@rebasepro/server-postgres 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/{auth-users-columns-CgyPWQ18.js → collection-index-DxJBvVTH.js}

@@ -1,10 +1,50 @@
 import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
-import { l as __require, s as __commonJSMin } from "./connection-BuZ97wsr.js";
-import { a as policy, i as ANONYMOUS_USER_IDS, r as ANONYMOUS_USER_ID } from "./data_driver-ULAyJEi9.js";
-import { _ as isRelationAggregateSort, a as rewriteLegacyRlsFunctions, b as toCanonicalOp, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as ALL_WHERE_FILTER_OPS, h as REST_TO_CANONICAL, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as NULL_OPS, p as CANONICAL_TO_REST, r as RLS_ROLES_SQL, s as getDeclaredSubcollections, y as sortKeyToString } from "./src-BBFsDaeA.js";
-import { createHash } from "node:crypto";
+import { d as __require, l as __commonJSMin } from "./connection-GOKU3Hu5.js";
+import { _ as isRelationAggregateSort, a as rewriteLegacyRlsFunctions, b as toCanonicalOp, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as ALL_WHERE_FILTER_OPS, h as REST_TO_CANONICAL, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as NULL_OPS, p as CANONICAL_TO_REST, r as RLS_ROLES_SQL, s as getDeclaredSubcollections, y as sortKeyToString } from "./src-DiDgtX8P.js";
+//#region ../types/src/errors.ts
+/**
+* The single error type thrown across the entire Rebase client surface —
+* HTTP data/control-plane calls, realtime/WebSocket operations, and
+* client-side logic errors (e.g. an unknown collection accessor). A `catch`
+* block only ever needs to check for this one class:
+*
+* ```ts
+* import { RebaseApiError } from "@rebasepro/client"; // re-exported
+*
+* try {
+*   await client.data.products.update(id, { price: 9 });
+* } catch (e) {
+*   if (e instanceof RebaseApiError) {
+*     if (e.status === 404) { ... }   // HTTP failures carry a status
+*     console.error(e.code, e.details);
+*   }
+* }
+* ```
+*
+* `status` is present for HTTP failures and `undefined` otherwise, so its
+* presence distinguishes transport-level errors from realtime/logic errors.
+*
+* @group Errors
+*/
+var RebaseApiError = class extends Error {
+	/** HTTP status code, or `undefined` for non-HTTP errors. */
+	status;
+	/** Stable machine-readable error code, when the server supplied one. See {@link RebaseErrorCode}. */
+	code;
+	/** Structured error payload from the server, when present. */
+	details;
+	constructor(message, init = {}) {
+		super(message);
+		this.name = "RebaseApiError";
+		this.status = init.status;
+		this.code = init.code;
+		this.details = init.details;
+		if (init.cause !== void 0) this.cause = init.cause;
+	}
+};
+//#endregion
 //#region ../types/src/types/entities.ts
 /**
 * Class used to create a reference to a entity in a different path
@@ -57,6 +97,151 @@ function isManyToMany(relation) {
 	return relation.kind === "manyToMany";
 }
 //#endregion
+//#region ../types/src/types/policy.ts
+/**
+* The id a request without a logged-in user reports as `rebase.uid()`.
+*
+* A user-context request always sets `app.uid`: blank would read back as
+* `NULL`, and `NULL` is how the trusted server context is recognised, so an
+* anonymous visitor would be promoted to server privileges. The driver
+* therefore substitutes this sentinel at the single chokepoint where the GUC
+* is set.
+*
+* The consequence for policy authors is that **`rebase.uid() IS NOT NULL` is a
+* tautology on the user path** — it is true for anonymous visitors too. Use
+* {@link policy.authenticated} to mean "signed in", and
+* {@link policy.serverContext} to mean "the trusted server context". Do not
+* hand-write the comparison: see {@link ANONYMOUS_USER_IDS} for why one
+* literal is not enough.
+*
+* @group Models
+*/
+var ANONYMOUS_USER_ID = "anonymous";
+/**
+* Every uid that has ever meant "nobody is signed in" — newest first.
+*
+* There are two because there were two. The types, the policy compiler, the
+* JavaScript evaluator and the linter were all built on
+* {@link ANONYMOUS_USER_ID}, while the request path scoped unauthenticated
+* callers as `'anon'` — so `policy.authenticated()`, which compiled to
+* `rebase.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The
+* sanctioned way to write "signed in" granted to everyone, and the linter
+* flagged the spelling that actually worked as a foreign convention.
+*
+* The request path now reports {@link ANONYMOUS_USER_ID}. `'anon'` stays here
+* because policies outlive the server that generated them: a database still
+* holding policies from before the fix, or a project whose server has not been
+* upgraded yet, must not become a grant in either direction. Compile against
+* this list, not against a single literal.
+*
+* No real user id is ever one of these, so a match is always "not signed in".
+*
+* @group Models
+*/
+var ANONYMOUS_USER_IDS = [ANONYMOUS_USER_ID, "anon"];
+/** @group Models */
+var policy = {
+	true: () => ({ kind: "true" }),
+	false: () => ({ kind: "false" }),
+	and: (...operands) => ({
+		kind: "and",
+		operands
+	}),
+	or: (...operands) => ({
+		kind: "or",
+		operands
+	}),
+	not: (operand) => ({
+		kind: "not",
+		operand
+	}),
+	compare: (left, op, right) => ({
+		kind: "compare",
+		op,
+		left,
+		right
+	}),
+	rolesOverlap: (roles) => ({
+		kind: "rolesOverlap",
+		roles
+	}),
+	rolesContain: (roles) => ({
+		kind: "rolesContain",
+		roles
+	}),
+	authenticated: () => ({ kind: "authenticated" }),
+	serverContext: () => ({ kind: "serverContext" }),
+	existsIn: (args) => ({
+		kind: "existsIn",
+		collection: args.collection,
+		where: args.where
+	}),
+	raw: (sql) => ({
+		kind: "raw",
+		sql
+	}),
+	field: (name) => ({
+		kind: "field",
+		name
+	}),
+	outerField: (name) => ({
+		kind: "outerField",
+		name
+	}),
+	literal: (value) => ({
+		kind: "literal",
+		value
+	}),
+	authUid: () => ({ kind: "authUid" }),
+	authRoles: () => ({ kind: "authRoles" })
+};
+/**
+* Thrown by {@link resolveClientListLimit} for a `limit` the platform will not
+* serve. Carries an HTTP status so an ingress that speaks HTTP can forward it
+* verbatim, and `maxLimit` so one can be built without re-deriving the ceiling.
+*
+* @group Errors
+*/
+var ListLimitError = class ListLimitError extends RebaseApiError {
+	/** The ceiling that was exceeded — what the caller should page by instead. */
+	maxLimit;
+	constructor(message, maxLimit) {
+		super(message, {
+			status: 400,
+			code: "INVALID_LIMIT"
+		});
+		this.name = "ListLimitError";
+		this.maxLimit = maxLimit;
+		Object.setPrototypeOf(this, ListLimitError.prototype);
+	}
+};
+/**
+* Resolve a client-supplied list `limit` into a safe, always-defined value.
