf8");
+	if (bytes.byteLength <= 63) return name;
+	return bytes.subarray(0, 63).toString("utf8").replace(/�+$/, "");
+};
+var foreignKeyPlan = (args) => {
+	const constraintName = toPostgresIdentifier(`${args.table}_${args.column}_fkey`);
+	const onUpdate = args.onUpdate ? ` ON UPDATE ${args.onUpdate.toUpperCase()}` : "";
+	return {
+		constraintName,
+		schema: args.schema,
+		table: args.table,
+		column: args.column,
+		targetSchema: args.targetSchema,
+		targetTable: args.targetTable,
+		targetColumn: args.targetColumn,
+		sql: `ALTER TABLE "${args.schema}"."${args.table}" ADD CONSTRAINT "${constraintName}" FOREIGN KEY ("${args.column}") REFERENCES "${args.targetSchema}"."${args.targetTable}" ("${args.targetColumn}") ON DELETE ${args.onDelete.toUpperCase()}${onUpdate};`
+	};
+};
+/**
+* The FK columns the declared collections own — one entry per `relation`
+* (`belongsTo` side) or `reference` property.
+*
+* Split out of {@link generatePostgresDdl} so the boot-time schema ensure can
+* create the same columns with the same names, types and constraints. Before
+* this it skipped them outright, which was survivable only because `db push`
+* always followed; on a managed tenant nothing follows, so a table arrived
+* without the column its own collection reads and wrote 400 on every insert.
+*
+* A relation whose target is not in the bundle yields no column at all (the
+* generator returns early on an unresolvable target); a `reference` whose target
+* is unknown yields the column without a constraint. Both mirror the generator
+* exactly — a divergence here is a schema fork between boot and `db push`.
+*/
+var planRelationalColumns = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	const plans = [];
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (!tableName) continue;
+		const schema = schemaOfCollection(collection);
+		const table = bareTableName(tableName);
+		for (const [propName, rawProp] of Object.entries(collection.properties ?? {})) {
+			const prop = rawProp;
+			if (prop.type === "relation") {
+				const refProp = prop;
+				const relInfo = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+				if (relInfo?.kind !== "belongsTo") continue;
+				if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) continue;
+				let targetCollection;
+				try {
+					targetCollection = relInfo.target();
+				} catch {
+					continue;
+				}
+				if (!targetCollection) continue;
+				const required = prop.validation?.required;
+				const relationName = refProp.relation?.relationName ?? propName;
+				const legacyKey = legacyForeignKeyName(relationName);
+				const derived = relInfo.localKey === generateForeignKeyName(relationName);
+				plans.push({
+					schema,
+					table,
+					column: relInfo.localKey,
+					legacyColumn: derived && legacyKey !== relInfo.localKey ? legacyKey : void 0,
+					type: getSqlColumnType(propName, prop, collection, collections),
+					foreignKey: foreignKeyPlan({
+						schema,
+						table,
+						column: relInfo.localKey,
+						targetSchema: schemaOfCollection(targetCollection),
+						targetTable: bareTableName(getTableName(targetCollection)),
+						targetColumn: getPrimaryKeyName(targetCollection),
+						onDelete: relInfo.onDelete ?? (required ? "CASCADE" : "SET NULL"),
+						onUpdate: relInfo.onUpdate
+					})
+				});
+			} else if (prop.type === "reference") {
+				const refProp = prop;
+				const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
+				const column = resolveColumnName(propName, prop);
+				const type = getSqlColumnType(propName, prop, collection, collections);
+				const required = prop.validation?.required;
+				plans.push({
+					schema,
+					table,
+					column,
+					type,
+					foreignKey: targetCollection ? foreignKeyPlan({
+						schema,
+						table,
+						column,
+						targetSchema: schemaOfCollection(targetCollection),
+						targetTable: bareTableName(getTableName(targetCollection)),
+						targetColumn: getPrimaryKeyName(targetCollection),
+						onDelete: required ? "CASCADE" : "SET NULL"
+					}) : void 0
+				});
+			}
+		}
+	}
+	return plans;
+};
+/**
+* The junction tables a bundle's many-to-many relations imply.
+*
+* Derived from {@link resolveJunctionSpecs}, the same source the junction RLS
+* comes from, so a table created here always has policies planned for it — a
+* junction with row-level security left off is readable and writable by every
+* signed-in user, which is why the two must ship together.
