@rebasepro/server-postgres 0.16.0 → 0.16.1-canary.g2d1aec8

package/dist/{auth-users-columns-CgyPWQ18.js → ensure-collection-tables-jYsvOLZF.js}

@@ -1,9 +1,10 @@
 import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
-import { l as __require, s as __commonJSMin } from "./connection-BuZ97wsr.js";
+import { c as __exportAll, l as __require, s as __commonJSMin } from "./connection-BuZ97wsr.js";
 import { a as policy, i as ANONYMOUS_USER_IDS, r as ANONYMOUS_USER_ID } from "./data_driver-ULAyJEi9.js";
-import { _ as isRelationAggregateSort, a as rewriteLegacyRlsFunctions, b as toCanonicalOp, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as ALL_WHERE_FILTER_OPS, h as REST_TO_CANONICAL, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as NULL_OPS, p as CANONICAL_TO_REST, r as RLS_ROLES_SQL, s as getDeclaredSubcollections, y as sortKeyToString } from "./src-BBFsDaeA.js";
+import { _ as isRelationAggregateSort, a as rewriteLegacyRlsFunctions, b as toCanonicalOp, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as ALL_WHERE_FILTER_OPS, h as REST_TO_CANONICAL, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as NULL_OPS, n as REBASE_SCHEMA, p as CANONICAL_TO_REST, r as RLS_ROLES_SQL, s as getDeclaredSubcollections, y as sortKeyToString } from "./src-BBFsDaeA.js";
+import { isConcurrentDdlRace, isDuplicateObjectRace, logger } from "@rebasepro/server";
 import { createHash } from "node:crypto";
 //#region ../types/src/types/entities.ts
 /**
@@ -2482,7 +2483,7 @@ function compile(expr, scope) {
 		case "authenticated": return `${RLS_UID_SQL} IS NOT NULL AND ${RLS_UID_SQL} NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
 		case "serverContext": return `${RLS_UID_SQL} IS NULL`;
 		case "existsIn": return compileExistsIn(expr, scope);
-		case "raw": return rewriteLegacyRlsFunctions(expr.sql).replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
+		case "raw": return rewriteLegacyRlsFunctions(expr.sql).replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName$1(col, scope.outerCollection)}`);
 	}
 }
 /**
@@ -2493,7 +2494,7 @@ function compile(expr, scope) {
 function compileExistsIn(expr, scope) {
 	const join = scope.resolveCollection?.(expr.collection);
 	const joinTable = join ? getTableName(join) : toSnakeCase(expr.collection);
-	const joinSchema = schemaOf(join) ?? schemaOf(scope.outerCollection) ?? "public";
+	const joinSchema = schemaOf$1(join) ?? schemaOf$1(scope.outerCollection) ?? "public";
 	const alias = `_ex${scope.alias.n++}`;
 	const outerPrefix = outerQualifier(scope);
 	const innerScope = {
@@ -2516,8 +2517,8 @@ var COMPARE_SQL = {
 };
 function operandToSql(operand, scope) {
 	switch (operand.kind) {
-		case "field": return `${scope.fieldPrefix}${resolveColumnName(operand.name, scope.fieldCollection)}`;
-		case "outerField": return `${scope.outerPrefix}${resolveColumnName(operand.name, scope.outerCollection)}`;
+		case "field": return `${scope.fieldPrefix}${resolveColumnName$1(operand.name, scope.fieldCollection)}`;
+		case "outerField": return `${scope.outerPrefix}${resolveColumnName$1(operand.name, scope.outerCollection)}`;
 		case "literal": return quoteLiteral(operand.value);
 		case "authUid": return RLS_UID_SQL;
 		case "authRoles": return `string_to_array(${RLS_ROLES_SQL}, ',')`;
@@ -2530,12 +2531,12 @@ function operandToSql(operand, scope) {
 function outerQualifier(scope) {
 	const table = scope.outerCollection ? getTableName(scope.outerCollection) : void 0;
 	if (!table) return "";
-	return `"${schemaOf(scope.outerCollection) ?? "public"}"."${table}".`;
+	return `"${schemaOf$1(scope.outerCollection) ?? "public"}"."${table}".`;
 }
-function schemaOf(collection) {
+function schemaOf$1(collection) {
 	return collection?.schema || void 0;
 }
-function resolveColumnName(propName, collection) {
+function resolveColumnName$1(propName, collection) {
 	const prop = collection?.properties?.[propName];
 	if (prop && "columnName" in prop && typeof prop.columnName === "string") return quoteColumnIdentifier(prop.columnName);
 	return quoteColumnIdentifier(toSnakeCase(propName));
@@ -2805,6 +2806,22 @@ function getEffectiveSecurityRules(collection) {
 	}
 	return [...explicit, ...injected];
 }
+/**
+* The framework defaults that {@link getEffectiveSecurityRules} would add to a
+* collection, without the author's own rules.
+*
+* These policies appear in the database under names the author never wrote, and
+* a permissive policy ORs with every other permissive policy — so someone
+* reading their `securityRules` and then the real ACL sees more access than they
+* declared. Dropping them by hand does nothing either: `db push` is declarative,
+* so the next push asserts them again. Callers use this to say, in the generated
+* DDL, which policies are injected and how to take them off.
+*/
+function getInjectedSecurityRules(collection) {
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection$1(collection) ? [adminWriteGate(getTableName(collection))] : [];
+	const explicitCount = (collection.securityRules ?? []).length;
+	return getEffectiveSecurityRules(collection).slice(explicitCount);
+}
 //#endregion
 //#region ../common/src/util/junction-policies.ts
 var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
@@ -5469,6 +5486,10 @@ var searchHelperFunctions = (spec) => {
 * with "text search dictionary does not exist". Observed, not theorised.
 */
 var searchExtensionStatements = (spec) => spec.extensions.map((e) => `CREATE EXTENSION IF NOT EXISTS ${e} WITH SCHEMA ${HELPER_SCHEMA};`);
+/** The column definition as it appears inside `CREATE TABLE`. */
+var searchColumnDefinition = (spec) => `"${spec.column}" tsvector GENERATED ALWAYS AS (${spec.expression}) STORED`;
+/** The fuzzy column definition, when the spec asks for one. */
+var fuzzyColumnDefinition = (spec) => spec.fuzzy ? `"${spec.fuzzy.column}" text GENERATED ALWAYS AS (${spec.fuzzy.expression}) STORED` : void 0;
 /**
 * Index statements for the spec.
 *
@@ -5526,6 +5547,30 @@ var searchColumnStamps = (spec) => {
 	return stamps;
 };
 /**
+* The same drift check as the boot ensure, for the SQL file.
+*
+* Needed because {@link searchColumnStamps} would otherwise *launder* drift on
+* the migration path: `ADD COLUMN IF NOT EXISTS` does nothing to a column that
+* exists, so a re-generated `search.sql` would stamp a stale column with the
+* new block's fingerprint and the next boot would find them in agreement.
+* Guarding first means the file refuses instead — `rebase db push` is attended,
+* and the operator reading the failure is the person who changed the block.
+*/
+var searchStampGuards = (spec) => searchColumnStamps(spec).map((stamp) => {
+	const relation = quote(`"${spec.schema}"."${spec.table}"`);
+	return `DO $rebase_search$
+DECLARE recorded text;
+BEGIN
+    SELECT col_description(a.attrelid, a.attnum) INTO recorded
+    FROM pg_attribute a
+    WHERE a.attrelid = ${relation}::regclass AND a.attname = ${quote(stamp.column)} AND NOT a.attisdropped;
+    IF recorded LIKE ${quote(`${SEARCH_STAMP_PREFIX}%`)} AND recorded <> ${quote(stamp.fingerprint)} THEN
+        RAISE EXCEPTION 'Rebase: the search block for ${spec.schema}.${spec.table} changed after the generated column "${stamp.column}" was built (recorded %, expected ${stamp.fingerprint}). Postgres cannot alter a generated expression in place. Drop the column and re-apply this file — it rewrites the table and rebuilds the index: ALTER TABLE ${relation.slice(1, -1)} DROP COLUMN "${stamp.column}";', recorded;
+    END IF;
+END
+$rebase_search$;`;
+});
+/**
 * The generated column names a collection's search block adds, if any.
 *
 * These are physical columns on the table, so `SELECT *` returns them. They are
@@ -5702,6 +5747,1393 @@ function isAuthCollection(collection) {
 	return typeof auth === "object" && auth !== null && auth.enabled === true;
 }
 //#endregion
-export { mergeDeep as $, fieldKeyForColumn as A, parseIdValues as B, getJunctionCollectionConfig as C, policyToPostgres as D, getEffectiveSecurityRules as E, getTableVarName as F, updateDateAutoValues as G, createRelationRef as H, resolveCollectionRelations as I, legacyForeignKeyName as J, firstFreeKey as K, buildCompositeId as L, getColumnName as M, getEnumVarName as N, securityRuleToConditions as O, getTableName as P, isPrototypePollutingKey as Q, getDeclaredPrimaryKeys as R, resolveStringColumnLength as S, resolveJunctionSpecs as T, createRelationRefWithData as U, sortCollectionsBySlug as V, normalizeToEntityRelation as W, toWireKey as X, toPostgresIdentifier as Y, getPolicyNamesForRule as Z, OrderBySpecError as _, SEARCH_STAMP_PREFIX as a, isManyToMany as at, CollectionRegistry as b, assertSearchIsPostgresOnly as c, searchColumnStamps as d, camelCase as et, searchExtensionStatements as f, buildSdkData as g, visibleColumnProjection as h, isAuthCollection as i, hasForeignKeyOnTarget as it, findRelation as j, findAnonymousGrants as k, buildSearchColumnSpec as l, searchIndexStatements as m, authUsersColumnDefinition as n, DEFAULT_ONE_OF_TYPE as nt, SEARCH_TEXT_FN as o, Vector as ot, searchHelperFunctions as p, generateForeignKeyName as q, authUsersColumnSql as r, DEFAULT_ONE_OF_VALUE as rt, SEARCH_UNACCENT_FN as s, AUTH_USERS_COLUMNS as t, toSnakeCase as tt, hiddenColumnsOption as u, normalizeDriverOrderBy as v, getJunctionSecurityRules as w, relationalCollections as x, parseOrderBySpecStrict as y, isAddressableId as z };
+//#region src/schema/vector-index.ts
+/**
+* The widest `vector` pgvector will build an HNSW or IVFFlat index over.