+*
+* - An absent / blank limit falls back to the mode default:
+*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
+* - A limit that is present must be an integer in `[1, maxLimit]`. Anything
+*   else — `0`, a negative, `1.5`, `abc`, `100000000` — throws
+*   {@link ListLimitError} rather than being coerced into range, because every
+*   coercion answers a question the caller did not ask with a page it cannot
+*   tell apart from the whole collection.
+*
+* The return is never `undefined` — no ingress that routes its client limit
+* through this can produce an unbounded read.
+*
+* @throws {ListLimitError} when a present `limit` is not an integer in range.
+*/
+function resolveClientListLimit(rawLimit, opts = {}) {
+	const maxLimit = opts.maxLimit ?? 1e3;
+	if (rawLimit != null && String(rawLimit).trim() !== "") {
+		const parsed = typeof rawLimit === "number" ? rawLimit : Number(String(rawLimit).trim());
+		if (!Number.isInteger(parsed) || parsed < 1) throw new ListLimitError(`Invalid \`limit\`: ${String(rawLimit)}. Expected a whole number between 1 and ${maxLimit}.`, maxLimit);
+		if (parsed > maxLimit) throw new ListLimitError(`\`limit\` ${parsed} is above the maximum of ${maxLimit}. Ask for at most ${maxLimit} rows per read and page through the rest with \`offset\` — answering with a smaller page would be indistinguishable from there being no more rows.`, maxLimit);
+		return parsed;
+	}
+	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
+}
+//#endregion
 //#region ../common/src/util/common.ts
 var DEFAULT_ONE_OF_TYPE = "type";
 var DEFAULT_ONE_OF_VALUE = "value";
@@ -1408,9 +1593,28 @@ function legacyForeignKeyName(name) {
 * and `TextDecoder` are standard in both runtimes and need no ambient types.
 */
 function toPostgresIdentifier(name) {
+	return truncateToBytes(name, 63);
+}
+/**
+* {@link toPostgresIdentifier} with the bound lifted to a parameter.
+*
+* Exists for names that end in something load-bearing. Truncating at 63 keeps
+* the *head* of a name and discards the tail, which is right for a descriptive
+* identifier and wrong for a hashed one: the hash is the part that makes it
+* unique, and it is at the end. A caller that appends a fingerprint truncates
+* the readable head to `63 - <tail>` itself and then appends, so the bound is
+* still 63 and the hash always survives.
+*
+* `contracts/derived-names.txt` records what the alternative costs — a foreign
+* key frozen as `..._corres`, its `_fkey` suffix truncated away, so a second
+* foreign key on that table would derive a byte-identical name.
+*
+* One truncation rule, in one function, so the two cannot drift.
+*/
+function truncateToBytes(name, maxBytes) {
 	const bytes = new TextEncoder().encode(name);
-	if (bytes.byteLength <= 63) return name;
-	return new TextDecoder("utf-8").decode(bytes.subarray(0, 63)).replace(/�+$/, "");
+	if (bytes.byteLength <= maxBytes) return name;
+	return new TextDecoder("utf-8").decode(bytes.subarray(0, maxBytes)).replace(/�+$/, "");
 }
 /**
 * The API name a database column is served under.
@@ -1965,8 +2169,45 @@ function getTableName(collection) {
 	if (isRelationalCollectionConfig(collection)) return collection.table ?? toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
 	return toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
 }
+/**
+* A JavaScript identifier: what a generated `export const <name> =` needs.
+*
+* Deliberately the same shape the two schema generators already define
+* privately — this is the third place that needed it, and the first two guard
+* property keys and member accesses while nothing guarded the variable name
+* itself.
+*/
+var JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+/**
+* The variable name a generated table is bound to.
+*
+* Camel-cases underscores, and then guarantees the result is a legal
+* identifier. It did only the first, so a table name that is legal in Postgres
+* and not in JavaScript produced a `schema.generated.ts` that does not parse:
+*
+*   `2024_archive`       → `export const 2024Archive = pgTable(…)`
+*                          "An identifier or keyword cannot immediately follow
+*                           a numeric literal"
+*   `reporting.events`   → `export const reporting.events = pgTable(…)`
+*                          "',' expected"
+*
+* That file is imported by the server, so the failure is not one broken
+* collection — `rebase build` and `db push` fail at tsc for the whole
+* directory. And it is reachable from a documented flow: `rebase init` against
+* a database holding a table called `2024_archive` writes a collection file
+* that parses and a schema file that does not.
+*
+* **A no-op for every name that already worked**, which is what makes changing
+* a derived name safe here: the only inputs whose output changes are the ones
+* that produced a syntax error, and nothing can be running against those.
+* Separators become camel case rather than disappearing, so `reporting.events`
+* and `reporting_events` do not collide into one variable.
+*/
 function getTableVarName(tableName) {
-	return tableName.replace(/_([a-z])/g, (_, char) => char.toUpperCase());
+	const camel = tableName.replace(/_([a-z])/g, (_, char) => char.toUpperCase());
+	if (JS_IDENTIFIER.test(camel)) return camel;
+	const sanitised = camel.replace(/[^A-Za-z0-9_$]+([A-Za-z0-9])?/g, (_, char) => char ? char.toUpperCase() : "").replace(/^([0-9])/, "t$1");
+	return JS_IDENTIFIER.test(sanitised) ? sanitised : `t${sanitised}`;
 }
 function getEnumVarName(tableName, propName) {
 	return `${getTableVarName(tableName)}${propName.charAt(0).toUpperCase() + propName.slice(1)}`;
@@ -2479,7 +2720,7 @@ function compile(expr, scope) {
 		}
 		case "rolesOverlap": return `string_to_array(${RLS_ROLES_SQL}, ',') && ${rolesArraySql(expr.roles)}`;
 		case "rolesContain": return `string_to_array(${RLS_ROLES_SQL}, ',') @> ${rolesArraySql(expr.roles)}`;
-		case "authenticated": return `${RLS_UID_SQL} IS NOT NULL AND ${RLS_UID_SQL} NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
+		case "authenticated": return `${RLS_UID_SQL} IS NOT NULL AND ${RLS_UID_SQL} NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral$1).join(", ")})`;
 		case "serverContext": return `${RLS_UID_SQL} IS NULL`;
 		case "existsIn": return compileExistsIn(expr, scope);
 		case "raw": return rewriteLegacyRlsFunctions(expr.sql).replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
@@ -2518,7 +2759,7 @@ function operandToSql(operand, scope) {
 	switch (operand.kind) {
 		case "field": return `${scope.fieldPrefix}${resolveColumnName(operand.name, scope.fieldCollection)}`;
 		case "outerField": return `${scope.outerPrefix}${resolveColumnName(operand.name, scope.outerCollection)}`;
-		case "literal": return quoteLiteral(operand.value);
+		case "literal": return quoteLiteral$1(operand.value);
 		case "authUid": return RLS_UID_SQL;
 		case "authRoles": return `string_to_array(${RLS_ROLES_SQL}, ',')`;
 	}
@@ -2679,7 +2920,7 @@ function quoteColumnIdentifier(name) {
 	if (BARE_IDENTIFIER.test(name) && !RESERVED_SQL_WORDS.has(name)) return name;
 	return `"${name.replace(/"/g, "\"\"")}"`;
 }
-function quoteLiteral(value) {
+function quoteLiteral$1(value) {
 	if (value === null) return "NULL";
 	if (typeof value === "boolean") return value ? "true" : "false";
 	if (typeof value === "number") return String(value);
@@ -2745,7 +2986,7 @@ var DEFAULT_GUARDED_OPS = [
 	"delete"
 ];
 /** Whether a collection is flagged as an authentication collection. */
-function isAuthCollection$1(collection) {
+function isAuthCollection(collection) {
 	const auth = collection.auth;
 	return auth === true || typeof auth === "object" && auth?.enabled === true;
 }
@@ -2783,7 +3024,7 @@ function getEffectiveSecurityRules(collection) {
 	const explicit = [...collection.securityRules ?? []];
 	const tableName = getTableName(collection);
 	const injected = [];
-	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection$1(collection) ? [...explicit, adminWriteGate(tableName)] : explicit;
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection(collection) ? [...explicit, adminWriteGate(tableName)] : explicit;
 	injected.push({
 		name: `${tableName}_default_admin_read`,
 		operations: ["select"],
@@ -2795,7 +3036,7 @@ function getEffectiveSecurityRules(collection) {
 		condition: SERVER_OR_ADMIN_EXPR$1,
 		check: SERVER_OR_ADMIN_EXPR$1
 	});
-	if (isAuthCollection$1(collection)) {
+	if (isAuthCollection(collection)) {
 		injected.push({
 			name: `${tableName}_default_self_read`,
 			operations: ["select"],
@@ -2805,6 +3046,22 @@ function getEffectiveSecurityRules(collection) {
 	}
 	return [...explicit, ...injected];
 }
+/**
+* The framework defaults that {@link getEffectiveSecurityRules} would add to a
+* collection, without the author's own rules.