+*/
+var planJunctionTables = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	const plans = [];
+	for (const spec of resolveJunctionSpecs(collections).values()) {
+		const [source, target] = spec.endpoints;
+		const legacyFor = (endpoint) => {
+			const slug = toSnakeCase(endpoint.collection.slug ?? endpoint.collection.name ?? "");
+			const legacy = legacyForeignKeyName(slug);
+			return endpoint.junctionColumn === generateForeignKeyName(slug) && legacy !== endpoint.junctionColumn ? legacy : void 0;
+		};
+		const columns = [{
+			name: source.junctionColumn,
+			type: junctionKeyType(source.collection),
+			legacyName: legacyFor(source)
+		}, {
+			name: target.junctionColumn,
+			type: junctionKeyType(target.collection),
+			legacyName: legacyFor(target)
+		}];
+		const onDelete = spec.declaringSides[0]?.relation.onDelete ?? "CASCADE";
+		plans.push({
+			schema: spec.schema,
+			table: spec.table,
+			columns,
+			createTable: `CREATE TABLE IF NOT EXISTS "${spec.schema}"."${spec.table}" (` + columns.map((c) => `"${c.name}" ${c.type} NOT NULL`).join(", ") + `, PRIMARY KEY (${columns.map((c) => `"${c.name}"`).join(", ")}));`,
+			foreignKeys: [source, target].map((endpoint, i) => foreignKeyPlan({
+				schema: spec.schema,
+				table: spec.table,
+				column: columns[i].name,
+				targetSchema: schemaOfCollection(endpoint.collection),
+				targetTable: bareTableName(getTableName(endpoint.collection)),
+				targetColumn: getPrimaryKeyName(endpoint.collection),
+				onDelete
+			}))
+		});
+	}
+	return plans;
+};
+/**
+* The per-table RLS plan for the *declared* collections, as executable
+* statements — what the managed runtime applies at boot so a freshly
+* provisioned tenant database serves data instead of 401ing every read.
+*
+* Mirrors {@link generatePostgresPoliciesDdl} exactly (same
+* `generatePolicyStatements`, same enable-RLS, same effective rules, same
+* derived junction rules), so boot and `db push` produce identical policies from
+* identical collections.
+*
+* Junction tables are included, and have to be: boot creates them now
+* ({@link planJunctionTables}), and a junction with RLS left off is readable and
+* writable by every signed-in user. A junction whose table is still absent is
+* skipped by the applier, not planned away here.
+*/
+var planCollectionPolicies = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+	const plans = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (!tableName) continue;
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+		const qualified = `${schema}.${baseTableName}`;
+		if (seen.has(qualified)) continue;
+		seen.add(qualified);
+		const policyStatements = [];
+		for (const rule of getEffectiveSecurityRules(collection)) policyStatements.push(...generatePolicyStatements(collection, rule, resolveCollection));
+		plans.push({
+			schema,
+			table: baseTableName,
+			qualified,
+			enableRls: `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;`,
+			policyStatements
+		});
+	}
+	for (const spec of resolveJunctionSpecs(collections).values()) {
+		const qualified = `${spec.schema}.${spec.table}`;
+		if (seen.has(qualified)) continue;
+		seen.add(qualified);
+		const junctionCollection = getJunctionCollectionConfig(spec);
+		const policyStatements = [];
+		for (const rule of getJunctionSecurityRules(spec)) policyStatements.push(...generatePolicyStatements(junctionCollection, rule, resolveCollection));
+		plans.push({
+			schema: spec.schema,
+			table: spec.table,
+			qualified,
+			enableRls: `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;`,
+			policyStatements
+		});
+	}
+	return plans;
+};
+//#endregion
+//#region src/schema/ensure-collection-tables.ts
+/**
+* Bringing a database up to date with a bundle's collections, additively.
+*
+* ## Why this exists
+*
+* A managed runtime boots someone else's compiled project against a database it
+* has never seen. Auth tables are ensured at boot already, but collection tables
+* were not created by anything: the platform ran the app and every `/api/data/*`
+* request answered 500 on a missing relation. `rebase db push` cannot help — it
+* is an Atlas-driven CLI command, and the runtime image ships no CLI.
