@rebasepro/server-postgres 0.13.1-canary.g18cfeb7 → 0.13.1-canary.g1bf9303

package/dist/{auth-users-columns-Do9mw5Y5.js → auth-users-columns-BxT6FRyu.js}

@@ -2,8 +2,9 @@ import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
 import { l as __require, s as __commonJSMin } from "./connection-BuZ97wsr.js";
-import { a as rewriteLegacyRlsFunctions, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as NULL_OPS, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as toCanonicalOp, p as REST_TO_CANONICAL, r as RLS_ROLES_SQL, s as getDeclaredSubcollections } from "./src-C_wvdMnl.js";
-import { n as ANONYMOUS_USER_IDS, r as policy, t as ANONYMOUS_USER_ID } from "./policy-CPkCqVTz.js";
+import { a as policy, i as ANONYMOUS_USER_IDS, r as ANONYMOUS_USER_ID } from "./data_driver-ULAyJEi9.js";
+import { a as rewriteLegacyRlsFunctions, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as ALL_WHERE_FILTER_OPS, g as toCanonicalOp, h as REST_TO_CANONICAL, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as NULL_OPS, p as CANONICAL_TO_REST, r as RLS_ROLES_SQL, s as getDeclaredSubcollections } from "./src-DCdn3Val.js";
+import { createHash } from "node:crypto";
 //#region ../types/src/types/entities.ts
 /**
 * Class used to create a reference to a entity in a different path
@@ -55,25 +56,6 @@ function hasForeignKeyOnTarget(relation) {
 function isManyToMany(relation) {
 	return relation.kind === "manyToMany";
 }
-/**
-* Resolve a client-supplied list `limit` into a safe, always-defined value.
-*
-* - A provided limit is coerced to an integer and clamped to `[1, maxLimit]`,
-*   so `0`, negatives, and absurd values can never bypass the cap.
-* - An absent / blank / non-numeric limit falls back to the mode default:
-*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
-*
-* The return is never `undefined` — no ingress that routes its client limit
-* through this can produce an unbounded read.
-*/
-function resolveClientListLimit(rawLimit, opts = {}) {
-	const maxLimit = opts.maxLimit ?? 1e3;
-	if (rawLimit != null && String(rawLimit).trim() !== "") {
-		const parsed = typeof rawLimit === "number" ? rawLimit : parseInt(String(rawLimit), 10);
-		if (Number.isFinite(parsed)) return Math.min(Math.max(1, Math.floor(parsed)), maxLimit);
-	}
-	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
-}
 //#endregion
 //#region ../common/src/util/common.ts
 var DEFAULT_ONE_OF_TYPE = "type";
@@ -1408,6 +1390,28 @@ function legacyForeignKeyName(name) {
 	const snake = toSnakeCase(name);
 	return `${snake.endsWith("s") ? snake.slice(0, -1) : snake}_id`;
 }
+/**
+* Truncate an identifier to what Postgres will actually store.
+*
+* Postgres silently truncates identifiers at NAMEDATALEN-1 = 63 **bytes**, so a
+* name generated longer than that is not the name the database ends up holding.
+* Anything that later looks the object up by the name it generated then misses.
+*
+* Byte length, not string length: NAMEDATALEN is a byte bound, and a multi-byte
+* character straddling the boundary would be cut mid-sequence by `slice(0, 63)`.
+*
+* `TextEncoder` rather than `Buffer`, which is not a matter of taste: `Buffer`
+* is a Node global, and this package is imported by browser-facing ones. It
+* typechecked only where `@types/node` happened to be in scope, so
+* `packages/codegen` — whose tsconfig is `lib: ["ESNext", "dom"]` — could not
+* compile the file at all, and both of its suites failed to run. `TextEncoder`
+* and `TextDecoder` are standard in both runtimes and need no ambient types.
+*/
+function toPostgresIdentifier(name) {
+	const bytes = new TextEncoder().encode(name);
+	if (bytes.byteLength <= 63) return name;
+	return new TextDecoder("utf-8").decode(bytes.subarray(0, 63)).replace(/�+$/, "");
+}
 //#endregion
 //#region ../common/src/util/entities.ts
 /**
@@ -1517,6 +1521,25 @@ function createRelationRefWithData(id, path, data) {
 		data
 	};
 }
+//#endregion
+//#region ../common/src/util/collections.ts
+/**
+* A copy of `collections` ordered by slug.
+*
+* Every generator that turns collections into a file is order-dependent, and
+* every one of them is compared against its own output — `rebase doctor`
+* regenerates in memory and diffs, `generate-sdk && git diff --exit-code` gates
+* CI. While only the *writers* sorted, a project whose `readdirSync` order
+* differed from its slug order was reported permanently out of date, and the
+* fix the message printed rewrote the file in the order it was already in. The
+* generators sort themselves now, so no caller can get this wrong.
+*
+* A slug-less collection is left to the generator's own validation, which names
+* the offending collection; sorting must not throw first.
+*/
+function sortCollectionsBySlug(collections) {
+	return [...collections].sort((a, b) => (a.slug ?? "").localeCompare(b.slug ?? ""));
+}
 /** The eight-four-four-four-twelve shape of a UUID, any version. */
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /** Whether one address part can be a value of the column it addresses. */
@@ -2092,11 +2115,32 @@ function sqlToPolicy(sql) {
 * is the more dangerous spelling, because it inverts a rule instead of
 * emptying a table.
 */
-var FOREIGN_CONVENTION_UIDS = {
-	anon: "Supabase",
-	authenticated: "Supabase",
-	service_role: "Supabase"
-};
+/**
+* A `Map`, not an object literal.
+*
+* As `Record<string, string>` this was indexed with a literal taken straight
+* out of a policy, so every key on `Object.prototype` answered: a rule
+* comparing `rebase.uid()` to `"valueOf"`, `"toString"`, `"constructor"` or
+* `"hasOwnProperty"` found a truthy "platform" and reported an anonymous-grant
+* risk that does not exist — with the matched function interpolated into the
+* explanation as the platform's name. A security warning that fires on
+* innocent input is worse than none: it is what teaches people to skip the
+* warnings that are real.
+*
+* Same shape as the prototype-pollution class swept out of `setIn`, `getIn`,
+* `mergeDeep` and `unflattenObject` — a data-derived key reaching a plain
+* object. Found by a property test, on the input `"valueOf"`.
+*/
+var FOREIGN_CONVENTION_UIDS = /* @__PURE__ */ new Map([
+	["anon", "Supabase"],
+	["authenticated", "Supabase"],
+	["service_role", "Supabase"]
+]);
+/**
+* The same foreign literals, as a pattern for SQL that could not be parsed
+* back into structure.