+*
+* These policies appear in the database under names the author never wrote, and
+* a permissive policy ORs with every other permissive policy — so someone
+* reading their `securityRules` and then the real ACL sees more access than they
+* declared. Dropping them by hand does nothing either: `db push` is declarative,
+* so the next push asserts them again. Callers use this to say, in the generated
+* DDL, which policies are injected and how to take them off.
+*/
+function getInjectedSecurityRules(collection) {
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection(collection) ? [adminWriteGate(getTableName(collection))] : [];
+	const explicitCount = (collection.securityRules ?? []).length;
+	return getEffectiveSecurityRules(collection).slice(explicitCount);
+}
 //#endregion
 //#region ../common/src/util/junction-policies.ts
 var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
@@ -3281,25 +3538,8 @@ function getJunctionSecurityRules(spec) {
 	});
 })))();
 /**
-* How wide a `varchar`/`char` column should be for a given property.
-*
-* One definition, three call sites, because they used to disagree. For the same
-* `columnType: "varchar"` property the DDL generator emitted `VARCHAR(255)`
-* while the Drizzle generator emitted a bare `varchar("col")` — which Postgres
-* reads as *unbounded* — so which of the two you ran decided whether the column
-* had a limit at all. Introspection then dropped the length entirely, so reading
-* an existing `character varying(500)` column back and regenerating it produced
-* a `VARCHAR(255)`: a silent narrowing of a column with data already in it.
-*
-* `validation.max` is the property's own statement about how long the value may
-* be, so it is the only sensible source for the column's width — and it keeps
-* the constraint the database enforces in step with the one the app enforces,
-* rather than inventing a second, different limit underneath it.
+* Apply PropertyConditions to a resolved property, evaluating all JSON Logic rules.
 */
-function resolveStringColumnLength(prop) {
-	const max = prop.validation?.max;
-	return typeof max === "number" && Number.isInteger(max) && max > 0 ? max : 255;
-}
 //#endregion
 //#region ../../node_modules/.pnpm/fast-equals@6.0.2/node_modules/fast-equals/dist/es/index.mjs
 var { getOwnPropertyNames, getOwnPropertySymbols } = Object;
@@ -4931,6 +5171,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				orderBy: normalizeOrderBy(params?.orderBy),
 				searchString: params?.searchString,
 				searchExplain: params?.searchExplain,
+				vectorSearch: params?.vectorSearch,
 				onUpdate: (entities) => {
 					onUpdate({
 						data: entities.map((row) => rowToEntity(normalize(row), slug, getPks())),
@@ -5206,502 +5447,244 @@ function buildSdkData(driver) {
 	return wrapAsSdkData(buildRebaseData(driver));
 }
 //#endregion
-//#region src/schema/search-column.ts
-/**
-* The one place a collection's `search` block becomes SQL.
-*
-* Four things describe a Postgres table in this codebase — the DDL generator,
-* the Drizzle schema generator, the runtime table builder for BaaS mode, and
-* the boot-time schema ensure — and each of them has, at some point, described
-* a column differently from the others. The `varchar(255)` note in
-* `generate-postgres-ddl-logic` is one such scar: the same property produced a
-* capped column down one path and an uncapped one down the other, and nothing
-* failed until a user hit the cap.
-*
-* So the search column is not implemented four times. It is computed once,
-* here, and every generator renders the same {@link SearchColumnSpec}. There is
-* a test asserting exactly that (`search-column-contract.test.ts`); the point of
-* this module is that the test has something to assert *about*.
-*
-* ## Why the expressions look the way they do
-*
-* A `GENERATED ALWAYS AS … STORED` expression must be strictly IMMUTABLE, and
-* Postgres is stricter here than intuition. Verified against PostgreSQL 18:
-*
-* | expression                              | immutable |
-* |-----------------------------------------|-----------|
-* | `to_tsvector('spanish', col)`           | yes       |
-* | `to_tsvector(col)` (1-arg)              | **no** — depends on `default_text_search_config` |
-* | `array_to_string(col, ' ')`             | **no**    |
-* | `col::text` on `text[]`                 | **no**    |
-* | `to_jsonb(col)`                         | **no**    |
-* | `unaccent(col)`                         | **no** — dictionary lookup is STABLE |
-* | `jsonb_to_tsvector('spanish', j, '["string"]')` | yes |
-* | `setweight(...) || setweight(...)`      | yes       |
-*
-* Three of the four things a real search column needs are therefore unavailable
-* directly, which is why {@link searchHelperFunctions} exists: each wraps a
-* stable built-in in an SQL function declared IMMUTABLE. That declaration is a
-* promise, and it is a true one for these three — array joining, JSON string
-* extraction and accent folding are all deterministic for a given input; the
-* built-ins are marked stable only because they must account for element types
-* and dictionaries in general.
-*
-* The alternative was to skip `unaccent` and text arrays entirely. That is not
-* a real option in an accented language: Postgres stems `auditoría` to
-* `auditor` and `auditoria` to `auditori` — *different lexemes* — so a query
-* typed without accents misses every row that carries them.
-*/
-/** Schema-qualified so a collection outside `public` still resolves them. */
-var HELPER_SCHEMA = "public";
-/**
-* Names of the helper functions. Frozen: they are recorded in the stored
-* generation expression of every search column ever created, so renaming one
-* orphans every table that already has a search column.