+* Storage and exact search are unaffected by this limit.
+*/
+var MAX_INDEXABLE_VECTOR_DIMENSIONS = 2e3;
+/**
+* Operator class per distance. These strings are part of the database contract:
+* they appear in `CREATE INDEX`, so renaming one renames an index.
+*/
+var OPERATOR_CLASS = {
+	cosine: "vector_cosine_ops",
+	l2: "vector_l2_ops",
+	inner_product: "vector_ip_ops"
+};
+/** Short, stable tag per distance, used to name the index. */
+var DISTANCE_TAG = {
+	cosine: "cosine",
+	l2: "l2",
+	inner_product: "ip"
+};
+var VectorIndexConfigError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "VectorIndexConfigError";
+	}
+};
+var isVectorProperty = (prop) => !!prop && typeof prop === "object" && prop.type === "vector";
+var asDistances = (config, label) => {
+	const raw = config.distance ?? "cosine";
+	const list = Array.isArray(raw) ? raw : [raw];
+	if (list.length === 0) throw new VectorIndexConfigError(`${label}: \`index.distance\` is an empty array. Name at least one distance, or set \`index: false\` to create no index.`);
+	const seen = /* @__PURE__ */ new Set();
+	for (const distance of list) {
+		if (!(distance in OPERATOR_CLASS)) throw new VectorIndexConfigError(`${label}: \`index.distance\` is "${distance}", which is not a pgvector distance. Use ${Object.keys(OPERATOR_CLASS).map((d) => `"${d}"`).join(", ")}.`);
+		if (seen.has(distance)) throw new VectorIndexConfigError(`${label}: \`index.distance\` lists "${distance}" twice.`);
+		seen.add(distance);
+	}
+	return list;
+};
+var assertPositiveInteger = (value, key, label) => {
+	if (value === void 0) return;
+	if (!Number.isInteger(value) || value <= 0) throw new VectorIndexConfigError(`${label}: \`index.${key}\` is ${JSON.stringify(value)}. It must be a positive integer.`);
+};
+/**
+* Index parameters for one method. Parameters belonging to the *other* method
+* are rejected rather than ignored, because a silently dropped `lists` on an
+* HNSW index reads, from the config, exactly like a tuned index.
+*/
+var parametersFor = (method, config, label) => {
+	assertPositiveInteger(config.m, "m", label);
+	assertPositiveInteger(config.efConstruction, "efConstruction", label);
+	assertPositiveInteger(config.lists, "lists", label);
+	if (method === "hnsw") {
+		if (config.lists !== void 0) throw new VectorIndexConfigError(`${label}: \`index.lists\` only applies to \`method: "ivfflat"\`. Remove it, or switch the method.`);
+		const params = [];
+		if (config.m !== void 0) params.push(["m", config.m]);
+		if (config.efConstruction !== void 0) params.push(["ef_construction", config.efConstruction]);
+		return params;
+	}
+	for (const key of ["m", "efConstruction"]) if (config[key] !== void 0) throw new VectorIndexConfigError(`${label}: \`index.${key}\` only applies to \`method: "hnsw"\`. Remove it, or switch the method.`);
+	return config.lists !== void 0 ? [["lists", config.lists]] : [];
+};
+/**
+* Every ANN index a collection's vector properties call for.
+*
+* `resolveColumn` is passed in rather than imported so that this module stays
+* free of the DDL generator, which imports *it*. Both callers hand it the same
+* `resolveColumnName`, and a contract test asserts the names agree.
+*/
+var buildVectorIndexPlan = (collection, resolveColumn) => {
+	const specs = [];
+	const skipped = [];
+	const properties = collection.properties ?? {};
+	const table = getTableName(collection);
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	for (const [propName, prop] of Object.entries(properties)) {
+		if (!isVectorProperty(prop)) continue;
+		if (prop.index === false) continue;
+		const label = `${collection.slug}.${propName}`;
+		const column = resolveColumn(propName, prop);
+		const config = prop.index ?? {};
+		const method = config.method ?? "hnsw";
+		if (method !== "hnsw" && method !== "ivfflat") throw new VectorIndexConfigError(`${label}: \`index.method\` is "${method}". Use "hnsw" or "ivfflat".`);
+		const distances = asDistances(config, label);
+		const parameters = parametersFor(method, config, label);
+		if (!Number.isInteger(prop.dimensions) || prop.dimensions <= 0) throw new VectorIndexConfigError(`${label}: \`dimensions\` is ${JSON.stringify(prop.dimensions)}. It must be a positive integer.`);
+		if (prop.dimensions > 2e3) {
+			skipped.push({
+				schema,
+				table,
+				column,
+				dimensions: prop.dimensions,
+				reason: `pgvector cannot index a vector wider than ${MAX_INDEXABLE_VECTOR_DIMENSIONS} dimensions, and ${label} declares ${prop.dimensions}. The column works and \`vectorSearch\` still answers, as an exact scan. To index it, reduce the dimensions (many embedding models support a shorter output) or set \`index: false\` to state that the scan is intended.`
+			});
+			continue;
+		}
+		for (const distance of distances) specs.push({
+			schema,
+			table,
+			column,
+			indexName: toPostgresIdentifier(`${table}_${column}_${method}_${DISTANCE_TAG[distance]}`),
+			method,
+			distance,
+			operatorClass: OPERATOR_CLASS[distance],
+			parameters
+		});
+	}
+	return {
+		specs,
+		skipped
+	};
+};
+/**
+* The `CREATE INDEX` for one spec.
+*
+* `CONCURRENTLY` is deliberately absent, for the same reason it is absent from
+* `searchIndexStatements`: this form is replayed as part of a migration, where
+* a concurrent build is not allowed. The boot-time ensure rewrites it — see
+* `ensureCollectionTables`.
+*/
+var vectorIndexStatement = (spec) => {
+	const params = spec.parameters.length ? ` WITH (${spec.parameters.map(([key, value]) => `${key} = ${value}`).join(", ")})` : "";
+	return `CREATE INDEX IF NOT EXISTS "${spec.indexName}" ON "${spec.schema}"."${spec.table}" USING ${spec.method} ("${spec.column}" ${spec.operatorClass})${params};`;
+};
+/** Every statement for a plan, in a stable order. */
+var vectorIndexStatements = (plan) => plan.specs.map(vectorIndexStatement);
+//#endregion
+//#region src/schema/generate-postgres-ddl-logic.ts
+var resolveColumnName = (propName, prop) => {
+	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+	return toSnakeCase(propName);
+};
+var getPrimaryKeyProp = (collection) => {
+	if (collection.properties) {
+		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
+		if (idPropEntry) {
+			const prop = idPropEntry[1];
+			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
+			return {
+				name: idPropEntry[0],
+				type: prop.type === "number" ? "number" : "string",
+				isUuid
+			};
+		}
+	}
+	const idProp = collection.properties?.["id"];
+	if (idProp?.type === "number") return {
+		name: "id",
+		type: "number",
+		isUuid: false
+	};
+	return {
+		name: "id",
+		type: "string",
+		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
+	};
+};
+var isNumericId = (collection) => {
+	return getPrimaryKeyProp(collection).type === "number";
+};
+var getPrimaryKeyName = (collection) => {
+	return getPrimaryKeyProp(collection).name;
+};
+/** The column type a junction holds for one endpoint's primary key. */
+var junctionKeyType = (collection) => isNumericId(collection) ? "INTEGER" : getPrimaryKeyProp(collection).isUuid ? "UUID" : "TEXT";
+var isIdProperty = (propName, prop, collection) => {
+	if ("isId" in prop && Boolean(prop.isId)) return true;
+	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
+};
+/**
+* Render statements produced by {@link generatePolicyStatements} back into the
+* exact string the DDL/policies files have always carried: each statement on
+* its own line, terminated by a newline. Keeping the string form derived from
+* the statement array means the two can never drift — the boot-time applier and
+* the generated `policies.sql` emit the same SQL, from the same source.
+*/
+var statementsToDdl = (statements) => statements.map((s) => `${s}\n`).join("");
+var generatePolicyDdl = (collection, rule, resolveCollection) => statementsToDdl(generatePolicyStatements(collection, rule, resolveCollection));
+/**
+* The individual SQL statements a single security rule compiles to: a
+* `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete
+* statement (terminated by `;`, no trailing newline).
+*
+* This is the primitive the boot-time RLS applier runs one statement at a time
+* (the runtime's DB handle speaks the extended query protocol, which forbids
+* multiple commands in one execute), while `db push` writes the joined string.