+*/
+var FOREIGN_UID_LITERAL_SQL = new RegExp(String.raw`rebase\.uid\(\)\s*=\s*'(${[...FOREIGN_CONVENTION_UIDS.keys()].join("|")})'`, "i");
 /**
 * `rebase.uid() IS NOT NULL` in raw SQL, the clause that is always true.
 *
@@ -2143,17 +2187,27 @@ function findAnonymousGrants(expr) {
 			case "existsIn":
 				visit(e.where);
 				return;
-			case "raw":
+			case "raw": {
 				if (UID_NOT_NULL.test(e.sql)) found.push({
 					pattern: "uid-not-null",
 					detail: e.sql,
 					explanation: `\`rebase.uid() IS NOT NULL\` is true for every request that came from a client, including anonymous ones — they carry '${ANONYMOUS_USER_ID}', not NULL. Use \`condition: policy.authenticated()\` to mean "signed in".`
 				});
+				const foreign = FOREIGN_UID_LITERAL_SQL.exec(e.sql);
+				if (foreign) {
+					const literal = foreign[1];
+					found.push({
+						pattern: "foreign-uid-literal",
+						detail: literal,
+						explanation: `'${literal}' is a ${FOREIGN_CONVENTION_UIDS.get(literal)} convention. Rebase reports an anonymous request as '${ANONYMOUS_USER_ID}', so comparing against '${literal}' passes for every caller. Use \`condition: policy.authenticated()\` to mean "signed in".`
+					});
+				}
 				return;
+			}
 			case "compare": {
 				const literal = [e.left, e.right].find((o) => o.kind === "literal");
 				if (!(e.left.kind === "authUid" || e.right.kind === "authUid") || typeof literal?.value !== "string") return;
-				const platform = FOREIGN_CONVENTION_UIDS[literal.value];
+				const platform = FOREIGN_CONVENTION_UIDS.get(literal.value);
 				if (!platform) return;
 				found.push({
 					pattern: "foreign-uid-literal",
@@ -2169,12 +2223,43 @@ function findAnonymousGrants(expr) {
 	return found;
 }
 function parseOperand(str) {
-	if (/current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)/i.test(str) || /rebase\.uid\(\)/i.test(str)) return policy.authUid();
-	const stringMatch = str.match(/^'(.+)'$/);
-	if (stringMatch) return policy.literal(stringMatch[1]);
-	if (/^\w+$/.test(str)) return policy.field(str);
+	if (/^current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)$/i.test(str) || /^rebase\.uid\(\)$/i.test(str)) return policy.authUid();
+	const literal = parseSingleQuoted(str);
+	if (literal !== null) return policy.literal(literal);
+	if (/^-?\d+$/.test(str)) return policy.literal(Number(str));
+	if (/^-?\d*\.\d+$/.test(str)) return policy.literal(Number(str));
+	if (/^true$/i.test(str)) return policy.literal(true);
+	if (/^false$/i.test(str)) return policy.literal(false);
+	if (/^null$/i.test(str)) return policy.literal(null);
+	if (/^\w+$/.test(str) && toSnakeCase(str) !== "") return policy.field(str);
 	return null;
 }
+/**
+* Decode a single-quoted SQL literal, or null when `str` is not exactly one.
+*
+* Rejecting is as important as decoding: `'a' = 'b'` is two literals and an
+* operator, not one literal whose body contains a quote, and a regex anchored
+* on the outer quotes would happily read it as the latter. Every interior quote
+* must therefore be part of a `''` pair.
+*/
+function parseSingleQuoted(str) {
+	if (str.length < 2 || !str.startsWith("'") || !str.endsWith("'")) return null;
+	const body = str.slice(1, -1);
+	let out = "";
+	for (let i = 0; i < body.length; i++) {
+		if (body[i] !== "'") {
+			out += body[i];
+			continue;
+		}
+		if (body[i + 1] === "'") {
+			out += "'";
+			i++;
+			continue;
+		}
+		return null;
+	}
+	return out;
+}
 //#endregion
 //#region ../common/src/util/policy/securityRuleToConditions.ts
 /**
@@ -2332,8 +2417,14 @@ function rolesArraySql(roles) {
 * Rebase's enforcement model is unified: authenticated (user-context) requests
 * run under the restricted `rebase_user` role, so Postgres RLS binds *every*
 * statement — reads and writes. A collection's `securityRules` are the whole
-* authorization model. The server context (auth flows, migrations,
-* `dataAsAdmin`) runs as the owner and bypasses RLS.
+* authorization model. The server context (auth flows, migrations, raw
+* `rebase.sql`) runs as the owner and bypasses RLS.
+*
+* `rebase.dataAsAdmin` is **not** in that set, despite the name: it is scoped as
+* `{ uid: "service", roles: ["admin"] }`, so it runs as `rebase_user` like any
+* other caller and clears the baseline below through the *admin* arm, not the
+* server arm. Which is why `disableDefaultPolicies` plus a lone
+* `policy.serverContext()` rule locks it out too.
 *
 * Because RLS default-denies, every collection is **locked by default**: with
 * no rules, only the server context and admins can touch it. The generator
@@ -2391,11 +2482,28 @@ function getIdPropertyName$1(collection) {
 *
 * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
 */
+/**
+* The restrictive write gate for an auth collection.
+*
+* Restrictive, so it is ANDed with everything else: whatever an author's
+* permissive rules allow, a write to this table still has to satisfy this too.
+* It is the only thing standing between "users may edit their own row" and
+* "users may grant themselves any role".
+*/
+function adminWriteGate(tableName) {
+	return {
+		name: `${tableName}_require_admin_write`,
+		mode: "restrictive",
+		operations: [...DEFAULT_GUARDED_OPS],
+		condition: SERVER_OR_ADMIN_EXPR$1,
+		check: SERVER_OR_ADMIN_EXPR$1
+	};
+}
 function getEffectiveSecurityRules(collection) {
 	const explicit = [...collection.securityRules ?? []];
-	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return explicit;
 	const tableName = getTableName(collection);
 	const injected = [];
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection$1(collection) ? [...explicit, adminWriteGate(tableName)] : explicit;
 	injected.push({
 		name: `${tableName}_default_admin_read`,
 		operations: ["select"],
@@ -2413,13 +2521,7 @@ function getEffectiveSecurityRules(collection) {
 			operations: ["select"],
 			condition: policy.compare(policy.field(getIdPropertyName$1(collection)), "eq", policy.authUid())
 		});
-		injected.push({
-			name: `${tableName}_require_admin_write`,
-			mode: "restrictive",
-			operations: [...DEFAULT_GUARDED_OPS],
-			condition: SERVER_OR_ADMIN_EXPR$1,
-			check: SERVER_OR_ADMIN_EXPR$1
-		});
+		injected.push(adminWriteGate(tableName));
 	}
 	return [...explicit, ...injected];
 }
@@ -3708,8 +3810,24 @@ var QueryBuilder = class {
 	/**
 	* Set a free-text search string if supported by the backend.