-*/
-var SEARCH_TEXT_FN = `${HELPER_SCHEMA}.rebase_search_text`;
-var SEARCH_UNACCENT_FN = `${HELPER_SCHEMA}.rebase_search_unaccent`;
-/** Raised when a `search` block names something that cannot be searched. */
-var SearchConfigError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "SearchConfigError";
+//#region src/schema/collection-index.ts
+/**
+* A declaration that cannot become an index.
+*
+* Thrown at build time, naming the collection and the array position, because
+* the alternative is a `CREATE INDEX` that fails during a push with a Postgres
+* error mentioning a column the author never wrote.
+*/
+var CollectionIndexConfigError = class extends Error {
+	collectionSlug;
+	position;
+	constructor(collectionSlug, position, message) {
+		super(`${collectionSlug}.indexes[${position}]: ${message}`);
+		this.name = "CollectionIndexConfigError";
+		this.collectionSlug = collectionSlug;
+		this.position = position;
 	}
 };
-/** The `search` block of a collection, or undefined when it has none. */
-var getSearchConfig = (collection) => isPostgresCollectionConfig(collection) ? collection.search : void 0;
 /**
-* Refuse a `search` block on a collection this engine does not store.
-*
-* The type only permits one on a `PostgresCollectionConfig`, so TypeScript
-* already stops the ordinary case. This catches the rest — a JS config, a cast,
-* a collection whose `engine` was changed after the block was written — because
-* the alternative is the exact failure the block exists to prevent: a developer
-* who declared what to index, saw no error, and got the substring fallback.
-*
-* Called with *every* collection, before the Postgres ones are filtered out.
-*/
-var assertSearchIsPostgresOnly = (collections) => {
-	for (const collection of collections) {
-		if (isPostgresCollectionConfig(collection)) continue;
-		if (!collection.search) continue;
-		const engine = collection.engine ?? "non-postgres";
-		throw new SearchConfigError(`${collection.slug}.search: full-text search is a Postgres feature, and this collection is served by \`${engine}\`. Remove the block — it would otherwise look configured while \`.search()\` kept using the default substring match.`);
-	}
+* `_ix`/`_ux` plus `_` plus 7 hex — the part of the name that must always
+* survive truncation, and therefore is never inside the truncated portion.
+*/
+var NAME_SUFFIX_BYTES = 11;
+var isOrderedMethod = (method) => method === "btree";
+/**
+* The parts of an index that decide what it *is*.
+*
+* A semantic projection, not the rendered statement — the same arrangement as
+* `getPolicyNameHash`, and for the same reason. A change to how this file
+* formats SQL (eliding a default `USING btree`, quoting differently, emitting
+* `NULLS LAST` explicitly) must not silently rename every index in every
+* deployed database. Hashing generator output would make every cosmetic edit a
+* fleet-wide DROP + CREATE.
+*
+* `reason` is deliberately absent: rewording a comment must not rebuild an
+* index. `nulls` is the *effective* placement, so writing Postgres's own
+* default down is a no-op rather than a redefinition.
+*
+* `v` is the only escape hatch, and it is expensive on purpose: bumping it
+* renames every index in the field.
+*/
+var indexFingerprint = (spec) => sha1Hex(JSON.stringify({
+	v: 1,
+	s: spec.schema,
+	t: spec.table,
+	m: spec.method,
+	u: spec.unique,
+	k: spec.keys.map((k) => [
+		k.column,
+		k.direction,
+		k.nulls
+	]),
+	i: spec.include,
+	w: spec.predicate
+})).substring(0, 7);
+/**
+* `<table>_<columns>_ix_<hash>`, or `_ux_` when unique.
+*
+* Truncation eats the readable head and never the hash. `toPostgresIdentifier`
+* truncates the whole string at 63 bytes, which on a hashed name would cut off
+* the one part that makes it unique — the failure already frozen into
+* `contracts/derived-names.txt`, where a foreign key is recorded with its
+* `_fkey` suffix truncated away, so a second foreign key on that table would
+* derive a byte-identical name.
+*/
+var deriveIndexName = (spec) => {
+	const suffix = `_${spec.unique ? "ux" : "ix"}_${indexFingerprint(spec)}`;
+	return `${truncateToBytes(`${spec.table}_${spec.keys.map((k) => k.column).join("_")}`, 63 - NAME_SUFFIX_BYTES)}${suffix}`;
 };
-var columnNameOf = (propName, prop) => prop && "columnName" in prop && typeof prop.columnName === "string" ? prop.columnName : toSnakeCase(propName);
-/**
-* Classify a property for search purposes.
-*
-* Deliberately narrower than `getSqlColumnType`: search only cares whether a
-* value reaches text, and the mapping from property to *physical* type is
-* asserted against `getSqlColumnType` in the contract test rather than
-* duplicated here.
-*
-* Returns null for anything that is not text-bearing, which the caller turns
-* into a boot error naming the property.
-*/
-var classify = (prop) => {
-	switch (prop.type) {
-		case "string": {
-			const sp = prop;
-			if (sp.enum) return {
-				kind: "text",
-				reason: "enum"
-			};
-			if (sp.isId === "uuid" || sp.columnType === "uuid") return {
-				kind: "text",
-				reason: "uuid"
-			};
-			return { kind: "text" };
-		}
-		case "map":
-			if (prop.columnType === "json") return {
-				kind: "jsonb",
-				reason: "json"
-			};
-			return { kind: "jsonb" };
-		case "array": {
-			const ap = prop;
-			let colType = ap.columnType;
-			if (!colType && ap.of && !Array.isArray(ap.of)) {
-				const of = ap.of;
-				if (of.type === "string") colType = "text[]";
-				else if (of.type === "number") colType = of.validation?.integer ? "integer[]" : "numeric[]";
-				else if (of.type === "boolean") colType = "boolean[]";
-			}
-			if (colType === "text[]") return { kind: "text_array" };
-			if (colType === "json") return {
-				kind: "jsonb",
-				reason: "json"
-			};
-			if (colType === "integer[]" || colType === "boolean[]" || colType === "numeric[]") return {
-				kind: "text_array",
-				reason: "non_text_array"
-			};
-			return { kind: "jsonb" };
-		}
-		default: return null;
-	}
-};
-var normalize = (inner, unaccent) => unaccent ? `${SEARCH_UNACCENT_FN}(${inner})` : inner;
-/** SQL reading one field as plain text, before normalization. */
-var rawTextSql = (field) => {
-	const col = `"${field.column}"`;
-	if (field.kind === "text") return `coalesce(${col}, '')`;
-	if (field.kind === "text_array") return `${SEARCH_TEXT_FN}(coalesce(${col}, '{}'::text[]))`;
-	return `${SEARCH_TEXT_FN}(coalesce(${field.jsonPath.length === 0 ? col : field.jsonPath.length === 1 ? `${col} -> ${quote(field.jsonPath[0])}` : `${col} #> ${quote(`{${field.jsonPath.join(",")}}`)}`}, '{}'::jsonb))`;
-};
-var quote = (v) => `'${v.replace(/'/g, "''")}'`;
-/**
-* Resolve and validate one declared field path.