+*/
+var generatePolicyStatements = (collection, rule, resolveCollection) => {
+	const tableName = getTableName(collection);
+	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+	const policyNames = getPolicyNamesForRule(rule, tableName);
+	return ops.flatMap((op, opIdx) => {
+		return generateSinglePolicyStatements(collection, rule, op, policyNames[opIdx], resolveCollection);
+	});
+};
+var generateSinglePolicyStatements = (collection, rule, operation, policyName, resolveCollection) => {
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	const tableName = getTableName(collection);
+	const mode = (rule.mode ?? "permissive").toUpperCase();
+	const operationUpper = operation.toUpperCase();
+	const pgRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
+	const needsUsing = operation !== "insert";
+	const needsWithCheck = operation !== "select" && operation !== "delete";
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	let usingClause = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection, { resolveCollection }) : null;
+	let withCheckClause = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection, { resolveCollection }) : null;
+	if (!usingClause && needsUsing) usingClause = "false";
+	if (!withCheckClause && needsWithCheck) withCheckClause = "false";
+	const drop = `DROP POLICY IF EXISTS "${policyName}" ON "${schema}"."${tableName}";`;
+	let create = `CREATE POLICY "${policyName}" ON "${schema}"."${tableName}" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map((r) => `"${r}"`).join(", ")}`;
+	if (usingClause) create += ` USING (${usingClause})`;
+	if (withCheckClause) create += ` WITH CHECK (${withCheckClause})`;
+	create += ";";
+	return [drop, create];
+};
+/**
+* Single-quote escaping for a SQL string literal (PostgreSQL doubles the
+* quote). Enum labels come straight from user-authored collection config, so a
+* label like `it's` closes the literal early and the whole generated file stops
+* parsing at the `CREATE TYPE`. Lives here rather than next to its other caller
+* because ensure-collection-tables already imports from this module — the
+* reverse would be a cycle.
+*/
+var quoteSqlLiteral = (value) => `'${value.replace(/'/g, "''")}'`;
+var getSqlColumnType = (propName, prop, collection, collections) => {
+	switch (prop.type) {
+		case "string": {
+			const stringProp = prop;
+			if (stringProp.enum) {
+				const tableName = getTableName(collection);
+				const colName = resolveColumnName(propName, prop);
+				return `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${tableName}_${colName}"`;
+			}
+			if (stringProp.isId === "uuid" || stringProp.columnType === "uuid") return "UUID";
+			if (stringProp.columnType === "char") return `CHAR(${resolveStringColumnLength(stringProp)})`;
+			if (stringProp.columnType === "varchar") return `VARCHAR(${resolveStringColumnLength(stringProp)})`;
+			return "TEXT";
+		}
+		case "number": {
+			const numProp = prop;
+			const isId = isIdProperty(propName, prop, collection);
+			if ("isId" in numProp && numProp.isId === "increment") return "INTEGER GENERATED BY DEFAULT AS IDENTITY";
+			if (numProp.columnType) {
+				if (numProp.columnType === "double precision") return "DOUBLE PRECISION";
+				return numProp.columnType.toUpperCase();
+			}
+			return numProp.validation?.integer || isId ? "INTEGER" : "NUMERIC";
+		}
+		case "boolean": return "BOOLEAN";
+		case "date": {
+			const dateProp = prop;
+			if (dateProp.columnType === "date") return "DATE";
+			if (dateProp.columnType === "time") return "TIME";
+			return "TIMESTAMP WITH TIME ZONE";
+		}
+		case "map": return prop.columnType === "json" ? "JSON" : "JSONB";
+		case "geopoint": return "JSONB";
+		case "array": {
+			const arrayProp = prop;
+			let colType = arrayProp.columnType;
+			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
+				const ofProp = arrayProp.of;
+				if (ofProp.type === "string") colType = "text[]";
+				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
+				else if (ofProp.type === "boolean") colType = "boolean[]";
+			}
+			if (colType === "json") return "JSON";
+			if (colType === "text[]") return "TEXT[]";
+			if (colType === "integer[]") return "INTEGER[]";
+			if (colType === "boolean[]") return "BOOLEAN[]";
+			if (colType === "numeric[]") return "NUMERIC[]";
+			return "JSONB";
+		}
+		case "vector": return `VECTOR(${prop.dimensions})`;
+		case "binary": return "BYTEA";
+		case "relation": {
+			const refProp = prop;
+			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+			if (relation?.kind !== "belongsTo") throw new Error(`Relation ${propName} does not put a column on this table (only \`belongsTo\` does)`);
+			let targetCollection;
+			try {
+				targetCollection = relation.target();
+			} catch {
+				return "TEXT";
+			}
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
+		}
+		case "reference": {
+			const refProp = prop;
+			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
+			if (!targetCollection) return "TEXT";
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
+		}
+		default: throw new Error(`No Postgres column type for property '${propName}' of type '${prop.type}' in collection '${collection.slug}'. Add a case to \`getSqlColumnType\` (and to \`getDrizzleColumn\`, which must agree).`);
+	}
+};
+var generatePostgresSearchDdl = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	const specs = collections.map((c) => buildSearchColumnSpec(c)).filter((s) => s !== void 0);
+	if (specs.length === 0) return "";
+	const extensions = Array.from(new Set(specs.flatMap(searchExtensionStatements)));
+	const helpers = Array.from(new Set(specs.flatMap(searchHelperFunctions)));
+	let ddl = "-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\n";
+	ddl += "--\n";
+	ddl += "-- Full-text search for the collections declaring a `search` block.\n";
+	ddl += "-- Applied by Rebase, not by Atlas — see generatePostgresSearchDdl.\n\n";
+	extensions.forEach((s) => {
+		ddl += `${s}\n`;
+	});
+	if (extensions.length > 0) ddl += "\n";
+	helpers.forEach((s) => {
+		ddl += `${s}\n\n`;
+	});
+	for (const collection of collections) {
+		const spec = buildSearchColumnSpec(collection);
+		if (!spec) continue;
+		const table = `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${getTableName(collection)}"`;
+		searchStampGuards(spec).forEach((s) => {
+			ddl += `${s}\n`;
+		});
+		ddl += `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${searchColumnDefinition(spec)};\n`;
+		const fuzzyDef = fuzzyColumnDefinition(spec);
+		if (fuzzyDef) ddl += `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${fuzzyDef};\n`;
+		searchColumnStamps(spec).forEach((s) => {
+			ddl += `${s.sql}\n`;
+		});
+		searchIndexStatements(spec).forEach((s) => {
+			ddl += `${s}\n`;
+		});
+		ddl += "\n";
+	}
+	return ddl;
+};
+var generatePostgresDdl = async (allCollections, options = {
+	includePolicies: true,
+	includeSearch: true
+}) => {
+	const collections = relationalCollections(allCollections);
+	let ddl = "-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\n\n";
+	const uniqueSchemas = Array.from(/* @__PURE__ */ new Set([REBASE_SCHEMA, ...collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)]));
+	uniqueSchemas.forEach((schema) => {
+		if (schema) ddl += `CREATE SCHEMA IF NOT EXISTS "${schema}";\n`;
+	});
+	if (uniqueSchemas.length > 0) ddl += "\n";
+	const searchSpecs = collections.map((c) => buildSearchColumnSpec(c)).filter((s) => s !== void 0);
+	if (searchSpecs.length > 0) if (options.includeSearch === false) ddl += "-- Full-text search support lives in `search.sql`, applied separately.\n\n";
+	else {
+		const extensions = Array.from(new Set(searchSpecs.flatMap(searchExtensionStatements)));
+		const helpers = Array.from(new Set(searchSpecs.flatMap(searchHelperFunctions)));
+		ddl += "-- Full-text search support (collections declaring a `search` block)\n";
+		extensions.forEach((s) => {
+			ddl += `${s}\n`;
+		});
+		if (extensions.length > 0) ddl += "\n";
+		helpers.forEach((s) => {
+			ddl += `${s}\n\n`;
+		});
+	}
+	const emittedEnums = /* @__PURE__ */ new Set();
+	collections.forEach((collection) => {
+		const collectionTable = getTableName(collection);
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
+			if ("enum" in prop && (prop.type === "string" || prop.type === "number") && prop.enum) {
+				const enumDbName = `${collectionTable}_${resolveColumnName(propName, prop)}`;
+				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
+				if (values.length > 0 && !emittedEnums.has(`${schema}.${enumDbName}`)) {
+					emittedEnums.add(`${schema}.${enumDbName}`);
+					ddl += `CREATE TYPE "${schema}"."${enumDbName}" AS ENUM (${values.map(quoteSqlLiteral).join(", ")});\n`;
+				}
+			}
+		});
+	});
+	if (ddl.endsWith(";\n")) ddl += "\n";
+	const junctionSpecs = resolveJunctionSpecs(collections);
+	const allTablesToGenerate = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (tableName) allTablesToGenerate.set(tableName, { collection });
+		const resolvedRelations = resolveCollectionRelations(collection);
+		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
+			const junctionTableName = relation.through.table;
+			if (!allTablesToGenerate.has(junctionTableName)) allTablesToGenerate.set(junctionTableName, {
+				collection: {
+					table: junctionTableName,
+					properties: {}
+				},
+				isJunction: true,
+				relation,
+				sourceCollection: collection
+			});
+		}
+	}
+	const fkStatements = [];
+	const indexStatements = [];
+	const policyStatements = [];
+	for (const [tableName, { collection, isJunction, relation, sourceCollection }] of allTablesToGenerate.entries()) {
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+		if (isJunction && relation && sourceCollection && isManyToMany(relation)) {
+			const targetCollection = relation.target();