 	*/
-	search(searchString) {
+	search(searchString, options) {
 		this.params.searchString = searchString;
+		if (options?.explain !== void 0) this.params.searchExplain = options.explain;
+		return this;
+	}
+	/**
+	* Order rows by nearest-neighbour distance to `vector`, closest first.
+	*
+	* Postgres only, over a property declared as `type: "vector"`. Rows come
+	* back with a `_distance`; `where` filters before the ordering.
+	*/
+	vectorSearch(property, vector, options) {
+		this.params.vectorSearch = {
+			property,
+			vector,
+			...options?.distance !== void 0 && { distance: options.distance },
+			...options?.threshold !== void 0 && { threshold: options.threshold }
+		};
 		return this;
 	}
 	/**
@@ -3909,21 +4027,50 @@ async function collectAllPages(find, params, label = "collection") {
 * metadata, so type coercion is the responsibility of the server-side data
 * driver which has access to the collection schema.
 *
-* Commas inside list values are backslash-escaped (`\,`), and literal
-* backslashes are escaped as `\\`.
+* Structural characters inside a value are backslash-escaped: `,` → `\,`,
+* `(` → `\(`, `)` → `\)`, and a literal backslash as `\\`. Decoding is
+* deliberately conservative — only those four sequences are decoded, so a
+* backslash that arrives unescaped from an older client survives intact.
 *
 * @module
 */
 /**
-* Unescape a single list item from the wire format.
-* `\\` → `\`, `\,` → `,`
+* Escape a value for the wire format: `\` → `\\`, `,` → `\,`, `(` → `\(`,
+* `)` → `\)`.
 */
-function unescapeListItem(value) {
+/**
+* The wire spelling of an empty list.
+*
+* A lone backslash: unproducible by {@link escapeWireValue}, which doubles
+* every backslash it emits, so it cannot collide with any real item.
+*/
+var EMPTY_LIST_TOKEN = "\\";
+/**
+* Unescape a wire-format value.
+*
+* **Conservative**, and deliberately so: only the four sequences
+* {@link escapeWireValue} actually produces are decoded. A backslash followed
+* by anything else is left exactly as it is.
+*
+* This used to consume the backslash before *any* character, which is
+* indistinguishable for anything this codec emitted — it only ever emits those
+* four — but not for input arriving from elsewhere. A client on an older
+* release sends a Windows path or a LIKE pattern with a literal `C:\x`
+* unescaped, and greedy unescaping silently turned it into `C:x`, changing
+* which rows matched. Decoding only what the encoder can produce makes the two
+* directions agree across versions.
+*/
+function unescapeWireValue(value) {
 	let result = "";
-	for (let i = 0; i < value.length; i++) if (value[i] === "\\" && i + 1 < value.length) {
-		result += value[i + 1];
-		i++;
-	} else result += value[i];
+	for (let i = 0; i < value.length; i++) {
+		const next = value[i + 1];
+		if (value[i] === "\\" && (next === "\\" || next === "," || next === "(" || next === ")")) {
+			result += next;
+			i++;
+			continue;
+		}
+		result += value[i];
+	}
 	return result;
 }
 /**
@@ -3941,13 +4088,205 @@ function splitListItems(inner) {
 		current += inner[i] + inner[i + 1];
 		i++;
 	} else if (inner[i] === ",") {
-		items.push(unescapeListItem(current));
+		items.push(unescapeWireValue(current));
 		current = "";
 	} else current += inner[i];
-	items.push(unescapeListItem(current));
+	items.push(unescapeWireValue(current));
 	return items;
 }
-var REST_OP_LOOKUP = REST_TO_CANONICAL;
+/**
+* Operator tables as `Map`s, because the key comes off the wire.
+*
+* Indexed as plain objects, every `Object.prototype` member answered: a query
+* string of `?f=valueOf.x` found a truthy "operator" — the inherited function —
+* and `deserializeTuple` returned it *as the operator*, so a function object
+* travelled on into the compilers in place of a `WhereFilterOp`. The guard one
+* line below (`if (!canonicalOp)`) reads as though it rejects anything unknown,
+* and does not: `Object.prototype` is not unknown to a plain object.
+*
+* Same shape as the prototype-key defects swept out of `setIn`, `getIn`,
+* `mergeDeep`, `unflattenObject` and `FOREIGN_CONVENTION_UIDS`.
+*/
+var REST_OP_LOOKUP = new Map(Object.entries(REST_TO_CANONICAL));
+new Map(Object.entries(CANONICAL_TO_REST));
+/** The operator spellings a rejection lists back to the caller. */
+var VALID_OPERATOR_LIST = ALL_WHERE_FILTER_OPS.join(", ");
+/**
+* A filter condition named an operator this dialect does not have.
+*
+* ## Why this throws, rather than returning a typed rejection
+*
+* `deserializeFilter` is the *shared* codec: the REST ingress
+* (`packages/server/src/api/rest/query-parser.ts`), the browser SDK and the
+* admin panel (`buildRebaseData.ts`) all decode through it. Two constraints
+* follow.
+*
+* - It cannot throw the server's `ApiError`. `@rebasepro/common` does not
+*   depend on `@rebasepro/server` (the dependency runs the other way), and a
+*   browser client has no error handler to render an `ApiError` with. So the
+*   rejection is this plain `Error` subclass, whose `message` reads correctly
+*   wherever it surfaces — a rejected promise in an app, a 400 body over HTTP.
+* - It cannot be a returned rejection *value*. Every caller assigns the result
+*   straight into a query it is about to run; a sentinel that none of them
+*   check would be ignored, which is exactly the silently-wrong-filter failure
+*   this exists to stop. Throwing is also what this file already does for the
+*   sibling cases — `serializeTuple` on an unknown canonical operator,
+*   `deserializeLogicalCondition` past the nesting bound — and the REST parser
+*   already converts the latter into a 400.
+*
+* `statusCode`, `code` and `details` are carried as fields because the server's
+* Hono error handler duck-types those off any thrown error: a decode path that
+* forgets to convert still answers 400 with the canonical envelope instead of a
+* 500 that says "An unexpected error occurred". `query-parser.ts` converts
+* explicitly all the same — that is the path the contract is stated on, and an
+* incidental 400 is not a contract.