-*
-* A path that does not resolve throws. The whole point of an explicit block is
-* that the author knows what is indexed; a silently dropped field would make it
-* a guess again, and the failure — a search that returns nothing for content
-* that is plainly in the row — is invisible from the outside.
-*/
-var resolveField = (entry, collection, cfg) => {
-	const path = typeof entry === "string" ? entry : entry.path;
-	const weight = (typeof entry === "string" ? void 0 : entry.weight) ?? "B";
-	const where = `${collection.slug}.search`;
-	if (!path || typeof path !== "string") throw new SearchConfigError(`${where}: every entry in \`fields\` needs a property path.`);
-	const [head, ...rest] = path.split(".");
-	const prop = collection.properties?.[head];
-	if (!prop) throw new SearchConfigError(`${where}: "${path}" starts at property "${head}", which this collection does not declare. Known properties: ${Object.keys(collection.properties ?? {}).join(", ")}.`);
-	const classified = classify(prop);
-	if (!classified) throw new SearchConfigError(`${where}: "${path}" is a \`${prop.type}\` property, which holds no text to search. Searchable kinds are \`string\`, \`string[]\` and \`map\` (or a path inside one).`);
-	if (classified.reason === "enum") throw new SearchConfigError(`${where}: "${path}" is an enum. Enums are a fixed vocabulary — filter on them with \`where\` instead, which is exact and uses an index.`);
-	if (classified.reason === "uuid") throw new SearchConfigError(`${where}: "${path}" is a UUID column. Look it up by id rather than searching it.`);
-	if (classified.reason === "json") throw new SearchConfigError(`${where}: "${path}" is a \`json\` column, and the cast from \`json\` to \`jsonb\` is not immutable, so it cannot feed a generated column. Declare the property as \`jsonb\` (the default) to search it.`);
-	if (classified.reason === "non_text_array") throw new SearchConfigError(`${where}: "${path}" is an array of numbers or booleans. Only \`string[]\` carries text to search.`);
-	if (rest.length > 0 && classified.kind !== "jsonb") throw new SearchConfigError(`${where}: "${path}" addresses a path inside "${head}", but "${head}" is a \`${prop.type}\` property, not a \`map\`. Only map properties have paths inside them.`);
-	const column = columnNameOf(head, prop);
-	const textSql = normalize(rawTextSql({
-		column,
-		jsonPath: rest,
-		kind: classified.kind
-	}), cfg.unaccent === true);
-	const language = cfg.language ?? "simple";
-	return {
-		path,
-		column,
-		jsonPath: rest,
-		kind: classified.kind,
-		weight,
-		sql: `setweight(to_tsvector(${quote(language)}, ${textSql}), ${quote(weight)})`,
-		textSql
-	};
+var quoteLiteral = (value) => {
+	if (typeof value === "number") return String(value);
+	if (typeof value === "boolean") return value ? "TRUE" : "FALSE";
+	return `'${value.replace(/'/g, "''")}'`;
 };
-/**
-* Build the full spec for a collection, or undefined when it has not opted in.
-*
-* Throws {@link SearchConfigError} on a config that cannot be honoured. Callers
-* at boot surface that as a startup failure — a search block that half-works is
-* worse than one that refuses.
-*/
-var buildSearchColumnSpec = (collection) => {
-	const cfg = getSearchConfig(collection);
-	if (!cfg) return void 0;
-	if (!Array.isArray(cfg.fields) || cfg.fields.length === 0) throw new SearchConfigError(`${collection.slug}.search: \`fields\` is empty. Name the properties to index, or remove the \`search\` block to keep the default ILIKE behaviour.`);
-	const table = getTableName(collection);
-	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-	const column = cfg.column ?? "search_vector";
-	if (collection.properties?.[column]) throw new SearchConfigError(`${collection.slug}.search: the generated column "${column}" collides with a declared property of the same name. Set \`search.column\` to something else.`);
-	const fields = cfg.fields.map((entry) => resolveField(entry, collection, cfg));
-	const seen = /* @__PURE__ */ new Set();
-	for (const f of fields) {
-		if (seen.has(f.path)) throw new SearchConfigError(`${collection.slug}.search: "${f.path}" is listed twice.`);
-		seen.add(f.path);
+/** Render a resolved predicate as the body of a `WHERE` clause. */
+var renderPredicate = (predicate) => {
+	if ("and" in predicate) return predicate.and.map(renderPredicate).join(" AND ");
+	switch (predicate.op) {
+		case "is null":
+		case "is not null": return `"${predicate.column}" ${predicate.op.toUpperCase()}`;
+		case "in": return `"${predicate.column}" IN (${predicate.value.map(quoteLiteral).join(", ")})`;
+		default: return `"${predicate.column}" ${predicate.op} ${quoteLiteral(predicate.value)}`;
 	}
-	const extensions = [];
-	if (cfg.unaccent) extensions.push("unaccent");
-	if (cfg.fuzzy) extensions.push("pg_trgm");
-	const spec = {
-		schema,
-		table,
-		column,
-		language: cfg.language ?? "simple",
-		unaccent: cfg.unaccent === true,
-		fields,
-		expression: fields.map((f) => f.sql).join(" || "),
-		indexName: toPostgresIdentifier(`${table}_${column}_gin`),
-		extensions
-	};
-	if (cfg.fuzzy) {
-		const fuzzyColumn = `${column}_text`;
-		if (collection.properties?.[fuzzyColumn]) throw new SearchConfigError(`${collection.slug}.search: \`fuzzy\` needs the column "${fuzzyColumn}", which collides with a declared property. Set \`search.column\` to something else.`);
-		spec.fuzzy = {
-			column: fuzzyColumn,
-			expression: fields.map((f) => f.textSql).join(" || ' ' || "),
-			indexName: toPostgresIdentifier(`${table}_${fuzzyColumn}_trgm`),
-			threshold: cfg.fuzzyThreshold ?? .3
-		};
-	}
-	return spec;
 };
 /**
-* The IMMUTABLE wrappers the generated expressions call.
-*
-* `CREATE OR REPLACE` so a boot against an existing database is a no-op rather
-* than an error, and idempotent for the same reason every other boot-time DDL
-* statement here is.
-*
-* The bodies are stable built-ins wrapped in an immutable promise — see the
-* module comment for why that promise is sound. `STRICT` matters: it makes NULL
-* in mean NULL out without executing the body, which is what the `coalesce` at
-* each call site then absorbs.
-*/
-var searchHelperFunctions = (spec) => {
-	const statements = [`CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(text[]) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT array_to_string($1, ' ') $$;`, `CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(jsonb) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT coalesce(string_agg(v, ' '), '')\n       FROM jsonb_array_elements_text(jsonb_path_query_array($1, 'strict $.**?(@.type() == "string")')) AS v $$;`];
-	if (spec.unaccent) statements.push(`CREATE OR REPLACE FUNCTION ${SEARCH_UNACCENT_FN}(text) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT ${HELPER_SCHEMA}.unaccent('${HELPER_SCHEMA}.unaccent'::regdictionary, $1) $$;`);
-	return statements;
+* The `CREATE INDEX` for one spec.