+			const sourceTable = getTableName(sourceCollection);
+			const targetTable = getTableName(targetCollection);
+			const sourceSchema = isPostgresCollectionConfig(sourceCollection) && sourceCollection.schema ? sourceCollection.schema : "public";
+			const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
+			const { sourceColumn, targetColumn } = relation.through;
+			const sourceColType = isNumericId(sourceCollection) ? "INTEGER" : getPrimaryKeyProp(sourceCollection).isUuid ? "UUID" : "TEXT";
+			const targetColType = isNumericId(targetCollection) ? "INTEGER" : getPrimaryKeyProp(targetCollection).isUuid ? "UUID" : "TEXT";
+			const sourceId = getPrimaryKeyName(sourceCollection);
+			const targetId = getPrimaryKeyName(targetCollection);
+			const onDelete = relation.onDelete ?? "CASCADE";
+			ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
+			ddl += `  "${sourceColumn}" ${sourceColType} NOT NULL,\n`;
+			ddl += `  "${targetColumn}" ${targetColType} NOT NULL,\n`;
+			ddl += `  PRIMARY KEY ("${sourceColumn}", "${targetColumn}")\n`;
+			ddl += `);\n\n`;
+			fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${sourceColumn}_fkey`)}" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
+			fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${targetColumn}_fkey`)}" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
+			if (options.includePolicies) {
+				ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
+				ddl += `\n`;
+				const spec = junctionSpecs.get(baseTableName);
+				if (spec) {
+					const junctionCollection = getJunctionCollectionConfig(spec);
+					const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+					getJunctionSecurityRules(spec).forEach((rule) => {
+						policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
+					});
+				}
+			}
+		} else if (!isJunction) {
+			ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
+			const columns = [];
+			Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
+				if (prop.type === "relation") {
+					const refProp = prop;
+					const relInfo = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+					if (relInfo?.kind !== "belongsTo") return;
+					if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) return;
+					let targetCollection;
+					try {
+						targetCollection = relInfo.target();
+					} catch {
+						return;
+					}
+					const targetTable = getTableName(targetCollection);
+					const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
+					const targetId = getPrimaryKeyName(targetCollection);
+					const fkColType = getSqlColumnType(propName, prop, collection, collections);
+					const onUpdate = relInfo.onUpdate ? ` ON UPDATE ${relInfo.onUpdate.toUpperCase()}` : "";
+					const required = prop.validation?.required;
+					const onDeleteVal = relInfo.onDelete ?? (required ? "CASCADE" : "SET NULL");
+					let colDef = `  "${relInfo.localKey}" ${fkColType}`;
+					if (required) colDef += " NOT NULL";
+					columns.push(colDef);
+					fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${relInfo.localKey}_fkey`)}" FOREIGN KEY ("${relInfo.localKey}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDeleteVal.toUpperCase()}${onUpdate};`);
+				} else if (prop.type === "reference") {
+					const refProp = prop;
+					const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
+					const colName = resolveColumnName(propName, prop);
+					const colType = getSqlColumnType(propName, prop, collection, collections);
+					const required = prop.validation?.required;
+					if (!targetCollection) {
+						let colDef = `  "${colName}" ${colType}`;
+						if (required) colDef += " NOT NULL";
+						columns.push(colDef);
+					} else {
+						const targetTable = getTableName(targetCollection);
+						const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
+						const targetId = getPrimaryKeyName(targetCollection);
+						const onDelete = required ? "CASCADE" : "SET NULL";
+						let colDef = `  "${colName}" ${colType}`;
+						if (required) colDef += " NOT NULL";
+						columns.push(colDef);
+						fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${colName}_fkey`)}" FOREIGN KEY ("${colName}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
+					}
+				} else {
+					const colName = resolveColumnName(propName, prop);
+					const authDefinition = isAuthCollection(collection) ? authUsersColumnDefinition(colName) : void 0;
+					if (authDefinition && !isIdProperty(propName, prop, collection)) {
+						columns.push(`  "${colName}" ${authDefinition}`);
+						return;
+					}
+					let colDef = `  "${colName}" ${getSqlColumnType(propName, prop, collection, collections)}`;
+					if (isIdProperty(propName, prop, collection)) colDef += " PRIMARY KEY";
+					if ("isId" in prop && prop.isId !== "manual" && prop.isId !== true && prop.isId !== "increment") {
+						if (prop.isId === "uuid") colDef += " DEFAULT gen_random_uuid()";
+						else if (prop.isId === "cuid") colDef += " DEFAULT cuid()";
+						else if (typeof prop.isId === "string") colDef += ` DEFAULT ${prop.isId}`;
+					}
+					if (!isIdProperty(propName, prop, collection) && prop.validation?.unique) colDef += " UNIQUE";
+					if (prop.type === "date") {
+						const dateProp = prop;
+						if (dateProp.autoValue === "on_create" || dateProp.autoValue === "on_update") colDef += " DEFAULT now()";
+					}
+					if (prop.validation?.required && !colDef.includes("PRIMARY KEY")) colDef += " NOT NULL";
+					columns.push(colDef);
+				}
+			});
+			if (isAuthCollection(collection)) {
+				const declared = new Set(Object.entries(collection.properties ?? {}).map(([name, prop]) => resolveColumnName(name, prop)));
+				for (const spec of AUTH_USERS_COLUMNS) {
+					if (declared.has(spec.column)) continue;
+					columns.push(`  "${spec.column}" ${authUsersColumnSql(spec)}`);
+				}
+			}
+			const searchSpec = options.includeSearch === false ? void 0 : buildSearchColumnSpec(collection);
+			if (searchSpec) {
+				columns.push(`  ${searchColumnDefinition(searchSpec)}`);
+				const fuzzyDef = fuzzyColumnDefinition(searchSpec);
+				if (fuzzyDef) columns.push(`  ${fuzzyDef}`);
+				indexStatements.push(...searchIndexStatements(searchSpec));
+			}
+			const vectorPlan = buildVectorIndexPlan(collection, resolveColumnName);
+			indexStatements.push(...vectorIndexStatements(vectorPlan));
+			for (const skip of vectorPlan.skipped) indexStatements.push(`-- No ANN index on "${skip.schema}"."${skip.table}"."${skip.column}": ${skip.reason}`);
+			if (!columns.some((c) => c.includes("PRIMARY KEY"))) columns.unshift("  \"id\" TEXT PRIMARY KEY");
+			ddl += columns.join(",\n");
+			ddl += `\n);\n\n`;
+			if (options.includePolicies) {
+				ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
+				ddl += `\n`;
+				const securityRules = getEffectiveSecurityRules(collection);
+				if (securityRules.length > 0) {
+					const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+					securityRules.forEach((rule) => {
+						policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
+					});
+				}
+			}
+		}
+	}
+	if (fkStatements.length > 0) {
+		ddl += "-- Foreign Key Constraints\n";
+		ddl += fkStatements.join("\n") + "\n\n";
+	}
+	if (indexStatements.length > 0) {
+		ddl += "-- Indexes\n";
+		ddl += indexStatements.join("\n") + "\n\n";
+	}
+	if (policyStatements.length > 0) {
+		ddl += "-- Row Level Security Policies\n";
+		ddl += policyStatements.join("");
+		ddl += "\n";
+	}
+	return ddl;
+};
+var schemaOfCollection = (collection) => isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+var bareTableName = (name) => name.includes(".") ? name.split(".").pop() : name;
+/**
+* Truncate a derived identifier the way Postgres does: to 63 bytes, silently.
+*
+* This is not cosmetic, and not really a naming choice at all — it is agreeing
+* with the name the database ALREADY stored. `ADD CONSTRAINT` on a longer name
+* succeeds and records the truncated form, so the untruncated name this used to
+* derive matched nothing in the catalogue. Boot-ensure compares its planned
+* constraints against `readExistingSchema`, which reads catalogue names, so the
+* comparison could never hit: every boot re-issued `ADD CONSTRAINT` for the same
+* constraint, forever, and got "already exists" every time. Non-fatal (foreign
+* keys are the one action allowed to fail) and therefore permanent — an error in
+* the log on every restart of a project whose table and column names happened to
+* be long.
+*
+* Byte length, not string length: NAMEDATALEN is 64 bytes, and a multi-byte
+* character straddling the boundary would be cut mid-sequence by `slice(0, 63)`.
+*/
+var foreignKeyPlan = (args) => {
+	const constraintName = toPostgresIdentifier(`${args.table}_${args.column}_fkey`);
+	const onUpdate = args.onUpdate ? ` ON UPDATE ${args.onUpdate.toUpperCase()}` : "";
+	return {
+		constraintName,
+		schema: args.schema,
+		table: args.table,
+		column: args.column,
+		targetSchema: args.targetSchema,
+		targetTable: args.targetTable,
+		targetColumn: args.targetColumn,
+		sql: `ALTER TABLE "${args.schema}"."${args.table}" ADD CONSTRAINT "${constraintName}" FOREIGN KEY ("${args.column}") REFERENCES "${args.targetSchema}"."${args.targetTable}" ("${args.targetColumn}") ON DELETE ${args.onDelete.toUpperCase()}${onUpdate};`
+	};
+};
+/**
+* The FK columns the declared collections own — one entry per `relation`
+* (`belongsTo` side) or `reference` property.
+*
+* Split out of {@link generatePostgresDdl} so the boot-time schema ensure can
+* create the same columns with the same names, types and constraints. Before
+* this it skipped them outright, which was survivable only because `db push`
+* always followed; on a managed tenant nothing follows, so a table arrived
+* without the column its own collection reads and wrote 400 on every insert.