+*
+* ## Why additive-only, forever
+*
+* This runs unattended, against a database with customers' data in it, with no
+* human reading a diff. So it may only ever do things that cannot lose data:
+* create a missing table, add a missing column, create a missing enum type.
+*
+* It will **never** drop a table or a column, narrow a type, or alter a
+* constraint. A removed field leaves its column behind; a renamed field looks
+* like an addition and the old column stays. That is the correct trade for an
+* automated path — the alternative is an unattended process that can silently
+* destroy a column, which is precisely the failure `db push` was hardened
+* against. Destructive changes stay a deliberate, human-reviewed migration.
+*
+* Because of that, this is safe to run on every boot, and re-running it is a
+* no-op.
+*/
+/** Postgres identifiers this module is willing to interpolate. */
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+function assertSafeIdentifier(value, what) {
+	if (!SAFE_IDENTIFIER.test(value)) throw new Error(`Refusing to build SQL with an unsafe ${what}: ${JSON.stringify(value)}`);
+	return value;
+}
+function schemaOf(collection) {
+	return isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+}
+function qualified(collection) {
+	return `${schemaOf(collection)}.${getTableName(collection)}`;
+}
+/**
+* Enum types a collection's properties require, as `schema.typename`.
+*
+* Named exactly as the DDL generator names them (`<table>_<column>`), because
+* a column added here has to reference the same type the generator would have
+* created — a second, differently-named type for the same field would be a
+* silent schema fork.
+*/
+function requiredEnums(collection) {
+	const table = getTableName(collection);
+	const schema = schemaOf(collection);
+	const out = [];
+	for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
+		const p = prop;
+		if (!("enum" in p) || !p.enum) continue;
+		if (p.type !== "string" && p.type !== "number") continue;
+		const values = p.enum.map((entry) => entry && typeof entry === "object" && "id" in entry ? String(entry.id) : String(entry)).filter((v) => v.length > 0);
+		if (values.length === 0) continue;
+		out.push({
+			name: `${schema}.${table}_${resolveColumnName(propName, p)}`,
+			values
+		});
+	}
+	return out;
+}
+/**
+* Decide what to add. Pure — the caller supplies what exists and runs the result.
+*
+* Ordering matters and is deliberate: enum types before the tables and columns
+* that reference them, tables before the columns added to other tables (a new
+* table may be the target of a relation), and nothing is emitted twice.
+*/
+function planCollectionSchemaEnsure(allCollections, existing) {
+	const collections = relationalCollections(allCollections);
+	const actions = [];
+	const plannedEnums = /* @__PURE__ */ new Set();
+	for (const collection of collections) for (const { name, values } of requiredEnums(collection)) {
+		if (existing.enums.has(name) || plannedEnums.has(name)) continue;
+		plannedEnums.add(name);
+		const [schema, typeName] = name.split(".");
+		actions.push({
+			kind: "create-enum",
+			target: name,
+			sql: `CREATE TYPE "${schema}"."${typeName}" AS ENUM (${values.map(quoteSqlLiteral).join(", ")});`
+		});
+	}
+	const created = /* @__PURE__ */ new Set();
+	for (const collection of collections) {
+		const key = qualified(collection);
+		if (existing.tables.has(key) || created.has(key)) continue;
+		created.add(key);
+		const schema = schemaOf(collection);
+		const table = getTableName(collection);
+		const idEntry = Object.entries(collection.properties ?? {}).find(([n, p]) => isIdProperty(n, p, collection));
+		const idName = idEntry ? resolveColumnName(idEntry[0], idEntry[1]) : "id";
+		const idProp = idEntry?.[1];
+		let idDef = `"${idName}" ${idProp ? getSqlColumnType(idEntry[0], idProp, collection, collections) : "TEXT"} PRIMARY KEY`;
+		if (idProp?.type === "string" && idProp.isId === "uuid") idDef += " DEFAULT gen_random_uuid()";
+		actions.push({
+			kind: "create-table",
+			target: key,
+			sql: `CREATE TABLE IF NOT EXISTS "${schema}"."${table}" (${idDef});`
+		});
+	}
+	const junctions = planJunctionTables(collections);
+	for (const junction of junctions) {
+		const key = `${junction.schema}.${junction.table}`;
+		if (existing.tables.has(key) || created.has(key)) continue;
+		created.add(key);
+		actions.push({
+			kind: "create-table",
+			target: key,
+			sql: junction.createTable
+		});
+	}
+	const legacyForeignKeys = [];
+	/**
+	* Move a relation column that is only missing because it was renamed.