+*/
+var UnknownFilterOperatorError = class extends Error {
+	/** The field the condition was written against. */
+	field;
+	/** The operator string as it arrived, verbatim. */
+	operator;
+	/** Every operator this dialect accepts, in canonical spelling. */
+	validOperators = ALL_WHERE_FILTER_OPS;
+	/** See the class docblock: read by the server's error handler. */
+	statusCode = 400;
+	code = "UNKNOWN_FILTER_OPERATOR";
+	details;
+	constructor(field, operator) {
+		super(`Unknown filter operator '${operator}' on field '${field}'. Valid operators: ${VALID_OPERATOR_LIST}`);
+		this.name = "UnknownFilterOperatorError";
+		this.field = field;
+		this.operator = operator;
+		this.details = {
+			field,
+			operator,
+			validOperators: ALL_WHERE_FILTER_OPS
+		};
+	}
+};
+/**
+* Two to three characters of ASCII punctuation and nothing else — the shape
+* every symbolic operator has (`==`, `>=`, `<>`, `~~`, `!!`, `>>`, `===`), and
+* one a column value effectively never has.
+*
+* Two characters minimum on purpose. A *single* punctuation character is a
+* perfectly ordinary value — `{ grade: ["-", "+"] }` is a two-item list, not a
+* condition — and the only single-character operator anyone actually mistypes
+* is `=`, which is named separately below. `<` and `>` need no special case:
+* they are real operators and resolve.
+*/
+var SYMBOLIC_OPERATOR = /^[^\p{L}\p{N}\s]{2,3}$/u;
+/** Lowercase, strip everything that is not a letter or digit. */
+function normalizeOperatorName(op) {
+	return op.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+/**
+* Every real operator name with its case and separators removed, so a
+* respelling of one — `arrayContains`, `not_in`, `NOT-LIKE`, `isNull` — is
+* recognised as an attempt at an operator rather than read as a value.
+*
+* These are rejected rather than accepted: admitting a second spelling of an
+* operator would leave two wire spellings of one thing, and the rejection
+* message names the one that works.
+*/
+var RESPELLED_OPERATORS = new Set([...ALL_WHERE_FILTER_OPS, ...Object.keys(REST_TO_CANONICAL)].map(normalizeOperatorName));
+/**
+* Operator names *other* query dialects use, which this one does not have.
+*
+* This list is curated, and deliberately so. For a word-shaped string there is
+* no rule that separates "an operator the caller guessed" from "a value that
+* happens to be a word": `{ tags: ["a", "b"] }` has to keep meaning a two-item
+* `in` list, so the codec cannot simply refuse every unrecognised word in
+* position 0. The line is therefore drawn by name, and only around names whose
+* use as an operator is far more likely than their use as one of two sibling
+* values. `contains` is the motivating case — the first thing a developer
+* reaches for, and until now it compiled to `title IN ('contains', 'Hell')`.
+*
+* Genuinely ambiguous single words (`any`, `all`, `exists`, `search`, `not`)
+* are left off: as operators they are rare, and as enum values they are common.
+* Everywhere else the tie goes to *rejecting*, because a 400 naming the
+* supported set costs the caller one round trip, and the alternative — which is
+* what every name on this list used to produce — is a query that runs, returns
+* rows, and is wrong.
+*/
+var NEAR_MISS_OPERATORS = /* @__PURE__ */ new Set([
+	"contains",
+	"notcontains",
+	"doesnotcontain",
+	"doesnotcontains",
+	"includes",
+	"notincludes",
+	"startswith",
+	"notstartswith",
+	"beginswith",
+	"startingwith",
+	"endswith",
+	"notendswith",
+	"matches",
+	"notmatches",
+	"regex",
+	"regexp",
+	"between",
+	"notbetween",
+	"equals",
+	"notequals",
+	"equalto",
+	"isequalto",
+	"isnotequalto",
+	"greaterthan",
+	"greaterthanorequal",
+	"greaterthanorequalto",
+	"lessthan",
+	"lessthanorequal",
+	"lessthanorequalto",
+	"isempty",
+	"isnotempty",
+	"oneof",
+	"noneof",
+	"anyof",
+	"allof",
+	"null",
+	"isnullorempty"
+]);
+/**
+* Was this string *meant* as an operator?
+*
+* Only consulted after {@link toCanonicalOp} has already failed to resolve it,
+* so a `true` here is always a rejection.
+*/
+function isOperatorShaped(op) {
+	if (op === "=") return true;
+	if (SYMBOLIC_OPERATOR.test(op)) return true;
+	const normalized = normalizeOperatorName(op);
+	if (!normalized) return false;
+	return RESPELLED_OPERATORS.has(normalized) || NEAR_MISS_OPERATORS.has(normalized);
+}
+/**
+* Read a `[op, value]` tuple, if that is what this is.
+*
+* Three outcomes, and the middle one is the defect this function exists for:
+*
+* - the operator resolves (canonical *or* REST spelling) → the canonical tuple;
+* - the operator does not resolve but was plainly meant as one → throw;
+* - it does not look like an operator at all → `undefined`, and the caller
+*   falls back to reading the array as a list of values.
+*
+* The old test was `toCanonicalOp(raw[0]) === raw[0]`, i.e. canonical spelling
+* only, with *everything else* — including every REST short-code — dropping
+* through to `["in", raw]`. So the operator string itself became a value in a
+* membership test: `["!!", "Hello"]` compiled to `title IN ('!!','Hello')`,
+* which matches, and the caller got back rows their filter was written to
+* exclude. `["eq", "active"]` had the same shape of failure.
+*/
+function readTuple(field, raw) {
+	if (!Array.isArray(raw) || raw.length !== 2) return void 0;
+	const [op, value] = raw;
+	if (typeof op !== "string") return void 0;
+	const canonical = toCanonicalOp(op);
+	if (canonical) return [canonical, value];
+	if (op.includes(".")) return void 0;
+	if (isOperatorShaped(op)) throw new UnknownFilterOperatorError(field, op);
+}
 /**
 * Parse a single PostgREST dot-string into a `[WhereFilterOp, unknown]` tuple.
 *
@@ -3964,10 +4303,13 @@ function deserializeSingle(raw) {
 	if (dotIndex === -1) return ["==", raw];
 	const prefix = raw.substring(0, dotIndex);
 	const rest = raw.substring(dotIndex + 1);
-	const canonicalOp = REST_OP_LOOKUP[prefix];
+	const canonicalOp = REST_OP_LOOKUP.get(prefix);
 	if (!canonicalOp) return ["==", raw];
 	if (NULL_OPS.has(canonicalOp)) return [canonicalOp, null];
-	if (rest.startsWith("(") && rest.endsWith(")")) return [canonicalOp, splitListItems(rest.slice(1, -1))];
+	if (rest.startsWith("(") && rest.endsWith(")")) {
+		const inner = rest.slice(1, -1);
+		return [canonicalOp, inner === EMPTY_LIST_TOKEN ? [] : splitListItems(inner)];
+	}
 	return [canonicalOp, rest];
 }
 /**
@@ -3982,20 +4324,27 @@ function deserializeSingle(raw) {
 *
 * deserializeFilter({ age: ["gte.18", "lt.65"] })
 * // → { age: [[">=", "18"], ["<", "65"]] }
+*
+* @throws {UnknownFilterOperatorError} when a condition names an operator this
+* dialect does not have. See that class for why a rejection here is a throw.