+*
+* A relation whose target is not in the bundle yields no column at all (the
+* generator returns early on an unresolvable target); a `reference` whose target
+* is unknown yields the column without a constraint. Both mirror the generator
+* exactly — a divergence here is a schema fork between boot and `db push`.
+*/
+var planRelationalColumns = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	const plans = [];
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (!tableName) continue;
+		const schema = schemaOfCollection(collection);
+		const table = bareTableName(tableName);
+		for (const [propName, rawProp] of Object.entries(collection.properties ?? {})) {
+			const prop = rawProp;
+			if (prop.type === "relation") {
+				const refProp = prop;
+				const relInfo = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+				if (relInfo?.kind !== "belongsTo") continue;
+				if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) continue;
+				let targetCollection;
+				try {
+					targetCollection = relInfo.target();
+				} catch {
+					continue;
+				}
+				if (!targetCollection) continue;
+				const required = prop.validation?.required;
+				const relationName = refProp.relation?.relationName ?? propName;
+				const legacyKey = legacyForeignKeyName(relationName);
+				const derived = relInfo.localKey === generateForeignKeyName(relationName);
+				plans.push({
+					schema,
+					table,
+					column: relInfo.localKey,
+					legacyColumn: derived && legacyKey !== relInfo.localKey ? legacyKey : void 0,
+					type: getSqlColumnType(propName, prop, collection, collections),
+					foreignKey: foreignKeyPlan({
+						schema,
+						table,
+						column: relInfo.localKey,
+						targetSchema: schemaOfCollection(targetCollection),
+						targetTable: bareTableName(getTableName(targetCollection)),
+						targetColumn: getPrimaryKeyName(targetCollection),
+						onDelete: relInfo.onDelete ?? (required ? "CASCADE" : "SET NULL"),
+						onUpdate: relInfo.onUpdate
+					})
+				});
+			} else if (prop.type === "reference") {
+				const refProp = prop;
+				const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
+				const column = resolveColumnName(propName, prop);
+				const type = getSqlColumnType(propName, prop, collection, collections);
+				const required = prop.validation?.required;
+				plans.push({
+					schema,
+					table,
+					column,
+					type,
+					foreignKey: targetCollection ? foreignKeyPlan({
+						schema,
+						table,
+						column,
+						targetSchema: schemaOfCollection(targetCollection),
+						targetTable: bareTableName(getTableName(targetCollection)),
+						targetColumn: getPrimaryKeyName(targetCollection),
+						onDelete: required ? "CASCADE" : "SET NULL"
+					}) : void 0
+				});
+			}
+		}
+	}
+	return plans;
+};
+/**
+* The junction tables a bundle's many-to-many relations imply.
+*
+* Derived from {@link resolveJunctionSpecs}, the same source the junction RLS
+* comes from, so a table created here always has policies planned for it — a
+* junction with row-level security left off is readable and writable by every
+* signed-in user, which is why the two must ship together.
+*/
+var planJunctionTables = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	const plans = [];
+	for (const spec of resolveJunctionSpecs(collections).values()) {
+		const [source, target] = spec.endpoints;
+		const legacyFor = (endpoint) => {
+			const slug = toSnakeCase(endpoint.collection.slug ?? endpoint.collection.name ?? "");
+			const legacy = legacyForeignKeyName(slug);
+			return endpoint.junctionColumn === generateForeignKeyName(slug) && legacy !== endpoint.junctionColumn ? legacy : void 0;
+		};
+		const columns = [{
+			name: source.junctionColumn,
+			type: junctionKeyType(source.collection),
+			legacyName: legacyFor(source)
+		}, {
+			name: target.junctionColumn,
+			type: junctionKeyType(target.collection),
+			legacyName: legacyFor(target)
+		}];
+		const onDelete = spec.declaringSides[0]?.relation.onDelete ?? "CASCADE";
+		plans.push({
+			schema: spec.schema,
+			table: spec.table,
+			columns,
+			createTable: `CREATE TABLE IF NOT EXISTS "${spec.schema}"."${spec.table}" (` + columns.map((c) => `"${c.name}" ${c.type} NOT NULL`).join(", ") + `, PRIMARY KEY (${columns.map((c) => `"${c.name}"`).join(", ")}));`,
+			foreignKeys: [source, target].map((endpoint, i) => foreignKeyPlan({
+				schema: spec.schema,
+				table: spec.table,
+				column: columns[i].name,
+				targetSchema: schemaOfCollection(endpoint.collection),
+				targetTable: bareTableName(getTableName(endpoint.collection)),
+				targetColumn: getPrimaryKeyName(endpoint.collection),
+				onDelete
+			}))
+		});
+	}
+	return plans;
+};
+/**
+* The per-table RLS plan for the *declared* collections, as executable
+* statements — what the managed runtime applies at boot so a freshly
+* provisioned tenant database serves data instead of 401ing every read.
+*
+* Mirrors {@link generatePostgresPoliciesDdl} exactly (same
+* `generatePolicyStatements`, same enable-RLS, same effective rules, same
+* derived junction rules), so boot and `db push` produce identical policies from
+* identical collections.
+*
+* Junction tables are included, and have to be: boot creates them now
+* ({@link planJunctionTables}), and a junction with RLS left off is readable and
+* writable by every signed-in user. A junction whose table is still absent is
+* skipped by the applier, not planned away here.
+*/
+var planCollectionPolicies = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+	const plans = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (!tableName) continue;
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+		const qualified = `${schema}.${baseTableName}`;
+		if (seen.has(qualified)) continue;
+		seen.add(qualified);
+		const policyStatements = [];
+		for (const rule of getEffectiveSecurityRules(collection)) policyStatements.push(...generatePolicyStatements(collection, rule, resolveCollection));
+		plans.push({
+			schema,
+			table: baseTableName,
+			qualified,
+			enableRls: `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;`,
+			policyStatements
+		});
+	}
+	for (const spec of resolveJunctionSpecs(collections).values()) {
+		const qualified = `${spec.schema}.${spec.table}`;
+		if (seen.has(qualified)) continue;
+		seen.add(qualified);
+		const junctionCollection = getJunctionCollectionConfig(spec);
+		const policyStatements = [];
+		for (const rule of getJunctionSecurityRules(spec)) policyStatements.push(...generatePolicyStatements(junctionCollection, rule, resolveCollection));
+		plans.push({
+			schema: spec.schema,
+			table: spec.table,
+			qualified,
+			enableRls: `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;`,
+			policyStatements
+		});
+	}
+	return plans;
+};
+var generatePostgresPoliciesDdl = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	let ddl = "-- This file contains RLS policies generated by Rebase. Applied separately from migrations.\n\n";
+	const allTablesToGenerate = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (tableName) allTablesToGenerate.set(tableName, { collection });
+	}
+	for (const [tableName, { collection }] of allTablesToGenerate.entries()) {
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+		ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
+		ddl += `\n`;
+		const securityRules = getEffectiveSecurityRules(collection);
+		if (securityRules.length > 0) {
+			const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+			const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
+			securityRules.forEach((rule) => {
+				if (rule.name && injectedNames.has(rule.name)) {
+					ddl += `-- Injected by Rebase (not from this collection's securityRules).\n`;
+					ddl += `-- Set \`disableDefaultPolicies: true\` on "${collection.slug}" to drop these and own its RLS outright.\n`;
+				}
+				ddl += generatePolicyDdl(collection, rule, resolveCollection);
+			});
+			ddl += "\n";
+		}
+	}
+	const junctionSpecs = resolveJunctionSpecs(collections);
+	for (const spec of junctionSpecs.values()) {
+		ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
+		ddl += `\n`;
+		const junctionRules = getJunctionSecurityRules(spec);
+		if (junctionRules.length === 0) continue;
+		const junctionCollection = getJunctionCollectionConfig(spec);
+		const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+		const declaringSlugs = spec.declaringSides.map((s) => s.collection.slug).join("\", \"");
+		ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
+		ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
+		ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
+		ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
+		junctionRules.forEach((rule) => {
+			ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
+		});
+		ddl += "\n";
+	}
+	return ddl;
+};
+//#endregion
+//#region src/schema/ensure-collection-tables.ts
+/**
+* Bringing a database up to date with a bundle's collections, additively.
+*
+* ## Why this exists
+*
+* A managed runtime boots someone else's compiled project against a database it
+* has never seen. Auth tables are ensured at boot already, but collection tables
+* were not created by anything: the platform ran the app and every `/api/data/*`
+* request answered 500 on a missing relation. `rebase db push` cannot help — it
+* is an Atlas-driven CLI command, and the runtime image ships no CLI.
+*
+* ## Why additive-only, forever
+*
+* This runs unattended, against a database with customers' data in it, with no
+* human reading a diff. So it may only ever do things that cannot lose data:
+* create a missing table, add a missing column, create a missing enum type.
+*
+* It will **never** drop a table or a column, narrow a type, or alter a
+* constraint. A removed field leaves its column behind; a renamed field looks
+* like an addition and the old column stays. That is the correct trade for an
+* automated path — the alternative is an unattended process that can silently
+* destroy a column, which is precisely the failure `db push` was hardened
+* against. Destructive changes stay a deliberate, human-reviewed migration.
+*
+* Because of that, this is safe to run on every boot, and re-running it is a
+* no-op.