+	*
+	* Returns true when it handled the column, so the caller skips the ordinary
+	* ADD. Adding here would be the wrong move and a quiet one: the data is in
+	* the old column, `ADD COLUMN` creates the new one empty beside it, every
+	* statement succeeds, and the relation reads the empty one. A rename is
+	* metadata-only in Postgres, keeps the values, and carries the column's
+	* indexes and constraints with it.
+	*
+	* Only ever reached when the new name is absent and the old name is
+	* present, so there is nothing to overwrite and nothing to choose between.
+	*/
+	const renameLegacyColumn = (key, schema, table, column, legacyName) => {
+		const present = existing.tables.get(key);
+		if (!legacyName || !present) return false;
+		if (present.has(column) || !present.has(legacyName)) return false;
+		legacyForeignKeys.push({
+			table: key,
+			expected: column,
+			legacy: legacyName
+		});
+		actions.push({
+			kind: "rename-column",
+			target: `${key}.${column}`,
+			sql: `ALTER TABLE "${schema}"."${table}" RENAME COLUMN "${legacyName}" TO "${column}";`
+		});
+		return true;
+	};
+	const addColumn = (key, schema, table, column, definition) => {
+		if (existing.tables.get(key)?.has(column)) return;
+		actions.push({
+			kind: "add-column",
+			target: `${key}.${column}`,
+			sql: `ALTER TABLE "${schema}"."${table}" ADD COLUMN IF NOT EXISTS "${column}" ${definition};`
+		});
+	};
+	for (const collection of collections) {
+		const key = qualified(collection);
+		const schema = schemaOf(collection);
+		const table = getTableName(collection);
+		const fresh = created.has(key);
+		const auth = isAuthCollection(collection);
+		for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
+			const p = prop;
+			if (isIdProperty(propName, p, collection)) continue;
+			if (p.type === "reference" || p.type === "relation") continue;
+			const column = resolveColumnName(propName, p);
+			const authDefinition = auth ? authUsersColumnDefinition(column) : void 0;
+			if (authDefinition) {
+				addColumn(key, schema, table, column, authDefinition);
+				continue;
+			}
+			let definition = getSqlColumnType(propName, p, collection, collections);
+			if (fresh && p.validation?.unique) definition += " UNIQUE";
+			const autoValue = p.autoValue;
+			if (p.type === "date" && (autoValue === "on_create" || autoValue === "on_update")) definition += " DEFAULT now()";
+			if (fresh && p.validation?.required) definition += " NOT NULL";
+			addColumn(key, schema, table, column, definition);
+		}
+		if (auth) {
+			const declared = new Set(Object.entries(collection.properties ?? {}).map(([name, prop]) => resolveColumnName(name, prop)));
+			for (const spec of AUTH_USERS_COLUMNS) {
+				if (declared.has(spec.column)) continue;
+				addColumn(key, schema, table, spec.column, authUsersColumnSql(spec));
+			}
+		}
+	}
+	for (const junction of junctions) {
+		const key = `${junction.schema}.${junction.table}`;
+		if (created.has(key)) continue;
+		for (const column of junction.columns) {
+			if (renameLegacyColumn(key, junction.schema, junction.table, column.name, column.legacyName)) continue;
+			addColumn(key, junction.schema, junction.table, column.name, column.type);
+		}
+	}
+	for (const relational of planRelationalColumns(collections)) {
+		const relKey = `${relational.schema}.${relational.table}`;
+		if (renameLegacyColumn(relKey, relational.schema, relational.table, relational.column, relational.legacyColumn)) continue;
+		addColumn(relKey, relational.schema, relational.table, relational.column, relational.type);
+	}
+	const knownConstraints = existing.constraints ?? /* @__PURE__ */ new Set();
+	const plannedConstraints = /* @__PURE__ */ new Set();
+	const foreignKeys = [...planRelationalColumns(collections).map((r) => r.foreignKey), ...junctions.flatMap((j) => j.foreignKeys)];
+	for (const fk of foreignKeys) {
+		if (!fk) continue;
+		const name = `${fk.schema}.${fk.table}.${fk.constraintName}`;