+*
+* `concurrently` is a parameter rather than a string replacement on the way
+* out. `search-column.ts` and `vector-index.ts` both reach for
+* `.replace("CREATE INDEX IF NOT EXISTS", …)` instead, which silently does
+* nothing for a UNIQUE index — the rendered text is `CREATE UNIQUE INDEX …`
+* and the pattern never matches.
+*/
+var collectionIndexStatement = (spec, options = {}) => {
+	const unique = spec.unique ? "UNIQUE " : "";
+	const concurrently = options.concurrently ? "CONCURRENTLY " : "";
+	const ifNotExists = options.ifNotExists ? "IF NOT EXISTS " : "";
+	const using = spec.method === "btree" ? "" : ` USING ${spec.method}`;
+	const keys = spec.keys.map((k) => {
+		if (!isOrderedMethod(spec.method)) return `"${k.column}"`;
+		const direction = k.direction === "desc" ? " DESC" : "";
+		const impliedNulls = k.direction === "desc" ? "first" : "last";
+		const nulls = k.nulls === impliedNulls ? "" : ` NULLS ${k.nulls.toUpperCase()}`;
+		return `"${k.column}"${direction}${nulls}`;
+	}).join(", ");
+	const include = spec.include.length > 0 ? ` INCLUDE (${spec.include.map((c) => `"${c}"`).join(", ")})` : "";
+	const where = spec.predicate ? ` WHERE ${renderPredicate(spec.predicate)}` : "";
+	return `CREATE ${unique}INDEX ${concurrently}${ifNotExists}"${spec.indexName}" ON "${spec.schema}"."${spec.table}"${using} (${keys})${include}${where};`;
 };
+var collectionIndexStatements = (specs, options = {}) => specs.map((spec) => collectionIndexStatement(spec, options));
+var relationOf = (collection, propKey) => resolveCollectionRelations(collection)[propKey];
 /**
-* `CREATE EXTENSION` statements the spec's expressions depend on.
+* The column a property key indexes.
 *
-* `WITH SCHEMA public` is load-bearing, not tidiness. An unqualified
-* `CREATE EXTENSION` installs into the first schema on `search_path`, which
-* defaults to `"$user", public` — and the scaffold's database role is named
-* `rebase`, the same as the schema the generator creates one statement earlier.
-* So the moment that schema exists, `CREATE EXTENSION unaccent` puts the
-* dictionary in `rebase`, and every reference to `public.unaccent` below fails
-* with "text search dictionary does not exist". Observed, not theorised.
-*/
-var searchExtensionStatements = (spec) => spec.extensions.map((e) => `CREATE EXTENSION IF NOT EXISTS ${e} WITH SCHEMA ${HELPER_SCHEMA};`);
-/**
-* Index statements for the spec.
+* A `belongsTo` resolves to its `localKey` — `primaryCategory` becomes
+* `primary_category_id` — which is the case an index is most often wanted for
+* and the case where the property key and the column differ. Everything else
+* goes through `resolveColumnName`.
 *
-* `CONCURRENTLY` is deliberately *not* used here. This form is emitted into a
-* SQL file replayed as one unit — a migration, or `search.sql` — where a
-* concurrent build is not allowed. The boot-time ensure path runs statement by
-* statement against tables that are live and populated, and uses the
-* concurrent form instead; see `ensureSearchColumns`.
+* The other relation kinds have no local column at all: the foreign key lives
+* on the target's table, or in a junction. Indexing them here is refused
+* rather than resolved to a column that does not exist.
 */
-var searchIndexStatements = (spec) => {
-	const statements = [`CREATE INDEX IF NOT EXISTS "${spec.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.column}");`];
-	if (spec.fuzzy) statements.push(`CREATE INDEX IF NOT EXISTS "${spec.fuzzy.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.fuzzy.column}" ${HELPER_SCHEMA}.gin_trgm_ops);`);
-	return statements;
+var resolveIndexableColumn = (collection, propKey, resolveColumnName, fail) => {
+	const relation = relationOf(collection, propKey);
+	if (relation) {
+		if (relation.kind === "belongsTo") return relation.localKey;
+		fail(`"${propKey}" is a ${relation.kind} relation, which has no column on this table — the foreign key lives on "${relation.targetSlug}". Declare the index there.`);
+	}
+	const property = collection.properties?.[propKey];
+	if (!property) fail(`"${propKey}" is not a property of this collection.`);
+	return resolveColumnName(propKey, property);
 };
-/**
-* Marker on the comment of every generated search column this module creates.
-*
-* Versioned because the fingerprint below is only comparable against itself: a
-* future change to how it is computed has to read as "not stamped by this
-* version" rather than as drift on every existing column.
-*/
-var SEARCH_STAMP_PREFIX = "rebase:search:v1:";
-/**
-* A stable fingerprint of one generated column's expression.
-*
-* Why a stamp rather than reading the expression back: Postgres stores a
-* generated column's expression *parsed*, and hands it back deparsed — casts
-* made explicit, identifiers requoted, schema qualifications added or dropped
-* according to `search_path`. Comparing that text to the text we generated
-* would report drift on wording, and this comparison decides whether a boot
-* refuses, so a false positive is an outage. The stamp is written by the same
-* code that writes the column, so equality means what it says.
-*/
-var searchExpressionFingerprint = (expression) => `${SEARCH_STAMP_PREFIX}${createHash("sha256").update(expression).digest("hex").slice(0, 16)}`;
-/**
-* The stamps for a spec's generated columns — one per column, never shared.
-*
-* Per column on purpose: turning `fuzzy` on adds a second column and changes
-* nothing about the first, and a spec-wide fingerprint would report the
-* untouched `tsvector` column as drifted and refuse a boot over a change that
-* is purely additive.
-*/
-var searchColumnStamps = (spec) => {
-	const stamp = (column, expression) => {
-		const fingerprint = searchExpressionFingerprint(expression);
-		return {
+var resolvePredicate = (collection, predicate, resolveColumnName, fail) => {
+	if ("and" in predicate) return { and: predicate.and.map((p) => resolvePredicate(collection, p, resolveColumnName, fail)) };
+	const column = resolveIndexableColumn(collection, predicate.prop, resolveColumnName, fail);
+	switch (predicate.op) {
+		case "is null":
+		case "is not null": return {
 			column,
-			expression,
-			fingerprint,
-			sql: `COMMENT ON COLUMN "${spec.schema}"."${spec.table}"."${column}" IS ${quote(fingerprint)};`
+			op: predicate.op
+		};
+		case "in":
+			if (new Set(predicate.value).size !== predicate.value.length) fail(`the \`in\` list for "${predicate.prop}" repeats a value, which changes nothing.`);
+			return {
+				column,
+				op: "in",
+				value: [...predicate.value]
+			};
+		default: return {
+			column,
+			op: predicate.op,
+			value: predicate.value
 		};
-	};
-	const stamps = [stamp(spec.column, spec.expression)];
-	if (spec.fuzzy) stamps.push(stamp(spec.fuzzy.column, spec.fuzzy.expression));
-	return stamps;
-};
-/**
-* The generated column names a collection's search block adds, if any.