 */
 function deserializeFilter(query) {
 	const result = {};
 	for (const [field, raw] of Object.entries(query)) {
 		if (raw === void 0) continue;
-		if (Array.isArray(raw) && raw.length === 2 && typeof raw[0] === "string" && toCanonicalOp(raw[0]) === raw[0]) {
-			result[field] = raw;
+		const tuple = readTuple(field, raw);
+		if (tuple) {
+			result[field] = tuple;
 			continue;
 		}
 		if (Array.isArray(raw)) {
 			if (raw.length === 0) continue;
-			if (Array.isArray(raw[0]) && raw[0].length === 2 && typeof raw[0][0] === "string" && toCanonicalOp(raw[0][0]) === raw[0][0]) {
-				result[field] = raw;
-				continue;
+			if (Array.isArray(raw[0])) {
+				const tuples = raw.map((item) => readTuple(field, item));
+				if (tuples.every((t) => t !== void 0)) {
+					result[field] = tuples;
+					continue;
+				}
 			}
 			if (raw.length === 1) result[field] = typeof raw[0] === "string" ? deserializeSingle(raw[0]) : ["==", raw[0]];
 			else if (typeof raw[0] === "string" && raw[0].includes(".")) result[field] = raw.map((r) => typeof r === "string" ? deserializeSingle(r) : ["==", r]);
@@ -4039,10 +4388,12 @@ function createPrimaryKeyResolver(options) {
 * than postgres still serve rows with one, and this keeps them working.
 */
 function rowToEntity(row, slug, primaryKeys = []) {
+	const { _matches, ...values } = row;
 	return {
 		id: primaryKeys.length > 0 ? buildCompositeId(row, primaryKeys) : row.id,
 		path: slug,
-		values: row
+		values,
+		..._matches ? { searchMatches: _matches } : {}
 	};
 }
 /**
@@ -4200,6 +4551,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString,
+				searchExplain: params?.searchExplain,
 				onUpdate: (entities) => {
 					onUpdate({
 						data: entities.map((row) => rowToEntity(normalize(row), slug, getPks())),
@@ -4237,8 +4589,11 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 		offset(count) {
 			return new QueryBuilder(accessor).offset(count);
 		},
-		search(searchString) {
-			return new QueryBuilder(accessor).search(searchString);
+		search(searchString, options) {
+			return new QueryBuilder(accessor).search(searchString, options);
+		},
+		vectorSearch(property, vector, options) {
+			return new QueryBuilder(accessor).vectorSearch(property, vector, options);
 		},
 		include(...relations) {
 			return new QueryBuilder(accessor).include(...relations);
@@ -4326,8 +4681,18 @@ var SdkQueryBuilder = class {
 		this.params.offset = count;
 		return this;
 	}
-	search(searchString) {
+	search(searchString, options) {
 		this.params.searchString = searchString;
+		if (options?.explain !== void 0) this.params.searchExplain = options.explain;
+		return this;
+	}
+	vectorSearch(property, vector, options) {
+		this.params.vectorSearch = {
+			property,
+			vector,
+			...options?.distance !== void 0 && { distance: options.distance },
+			...options?.threshold !== void 0 && { threshold: options.threshold }
+		};
 		return this;
 	}
 	include(...relations) {
@@ -4414,6 +4779,7 @@ function toSdkCollectionClient(snap, slug = "collection") {
 		limit: (count) => new SdkQueryBuilder(client).limit(count),
 		offset: (count) => new SdkQueryBuilder(client).offset(count),
 		search: (searchString) => new SdkQueryBuilder(client).search(searchString),
+		vectorSearch: (property, vector, options) => new SdkQueryBuilder(client).vectorSearch(property, vector, options),
 		include: (...relations) => new SdkQueryBuilder(client).include(...relations)
 	};
 	return client;
@@ -4459,6 +4825,391 @@ function buildSdkData(driver) {
 	return wrapAsSdkData(buildRebaseData(driver));
 }
 //#endregion
+//#region src/schema/search-column.ts
+/**
+* The one place a collection's `search` block becomes SQL.
+*
+* Four things describe a Postgres table in this codebase — the DDL generator,
+* the Drizzle schema generator, the runtime table builder for BaaS mode, and
+* the boot-time schema ensure — and each of them has, at some point, described
+* a column differently from the others. The `varchar(255)` note in
+* `generate-postgres-ddl-logic` is one such scar: the same property produced a
+* capped column down one path and an uncapped one down the other, and nothing
+* failed until a user hit the cap.
+*
+* So the search column is not implemented four times. It is computed once,
+* here, and every generator renders the same {@link SearchColumnSpec}. There is
+* a test asserting exactly that (`search-column-contract.test.ts`); the point of
+* this module is that the test has something to assert *about*.
+*
+* ## Why the expressions look the way they do
+*
+* A `GENERATED ALWAYS AS … STORED` expression must be strictly IMMUTABLE, and
+* Postgres is stricter here than intuition. Verified against PostgreSQL 18:
+*
+* | expression                              | immutable |
+* |-----------------------------------------|-----------|
+* | `to_tsvector('spanish', col)`           | yes       |
+* | `to_tsvector(col)` (1-arg)              | **no** — depends on `default_text_search_config` |
+* | `array_to_string(col, ' ')`             | **no**    |
+* | `col::text` on `text[]`                 | **no**    |
+* | `to_jsonb(col)`                         | **no**    |
+* | `unaccent(col)`                         | **no** — dictionary lookup is STABLE |
+* | `jsonb_to_tsvector('spanish', j, '["string"]')` | yes |
+* | `setweight(...) || setweight(...)`      | yes       |
+*
+* Three of the four things a real search column needs are therefore unavailable
+* directly, which is why {@link searchHelperFunctions} exists: each wraps a
+* stable built-in in an SQL function declared IMMUTABLE. That declaration is a
+* promise, and it is a true one for these three — array joining, JSON string
+* extraction and accent folding are all deterministic for a given input; the
+* built-ins are marked stable only because they must account for element types
+* and dictionaries in general.
+*
+* The alternative was to skip `unaccent` and text arrays entirely. That is not
+* a real option in an accented language: Postgres stems `auditoría` to
+* `auditor` and `auditoria` to `auditori` — *different lexemes* — so a query
+* typed without accents misses every row that carries them.
+*/
+/** Schema-qualified so a collection outside `public` still resolves them. */
+var HELPER_SCHEMA = "public";
+/**
+* Names of the helper functions. Frozen: they are recorded in the stored
+* generation expression of every search column ever created, so renaming one
+* orphans every table that already has a search column.