+*/
+var ensure_collection_tables_exports = /* @__PURE__ */ __exportAll({
+	ensureCollectionTables: () => ensureCollectionTables,
+	planCollectionSchemaEnsure: () => planCollectionSchemaEnsure,
+	readExistingSchema: () => readExistingSchema,
+	readSchemaFactsFor: () => readSchemaFactsFor
+});
+/** Postgres identifiers this module is willing to interpolate. */
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+function assertSafeIdentifier(value, what) {
+	if (!SAFE_IDENTIFIER.test(value)) throw new Error(`Refusing to build SQL with an unsafe ${what}: ${JSON.stringify(value)}`);
+	return value;
+}
+function schemaOf(collection) {
+	return isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+}
+function qualified(collection) {
+	return `${schemaOf(collection)}.${getTableName(collection)}`;
+}
+/**
+* Enum types a collection's properties require, as `schema.typename`.
+*
+* Named exactly as the DDL generator names them (`<table>_<column>`), because
+* a column added here has to reference the same type the generator would have
+* created — a second, differently-named type for the same field would be a
+* silent schema fork.
+*/
+function requiredEnums(collection) {
+	const table = getTableName(collection);
+	const schema = schemaOf(collection);
+	const out = [];
+	for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
+		const p = prop;
+		if (!("enum" in p) || !p.enum) continue;
+		if (p.type !== "string" && p.type !== "number") continue;
+		const values = p.enum.map((entry) => entry && typeof entry === "object" && "id" in entry ? String(entry.id) : String(entry)).filter((v) => v.length > 0);
+		if (values.length === 0) continue;
+		out.push({
+			name: `${schema}.${table}_${resolveColumnName(propName, p)}`,
+			values
+		});
+	}
+	return out;
+}
+/**
+* Decide what to add. Pure — the caller supplies what exists and runs the result.
+*
+* Ordering matters and is deliberate: enum types before the tables and columns
+* that reference them, tables before the columns added to other tables (a new
+* table may be the target of a relation), and nothing is emitted twice.
+*/
+function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
+	const constraintPolicy = options.constraints ?? "additive";
+	const withheldConstraints = [];
+	assertSearchIsPostgresOnly(allCollections);
+	const collections = relationalCollections(allCollections);
+	const actions = [];
+	const plannedEnums = /* @__PURE__ */ new Set();
+	for (const collection of collections) for (const { name, values } of requiredEnums(collection)) {
+		if (existing.enums.has(name) || plannedEnums.has(name)) {
+			const current = existing.enumValues?.get(name);
+			if (!current || plannedEnums.has(name)) continue;
+			const [schema, typeName] = name.split(".");
+			for (const value of values) {
+				if (current.includes(value)) continue;
+				actions.push({
+					kind: "add-enum-value",
+					target: `${name}.${value}`,
+					sql: `ALTER TYPE "${schema}"."${typeName}" ADD VALUE IF NOT EXISTS ${quoteSqlLiteral(value)};`
+				});
+			}
+			continue;
+		}
+		plannedEnums.add(name);
+		const [schema, typeName] = name.split(".");
+		actions.push({
+			kind: "create-enum",
+			target: name,
+			sql: `CREATE TYPE "${schema}"."${typeName}" AS ENUM (${values.map(quoteSqlLiteral).join(", ")});`
+		});
+	}
+	const searchSpecs = collections.map((c) => buildSearchColumnSpec(c)).filter((spec) => spec !== void 0);
+	const plannedExtensions = /* @__PURE__ */ new Set();
+	for (const spec of searchSpecs) for (const statement of searchExtensionStatements(spec)) {
+		if (plannedExtensions.has(statement)) continue;
+		plannedExtensions.add(statement);
+		actions.push({
+			kind: "create-extension",
+			target: statement.replace(/^CREATE EXTENSION IF NOT EXISTS |;$/g, ""),
+			sql: statement
+		});
+	}
+	const plannedFunctions = /* @__PURE__ */ new Set();
+	for (const spec of searchSpecs) for (const statement of searchHelperFunctions(spec)) {
+		if (plannedFunctions.has(statement)) continue;
+		plannedFunctions.add(statement);
+		actions.push({
+			kind: "create-function",
+			target: statement.includes("unaccent") ? SEARCH_UNACCENT_FN : SEARCH_TEXT_FN,
+			sql: statement
+		});
+	}
+	const created = /* @__PURE__ */ new Set();
+	for (const collection of collections) {
+		const key = qualified(collection);
+		if (existing.tables.has(key) || created.has(key)) continue;
+		created.add(key);
+		const schema = schemaOf(collection);
+		const table = getTableName(collection);
+		const idEntry = Object.entries(collection.properties ?? {}).find(([n, p]) => isIdProperty(n, p, collection));
+		const idName = idEntry ? resolveColumnName(idEntry[0], idEntry[1]) : "id";
+		const idProp = idEntry?.[1];
+		let idDef = `"${idName}" ${idProp ? getSqlColumnType(idEntry[0], idProp, collection, collections) : "TEXT"} PRIMARY KEY`;
+		if (idProp?.type === "string" && idProp.isId === "uuid") idDef += " DEFAULT gen_random_uuid()";
+		actions.push({
+			kind: "create-table",
+			target: key,
+			sql: `CREATE TABLE IF NOT EXISTS "${schema}"."${table}" (${idDef});`
+		});
+	}
+	const junctions = planJunctionTables(collections);
+	for (const junction of junctions) {
+		const key = `${junction.schema}.${junction.table}`;
+		if (existing.tables.has(key) || created.has(key)) continue;
+		created.add(key);
+		actions.push({
+			kind: "create-table",
+			target: key,
+			sql: junction.createTable
+		});
+	}
+	const legacyForeignKeys = [];
+	/**
+	* Move a relation column that is only missing because it was renamed.
+	*
+	* Returns true when it handled the column, so the caller skips the ordinary
+	* ADD. Adding here would be the wrong move and a quiet one: the data is in
+	* the old column, `ADD COLUMN` creates the new one empty beside it, every
+	* statement succeeds, and the relation reads the empty one. A rename is
+	* metadata-only in Postgres, keeps the values, and carries the column's
+	* indexes and constraints with it.
+	*
+	* Only ever reached when the new name is absent and the old name is
+	* present, so there is nothing to overwrite and nothing to choose between.
+	*/
+	const renameLegacyColumn = (key, schema, table, column, legacyName) => {
+		const present = existing.tables.get(key);
+		if (!legacyName || !present) return false;
+		if (present.has(column) || !present.has(legacyName)) return false;
+		legacyForeignKeys.push({
+			table: key,
+			expected: column,
+			legacy: legacyName
+		});
+		actions.push({
+			kind: "rename-column",
+			target: `${key}.${column}`,
+			sql: `ALTER TABLE "${schema}"."${table}" RENAME COLUMN "${legacyName}" TO "${column}";`
+		});
+		return true;
+	};
+	const addColumn = (key, schema, table, column, definition) => {
+		if (existing.tables.get(key)?.has(column)) return;
+		actions.push({
+			kind: "add-column",
+			target: `${key}.${column}`,
+			sql: `ALTER TABLE "${schema}"."${table}" ADD COLUMN IF NOT EXISTS "${column}" ${definition};`
+		});
+	};
+	for (const collection of collections) {
+		const key = qualified(collection);
+		const schema = schemaOf(collection);
+		const table = getTableName(collection);
+		const fresh = created.has(key);
+		const auth = isAuthCollection(collection);
+		for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
+			const p = prop;
+			if (isIdProperty(propName, p, collection)) continue;
+			if (p.type === "reference" || p.type === "relation") continue;
+			const column = resolveColumnName(propName, p);
+			const authDefinition = auth ? authUsersColumnDefinition(column) : void 0;
+			if (authDefinition) {
+				addColumn(key, schema, table, column, authDefinition);
+				continue;
+			}
+			let definition = getSqlColumnType(propName, p, collection, collections);
+			if (fresh && p.validation?.unique) definition += " UNIQUE";
+			const autoValue = p.autoValue;
+			const hasDefault = p.type === "date" && (autoValue === "on_create" || autoValue === "on_update");
+			if (hasDefault) definition += " DEFAULT now()";
+			const required = p.validation?.required === true;
+			const columnKey = `${key}.${column}`;
+			const columnExists = existing.tables.get(key)?.has(column) === true;
+			const tableIsEmpty = existing.populatedTables !== void 0 && existing.tables.has(key) && !existing.populatedTables.has(key);
+			const notNullIsSafe = fresh || tableIsEmpty || hasDefault;
+			if (required && !columnExists) if (notNullIsSafe) definition += " NOT NULL";
+			else withheldConstraints.push({
+				target: columnKey,
+				kind: "not-null",
+				reason: `"${column}" is required, but "${key}" already holds rows and the column has no default to backfill them with, so NOT NULL would be checked against data that does not have a value yet.`,
+				remedy: "Backfill the column, then add the constraint — or give the property a default so every existing row gets one."
+			});
+			addColumn(key, schema, table, column, definition);
+			if (columnExists && constraintPolicy === "converge") {
+				const isNotNull = existing.notNullColumns?.has(columnKey) === true;
+				if (required && !isNotNull) if (tableIsEmpty) actions.push({
+					kind: "set-not-null",
+					target: columnKey,
+					sql: `ALTER TABLE "${schema}"."${table}" ALTER COLUMN "${column}" SET NOT NULL;`
+				});
+				else withheldConstraints.push({
+					target: columnKey,
+					kind: "not-null",
+					reason: `"${column}" became required, but "${key}" holds rows and any of them with no value would make SET NOT NULL fail.`,
+					remedy: "Backfill the column first — `UPDATE … SET \"" + column + "\" = … WHERE \"" + column + "\" IS NULL` — then apply this again."