-*
-* These are physical columns on the table, so `SELECT *` returns them. They are
-* an index in column form — a list of lexeme positions, or a concatenation of
-* every searchable field on the row — and nothing outside the query planner has
-* any use for them. Left in, every list response carries a second, larger copy
-* of the row's text.
-*/
-var searchColumnNames = (collection) => {
-	let spec;
-	try {
-		spec = buildSearchColumnSpec(collection);
-	} catch {
-		return [];
 	}
-	if (!spec) return [];
-	return spec.fuzzy ? [spec.column, spec.fuzzy.column] : [spec.column];
-};
-/**
-* True for a column whose type only ever holds a search index.
-*
-* Independent of any collection config on purpose: an introspected database
-* (BaaS mode) can carry a `tsvector` column this framework never created —
-* Pagila's `film.fulltext` is the canonical one — and it should not be returned
-* to callers either. `isDerivedIndexColumn` already keeps such a column out of
-* the *properties*; this keeps it out of the *rows*.
-*/
-var isSearchIndexColumn = (column) => {
-	const sqlType = typeof column?.getSQLType === "function" ? column.getSQLType().toLowerCase() : "";
-	return sqlType === "tsvector" || sqlType === "tsquery";
 };
+/** The primary key columns of a collection, for the "you already have this" refusal. */
+var primaryKeyColumns = (collection, resolveColumnName) => Object.entries(collection.properties ?? {}).filter(([, prop]) => prop && typeof prop === "object" && "isId" in prop && Boolean(prop.isId)).map(([key, prop]) => resolveColumnName(key, prop));
 /**
-* A drizzle select projection over `table` with the search columns dropped.
+* Every index one collection declares, resolved and named.
 *
-* Returns undefined when nothing needs dropping, so the common case keeps using
-* a plain `select()` and this stays invisible in the generated SQL.
+* Throws {@link CollectionIndexConfigError} rather than dropping a bad entry:
+* an index that silently does not exist is the failure mode this whole feature
+* is here to remove.
 */
-var visibleColumnProjection = (tableColumns, collection) => {
-	const excluded = excludedColumnNames(tableColumns, collection);
-	if (!tableColumns || excluded.length === 0) return void 0;
-	const projection = {};
-	for (const [name, column] of Object.entries(tableColumns)) if (!excluded.includes(name)) projection[name] = column;
-	return projection;
-};
-/** The same exclusion as a drizzle `db.query` `columns` denylist. */
-var hiddenColumnsOption = (tableColumns, collection) => {
-	const excluded = excludedColumnNames(tableColumns, collection);
-	if (excluded.length === 0) return void 0;
-	return Object.fromEntries(excluded.map((name) => [name, false]));
-};
-/**
-* The columns to keep out of a response, by name.
-*
-* `tableColumns` is whatever `getTableColumns` returned, which is `undefined`
-* for anything that is not a real drizzle table — a stub in a test, a derived
-* or nested path with no table behind it. Nothing to exclude is the right
-* answer there, and it has to be an answer rather than a throw: this runs on
-* the read path of every collection, opted in or not.
-*/
-var excludedColumnNames = (tableColumns, collection) => {
-	if (!tableColumns || typeof tableColumns !== "object") return [];
-	const byName = new Set(collection ? searchColumnNames(collection) : []);
-	return Object.keys(tableColumns).filter((name) => byName.has(name) || isSearchIndexColumn(tableColumns[name]));
+var buildCollectionIndexSpecs = (collection, resolveColumnName) => {
+	if (!isPostgresCollectionConfig(collection)) return [];
+	const declared = collection.indexes;
+	if (!declared || declared.length === 0) return [];
+	const slug = collection.slug ?? getTableName(collection);
+	const schema = collection.schema ?? "public";
+	const table = getTableName(collection);
+	const pk = primaryKeyColumns(collection, resolveColumnName).sort().join(",");
+	const specs = [];
+	const byName = /* @__PURE__ */ new Map();
+	declared.forEach((index, position) => {
+		const fail = (message) => {
+			throw new CollectionIndexConfigError(slug, position, message);
+		};
+		if (typeof index.reason !== "string" || index.reason.trim() === "") fail("`reason` is required — see the doc comment. An index nobody can justify is one nobody can delete.");
+		if (!Array.isArray(index.on) || index.on.length === 0) fail("`on` must name at least one property.");
+		if (index.on.length > 5) fail(`\`on\` has ${index.on.length} keys; the limit is 5. Payload columns belong in \`include\`.`);
+		const method = index.using ?? "btree";
+		const unique = method === "btree" && Boolean(index.unique);
+		if (!isOrderedMethod(method)) {
+			for (const key of index.on) if (typeof key !== "string" && ("direction" in key || "nulls" in key)) fail(`access method "${method}" does not support ASC/DESC or NULLS options.`);
+		}
+		const keys = index.on.map((key) => {
+			const column = resolveIndexableColumn(collection, typeof key === "string" ? key : key.prop, resolveColumnName, fail);
+			const direction = (typeof key === "string" ? void 0 : key.direction) ?? "asc";
+			return {
+				column,
+				direction,
+				nulls: (typeof key === "string" ? void 0 : key.nulls) ?? (direction === "desc" ? "first" : "last")
+			};
+		});
+		const duplicateKey = keys.map((k) => k.column).find((c, i, all) => all.indexOf(c) !== i);
+		if (duplicateKey) fail(`"${duplicateKey}" appears twice in \`on\`.`);
+		if (keys.map((k) => k.column).sort().join(",") === pk && pk !== "") fail(`this is the primary key — "${table}_pkey" already indexes exactly these columns.`);
+		const include = (index.include ?? []).map((propKey) => resolveIndexableColumn(collection, propKey, resolveColumnName, fail));
+		const overlap = include.find((c) => keys.some((k) => k.column === c));
+		if (overlap) fail(`"${overlap}" is in both \`on\` and \`include\`; Postgres rejects the overlap.`);
+		if (unique && keys.length === 1) {
+			const propKey = typeof index.on[0] === "string" ? index.on[0] : index.on[0].prop;
+			if ((collection.properties?.[propKey])?.validation?.unique) fail(`"${propKey}" already declares \`validation.unique\`, which compiles to an inline UNIQUE. Two declarations of one guarantee — remove one.`);
+		}
+		const predicate = index.where ? resolvePredicate(collection, index.where, resolveColumnName, fail) : null;
+		const withoutName = {
+			schema,
+			table,
+			method,
+			unique,
+			keys,
+			include,
+			predicate,
+			reason: index.reason
+		};
+		const indexName = deriveIndexName(withoutName);
+		const clash = byName.get(indexName);
+		if (clash !== void 0) fail(`derives the same name as indexes[${clash}] — they are the same index declared twice.`);
+		byName.set(indexName, position);
+		specs.push({
+			...withoutName,
+			indexName
+		});
+	});
+	return specs;
 };
-//#endregion
-//#region src/schema/auth-users-columns.ts
-/**
-* `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it
-* — it synthesizes `anon_<32 hex>@anonymous.local` rather than inserting NULL.
-* The 320-char bound (RFC 5321) is a CHECK rather than a `VARCHAR(n)`, added
-* separately by `ensureAuthTablesExist` so it can be `NOT VALID` on an adopted
-* table that already holds a longer row.