+*/
+var SEARCH_TEXT_FN = `${HELPER_SCHEMA}.rebase_search_text`;
+var SEARCH_UNACCENT_FN = `${HELPER_SCHEMA}.rebase_search_unaccent`;
+/** Raised when a `search` block names something that cannot be searched. */
+var SearchConfigError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SearchConfigError";
+	}
+};
+/** The `search` block of a collection, or undefined when it has none. */
+var getSearchConfig = (collection) => isPostgresCollectionConfig(collection) ? collection.search : void 0;
+/**
+* Refuse a `search` block on a collection this engine does not store.
+*
+* The type only permits one on a `PostgresCollectionConfig`, so TypeScript
+* already stops the ordinary case. This catches the rest — a JS config, a cast,
+* a collection whose `engine` was changed after the block was written — because
+* the alternative is the exact failure the block exists to prevent: a developer
+* who declared what to index, saw no error, and got the substring fallback.
+*
+* Called with *every* collection, before the Postgres ones are filtered out.
+*/
+var assertSearchIsPostgresOnly = (collections) => {
+	for (const collection of collections) {
+		if (isPostgresCollectionConfig(collection)) continue;
+		if (!collection.search) continue;
+		const engine = collection.engine ?? "non-postgres";
+		throw new SearchConfigError(`${collection.slug}.search: full-text search is a Postgres feature, and this collection is served by \`${engine}\`. Remove the block — it would otherwise look configured while \`.search()\` kept using the default substring match.`);
+	}
+};
+var columnNameOf = (propName, prop) => prop && "columnName" in prop && typeof prop.columnName === "string" ? prop.columnName : toSnakeCase(propName);
+/**
+* Classify a property for search purposes.
+*
+* Deliberately narrower than `getSqlColumnType`: search only cares whether a
+* value reaches text, and the mapping from property to *physical* type is
+* asserted against `getSqlColumnType` in the contract test rather than
+* duplicated here.
+*
+* Returns null for anything that is not text-bearing, which the caller turns
+* into a boot error naming the property.
+*/
+var classify = (prop) => {
+	switch (prop.type) {
+		case "string": {
+			const sp = prop;
+			if (sp.enum) return {
+				kind: "text",
+				reason: "enum"
+			};
+			if (sp.isId === "uuid" || sp.columnType === "uuid") return {
+				kind: "text",
+				reason: "uuid"
+			};
+			return { kind: "text" };
+		}
+		case "map":
+			if (prop.columnType === "json") return {
+				kind: "jsonb",
+				reason: "json"
+			};
+			return { kind: "jsonb" };
+		case "array": {
+			const ap = prop;
+			let colType = ap.columnType;
+			if (!colType && ap.of && !Array.isArray(ap.of)) {
+				const of = ap.of;
+				if (of.type === "string") colType = "text[]";
+				else if (of.type === "number") colType = of.validation?.integer ? "integer[]" : "numeric[]";
+				else if (of.type === "boolean") colType = "boolean[]";
+			}
+			if (colType === "text[]") return { kind: "text_array" };
+			if (colType === "json") return {
+				kind: "jsonb",
+				reason: "json"
+			};
+			if (colType === "integer[]" || colType === "boolean[]" || colType === "numeric[]") return {
+				kind: "text_array",
+				reason: "non_text_array"
+			};
+			return { kind: "jsonb" };
+		}
+		default: return null;
+	}
+};
+var normalize = (inner, unaccent) => unaccent ? `${SEARCH_UNACCENT_FN}(${inner})` : inner;
+/** SQL reading one field as plain text, before normalization. */
+var rawTextSql = (field) => {
+	const col = `"${field.column}"`;
+	if (field.kind === "text") return `coalesce(${col}, '')`;
+	if (field.kind === "text_array") return `${SEARCH_TEXT_FN}(coalesce(${col}, '{}'::text[]))`;
+	return `${SEARCH_TEXT_FN}(coalesce(${field.jsonPath.length === 0 ? col : field.jsonPath.length === 1 ? `${col} -> ${quote(field.jsonPath[0])}` : `${col} #> ${quote(`{${field.jsonPath.join(",")}}`)}`}, '{}'::jsonb))`;
+};
+var quote = (v) => `'${v.replace(/'/g, "''")}'`;
+/**
+* Resolve and validate one declared field path.
+*
+* A path that does not resolve throws. The whole point of an explicit block is
+* that the author knows what is indexed; a silently dropped field would make it
+* a guess again, and the failure — a search that returns nothing for content
+* that is plainly in the row — is invisible from the outside.
+*/
+var resolveField = (entry, collection, cfg) => {
+	const path = typeof entry === "string" ? entry : entry.path;
+	const weight = (typeof entry === "string" ? void 0 : entry.weight) ?? "B";
+	const where = `${collection.slug}.search`;
+	if (!path || typeof path !== "string") throw new SearchConfigError(`${where}: every entry in \`fields\` needs a property path.`);
+	const [head, ...rest] = path.split(".");
+	const prop = collection.properties?.[head];
+	if (!prop) throw new SearchConfigError(`${where}: "${path}" starts at property "${head}", which this collection does not declare. Known properties: ${Object.keys(collection.properties ?? {}).join(", ")}.`);
+	const classified = classify(prop);
+	if (!classified) throw new SearchConfigError(`${where}: "${path}" is a \`${prop.type}\` property, which holds no text to search. Searchable kinds are \`string\`, \`string[]\` and \`map\` (or a path inside one).`);
+	if (classified.reason === "enum") throw new SearchConfigError(`${where}: "${path}" is an enum. Enums are a fixed vocabulary — filter on them with \`where\` instead, which is exact and uses an index.`);
+	if (classified.reason === "uuid") throw new SearchConfigError(`${where}: "${path}" is a UUID column. Look it up by id rather than searching it.`);
+	if (classified.reason === "json") throw new SearchConfigError(`${where}: "${path}" is a \`json\` column, and the cast from \`json\` to \`jsonb\` is not immutable, so it cannot feed a generated column. Declare the property as \`jsonb\` (the default) to search it.`);
+	if (classified.reason === "non_text_array") throw new SearchConfigError(`${where}: "${path}" is an array of numbers or booleans. Only \`string[]\` carries text to search.`);
+	if (rest.length > 0 && classified.kind !== "jsonb") throw new SearchConfigError(`${where}: "${path}" addresses a path inside "${head}", but "${head}" is a \`${prop.type}\` property, not a \`map\`. Only map properties have paths inside them.`);
+	const column = columnNameOf(head, prop);
+	const textSql = normalize(rawTextSql({
+		column,
+		jsonPath: rest,
+		kind: classified.kind
+	}), cfg.unaccent === true);
+	const language = cfg.language ?? "simple";
+	return {
+		path,
+		column,
+		jsonPath: rest,
+		kind: classified.kind,
+		weight,
+		sql: `setweight(to_tsvector(${quote(language)}, ${textSql}), ${quote(weight)})`,
+		textSql
+	};
+};
+/**
+* Build the full spec for a collection, or undefined when it has not opted in.