+				});
+				if (!required && isNotNull) actions.push({
+					kind: "drop-not-null",
+					target: columnKey,
+					sql: `ALTER TABLE "${schema}"."${table}" ALTER COLUMN "${column}" DROP NOT NULL;`
+				});
+			}
+		}
+		if (auth) {
+			const declared = new Set(Object.entries(collection.properties ?? {}).map(([name, prop]) => resolveColumnName(name, prop)));
+			for (const spec of AUTH_USERS_COLUMNS) {
+				if (declared.has(spec.column)) continue;
+				addColumn(key, schema, table, spec.column, authUsersColumnSql(spec));
+			}
+		}
+	}
+	const searchDrift = [];
+	const searchAdopted = [];
+	for (const spec of searchSpecs) {
+		const key = `${spec.schema}.${spec.table}`;
+		const definitions = { [spec.column]: `tsvector GENERATED ALWAYS AS (${spec.expression}) STORED` };
+		if (spec.fuzzy) definitions[spec.fuzzy.column] = `text GENERATED ALWAYS AS (${spec.fuzzy.expression}) STORED`;
+		for (const stamp of searchColumnStamps(spec)) {
+			const definition = definitions[stamp.column];
+			const exists = existing.tables.get(key)?.has(stamp.column) === true;
+			const recorded = existing.columnComments?.get(`${key}.${stamp.column}`);
+			if (exists && recorded?.startsWith("rebase:search:v1:") && recorded !== stamp.fingerprint) {
+				searchDrift.push({
+					table: key,
+					column: stamp.column,
+					found: recorded,
+					expected: stamp.fingerprint,
+					rebuild: [
+						`ALTER TABLE "${spec.schema}"."${spec.table}" DROP COLUMN "${stamp.column}";`,
+						`ALTER TABLE "${spec.schema}"."${spec.table}" ADD COLUMN "${stamp.column}" ${definition};`,
+						stamp.sql
+					]
+				});
+				continue;
+			}
+			addColumn(key, spec.schema, spec.table, stamp.column, definition);
+			if (exists && recorded === void 0) searchAdopted.push({
+				table: key,
+				column: stamp.column
+			});
+			if (recorded !== stamp.fingerprint) actions.push({
+				kind: "comment-column",
+				target: `${key}.${stamp.column}`,
+				sql: stamp.sql
+			});
+		}
+	}
+	for (const junction of junctions) {
+		const key = `${junction.schema}.${junction.table}`;
+		if (created.has(key)) continue;
+		for (const column of junction.columns) {
+			if (renameLegacyColumn(key, junction.schema, junction.table, column.name, column.legacyName)) continue;
+			addColumn(key, junction.schema, junction.table, column.name, column.type);
+		}
+	}
+	for (const relational of planRelationalColumns(collections)) {
+		const relKey = `${relational.schema}.${relational.table}`;
+		if (renameLegacyColumn(relKey, relational.schema, relational.table, relational.column, relational.legacyColumn)) continue;
+		addColumn(relKey, relational.schema, relational.table, relational.column, relational.type);
+	}
+	const knownConstraints = existing.constraints ?? /* @__PURE__ */ new Set();
+	const plannedConstraints = /* @__PURE__ */ new Set();
+	const foreignKeys = [...planRelationalColumns(collections).map((r) => r.foreignKey), ...junctions.flatMap((j) => j.foreignKeys)];
+	for (const fk of foreignKeys) {
+		if (!fk) continue;
+		const name = `${fk.schema}.${fk.table}.${fk.constraintName}`;
+		if (knownConstraints.has(name) || plannedConstraints.has(name)) continue;
+		plannedConstraints.add(name);
+		actions.push({
+			kind: "add-constraint",
+			target: `${fk.schema}.${fk.table}.${fk.constraintName}`,
+			sql: fk.sql
+		});
+	}
+	for (const spec of searchSpecs) for (const statement of searchIndexStatements(spec)) actions.push({
+		kind: "create-index",
+		target: `${spec.schema}.${spec.table}`,
+		sql: statement.replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS")
+	});
+	const vectorIndexSkipped = [];
+	for (const collection of collections) {
+		const plan = buildVectorIndexPlan(collection, resolveColumnName);
+		for (const spec of plan.specs) actions.push({
+			kind: "create-index",
+			target: `${spec.schema}.${spec.table}`,
+			sql: vectorIndexStatement(spec).replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS")
+		});
+		vectorIndexSkipped.push(...plan.skipped);
+	}
+	return {
+		actions,
+		statements: actions.map((a) => a.sql),
+		legacyForeignKeys,
+		searchDrift,
+		searchAdopted,
+		vectorIndexSkipped,
+		withheldConstraints
+	};
+}
+/** Read what the database has, for the schemas the collections live in. */
+async function readExistingSchema(client, schemas) {
+	const tables = /* @__PURE__ */ new Map();
+	const enums = /* @__PURE__ */ new Set();
+	if (schemas.length === 0) return {
+		tables,
+		enums
+	};
+	const inList = schemas.map((schema) => `'${assertSafeIdentifier(schema, "schema name")}'`).join(", ");
+	const notNullColumns = /* @__PURE__ */ new Set();
+	const { rows: columns } = await client.query(`SELECT table_schema, table_name, column_name, is_nullable
+         FROM information_schema.columns
+         WHERE table_schema IN (${inList})`);
+	for (const row of columns) {
+		const key = `${row.table_schema}.${row.table_name}`;
+		if (!tables.has(key)) tables.set(key, /* @__PURE__ */ new Set());
+		tables.get(key).add(row.column_name);
+		if (row.is_nullable === "NO") notNullColumns.add(`${key}.${row.column_name}`);
+	}
+	const populatedTables = /* @__PURE__ */ new Set();
+	const { rows: realTables } = await client.query(`SELECT n.nspname AS schema, c.relname AS name
+         FROM pg_class c
+         JOIN pg_namespace n ON c.relnamespace = n.oid
+         WHERE c.relkind IN ('r', 'p') AND n.nspname IN (${inList})`);
+	if (realTables.length > 0) {
+		const probes = realTables.map((row) => {
+			const schema = assertSafeIdentifier(row.schema, "schema name");
+			const table = assertSafeIdentifier(row.name, "table name");
+			return `SELECT ${quoteSqlLiteral(`${schema}.${table}`)} AS key, EXISTS(SELECT 1 FROM "${schema}"."${table}" LIMIT 1) AS populated`;
+		});
+		const { rows: populationRows } = await client.query(probes.join(" UNION ALL "));
+		for (const row of populationRows) if (row.populated) populatedTables.add(row.key);
+	}
+	const enumValues = /* @__PURE__ */ new Map();
+	const { rows: enumValueRows } = await client.query(`SELECT n.nspname AS schema, t.typname AS name, e.enumlabel AS value
+         FROM pg_enum e
+         JOIN pg_type t ON e.enumtypid = t.oid
+         JOIN pg_namespace n ON t.typnamespace = n.oid
+         WHERE n.nspname IN (${inList})
+         ORDER BY t.typname, e.enumsortorder`);
+	for (const row of enumValueRows) {
+		const key = `${row.schema}.${row.name}`;
+		if (!enumValues.has(key)) enumValues.set(key, []);
+		enumValues.get(key).push(row.value);
+	}
+	const { rows: enumRows } = await client.query(`SELECT n.nspname AS schema, t.typname AS name
+         FROM pg_type t
+         JOIN pg_namespace n ON t.typnamespace = n.oid
+         WHERE t.typtype = 'e' AND n.nspname IN (${inList})`);
+	for (const row of enumRows) enums.add(`${row.schema}.${row.name}`);
+	const constraints = /* @__PURE__ */ new Set();
+	const { rows: constraintRows } = await client.query(`SELECT n.nspname AS schema, c.relname AS table, con.conname AS name
+         FROM pg_constraint con
+         JOIN pg_class c ON con.conrelid = c.oid
+         JOIN pg_namespace n ON c.relnamespace = n.oid
+         WHERE n.nspname IN (${inList})`);
+	for (const row of constraintRows) constraints.add(`${row.schema}.${row.table}.${row.name}`);
+	const columnComments = /* @__PURE__ */ new Map();
+	const { rows: commentRows } = await client.query(`SELECT n.nspname AS schema, c.relname AS table, a.attname AS column, d.description AS comment
+         FROM pg_description d
+         JOIN pg_class c ON d.objoid = c.oid
+         JOIN pg_namespace n ON c.relnamespace = n.oid
+         JOIN pg_attribute a ON a.attrelid = c.oid AND a.attnum = d.objsubid
+         WHERE d.objsubid > 0 AND n.nspname IN (${inList})`);
+	for (const row of commentRows) {
+		if (row.comment == null) continue;
+		columnComments.set(`${row.schema}.${row.table}.${row.column}`, row.comment);
+	}
+	return {
+		tables,
+		enums,
+		constraints,
+		columnComments,
+		enumValues,
+		notNullColumns,
+		populatedTables
+	};
+}
+/**
+* What to tell an operator whose `search` block no longer matches its column.
+*
+* Every line here is doing work: naming the collection is not enough, because
+* the symptom (a search that finds nothing) points at the data, not the schema;
+* and the remediation has to be exact, because it is a table rewrite the
+* operator is being asked to schedule rather than discover.