-*/
-var AUTH_USERS_COLUMNS = [
-	{
-		column: "email",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		column: "display_name",
-		type: "TEXT"
-	},
-	{
-		column: "photo_url",
-		type: "TEXT"
-	},
-	{
-		column: "roles",
-		type: "TEXT[]",
-		default: "'{}'",
-		notNull: true
-	},
-	{
-		column: "password_hash",
-		type: "TEXT"
-	},
-	{
-		column: "email_verified",
-		type: "BOOLEAN",
-		default: "FALSE",
-		notNull: true
-	},
-	{
-		column: "email_verification_token",
-		type: "TEXT"
-	},
-	{
-		column: "email_verification_sent_at",
-		type: "TIMESTAMP WITH TIME ZONE"
-	},
-	{
-		column: "is_anonymous",
-		type: "BOOLEAN",
-		default: "FALSE",
-		notNull: true
-	},
-	{
-		column: "metadata",
-		type: "JSONB",
-		default: "'{}'",
-		notNull: true
-	},
-	{
-		column: "tokens_valid_after",
-		type: "TIMESTAMP WITH TIME ZONE"
-	},
-	{
-		column: "created_at",
-		type: "TIMESTAMP WITH TIME ZONE",
-		default: "NOW()",
-		notNull: true
-	},
-	{
-		column: "updated_at",
-		type: "TIMESTAMP WITH TIME ZONE",
-		default: "NOW()",
-		notNull: true
-	}
-];
-var BY_COLUMN = new Map(AUTH_USERS_COLUMNS.map((c) => [c.column, c]));
-/** Type + inline constraints, as they appear after the column name. */
-function authUsersColumnSql(spec) {
-	return [
-		spec.type,
-		spec.default !== void 0 ? `DEFAULT ${spec.default}` : "",
-		spec.notNull ? "NOT NULL" : ""
-	].filter(Boolean).join(" ");
-}
 /**
-* The auth-owned definition for a physical column name, or `undefined` when
-* auth does not own it.
+* Every declared index across a set of collections, in a stable order.
 *
-* Callers pass the RESOLVED column name (after `columnName` mapping), because
-* that is the only name the three creators agree on: the scaffold's users
-* collection spells the property `displayName` and the column `display_name`.
+* Sorted because the result reaches `schema.sql`, which `doctor` string-
+* compares against a regenerated copy — `generatePostgresDdl` does not sort its
+* collections, so leaving this in declaration order would make the artifact
+* depend on the order files happened to load in.
 */
-function authUsersColumnDefinition(column) {
-	const spec = BY_COLUMN.get(column);
-	return spec ? authUsersColumnSql(spec) : void 0;
-}
-/**
-* Whether a collection is an auth collection, i.e. whether the definitions in
-* this module apply to its table at all.
-*
-* Duplicated in shape from `@rebasepro/common`'s policy defaults on purpose:
-* that one takes a `CollectionConfig`, this one is called from DDL code paths
-* that hold looser objects, and both spellings must accept `auth: true` as well
-* as `auth: { enabled: true }`.
-*/
-function isAuthCollection(collection) {
-	const auth = collection?.auth;
-	if (auth === true) return true;
-	return typeof auth === "object" && auth !== null && auth.enabled === true;
-}
+var buildCollectionIndexPlan = (collections, resolveColumnName) => collections.flatMap((collection) => buildCollectionIndexSpecs(collection, resolveColumnName)).sort((a, b) => a.schema.localeCompare(b.schema) || a.table.localeCompare(b.table) || a.indexName.localeCompare(b.indexName));
 //#endregion
-export { mergeDeep as $, fieldKeyForColumn as A, parseIdValues as B, getJunctionCollectionConfig as C, policyToPostgres as D, getEffectiveSecurityRules as E, getTableVarName as F, updateDateAutoValues as G, createRelationRef as H, resolveCollectionRelations as I, legacyForeignKeyName as J, firstFreeKey as K, buildCompositeId as L, getColumnName as M, getEnumVarName as N, securityRuleToConditions as O, getTableName as P, isPrototypePollutingKey as Q, getDeclaredPrimaryKeys as R, resolveStringColumnLength as S, resolveJunctionSpecs as T, createRelationRefWithData as U, sortCollectionsBySlug as V, normalizeToEntityRelation as W, toWireKey as X, toPostgresIdentifier as Y, getPolicyNamesForRule as Z, OrderBySpecError as _, SEARCH_STAMP_PREFIX as a, isManyToMany as at, CollectionRegistry as b, assertSearchIsPostgresOnly as c, searchColumnStamps as d, camelCase as et, searchExtensionStatements as f, buildSdkData as g, visibleColumnProjection as h, isAuthCollection as i, hasForeignKeyOnTarget as it, findRelation as j, findAnonymousGrants as k, buildSearchColumnSpec as l, searchIndexStatements as m, authUsersColumnDefinition as n, DEFAULT_ONE_OF_TYPE as nt, SEARCH_TEXT_FN as o, Vector as ot, searchHelperFunctions as p, generateForeignKeyName as q, authUsersColumnSql as r, DEFAULT_ONE_OF_VALUE as rt, SEARCH_UNACCENT_FN as s, AUTH_USERS_COLUMNS as t, toSnakeCase as tt, hiddenColumnsOption as u, normalizeDriverOrderBy as v, getJunctionSecurityRules as w, relationalCollections as x, parseOrderBySpecStrict as y, isAddressableId as z };
+export { sortCollectionsBySlug as A, getPolicyNamesForRule as B, getTableName as C, getDeclaredPrimaryKeys as D, buildCompositeId as E, firstFreeKey as F, DEFAULT_ONE_OF_TYPE as G, mergeDeep as H, generateForeignKeyName as I, resolveClientListLimit as J, DEFAULT_ONE_OF_VALUE as K, legacyForeignKeyName as L, createRelationRefWithData as M, normalizeToEntityRelation as N, isAddressableId as O, updateDateAutoValues as P, Vector as Q, toPostgresIdentifier as R, getEnumVarName as S, resolveCollectionRelations as T, camelCase as U, isPrototypePollutingKey as V, toSnakeCase as W, hasForeignKeyOnTarget as X, ANONYMOUS_USER_ID as Y, isManyToMany as Z, securityRuleToConditions as _, buildSdkData as a, findRelation as b, parseOrderBySpecStrict as c, getJunctionCollectionConfig as d, getJunctionSecurityRules as f, policyToPostgres as g, getInjectedSecurityRules as h, collectionIndexStatements as i, createRelationRef as j, parseIdValues as k, CollectionRegistry as l, getEffectiveSecurityRules as m, buildCollectionIndexSpecs as n, OrderBySpecError as o, resolveJunctionSpecs as p, ListLimitError as q, collectionIndexStatement as r, normalizeDriverOrderBy as s, buildCollectionIndexPlan as t, relationalCollections as u, findAnonymousGrants as v, getTableVarName as w, getColumnName as x, fieldKeyForColumn as y, toWireKey as z };
 
-//# sourceMappingURL=auth-users-columns-CgyPWQ18.js.map
+//# sourceMappingURL=collection-index-DxJBvVTH.js.map