+*
+* Throws {@link SearchConfigError} on a config that cannot be honoured. Callers
+* at boot surface that as a startup failure — a search block that half-works is
+* worse than one that refuses.
+*/
+var buildSearchColumnSpec = (collection) => {
+	const cfg = getSearchConfig(collection);
+	if (!cfg) return void 0;
+	if (!Array.isArray(cfg.fields) || cfg.fields.length === 0) throw new SearchConfigError(`${collection.slug}.search: \`fields\` is empty. Name the properties to index, or remove the \`search\` block to keep the default ILIKE behaviour.`);
+	const table = getTableName(collection);
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	const column = cfg.column ?? "search_vector";
+	if (collection.properties?.[column]) throw new SearchConfigError(`${collection.slug}.search: the generated column "${column}" collides with a declared property of the same name. Set \`search.column\` to something else.`);
+	const fields = cfg.fields.map((entry) => resolveField(entry, collection, cfg));
+	const seen = /* @__PURE__ */ new Set();
+	for (const f of fields) {
+		if (seen.has(f.path)) throw new SearchConfigError(`${collection.slug}.search: "${f.path}" is listed twice.`);
+		seen.add(f.path);
+	}
+	const extensions = [];
+	if (cfg.unaccent) extensions.push("unaccent");
+	if (cfg.fuzzy) extensions.push("pg_trgm");
+	const spec = {
+		schema,
+		table,
+		column,
+		language: cfg.language ?? "simple",
+		unaccent: cfg.unaccent === true,
+		fields,
+		expression: fields.map((f) => f.sql).join(" || "),
+		indexName: toPostgresIdentifier(`${table}_${column}_gin`),
+		extensions
+	};
+	if (cfg.fuzzy) {
+		const fuzzyColumn = `${column}_text`;
+		if (collection.properties?.[fuzzyColumn]) throw new SearchConfigError(`${collection.slug}.search: \`fuzzy\` needs the column "${fuzzyColumn}", which collides with a declared property. Set \`search.column\` to something else.`);
+		spec.fuzzy = {
+			column: fuzzyColumn,
+			expression: fields.map((f) => f.textSql).join(" || ' ' || "),
+			indexName: toPostgresIdentifier(`${table}_${fuzzyColumn}_trgm`),
+			threshold: cfg.fuzzyThreshold ?? .3
+		};
+	}
+	return spec;
+};
+/**
+* The IMMUTABLE wrappers the generated expressions call.
+*
+* `CREATE OR REPLACE` so a boot against an existing database is a no-op rather
+* than an error, and idempotent for the same reason every other boot-time DDL
+* statement here is.
+*
+* The bodies are stable built-ins wrapped in an immutable promise — see the
+* module comment for why that promise is sound. `STRICT` matters: it makes NULL
+* in mean NULL out without executing the body, which is what the `coalesce` at
+* each call site then absorbs.
+*/
+var searchHelperFunctions = (spec) => {
+	const statements = [`CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(text[]) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT array_to_string($1, ' ') $$;`, `CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(jsonb) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT coalesce(string_agg(v, ' '), '')\n       FROM jsonb_array_elements_text(jsonb_path_query_array($1, 'strict $.**?(@.type() == "string")')) AS v $$;`];
+	if (spec.unaccent) statements.push(`CREATE OR REPLACE FUNCTION ${SEARCH_UNACCENT_FN}(text) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT ${HELPER_SCHEMA}.unaccent('${HELPER_SCHEMA}.unaccent'::regdictionary, $1) $$;`);
+	return statements;
+};
+/**
+* `CREATE EXTENSION` statements the spec's expressions depend on.
+*
+* `WITH SCHEMA public` is load-bearing, not tidiness. An unqualified
+* `CREATE EXTENSION` installs into the first schema on `search_path`, which
+* defaults to `"$user", public` — and the scaffold's database role is named
+* `rebase`, the same as the schema the generator creates one statement earlier.
+* So the moment that schema exists, `CREATE EXTENSION unaccent` puts the
+* dictionary in `rebase`, and every reference to `public.unaccent` below fails
+* with "text search dictionary does not exist". Observed, not theorised.
+*/
+var searchExtensionStatements = (spec) => spec.extensions.map((e) => `CREATE EXTENSION IF NOT EXISTS ${e} WITH SCHEMA ${HELPER_SCHEMA};`);
+/**
+* Index statements for the spec.
+*
+* `CONCURRENTLY` is deliberately *not* used here. This form is emitted into a
+* SQL file replayed as one unit — a migration, or `search.sql` — where a
+* concurrent build is not allowed. The boot-time ensure path runs statement by
+* statement against tables that are live and populated, and uses the
+* concurrent form instead; see `ensureSearchColumns`.
+*/
+var searchIndexStatements = (spec) => {
+	const statements = [`CREATE INDEX IF NOT EXISTS "${spec.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.column}");`];
+	if (spec.fuzzy) statements.push(`CREATE INDEX IF NOT EXISTS "${spec.fuzzy.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.fuzzy.column}" ${HELPER_SCHEMA}.gin_trgm_ops);`);
+	return statements;
+};
+/**
+* Marker on the comment of every generated search column this module creates.
+*
+* Versioned because the fingerprint below is only comparable against itself: a
+* future change to how it is computed has to read as "not stamped by this
+* version" rather than as drift on every existing column.
+*/
+var SEARCH_STAMP_PREFIX = "rebase:search:v1:";
+/**
+* A stable fingerprint of one generated column's expression.
+*
+* Why a stamp rather than reading the expression back: Postgres stores a
+* generated column's expression *parsed*, and hands it back deparsed — casts
+* made explicit, identifiers requoted, schema qualifications added or dropped
+* according to `search_path`. Comparing that text to the text we generated
+* would report drift on wording, and this comparison decides whether a boot
+* refuses, so a false positive is an outage. The stamp is written by the same
+* code that writes the column, so equality means what it says.
+*/
+var searchExpressionFingerprint = (expression) => `${SEARCH_STAMP_PREFIX}${createHash("sha256").update(expression).digest("hex").slice(0, 16)}`;
+/**
+* The stamps for a spec's generated columns — one per column, never shared.
+*
+* Per column on purpose: turning `fuzzy` on adds a second column and changes
+* nothing about the first, and a spec-wide fingerprint would report the
+* untouched `tsvector` column as drifted and refuse a boot over a change that
+* is purely additive.