+*/
+function searchDriftMessage(drift) {
+	return "The `search` block changed after its generated column was created, and Postgres cannot alter a generated expression in place.\nRebase will not rebuild it for you: dropping and re-adding a STORED generated column rewrites the whole table under an ACCESS EXCLUSIVE lock and rebuilds its GIN index, which is an outage this unattended path may not schedule on your behalf.\nUntil it is rebuilt the column keeps indexing the previous fields, weights and language — searches for anything added since return nothing, which reads from outside as \"no such row\".\nRun these (or revert the block to what the column was built from), then boot again:\n" + drift.map((d) => `  "${d.table}"."${d.column}" was generated from a different \`search\` block (recorded ${d.found}, current ${d.expected}).\n` + d.rebuild.map((s) => `      ${s}`).join("\n")).join("\n") + "\n  The GIN index is dropped with the column and recreated concurrently on the next boot.";
+}
+/**
+* The missing-pgvector explanation, appended to the error that reveals it.
+*
+* A `{ type: "vector" }` property compiles to `VECTOR(n)`, and nothing in the
+* OSS pipeline installs pgvector — not this ensure, not `db push`. Installing
+* an extension on someone's database is a decision with a deployment behind it
+* (image, superuser, cloud allow-list), so this path stays a refusal; what it
+* must not stay is a bare `type "vector" does not exist` on a crash-looping
+* pod, which names nothing the reader can act on.
+*
+* The scaffold now ships `pgvector/pgvector:pg18`, so this is reached by a
+* project pointed at a database someone else provisioned — which is exactly
+* the case where naming the extension and the image is worth the words.
+*/
+function vectorExtensionHint(message) {
+	if (!/type "(vector|halfvec|sparsevec)" does not exist/i.test(message)) return "";
+	return "\n  pgvector is not installed on this database, and Rebase does not install it: it is a server extension, so it needs an image that ships it (the scaffold's `pgvector/pgvector:pg18` does; a stock `postgres:18` does not) and a role allowed to run `CREATE EXTENSION vector;`. Install it once, then boot again. Rebase then creates an ANN index for the column automatically — see the `index` option on the property.";
+}
+/**
+* Read what the database looks like, for the schemas a set of collections
+* lives in.
+*
+* The same read `ensureCollectionTables` does at boot, exposed on its own for
+* the callers that want to *plan* against a real database without changing it —
+* the live schema editor, which has to tell somebody what a change would do
+* before they agree to it.
+*/
+async function readSchemaFactsFor(client, collections) {
+	const relational = relationalCollections(collections);
+	return readExistingSchema(client, Array.from(/* @__PURE__ */ new Set([...relational.map(schemaOf), ...planJunctionTables(relational).map((junction) => junction.schema)])));
+}
+/**
+* Bring the database up to date. Returns what it did.
+*
+* Each statement runs on its own rather than in one transaction: they are all
+* independently safe and idempotent, and a single failure (an enum label that
+* cannot be added, say) should not roll back the tables that were created fine.
+* The error is surfaced with the statement that caused it.
+*/
+async function ensureCollectionTables(client, collections, log) {
+	const schemas = Array.from(/* @__PURE__ */ new Set([...collections.map(schemaOf), ...planJunctionTables(collections).map((j) => j.schema)]));
+	for (const schema of schemas) {
+		assertSafeIdentifier(schema, "schema name");
+		if (schema !== "public") await client.query(`CREATE SCHEMA IF NOT EXISTS "${schema}";`);
+	}
+	const plan = planCollectionSchemaEnsure(collections, await readExistingSchema(client, schemas));
+	const failures = [];
+	for (const legacy of plan.legacyForeignKeys) {
+		const message = `Renaming "${legacy.table}"."${legacy.legacy}" to "${legacy.expected}". The old name is the one Rebase derived for this relation before it singularized properly; the column keeps its data, indexes and constraints. To keep the old name instead, set \`localKey: "${legacy.legacy}"\` on the relation and this will stop.`;
+		logger.info(`[schema] ${message}`);
+		log?.(message);
+	}
+	if (plan.searchDrift.length > 0) throw new Error(searchDriftMessage(plan.searchDrift));
+	for (const adopted of plan.searchAdopted) {
+		const message = `Adopting the existing generated column "${adopted.table}"."${adopted.column}" and recording what the current \`search\` block would generate. Any later change to that block will be detected and refused; a change made *before* this version was deployed cannot be, so if search has been missing content, rebuild the column once: ALTER TABLE "${adopted.table.split(".").join("\".\"")}" DROP COLUMN "${adopted.column}"; and boot again.`;
+		logger.info(`[schema] ${message}`);
+		log?.(message);
+	}
+	for (const skip of plan.vectorIndexSkipped) {
+		const message = `No ANN index on "${skip.table}"."${skip.column}": ${skip.reason}`;
+		logger.warn(`[schema] ${message}`);
+		log?.(message);
+	}
+	for (const withheld of plan.withheldConstraints) {
+		const message = `No NOT NULL on "${withheld.target}": ${withheld.reason} ${withheld.remedy}`;
+		logger.warn(`[schema] ${message}`);
+		log?.(message);
+	}
+	if (plan.actions.length === 0) {
+		log?.("Schema is up to date; nothing to create.");
+		return {
+			...plan,
+			failures
+		};
+	}
+	for (const action of plan.actions) try {
+		if (await applyAction(client, action)) log?.(`${action.kind}: ${action.target}`);
+		else log?.(`${action.kind}: ${action.target} (already created by a peer)`);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (action.kind === "add-constraint" || action.kind === "comment-column") {
+			failures.push({
+				kind: action.kind,
+				target: action.target,
+				error: message
+			});
+			continue;
+		}
+		throw new Error(`Failed to ${action.kind} ${action.target}: ${message}${vectorExtensionHint(message)}\n  ${action.sql}`);
+	}
+	return {
+		...plan,
+		failures
+	};
+}
+/** Attempts per action, including the first. Matches the server's bootstraps. */
+var DDL_ATTEMPTS = 4;
+/**
+* Run one planned statement, surviving a simultaneous boot.
+*
+* Every statement in a plan is written to be idempotent, and that is not the
+* same as being safe to run concurrently: `CREATE … IF NOT EXISTS` reads the
+* catalog and then writes to it as two steps, so peers starting together both
+* see "absent" and the loser gets a duplicate key on a *catalog* index. Measured
+* against Postgres 18: five instances, 8 of 10 calls lost. `CREATE TYPE` is
+* worse, because Postgres has no `IF NOT EXISTS` for it at all.
+*
+* What made that fatal here rather than merely noisy is the loop this sits in.
+* A losing statement threw, and the throw abandoned **every remaining action in
+* the plan** — so a replica that lost one race came up missing tables it never
+* attempted, and the boot log blamed the one statement that failed.
+*
+* @returns `true` if this process applied the statement, `false` if a peer had
+*   already created the object. The distinction is only for the log; both mean
+*   the object is now there.
+* @throws the original error for anything that is not a race — a syntax error, a
+*   permission failure, a unique constraint the customer's own rows violate.
+*/
+async function applyAction(client, action) {
+	for (let attempt = 1;; attempt++) try {
+		await client.query(action.sql);
+		return true;
+	} catch (err) {
+		if (isDuplicateObjectRace(err)) {
+			logger.debug(`[schema] ${action.kind} ${action.target}: already created by another instance`);
+			return false;
+		}
+		if (isConcurrentDdlRace(err) && attempt < DDL_ATTEMPTS) {
+			logger.debug(`[schema] ${action.kind} ${action.target}: lost a race with another instance (attempt ${attempt}/${DDL_ATTEMPTS}) — retrying`);
+			await new Promise((resolve) => setTimeout(resolve, 40 * attempt * (1 + Math.random())));
+			continue;
+		}
+		throw err;
+	}
+}
+//#endregion
+export { camelCase as $, fieldKeyForColumn as A, parseIdValues as B, getJunctionCollectionConfig as C, policyToPostgres as D, getEffectiveSecurityRules as E, getTableVarName as F, updateDateAutoValues as G, createRelationRef as H, resolveCollectionRelations as I, legacyForeignKeyName as J, firstFreeKey as K, buildCompositeId as L, getColumnName as M, getEnumVarName as N, securityRuleToConditions as O, getTableName as P, mergeDeep as Q, getDeclaredPrimaryKeys as R, resolveStringColumnLength as S, resolveJunctionSpecs as T, createRelationRefWithData as U, sortCollectionsBySlug as V, normalizeToEntityRelation as W, getPolicyNamesForRule as X, toWireKey as Y, isPrototypePollutingKey as Z, OrderBySpecError as _, generatePostgresDdl as a, Vector as at, CollectionRegistry as b, planCollectionPolicies as c, authUsersColumnSql as d, toSnakeCase as et, SEARCH_UNACCENT_FN as f, buildSdkData as g, visibleColumnProjection as h, readSchemaFactsFor as i, isManyToMany as it, findRelation as j, findAnonymousGrants as k, resolveColumnName as l, hiddenColumnsOption as m, planCollectionSchemaEnsure as n, DEFAULT_ONE_OF_VALUE as nt, generatePostgresPoliciesDdl as o, buildSearchColumnSpec as p, generateForeignKeyName as q, readExistingSchema as r, hasForeignKeyOnTarget as rt, generatePostgresSearchDdl as s, ensure_collection_tables_exports as t, DEFAULT_ONE_OF_TYPE as tt, AUTH_USERS_COLUMNS as u, normalizeDriverOrderBy as v, getJunctionSecurityRules as w, relationalCollections as x, parseOrderBySpecStrict as y, isAddressableId as z };
 
-//# sourceMappingURL=auth-users-columns-CgyPWQ18.js.map
+//# sourceMappingURL=ensure-collection-tables-jYsvOLZF.js.map