+		if (knownConstraints.has(name) || plannedConstraints.has(name)) continue;
+		plannedConstraints.add(name);
+		actions.push({
+			kind: "add-constraint",
+			target: `${fk.schema}.${fk.table}.${fk.constraintName}`,
+			sql: fk.sql
+		});
+	}
+	return {
+		actions,
+		statements: actions.map((a) => a.sql),
+		legacyForeignKeys
+	};
+}
+/** Read what the database has, for the schemas the collections live in. */
+async function readExistingSchema(client, schemas) {
+	const tables = /* @__PURE__ */ new Map();
+	const enums = /* @__PURE__ */ new Set();
+	if (schemas.length === 0) return {
+		tables,
+		enums
+	};
+	const inList = schemas.map((schema) => `'${assertSafeIdentifier(schema, "schema name")}'`).join(", ");
+	const { rows: columns } = await client.query(`SELECT table_schema, table_name, column_name
+         FROM information_schema.columns
+         WHERE table_schema IN (${inList})`);
+	for (const row of columns) {
+		const key = `${row.table_schema}.${row.table_name}`;
+		if (!tables.has(key)) tables.set(key, /* @__PURE__ */ new Set());
+		tables.get(key).add(row.column_name);
+	}
+	const { rows: enumRows } = await client.query(`SELECT n.nspname AS schema, t.typname AS name
+         FROM pg_type t
+         JOIN pg_namespace n ON t.typnamespace = n.oid
+         WHERE t.typtype = 'e' AND n.nspname IN (${inList})`);
+	for (const row of enumRows) enums.add(`${row.schema}.${row.name}`);
+	const constraints = /* @__PURE__ */ new Set();
+	const { rows: constraintRows } = await client.query(`SELECT n.nspname AS schema, c.relname AS table, con.conname AS name
+         FROM pg_constraint con
+         JOIN pg_class c ON con.conrelid = c.oid
+         JOIN pg_namespace n ON c.relnamespace = n.oid
+         WHERE n.nspname IN (${inList})`);
+	for (const row of constraintRows) constraints.add(`${row.schema}.${row.table}.${row.name}`);
+	return {
+		tables,
+		enums,
+		constraints
+	};
+}
+/**
+* Bring the database up to date. Returns what it did.
+*
+* Each statement runs on its own rather than in one transaction: they are all
+* independently safe and idempotent, and a single failure (an enum label that
+* cannot be added, say) should not roll back the tables that were created fine.
+* The error is surfaced with the statement that caused it.
+*/
+async function ensureCollectionTables(client, collections, log) {
+	const schemas = Array.from(/* @__PURE__ */ new Set([...collections.map(schemaOf), ...planJunctionTables(collections).map((j) => j.schema)]));
+	for (const schema of schemas) {
+		assertSafeIdentifier(schema, "schema name");
+		if (schema !== "public") await client.query(`CREATE SCHEMA IF NOT EXISTS "${schema}";`);
+	}
+	const plan = planCollectionSchemaEnsure(collections, await readExistingSchema(client, schemas));
+	const failures = [];
+	for (const legacy of plan.legacyForeignKeys) {
+		const message = `Renaming "${legacy.table}"."${legacy.legacy}" to "${legacy.expected}". The old name is the one Rebase derived for this relation before it singularized properly; the column keeps its data, indexes and constraints. To keep the old name instead, set \`localKey: "${legacy.legacy}"\` on the relation and this will stop.`;
+		logger.info(`[schema] ${message}`);
+		log?.(message);
+	}
+	if (plan.actions.length === 0) {
+		log?.("Schema is up to date; nothing to create.");
+		return {
+			...plan,
+			failures
+		};
+	}
+	for (const action of plan.actions) try {
+		await client.query(action.sql);
+		log?.(`${action.kind}: ${action.target}`);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (action.kind === "add-constraint") {
+			failures.push({
+				target: action.target,
+				error: message
+			});
+			continue;
+		}
+		throw new Error(`Failed to ${action.kind} ${action.target}: ${message}\n  ${action.sql}`);
+	}
+	return {
+		...plan,
+		failures
+	};
+}
+//#endregion
+export { ensureCollectionTables, readExistingSchema, planCollectionPolicies as t };
+
+//# sourceMappingURL=ensure-collection-tables-DSIxvLLD.js.map