+*/
+var searchColumnStamps = (spec) => {
+	const stamp = (column, expression) => {
+		const fingerprint = searchExpressionFingerprint(expression);
+		return {
+			column,
+			expression,
+			fingerprint,
+			sql: `COMMENT ON COLUMN "${spec.schema}"."${spec.table}"."${column}" IS ${quote(fingerprint)};`
+		};
+	};
+	const stamps = [stamp(spec.column, spec.expression)];
+	if (spec.fuzzy) stamps.push(stamp(spec.fuzzy.column, spec.fuzzy.expression));
+	return stamps;
+};
+/**
+* The generated column names a collection's search block adds, if any.
+*
+* These are physical columns on the table, so `SELECT *` returns them. They are
+* an index in column form — a list of lexeme positions, or a concatenation of
+* every searchable field on the row — and nothing outside the query planner has
+* any use for them. Left in, every list response carries a second, larger copy
+* of the row's text.
+*/
+var searchColumnNames = (collection) => {
+	let spec;
+	try {
+		spec = buildSearchColumnSpec(collection);
+	} catch {
+		return [];
+	}
+	if (!spec) return [];
+	return spec.fuzzy ? [spec.column, spec.fuzzy.column] : [spec.column];
+};
+/**
+* True for a column whose type only ever holds a search index.
+*
+* Independent of any collection config on purpose: an introspected database
+* (BaaS mode) can carry a `tsvector` column this framework never created —
+* Pagila's `film.fulltext` is the canonical one — and it should not be returned
+* to callers either. `isDerivedIndexColumn` already keeps such a column out of
+* the *properties*; this keeps it out of the *rows*.
+*/
+var isSearchIndexColumn = (column) => {
+	const sqlType = typeof column?.getSQLType === "function" ? column.getSQLType().toLowerCase() : "";
+	return sqlType === "tsvector" || sqlType === "tsquery";
+};
+/**
+* A drizzle select projection over `table` with the search columns dropped.
+*
+* Returns undefined when nothing needs dropping, so the common case keeps using
+* a plain `select()` and this stays invisible in the generated SQL.
+*/
+var visibleColumnProjection = (tableColumns, collection) => {
+	const excluded = excludedColumnNames(tableColumns, collection);
+	if (!tableColumns || excluded.length === 0) return void 0;
+	const projection = {};
+	for (const [name, column] of Object.entries(tableColumns)) if (!excluded.includes(name)) projection[name] = column;
+	return projection;
+};
+/** The same exclusion as a drizzle `db.query` `columns` denylist. */
+var hiddenColumnsOption = (tableColumns, collection) => {
+	const excluded = excludedColumnNames(tableColumns, collection);
+	if (excluded.length === 0) return void 0;
+	return Object.fromEntries(excluded.map((name) => [name, false]));
+};
+/**
+* The columns to keep out of a response, by name.
+*
+* `tableColumns` is whatever `getTableColumns` returned, which is `undefined`
+* for anything that is not a real drizzle table — a stub in a test, a derived
+* or nested path with no table behind it. Nothing to exclude is the right
+* answer there, and it has to be an answer rather than a throw: this runs on
+* the read path of every collection, opted in or not.
+*/
+var excludedColumnNames = (tableColumns, collection) => {
+	if (!tableColumns || typeof tableColumns !== "object") return [];
+	const byName = new Set(collection ? searchColumnNames(collection) : []);
+	return Object.keys(tableColumns).filter((name) => byName.has(name) || isSearchIndexColumn(tableColumns[name]));
+};
+//#endregion
 //#region src/schema/auth-users-columns.ts
 /**
 * `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it
@@ -4570,6 +5321,6 @@ function isAuthCollection(collection) {
 	return typeof auth === "object" && auth !== null && auth.enabled === true;
 }
 //#endregion
-export { generateForeignKeyName as A, hasForeignKeyOnTarget as B, getDeclaredPrimaryKeys as C, createRelationRefWithData as D, createRelationRef as E, camelCase as F, Vector as H, toSnakeCase as I, DEFAULT_ONE_OF_TYPE as L, getPolicyNamesForRule as M, isPrototypePollutingKey as N, normalizeToEntityRelation as O, mergeDeep as P, DEFAULT_ONE_OF_VALUE as R, buildCompositeId as S, parseIdValues as T, isManyToMany as V, getColumnName as _, buildSdkData as a, getTableVarName as b, resolveStringColumnLength as c, resolveJunctionSpecs as d, getEffectiveSecurityRules as f, findRelation as g, findAnonymousGrants as h, isAuthCollection as i, legacyForeignKeyName as j, updateDateAutoValues as k, getJunctionCollectionConfig as l, securityRuleToConditions as m, authUsersColumnDefinition as n, CollectionRegistry as o, policyToPostgres as p, authUsersColumnSql as r, relationalCollections as s, AUTH_USERS_COLUMNS as t, getJunctionSecurityRules as u, getEnumVarName as v, isAddressableId as w, resolveCollectionRelations as x, getTableName as y, resolveClientListLimit as z };
+export { isManyToMany as $, getTableName as A, normalizeToEntityRelation as B, getEffectiveSecurityRules as C, findRelation as D, findAnonymousGrants as E, isAddressableId as F, getPolicyNamesForRule as G, generateForeignKeyName as H, parseIdValues as I, camelCase as J, isPrototypePollutingKey as K, sortCollectionsBySlug as L, resolveCollectionRelations as M, buildCompositeId as N, getColumnName as O, getDeclaredPrimaryKeys as P, hasForeignKeyOnTarget as Q, createRelationRef as R, resolveJunctionSpecs as S, securityRuleToConditions as T, legacyForeignKeyName as U, updateDateAutoValues as V, toPostgresIdentifier as W, DEFAULT_ONE_OF_TYPE as X, toSnakeCase as Y, DEFAULT_ONE_OF_VALUE as Z, CollectionRegistry as _, SEARCH_STAMP_PREFIX as a, getJunctionCollectionConfig as b, assertSearchIsPostgresOnly as c, searchColumnStamps as d, Vector as et, searchExtensionStatements as f, buildSdkData as g, visibleColumnProjection as h, isAuthCollection as i, getTableVarName as j, getEnumVarName as k, buildSearchColumnSpec as l, searchIndexStatements as m, authUsersColumnDefinition as n, SEARCH_TEXT_FN as o, searchHelperFunctions as p, mergeDeep as q, authUsersColumnSql as r, SEARCH_UNACCENT_FN as s, AUTH_USERS_COLUMNS as t, hiddenColumnsOption as u, relationalCollections as v, policyToPostgres as w, getJunctionSecurityRules as x, resolveStringColumnLength as y, createRelationRefWithData as z };
 
-//# sourceMappingURL=auth-users-columns-Do9mw5Y5.js.map
+//# sourceMappingURL=auth-users-columns-BxT6FRyu.js.map